last executing test programs: 3m5.18890018s ago: executing program 0 (id=370): r0 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) chdir(&(0x7f00000000c0)='./file0\x00') (async) rename(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file0\x00') (async, rerun: 64) sendmsg$nl_generic(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000008ec0)=ANY=[@ANYBLOB="2c0000002dffdbdf25017c00001800018014000600fc010000000000000000000000002001"], 0x2c}, 0x1, 0x0, 0x0, 0xc000}, 0x2000c010) (rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async, rerun: 32) r2 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) (rerun: 32) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) kexec_load(0xfffffffffffffffc, 0x1, &(0x7f0000000900)=[{0x0, 0x0, 0x200400000, 0x3e0000}], 0x0) (async) finit_module(r0, &(0x7f0000000240)='\x00', 0x1) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) (async) msgrcv(0x0, 0x0, 0x0, 0x3, 0x5800) (async) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/warn_count', 0x800, 0x4) read$char_usb(r4, &(0x7f0000000040)=""/236, 0xec) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@bridge_newneigh={0x28, 0x1c, 0x1, 0x70bd28, 0x25dfdbfc, {0x7, 0x0, 0x0, r6, 0x2, 0xc2, 0xb}, [@NDA_LLADDR={0xa, 0x2, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xc}}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4040000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)=@mpls_delroute={0xc8, 0x19, 0x1, 0x70bd28, 0x25dfdbfe, {0x1c, 0x0, 0x14, 0x3, 0xfd, 0x1, 0xfe, 0x8, 0x1000}, [@RTA_TTL_PROPAGATE={0x5, 0x1a, 0xc}, @RTA_TTL_PROPAGATE={0x5, 0x1a, 0x4}, @RTA_NEWDST={0x84, 0x13, [{0xfc8b, 0x0, 0x1}, {0x1}, {0x8}, {0x80}, {0x5, 0x0, 0x1}, {0x900, 0x0, 0x1}, {0x101}, {0x1}, {0x800}, {0x8}, {0x2}, {0x7}, {0x2}, {0xe4}, {0x2}, {0x7, 0x0, 0x1}, {0x11}, {0x2}, {0x3}, {0x4, 0x0, 0x1}, {0x3}, {0x4}, {0x7}, {0x9, 0x0, 0x1}, {0x8219}, {0x7}, {0xd}, {0x1ff, 0x0, 0x1}, {0xfff, 0x0, 0x1}, {0xae}, {0x8b86, 0x0, 0x1}, {0x1, 0x0, 0x1}]}, @RTA_MULTIPATH={0xc, 0x9, {0x5, 0x12, 0x0, r6}}, @RTA_MULTIPATH={0xc, 0x9, {0x8, 0xc, 0x4}}]}, 0xc8}, 0x1, 0x0, 0x0, 0x40040}, 0x20000000) r7 = dup(r3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r7, 0x0) (async, rerun: 32) r8 = fsopen(&(0x7f0000000340)='overlay\x00', 0x1) (rerun: 32) r9 = socket(0x10, 0x3, 0x0) fsconfig$FSCONFIG_SET_FD(r8, 0x5, &(0x7f0000000380)='workdir', 0x0, r9) (async, rerun: 64) ioctl$DRM_IOCTL_PANTHOR_GROUP_CREATE(r7, 0xc0386447, &(0x7f0000000040)={{0x8, 0x0, 0x0}, 0x0, 0x23, 0xc, 0x3, 0x0, 0x6, 0x5f, 0x7fffffffffffffff}) (async, rerun: 64) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) 3m3.550779066s ago: executing program 0 (id=374): prlimit64(0x0, 0xe, &(0x7f0000000200)={0x7, 0x7ff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x802, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x8, 0x1014}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000780)=@base={0xc, 0x4, 0x4, 0x9, 0x18, r1}, 0x50) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0xa) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000100)={{0x100, 0xec1, 0x0, 0x1}, 'syz1\x00', 0x1a}) ioctl$UI_DEV_CREATE(r0, 0x5501) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) accept4(r2, 0x0, 0x0, 0x800) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) 3m3.331010222s ago: executing program 0 (id=378): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x18, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000000000000000000000000000085100000fcffffff95000000000000003c19c2205e8f62acea6f657b800d2bb95ccfcd279cbb7bcc306283a39af26c593326995011aa09dd9cf66a02df3fd88c4ccd0d7ee692affba2a67318115e0231406090a4c0adace68f2563aa868fd940886a52e54c27edc02e3d3df0449ff0d2b81d7fd0eaa23b1ee56266cea6"], &(0x7f0000000140)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000280)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00'}) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$uinput_user_dev(r5, &(0x7f0000000a00)={'syz1\x00', {0x6ec9, 0x7, 0x5, 0x5}, 0x3e, [0x9, 0x5, 0x8, 0x2, 0x5334, 0x400, 0x80000000, 0x8ef7, 0x8, 0x0, 0x7, 0xf5, 0x5, 0x39, 0x747d5a16, 0x8, 0xfffffb9a, 0xfffffffc, 0x4, 0xfffffffb, 0x4, 0x3, 0x4, 0xf252, 0x1, 0x800, 0x300000, 0x7, 0xe, 0x5, 0x0, 0xffffffff, 0x1ff, 0x8000, 0x3ff, 0x3, 0xd, 0x3, 0x6, 0x1000, 0x2, 0x200, 0x2, 0x400008, 0x8, 0x4, 0x2, 0x7, 0x40, 0x1009, 0x1, 0x199f, 0x8, 0x2, 0x9, 0x1, 0x4, 0x6, 0x1000, 0x5, 0x40, 0x9, 0x7, 0x5], [0x6, 0x1e, 0x3, 0x8000, 0xfffffffe, 0x3, 0x0, 0x5, 0x27, 0xfffffffc, 0x4, 0x7fff, 0x72c, 0x1c32, 0x3, 0x9, 0x10000, 0x400, 0x8001, 0x3, 0x1, 0x294, 0x5, 0x0, 0x981, 0x4, 0xfd, 0x3ff, 0x0, 0xfffffffe, 0x0, 0x1000001, 0x10, 0xfffffff9, 0x0, 0x5, 0x1, 0xffffffff, 0x6, 0x5, 0x800, 0xf6, 0x6, 0x96, 0xfffffffd, 0x101, 0x0, 0x2, 0x1, 0xc, 0x3, 0x379, 0x9, 0xe, 0x5, 0xb, 0x6, 0x2, 0x400001, 0x3, 0x8, 0x6, 0x202, 0x3], [0x3fd, 0xc584, 0x34711b8a, 0x4cd4, 0xffff, 0x20, 0x4, 0x4, 0x8, 0x10, 0x7, 0x9, 0xe8b, 0x5, 0x80000001, 0x8, 0x3, 0x1000, 0x2, 0xe, 0x1, 0xfffffff9, 0xe55, 0x10, 0x80000001, 0x4, 0x4, 0x1000007, 0x9, 0x2, 0x20000005, 0x7d, 0x9, 0xb, 0x47, 0x2, 0x3, 0x4, 0x207, 0x6d7e, 0x3, 0x8, 0x8001, 0xbf23, 0x6, 0x8, 0x95a, 0xffffffff, 0x4, 0x3, 0x6, 0x100fffd, 0x2005, 0x7, 0x4, 0xea, 0x9, 0x5, 0x2, 0xd9, 0x0, 0x7ff, 0x401, 0x7], [0x108e, 0x7fff, 0x3, 0x3, 0x88, 0x2, 0x6, 0x1, 0x40, 0x2, 0x763, 0xb, 0x8000402, 0x804, 0x2, 0xffd, 0x7f, 0x5, 0x3fa6, 0x4, 0x8e8, 0x5, 0x9, 0x4, 0x4, 0x4, 0x0, 0x4, 0x200, 0x1000, 0x3b, 0x2, 0x5, 0x800, 0xa809, 0x65f413f9, 0x4, 0x8, 0x8a8, 0x2, 0x40, 0x7, 0x2, 0x4, 0x4, 0x10, 0x0, 0x0, 0x7fff, 0x1, 0xfffffff8, 0x402, 0x1, 0x200, 0x7, 0x4edf, 0xfefffffd, 0x4, 0xe, 0x2, 0xe, 0x11, 0x133, 0x2]}, 0x45c) ioctl$UI_DEV_CREATE(r5, 0x5501) readv(r5, &(0x7f00000005c0)=[{0x0}, {&(0x7f00000003c0)=""/138, 0x8a}], 0x2) 3m2.090667478s ago: executing program 0 (id=383): syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) sendmsg$NL80211_CMD_SET_PMKSA(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYBLOB="030000006000fedbdf25340000", @ANYRES32, @ANYBLOB="0a000600ffffffffffff00001400fe00cef95fb597ea0d3f10c5a30c8b74393b1400fe00"], 0x7c}, 0x1, 0x0, 0x0, 0x84}, 0x20004094) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000000080)={0x8}, 0x1) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback, 0x9}, 0x1c) sendto$inet6(r0, &(0x7f00000007c0)="87", 0x1, 0x4000, 0x0, 0xfffffffffffffe00) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20004000, 0x0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = pidfd_getfd(0xffffffffffffffff, r2, 0x0) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_TSINFO_GET(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000500)={0x2c, r4, 0x1, 0x0, 0x0, {0x1c}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x810}, 0x4) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20102000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x24002090}, 0x40) bind$bt_hci(r2, &(0x7f0000000040), 0x6) setreuid(0xee01, 0xee01) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEV(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16, @ANYBLOB="010627bd7000fedbdf251a000000080003", @ANYRES32=r6, @ANYBLOB='\f\x00.'], 0x28}, 0x1, 0x0, 0x0, 0x20000004}, 0x40000) 3m2.024934534s ago: executing program 0 (id=384): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) fchdir(r1) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x500, 0x8000) ioctl$FS_IOC_GETFSUUID(0xffffffffffffffff, 0x80111500, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r5, 0x0, 0x0, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r6 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101001, 0x0) ioctl$COMEDI_DEVCONFIG(r6, 0x40946400, &(0x7f0000000000)={'comedi_bond\x00', [0x4, 0x0, 0x7fffffff, 0x8, 0x90000, 0x9, 0xed, 0x890, 0x280ffa, 0xfffffffb, 0x4, 0x1, 0x1030, 0x1000008, 0x4c, 0x40000009, 0xfff7ffa6, 0x3ff, 0x1ff, 0x9ea, 0x3, 0xb, 0x9, 0x101, 0x1, 0x990e, 0x5, 0x18, 0xf, 0x2000006, 0x77fd]}) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x10, 0x1401, 0x201, 0x70bd2d, 0x25dfdbfe}, 0x10}, 0x1, 0x0, 0x0, 0x4000080}, 0x0) sendmsg$nl_route(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newnexthop={0x48, 0x68, 0x1, 0x100003, 0x7ffffffd, {}, [@NHA_GROUP={0x14, 0x2, [{0x1, 0x8}, {0x0, 0x3}]}, @NHA_RES_GROUP={0x14, 0xc, 0x0, 0x1, [@NHA_RES_GROUP_BUCKETS={0x6, 0x1, 0x3fd4}, @NHA_RES_GROUP_BUCKETS={0x6, 0x1, 0x9}]}, @NHA_ID={0x8, 0x1, 0x1}]}, 0x48}, 0x1, 0x0, 0x0, 0x4008018}, 0x4000080) sendmsg$DEVLINK_CMD_RATE_GET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)={0x1c, r7, 0xffffffffffffffff, 0x170bd2c, 0x8000, {0x34}, [@DEVLINK_ATTR_PORT_INDEX={0x8, 0xb8, 0x2000000}]}, 0x1c}, 0x1, 0x0, 0x0, 0x6008010}, 0x20000000) 3m1.077138064s ago: executing program 0 (id=391): openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x64) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='attr\x00') prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000440)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0xa2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000200), 0x1ffffffffffffe, 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) read$msr(r1, &(0x7f000004b680)=""/102392, 0x18ff8) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000140)=r0, 0x1) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000080)) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x5, 0x2, 0x1000, 0x4}, 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x15, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000047b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000100850000000100000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000bc0)={r4, 0x0, 0x0}, 0x10) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r5, 0x6, 0x2c, &(0x7f0000000100)=0x2, 0x4) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfff7}, 0x3a, [0x8000, 0xc95a, 0x1, 0x8, 0x7fffffff, 0x2, 0x1080007, 0x7f, 0x20000006, 0xca, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x100001, 0x3, 0x0, 0x5, 0x6, 0x2000001, 0x7, 0x3c5b, 0x1, 0x24, 0x8006, 0x1, 0x5, 0xffffffff, 0xe661, 0x80004, 0x7, 0x89d2, 0x8, 0x4c74, 0x80000000, 0x40000, 0x3, 0xe, 0xfffffffc, 0x80008071, 0x7, 0x17, 0xd, 0x3, 0x2, 0x3e, 0x8f, 0x4006, 0x6, 0x80000000, 0x0, 0xf, 0x8, 0x400, 0x80, 0x0, 0x4, 0x7, 0x8, 0x4, 0x5, 0x40], [0x10000007, 0xf0000000, 0x8000012f, 0x8004, 0x5, 0x6, 0x169432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x19, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0x0, 0x312, 0xd, 0x8, 0xffffffff, 0x4, 0x7, 0x7fff, 0x5a7c, 0x7ffe, 0x401, 0x6, 0x0, 0xff, 0x1, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x20009, 0x8, 0x9, 0x9, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0xfffffffe, 0x7, 0x9, 0x5, 0x3, 0x8, 0xa6d, 0x3, 0x6c0, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x8004, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x9, 0x5, 0x2000000, 0x1ef, 0x5, 0x6, 0x10000, 0x3, 0x5, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x1, 0x800003, 0x1fe, 0x1f1, 0x7, 0x4, 0x2850bfaf, 0xffe, 0xa2, 0x7, 0x4000a9, 0x5, 0x9, 0xac8, 0x2000af, 0xfffffffe, 0x8, 0x7ff, 0x12b, 0x4, 0xfffffffe, 0x0, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2004, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0x2, 0x5, 0x42c2, 0x0, 0x6, 0x0, 0xb9, 0x4e7, 0x5, 0x2, 0x57, 0x4, 0x8000003, 0x101, 0x10000, 0x4, 0x7fff, 0xffff, 0x2000a623, 0x2, 0x1, 0x1, 0x2, 0x5, 0xe7, 0x8, 0x16, 0xfffffffe, 0x80000003, 0x6, 0x4, 0xc8, 0x9, 0xfffff000, 0x521, 0x3, 0x7e, 0x6, 0x9602, 0x7, 0xaf, 0x8, 0x6, 0xffffffff, 0x5, 0x41, 0x8, 0x30b1d693, 0x5, 0x1f40, 0x7, 0x41, 0x6c1b, 0x0, 0x804, 0xac1, 0xb1e, 0xd7, 0xc, 0xffff3441, 0xfff]}, 0x45c) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, 0x0) ioctl$KVM_GET_EMULATED_CPUID(r0, 0xc008ae09, &(0x7f0000000880)={0x1, 0x0, [{0xc0000000, 0xe1, 0x6, 0x2324, 0x3, 0x8, 0xcd}]}) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@newlink={0x64, 0x10, 0xffffffffffffffff, 0x70bd28, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x35a71, 0x51a23}, [@IFLA_LINKINFO={0x44, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x34, 0x2, 0x0, 0x1, [@IFLA_GRE_LOCAL={0x14, 0x6, @dev={0xfe, 0x80, '\x00', 0x41}}, @IFLA_GRE_REMOTE={0x14, 0x7, @loopback={0x0, 0x10d}}, @IFLA_GRE_LINK={0x8}]}}}]}, 0x64}, 0x1, 0x0, 0x0, 0x1}, 0x20040040) sendmsg$nl_route(r0, &(0x7f0000001640)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000001680)=ANY=[@ANYBLOB="4c0000001300000828bd7000fedbdf25073f82c41e000000", @ANYRES32, @ANYBLOB="8008000040400100050027000f0000000a000100bbbbbbbbbbbb00000a0002000180c200000100000a0002000180"], 0x4c}, 0x1, 0x0, 0x0, 0x84}, 0x20000800) mknod$loop(&(0x7f0000001b80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x8, 0x1) mount(&(0x7f0000000000)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f00000003c0)='vxfs\x00', 0x1000001, 0x0) 2m45.294726294s ago: executing program 32 (id=391): openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x64) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='attr\x00') prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000440)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0xa2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000200), 0x1ffffffffffffe, 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) read$msr(r1, &(0x7f000004b680)=""/102392, 0x18ff8) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000140)=r0, 0x1) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000080)) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x5, 0x2, 0x1000, 0x4}, 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x15, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000047b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000100850000000100000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000bc0)={r4, 0x0, 0x0}, 0x10) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r5, 0x6, 0x2c, &(0x7f0000000100)=0x2, 0x4) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfff7}, 0x3a, [0x8000, 0xc95a, 0x1, 0x8, 0x7fffffff, 0x2, 0x1080007, 0x7f, 0x20000006, 0xca, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x100001, 0x3, 0x0, 0x5, 0x6, 0x2000001, 0x7, 0x3c5b, 0x1, 0x24, 0x8006, 0x1, 0x5, 0xffffffff, 0xe661, 0x80004, 0x7, 0x89d2, 0x8, 0x4c74, 0x80000000, 0x40000, 0x3, 0xe, 0xfffffffc, 0x80008071, 0x7, 0x17, 0xd, 0x3, 0x2, 0x3e, 0x8f, 0x4006, 0x6, 0x80000000, 0x0, 0xf, 0x8, 0x400, 0x80, 0x0, 0x4, 0x7, 0x8, 0x4, 0x5, 0x40], [0x10000007, 0xf0000000, 0x8000012f, 0x8004, 0x5, 0x6, 0x169432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x19, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0x0, 0x312, 0xd, 0x8, 0xffffffff, 0x4, 0x7, 0x7fff, 0x5a7c, 0x7ffe, 0x401, 0x6, 0x0, 0xff, 0x1, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x20009, 0x8, 0x9, 0x9, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0xfffffffe, 0x7, 0x9, 0x5, 0x3, 0x8, 0xa6d, 0x3, 0x6c0, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x8004, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x9, 0x5, 0x2000000, 0x1ef, 0x5, 0x6, 0x10000, 0x3, 0x5, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x1, 0x800003, 0x1fe, 0x1f1, 0x7, 0x4, 0x2850bfaf, 0xffe, 0xa2, 0x7, 0x4000a9, 0x5, 0x9, 0xac8, 0x2000af, 0xfffffffe, 0x8, 0x7ff, 0x12b, 0x4, 0xfffffffe, 0x0, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2004, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0x2, 0x5, 0x42c2, 0x0, 0x6, 0x0, 0xb9, 0x4e7, 0x5, 0x2, 0x57, 0x4, 0x8000003, 0x101, 0x10000, 0x4, 0x7fff, 0xffff, 0x2000a623, 0x2, 0x1, 0x1, 0x2, 0x5, 0xe7, 0x8, 0x16, 0xfffffffe, 0x80000003, 0x6, 0x4, 0xc8, 0x9, 0xfffff000, 0x521, 0x3, 0x7e, 0x6, 0x9602, 0x7, 0xaf, 0x8, 0x6, 0xffffffff, 0x5, 0x41, 0x8, 0x30b1d693, 0x5, 0x1f40, 0x7, 0x41, 0x6c1b, 0x0, 0x804, 0xac1, 0xb1e, 0xd7, 0xc, 0xffff3441, 0xfff]}, 0x45c) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, 0x0) ioctl$KVM_GET_EMULATED_CPUID(r0, 0xc008ae09, &(0x7f0000000880)={0x1, 0x0, [{0xc0000000, 0xe1, 0x6, 0x2324, 0x3, 0x8, 0xcd}]}) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@newlink={0x64, 0x10, 0xffffffffffffffff, 0x70bd28, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x35a71, 0x51a23}, [@IFLA_LINKINFO={0x44, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x34, 0x2, 0x0, 0x1, [@IFLA_GRE_LOCAL={0x14, 0x6, @dev={0xfe, 0x80, '\x00', 0x41}}, @IFLA_GRE_REMOTE={0x14, 0x7, @loopback={0x0, 0x10d}}, @IFLA_GRE_LINK={0x8}]}}}]}, 0x64}, 0x1, 0x0, 0x0, 0x1}, 0x20040040) sendmsg$nl_route(r0, &(0x7f0000001640)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000001680)=ANY=[@ANYBLOB="4c0000001300000828bd7000fedbdf25073f82c41e000000", @ANYRES32, @ANYBLOB="8008000040400100050027000f0000000a000100bbbbbbbbbbbb00000a0002000180c200000100000a0002000180"], 0x4c}, 0x1, 0x0, 0x0, 0x84}, 0x20000800) mknod$loop(&(0x7f0000001b80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x8, 0x1) mount(&(0x7f0000000000)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f00000003c0)='vxfs\x00', 0x1000001, 0x0) 2m1.648142193s ago: executing program 2 (id=563): socket$nl_netfilter(0x10, 0x3, 0xc) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/address_bits', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x40, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) socket(0x31, 0x3, 0x8) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00'}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x104, 0xe}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r7 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=@newqdisc={0x218, 0x24, 0x300, 0x70bd2b, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xd}, {0xffff, 0x5}, {0x5, 0xf}}, [@TCA_STAB={0x2c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x2, 0x0, 0x9, 0xc, 0x0, 0x866, 0x1f, 0x3}}, {0xa, 0x2, [0x7, 0x7f, 0x9ec]}}]}, @TCA_STAB={0x160, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x3, 0x1, 0x7, 0x2, 0x1, 0x2, 0x40, 0xa}}, {0x18, 0x2, [0x1, 0x5, 0x2, 0x7, 0xfff7, 0x40, 0x5, 0x6, 0x8001, 0x3]}}, {{0x1c, 0x1, {0x1, 0x0, 0xd2f, 0xf0000000, 0x1, 0xe, 0x73a, 0x8}}, {0x14, 0x2, [0xa, 0x5, 0x8000, 0x3e, 0x5, 0x81, 0xffd9, 0x4df]}}, {{0x1c, 0x1, {0x2, 0x6, 0x1de, 0x8, 0x1, 0x4, 0x7, 0x2}}, {0x8, 0x2, [0x4, 0x5]}}, {{0x1c, 0x1, {0x0, 0x33, 0xe1d8, 0x6, 0x2, 0x9, 0x6, 0x9}}, {0x16, 0x2, [0x7, 0x4, 0x0, 0x7, 0x7, 0x3000, 0xff, 0x5, 0x6]}}, {{0x1c, 0x1, {0xf9, 0x0, 0xd, 0x5, 0x0, 0x9, 0xd, 0x1}}, {0x6, 0x2, [0x7]}}, {{0x1c, 0x1, {0x6, 0xb, 0x7, 0xfffffffa, 0x1, 0xd, 0x3ff, 0x3}}, {0xa, 0x2, [0x3, 0x4, 0x3ff]}}, {{0x1c, 0x1, {0x3, 0x9, 0x3a, 0x96b, 0x0, 0x8, 0x9, 0x5}}, {0xe, 0x2, [0xc6, 0x5be1, 0x9, 0x5, 0x6]}}, {{0x1c, 0x1, {0x0, 0x10, 0x3ff, 0x80000000, 0x0, 0x4, 0x5, 0x3}}, {0xa, 0x2, [0x6, 0x1, 0x81]}}]}, @TCA_RATE={0x6, 0x5, {0x2, 0x1}}, @TCA_STAB={0x60, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x2, 0x8, 0x2d, 0xc0000, 0x2, 0x6, 0x6, 0x4}}, {0xc, 0x2, [0xe66b, 0x0, 0x0, 0x2]}}, {{0x1c, 0x1, {0x5, 0x1, 0x1, 0x3, 0x1, 0x771, 0x400, 0xa}}, {0x18, 0x2, [0x6, 0x5, 0x7, 0x1000, 0x90, 0x2, 0x9, 0x10, 0x7f, 0x3ff]}}]}]}, 0x218}, 0x1, 0x0, 0x0, 0x10}, 0x48880) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r8, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010027bd7000f8dbdf25030000000500020009000000180001801400020073797a5f74756e000000000000000000050005"], 0x3c}, 0x1, 0x0, 0x0, 0x20009805}, 0x40010) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) r10 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r10, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r10, 0x6, 0xd, &(0x7f00000000c0)='dctcp', 0x5) 2m0.254827881s ago: executing program 2 (id=566): r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002b40), r1) sendmsg$NLBL_MGMT_C_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x34, r2, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@NLBL_MGMT_A_DOMAIN={0xe, 0x1, 'net/l2cap\x00'}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @empty}]}, 0x34}, 0x1, 0x2000000, 0x0, 0x20000000}, 0x4000080) set_mempolicy(0x5, 0x0, 0xf) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = fsmount(r0, 0x0, 0x86) fchdir(r3) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x4, 0x6, 0xfffa}, 0x38, [0xb, 0xc95a, 0x1, 0x8, 0x7ffffffb, 0x2, 0x80007, 0x83, 0x20000006, 0xca, 0x6, 0x5f, 0x8, 0x5, 0xfeff2d37, 0xffffff00, 0x20100001, 0x3, 0x0, 0x5, 0x6, 0x9, 0x7, 0x3c5b, 0x1, 0x24, 0x8006, 0x1, 0x5, 0xffffffff, 0x5, 0x4, 0x7, 0x89d2, 0x9, 0x4c74, 0x80000000, 0x40000, 0x0, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0xd, 0x3, 0xfffffa01, 0x42, 0x8f, 0x4006, 0x6, 0x80000000, 0x0, 0x7, 0x8, 0x400, 0x80, 0x0, 0x4, 0x7, 0x80000001, 0x4, 0x7, 0x40], [0x10000007, 0xf0000000, 0x8000012f, 0x8004, 0x5, 0x6, 0x129432e6, 0xc8, 0xf9, 0x11, 0x400, 0x6c7, 0x2, 0xfffffffc, 0x3, 0x0, 0x84, 0x5, 0x2f, 0x10, 0x312, 0xd, 0xffff, 0x2, 0x4, 0x7, 0x7fff, 0x5a7c, 0x7ffe, 0x401, 0x802, 0x7, 0x0, 0x1, 0x4, 0x5f31, 0xd, 0x7f, 0x2, 0x3, 0xb, 0x3ff, 0x20009, 0x8, 0x9, 0x9, 0x47, 0x8000, 0x1, 0xfe000000, 0xfffe, 0xfffffffe, 0xd5e, 0x9, 0x5, 0x3, 0x8, 0xa6d, 0x3, 0x6c0, 0xbc45, 0x48c93690, 0x42, 0x1], [0x7, 0x408, 0x8004, 0x6, 0xffffffff, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x9, 0x5, 0x2000000, 0x1ef, 0x5, 0x8, 0x10000, 0x3, 0x30f0, 0x7, 0x7418, 0x5, 0x2, 0x0, 0x5a9c, 0x20000008, 0x4, 0x6d01, 0x6, 0x1, 0x800003, 0x1fe, 0x7c, 0x7, 0x4, 0x0, 0xffe, 0xa2, 0x7, 0x4000a9, 0x5, 0x7, 0x8c8, 0x2000af, 0x3, 0x8, 0x7ff, 0x123, 0x4, 0x7, 0xfff, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2004, 0x6, 0x0, 0x27], [0x9, 0xbb33, 0x7, 0x81, 0x8, 0x42c2, 0x3, 0x6, 0x0, 0xb9, 0x4e7, 0x5, 0x2, 0x8007, 0x4, 0x8000003, 0x101, 0x10000, 0x4, 0x7ffc, 0x81, 0x2000a620, 0x2, 0x7, 0x1, 0x2, 0x5, 0xe7, 0x6, 0x10000018, 0xfffffffe, 0x80000003, 0x6, 0x4, 0x0, 0x9, 0xfffff000, 0x10000, 0x1, 0x7e, 0xda4, 0x9602, 0x7, 0xaf, 0x8, 0x4, 0xffffffff, 0x5, 0x45, 0xc, 0x30b1d68f, 0x5, 0x1f40, 0x1, 0x41, 0x6c1b, 0x0, 0x804, 0xac1, 0xb1e, 0xd7, 0x9, 0xffff3441, 0xfff]}, 0x45c) syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a000008048002000905", @ANYRES64], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) ppoll(&(0x7f00000000c0)=[{}, {0xffffffffffffffff, 0x300}], 0x20000000000000dc, 0x0, 0x0, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200), 0x1, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000140)=0x15) ioctl$TIOCSTI(r4, 0x5412, &(0x7f00000002c0)=0x7e) r5 = fcntl$dupfd(r4, 0x0, r4) write$bt_hci(r5, &(0x7f0000000100)={0x1, @read_clock={{0x1407, 0x3}, {0xc9, 0x6}}}, 0x7) mkdirat(r5, &(0x7f0000000300)='./bus\x00', 0x108) r6 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r6, &(0x7f0000000080)={&(0x7f0000000440)=@l2tp6={0xa, 0x0, 0x10000, @loopback={0xfe80000000000000, 0xac14140c}, 0x0, 0x200}, 0x80, &(0x7f00000000c0)=[{&(0x7f00000008c0)="11079b67", 0x4}], 0x1, 0x0, 0x0, 0x900}, 0x60) recvmsg(r6, &(0x7f0000001a00)={0x0, 0x0, 0x0}, 0x40) sendmsg$IPCTNL_MSG_EXP_GET(r3, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="240000007099d172fae1630ae8caa728d62ffca70102050000000000000000000000000727d2b314f6e08d6072212b4a53"], 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x4040005) ioctl$VHOST_RESET_OWNER(r3, 0xaf02, 0x0) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(r3, 0x8008ae9d, &(0x7f00000002c0)) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000040)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@nfs_export_on}]}) 1m56.804253744s ago: executing program 2 (id=575): mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1\x00', 0x40) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1a0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) kexec_load(0x29a1, 0x0, 0x0, 0x320000) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0xc000, &(0x7f0000000340)={[{@nfs_export_off}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@nfs_export_on}], [{@permit_directio}, {@pcr={'pcr', 0x3d, 0x18}}, {@smackfsdef}, {@dont_appraise}, {@smackfsdef={'smackfsdef', 0x3d, 'r;\xb3\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00T^\xd0h\xa9b\x16?\xf6\xdeA\xed\xbf\xd0\xfa\xfdX7\xb9\x9b\x84\x9d\x8f\x94\t\xdb^^\t\xf0\xcd\xc2P\x83(\xafy\xbfH.IhI\xe7\x15b\n\xc0\x9ao\xb9t\xad\x11(=\xf7\xe4j8Z\"I\xb9\xac\xef\x10\xac\xdd!\x96,\'\xa9-\xf9n=\xcde)\x9a/\xce}\xb3\xc6\x98\xa5\xf9l\xdb\x11b\xf6\\{lm\b\xf7\xf8\xcb\x91N`\xb0f\x81R\x17\xb0\xaaasz\x8a\x04\xbeH\x19\xdc]H:T\xe2\xfd\xd8\xe8\x85\xc0%\t\xf2x\xb60&?\x10y\xd9\'\xb0\xc9e\xfc\xa2m^\x88\xd5T46\x10'}}]}) r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000042200df01a3bd7000fcdbdf251400000020d000599ac3caf351dc201699d00408eb8efc1a596b0e4c82caadb74b374daddcae5864d58fb4353a9e3991efde1d5f04f87a021dcf3e61c164fe3a27f4064cb83a21"], 0x14}}, 0x4008811) chdir(&(0x7f00000000c0)='./bus\x00') r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.pending_reads\x00', 0xa00, 0x9c37611dc13d0da6) fchown(r1, 0xffffffffffffffff, 0xee01) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = syz_open_dev$dvb_demux(0x0, 0x0, 0x41) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, 0x0, 0x40800) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) umount2(0x0, 0xe) dup(0xffffffffffffffff) connect$inet(r5, &(0x7f0000000140)={0x2, 0x4e21, @empty}, 0x10) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYRES64=r3, @ANYRES8=r4, @ANYRES8=r4], 0x28}}, 0x4000000) close_range(r2, 0xffffffffffffffff, 0x0) r6 = openat(r1, &(0x7f0000000080)='./file1\x00', 0x2442, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r6, 0x0) add_key(&(0x7f0000000040)='rxrpc\x00', 0x0, &(0x7f0000000080)="0000000000000002ff69000000000001000000c000000006000200861fa72e5b01504104bfeacdd5a9007d167c71e3b8a90400000000000000c833020a6da8881fb79e110483bfadf224a22c76ecc7a56843a85f7df51293f0eb84ef8f0f07342db3b0e5a5647b7bed1fbf069ca713670adf7d9fb6d2600fd9c1981fe9f095cfe9d2fe1e1e34f6096bf02543747b2c792890f07c0da0fa25e6101062e6c9176a70e41698814a213711764f88495994cfd8a57c1e13f6b5298e7ab3a2bfb58dde34d58536633c27882e51ced17d67999b00094461", 0xd4, 0xffffffffffffffff) fanotify_init(0x1200, 0x0) 1m52.343450873s ago: executing program 2 (id=581): mkdir(&(0x7f0000000040)='./file0\x00', 0x65) r0 = inotify_init1(0x800) inotify_add_watch(r0, &(0x7f0000000000)='./file0\x00', 0x60000526) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000001d80)="900736ffd7fb87465963b0d3522d82eab665c2832180d084a2b466cc4ea717ab45c96aea10a8c013fdd2a867d155cff2cc400602ee3af3f80c92a078afe315445c352d1695da6c390258ae2e7efc2c02fc161e1b5e271d98a04e5d977b6ca58c3c61f2e559489bcad21796d816c99b330ad4f7f0ff31a95635d4e18731539a4485d53546337f6453f17004a64899aa1c42bceea63fb4bb4a43deb4de7ddf18f773c836c304b2f2edf9c37e2859da3e0f28a1db43866032877a5b3218da48534a923d2b864964cf53bc0156359c23b20c4b5ed905fb9b6dd9178e6110aa63b24a24c71ff171dbf7bb65c26a4f3e3b960e1fe4e5c38c458170e7e5d38a2fa77262a334b70da13159214b59e99043f2d45738cfe619d4e54d9d9d52faad4185dc1461e3de1d4a8e2bac117f496b9198352ed12b367de480013f50733fcce28686f100f105d037fe1d3c387164fd3bb6d9f758e8c35de274cc824e0ef8a4ec4d740cb37a646300158bd9f137d0712242f3ff01641eedbf6207cc3e7b9314e8cd44581f210ae9980710a38a426305d71a732645e48a5faf121177bb16c0253dbba4b6495b2fdf147bf3557edbf1134ad8135eddb75535613f0c13e995f458d7117b7b4484be02dda974d1f894074f5258bc3416e61b41949c2bca7746dd9edc6fc1d0b9305c7ee799be795a7df68f76872046beb4e1ff6d5a62a7177902fdb74cb5d1e104b8852fd4db5ced74b73b68eb138695110452ddf5def0a6961d7010d1b170391e5897f32102ebade663ec2804708f63becf2b7595461d10062df096794e1cb4232cda841f3a86a6d5e50fe8db194bfb3721c9bc3e29b176f3554f1010776afe8fe89b5869bb25e5ffe24ad26f382b7176fd85e3d19a2d8e58031e1939ed39c96c4f2f967f75049ee7e36469b8c010992623f8248cff1c362bbb12e8ed5fd05b72fb1f391b4c13d06a453f2169bea0cc67768e06311494a3dc736c80ef644fc0d09dae7dfc09de2b7f6d0b21734486503b74bd3387ffa9a5da1b39a2ec9c410a4b2d4ec1f8ef1d3a7ced2637878b038da8d69b32a3e402580e5b746f8e7f930ff478e6b15f475b6b96a25cd8f55bdd73bc483ee5625b56b81f8d9183bc36a5c4c0974db6ad499bf1fcccb994c3defccf1324543260fb1a790ef60d50da4f955783af41066d51abdf7a566c2b2c876e0199e7b920068f226c7a5f14b65b3dbd7fb244c3fb1660740b5f849942e468af39e5a9bc80a6075878dfac23d0ae839a0e509448130e7dabadd7c494b64e67be6400ea34b097bfc578deb3c5ebefa9c1019ef65bf641c9388d9b29f6c9c2e5b8b81fcfdd94059d9a21c80f318d9675721a31ca77a4920b06cb744e96ae74ef66b4dfbe5d1085c9485abf9356d966cb63a75a250dc4432b89ec09dff3531613e12694abdd61d270ab34fba12ae1db3ed45fbc87eb1725f962de4922a64c82ed5d4b652ad926be7330f15fee7a6d53719f6231be26e7593454eabf6fdfe940f04c8cdf022ce9e278c0e2ce9aa9285594972d2b910cedf1d956976f9e6d9571210e4939821c9b68146925e2780db8e1fe6872ba1e178dfb627d9623b5c700cae1d3ce830422b9d906060b28d0956af355a2ce927c9cde8391b43fdbccd428403ee758de7c09de5a2c8eb2dac85a0e056b1ce291da6e54ea1e669b5eee9ca1043aa4f92368b39920f23f2ce3ea3906412de447a0ba28474f2b839a0413e1a0c5c1e7e818b6ae483fbf9a5fcf9367cf9badb8d2040e54dd868a672f3d24fc0e9a77648acb524999c46061b5a71cc8e0b3e66e5421b4e4f8ade64015793ac3949f7c0a3bd64b8e1d2bb99d3e51b5a295b1d2ae2de914a8d6309d9faf5f6b10edb2d9c1dad7eef2ade703d92f06f811cc8682fb98ba2ec324d9ffb23ccff4d231b459214004c7c3afd1f43265f3e40dfc15053103c220347ce2c480ffc73e500314bf7125baf8047ae9521a9c23b53983366fa69466d0bbd00374f703d8e1645849f024b5f2e6affcd99d0ac335e91daf78d5966b081f82762f050b090847f48696736db6ca4afa74e40c8be0fa72a4f8dfc1ba573ee763c9f995fe9fb17c2d1e6ef167c9f15d3bce4ea8a4634628e38f2460d0387c60cabdc6eb6c7223644ab5375a12b8bc39beec9d4c0346e3030fecb85b78038026498a62fdeefcde9de58bc66b9f8e23ff49ea9648080924aac75a0a11973c064def20293285118de764168417878dec47252d9f78f75e42b64476b816811cffe4b336d971f0e30ef9", 0x64b}], 0x1}, 0x84) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) connect$can_bcm(0xffffffffffffffff, &(0x7f0000000040), 0x10) sendmsg(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000080)=@rc={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x5}, 0x80, &(0x7f0000000340)=[{0x0}, {0x0}, {&(0x7f0000000240)}], 0x3}, 0x40080d4) r2 = syz_open_dev$dri(0x0, 0x0, 0x133000) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f00000003c0)={{0x1, 0x1, 0x18, r2, {r2}}, './file0\x00'}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r3, &(0x7f0000000100)={0xa, 0x4, 