last executing test programs: 22.70846733s ago: executing program 3 (id=3096): syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000027c0)=ANY=[@ANYBLOB="1c0200001b00000325bd7000fcdbdf257f000001000000000000000000000000fe8000000000000000000000000000144e2102004e2000000a00102027000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000800300000000000000030000000000000006000000000000003776c3450000000008000000000000002800000000000000ffffffffffffff7f707461b2fc67f5d92670b546b30d0000000000000b000000000000000001000001000000090000000000000005000000bc6b6e000200020300000000400000000000000010000a002cbd700025bd700007000000410101006362636d61632863617374352d67656e657269632900000000000000000000000000000000000000000000000000000000000000000000000000000000000000c807000043bd238d335d347b5bcfcb11e94d094d55ca668076a111f50b71bdce5ea7722efa7543a391efa227aa4b88cc845fb683f91d059182d15f9c47e1e677588b8e068a3bcaf1f0a4422554b6a81e3e2dd9fdcf126a1f218e7340a15e8808337c55782216ce17fae91d9e3d4bd9ce978c9db7bf31dead79782e5a21000a786b6d8bf98a28661afb80db2735148230edcc50473e1e6f6c91da788ac90b155902f21b325e3e37ca43bc5892f0900b1671d3b6e561d70e28ae5fa2c662a68fe375084277d2b6b2674968a93901bb1e9b37fc72a759023d37e4fefaed7361c6ef12f9456f38003b25fa7d74dea5ffffc40800000000000000ccfe8c99bc00000008001f00030000000837d03d6d08b80f16cde05478062adb77631f4346d717e5975670cf6d1f20eea55d6242ac55d48c4513186f74b09dcc2797424023d3db76ee153b1efed8b648bc95ffd3db3652c83334e58f2bdc35fc84628d1b5ccfd493e195f5c77e42fba34908c15924ca22fe13483e7b1e1d7a6cf3b8ffab39defc00"], 0x21c}, 0x1, 0x0, 0x0, 0x4001000}, 0x20000810) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000001180)=0x2000000) mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3, 0x12, r1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet6_sctp(0xa, 0x1, 0x84) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/cgroup.procs\x00', 0x2, 0x0) read$FUSE(r3, &(0x7f0000000440)={0x2020}, 0x2020) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x1, 0x0) r6 = openat$cgroup_subtree(r5, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r6, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) bpf$MAP_CREATE(0x0, &(0x7f0000000c80)=ANY=[@ANYBLOB], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) read$FUSE(r3, &(0x7f0000003b80)={0x2020}, 0x2020) r7 = socket$kcm(0x10, 0x0, 0x10) sendmsg$kcm(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000180)="1400000016000b43d27a80648c2594f90924fc60", 0x14}], 0x1, 0x0, 0x0, 0x600}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r8, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000002480)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="110127bd7000fddbdf2517000073696d00006e657464657673696da4cb000800030002000000d5000b000900000006001600faff00000500120001000000000000000000000000000000000000001f309a4631136d80658de85dedf2337044e17c1aed0a6e82029f8c0cf9a3a4ca37fb9f1950b9dd7d8b43f6b940291e544e52b926935361683b2031daa46e"], 0x54}, 0x1, 0x0, 0x0, 0x804}, 0x20000) writev(0xffffffffffffffff, &(0x7f00000002c0), 0x0) 22.520645348s ago: executing program 3 (id=3097): prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) openat$binfmt_format(0xffffff9c, 0x0, 0x2, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0x405}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @byteorder={{0xe}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_BYTEORDER_DREG={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_BYTEORDER_SREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x80}}, 0x44000) syz_emit_ethernet(0x42, &(0x7f00000007c0)={@random="793a446f0204", @empty, @void, {@arp={0x806, @ether_ipv6={0x1, 0x86dd, 0x6, 0x10, 0x1, @random="b23c0edb4698", @private2, @local, @remote}}}}, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) syz_clone3(&(0x7f0000000440)={0x10000, &(0x7f0000000000), &(0x7f0000000040), &(0x7f00000000c0)=0x0, {0x41}, &(0x7f0000000100)=""/99, 0x63, &(0x7f0000000240)=""/77, &(0x7f0000000340)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x6}, 0x58) ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(0xffffffffffffffff, 0xc1105518, &(0x7f00000004c0)={{0x9, 0x5, 0x0, 0x9, '\x00', 0x5}, 0x2, 0x1, 0x5f, r3, 0x7, 0x9, 'syz1\x00', &(0x7f0000000380)=['[\x00', '&\'@@%\x00', '/dev/adsp1\x00', '$$^!