last executing test programs: 4m42.324590913s ago: executing program 4 (id=446): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x14}, 0x14}}, 0x0) (async) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x14}, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) socket$nl_route(0x10, 0x3, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0xffffff1f, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x4010, 0x3f00}, [@IFLA_MASTER={0x8, 0xa, r2}, @IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_VLAN_FILTERING={0x5, 0x7, 0x6}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x40000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)) socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000100), 0xffffffffffffffff) (async) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_PRI(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010027bd7000fedbdf25010000000000000008410000001400180000101069623a7663616e307cd3b8c5"], 0x30}, 0x1, 0x0, 0x0, 0x4004}, 0x20008080) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x30, r5, 0x300, 0x70bd25, 0x25dfdbff, {{}, {}, {0x14, 0x19, {0x0, 0x6, 0xd, 0x5}}}, ["", "", "", "", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x4000040}, 0x801) 4m41.523551136s ago: executing program 4 (id=451): r0 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x4}, 0x80, &(0x7f0000000080)=[{0x0}, {&(0x7f0000001400)}], 0x2}, 0x4000001) r1 = socket(0x2b, 0x1, 0x1) listen(r1, 0x5) ioctl$sock_inet_udp_SIOCINQ(r1, 0x894b, 0x0) syz_usb_connect$uac2(0x0, 0xa6, 0x0, 0x0) r2 = io_uring_setup(0x1890, &(0x7f0000000580)={0x0, 0xa1c5, 0x80, 0x4, 0x30f}) r3 = eventfd2(0x100, 0x80000) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r2, 0x7, &(0x7f0000000140)=r3, 0x1) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x5, &(0x7f0000000740)=ANY=[@ANYBLOB="180200000100000000000000000000008500000017000000850000005000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x9, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ffffffc}, 0x94) r5 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r5, 0x40186f40, &(0x7f0000000440)=0x10) ioctl$SNDCTL_FM_4OP_ENABLE(r5, 0x4004510f, &(0x7f0000000200)) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1ec) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000140)='ramfs\x00', 0x10010, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000003800)={0x2020, 0x0, 0x0}, 0x2020) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x0, 0x14, 0x0, &(0x7f0000000900)="e02742e8680d85ff9782762f86dd", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002f40)=ANY=[@ANYBLOB="ac0000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000000010c000280050001000000000008000740000000"], 0xac}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="b40000000001010400000000000000000a0000003c0001802c000180140003000000000000000000000000000000000014000400ff0100000000000000000000000000010c0002800500010000000000440002802c00018014000300fe8000200000000000000000000000aa14000400fe8000000000000000000000000000aa0c00028005000100000000000600034000040000080007400000040018000680140004"], 0xb4}}, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r2, 0x5, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xa6d9d000) setsockopt$MRT_DEL_MFC_PROXY(r1, 0x0, 0xd3, &(0x7f0000000280)={@multicast2, @rand_addr=0x64010100, 0x0, "ea8183a83326c6ee672806e7dc060c3deb30c317a448f484342df850698125c8", 0x3, 0x9, 0x8001, 0x5}, 0x3c) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000680)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="3f0000000000000014aa6b117064676500000400028008000400fffbffffb9f949e24e0881756f56d71a7ed450a5fdef9d13a4089756edd8a6e400"/73], 0x3c}}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000440)={0x50, 0x0, r6, {0x7, 0x29, 0x0, 0x4001000, 0x3, 0x8002, 0x0, 0x7, 0x0, 0x0, 0x0, 0x1}}, 0x50) 4m39.288017179s ago: executing program 4 (id=459): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x36, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x5, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000040)={0x1000002, 0x2, 0x1, 0x0, 0x9}) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000240)=@mmap={0x1, 0x2, 0x4, 0x100000, 0x7, {}, {0x0, 0x8, 0x4, 0xc0, 0x0, 0xf0, "0100"}, 0x1, 0x1, {}, 0x1}) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) getpid() mq_open(&(0x7f0000000200)='#\x00\x00', 0x800, 0x2c, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000380), 0x40000000301241, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f00000003c0)={0x0, 0xfee0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYRES32=r1], 0xb4}}, 0x40) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="480000000d0a010800000000000000000a0000010900020073797a31000000000900010073797a31000000001c000380180000800c00018006000100e47c00000800034000000001"], 0x48}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) ioctl$SNDCTL_DSP_CHANNELS(r1, 0xc0045006, &(0x7f0000000080)=0x7f) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x4000001) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000080)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xa2, 0x7}}, './file0\x00'}) r4 = syz_open_dev$sg(&(0x7f00000004c0), 0x0, 0x0) ioctl$SG_GET_VERSION_NUM(r4, 0x2284, &(0x7f0000000080)) 4m37.891042248s ago: executing program 4 (id=465): r0 = syz_open_dev$video(&(0x7f0000000000), 0x7fff, 0x0) ioctl$VIDIOC_S_PARM(r0, 0xc0cc5616, &(0x7f0000000140)={0x1, @output={0x0, 0x0, {0x0, 0x10000}}}) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x480c1) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_open_dev$I2C(&(0x7f0000000180), 0x0, 0x40402) ioctl$XFS_IOC_START_COMMIT(r1, 0x80585882, &(0x7f0000000240)={0xffffffffffffffff}) write$fb(r2, &(0x7f0000000100)="253ef96872c24d44cae5ee1e6c9247cb9f02a65d940d47f5541bbd1cc3c4705703e66c33c1ccd2429ad3c187b0bc66b8bc9767d2207ea43febdc39174196099d58502eba", 0x44) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x81899, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='sched\x00') write$P9_RGETLOCK(r4, 0x0, 0x24) mount$bind(0x0, &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount(0x0, &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x80000, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r5, &(0x7f0000006b40)={0x2020}, 0x2020) write$tun(r2, &(0x7f0000000440)={@val={0x0, 0x809b}, @void, @ipv6=@icmpv6={0x6, 0x6, "fa509a", 0x1455, 0x3a, 0x1, @dev={0xfe, 0x80, '\x00', 0x15}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, {[@hopopts={0x0, 0x0, '\x00', [@pad1]}, @fragment={0xa0, 0x0, 0x6, 0x1, 0x0, 0x13, 0x64}, @srh={0x87, 0x2, 0x4, 0x1, 0x9, 0x0, 0x9, [@local]}, @fragment={0x1, 0x0, 0xf, 0x0, 0x0, 0x10, 0x64}, @hopopts={0x58, 0x21, '\x00', [@ra={0x5, 0x2, 0x6}, @pad1, @ra={0x5, 0x2, 0x1}, @generic={0x40, 0xfe, "36387f06c5a1f543e7ad921d54f8bec63124d0700731cc3fde0621a23137386c83f7140b8e359321a52dbc1c003be2a12472cc095e3f32e5e27fd820350d0f75ffa8f281273c8e185f3a8a88c7f6b69e183d0db5babec8115c2045f25397ca5504645e2a098574dc8b339439b8e31fbf7a810ed5bc56cc83735dad22dd856e01e6f637c6fa336e0c9f33ccf3325c15f3572a76e582bef77a14c46c4d6af3760db50e4794e980de28d50597390e23c9226758c84d971afcd4f746e6cb0716218847c167534a2b262642423c6df3a9be5f77540cbfe3ce7179b6c4ddbcd81957c92d6589e2304b1389964b02b3eafa613d3e5a090a7a34d35afb10166b2bbd"}, @ra={0x5, 0x2, 0xfffc}]}, @dstopts={0x21, 0x244, '\x00', [@generic={0xc6, 0xd5, "093a8dcd75f5aa627a36b72fa4e71eb5d117bb5e4b99696dd139dfc918055c01e350503d69f12c7404214fd4e53e9f4bf912f46c933b3ed8f1a47747202697c11318c72fa0d193252046e458d6be526bb02b0f714acbbf6dfe215c7bd4b015eb5e50a651c8daec2e3b22916bb55114d26e7953f18a907486b2b66ad3bb7fd60d8360b2dcf5e9cefcbbf63269540d3bbfe023f55edf01ddf79c3ce4beb03c41e583b94551e7dbec44dd3ec190c26dcdefb148fae1155d31a48883223deb6c82cdfdce1b382f74354061c351226d081ac2619d0e172d"}, @generic={0x76, 0x1000, "d28ff90d5b0d77d522b43450d0e045c6efc924a93c434f9aaf9b698284aefd45f283245c4027d1079424835683d20de2cc53a44cafe6e8b5cd107ba04180b6cc43a688828e02da3fa74762f816f4858b7a607b89c492d427741f5e70d78e053cd222e5bf12af96b9ceefdbafc627eb39b6560074c2be258ce4e778092947c68438ef0a1693ecfdf6a56ba55390e03f4a7e7ff6d30ee5db2710dd460337bfb05405545cd2c9aac5819527b613c63ca7129c9bbfec667db0c4b3590f707709c8f988f17f16a3d15574c2f240481dda46c759604579e62194d0639cb8439e972923bc35bb578f373ab7138a691974b167b53c0a6e4e0523a69255541a7b98538ad8badbb2d3847ac3a5d932bae5afb2963414fb64ffa5941c9a9f441c8d181e775fc2c3c16a8f074a66bb38e32bead8f9286b19c56699ad1b7bc5f39cd86242b5dc53460a692a6bbf010c973de02924b001dfcc3dd48541edd4a1e485bc01216fb95ed55b8c9f2fbe92a23504d391e20ab7050ed6218eb2505eee48c4032dbcfdf5744424756a6c209fc29c161cf147fd979bf34d55affc59cf308434be58ede1229bcfbc5fc43a59e0495fb22c41d60aa966fac1f00e0882b6260d6ed6395dfdba2b64cb60befaa3d00b97b2e62eca7578259763c9e1623e54961e6e14f933c6a417ffb20d54d24fd0f2f5086e95b36a989d0f2746e803beec6d7e5d24984bbfea16eee66338d320618888be6f89d4126afcaf3991d5617260e1bdf16b22f1981aed5a4d4cdb92d8fad960d4defae60e29a8bca5d6c8c1acd3e9de75ce986ca6f7f68651f5dbcfee7d3e161609e07d04167a625e37c2dbcee406e3ff5b8ddd5a8390d9da98e2fc171089d635569d46e75e83837e97d0efca6e2e0cb889818e27fd3a296b16495fb9e582729e47d53b9fc9481990d45b5221eeb03d3c579ca714403d2475dc588a3c0116927c4bb3dd785b83175880f29961cd00a8d089bb4712dccb4cbad3a0a5c151a601bc35fe2597b4112bd98d1ee38687b884a0dc2ef54ead682faef6b5df59e4bf3c72fff5397e44230dd3c0f22ffa60ad39f83f2d450770ecfae2f0f0ad855314239123603f5d5b86d6db4de1e998d3bb98f8367851ce9a5c7bc6dd632ad6345321060f4668b8f17b32d4336d6f623c9791a473762409ca5e6414340e0278bf5d53f7ea80ff22e20164d55718826144d15992af5c6a56bff22c35e2b28680a716c1c9af0e23116f7ef5d87f2cfe97b654a6634e7414a6a92245ee0d9f1a5586a61137a2627bb69317009004c465da7ed81f4a01898b18f30f5282bb3f1b532e85ed1d667c4da8f30c7af8fa1e455fdde69b4f7d6c2297d731dfa4f8b0b02b0403057b626cc6fe18eba26d4885f103b0996a04eaf2fb1b0bf835a143fa3e824923cea092232b8ceaa0b6855ef20fae8a68f4fbcbecd65c1913df6d97fa4c1044c05f653a1637ef6e6aadeaf1f97264ac6182facb815ef989c05236994784baa36a6e7f2700edc9f331c045a840a27e6c53c136ff420c0cd0f12d402806bd3f55329fff3926e1bca7da85aafc38cdefe63ebb778f353fea38d1e7c80d2b38e4eacc90c81b836ed5526e2cbe0a4324e66264082deba0a73effcacb42b31105f8701729855e34823d4e66c71cb6ce4ced3e641be0d00e0872ad1a68f56cd4b2e21995ef282b7f8ea292556e8a45960eff5a118549aa43d6d039cce612daf73555e9b31cf1ecc453811b5baf7774e77a1e5a11bb8ffdf194c3384256b8b7a73fd6862338b1da2591c46324890afd951b2d328660253d39386bca0e1592dde82f10c41de43faea86532df316c605f305c1a10ec91e920812914bbba24818b96bac40aad1db8f8f118120ab499e0547dce0c72270b4aad1c4e9a3223e0b6fa8799863da9c5c02b39c0512fdec4ed3257001eec8e2bdf2d7f2d51a8a1bc769aaabd21030acfdfd8cf939b710fad34a9f7c30c9f82c5c6416c510832ce35092234195839846b1774535898b9319effaf2274428f02bb9cfb823e4c9cb27bfb2bb9470c4b925b0661d031eb7411efc00eee35f6b472279e8496d54d94bf8a503ccb17b6161cda3458ce55464f2ea5663fd98febaa8f176a66016afda3604abc168e3c00c56c485ef179a727da38d25b7d1c81bdafa56e393a653e84d4b6a7444918e949b320a4c7a28ae22b78440710b123480cf7606c62acd0403d63bed56410105c611d1668f356e67f41005e286c067c9a6b5e75b208aaf30c240a4055ddda9300173040c89d6ed8a8393ae8a93ea90a3624ef31a490ac0295da640f4b5be87e6845de4cf365f5656f9bbc568cae6f0d0e6a8286049b6137c91c5bc445477c2eb167770d02ecc62e36453af213dd4ac5b386acfbbb6a5a805f298ae672c6056d62c9752f02f4c3dc3ee626215c7733f8a82d4a070aeb3ba0ba69bd5bdafdeb47d21fc3443b4222f36b28bcc17e959360b1791b1f49c5d4ff0d54101a70597745d10002d414759fe83eb8646b7d008b637c7b64e14c196dfaeb5541432e3f2f2fff9b539ece99b8c908d1d94240ecdb5817435a386a4f0a785b1bf85e57e208e67932c01352592600515b981235494b8a2fb672d9a566e4eaaab8845617df144652218f97268d2e3bb86f49944a5273f5c1339e906606d7a6447247507b8727d81afb41d37152391235740cd06fab8c45987931703514e61f792a56e0d718452ad11918a03efd8c7a49d4d1f4a49ac44b3a238f8257af0915c968681aa90e65e44bf12f72bbe6a31bd28f074fd4a51e068b4e57a00e2f74f02ee788e398f722f119ab371ae6e3bbce3b2c796a9083f4ae5372a2890a7cae73fb9ef7f1caa0caadb9ebfe8636bd192d98c686af1a207cec876102be7110f7de35da6bdf66a8bad26fc70ec0e7aee99ee65f6631033d2d6526b30d7a3d532f8e169c9064927db7f20e2e60356cc21e60bfaa4a9dc497bb98d224c2d77eb85a91fdf5bce2cf4cd8888bf422bb3797df8c1285f057b294fc960401c7fdd061f26cc08c26f1d9946b5c3f745342570891b9d1bcb74f612caa6fe5125bad361d237a4f9933e13580bbe8a6b68f9a638cfb66617a887e4dde94e096308fcaa8e8f1989e541526d17e2ec4626a635820c588b14e0451125853189b083a22d30268e938f6379f53abbc23864b6a9b4b050494e38cea3d15920804315c9b323cb5481a84eb97f0beb10db2a516ca7fa475d0abe5b835900bcf14657d3365e6b9f0913e795622adf8751f8edeb5fc9005b334ed36c45cfcc8579aa062ffb9ce18ac224ea408a3bb412fee840085eaf748bc5f469bb7d25d0ef926dd696c294da9fb41c22bb4d0c5bbf73cdc8d98d4f8d74c1da1994a616039e35ab05404f0d56fd4a491cbe154c81f96e2c3fb31579f9597892afb3d99cf66ddb4ed83a09aacbe916281ecd4ca1b0f31691324a2a525ae075c1e75d5e8ac692b810bea9e188f34004776a51ee5d09f5e6224e60125c7b557d624aa07e8e85f794574eff700fbca5ef86ccc249654cc997f2c3396490e94263c7a1ead02080ffe3701bcff7ddad160eb230e0de2cb152dd733d64b743b703a41c26359bc8b94597658ecc9a54dd7547ee5744d21503a1934f8b16e63d7a29f94ac10095e72829d9426192d0d9d9f3427241b1d4d4095bf798cba0e37d3b5fb67f18ad0810d4cc4239dd872277301c56bd2413aaec428afc3d397556aaf8467156f5af23a7fdfdb732964ef9b9269e744fcd774b540c7e19d2c1f1b12b1bd1dbe42782b4886cc5cc347eaaf3fd1dce8c7184197cefe62e395a7fcb100d01981afc240971f67e0a6ed01e548647da36762ee1b6a91cb7bb6030996dfc0d4c6cce0d4892b0e3c83335af828e8c82398174a43e4362dd9c1f4e4a1b3634b4353d2efb13d89dce5b6f944ef1245f2f744b249b6cab8e1e33d8fba1fa8738f173d5d5b528488966019f4c1b7c907da3fe4592cd961b76ee35d13873bba572dfe6e9ddc3034789f33a88e32cf01ec9137da0a89cda248a9b11d3ec11a7284c859a2a3c90ab0065b62d29dc3aae855407489fd15ecdd21c13fbf5976c9b3a3f2cce8d270508b77cbb9933d154107fd3b23a015a68ec67da032f4ff6951de6180a0459dd57ac033707d976282002cd9ea2a5de06c624a1be789b5bbe1c4ccd4a6888d3c2e62cf14f5dcf888c1ff1325feaacb5a43db76105cda5e1d837a9aba413bcac108fb387dcbcaaed666570e86b530a96b5dacb5def32ed266f756297f875eba224245817e0694b676e167424e100ad4b554dc8607a5ec17200d6891b76ba0fea1d0be8cb3644a0ebe9aa5bec103c41885d301706a5936bf7b18a8b9efce9096bb7ed6e149a0cd5ca2887733bb53f75c6609a955cacd6bcd28ba65664afb255d1785a87ba550b8b055407e1aef5e99b98ec6d81893d1708faad09af55d91b1afcabf794599ad569936b2639259f1c92067b8e59dadc805d3c736c7af6ad5ddc335c1b79824ef22d08925837eecfe1fd56dc2f1980d74063c11ef3c0e64ad9f26c5d2f633cb29334ed858b936f447a84df80e709c7ed91e8cbc5c59547ed58311e0ca9ecdb18f3bb6d246e76a354daa230ebedf70edbe92ac4c0385732037724d67add6d7fe64c08a96ade10569516446823a84dd4f7d68784c1ddd19431e298b84789473a56f85920422f3b1f6350f076190eb291d7ee00012c831857f95c990f95a5d2c7fa6dd6a19734190811367a7e1fe630d0f2261c241443cdb7ffea6ca4c18473332af84651118ccab584140d8a6ce4f605c888d486b74e8f1aa079cf615e04b61aff3eb6451619aa1cf9c760bdba32030b37d0b6920716cbbbf575f67fc98ec5e3de17193059737b341a1b0e84c0364ff41d60d6191a498074745a0c29e7773f7f37046a300bbd7924fd8369d3bb2af18f40be98dc5a20c5d28c0307abe489ae868376c5ba1fd635690a17698b76f901b6de4843a20232448ead69348f8897f13e16b56f52e4c305e5e4b9552bac9f8f1bf871a7b6b5a7ab5acf1dea075e50a98d32c75f03a4b300317ede984cf5fefa5cf80cea3167fbcadf231ffd1105dc869f5e82db66669d6b73aaf3e34eea50f3c20ad794361709dc118e0ce89ea2780e213a3d9d7a4a9878aeb89d35b1e299e4fd81ec7a47279aa8416f940e1a8655a03c4a6974be31033aaf46e2022ca1650b5bbe5b2667df91a8a705f333189b1846ad081daaef298a4280eb6b4c671a5edb62ba8ae9a4e6bfe81af66ffc76df57e094ff98762a10fbe8766e0fe2f89769006c964fff0749bb135230187005cb4f849c54aa41f3f2834664ef2e09833a3e648b06d0b349268adce2c6e65ac5a6f07b50b90b40d60a3a2114709ab000ae9218c87e7a867e46a5b940bfd715a24b0fcc31bf2d5f2d425916ffd543ed7afe6828871f1b8314d939fafd99affca4f6d2da0340b36a0e9fde9f2fb9c540d8ff0cdb62787947abaecddf6efacfda5e2c47d0da0e03710f1427506127d2750c46e05cf5f7b1b26f582c2caa8151558d4b29c44bf5eb1ccc6652aa0b92501a171948f7881a5a7a9131495b23fbefe197c2843cf5c984fccdabe899c9dd7071430ecbe938d32441bf22e732327b48101deb8d82066b00ebfb21b1657c3ef3ea696bd55db92dc42f2d78a01688f03d7140fd4d83ffab4c950520f3c81d19a0c62a37de5acc6d1b4c590ace4f3beae59dc3020012329220110ccc91cee70dc56b2afbf6e488b19f145b1f8abe956e7cb49787de114fdce8ba823bcfcab6d429aad0dd3c9f0cf047f"}, @padn={0x1, 0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}, @generic={0x1, 0xce, "eac0de4d592eb1ea2f504f33b73adf899a84b94557c40e46d3c88fe44d960e03ae217d7cc2c7ea4b3b4284ffb76fdab63c95ba5ca36b6cf821f7f11d9c35ce07d9fbd56c55712586dab7929ae4b8c3586cc58d01c74b82131cd2b9f612ff3afd8460af5b0e13eaccd0627ef3ecbe8c64637cd5dcb13c7880a17d6b60f23cb0ced137670ae8c579b85facfa109f2a7d07b13e2e5481395da02d5003d1e70bf0c01a822a2825030a34f6d6af26a12b608a9325ad1b464a6d99ade004cb951428e8b52da07fa65d34d4f2aa7375ca82"}, @hao={0xc9, 0x10, @mcast1}, @jumbo={0xc2, 0x4, 0x6}, @padn={0x1, 0x1, [0x0]}, @ra={0x5, 0x2, 0x81}, @generic={0x2, 0x55, "708012ca551655c00983aa78fcbf0044d4f120acf542f761051d8f3b7423bfc3c947d2ab10c602a006927f57cb13e0c2db7f169db6fb8d264295942b38c7a6fa671f8ddd738fee36b89b8b95cae4602d237f5739b3"}]}, @fragment={0x33, 0x0, 0x5, 0x1, 0x0, 0x12, 0x68}], @echo_request={0x80, 0x0, 0x0, 0x2, 0xe, "35740eb926c68502ccf0250cf52916fbf0e0bb7c5f24d6b03b9a0444b4e6cdf4b27e921ea4bb256041802e4d538dff6a87446174c153e552c7c2c60ff0fa1ae764fe595252a5437b9b6842bf29d33c3a98bd74b5d5c9a2ca6e30e62b7579f505d30a3784e819fc82d2bc75e872bc72d4d157fba72b7454835b3e3ddddb976f6b92210ebb94153a81fd095b9a8505531e57d90f15a169262998497d5f414d110f8055c2bab958e67546b1e360ef39b36ba7bc058005ecf622a12abca159dce0a9dfcaf0f2f4"}}}}, 0x1481) ioctl$IOMMU_OPTION$IOMMU_OPTION_RLIMIT_MODE(r3, 0x3b87, &(0x7f0000000040)={0x18}) syz_usb_connect(0x5, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b510f210950b2a777382010203010902240001000000000904"], 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r7, 0x0, 0x482, &(0x7f0000000040)={0x84, @dev={0xac, 0x14, 0x14, 0xf}, 0x15, 0x3, 'wlc\x00', 0x1, 0x6, 0x3d}, 0x2c) r8 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r8, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e21, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x10000, 0xc, 0x2}}, 0x44) r9 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r9, 0x0, 0x487, &(0x7f0000000000)={{0x84, @loopback, 0x4e21, 0x3, 'lblcr\x00', 0x0, 0x81, 0x39}, {@rand_addr=0x64010500, 0x4e25, 0x3, 0xc3, 0xfffffff8, 0x12d5c}}, 0x44) r10 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r10, &(0x7f0000000400)={&(0x7f0000000140)=@in6={0x2, 0x15, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}}, 0x80, 0x0, 0x0, &(0x7f00000002c0)=[@mark={{0x14, 0x1, 0x24, 0x3}}, @timestamping={{0x14, 0x1, 0x25, 0x400}}], 0x30}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000003c0)={'wlan0\x00'}) 4m35.05790645s ago: executing program 4 (id=471): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000300)={0x58, 0x2, 0x6, 0x301, 0x0, 0x0, {0x5}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x6}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x10}, 0x4000) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_NAN(r4, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000380)={&(0x7f0000000280)={0x5c, r5, 0x4, 0x70bd2a, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x6}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x1}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x6}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x1}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x6}, @NL80211_ATTR_BANDS={0x8, 0xef, 0xc}, @NL80211_ATTR_NAN_MASTER_PREF={0x5}, @NL80211_ATTR_BANDS={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4800) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r8, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r10 = syz_open_procfs(0x0, 0x0) getdents(r10, 0x0, 0x0) setsockopt$sock_attach_bpf(r1, 0x107, 0xf, &(0x7f0000000600)=r10, 0x4) sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r9, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee162fd4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, &(0x7f0000000000)={0xff, r0, 'id1\x00'}) ioctl$MON_IOCG_STATS(r11, 0x80089203, &(0x7f0000000080)) r12 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r10, 0x400) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000000b40)={0xe8, 0x0, &(0x7f00000009c0)=[@acquire={0x40046305, 0x2}, @acquire_done, @increfs={0x40046304, 0x2}, @acquire={0x40046305, 0x1}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000780)={@ptr={0x70742a85, 0x0, &(0x7f0000000480)=""/155, 0x9b, 0x1, 0x1d}, @ptr={0x70742a85, 0x1, &(0x7f0000000680)=""/81, 0x51, 0x0, 0x5}, @ptr={0x70742a85, 0x1, &(0x7f0000000700)=""/106, 0x6a, 0x2, 0x39}}, &(0x7f0000000800)={0x0, 0x28, 0x50}}}, @free_buffer={0x40086303, r12}, @request_death, @increfs={0x40046304, 0x1}, @reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000900)={@flat=@binder={0x73622a85, 0xa, 0x3}, @fda={0x66646185, 0x3, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000840)=""/181, 0xb5, 0x1, 0x7}}, &(0x7f0000000980)={0x0, 0x18, 0x38}}, 0x40}], 0x77, 0x0, &(0x7f0000000ac0)="62949904b35644b2e4d05437b002f0f135bb15d24ba30195a4f9726edf681d7c984545c91cbebed436a58b63bccf739aa54ae9b7e1cb32b308b925cdc2e42468fabdc1a7089952173ddc1dd981765f36d0a43ee34ac2d6bbf5c8f5cbbe27aeb4884169797df44b8afd413db25da010aa87556472a05ae1"}) 4m33.247461309s ago: executing program 4 (id=475): r0 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x4}, 0x80, &(0x7f0000000080)=[{0x0}, {&(0x7f0000001400)}], 0x2}, 0x4000001) r1 = socket(0x2b, 0x1, 0x1) listen(r1, 0x5) ioctl$sock_inet_udp_SIOCINQ(r1, 0x894b, 0x0) syz_usb_connect$uac2(0x0, 0xa6, 0x0, 0x0) r2 = io_uring_setup(0x1890, &(0x7f0000000580)={0x0, 0xa1c5, 0x80, 0x4, 0x30f}) r3 = eventfd2(0x100, 0x80000) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r2, 0x7, &(0x7f0000000140)=r3, 0x1) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x5, &(0x7f0000000740)=ANY=[@ANYBLOB="180200000100000000000000000000008500000017000000850000005000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x9, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ffffffc}, 0x94) r5 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r5, 0x40186f40, &(0x7f0000000440)=0x10) ioctl$SNDCTL_FM_4OP_ENABLE(r5, 0x4004510f, &(0x7f0000000200)) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1ec) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000140)='ramfs\x00', 0x10010, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000003800)={0x2020}, 0x2020) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x0, 0x14, 0x0, &(0x7f0000000900)="e02742e8680d85ff9782762f86dd", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002f40)=ANY=[@ANYBLOB="ac0000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000000010c000280050001000000000008000740000000"], 0xac}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="b40000000001010400000000000000000a0000003c0001802c000180140003000000000000000000000000000000000014000400ff0100000000000000000000000000010c0002800500010000000000440002802c00018014000300fe8000200000000000000000000000aa14000400fe8000000000000000000000000000aa0c00028005000100000000000600034000040000080007400000040018000680140004"], 0xb4}}, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r2, 0x5, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xa6d9d000) setsockopt$MRT_DEL_MFC_PROXY(r1, 0x0, 0xd3, &(0x7f0000000280)={@multicast2, @rand_addr=0x64010100, 0x0, "ea8183a83326c6ee672806e7dc060c3deb30c317a448f484342df850698125c8", 0x3, 0x9, 0x8001, 0x5}, 0x3c) landlock_restrict_self(0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) 4m32.361714803s ago: executing program 32 (id=475): r0 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x4}, 0x80, &(0x7f0000000080)=[{0x0}, {&(0x7f0000001400)}], 0x2}, 0x4000001) r1 = socket(0x2b, 0x1, 0x1) listen(r1, 0x5) ioctl$sock_inet_udp_SIOCINQ(r1, 0x894b, 0x0) syz_usb_connect$uac2(0x0, 0xa6, 0x0, 0x0) r2 = io_uring_setup(0x1890, &(0x7f0000000580)={0x0, 0xa1c5, 0x80, 0x4, 0x30f}) r3 = eventfd2(0x100, 0x80000) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r2, 0x7, &(0x7f0000000140)=r3, 0x1) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x5, &(0x7f0000000740)=ANY=[@ANYBLOB="180200000100000000000000000000008500000017000000850000005000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x9, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ffffffc}, 