0x0, @loopback, 0x4}, 0x1c) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000180)=0x1, 0x4) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000040), 0x4) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304}, "0000000400", "6abc00000000000000000000001000", "f0630400"}, 0x28) sendto$inet6(r3, &(0x7f0000000240)="c62ee5d6a89f2387cb4093532f7c0a22ce", 0xffffffffffffff69, 0x8040, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x11, 0x3, 0x10) syz_emit_ethernet(0x0, 0x0, 0x0) 1m51.171957935s ago: executing program 2 (id=582): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x48, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1c, 0x3, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000851}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={0x0, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 1m50.907304485s ago: executing program 2 (id=585): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x0, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0xc0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x0, &(0x7f0000000180)=0x6400, 0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) r3 = openat$cgroup_subtree(r2, &(0x7f00000006c0), 0x2, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f0000000500)) socket$nl_route(0x10, 0x3, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000340), 0x2440, 0x0) write$cgroup_subtree(r3, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r3, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) r4 = socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x25104000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_generic(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5407000044000701fefffffffcdbdf25037c6000040045803c0701"], 0x754}}, 0xc000) r8 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x181c82, 0x0) write$sequencer(r8, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000540)=@IORING_OP_MKDIRAT={0x25, 0x2, 0x0, r2, 0x0, &(0x7f0000000480)='./file0\x00', 0x84}) 1m35.841019418s ago: executing program 33 (id=585): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x0, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0xc0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x0, &(0x7f0000000180)=0x6400, 0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) r3 = openat$cgroup_subtree(r2, &(0x7f00000006c0), 0x2, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f0000000500)) socket$nl_route(0x10, 0x3, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000340), 0x2440, 0x0) write$cgroup_subtree(r3, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r3, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) r4 = socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x25104000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_generic(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5407000044000701fefffffffcdbdf25037c6000040045803c0701"], 0x754}}, 0xc000) r8 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x181c82, 0x0) write$sequencer(r8, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000540)=@IORING_OP_MKDIRAT={0x25, 0x2, 0x0, r2, 0x0, &(0x7f0000000480)='./file0\x00', 0x84}) 27.366331338s ago: executing program 3 (id=812): r0 = epoll_create1(0x0) syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x8, 0x6, &(0x7f0000000200)=ANY=[@ANYBLOB="1800008080b63428e900"/20, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x7, 0x0, 0x0, 0x41000, 0xf72cb191e650cab, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r1 = syz_open_dev$loop(&(0x7f0000000280), 0xffff, 0x14f600) ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000200)=@fd={0x0, 0x6, 0x4, 0x4, 0x0, {}, {0x0, 0xb846941ed94b4582, 0x96, 0x0, 0x0, 0xa, "ee0f09a2"}, 0xffff, 0x2, {}, 0x80000}) ioctl$FE_GET_PROPERTY(0xffffffffffffffff, 0x80106f53, &(0x7f0000000380)={0x5, &(0x7f00000000c0)=[{0x3f, '\x00', @st={0x4, [{0x0, @svalue=0x2}, {0x3, @uvalue=0x3}, {0x1, @svalue=0xff}, {0x0, @uvalue=0x8d3c}]}, 0x4}, {0x39, '\x00', @buffer={"55eb476b13d85ef7a019aef895e9baae03d9827fe704c54bbcd80c0ac8383761", 0x20}, 0x5}, {0x13, '\x00', @data=0x81, 0x3}, {0x28}, {0x3c, '\x00', @data=0x8, 0x1}]}) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x80000000700, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x31]}}) r2 = syz_open_dev$media(&(0x7f00000000c0), 0x103, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r2, 0x80047c05, &(0x7f0000000080)=0xffffffffffffffff) accept4(r3, &(0x7f0000000100)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000180)=0x80, 0x80800) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f00000000c0)=0x3) ioctl$FIONREAD(r6, 0x541b, &(0x7f0000000080)) r7 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r7, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r8, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r9 = socket(0x1e, 0x1, 0x0) getsockopt$inet6_tcp_buf(r9, 0x6, 0x3c, 0x0, &(0x7f00000000c0)) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)=ANY=[@ANYBLOB="5800000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0000000008440000300012800b00010067656e6576650000200002801400070000007acc3bdf837aac0000000000000000000000000001050004000100000008000a00fcaa839ceb60ce2c8e20d3fe31fd91227850556b1313c9255bd99ff6ad7620a1dd6cdb2eef967059d6975a4aef42a8054a30d8d42d2c08712d9464f648e2a0213e8d799fa49e9a43bbad791f0e8b80a7c0189528a6a75d9e1d600cb2e94bc8d1827062000b7a2804a89b81869d9b6046d3d6c09b369b50033eac81ce7ddf1c40bb0db26f", @ANYRES32=r8, @ANYBLOB], 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r4, &(0x7f00000001c0)={0x40000014}) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r3, &(0x7f0000000040)={0x2}) syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="120100002eab5a40401c3405cc6d010203010902120001000000000904"], 0x0) 27.221249033s ago: executing program 6 (id=815): r0 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r0, 0x110, 0x4, &(0x7f0000000000), 0x4) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x80, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xd) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x6, &(0x7f0000006680)) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f00000062c0)=[{{&(0x7f00000003c0)=@abs={0x1, 0x0, 0x4e24}, 0x6e, &(0x7f0000000800)=[{&(0x7f0000000640)="4c2ae7fa0de0013fe4ef83d5f264e52a2024bfc422dcbe07bf492ccef04d35b0f4c72d7bd89c6c1605ee99095da63d43c2f9ccdf144cda72b6ca08bd664f7fb6cb592db4b4730b92db7e681877d30f9373528465a5dda0120062f1503b75b5d638abb175ebe8238b0ecee602e1e830f6e91624a501b2da02ae1a9da92f2efc9284", 0x81}, {&(0x7f0000000740)="dae3208f41bbf1c0a026875476e962d5e3898a3171ad540ceb7b9fa1285b9dc5b36747635103ec87b7c1513ec3d6fe956d489239eb0c751e8aa706ec192e7720daa944a1b868ec9ab77d77d4f9aae3d32dfa966fed7e4f88ae39227fbbac68983d7f2a90d4a4ad1eaf6ee153f08bb9a087939cee7b52dc63ae77a7556cd1a8a8a7a884c66d73a32a38b40e10d0ce3c4400b0a8610eeba651b68fc3a330419cc906c85cc446c0e288c88292699f4a4cea491a2f8e3e10619ea0", 0xb9}], 0x2, 0x0, 0x0, 0x80}}, {{&(0x7f0000000840)=@file={0xb666d7b9f0a94515, './file0/file0\x00'}, 0x6e, &(0x7f0000005ac0)=[{&(0x7f00000008c0)="231f7217004c02cd9357d3681434f5b91c79db1ab2cd706012e551929d6111984f9e6615d1df9fddc2660e84a1b205125b8c950c23b68e78b59bf5699899e445615b0c1f769800f817ee427850db2702f317fd1c717111", 0x57}, {&(0x7f0000000940)="ec91e580e02800abb19ad89c5a5b7ae8471b1189851dce6056cb729762ff17a6fdf1d992819a375e2b5305e55a3ffafc7d46f31f6fb759f8bfc0b89e67ec65583e393dd5d6aa3bf035a0d4e1aa1d5bf8a708f17007a057854df4ca638e598b45e408b151faead4c7de8482fd38f674ecf943bcf48344c8025a0fa75809a49063a270f61cb7a62f7998142039419a36fe6523d6e83c92bcdf356b0f42ab88a5bbeed5a8277fbf16f4c5182324c71f39da3e9734217366596304629bd63e66b3be78f828d856d2782339254680bdbd96c2da19c0193aae0466a455afdb3d461a0529075080c752ecce425f15e01cdef86c664f974d4d5751f3378b878e10d307aa6195fdb68104a305185f0dc2ac87962d9398425a6bc94c8cb97f81db7d428c70d25d3fb68a38f7d00e71681cc791fba92bf5ac936d64bac7a0e644c68680c64f7266a8c802f8418b6a6d14c589e28c078099d603883df19f41388d5b996c6e99bc7d0787dd50329170596ae9ee365f775f1380d22ba32f758047711db4b56e48e5a4278f217dda37efd85e2f0743c70f1f4ed88f5936d0c04d3cc13ee9b07c8aeef1dc776fd02fab5b884772f0232ffb28bf7d50cf2844dd6138bb4e5d7c2e49aa0cd47921240fbb71ef08ec8dce2956efba94f2de1e2e3d6af908ce483f50ff622565ab6255de92a5b5b64e7b5f9ee926bb1b57fae60f2d885d1b93a576d064b98db51da47177c30b37d8895ba32bdb1376c9f26f9d7d7f20ca2c7e22be6ce8c031fa54f2bb67b3a28b5f21b83fa99af5731045c8e6c48cdd3128f7947d2cf113c48e90d9cec0c7e6167f44be9d6e09c8c342cfcbf6103ea7dcde26a5e03e78986519b72b89e9a33919d4e7b61355b6b5cd068da4abb0895ce3f1cce805dc5c6938a5016c63025ac9862ccb5cafb1eb8ed8c396477b769af8a876c61c6c9b05495c23af3994270561211d6c5b45a82392e061e417c7557c9f26ecd5cc7c681304da10783aa3ef2261e436f345d168278d670057beea276aca184712901d32cbc6e5d64c980e98c6518a3349697f3eb623390da23e1e3513fdb4f762d6211b8cbfcee39a1610dbd445ab82e3b3de500efceeae2984fdd47b25a60e16ef0e62a4d33b4e20c5e8c1b6a4664aea3bb8814602804a3403f6220c0851669c67d345d2a245f4d897b4b407ecf31245d58ce99340aa11dce82ac2f7536ea58f18c647d09ec579c3d46efc299eb59e8bad3c0ed211dbbf85807815a223baf4512a42832714f48490c59b7cbffbc5ffb85ee4af075215cc1266272aa2410d4cb34b23fe245237a1c58f8806e0080d6d00a9a8741b9f1f5facec2b33693eee7cb6d8cadf64a09a673e344a59c6d6090fda0b2bf4c72684ac3c1c6a19706ad301eaa9b31a4ecbb4f621d59922174329484f55582d511a9f752f8369cfe50213c91dfae5092ca700b07d726dc9909c4427e885061c444c3c1eb2c25aed3c0d01fadf5fe227fb1ad067d04e94b9466a2e929be51965515e682e2d3ff3262bafac3593298cb8e46c682cac8ae189c7c1bfa0e2fc05bc6b8ebe9deebfa6e23c640786b7bba6f1a220f6c8b64d5feecd2f2bf7003344a25b4668b8e96051ed1cf3cb33c1491a24ce030b30b241e82bb72e82dbad90d3dd799b25394c7789285af123bc94358ad6c2cce0a5a5e026ef11b8c0520b50ba2cc6e794076cbb9fc7adbce63312e1e7210d80b8d68b36d6cf6d8312d632ca2d809432a7270ceae5d3b6a9c7d6f8dfe8885d00cc86189f1ec4e2f6969f5d995b9ea8278e4a3d9c4b331abfbaef64bcf05e76ad3e4eafc4aa6e3106207f2462a2089c0d08e4c745c8ea68b6881af364ee1a211e5db55956b27d4f2143f53fb1c809b5621b2825ba76fe835fb24023b917e52b3634b4c63cd7b978b6e3f69f126742db1d7a0a6acabff5877bb921770318917b397158b4ff9a7a27e8e6eb3a960cb4ed90cf1f4cb421da14733e42e70f95e8759695897dd1220891833eb56f7acb61264f4d3f34a863f43309951f4280d5a67fbf8ffdd0012b90154d036892211e1d166cddbc8dcfa21d427f5e506bd1988acb8b6057dbdab8c865635b71e14fefb932e9403e57034b79f227776400754e559588b738eca766a4cf7ba97f34dd8ff0db73cddeec40c9c106f04349eb80987ff0dfc854d9c6a32b3c272cba980d300cfd960dea3bdbf814ad1f82d758ee4107a936754619129e8ec072c663261f59b641a5ca99d2c37023e722222d9ef2cb17d569593dfdbedc8d41ada701967be66900caac64382f0cbcbc8b7f00f0841b94e9dbcdf77dd7944f91cca3a1a77d205cdeb858231b0fecd78728e2c64a1dbe08cfbef79f6ee06d67454206d9280175e647dec5c2c970f84db73eb9d1dffb32afcd8e7bfac916322ab6f2aa771c483d41343e5c7ebd77e467f41dd4bb243812c03e0c35930aecbe704d6e775e84af73f3d0344349b82cc8d4bc31961cbbfb73bdbd3d1af27f3f2e03a7750325f5d352c7f0bac203af75d0c095f2383eb5bfb351bcbc1872be122fda7ac7424e9aa5ad5e6785e63510798d51e8225a3f9b802e3d8db66d992111aa6697bff6b5a2866fd53a505d8131ffe554388748be430fa8b7b70d2ce238f188531a7ec27fc7fa91743e64b397da48f2f64cfb9d0cbd87da5c163e195b29e39e3dc3dd0ba362938db7a2f2c0953c45c2fd061ae796069698417a3b6eb17ace8c3bf8cb1d22771326736bebe61d5ae4dff1c6f782299240e6a01d7b928bffa02a70039b3558e4463e0ecc4799e6c5890cb9a66f14217b35dab87aa596107d57f10c4fdb080f5230ed00510e2c81472bc7d2e38bb15f6e1a98e98a65bec11bda345a57fae60696865c9a0c0a7d4e9be334610d3c9446a5cb7ad28680b89205da06e50d995bca5fd3dccabe9a78a6426130725ad817ad20322f78eac7dcc210c842f3b443943b8e8a396026cdf4c49c6c8a9c8d0e24f62bf0dc045ef1884a2997a3b5cfe2077d9bd200832a84eb182302b28e435dc8ad005f79825307b98d5e7d742e1e79b63519ed93d7f32429543622f74b5d46b56492a49a36ee1739daa7dbd3826fcc7e0eb65f4cd9e745d54075eaf1745e1af9bc15422afcdcc428e4dc3771209e6ef919a579a9e76bcae0cbbb0b5de6fb829b26dcffdb28e9993f16be59d89e864910bb9f9b91b871d3c9b21f6a2e793432a1532c1038bdbf49ae9b62b5930c14e965d960e301dfc74f2887311328ec9910ccc501c9362a2988054765cd0eea54b7b4b18ee30cae10e2fe750aea42fb02e1557f0372941bd6f32d839300d17ee1d1379c5d9426ffad2e1195eed89dfe244a5f50370248f69e40bf7404cb703111913419c97eb7ccbf20f537c0fa5839a70720bc3c4f23bc3f42f6aa2b52dc2c5686ac6252aebee1073a3cc907ecce5d5179b951b5472b208d60bd4a65e0888e0b53fb57eb027ad5874c996ad98d2f0b0ab88ac11d5e1604e613280d31fd3d0bf2209ac0b6a6b66960905c032dce2ebe1c3b7ab6a07fd6c025842509ae5a4821c40626feb96ab77d1aaa2e7c5b8056dfb86de0165137dd0cf4df844480aca62644525418665283a3a8a566087f41a65a039713f81947841e5b5adb27275b832b87ce69b00c40d70271c26ecad07187b55968d92fe6689b8754a7f27cccfbf692d60bf0a7b0f072e629037575ae5ad2b4099230a5b6f67db0656bef2d6f2332f5f90b50f6d7939c54011c8f5b58382d7e6ea6d7dae443503d4d77b3fb12c6df66d302d27f901919e256b8e9380b5cc536046e34cc958127a8a9e4fc4c9249df83a0e6b548dcefa852ee822559b7f07d159d30492747c707d8c61096c2027d42ffed113526931de24088d22c4b10e38c8169bbcd9b2030290a70191dba81a2fd4c38d27193a43456c9e44ed95c2ba5a6a667796bb9a254a1a6955385d5572f02c6ab377c96769e11c551c91ffa2f712004413e0f6a5b914e6068d18a423ff16244c8fcb0b871c22ef0e83c25973285427fae23f545b0e868c19cb1d82c23a90f0efe6a2478cb78200c5a1e5912e6fb752bc4785e1cb8e9ae322fd79ed82a4266e69e6f6c9089b7d544008df220419710cc06c5d152bf0dbec6dd0663f42866228135225865bdf0f261204becbde554c1e2472982d5f22535f0d5843b7c39dddaa6083b0a9160bc81d4d7ba7aeb252f4704ce0036ec4a24e64692aef7292528228fa7d14913a5ff94c6f9bb4857bc5ab7e9060ece7275b7da22837f7d589ded0fe207151e2049de113145ade324a650ff4fc5f12427dacf54e42aa1993f3db434b2f963d056bc1d2928f22ebd5e62863b0c7e36f899f48da2f8d879d751f86c7c1325dbfec61012faaff0c5d4b7116eb07e8042b35037478253750e46d4f17ba60686d521aeb06865826bcb2d34ac7a88c87bdf8176b0a98514ecdf62dabe8c21ba7d1991c56f3b8d57d895e01e19d09c6a7db16786d80ed6319edbb51a7cc5c3989a6f76dd9296102f884bd13466b01b7cea0f513fcd5978460913c8b9b9dbe798ed38d032c6650b5ef34bfaead60b92e33938e1c088de6de73fc6e8ea0f582540101ff60e80e779e86222094f6252a690367eab2e57f63ce13dacb65a1d9cc08aecd98e5e8b8f9a31da6cb888b4632314503be2b4a27087ba1542fa756e86d3a0357b3900168322436650fb502fbacad1e2438a181dc3f5f03989f1bfdba485291eb45c8cb7d7cd2bca05c5e73484ede6cef3771ff73a1c6bc80e7f56590ebae850f1d657858e1167a24e6a727a97210e7ff18fc403510efad6f1a18463ae4034fff775f714c16ed6de0cd9914bdf9162f88d83ec57be9bf52862d820107c1565672e6ad94806febf6dc473e8a0be4472bb8fb527c5fb58ace06177f5dd75be1ae70e881db7ee65d2656325aeb42e06ab104c55881b74973a369223252c3df23053a5c96b785e226d7432e729821f242b06e171b61c3ead56efc61631b585d4dbb38fe3691e49575c2d2a6a9bafdf7e08b36eae8084c07f6fb616e9f1668e092c4f5bcd437023445e758f2d1fa5b58ba1a06c678425fdc9b5f15d7a2078524a71a22b562f17b189efab81e0ad1a928e8c37ec26d24392f951aa485d63d44467f5fbed13c0fe096b6218ab3326a6595d80d97418b127d9733c083b8ea726ae4a1b7150474be22d7a0029934f030b9fbbbf6af8916a84b7ba4750b55dd1fec8f2b63ef65494ff526d8bbafd1ae98ec1fa95a81a7fa221cb5a74cdb398646346c4cb47dd3e658f2b7dc4770e95246f663e3af9688438c63c0252b1c73de33bd6e884c5a112c5c4a8cb6fd016b13df6c9a870e2ba2ba1794e8fc1492a4d64ef45b7bf9a7cbf044d2c6e36a2c0fa7de2d102beeb05ceb1c297906170f5e3237796786c4184a175e58f1f73bbb101c0fcf8724264311c5521dd0a84255e793d77caf59bc0977ae76c9fe52cd7faaddc731ee381ef4e59ae255493c79b62dcfe4ada1d7b65c54bb161ddc3d4be62d111c6f859b830dda1b53085c481a41221a1ad79f993fb13752f34491cda8c038cbd62f07f2c5efc68650ed81db38a1a532ba891c8d973c784494152e2854c159d9256ecaec1a9b5164bcf1cbd359a3a5373f848a94a867e7204313233fdc3382512fc855544bcd7a242b79e2653b51993f9d3b09b3e326f6099fa3413e15e8b5989c3cc38e012498e6983609ef4d2a836c2b90b2e0f9e4c9374a8780dfd86bc12ed2234b8734f4fa385ffa5d94f9719b5d8f2a0ece9cc7322859f2869f6c595a498517d4288b8970dbcea7cca5506", 0x1000}, {&(0x7f00000047c0)="feef29c5e82e9c94b3434b7fb70d88fc5c9bf5fc7d324d962619f6d4f3ee2c636247fa9610d2b778f87db1c0f106fe8bddc9e3d0e91446d072e14d7aeba85337a0d024a813fe2011d975e43911d232c656381a99ff63979b2cfefe0e3807240410ad612257b52b801798c7c9346ac86ebe371e00c6999ac8db3ba48ccdaa7871d7bee1aaaebd7514543a7ed6e1cd61f9cc55c983bf9f2f9adea46f3b3951e04cc146a0c69404228470319f4fe7041c9e998e700636c3d9e550b47b6496bb5c5751b58377d766de8ebbf1ec59f2ec92c483b3a1d62a1defb54003ecdbb11e217533e7ffff508db433b07d69515d2d3d253f31dae55251abe8c2a17a1bbd0279df6e3a02082aca5cd165b6ec9a6cb81bccf7a65f0c7f13cf15e3430594aa04717741145a8f783c369ac394509895ed6b0e346405e59cde847a0f89df21b5d5297521553524558b892b5f9255082bec685030121289da2f5341efe4fa0a988a0fa9914cd4da30794b033b122bd608e5e49723f32e5071b16451d4aa5f632b10681249dbb284c6124bfca59f0f62ee9ebc3f6a307611875073a69918bb23e9026e0e73c5e8c59735ce64e4fb7efc3fc50f423c4073ffc2fd6a305c8de529693b30c5306168e3cdba0c1b38323ac87a344db34300772d2cedb1adaa79278694455f8a0d2dfe27559d2220e87301af13d7311dfb882bbcd6f2d06bd1d6d11e6af02710d6da6f0c54b2eaa61dd683d8a6168c3caca71b1452b934e03203aabe43a37bd4d826b6fd591387788ef1418b50bcf193abf987a9df1cc1363f9ce3e7b24ac65eae204dd258be6423a2797fa4b6596d7bf364deeebb624773a829e85be7011a663f59d7fbb776c407853a64b21720876c458748510c7e10711d31e71ec4344846de1d8a3e23292a5ccf866a5169299c46db2cac9c980ce2beddf31afa0b42d55c0f8fd98a10a8614c1c7e52ccf61bc9c4478d5fe8282fd1fb63e309b60363c91ff09d63cab5ee7d82c82356199332a9eefd4e612f7d6782e856dcbf0772f3a6247124aa26eaa20206e8284f0853f53f2ce0d7b1bec7853800c457ae3a00f423f2649c4fc0c1f976409d7126b823878fc09f46e0a5d02e983a5b993b1a93036ddef2301ef27a3047f0d11e5c9caad567ff8879fce01b48c9c87c7accf2a97232257babf9d737934f72b4a8ed4115ef70058f8906a02304a727c51c943ca63039dcb5f56c09b91834ad2a95c4541403ce120d9e65570e878ba74a8ace0eb68898c880a017c18d4318d3066dc97c0b2f427daae403261da7a339e5aea71f26929fbe9c115002272238425032fc45e67392056e2218b3ba63ea51311788eb5706c45b111b688f6173330c0d8eba119be7faed121feed47c193f522c2886822afc44f2caafd22741c8632887653faea52e321054e83632765d499c1fa34c390bc103b2f2c89c48f495e91dfb4353eeff0f376033d79c12be2b2ad2ce829a90f4534dbf21082aae60dd4ad06d9561b54ee1b6b1de695d4be02cdef169f8a4f1e20a5f752c87a1527e3e68b13b7d2ae0cadb902daea767d0c908ff214885c757313c0046e0fe965b520daac5fe48f43a53336ce583d009bec2edf866b0d45307f78fd8a638c39cbf6b960019988b161fcaa81c43c2074af6dd4f7a586fe9557bc7d28df19ef8b75ce581ca45b364525e79940d92227bff0c646f96e16b388ee34701dad25f451dd0297e6a708b95c99f0bde720ae25a6c750e72e4503ef5ac7e46e42ed90b9d5e12fda6760ed99779efacc743201f774c6b342487411ba2604af07b8b41a02e7246dbd7aa661a72704254d5864b4051b1c478c5904c0005f95751c92f27fd96a251003caef2f6259c2ec29e424a0e8337a715e3c5a0ac2c9cd4a9f40628d5898f47eee232c61ab901f8e622363f4cde4568d7b63e2d08eab82bd4eecef4c9fe6729c940489c926f3eeadfc1fca08cc1a4678aeb48065e3962883ec1115f16a1c383ef0addc9840d71fedd5f8e602035a4b807345f7c94657ec092fccd97efbcde81892dc12e015d2b6a6b37d81d7ba498da618ca88f6147a1f98fb270c3878f84b924991cc076308da3e71613e770c59d2c58b525b4fb5aa47f28a3a7f3aaf91bfab92645eabe0772b8ae8861d8be0ec37bb9a1e05bbd81b7a0824b85e0326f79738d6c66d77418e747be8381f963b9e12caac629dc7da25dc74819309766a8e11338abd29edbba16953f4cb74246ec6b1f6b408eda1b7ca7c72b07910cfae1ab7970790b4d06ecdb4202db055b100cbb05a5387e526a66f20cb9ead42808e92739fdc0d33a715cd8b83b0c4e01cc65102555f313171e2dff323e2c801ea8b6700544d4bbb59bbfefb06af472efc873eda3b0cdfb47c229ff53083cd5bbe7c18722f670e59afabe46489b222a7c3f578ca88a884f0ab3c8b55ca66c7eb81c1100ebe80c51a7d85682f42cfc98f494914e47a71cffcd95c9378432bfbc4caa0c8408c358cfbe40117a6e2744e769faf4eff94a337eb5d413833a8a3c7affd1756ba8fd84e693c00fe0303590dea85b327cdee3234dd21002fc2f489855e03f80890aaa1436b571464268a6bb2313f2d31eef851cfb109387395d7a6d25c2dfa4fe69c6e14f6872946c548e6f27b084464cdf9ef7ba27ef6636ccbd8e1ca589835397dd509e98c4daa946e14035157ab9ad9ffe8e0dd4406ab429826a334b986fb7116103e6093cba5cc1d080768fa1e05e85e80a7568e2379398a5701d487858bbdc86e3941600c321e5753f7c229a2d2a5ed9359eee84b3ea1b366917f47aa68056e9d325e279f2b3941ea30d0a7ac0798ad63012afe03adec0b53d5bae9657153d5184e684db06c814e4c120dd814ec48b3d22d56323bed10c6bf5dcd626d97679260c627f13ff7eef716259f5a46950cc35a61448db61086fe3a5536637e0eba07700e4c3039da5e3455c7fc6a5dcace1bfd0c9310f15c66a0c4daecd0d0dced716cb07ba18063fe8e5db46e3d1a220b70aa73c0ce92935eea0134f5a20fdbada4b04cf2e40d7aef54f3e87805e6aaffd5d062c1b3b22a2f16012d89cbe5ccce54ad12de88f5600f37539ac7a37038f2252f0dd0286e48187c8628d70704c59cffff4587b54bd799674aacb2d54345d60140435fe7cf2cfdbd04a67850bc166281fad6f0f4b5d6b2527846be45a8accd54afdea43107924f1c09ec2b5c1eac5bd5e91e6ad6fd0ea48b4282d242283fbc50b4dcca8adda5ad051ba7d079f0871bbfc23bcd0226a066d2e96711b2db382000276161648c85c255bef1b7607a45538d8864dec9f5d56356b7c9ae8f7852792bd76cd798d3a22d8a202a82ad229e5703a8e8f09428a84eeaff4b7a9c2fc06190b9481dcce9b40ca2460db17583c4b1d3cf13bfc1cc9596a7e7ebcab8c9cdb9dfd98d7df313c06f68da51ec600e8755a1193bc9e627e8b48ac8325ca6fdc4b520246e1c170c9b47a619bfb8b1f356c5504a2595096f33810f6f01211b7bd2bf7c6ba1c47e28b8a3724905054b0a7cb3bb1b29dfad92539b11b055fe23fb86165b72d82af7aff87ee8f5bd00353119c2ed8310726fe6c3af572362e64962070aec7d4fac8e5036990b9d270a67cdd5f81a89f64cc6ccec0d00fcedc1735c9674af09a1141830c853dd7458aecc2ae096bd327599008fb5c7bc969fa9636802e2b69ea362d277e1d0b72c72b303f0cc37917a4fba980554f069ac2df2a7997b523920ff2b3c81497f0e38bcbdd8238762d256e1494dc4c8ab22d7e557f81a80980c3513a165e25393d10d2e5f38b783d539ee25cda7dd71f4b530d6bc4a3adca342bdbc5cbb428e897955b5132d73eb4611d0a01f9c7b0b19956a77fcc2e3fed77fc41ae4279cce2d824454b320f719777fc96e85c1f9080d975ac10afbf60a42842ddced91c7b179ac4f3a11e3e0c9eac36e41611067af3fc273bd50806e334ee1fb6338d0a80f3035700a79eb1f0ef6fa21f4f4f865e99dd3a85ffc4dada3e7486de9ee0bf3ba9901b7754e7d99bf287f860aa5c9fef31acc14229e5778f835469be6b69092ded1c198b1ebc80fc3d8dbd4f98a6fe12c7d234a0eb4db33bd2cec7e34ca884da25a1c017ca7e33ea52b2464edf151dcf81c58755a7f990053878a43b845d5c3971e6a249f45d24d6e1e107103ed973b45aa5b9aabadd79b30bfbca6c5be9159fb0c24efc373eee891d04c3bae508563916988b4c04132fde57c0f69ee6cf94077ad5fa31bfd7097a5c2a68373ecb0cd3366157e0f1d7ceeb0f9510d4751a9825870e7e9473119734bbb6bcfe7c3057a7c3c41deabe11fa8a5fa1f317a586dbbbf5549823c7f43e733839907806ca814391eaf469115e5bdde7b629be6732da1096be6e8adab06ca616ef2623d87706f9edc5967b5994a03b00a9b47a10245c26ddc00792457df713bd5b8670e46ad54322605348efb5dcf1ab0561b7187da967a280a4a446682a13bc7b6e2bb0b87744ab35709d2fff489a35434d58906321a20c580b12426aa79a710ca0fdcc8d59b8b43a4f9ddf2bdd53024acc3e3e655790c0cc6ce4dafaea3c2d229fc515db3f65a64a852d26b0d5a3adb014b66dad1ced29fa24572a874ba60b7c2e0b33c31b1fbaa8544fb1408012fb207ba24e9cf0461046333dd37c500c3ead776caef3f1b871da1bea5917bf6269e69281ca3058403f58206f1c954fafeb7cabf4106c368c554bfc17eff5342bea357a3fbb7f96631bb5303f9c21d0f354e44c121a86c35bea0c6a7f39991111cf58cdf5fcf5f21e93b2b9379998a13ee7378dca8b179f4f2304fcdd9a4c602c01dd12bafeefebc9477a60fae6a0a5cc614d25b1069fdc4344dc05a4692042688742590c0c6ff421d5c6acc584099b3a222da3f7b52f52534fce9b35f7b9f92aefdaca0c66d5ba46d4cec66e5960271be1bf9a64e43c771e63f46d58328d36bc0af406ec6e9ab66407676250ac599b2855f4fff4cb8b7c9eb3b050cb50ba8c841fafb8b2688ffc8d055cf148add61762f30230ba7bc1514aebcaf0ee1a4d305b070819d356c492a17bbfd7522847a0dd662da1778920696fd8cba524834c74a76fe21b92c3a574b1624f7dbbeff96f9056536db80ac852cdc4739521166b0ce08864b8c22db3ac4b6a69a1dd90d1cdcdc88b574925549db5e3b19c7749942200e0db4f325167d294a4bb27c3d2d8c09965915518857f327cb33be47259427e8d828b0c8ce4e1b07201b367df55d6c75858ae6632841369e2e76b41065924449ce3d6a7b31b115530145760e1b3eeccb786754aaf773b19dda72816b5233652d2214377b2e18da4199e0799b3c05ca1f3377820b6a4e6de619a78049150f4f4d16ca24c8f57ec2e89f7bec39236f755fd91bfac843fc147b1c855f9d0738a2919adc0416f1fd352111758aecae904895d7ea7cd2fae952938ec00edfd03fdea4e8d7be30f25a50d936afc22cfabcef27f239ded4e56dfc52e59b69f2ffc700b6bb1d2f5bb54fa0e6313f8b1699d66774a8effd067b51e6b1d268553faf4503337b35a0c217a7e94dd0e0320b80c99430e7d8bcf5f9f87f327e0a0d217b90604aacfdfd110981ce24e31e37a80932a35d271cf9e2613a83d9a7e6c32a17866e796b125a363277631fc94a0a2da9efa632cd370a133cbbb6178341035fa2d141acd949930489e620560570723fd56c802b32046f47e52bdd0e9f6a4ab02d402c5293590852c269908b427463d889beb2f16fe0f9a01bfaa407e5792f4ba4b302244d75ccc1359fa081c7f8ec353319b", 0x1000}, {&(0x7f00000057c0)="472426ac97f1b50684b0e0581fc1945284933cc964fa319f4e5099579f2640428c6fae9aa244c144bac8728a3853122fdc5055de526ccb8b4bff4c0513d2ff6de18c717da545fa2d04e6cbb6cdc27f53a8d3262b47c0e6ddfdd87b41952d9a6455d29542e3ee6da9b427a3058140b2f0991e9305133956765e5cc21029975afd3c97dbd8ebe9a7c2c70491eba00abe372a91cbdac0f3a7041f4ac3724634b021086fc9b8c42c15ad3017ec6ec0fa430722a3f29a9d4f05345cd407d3eead805feab1b5c7d1deb89c3b797c3fd456853e2cd3d9600230d29c5d", 0xd9}, {&(0x7f00000058c0)="9b5b1dd79cc3093f8f7cef1f684d97addf8713eda6c3b51315da54d5b773a7a918e7a8ba220b434f73d7af449543e789836ec74d51fa06b450b090bd9f37703dfa12f80c723b3722a8c694a9a4e0a18e4c7092e38f1bc69bc92b3b7f074dfe6adf36e5d2dc608f1625043420851c72d72e2d7fbfaf51ac44d0b75c52dcced0d03f2b402621d781bc5580ade7cafadc792ce4ba154764f73b5076586acb84d372f801644fdde77472ca42930c158d58321b94482df3f8ecd6e74efd9f7330a2f863ea99be089147ea46dd192d57193f13a57ee70a2d2ae9474c", 0xd9}, {&(0x7f00000059c0)="cee92485b1cf77cfd782427a8ec42fa507748e0ed7987d5f", 0x18}, {&(0x7f0000005a00)="d1aa1f109c16bc0da775a7c754dd53e7819e9caf3ecefefc67c0310c437b00ea80718c108fc243eb91110c5b848eda8e70748d0f650bb2a1bcc4e67c41ea6aaaa554d32eb767929ab08c", 0x4a}, {&(0x7f0000005a80)="42d04cc48439a73468a20c730223", 0xe}], 0x8, &(0x7f0000005fc0)=[@rights={{0x38, 0x1, 0x1, [r4, r3, r1, r5, r0, r2, r2, r5, r2, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [r5]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, r3, r3]}}, @cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [r0, 0xffffffffffffffff, r1, 0xffffffffffffffff, r3]}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0xee00}}}, @rights={{0x38, 0x1, 0x1, [r5, r0, 0xffffffffffffffff, r1, r2, 0xffffffffffffffff, r1, 0xffffffffffffffff, r5, r1]}}], 0x110, 0x24048814}}, {{&(0x7f0000006100)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000006240)=[{&(0x7f0000006180)="ca928e79397a942d5aade3932aefdc994c69b862583f1dc6021bce141979ef608523fd94e8c0db3a801dd86db95b248fc96e9fc28f326fe4fdd0d737243acbdf0efb03812f9f498b34c02cb0", 0x4c}, {&(0x7f0000006200)="72b6817d8bd4b2f4131eacb3fbcfaa21f891d4c82372908b00db71ac4980775551f591b55a6101e4224510da4d050b3ed9", 0x31}], 0x2, &(0x7f0000006280)=ANY=[@ANYBLOB="20000000000000000105000000000000", @ANYRES32, @ANYRES32, @ANYRES32=r1, @ANYRES32, @ANYBLOB="1c000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x40, 0x40}}], 0x3, 0x0) recvmmsg(r4, &(0x7f00000093c0)=[{{&(0x7f0000007c80)=@phonet, 0x80, &(0x7f0000008140)=[{&(0x7f0000007d00)=""/230, 0xe6}, {&(0x7f0000007e00)=""/248, 0xf8}, {&(0x7f0000007f00)=""/103, 0x67}, {&(0x7f0000007f80)=""/155, 0x9b}, {&(0x7f0000008040)=""/114, 0x72}, {&(0x7f00000080c0)=""/93, 0x5d}], 0x6, &(0x7f0000001b40)=""/11, 0xb}, 0x3}, {{&(0x7f0000001a40)=@can, 0x80, &(0x7f00000079c0)=[{&(0x7f00000066c0)=""/4096, 0x1000}, {&(0x7f00000076c0)=""/39, 0x27}, {&(0x7f0000007700)=""/26, 0x1a}, {&(0x7f0000007740)=""/41, 0x29}, {&(0x7f0000007780)=""/206, 0xce}, {&(0x7f0000007880)=""/215, 0xd7}, {&(0x7f0000007980)=""/15, 0xf}], 0x7, &(0x7f0000007a40)=""/39, 0x27}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f0000001940)=""/148, 0x94}], 0x1}, 0x3}, {{&(0x7f0000007a80)=@vsock, 0x80, &(0x7f0000007b40)=[{&(0x7f0000007b00)=""/14, 0xe}], 0x1, &(0x7f0000007b80)=""/225, 0xe1}, 0x85}, {{&(0x7f0000000580)=@x25={0x9, @remote}, 0x80, &(0x7f0000009300)=[{&(0x7f0000001ac0)=""/69, 0x45}, {&(0x7f0000008300)=""/4096, 0x1000}], 0x2, &(0x7f0000009340)=""/78, 0x4e}, 0x7}], 0x5, 0x2003, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x10, 0x6, 0x0, 0xb49, 0x9, 0xf6, 0x2, 0x3}, 0x0) r6 = fsopen(&(0x7f0000000300)='gadgetfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f00000001c0)='source', &(0x7f0000000100)='%\xff:2\x82|\x9a\xe0\xadA\xde\xd5\x03\x00\x00\x00\xb7\xe5\xee:\xb5\x0e\xec\xe5\xdc\xe5\x8d?\x16BE\x8b\xe8)\xa9H\x99\x10\x02q\xf7\xd3\xc5*\x15\xdf_\xb2_`\x92|\x7f\xff9\xf7o$e&1\xfd\xea\xb0\xb0', 0x0) fsetxattr(r4, &(0x7f0000000200)=@known='user.incfs.id\x00', &(0x7f0000000280)='+.