{\x9f.*\'', '\x00', '/dev/nvram\x00', '/dev/L\x12?\xf3m\b'], 0x33}) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) kexec_load(0x0, 0x10, &(0x7f0000000340)=[{0x0, 0x0, 0x0, 0x3e0000000000}], 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) socket$nl_route(0x10, 0x3, 0x0) r4 = io_uring_setup(0x3454, &(0x7f00000003c0)={0x0, 0x0, 0x40, 0x0, 0xa7}) io_uring_register$IORING_REGISTER_BUFFERS(r4, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETOFFLOAD(r5, 0x400454d0, 0x6627993fc9cad4e5) 21.500903777s ago: executing program 3 (id=3102): r0 = socket$inet_tcp(0x2, 0x1, 0x0) creat(&(0x7f00000002c0)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x1a1043, 0xc5) tee(r2, r1, 0x5, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) preadv(0xffffffffffffffff, &(0x7f00000001c0), 0x0, 0x740, 0x0) sendmsg$DEVLINK_CMD_RELOAD(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20048041}, 0x4004080) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x44) creat(&(0x7f0000000040)='./file0\x00', 0x10a) open$dir(&(0x7f0000000080)='./file0\x00', 0x41c402, 0x80) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={0xffffffffffffffff, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000280)='./file0\x00', &(0x7f0000000300)=[0x5], &(0x7f0000000180)=[0x2], 0x0, 0x1, 0x1}}, 0x40) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000580)='htcp', 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r0, &(0x7f00000000c0), 0xffffffffffffffef, 0x41020000, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) 18.975292065s ago: executing program 3 (id=3108): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@ipv6_newrule={0x4c, 0x20, 0x1, 0x0, 0x25dfdbff, {0xa, 0x80, 0x14, 0x0, 0x0, 0x0, 0x0, 0x7, 0x1a}, [@FRA_SRC={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e23, 0x4e23}}, @FRA_DST={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, 0x4c}}, 0x40000) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=@newlink={0x5c, 0x10, 0x439, 0xfe, 0x0, {}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFLA_IPTUN_LOCAL={0x14, 0x2, @private2}]}}}]}, 0x5c}}, 0x0) 18.918125937s ago: executing program 3 (id=3109): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x41, [0x8000, 0xc95a, 0xf, 0x8, 0x7fffffff, 0x2, 0x7, 0x7f, 0x20000006, 0x4d, 0x2000006, 0x5f, 0x80000000, 0x5, 0xffff2d37, 0xffffff01, 0x7, 0x6, 0x0, 0x5, 0x24, 0x1, 0x7, 0x3c5b, 0x1, 0x24, 0x10006, 0x4, 0x5, 0xffffffff, 0xe661, 0x4, 0x7, 0x89d2, 0x8, 0x4c74, 0x80000004, 0x40000, 0x3, 0xe, 0x2, 0x80008071, 0x7, 0x17, 0xd, 0x407, 0x5, 0x3e, 0x8f, 0x4006, 0x6, 0x80000000, 0x0, 0x4, 0x8, 0x400, 0x80, 0x0, 0x0, 0x7, 0x8, 0x4, 0xfffffffe, 0x40], [0x10000007, 0xf0000000, 0x8000012f, 0x0, 0x800, 0x7, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x101, 0x14, 0x312, 0xd, 0xea4, 0xffffffff, 0x4, 0x7, 0x7fff, 0x5a7c, 0x420, 0xfffffffb, 0x6, 0x0, 0xff, 0x1, 0x5, 0x5f31, 0xd, 0x4e0, 0x7, 0x4, 0xb, 0x4, 0x20009, 0x8, 0x9, 0x9, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0xffffeffe, 0x7, 0x9, 0x5, 0x3, 0x8, 0x1, 0x3, 0x6c0, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x8004, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x9, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x10000, 0x3, 0x5, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x1, 0x800003, 0x200, 0x7e, 0x7, 0x4, 0x2950bfaf, 0xffe, 0xa2, 0x7, 0xa9, 0x5, 0xd, 0xac8, 0x2000bf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0x0, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2004, 0x80a0ed, 0x2, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0x7, 0x2, 0x57, 0x9, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0xffff, 0x2000a620, 0x2, 0x5, 0x1, 0x2, 0x5, 0xe7, 0x6, 0x16, 0xfffffffe, 0x80000003, 0x5, 0x4, 0xc8, 0x9, 0xfffff000, 0x10000, 0x3, 0x7e, 0xfd, 0x9602, 0x7, 0xaf, 0x8, 0x6, 0xffffffff, 0x5, 0x5, 0x8, 0x30b1d693, 0x2, 0xf40, 0x7, 0x1, 0x6c1c, 0xae000000, 0x4, 0x5, 0x2000b1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000105509147200ed0000000109022400010000000009040000030300000009210000000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000100)={0x2c, &(0x7f0000000280)=ANY=[@ANYBLOB=' mO'], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f00005f5000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000007c0)={0x2, 