0x94) r5 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r5, 0x40186f40, &(0x7f0000000440)=0x10) ioctl$SNDCTL_FM_4OP_ENABLE(r5, 0x4004510f, &(0x7f0000000200)) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1ec) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000140)='ramfs\x00', 0x10010, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000003800)={0x2020}, 0x2020) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x0, 0x14, 0x0, &(0x7f0000000900)="e02742e8680d85ff9782762f86dd", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002f40)=ANY=[@ANYBLOB="ac0000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000000010c000280050001000000000008000740000000"], 0xac}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="b40000000001010400000000000000000a0000003c0001802c000180140003000000000000000000000000000000000014000400ff0100000000000000000000000000010c0002800500010000000000440002802c00018014000300fe8000200000000000000000000000aa14000400fe8000000000000000000000000000aa0c00028005000100000000000600034000040000080007400000040018000680140004"], 0xb4}}, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r2, 0x5, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xa6d9d000) setsockopt$MRT_DEL_MFC_PROXY(r1, 0x0, 0xd3, &(0x7f0000000280)={@multicast2, @rand_addr=0x64010100, 0x0, "ea8183a83326c6ee672806e7dc060c3deb30c317a448f484342df850698125c8", 0x3, 0x9, 0x8001, 0x5}, 0x3c) landlock_restrict_self(0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) 2m33.90613049s ago: executing program 5 (id=916): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x0, 0x0, &(0x7f0000000100)='syzkaller\x00', 0x8001000d, 0xad, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x8d}, 0x90) io_setup(0x10001, &(0x7f0000000000)=0x0) r4 = eventfd2(0x9, 0x801) io_cancel(r3, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0xf, r2, &(0x7f0000000140)="d2865e0aff21c25379b8ec4386d14412978b6e0f6dfb32d9b480a6831b81434a720c7165fd7da3620f18f14ac42c0d9402df2c8f1a604507305aff2acd5bf7d3e370c9d9bbd7d1c9a3ee5e7d58a894684c8c5aa326c1791eea63fdbe6d31a0af09f8da3ddfecc9ddec630be39bcf999ed0ec3ebf7aaf7ab17f6654fcf769c429fed40615e73d10ec580b3845dfd89ce995f08347e5ffb1c76b9a5b7646e1fdc61fae52a9a30e0cf314c51daaf3fcc4fe7876075c8788c738f8bf9b11e5fe49e518408cb17091d1d292514bf3", 0xcc, 0x4, 0x0, 0x2, r4}, &(0x7f0000000280)) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) ioctl(r1, 0x8b1a, &(0x7f0000000040)) 2m33.815641193s ago: executing program 5 (id=917): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x88041, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)={0x18, 0x32, 0x9, 0x870bd27, 0x25dfdbfe, {0x3}, [@nested={0x4, 0x1a}]}, 0x16}, 0x1, 0x0, 0x0, 0x46804}, 0x84) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f00000000c0)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_VLAN(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r5, 0x1, 0x0, 0x10, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}]}, 0x1c}}, 0x8010) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d03, 0x0, 0x1}]}) r7 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r7, &(0x7f0000000240)={0x2020}, 0x2020) ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x10000000000000cf, 0x0, [{}]}) 2m33.603409237s ago: executing program 5 (id=918): writev(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=@newsa={0x130, 0x10, 0x7, 0x0, 0x0, {{@in6=@mcast2, @in=@multicast2, 0x4e20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@ipv4={'\x00', '\xff\xff', @loopback}, {0x6, 0x1, 0x2, 0x0, 0xffffffe, 0x1}, {0x0, 0x200000, 0x7}, {0x40000, 0xfffffffd, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0xfe, 0x34}, [@encap={0x1c, 0x4, {0x0, 0x4e22, 0x4e22, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}, @lifetime_val={0x24, 0x9, {0x6b8f, 0x8000000000000001, 0xb4, 0x5}}]}, 0x130}, 0x1, 0x0, 0x0, 0x1}, 0x0) socket$key(0xf, 0x3, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newsa={0x118, 0x1a, 0x2, 0x70bd2a, 0x0, {{@in6=@dev={0xfe, 0x80, '\x00', 0x1f}, @in=@rand_addr=0x64010104, 0x3, 0x0, 0x4e22, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x4d5, 0x2b}, @in6=@private0, {0x5a, 0xb400, 0x2, 0xfeffff7f00000001, 0x0, 0x60000}, {0x0, 0x200000, 0x4, 0xfffffffffffffffd}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x20}, [@address_filter={0x28, 0x1a, {@in=@empty, @in6=@ipv4={'\x00', '\xff\xff', @multicast1}, 0x2, 0x67, 0x5c}}]}, 0x118}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @redir={{0xa}, @val={0x4}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x6c}, 0x1, 0x0, 0x0, 0x40}, 0x24000840) syz_emit_ethernet(0x7e, &(0x7f0000000300)={@local, @local, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x48, 0x11, 0x0, @remote, @local, {[], {0x4e20, 0xe22, 0x48, 0x0, @wg=@cookie={0x3, 0x2, "88c73b21f267636d01dbe5712c1c941e1cdafbbb43f09c28", "e13808ca72381f41e5fff9620915b6f78670dfaf9a2038083179cf6b7931c9b4"}}}}}}}, 0x0) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_VLAN(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x24, r3, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x9}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x240080d4}, 0x0) 2m33.518909464s ago: executing program 5 (id=919): mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r1, 0x3ba0, &(0x7f0000000380)={0x48, 0x1, r2, 0x0, 0x4, 0x5b}) ioctl$IOMMU_IOAS_IOVA_RANGES(r1, 0x3b84, &(0x7f0000000340)={0x20, r2, 0x0, 0x0, 0x0}) chdir(&(0x7f0000000140)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x100) mount$afs(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn']) r3 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000100)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x98f90f, 0x8000, '\x00', @string=&(0x7f0000000140)}}) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r5 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r5, 0xc018937c, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r4}, './bus\x00'}) ioctl$IOMMU_TEST_OP_MD_CHECK_REFS(r0, 0x3ba0, &(0x7f0000000540)={0x48, 0x4, 0x0, 0x0, 0xeb, &(0x7f0000000440)="032639405da2acf046ed4fe3443137f28b937baec209a1013e07fc0ea6a1f47d25f3b3bde4b92c845e1b1e1d231f4945d920316ada71c3e95e8959dae56e1d8d78f025ed0bdeb9eb1dae3f5eba57ea99e0d54f5881d860f80bbeee7b458a5cb6156fe5c362d154c69e888dfef8d1cd96b76e5debd781e1c7aa765e7c169043f857395f2c115958f81e3b012496e86030fe51909c025ee91020bb4f049a944ef1bc5d2235764db9973cf0f32cdd8db76430a49cd279cad9d20d10efe39cbe84f9876c67e12ceef56c390d694716232d0034734a66c987a43d0e81fe7bd324035ee09d34d91fb40fbcbb46e7", 0x4}) 2m33.396145314s ago: executing program 5 (id=920): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x74}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x18, 0x4, &(0x7f0000000100)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xbf}]}, &(0x7f0000000300)='GPL\x00', 0x8, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x101}, 0x94) 2m32.753200849s ago: executing program 5 (id=924): r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) fchdir(r0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/uts\x00') mount(&(0x7f0000000000), &(0x7f0000000040)='./cgroup\x00', 0x0, 0x1001, 0x0) r1 = add_key$user(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x3}, &(0x7f0000000100)="bf323d040be3bfe276e6cae5ff89859edfaffbaaab3ba3c9a35412fb797bbae15ee98556de91bc03f5aff00d965375969befde52e19dbb413a4904e63bc9f30362d242b77482f335016bf68b57166eed57c2239f329b2cf8ed4d57957b1b3a7e7620d2b82bafd5d2d699058c026489258dee4b6129b9d6b4276fbe8c", 0x7c, 0xffffffffffffffff) r2 = add_key$user(&(0x7f0000000180), &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000240)="062f2e45563a9252fc56c9bc43aecaf17241fe0feb6cf7b75e32b21372427c344bc937f7ce34b64d244515193e5a9d2596c9334a3e154035a87614770a13613aa17ab9d254cd14b4e90bf45524211d712439fd826c2ee5bbc929a4597b9089cd7ed98ab299ef585973b86007b843bdbba61dc4eb8a8577fecf19b3852c0a3de8e97bf2434c518e2008f2b8e31c24e4664b60575e3a2f3a413311b0fbddcf17273c0cca849d956d12f32e35873c4a5ec94f01d9ebe18fd7f3983111c6b2a1a28702be224a908cd04b640e09be90a0991780c6c3416bf7f78b7cda3f53dba14f964914010fa7205e587c7958450e9bd4a96716978d655cd55b333a93a0b9cf460391e625432bbb70b4832b9aec1388eb6d67202e6beb04fc13781cd38652540de248e1399d3e5e189d1006f2769c57574898fe97a7cf6af034d0bb7564da01efbd3dfb9727a61f3d046785039ec39b4bc2ef1150278d6baba7466ceae65f20ee51de25645dcd20c9becef92b9971f378d4957dfdeb3e604ef8d7e39d6f1801a59d97d5a648a8c9d94cc0d0827bf5887569f17b19d0a70a8f039ed44b4a0753e9ce440f0cbe442a04c7124ad59aa968820778410c48b14cdb94d73a9adced212a4662d35b1ea0b81a97bb0fca9a128e631e4635fc2655744cb2c24bd9eebd192538f72fc16eeda69bc02ed1ec3acd565b31f4329957ed39dd614e2c6965dc61116b4556f5ea6f031817967d3f79db83c34a666328dcb7adaea5b5ee2125442af6d9c42a44ce9e8731f400c57368016e8e8c5868b3f2c8ee33eb74a90c7f7900e17cd5864af9d18941a45c3f7a020ba2f4f7febbd593398ba8e72ad2876e57791851f11e56a66220bea7fd10282e952a116192dd3550c9c5d727f0810d9edced27c39dcd74cc20f5ad733dedfcdbc9b5273b67ca1fe45de8ff82c3d5488d8e57c217e4aa4d6d9ebbbe780e93296f6c24c40d08419178ed29e5cef0b6a3512b333601e103f3a63709a54f4d3741521faaddd16327bfe6a417b7eab16f94f6a44f764c9a39794877e49455a57b2ef513a28070984e8dfb9d27e8cfd1dfcdc90ae47e983ebfb737ed5b4cd09084b4a5b03a2b606c1e42d67947f7b149a843f21b7e0ac50889adb96988f913b4beacb1c5dd41769f876cafc69513aece40184e0a5104d8a059775b122647b064ccef1a1a4eaa48936c14af56a7e575dfefe033d152a685de23fe004eaa3f2b12c5bf9af743e78072208a42ab5f3336c4d1967a82a20c5a42cc7a74aee263e82ee3f8a9f53335c0c23575443710297e2eb351d7ddb9736437fef1c5049bed6607c6740b29d919b22834d2dad9496205e4f979898f5a75a3336d9e5f99b6e7b4c81c501544a307cb7edfef320686027d33eaa75954c44874a70a6f67af7e6378bb34ea8a7e1ab967c7b30a205307e73229f1c53549fd71c47fa40dd226a1effa19a67a76328decf7d94a086883c9ef230a2a61a1c7db808d34c83de28f94deb3c0134256807f9d51fb04af032db53abc5e8dad6acbea1538a661f659566155427fba7be5a56683f90b39b16595ef8896dcce32cb7b2bb9ef9f885684b36ebe7bf21e69bcb6959c0ce90700b5aefd50f51934ea03c5ed1cabaab6ef28c9dc5433fb373998e8112e65c2f6be4363e2cdd7913a6371aad6b00b470c2e46cd78b486bea8b55d79d2b171200c922b50ac8218398e34cb85412b0bd07fdb35fa97f160150c270eb3a1bc088069bd682471ded836d5ba2c026c66a599f3ab0f28b4f9406a30c6710f7b00af3fc6efcd4faf00264e03c178e140319d121421a8db127ff6c65360325a0d0b7906111dfafb0c6fe0b1bdf7a5aa688ecdfacdf13f7229183d5b4b7d814ba4ace4b5f3aee1f9477e9022550ae7a6f7cb378a744d27e8c20be0378d83c10c4b5bae87335d93803e3027224c8485ca24fec1b9c3709ec0e1bf181a9074e305a68c260ee15fd0cbaa2007243611853ac15ba59597c0693da81104b3c6e6b0e10663bc331666b5bddd8a2373148644e9ede9cebf3a51d06aaa9232a481547dbf551e43775cbc85edb2ed94769edc87b020578f951e0de1d690d894ddf8292b0e6cc19d2c5bc187942ecdb531ac87aab1c0fbffd5fbde6b4b87590cbc2e7eaf60382c29db0e37e320523228f4bc07a42a82e037ae308cf3683d1508ecc20fea52fbf35ad2e5effbf23d1764f03fdcf08dd0b13fe6a571b7b1e3c037fc01d23c48b2340cacea00f7c675a74b2802a5d246941953ee255b5e605cc039c40ddf89025f5f93ea9594a12fd0f534d1fdc3ccbe7e10db539406843570394ace9cc3b612b61bd80cc12bf467b004c9437c313bbe8634c1ee4bc4ee64aa5de01b678c9104d71256a9459aee1f786470926130b19bf73f091d2970bd17131f0adeeefa2baa6ce7f50870a0e6c0f3406e01d64cd0a97944becccee070f3ac2edfb2e05a931d4c2d419695d4bcdf2685f1c9c7fcee192a186b541c838b64e861c9ed6b4470bbdf25bef5933f414d195eeb461f9f2985114373360a54045cd5d8f0d1aa1a8176dbf40044405cdc9feb554f97218e952b7d07c3d9ae1aea92e49d2d70184e909249d832a8a30d952890bcf70db62ed5a8af57cdff58fa28abc0b5127bef73b44d4743581addf2ab0d61830e3d8586c1ca34fd72a80c3d70b3aec6bb87322f1edac9f716ed708f0190a550ea08c6416d1fa08416a5fd019e1e80ee6015c0fd7de06b6ae9b59d2dbe35e33a8035264f3389d00e9dcbf76d82b12a599bfe15233dfdf6a5c63d7bbdf1fc483a41576273c550a82ea1b8790f61c87f0b5bff75b95276369f52a02b9fab1b13b35316c465955478f2c3d857ff1264f02b39b8af77ddf57de74b82bbd14169ef0bd5de73af2e5da5aee5f94664a9ebdf4b026c9b9d5e7fa454bbcff38f42b749694f8fae31caa1ce6a891f5222326d777f3247c14d9c01ec1b331f9b35af186099cfd9f7c200508e48ae2d870f591d829d78258c658f0ed4d832dc363b1b7adee9a9ce83939e372e7ef289a6d05be8226970d04c70d8bcbd8ecf57970730aecb12b7fb6423bcee8b09debb5e2841e551dd4cecdb02891f53ad3101a6f5c813c5cb1663ba924411f9be590f10fb8d1af51dff8e15af5192e863f93260989c52a65f2b99c1e1e2bb0dd1f85b44fff361359308de1b19867c6c813b62e46e7712cc484ed730b078d8abf88d9e6419045679f4cfbaa2556a6d67cf9b0873461f8bc960bd9ae96112d435870575f278e95588f9e9c3d99f599b459ab656992d249d2c4e4cd9b86b46d7c363218ab06382eee6291c2fea424e17ce0f011ef30e0159f26949fa44b066c71a586f4fa22799977a2a873a1e687ddf764c3d416dc85d727c6de397c4b5eba051480f3c313b97f053cfbb53e90409792c2fc333e58370473e7101915ee19b55c381687d71829a144cf983cf4af4b605c7bdb182c9f351d1a148ea031ab1aa387721ad89fbcfa188c9d74706d76fe08b5551d93702bc08ef9e045a8414d679858f5a0b0670d04c4b1961e75ec8dfbbabb324be69ea459099b2209cce1f8938260083263964838cf7002d5e0fd5ae90e34395ad2acb224fe790fa2af509d5df3a7c049a9376f6f749e4655fd2be265f097afbc48033e4743290ca514c379eef02cae6533065fbf5a3a8874dc1930be27d7616034c295b7f96a2393fe0947f97c70991e8591d0573f2852b22f87222a5e4ae65db2a21e49089a35009fae94dc5238e5b4684a617b43cbd7fda7f34233490f50c1802cc73f3e15aa25e6985b4a5d8e4b54e155518f0e8c670b9c2dffbe38870f7a004b3219bfbae1bd37b914a45444e75eb39922211d36e196e7669a9bf7f11aafee4c516497f7273a6ca9975a70e0a47db80085da52b590ed4a7f5ec9336135fb2a30ea07f185dd05d4b8285cd46b492df1d912c2be176fe0c77d1a8a98cd43184cd2e2c9752c3179018a119c08aa29ca4be26593d45048f8840a45a68c89d7637fa2c13499da90ffe20b4a0e26ddb725709802745aac598a86c66be1a5b830549389edd0dc2ecf75f7e720be38d7504b568662db2f88b71f3e236ffecfe96a59a5c9f3d903d5343c60b5a85f7da6bb3dbcea30b3919838d13e29943e80bbe44b2e0b1cab4e08b0a5993ea7bfbf8f41697c8664f61d90b77d149acd4cb74e7e6d442245672e252106bfe7246c3fde1e046422b4db916263555f1e30f29bb918cb75801ef948d4052b1322c554a10c821e72f1f5c079d4f2dc690cfa3eed33ecd7ac10478a4e39d5aa03389914256b77cdc2426a8b4cb11e1a0a740388b95046614a910e2fecd2a610227287be120ad81bb809cd0b560290b1d678882a515db7bd3a67a2e49dc4a5f149c161ee0f823a87ca7cb785e63ff916ec700704c95919adc424e10c0f7ca6167c7f59ee51bdeaa3eadbb2ad40def4b06352c02ee2622222f818bb61542f2b667fdb81539690330391052968675a2b2158432b98e71d630340fb2183dcae3d4da4b808846b2f1117417dba66e5c68d9ccec9eccf8720ff762c024e6e603134b5866c8439bd505d03ff2489849f70e7408dd20182a7163bd0b6827bcd65c662f2f3f3ea932b717d7105d6fb62c520d1bd1e55661e63f1de124b3a2123e613fae974c44747bd3888de3d0daf4616b54561c7f2f6d1ab34e57809045c1a463e7e45c32f1857cd90aefa0a6cb22b66de798d86bd1e8fbf3caab658096e64f27d3d0d6b7dc2f91af5db7fcdc042059a2ea1e070989aa55f357d54c8b484b91bc345ddcf04cceb7012771b76d6e7af237f6d7d939709e2bb94c63786cda527c98258063a84eec8c91c3c7e155dbc8fb19d27af60c5720ded6df3a2b65239b343085a1d2ca24142669e42e39b536f7c203628c41400a9be4cab73b4912f4e8685b54c7573ef881596d77c460c8eed7de7175062d8e65b541317ba02cde2fd9d59c3ad480626217f395253f8bae7461d559ea7a11c98327b4f0fcc9b7c1282496b75c66aebc60515ada55b4aa8b0204ec4ad911f7432010e962b95ccf08274cd7b47bbf558fc5f26bfb94959aacddfed8ca983cd63f411b410e65c148a19560b0f7bf98cb04c01bf8c315b2db84dd9e839f549a60a55acb02cf7cd7780054a904f6fc8a52909bcb000c7034f97234fd16a29dd4041d28d763bb683c1ac8506c471c99f8ff02b452bfd93a08e3143d8fb3a6a343e7eb2bf302680c976d5c8424a54579e7170d2a3718017f5be2f7de82ff34c1f368d33a71aab803c07088c5f7ef8d65ca5436dfefb6c275f6e8043dc9f658a65bfc8441e7a87c90a645eb7e0319d128dc04e6a49e1e4562b4b07e74b64e774e5058b21cf089cac55a4e3ec7b12bb92dc4c69251c9d9a60271e192679780fe9029534c8859c469d1b875cf71e808ff953177c086bbe5ee33f84e18a07044e528849d75a7f063ceb99ffdc268b35b3ef9c87c14e874d359e6751fb858c2b2bd12917d2166a65b16a539657e971cffc24dece7a41ad59e8a5c5fa852f5b614584d180a81feb57f4f64f0c43f33d860fe87f906f5a3a5b06dab08e3e6ea06d92eb57164d0eab0468a849f8979fa8db6877779fac41abca25f200873717cddc68f6480f1a0b77f2b70d6cbe72a426f3e33919ee4b4a1f172d229ba2ddf02b82fe5653e04c5d50aa80325ed63c357ba611bd80a034b71ce786b4371fc20b47a1dec4c1ee85b068275fd7f8d1ad41aa8e6d419211b7dc7425a6df8ff0f853589b58e466f04d02d359491e14b84d67bd0f3d5c6e8674bcde2c73b2e3280", 0x1000, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000001240)={r1, r2}, &(0x7f0000001280)=""/95, 0x5f, &(0x7f0000001400)={&(0x7f0000001300)={'sha224-asm\x00'}, &(0x7f0000001340)="e7ff8d9a85890e444e71233e0c45b80b91003c9d65cf229d3747dcee790f23c04dde73c081b0cb4fc468828466d9d4452f07b4033857e72c67cf9fcc6a9018a2a8cf7369b113e4ff9da13d0ba2f93b5d394811e4b4162ff3aa79469afd99c6807525ece3745b3c602467177e2c0b22d71e54901d8b1f379809c81a80d4c21ab7118c6cb88c9ca4d03d1b275912db0795bb0d8c04acda0f44837e4c4ad5c8de6440b81895e3e30b0802", 0xa9}) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4c0000001000010400000000feffffff00000000", @ANYRES32=0x0, @ANYBLOB="10100000200800001c0012800e00010069703665727370616e000000080002800400120008000300", @ANYRES32], 0x4c}, 0x1, 0x0, 0x0, 0x8080}, 0xd0) sendmmsg(r4, &(0x7f0000000000), 0x4000000000001f2, 0x0) read$FUSE(r3, &(0x7f0000004200)={0x2020}, 0x2020) 2m32.549215468s ago: executing program 33 (id=924): r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) fchdir(r0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/uts\x00') mount(&(0x7f0000000000), &(0x7f0000000040)='./cgroup\x00', 0x0, 0x1001, 0x0) r1 = add_key$user(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x3}, &(0x7f0000000100)="bf323d040be3bfe276e6cae5ff89859edfaffbaaab3ba3c9a35412fb797bbae15ee98556de91bc03f5aff00d965375969befde52e19dbb413a4904e63bc9f30362d242b77482f335016bf68b57166eed57c2239f329b2cf8ed4d57957b1b3a7e7620d2b82bafd5d2d699058c026489258dee4b6129b9d6b4276fbe8c", 0x7c, 0xffffffffffffffff) r2 = add_key$user(&(0x7f0000000180), &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000240)="062f2e45563a9252fc56c9bc43aecaf17241fe0feb6cf7b75e32b21372427c344bc937f7ce34b64d244515193e5a9d2596c9334a3e154035a87614770a13613aa17ab9d254cd14b4e90bf45524211d712439fd826c2ee5bbc929a4597b9089cd7ed98ab299ef585973b86007b843bdbba61dc4eb8a8577fecf19b3852c0a3de8e97bf2434c518e2008f2b8e31c24e4664b60575e3a2f3a413311b0fbddcf17273c0cca849d956d12f32e35873c4a5ec94f01d9ebe18fd7f3983111c6b2a1a28702be224a908cd04b640e09be90a0991780c6c3416bf7f78b7cda3f53dba14f964914010fa7205e587c7958450e9bd4a96716978d655cd55b333a93a0b9cf460391e625432bbb70b4832b9aec1388eb6d67202e6beb04fc13781cd38652540de248e1399d3e5e189d1006f2769c57574898fe97a7cf6af034d0bb7564da01efbd3dfb9727a61f3d046785039ec39b4bc2ef1150278d6baba7466ceae65f20ee51de25645dcd20c9becef92b9971f378d4957dfdeb3e604ef8d7e39d6f1801a59d97d5a648a8c9d94cc0d0827bf5887569f17b19d0a70a8f039ed44b4a0753e9ce440f0cbe442a04c7124ad59aa968820778410c48b14cdb94d73a9adced212a4662d35b1ea0b81a97bb0fca9a128e631e4635fc2655744cb2c24bd9eebd192538f72fc16eeda69bc02ed1ec3acd565b31f4329957ed39dd614e2c6965dc61116b4556f5ea6f031817967d3f79db83c34a666328dcb7adaea5b5ee2125442af6d9c42a44ce9e8731f400c57368016e8e8c5868b3f2c8ee33eb74a90c7f7900e17cd5864af9d18941a45c3f7a020ba2f4f7febbd593398ba8e72ad2876e57791851f11e56a66220bea7fd10282e952a116192dd3550c9c5d727f0810d9edced27c39dcd74cc20f5ad733dedfcdbc9b5273b67ca1fe45de8ff82c3d5488d8e57c217e4aa4d6d9ebbbe780e93296f6c24c40d08419178ed29e5cef0b6a3512b333601e103f3a63709a54f4d3741521faaddd16327bfe6a417b7eab16f94f6a44f764c9a39794877e49455a57b2ef513a28070984e8dfb9d27e8cfd1dfcdc90ae47e983ebfb737ed5b4cd09084b4a5b03a2b606c1e42d67947f7b149a843f21b7e0ac50889adb96988f913b4beacb1c5dd41769f876cafc69513aece40184e0a5104d8a059775b122647b064ccef1a1a4eaa48936c14af56a7e575dfefe033d152a685de23fe004eaa3f2b12c5bf9af743e78072208a42ab5f3336c4d1967a82a20c5a42cc7a74aee263e82ee3f8a9f53335c0c23575443710297e2eb351d7ddb9736437fef1c5049bed6607c6740b29d919b22834d2dad9496205e4f979898f5a75a3336d9e5f99b6e7b4c81c501544a307cb7edfef320686027d33eaa75954c44874a70a6f67af7e6378bb34ea8a7e1ab967c7b30a205307e73229f1c53549fd71c47fa40dd226a1effa19a67a76328decf7d94a086883c9ef230a2a61a1c7db808d34c83de28f94deb3c0134256807f9d51fb04af032db53abc5e8dad6acbea1538a661f659566155427fba7be5a56683f90b39b16595ef8896dcce32cb7b2bb9ef9f885684b36ebe7bf21e69bcb6959c0ce90700b5aefd50f51934ea03c5ed1cabaab6ef28c9dc5433fb373998e8112e65c2f6be4363e2cdd7913a6371aad6b00b470c2e46cd78b486bea8b55d79d2b171200c922b50ac8218398e34cb85412b0bd07fdb35fa97f160150c270eb3a1bc088069bd682471ded836d5ba2c026c66a599f3ab0f28b4f9406a30c6710f7b00af3fc6efcd4faf00264e03c178e140319d121421a8db127ff6c65360325a0d0b7906111dfafb0c6fe0b1bdf7a5aa688ecdfacdf13f7229183d5b4b7d814ba4ace4b5f3aee1f9477e9022550ae7a6f7cb378a744d27e8c20be0378d83c10c4b5bae87335d93803e3027224c8485ca24fec1b9c3709ec0e1bf181a9074e305a68c260ee15fd0cbaa2007243611853ac15ba59597c0693da81104b3c6e6b0e10663bc331666b5bddd8a2373148644e9ede9cebf3a51d06aaa9232a481547dbf551e43775cbc85edb2ed94769edc87b020578f951e0de1d690d894ddf8292b0e6cc19d2c5bc187942ecdb531ac87aab1c0fbffd5fbde6b4b87590cbc2e7eaf60382c29db0e37e320523228f4bc07a42a82e037ae308cf3683d1508ecc20fea52fbf35ad2e5effbf23d1764f03fdcf08dd0b13fe6a571b7b1e3c037fc01d23c48b2340cacea00f7c675a74b2802a5d246941953ee255b5e605cc039c40ddf89025f5f93ea9594a12fd0f534d1fdc3ccbe7e10db539406843570394ace9cc3b612b61bd80cc12bf467b004c9437c313bbe8634c1ee4bc4ee64aa5de01b678c9104d71256a9459aee1f786470926130b19bf73f091d2970bd17131f0adeeefa2baa6ce7f50870a0e6c0f3406e01d64cd0a97944becccee070f3ac2edfb2e05a931d4c2d419695d4bcdf2685f1c9c7fcee192a186b541c838b64e861c9ed6b4470bbdf25bef5933f414d195eeb461f9f2985114373360a54045cd5d8f0d1aa1a8176dbf40044405cdc9feb554f97218e952b7d07c3d9ae1aea92e49d2d70184e909249d832a8a30d952890bcf70db62ed5a8af57cdff58fa28abc0b5127bef73b44d4743581addf2ab0d61830e3d8586c1ca34fd72a80c3d70b3aec6bb87322f1edac9f716ed708f0190a550ea08c6416d1fa08416a5fd019e1e80ee6015c0fd7de06b6ae9b59d2dbe35e33a8035264f3389d00e9dcbf76d82b12a599bfe15233dfdf6a5c63d7bbdf1fc483a41576273c550a82ea1b8790f61c87f0b5bff75b95276369f52a02b9fab1b13b35316c465955478f2c3d857ff1264f02b39b8af77ddf57de74b82bbd14169ef0bd5de73af2e5da5aee5f94664a9ebdf4b026c9b9d5e7fa454bbcff38f42b749694f8fae31caa1ce6a891f5222326d777f3247c14d9c01ec1b331f9b35af186099cfd9f7c200508e48ae2d870f591d829d78258c658f0ed4d832dc363b1b7adee9a9ce83939e372e7ef289a6d05be8226970d04c70d8bcbd8ecf57970730aecb12b7fb6423bcee8b09debb5e2841e551dd4cecdb02891f53ad3101a6f5c813c5cb1663ba924411f9be590f10fb8d1af51dff8e15af5192e863f93260989c52a65f2b99c1e1e2bb0dd1f85b44fff361359308de1b19867c6c813b62e46e7712cc484ed730b078d8abf88d9e6419045679f4cfbaa2556a6d67cf9b0873461f8bc960bd9ae96112d435870575f278e95588f9e9c3d99f599b459ab656992d249d2c4e4cd9b86b46d7c363218ab06382eee6291c2fea424e17ce0f011ef30e0159f26949fa44b066c71a586f4fa22799977a2a873a1e687ddf764c3d416dc85d727c6de397c4b5eba051480f3c313b97f053cfbb53e90409792c2fc333e58370473e7101915ee19b55c381687d71829a144cf983cf4af4b605c7bdb182c9f351d1a148ea031ab1aa387721ad89fbcfa188c9d74706d76fe08b5551d93702bc08ef9e045a8414d679858f5a0b0670d04c4b1961e75ec8dfbbabb324be69ea459099b2209cce1f8938260083263964838cf7002d5e0fd5ae90e34395ad2acb224fe790fa2af509d5df3a7c049a9376f6f749e4655fd2be265f097afbc48033e4743290ca514c379eef02cae6533065fbf5a3a8874dc1930be27d7616034c295b7f96a2393fe0947f97c70991e8591d0573f2852b22f87222a5e4ae65db2a21e49089a35009fae94dc5238e5b4684a617b43cbd7fda7f34233490f50c1802cc73f3e15aa25e6985b4a5d8e4b54e155518f0e8c670b9c2dffbe38870f7a004b3219bfbae1bd37b914a45444e75eb39922211d36e196e7669a9bf7f11aafee4c516497f7273a6ca9975a70e0a47db80085da52b590ed4a7f5ec9336135fb2a30ea07f185dd05d4b8285cd46b492df1d912c2be176fe0c77d1a8a98cd43184cd2e2c9752c3179018a119c08aa29ca4be26593d45048f8840a45a68c89d7637fa2c13499da90ffe20b4a0e26ddb725709802745aac598a86c66be1a5b830549389edd0dc2ecf75f7e720be38d7504b568662db2f88b71f3e236ffecfe96a59a5c9f3d903d5343c60b5a85f7da6bb3dbcea30b3919838d13e29943e80bbe44b2e0b1cab4e08b0a5993ea7bfbf8f41697c8664f61d90b77d149acd4cb74e7e6d442245672e252106bfe7246c3fde1e046422b4db916263555f1e30f29bb918cb75801ef948d4052b1322c554a10c821e72f1f5c079d4f2dc690cfa3eed33ecd7ac10478a4e39d5aa03389914256b77cdc2426a8b4cb11e1a0a740388b95046614a910e2fecd2a610227287be120ad81bb809cd0b560290b1d678882a515db7bd3a67a2e49dc4a5f149c161ee0f823a87ca7cb785e63ff916ec700704c95919adc424e10c0f7ca6167c7f59ee51bdeaa3eadbb2ad40def4b06352c02ee2622222f818bb61542f2b667fdb81539690330391052968675a2b2158432b98e71d630340fb2183dcae3d4da4b808846b2f1117417dba66e5c68d9ccec9eccf8720ff762c024e6e603134b5866c8439bd505d03ff2489849f70e7408dd20182a7163bd0b6827bcd65c662f2f3f3ea932b717d7105d6fb62c520d1bd1e55661e63f1de124b3a2123e613fae974c44747bd3888de3d0daf4616b54561c7f2f6d1ab34e57809045c1a463e7e45c32f1857cd90aefa0a6cb22b66de798d86bd1e8fbf3caab658096e64f27d3d0d6b7dc2f91af5db7fcdc042059a2ea1e070989aa55f357d54c8b484b91bc345ddcf04cceb7012771b76d6e7af237f6d7d939709e2bb94c63786cda527c98258063a84eec8c91c3c7e155dbc8fb19d27af60c5720ded6df3a2b65239b343085a1d2ca24142669e42e39b536f7c203628c41400a9be4cab73b4912f4e8685b54c7573ef881596d77c460c8eed7de7175062d8e65b541317ba02cde2fd9d59c3ad480626217f395253f8bae7461d559ea7a11c98327b4f0fcc9b7c1282496b75c66aebc60515ada55b4aa8b0204ec4ad911f7432010e962b95ccf08274cd7b47bbf558fc5f26bfb94959aacddfed8ca983cd63f411b410e65c148a19560b0f7bf98cb04c01bf8c315b2db84dd9e839f549a60a55acb02cf7cd7780054a904f6fc8a52909bcb000c7034f97234fd16a29dd4041d28d763bb683c1ac8506c471c99f8ff02b452bfd93a08e3143d8fb3a6a343e7eb2bf302680c976d5c8424a54579e7170d2a3718017f5be2f7de82ff34c1f368d33a71aab803c07088c5f7ef8d65ca5436dfefb6c275f6e8043dc9f658a65bfc8441e7a87c90a645eb7e0319d128dc04e6a49e1e4562b4b07e74b64e774e5058b21cf089cac55a4e3ec7b12bb92dc4c69251c9d9a60271e192679780fe9029534c8859c469d1b875cf71e808ff953177c086bbe5ee33f84e18a07044e528849d75a7f063ceb99ffdc268b35b3ef9c87c14e874d359e6751fb858c2b2bd12917d2166a65b16a539657e971cffc24dece7a41ad59e8a5c5fa852f5b614584d180a81feb57f4f64f0c43f33d860fe87f906f5a3a5b06dab08e3e6ea06d92eb57164d0eab0468a849f8979fa8db6877779fac41abca25f200873717cddc68f6480f1a0b77f2b70d6cbe72a426f3e33919ee4b4a1f172d229ba2ddf02b82fe5653e04c5d50aa80325ed63c357ba611bd80a034b71ce786b4371fc20b47a1dec4c1ee85b068275fd7f8d1ad41aa8e6d419211b7dc7425a6df8ff0f853589b58e466f04d02d359491e14b84d67bd0f3d5c6e8674bcde2c73b2e3280", 