%+\x00', 0x5, 0x2) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) ioctl$SNDRV_CTL_IOCTL_PVERSION(0xffffffffffffffff, 0x80045500, &(0x7f0000000240)) r7 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x20080, 0x0) openat$adsp1(0xffffffffffffff9c, &(0x7f00000002c0), 0xa0201, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r7, 0xc0045006, &(0x7f0000000180)=0x6f) r8 = dup2(r7, r7) prlimit64(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$SNDCTL_DSP_SPEED(r8, 0xc0045002, &(0x7f00000001c0)=0x2) read$FUSE(r8, &(0x7f0000002780)={0x2020}, 0x2020) r9 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r9, &(0x7f0000000100)={0x0, 0xfffffffffffffd51, &(0x7f0000000700)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e000a00100000000280", 0x2a}, {&(0x7f0000000440)="840f330c89acd29dd12e6bc341d9bb1a7ec6b01646c61be44142465648c8aab6195dcd1092a066d3a15a6dd0d127c61d37b598e0785cb134879c57c386829b62cde8e1af4eba1a8f876dcd2b12f8b42ba968d56661173157fe7381d368901420ec115a8a6646ab186112527472ec04a7f2ca25bf86d8ef21813f05de92994d32f200841ed4ac1b1021938e96d3d8cbea0687404b70b9a15bc04ef7bd52fee2e9ee0a8ca7ea391d112c01045631ee74bc3ef6f83f539ba32291f5c0f1f038c187372ec66c55644af29ec20b76cccd3c7704c7a5af53b45bb338523ea9e1bd38b7de59c53f19ad8eecc0749b5dbf6afb03005fb94a96a4d025f5d771a7928fc5040ad5b0928215bf112ad8ce4e8534aeff6ef847a74a56d32290ac44571751c5cba68a93c465", 0x4}], 0x2}, 0x0) sendmsg$kcm(r9, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000", 0x17}], 0x1}, 0x0) openat$comedi(0xffffff9c, &(0x7f0000000340)='/dev/comedi0\x00', 0x2c83, 0x0) 24.730242346s ago: executing program 6 (id=821): openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000400), 0x8) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={0x0, 0x10}}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bind$inet(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000002000)=""/102384, 0x18ff0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010027bd7000fedbdf25"], 0x20}, 0x1, 0x0, 0x0, 0x20004010}, 0x8000000) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0xd) 23.709198758s ago: executing program 5 (id=823): r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000180), 0x20802, 0x0) add_key$keyring(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xfffffffffffffffe) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) creat(0x0, 0xecf86c37d53049ee) mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, 0x0) get_mempolicy(0x0, 0x0, 0x2, &(0x7f0000240000/0x1000)=nil, 0x3) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) openat$vnet(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) close(0x3) socket(0x2, 0x80805, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f00000001c0)=@req3={0x2906e7e9, 0x7, 0x4, 0x7, 0x4, 0x3, 0x400}, 0x1c) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1c, &(0x7f0000000300)=[@in6={0xa, 0x4e24, 0x7e8, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4}]}, &(0x7f0000000140)=0x10) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000000)="cfe9ef6d6ee1d433ba73a5ddf753c74ac91bc34a934afacb0751028db60a", 0x1e}], 0x1) 23.179337297s ago: executing program 6 (id=824): r0 = socket$packet(0x11, 0x2, 0x300) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_X2APIC_API(r2, 0x4068aea3, &(0x7f0000000100)={0x81, 0x0, 0x6a6fde48ea496772}) creat(&(0x7f00000002c0)='./file0\x00', 0x0) open$dir(&(0x7f0000000380)='./file0\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000003bc0)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000}, 0x94) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) r4 = syz_open_procfs$namespace(0x0, &(0x7f0000001380)='ns/cgroup\x00') open_by_handle_at(r4, &(0x7f0000000040)=ANY=[@ANYBLOB="20000000f1000100", @ANYRES64=r3], 0x0) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000280)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x3}, 0x1c) r5 = socket$packet(0x11, 0x3, 0x300) syz_emit_ethernet(0x46, &(0x7f0000000080)={@link_local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "b33883", 0x10, 0x3a, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @local, {[], @ndisc_ra={0xc0}}}}}}, 0x0) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000000c0)={'ip6gretap0\x00'}) r6 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xc, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r6, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r7, 0x3e8, 0xe, 0x0, &(0x7f0000000000)="c1df07000000d30a298ee68888a8", 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) 22.610751935s ago: executing program 5 (id=826): r0 = socket$nl_audit(0x10, 0x3, 0x9) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x0, 0x8) r6 = openat$cgroup(r5, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) openat$cgroup_ro(r6, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000080)=0x6, 0x4) close(0xffffffffffffffff) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x4090}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_ADD(r7, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x44, 0x9, 0x6, 0x5, 0x0, 0x0, {0x1, 0x0, 0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x1}, @IPSET_ATTR_ADT={0x14, 0x8, 0x0, 0x1, [{0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_ETHER={0xa, 0x11, @local}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x8000}, 0x44000) sendmsg$AUDIT_SET_FEATURE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x20, 0x3e8, 0x1, 0x70bd27, 0x25dfdbfd}, 0x20}, 0x1, 0x0, 0x0, 0x8010}, 0x20000020) r8 = syz_open_dev$video(&(0x7f0000000080), 0x3384, 0x1e1400) ioctl$VIDIOC_ENUMAUDOUT(r8, 0xc0345642, &(0x7f00000000c0)={0x0, "e6c23a0a68641f879a657fd49b44c2f29170ce91f65d21e1afa42cde5a1c6af7"}) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@ipv6_newrule={0x44, 0x20, 0x1, 0x4, 0x25dfdbfb, {0xa, 0x40, 0x20, 0x0, 0x0, 0x0, 0x0, 0x8, 0x11}, [@FRA_SRC={0x14, 0x2, @private2}, @FRA_DST={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x44}}, 0x40000) 22.598466079s ago: executing program 3 (id=827): bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0b00000008000000070000000300000001"], 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[], 0x50) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x20100, 0x0) ioctl$TIOCGSID(r1, 0x5429, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000640), &(0x7f0000000740), 0x20075, r0}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0xfffffffffffffe8b, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x50, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffe89, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r2, 0x2000300, 0xe, 0x0, &(0x7f0000000000)="63eced8e46dc3f0adf3389f7b986", 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 22.3078695s ago: executing program 6 (id=828): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000280)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x3}, 0x1c) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'ip6gretap0\x00', 0x0}) sendto$packet(r1, &(0x7f0000000180)="0b032200e0ff25000200475400f6a13bb10000a8880008004803", 0x10000, 0x0, &(0x7f0000000140)={0x11, 0x0, r2}, 0x14) (fail_nth: 2) 21.561513019s ago: executing program 5 (id=829): setpriority(0x0, 0x0, 0x3) r0 = mq_open(&(0x7f0000000040)='!\x7f\x00\xca\x00\x00\x00\f\x00\x00\x01E!Tnux\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000000)={0x0, 0x9, 0xa, 0x3}) mq_timedreceive(r0, 0x0, 0xfffffffffffffee3, 0x1, 0x0) mq_timedreceive(r0, &(0x7f0000000180)=""/196, 0xc4, 0x0, 0x0) mq_timedreceive(r0, &(0x7f0000000080)=""/94, 0x5e, 0x4, 0x0) 21.387899727s ago: executing program 1 (id=831): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6d71b000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000075c0)={@local, @initdev={0xfe, 0x88, '\x00', 0x8, 0x0}, @private2={0xfc, 0x2, '\x00', 0x1}, 0xd431, 0x40, 0x409, 0x100, 0xa, 0x1}) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$nl_route_sched(r3, &(0x7f00000009c0)={0x0, 0x0, 0x0, 0x1, 0x2b1e}, 0x0) r7 = socket$inet6(0xa, 0x5, 0x0) getsockopt$inet6_opts(r7, 0x29, 0x39, 0x0, &(0x7f0000000240)) r8 = socket$nl_generic(0x10, 0x3, 0x10) setrlimit(0x4, &(0x7f0000000000)={0x5, 0x80000001}) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f0000000240)={0x24, r9, 0x1, 0x70bd2a, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_SCAN_FLAGS={0x8, 0x9e, 0x3808}]}, 0x24}, 0x1, 0x0, 0x0, 0x805}, 0x40084) 21.387505057s ago: executing program 6 (id=832): socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x80c80, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) syz_emit_ethernet(0xbe, &(0x7f00000000c0)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e22, 0x9c, 0x0, @wg}}}}}, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0), 0x101002, 0x0) ioctl$DRM_IOCTL_MODE_REVOKE_LEASE(r3, 0xc00464c9, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000380), 0x8c940) connect$inet(r2, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) sched_getaffinity(0x0, 0x4, &(0x7f0000000100)) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) epoll_create(0x7) write(0xffffffffffffffff, &(0x7f0000000280)="a773f12b3280673944e9e9d116b5308765ffea68c5cf5d2e4fd2242ce304d8ac8e13345c9e31d6fd7a8d4212e1f4327287812856b887e331554261ea454a15ff9bb648223f5df1b09ba71f66455f9d0f6d1ec81ba828fec686d2b2df647a6c50957a373e6c9e77221322ec2ee269541a88c92aec80c85953e72121820c240de0ac78412bbf0c557f3e20ee29b85030f50227a81f64d740dc5cb6d31ec7ef4eb2e3398f19043178fafbad2a20af6d7e65a6174c09c8cb7542ee4610099b03302ec456c987ffd538179a1649bc5e394669a3d90a2ecc7ded88dd5d529351bf285e39e57d577e796e3e1f46fa1f25678bc7331b3e78402271876f", 0xf9) 20.400351668s ago: executing program 1 (id=833): prlimit64(0x0, 0xe, &(0x7f0000000200)={0x7, 0x7ff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x8, 0x1014}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000780)=@base={0xc, 0x4, 0x4, 0x9, 0x18, r2}, 0x50) ioctl$UI_SET_LEDBIT(r1, 0x40045569, 0xa) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x11) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{0x100, 0xec1, 0x0, 0x1}, 'syz1\x00', 0x1a}) ioctl$UI_DEV_CREATE(r1, 0x5501) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) accept4(r3, 0x0, 0x0, 0x800) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) 19.819831658s ago: executing program 5 (id=834): socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x80c80, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) syz_emit_ethernet(0xbe, &(0x7f00000000c0)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e22, 0x9c, 0x0, @wg}}}}}, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, 0x0, 0x101002, 0x0) ioctl$DRM_IOCTL_MODE_REVOKE_LEASE(r3, 0xc00464c9, &(0x7f0000000480)) openat$mice(0xffffffffffffff9c, &(0x7f0000000380), 0x8c940) connect$inet(r2, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) sched_getaffinity(0x0, 0x4, &(0x7f0000000100)) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) epoll_create(0x7) write(0xffffffffffffffff, &(0x7f0000000280)="a773f12b3280673944e9e9d116b5308765ffea68c5cf5d2e4fd2242ce304d8ac8e13345c9e31d6fd7a8d4212e1f4327287812856b887e331554261ea454a15ff9bb648223f5df1b09ba71f66455f9d0f6d1ec81ba828fec686d2b2df647a6c50957a373e6c9e77221322ec2ee269541a88c92aec80c85953e72121820c240de0ac78412bbf0c557f3e20ee29b85030f50227a81f64d740dc5cb6d31ec7ef4eb2e3398f19043178fafbad2a20af6d7e65a6174c09c8cb7542ee4610099b03302ec456c987ffd538179a1649bc5e394669a3d90a2ecc7ded88dd5d529351bf285e39e57d577e796e3e1f46fa1f25678bc7331b3e78402271876f", 0xf9) 19.490241711s ago: executing program 4 (id=835): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000001380)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) sendto$inet(r0, &(0x7f0000000080)='MQ', 0x2, 0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r1, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r0}, 0x20) recvmmsg$unix(r0, &(0x7f0000004480)=[{{0x0, 0x0, &(0x7f0000001180)=[{&(0x7f0000000f00)=""/128, 0x80}], 0x1}}], 0x1, 0x0, 0x0) (fail_nth: 2) 19.438972417s ago: executing program 6 (id=836): pipe(&(0x7f0000000180)) socket(0x1e, 0x1, 0x0) r0 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000140), 0x82084, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) unshare(0x24040400) pipe2$watch_queue(0x0, 0x80) ioctl$KVM_SET_USER_MEMORY_REGION2(0xffffffffffffffff, 0x40a0ae49, 0x0) r3 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x2a9e524, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep1(r3, 0x82, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040), 0x80a41, 0x0) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x38f9, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) r5 = socket$phonet_pipe(0x23, 0x5, 0x2) request_key(&(0x7f00000001c0)='dns_resolver\x00', &(0x7f0000000180)={'syz', 0x1}, &(0x7f0000000100)='/d%v\xff\x00\xd4\xcd/snd/midiC#D#\x00', 0x0) keyctl$dh_compute(0x17, 0x0, 0x0, 0x0, 0x0) setsockopt$PNPIPE_ENCAP(r5, 0x113, 0x1, &(0x7f0000000140)=0x1, 0x4) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) pselect6(0x40, &(0x7f0000000880)={0xfffffffffffffffc, 0xa000000, 0x1fe, 0x3ff, 0x603, 0x400000000001, 0xfffffffffa86cde8, 0x4}, 0x0, &(0x7f00000002c0)={0x5, 0x7fff, 0xfffffffffbffffff, 0x9, 0x0, 0x4}, 0x0, 0x0) ioctl$TCSETSF2(r0, 0x402c542d, &(0x7f0000000200)={0x80000002, 0x1801, 0x9, 0xb, 0x59, "ea7102000000f900edffff0900000000000005", 0x800, 0x3}) 18.595160752s ago: executing program 5 (id=837): r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000180), 0x20802, 0x0) add_key$keyring(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xfffffffffffffffe) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049ee) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) get_mempolicy(0x0, 0x0, 0x2, &(0x7f0000240000/0x1000)=nil, 0x3) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) openat$vnet(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) close(0x3) socket(0x2, 0x80805, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f00000001c0)=@req3={0x2906e7e9, 0x7, 0x4, 0x7, 0x4, 0x3, 0x400}, 0x1c) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1c, &(0x7f0000000300)=[@in6={0xa, 0x4e24, 0x7e8, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4}]}, &(0x7f0000000140)=0x10) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000000)="cfe9ef6d6ee1d433ba73a5ddf753c74ac91bc34a934afacb0751028db60a", 0x1e}], 0x1) 18.561006965s ago: executing program 1 (id=838): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdc01, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_MEMORY={0x8, 0xa, 0x3ff}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240408a0}, 0x4890) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r6) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r8 = syz_genetlink_get_family_id$nfc(&(0x7f0000000480), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r8, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r9], 0x1c}}, 0x840) unshare(0x2c020400) write$nci(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="400404"], 0x7) r10 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r10, &(0x7f00000003c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x60, 0x140d, 0x20, 0x70bd2b, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x2}, @RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x1}, @RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x60}, 0x1, 0x0, 0x0, 0x1}, 0x4044000) write$nci(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="000501"], 0x4) 18.483183501s ago: executing program 4 (id=839): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000001380)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) sendto$inet(r0, &(0x7f0000000080)='MQ', 0x2, 0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r1, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r0}, 0x20) r2 = socket(0x10, 0x3, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) listen(0xffffffffffffffff, 0x5) acct(&(0x7f0000000000)='./file0\x00') openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f00000000c0)=[{0x20, 0x0, 0xff, 0xfffff00c}, {0xb1, 0x20, 0x40, 0xffffefff}, {0x8000, 0x0, 0x0, 0x2}]}, 0x10) sendmmsg(r3, &(0x7f0000000100), 0x0, 0x1400c800) ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) r6 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) r7 = ioctl$LOOP_CTL_GET_FREE(r6, 0x4c82) ioctl$LOOP_CTL_REMOVE(r6, 0x4c81, r7) r8 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x102) write$cgroup_int(r8, &(0x7f0000000040)=0x8000000001cb, 0x12) setsockopt$CAN_RAW_FILTER(r2, 0x65, 0x1, &(0x7f0000000140)=[{{0x0, 0x1, 0x1, 0x1}, {0x2, 0x1, 0x1}}, {{0x0, 0x1, 0x0, 0x1}, {0x3, 0x0, 0x1, 0x1}}, {{0x0, 0x0, 0x0, 0x1}, {0x0, 0x1, 0x1, 0x1}}, {{0x4}, {0x3, 0x1}}, {{0x0, 0x1, 0x1}, {0x4, 0x1}}], 0x28) ioctl$LOOP_CTL_GET_FREE(r6, 0x4c82) 17.450388885s ago: executing program 3 (id=840): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1c, &(0x7f0000000300)=[@in6={0xa, 0x4e24, 0x7e8, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4}]}, &(0x7f0000000140)=0x10) 17.426870527s ago: executing program 4 (id=841): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) futex(0x0, 0x85, 0x0, 0x0, 0x0, 0xc5fffffd) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x22, &(0x7f0000001680)=0x1, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000380)={@in6={{0xa, 0x4e24, 0x1, @loopback, 0x9}}, 0x0, 0x0, 0x32, 0x0, "aae37be4753f0a28060a80cdd60fe31d6ba25cec257a3a485a338d600a8402d23df4854ed4cf29109f0e30e8d115e434392db157494620680fffb8cb989ab0cfc17eb88225e0fb0a062dd7a81eb098d3"}, 0xd8) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8000}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x1000001, 0x13, r3, 0x8cee000) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000001c00)=ANY=[], 0x0) bind$inet6(r4, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2d}}, 0x6}, 0x1c) connect$inet6(r4, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) sendmmsg$inet(r4, &(0x7f0000001740)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000004c0)="cce63b152f4f235135cd164df5cbec6929499dd14d101c2ebfea774d7fc9c6352470a4041e7eefa0af59e82c6cc79a432584707b31324753e034b9e62156ef937610325daa0c7a215ed52b9418c16d0ffd7be7f9e66e8b069e1c06085244d4444b42b6371837677a7caca2aeba263a67f228fb9be53428b7de8d165754f5fd2a4192a22ffd351f3336edbe0cf7dc299385e9593d5c7f0714378cf083f72e26a5bd1e8a8d08ee0bec243ceacf2582908a00cac0d83ce3062b1e0752126a1bd945ce2680f3c9519795d9876988f2a32943d1ab821b69b1cbcb2b9e0edb3a3368abaefd34103585f5a2ea10867a73354246e2d44a1c358c73b260d1f57f0cd5e4b0cc2e3de70e388c201cd23d0a59e44d031604895b81d25c9ca35c2837e83a0d89e7d8735029566a933ad82c49993843767ec4856d48c12df87ba099c9b7e77b211a277a8e8d3def4fe7e2b1c6e5fa7bdde283881faedbca089d0156cbcc70cd365547d1a917d73c145b6f3ab45ab5ed187a15b6b86e8d6d1f4a637f2aea028d46e4148e4c70803b367c0435fb5f3d450e3eb93e1c752ab28ce7baa89d309341ed1e3767b9bc082cbc8a024d16e5538a3612432a9864198d7a20e45c67460b3ea869cf667fc48614925104ce05bcc5260cd3e2fdb8ee9bbeb69db6aedb22b31cfb808e7147af7ac7e4c41918645ac9e0d3e9aa6ecdd957bef547e8d4fc1329e9494308b2739cf4d7926bfce3474de8795844a2d61ad43af119c0ae2b7e0dfd0077720f364cdd46d21722e87fecb5c2c0e0d93325d7d3e8f7dc8373ac493fd5119f3d0760951b0b2fa4ac7fa2e8f56af2cb20fc7cbe57c7166ca4c15aeae7ec8348c41d98b76fd12cffd5b34f4b97b9daf780f3191eba3306fcfed2bcba7e21ea12881f1ad4365d2e1c783290ecf18545b2ca5490bf7eb7d41c6b35ea56524fd1bb1e7116e828ef4b1062124ec15e9ea23f6905314d27480fcbd9900aa05aba98d679c97a43d0cb940927c292178e817330d0656b4cb4ed3df31f685b23fab9ef679f7512fbed0dcef4a35cc3a6b84c46a2e5dacccdc7b78ffe71b49c1093816f9df2743777bbe443e33132b7f97ea4b4ea1404e1ef56a220f699be0e4e63272e477ec4969f6c6cd0cba029361d223640d123f42b9ffda812feb630c3b91f1d6e6fdd0e435a5cc88ae2ed0aed207e811bf374872496218ebe8f76a1feafbdda1bbefa5ee48bf6e4e7323ee2cbb4ce35ef994c4e781a89cb6ed05cfeeb3885a443c1d0f344427524c640d42b1b56f2c19869d60d8c63956456aabd12fc47d46ca660d945e31dfd6e07bbfe1cfbd051ce2db33ea691c5c4f3f8e912b8de1b312bd5f7873aaf4924645c6a3b1445655548d212ec3081e8d13eebdf6da7ed7c191bc758455fb1dbccef24baf75564bb603fc72e21dd9187259f9ab6ae4cf9f439f93a65da4c9389d6f3731901beca82631eb781e01c0d9c91495f63c78e99fe05bc4c1eb97a84a5756b3572fa68c3cb148933012a7c7c853b2a226d814f0559d13f32c060943cda1ac58cd617cf951e83fff0581a4cdc1db11bbdd2cac106004968cb5ffc26fac08af9212a8c59e94c9736325f61d179b9c5e8fea7e06a61d8b1cfad62a9839a56615be390b9dceaa0fa46841df5f5cb172a6c014ab380745a2b0461d57137a2a86ec508022960faf2b2c638c75c56043be513daab7d5907e3bcd416f1d0d75e0096f1f3ce9c620375d40b2355eaa059697c2a615b3cf8cec387405a5a320605b846ff5b6311fd93df025ece92add51e3092a10b8ff0e1abb60b32fae6a037c6ba7771b0fdc8fd0d5792db39a36b0b99bbd1e5bf4caa0c5e253cfbf4314b5b60dd682653862659a5277f79ed1d8324c63893b35e55da568bbe8404f1d2763c776a930a1fc6c945f5bda517e1179a2c610392a9c4fe8bb3df289ff29de2cc52c49701f4feef0481bb84a5fd52df64dd165163aaefbae89ba84d73c57eb123f771e52596b49ed11687830ff1a1d056d42298fe73599ac07c950abe68b6622c394f27e0b54eee55a1a0f3dc47f8d55d95cdc4372d547ea3280fb7cccd85332541e1fb20cc45198e480ed518ac6e634049f2e7cb05c150cc889a891a18cdf3492fe2ce8d436b3586584ec0851faa3168be699b1c9caa18760e45674ca8bea7d891f31b9e995c0aacecb2fd8439e5398d31fc8aae6f5ac2b5a6183f8368d3c0de1a55be202e4ffa60ef71b46e0e0ee061cc43311c5305c02d14d6be4347d2327c35ff9328b76d55aa3f11ecfd4c3213b008c49d0a2dc0ce12c2392eb6df7cbc632db538f706c3c5bc5635434657747dffd9ee56e16058c67e9e80c141f11b0b5ae8838cbc981ce923ac66bcd6a6c7a92d9f7cad10480336edd67058c241b2016592af3c5e8b4a7069559b190aafc0d0af085601439e8819b05ba2ea5ba8a7f4fc585657bd5857e1d88d74a7eeff2ce6049efaa7e41e742583ef20c0a5c60e18e6da9f5342ae957a2cb62994cf9f35c3e914460d3b8e8e1fb6fbb37ac5e6f51b680a67d760259ed3797001f72e85701bfedcccd82e7945da63b3cf6ed19b2bb611eb31937ca13df724b81cec4ba6bdbe603783d1e9818a8cf22fb2f9f4c96940e667848a3177b617bec1f3d81d11da80079b65923434475e3756f51d1ef833d24a77c33b0eba2a89cb2019cc0af083e7c8fde8871db6536dd11b7c713f3a88c0d85fb7567d34e77e1f23c5ff3b2e0f9f302021163f1aeef73faf6bebc0c8783ee5a50a0fb72f0ecc7be3931570a4584c2ec79642e62289d524497e3a0ca7928d2273a057f6428d8c9b6ce047e8ad880bd212a9b902ac13407c80dae76d6db04fde7584203d98bd453c0b722fb2469665ed09739dc79c4856f7c2c1e7fd860161fc393b26c38a7de3c056ef8fc1bdbb53b136cf9e04b5a342fb8828cec4b3b8955cdfd8eda47492d4227289e81a40ff6bff03d3fc983df2097fbe413605189a06ed4305101555b611e541f037189ffad1ff5002a126db8f2d2504294081dbb9b211fbb6042c913ff34ae9537a560432c104470271aa687de030e3609c34ddb061011dbc08b66db1b45c43cfea804d1bea8c1c91d3a982f51593f5e209470d618cd430b44acead709936519b6937f3db2946a942153d78fe218eb4114af5ed60bc79e4ff8d48a9e8462b598cc4918124926711ca81b84e080b2a1b2d213904b9e2f3559f66521f9636ede23db18e3416ddef5a22956840ceab1bac6435716448fcf89d45d129120cb2ac92dbcb97be56b169523a7fc44ba32d3f62414b3868b1b8ab078d8cf65c967bcf702f16cdf099bd345787bc0b189a15c343322eae2958e6469f5715ab2eb81ec0a85311d53adb831a3350419ea4746c0d98bbb51d0eba63db662762c6c4af089d26fb57c5f1f7b78fded3e57d726ba3a61a57241681ba43ac35da7e13e860a1984cd0ab43f29b119885eea68941faa4e30f3cc4b3e98e015111a6c24a609ab4d686ceff1b218d68273ac3e87f150ca7ef2c6fba616bc626a009e551cf6801c942a8801c3a78d428ba626c1d449c17b962a7cbccff1a41fdf21e6847b6a0cd272ff01b685048a3ea03156bdf804016d6e558cdfd790772fc82f96adac5770d4a8eafc2d4d9cab076c38edf2cf4b3e830fb2acde872294b79250aaa30c152d83e991faa29f9c07483cb54c08f39099c12fca9579d847e3f7733b978c454c85ed6213673e475458e45f0b93d1eb1f484b0e181905097d79cd8bc565a14cb1c8835c3fc287d72d9616b99aa042c186a06aa91c5f4c00a7d86549767cb785a0f468d153003726516ecba477f3173bb05f2df60da83d5c4ddf889549e9504fb4052dfe5d3465563aeba8e5253b3cc9eda8dc0b8ffc74fdbd4d49e64de3eef79be08569042a7c5bf942cca6da27b90ba4c4832ada245b4f9ebdad645776b238af65073fd31924c1a1a04cd1a83f212caabb5601d11fa6375b1d4781ab75f398cf1d94d2881c105f15530b9a5c50fa852c3999cfea0f9b7c13a862a5bc21c28d6dcf9148a88ef5e6997bbb28aef8b637fc95e0359c741e32db2a267d96aba13aed03f89f5395ae5d19a5c2fd2564ee10523737a83856be448bd4186e2368b6631bea63142bc4d270fee89062bf7d61e5f6e49c798054760e624910c732737fb89aee6d51ac1dcc2b0a43bbbac1e23d691f42509d1475fb29cbdfd32599e95dda27424b288b3ec59109f6113bca5df34a870ad5f78a18864641e1196f47ab679914de32be7b4568c40d28c637c37c4bc61e561af71e867bd477ad8d8ff48208e781aeee17f7e4e89a795fc725b341df564859a33823af64535a81c56dfc0463d7264608be7eb101584031afcb2dd9fde4e9898c979973c2370b87cd0c28b16de10548ddc457fbc34309663418dc7df60c4ed965bbc5655ee79aa95aed1f33742034cf18df47530912cd19da57d44493b54c5a625e2c237d4ec4496df293d301359126d0129465a45aef9340515c2627f1919efa25c0fa5bf515a67ae10d527977138ade3e7422e41215aa75d6133b7710426c1e27f725e6040f01c6e7524e3789fefcb4640442cd4f72a03edec97bd47d12624053419048431ac781e6a17b9ab5030a5705ca11efb3dc58aaa41f9a6cfe397f774f0dc74610ac72624ca48af1ecba87376df745bccd434351f5831bcdc946bfa4ebb025412679f1e5011f1391935b6648007c98f5af3f0366eaa928de4180024188bae3aecea59a27edaf0cd199c57ef290c205dfbb89c82e9733d1bd12b59863a7f8a34b51f0a6da8b8f8ea6a571460938d4ea26f097e78af31c40501eeb8ad0f9feed8a6430149b85cdd7ed62c2e12cfa6a3c7292a1dfd3ca438e583d7f3af6ca123fe1c80352490c831ea385b132d792b4b6e0e570d0df29d9b39a761cf3b07ab29255cf4c3c281c71c47654144b0b61cda5830fa9d1feec4c305e89b12694fccab28759239b1e52377fdee05785867c281411372bab2a315403519199af83e75a402051fcfd2fdd179f4307ec96d1236cd9e24054582d242ed1e4113f1b244be3e26f78ad1668fbeee0e5e51b81d8302a85c64b2c8b3dbf6f126e289e216dd22902df37905872be8610c1e31fb2b0bcce23b7bbe76bc1eb69fac2ffffe06601273dda4769075823293cc94eb1a3a06b8cd13db4b1c7dc9ddd6ed4eeff148e3cd8494d81826d4586f780177664e4495fbb0045da95dfdfb96fcbbcd6ec5f78b66e2c738e1a6edc0c7bb17f5d764cff4eb5d572fb2e376b258a891ae25f16ee9d0803ae7b9ecbbdfe6d5de3cf4535d2f7cdbbb522d91693fc511589b2be769927954ae4574917c492bf4d75ffb0914939526f1d76fc73fc6a785f71707f41bb4766741926eda68c2783dd8a651c67edf80a4e5235fc72c343189eaf9563faced85942ddf1521b3f8f72565bd30de38f289ea131e228dbe53267b35e08575bd529c062c8d102ae61ef2af9c76132f53727e418c6bb903b0c8258f30f0b629701ce741434542e59a866766bd78d77274e6d56d40b2d8abb0cdb4ee7060ffe569f6080ddf7a7b696d8fba17ef2305547250ad5cde88c94f957febfd5c1a788b67d044369ceeb64bdcd8ec631658245eee03acc3de7fd4649060fde28c424f5e9f4f7f2013773a208c2faa4212e8c38685fc3773f04466329beca3ebd6ccf4a162fc1e5481fe537649c61c44e784c93db71036417dd96271cd21811178af52aa76b5b69342710c935707f792be532a346e47ffe576999f7ccd065eb1e439768cce2908a600d9e62148f4", 0x1000}], 0x1}}, {{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000180)="8b", 0x1}], 0x1}}], 0x2, 0x4001) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r4, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000c54000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000240)=0x40) r6 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r6, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)={0x14, r7, 0x321, 0x70bd29, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4c811}, 0x4) recvmmsg(r8, &(0x7f00000001c0)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x180, 0x0) sendmmsg$inet6(r2, &(0x7f0000000140)=[{{&(0x7f0000000100)={0xa, 0x4e20, 0x3, @empty, 0xfe5}, 0x1c, &(0x7f0000000680)=[{&(0x7f00000002c0)="be85c089d56926bc2b513f0002ee324d495c4e1a9f659b0c4574e052344f124419b8ff02f38300811bd1c1dad9aa4b584a39115a6df3dab108b761429cb60e4dc3f8634b2df1a47b939f6b28c7d4f0a9f6f46a1a18b0f4715a77b44c82ca9b2c8e1ae9f5de27e9713dcd03b89e479e9890d47f962d4cf1e1419dcd6867da3eaafade2a23", 0x84}], 0x1}}], 0x1, 0x200880d8) dup3(r1, r0, 0x0) 17.299195874s ago: executing program 5 (id=842): openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000180), 0x20802, 0x0) add_key$keyring(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xfffffffffffffffe) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) creat(0x0, 0xecf86c37d53049ee) mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, 0x0) get_mempolicy(0x0, 0x0, 0x2, &(0x7f0000240000/0x1000)=nil, 0x3) openat(0xffffffffffffff9c, 0x0, 0x601c2, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, &(0x7f0000001a00)={'pcmmio\x00', [0x80, 0x0, 0x4, 0xfffd, 0x25, 0x8000, 0x400, 0x7, 0x54c6cff3, 0xfd, 0x0, 0x7fffffff, 0xfffffff7, 0x400001, 0x6, 0x5, 0x0, 0x7f, 0x3, 0x40000001, 0x9, 0x4, 0x2d57, 0x20001e5b, 0x3, 0xe66, 0x3, 0x6, 0x4008, 0x0, 0x3]}) ioctl$VHOST_SET_FEATURES(r1, 0x4008af00, &(0x7f0000000000)=0x200000000) close(0x3) socket(0x2, 0x80805, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f00000001c0)=@req3={0x2906e7e9, 0x7, 0x4, 0x7, 0x4, 0x3, 0x400}, 0x1c) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1c, &(0x7f0000000300)=[@in6={0xa, 0x4e24, 0x7e8, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4}]}, &(0x7f0000000140)=0x10) 15.987683864s ago: executing program 1 (id=843): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6d71b000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000075c0)={@local, @initdev={0xfe, 0x88, '\x00', 0x8, 0x0}, @private2={0xfc, 0x2, '\x00', 0x1}, 0xd431, 0x40, 0x409, 0x100, 0xa, 0x1}) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$nl_route_sched(r3, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000700)=@newtaction={0x14, 0x1e, 0x109}, 0x14}, 0x1, 0x2b1e}, 0x0) r7 = socket$inet6(0xa, 0x5, 0x0) getsockopt$inet6_opts(r7, 0x29, 0x39, 0x0, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) setrlimit(0x4, &(0x7f0000000000)={0x5, 0x80000001}) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f0000000240)={0x24, r9, 0x1, 0x70bd2a, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_SCAN_FLAGS={0x8, 0x9e, 0x3808}]}, 0x24}, 0x1, 0x0, 0x0, 0x805}, 0x40084) 15.839904283s ago: executing program 3 (id=844): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x7f, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) close(0xffffffffffffffff) syz_open_procfs(0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1a1000, 0x0) mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000140)='vfat\x00', 0x208000, 0x0) ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0xa3) syz_open_dev$loop(&(0x7f0000000380), 0x6, 0x204000) r3 = socket$igmp(0x2, 0x3, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r4, 0x5452, &(0x7f0000000080)=0x1a43) shutdown(r5, 0x2) setsockopt$MRT_INIT(r3, 0x0, 0xc8, &(0x7f0000000180), 0x4) r6 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r6, 0x0, 0xd2, &(0x7f0000000000)={@broadcast, @multicast1, 0x0, "12ceaac82ab7d944e84b6fbd6178697e3b10c9b81bede26c85ee73daab4158e8", 0x2, 0x6, 0x4, 0x4}, 0x3c) setsockopt$MRT_FLUSH(r6, 0x0, 0xd4, &(0x7f0000000100)=0xe, 0x4) bind$rds(r1, &(0x7f0000000840)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x10}}, 0x10) sendmsg$rds(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000200)={0x2, 0x0, @private=0xa010101}, 0x10, 0x0, 0x0, &(0x7f0000000580)=[@cswp={0x58, 0x114, 0x7, {{0x7, 0x1}, &(0x7f00000002c0)=0x2, 0x0, 0x5772, 0x3, 0xdb30, 0xe8, 0x0, 0x17}}], 0x58}, 0x0) msgrcv(0x0, 0x0, 0x2000, 0x1, 0x5800) syz_usb_connect$uac3(0x5, 0x80, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x20, 0x46d, 0x8f6, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x0, 0x50, 0x8, {0x8, 0xb, 0x0, 0x2, 0x1, 0x1, 0x30, 0x5}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xa, 0xa, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x5, 0x4, 0xa, {0xa, 0x25, 0x25, 0x7fff, 0x5, 0xd}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x9, 0xf, 0x2, {0xa, 0x25, 0x25, 0x3ff, 0x7, 0xff}}}}}}}}]}}, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x9, [{0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x280a}}, {0x58, &(0x7f0000000180)=@string={0x58, 0x3, "aaa939defcf3cb3352f607705df605b463af0a73ae6dc835bfd87e5f96cfb8ba3069c3cb51b1791648aca2a377ad6aa314208150e97025da279d4cf2a65cd477d0a9cb991cef8d7e0166e4dfc208a578d02610e54359"}}, {0x8, &(0x7f0000000200)=@string={0x8, 0x3, "d8a72aaf7e7e"}}, {0x8f, &(0x7f00000006c0)=ANY=[@ANYBLOB="8f03478ab7d437660d0cd70c14ef9165d52da02923fe40e32cab9a8e99c537f5bafa6d8851aaea1a34ce1e791d474e926bf6f3d13d81339c9c99ef3914f9914979c17e8a90eea123279f2fc6c76928fd715611c5630a719859f60cdb1d5c37dc6a6c868671c989be76a2c1fea4692b7efbc98fd282a86655050012b98e5ec5fdc3f0011c210338e552e89ffe14944ceecbe8724700f34849f9bf571243d063cc84781367729be7fbbe8318fc0cc4fd8d5ce9a0452a5c0a458f307aa44be673c78e43d196a273841fee78a0118a2681740b2b7e993e639aeac0eee0cede9bfa269d8dd3edc0b96277dd9d6d6ed75a9f950e6cb92dc8ae5b832fc66bece7e53772127a70fb20ea44c9c9abf875ee70ab09cd1717a1f650f7"]}, {0xaf, &(0x7f0000000600)=@string={0xaf, 