0x400000000000003, 0x0, 0x9, 0x16, 0x0, 0x0, 0x0, [@sadb_lifetime={0x4, 0x3, 0xfb}, @sadb_address={0x5, 0x6, 0x6c, 0x0, 0x0, @in6={0xa, 0x1, 0x0, @remote}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x70000001}, @sadb_address={0x5, 0x5, 0x0, 0x80, 0x0, @in6={0xa, 0x10, 0x2, @mcast1}}, @sadb_lifetime={0x4, 0x4, 0x5, 0x80000000, 0x6}]}, 0xb0}}, 0x0) sendmsg$ETHTOOL_MSG_WOL_SET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000740)=ANY=[@ANYBLOB="1c000000", @ANYRES16, @ANYBLOB="470d000000000000000000000000080002"], 0x1c}}, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) syz_clone(0x0, &(0x7f0000000000)="64d5e3aa402c9aa1270d53d460946455e24e813d6ecc4748ae4d834c9ea1a28267d991988aad1940e7ba359dffc9378df812f08f06711a47a5135b4331f30247976cf579c25519c535d6", 0x4a, &(0x7f00000000c0), &(0x7f0000000140), &(0x7f0000000880)="399066088de2b57889667e477ccf15d5172e497da64f72700a513e732b1c161027399ba77201201c3d9e3814854aff06368098dfc9203839b8b6fb05411611a028a8a749ae167dc2ef1e902c98742049d1431e4e4186bdab46ec603feab8853016472740a120a32cefeb56953cb877c5f0625ffd9868c1b27903b95f0ca2ce4c243846c33e52a0a5d3e5b33476d056a147c3e4d820b4558d5ae22dd891b6d9de5ac2eb9565af61ac2dfc8ebdb2f2472eb14b194bc454cbc6ce53bf3c3bdb224b603082fefcd7e0b6441d17a2617b7f905575bb00bafb285e8ba5eaa2a175930d70a384f3d0603de7c251e5f7a35e9a842f8f4c3e5a57a4fc6c7bea981fdfed7f17065fe56a5cbf35295b7c284146092bd6fe5b36903c4451a33bf912c551597dc096b57b52d2b8c395cefb1b696d3e1b1475fedf7c8fdd6e196a904a6083c952cac84e01ce40dac4fbcc5dbd64525b164997edcf1f2b3a3868ce66c735ff069c2cf13c767fc9524f0cc0d52459dc286b220122d6bd8768362b6f4f9937158af6604a57825366d0561104040b9fb55a74d10f2da388d352bf810b034bd93d9e8c5d21b66c624669ea523b024e123a956fb8ae6b9abe379008a225bc8806371dc6741b14c2fb7b2f119052114bf97e6a83f7c5997b389787f53b898e7d72f2ca70cb49c0e624b2d4abb8d4f05c6c6b9226439cc5526b4ab4dad3d2f83ebf1c3fa3344937cfa2e07b20cab0c39f7d02f937e4ece9092597f6615c37ae5089d5ab5f0e247f98a55d848d00f0be46b167f4dbe499284e0500ebf8aa4f03991b32a4cc1327658de5eeaa25142cc6d47c548511ea36bec8c324599ffad202c032f3f995a7afa07ab1d4a3c39fe615e2974ad51ecb756fe2c5f23a5da04a33014070ec4fa5bea895d8dea3a5d46483d5e4371cc076f82921a28ca0880d0d0a4622b055831c7859dbb9059542dd11379bc0fa8670cf7b70f8f220f1b0d6b37bec06986aacb7dfee0dbb62637ff3f8baf8417efc0d28d418ad2abd2ea81549b11eedc7cb8ebc3e88d8ced93c5bdaefbd044ec8941134af21e09a793f2f8de6ad8212464aede82f312a01cdf6e1d66290aa31074bf1ee4e95fb246ea74a738aedfe7b9f4e5a6866eae6e0054d3b7e74d910cb086500d4ca243a94cebc1032eb9360bc4474657f698cf8ae43e7ae499046a7f8b6b6d35c6066c0e589eb16a0fec4e6b369d39c17491b2824835983fb76fa43073c1fd09302e531b7f52646ff99f9db34f0c795b580f1c2b57eb6cf2b9c669c6e7f8c01c4a49d2524b64cbc1065afe358ad89e689c5f9f8627c519b556bcb6f987dc79f1a0a487906f43dfe1144d86d9bc696b3620cf1efc1446ffe70acd7d4c92e048daddab6ac9423988fee4391f20ecb745c5880566c13fb133fad195551d3483b9c9ee9e111ab2199be67de3a9642ed54f133ea1c84270464916b9034c0bca8b6039b54c9f06191d6990692ea96e24fcdc00d02109076547f379c85d5e67de623451f02e1237d68fb89c40cf24c029678314a94b049ec697974e5234700cb4f6ab80144bcf843621dba8042cf06c33859eb1d943008a161aab5c7649d41e9ada1b888005341c01be4b6baa9c68419b39b2ef4129b8b8e3b822737bddfaa4329ccac2eddcef6c2a176611e2f3582cf134ca0292a328314cfdb60e9d6392b37ddbf731d478dbd1cbb1c4b6e572cfd6392126f4ebb84f94da9b7dce526276fb770e46128d1efb6e2fca20f48a4ae1845b67eaa4b566f8f8a38c86cf3711875292a8beb5581a2f8f9b383214cb860770229cb5815f8c49b17406377cf9f79fb90c95d236ca3e20ea418b43b45e67c3b5927546de38a618453c511c991c18b2c15de5cf69426af3b4ea5fd95814ea4c3ae4875df84a7dab0fdbac4d5788211401496a8ace06c754bc32b99065a93a55a47163c53e7336fbdc63944f41c10ed010d0f294739b28f547648ab1e3fb46319e13707091e72e633470e56622a94b9928c7eb36ff8194d30594a4cb412cb1d9beeb78e4b16bbd57d3aa94fc0f165d62d3886e7a8008fea170dffe67c5eadbcec940b79d6bd3970b240763e17c1699a33398263a57134ec3cef74f0b676de025c607e059ae11a94a43599cbceacaf411c98d1b8424ee97c9345d6f5d8d1a2557023b21115b04f7a04754a4fd98c1727f9f4c9c8e6625d71cb8f553f74bba80c14c1267cc0305d93a453141624e81dbb466a5db402479936f5a7eb54ff0c23b399f7893bb476ea93c33661e4aaafd79f