0x1000, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000001240)={r1, r2}, &(0x7f0000001280)=""/95, 0x5f, &(0x7f0000001400)={&(0x7f0000001300)={'sha224-asm\x00'}, &(0x7f0000001340)="e7ff8d9a85890e444e71233e0c45b80b91003c9d65cf229d3747dcee790f23c04dde73c081b0cb4fc468828466d9d4452f07b4033857e72c67cf9fcc6a9018a2a8cf7369b113e4ff9da13d0ba2f93b5d394811e4b4162ff3aa79469afd99c6807525ece3745b3c602467177e2c0b22d71e54901d8b1f379809c81a80d4c21ab7118c6cb88c9ca4d03d1b275912db0795bb0d8c04acda0f44837e4c4ad5c8de6440b81895e3e30b0802", 0xa9}) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4c0000001000010400000000feffffff00000000", @ANYRES32=0x0, @ANYBLOB="10100000200800001c0012800e00010069703665727370616e000000080002800400120008000300", @ANYRES32], 0x4c}, 0x1, 0x0, 0x0, 0x8080}, 0xd0) sendmmsg(r4, &(0x7f0000000000), 0x4000000000001f2, 0x0) read$FUSE(r3, &(0x7f0000004200)={0x2020}, 0x2020) 12.368154039s ago: executing program 3 (id=1485): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r1 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) (async) getgroups(0x2, &(0x7f0000001080)=[0xee01, 0xffffffffffffffff]) setgroups(0x0, 0x0) (async) keyctl$chown(0x4, r1, 0xee01, r2) keyctl$setperm(0x5, r1, 0x80b0927) keyctl$KEYCTL_MOVE(0x3, r1, 0x0, 0x0, 0x0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010829bd7000000000000100000008000300", @ANYRES32=r4], 0x7c}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x16, 0xb, &(0x7f00000000c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffe}, [@printk={@lld, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x40}, {0x85, 0x0, 0x0, 0x73}}]}, &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 9.112392825s ago: executing program 1 (id=1493): sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00', @ANYRES16, @ANYBLOB="050059e709c11a65"], 0x24}}, 0x0) r0 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000000), 0x20000007c, 0x0) r2 = dup3(r0, r1, 0x0) ioctl$MON_IOCG_STATS(r2, 0xc0109207, 0x0) 9.015302826s ago: executing program 3 (id=1494): r0 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x4}, 0x80, &(0x7f0000000080)=[{0x0}, {&(0x7f0000001400)}], 0x2}, 0x4000001) r1 = socket(0x2b, 0x1, 0x1) ioctl$sock_inet_udp_SIOCINQ(r1, 0x894b, 0x0) syz_usb_connect$uac2(0x0, 0xa6, 0x0, 0x0) r2 = io_uring_setup(0x1890, &(0x7f0000000580)={0x0, 0xa1c5, 0x80, 0x4, 0x30f}) r3 = eventfd2(0x100, 0x80000) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r2, 0x7, &(0x7f0000000140)=r3, 0x1) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x5, &(0x7f0000000740)=ANY=[@ANYBLOB="180200000100000000000000000000008500000017000000850000005000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x9, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ffffffc}, 0x94) r5 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r5, 0x40186f40, &(0x7f0000000440)=0x10) ioctl$SNDCTL_FM_4OP_ENABLE(r5, 0x4004510f, &(0x7f0000000200)) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1ec) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000140)='ramfs\x00', 0x10010, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000003800)={0x2020, 0x0, 0x0}, 0x2020) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x0, 0x14, 0x0, &(0x7f0000000900)="e02742e8680d85ff9782762f86dd", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002f40)=ANY=[@ANYBLOB="ac0000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000000010c000280050001000000000008000740000000"], 0xac}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="b40000000001010400000000000000000a0000003c0001802c000180140003000000000000000000000000000000000014000400ff0100000000000000000000000000010c0002800500010000000000440002802c00018014000300fe8000200000000000000000000000aa14000400fe8000000000000000000000000000aa0c00028005000100000000000600034000040000080007400000040018000680140004"], 0xb4}}, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r2, 0x5, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xa6d9d000) setsockopt$MRT_DEL_MFC_PROXY(r1, 0x0, 0xd3, &(0x7f0000000280)={@multicast2, @rand_addr=0x64010100, 0x0, "ea8183a83326c6ee672806e7dc060c3deb30c317a448f484342df850698125c8", 0x3, 0x9, 0x8001, 0x5}, 0x3c) landlock_restrict_self(0xffffffffffffffff, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000680)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="3f0000000000000014aa6b117064676500000400028008000400fffbffffb9f949e24e0881756f56d71a7ed450a5fdef9d13a4089756edd8a6e400"/73], 0x3c}}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000440)={0x50, 0x0, r6, {0x7, 0x29, 0x0, 0x4001000, 0x3, 0x8002, 0x0, 0x7, 0x0, 0x0, 0x0, 0x1}}, 0x50) 8.868937965s ago: executing program 1 (id=1498): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = socket$alg(0x26, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r3 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000040)) ioctl$NS_GET_NSTYPE(r3, 0xb703, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r4 = getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(r4, 0x2, &(0x7f0000000000)=0x10000006) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7be", 0x10) fcntl$addseals(r3, 0x409, 0xf) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xf, 0x3, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='GPL\x00', 0x100000, 0x0, 0x0, 0x41000, 0x62, '\x00', 0x0, @fallback=0x5d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000001c0)={r8, 0x0, 0x25, 0x19, @val=@kprobe_multi=@syms={0x0, 0x9, &(0x7f0000000740)=[&(0x7f0000000340)='+\x00', &(0x7f0000000600)='#[\'\x90@^#\x00', &(0x7f00000007c0)='skcipher\x00\as\xf0~d%\x97%\n\xed\xbd\xdc\x95\xaf\x19W\xa29=\x04\xf6g\xf1\\\xdfJ\xce\x87\xe6n\xa8:\x7f\x89\a\xd30\xe3ms\xb8\xc0\a\xb2\xb1\xa3\xec\x00O\xbd1\x1c\xa0(\xe3\x99\b0,\x00!\xbc\xd6(\x8c\\j\xe6\x98\x81\x15\a@\x0e\xde\x1dp\x9f\x8dd\x83\xfb\x9eZm\xbc\xdf\x92\xd4\xe9\x1f;\x8a\x98\x8c!\x1c\xcf \xfa\xde\x91yN\xf5G\x00', &(0x7f00000005c0)='\x00', &(0x7f0000000540)='skcipher\x00', &(0x7f0000000640), &(0x7f0000000680)='syz1\x00', &(0x7f00000006c0), &(0x7f0000000700)='+\x00']}}, 0x30) r9 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000040)="d8000000100081044e81f782db44b904021d006a0f000000e8fe55a1290015000600142603600e120900040044fe0000a8001600050003402e60000000000000b94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a985162f7ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d3220a7c9f8775730d16a4683f1aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x60044084) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4004}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}]}, @NFT_MSG_DELSETELEM={0x2c, 0xe, 0xa, 0x401, 0x0, 0x0, {0xa}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x98}, 0x1, 0x0, 0x0, 0x4000804}, 0x40) r10 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r10, 0x0) 7.498618138s ago: executing program 3 (id=1501): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f00000003c0)=@raw={'raw\x00', 0x8, 0x3, 0xb20, 0x0, 0x43, 0xa0, 0x0, 0x98, 0xa88, 0x178, 0x178, 0xa88, 0x178, 0x49, 0x0, {[{{@ip={@loopback, @local, 0x0, 0x0, 'veth0_to_bond\x00', 'ip6erspan0\x00'}, 0x12a, 0x1a0, 0x1c0, 0x0, {0x0, 0x7a010000}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x8, 0x0, 'syz0\x00'}}, @common=@unspec=@quota={{0x38}, {0x0, 0x0, 0x3, {0x100000001}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0x888, 0x8c8, 0x0, {}, [@common=@unspec=@connbytes={{0x38}, {[{0xb}]}}, @common=@unspec=@u32={{0x7e0}, {[{[{0x9}, {0x3}, {0x1, 0x1}, {0x0, 0x3}, {0x4, 0x2}, {0xb1d}, {0x3}, {0x8}, {0x2, 0x3}, {0x3}, {0x103}], [{0xe8f3, 0x5}, {0x1d, 0x6}, {0x4, 0x8}, {0x0, 0x4}, {0x4, 0xc3e}, {0x1, 0x100}, {0x6, 0x7}, {0x3, 0x3}, {0xf2, 0x3}, {0x3ff, 0x8}, {0x10, 0x3}], 0x6, 0x6}, {[{0x80, 0x3}, {0x2}, {0x6, 0x1}, {0x355cbac3, 0x2}, {0x0, 0x2}, {0x0, 0x2}, {0x7}, {0xe7, 0x2}, {0x3, 0x3}, {0x5598e8fe, 0x2}, {0x6, 0x1}], [{0x9, 0x9097}, {0x7, 0x9}, {0x7, 0xa}, {0x6, 0x8}, {0x20080, 0x5}, {0x13, 0xc0000000}, {0x40, 0xb}, {0x9, 0x6}, {0x4, 0x2}, {0x6, 0x7fffffff}, {0x7fffffff, 0x400}], 0x7}, {[{0x84, 0x2}, {}, {0x0, 0x2}, {0xffffffff, 0x1}, {}, {0x5, 0x1}, {0x5, 0x2}, {0x8, 0x3}, {0x2, 0x3}, {0x8, 0x1}, {0x7, 0x1}], [{0x9, 0x5}, {0x80, 0x32}, {0x0, 0xfffffff7}, {0xff, 0x1}, {0x7, 0x6}, {0xdb9, 0xff4}, {0x6, 0x3ff}, {0x3, 0x6}, {0x5, 0x10}, {0x9, 0x6}, {0x10000, 0x2}], 0x4, 0x2a}, {[{0x3, 0x2}, {0xa, 0x1}, {0x6, 0x1}, {0x10, 0x3}, {0x2, 0x2}, {0x2, 0x2}, {0x3, 0x1}, {0x2, 0x3}, {0x3, 0x1}, {0x2, 0x2}, {0x477d, 0x1}], [{0x4, 0xffffffff}, {0x200, 0x6}, {0x4be1, 0x4044}, {0x1}, {0x5, 0xc}, {0x3, 0x4}, {0x2, 0x4}, {0x800, 0x8000}, {0x8, 0x800}, {0x3, 0x2}, {0xe, 0x8000}], 0x4, 0xb}, {[{0x7, 0x1}, {0xd, 0x3}, {0x5}, {0x61}, {0x9}, {}, {0x2}, {0x1}, {0x0, 0x2}, {0x9, 0x3}, {0x5, 0x3}], [{0x58d, 0x3ff}, {0x0, 0x7f}, {0x6}, {0xfc9b, 0x80000001}, {0x101, 0x7}, {0x7, 0x1}, {0x7, 0x8001}, {0x2, 0x1}, {0x2, 0x2}, {0x9, 0x4cf}, {0x7, 0x10000}], 0x1}, {[{0x2}, {0x9}, {0x8, 0x1}, {0x2, 0x3}, {0x71, 0x3}, {0x0, 0x2}, {0xe, 0x2}, {0x6, 0x2}, {0x5}, {0x3000000, 0x3}, {0x6, 0x1}], [{0x9, 0x3}, {0x5, 0x7fffffff}, {0xffff, 0x4}, {0x0, 0x7}, {0x8, 0xb502}, {0x1ff, 0x86}, {0x6, 0xffffffff}, {0x3, 0x4}, {0x5, 0x6}, {0xf, 0xf93}, {0x5, 0x4}], 0x3, 0x3}, {[{0x7, 0x1}, {0x3, 0x1}, {0x45d7}, {0xfff, 0x3}, {0xc4f, 0x3}, {0x0, 0x2}, {0x400, 0x1}, {0x2, 0x1}, {0x4, 0x2}, {0xfffffffd}, {0x2}], [{0x3, 0x6}, {0xed, 0xd}, {0x80, 0xb81d}, {0x2ca, 0x80000000}, {0x8, 0xff}, {0x7, 0x45a8}, {0x8, 0x6}, {0x4, 0x1}, {0x2, 0x6}, {0xfc, 0x6}, {0xd, 0x138c}], 0x6}, {[{0x4, 0x1}, {0x800}, {0x9, 0x2}, {0xf0000000, 0x2}, {0x6, 0x3}, {0x3, 0x2}, {0x8, 0x2}, {}, {0x9}, {0x400, 0x2}, {0x8, 0x3}], [{0x7, 0xfffffffd}, {0x2}, {0x2, 0x2}, {0x8f, 0x6}, {0x7, 0x5}, {0x8, 0x7}, {0xb, 0x82c6}, {0xb1b}, {0x7, 0xffff}, {0x1, 0x9b8d}, {0xec, 0x5}], 0x2, 0x6}, {[{0x8}, {0x0, 0x1}, {0xac000000}, {0x6, 0x2}, {0x2d8, 0x3}, {0x7e3ea4bc}, {0x8, 0x1}, {0x4f, 0x3}, {0x4, 0x2}, {0xfffffff7}, {0x3, 0x2}], [{0x5, 0x42}, {0x76a74689, 0x4}, {0x1, 0xfffffffd}, {0x8000, 0x7}, {0x400, 0xdd}, {0xfff, 0x8}, {0x10, 0xfffffffe}, {0xa6d00, 0xfffffff7}, {0x10001, 0xfc8d}, {0x0, 0x10001}, {0x4, 0x3}], 0x1, 0x9}, {[{0x8, 0x1}, {0x3, 0x3}, {0x18, 0x3}, {0x3ff, 0x3}, {0x7fffffff}, {0x8}, {0x1}, {0x8, 0x3}, {0xf1b6}, {0x80, 0x3}, {0x4, 0x2}], [{0x2, 0x4}, {0x3, 0xf}, {0x9, 0x6}, {0x7f, 0x8}, {0x7, 0x273e1899}, {0x4, 0x1}, {0x6, 0x3}, {0x1, 0xb7}, {0x8, 0x3}, {0x3, 0x1}, {0x7ff, 0x63}], 0xb, 0x3}, {[{0x1, 0x2}, {0x6, 0x3}, {0xffff, 0x1}, {0x1}, {0x4, 0x3}, {0x3, 0x3}, {0xaa7}, {0x100, 0x3}, {0x2}, {0xfffffff7, 0xb90af65875a5dc08}, {0x4, 0x3}], [{0x3}, {0x8001, 0x7}, {0x10000, 0x7524}, {0x73d, 0x4}, {0x0, 0x280000}, {0x3, 0x3af}, {0x5, 0x2}, {0x101, 0xbf}, {0x10000, 0x6}, {0x3, 0x800}], 0x8, 0x5}], 0xff}}]}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "f1c098b60204ed02d82cf440fef5497b80c29d381d41116000"}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0xb80) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x140) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', 0x0, 0x8c0058, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000001180)={0xffffffffffffffff, 0x20, &(0x7f0000001140)={&(0x7f0000000f40)=""/233, 0xe9, 0x0, &(0x7f0000001040)=""/222, 0xde}}, 0x10) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000001340), 0x101800, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000011c0)={0x1b, 0xc, &(0x7f0000000000)=ANY=[@ANYRESHEX=r2], &(0x7f0000000880)='syzkaller\x00', 0x5, 0x0, 0x0, 0x41100, 0xc0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, r3, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) io_uring_setup(0x650b, &(0x7f0000000180)={0x0, 0x2c3f, 0x0, 0x21, 0xab}) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) close(r4) r5 = socket(0x28, 0x5, 0x0) r6 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r6, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r6, 0x4) connect$vsock_stream(r5, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff9000/0x5000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r7 = io_uring_setup(0x80000007, &(0x7f0000000040)={0x0, 0xc8a1, 0x4000, 0x3, 0xa2}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r7, 0x2219, 0x7721, 0x16, 0x0, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xd, 0xf}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r11 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r11) 7.155729978s ago: executing program 0 (id=1503): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0xffffffffffffff34, &(0x7f0000000080)={0x0, 0xb8}}, 0x0) getsockname$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000000)=0x14) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="34000000100081eee80000040000000010000000", @ANYRES32=r3, @ANYBLOB="ddfffffdff000000140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="20000000140001000000000000000000020000ff", @ANYRES32=r3, @ANYBLOB="08000200ac1414aa"], 0x20}}, 0x0) r4 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r4, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local}, 0xc) r5 = socket(0x10, 0x803, 0x4) sendmsg$nl_route(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x20088814}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@delchain={0x24, 0x11, 0x1, 0x70bd2b, 0x600, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0x0, 0x10}, {0xfff1}}}, 0x24}}, 0x0) 6.971344804s ago: executing program 3 (id=1504): openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101001, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$FS_IOC_READ_VERITY_METADATA(0xffffffffffffffff, 0xc0286687, &(0x7f0000000280)={0x3, 0x1, 0x0, 0x0}) setsockopt$IP_VS_SO_SET_STARTDAEMON(0xffffffffffffffff, 0x0, 0x48b, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffff, 0x2}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, 0x0, 0x0) r2 = socket$inet(0xa, 0x801, 0x84) listen(r2, 0x8) r3 = socket$inet(0xa, 0x801, 0x84) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fff7ffa}]}) userfaultfd(0x1) syz_init_net_socket$x25(0x9, 0x5, 0x0) listen(r3, 0xfffffffd) r4 = socket$inet(0xa, 0x801, 0x84) listen(r4, 0x8) r5 = socket$inet(0xa, 0x2, 0x87) listen(r5, 0x8) listen(0xffffffffffffffff, 0x7) socket$inet6_sctp(0xa, 0x1, 0x84) socket$packet(0x11, 0x2, 0x300) r6 = socket(0x15, 0x5, 0x0) getsockopt(r6, 0x200000000114, 0x2721, 0x0, &(0x7f0000000000)) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x48241, 0x0) 6.415458697s ago: executing program 1 (id=1505): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="3800000040000701feffffff02000007017c0000040042800c00018006000600800a00001400028010000b800c0011"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc800) 6.3706427s ago: executing program 3 (id=1506): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x45e, 0x9d, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xe8, 0xb, "", [{{0x9, 0x4, 0x0, 0x5, 0x11, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x7, 0x0, 0x1, {0x22, 0x1e3}}, {{{0x9, 0x5, 0x81, 0x3, 0x38d707d343173689, 0x1, 0xa, 0x70}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$OSF_MSG_ADD(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="0815000000051104000000000000000001000005540201"], 0x1508}, 0x1, 0x0, 0x0, 0x40000d0}, 0x10) 6.300767086s ago: executing program 0 (id=1507): r0 = syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f00000000c0)={0x6, 0x7, 0x5}) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x400, 0x43) lsetxattr$security_selinux(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240), &(0x7f00000006c0)='system_u:object_r:hald_var_lib_t:s0\x00', 0x24, 0x0) read$FUSE(r2, 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_freezer_state(r3, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r4, &(0x7f0000000080)='THAWED\x00', 0x7) 6.294532668s ago: executing program 2 (id=1508): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='comm\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x7) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x202000) file_setattr(r1, 0x0, &(0x7f0000000000)={0x2000, 0xfffffffc, 0xed, 0x0, 0x400}, 0x18, 0x1000) write$selinux_load(r1, &(0x7f0000000040)={0xf97cff8c, 0x8, 'SE Linux', "bac9767a6e3cc8c8935b230b967f813f7774719466a1bb4914574cde8b60946e36b352cd66bffa864774602bde"}, 0x3d) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000000)) syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='comm\x00') (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x7) (async) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x202000) (async) file_setattr(r1, 0x0, &(0x7f0000000000)={0x2000, 0xfffffffc, 0xed, 0x0, 0x400}, 0x18, 0x1000) (async) write$selinux_load(r1, &(0x7f0000000040)={0xf97cff8c, 0x8, 'SE Linux', "bac9767a6e3cc8c8935b230b967f813f7774719466a1bb4914574cde8b60946e36b352cd66bffa864774602bde"}, 0x3d) (async) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000000)) (async) 6.116050724s ago: executing program 1 (id=1509): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, 0x0) r0 = socket$inet6(0xa, 0x3, 0x7) r1 = socket$packet(0x11, 0x2, 0x300) r2 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r2, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000140)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1e, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r3}, &(0x7f0000000200), &(0x7f0000000300)}, 0x20) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000180)=r4, 0x4) sendmmsg$inet6(r0, &(0x7f0000004580)=[{{&(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='$'], 0x28}}], 0x1, 0x0) 6.115660143s ago: executing program 2 (id=1510): syz_emit_ethernet(0x52, &(0x7f0000000140)={@local, @multicast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "020001", 0x1c, 0x6, 0x1, @local, @local, {[], {{0xfffa, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x7, 0x2, 0x88, 0x0, 0x0, {[@generic={0xfe, 0x5, "8a9587"}]}}}}}}}}, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni-avx2\x00'}, 0x58) socket(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000005580)=""/102392, 0x18ff8) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_CAP_HYPERV_SYNIC(r3, 0x4068aea3, &(0x7f0000000180)) ioctl$KVM_RUN(r3, 0xae80, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, 0x0}], 0x1, 0x40800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000e40)=@newtaction={0x18, 0x30, 0xb, 0x5, 0x0, {}, [{0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x8890}, 0x40) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x85c}, 0x1, 0x0, 0x0, 0x24048011}, 0xc000) recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{0x0}, {0x0}], 0x2}, 0x41) r5 = socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000001c00)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000001bc0)={&(0x7f0000000800)=@ipv6_getrule={0x1c, 0x22, 0x100, 0x70bd26, 0x25dfdbfc, {0xa, 0x80, 0x0, 0xd, 0x4, 0x0, 0x0, 0x4, 0xc}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x55010) recvmmsg(0xffffffffffffffff, &(0x7f0000003600)=[{{0x0, 0x0, &(0x7f00000003c0)=[{0x0}, {&(0x7f0000000080)=""/76, 0x4c}, {&(0x7f0000003280)=""/88, 0x58}, {&(0x7f0000000180)=""/91, 0x5b}, {&(0x7f0000000200)=""/38, 0x26}, {&(0x7f0000000240)=""/75, 0x4b}, {&(0x7f00000002c0)=""/193, 0xc1}], 0x7, &(0x7f0000000440)=""/252, 0xfc}, 0x4870}, {{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000640)=""/73, 0x49}, {&(0x7f00000006c0)=""/181, 0xb5}], 0x2}, 0x6}, {{0x0, 0x0, &(0x7f0000001c40)=[{&(0x7f0000000840)=""/223, 0xdf}, {&(0x7f0000000940)=""/16, 0x10}, {&(0x7f0000001980)=""/150, 0x96}, {&(0x7f0000001a40)=""/193, 0xc1}, {&(0x7f0000001b40)=""/74, 0x4a}, {0x0}], 0x6, &(0x7f0000001cc0)=""/143, 0x8f}, 0x1}, {{0x0, 0x0, &(0x7f0000001e00), 0x0, &(0x7f0000001e40)=""/83, 0x53}, 0x9}], 0x4, 0x40000100, 0x0) poll(&(0x7f0000000040)=[{0xffffffffffffffff, 0x30c8}], 0x1, 0xff) setsockopt$inet_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) r6 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) 6.100387383s ago: executing program 0 (id=1511): r0 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x4}, 0x80, &(0x7f0000000080)=[{0x0}, {&(0x7f0000001400)}], 0x2}, 0x4000001) r1 = socket(0x2b, 0x1, 0x1) ioctl$sock_inet_udp_SIOCINQ(r1, 0x894b, 0x0) syz_usb_connect$uac2(0x0, 0xa6, 0x0, 0x0) r2 = io_uring_setup(0x1890, &(0x7f0000000580)={0x0, 0xa1c5, 0x80, 0x4, 0x30f}) r3 = eventfd2(0x100, 0x80000) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r2, 0x7, &(0x7f0000000140)=r3, 0x1) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x5, &(0x7f0000000740)=ANY=[@ANYBLOB="180200000100000000000000000000008500000017000000850000005000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x9, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ffffffc}, 0x94) r5 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r5, 0x40186f40, &(0x7f0000000440)=0x10) ioctl$SNDCTL_FM_4OP_ENABLE(r5, 0x4004510f, &(0x7f0000000200)) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1ec) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000140)='ramfs\x00', 0x10010, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000003800)={0x2020, 0x0, 0x0}, 0x2020) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x0, 0x14, 0x0, &(0x7f0000000900)="e02742e8680d85ff9782762f86dd", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002f40)=ANY=[@ANYBLOB="ac0000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000000010c000280050001000000000008000740000000"], 0xac}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="b40000000001010400000000000000000a0000003c0001802c000180140003000000000000000000000000000000000014000400ff0100000000000000000000000000010c0002800500010000000000440002802c00018014000300fe8000200000000000000000000000aa14000400fe8000000000000000000000000000aa0c00028005000100000000000600034000040000080007400000040018000680140004"], 0xb4}}, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r2, 0x5, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xa6d9d000) setsockopt$MRT_DEL_MFC_PROXY(r1, 0x0, 0xd3, &(0x7f0000000280)={@multicast2, @rand_addr=0x64010100, 0x0, "ea8183a83326c6ee672806e7dc060c3deb30c317a448f484342df850698125c8", 0x3, 0x9, 0x8001, 0x5}, 0x3c) landlock_restrict_self(0xffffffffffffffff, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000680)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="3f0000000000000014aa6b117064676500000400028008000400fffbffffb9f949e24e0881756f56d71a7ed450a5fdef9d13a4089756edd8a6e400"/73], 