0x3, "befd7edf1f46937239514b616d9aae61e4c7ab24acbcfa8dc4a9b6a00db3199b658f7649297fe8e03023ac2153620ee2a335296fa188515a26d561833db051d342283111577ed8b7a20979e35b9069882e2dd085f82778c66a2b7e1e334e69ba762901a61aa7fedda3827fb77d9266f2be5198641dd619ac89586a5f125ac12a9042ec137fd47489b6dbed686388150cb4c317afe9324a6e9f5a69d1c9427c855f18707acc5eb92bfe2fa7fc8e"}}, {0x0, 0x0}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x44f}}, {0xa7, &(0x7f0000000280)=@string={0xa7, 0x3, "c16ca2a859c91a41f82b746a6e662b2150f2d05e7daa08eb610a38579d40257bd014c2eda9ec4cb49e0338682b9bf1fad1e07ba05fc5ce8398610a8939b2f567161ca953f973d33dc721af0efdcb5e95836b25b14766bf86838387fa0291b7f92afcda18095978a733753c26fb948c133e9369db656b7d7438bb60f4b1981a7a7f33172e6018ff292d6c14a7e51b2a9086de91e15390e40a1ee55f1645c13417e25c099277"}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x409}}]}) 10.964802492s ago: executing program 1 (id=845): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, 0x0, 0x0, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r3, &(0x7f0000001a40)=""/102392, 0x18ff8) recvmsg(r2, 0x0, 0x0) pipe2$watch_queue(0x0, 0x80) r4 = add_key(&(0x7f0000000000)='id_resolver\x00', 0x0, &(0x7f0000000080)="f8", 0x1, 0xfffffffffffffffe) keyctl$KEYCTL_WATCH_KEY(0x20, r4, 0xffffffffffffffff, 0x0) keyctl$revoke(0x3, r4) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r0, 0x8982, &(0x7f0000000000)) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16, @ANYBLOB="01002dbd0ecebbc7216d1504000008000300", @ANYRES32], 0x34}, 0x1, 0x0, 0x0, 0x4000019}, 0x0) 10.847915862s ago: executing program 4 (id=846): socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x80c80, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) syz_emit_ethernet(0xbe, &(0x7f00000000c0)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e22, 0x9c, 0x0, @wg}}}}}, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0), 0x101002, 0x0) ioctl$DRM_IOCTL_MODE_REVOKE_LEASE(r3, 0xc00464c9, &(0x7f0000000480)) openat$mice(0xffffffffffffff9c, 0x0, 0x8c940) connect$inet(r2, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) sched_getaffinity(0x0, 0x4, &(0x7f0000000100)) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) epoll_create(0x7) write(0xffffffffffffffff, &(0x7f0000000280)="a773f12b3280673944e9e9d116b5308765ffea68c5cf5d2e4fd2242ce304d8ac8e13345c9e31d6fd7a8d4212e1f4327287812856b887e331554261ea454a15ff9bb648223f5df1b09ba71f66455f9d0f6d1ec81ba828fec686d2b2df647a6c50957a373e6c9e77221322ec2ee269541a88c92aec80c85953e72121820c240de0ac78412bbf0c557f3e20ee29b85030f50227a81f64d740dc5cb6d31ec7ef4eb2e3398f19043178fafbad2a20af6d7e65a6174c09c8cb7542ee4610099b03302ec456c987ffd538179a1649bc5e394669a3d90a2ecc7ded88dd5d529351bf285e39e57d577e796e3e1f46fa1f25678bc7331b3e78402271876f", 0xf9) 2.265441729s ago: executing program 34 (id=836): pipe(&(0x7f0000000180)) socket(0x1e, 0x1, 0x0) r0 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000140), 0x82084, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) unshare(0x24040400) pipe2$watch_queue(0x0, 0x80) ioctl$KVM_SET_USER_MEMORY_REGION2(0xffffffffffffffff, 0x40a0ae49, 0x0) r3 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x2a9e524, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep1(r3, 0x82, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040), 0x80a41, 0x0) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x38f9, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) r5 = socket$phonet_pipe(0x23, 0x5, 0x2) request_key(&(0x7f00000001c0)='dns_resolver\x00', &(0x7f0000000180)={'syz', 0x1}, &(0x7f0000000100)='/d%v\xff\x00\xd4\xcd/snd/midiC#D#\x00', 0x0) keyctl$dh_compute(0x17, 0x0, 0x0, 0x0, 0x0) setsockopt$PNPIPE_ENCAP(r5, 0x113, 0x1, &(0x7f0000000140)=0x1, 0x4) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) pselect6(0x40, &(0x7f0000000880)={0xfffffffffffffffc, 0xa000000, 0x1fe, 0x3ff, 0x603, 0x400000000001, 0xfffffffffa86cde8, 0x4}, 0x0, &(0x7f00000002c0)={0x5, 0x7fff, 0xfffffffffbffffff, 0x9, 0x0, 0x4}, 0x0, 0x0) ioctl$TCSETSF2(r0, 0x402c542d, &(0x7f0000000200)={0x80000002, 0x1801, 0x9, 0xb, 0x59, "ea7102000000f900edffff0900000000000005", 0x800, 0x3}) 2.209478097s ago: executing program 35 (id=842): openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000180), 0x20802, 0x0) add_key$keyring(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xfffffffffffffffe) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) creat(0x0, 0xecf86c37d53049ee) mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, 0x0) get_mempolicy(0x0, 0x0, 0x2, &(0x7f0000240000/0x1000)=nil, 0x3) openat(0xffffffffffffff9c, 0x0, 0x601c2, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, &(0x7f0000001a00)={'pcmmio\x00', [0x80, 0x0, 0x4, 0xfffd, 0x25, 0x8000, 0x400, 0x7, 0x54c6cff3, 0xfd, 0x0, 0x7fffffff, 0xfffffff7, 0x400001, 0x6, 0x5, 0x0, 0x7f, 0x3, 0x40000001, 0x9, 0x4, 0x2d57, 0x20001e5b, 0x3, 0xe66, 0x3, 0x6, 0x4008, 0x0, 0x3]}) ioctl$VHOST_SET_FEATURES(r1, 0x4008af00, &(0x7f0000000000)=0x200000000) close(0x3) socket(0x2, 0x80805, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f00000001c0)=@req3={0x2906e7e9, 0x7, 0x4, 0x7, 0x4, 0x3, 0x400}, 0x1c) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1c, &(0x7f0000000300)=[@in6={0xa, 0x4e24, 0x7e8, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4}]}, &(0x7f0000000140)=0x10) 2.196387254s ago: executing program 3 (id=849): bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0xc, 0x13, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000ffffff858500000071000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb70200"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000001}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.io_wait_time_recursive\x00', 0x26e1, 0x0) r3 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000080)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x800, 0x0, 0x2, 0x1}, 0x20) mount(&(0x7f0000000380)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000040)='.\x00', &(0x7f0000000340)='nilfs2\x00', 0x800000, 0x0) unshare(0x2c020400) syz_emit_vhci(&(0x7f00000003c0)=@HCI_EVENT_PKT={0x4, @hci_ev_pscan_rep_mode={{0x20, 0x7}, {@none, 0x60}}}, 0xa) open_tree(0xffffffffffffffff, &(0x7f0000000640)='\x00', 0x9901) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x7, 0x6, 0x5, 0x0, 0x0, {0x1, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004080}, 0x48810) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) r5 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r5, &(0x7f0000000440), 0x10) listen(r5, 0x709) r6 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r6, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10) r7 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r7, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) 1.172417621s ago: executing program 1 (id=850): r0 = syz_open_dev$evdev(&(0x7f0000000000), 0xffffffffffffff28, 0x80) ioctl$EVIOCSABS0(r0, 0x401845c0, 0x0) ioctl$EVIOCGABS0(r0, 0x80184540, 0x0) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="18000000141401"], 0x18}, 0x1, 0x0, 0x0, 0x180d1}, 0x49010) ioctl$EVIOCGABS2F(r0, 0x8018456f, 0x0) syz_usb_connect(0x0, 0x4a, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000264117408ac057650e5c033ae7d220902380001040900d409049606000e0100060a2402020000008007000924020108080906070b2402020600100004f127082402016f0409064a5f0446272998432716145b0a3495d694de60b3451efa7a414a91c6d72359cc77357d22ffa29f70f1b70583218287d81284cb56ee0f92c762e34d10eee567ad7b6ce5826570ca4fd173a0dcfc100e0355d560f15f3b48be2c8bd9dc484a677543cf99bcd1c8c4ad68898bddbf88e18002e2c66ba145c2039ef526c4cc82a5778921240bee051fe1b83fe6669384dddfaa3fadd107450e16d71e8690745ab8ee911a39454e80f6264b69af86af324fbc7036f311a74144d0bf8efc0974a101038908"], 0x0) 1.153858485s ago: executing program 4 (id=851): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) futex(0x0, 0x85, 0x0, 0x0, 0x0, 0xc5fffffd) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x22, &(0x7f0000001680)=0x1, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000380)={@in6={{0xa, 0x4e24, 0x1, @loopback, 0x9}}, 0x0, 0x0, 0x32, 0x0, "aae37be4753f0a28060a80cdd60fe31d6ba25cec257a3a485a338d600a8402d23df4854ed4cf29109f0e30e8d115e434392db157494620680fffb8cb989ab0cfc17eb88225e0fb0a062dd7a81eb098d3"}, 0xd8) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8000}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x1000001, 0x13, r3, 0x8cee000) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000001c00)=ANY=[], 0x0) bind$inet6(r4, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2d}}, 0x6}, 0x1c) connect$inet6(r4, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) sendmmsg$inet(r4, &(0x7f0000001740)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000004c0)="cce63b152f4f235135cd164df5cbec6929499dd14d101c2ebfea774d7fc9c6352470a4041e7eefa0af59e82c6cc79a432584707b31324753e034b9e62156ef937610325daa0c7a215ed52b9418c16d0ffd7be7f9e66e8b069e1c06085244d4444b42b6371837677a7caca2aeba263a67f228fb9be53428b7de8d165754f5fd2a4192a22ffd351f3336edbe0cf7dc299385e9593d5c7f0714378cf083f72e26a5bd1e8a8d08ee0bec243ceacf2582908a00cac0d83ce3062b1e0752126a1bd945ce2680f3c9519795d9876988f2a32943d1ab821b69b1cbcb2b9e0edb3a3368abaefd34103585f5a2ea10867a73354246e2d44a1c358c73b260d1f57f0cd5e4b0cc2e3de70e388c201cd23d0a59e44d031604895b81d25c9ca35c2837e83a0d89e7d8735029566a933ad82c49993843767ec4856d48c12df87ba099c9b7e77b211a277a8e8d3def4fe7e2b1c6e5fa7bdde283881faedbca089d0156cbcc70cd365547d1a917d73c145b6f3ab45ab5ed187a15b6b86e8d6d1f4a637f2aea028d46e4148e4c70803b367c0435fb5f3d450e3eb93e1c752ab28ce7baa89d309341ed1e3767b9bc082cbc8a024d16e5538a3612432a9864198d7a20e45c67460b3ea869cf667fc48614925104ce05bcc5260cd3e2fdb8ee9bbeb69db6aedb22b31cfb808e7147af7ac7e4c41918645ac9e0d3e9aa6ecdd957bef547e8d4fc1329e9494308b2739cf4d7926bfce3474de8795844a2d61ad43af119c0ae2b7e0dfd0077720f364cdd46d21722e87fecb5c2c0e0d93325d7d3e8f7dc8373ac493fd5119f3d0760951b0b2fa4ac7fa2e8f56af2cb20fc7cbe57c7166ca4c15aeae7ec8348c41d98b76fd12cffd5b34f4b97b9daf780f3191eba3306fcfed2bcba7e21ea12881f1ad4365d2e1c783290ecf18545b2ca5490bf7eb7d41c6b35ea56524fd1bb1e7116e828ef4b1062124ec15e9ea23f6905314d27480fcbd9900aa05aba98d679c97a43d0cb940927c292178e817330d0656b4cb4ed3df31f685b23fab9ef679f7512fbed0dcef4a35cc3a6b84c46a2e5dacccdc7b78ffe71b49c1093816f9df2743777bbe443e33132b7f97ea4b4ea1404e1ef56a220f699be0e4e63272e477ec4969f6c6cd0cba029361d223640d123f42b9ffda812feb630c3b91f1d6e6fdd0e435a5cc88ae2ed0aed207e811bf374872496218ebe8f76a1feafbdda1bbefa5ee48bf6e4e7323ee2cbb4ce35ef994c4e781a89cb6ed05cfeeb3885a443c1d0f344427524c640d42b1b56f2c19869d60d8c63956456aabd12fc47d46ca660d945e31dfd6e07bbfe1cfbd051ce2db33ea691c5c4f3f8e912b8de1b312bd5f7873aaf4924645c6a3b1445655548d212ec3081e8d13eebdf6da7ed7c191bc758455fb1dbccef24baf75564bb603fc72e21dd9187259f9ab6ae4cf9f439f93a65da4c9389d6f3731901beca82631eb781e01c0d9c91495f63c78e99fe05bc4c1eb97a84a5756b3572fa68c3cb148933012a7c7c853b2a226d814f0559d13f32c060943cda1ac58cd617cf951e83fff0581a4cdc1db11bbdd2cac106004968cb5ffc26fac08af9212a8c59e94c9736325f61d179b9c5e8fea7e06a61d8b1cfad62a9839a56615be390b9dceaa0fa46841df5f5cb172a6c014ab380745a2b0461d57137a2a86ec508022960faf2b2c638c75c56043be513daab7d5907e3bcd416f1d0d75e0096f1f3ce9c620375d40b2355eaa059697c2a615b3cf8cec387405a5a320605b846ff5b6311fd93df025ece92add51e3092a10b8ff0e1abb60b32fae6a037c6ba7771b0fdc8fd0d5792db39a36b0b99bbd1e5bf4caa0c5e253cfbf4314b5b60dd682653862659a5277f79ed1d8324c63893b35e55da568bbe8404f1d2763c776a930a1fc6c945f5bda517e1179a2c610392a9c4fe8bb3df289ff29de2cc52c49701f4feef0481bb84a5fd52df64dd165163aaefbae89ba84d73c57eb123f771e52596b49ed11687830ff1a1d056d42298fe73599ac07c950abe68b6622c394f27e0b54eee55a1a0f3dc47f8d55d95cdc4372d547ea3280fb7cccd85332541e1fb20cc45198e480ed518ac6e634049f2e7cb05c150cc889a891a18cdf3492fe2ce8d436b3586584ec0851faa3168be699b1c9caa18760e45674ca8bea7d891f31b9e995c0aacecb2fd8439e5398d31fc8aae6f5ac2b5a6183f8368d3c0de1a55be202e4ffa60ef71b46e0e0ee061cc43311c5305c02d14d6be4347d2327c35ff9328b76d55aa3f11ecfd4c3213b008c49d0a2dc0ce12c2392eb6df7cbc632db538f706c3c5bc5635434657747dffd9ee56e16058c67e9e80c141f11b0b5ae8838cbc981ce923ac66bcd6a6c7a92d9f7cad10480336edd67058c241b2016592af3c5e8b4a7069559b190aafc0d0af085601439e8819b05ba2ea5ba8a7f4fc585657bd5857e1d88d74a7eeff2ce6049efaa7e41e742583ef20c0a5c60e18e6da9f5342ae957a2cb62994cf9f35c3e914460d3b8e8e1fb6fbb37ac5e6f51b680a67d760259ed3797001f72e85701bfedcccd82e7945da63b3cf6ed19b2bb611eb31937ca13df724b81cec4ba6bdbe603783d1e9818a8cf22fb2f9f4c96940e667848a3177b617bec1f3d81d11da80079b65923434475e3756f51d1ef833d24a77c33b0eba2a89cb2019cc0af083e7c8fde8871db6536dd11b7c713f3a88c0d85fb7567d34e77e1f23c5ff3b2e0f9f302021163f1aeef73faf6bebc0c8783ee5a50a0fb72f0ecc7be3931570a4584c2ec79642e62289d524497e3a0ca7928d2273a057f6428d8c9b6ce047e8ad880bd212a9b902ac13407c80dae76d6db04fde7584203d98bd453c0b722fb2469665ed09739dc79c4856f7c2c1e7fd860161fc393b26c38a7de3c056ef8fc1bdbb53b136cf9e04b5a342fb8828cec4b3b8955cdfd8eda47492d4227289e81a40ff6bff03d3fc983df2097fbe413605189a06ed4305101555b611e541f037189ffad1ff5002a126db8f2d2504294081dbb9b211fbb6042c913ff34ae9537a560432c104470271aa687de030e3609c34ddb061011dbc08b66db1b45c43cfea804d1bea8c1c91d3a982f51593f5e209470d618cd430b44acead709936519b6937f3db2946a942153d78fe218eb4114af5ed60bc79e4ff8d48a9e8462b598cc4918124926711ca81b84e080b2a1b2d213904b9e2f3559f66521f9636ede23db18e3416ddef5a22956840ceab1bac6435716448fcf89d45d129120cb2ac92dbcb97be56b169523a7fc44ba32d3f62414b3868b1b8ab078d8cf65c967bcf702f16cdf099bd345787bc0b189a15c343322eae2958e6469f5715ab2eb81ec0a85311d53adb831a3350419ea4746c0d98bbb51d0eba63db662762c6c4af089d26fb57c5f1f7b78fded3e57d726ba3a61a57241681ba43ac35da7e13e860a1984cd0ab43f29b119885eea68941faa4e30f3cc4b3e98e015111a6c24a609ab4d686ceff1b218d68273ac3e87f150ca7ef2c6fba616bc626a009e551cf6801c942a8801c3a78d428ba626c1d449c17b962a7cbccff1a41fdf21e6847b6a0cd272ff01b685048a3ea03156bdf804016d6e558cdfd790772fc82f96adac5770d4a8eafc2d4d9cab076c38edf2cf4b3e830fb2acde872294b79250aaa30c152d83e991faa29f9c07483cb54c08f39099c12fca9579d847e3f7733b978c454c85ed6213673e475458e45f0b93d1eb1f484b0e181905097d79cd8bc565a14cb1c8835c3fc287d72d9616b99aa042c186a06aa91c5f4c00a7d86549767cb785a0f468d153003726516ecba477f3173bb05f2df60da83d5c4ddf889549e9504fb4052dfe5d3465563aeba8e5253b3cc9eda8dc0b8ffc74fdbd4d49e64de3eef79be08569042a7c5bf942cca6da27b90ba4c4832ada245b4f9ebdad645776b238af65073fd31924c1a1a04cd1a83f212caabb5601d11fa6375b1d4781ab75f398cf1d94d2881c105f15530b9a5c50fa852c3999cfea0f9b7c13a862a5bc21c28d6dcf9148a88ef5e6997bbb28aef8b637fc95e0359c741e32db2a267d96aba13aed03f89f5395ae5d19a5c2fd2564ee10523737a83856be448bd4186e2368b6631bea63142bc4d270fee89062bf7d61e5f6e49c798054760e624910c732737fb89aee6d51ac1dcc2b0a43bbbac1e23d691f42509d1475fb29cbdfd32599e95dda27424b288b3ec59109f6113bca5df34a870ad5f78a18864641e1196f47ab679914de32be7b4568c40d28c637c37c4bc61e561af71e867bd477ad8d8ff48208e781aeee17f7e4e89a795fc725b341df564859a33823af64535a81c56dfc0463d7264608be7eb101584031afcb2dd9fde4e9898c979973c2370b87cd0c28b16de10548ddc457fbc34309663418dc7df60c4ed965bbc5655ee79aa95aed1f33742034cf18df47530912cd19da57d44493b54c5a625e2c237d4ec4496df293d301359126d0129465a45aef9340515c2627f1919efa25c0fa5bf515a67ae10d527977138ade3e7422e41215aa75d6133b7710426c1e27f725e6040f01c6e7524e3789fefcb4640442cd4f72a03edec97bd47d12624053419048431ac781e6a17b9ab5030a5705ca11efb3dc58aaa41f9a6cfe397f774f0dc74610ac72624ca48af1ecba87376df745bccd434351f5831bcdc946bfa4ebb025412679f1e5011f1391935b6648007c98f5af3f0366eaa928de4180024188bae3aecea59a27edaf0cd199c57ef290c205dfbb89c82e9733d1bd12b59863a7f8a34b51f0a6da8b8f8ea6a571460938d4ea26f097e78af31c40501eeb8ad0f9feed8a6430149b85cdd7ed62c2e12cfa6a3c7292a1dfd3ca438e583d7f3af6ca123fe1c80352490c831ea385b132d792b4b6e0e570d0df29d9b39a761cf3b07ab29255cf4c3c281c71c47654144b0b61cda5830fa9d1feec4c305e89b12694fccab28759239b1e52377fdee05785867c281411372bab2a315403519199af83e75a402051fcfd2fdd179f4307ec96d1236cd9e24054582d242ed1e4113f1b244be3e26f78ad1668fbeee0e5e51b81d8302a85c64b2c8b3dbf6f126e289e216dd22902df37905872be8610c1e31fb2b0bcce23b7bbe76bc1eb69fac2ffffe06601273dda4769075823293cc94eb1a3a06b8cd13db4b1c7dc9ddd6ed4eeff148e3cd8494d81826d4586f780177664e4495fbb0045da95dfdfb96fcbbcd6ec5f78b66e2c738e1a6edc0c7bb17f5d764cff4eb5d572fb2e376b258a891ae25f16ee9d0803ae7b9ecbbdfe6d5de3cf4535d2f7cdbbb522d91693fc511589b2be769927954ae4574917c492bf4d75ffb0914939526f1d76fc73fc6a785f71707f41bb4766741926eda68c2783dd8a651c67edf80a4e5235fc72c343189eaf9563faced85942ddf1521b3f8f72565bd30de38f289ea131e228dbe53267b35e08575bd529c062c8d102ae61ef2af9c76132f53727e418c6bb903b0c8258f30f0b629701ce741434542e59a866766bd78d77274e6d56d40b2d8abb0cdb4ee7060ffe569f6080ddf7a7b696d8fba17ef2305547250ad5cde88c94f957febfd5c1a788b67d044369ceeb64bdcd8ec631658245eee03acc3de7fd4649060fde28c424f5e9f4f7f2013773a208c2faa4212e8c38685fc3773f04466329beca3ebd6ccf4a162fc1e5481fe537649c61c44e784c93db71036417dd96271cd21811178af52aa76b5b69342710c935707f792be532a346e47ffe576999f7ccd065eb1e439768cce2908a600d9e62148f4", 0x1000}], 0x1}}, {{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000180)="8b", 0x1}], 0x1}}], 0x2, 0x4001) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r4, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000c54000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000240)=0x40) r6 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r6, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)={0x14, r7, 0x321, 0x70bd29, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4c811}, 0x4) recvmmsg(r8, &(0x7f00000001c0)=[{{0x0, 0x0, &(0x7f0000001bc0)}, 0x8}], 0x1, 0x180, 0x0) sendmmsg$inet6(r2, 0x0, 0x0, 0x200880d8) dup3(r1, r0, 0x0) 9.229427ms ago: executing program 4 (id=852): r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000180), 0x20802, 0x0) add_key$keyring(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xfffffffffffffffe) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049ee) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) get_mempolicy(0x0, 0x0, 0x2, &(0x7f0000240000/0x1000)=nil, 0x3) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) openat$vnet(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) close(0x3) socket(0x2, 0x80805, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f00000001c0)=@req3={0x2906e7e9, 0x7, 0x4, 0x7, 0x4, 0x3, 0x400}, 0x1c) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1c, &(0x7f0000000300)=[@in6={0xa, 0x4e24, 0x7e8, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4}]}, &(0x7f0000000140)=0x10) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000000)="cfe9ef6d6ee1d433ba73a5ddf753c74ac91bc34a934afacb0751028db60a", 0x1e}], 0x1) 0s ago: executing program 3 (id=853): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000003c0)=0x11) r1 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000000), 0x121383, 0x0) r2 = syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) tkill(r2, 0x13) r3 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r3, &(0x7f0000000100)=@name={0x1e, 0x2, 0x2, {{0x42}, 0x4}}, 0xf) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000140)={0x42, 0x3}, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$SEG6(&(0x7f0000002040), r4) sendmsg$SEG6_CMD_SETHMAC(r4, &(0x7f0000002140)={0x0, 0x0, &(0x7f0000002100)={&(0x7f0000000080)=ANY=[@ANYBLOB="d000"/12, @ANYRES16=r5, @ANYBLOB="010029bd7000fddbdf25010000000800030007000000080004000400000005000500030000000500060001000000"], 0x34}, 0x1, 0x4000000000000000, 0x0, 0x882}, 0x0) bind$tipc(r3, 0x0, 0x0) close(r3) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, @flow_dissector, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x94) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000004a00), r6) sendmsg$NL802154_CMD_GET_WPAN_PHY(r6, &(0x7f0000004b00)={0x0, 0x0, &(0x7f0000004ac0)={&(0x7f0000004a80)={0x1c, r7, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40480c0}, 0x20048004) r8 = socket(0x10, 0x803, 0x0) ptrace$ARCH_GET_CPUID(0x1e, r2, 0x0, 0x1011) r9 = socket(0x1, 0x803, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=ANY=[@ANYBLOB="340000001400b59527bd7000fcdbdf250a400000", @ANYRES32=r10, @ANYBLOB="140002"], 0x34}}, 0x0) tkill(r2, 0x12) waitid(0x1, r2, 0x0, 0x40000000, &(0x7f00000003c0)) ioctl$SNDCTL_TMR_TIMEBASE(r1, 0xc0045401, &(0x7f0000000040)=0x262) read$FUSE(r0, 0x0, 0x0) kernel console output (not intermixed with test programs): this program [ 259.929167][ T7969] input: syz1 as /devices/virtual/input/input44 [ 259.948077][ T7972] sch_tbf: peakrate 9002274071266264692 is lower than or equals to rate 14180566848366662437 ! [ 260.932108][ T7979] netlink: 'syz.4.555': attribute type 1 has an invalid length. [ 260.999088][ T7980] netlink: 8 bytes leftover after parsing attributes in process `syz.4.555'. [ 261.046530][ T7980] netlink: 8 bytes leftover after parsing attributes in process `syz.4.555'. [ 263.093478][ T10] block nbd0: Possible stuck request ffff888028857000: control (read@0,4096B). Runtime 150 seconds [ 263.139427][ T7979] 8021q: adding VLAN 0 to HW filter on device bond2 [ 263.177751][ T5719] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 263.981036][ T7992] comedi comedi3: pcmmio: I/O port conflict (0x80,32) [ 264.472485][ T5738] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 264.836584][ T5738] usb 4-1: Using ep0 maxpacket: 32 [ 264.922410][ T8005] netlink: 12 bytes leftover after parsing attributes in process `syz.1.562'. [ 265.071560][ T5738] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 265.102995][ T8004] netlink: 36 bytes leftover after parsing attributes in process `syz.1.562'. [ 265.112088][ T8004] netlink: 36 bytes leftover after parsing attributes in process `syz.1.562'. [ 265.136272][ T5738] usb 4-1: New USB device found, idVendor=056a, idProduct=0309, bcdDevice= 0.00 [ 265.152068][ T5738] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 265.190644][ T5738] usb 4-1: config 0 descriptor?? [ 265.336937][ T8010] comedi comedi3: pcmmio: I/O port conflict (0x80,32) [ 265.375702][ T8009] ======================================================= [ 265.375702][ T8009] WARNING: The mand mount option has been deprecated and [ 265.375702][ T8009] and is ignored by this kernel. Remove the mand [ 265.375702][ T8009] option from the mount to silence this warning. [ 265.375702][ T8009] ======================================================= [ 265.424481][ T30] audit: type=1400 audit(1783248866.586:907): avc: denied { read } for pid=8006 comm="syz.2.563" dev="sockfs" ino=18521 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 265.460540][ T8009] 9p: Bad value for 'wfdno' [ 265.651608][ T5738] hid_parser_main: 31 callbacks suppressed [ 265.651630][ T5738] wacom 0003:056A:0309.0007: unknown main item tag 0x4 [ 265.703536][ T5711] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 265.705881][ T5738] wacom 0003:056A:0309.0007: reserved main item tag 0xd [ 265.765495][ T5738] wacom 0003:056A:0309.0007: unknown main item tag 0x3 [ 265.787582][ T5738] wacom 0003:056A:0309.0007: unknown main item tag 0x3 [ 265.815805][ T5738] wacom 0003:056A:0309.0007: unknown main item tag 0x3 [ 265.839457][ T5738] wacom 0003:056A:0309.0007: unknown main item tag 0x3 [ 265.874211][ T5738] wacom 0003:056A:0309.0007: unknown main item tag 0x3 [ 265.906462][ T5738] wacom 0003:056A:0309.0007: unknown main item tag 0x3 [ 265.913604][ T5711] usb 2-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 265.947137][ T5711] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 265.959887][ T5711] usb 2-1: Product: syz [ 265.974951][ T5711] usb 2-1: Manufacturer: syz [ 265.982811][ T5711] usb 2-1: SerialNumber: syz [ 266.017324][ T5711] usb 2-1: config 0 descriptor?? [ 266.042086][ T5711] gspca_main: sq905c-2.14.0 probing 2770:9052 [ 266.211512][ T5738] usb 4-1: USB disconnect, device number 16 [ 266.293525][ T5711] gspca_sq905c: sq905c_command: usb_control_msg failed (-71) [ 266.334363][ T5711] sq905c 2-1:0.0: Get version command failed [ 266.349745][ T5711] sq905c 2-1:0.0: probe with driver sq905c failed with error -71 [ 266.376634][ T5711] usb 2-1: USB disconnect, device number 16 [ 266.662632][ T804] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 266.844089][ T804] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 266.890278][ T804] usb 3-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 266.966138][ T804] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 267.059913][ T804] usb 3-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 267.177434][ T804] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 267.294396][ T804] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 267.349799][ T8030] netlink: 'syz.3.568': attribute type 1 has an invalid length. [ 267.439255][ T8030] netlink: 'syz.3.568': attribute type 2 has an invalid length. [ 267.491922][ T8033] fuse: Unknown parameter 'ȍǧn\'00000000000000000000' [ 267.524957][ T804] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 267.593414][ T8034] netlink: 'syz.1.570': attribute type 1 has an invalid length. [ 267.608211][ T804] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 267.634025][ T8030] netlink: 200 bytes leftover after parsing attributes in process `syz.3.568'. [ 268.151495][ T804] usb 3-1: Product: syz [ 268.156852][ T804] usb 3-1: Manufacturer: syz [ 268.170717][ T8039] netlink: 8 bytes leftover after parsing attributes in process `syz.1.570'. [ 268.179606][ T8039] netlink: 8 bytes leftover after parsing attributes in process `syz.1.570'. [ 268.200687][ T8024] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 268.209979][ T804] cdc_wdm 3-1:1.0: skipping garbage [ 268.230841][ T804] cdc_wdm 3-1:1.0: skipping garbage [ 268.248415][ T804] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 268.254797][ T804] cdc_wdm 3-1:1.0: Unknown control protocol [ 268.295363][ T8034] 8021q: adding VLAN 0 to HW filter on device bond9 [ 268.452268][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 268.459067][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 268.465332][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 268.471911][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 268.472537][ T5704] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 268.478160][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 268.478181][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 268.478374][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 268.505096][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 268.511951][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 268.518551][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 268.524816][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 268.531407][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 268.538213][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 268.544806][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 268.551399][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 268.557990][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 268.564330][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 268.570919][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 268.577143][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 268.583718][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 268.670637][ T8046] input: syz1 as /devices/virtual/input/input45 [ 268.680699][ T30] audit: type=1400 audit(1783248869.896:908): avc: denied { bind } for pid=8044 comm="syz.5.572" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 268.685107][ T8045] SELinux: policydb magic number 0x9fd35f50 does not match expected magic number 0xf97cff8c [ 268.700149][ T30] audit: type=1400 audit(1783248869.896:909): avc: denied { load_policy } for pid=8044 comm="syz.5.572" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 268.738864][ T8045] SELinux: failed to load policy [ 268.805285][ T30] audit: type=1400 audit(1783248870.026:910): avc: denied { lock } for pid=8048 comm="syz.3.573" path="socket:[18001]" dev="sockfs" ino=18001 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 268.849639][ T30] audit: type=1400 audit(1783248870.056:911): avc: denied { read } for pid=8023 comm="syz.2.566" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 268.851514][ T5704] usb 2-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 268.873185][ T5719] usb 3-1: USB disconnect, device number 21 [ 268.887730][ T8050] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(7) [ 268.894252][ T8050] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 268.939320][ T8050] vhci_hcd vhci_hcd.0: Device attached [ 268.950556][ T8053] vhci_hcd vhci_hcd.0: pdev(3) rhport(1) sockfd(10) [ 268.957169][ T8053] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 268.967610][ T5704] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 268.982790][ T5704] usb 2-1: Product: syz [ 269.010536][ T5704] usb 2-1: Manufacturer: syz [ 269.025126][ T8053] vhci_hcd vhci_hcd.0: Device attached [ 269.026799][ T5704] usb 2-1: SerialNumber: syz [ 269.071298][ T8050] vhci_hcd vhci_hcd.0: pdev(3) rhport(2) sockfd(9) [ 269.077849][ T8050] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 269.087716][ T5704] usb 2-1: config 0 descriptor?? [ 269.098326][ T5704] i2c-tiny-usb 2-1:0.0: version 6d.cc found at bus 002 address 017 [ 269.172799][ T804] usb 39-1: new low-speed USB device number 2 using vhci_hcd [ 269.174789][ T8050] vhci_hcd vhci_hcd.0: Device attached [ 269.524696][ T8062] vhci_hcd vhci_hcd.0: pdev(3) rhport(3) sockfd(12) [ 269.531316][ T8062] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 269.666008][ T8062] vhci_hcd vhci_hcd.0: Device attached [ 269.709797][ T5704] (null): failure reading functionality [ 269.726843][ T5704] i2c i2c-1: failure reading functionality [ 269.745522][ T8058] vhci_hcd: connection closed [ 269.746783][ T6074] vhci_hcd vhci_hcd.3: stop threads [ 269.746955][ T8054] vhci_hcd: connection closed [ 269.758464][ T6074] vhci_hcd vhci_hcd.3: release socket [ 269.762152][ T6074] vhci_hcd vhci_hcd.3: disconnect device [ 269.768447][ T8051] vhci_hcd: connection reset by peer [ 269.786187][ T8064] vhci_hcd: connection closed [ 269.797809][ T6074] vhci_hcd vhci_hcd.3: stop threads [ 269.803150][ T5704] i2c i2c-1: connected i2c-tiny-usb device [ 270.112926][ T5704] usb 2-1: USB disconnect, device number 17 [ 270.162617][ T6074] vhci_hcd vhci_hcd.3: release socket [ 270.201368][ T6074] vhci_hcd vhci_hcd.3: disconnect device [ 270.242576][ T6074] vhci_hcd vhci_hcd.3: stop threads [ 270.268913][ T6074] vhci_hcd vhci_hcd.3: release socket [ 270.291046][ T6074] vhci_hcd vhci_hcd.3: disconnect device [ 270.326496][ T6074] vhci_hcd vhci_hcd.3: stop threads [ 270.347681][ T6074] vhci_hcd vhci_hcd.3: release socket [ 270.371042][ T6074] vhci_hcd vhci_hcd.3: disconnect device [ 270.771323][ T8073] comedi comedi3: pcmmio: I/O port conflict (0x80,32) [ 271.862890][ T8083] FAT-fs (nbd4): unable to read boot sector [ 273.857991][ T5704] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 273.980650][ T8075] syz.5.578 (8075): drop_caches: 2 [ 274.132512][ T5704] usb 5-1: Using ep0 maxpacket: 32 [ 274.309448][ T5704] usb 5-1: unable to get BOS descriptor or descriptor too short [ 274.332654][ T804] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 275.313532][ T5704] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 275.340957][ T5704] usb 5-1: can't read configurations, error -71 [ 275.581265][ T30] audit: type=1400 audit(1783248876.796:912): avc: denied { append } for pid=8103 comm="syz.2.585" name="ptp0" dev="devtmpfs" ino=1266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 275.581536][ T8107] FAULT_INJECTION: forcing a failure. [ 275.581536][ T8107] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 275.644477][ T8107] CPU: 0 UID: 0 PID: 8107 Comm: syz.3.586 Not tainted syzkaller #0 PREEMPT(full) [ 275.644503][ T8107] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 275.644514][ T8107] Call Trace: [ 275.644520][ T8107] [ 275.644527][ T8107] dump_stack_lvl+0x100/0x190 [ 275.644555][ T8107] should_fail_ex.cold+0x5/0xa [ 275.644578][ T8107] _copy_from_user+0x2e/0xd0 [ 275.644601][ T8107] __keyctl_dh_compute+0x1b6/0x10d0 [ 275.644628][ T8107] ? find_held_lock+0x2b/0x80 [ 275.644654][ T8107] ? get_pid_task+0xfc/0x250 [ 275.644679][ T8107] ? get_pid_task+0xfc/0x250 [ 275.644706][ T8107] ? __pfx___keyctl_dh_compute+0x10/0x10 [ 275.644736][ T8107] ? proc_fail_nth_write+0x9f/0x220 [ 275.644770][ T8107] ? rcu_read_lock_any_held+0x6a/0xa0 [ 275.644797][ T8107] ? find_held_lock+0x2b/0x80 [ 275.644821][ T8107] ? ksys_write+0x190/0x250 [ 275.644852][ T8107] ? __mutex_unlock_slowpath+0x35d/0x930 [ 275.644886][ T8107] keyctl_dh_compute+0xd9/0x140 [ 275.644911][ T8107] ? __pfx_keyctl_dh_compute+0x10/0x10 [ 275.644950][ T8107] __do_sys_keyctl+0x464/0x5a0 [ 275.644971][ T8107] do_syscall_64+0x115/0x870 [ 275.644993][ T8107] ? clear_bhb_loop+0x40/0x90 [ 275.645015][ T8107] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 275.645033][ T8107] RIP: 0033:0x7f0e6db9de59 [ 275.645048][ T8107] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 275.645066][ T8107] RSP: 002b:00007f0e6eb17028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 275.645084][ T8107] RAX: ffffffffffffffda RBX: 00007f0e6de25fa0 RCX: 00007f0e6db9de59 [ 275.645096][ T8107] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 0000000000000017 [ 275.645107][ T8107] RBP: 00007f0e6eb17090 R08: 0000000000000000 R09: 0000000000000000 [ 275.645118][ T8107] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 275.645129][ T8107] R13: 00007f0e6de26038 R14: 00007f0e6de25fa0 R15: 00007ffee5322ee8 [ 275.645153][ T8107] [ 275.657095][ T8108] comedi comedi3: pcmmio: I/O port conflict (0x80,32) [ 275.991185][ T8114] futex_wake_op: syz.3.588 tries to shift op by -1; fix this program [ 276.922748][ T5704] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 277.314705][ T5704] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 277.389745][ T5704] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 277.436924][ T5704] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 277.524259][ T5704] usb 5-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 277.558104][ T5704] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 277.568131][ T5704] usb 5-1: Product: syz [ 277.574551][ T5704] usb 5-1: Manufacturer: syz [ 277.582782][ T5704] usb 5-1: SerialNumber: syz [ 277.606440][ T5704] usb 5-1: config 0 descriptor?? [ 277.612737][ T8112] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 277.627789][ T804] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 277.640013][ T8112] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 277.662794][ T5704] usb 5-1: ucan: probing device on interface #0 [ 277.697410][ T8125] input: syz1 as /devices/virtual/input/input46 [ 277.797731][ T804] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 277.810513][ T804] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 277.821794][ T804] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 277.836213][ T804] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 277.847037][ T804] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 277.871371][ T804] usb 2-1: config 0 descriptor?? [ 277.918631][ T8112] 9pnet_fd: Insufficient options for proto=fd [ 277.936149][ T8112] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 277.959556][ T8112] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 277.976570][ T5704] usb 5-1: ucan: could not read protocol version, ret=0 [ 277.992106][ T5704] usb 5-1: ucan: probe failed; try to update the device firmware [ 278.159280][ T8129] FAT-fs (nbd5): unable to read boot sector [ 278.985068][ T5738] usb 5-1: USB disconnect, device number 32 [ 279.047488][ T804] plantronics 0003:047F:FFFF.0008: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 279.424894][ T30] audit: type=1400 audit(1783248880.606:913): avc: denied { ioctl } for pid=8131 comm="syz.5.592" path="socket:[18678]" dev="sockfs" ino=18678 ioctlcmd=0x5865 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 280.162310][ T8143] netlink: 68 bytes leftover after parsing attributes in process `syz.4.594'. [ 280.396374][ T5738] usb 2-1: USB disconnect, device number 18 [ 280.619673][ T8152] FAULT_INJECTION: forcing a failure. [ 280.619673][ T8152] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 280.633145][ T8152] CPU: 1 UID: 0 PID: 8152 Comm: syz.3.596 Not tainted syzkaller #0 PREEMPT(full) [ 280.633169][ T8152] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 280.633180][ T8152] Call Trace: [ 280.633186][ T8152] [ 280.633193][ T8152] dump_stack_lvl+0x100/0x190 [ 280.633221][ T8152] should_fail_ex.cold+0x5/0xa [ 280.633243][ T8152] _copy_from_user+0x2e/0xd0 [ 280.633263][ T8152] copy_msghdr_from_user+0x9f/0x4c0 [ 280.633288][ T8152] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 280.633323][ T8152] ___sys_sendmsg+0x106/0x1e0 [ 280.633347][ T8152] ? __pfx____sys_sendmsg+0x10/0x10 [ 280.633368][ T8152] ? __lock_acquire+0x49f/0x1a40 [ 280.633388][ T8152] ? get_pid_task+0x106/0x250 [ 280.633439][ T8152] __sys_sendmsg+0x160/0x210 [ 280.633457][ T8152] ? __pfx___sys_sendmsg+0x10/0x10 [ 280.633487][ T8152] do_syscall_64+0x115/0x870 [ 280.633511][ T8152] ? clear_bhb_loop+0x40/0x90 [ 280.633533][ T8152] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 280.633551][ T8152] RIP: 0033:0x7f0e6db9de59 [ 280.633564][ T8152] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 280.633581][ T8152] RSP: 002b:00007f0e6ead5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 280.633598][ T8152] RAX: ffffffffffffffda RBX: 00007f0e6de26180 RCX: 00007f0e6db9de59 [ 280.633609][ T8152] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000009 [ 280.633619][ T8152] RBP: 00007f0e6ead5090 R08: 0000000000000000 R09: 0000000000000000 [ 280.633630][ T8152] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 280.633640][ T8152] R13: 00007f0e6de26218 R14: 00007f0e6de26180 R15: 00007ffee5322ee8 [ 280.633663][ T8152] [ 281.312778][ T8156] netlink: 8 bytes leftover after parsing attributes in process `syz.5.595'. [ 281.322840][ T8156] netlink: 8 bytes leftover after parsing attributes in process `syz.5.595'. [ 282.172437][ T30] audit: type=1400 audit(1783248883.296:914): avc: denied { mount } for pid=8162 comm="syz.1.599" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 282.724422][ T8169] futex_wake_op: syz.5.600 tries to shift op by -1; fix this program [ 282.810062][ T30] audit: type=1400 audit(1783248884.026:915): avc: denied { unmount } for pid=5606 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 283.462872][ T8171] netlink: 'syz.1.601': attribute type 1 has an invalid length. [ 283.598079][ T8175] netlink: 8 bytes leftover after parsing attributes in process `syz.1.601'. [ 283.628734][ T8171] 8021q: adding VLAN 0 to HW filter on device bond10 [ 283.650093][ T8175] netlink: 8 bytes leftover after parsing attributes in process `syz.1.601'. [ 283.912489][ T5738] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 285.072317][ T5738] usb 2-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 285.120006][ T5738] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 285.152003][ T5738] usb 2-1: Product: syz [ 285.156966][ T5738] usb 2-1: Manufacturer: syz [ 285.162063][ T5738] usb 2-1: SerialNumber: syz [ 285.328803][ T5738] usb 2-1: config 0 descriptor?? [ 285.357614][ T5738] i2c-tiny-usb 2-1:0.0: version 6d.cc found at bus 002 address 019 [ 285.451166][ T8192] kernel profiling enabled (shift: 9) [ 286.260893][ T5738] (null): error -EIO: failure setting delay to 10us [ 286.292653][ T5738] i2c-tiny-usb 2-1:0.0: probe with driver i2c-tiny-usb failed with error -5 [ 286.340693][ T5738] usb 2-1: USB disconnect, device number 19 [ 286.532590][ T5719] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 286.548406][ T76] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 286.627081][ T8205] FAULT_INJECTION: forcing a failure. [ 286.627081][ T8205] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 286.648904][ T8205] CPU: 1 UID: 0 PID: 8205 Comm: syz.5.610 Not tainted syzkaller #0 PREEMPT(full) [ 286.648934][ T8205] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 286.648945][ T8205] Call Trace: [ 286.648950][ T8205] [ 286.648957][ T8205] dump_stack_lvl+0x100/0x190 [ 286.648983][ T8205] should_fail_ex.cold+0x5/0xa [ 286.649004][ T8205] _copy_from_user+0x2e/0xd0 [ 286.649024][ T8205] get_bitmap+0xde/0x1a0 [ 286.649044][ T8205] get_nodes+0x1df/0x210 [ 286.649062][ T8205] ? __pfx_get_nodes+0x10/0x10 [ 286.649078][ T8205] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 286.649106][ T8205] ? __fget_files+0x21f/0x3d0 [ 286.649135][ T8205] kernel_migrate_pages+0x8e/0x700 [ 286.649156][ T8205] ? __pfx_kernel_migrate_pages+0x10/0x10 [ 286.649177][ T8205] ? __pfx_ksys_write+0x10/0x10 [ 286.649204][ T8205] __x64_sys_migrate_pages+0x96/0x100 [ 286.649225][ T8205] ? lockdep_hardirqs_on+0x78/0x100 [ 286.649247][ T8205] do_syscall_64+0x115/0x870 [ 286.649268][ T8205] ? clear_bhb_loop+0x40/0x90 [ 286.649289][ T8205] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 286.649305][ T8205] RIP: 0033:0x7f1481d9de59 [ 286.649319][ T8205] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 286.649335][ T8205] RSP: 002b:00007f1482b7e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000100 [ 286.649351][ T8205] RAX: ffffffffffffffda RBX: 00007f1482025fa0 RCX: 00007f1481d9de59 [ 286.649362][ T8205] RDX: 0000200000000040 RSI: 0000000000000005 RDI: 0000000000000000 [ 286.649371][ T8205] RBP: 00007f1482b7e090 R08: 0000000000000000 R09: 0000000000000000 [ 286.649380][ T8205] R10: 00002000000009c0 R11: 0000000000000246 R12: 0000000000000001 [ 286.649390][ T8205] R13: 00007f1482026038 R14: 00007f1482025fa0 R15: 00007ffe2ec8c918 [ 286.649413][ T8205] [ 286.853876][ T5719] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 286.865855][ T5719] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 286.877288][ T5719] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 286.890376][ T5719] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 286.900901][ T5719] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 286.915052][ T5719] usb 4-1: config 0 descriptor?? [ 286.987641][ T30] audit: type=1400 audit(1783248888.206:916): avc: denied { write } for pid=8207 comm="syz.1.611" name="mice" dev="devtmpfs" ino=917 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 287.091121][ T30] audit: type=1400 audit(1783248888.236:917): avc: denied { ioctl } for pid=8207 comm="syz.1.611" path="/dev/input/mice" dev="devtmpfs" ino=917 ioctlcmd=0x5883 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 287.372802][ T5719] plantronics 0003:047F:FFFF.0009: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 287.639461][ T8220] netlink: 'syz.4.614': attribute type 1 has an invalid length. [ 287.712223][ T8223] netlink: 8 bytes leftover after parsing attributes in process `syz.4.614'. [ 287.766151][ T8223] netlink: 8 bytes leftover after parsing attributes in process `syz.4.614'. [ 287.800413][ T8220] 8021q: adding VLAN 0 to HW filter on device bond3 [ 288.032729][ T5719] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 288.207441][ T5719] usb 5-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 288.251327][ T5719] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 288.299440][ T5719] usb 5-1: Product: syz [ 288.313153][ T5719] usb 5-1: Manufacturer: syz [ 288.319224][ T5719] usb 5-1: SerialNumber: syz [ 288.337365][ T5719] usb 5-1: config 0 descriptor?? [ 288.352183][ T5719] i2c-tiny-usb 5-1:0.0: version 6d.cc found at bus 005 address 033 [ 288.534176][ T8226] netlink: 12 bytes leftover after parsing attributes in process `syz.5.616'. [ 288.801610][ T5719] (null): failure reading functionality [ 288.825786][ T5719] i2c i2c-1: failure reading functionality [ 288.858764][ T5719] i2c i2c-1: connected i2c-tiny-usb device [ 288.878036][ T5719] usb 5-1: USB disconnect, device number 33 [ 288.892518][ T804] usb 4-1: reset high-speed USB device number 17 using dummy_hcd [ 288.973521][ T5738] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 289.132428][ T5738] usb 6-1: Using ep0 maxpacket: 8 [ 289.147745][ T5738] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 289.161547][ T5738] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 289.184806][ T5738] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 289.242970][ T5738] usb 6-1: config 0 descriptor?? [ 289.509672][ T5738] iowarrior 6-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior1 [ 289.610182][ T8241] netlink: 'syz.4.619': attribute type 1 has an invalid length. [ 289.667715][ T8245] netlink: 8 bytes leftover after parsing attributes in process `syz.4.619'. [ 289.681249][ T8241] 8021q: adding VLAN 0 to HW filter on device bond4 [ 289.706732][ T8245] netlink: 8 bytes leftover after parsing attributes in process `syz.4.619'. [ 290.078931][ T29] usb 4-1: USB disconnect, device number 17 [ 290.348426][ T5711] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 290.518506][ T5711] usb 5-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 290.548639][ T5711] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 290.579091][ T5711] usb 5-1: Product: syz [ 290.594190][ T5711] usb 5-1: Manufacturer: syz [ 290.605772][ T5711] usb 5-1: SerialNumber: syz [ 290.627586][ T5711] usb 5-1: config 0 descriptor?? [ 290.647882][ T5711] i2c-tiny-usb 5-1:0.0: version 6d.cc found at bus 005 address 034 [ 291.828986][ T5711] (null): error -EIO: failure setting delay to 10us [ 292.391124][ T8255] FAT-fs (nbd1): unable to read boot sector [ 292.867458][ T5711] i2c-tiny-usb 5-1:0.0: probe with driver i2c-tiny-usb failed with error -5 [ 293.624382][ T10] block nbd0: Possible stuck request ffff888028857000: control (read@0,4096B). Runtime 180 seconds [ 293.671069][ T5808] usb 6-1: USB disconnect, device number 6 [ 293.677963][ T5711] usb 5-1: USB disconnect, device number 34 [ 293.710601][ T5622] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 293.730714][ T5622] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 293.741205][ T5622] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 293.748900][ T5704] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 293.769686][ T5622] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 293.779267][ T5622] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 293.939775][ T8267] netlink: 'syz.5.626': attribute type 1 has an invalid length. [ 294.004263][ T8275] netlink: 8 bytes leftover after parsing attributes in process `syz.5.626'. [ 294.070361][ T8275] netlink: 8 bytes leftover after parsing attributes in process `syz.5.626'. [ 294.111068][ T8267] 8021q: adding VLAN 0 to HW filter on device bond1 [ 294.342688][ T804] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 294.383889][ T29] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 294.517224][ T804] usb 6-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 294.542442][ T804] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 294.554293][ T29] usb 5-1: too many configurations: 36, using maximum allowed: 8 [ 294.571224][ T804] usb 6-1: Product: syz [ 294.579326][ T804] usb 6-1: Manufacturer: syz [ 294.592953][ T804] usb 6-1: SerialNumber: syz [ 294.608474][ T804] usb 6-1: config 0 descriptor?? [ 294.627961][ T804] i2c-tiny-usb 6-1:0.0: version 6d.cc found at bus 006 address 007 [ 294.651431][ T29] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 294.661577][ T29] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 294.676285][ T29] usb 5-1: Product: syz [ 294.686933][ T29] usb 5-1: Manufacturer: syz [ 294.694743][ T29] usb 5-1: SerialNumber: syz [ 294.720593][ T29] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 294.746698][ T24] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 294.786827][ T8259] bridge0: port 1(bridge_slave_0) entered blocking state [ 294.834373][ T8259] bridge0: port 1(bridge_slave_0) entered disabled state [ 294.872748][ T8259] bridge_slave_0: entered allmulticast mode [ 294.886896][ T8297] input: syz1 as /devices/virtual/input/input49 [ 294.917417][ T8259] bridge_slave_0: entered promiscuous mode [ 294.980787][ T8259] bridge0: port 2(bridge_slave_1) entered blocking state [ 295.030863][ T8259] bridge0: port 2(bridge_slave_1) entered disabled state [ 295.092023][ T8259] bridge_slave_1: entered allmulticast mode [ 295.115704][ T804] (null): failure reading functionality [ 295.307213][ T8259] bridge_slave_1: entered promiscuous mode [ 295.317864][ T804] i2c i2c-1: failure reading functionality [ 295.333267][ T8280] random: crng reseeded on system resumption [ 295.977914][ T5618] Bluetooth: hci6: command tx timeout [ 295.985756][ T24] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 296.053153][ T24] ath9k_htc: Failed to initialize the device [ 296.196895][ T804] i2c i2c-1: connected i2c-tiny-usb device [ 296.206087][ T24] usb 5-1: ath9k_htc: USB layer deinitialized [ 296.232910][ T804] usb 6-1: USB disconnect, device number 7 [ 296.568418][ T8259] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 296.632320][ T8259] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 296.712693][ T8311] Cannot find add_set index 0 as target [ 297.130631][ T8259] team0: Port device team_slave_0 added [ 297.166460][ T8259] team0: Port device team_slave_1 added [ 297.207943][ T5719] usb 5-1: USB disconnect, device number 35 [ 297.439572][ T8259] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 297.469748][ T8259] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 297.503637][ T8259] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 297.801988][ T8320] comedi comedi3: pcmmio: I/O port conflict (0x80,32) [ 297.886386][ T8259] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 297.909014][ T8259] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 298.022589][ T5618] Bluetooth: hci6: command tx timeout [ 298.037556][ T8259] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 298.130974][ T8331] FAULT_INJECTION: forcing a failure. [ 298.130974][ T8331] name failslab, interval 1, probability 0, space 0, times 0 [ 298.162786][ T8331] CPU: 1 UID: 0 PID: 8331 Comm: syz.5.636 Not tainted syzkaller #0 PREEMPT(full) [ 298.162812][ T8331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 298.162823][ T8331] Call Trace: [ 298.162829][ T8331] [ 298.162835][ T8331] dump_stack_lvl+0x100/0x190 [ 298.162862][ T8331] should_fail_ex.cold+0x5/0xa [ 298.162884][ T8331] should_failslab+0xc2/0x120 [ 298.162904][ T8331] __kmalloc_noprof+0xfc/0x820 [ 298.162923][ T8331] ? bpf_test_init.isra.0+0x88/0x100 [ 298.162947][ T8331] bpf_test_init.isra.0+0x88/0x100 [ 298.162970][ T8331] bpf_prog_test_run_xdp+0x57e/0x1670 [ 298.163001][ T8331] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 298.163031][ T8331] ? fput+0x79/0x100 [ 298.163050][ T8331] ? __bpf_prog_get+0x97/0x2a0 [ 298.163070][ T8331] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 298.163093][ T8331] __sys_bpf+0x2a12/0x4e80 [ 298.163126][ T8331] ? __pfx___sys_bpf+0x10/0x10 [ 298.163152][ T8331] ? find_held_lock+0x2b/0x80 [ 298.163175][ T8331] ? get_pid_task+0xfc/0x250 [ 298.163199][ T8331] ? get_pid_task+0xfc/0x250 [ 298.163231][ T8331] ? find_held_lock+0x2b/0x80 [ 298.163261][ T8331] ? rcu_read_lock_any_held+0x6a/0xa0 [ 298.163287][ T8331] ? find_held_lock+0x2b/0x80 [ 298.163310][ T8331] ? ksys_write+0x190/0x250 [ 298.163332][ T8331] ? ksys_write+0x190/0x250 [ 298.163374][ T8331] ? fput+0x79/0x100 [ 298.163395][ T8331] ? __x64_sys_bpf+0xce/0x140 [ 298.163420][ T8331] __x64_sys_bpf+0xce/0x140 [ 298.163454][ T8331] ? do_syscall_64+0x90/0x870 [ 298.163478][ T8331] do_syscall_64+0x115/0x870 [ 298.163499][ T8331] ? clear_bhb_loop+0x40/0x90 [ 298.163518][ T8331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 298.163535][ T8331] RIP: 0033:0x7f1481d9de59 [ 298.163549][ T8331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 298.163565][ T8331] RSP: 002b:00007f1482b7e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 298.163582][ T8331] RAX: ffffffffffffffda RBX: 00007f1482025fa0 RCX: 00007f1481d9de59 [ 298.163592][ T8331] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 298.163603][ T8331] RBP: 00007f1482b7e090 R08: 0000000000000000 R09: 0000000000000000 [ 298.163613][ T8331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 298.163623][ T8331] R13: 00007f1482026038 R14: 00007f1482025fa0 R15: 00007ffe2ec8c918 [ 298.163646][ T8331] [ 298.433452][ T8259] hsr_slave_0: entered promiscuous mode [ 298.439804][ T8259] hsr_slave_1: entered promiscuous mode [ 298.445935][ T8259] debugfs: 'hsr0' already exists in 'hsr' [ 298.451647][ T8259] Cannot create hsr debugfs directory [ 298.537527][ T8317] netlink: 13284 bytes leftover after parsing attributes in process `syz.1.633'. [ 298.551761][ T8334] FAULT_INJECTION: forcing a failure. [ 298.551761][ T8334] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 298.628993][ T8338] FAULT_INJECTION: forcing a failure. [ 298.628993][ T8338] name failslab, interval 1, probability 0, space 0, times 0 [ 298.651515][ T8334] CPU: 0 UID: 0 PID: 8334 Comm: syz.3.637 Not tainted syzkaller #0 PREEMPT(full) [ 298.651532][ T8334] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 298.651538][ T8334] Call Trace: [ 298.651542][ T8334] [ 298.651546][ T8334] dump_stack_lvl+0x100/0x190 [ 298.651563][ T8334] should_fail_ex.cold+0x5/0xa [ 298.651577][ T8334] _copy_from_iter+0x1f4/0x1690 [ 298.651593][ T8334] ? __pfx__copy_from_iter+0x10/0x10 [ 298.651605][ T8334] ? trace_kmalloc+0xeb/0x110 [ 298.651617][ T8334] ? __kasan_kmalloc+0xaa/0xb0 [ 298.651628][ T8334] ? __kmalloc_noprof+0x343/0x820 [ 298.651639][ T8334] ? kernfs_fop_write_iter+0x26a/0x5f0 [ 298.651654][ T8334] kernfs_fop_write_iter+0x186/0x5f0 [ 298.651668][ T8334] vfs_write+0x6ac/0x1050 [ 298.651684][ T8334] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 298.651701][ T8334] ? __pfx_vfs_write+0x10/0x10 [ 298.651738][ T8334] ksys_write+0x12a/0x250 [ 298.651759][ T8334] ? __pfx_ksys_write+0x10/0x10 [ 298.651788][ T8334] do_syscall_64+0x115/0x870 [ 298.651809][ T8334] ? clear_bhb_loop+0x40/0x90 [ 298.651830][ T8334] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 298.651844][ T8334] RIP: 0033:0x7f0e6db9de59 [ 298.651854][ T8334] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 298.651864][ T8334] RSP: 002b:00007f0e6eb17028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 298.651875][ T8334] RAX: ffffffffffffffda RBX: 00007f0e6de25fa0 RCX: 00007f0e6db9de59 [ 298.651882][ T8334] RDX: 0000000000000009 RSI: 0000200000000300 RDI: 0000000000000003 [ 298.651888][ T8334] RBP: 00007f0e6eb17090 R08: 0000000000000000 R09: 0000000000000000 [ 298.651894][ T8334] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 298.651900][ T8334] R13: 00007f0e6de26038 R14: 00007f0e6de25fa0 R15: 00007ffee5322ee8 [ 298.651914][ T8334] [ 298.847903][ T8338] CPU: 0 UID: 0 PID: 8338 Comm: syz.5.638 Not tainted syzkaller #0 PREEMPT(full) [ 298.847928][ T8338] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 298.847938][ T8338] Call Trace: [ 298.847944][ T8338] [ 298.847950][ T8338] dump_stack_lvl+0x100/0x190 [ 298.847975][ T8338] should_fail_ex.cold+0x5/0xa [ 298.847997][ T8338] should_failslab+0xc2/0x120 [ 298.848015][ T8338] __kmalloc_noprof+0xfc/0x820 [ 298.848033][ T8338] ? tomoyo_encode2+0xfb/0x3c0 [ 298.848061][ T8338] tomoyo_encode2+0xfb/0x3c0 [ 298.848086][ T8338] tomoyo_encode+0x29/0x50 [ 298.848107][ T8338] tomoyo_realpath_from_path+0x18c/0x690 [ 298.848135][ T8338] tomoyo_check_open_permission+0x2af/0x3c0 [ 298.848156][ T8338] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 298.848184][ T8338] ? ksys_write+0x190/0x250 [ 298.848208][ T8338] ? ksys_write+0x190/0x250 [ 298.848241][ T8338] ? __fget_files+0x215/0x3d0 [ 298.848275][ T8338] tomoyo_file_fcntl+0x9e/0xc0 [ 298.848293][ T8338] security_file_fcntl+0x9b/0x230 [ 298.848320][ T8338] __x64_sys_fcntl+0x108/0x200 [ 298.848343][ T8338] do_syscall_64+0x115/0x870 [ 298.848366][ T8338] ? clear_bhb_loop+0x40/0x90 [ 298.848388][ T8338] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 298.848406][ T8338] RIP: 0033:0x7f1481d9de59 [ 298.848420][ T8338] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 298.848435][ T8338] RSP: 002b:00007f1482b7e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000048 [ 298.848452][ T8338] RAX: ffffffffffffffda RBX: 00007f1482025fa0 RCX: 00007f1481d9de59 [ 298.848464][ T8338] RDX: 0000000000046800 RSI: 0000000000000004 RDI: 0000000000000003 [ 298.848474][ T8338] RBP: 00007f1482b7e090 R08: 0000000000000000 R09: 0000000000000000 [ 298.848490][ T8338] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 298.848500][ T8338] R13: 00007f1482026038 R14: 00007f1482025fa0 R15: 00007ffe2ec8c918 [ 298.848523][ T8338] [ 298.848540][ T8338] ERROR: Out of memory at tomoyo_realpath_from_path. [ 299.153648][ T8346] loop3: detected capacity change from 0 to 7 [ 299.165450][ T8346] Dev loop3: unable to read RDB block 7 [ 299.171200][ T8346] loop3: unable to read partition table [ 299.176991][ T8346] loop3: partition table beyond EOD, truncated [ 299.192492][ T8346] loop_reread_partitions: partition scan of loop3 (被x ) failed (rc=-5) [ 299.208560][ T8259] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 299.231465][ T8259] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 299.255442][ T8259] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 299.290243][ T8259] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 299.319710][ T8259] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 299.344547][ T8348] FAULT_INJECTION: forcing a failure. [ 299.344547][ T8348] name failslab, interval 1, probability 0, space 0, times 0 [ 299.362167][ T8259] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 299.372492][ T5808] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 299.375656][ T8348] CPU: 1 UID: 0 PID: 8348 Comm: syz.1.643 Not tainted syzkaller #0 PREEMPT(full) [ 299.375677][ T8348] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 299.375687][ T8348] Call Trace: [ 299.375692][ T8348] [ 299.375698][ T8348] dump_stack_lvl+0x100/0x190 [ 299.375721][ T8348] should_fail_ex.cold+0x5/0xa [ 299.375741][ T8348] should_failslab+0xc2/0x120 [ 299.375759][ T8348] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 299.375775][ T8348] ? __alloc_skb+0x5b7/0x710 [ 299.375797][ T8348] ? __alloc_skb+0x140/0x710 [ 299.375822][ T8348] __alloc_skb+0x140/0x710 [ 299.375842][ T8348] ? __alloc_skb+0x5b7/0x710 [ 299.375864][ T8348] ? __pfx___alloc_skb+0x10/0x10 [ 299.375892][ T8348] netlink_alloc_large_skb+0x69/0x150 [ 299.375915][ T8348] netlink_sendmsg+0x680/0xda0 [ 299.375938][ T8348] ? __pfx_netlink_sendmsg+0x10/0x10 [ 299.375957][ T8348] ? __might_fault+0xc0/0x140 [ 299.375986][ T8348] ____sys_sendmsg+0xa4d/0xbe0 [ 299.376003][ T8348] ? __pfx_netlink_sendmsg+0x10/0x10 [ 299.376025][ T8348] ? __pfx_____sys_sendmsg+0x10/0x10 [ 299.376053][ T8348] ___sys_sendmsg+0x190/0x1e0 [ 299.376074][ T8348] ? __pfx____sys_sendmsg+0x10/0x10 [ 299.376092][ T8348] ? __lock_acquire+0x49f/0x1a40 [ 299.376109][ T8348] ? get_pid_task+0x106/0x250 [ 299.376154][ T8348] __sys_sendmsg+0x160/0x210 [ 299.376169][ T8348] ? __pfx___sys_sendmsg+0x10/0x10 [ 299.376196][ T8348] do_syscall_64+0x115/0x870 [ 299.376216][ T8348] ? clear_bhb_loop+0x40/0x90 [ 299.376234][ T8348] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 299.376250][ T8348] RIP: 0033:0x7f456259de59 [ 299.376263][ T8348] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 299.376277][ T8348] RSP: 002b:00007f4563513028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 299.376293][ T8348] RAX: ffffffffffffffda RBX: 00007f4562825fa0 