780ceae513c865b985d196782bb4b318532e6887db97fdf09c4f27bd04968f536202fd19d7a8b024d04f9cd24b8607a7cf50dad0374a4a4306a9f68048a4159be1ff047d260b0096649c42971a6f1ce0bc2805affe03a9623999d3be31d75acbe9ea596f8f8fd2b319df5764cf02c16b9a659171043c30988b79b8b4ade1fcefa59a35c302d7107b30cd252cf9c188edb4e7d4b057b80dbf7b78719c2874558945852c2b3477af105645abfaeafee1311030e472e16d806d90632136deae0bce8d4ee2262e5c3e0c96bf9196bd30b8158a8c073816a2e757bf754732249be218c385a688a5921f1476a1f6245fc8963600fce8070059b629c02e705848712599ddc48374903618e38c76ba8330630f4ea1a1d742fb0b8d01d0c6350d48ca2daea91d8c8cf47e7a0c95b5036303ea13cbac89576afd62093577956065640c1233bcaeacd0645efa8691aba68c019649d9492a74e301cee5b0931f6018109c815df452d0b1906a79f5256533da19c57db4120027ad57c3fe907952244b81e0f0c279aa8fd8abb6cc850fd424d7f4624515d0dca13ee274be44c23f2388568d7b1a79329a43a970053d19c5c426aff392f078fd137841ef4d2c4b00946beb50d50f6996178d727058987b8f499e948c6bf76299c8b9e368ccf04d0cfea95726cbec4e0defacaa4b8e23463365fda8039d3e79418a4069bf26c3490f6cc4d00f0ab3ced2b52b56e9d54a6e9623492aebc696bd8fd59825e0b01d58d7c6930f488b08436b6abea4587d59912505a9c8f1d64270d0994cbc52121f5faacc284b20a55a350a3e5ab29798ffdd62ea607287c0ab2b45e961474ef1bdbcf390513bd836c1e5330f88ac67876b8229988bccc4b5d48b5ddaac498d5a15444d233770a918dfb6101afe5507e7cfdf16256fd28887bf12537ac723f6f9d32e05546c7c0afd2615d559c84ae20b22e105d63ef8736e37437ee2984752d33fd7ed84f6fe09bf7bdbd16da30814a3660ca264646eadbc6f75fa081bc9a309e3113344f780917b1091985cca90f4e3fdbe7239f86ae0137fd323bd4665b80b099bb8d08e72fd8ce2c3a56dbeb719d07c09f50957c2b2401ae3b2449699d65766ae90cc01f835b953e4a0b604f464ec47dcea6d83c4c75d16944ba481608bb03cced8572a45ab0a99c816583fdedb6788c056ce2cf1e156a6571e123fb369c0582d4dbb32d197219d70aeba7a9860327d347676c1b44b27d763bc760a943a695832b737e055fa725ff217e9ce2bc39af0cb48b026228474c5690e7b17615e3d5f65407b897ce4bc446dbf24de251e7c8a7fd4915602c5e3465089b95b962f939e42411ee7db79d0628914307303c048f8a50bc79ebb7bbdd27c027fc46607a41db931eee5455e6f351a04d3b3d1962918b7350b395ac5a74cec33d73f3f4e39a63ce1fb9085e5fb8db26e6667b76bf625cf60de7f8104ee04e0d71eaeae05461b7c9d61f5a797c1aab1fb3fb707f16fd2f5f72f618e632d1becad59996cc1543a54db93c4aa8fb3ab2383f84fccefaff66f34d6ff2de2ea83db5257c2ff049fb0972c1a9f3bfb9524780c4a682889b42eef5097e61d982ede2d4546e05a497d8a54fa0a85093f536b43cd7b1a631193fa7d386000d22b3de3308c64a6203de3f99a9771fb46c8dfaad0a8682daef95d1ac24fa0ee113c90e88957216b2d16db387d0f25cd2f3886c87a601265c31e9b15c8dacdebab914e5cc064c07a015dd58c45c8433847d45b74e29601d5cc4ed68333dea0c16ecd1e828994cbf7aacb69571d0ca2874457ecbc2146fb21224a711aac131ff303f31c3e0c9407adba8aaace125356dc884180c9d64d7a26c2516b53bee002cfa2630736a5b916095b10d581063aefaff30974bfb44977e98e50bf12ad8ed3fea5be0f86cee1ca5d07d8f84aaf40c248fcb9c5ae2948110fdcd081a8a6a084dd517c1679d7bda2e33f80ef62bfbc528f1bd7ec127ee3493b4447915a74c17ece4c6656e8b6e74edba6134d61d2d562a6acdcc505fa89cb428287c5a35069c362dd9d6e36c8e2e71b966e528b687d82728632da009644d2b9cc609410aff3d0da185610e985f06aa6a02c76cdccffbb23e61ef04074aa32eb3e9b4ea1d5f6ee65bdbc9ac4825dad623409ad3cc4af671ca62b118b41ad73f1152655e92caf62a54c279e3c46daa29251b6e8b35bcafbfb6dd456a6523d080a6e02834fd9d9f112584613fccc5511e02d676e2484adc6472e1199213b796de89f84288db7117349759a5661f38b89b638c7f6fcf4a81e59e3a04cc1f5354881c8fdfdc8aa8dbf444debbda58547f7c01423ebfd4607952b741226c7741775a9d4af52e55aee1ee0f349f3d9bfd77db6fd9981e6360886295d0012796cae361bca560abd96a8d49089965fa058514cca4721385cd06a08fe5e72c2e742124b10a44a9d41dbff63a00bb4100746dd252d0349eae90bb979da1a6cc254b7000bceb73326f3062dff8d4e230121ccd85053282195e93846f1352d9c666a6ceb8a5c5c92246f8b659d785937139be36219a107f15fd3f8527d91ded3f0189c584065b0eccbb08e28b6a68cbb30160a13b70968438fc9171c1139e6b3bbf592ce2ade2e04eba202246e34144c9322b6077017b309dc46995998b8a1615777a7eeacab00aae1a210149c214d00df5856fce3020c73cb0f1b016a4885cdb494f3006db9117f76aade49d6388f7c49cb808a20d0baa930581f499e11ea6709a72337c10b06bcac2e7409062ce76c87e15b370b3ef3c3a0b9fd59f1d14a4e4589e86a60289ac8cadffd5447597b74ec99a5e5f58b9094ad5dfd2e8f7f77f8c78feb90196a7494a35fab8a87c6417055783b06dcb2e10595f8c968d4ab6a1429fcaa981bd2dbeec5e552fca9cfd39cd22f4d540721caae1d8cec0ed723ab3438aadfb61ce5019c010fc7c92d96e8eebc760907ffe09126ba98b0494c9cc57cfba4c03dfef6a4b6e564bf0682cef581773e5240305ee7dc40af516a41145f25d8d5cf29f8863e09f309f6fcfee5df3f9e9e524981fe61e95e3d6d0b0f09f5a3a732955e06510490c3a5e80d14c38e98c981e905e09b2180a4fb58a4900549289d8544ee73c055e336e76a939313ac40c8fc32acedfad2fdb9a0d79263eacc332e7c17a3b9d43bf08b4b47bc9d3ebc07f4cbd0df2a744c86c611e69380bc6ca13c60b11a8fca3ae279074b1c0f82c86ad1866768471603f67bd96732b3e5c653eac1277221a708ecc22ba19df95d42cab4824df66262f4144b95505afb0841958315419964ab6c68f0f98c50aee3d7bc3b7e8705e31f2eec850dc840a44702ab43747714d5b614b71ac0c6b0d79ac0c79ec87d11912717399f1dabb13bb06a5cebe429dd9c8cf00b4bcc14eee39b4b72c0bb38e8cb00779edcec5b748ddcb8d0583af793af31eb2d9aec6624b29bc426bab2454d676e959359dbc2fa46fa76498e5c4f14e30f9f0c22a720c6d9a551dd4a548db50626ca") r2 = fsopen(&(0x7f00000001c0)='bpf\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x1, 0x0) fchdir(r3) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r5, 0x4068aea3, &(0x7f0000000080)={0x79, 0x0, 0x169}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x80000) mmap$KVM_VCPU(&(0x7f0000005000/0x1000)=nil, 0x0, 0x2, 0x13, r6, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="04090380"], 0x6) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) 5.975614439s ago: executing program 2 (id=3142): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000380)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x50) add_key(0x0, 0x0, &(0x7f0000000080), 0x0, 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000009b80)=""/102392, 0x18ff8) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{}, &(0x7f00000000c0), &(0x7f0000000100)}, 0x20) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) syz_usb_connect$printer(0x4, 0x36, &(0x7f0000000540)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x40, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x7a, 0x30, 0x2, "", [{{0x9, 0x4, 0x0, 0x9, 0x2, 0x7, 0x1, 0x2, 0x82, "", {{{0x9, 0x5, 0x1, 0x2, 0x608, 0x0, 0x9}}, [{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x13, 0x4, 0x9}}]}}}]}}]}}, &(0x7f0000000e00)={0xa, &(0x7f0000000580)={0xa, 0x6, 0x110, 0x0, 0x1, 0x4, 0x20, 0x8}, 0x109, &(0x7f00000005c0)={0x5, 0xf, 0x109, 0x4, [@ptm_cap={0x3}, @generic={0xec, 0x10, 0x3, "6b7c761cdd6cadc781d439c5c937fdbc16fca98b66f1475d3c5380db7c8fceb68c7733af9422185d143ce7281547e2e10c510b201893ae299a1c1542737b9f2f2f50322cbcbcbff3e6be6ec3c38f14ad346b01a541539c1d6355f18fba6808200228c19741502fbc4e8d249a8d2524e99f8eaada02d18a859258cc037e8f48802e10da4932adfe3d8fa0464e7d734bccad0aff0cdb321e876244a4ca80cc55138f200d93b18842ffa51786dbe4e2b4ce5a5430f6d6a7fe61f5e206730243ffa282a254b6cfc72b8c78933d9cf533232cc6c27f0471295ae4be41f0c10628cb8d9246ad4b176ff0e7ab"}, @ss_cap={0xa, 0x10, 0x3, 0x27249db533e7e035, 0x8, 0x40, 0x3, 0xfffa}, @wireless={0xb, 0x10, 0x1, 0xc, 0x81, 0x12, 0xfc, 0x5, 0x6}]}, 0x9, [{0x4, &(0x7f0000000700)=@lang_id={0x4, 0x3, 0x400a}}, {0x4, &(0x7f0000000740)=@lang_id={0x4, 0x3, 0x441}}, {0x2, &(0x7f0000000900)=@string={0x2}}, {0xe9, &(0x7f0000000c00)=@string={0xe9, 0x3, "8547397370b642ca6463e506dd6b945fb42b7b3c897247baa68927a21a6ca630214c95bbf7666c9db3900221772c34f193f25ad49e76242402427863cff77ed1f9ad1f36fde21d07b5d42c5b856f9e2530f9bd72fa8536dd161e15ab09a872fdb9edf4f2a306343bb940dfa9e3c3e824790dc4de12489ef17f33d32382dcdbe99becef9937fbe29f0c778df0eaa0bbca794150b7a71c910f497fd77a9627fe6f669688392687548deecd7bb7629226bc7bdfbf34c4f67df8af7203b7e7817deb8ac5c30922c2c7a14288e82986fb26faee3a73461b51d37d02ebc8381d1197165a5e6fc9c4d67a"}}, {0x4, &(0x7f0000000940)=@lang_id={0x4, 0x3, 0x413}}, {0x22, &(0x7f00000009c0)=@string={0x22, 0x3, "2de8b27f86613999553af6b9e62b595295faf9aad9e23807af437b36896a06c2"}}, {0x4, &(0x7f0000000a00)=@lang_id={0x4, 0x3, 0x3001}}, {0xe2, &(0x7f0000000d00)=@string={0xe2, 0x3, "5427f42e3097f7b3a550b3676d0bfcdcdf35dd2ddd62926483cd5ee410cd56a253a9c4c04a7fd2074e0a473d5f57b44bf80dc5b4dbba71421dfbb1b5df6e4971c7e31ac45f280da42741f39c0a05d319cc6b0212662260f3494787d8d6a3349b727e502c9910ec9fa98aee203c8160481d6a010e858b7d4411fdb329910ae6bded1e4b12f9706092f14f3f0d870f77c1e5a472ba32449338336386ac762fbf5c2d13f2118e6fdf4158a7063aae181b3dc26660a05820183a19996e9fa47dca2ff9fe69f991bc159ad2209ba98f635b76ba07cb3987243249c848a3d27d618eba"}}, {0xb5, &(0x7f0000000a80)=@string={0xb5, 