0x3c}}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000440)={0x50, 0x0, r6, {0x7, 0x29, 0x0, 0x4001000, 0x3, 0x8002, 0x0, 0x7, 0x0, 0x0, 0x0, 0x1}}, 0x50) 5.96960659s ago: executing program 1 (id=1512): r0 = socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='westwood', 0x8) dup2(0xffffffffffffffff, 0xffffffffffffffff) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x41}}, 0x1a) r1 = socket$alg(0x26, 0x5, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf0667000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(0xffffffffffffffff, 0x4008af60, 0x0) sendmsg$NFT_BATCH(r2, 0x0, 0x40) ioctl$FIONCLEX(0xffffffffffffffff, 0x5450) bind$alg(r1, &(0x7f0000000300)={0x26, 'hash\x00', 0x0, 0x0, 'streebog256\x00'}, 0x58) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSETMODE(r6, 0x4b3a, 0x0) r7 = accept4(r1, 0x0, 0x0, 0x800) recvmmsg$unix(r7, &(0x7f0000003700)=[{{0x0, 0x700, 0x0, 0x0, 0x0, 0x500}}], 0x600, 0x0, 0x0) 5.349939484s ago: executing program 2 (id=1513): ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'ip6tnl0\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x4, 0x40, 0x0, 0xfff, 0x20, @mcast1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x7800, 0x700, 0x3, 0x3a9}}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000100)={@ifindex=r0, 0x6, 0x1, 0x8, &(0x7f0000000000)=[0x0, 0x0, 0x0], 0x3, 0x0, &(0x7f0000000040)=[0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x40) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000240), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_HARDIF(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x34, r2, 0x400, 0x70bd28, 0x25dfdbfb, {}, [@BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xadc}]}, 0x34}, 0x1, 0x0, 0x0, 0x4008080}, 0x20000481) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), r1) sendmsg$NL80211_CMD_GET_STATION(r1, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x54, r4, 0x4, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xc, 0x78}}}}, [@NL80211_ATTR_STA_AID={0x6, 0x10, 0x396}, @NL80211_ATTR_STA_SUPPORTED_RATES={0x24, 0x13, [{0x4}, {0x36}, {0x30}, {0x9}, {0x1, 0x1}, {0x0, 0x1}, {0x24}, {0x2, 0x1}, {0x36}, {0x30}, {0x6c}, {0x2}, {0xdb6b5f0037193638, 0x1}, {0x60}, {0x2}, {0x25, 0x1}, {0x48, 0x1}, {0x3dcdfe6244f38e83}, {0x30, 0x1}, {0xb}, {0x36, 0x1}, {0x18}, {0x60}, {0x16}, {0x5, 0x1}, {0xc}, {0xb, 0x1}, {0x60, 0x1}, {0x5, 0x1}, {0x6c, 0x1}, {0x0, 0x1}, {0x24, 0x1}]}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x2}]}, 0x54}, 0x1, 0x0, 0x0, 0x20048005}, 0x110) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_POWER_SAVE(r5, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x48, r4, 0x1, 0x70bd25, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0xc, 0x2d}}}}, [@NL80211_ATTR_PS_STATE={0x8, 0x5d, 0x1}, @NL80211_ATTR_PS_STATE={0x8, 0x5d, 0x1}, @NL80211_ATTR_PS_STATE={0x8, 0x5d, 0x1}, @NL80211_ATTR_PS_STATE={0x8, 0x5d, 0x1}, @NL80211_ATTR_PS_STATE={0x8, 0x5d, 0x1}]}, 0x48}, 0x1, 0x0, 0x0, 0x1}, 0xd0) (async, rerun: 64) r6 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) r7 = accept4$packet(0xffffffffffffffff, &(0x7f0000000640)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000680)=0x14, 0x0) getpeername$packet(r7, &(0x7f00000006c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000700)=0x14) (async) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000780), r5) sendmsg$TIPC_CMD_RESET_LINK_STATS(r5, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x28, r9, 0x200, 0x70bd25, 0x25dfdbff, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, ["", "", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x48014}, 0x1) (async, rerun: 32) r10 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000008c0)=@generic={&(0x7f0000000880)='./file0\x00', 0x0, 0x8}, 0x18) (async, rerun: 32) r11 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000ac0)={&(0x7f0000000900)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xac, 0xac, 0x3, [@float={0xd, 0x0, 0x0, 0x10, 0x4}, @struct={0x4, 0x3, 0x0, 0x4, 0x1, 0x5, [{0x10, 0x4, 0x9}, {0x9, 0x5, 0xfffffff0}, {0x7, 0x2}]}, @ptr={0x9}, @int={0x3, 0x0, 0x0, 0x1, 0x0, 0x73, 0x0, 0x24, 0x1}, @type_tag={0x7, 0x0, 0x0, 0x12, 0x2}, @struct={0x5, 0x5, 0x0, 0x4, 0x1, 0x401, [{0x8, 0x2}, {0x2, 0x1, 0x7}, {0x6, 0x4, 0x5}, {0x3, 0x0, 0x9}, {0x3, 0x1}]}]}, {0x0, [0x5f]}}, &(0x7f0000000a00)=""/161, 0xc7, 0xa1, 0x0, 0x8, 0x10000, @value=r7}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=@base={0xc, 0x1, 0x1000000, 0x4, 0x5002, r10, 0xb0000000, '\x00', 0x0, r11, 0x4, 0x4, 0x4}, 0x50) sendmsg$IPVS_CMD_DEL_DAEMON(r1, &(0x7f0000000d00)={&(0x7f0000000b80), 0xc, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0xd0, 0x0, 0x10, 0x70bd28, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x9}, @IPVS_CMD_ATTR_DEST={0x34, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x3}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x4}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xe}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x2289}]}, @IPVS_CMD_ATTR_SERVICE={0x3c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0xc}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e21}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10001}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}, @IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_STATE={0x8}]}]}, 0xd0}, 0x1, 0x0, 0x0, 0x4000090}, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000e00)={'ip6_vti0\x00', &(0x7f0000000d80)={'ip6gre0\x00', r8, 0x2f, 0xd, 0x3, 0xa8, 0x40, @private1, @dev={0xfe, 0x80, '\x00', 0x1e}, 0x80, 0x10, 0x80000000, 0x8}}) sendmsg$nl_route(r6, &(0x7f0000000ec0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000e80)={&(0x7f0000000e40)=@dellink={0x30, 0x11, 0x800, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r12, 0x1000, 0x521}, [@IFLA_CARRIER_CHANGES={0x8, 0x23, 0x1}, @IFLA_PROMISCUITY={0x8, 0x1e, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x4c011) (async) syz_create_resource$binfmt(&(0x7f0000000f00)='./file0\x00') (async, rerun: 64) r13 = socket$inet6(0xa, 0xa, 0x85e00000) (rerun: 64) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x20, &(0x7f0000000f40)={@loopback, 0x1, 0x2, 0x1, 0x8, 0x0, 0x86ce}, &(0x7f0000000f80)=0x20) (async, rerun: 64) r14 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000fc0), 0x200000, 0x0) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000001040)={&(0x7f0000001000)=[0x0], 0x1}) (async) ioctl$DRM_IOCTL_MODE_GET_LEASE(0xffffffffffffffff, 0xc01064c8, &(0x7f00000010c0)={0x6, 0x0, &(0x7f0000001080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) (async) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(0xffffffffffffffff, 0xc01064bd, &(0x7f0000001180)={&(0x7f0000001100)="7dba6898abb72c2bab5b5ab18e5338786506e45bb4a6898278037bd50a6fe2d7a09e121e30a4da8ae87dde576e841a7ec577ed794cbf0d38ed0aa14afdf9c8f4c2a9bbc1eceb6232", 0x48, 0x0}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(0xffffffffffffffff, 0xc02064b9, &(0x7f0000001280)={&(0x7f00000011c0)=[0x0], &(0x7f0000001200)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1, 0x0, 0xbbbbbbbb}) (rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r14, 0xc01864c6, &(0x7f0000001300)={&(0x7f00000012c0)=[r15, r16, r17, r18], 0x4, 0x80800}) 5.196700457s ago: executing program 2 (id=1515): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = socket$alg(0x26, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r3 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000040)) ioctl$NS_GET_NSTYPE(r3, 0xb703, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r4 = getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(r4, 0x2, &(0x7f0000000000)=0x10000006) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7be", 0x10) fcntl$addseals(r3, 0x409, 0xf) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xf, 0x3, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='GPL\x00', 0x100000, 0x0, 0x0, 0x41000, 0x62, '\x00', 0x0, @fallback=0x5d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000580)={'veth1_to_bond\x00'}) r9 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000040)="d8000000100081044e81f782db44b904021d006a0f000000e8fe55a1290015000600142603600e120900040044fe0000a8001600050003402e60000000000000b94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a985162f7ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d3220a7c9f8775730d16a4683f1aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x60044084) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4004}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}]}, @NFT_MSG_DELSETELEM={0x2c, 0xe, 0xa, 0x401, 0x0, 0x0, {0xa}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x98}, 0x1, 0x0, 0x0, 0x4000804}, 0x40) r10 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r10, 0x0) 4.794295099s ago: executing program 1 (id=1517): r0 = socket$inet6(0xa, 0x3, 0x8000000003c) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x3a8bc000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) inotify_init1(0x80000) sendmsg$NL80211_CMD_NEW_STATION(r4, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000480)={0x3c, r5, 0xb97534d5fe9704cf, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x580}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc0}, 0x0) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(r2, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000002c0)={&(0x7f0000000180)={0x20, r5, 0x10, 0x70bd2a, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xdad0, 0x2}}}}, ["", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="44000000100001040000000000001a7165368586160fa5fdc9c570d76700000000000032238ee9ab0302f200c9f25f01af0325b6978f4546046ae447e19680a022ec34f154eead495a2a0e55c906b173793f0a8795e3ddb52e1db097cfd3cd80979738036f865cbee8a91de1e572e841fe3ec8", @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800b000100626174616476000014000280100001004241544d414e5f56"], 0xfd12}}, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0xffff, 0xe9, @dev={0xfe, 0x80, '\x00', 0x6}, 0x5}, 0x1c) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x953c, &(0x7f0000000100)=[{&(0x7f0000000000)="2b10", 0xffbd}], 0x1, 0x0, 0x0, 0x2c}, 0x4) 4.201652066s ago: executing program 0 (id=1519): socket$kcm(0x29, 0x5, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000096c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000580)=@newtaction={0x100, 0x30, 0x9, 0x70bd29, 0x0, {}, [{0xec, 0x1, [@m_mpls={0xe8, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x2, 0x101, 0x1, 0x7, 0x9}, 0x3}}, @TCA_MPLS_TTL={0x5, 0x7, 0x9}]}, {0x95, 0x6, "888fd21da1428ca35a908f845604a048c9427efb6b9e9603cc69d195eb40bd7d0afe0ac30d92a7ea443882d92fadf51107f4802b27cad92b0cf7c524269d913be1aba6ddf3a76498fd815834df4045282e23e6a6c807b3988b28104d7390adebf8b1c427eedfd45f1ff360bb873f28127ec1039df043f9e7085f4fbbe2d93593e272916ca623c434da6b1862612ae2c7a9"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}, 0x100}, 0x1, 0x0, 0x0, 0x805}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r2, &(0x7f00000001c0), 0x37) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) pipe2$watch_queue(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) mknodat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x81c0, 0x0) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x1, 0x0) r6 = landlock_create_ruleset(&(0x7f0000000140)={0x4000}, 0x18, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r6, 0x1, &(0x7f0000000180)={0x4000, r5}, 0x0) write$cgroup_int(r4, &(0x7f0000000240)=0x1, 0x12) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) socketpair$tipc(0x1e, 0x2, 0x0, 0x0) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) listen(r2, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) r7 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(0xffffffffffffffff, &(0x7f0000000340)={0x18, 0x0, {0x3, @local, 'hsr0\x00'}}, 0x1e) sendmmsg(r7, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4000000) accept4(r2, 0x0, 0x0, 0x800) (fail_nth: 3) r8 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r8, &(0x7f0000000b00)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) 3.399953197s ago: executing program 3 (id=1520): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000001300)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffee}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x28, 0x2, {{0x3, 0x3, 0x6361, 0x3a, 0xffffffff, 0x1}, [@TCA_NETEM_CORRUPT={0xc, 0x4, {0x5, 0xfffffc01}}]}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b92a, 0x25dfdc01, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0x6, 0xb}, {0xffff, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0xa5b100, 0xffffffc0, 0xffffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4004860}, 0x4890) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="2703", 0x2}], 0x1}, 0x20000000) 3.377501412s ago: executing program 0 (id=1521): r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000400)={[0xfffffffffffffff5]}, 0x8, 0x800) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) epoll_pwait2(r0, &(0x7f0000000380)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x8, &(0x7f00000004c0)={0x0, 0x989680}, &(0x7f0000000500)={[0x6a]}, 0x8) r2 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r2}, &(0x7f0000000000)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r3, 0x1, &(0x7f0000000040), 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYRESDEC], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0xfffffffffffffe8b, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r5, 0x2000300, 0xe, 0x0, &(0x7f0000000000)="63eced8e46dc3f0adf3389f7b986", 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) syz_usb_connect(0x2, 0x2d, &(0x7f0000000080)=ANY=[@ANYRES32=0x0], 0x0) 3.330189047s ago: executing program 6 (id=1522): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, 0x0) r0 = socket$inet6(0xa, 0x3, 0x7) r1 = socket$packet(0x11, 0x2, 0x300) r2 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r2, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000140)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1e, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r3}, &(0x7f0000000200), &(0x7f0000000300)}, 0x20) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000180)=r4, 0x4) sendmmsg$inet6(r0, &(0x7f0000004580)=[{{&(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='$'], 0x28}}], 0x1, 0x0) 3.224228557s ago: executing program 6 (id=1523): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r2 = dup(r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r2, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) fcntl$setsig(0xffffffffffffffff, 0xa, 0x14) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x1c800) socket$inet6(0xa, 0x2, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0x22401, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="c4c1f82f159900000066ba400066ed0f20d835080000000f22d80f09b8010000000f01d90f20e035000002000f22e0c4e1f951b800600000c4e1e958acfd0080000066bad004ed0f2293", 0x4a}], 0x0, 0x43, 0x0, 0x0) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0, 0x3f}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, 0x0) 2.569605344s ago: executing program 2 (id=1524): syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x200000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x3fa, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000008c0)={&(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000bbb000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0x0}, 0x68) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='environ\x00') read$FUSE(r2, &(0x7f0000000a40)={0x2020}, 0xffffffb2) 2.293716885s ago: executing program 6 (id=1525): mkdir(&(0x7f0000000300)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000100)={0x200000000000001}, 0x8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0x2000400}, 0x1c) r1 = msgget(0x1, 0x34) msgctl$MSG_STAT_ANY(r1, 0xd, &(0x7f0000001180)=""/150) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0xc}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x8, 0xc, 0x0, 0x0, 0x2, 0x0, 0x0, 0x40f00, 0xd, '\x00', 0x0, @fallback=0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) epoll_create1(0x0) sendmmsg$inet6(r0, &(0x7f0000003cc0), 0x0, 0x4000000) openat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x143142, 0x120) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d1) socket(0x10, 0x3, 0x0) capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000200)={0x200002, 0x200003, 0x4, 0x4, 0x7}) ioctl$IOMMU_IOAS_UNMAP(0xffffffffffffffff, 0x3b86, &(0x7f0000000080)={0x18, 0x0, 0x7, 0x556}) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSETLED(r5, 0x4b32, 0x7) mkdirat(0xffffffffffffffff, 0x0, 0x10) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000280), 0x8, &(0x7f0000000180)={[{@uuid_on}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@metacopy_on}]}) linkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file2\x00', 0x1000) openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0/file2\x00', 0x2028, 0x110) 1.578322296s ago: executing program 2 (id=1526): socket$igmp6(0xa, 0x3, 0x2) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'macvlan1\x00', 0x0}) modify_ldt$write(0x1, &(0x7f0000000040)={0x806, 0xffffffffffffffff}, 0x10) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@bridge_dellink={0x34, 0x13, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, r7}, [@IFLA_AF_SPEC={0x14, 0x1a, 0x0, 0x1, [@AF_INET={0x10, 0x4, 0x0, 0x1, {0xc, 0x2, 0x0, 0x1, [{0x8, 0x1, 0x0, 0x0, 0x9}]}}]}]}, 0x34}}, 0x0) recvmmsg(r3, &(0x7f0000003800)=[{{0x0, 0x0, &(0x7f0000001340)=[{&(0x7f0000000240)=""/4096, 0x1000}, {&(0x7f0000001240)=""/142, 0x8e}, {&(0x7f0000001300)=""/61, 0x3d}], 0x3, &(0x7f0000001380)=""/31, 0x1f}, 0x81}, {{&(0x7f00000013c0)=@in={0x2, 0x0, @multicast1}, 0x80, &(0x7f0000001580)=[{&(0x7f0000001440)=""/171, 0xab}, {&(0x7f0000001500)=""/66, 0x42}], 0x2, &(0x7f00000015c0)=""/178, 0xb2}, 0xfffffffd}, {{&(0x7f0000001680)=@alg, 0x80, &(0x7f0000001ac0)=[{&(0x7f0000001700)=""/168, 0xa8}, {&(0x7f00000017c0)=""/30, 0x1e}, {&(0x7f0000001800)=""/32, 0x20}, {&(0x7f0000001840)=""/182, 0xb6}, {&(0x7f0000001900)=""/129, 0x81}, {&(0x7f00000019c0)=""/46, 0x2e}, {&(0x7f0000001a00)=""/180, 0xb4}], 0x7, &(0x7f0000001b40)=""/78, 0x4e}, 0x1}, {{0x0, 0x0, &(0x7f0000002cc0)=[{&(0x7f0000001bc0)=""/4096, 0x1000}, {&(0x7f0000002bc0)=""/109, 0x6d}, {&(0x7f0000002c40)=""/26, 0x1a}, {&(0x7f0000002c80)=""/29, 0x1d}], 0x4, &(0x7f0000002d00)=""/16, 0x10}, 0x4}, {{&(0x7f0000002d40)=@rc={0x1f, @none}, 0x80, &(0x7f0000003080)=[{&(0x7f0000002dc0)=""/72, 0x48}, {&(0x7f0000002e40)=""/15, 0xf}, {&(0x7f0000002e80)=""/111, 0x6f}, {&(0x7f0000002f00)=""/93, 0x5d}, {&(0x7f0000002f80)=""/234, 0xea}], 0x5, &(0x7f0000003100)=""/164, 0xa4}, 0x1}, {{&(0x7f00000031c0)=@ax25={{}, [@rose, @netrom, @netrom, @bcast, @rose, @rose, @bcast, @netrom]}, 0x80, &(0x7f0000003580)=[{&(0x7f0000003240)=""/129, 0x81}, {&(0x7f0000003300)=""/209, 0xd1}, {&(0x7f0000003400)=""/119, 0x77}, {&(0x7f0000003480)=""/245, 0xf5}], 0x4}, 0x2}, {{0x0, 0x0, &(0x7f00000037c0)=[{&(0x7f00000035c0)=""/49, 0x31}, {&(0x7f0000003600)=""/207, 0xcf}, {&(0x7f0000003700)=""/54, 0x36}, {&(0x7f0000003740)=""/75, 0x4b}], 0x4}, 0x400}], 0x7, 0x2, 0x0) syz_clone(0xc0012fb, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r1, {}, {0x3, 0x5}, {0xfff2}}}, 0x24}}, 0x0) r8 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r8, &(0x7f0000000200)={0xa, 0x4e9f, 0x0, @mcast1, 0x7}, 0x1c) sendmsg(r8, &(0x7f00000000c0)={0x0, 0x952f, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0xfff2}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 1.243504266s ago: executing program 6 (id=1527): r0 = socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='westwood', 0x8) dup2(0xffffffffffffffff, 0xffffffffffffffff) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x41}}, 0x1a) r1 = socket$alg(0x26, 0x5, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf0667000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(0xffffffffffffffff, 0x4008af60, 0x0) sendmsg$NFT_BATCH(r2, 0x0, 0x40) ioctl$FIONCLEX(0xffffffffffffffff, 0x5450) bind$alg(r1, &(0x7f0000000300)={0x26, 'hash\x00', 0x0, 0x0, 'streebog256\x00'}, 0x58) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSETMODE(r6, 0x4b3a, 0x0) r7 = accept4(r1, 0x0, 0x0, 0x800) recvmmsg$unix(r7, &(0x7f0000003700)=[{{0x0, 0x700, 0x0, 0x0, 0x0, 0x500}}], 0x600, 0x0, 0x0) 265.613627ms ago: executing program 6 (id=1528): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0/file0\x00', 0x1c0) r2 = inotify_init() inotify_add_watch(r2, &(0x7f0000000380)='./file0/file0\x00', 0x250008f0) umount2(&(0x7f00000002c0)='./file0\x00', 0x0) recvfrom(r1, 0x0, 0x0, 0x142, 0x0, 0x0) ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r0, 0x3b8c, &(0x7f00000001c0)={0x30, 0x0, 0x0, 0x0, 0x7fffffff, 0x6, 0x1, 0x0}) 102.233263ms ago: executing program 6 (id=1529): r0 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x4}, 0x80, &(0x7f0000000080)=[{0x0}, {&(0x7f0000001400)}], 0x2}, 0x4000001) listen(0xffffffffffffffff, 0x5) ioctl$sock_inet_udp_SIOCINQ(0xffffffffffffffff, 0x894b, 0x0) syz_usb_connect$uac2(0x0, 0xa6, 0x0, 0x0) r1 = io_uring_setup(0x1890, &(0x7f0000000580)={0x0, 0xa1c5, 0x80, 0x4, 0x30f}) r2 = eventfd2(0x100, 0x80000) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r1, 0x7, &(0x7f0000000140)=r2, 0x1) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x5, &(0x7f0000000740)=ANY=[@ANYBLOB="180200000100000000000000000000008500000017000000850000005000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x9, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ffffffc}, 0x94) r4 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r4, 0x40186f40, &(0x7f0000000440)=0x10) ioctl$SNDCTL_FM_4OP_ENABLE(r4, 0x4004510f, &(0x7f0000000200)) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1ec) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000140)='ramfs\x00', 0x10010, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000003800)={0x2020, 0x0, 0x0}, 0x2020) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x0, 0x14, 0x0, &(0x7f0000000900)="e02742e8680d85ff9782762f86dd", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002f40)=ANY=[@ANYBLOB="ac0000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000000010c000280050001000000000008000740000000"], 0xac}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="b40000000001010400000000000000000a0000003c0001802c000180140003000000000000000000000000000000000014000400ff0100000000000000000000000000010c0002800500010000000000440002802c00018014000300fe8000200000000000000000000000aa14000400fe8000000000000000000000000000aa0c00028005000100000000000600034000040000080007400000040018000680140004"], 0xb4}}, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r1, 0x5, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xa6d9d000) setsockopt$MRT_DEL_MFC_PROXY(0xffffffffffffffff, 0x0, 0xd3, &(0x7f0000000280)={@multicast2, @rand_addr=0x64010100, 0x0, "ea8183a83326c6ee672806e7dc060c3deb30c317a448f484342df850698125c8", 0x3, 0x9, 0x8001, 0x5}, 0x3c) landlock_restrict_self(0xffffffffffffffff, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000680)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="3f0000000000000014aa6b117064676500000400028008000400fffbffffb9f949e24e0881756f56d71a7ed450a5fdef9d13a4089756edd8a6e400"/73], 0x3c}}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000440)={0x50, 0x0, r5, {0x7, 0x29, 0x0, 0x4001000, 0x3, 0x8002, 0x0, 0x7, 0x0, 0x0, 0x0, 0x1}}, 0x50) 0s ago: executing program 0 (id=1530): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) r2 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x2) write$binfmt_aout(r2, &(0x7f0000000200)=ANY=[@ANYBLOB="03040000b50000000100fefffeefffff"], 0xc8) socket$alg(0x26, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$sock(r1, &(0x7f0000001540)={&(0x7f0000000140)=@pppoe={0x2a, 