RCX: 00007f456259de59 [ 299.376303][ T8348] RDX: 00000000040080c0 RSI: 0000200000000000 RDI: 0000000000000003 [ 299.376312][ T8348] RBP: 00007f4563513090 R08: 0000000000000000 R09: 0000000000000000 [ 299.376321][ T8348] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 299.376330][ T8348] R13: 00007f4562826038 R14: 00007f4562825fa0 R15: 00007fff7dbe3138 [ 299.376352][ T8348] [ 299.445073][ T8259] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 299.636374][ T5808] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 299.649314][ T5808] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 299.662770][ T5808] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 299.675654][ T5808] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 299.684682][ T5808] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 299.701838][ T5808] usb 6-1: config 0 descriptor?? [ 299.787458][ T8259] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 300.102706][ T5618] Bluetooth: hci6: command tx timeout [ 300.425248][ T8259] 8021q: adding VLAN 0 to HW filter on device bond0 [ 300.529687][ T8259] 8021q: adding VLAN 0 to HW filter on device team0 [ 300.693656][ T5808] plantronics 0003:047F:FFFF.000A: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 300.838385][ T6024] bridge0: port 1(bridge_slave_0) entered blocking state [ 300.845572][ T6024] bridge0: port 1(bridge_slave_0) entered forwarding state [ 300.911519][ T1028] bridge0: port 2(bridge_slave_1) entered blocking state [ 300.918627][ T1028] bridge0: port 2(bridge_slave_1) entered forwarding state [ 300.958663][ T8369] xt_hashlimit: size too large, truncated to 1048576 [ 301.045520][ T5711] usb 6-1: USB disconnect, device number 8 [ 301.214554][ T8370] fido_id[8370]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 301.296716][ T804] kernel read not supported for file 460/task/461/stack (pid: 804 comm: kworker/1:2) [ 301.441527][ T8377] FAULT_INJECTION: forcing a failure. [ 301.441527][ T8377] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 301.482153][ T8377] CPU: 0 UID: 0 PID: 8377 Comm: syz.1.648 Not tainted syzkaller #0 PREEMPT(full) [ 301.482172][ T8377] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 301.482178][ T8377] Call Trace: [ 301.482182][ T8377] [ 301.482186][ T8377] dump_stack_lvl+0x100/0x190 [ 301.482203][ T8377] should_fail_ex.cold+0x5/0xa [ 301.482217][ T8377] _copy_from_user+0x2e/0xd0 [ 301.482230][ T8377] copy_from_sockptr_offset.constprop.0+0x134/0x170 [ 301.482246][ T8377] ? __pfx_copy_from_sockptr_offset.constprop.0+0x10/0x10 [ 301.482263][ T8377] ? __local_bh_enable_ip+0x9e/0x120 [ 301.482279][ T8377] sk_setsockopt+0x3c75/0x5d80 [ 301.482293][ T8377] ? __pfx_sk_setsockopt+0x10/0x10 [ 301.482304][ T8377] ? selinux_netlbl_socket_setsockopt+0x134/0x470 [ 301.482320][ T8377] ? __pfx_selinux_netlbl_socket_setsockopt+0x10/0x10 [ 301.482339][ T8377] ? find_held_lock+0x2b/0x80 [ 301.482354][ T8377] ? __fget_files+0x215/0x3d0 [ 301.482386][ T8377] ? selinux_socket_setsockopt+0x6a/0x80 [ 301.482410][ T8377] do_sock_setsockopt+0x193/0x1d0 [ 301.482432][ T8377] __sys_setsockopt+0x195/0x220 [ 301.482463][ T8377] __x64_sys_setsockopt+0xbd/0x160 [ 301.482486][ T8377] ? do_syscall_64+0x90/0x870 [ 301.482508][ T8377] ? lockdep_hardirqs_on+0x78/0x100 [ 301.482530][ T8377] do_syscall_64+0x115/0x870 [ 301.482551][ T8377] ? clear_bhb_loop+0x40/0x90 [ 301.482572][ T8377] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 301.482590][ T8377] RIP: 0033:0x7f456259de59 [ 301.482606][ T8377] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 301.482623][ T8377] RSP: 002b:00007f4563513028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 301.482640][ T8377] RAX: ffffffffffffffda RBX: 00007f4562825fa0 RCX: 00007f456259de59 [ 301.482651][ T8377] RDX: 0000000000000034 RSI: 0000000000000001 RDI: 0000000000000003 [ 301.482660][ T8377] RBP: 00007f4563513090 R08: 0000000000000004 R09: 0000000000000000 [ 301.482670][ T8377] R10: 00002000000000c0 R11: 0000000000000246 R12: 0000000000000001 [ 301.482680][ T8377] R13: 00007f4562826038 R14: 00007f4562825fa0 R15: 00007fff7dbe3138 [ 301.482705][ T8377] [ 301.903278][ T30] audit: type=1400 audit(1783248903.116:918): avc: denied { remount } for pid=8379 comm="syz.3.649" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 301.934598][ T8384] binder: Binderfs stats mode cannot be changed during a remount [ 302.184069][ T5618] Bluetooth: hci6: command tx timeout [ 302.577021][ T8401] FAULT_INJECTION: forcing a failure. [ 302.577021][ T8401] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 302.606858][ T8401] CPU: 1 UID: 0 PID: 8401 Comm: syz.5.654 Not tainted syzkaller #0 PREEMPT(full) [ 302.606881][ T8401] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 302.606890][ T8401] Call Trace: [ 302.606895][ T8401] [ 302.606901][ T8401] dump_stack_lvl+0x100/0x190 [ 302.606926][ T8401] should_fail_ex.cold+0x5/0xa [ 302.606949][ T8401] _copy_from_iter+0x1f4/0x1690 [ 302.606975][ T8401] ? __pfx__copy_from_iter+0x10/0x10 [ 302.607003][ T8401] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 302.607032][ T8401] copy_page_from_iter+0x238/0x300 [ 302.607055][ T8401] tun_build_skb.constprop.0+0x2ea/0x18f0 [ 302.607089][ T8401] ? __pfx_tun_build_skb.constprop.0+0x10/0x10 [ 302.607112][ T8401] ? unwind_get_return_address+0x59/0xa0 [ 302.607138][ T8401] ? arch_stack_walk+0xa6/0xf0 [ 302.607176][ T8401] ? _kstrtoull+0x13c/0x1f0 [ 302.607197][ T8401] ? __pfx__kstrtoull+0x10/0x10 [ 302.607223][ T8401] tun_get_user+0x16d6/0x3c20 [ 302.607256][ T8401] ? __pfx_tun_get_user+0x10/0x10 [ 302.607282][ T8401] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 302.607313][ T8401] ? find_held_lock+0x2b/0x80 [ 302.607337][ T8401] ? tun_get+0x191/0x370 [ 302.607357][ T8401] ? tun_get+0x191/0x370 [ 302.607385][ T8401] tun_chr_write_iter+0xdc/0x200 [ 302.607411][ T8401] vfs_write+0x6ac/0x1050 [ 302.607435][ T8401] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 302.607461][ T8401] ? __pfx_vfs_write+0x10/0x10 [ 302.607482][ T8401] ? find_held_lock+0x2b/0x80 [ 302.607514][ T8401] ksys_write+0x12a/0x250 [ 302.607535][ T8401] ? __pfx_ksys_write+0x10/0x10 [ 302.607564][ T8401] do_syscall_64+0x115/0x870 [ 302.607588][ T8401] ? clear_bhb_loop+0x40/0x90 [ 302.607609][ T8401] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 302.607626][ T8401] RIP: 0033:0x7f1481d5e68e [ 302.607641][ T8401] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 302.607656][ T8401] RSP: 002b:00007f1482b7dfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 302.607673][ T8401] RAX: ffffffffffffffda RBX: 00007f1482b7e6c0 RCX: 00007f1481d5e68e [ 302.607684][ T8401] RDX: 0000000000000019 RSI: 0000200000001bc0 RDI: 00000000000000c8 [ 302.607694][ T8401] RBP: 00007f1482b7e090 R08: 0000000000000000 R09: 0000000000000000 [ 302.607704][ T8401] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 302.607714][ T8401] R13: 00007f1482026038 R14: 00007f1482025fa0 R15: 00007ffe2ec8c918 [ 302.607736][ T8401] [ 304.293282][ T8259] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 305.167824][ T8417] netlink: 'syz.5.658': attribute type 1 has an invalid length. [ 305.235900][ T8424] netlink: 8 bytes leftover after parsing attributes in process `syz.5.658'. [ 305.245874][ T8424] netlink: 8 bytes leftover after parsing attributes in process `syz.5.658'. [ 305.250483][ T8417] 8021q: adding VLAN 0 to HW filter on device bond2 [ 305.542645][ T804] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 305.634538][ T8259] veth0_vlan: entered promiscuous mode [ 305.856383][ T804] usb 6-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 305.867933][ T8259] veth1_vlan: entered promiscuous mode [ 305.875312][ T804] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 305.907849][ T804] usb 6-1: Product: syz [ 305.922020][ T804] usb 6-1: Manufacturer: syz [ 305.941225][ T804] usb 6-1: SerialNumber: syz [ 305.969653][ T8259] veth0_macvtap: entered promiscuous mode [ 305.982602][ T804] usb 6-1: config 0 descriptor?? [ 306.019129][ T804] i2c-tiny-usb 6-1:0.0: version 6d.cc found at bus 006 address 009 [ 306.029199][ T8259] veth1_macvtap: entered promiscuous mode [ 306.108884][ T8259] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 306.144326][ T8259] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 306.210100][ T6024] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 306.224530][ T24] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 306.235437][ T804] (null): error -EIO: failure setting delay to 10us [ 306.243779][ T6024] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 306.273346][ T804] i2c-tiny-usb 6-1:0.0: probe with driver i2c-tiny-usb failed with error -5 [ 306.307652][ T6024] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 306.329540][ T804] usb 6-1: USB disconnect, device number 9 [ 306.352889][ T6024] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 306.428975][ T24] usb 5-1: too many configurations: 36, using maximum allowed: 8 [ 306.483677][ T24] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 306.541123][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 306.582867][ T24] usb 5-1: Product: syz [ 306.599818][ T24] usb 5-1: Manufacturer: syz [ 306.630794][ T24] usb 5-1: SerialNumber: syz [ 306.651094][ T6074] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 306.660988][ T8448] CIFS: bad ip= option (%RHe'ˠ/1C~1WexEAeSb{~R) [ 306.669946][ T6074] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 306.679277][ T24] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 306.696006][ T804] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 307.149076][ T8451] xt_hashlimit: size too large, truncated to 1048576 [ 307.268735][ T1040] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 307.286363][ T8442] random: crng reseeded on system resumption [ 307.328969][ T1040] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 307.839015][ T804] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 307.960387][ T804] ath9k_htc: Failed to initialize the device [ 308.040890][ T804] usb 5-1: ath9k_htc: USB layer deinitialized [ 308.332680][ T5808] usb 5-1: USB disconnect, device number 36 [ 309.081589][ T6074] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 309.116360][ T6074] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 309.200392][ T6074] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 309.261373][ T6074] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 309.344658][ T8487] netlink: 'syz.5.674': attribute type 1 has an invalid length. [ 309.709794][ T8497] comedi comedi3: pcmmio: I/O port conflict (0x80,32) [ 310.399669][ T8487] 8021q: adding VLAN 0 to HW filter on device bond3 [ 310.592651][ T804] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 310.613568][ T8504] futex_wake_op: syz.4.678 tries to shift op by -1; fix this program [ 311.525379][ T804] usb 6-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 311.540755][ T804] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 311.562981][ T1309] ieee802154 phy0 wpan0: encryption failed: -22 [ 311.585365][ T804] usb 6-1: Product: syz [ 311.588039][ T1309] ieee802154 phy1 wpan1: encryption failed: -22 [ 311.613889][ T8508] futex_wake_op: syz.1.679 tries to shift op by -1; fix this program [ 311.622348][ T804] usb 6-1: Manufacturer: syz [ 311.654850][ T804] usb 6-1: SerialNumber: syz [ 311.691310][ T804] usb 6-1: config 0 descriptor?? [ 311.734669][ T804] i2c-tiny-usb 6-1:0.0: version 6d.cc found at bus 006 address 010 [ 312.298776][ T8513] netlink: 12 bytes leftover after parsing attributes in process `syz.4.680'. [ 312.448199][ T8514] Set syz1 is full, maxelem 14 reached [ 312.532992][ T804] (null): failure reading functionality [ 312.548183][ T804] i2c i2c-1: failure reading functionality [ 312.569074][ T804] i2c i2c-1: connected i2c-tiny-usb device [ 312.620712][ T804] usb 6-1: USB disconnect, device number 10 [ 312.890803][ T8522] comedi comedi3: pcmmio: I/O port conflict (0x80,32) [ 313.058342][ T8525] input: syz1 as /devices/virtual/input/input51 [ 313.222893][ T29] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 313.402717][ T29] usb 4-1: too many configurations: 36, using maximum allowed: 8 [ 313.444544][ T29] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 313.453770][ T29] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 313.462346][ T29] usb 4-1: Product: syz [ 313.468303][ T29] usb 4-1: Manufacturer: syz [ 313.544706][ T29] usb 4-1: SerialNumber: syz [ 313.616034][ T29] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 313.674399][ T804] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 313.927086][ T8517] random: crng reseeded on system resumption [ 314.062577][ T29] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 314.155501][ T8545] comedi comedi3: pcmmio: I/O port conflict (0x80,32) [ 314.234737][ T29] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 314.271314][ T29] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 314.288462][ T29] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 314.304359][ T29] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 314.314163][ T29] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 314.559408][ T29] usb 5-1: config 0 descriptor?? [ 315.308234][ T804] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 315.347307][ T804] ath9k_htc: Failed to initialize the device [ 315.419819][ T804] usb 4-1: ath9k_htc: USB layer deinitialized [ 315.503069][ T8554] futex_wake_op: syz.6.690 tries to shift op by -1; fix this program [ 315.900851][ T5719] usb 4-1: USB disconnect, device number 18 [ 316.496789][ T29] plantronics 0003:047F:FFFF.000B: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 316.532129][ T8536] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 316.564115][ T8558] comedi comedi3: pcmmio: I/O port conflict (0x80,32) [ 316.611274][ T8536] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 316.728547][ T8565] FAULT_INJECTION: forcing a failure. [ 316.728547][ T8565] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 316.800776][ T8565] CPU: 1 UID: 0 PID: 8565 Comm: syz.6.693 Not tainted syzkaller #0 PREEMPT(full) [ 316.800803][ T8565] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 316.800813][ T8565] Call Trace: [ 316.800818][ T8565] [ 316.800825][ T8565] dump_stack_lvl+0x100/0x190 [ 316.800851][ T8565] should_fail_ex.cold+0x5/0xa [ 316.800879][ T8565] _copy_from_user+0x2e/0xd0 [ 316.800900][ T8565] __sys_bpf+0x2f5/0x4e80 [ 316.800932][ T8565] ? __pfx___sys_bpf+0x10/0x10 [ 316.800957][ T8565] ? find_held_lock+0x2b/0x80 [ 316.800980][ T8565] ? get_pid_task+0xfc/0x250 [ 316.801004][ T8565] ? get_pid_task+0xfc/0x250 [ 316.801035][ T8565] ? find_held_lock+0x2b/0x80 [ 316.801063][ T8565] ? rcu_read_lock_any_held+0x6a/0xa0 [ 316.801088][ T8565] ? find_held_lock+0x2b/0x80 [ 316.801109][ T8565] ? ksys_write+0x190/0x250 [ 316.801131][ T8565] ? ksys_write+0x190/0x250 [ 316.801170][ T8565] ? fput+0x79/0x100 [ 316.801190][ T8565] ? __x64_sys_bpf+0xce/0x140 [ 316.801215][ T8565] __x64_sys_bpf+0xce/0x140 [ 316.801240][ T8565] ? do_syscall_64+0x90/0x870 [ 316.801264][ T8565] do_syscall_64+0x115/0x870 [ 316.801286][ T8565] ? clear_bhb_loop+0x40/0x90 [ 316.801306][ T8565] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 316.801324][ T8565] RIP: 0033:0x7f569ff9de59 [ 316.801338][ T8565] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 316.801355][ T8565] RSP: 002b:00007f56a0e7e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 316.801372][ T8565] RAX: ffffffffffffffda RBX: 00007f56a0225fa0 RCX: 00007f569ff9de59 [ 316.801384][ T8565] RDX: 0000000000000094 RSI: 0000200000000680 RDI: 0000000000000005 [ 316.801394][ T8565] RBP: 00007f56a0e7e090 R08: 0000000000000000 R09: 0000000000000000 [ 316.801404][ T8565] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 316.801415][ T8565] R13: 00007f56a0226038 R14: 00007f56a0225fa0 R15: 00007ffde9bb8a48 [ 316.801438][ T8565] [ 317.276208][ T30] audit: type=1400 audit(1783248918.496:919): avc: denied { read write } for pid=8568 comm="syz.3.695" name="mtd0" dev="devtmpfs" ino=704 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 317.402969][ T30] audit: type=1400 audit(1783248918.496:920): avc: denied { open } for pid=8568 comm="syz.3.695" path="/dev/mtd0" dev="devtmpfs" ino=704 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 317.508100][ T30] audit: type=1401 audit(1783248918.596:921): op=setxattr invalid_context="system_u:" [ 317.582906][ T8572] FAULT_INJECTION: forcing a failure. [ 317.582906][ T8572] name failslab, interval 1, probability 0, space 0, times 0 [ 317.622526][ T8572] CPU: 0 UID: 0 PID: 8572 Comm: syz.6.696 Not tainted syzkaller #0 PREEMPT(full) [ 317.622552][ T8572] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 317.622562][ T8572] Call Trace: [ 317.622568][ T8572] [ 317.622574][ T8572] dump_stack_lvl+0x100/0x190 [ 317.622600][ T8572] should_fail_ex.cold+0x5/0xa [ 317.622621][ T8572] should_failslab+0xc2/0x120 [ 317.622640][ T8572] __kmalloc_noprof+0xfc/0x820 [ 317.622655][ T8572] ? is_bpf_text_address+0x8a/0x1a0 [ 317.622677][ T8572] ? bpf_test_init.isra.0+0x88/0x100 [ 317.622707][ T8572] bpf_test_init.isra.0+0x88/0x100 [ 317.622732][ T8572] bpf_prog_test_run_skb+0x497/0x3540 [ 317.622765][ T8572] ? find_held_lock+0x2b/0x80 [ 317.622786][ T8572] ? __fget_files+0x211/0x3d0 [ 317.622817][ T8572] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 317.622839][ T8572] ? fput+0x79/0x100 [ 317.622855][ T8572] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 317.622877][ T8572] __sys_bpf+0x2a12/0x4e80 [ 317.622907][ T8572] ? __pfx___sys_bpf+0x10/0x10 [ 317.622930][ T8572] ? find_held_lock+0x2b/0x80 [ 317.622953][ T8572] ? get_pid_task+0xfc/0x250 [ 317.622976][ T8572] ? get_pid_task+0xfc/0x250 [ 317.623005][ T8572] ? find_held_lock+0x2b/0x80 [ 317.623026][ T8572] ? rcu_read_lock_any_held+0x6a/0xa0 [ 317.623043][ T8572] ? find_held_lock+0x2b/0x80 [ 317.623058][ T8572] ? ksys_write+0x190/0x250 [ 317.623076][ T8572] ? ksys_write+0x190/0x250 [ 317.623101][ T8572] ? fput+0x79/0x100 [ 317.623114][ T8572] ? __x64_sys_bpf+0xce/0x140 [ 317.623130][ T8572] __x64_sys_bpf+0xce/0x140 [ 317.623147][ T8572] ? do_syscall_64+0x90/0x870 [ 317.623163][ T8572] do_syscall_64+0x115/0x870 [ 317.623177][ T8572] ? clear_bhb_loop+0x40/0x90 [ 317.623190][ T8572] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 317.623201][ T8572] RIP: 0033:0x7f569ff9de59 [ 317.623213][ T8572] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 317.623225][ T8572] RSP: 002b:00007f56a0e7e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 317.623236][ T8572] RAX: ffffffffffffffda RBX: 00007f56a0225fa0 RCX: 00007f569ff9de59 [ 317.623243][ T8572] RDX: 0000000000000050 RSI: 0000200000000180 RDI: 000000000000000a [ 317.623249][ T8572] RBP: 00007f56a0e7e090 R08: 0000000000000000 R09: 0000000000000000 [ 317.623255][ T8572] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 317.623261][ T8572] R13: 00007f56a0226038 R14: 00007f56a0225fa0 R15: 00007ffde9bb8a48 [ 317.623278][ T8572] [ 317.945457][ T76] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 318.320619][ T9] usb 5-1: USB disconnect, device number 37 [ 318.353205][ T11] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 318.512488][ T11] usb 4-1: Using ep0 maxpacket: 8 [ 318.519839][ T11] usb 4-1: config index 0 descriptor too short (expected 1307, got 27) [ 318.529007][ T11] usb 4-1: config 0 has an invalid interface number: 0 but max is -1 [ 318.556508][ T11] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 318.571210][ T11] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 318.589394][ T11] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 7 [ 318.601789][ T11] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 318.614934][ T11] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 246 [ 318.637862][ T11] usb 4-1: string descriptor 0 read error: -22 [ 318.665133][ T11] usb 4-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 318.692659][ T11] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 318.724442][ T11] usb 4-1: config 0 descriptor?? [ 318.750328][ T11] hub 4-1:0.0: bad descriptor, ignoring hub [ 318.781463][ T11] hub 4-1:0.0: probe with driver hub failed with error -5 [ 318.840338][ T11] input: USB Acecad 302 Tablet 0460:0008 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input53 [ 318.912344][ T8585] netlink: 'syz.4.701': attribute type 1 has an invalid length. [ 318.952455][ T5711] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 318.991835][ T30] audit: type=1400 audit(1783248920.206:922): avc: denied { create } for pid=8584 comm="syz.4.701" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 319.010969][ T11] usb 4-1: USB disconnect, device number 19 [ 319.011901][ T30] audit: type=1400 audit(1783248920.206:923): avc: denied { getopt } for pid=8584 comm="syz.4.701" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 319.031577][ T8589] netlink: 8 bytes leftover after parsing attributes in process `syz.4.701'. [ 319.071845][ T8585] 8021q: adding VLAN 0 to HW filter on device bond5 [ 319.141719][ T8589] netlink: 8 bytes leftover after parsing attributes in process `syz.4.701'. [ 319.175596][ T5711] usb 7-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 319.198061][ T5711] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 319.235403][ T5711] usb 7-1: Product: syz [ 319.251500][ T5711] usb 7-1: Manufacturer: syz [ 319.268009][ T5711] usb 7-1: SerialNumber: syz [ 319.293359][ T5711] usb 7-1: config 0 descriptor?? [ 319.432570][ T5719] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 319.488229][ T5711] gspca_main: sq905c-2.14.0 probing 2770:9052 [ 319.596000][ T5719] usb 5-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 319.621030][ T5719] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 319.657092][ T5719] usb 5-1: Product: syz [ 319.670767][ T5719] usb 5-1: Manufacturer: syz [ 319.720338][ T5719] usb 5-1: SerialNumber: syz [ 319.754923][ T5719] usb 5-1: config 0 descriptor?? [ 319.776070][ T5719] i2c-tiny-usb 5-1:0.0: version 6d.cc found at bus 005 address 038 [ 319.932118][ T5711] gspca_sq905c: sq905c_read: usb_control_msg failed (-71) [ 319.945789][ T5711] sq905c 7-1:0.0: Reading version command failed [ 319.952207][ T5711] sq905c 7-1:0.0: probe with driver sq905c failed with error -71 [ 319.985054][ T5711] usb 7-1: USB disconnect, device number 2 [ 320.028750][ T8597] netlink: 'syz.1.704': attribute type 1 has an invalid length. [ 320.045822][ T5719] (null): error -EIO: failure setting delay to 10us [ 320.050227][ T11] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 320.059956][ T5719] i2c-tiny-usb 5-1:0.0: probe with driver i2c-tiny-usb failed with error -5 [ 320.074039][ T5719] usb 5-1: USB disconnect, device number 38 [ 320.103548][ T8597] 8021q: adding VLAN 0 to HW filter on device bond11 [ 320.154932][ T8599] netlink: 8 bytes leftover after parsing attributes in process `syz.1.704'. [ 320.173407][ T8599] netlink: 8 bytes leftover after parsing attributes in process `syz.1.704'. [ 320.315348][ T11] usb 6-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 320.329869][ T11] usb 6-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 320.342124][ T11] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 320.359554][ T11] usb 6-1: Product: syz [ 320.366953][ T11] usb 6-1: Manufacturer: syz [ 320.371995][ T11] usb 6-1: SerialNumber: syz [ 320.401697][ T11] usb 6-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 320.473292][ T29] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 320.652223][ T29] usb 2-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 320.689437][ T29] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 320.725632][ T29] usb 2-1: Product: syz [ 320.742993][ T29] usb 2-1: Manufacturer: syz [ 320.764853][ T29] usb 2-1: SerialNumber: syz [ 320.790177][ T29] usb 2-1: config 0 descriptor?? [ 320.831204][ T29] i2c-tiny-usb 2-1:0.0: version 6d.cc found at bus 002 address 021 [ 320.831530][ T11] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 320.853479][ T11] dvbdev: DVB: registering new adapter (774 Friio White ISDB-T USB2.0) [ 320.864315][ T11] usb 6-1: media controller created [ 320.877703][ T11] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 320.882005][ T30] audit: type=1400 audit(1783248922.086:924): avc: denied { setattr } for pid=8605 comm="syz.4.706" name="sequencer2" dev="devtmpfs" ino=1286 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sound_device_t tclass=chr_file permissive=1 [ 320.988648][ T8609] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 320.997361][ T8609] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 320.998316][ T8612] netlink: 12 bytes leftover after parsing attributes in process `syz.6.707'. [ 321.275481][ T29] (null): failure reading functionality [ 321.496010][ T8619] comedi comedi3: pcmmio: I/O port conflict (0x80,32) [ 321.535228][ T29] i2c i2c-2: failure reading functionality [ 321.550832][ T30] audit: type=1400 audit(1783248922.766:925): avc: denied { read } for pid=8613 comm="syz.4.708" lport=59234 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 321.580127][ T29] i2c i2c-2: connected i2c-tiny-usb device [ 321.596476][ T29] usb 2-1: USB disconnect, device number 21 [ 321.814505][ T30] audit: type=1400 audit(1783248923.036:926): avc: denied { setopt } for pid=8620 comm="syz.6.710" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 321.845331][ T5719] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 321.984082][ T5719] usb 5-1: device descriptor read/64, error -71 [ 322.118547][ T30] audit: type=1400 audit(1783248923.336:927): avc: denied { name_bind } for pid=8628 comm="syz.1.713" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 322.173654][ T30] audit: type=1400 audit(1783248923.386:928): avc: denied { unmount } for pid=5607 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 322.252851][ T5719] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 322.502479][ T5719] usb 5-1: device descriptor read/64, error -71 [ 322.623705][ T5719] usb usb5-port1: attempt power cycle [ 323.383541][ T11] usb 6-1: USB disconnect, device number 11 [ 323.593619][ T5719] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 323.845091][ T5719] usb 5-1: device descriptor read/8, error -71 [ 323.866787][ T10] block nbd0: Possible stuck request ffff888028857000: control (read@0,4096B). Runtime 210 seconds [ 324.142470][ T9] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 324.163849][ T5719] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 324.215420][ T8652] netlink: 'syz.6.721': attribute type 1 has an invalid length. [ 324.295275][ T9] usb 2-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 324.315486][ T9] usb 2-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 324.396592][ T8658] comedi comedi3: pcmmio: I/O port conflict (0x80,32) [ 324.630420][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 324.638893][ T9] usb 2-1: Product: syz [ 324.645365][ T9] usb 2-1: Manufacturer: syz [ 324.650253][ T9] usb 2-1: SerialNumber: syz [ 324.664776][ T5719] usb 5-1: device not accepting address 42, error -71 [ 324.682500][ T5711] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 324.699882][ T5719] usb usb5-port1: unable to enumerate USB device [ 324.725119][ T9] usb 2-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 324.815812][ T8660] netlink: 'syz.5.724': attribute type 1 has an invalid length. [ 324.837273][ T5711] usb 7-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 324.848138][ T5711] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 324.863481][ T5711] usb 7-1: Product: syz [ 324.863574][ T8660] 8021q: adding VLAN 0 to HW filter on device bond4 [ 324.880293][ T5711] usb 7-1: Manufacturer: syz [ 324.886740][ T5711] usb 7-1: SerialNumber: syz [ 324.891089][ T8660] netlink: 8 bytes leftover after parsing attributes in process `syz.5.724'. [ 324.901299][ T8660] netlink: 8 bytes leftover after parsing attributes in process `syz.5.724'. [ 324.902698][ T5711] usb 7-1: config 0 descriptor?? [ 324.927096][ T5711] i2c-tiny-usb 7-1:0.0: version 6d.cc found at bus 007 address 003 [ 325.128788][ T5711] (null): error -EIO: failure setting delay to 10us [ 325.149368][ T9] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 325.161583][ T5711] i2c-tiny-usb 7-1:0.0: probe with driver i2c-tiny-usb failed with error -5 [ 325.175875][ T9] dvbdev: DVB: registering new adapter (774 Friio White ISDB-T USB2.0) [ 325.187654][ T5711] usb 7-1: USB disconnect, device number 3 [ 325.194738][ T9] usb 2-1: media controller created [ 325.217876][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 325.245705][ T8668] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 325.259363][ T8668] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 325.322097][ T30] audit: type=1400 audit(1783248926.536:929): avc: denied { name_connect } for pid=8666 comm="syz.3.725" dest=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=sctp_socket permissive=1 [ 325.730105][ T30] audit: type=1400 audit(1783248926.946:930): avc: denied { write } for pid=8672 comm="syz.5.726" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 325.755734][ T30] audit: type=1400 audit(1783248926.946:931): avc: denied { open } for pid=8672 comm="syz.5.726" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 325.899512][ T8679] netlink: 'syz.3.728': attribute type 1 has an invalid length. [ 325.925039][ T8679] 8021q: adding VLAN 0 to HW filter on device bond1 [ 325.951074][ T8679] netlink: 8 bytes leftover after parsing attributes in process `syz.3.728'. [ 325.960098][ T8679] netlink: 8 bytes leftover after parsing attributes in process `syz.3.728'. [ 326.072420][ T29] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 326.222589][ T5719] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 