0x3, "fe7395fe96f65120440082aca197605b3a7ca5a5cd5c011a3f1da90975eccb70e3d08b5b13b8a3c9b7df285387665c38996bfd0af837161e2e2484ef414325b7dbe01896d94b9c14d0d9fe8cf6a48ca5bb9d1571ed4e56d8c8b81c489e920dee4f2b2884e85f149be64cb405269745409cb280ebe1e87dc4ad1f3fbffc8c4ea72119c760e6fa18daf81b61d0641243876eae62c4cd8c31999f5157c6ee64ae2dbb88606219b38856ec8f555b124e44d06b6ae6"}}]}) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x180, 0x4, 0x28}, 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x11, 0x8, &(0x7f0000000a40)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xcb13119f635c50e1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000400)={r3}, 0xc) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000340)={@private=0xa010102, @multicast2}, 0xc) r4 = dup(r1) write$UHID_INPUT(r4, &(0x7f0000001040)={0xfc, {"a2e3ad0e090d07f91b371a1887f70706d038e7ff7fc6e5539b0d3e0a8b089b3f32356c030890e0879b0a4cc6e70a9b334a959b669a240d0a0af3988f7ef319520100ffe8d178708c523c921b1b5b31070d07732f0acd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0xffffffffffffff34}}, 0x1006) 5.28214392s ago: executing program 0 (id=3144): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=@ipv6_newrule={0x2c, 0x20, 0x2d2c6d60ea1da725, 0x70bd29, 0x25dfdbfd, {0xa, 0x0, 0x0, 0xcd, 0xff, 0x0, 0x0, 0x1, 0x10002}, [@FIB_RULE_POLICY=@FRA_PRIORITY={0x8}, @FIB_RULE_POLICY=@FRA_PROTOCOL={0x5, 0x15, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4040090}, 0x40000) process_vm_readv(0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) r2 = socket$inet6(0xa, 0x2, 0x0) unshare(0x8000000) shmget$private(0x0, 0xfffffffffeffffff, 0x4800, &(0x7f0000ffc000/0x3000)=nil) bind$inet6(r2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = socket$kcm(0x29, 0x5, 0x0) r4 = syz_io_uring_setup(0x90c, &(0x7f0000000200)={0x0, 0x5885, 0x0, 0x0, 0xfd}, &(0x7f0000000740)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_SEND={0x1a, 0x40, 0x0, r3, 0x0, 0x0, 0x5c, 0x10}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x48, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x2}]}}}, {0x28, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_NAT_REG_PROTO_MIN={0x8, 0x5, 0x1, 0x0, 0x3}, @NFTA_NAT_TYPE={0x8}, @NFTA_NAT_FAMILY={0x8, 0x2, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x90}}, 0x0) io_uring_enter(r4, 0x3516, 0x0, 0x0, 0x0, 0x0) sendmsg$NFT_MSG_GETCHAIN(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x3c, 0x4, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x5}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x4}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffd}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4004000}, 0x8004) 4.893642737s ago: executing program 1 (id=3147): r0 = socket(0x2, 0x2, 0x1) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000380)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0xfffffffc, '\x00', r1, 0xffffffffffffffff, 0x3, 0x4}, 0x50) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r3, 0x0, &(0x7f00000002c0)) r4 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x151000, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x3, 0x4, &(0x7f0000000140)=ANY=[], &(0x7f0000000400)='syzkaller\x00', 0x1, 0x31, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x16, r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff7}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000010000800000000000000005f66385e628d6920085000000050000009500000000000000"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x0, 0xe, 0x0, &(0x7f0000000440)="9f70bada2adbf329566780dc3bff", 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e20, @initdev={0xac, 0x1e, 0xfc, 0x0}}, 0x10) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000040000000000000000000000850000002c000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000540000007300000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$AUDIT_SET(r0, &(0x7f0000000580)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000540)={&(0x7f0000000440)={0x3c, 0x3e9, 0x800, 0x70bd2d, 0x25dfdbfe, {0x33, 0x1, 0x2, r3, 0x6, 0x2, 0xa, 0x3, 0x0, 0x6, 0x2}, ["", "", "", ""]}, 0x3c}, 0x1, 0x0, 