0x0, {0x0, @empty, 'lo\x00'}}, 0x80, 0x0}, 0x0) write$cgroup_subtree(r0, &(0x7f0000000200)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = gettid() sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="3c000000100005ff00000000000000000000004a", @ANYRES32=0x0, @ANYBLOB="942a000004000600010000000900011af810de3e16cb71acf55c5199c13135f096684e1818ca93777e8a870cb0f7bbf9d5f7a1ffac9c29f91c324e67e7611a8ae9607a86126ec2ba8ec1b848ba70d1626ca2842c4fa099fb54dce5b2af", @ANYRES32=r8, @ANYBLOB], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x24008080) ptrace$setregs(0xd, r6, 0x0, &(0x7f00000003c0)) kernel console output (not intermixed with test programs): [ 397.751918][ T5617] Bluetooth: hci0: Opcode 0x0c03 failed: -110 ./file0fuseh-s[ 398.172741][ T9577] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 398.319651][ T9577] usb 1-1: device descriptor read/64, error -71 [ 398.586750][ T9577] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 398.754162][ T9577] usb 1-1: device descriptor read/64, error -71 [ 398.875677][ T9577] usb usb1-port1: attempt power cycle [ 399.238790][ T9577] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 399.294792][ T9577] usb 1-1: device descriptor read/8, error -71 [ 399.593387][ T9577] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 399.808005][ T9577] usb 1-1: device descriptor read/8, error -71 [ 400.093882][ T9577] usb usb1-port1: unable to enumerate USB device [ 400.853127][ T30] audit: type=1400 audit(2000000141.151:796): avc: denied { mount } for pid=10404 comm="syz.2.1160" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 400.887184][ T30] audit: type=1400 audit(2000000141.160:797): avc: denied { mounton } for pid=10404 comm="syz.2.1160" path="/252/file0" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=dir permissive=1 [ 400.945861][ T30] audit: type=1400 audit(2000000141.216:798): avc: denied { write } for pid=10375 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 401.072184][ T30] audit: type=1400 audit(2000000141.357:799): avc: denied { unmount } for pid=5622 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 401.179474][ T30] audit: type=1400 audit(2000000141.385:800): avc: denied { write } for pid=10409 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 401.302433][ T30] audit: type=1400 audit(2000000141.563:801): avc: denied { accept } for pid=10391 comm="syz.3.1158" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 401.343777][T10417] : renamed from dummy0 (while UP) [ 401.391280][T10420] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 402.002126][T10420] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 402.182669][T10429] tipc: Started in network mode [ 402.232365][T10429] tipc: Node identity ff000064482d6c58c3e1980000000001, cluster identity 4711 [ 402.253191][T10429] tipc: Enabling of bearer rejected, failed to enable media [ 402.391558][ T30] audit: type=1400 audit(2000000142.601:802): avc: denied { write } for pid=10418 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 402.535505][ T30] audit: type=1400 audit(2000000142.723:803): avc: denied { write } for pid=10438 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 402.773165][T10447] FAULT_INJECTION: forcing a failure. [ 402.773165][T10447] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 402.793337][T10447] CPU: 0 UID: 0 PID: 10447 Comm: syz.0.1167 Tainted: G L syzkaller #0 PREEMPT(full) [ 402.793365][T10447] Tainted: [L]=SOFTLOCKUP [ 402.793372][T10447] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 402.793381][T10447] Call Trace: [ 402.793387][T10447] [ 402.793393][T10447] dump_stack_lvl+0x100/0x190 [ 402.793417][T10447] should_fail_ex.cold+0x5/0xa [ 402.793439][T10447] _copy_from_user+0x2e/0xd0 [ 402.793469][T10447] copy_msghdr_from_user+0x9f/0x4f0 [ 402.793489][T10447] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 402.793518][T10447] ___sys_sendmsg+0x106/0x1e0 [ 402.793541][T10447] ? __pfx____sys_sendmsg+0x10/0x10 [ 402.793588][T10447] __sys_sendmsg+0x170/0x220 [ 402.793615][T10447] ? __pfx___sys_sendmsg+0x10/0x10 [ 402.793652][T10447] ? rcu_is_watching+0x12/0xc0 [ 402.793680][T10447] do_syscall_64+0x10b/0xf80 [ 402.793699][T10447] ? clear_bhb_loop+0x40/0x90 [ 402.793721][T10447] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 402.793739][T10447] RIP: 0033:0x7f0abe59cdd9 [ 402.793754][T10447] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 402.793770][T10447] RSP: 002b:00007f0abf3fd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 402.793787][T10447] RAX: ffffffffffffffda RBX: 00007f0abe815fa0 RCX: 00007f0abe59cdd9 [ 402.793798][T10447] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 402.793808][T10447] RBP: 00007f0abf3fd090 R08: 0000000000000000 R09: 0000000000000000 [ 402.793818][T10447] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 402.793827][T10447] R13: 00007f0abe816038 R14: 00007f0abe815fa0 R15: 00007ffe38e39d88 [ 402.793852][T10447] [ 403.088836][T10441] overlayfs: failed to resolve './file1': -2 [ 403.199055][ T30] audit: type=1400 audit(2000000143.350:804): avc: denied { mounton } for pid=10446 comm="syz.2.1168" path="/dev/binderfs" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 403.238787][ T1049] Bluetooth: (null): Invalid header checksum [ 403.343825][ T1418] Bluetooth: (null): Invalid header checksum [ 403.350239][T10467] FAULT_INJECTION: forcing a failure. [ 403.350239][T10467] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 403.364503][T10469] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1173'. [ 403.383972][T10469] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1173'. [ 403.399107][T10467] CPU: 0 UID: 0 PID: 10467 Comm: syz.3.1172 Tainted: G L syzkaller #0 PREEMPT(full) [ 403.399134][T10467] Tainted: [L]=SOFTLOCKUP [ 403.399139][T10467] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 403.399148][T10467] Call Trace: [ 403.399153][T10467] [ 403.399159][T10467] dump_stack_lvl+0x100/0x190 [ 403.399186][T10467] should_fail_ex.cold+0x5/0xa [ 403.399213][T10467] _copy_from_user+0x2e/0xd0 [ 403.399238][T10467] kstrtouint_from_user+0xd6/0x1d0 [ 403.399258][T10467] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 403.399276][T10467] ? __lock_acquire+0x4a5/0x2630 [ 403.399301][T10467] ? lock_acquire+0x1b1/0x370 [ 403.399326][T10467] proc_fail_nth_write+0x83/0x220 [ 403.399345][T10467] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 403.399368][T10467] vfs_write+0x2aa/0x1070 [ 403.399387][T10467] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 403.399406][T10467] ? __pfx_vfs_write+0x10/0x10 [ 403.399423][T10467] ? __fget_files+0x215/0x3d0 [ 403.399456][T10467] ? __fget_files+0x21f/0x3d0 [ 403.399486][T10467] ksys_write+0x12a/0x250 [ 403.399504][T10467] ? __pfx_ksys_write+0x10/0x10 [ 403.399523][T10467] ? rcu_is_watching+0x12/0xc0 [ 403.399554][T10467] do_syscall_64+0x10b/0xf80 [ 403.399574][T10467] ? clear_bhb_loop+0x40/0x90 [ 403.399597][T10467] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 403.399615][T10467] RIP: 0033:0x7f83f515d60e [ 403.399629][T10467] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 403.399645][T10467] RSP: 002b:00007f83f33f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 403.399662][T10467] RAX: ffffffffffffffda RBX: 00007f83f33f66c0 RCX: 00007f83f515d60e [ 403.399673][T10467] RDX: 0000000000000001 RSI: 00007f83f33f60a0 RDI: 0000000000000006 [ 403.399683][T10467] RBP: 00007f83f33f6090 R08: 0000000000000000 R09: 0000000000000000 [ 403.399692][T10467] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 403.399702][T10467] R13: 00007f83f5416038 R14: 00007f83f5415fa0 R15: 00007ffc28eec548 [ 403.399727][T10467] [ 403.456428][ T30] audit: type=1400 audit(2000000143.546:805): avc: denied { write } for pid=10442 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 403.903904][T10486] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1175'. [ 403.913086][T10486] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1175'. [ 403.922092][T10486] netlink: 'syz.3.1175': attribute type 11 has an invalid length. [ 403.929942][T10486] netlink: 'syz.3.1175': attribute type 13 has an invalid length. [ 404.035886][T10486] bridge0: port 3(erspan0) entered disabled state [ 404.042524][T10486] bridge0: port 2(bridge_slave_1) entered disabled state [ 404.049895][T10486] bridge0: port 1(bridge_slave_0) entered disabled state [ 404.059520][T10486] bridge0: entered allmulticast mode [ 404.137030][T10486] erspan0: left allmulticast mode [ 404.142148][T10486] erspan0: left promiscuous mode [ 404.147942][T10486] bridge0: port 3(erspan0) entered disabled state [ 404.256346][T10486] bridge_slave_1: left allmulticast mode [ 404.262112][T10486] bridge_slave_1: left promiscuous mode [ 404.269994][T10486] bridge0: port 2(bridge_slave_1) entered disabled state [ 404.302401][T10486] bridge_slave_0: left allmulticast mode [ 404.308467][T10486] bridge_slave_0: left promiscuous mode [ 404.314257][T10486] bridge0: port 1(bridge_slave_0) entered disabled state [ 404.858313][T10506] ALSA: mixer_oss: invalid OSS volume ':' [ 404.882937][T10506] ALSA: mixer_oss: invalid OSS volume '010000E0' [ 404.905253][T10506] ALSA: mixer_oss: invalid OSS volume '5' [ 404.924921][T10506] ALSA: mixer_oss: invalid OSS volume '010000E0' [ 404.945017][T10506] ALSA: mixer_oss: invalid OSS volume '6' [ 404.955608][ T9592] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 404.966658][T10506] ALSA: mixer_oss: invalid OSS volume '010000E0' [ 404.987755][ T5708] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 404.995982][T10506] ALSA: mixer_oss: invalid OSS volume '7' [ 405.033049][T10506] ALSA: mixer_oss: invalid OSS volume 'Iq zy?}' [ 405.058872][T10506] ALSA: mixer_oss: invalid OSS volume 'P#dܟQ{i0Rڬk m5' [ 405.083926][T10506] ALSA: mixer_oss: invalid OSS volume '2}f7ج:L' [ 405.107393][T10506] ALSA: mixer_oss: invalid OSS volume '^@䇵_u@)PY 00V' [ 405.132260][ T9592] usb 7-1: too many configurations: 51, using maximum allowed: 8 [ 405.160280][ T5708] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 405.180173][ T9592] usb 7-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 405.194467][ T5708] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 405.204799][ T9579] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 405.212561][ T9592] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 405.225259][ T9592] usb 7-1: Product: syz [ 405.231159][ T5708] usb 4-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 405.241608][ T9592] usb 7-1: Manufacturer: syz [ 405.249552][ T9592] usb 7-1: SerialNumber: syz [ 405.257278][ T5708] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 405.294301][ T5708] usb 4-1: config 0 descriptor?? [ 405.380196][T10528] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 405.384008][ T9579] usb 2-1: Using ep0 maxpacket: 16 [ 405.421220][ T9579] usb 2-1: config 1 has an invalid interface number: 228 but max is 0 [ 405.430024][ T9579] usb 2-1: config 1 has no interface number 0 [ 405.446027][T10531] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1186'. [ 405.455350][ T9579] usb 2-1: config 1 interface 228 has no altsetting 0 [ 405.466703][ T9579] usb 2-1: New USB device found, idVendor=0a5c, idProduct=396e, bcdDevice=21.b9 [ 405.484959][ T9579] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 405.498099][ T9592] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 405.524886][ T9579] usb 2-1: Product: syz [ 405.536499][ T9579] usb 2-1: Manufacturer: syz [ 405.541444][ T9592] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 405.559547][ T9579] usb 2-1: SerialNumber: syz [ 405.592852][ T9592] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 405.657477][ T9592] lan78xx 7-1:1.0: probe with driver lan78xx failed with error -71 [ 405.682319][ T9592] usb 7-1: USB disconnect, device number 3 [ 405.792076][ T5708] hid-steam 0003:28DE:1142.000F: : USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.3-1/input0 [ 405.856457][ T9579] usb 2-1: USB disconnect, device number 40 [ 405.941756][ T5708] hid-steam 0003:28DE:1142.000F: Steam wireless receiver connected [ 406.246893][ T30] kauditd_printk_skb: 4 callbacks suppressed [ 406.246903][ T30] audit: type=1400 audit(2000000146.195:810): avc: denied { write } for pid=10534 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 406.329524][ T5708] hid-steam 0003:28DE:1142.0010: hidraw0: USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.3-1/input0 [ 406.421767][ T30] audit: type=1400 audit(2000000146.363:811): avc: denied { watch watch_reads } for pid=10545 comm="syz.0.1187" path="pipe:[4812]" dev="pipefs" ino=4812 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 406.626336][ T30] audit: type=1400 audit(2000000146.550:812): avc: denied { write } for pid=10549 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 406.751208][ T9575] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 406.836244][T10548] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 406.892758][T10548] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 406.921816][ T9575] usb 1-1: Using ep0 maxpacket: 8 [ 406.934571][ T9575] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 406.954376][ T9575] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 406.985014][ T9575] usb 1-1: New USB device found, idVendor=15c2, idProduct=003b, bcdDevice=66.3e [ 407.015443][ T9575] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 407.038627][ T9575] usb 1-1: Product: syz [ 407.047658][ T9575] usb 1-1: Manufacturer: syz [ 407.070747][ T9575] usb 1-1: SerialNumber: syz [ 407.071539][ T5708] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 407.094808][ T9575] usb 1-1: config 0 descriptor?? [ 407.234454][ T9592] usb 4-1: reset high-speed USB device number 51 using dummy_hcd [ 407.247946][ T5708] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 407.263288][ T5708] usb 2-1: config 0 has no interfaces? [ 407.272648][ T5708] usb 2-1: New USB device found, idVendor=0763, idProduct=2003, bcdDevice= 0.40 [ 407.282000][ T5708] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 407.290115][ T5708] usb 2-1: Product: syz [ 407.294467][ T5708] usb 2-1: Manufacturer: syz [ 407.299273][ T9579] usb 7-1: new full-speed USB device number 4 using dummy_hcd [ 407.307086][ T5708] usb 2-1: SerialNumber: syz [ 407.316938][ T5708] usb 2-1: config 0 descriptor?? [ 407.348514][T10546] netlink: 'syz.0.1187': attribute type 1 has an invalid length. [ 407.353958][ T30] audit: type=1400 audit(2000000147.224:813): avc: denied { setopt } for pid=10564 comm="syz.2.1192" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 407.359511][T10546] netlink: 220 bytes leftover after parsing attributes in process `syz.0.1187'. [ 407.386871][T10546] NCSI netlink: No device for ifindex 0 [ 407.416117][ T5708] usb 1-1: USB disconnect, device number 45 [ 407.468498][ T9579] usb 7-1: not running at top speed; connect to a high speed hub [ 407.480995][ T9579] usb 7-1: config 2 has an invalid interface number: 38 but max is 0 [ 407.489387][ T9579] usb 7-1: config 2 has no interface number 0 [ 407.495501][ T9579] usb 7-1: config 2 interface 38 has no altsetting 0 [ 407.504598][ T9579] usb 7-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=a1.32 [ 407.514228][ T9579] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 407.523155][ T9579] usb 7-1: Product: syz [ 407.527525][ T9579] usb 7-1: Manufacturer: syz [ 407.532261][ T9579] usb 7-1: SerialNumber: syz [ 407.551993][ T9579] r8152-cfgselector 7-1: Unknown version 0x0000 [ 407.762198][ T5708] usb 2-1: USB disconnect, device number 41 [ 408.364694][ T9592] usb 4-1: device descriptor read/64, error -71 [ 408.399618][ T9579] r8152 7-1:2.38: Expected endpoints are not found [ 408.440796][ T9579] r8152-cfgselector 7-1: USB disconnect, device number 4 [ 408.608866][T10593] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 408.617962][T10593] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 408.652203][T10593] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 408.662875][ T9592] usb 4-1: reset high-speed USB device number 51 using dummy_hcd [ 408.671062][T10593] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 408.679187][ T9592] usb 4-1: device reset changed ep0 maxpacket size! [ 408.699657][ T9591] usb 4-1: USB disconnect, device number 51 [ 408.710786][ T30] audit: type=1400 audit(2000000148.506:814): avc: denied { create } for pid=10592 comm="syz.2.1203" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 408.734795][ T30] audit: type=1400 audit(2000000148.506:815): avc: denied { write } for pid=10592 comm="syz.2.1203" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 408.757126][T10595] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 408.767045][ T803] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 408.779161][ T9591] hid-steam 0003:28DE:1142.000F: Steam wireless receiver disconnected [ 408.818736][T10593] macvlan2: entered promiscuous mode [ 408.824282][T10593] macvlan2: entered allmulticast mode [ 408.920188][ T9579] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 408.932930][ T9591] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 408.944843][ T803] usb 2-1: Using ep0 maxpacket: 8 [ 408.951091][ T803] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 408.962963][ T803] usb 2-1: New USB device found, idVendor=05e1, idProduct=0893, bcdDevice=fd.5b [ 408.972846][ T803] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 408.981052][ T803] usb 2-1: Product: syz [ 408.985307][ T803] usb 2-1: Manufacturer: syz [ 408.989888][ T803] usb 2-1: SerialNumber: syz [ 408.996858][ T803] usb 2-1: config 0 descriptor?? [ 409.003987][ T803] gspca_main: stk014-2.14.0 probing 05e1:0893 [ 409.010218][ T803] usb 2-1: selecting invalid altsetting 1 [ 409.080498][ T9579] usb 7-1: Using ep0 maxpacket: 32 [ 409.087931][ T9579] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 32 [ 409.099600][ T9579] usb 7-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 409.110146][ T9591] usb 4-1: Using ep0 maxpacket: 32 [ 409.115448][ T9579] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 409.124033][ T9579] usb 7-1: Product: syz [ 409.128228][ T9579] usb 7-1: Manufacturer: syz [ 409.132980][ T9579] usb 7-1: SerialNumber: syz [ 409.138024][ T9591] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 32 [ 409.150110][ T9579] usb 7-1: config 0 descriptor?? [ 409.156595][T10591] raw-gadget.3 gadget.6: fail, usb_ep_enable returned -22 [ 409.157333][ T9591] usb 4-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 409.173207][ T9591] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 409.184500][ T9579] hub 7-1:0.0: bad descriptor, ignoring hub [ 409.190509][ T9591] usb 4-1: Product: syz [ 409.194718][ T9579] hub 7-1:0.0: probe with driver hub failed with error -5 [ 409.201936][ T9591] usb 4-1: Manufacturer: syz [ 409.206750][ T9591] usb 4-1: SerialNumber: syz [ 409.215094][ T9579] input: syz syz as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/input/input26 [ 409.231787][T10587] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 409.246021][ T9591] usb 4-1: config 0 descriptor?? [ 409.259849][T10576] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 409.266869][T10597] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1204'. [ 409.282298][T10587] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 409.292319][ T9591] hub 4-1:0.0: bad descriptor, ignoring hub [ 409.299349][ T803] gspca_stk014: reg_r err -71 [ 409.315734][ T9591] hub 4-1:0.0: probe with driver hub failed with error -5 [ 409.323077][ T803] stk014 2-1:0.0: probe with driver stk014 failed with error -71 [ 409.343736][ T9591] input: syz syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input27 [ 409.380589][ T803] usb 2-1: USB disconnect, device number 42 [ 409.623260][T10576] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 409.632530][T10576] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 409.666655][T10591] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 409.675731][T10591] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 409.696543][ T9585] usb 4-1: USB disconnect, device number 52 [ 409.696593][ C0] usbtouchscreen 4-1:0.0: usbtouch_irq - usb_submit_urb failed with result: -19 [ 409.734007][ T9591] usb 7-1: USB disconnect, device number 5 [ 409.739934][ C0] usbtouchscreen 7-1:0.0: usbtouch_irq - usb_submit_urb failed with result: -19 [ 409.837492][T10603] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 410.512779][T10607] comedi comedi0: Minor 2 could not be opened [ 411.046094][T10621] netlink: 212368 bytes leftover after parsing attributes in process `syz.6.1212'. [ 411.077618][T10621] netlink: 212368 bytes leftover after parsing attributes in process `syz.6.1212'. [ 411.134348][ T30] audit: type=1400 audit(2000000150.771:816): avc: denied { execute } for pid=10627 comm="syz.3.1214" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 411.206987][ T9591] usb 1-1: new full-speed USB device number 46 using dummy_hcd [ 411.258134][T10630] netlink: 32 bytes leftover after parsing attributes in process `syz.6.1215'. [ 411.347425][ T9591] usb 1-1: device descriptor read/64, error -71 [ 411.623723][ T9591] usb 1-1: new full-speed USB device number 47 using dummy_hcd [ 411.756519][ T9585] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 412.713683][ T9591] usb 1-1: device descriptor read/64, error -71 [ 412.788729][ T9585] usb 7-1: Using ep0 maxpacket: 32 [ 412.950574][ T9591] usb usb1-port1: attempt power cycle [ 412.990042][ T9585] usb 7-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 413.012104][ T9585] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 413.032684][ T9585] usb 7-1: Product: syz [ 413.043524][ T9585] usb 7-1: Manufacturer: syz [ 413.045209][T10647] vivid-004: ================= START STATUS ================= [ 413.050509][ T9585] usb 7-1: SerialNumber: syz [ 413.077029][T10647] vivid-004: Radio HW Seek Mode: Bounded [ 413.088011][T10647] vivid-004: Radio Programmable HW Seek: false [ 413.103791][T10647] vivid-004: RDS Rx I/O Mode: Block I/O [ 413.117408][T10647] vivid-004: Generate RBDS Instead of RDS: false [ 413.137828][T10647] vivid-004: RDS Reception: true [ 413.153857][T10647] vivid-004: RDS Program Type: 0 inactive [ 413.162754][T10647] vivid-004: RDS PS Name: inactive [ 413.173352][T10647] vivid-004: RDS Radio Text: inactive [ 413.184339][T10647] vivid-004: RDS Traffic Announcement: false inactive [ 413.193632][T10647] vivid-004: RDS Traffic Program: false inactive [ 413.250975][T10647] vivid-004: RDS Music: false inactive [ 413.261258][T10647] vivid-004: ================== END STATUS ================== [ 413.344161][ T9591] usb 1-1: new full-speed USB device number 48 using dummy_hcd [ 413.377989][ T9591] usb 1-1: device descriptor read/8, error -71 [ 413.669583][ T9591] usb 1-1: new full-speed USB device number 49 using dummy_hcd [ 413.733762][ T9585] usb 7-1: 1:1: cannot get freq (v2/v3): err -32 [ 413.742888][ T9591] usb 1-1: device descriptor read/8, error -71 [ 413.868532][ T9591] usb usb1-port1: unable to enumerate USB device [ 413.968609][ T30] audit: type=1400 audit(2000000153.428:817): avc: denied { write } for pid=10635 comm="syz.6.1219" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 414.009610][ T9585] usb 7-1: 1:1: cannot get freq (v2/v3): err -71 [ 414.031426][ T9585] usb 7-1: 2:1: cannot get freq (v2/v3): err -71 [ 414.042800][ T9585] usb 7-1: 2:1: cannot set freq 44100 (v2/v3): err -71 [ 414.178070][ T9585] usb 7-1: USB disconnect, device number 6 [ 414.327757][ T5605] udevd[5605]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 414.485020][T10660] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 414.521304][T10660] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 415.193645][ T803] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 415.409742][ T803] usb 2-1: Using ep0 maxpacket: 8 [ 415.420945][ T803] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 