326.236433][ T29] usb 7-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 326.245679][ T29] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 326.253796][ T29] usb 7-1: Product: syz [ 326.258058][ T29] usb 7-1: Manufacturer: syz [ 326.262911][ T29] usb 7-1: SerialNumber: syz [ 326.269815][ T29] usb 7-1: config 0 descriptor?? [ 326.285482][ T29] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 326.297308][ T29] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 326.307341][ T29] dvbdev: DVB: registering new adapter (Nebula Electronics uDigiTV DVB-T USB2.0)) [ 326.316881][ T29] usb 7-1: media controller created [ 326.344435][ T29] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 326.389972][ T5719] usb 4-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 326.427240][ T5719] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 326.435394][ T29] DVB: Unable to find symbol mt352_attach() [ 326.452587][ T5719] usb 4-1: Product: syz [ 326.458299][ T5719] usb 4-1: Manufacturer: syz [ 326.475504][ T29] DVB: Unable to find symbol nxt6000_attach() [ 326.481587][ T5719] usb 4-1: SerialNumber: syz [ 326.490238][ T29] dvb-usb: no frontend was attached by 'Nebula Electronics uDigiTV DVB-T USB2.0)' [ 326.523024][ T5719] usb 4-1: config 0 descriptor?? [ 326.550168][ T29] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.6/usb7/7-1/input/input54 [ 326.568677][ T29] dvb-usb: schedule remote query interval to 1000 msecs. [ 326.596992][ T5719] i2c-tiny-usb 4-1:0.0: version 6d.cc found at bus 004 address 020 [ 326.605866][ T29] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) successfully initialized and connected. [ 326.620912][ T29] dvb-usb: bulk message failed: -22 (7/0) [ 326.627296][ T29] dvb-usb: bulk message failed: -22 (7/0) [ 326.807275][ T5719] (null): error -EIO: failure setting delay to 10us [ 326.821980][ T5719] i2c-tiny-usb 4-1:0.0: probe with driver i2c-tiny-usb failed with error -5 [ 326.841362][ T8685] lo speed is unknown, defaulting to 1000 [ 326.847491][ T8685] lo speed is unknown, defaulting to 1000 [ 326.898744][ T8686] netlink: 8 bytes leftover after parsing attributes in process `syz.6.727'. [ 326.925073][ T5719] usb 4-1: USB disconnect, device number 20 [ 327.251158][ T8685] lo speed is unknown, defaulting to 1000 [ 327.271166][ T8687] netlink: 8 bytes leftover after parsing attributes in process `syz.5.729'. [ 327.380262][ T8687] netlink: 4 bytes leftover after parsing attributes in process `syz.5.729'. [ 327.531000][ T8687] netlink: 'syz.5.729': attribute type 15 has an invalid length. [ 327.637167][ T29] dvb-usb: bulk message failed: -22 (7/0) [ 327.725218][ T29] dvb-usb: error while querying for an remote control event. [ 328.191428][ T8687] netlink: 8 bytes leftover after parsing attributes in process `syz.5.729'. [ 328.215709][ T6024] netdevsim netdevsim5 netdevsim0: set [0, 1] type 1 family 0 port 256 - 0 [ 328.274776][ T8687] netlink: 4 bytes leftover after parsing attributes in process `syz.5.729'. [ 328.301231][ T6024] netdevsim netdevsim5 netdevsim1: set [0, 1] type 1 family 0 port 256 - 0 [ 328.370273][ T8687] netlink: 'syz.5.729': attribute type 15 has an invalid length. [ 328.399637][ T6024] netdevsim netdevsim5 netdevsim2: set [0, 1] type 1 family 0 port 256 - 0 [ 328.475864][ T6024] netdevsim netdevsim5 netdevsim3: set [0, 1] type 1 family 0 port 256 - 0 [ 328.502888][ T29] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 328.829086][ T9] usb 2-1: USB disconnect, device number 22 [ 328.837673][ T29] usb 5-1: too many configurations: 36, using maximum allowed: 8 [ 328.885321][ T8685] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 328.949632][ T8695] xt_hashlimit: size too large, truncated to 1048576 [ 328.969449][ T29] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 328.989791][ T8685] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 329.049280][ T29] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 329.057782][ T5738] dvb-usb: bulk message failed: -22 (7/0) [ 329.068822][ T5738] dvb-usb: error while querying for an remote control event. [ 329.092632][ T29] usb 5-1: Product: syz [ 329.095401][ T8685] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 329.111220][ T29] usb 5-1: Manufacturer: syz [ 329.127988][ T8685] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 329.140092][ T8685] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 329.161046][ T29] usb 5-1: SerialNumber: syz [ 329.342205][ T5738] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 329.352650][ T29] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 329.726921][ T8685] lo speed is unknown, defaulting to 1000 [ 329.770958][ T8691] random: crng reseeded on system resumption [ 329.790634][ T8685] lo speed is unknown, defaulting to 1000 [ 329.844461][ T8685] lo speed is unknown, defaulting to 1000 [ 330.033703][ T8685] lo speed is unknown, defaulting to 1000 [ 330.115695][ T29] dvb-usb: bulk message failed: -22 (7/0) [ 330.934535][ T5738] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 331.897283][ T29] dvb-usb: error while querying for an remote control event. [ 331.906267][ T5738] ath9k_htc: Failed to initialize the device [ 331.956714][ T8685] lo speed is unknown, defaulting to 1000 [ 331.972127][ T5719] usb 5-1: USB disconnect, device number 43 [ 332.012306][ T5719] usb 5-1: ath9k_htc: USB layer deinitialized [ 332.124661][ T8685] lo speed is unknown, defaulting to 1000 [ 332.189583][ T8685] lo speed is unknown, defaulting to 1000 [ 332.510986][ T5711] usb 7-1: USB disconnect, device number 4 [ 332.868577][ T8717] 9p: Bad value for 'rfdno' [ 332.989275][ T5711] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0 successfully deinitialized and disconnected. [ 333.222821][ T9] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 334.126033][ T9] usb 5-1: unable to get BOS descriptor or descriptor too short [ 334.250003][ T9] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 334.408954][ T9] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 334.437019][ T8722] comedi comedi3: pcmmio: I/O port conflict (0x80,32) [ 334.493806][ T9] usb 5-1: config 1 has no interface number 1 [ 334.565424][ T9] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 334.612787][ T9] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 334.660612][ T9] usb 5-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 334.690142][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 334.714534][ T9] usb 5-1: Product: syz [ 334.735674][ T9] usb 5-1: Manufacturer: syz [ 334.740938][ T9] usb 5-1: SerialNumber: syz [ 335.012447][ T30] audit: type=1400 audit(1783248936.226:932): avc: denied { listen } for pid=8757 comm="syz.6.741" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 335.381672][ T9] usb 5-1: 2:1 : invalid UAC_AS_GENERAL desc [ 335.486116][ T8766] netlink: 'syz.5.743': attribute type 1 has an invalid length. [ 335.526960][ T8769] input: syz1 as /devices/virtual/input/input55 [ 335.570349][ T9] usb 5-1: USB disconnect, device number 44 [ 335.587197][ T8766] 8021q: adding VLAN 0 to HW filter on device bond5 [ 335.681000][ T6579] udevd[6579]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 335.721204][ T30] audit: type=1400 audit(1783248936.936:933): avc: denied { create } for pid=8771 comm="syz.6.745" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 335.741298][ T30] audit: type=1400 audit(1783248936.936:934): avc: denied { bind } for pid=8771 comm="syz.6.745" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 335.772266][ T30] audit: type=1400 audit(1783248936.986:935): avc: denied { create } for pid=8771 comm="syz.6.745" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 335.792217][ T30] audit: type=1400 audit(1783248936.996:936): avc: denied { sys_admin } for pid=8771 comm="syz.6.745" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 335.883598][ T5738] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 336.067612][ T5738] usb 6-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 336.079585][ T8780] netlink: 'syz.6.748': attribute type 1 has an invalid length. [ 336.099296][ T5738] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 336.108509][ T5738] usb 6-1: Product: syz [ 336.113904][ T5738] usb 6-1: Manufacturer: syz [ 336.118545][ T5738] usb 6-1: SerialNumber: syz [ 336.132848][ T5738] usb 6-1: config 0 descriptor?? [ 336.142178][ T5738] i2c-tiny-usb 6-1:0.0: version 6d.cc found at bus 006 address 012 [ 336.152697][ T8783] netlink: 8 bytes leftover after parsing attributes in process `syz.6.748'. [ 336.161955][ T8783] netlink: 8 bytes leftover after parsing attributes in process `syz.6.748'. [ 336.262147][ T8782] xt_hashlimit: size too large, truncated to 1048576 [ 336.482517][ T9] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 336.641619][ T5738] (null): error -EIO: failure setting delay to 10us [ 336.691343][ T5738] i2c-tiny-usb 6-1:0.0: probe with driver i2c-tiny-usb failed with error -5 [ 336.782010][ T5738] usb 6-1: USB disconnect, device number 12 [ 337.540222][ T9] usb 7-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 337.572705][ T9] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 337.756962][ T9] usb 7-1: Product: syz [ 337.776913][ T9] usb 7-1: Manufacturer: syz [ 337.817723][ T9] usb 7-1: SerialNumber: syz [ 337.845827][ T9] usb 7-1: config 0 descriptor?? [ 337.870750][ T8795] SELinux: security_context_str_to_sid (ramfs) failed with errno=-22 [ 337.903599][ T9] i2c-tiny-usb 7-1:0.0: version 6d.cc found at bus 007 address 005 [ 337.912776][ T30] audit: type=1400 audit(1783248939.126:937): avc: denied { mount } for pid=8794 comm="syz.3.752" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 338.006589][ T8804] netlink: 96 bytes leftover after parsing attributes in process `syz.1.754'. [ 338.272493][ T5808] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 338.336816][ T9] (null): failure reading functionality [ 338.368266][ T9] i2c i2c-1: failure reading functionality [ 338.410211][ T9] i2c i2c-1: connected i2c-tiny-usb device [ 338.426729][ T9] usb 7-1: USB disconnect, device number 5 [ 338.462478][ T5808] usb 6-1: Using ep0 maxpacket: 32 [ 338.482892][ T5808] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 338.517998][ T5808] usb 6-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 338.539164][ T5808] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 338.552824][ T5808] usb 6-1: Product: syz [ 338.558728][ T5808] usb 6-1: Manufacturer: syz [ 338.564597][ T5808] usb 6-1: SerialNumber: syz [ 338.603651][ T5808] usb 6-1: config 0 descriptor?? [ 338.618564][ T5808] quatech2 6-1:0.0: Quatech 2nd gen USB to Serial Driver converter detected [ 338.845744][ T5808] usb 6-1: qt2_setup_urbs - submit read urb failed -8 [ 338.854363][ T5808] quatech2 6-1:0.0: probe with driver quatech2 failed with error -8 [ 339.160664][ T8812] comedi comedi3: pcmmio: I/O port conflict (0x80,32) [ 341.064845][ T24] usb 6-1: USB disconnect, device number 13 [ 341.108271][ T30] audit: type=1400 audit(1783248942.326:938): avc: denied { mount } for pid=8829 comm="syz.4.763" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 341.149963][ T8831] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 341.173061][ T8831] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 341.207945][ T30] audit: type=1400 audit(1783248942.366:939): avc: denied { mounton } for pid=8829 comm="syz.4.763" path="/161/file0" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 341.398810][ T30] audit: type=1400 audit(1783248942.616:940): avc: denied { unmount } for pid=5609 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 341.458803][ T8841] xt_hashlimit: size too large, truncated to 1048576 [ 341.692750][ T5719] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 341.738700][ T8845] netlink: 68 bytes leftover after parsing attributes in process `syz.5.768'. [ 342.012611][ T5719] usb 2-1: Using ep0 maxpacket: 8 [ 342.042717][ T5719] usb 2-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 342.089875][ T5719] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 342.158926][ T5719] pvrusb2: Hardware description: Terratec Grabster AV400 [ 342.209709][ T5719] pvrusb2: ********** [ 342.216034][ T8852] futex_wake_op: syz.5.770 tries to shift op by -1; fix this program [ 342.226175][ T5719] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 342.246159][ T30] audit: type=1400 audit(1783248943.466:941): avc: denied { map } for pid=8851 comm="syz.5.770" path="socket:[20876]" dev="sockfs" ino=20876 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 342.292670][ T5738] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 342.303687][ T5719] pvrusb2: Important functionality might not be entirely working. [ 342.376277][ T5719] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 342.454137][ T5719] pvrusb2: ********** [ 342.505939][ T5738] usb 5-1: New USB device found, idVendor=05d1, idProduct=2021, bcdDevice= 9.00 [ 342.571577][ T5738] usb 5-1: New USB device strings: Mfr=0, Product=16, SerialNumber=0 [ 342.610537][ T5738] usb 5-1: Product: syz [ 342.656164][ T2362] pvrusb2: Invalid write control endpoint [ 342.672071][ T5738] usb 5-1: config 0 descriptor?? [ 342.724647][ T5738] ftdi_sio 5-1:0.0: FTDI USB Serial Device converter detected [ 342.866407][ T5738] usb 5-1: Detected FT232H [ 342.985056][ T5738] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 343.035565][ T8840] netlink: 'syz.1.766': attribute type 21 has an invalid length. [ 343.065340][ T8840] netlink: 156 bytes leftover after parsing attributes in process `syz.1.766'. [ 343.104616][ T8857] FAULT_INJECTION: forcing a failure. [ 343.104616][ T8857] name failslab, interval 1, probability 0, space 0, times 0 [ 343.171147][ T8857] CPU: 1 UID: 0 PID: 8857 Comm: syz.3.772 Not tainted syzkaller #0 PREEMPT(full) [ 343.171172][ T8857] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 343.171184][ T8857] Call Trace: [ 343.171191][ T8857] [ 343.171198][ T8857] dump_stack_lvl+0x100/0x190 [ 343.171224][ T8857] should_fail_ex.cold+0x5/0xa [ 343.171246][ T8857] should_failslab+0xc2/0x120 [ 343.171266][ T8857] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 343.171284][ T8857] ? __alloc_skb+0x5b7/0x710 [ 343.171310][ T8857] ? __alloc_skb+0x140/0x710 [ 343.171339][ T8857] __alloc_skb+0x140/0x710 [ 343.171363][ T8857] ? __alloc_skb+0x5b7/0x710 [ 343.171387][ T8857] ? __pfx___alloc_skb+0x10/0x10 [ 343.171420][ T8857] netlink_alloc_large_skb+0x69/0x150 [ 343.171446][ T8857] netlink_sendmsg+0x680/0xda0 [ 343.171472][ T8857] ? __pfx_netlink_sendmsg+0x10/0x10 [ 343.171494][ T8857] ? __might_fault+0xc0/0x140 [ 343.171528][ T8857] ____sys_sendmsg+0xa4d/0xbe0 [ 343.171548][ T8857] ? __pfx_netlink_sendmsg+0x10/0x10 [ 343.171573][ T8857] ? __pfx_____sys_sendmsg+0x10/0x10 [ 343.171606][ T8857] ___sys_sendmsg+0x190/0x1e0 [ 343.171631][ T8857] ? __pfx____sys_sendmsg+0x10/0x10 [ 343.171651][ T8857] ? __lock_acquire+0x49f/0x1a40 [ 343.171671][ T8857] ? rcu_is_watching+0x12/0xc0 [ 343.171722][ T8857] __sys_sendmsg+0x160/0x210 [ 343.171739][ T8857] ? __pfx___sys_sendmsg+0x10/0x10 [ 343.171769][ T8857] do_syscall_64+0x115/0x870 [ 343.171800][ T8857] ? clear_bhb_loop+0x40/0x90 [ 343.171822][ T8857] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 343.171840][ T8857] RIP: 0033:0x7f0e6db9de59 [ 343.171855][ T8857] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 343.171871][ T8857] RSP: 002b:00007f0e6eb17028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 343.171888][ T8857] RAX: ffffffffffffffda RBX: 00007f0e6de25fa0 RCX: 00007f0e6db9de59 [ 343.171899][ T8857] RDX: 0000000020004090 RSI: 0000200000000040 RDI: 0000000000000003 [ 343.171909][ T8857] RBP: 00007f0e6eb17090 R08: 0000000000000000 R09: 0000000000000000 [ 343.171920][ T8857] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 343.171929][ T8857] R13: 00007f0e6de26038 R14: 00007f0e6de25fa0 R15: 00007ffee5322ee8 [ 343.171953][ T8857] [ 343.538947][ T8863] FAULT_INJECTION: forcing a failure. [ 343.538947][ T8863] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 343.561864][ T8863] CPU: 0 UID: 0 PID: 8863 Comm: syz.5.773 Not tainted syzkaller #0 PREEMPT(full) [ 343.561883][ T8863] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 343.561890][ T8863] Call Trace: [ 343.561893][ T8863] [ 343.561898][ T8863] dump_stack_lvl+0x100/0x190 [ 343.561924][ T8863] should_fail_ex.cold+0x5/0xa [ 343.561945][ T8863] _copy_to_user+0x32/0xd0 [ 343.561966][ T8863] bpf_prog_test_run_raw_tp+0x583/0x7d0 [ 343.561989][ T8863] ? __pfx_bpf_prog_test_run_raw_tp+0x10/0x10 [ 343.562004][ T8863] ? fput+0x79/0x100 [ 343.562015][ T8863] ? __bpf_prog_get+0x97/0x2a0 [ 343.562028][ T8863] ? __pfx_bpf_prog_test_run_raw_tp+0x10/0x10 [ 343.562045][ T8863] __sys_bpf+0x2a12/0x4e80 [ 343.562076][ T8863] ? __pfx___sys_bpf+0x10/0x10 [ 343.562099][ T8863] ? find_held_lock+0x2b/0x80 [ 343.562121][ T8863] ? get_pid_task+0xfc/0x250 [ 343.562137][ T8863] ? get_pid_task+0xfc/0x250 [ 343.562156][ T8863] ? find_held_lock+0x2b/0x80 [ 343.562174][ T8863] ? rcu_read_lock_any_held+0x6a/0xa0 [ 343.562195][ T8863] ? find_held_lock+0x2b/0x80 [ 343.562216][ T8863] ? ksys_write+0x190/0x250 [ 343.562238][ T8863] ? ksys_write+0x190/0x250 [ 343.562271][ T8863] ? fput+0x79/0x100 [ 343.562283][ T8863] ? __x64_sys_bpf+0xce/0x140 [ 343.562299][ T8863] __x64_sys_bpf+0xce/0x140 [ 343.562316][ T8863] ? do_syscall_64+0x90/0x870 [ 343.562338][ T8863] do_syscall_64+0x115/0x870 [ 343.562357][ T8863] ? clear_bhb_loop+0x40/0x90 [ 343.562378][ T8863] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 343.562394][ T8863] RIP: 0033:0x7f1481d9de59 [ 343.562409][ T8863] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 343.562425][ T8863] RSP: 002b:00007f1482b7e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 343.562443][ T8863] RAX: ffffffffffffffda RBX: 00007f1482025fa0 RCX: 00007f1481d9de59 [ 343.562454][ T8863] RDX: 000000000000000c RSI: 0000200000000380 RDI: 000000000000000a [ 343.562464][ T8863] RBP: 00007f1482b7e090 R08: 0000000000000000 R09: 0000000000000000 [ 343.562474][ T8863] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 343.562483][ T8863] R13: 00007f1482026038 R14: 00007f1482025fa0 R15: 00007ffe2ec8c918 [ 343.562508][ T8863] [ 343.845513][ T2362] pvrusb2: Invalid write control endpoint [ 343.851398][ T2362] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 343.862118][ T5738] usb 5-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 343.876857][ T2362] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 343.884626][ T2362] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 343.901687][ T2362] pvrusb2: Device being rendered inoperable [ 343.908793][ T2362] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 343.925292][ T2362] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 343.936716][ T2362] pvrusb2: Attached sub-driver cx25840 [ 343.944964][ T2362] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 343.946769][ T5808] usb 2-1: USB disconnect, device number 23 [ 343.974389][ T2362] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 344.245102][ T9] usb 4-1: new low-speed USB device number 21 using dummy_hcd [ 344.349307][ T5622] Bluetooth: hci5: command 0x0405 tx timeout [ 344.428903][ T9] usb 4-1: Invalid ep0 maxpacket: 16 [ 344.563901][ T9] usb 4-1: new low-speed USB device number 22 using dummy_hcd [ 344.809447][ T8877] comedi comedi3: pcmmio: I/O port conflict (0x80,32) [ 345.087281][ T8872] lo speed is unknown, defaulting to 1000 [ 345.218698][ T8881] comedi comedi3: pcmmio: I/O port conflict (0x80,32) [ 345.422477][ T9] usb 4-1: Invalid ep0 maxpacket: 16 [ 345.429518][ T9] usb usb4-port1: attempt power cycle [ 345.448078][ T5711] usb 5-1: USB disconnect, device number 45 [ 345.473758][ T5711] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 345.516524][ T5711] ftdi_sio 5-1:0.0: device disconnected [ 345.822570][ T9] usb 4-1: new low-speed USB device number 23 using dummy_hcd [ 345.853327][ T8886] xt_hashlimit: size too large, truncated to 1048576 [ 345.935058][ T9] usb 4-1: Invalid ep0 maxpacket: 16 [ 346.078883][ T9] usb 4-1: new low-speed USB device number 24 using dummy_hcd [ 346.126038][ T9] usb 4-1: Invalid ep0 maxpacket: 16 [ 346.222808][ T9] usb usb4-port1: unable to enumerate USB device [ 346.720684][ T8894] xt_hashlimit: size too large, truncated to 1048576 [ 348.198396][ T8901] syz.6.782 (8901): drop_caches: 2 [ 348.960836][ T8086] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 349.386228][ T8910] comedi comedi3: pcmmio: I/O port conflict (0x80,32) [ 349.606261][ T30] audit: type=1400 audit(1783248950.826:942): avc: denied { mounton } for pid=8911 comm="syz.6.786" path="/24/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 349.821237][ T8920] comedi comedi3: pcmmio: I/O port conflict (0x80,32) [ 349.980336][ T8926] netlink: 'syz.3.790': attribute type 1 has an invalid length. [ 350.035854][ T8926] 8021q: adding VLAN 0 to HW filter on device bond2 [ 350.130353][ T8926] netlink: 8 bytes leftover after parsing attributes in process `syz.3.790'. [ 350.190664][ T8926] netlink: 8 bytes leftover after parsing attributes in process `syz.3.790'. [ 350.222258][ T5808] usb 5-1: new full-speed USB device number 46 using dummy_hcd [ 350.395661][ T5808] usb 5-1: config 0 has an invalid interface number: 41 but max is 0 [ 350.416383][ T5808] usb 5-1: config 0 has no interface number 0 [ 350.423881][ T5808] usb 5-1: config 0 interface 41 has no altsetting 0 [ 350.434664][ T5808] usb 5-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 350.444929][ T5808] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 350.458132][ T5808] usb 5-1: Product: syz [ 350.463863][ T5808] usb 5-1: Manufacturer: syz [ 350.469107][ T5808] usb 5-1: SerialNumber: syz [ 350.484542][ T8938] FAULT_INJECTION: forcing a failure. [ 350.484542][ T8938] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 350.509214][ T5808] usb 5-1: config 0 descriptor?? [ 350.520440][ T8938] CPU: 0 UID: 0 PID: 8938 Comm: syz.6.793 Not tainted syzkaller #0 PREEMPT(full) [ 350.520462][ T8938] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 350.520472][ T8938] Call Trace: [ 350.520479][ T8938] [ 350.520485][ T8938] dump_stack_lvl+0x100/0x190 [ 350.520505][ T8938] should_fail_ex.cold+0x5/0xa [ 350.520519][ T8938] _copy_from_user+0x2e/0xd0 [ 350.520532][ T8938] sctp_setsockopt+0x8cc/0xb370 [ 350.520552][ T8938] ? __pfx_sctp_setsockopt+0x10/0x10 [ 350.520565][ T8938] ? __fget_files+0x215/0x3d0 [ 350.520583][ T8938] ? selinux_socket_setsockopt+0x6a/0x80 [ 350.520596][ T8938] ? sock_common_setsockopt+0x2e/0xf0 [ 350.520609][ T8938] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 350.520622][ T8938] do_sock_setsockopt+0xf3/0x1d0 [ 350.520637][ T8938] __sys_setsockopt+0x195/0x220 [ 350.520656][ T8938] __x64_sys_setsockopt+0xbd/0x160 [ 350.520672][ T8938] ? do_syscall_64+0x90/0x870 [ 350.520687][ T8938] ? lockdep_hardirqs_on+0x78/0x100 [ 350.520701][ T8938] do_syscall_64+0x115/0x870 [ 350.520715][ T8938] ? clear_bhb_loop+0x40/0x90 [ 350.520728][ T8938] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 350.520740][ T8938] RIP: 0033:0x7f569ff9de59 [ 350.520749][ T8938] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 350.520759][ T8938] RSP: 002b:00007f56a0e5d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 350.520770][ T8938] RAX: ffffffffffffffda RBX: 00007f56a0226090 RCX: 00007f569ff9de59 [ 350.520776][ T8938] RDX: 0000000000000077 RSI: 0000000000000084 RDI: 0000000000000003 [ 350.520782][ T8938] RBP: 00007f56a0e5d090 R08: 0000000000000008 R09: 0000000000000000 [ 350.520788][ T8938] R10: 0000200000000100 R11: 0000000000000246 R12: 0000000000000001 [ 350.520794][ T8938] R13: 00007f56a0226128 R14: 00007f56a0226090 R15: 00007ffde9bb8a48 [ 350.520808][ T8938] [ 350.622581][ T5738] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 350.883167][ T5738] usb 2-1: too many configurations: 36, using maximum allowed: 8 [ 350.922921][ T5738] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 350.922962][ T9] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 350.945790][ T5738] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 350.954663][ T5738] usb 2-1: Product: syz [ 350.961016][ T5738] usb 2-1: Manufacturer: syz [ 350.966067][ T5738] usb 2-1: SerialNumber: syz [ 350.990801][ T5738] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 351.012191][ T5719] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 351.504198][ T8934] random: crng reseeded on system resumption [ 351.899587][ T5704] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 352.222312][ T9] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 352.237275][ T5719] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 352.241613][ T9] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 352.301702][ T9] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 352.422073][ T9] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 352.709460][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 352.747373][ T30] audit: type=1400 audit(1783248953.936:943): avc: denied { bind } for pid=8964 comm="syz.3.801" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 353.068212][ T9] usb 7-1: config 0 descriptor?? [ 353.170371][ T30] audit: type=1400 audit(1783248953.936:944): avc: denied { listen } for pid=8964 comm="syz.3.801" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 353.209822][ T5704] usb 6-1: config 0 has an invalid descriptor of length 126, skipping remainder of the config [ 353.222796][ T5808] CoreChips 5-1:0.41 (unnamed net_device) (uninitialized): set LINK LED failed : -71 [ 353.243693][ T5704] usb 6-1: too many endpoints for config 0 interface 0 altsetting 1: 66, using maximum allowed: 30 [ 353.408427][ T5719] ath9k_htc: Failed to initialize the device [ 353.536417][ T5808] CoreChips 5-1:0.41: probe with driver CoreChips failed with error -71 [ 353.559564][ T5704] usb 6-1: config 0 interface 0 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 66 [ 353.572540][ T5704] usb 6-1: config 0 interface 0 has no altsetting 0 [ 353.608728][ T5808] usb 5-1: USB disconnect, device number 46 [ 353.673856][ T24] usb 2-1: USB disconnect, device number 24 [ 353.687143][ T24] usb 2-1: ath9k_htc: USB layer deinitialized [ 353.820265][ T5704] usb 6-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=7e.ce [ 353.834703][ T5704] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 353.851785][ T9] plantronics 0003:047F:FFFF.000C: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.6-1/input0 [ 353.877136][ T5704] usb 6-1: Product: syz [ 353.886916][ T5704] usb 6-1: Manufacturer: syz [ 353.901881][ T5704] usb 6-1: SerialNumber: syz [ 353.920970][ T8976] FAULT_INJECTION: forcing a failure. [ 353.920970][ T8976] name failslab, interval 1, probability 0, space 0, times 0 [ 353.964230][ T5704] usb 6-1: config 0 descriptor?? [ 353.999327][ T8976] CPU: 0 UID: 0 PID: 8976 Comm: syz.1.803 Not tainted syzkaller #0 PREEMPT(full) [ 353.999351][ T8976] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 353.999361][ T8976] Call Trace: [ 353.999367][ T8976] [ 353.999374][ T8976] dump_stack_lvl+0x100/0x190 [ 353.999402][ T8976] should_fail_ex.cold+0x5/0xa [ 353.999429][ T8976] should_failslab+0xc2/0x120 [ 353.999448][ T8976] __kmalloc_noprof+0xfc/0x820 [ 353.999464][ T8976] ? tomoyo_encode2+0xfb/0x3c0 [ 353.999492][ T8976] tomoyo_encode2+0xfb/0x3c0 [ 353.999519][ T8976] tomoyo_encode+0x29/0x50 [ 353.999541][ T8976] tomoyo_realpath_from_path+0x18c/0x690 [ 353.999571][ T8976] tomoyo_path_number_perm+0x23c/0x580 [ 353.999590][ T8976] ? tomoyo_path_number_perm+0x22e/0x580 [ 353.999611][ T8976] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 353.999655][ T8976] ? find_held_lock+0x2b/0x80 [ 353.999681][ T8976] ? __fget_files+0x215/0x3d0 [ 353.999705][ T8976] ? hook_file_ioctl_common+0x140/0x440 [ 353.999731][ T8976] ? __fget_files+0x215/0x3d0 [ 353.999760][ T8976] ? __fget_files+0x21f/0x3d0 [ 353.999788][ T8976] security_file_ioctl+0xd3/0x230 [ 353.999812][ T8976] __x64_sys_ioctl+0xb7/0x210 [ 353.999834][ T8976] do_syscall_64+0x115/0x870 [ 353.999858][ T8976] ? clear_bhb_loop+0x40/0x90 [ 353.999880][ T8976] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 353.999898][ T8976] RIP: 0033:0x7f456259de59 [ 353.999913][ T8976] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 353.999929][ T8976] RSP: 002b:00007f4563513028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 353.999946][ T8976] RAX: ffffffffffffffda RBX: 00007f4562825fa0 RCX: 00007f456259de59 [ 353.999958][ T8976] RDX: 0000200000002780 RSI: 0000000000005452 RDI: 0000000000000003 [ 353.999969][ T8976] RBP: 00007f4563513090 R08: 0000000000000000 R09: 0000000000000000 [ 353.999979][ T8976] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 353.999989][ T8976] R13: 00007f4562826038 R14: 00007f4562825fa0 R15: 00007fff7dbe3138 [ 354.000013][ T8976] [ 354.001555][ T8976] ERROR: Out of memory at tomoyo_realpath_from_path. [ 354.482713][ T1694] block nbd0: Possible stuck request ffff888028857000: control (read@0,4096B). Runtime 240 seconds [ 354.552537][ T8982] netlink: 12 bytes leftover after parsing attributes in process `syz.3.804'. [ 354.986931][ T8940] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 355.175392][ T8940] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 355.181927][ T8991] netlink: 12 bytes leftover after parsing attributes in process `syz.1.806'. [ 355.335108][ T5704] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 355.352792][ T30] audit: type=1400 audit(1783248956.576:945): avc: denied { write } for pid=8974 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 355.399160][ T5704] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 355.513064][ T5704] dvbdev: DVB: registering new adapter (MSI DIGI VOX mini II DVB-T USB2.0) [ 