0x0, 0xc040}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002300)={r8, 0x18000000000002a0, 0x13, 0x0, &(0x7f0000000000)="b9ff03006037698cff9e14d186dd043aa4cd4e", 0x0, 0xa0, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x28}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @multicast2}, 0x10) sendto$inet(r2, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) recvfrom$inet(r2, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) shutdown(r2, 0x1) openat$ptp0(0xffffffffffffff9c, 0x0, 0x40001, 0x0) 4.683428039s ago: executing program 2 (id=3148): r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000100)=0xa0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000040)={@host}) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) preadv(r2, &(0x7f0000000080)=[{&(0x7f0000000140)=""/176, 0xb0}], 0x1, 0xa, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0xff}, 0x0) ioctl$SNDCTL_TMR_STOP(0xffffffffffffffff, 0x5403) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() getpid() sched_setscheduler(r3, 0x3, &(0x7f00000000c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000001a00)=[{{&(0x7f0000000280)=@abs={0x3063583d0f1cf8a4, 0x0, 0x4e23}, 0x6e, &(0x7f0000000380)=[{&(0x7f0000000300)="657aca23ce1fcc94241e808b230d0864e375472381626779ed932dc57d8b6ebb1a7a0cea8d02a0609e41982b32cbd2fdd8f884aa551257f97c2aa88b51b32a1870402fa057ad4c655f77a2869e6ef595f2b1e398ef612915e6e10957e2921282370a6affef", 0x65}], 0x1, &(0x7f0000000580)=[@cred={{0x1c, 0x1, 0x2, {r3}}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {r3}}}, @rights={{0x20, 0x1, 0x1, [r0, 0xffffffffffffffff, r5, r4]}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r5, r0, 0xffffffffffffffff, r4, 0xffffffffffffffff, 0xffffffffffffffff, r2, r5]}}], 0xb0, 0x40008d0}}, {{&(0x7f0000000640)=@file={0x1, './file1\x00'}, 0x6e, &(0x7f00000006c0), 0x0, &(0x7f0000000700), 0x0, 0x1}}, {{0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000740)="3f6b5106ba445319ef1939d63eed4ba761af9e7993ccb33392bc53429b96d6e2c0c02cfbca64a6b1663ef9a6d1fb1e8f95f8a1f2b95405094bbc577d6140441810797338029036af84e0c78efad3fd2cb67c6df3cea81cd6ca123c8ea746abff44bddae060004d172f397ae1646cd477f3231f7994190a6d47ea1cb84411e898b2298450080ed1bad092dfa3e970b5012efb097dc0381cc8c134fce359bd3be87e54f39cff8cee8b5a836fb7cb4bdf5a4c2409a9dd6e61fb9c39aa0170e717ed8b9a", 0xc2}, {&(0x7f0000000840)="b96ae1af8554863efeeb07a14cc8121e505dd79f2fadae7fa8f8cb4dd26469eeed5cd6d81dac7bb40b78f496e434c39364a7d9b266f22da4ecbe08fe982379403007adcb7777a85f1bf36eb8045e4c9c7ed8", 0x52}, {&(0x7f0000000980)="0b63659d785fabb3360ab9684e73c11b901ab651584fe9bd1646a84bcb9d0d19c12f4f399d95e25fbc0f390da1963fa98a25bd6e3ec128e7af780847a388e7a0893a1e7a95a850da53a2e0a8878e90601375edbbc11bd111fb86e31a59afbbcf087144322222d8531c882b02d48b990243754db1a66793af71c4efb0ea29abaad4e95475709c5790ce1cc55dabdd5e4fa100ad661ae88cb67f70819e22a81612ab424e6f1473ac769b29b25cdbf7e931af11b2155ef815f655e0a0f3143b5e3e8f6f4dc3123705b25d3f4aafcbb5db3d1da62e78b637b8ce66994862092ef052493174a2f4789573e26808eecb1eb413d40f6e0a744e43951adb", 0xfa}, {&(0x7f0000000a80)="92d1f73396004d36e5cd434caf39afacd13630cfc4dde505237953e68595daaf3ad3c8e1b0d210730c938c776f1f1d68e2e49a4e5edad1ce27f976", 0x3b}, {&(0x7f0000004200)="9eec06d96c4a80d785307e2c7aee6abd5c6092a12077c8286921f757ee54e76f94dc1a4ae3a2af0cc49e82dcfe0cc5eb8accbfedb475da6d63c1b81b7945d5dd300c2048f080a4b591cab6e106e8745526606e0a7339cfbc52a12719c5849cc5e13375ef9add494759655fa66797e070cfb552e291f40faf22e70897cbf03043bcc922e206e9f4229aae112299465eef71aee4ce3de178df03c541330e2f1e7766788dead82076636960358bac6b662636ed64b25f0a147c53fd419d9f1dbfd66aea67575e1545f786f700e8e23d6d9507c2eb18257e7195ec55d73296556bff96874c00e3df4e6dd6b152f6ddbdd573f2b08758804396bb4b0409f0c7500bd4c7f61b48d7c7f24a98daccc01def27a6724cb77e5115aa9ccaf3e9828bc78ae8959ada8dac84dc65a0c8cdab8ef90d4fbd089e35dbfe59016413873ff245b410b627dad9aee3c4130af8a418d7897fe37ec74bc9d2163d13f452f39e907ef0bbf8ae470e93ae574952fbf2016c6864454c70c4d50310cb0508743771a1ee7afbc97e7121ea033841d245bf5bb3541c3317486225267c36a6c80241c0935e360ed99b598fa22636ed50a01cd2012bf57b2244d6dd8cd8cedd7d52edeb0b1cec0548df04765da2588491c7a9b838c9cf1bb162d3990770c75a567e0df63ec3