415.434567][ T803] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 415.682107][ T803] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 416.537578][ T803] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 416.549509][ T803] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 416.561732][ T803] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 416.573297][ T803] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 416.586746][ T803] usb 2-1: config 168 interface 0 has no altsetting 0 [ 416.594588][ T803] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 416.602216][ T803] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 416.613448][ T803] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 416.624886][ T803] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 416.636941][ T803] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 416.648198][ T803] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 416.659907][ T803] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 416.673801][ T803] usb 2-1: config 168 interface 0 has no altsetting 0 [ 416.685110][ T803] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 416.693322][ T803] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 416.732127][T10694] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1233'. [ 416.809233][ T803] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 416.821155][ T803] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 416.833106][ T803] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 416.844496][ T803] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 416.856005][ T803] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 416.869886][ T803] usb 2-1: config 168 interface 0 has no altsetting 0 [ 416.881341][ T803] usb 2-1: string descriptor 0 read error: -22 [ 416.891218][ T803] usb 2-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 416.908350][ T803] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 416.945795][ T803] adutux 2-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 417.041831][T10698] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 417.080067][T10698] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 417.281762][ T803] usb 2-1: USB disconnect, device number 43 [ 417.289601][T10706] usb 2-1: Couldn't submit interrupt_out_urb -19 [ 417.299109][T10694] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1233'. [ 417.777243][T10726] comedi comedi0: Minor 2 could not be opened threadedA&:./file0/file1 @   /dev/fusefd=0x0000000000000003,rootmode=00000000000000000040000,user_id=00000000000000000000,group_id=00000000000000000000P)̆@s [ 418.362773][T10740] program syz.1.1248 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 418.399187][ T803] usb 4-1: new high-speed USB device number 53 using dummy_hcd ./file0fuse[ 418.580784][ T803] usb 4-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 h-s[ 418.617923][ T803] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 418.629067][ T803] usb 4-1: Product: syz [ 418.634571][ T803] usb 4-1: Manufacturer: syz [ 418.639882][ T803] usb 4-1: SerialNumber: syz [ 418.653033][ T803] usb 4-1: config 0 descriptor?? [ 418.676066][ T803] gspca_main: sq905c-2.14.0 probing 2770:9052 [ 418.890364][ T5708] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 418.966835][T10754] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1252'. [ 419.119421][T10754] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=10754 comm=syz.0.1252 [ 419.199356][T10754] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=10754 comm=syz.0.1252 [ 419.229843][ T5617] Bluetooth: hci4: ACL packet for unknown connection handle 201 [ 419.234571][T10731] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 419.266216][T10731] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 419.298675][ T803] gspca_sq905c: sq905c_read: usb_control_msg failed (-71) [ 419.313792][ T30] audit: type=1400 audit(2000000158.426:818): avc: denied { create } for pid=10756 comm="syz.1.1254" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 419.337959][ T803] sq905c 4-1:0.0: Reading version command failed [ 419.348631][ T803] sq905c 4-1:0.0: probe with driver sq905c failed with error -71 [ 419.468229][ T5708] usb 7-1: Using ep0 maxpacket: 16 [ 419.537772][ T30] audit: type=1400 audit(2000000158.426:819): avc: denied { bind } for pid=10756 comm="syz.1.1254" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 419.567039][ T5708] usb 7-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 419.579206][ T803] usb 4-1: USB disconnect, device number 53 [ 419.590035][ T5708] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 419.768844][ T5708] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 419.801096][ T5708] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 419.816068][ T5708] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 419.858002][ T5708] usb 7-1: Product: syz [ 419.939904][T10763] comedi comedi0: Minor 2 could not be opened [ 420.113259][ T5708] usb 7-1: Manufacturer: syz [ 420.117976][ T5708] usb 7-1: SerialNumber: syz [ 420.134145][ T5708] usb 7-1: 0:2 : does not exist [ 421.574860][ T5708] usb 7-1: USB disconnect, device number 7 [ 421.674766][ T5607] udevd[5607]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 421.979689][T10791] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1262'. [ 422.067015][T10799] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1265'. [ 422.368587][T10811] FAULT_INJECTION: forcing a failure. [ 422.368587][T10811] name failslab, interval 1, probability 0, space 0, times 0 [ 422.381694][T10811] CPU: 0 UID: 0 PID: 10811 Comm: syz.1.1267 Tainted: G L syzkaller #0 PREEMPT(full) [ 422.381722][T10811] Tainted: [L]=SOFTLOCKUP [ 422.381728][T10811] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 422.381739][T10811] Call Trace: [ 422.381745][T10811] [ 422.381752][T10811] dump_stack_lvl+0x100/0x190 [ 422.381779][T10811] should_fail_ex.cold+0x5/0xa [ 422.381805][T10811] should_failslab+0xc2/0x120 [ 422.381827][T10811] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 422.381853][T10811] ? security_inode_alloc+0x3b/0x2c0 [ 422.381874][T10811] ? lockdep_init_map_type+0x5c/0x250 [ 422.381903][T10811] security_inode_alloc+0x3b/0x2c0 [ 422.381924][T10811] inode_init_always_gfp+0xcc0/0x1000 [ 422.381951][T10811] alloc_inode+0x8e/0x250 [ 422.381969][T10811] new_inode+0x22/0x1c0 [ 422.381989][T10811] proc_get_inode+0x1d/0x780 [ 422.382015][T10811] proc_lookup_de+0x236/0x360 [ 422.382044][T10811] proc_lookup+0xcf/0x110 [ 422.382070][T10811] proc_root_lookup+0x3b/0x70 [ 422.382096][T10811] __lookup_slow+0x251/0x460 [ 422.382125][T10811] ? __pfx___lookup_slow+0x10/0x10 [ 422.382173][T10811] lookup_slow+0x50/0x70 [ 422.382207][T10811] link_path_walk+0x1377/0x1cc0 [ 422.382236][T10811] path_openat+0x1be/0x31a0 [ 422.382259][T10811] ? __schedule+0x10fb/0x6820 [ 422.382277][T10811] ? kmem_cache_alloc_noprof+0x241/0x6e0 [ 422.382308][T10811] ? __pfx_path_openat+0x10/0x10 [ 422.382339][T10811] do_file_open+0x20e/0x430 [ 422.382364][T10811] ? __pfx_do_file_open+0x10/0x10 [ 422.382386][T10811] ? irqentry_exit+0x246/0x790 [ 422.382425][T10811] ? alloc_fd+0x476/0x790 [ 422.382451][T10811] ? do_getname+0x191/0x390 [ 422.382479][T10811] do_sys_openat2+0x10d/0x1e0 [ 422.382505][T10811] ? __pfx_do_sys_openat2+0x10/0x10 [ 422.382529][T10811] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 422.382555][T10811] ? __fget_files+0x21f/0x3d0 [ 422.382581][T10811] __x64_sys_openat+0x12d/0x210 [ 422.382607][T10811] ? __pfx___x64_sys_openat+0x10/0x10 [ 422.382633][T10811] ? ksys_write+0x1ac/0x250 [ 422.382656][T10811] ? rcu_is_watching+0x12/0xc0 [ 422.382687][T10811] do_syscall_64+0x10b/0xf80 [ 422.382706][T10811] ? clear_bhb_loop+0x40/0x90 [ 422.382728][T10811] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 422.382746][T10811] RIP: 0033:0x7f71ee99cdd9 [ 422.382762][T10811] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 422.382778][T10811] RSP: 002b:00007f71ef890028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 422.382796][T10811] RAX: ffffffffffffffda RBX: 00007f71eec16090 RCX: 00007f71ee99cdd9 [ 422.382807][T10811] RDX: 0000000000000000 RSI: 0000200000000140 RDI: ffffffffffffff9c [ 422.382829][T10811] RBP: 00007f71ef890090 R08: 0000000000000000 R09: 0000000000000000 [ 422.382839][T10811] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 422.382849][T10811] R13: 00007f71eec16128 R14: 00007f71eec16090 R15: 00007ffc842b5298 [ 422.382874][T10811] [ 423.861990][T10819] kvm: vcpu 1: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer. [ 423.970989][T10825] netlink: 212340 bytes leftover after parsing attributes in process `syz.0.1272'. [ 424.276169][T10825] openvswitch: netlink: Message has 16 unknown bytes. [ 426.218065][ T30] audit: type=1400 audit(2000000164.883:820): avc: denied { set_context_mgr } for pid=10845 comm="syz.1.1278" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 426.336916][ T30] audit: type=1400 audit(2000000164.920:821): avc: denied { ioctl } for pid=10845 comm="syz.1.1278" path="user:[4026531837]" dev="nsfs" ino=4026531837 ioctlcmd=0xb703 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 426.453869][T10854] netlink: 'syz.1.1278': attribute type 4 has an invalid length. [ 426.488725][T10854] netlink: 156 bytes leftover after parsing attributes in process `syz.1.1278'. [ 426.627454][ T1597] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 427.033616][T10854] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 427.068457][ T30] audit: type=1400 audit(2000000165.687:822): avc: denied { map } for pid=10845 comm="syz.1.1278" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 427.226109][ T1597] usb 1-1: Using ep0 maxpacket: 8 [ 427.251733][ T1597] usb 1-1: config 0 has an invalid interface number: 64 but max is 0 [ 427.266787][ T1597] usb 1-1: config 0 has no interface number 0 [ 427.282560][ T1597] usb 1-1: New USB device found, idVendor=1de1, idProduct=c102, bcdDevice= 0.00 [ 427.301641][ T1597] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 427.333854][ T1597] usb 1-1: config 0 descriptor?? [ 427.341969][ T1597] usb-storage 1-1:0.64: USB Mass Storage device detected [ 427.430872][ T1597] usb-storage 1-1:0.64: device ignored [ 427.559194][T10848] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 427.586880][T10848] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 427.899140][ T1597] usb 1-1: USB disconnect, device number 50 [ 428.725093][T10888] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 428.727259][ T30] audit: type=1400 audit(2000000167.241:823): avc: denied { getopt } for pid=10887 comm="syz.6.1289" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 428.945864][ T30] audit: type=1400 audit(2000000167.316:824): avc: denied { ioctl } for pid=10887 comm="syz.6.1289" path="socket:[34167]" dev="sockfs" ino=34167 ioctlcmd=0x89e3 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 429.612181][T10898] netlink: 20 bytes leftover after parsing attributes in process `syz.6.1292'. [ 429.738361][T10899] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1292'. [ 429.748971][T10899] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 429.763959][T10899] bridge0: port 2(bridge_slave_1) entered disabled state [ 429.773379][T10899] bridge0: port 1(bridge_slave_0) entered disabled state [ 429.963523][T10905] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1295'. [ 429.992405][T10905] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1295'. [ 430.031155][T10905] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1295'. [ 430.107524][ T12] netdevsim netdevsim6 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 430.109402][T10905] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1295'. [ 430.138725][ T9575] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 430.151427][ T12] netdevsim netdevsim6 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 430.173424][ T12] netdevsim netdevsim6 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 430.176077][T10905] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1295'. [ 430.213347][ T12] netdevsim netdevsim6 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 430.227876][T10905] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1295'. threadedA&:./file0/file1[ 430.302961][ T9575] usb 2-1: device descriptor read/64, error -71  @   /dev/fusefd=0x0000000000000003,rootmode=00000000000000000040000,user_id=00000000000000000000,group_id=00000000000000000000P)̆@s [ 430.773111][ T9575] usb 2-1: new high-speed USB device number 45 using dummy_hcd ./file0fuseh-s[ 431.574715][ T9575] usb 2-1: device descriptor read/64, error -71 [ 431.755751][ T9575] usb usb2-port1: attempt power cycle [ 431.893694][T10928] netlink: 'syz.3.1301': attribute type 4 has an invalid length. [ 431.910198][T10928] netlink: 156 bytes leftover after parsing attributes in process `syz.3.1301'. [ 431.940993][T10928] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 432.290837][ T9592] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 432.465376][ T9592] usb 7-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 432.479443][ T9592] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 432.508528][ T9592] usb 7-1: Product: syz [ 432.521384][ T9592] usb 7-1: Manufacturer: syz [ 432.537065][ T9592] usb 7-1: SerialNumber: syz [ 432.585418][ T9592] usb 7-1: config 0 descriptor?? [ 432.613993][ T9592] gspca_main: sq905c-2.14.0 probing 2770:9052 [ 432.987342][ T30] audit: type=1400 audit(2000000171.227:825): avc: denied { read } for pid=10939 comm="syz.0.1305" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 433.049447][T10931] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 433.068193][T10931] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 433.078594][ T9592] gspca_sq905c: sq905c_read: usb_control_msg failed (-71) [ 433.099615][ T9592] sq905c 7-1:0.0: Reading version command failed [ 433.115996][ T9592] sq905c 7-1:0.0: probe with driver sq905c failed with error -71 [ 433.144464][ T9592] usb 7-1: USB disconnect, device number 8 [ 433.774408][T10940] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 433.802547][T10965] FAULT_INJECTION: forcing a failure. [ 433.802547][T10965] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 433.892083][T10965] CPU: 0 UID: 0 PID: 10965 Comm: syz.6.1311 Tainted: G L syzkaller #0 PREEMPT(full) [ 433.892115][T10965] Tainted: [L]=SOFTLOCKUP [ 433.892121][T10965] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 433.892131][T10965] Call Trace: [ 433.892137][T10965] [ 433.892144][T10965] dump_stack_lvl+0x100/0x190 [ 433.892171][T10965] should_fail_ex.cold+0x5/0xa [ 433.892197][T10965] _copy_from_user+0x2e/0xd0 [ 433.892225][T10965] bpf_test_init.isra.0+0xaf/0x100 [ 433.892247][T10965] bpf_prog_test_run_skb+0x497/0x3540 [ 433.892275][T10965] ? find_held_lock+0x2b/0x80 [ 433.892294][T10965] ? __fget_files+0x151/0x3d0 [ 433.892324][T10965] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 433.892348][T10965] ? fput+0x79/0x100 [ 433.892374][T10965] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 433.892396][T10965] __sys_bpf+0x1725/0x4b90 [ 433.892416][T10965] ? __pfx___sys_bpf+0x10/0x10 [ 433.892430][T10965] ? proc_fail_nth_write+0x9f/0x220 [ 433.892449][T10965] ? find_held_lock+0x2b/0x80 [ 433.892470][T10965] ? find_held_lock+0x2b/0x80 [ 433.892486][T10965] ? ksys_write+0x190/0x250 [ 433.892504][T10965] ? ksys_write+0x190/0x250 [ 433.892527][T10965] ? __mutex_unlock_slowpath+0x15d/0x8a0 [ 433.892549][T10965] ? kernel_write+0x613/0x6c0 [ 433.892567][T10965] ? __fget_files+0x215/0x3d0 [ 433.892600][T10965] ? fput+0x79/0x100 [ 433.892623][T10965] ? ksys_write+0x1ac/0x250 [ 433.892641][T10965] ? __pfx_ksys_write+0x10/0x10 [ 433.892665][T10965] __x64_sys_bpf+0x7b/0xc0 [ 433.892681][T10965] ? lockdep_hardirqs_on+0x78/0x100 [ 433.892701][T10965] do_syscall_64+0x10b/0xf80 [ 433.892721][T10965] ? clear_bhb_loop+0x40/0x90 [ 433.892742][T10965] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 433.892760][T10965] RIP: 0033:0x7fda8599cdd9 [ 433.892775][T10965] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 433.892790][T10965] RSP: 002b:00007fda867e1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 433.892808][T10965] RAX: ffffffffffffffda RBX: 00007fda85c15fa0 RCX: 00007fda8599cdd9 [ 433.892818][T10965] RDX: 0000000000000050 RSI: 0000200000000140 RDI: 000000000000000a [ 433.892828][T10965] RBP: 00007fda867e1090 R08: 0000000000000000 R09: 0000000000000000 [ 433.892837][T10965] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 433.892847][T10965] R13: 00007fda85c16038 R14: 00007fda85c15fa0 R15: 00007ffd1f0d9b38 [ 433.892870][T10965] [ 434.632204][T10970] FAULT_INJECTION: forcing a failure. [ 434.632204][T10970] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 434.688624][T10970] CPU: 0 UID: 0 PID: 10970 Comm: syz.0.1313 Tainted: G L syzkaller #0 PREEMPT(full) [ 434.688644][T10970] Tainted: [L]=SOFTLOCKUP [ 434.688648][T10970] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 434.688654][T10970] Call Trace: [ 434.688658][T10970] [ 434.688662][T10970] dump_stack_lvl+0x100/0x190 [ 434.688680][T10970] should_fail_ex.cold+0x5/0xa [ 434.688696][T10970] _copy_from_iter+0x1f4/0x1690 [ 434.688713][T10970] ? __asan_memset+0x23/0x50 [ 434.688729][T10970] ? __pfx__copy_from_iter+0x10/0x10 [ 434.688744][T10970] ? __pfx___alloc_skb+0x10/0x10 [ 434.688764][T10970] netlink_sendmsg+0x808/0xda0 [ 434.688781][T10970] ? __pfx_netlink_sendmsg+0x10/0x10 [ 434.688798][T10970] sock_write_iter+0x524/0x5a0 [ 434.688810][T10970] ? __pfx_netlink_sendmsg+0x10/0x10 [ 434.688823][T10970] ? __pfx_sock_write_iter+0x10/0x10 [ 434.688840][T10970] ? bpf_lsm_file_permission+0x9/0x10 [ 434.688856][T10970] ? security_file_permission+0x76/0x210 [ 434.688871][T10970] ? rw_verify_area+0xce/0x6d0 [ 434.688882][T10970] vfs_write+0x6ac/0x1070 [ 434.688894][T10970] ? __pfx_sock_write_iter+0x10/0x10 [ 434.688909][T10970] ? __pfx_vfs_write+0x10/0x10 [ 434.688919][T10970] ? find_held_lock+0x2b/0x80 [ 434.688937][T10970] ksys_write+0x1f8/0x250 [ 434.688948][T10970] ? __pfx_ksys_write+0x10/0x10 [ 434.688961][T10970] ? rcu_is_watching+0x12/0xc0 [ 434.688978][T10970] do_syscall_64+0x10b/0xf80 [ 434.688991][T10970] ? clear_bhb_loop+0x40/0x90 [ 434.689003][T10970] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 434.689014][T10970] RIP: 0033:0x7f0abe59cdd9 [ 434.689023][T10970] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 434.689033][T10970] RSP: 002b:00007f0abf3fd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 434.689043][T10970] RAX: ffffffffffffffda RBX: 00007f0abe815fa0 RCX: 00007f0abe59cdd9 [ 434.689050][T10970] RDX: 0000000000000014 RSI: 0000200000000240 RDI: 0000000000000004 [ 434.689056][T10970] RBP: 00007f0abf3fd090 R08: 0000000000000000 R09: 0000000000000000 [ 434.689062][T10970] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 434.689068][T10970] R13: 00007f0abe816038 R14: 00007f0abe815fa0 R15: 00007ffe38e39d88 [ 434.689081][T10970] [ 435.507059][ T9579] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 435.683305][ T9579] usb 7-1: Using ep0 maxpacket: 8 [ 435.705183][ T9579] usb 7-1: unable to get BOS descriptor or descriptor too short [ 435.858846][T10989] comedi comedi0: Minor 2 could not be opened [ 435.991118][ T9579] usb 7-1: New USB device found, idVendor=200c, idProduct=1018, bcdDevice= 0.40 [ 436.090467][ T9579] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 436.099368][ T9579] usb 7-1: Product: syz [ 436.105603][ T9579] usb 7-1: Manufacturer: syz [ 436.111800][ T9579] usb 7-1: SerialNumber: syz [ 437.517053][ T30] audit: type=1400 audit(2000000175.467:826): avc: denied { write } for pid=11007 comm="syz.0.1324" name="mdstat" dev="proc" ino=4026532009 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_mdstat_t tclass=file permissive=1 [ 437.613561][ T30] audit: type=1400 audit(2000000175.551:827): avc: denied { bpf } for pid=11002 comm="syz.1.1323" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 438.845889][ T9579] usb 7-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 438.860269][ T9579] usb 7-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 439.014273][ T9579] usb 7-1: USB disconnect, device number 9 [ 439.272324][ T5607] udevd[5607]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 439.277090][T11038] overlayfs: failed to resolve './file0redirect_dir=follow': -2 [ 439.446468][T11028] Invalid option length (17419) for dns_resolver key [ 439.595420][ T30] audit: type=1400 audit(2000000177.404:828): avc: denied { create } for pid=11039 comm="syz.0.1334" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 439.663480][ T30] audit: type=1400 audit(2000000177.404:829): avc: denied { write } for pid=11039 comm="syz.0.1334" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 439.866977][ T9577] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 440.028009][ T9577] usb 1-1: Using ep0 maxpacket: 32 [ 440.049698][ T9577] usb 1-1: config index 0 descriptor too short (expected 156, got 27) [ 440.074293][ T9577] usb 1-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 440.105278][ T9577] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 440.166738][ T9577] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has invalid wMaxPacketSize 0 [ 440.211125][ T9577] usb 1-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 440.249854][ T9577] usb 1-1: config 0 interface 0 has no altsetting 0 [ 440.269887][ T9577] usb 1-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 440.300922][ T9577] usb 1-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 440.325552][ T9577] usb 1-1: Product: syz [ 440.333448][ T9577] usb 1-1: Manufacturer: syz [ 440.360636][ T9577] usb 1-1: SerialNumber: syz [ 440.391406][ T9577] usb 1-1: config 0 descriptor?? [ 440.422181][ T9577] ldusb 1-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 440.450318][ T30] audit: type=1400 audit(2000000178.208:830): avc: denied { bind } for pid=11051 comm="syz.2.1337" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 440.464490][ T9577] ldusb 1-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 440.594118][ T30] audit: type=1400 audit(2000000178.349:831): avc: denied { view } for pid=11056 comm="syz.6.1339" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 440.809864][ T30] audit: type=1400 audit(2000000178.517:832): avc: denied { name_bind } for pid=11056 comm="syz.6.1339" src=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 440.846376][T11061] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 440.889780][ T30] audit: type=1400 audit(2000000178.620:833): avc: denied { perfmon } for pid=11051 comm="syz.2.1337" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 441.259752][ T30] audit: type=1400 audit(2000000178.957:834): avc: denied { read } for pid=11067 comm="syz.3.1342" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 441.325807][ T30] audit: type=1400 audit(2000000178.966:835): avc: denied { open } for pid=11067 comm="syz.3.1342" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 441.326140][T11068] veth3: entered promiscuous mode [ 441.388094][ T30] audit: type=1400 audit(2000000179.088:836): avc: denied { ioctl } for pid=11067 comm="syz.3.1342" path="/dev/fb0" dev="devtmpfs" ino=629 ioctlcmd=0x4605 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 441.459713][T11068] veth3: entered allmulticast mode [ 441.902639][ T1308] ieee802154 phy0 wpan0: encryption failed: -22 [ 441.909649][ T1308] ieee802154 phy1 wpan1: encryption failed: -22 [ 442.296680][T11088] FAULT_INJECTION: forcing a failure. [ 442.296680][T11088] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 442.312212][T11088] CPU: 0 UID: 0 PID: 11088 Comm: syz.3.1349 Tainted: G L syzkaller #0 PREEMPT(full) [ 442.312241][T11088] Tainted: [L]=SOFTLOCKUP [ 442.312247][T11088] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 442.312258][T11088] Call Trace: [ 442.312265][T11088] [ 