355.540492][ T5704] usb 6-1: media controller created [ 355.596391][ T8991] Set syz1 is full, maxelem 14 reached [ 355.648334][ T5704] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 355.774334][ T9007] FAT-fs (nbd3): unable to read boot sector [ 355.893098][ T9003] netlink: 12 bytes leftover after parsing attributes in process `syz.5.807'. [ 356.182560][ T5719] usb 7-1: reset high-speed USB device number 6 using dummy_hcd [ 356.201734][ T30] audit: type=1400 audit(1783248957.416:946): avc: denied { write } for pid=9006 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 356.292628][ T5738] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 356.443005][ T5719] usb 7-1: device descriptor read/64, error -32 [ 356.546774][ T29] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 356.555519][ T5738] usb 4-1: Using ep0 maxpacket: 32 [ 356.645393][ T5738] usb 4-1: unable to get BOS descriptor or descriptor too short [ 356.729080][ T9014] Set syz1 is full, maxelem 14 reached [ 356.807155][ T5738] usb 4-1: New USB device found, idVendor=046d, idProduct=08f6, bcdDevice= 0.40 [ 356.858358][ T29] usb 5-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 356.926065][ T5738] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 356.959185][ T29] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 357.013883][ T5738] usb 4-1: Product: Ꟙ꼪繾 [ 357.060519][ T29] usb 5-1: Product: syz [ 357.077421][ T5738] usb 4-1: Manufacturer: ꦪ㏋瀇됅꽣猊涮㗈彾쾖몸椰쯃녑ᙹ걈ꎢ굷ꍪ—傁烩鴧岦矔꧐駋纍昁ࣂ碥⛐奃 [ 357.127353][ T29] usb 5-1: Manufacturer: syz [ 357.172821][ T29] usb 5-1: SerialNumber: syz [ 357.250208][ T5738] usb 4-1: SerialNumber: 詇풷昷఍೗斑ⷕ⦠︣ꬬ躚얙諸衭꩑᫪츴礞䜝鉎퇳脽鰳馜㧯樂䦑셹詾⎡鼧옯槇ﴨ噱씑੣顱尝汪蚆쥱뺉ꉶﻁ榤縫짻튏ꢂ啦뤒庎ﷅᰁ̡ﺟ鐔 [ 357.280105][ T29] usb 5-1: config 0 descriptor?? [ 357.442763][ T29] gspca_main: sq905c-2.14.0 probing 2770:9052 [ 357.579348][ T24] usb 7-1: USB disconnect, device number 6 [ 357.744623][ T5738] gspca_main: STV06xx-2.14.0 probing 046d:08f6 [ 357.842882][ T5738] gspca_stv06xx: st6422 sensor detected [ 358.338207][ T29] gspca_sq905c: sq905c_command: usb_control_msg failed (-71) [ 358.489999][ T29] sq905c 5-1:0.0: probe with driver sq905c failed with error -71 [ 358.707048][ T29] usb 5-1: USB disconnect, device number 47 [ 358.829080][ T5618] Bluetooth: hci6: link tx timeout [ 358.835593][ T5618] Bluetooth: hci6: killing stalled connection 11:aa:aa:aa:aa:aa [ 358.895595][ T5704] DVB: Unable to find symbol tda10046_attach() [ 358.901784][ T5704] dvb-usb: no frontend was attached by 'MSI DIGI VOX mini II DVB-T USB2.0' [ 358.912320][ T5704] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 successfully initialized and connected. [ 358.986005][ T5704] dvb_usb_m920x 6-1:0.0: probe with driver dvb_usb_m920x failed with error -71 [ 358.990613][ T5738] STV06xx 4-1:1.0: probe with driver STV06xx failed with error -71 [ 359.042452][ T5704] usb 6-1: USB disconnect, device number 14 [ 359.116058][ T5738] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 359.182146][ T9032] netlink: 'syz.3.812': attribute type 1 has an invalid length. [ 359.257143][ T9038] netlink: 8 bytes leftover after parsing attributes in process `syz.3.812'. [ 359.371113][ T9038] netlink: 8 bytes leftover after parsing attributes in process `syz.3.812'. [ 359.597554][ T30] audit: type=1400 audit(1783248960.806:947): avc: denied { recv } for pid=9034 comm="syz.1.813" saddr=10.128.0.169 src=44836 daddr=10.128.1.28 dest=22 netif=eth0 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unlabeled_t tclass=peer permissive=1 [ 359.813671][ T24] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 359.943861][ T9032] 8021q: adding VLAN 0 to HW filter on device bond3 [ 360.105401][ T24] usb 6-1: too many configurations: 36, using maximum allowed: 8 [ 360.272361][ T24] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 360.314002][ T30] audit: type=1400 audit(1783248961.536:948): avc: denied { setopt } for pid=9044 comm="syz.6.815" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 360.391219][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 360.451491][ T5738] usb 4-1: USB disconnect, device number 25 [ 360.465276][ T24] usb 6-1: Product: syz [ 360.486748][ T24] usb 6-1: Manufacturer: syz [ 360.514731][ T24] usb 6-1: SerialNumber: syz [ 360.567258][ T24] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 360.587047][ T5719] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 360.622508][ T9058] netlink: 'syz.1.818': attribute type 1 has an invalid length. [ 360.735375][ T9047] netlink: 'syz.6.815': attribute type 10 has an invalid length. [ 360.744312][ T9058] 8021q: adding VLAN 0 to HW filter on device bond12 [ 360.808963][ T9058] netlink: 8 bytes leftover after parsing attributes in process `syz.1.818'. [ 360.903957][ T5622] Bluetooth: hci6: command 0x0406 tx timeout [ 360.923501][ T9058] netlink: 8 bytes leftover after parsing attributes in process `syz.1.818'. [ 360.975901][ T5738] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 361.266187][ T9039] random: crng reseeded on system resumption [ 361.336003][ T9047] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 361.368925][ T30] audit: type=1400 audit(1783248962.586:949): avc: denied { write } for pid=9042 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 361.403673][ T9047] team0: Port device netdevsim1 added [ 361.415525][ T5808] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 361.484016][ T5738] usb 4-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 361.496697][ T5738] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 361.512856][ T5738] usb 4-1: Product: syz [ 361.520034][ T5738] usb 4-1: Manufacturer: syz [ 361.532487][ T5738] usb 4-1: SerialNumber: syz [ 361.567830][ T5738] usb 4-1: config 0 descriptor?? [ 361.620484][ T5738] i2c-tiny-usb 4-1:0.0: version 6d.cc found at bus 004 address 026 [ 361.634813][ T5719] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 361.667168][ T5719] ath9k_htc: Failed to initialize the device [ 361.671416][ T5808] usb 2-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 362.030721][ T5808] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 362.182196][ T5808] usb 2-1: Product: syz [ 362.406614][ T5808] usb 2-1: Manufacturer: syz [ 362.420249][ T5808] usb 2-1: SerialNumber: syz [ 362.458990][ T5808] usb 2-1: config 0 descriptor?? [ 362.468456][ T5719] usb 6-1: ath9k_htc: USB layer deinitialized [ 362.537750][ T24] usb 6-1: USB disconnect, device number 15 [ 362.546669][ T5808] i2c-tiny-usb 2-1:0.0: version 6d.cc found at bus 002 address 025 [ 362.574464][ T30] audit: type=1400 audit(1783248963.786:950): avc: denied { write } for pid=9080 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 362.755360][ T5738] (null): error -EIO: failure setting delay to 10us [ 362.780659][ T5738] i2c-tiny-usb 4-1:0.0: probe with driver i2c-tiny-usb failed with error -5 [ 362.899622][ T5738] usb 4-1: USB disconnect, device number 26 [ 362.970841][ T5808] (null): failure reading functionality [ 363.156309][ T5808] i2c i2c-2: failure reading functionality [ 363.186823][ T5808] i2c i2c-2: connected i2c-tiny-usb device [ 363.244287][ T5808] usb 2-1: USB disconnect, device number 25 [ 363.256120][ T30] audit: type=1400 audit(1783248964.456:951): avc: denied { set_context_mgr } for pid=9089 comm="syz.4.822" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 363.427003][ T9095] af_packet: tpacket_rcv: packet too big, clamped from 56 to 4294967272. macoff=96 [ 363.518903][ T30] audit: type=1400 audit(1783248964.736:952): avc: denied { append } for pid=9094 comm="syz.6.824" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 364.137757][ T9113] FAULT_INJECTION: forcing a failure. [ 364.137757][ T9113] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 364.235788][ T9113] CPU: 1 UID: 0 PID: 9113 Comm: syz.6.828 Not tainted syzkaller #0 PREEMPT(full) [ 364.235815][ T9113] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 364.235825][ T9113] Call Trace: [ 364.235831][ T9113] [ 364.235839][ T9113] dump_stack_lvl+0x100/0x190 [ 364.235867][ T9113] should_fail_ex.cold+0x5/0xa [ 364.235889][ T9113] _copy_from_iter+0x1f4/0x1690 [ 364.235915][ T9113] ? __pfx__copy_from_iter+0x10/0x10 [ 364.235936][ T9113] ? find_held_lock+0x2b/0x80 [ 364.235960][ T9113] ? dev_get_by_index+0x180/0x380 [ 364.235987][ T9113] ? dev_get_by_index+0x180/0x380 [ 364.236019][ T9113] packet_sendmsg+0x1bb3/0x5100 [ 364.236047][ T9113] ? avc_has_perm+0x135/0x1e0 [ 364.236064][ T9113] ? __pfx_avc_has_perm+0x10/0x10 [ 364.236083][ T9113] ? __lock_acquire+0x49f/0x1a40 [ 364.236108][ T9113] ? sock_has_perm+0x25a/0x2f0 [ 364.236128][ T9113] ? __pfx_sock_has_perm+0x10/0x10 [ 364.236150][ T9113] ? __pfx_packet_sendmsg+0x10/0x10 [ 364.236190][ T9113] __sys_sendto+0x48b/0x4e0 [ 364.236215][ T9113] ? __pfx_packet_sendmsg+0x10/0x10 [ 364.236241][ T9113] ? __pfx___sys_sendto+0x10/0x10 [ 364.236274][ T9113] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 364.236310][ T9113] ? ksys_write+0x1ac/0x250 [ 364.236334][ T9113] ? __pfx_ksys_write+0x10/0x10 [ 364.236361][ T9113] __x64_sys_sendto+0xe0/0x1c0 [ 364.236386][ T9113] ? do_syscall_64+0x90/0x870 [ 364.236411][ T9113] ? lockdep_hardirqs_on+0x78/0x100 [ 364.236435][ T9113] do_syscall_64+0x115/0x870 [ 364.236457][ T9113] ? clear_bhb_loop+0x40/0x90 [ 364.236479][ T9113] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 364.236502][ T9113] RIP: 0033:0x7f569ff9de59 [ 364.236517][ T9113] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 364.236534][ T9113] RSP: 002b:00007f56a0e5d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 364.236551][ T9113] RAX: ffffffffffffffda RBX: 00007f56a0226090 RCX: 00007f569ff9de59 [ 364.236562][ T9113] RDX: 0000000000010000 RSI: 0000200000000180 RDI: 0000000000000004 [ 364.236573][ T9113] RBP: 00007f56a0e5d090 R08: 0000200000000140 R09: 0000000000000014 [ 364.236583][ T9113] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 364.236593][ T9113] R13: 00007f56a0226128 R14: 00007f56a0226090 R15: 00007ffde9bb8a48 [ 364.236617][ T9113] [ 367.366037][ T9142] FAULT_INJECTION: forcing a failure. [ 367.366037][ T9142] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 367.392510][ T30] audit: type=1400 audit(1783248968.586:953): avc: denied { name_bind } for pid=9140 comm="syz.4.835" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 367.465821][ T9142] CPU: 1 UID: 0 PID: 9142 Comm: syz.4.835 Not tainted syzkaller #0 PREEMPT(full) [ 367.465847][ T9142] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 367.465856][ T9142] Call Trace: [ 367.465862][ T9142] [ 367.465868][ T9142] dump_stack_lvl+0x100/0x190 [ 367.465894][ T9142] should_fail_ex.cold+0x5/0xa [ 367.465917][ T9142] _copy_to_iter+0x1f3/0x1720 [ 367.465938][ T9142] ? __lock_acquire+0x49f/0x1a40 [ 367.465959][ T9142] ? __pfx__copy_to_iter+0x10/0x10 [ 367.465989][ T9142] simple_copy_to_iter+0x46/0x90 [ 367.466014][ T9142] __skb_datagram_iter+0x5c8/0x900 [ 367.466035][ T9142] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 367.466064][ T9142] skb_copy_datagram_iter+0xa1/0x250 [ 367.466089][ T9142] tcp_recvmsg_locked+0x1b74/0x2a30 [ 367.466117][ T9142] ? __pfx_tcp_recvmsg_locked+0x10/0x10 [ 367.466141][ T9142] ? __local_bh_enable_ip+0x9e/0x120 [ 367.466165][ T9142] tcp_recvmsg+0x141/0x630 [ 367.466183][ T9142] ? __pfx_tcp_recvmsg+0x10/0x10 [ 367.466201][ T9142] ? sk_psock_get+0x142/0x480 [ 367.466229][ T9142] tcp_bpf_recvmsg+0x26c/0x390 [ 367.466253][ T9142] ? __pfx_tcp_bpf_recvmsg+0x10/0x10 [ 367.466273][ T9142] inet_recvmsg+0x455/0x4c0 [ 367.466296][ T9142] ? bpf_lsm_socket_recvmsg+0x9/0x10 [ 367.466322][ T9142] ? __pfx_inet_recvmsg+0x10/0x10 [ 367.466348][ T9142] sock_recvmsg+0x1b8/0x220 [ 367.466369][ T9142] ____sys_recvmsg+0x21e/0x670 [ 367.466393][ T9142] ? __pfx_____sys_recvmsg+0x10/0x10 [ 367.466428][ T9142] ? __lock_acquire+0x49f/0x1a40 [ 367.466446][ T9142] ? __lock_acquire+0x49f/0x1a40 [ 367.466465][ T9142] ___sys_recvmsg+0x16a/0x1a0 [ 367.466487][ T9142] ? __pfx____sys_recvmsg+0x10/0x10 [ 367.466511][ T9142] ? find_held_lock+0x2b/0x80 [ 367.466548][ T9142] do_recvmmsg+0x2f3/0x740 [ 367.466573][ T9142] ? __pfx_do_recvmmsg+0x10/0x10 [ 367.466599][ T9142] ? __mutex_unlock_slowpath+0x35d/0x930 [ 367.466629][ T9142] ? __fget_files+0x21f/0x3d0 [ 367.466660][ T9142] __x64_sys_recvmmsg+0x22a/0x280 [ 367.466678][ T9142] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 367.466702][ T9142] do_syscall_64+0x115/0x870 [ 367.466723][ T9142] ? clear_bhb_loop+0x40/0x90 [ 367.466743][ T9142] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 367.466760][ T9142] RIP: 0033:0x7fd5f4d9de59 [ 367.466774][ T9142] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 367.466789][ T9142] RSP: 002b:00007fd5f5b92028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 367.466805][ T9142] RAX: ffffffffffffffda RBX: 00007fd5f5025fa0 RCX: 00007fd5f4d9de59 [ 367.466815][ T9142] RDX: 0000000000000001 RSI: 0000200000004480 RDI: 0000000000000003 [ 367.466825][ T9142] RBP: 00007fd5f5b92090 R08: 0000000000000000 R09: 0000000000000000 [ 367.466834][ T9142] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 367.466843][ T9142] R13: 00007fd5f5026038 R14: 00007fd5f5025fa0 R15: 00007ffc11d05c98 [ 367.466865][ T9142] [ 368.093779][ T5801] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 368.454883][ T5801] usb 7-1: too many configurations: 36, using maximum allowed: 8 [ 368.571701][ T9152] syzkaller0: entered promiscuous mode [ 368.581674][ T9152] syzkaller0: entered allmulticast mode [ 368.596938][ T9152] tipc: Enabled bearer , priority 0 [ 368.638135][ T5801] usb 7-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 368.659556][ T5801] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 368.679857][ T9157] block device autoloading is deprecated and will be removed. [ 368.722082][ T5801] usb 7-1: Product: syz [ 368.740265][ T5801] usb 7-1: Manufacturer: syz [ 368.772873][ T5801] usb 7-1: SerialNumber: syz [ 368.789312][ T9158] tipc: Resetting bearer [ 368.796007][ T5801] usb 7-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 368.932693][ T5711] usb 7-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 369.097109][ T9158] tipc: Disabling bearer [ 369.113571][ T9161] futex_wake_op: syz.4.841 tries to shift op by -1; fix this program [ 369.459752][ T9143] random: crng reseeded on system resumption [ 370.022555][ T5711] ath9k_htc 7-1:1.0: ath9k_htc: Target is unresponsive [ 370.030774][ T5711] ath9k_htc: Failed to initialize the device [ 370.447543][ T9173] comedi comedi3: pcmmio: I/O port conflict (0x80,32) [ 373.061642][ T1309] ieee802154 phy0 wpan0: encryption failed: -22 [ 373.072601][ T1309] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.842425][ C1] sched: DL replenish lagged too much [ 383.887449][ T9] usb 7-1: USB disconnect, device number 7 [ 383.938698][ T9] usb 7-1: ath9k_htc: USB layer deinitialized [ 384.510942][ T10] block nbd0: Possible stuck request ffff888028857000: control (read@0,4096B). Runtime 270 seconds [ 384.537638][ T36] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 385.122233][ T9192] NILFS (nbd3): device size too small [ 385.237026][ T30] audit: type=1400 audit(1783248986.456:954): avc: denied { connect } for pid=9189 comm="syz.3.849" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 385.468041][ T9198] netlink: 8 bytes leftover after parsing attributes in process `syz.1.850'. [ 385.477694][ T9200] futex_wake_op: syz.4.851 tries to shift op by -1; fix this program [ 386.399132][ T5622] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 386.413933][ T5622] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 386.424059][ T5622] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 386.440622][ T5622] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 386.452746][ T5622] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 386.566316][ T5618] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 386.577282][ T5618] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 386.604095][ T5618] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 386.613444][ T5618] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 386.620928][ T5618] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 386.692829][ T29] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 387.063484][ T31] INFO: task syz.0.391:7333 blocked for more than 143 seconds. [ 387.084981][ T31] Not tainted syzkaller #0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 387.121038][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 387.144006][ T31] task:syz.0.391 state:D stack:24096 pid:7333 tgid:7331 ppid:5617 task_flags:0x400140 flags:0x00080002 [ 387.203863][ T31] Call Trace: [ 387.207182][ T31] [ 387.223027][ T29] usb 2-1: Using ep0 maxpacket: 8 [ 387.247605][ T9213] can0: slcan on ttyS3. [ 387.259077][ T31] __schedule+0x125c/0x6730 [ 387.302295][ T31] ? __pfx___schedule+0x10/0x10 [ 387.359187][ T31] ? find_held_lock+0x2b/0x80 [ 387.405614][ T30] audit: type=1400 audit(1783248988.626:955): avc: denied { sys_module } for pid=9208 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 387.448324][ T31] ? schedule+0x225/0x2c0 [ 387.485875][ T31] schedule+0xdd/0x2c0 [ 387.523909][ T31] schedule_preempt_disabled+0x13/0x30 [ 387.572866][ T31] __mutex_lock+0xccc/0x1bd0 [ 387.599655][ T31] ? bdev_open+0xa2/0xe40 [ 387.614384][ T30] audit: type=1400 audit(1783248988.676:956): avc: denied { bind } for pid=9210 comm="syz.3.853" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 387.652414][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 387.667017][ T31] ? bd_prepare_to_claim+0x1e0/0x280 [ 387.674459][ T31] ? __pfx_bd_prepare_to_claim+0x10/0x10 [ 387.690710][ T31] ? file_init_path+0x48e/0x670 [ 387.708270][ T31] ? bdev_open+0xa2/0xe40 [ 387.722280][ T31] bdev_open+0xa2/0xe40 [ 387.742454][ T31] ? iput+0x3a/0x40 [ 387.752418][ T31] bdev_file_open_by_dev+0x179/0x210 [ 387.770402][ T31] setup_bdev_super+0x78/0x730 [ 387.777376][ T31] get_tree_bdev_flags+0x363/0x620 [ 387.787832][ T31] ? __pfx_vxfs_fill_super+0x10/0x10 [ 387.799183][ T31] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 387.813656][ T31] ? cap_capable+0x107/0x430 [ 387.833657][ T31] ? bpf_lsm_capable+0x9/0x10 [ 387.850230][ T31] ? security_capable+0x80/0x260 [ 387.855694][ T30] audit: type=1400 audit(1783248989.066:957): avc: denied { write } for pid=9190 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 387.892540][ T31] vfs_get_tree+0x92/0x320 [ 387.897287][ T31] path_mount+0x7d0/0x23d0 [ 387.901960][ T31] ? __pfx_path_mount+0x10/0x10 [ 387.927081][ T31] ? lockdep_hardirqs_on+0x78/0x100 [ 387.942533][ T31] ? putname+0xb1/0x110 [ 387.948859][ T31] ? kmem_cache_free+0x127/0x6b0 [ 387.962394][ T31] ? kfree+0x22b/0x6c0 [ 387.972466][ T31] ? __x64_sys_mount+0x293/0x310 [ 387.982449][ T31] __x64_sys_mount+0x293/0x310 [ 387.994258][ T31] ? __pfx___x64_sys_mount+0x10/0x10 [ 388.006603][ T31] do_syscall_64+0x115/0x870 [ 388.011647][ T31] ? clear_bhb_loop+0x40/0x90 [ 388.032460][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 388.059673][ T31] RIP: 0033:0x7fc70059de59 [ 388.064115][ T31] RSP: 002b:00007fc701495028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 388.072527][ T31] RAX: ffffffffffffffda RBX: 00007fc700826090 RCX: 00007fc70059de59 [ 388.080492][ T31] RDX: 00002000000003c0 RSI: 00002000000001c0 RDI: 0000200000000000 [ 388.088464][ T31] RBP: 00007fc700633e6f R08: 0000000000000000 R09: 0000000000000000 [ 388.096464][ T30] audit: type=1400 audit(1783248989.256:958): avc: denied { write } for pid=9230 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 388.120035][ T31] R10: 0000000001000001 R11: 0000000000000246 R12: 0000000000000000 [ 388.128026][ T31] R13: 00007fc700826128 R14: 00007fc700826090 R15: 00007ffff3e169f8 [ 388.136016][ T31] [ 388.154578][ T31] [ 388.154578][ T31] Showing all locks held in the system: [ 388.272429][ T31] 5 locks held by kworker/1:1/29: [ 388.292421][ T31] #0: ffff8880206ed140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 [ 388.334896][ T31] #1: ffffc90000a47d08 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 [ 388.416053][ T31] #2: ffff88802b9511d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 [ 388.487814][ T31] #3: ffff88802b99b568 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x2bd2/0x4af0 [ 388.502739][ T5618] Bluetooth: hci7: command tx timeout [ 388.552469][ T31] #4: ffff88802b8a5760 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x2bfb/0x4af0 [ 388.619750][ T31] 1 lock held by khungtaskd/31: [ 388.664119][ T5618] Bluetooth: hci8: command tx timeout [ 388.719847][ T31] #0: ffffffff8ebe6100 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 [ 388.730088][ T31] 2 locks held by kworker/1:2/804: [ 388.735475][ T31] #0: ffff88801bc0b140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 [ 388.751243][ T31] #1: ffffc9000464fd08 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 [ 388.774243][ T31] 2 locks held by getty/5364: [ 388.794173][ T31] #0: ffff888033ac00a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 388.851044][ T31] #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0 [ 388.897034][ T31] 1 lock held by udevd/5608: [ 388.935591][ T31] #0: ffff88802879a350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 388.969687][ T31] 4 locks held by kworker/0:5/5711: [ 389.000530][ T31] 2 locks held by syz.0.391/7333: [ 389.016946][ T31] #0: ffff8880339480d8 (&type->s_umount_key#86/1){+.+.}-{4:4}, at: sget_fc+0x3c8/0x1d80 [ 389.059905][ T31] #1: ffff88802879a350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xa2/0xe40 [ 389.111539][ T31] 3 locks held by syz.2.585/8110: [ 389.134243][ T31] #0: ffff88803368e0f0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 389.171464][ T31] #1: ffff88807d63a450 (sb_writers#10){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 389.192412][ T31] #2: ffff88805773e080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 [ 389.206579][ T31] 1 lock held by syz-executor/8259: [ 389.212281][ T31] #0: ffff88807f8d4ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0xb0 [ 389.232158][ T31] 5 locks held by syz.5.842/9164: [ 389.239113][ T31] #0: ffff888056e00ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0xb0 [ 389.249829][ T31] #1: ffff888056e000b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x37e/0x13c0 [ 389.259570][ T31] #2: ffffffff90d261a0 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xbb/0x280 [ 389.269600][ T31] #3: ffff88804eefeaf8 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x95/0x710 [ 389.278941][ T31] #4: ffffffff8ebf1ba8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 [ 389.288969][ T31] 1 lock held by syz.1.850/9198: [ 389.293907][ T31] #0: ffff88807bc94ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0xb0 [ 389.303638][ T31] 2 locks held by syz-executor/9201: [ 389.308923][ T31] #0: ffff888056784ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0xb0 [ 389.318523][ T31] #1: ffffffff8ebf1ba8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 [ 389.328548][ T31] 1 lock held by syz-executor/9208: [ 389.333743][ T31] #0: ffff888045ab0ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0xb0 [ 389.343362][ T30] audit: type=1400 audit(1783248990.526:959): avc: denied { write } for pid=9233 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 389.376870][ T31] 1 lock held by syz.4.852/9217: [ 389.381839][ T31] #0: ffff88805b998ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0xb0 [ 389.391443][ T31] 1 lock held by syz.3.853/9210: [ 389.396378][ T31] #0: ffff88807bc90ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0xb0 [ 389.405972][ T31] 1 lock held by rm/9244: [ 389.410342][ T31] [ 389.414198][ T31] ============================================= [ 389.414198][ T31] [ 389.425371][ T31] NMI backtrace for cpu 0 [ 389.425390][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 389.425408][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 389.425416][ T31] Call Trace: [ 389.425422][ T31] [ 389.425428][ T31] dump_stack_lvl+0x100/0x190 [ 389.425452][ T31] nmi_cpu_backtrace.cold+0x12d/0x151 [ 389.425473][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 389.425493][ T31] nmi_trigger_cpumask_backtrace+0x21c/0x2a0 [ 389.425515][ T31] sys_info+0x141/0x190 [ 389.425531][ T31] watchdog+0xcb1/0x1030 [ 389.425550][ T31] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 389.425568][ T31] ? __pfx_watchdog+0x10/0x10 [ 389.425583][ T31] ? __kthread_parkme+0x18c/0x230 [ 389.425604][ T31] ? kthread+0x13a/0x450 [ 389.425626][ T31] ? __pfx_watchdog+0x10/0x10 [ 389.425640][ T31] kthread+0x370/0x450 [ 389.425661][ T31] ? __pfx_kthread+0x10/0x10 [ 389.425681][ T31] ret_from_fork+0x72b/0xd50 [ 389.425699][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 389.425716][ T31] ? __switch_to+0x800/0x10f0 [ 389.425736][ T31] ? __pfx_kthread+0x10/0x10 [ 389.425757][ T31] ret_from_fork_asm+0x1a/0x30 [ 389.425785][ T31] [ 389.425792][ T31] Sending NMI from CPU 0 to CPUs 1: [ 389.560953][ C1] NMI backtrace for cpu 1 [ 389.560968][ C1] CPU: 1 UID: 0 PID: 9247 Comm: dhcpcd-run-hook Not tainted syzkaller #0 PREEMPT(full) [ 389.560984][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 389.560992][ C1] RIP: 0010:lock_is_held_type+0xf5/0x140 [ 389.561016][ C1] Code: ff ff ff ff 65 0f c1 15 19 d5 aa 08 83 fa 01 8b 44 24 04 75 2d 9c 5a 80 e6 02 75 47 41 f7 c5 00 02 00 00 74 01 fb 48 83 c4 08 <5b> 5d 41 5c 41 5d 41 5e 41 5f e9 7c 3f 03 00 c3 cc cc cc cc 31 c0 [ 389.561029][ C1] RSP: 0018:ffffc900044ef968 EFLAGS: 00000282 [ 389.561040][ C1] RAX: 0000000000000001 RBX: ffff88807f23e9b8 RCX: 0000000000000001 [ 389.561049][ C1] RDX: 0000000000000046 RSI: ffffffff8e17cd15 RDI: ffffffff8c400c80 [ 389.561057][ C1] RBP: ffff888032aaca80 R08: 0000000000000005 R09: 0000000000000000 [ 389.561066][ C1] R10: 0000000000000001 R11: 0000000000000000 R12: 00000000ffffffff [ 389.561074][ C1] R13: 0000000000000246 R14: ffff888032aad620 R15: 0000000000000000 [ 389.561083][ C1] FS: 0000000000000000(0000) GS:ffff888123eec000(0000) knlGS:0000000000000000 [ 389.561096][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 389.561105][ C1] CR2: 00005580f9f5ece8 CR3: 000000007fa2e000 CR4: 00000000003526f0 [ 389.561114][ C1] Call Trace: [ 389.561118][ C1] [ 389.561125][ C1] unlink_anon_vmas+0x6ab/0x8e0 [ 389.561146][ C1] free_pgtables+0x2e7/0xd80 [ 389.561162][ C1] ? __pfx_free_pgtables+0x10/0x10 [ 389.561181][ C1] exit_mmap+0x44c/0xa00 [ 389.561197][ C1] ? __pfx_exit_mmap+0x10/0x10 [ 389.561211][ C1] ? rcu_is_watching+0x12/0xc0 [ 389.561231][ C1] ? __lock_acquire+0x49f/0x1a40 [ 389.561245][ C1] ? find_held_lock+0x2b/0x80 [ 389.561262][ C1] ? uprobe_clear_state+0x5f/0x260 [ 389.561282][ C1] ? __mutex_unlock_slowpath+0x35d/0x930 [ 389.561304][ C1] ? arch_uprobe_clear_state+0x107/0x150 [ 389.561323][ C1] __mmput+0x12a/0x410 [ 389.561339][ C1] mmput+0x67/0x80 [ 389.561352][ C1] do_exit+0x8b1/0x2ae0 [ 389.561370][ C1] ? do_raw_spin_lock+0x128/0x260 [ 389.561386][ C1] ? __pfx_do_exit+0x10/0x10 [ 389.561402][ C1] ? do_group_exit+0x1bd/0x2a0 [ 389.561420][ C1] ? rcu_is_watching+0x12/0xc0 [ 389.561438][ C1] do_group_exit+0xd5/0x2a0 [ 389.561456][ C1] __x64_sys_exit_group+0x3e/0x50 [ 389.561473][ C1] x64_sys_call+0x102c/0x1530 [ 389.561491][ C1] do_syscall_64+0x115/0x870 [ 389.561508][ C1] ? clear_bhb_loop+0x40/0x90 [ 389.561522][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 389.561535][ C1] RIP: 0033:0x7f0fd56456c5 [ 389.561545][ C1] Code: Unable to access opcode bytes at 0x7f0fd564569b. [ 389.561551][ C1] RSP: 002b:00007ffd66c1f308 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 389.561564][ C1] RAX: ffffffffffffffda RBX: 00005580f9f492c0 RCX: 00007f0fd56456c5 [ 389.561572][ C1] RDX: 00000000000000e7 RSI: ffffffffffffff88 RDI: 0000000000000000 [ 389.561580][ C1] RBP: 00007ffd66c1f638 R08: 0000000000000000 R09: 0000000000000000 [ 389.561589][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd66c1f630 [ 389.561597][ C1] R13: 00007ffd66c1f640 R14: 00007f0fd5855000 R15: 00005580e1185d98 [ 389.561611][ C1] [ 389.592621][ T30] audit: type=1400 audit(1783248990.656:960): avc: denied { write } for pid=9244 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 389.900650][ T30] audit: type=1400 audit(1783248991.076:961): avc: denied { write } for pid=9248 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 389.931404][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 389.931423][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 389.931442][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 389.931451][ T31] Call Trace: [ 389.931457][ T31] [ 389.931465][ T31] dump_stack_lvl+0x100/0x190 [ 389.931490][ T31] vpanic+0x552/0x970 [ 389.931534][ T31] ? __pfx_vpanic+0x10/0x10 [ 389.931552][ T31] ? nmi_trigger_cpumask_backtrace+0x1c7/0x2a0 [ 389.931574][ T31] panic+0xd1/0xe0 [ 389.931589][ T31] ? __pfx_panic+0x10/0x10 [ 389.931606][ T31] ? nmi_trigger_cpumask_backtrace+0x1fa/0x2a0 [ 389.931624][ T31] ? nmi_trigger_cpumask_backtrace+0x260/0x2a0 [ 389.931642][ T31] ? nmi_trigger_cpumask_backtrace+0x26a/0x2a0 [ 389.931660][ T31] ? watchdog.cold+0x1ec/0x234 [ 389.931677][ T31] ? watchdog+0xcc1/0x1030 [ 389.931695][ T31] watchdog.cold+0x1fd/0x234 [ 389.931716][ T31] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 389.931736][ T31] ? __pfx_watchdog+0x10/0x10 [ 389.931753][ T31] ? __kthread_parkme+0x18c/0x230 [ 389.931775][ T31] ? kthread+0x13a/0x450 [ 389.931796][ T31] ? __pfx_watchdog+0x10/0x10 [ 389.931811][ T31] kthread+0x370/0x450 [ 389.931832][ T31] ? __pfx_kthread+0x10/0x10 [ 389.931855][ T31] ret_from_fork+0x72b/0xd50 [ 389.931876][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 389.931896][ T31] ? __switch_to+0x800/0x10f0 [ 389.931919][ T31] ? __pfx_kthread+0x10/0x10 [ 389.931943][ T31] ret_from_fork_asm+0x1a/0x30 [ 389.931974][ T31] [ 389.938747][ T31] Kernel Offset: disabled