442.312271][T11088] dump_stack_lvl+0x100/0x190 [ 442.312300][T11088] should_fail_ex.cold+0x5/0xa [ 442.312327][T11088] _copy_to_user+0x32/0xd0 [ 442.312355][T11088] simple_read_from_buffer+0xcb/0x170 [ 442.312380][T11088] proc_fail_nth_read+0x1af/0x230 [ 442.312403][T11088] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 442.312424][T11088] ? rw_verify_area+0xce/0x6d0 [ 442.312441][T11088] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 442.312458][T11088] vfs_read+0x1e4/0xb30 [ 442.312480][T11088] ? __pfx_vfs_read+0x10/0x10 [ 442.312497][T11088] ? __fget_files+0x215/0x3d0 [ 442.312525][T11088] ? __fget_files+0x21f/0x3d0 [ 442.312554][T11088] ksys_read+0x12a/0x250 [ 442.312572][T11088] ? __pfx_ksys_read+0x10/0x10 [ 442.312593][T11088] ? rcu_is_watching+0x12/0xc0 [ 442.312623][T11088] do_syscall_64+0x10b/0xf80 [ 442.312645][T11088] ? clear_bhb_loop+0x40/0x90 [ 442.312666][T11088] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 442.312684][T11088] RIP: 0033:0x7f83f515d60e [ 442.312699][T11088] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 442.312716][T11088] RSP: 002b:00007f83f33f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 442.312741][T11088] RAX: ffffffffffffffda RBX: 00007f83f33f66c0 RCX: 00007f83f515d60e [ 442.312752][T11088] RDX: 000000000000000f RSI: 00007f83f33f60a0 RDI: 0000000000000004 [ 442.312762][T11088] RBP: 00007f83f33f6090 R08: 0000000000000000 R09: 0000000000000000 [ 442.312773][T11088] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 442.312782][T11088] R13: 00007f83f5416038 R14: 00007f83f5415fa0 R15: 00007ffc28eec548 [ 442.312805][T11088] [ 442.578029][ T9579] usb 1-1: USB disconnect, device number 51 [ 442.616274][ T9579] ldusb 1-1:0.0: LD USB Device #0 now disconnected [ 442.909798][ T30] audit: type=1400 audit(2000000180.408:837): avc: denied { getopt } for pid=11090 comm="syz.0.1350" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 443.477790][T11112] netlink: 'syz.6.1358': attribute type 5 has an invalid length. [ 443.781263][ T9577] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 444.657550][T11125] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1361'. [ 444.759763][ T12] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 444.774781][ T9577] usb 7-1: device descriptor read/64, error -71 [ 444.833948][ T1445] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 444.912223][ T1445] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 445.000165][ T1445] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 445.060701][ T9577] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 445.243296][ T9577] usb 7-1: device descriptor read/64, error -71 [ 445.382677][ T9577] usb usb7-port1: attempt power cycle [ 445.573033][T11131] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 445.585095][T11131] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 445.794224][T11147] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1365'. [ 445.829883][ T9577] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 446.086039][ T9577] usb 7-1: device descriptor read/8, error -71 [ 446.194650][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 446.194667][ T30] audit: type=1400 audit(2000000183.589:840): avc: denied { setopt } for pid=11152 comm="syz.0.1369" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 446.236684][T11153] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1369'. [ 446.388317][ T9577] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 446.400431][T11159] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 446.412002][T11159] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 446.421888][ T30] audit: type=1400 audit(2000000183.795:841): avc: denied { attach_queue } for pid=11154 comm="syz.0.1370" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 446.450251][ T9577] usb 7-1: device descriptor read/8, error -71 [ 446.665169][ T9577] usb usb7-port1: unable to enumerate USB device [ 446.669705][T11164] comedi comedi0: Minor 2 could not be opened [ 447.809183][ T803] usb 7-1: new full-speed USB device number 14 using dummy_hcd [ 448.042703][ T803] usb 7-1: not running at top speed; connect to a high speed hub [ 448.840294][T11215] netlink: 'syz.3.1387': attribute type 1 has an invalid length. [ 448.845624][T11212] comedi comedi0: Minor 2 could not be opened [ 448.931121][T11215] 8021q: adding VLAN 0 to HW filter on device bond1 [ 449.311371][T11236] overlayfs: failed to decode file handle (len=6, type=248, flags=0, err=-22) [ 449.374120][ T9579] kernel read not supported for file /adsp1 (pid: 9579 comm: kworker/0:9) [ 449.603303][ T9577] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 449.611899][ T1597] usb 2-1: new full-speed USB device number 47 using dummy_hcd [ 449.639130][ T30] audit: type=1400 audit(2000000186.771:842): avc: denied { read } for pid=11235 comm="syz.2.1394" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 449.778847][ T30] audit: type=1400 audit(2000000186.837:843): avc: denied { setopt } for pid=11235 comm="syz.2.1394" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 449.879273][ T1597] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 449.889923][ T1597] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 449.905968][ T9577] usb 1-1: unable to get BOS descriptor or descriptor too short [ 449.932686][ T9577] usb 1-1: config 114 has an invalid interface number: 240 but max is 0 [ 449.946535][ T1597] usb 2-1: Product: syz [ 449.963821][ T1597] usb 2-1: Manufacturer: syz [ 449.973244][ T9577] usb 1-1: config 114 has no interface number 0 [ 449.987780][ T1597] usb 2-1: SerialNumber: syz [ 450.001589][ T9577] usb 1-1: config 114 interface 240 altsetting 232 bulk endpoint 0x1 has invalid maxpacket 1023 [ 450.052879][ T1597] usb 2-1: config 0 descriptor?? [ 450.073117][ T9577] usb 1-1: config 114 interface 240 altsetting 232 has an endpoint descriptor with address 0xCA, changing to 0x8A [ 450.096755][ T9577] usb 1-1: config 114 interface 240 altsetting 232 bulk endpoint 0x8A has invalid maxpacket 16 [ 450.122215][ T9577] usb 1-1: config 114 interface 240 has no altsetting 0 [ 450.140630][ T9577] usb 1-1: string descriptor 0 read error: -22 [ 450.148697][ T9577] usb 1-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice= 6.38 [ 450.159721][ T9577] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 450.243190][ T9578] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 450.253225][T11233] raw-gadget.3 gadget.0: fail, usb_ep_enable returned -22 [ 450.265600][T11233] raw-gadget.3 gadget.0: fail, usb_ep_enable returned -22 [ 450.292196][ T9577] ir_usb 1-1:114.240: IR Dongle converter detected [ 450.327523][ T1597] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 450.416208][ T9578] usb 4-1: New USB device found, idVendor=1d50, idProduct=6089, bcdDevice=d0.1d [ 450.430028][ T9578] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 450.457695][ T803] usb 7-1: New USB device found, idVendor=0582, idProduct=0048, bcdDevice= 0.40 [ 450.467357][ T9578] usb 4-1: config 0 descriptor?? [ 450.478666][ T803] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 450.486954][ T803] usb 7-1: Product: ⠉ [ 450.494324][ T803] usb 7-1: Manufacturer: ч [ 450.505276][ T803] usb 7-1: can't set config #1, error -71 [ 450.769320][ T803] usb 7-1: USB disconnect, device number 14 [ 450.853783][ T9578] hackrf 4-1:0.0: usb_control_msg() failed -71 request 0e [ 450.861108][ T9577] usb 1-1: IRDA class descriptor not found, device not bound [ 450.875882][ T9578] hackrf 4-1:0.0: Could not detect board [ 450.884889][ T9578] hackrf 4-1:0.0: probe with driver hackrf failed with error -71 [ 451.000780][ T9578] usb 4-1: USB disconnect, device number 54 [ 451.025151][ T9577] usb 1-1: USB disconnect, device number 52 [ 451.399425][T11258] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1400'. [ 451.994285][T11263] gtp1: entered promiscuous mode [ 452.002187][T11263] gtp1: entered allmulticast mode [ 452.839454][T11258] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1400'. [ 452.840008][ T1597] usb 2-1: dvb_usb_v2: will use the device's hardware PID filter (table count: 32) [ 452.860323][ T1597] dvbdev: DVB: registering new adapter (TerraTec NOXON DAB Stick) [ 452.870116][ T1597] usb 2-1: media controller created [ 452.878121][ T1597] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 452.981448][ T1597] i2c i2c-1: Added multiplexed i2c bus 2 [ 452.999024][ T1597] rtl2832 1-0010: Realtek RTL2832 successfully attached [ 453.002079][T11273] binder: 11272:11273 ioctl c0306201 2000000001c0 returned -14 [ 453.015209][ T30] audit: type=1400 audit(2000000189.953:844): avc: denied { call } for pid=11272 comm="syz.2.1405" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 453.047486][ T1597] usb 2-1: DVB: registering adapter 1 frontend 0 (Realtek RTL2832 (DVB-T))... [ 453.067933][ T30] audit: type=1400 audit(2000000189.953:845): avc: denied { transfer } for pid=11272 comm="syz.2.1405" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 453.088587][ T1597] dvbdev: dvb_create_media_entity: media entity 'Realtek RTL2832 (DVB-T)' registered. [ 453.332039][ T9577] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 453.383420][ T1597] DVB: Unable to find symbol r820t_attach() [ 453.540762][ T9577] usb 1-1: Using ep0 maxpacket: 8 [ 453.572245][ T9577] usb 1-1: New USB device found, idVendor=0fe9, idProduct=db01, bcdDevice=e9.9b [ 453.582062][ T9577] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 453.591765][ T9577] usb 1-1: Product: syz [ 453.596709][ T9577] usb 1-1: Manufacturer: syz [ 453.601682][ T9577] usb 1-1: SerialNumber: syz [ 453.624841][ T9577] usb 1-1: config 0 descriptor?? [ 453.638780][ T9577] dvb-usb: found a 'DViCO FusionHDTV DVB-T USB (LGZ201)' in warm state. [ 453.654222][ T9577] dvb-usb: bulk message failed: -22 (2/0) [ 453.677592][ T9577] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 453.693564][ T9577] dvbdev: DVB: registering new adapter (DViCO FusionHDTV DVB-T USB (LGZ201)) [ 453.716967][ T9577] usb 1-1: media controller created [ 453.758503][ T9577] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 453.858020][T11269] loop5: detected capacity change from 0 to 7 [ 453.893082][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 453.902344][ C1] buffer_io_error: 27 callbacks suppressed [ 453.902355][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 453.945109][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 453.954373][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 453.965349][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 453.974600][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 453.982977][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 453.992167][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 454.002302][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 454.011504][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 454.020123][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 454.029340][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 454.039102][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 454.048401][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 454.056404][T11269] ldm_validate_partition_table(): Disk read failed. [ 454.073803][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 454.083010][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 454.091811][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 454.101051][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 454.109664][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 454.118875][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 454.129057][T11269] Dev loop5: unable to read RDB block 0 [ 454.150601][T11269] loop5: unable to read partition table [ 454.162379][T11269] loop5: partition table beyond EOD, truncated [ 454.179266][T11269] loop_reread_partitions: partition scan of loop5 (Wý* %4FLQk݊5) failed (rc=-5) [ 454.254150][ T1597] usb 2-1: USB disconnect, device number 47 [ 454.288403][T11271] ldm_validate_partition_table(): Disk read failed. [ 454.306550][T11271] Dev loop5: unable to read RDB block 0 [ 454.327851][T11271] loop5: unable to read partition table [ 454.398426][T11271] loop5: partition table beyond EOD, truncated [ 454.407205][T11293] comedi comedi0: Minor 2 could not be opened [ 454.730788][ T9577] cxusb: set interface failed [ 454.742592][ T9577] dvb-usb: bulk message failed: -22 (1/0) [ 454.950226][ T9577] DVB: Unable to find symbol mt352_attach() [ 454.971107][ T9577] dvb-usb: no frontend was attached by 'DViCO FusionHDTV DVB-T USB (LGZ201)' [ 455.181163][ T9577] rc_core: IR keymap rc-dvico-portable not found [ 455.188763][ T9577] Registered IR keymap rc-empty [ 455.195061][ T9577] rc rc0: DViCO FusionHDTV DVB-T USB (LGZ201) as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 455.212221][ T9577] input: DViCO FusionHDTV DVB-T USB (LGZ201) as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input28 [ 455.212413][T11304] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1412'. [ 455.238766][T11306] netlink: 512 bytes leftover after parsing attributes in process `syz.3.1413'. [ 455.254234][ T9577] dvb-usb: schedule remote query interval to 100 msecs. [ 455.341972][ T9577] dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized and connected. [ 455.355922][ T9577] usb 1-1: USB disconnect, device number 53 [ 455.481882][T11308] overlayfs: missing 'lowerdir' [ 457.444595][ T9577] dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully deinitialized and disconnected. [ 457.717351][T11334] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 457.727181][T11334] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 457.740786][T11334] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 457.766947][T11334] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 457.934668][T11322] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=11322 comm=syz.3.1416 [ 458.047995][T11338] netlink: 17 bytes leftover after parsing attributes in process `syz.6.1419'. [ 458.632783][ T30] audit: type=1400 audit(2000000195.221:846): avc: denied { remount } for pid=11349 comm="syz.1.1423" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 458.973330][T11346] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1422'. [ 459.986444][T11375] netlink: 30 bytes leftover after parsing attributes in process `syz.1.1430'. [ 460.469643][ T30] audit: type=1400 audit(2000000196.934:847): avc: denied { watch } for pid=11384 comm="syz.3.1434" path="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 460.512481][ T30] audit: type=1400 audit(2000000196.943:848): avc: denied { watch_sb watch_reads } for pid=11384 comm="syz.3.1434" path="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 460.538114][T11388] syzkaller1: entered promiscuous mode [ 460.548978][T11388] syzkaller1: entered allmulticast mode [ 460.658750][ T30] audit: type=1400 audit(2000000197.121:849): avc: denied { name_bind } for pid=11376 comm="syz.0.1431" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=rawip_socket permissive=1 [ 460.746247][T11385] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=11385 comm=syz.0.1431 [ 460.791940][ T30] audit: type=1400 audit(2000000197.243:850): avc: denied { ioctl } for pid=11392 comm="syz.6.1437" path="socket:[36414]" dev="sockfs" ino=36414 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 461.125398][ T30] audit: type=1400 audit(2000000197.561:851): avc: denied { accept } for pid=11401 comm="syz.2.1441" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 461.217677][ T1597] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 461.856515][ T1597] usb 7-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 461.875081][ T1597] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 462.022112][ T1597] usb 7-1: Product: syz [ 462.039177][T11412] comedi comedi0: Minor 2 could not be opened [ 462.042705][ T1597] usb 7-1: Manufacturer: syz [ 462.077252][ T1597] usb 7-1: SerialNumber: syz [ 462.135816][ T1597] usb 7-1: config 0 descriptor?? [ 462.160303][ T1597] gspca_main: sq905c-2.14.0 probing 2770:9052 [ 462.254384][ T30] audit: type=1400 audit(2000000198.581:852): avc: denied { read } for pid=11413 comm="syz.3.1444" path="socket:[37712]" dev="sockfs" ino=37712 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 462.404872][T11421] random: crng reseeded on system resumption [ 462.657113][T11399] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 462.705903][ T30] audit: type=1400 audit(2000000199.039:853): avc: denied { ioctl } for pid=11419 comm="syz.3.1448" path="/dev/snapshot" dev="devtmpfs" ino=92 ioctlcmd=0xf509 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 462.710921][T11399] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 463.021676][ T1597] gspca_sq905c: sq905c_read: usb_control_msg failed (-110) [ 463.033965][ T1597] sq905c 7-1:0.0: Reading version command failed [ 463.050789][ T1597] sq905c 7-1:0.0: probe with driver sq905c failed with error -110 [ 463.099614][ T1597] usb 7-1: USB disconnect, device number 15 [ 463.711223][ T30] audit: type=1400 audit(2000000199.975:854): avc: denied { mounton } for pid=11437 comm="syz.0.1451" path="/syzcgroup/cpu/syz0/cgroup.procs" dev="cgroup" ino=178 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=1 [ 463.711359][T11441] 9p: Bad value for 'port' [ 463.783868][ T30] audit: type=1326 audit(2000000200.041:855): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11443 comm="syz.1.1453" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f71ee99cdd9 code=0x0 [ 463.824783][T11449] netlink: 'syz.3.1452': attribute type 8 has an invalid length. [ 463.845431][T11441] comedi comedi4: bad chanlist[0]=0x00000ffb chan=4091 range length=2 [ 463.877362][ T9579] hid-generic 0000:0000:0000.0011: unknown main item tag 0x0 [ 463.902344][ T9579] hid-generic 0000:0000:0000.0011: unknown main item tag 0x0 [ 463.969027][ T9579] hid-generic 0000:0000:0000.0011: hidraw0: HID v0.00 Device [syz0] on syz0 [ 464.254608][T11460] comedi comedi4: bad chanlist[0]=0x00010300 chan=768 range length=2 [ 464.498689][ T9592] usb 7-1: new full-speed USB device number 16 using dummy_hcd [ 464.681895][ T9592] usb 7-1: unable to get BOS descriptor or descriptor too short [ 464.703033][ T9592] usb 7-1: not running at top speed; connect to a high speed hub [ 464.729153][ T9592] usb 7-1: config 243 has an invalid interface number: 8 but max is 0 [ 464.749626][ T9592] usb 7-1: config 243 has no interface number 0 [ 464.771217][ T9592] usb 7-1: config 243 interface 8 altsetting 1 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 464.807553][ T9592] usb 7-1: config 243 interface 8 has no altsetting 0 [ 464.832004][ T9592] usb 7-1: New USB device found, idVendor=0d9f, idProduct=0002, bcdDevice=fe.96 [ 464.847829][ T9592] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 464.867755][ T9592] usb 7-1: Product: syz [ 464.872082][ T9592] usb 7-1: Manufacturer: syz [ 464.879742][ T9592] usb 7-1: SerialNumber: syz [ 464.889072][T11461] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 465.209007][ T9592] cypress_m8 7-1:243.8: HID->COM RS232 Adapter converter detected [ 465.233356][ T9592] cyphidcom ttyUSB0: required endpoint is missing [ 465.265025][ T9592] usb 7-1: USB disconnect, device number 16 [ 465.288772][ T9592] cypress_m8 7-1:243.8: device disconnected [ 465.916640][T11482] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 466.373039][T11491] netlink: 17 bytes leftover after parsing attributes in process `syz.0.1465'. [ 466.941733][T11494] comedi comedi0: Minor 2 could not be opened [ 467.342202][ T9585] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 467.517504][ T9585] usb 1-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 467.543228][ T9585] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 467.557764][ T9585] usb 1-1: Product: syz [ 467.567100][ T9585] usb 1-1: Manufacturer: syz [ 467.575870][ T9585] usb 1-1: SerialNumber: syz [ 467.589437][ T9585] usb 1-1: config 0 descriptor?? [ 467.601789][ T9585] gspca_main: sq905c-2.14.0 probing 2770:9052 [ 467.620069][ T9577] usb 7-1: new high-speed USB device number 17 using dummy_hcd [ 467.662945][ T803] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 467.829038][ T803] usb 2-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 467.848679][ T803] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 467.894770][ T803] usb 2-1: Product: syz [ 467.902399][ T803] usb 2-1: Manufacturer: syz [ 467.911505][ T803] usb 2-1: SerialNumber: syz [ 467.925472][ T803] usb 2-1: config 0 descriptor?? [ 467.939292][ T9577] usb 7-1: Using ep0 maxpacket: 8 [ 467.953885][ T9577] usb 7-1: unable to get BOS descriptor or descriptor too short [ 467.966643][ T9577] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 467.985404][ T9577] usb 7-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0x9C, changing to 0x8C [ 468.001865][ T9577] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x8C has invalid wMaxPacketSize 0 [ 468.219303][ T9577] usb 7-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 468.244069][ T5617] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 468.266141][T11496] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 468.268948][ T803] gspca_main: sq905c-2.14.0 probing 2770:9052 [ 468.283427][ T9577] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 468.305000][T11496] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 468.324356][ T9577] usb 7-1: Product: syz [ 468.328674][ T9577] usb 7-1: Manufacturer: syz [ 468.336084][ T9585] gspca_sq905c: sq905c_read: usb_control_msg failed (-71) [ 468.344953][ T9577] usb 7-1: SerialNumber: syz [ 468.357042][ T9585] sq905c 1-1:0.0: Reading version command failed [ 468.377639][ T9585] sq905c 1-1:0.0: probe with driver sq905c failed with error -71 [ 468.390871][ T9585] usb 1-1: USB disconnect, device number 54 [ 468.588692][T11498] syzkaller0: entered promiscuous mode [ 468.600482][T11498] syzkaller0: entered allmulticast mode [ 468.651320][ T9577] usb 7-1: selecting invalid altsetting 1 [ 468.706323][ T5617] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 468.708380][T11500] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 468.729878][T11500] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 468.766588][ T803] gspca_sq905c: sq905c_read: usb_control_msg failed (-71) [ 468.787797][ T9577] snd-usb-audio 7-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 468.788636][ T803] sq905c 2-1:0.0: Reading version command failed [ 468.812903][ T9577] usb 7-1: USB disconnect, device number 17 [ 468.830637][ T803] sq905c 2-1:0.0: probe with driver sq905c failed with error -71 [ 468.843727][ T5607] udevd[5607]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 468.866313][ T803] usb 2-1: USB disconnect, device number 48 [ 469.057285][T11521] syzkaller0: entered promiscuous mode [ 469.100535][T11523] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1478'. [ 469.129566][T11523] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1478'. [ 469.242906][ T9592] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 469.489166][ T9592] usb 4-1: Using ep0 maxpacket: 16 [ 469.495712][ T9592] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 469.508411][ T9592] usb 4-1: New USB device found, idVendor=0e20, idProduct=0101, bcdDevice=7a.5a [ 469.517937][ T9592] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 469.526008][ T9592] usb 4-1: Product: syz [ 469.530290][ T9592] usb 4-1: Manufacturer: syz [ 469.540092][ T30] audit: type=1400 audit(2000000205.431:856): avc: denied { nlmsg_write } for pid=11528 comm="syz.6.1480" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 469.552748][ T9592] usb 4-1: SerialNumber: syz [ 469.586848][ T9592] usb 4-1: config 0 descriptor?? [ 469.611698][ T30] audit: type=1400 audit(2000000205.459:857): avc: denied { audit_write } for pid=11528 comm="syz.6.1480" capability=29 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 469.629117][ T9592] pegasus_notetaker 4-1:0.0: Invalid number of endpoints [ 469.667982][ T9592] pegasus_notetaker 4-1:0.0: probe with driver pegasus_notetaker failed with error -22 [ 469.685608][ T30] audit: type=1107 audit(2000000205.459:858): pid=11528 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 469.859696][T11539] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1483'. [ 469.969280][T11540] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1483'. [ 470.220668][ T9577] usb 4-1: USB disconnect, device number 55 [ 470.540865][ T9592] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 470.729347][ T9592] usb 7-1: Using ep0 maxpacket: 16 [ 470.758700][ T9592] usb 7-1: config 4 has an invalid interface number: 9 but max is 0 [ 470.779972][ T9592] usb 7-1: config 4 has an invalid descriptor of length 101, skipping remainder of the config [ 470.867208][ T9592] usb 7-1: config 4 has no interface number 0 [ 470.875087][ T9592] usb 7-1: config 4 interface 9 altsetting 2 endpoint 0x4 has invalid maxpacket 29200, setting to 1024 [ 470.888240][ T9592] usb 7-1: config 4 interface 9 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 1024 [ 470.904712][ T9592] usb 7-1: config 4 interface 9 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 470.917632][ T9592] usb 7-1: config 4 interface 9 has no altsetting 0 [ 470.945811][ T9592] usb 7-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=76.fe [ 470.963151][ T9592] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 470.969106][T11550] netlink: 96 bytes leftover after parsing attributes in process `syz.3.1485'. [ 470.981725][ T9592] usb 7-1: Product: syz [ 470.987918][ T9592] usb 7-1: Manufacturer: syz [ 471.005866][ T9592] usb 7-1: SerialNumber: syz [ 471.046867][T11543] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 471.060714][T11552] netlink: 17 bytes leftover after parsing attributes in process `syz.2.1484'. [ 471.345034][ T9592] usb 7-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 471.849521][T11557] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1487'. [ 471.859177][T11557] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1487'. [ 471.877900][T11557] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1487'. [ 472.479289][ T12] usb 7-1: Failed to submit usb control message: -110 [ 472.496152][ T12] usb 7-1: unable to send the bmi data to the device: -110 [ 472.503542][ T12] usb 7-1: unable to get target info from device [ 472.520607][ T12] usb 7-1: could not get target info (-110) [ 472.537057][ T12] usb 7-1: could not probe fw (-110) [ 473.172562][ T30] audit: type=1400 audit(2000000208.828:859): avc: denied { read } for pid=11570 comm="syz.2.1490" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 473.265505][T11573] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1490'. [ 474.013896][T11542] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 474.023199][T11542] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 474.208403][ T30] audit: type=1400 audit(2000000209.801:860): avc: denied { bind } for pid=11579 comm="syz.6.1492" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 474.301565][ T1049] tipc: Subscription rejected, illegal request [ 474.314202][ T13] netdevsim netdevsim6 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 474.329102][T11582] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1494'. [ 474.361506][ T13] netdevsim netdevsim6 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 474.403772][ T13] netdevsim netdevsim6 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 474.423913][ T9579] usb 7-1: USB disconnect, device number 18 [ 474.440942][ T13] netdevsim netdevsim6 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 474.494996][ T13] netdevsim netdevsim6 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 474.520043][T11587] binder: 11586:11587 ioctl 89e1 200000000500 returned -22 [ 474.535814][ T13] netdevsim netdevsim6 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 474.556862][T11587] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 474.591052][ T13] netdevsim netdevsim6 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 474.632806][ T13] netdevsim netdevsim6 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 474.836491][T11599] netlink: 'syz.1.1498': attribute type 4 has an invalid length. [ 474.841782][T11582] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1494'. [ 474.874131][T11599] netlink: 156 bytes leftover after parsing attributes in process `syz.1.1498'. [ 474.917221][T11599] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 475.644094][ T9579] usb 7-1: new low-speed USB device number 19 using dummy_hcd [ 475.894808][ T9579] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 475.941126][ T9579] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 475.997075][ T9579] usb 7-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 476.033770][ T9579] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 476.067717][T11612] xt_connbytes: Forcing CT accounting to be enabled [ 476.092916][ T9579] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 476.113907][ T9579] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 476.142349][ T9579] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 476.175450][ T9579] usb 7-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 476.182881][T11615] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1503'. [ 476.200022][ T9579] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 476.224450][ T9579] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 476.248004][ T9579] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 476.269308][ T9579] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 476.291209][ T9579] usb 7-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 476.316963][ T9579] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 476.349119][ T9579] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 476.361223][T11618] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1503'. [ 476.372991][ T9579] usb 7-1: string descriptor 0 read error: -22 [ 476.381575][ T9579] usb 7-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 476.401492][ T9579] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 476.748640][ T9579] adutux 7-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 476.987267][T11626] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 477.068057][T11630] SELinux: Context system_u:object_r:hald_var_lib_t:s0 is not valid (left unmapped). [ 477.080153][ T30] audit: type=1400 audit(2000000212.487:861): avc: denied { relabelto } for pid=11629 comm="syz.0.1507" name="file0" dev="tmpfs" ino=1675 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:hald_var_lib_t:s0" [ 477.163308][ T30] audit: type=1400 audit(2000000212.515:862): avc: denied { associate } for pid=11629 comm="syz.0.1507" name="file0" dev="tmpfs" ino=1675 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:hald_var_lib_t:s0" [ 477.244970][ T30] audit: type=1400 audit(2000000212.599:863): avc: denied { rmdir } for pid=5620 comm="syz-executor" name="file0" dev="tmpfs" ino=1675 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:hald_var_lib_t:s0" [ 477.272776][ T9577] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 477.293206][T11637] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1511'. [ 477.433761][T11640] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1511'. [ 477.468495][ T9577] usb 4-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 477.481603][ T9577] usb 4-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 477.542478][ T9577] usb 4-1: config 0 interface 0 has no altsetting 0 [ 477.563871][ T9577] usb 4-1: New USB device found, idVendor=045e, idProduct=009d, bcdDevice= 0.00 [ 477.618569][ T9577] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 477.722796][ T9577] usb 4-1: config 0 descriptor?? [ 477.739108][T11628] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 477.977159][ T9579] usb 7-1: USB disconnect, device number 19 [ 478.547242][ T9577] microsoft 0003:045E:009D.0012: unknown main item tag 0x0 [ 478.582130][ T9577] microsoft 0003:045E:009D.0012: unknown main item tag 0x0 [ 478.619565][ T9577] microsoft 0003:045E:009D.0012: unknown main item tag 0x0 [ 478.627596][T11663] netlink: 17 bytes leftover after parsing attributes in process `syz.6.1516'. [ 478.667430][ T9577] microsoft 0003:045E:009D.0012: unknown main item tag 0x0 [ 478.669282][T11628] netlink: 4768 bytes leftover after parsing attributes in process `syz.3.1506'. [ 478.675340][T11664] netlink: 'syz.2.1515': attribute type 4 has an invalid length. [ 478.718352][ T9577] microsoft 0003:045E:009D.0012: unknown main item tag 0x0 [ 478.880971][T11664] netlink: 156 bytes leftover after parsing attributes in process `syz.2.1515'. [ 478.883190][ T9577] microsoft 0003:045E:009D.0012: unknown main item tag 0x0 [ 478.937662][T11664] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 478.953486][ T9577] microsoft 0003:045E:009D.0012: unknown main item tag 0x0 [ 478.972972][ T9577] microsoft 0003:045E:009D.0012: unknown main item tag 0x0 [ 478.981385][ T9577] microsoft 0003:045E:009D.0012: unknown main item tag 0x0 [ 478.990228][ T9577] microsoft 0003:045E:009D.0012: unknown main item tag 0x0 [ 479.019361][ T9577] microsoft 0003:045E:009D.0012: hidraw0: USB HID v0.07 Device [HID 045e:009d] on usb-dummy_hcd.3-1/input0 [ 479.074548][ T9577] microsoft 0003:045E:009D.0012: no inputs found [ 479.112972][ T9577] microsoft 0003:045E:009D.0012: could not initialize ff, continuing anyway [ 479.155263][ T9577] usb 4-1: USB disconnect, device number 56 [ 479.168510][T11671] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 479.173687][T11669] fido_id[11669]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:045E:009D.0012/report_descriptor': No such device [ 479.270325][T11674] FAULT_INJECTION: forcing a failure. [ 479.270325][T11674] name failslab, interval 1, probability 0, space 0, times 0 [ 479.361707][T11674] CPU: 1 UID: 0 PID: 11674 Comm: syz.0.1519 Tainted: G L syzkaller #0 PREEMPT(full) [ 479.361737][T11674] Tainted: [L]=SOFTLOCKUP [ 479.361743][T11674] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 479.361752][T11674] Call Trace: [ 479.361758][T11674] [ 479.361765][T11674] dump_stack_lvl+0x100/0x190 [ 479.361791][T11674] should_fail_ex.cold+0x5/0xa [ 479.361817][T11674] should_failslab+0xc2/0x120 [ 479.361836][T11674] kmem_cache_alloc_lru_noprof+0x80/0x6e0 [ 479.361862][T11674] ? __d_alloc+0x34/0xa40 [ 479.361892][T11674] __d_alloc+0x34/0xa40 [ 479.361918][T11674] d_alloc_pseudo+0x1c/0xc0 [ 479.361936][T11674] alloc_file_pseudo+0xcf/0x230 [ 479.361963][T11674] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 479.361987][T11674] ? inode_init_always_gfp+0xce1/0x1000 [ 479.362018][T11674] sock_alloc_file+0x50/0x210 [ 479.362038][T11674] do_accept+0x242/0x530 [ 479.362062][T11674] ? do_raw_spin_lock+0x128/0x260 [ 479.362090][T11674] ? __pfx_do_accept+0x10/0x10 [ 479.362128][T11674] __sys_accept4+0x108/0x200 [ 479.362166][T11674] ? __pfx___sys_accept4+0x10/0x10 [ 479.362189][T11674] ? __pfx_ksys_write+0x10/0x10 [ 479.362212][T11674] __x64_sys_accept4+0x96/0x100 [ 479.362235][T11674] ? lockdep_hardirqs_on+0x78/0x100 [ 479.362256][T11674] do_syscall_64+0x10b/0xf80 [ 479.362275][T11674] ? clear_bhb_loop+0x40/0x90 [ 479.362297][T11674] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 479.362321][T11674] RIP: 0033:0x7f0abe59cdd9 [ 479.362336][T11674] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 479.362354][T11674] RSP: 002b:00007f0abf3fd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000120 [ 479.362371][T11674] RAX: ffffffffffffffda RBX: 00007f0abe815fa0 RCX: 00007f0abe59cdd9 [ 479.362382][T11674] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000007 [ 479.362392][T11674] RBP: 00007f0abf3fd090 R08: 0000000000000000 R09: 0000000000000000 [ 479.362402][T11674] R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000001 [ 479.362416][T11674] R13: 00007f0abe816038 R14: 00007f0abe815fa0 R15: 00007ffe38e39d88 [ 479.362439][T11674] [ 480.092700][T11678] syzkaller0: entered promiscuous mode [ 480.117204][T11678] syzkaller0: entered allmulticast mode [ 480.125826][T11676] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1517'. [ 480.303068][ T9585] usb 1-1: new full-speed USB device number 55 using dummy_hcd [ 480.545000][ T9585] usb 1-1: device descriptor read/64, error -71 [ 480.815253][ T9585] usb 1-1: new full-speed USB device number 56 using dummy_hcd [ 480.986921][ T9585] usb 1-1: device descriptor read/64, error -71 [ 481.202718][ T9585] usb usb1-port1: attempt power cycle [ 481.354308][T11696] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 481.363226][T11696] overlayfs: option "uuid=on" requires an upper fs, falling back to uuid=null. [ 481.372577][T11696] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 481.588494][ T9585] usb 1-1: new full-speed USB device number 57 using dummy_hcd [ 481.635922][ T9585] usb 1-1: device descriptor read/8, error -71 [ 482.002238][ T9585] usb 1-1: new full-speed USB device number 58 using dummy_hcd [ 482.037765][ T9585] usb 1-1: device descriptor read/8, error -71 [ 482.108992][T11703] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1526'. [ 482.168230][ T9585] usb usb1-port1: unable to enumerate USB device [ 483.280018][T11713] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1529'. [ 483.468303][T11713] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1529'. [ 483.681006][ T30] audit: type=1400 audit(2000000218.598:864): avc: denied { write } for pid=11714 comm="syz.0.1530" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 484.053235][T11667] ------------[ cut here ]------------ [ 484.059085][T11667] !chanctx_conf [ 484.059095][T11667] WARNING: net/mac80211/rate.c:53 at rate_control_rate_init+0x5c5/0x730, CPU#0: syz.1.1517/11667 [ 484.074811][T11667] Modules linked in: [ 484.080572][T11667] CPU: 0 UID: 0 PID: 11667 Comm: syz.1.1517 Tainted: G L syzkaller #0 PREEMPT(full) [ 484.091588][T11667] Tainted: [L]=SOFTLOCKUP [ 484.095914][T11667] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 484.106004][T11667] RIP: 0010:rate_control_rate_init+0x5c5/0x730 [ 484.112203][T11667] Code: 48 8d 35 00 00 00 00 e8 79 32 e3 f6 e8 74 8a ec f6 e9 20 fe ff ff e8 9a 46 07 f7 90 0f 0b 90 e9 12 fe ff ff e8 8c 46 07 f7 90 <0f> 0b 90 eb b1 e8 81 46 07 f7 e8 cc 92 eb f6 31 ff 89 c3 89 c6 e8 [ 484.131970][T11667] RSP: 0018:ffffc90005ebf200 EFLAGS: 00010283 [ 484.138044][T11667] RAX: 0000000000000838 RBX: ffff88802d9fc000 RCX: ffffc9000406a000 [ 484.146076][T11667] RDX: 0000000000080000 RSI: ffffffff8b014394 RDI: ffff8880264a0000 [ 484.154078][T11667] RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000 [ 484.162134][T11667] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88802b86aea0 [ 484.170115][T11667] R13: ffff888053c50f20 R14: ffff88804704c000 R15: 0000000000000000 [ 484.178279][T11667] FS: 00007f71ef8b16c0(0000) GS:ffff888124376000(0000) knlGS:0000000000000000 [ 484.187298][T11667] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 484.193935][T11667] CR2: 00007fecce23b990 CR3: 000000005de47000 CR4: 00000000003526f0 [ 484.201917][T11667] Call Trace: [ 484.205272][T11667] [ 484.208214][T11667] rate_control_rate_init_all_links+0x76/0x1f0 [ 484.214396][T11667] sta_apply_auth_flags.isra.0+0x4aa/0x500 [ 484.220190][T11667] sta_apply_parameters+0x1234/0x2090 [ 484.225665][T11667] ? __sta_info_alloc+0x1146/0x1cd0 [ 484.230861][T11667] ieee80211_add_station+0x3ff/0x760 [ 484.236190][T11667] nl80211_new_station+0x14a9/0x20f0 [ 484.241469][T11667] ? __pfx_nl80211_new_station+0x10/0x10 [ 484.247166][T11667] ? nl80211_pre_doit+0x19a/0xae0 [ 484.252176][T11667] genl_family_rcv_msg_doit+0x214/0x300 [ 484.258022][T11667] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 484.264157][T11667] ? bpf_lsm_capable+0x9/0x10 [ 484.268852][T11667] ? security_capable+0x80/0x260 [ 484.273775][T11667] ? ns_capable+0xd2/0xf0 [ 484.278142][T11667] genl_rcv_msg+0x560/0x800 [ 484.282649][T11667] ? __pfx_genl_rcv_msg+0x10/0x10 [ 484.287663][T11667] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 484.293065][T11667] ? __pfx_nl80211_new_station+0x10/0x10 [ 484.298695][T11667] ? __pfx_nl80211_post_doit+0x10/0x10 [ 484.304191][T11667] netlink_rcv_skb+0x159/0x420 [ 484.308945][T11667] ? __pfx_genl_rcv_msg+0x10/0x10 [ 484.314000][T11667] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 484.319288][T11667] ? netlink_deliver_tap+0x1ae/0xcc0 [ 484.324596][T11667] genl_rcv+0x28/0x40 [ 484.328668][T11667] netlink_unicast+0x585/0x850 [ 484.333590][T11667] ? __pfx_netlink_unicast+0x10/0x10 [ 484.338892][T11667] netlink_sendmsg+0x8b0/0xda0 [ 484.343697][T11667] ? __pfx_netlink_sendmsg+0x10/0x10 [ 484.348983][T11667] ? __might_fault+0x90/0x140 [ 484.353766][T11667] ____sys_sendmsg+0x9e1/0xb70 [ 484.358557][T11667] ? __pfx_netlink_sendmsg+0x10/0x10 [ 484.363958][T11667] ? __pfx_____sys_sendmsg+0x10/0x10 [ 484.369282][T11667] ? __pfx_futex_wake_mark+0x10/0x10 [ 484.374623][T11667] ___sys_sendmsg+0x190/0x1e0 [ 484.379309][T11667] ? __pfx____sys_sendmsg+0x10/0x10 [ 484.384548][T11667] __sys_sendmsg+0x170/0x220 [ 484.389185][T11667] ? __pfx___sys_sendmsg+0x10/0x10 [ 484.394308][T11667] ? __x64_sys_futex+0x34f/0x4d0 [ 484.399302][T11667] ? arch_syscall_is_vdso_sigreturn+0xb6/0x200 [ 484.405468][T11667] ? syscall_user_dispatch+0x76/0x130 [ 484.410889][T11667] do_syscall_64+0x10b/0xf80 [ 484.415487][T11667] ? clear_bhb_loop+0x40/0x90 [ 484.420226][T11667] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 484.426125][T11667] RIP: 0033:0x7f71ee99cdd9 [ 484.430700][T11667] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 484.450470][T11667] RSP: 002b:00007f71ef8b1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 484.458919][T11667] RAX: ffffffffffffffda RBX: 00007f71eec15fa0 RCX: 00007f71ee99cdd9 [ 484.466954][T11667] RDX: 0000000000000000 RSI: 0000200000001080 RDI: 0000000000000008 [ 484.474977][T11667] RBP: 00007f71eea32d69 R08: 0000000000000000 R09: 0000000000000000 [ 484.482981][T11667] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 484.490964][T11667] R13: 00007f71eec16038 R14: 00007f71eec15fa0 R15: 00007ffc842b5298 [ 484.499030][T11667] [ 484.502050][T11667] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 484.509338][T11667] CPU: 0 UID: 0 PID: 11667 Comm: syz.1.1517 Tainted: G L syzkaller #0 PREEMPT(full) [ 484.520254][T11667] Tainted: [L]=SOFTLOCKUP [ 484.524558][T11667] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 484.534597][T11667] Call Trace: [ 484.537863][T11667] [ 484.540777][T11667] dump_stack_lvl+0x100/0x190 [ 484.545446][T11667] vpanic+0x552/0x970 [ 484.549415][T11667] ? __pfx_vpanic+0x10/0x10 [ 484.553919][T11667] panic+0xd1/0xe0 [ 484.557626][T11667] ? __pfx_panic+0x10/0x10 [ 484.562046][T11667] check_panic_on_warn.cold+0x19/0x34 [ 484.567410][T11667] ? rate_control_rate_init+0x5c5/0x730 [ 484.572942][T11667] __warn.cold+0x191/0x328 [ 484.577341][T11667] __report_bug+0x296/0x3d0 [ 484.581826][T11667] ? rate_control_rate_init+0x5c5/0x730 [ 484.587357][T11667] ? __pfx___report_bug+0x10/0x10 [ 484.592363][T11667] ? kasan_save_track+0x14/0x30 [ 484.597196][T11667] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 484.603517][T11667] ? ieee80211_add_station+0x5f1/0x760 [ 484.608961][T11667] ? nl80211_new_station+0x14a9/0x20f0 [ 484.614408][T11667] ? genl_family_rcv_msg_doit+0x214/0x300 [ 484.620119][T11667] ? netlink_rcv_skb+0x159/0x420 [ 484.625039][T11667] ? netlink_unicast+0x585/0x850 [ 484.629959][T11667] ? netlink_sendmsg+0x8b0/0xda0 [ 484.634893][T11667] ? ____sys_sendmsg+0x9e1/0xb70 [ 484.639822][T11667] ? rate_control_rate_init+0x5c5/0x730 [ 484.645350][T11667] report_bug+0xb2/0x220 [ 484.649577][T11667] ? rate_control_rate_init+0x5c5/0x730 [ 484.655113][T11667] handle_bug+0x16a/0x2a0 [ 484.659429][T11667] exc_invalid_op+0x17/0x50 [ 484.663922][T11667] asm_exc_invalid_op+0x1a/0x20 [ 484.668756][T11667] RIP: 0010:rate_control_rate_init+0x5c5/0x730 [ 484.674896][T11667] Code: 48 8d 35 00 00 00 00 e8 79 32 e3 f6 e8 74 8a ec f6 e9 20 fe ff ff e8 9a 46 07 f7 90 0f 0b 90 e9 12 fe ff ff e8 8c 46 07 f7 90 <0f> 0b 90 eb b1 e8 81 46 07 f7 e8 cc 92 eb f6 31 ff 89 c3 89 c6 e8 [ 484.694486][T11667] RSP: 0018:ffffc90005ebf200 EFLAGS: 00010283 [ 484.700535][T11667] RAX: 0000000000000838 RBX: ffff88802d9fc000 RCX: ffffc9000406a000 [ 484.708488][T11667] RDX: 0000000000080000 RSI: ffffffff8b014394 RDI: ffff8880264a0000 [ 484.716441][T11667] RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000 [ 484.724393][T11667] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88802b86aea0 [ 484.732344][T11667] R13: ffff888053c50f20 R14: ffff88804704c000 R15: 0000000000000000 [ 484.740301][T11667] ? rate_control_rate_init+0x5c4/0x730 [ 484.745837][T11667] rate_control_rate_init_all_links+0x76/0x1f0 [ 484.751976][T11667] sta_apply_auth_flags.isra.0+0x4aa/0x500 [ 484.757771][T11667] sta_apply_parameters+0x1234/0x2090 [ 484.763145][T11667] ? __sta_info_alloc+0x1146/0x1cd0 [ 484.768330][T11667] ieee80211_add_station+0x3ff/0x760 [ 484.773603][T11667] nl80211_new_station+0x14a9/0x20f0 [ 484.778881][T11667] ? __pfx_nl80211_new_station+0x10/0x10 [ 484.784521][T11667] ? nl80211_pre_doit+0x19a/0xae0 [ 484.789534][T11667] genl_family_rcv_msg_doit+0x214/0x300 [ 484.795070][T11667] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 484.801131][T11667] ? bpf_lsm_capable+0x9/0x10 [ 484.805791][T11667] ? security_capable+0x80/0x260 [ 484.810712][T11667] ? ns_capable+0xd2/0xf0 [ 484.815031][T11667] genl_rcv_msg+0x560/0x800 [ 484.819525][T11667] ? __pfx_genl_rcv_msg+0x10/0x10 [ 484.824539][T11667] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 484.829899][T11667] ? __pfx_nl80211_new_station+0x10/0x10 [ 484.835519][T11667] ? __pfx_nl80211_post_doit+0x10/0x10 [ 484.840972][T11667] netlink_rcv_skb+0x159/0x420 [ 484.845723][T11667] ? __pfx_genl_rcv_msg+0x10/0x10 [ 484.850736][T11667] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 484.856014][T11667] ? netlink_deliver_tap+0x1ae/0xcc0 [ 484.861287][T11667] genl_rcv+0x28/0x40 [ 484.865252][T11667] netlink_unicast+0x585/0x850 [ 484.870003][T11667] ? __pfx_netlink_unicast+0x10/0x10 [ 484.875279][T11667] netlink_sendmsg+0x8b0/0xda0 [ 484.880032][T11667] ? __pfx_netlink_sendmsg+0x10/0x10 [ 484.885306][T11667] ? __might_fault+0x90/0x140 [ 484.889978][T11667] ____sys_sendmsg+0x9e1/0xb70 [ 484.894727][T11667] ? __pfx_netlink_sendmsg+0x10/0x10 [ 484.900003][T11667] ? __pfx_____sys_sendmsg+0x10/0x10 [ 484.905276][T11667] ? __pfx_futex_wake_mark+0x10/0x10 [ 484.910548][T11667] ___sys_sendmsg+0x190/0x1e0 [ 484.915217][T11667] ? __pfx____sys_sendmsg+0x10/0x10 [ 484.920424][T11667] __sys_sendmsg+0x170/0x220 [ 484.925004][T11667] ? __pfx___sys_sendmsg+0x10/0x10 [ 484.930104][T11667] ? __x64_sys_futex+0x34f/0x4d0 [ 484.935032][T11667] ? arch_syscall_is_vdso_sigreturn+0xb6/0x200 [ 484.941179][T11667] ? syscall_user_dispatch+0x76/0x130 [ 484.946557][T11667] do_syscall_64+0x10b/0xf80 [ 484.951131][T11667] ? clear_bhb_loop+0x40/0x90 [ 484.955793][T11667] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 484.961666][T11667] RIP: 0033:0x7f71ee99cdd9 [ 484.966063][T11667] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 484.985664][T11667] RSP: 002b:00007f71ef8b1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 484.994099][T11667] RAX: ffffffffffffffda RBX: 00007f71eec15fa0 RCX: 00007f71ee99cdd9 [ 485.002089][T11667] RDX: 0000000000000000 RSI: 0000200000001080 RDI: 0000000000000008 [ 485.010045][T11667] RBP: 00007f71eea32d69 R08: 0000000000000000 R09: 0000000000000000 [ 485.018004][T11667] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 485.025956][T11667] R13: 00007f71eec16038 R14: 00007f71eec15fa0 R15: 00007ffc842b5298 [ 485.033933][T11667] [ 485.037247][T11667] Kernel Offset: disabled [ 485.041557][T11667] Rebooting in 86400 seconds..