dd61a9422029a794cc35a8245a898fd5a01bcb4c62891e8a0dc7230d69215d7706387c21a0d9a1b1b739b0c39a7dd32f59f99fe5aa2e1ce736fcbfe61e62dbf98d08e2051eafb1e815f8d2b0c12ccf3a00399567d00a5c7162c16bc3422192148ee8fef8db66178bd1697470a614b76264d279980c74270dbe96e132f11aff4df41ecf84a1b81453edc244737f6d8cfb3b4c1b8b4f68855bd6c06b4953e15553d8f82167baa778b31c8fa38b50357d66d905c7896b2696c5709b038a6039a088314c3f379053a5ca32c8707fe447a907b35c6e48a5cdc871e2898f78b9e2569ef0d6af983371bad51f2742ddf85483eb8dbbba9bc1966a6c527b6b995e75a8680c8be5d444da82fb92620967a1a73d9cb34f0f8d105e0b1f74d0fae95769b9ae4c079358363baa95ed77285998168cc39d3d26e0d300e4b62e0b37f2603a9a9206c3e4073d094362debcf4bfcf009f498e94cace1d432d237d024daae257823b3a97c0e168b4eaabde3873bdb920df6788819886515ba9ad471c6d7e616d64c3362bc994e0e43b1a585670aef30e0a26f4666a8602f2cdbef0b8b62df60b3516e4d1e7f518fcec61c0768939f4e2da63a39600bf9d96a5d1b481a22bcb437a32778f2ca1631a095bd87b94a8a237c2206bb0148b01626ae2de261a641d75c69ac3ac0bb556397b20bb34848279264abae33d47736e368186db289c794e9a42fde6563a2cbcac99a3ae24c12bf412cac49c23d348f96a56b9a15b644a27340573ab8deb691db384410dc57017bb5995ae2a6f4b6936c21378726bc91545a33279c8e61c2a5730a33c3ac0d3e1aa990369aeb725b7a0457a0abd353b01b60ec47caa37d7ebf7c4d8fa592526a833712c225606e3236b873ff7730245dddf1797e59f05a23960f30d61e7f7e008fb349dbebdd61174c2fdcb7117173d8e10ce07972ed76b8936b4dbe3b7c3687759c545354f7939b800756d4e232b3acc5a87f7694ba28edc25b421763a28f1493f83a5df05f02839158b27c8f1baad86c2a185b63e3a35b54415b657a5229a9ad2a97002e6df375b1ddc9452e0267ed863cf7922b304a4021be6e99e157eb4edafcc011c03ade0a55252710a3fb2af2164959afc11db5b649c9f35888112da4992d13cb8d019d59136e62467ca9d3d2af911f78585d9077edbf09833a0b449c269c88fbf348381ddc1c19df5b8a559325653020ff5948c6a9123410c6dc69cdca8f3ab77ccb9c5e84903e44dca530e7e12ed1f7929e95f195e151c2d6e9b5bdef36bda3522c5e5753944aa3b6c1eea404295c7a381a1dd4f7e0660aa2e0bd70d8fb017962bf9a588cd64d859e5046d4acfdb0080cc105aa16dea204b8797e9f4ec3aee7feae428e037cf626892a8a653b7a446dc0bce85091d51a57f1e6169a194cdc8791da9c137a711d4a6105b5090a507bf54d3ced54f570a3d55c96a6073bb3e321db8b4c44298c0b89e1fb8aa7f302aff78ab304e43c05cad4a86d35a515927b506ac25675cc7068114af9c77f7be586bff65dccf2ccab206df9c4f1fb75044cbdbc3cc4d75b55d76735c3c2e975dacc675166eaf3d8a5b654b1a79d04e4420179e32c9dc86d5e8dde368d210c411ae675604b722e29bce44f2133a6bcad8a79b4ae8745395dc728e8e9838b0a08226e4a31b3ef03ca6dd81e4fc3fff95da45ff765ba6597e94f8111ddf690d8d1b532cc1cd03e49d4ca55e317e0cada1bcfbfe5786af33c628ace2934dcc74c80b841f8e848d1e89d44430496072b1a287546204b21d434807e8c3bc975cf07a6f9c64f6508832f8ec83f58b6978d3a956eb3d0fcd0c87d5c4c45961810337bbfab2a87ebf4790e9f6b937f3c61101e902d50a0469d46963cee7249f0434591df3dedef441e1daab727d5e2636493749a12e5a52df9c37ed085e04e7061a278286ca677fdf68ce685c9ffb8cf11029de635ec8c922f7140290fb66a4fdc99b35e4de1c297a8e2d78250a705ef6431ba3954e673870da4859c8bf350e8f516464dbcf2d2124f0f32e8674a62e43e2fb1a6811e619269d1cb2fe43d33a8a557156e8dc54f50ae811eba1d5057ee47b46b681c6cbf97b92eb2ea031f328848d8ac08edb752840e5c992db45d9512fa8ab6834e6b942546a0257cd7e809c684ab3f3384ff8e4a6906cc14e6793f1c86e697f2a873390f0f610ff5cc4dcdb90d7c2a285576c091f28aef4c0e50fe0f86bf723f5e9329263e828c8b95821ca9c6d64b88e48b215d3eedd87b5736642016dd5eeeabb57fb9d021982bd47246e8286d9dd5160832e20b4ec8ef746b4ce51668ee2c0b9e72034a4aa6629153d1b449b8f5a0862d674f9713ad45e3e45ec77581bf45c9ae5c94fe1ebf47fa71f1ffb6d3bd9fb004ecc154006130bce9fd15eae08b5a9a7abf0ed7166a88bfde7026b727958c72e86fd88d6dba60d638eedb35ba4b677007a87bee66ee6d37eb96d50f5405765e91dd0b19d7486fde4230663ef5763672a265e9d937ba5046ad47289e0492d8e1989d58145a7a8354f627cdc67df8e3837c5538bff0e01b95f85725bd6fc85d357480093d5935da5baf55be73e787e9e84aef2b953efd7a0a3795dac6c3402a81477b6208171fc0de9a2813d4d10ec0cf14d64321636e4707830fd9ff1e8448b4fb2a883d0fb0506b2d38ee7553030c88e6f503ba78ab15250a735d1882189956838a768c58ea0206108042c458592301267404962d508bc82dd4a20d0750ed23b8e26aa2a8d5e72ddce566933b7dc0756522d684c2d0f7210b5a6ec85308f8010268b58bcdac2488789d9139450ddb690f7a9f49dd86ba273088cb74f9088949429f416ec5f94f144ddafb16b98d5a6cc228eaaf9f73d4632f3b258c7543333944b4a4e90c2011aaa98175484fab13e7533b0739df7a6eb0889ecd24ebec86a8d2dcf3b9cebb0d7bede69eea18d7d4c9e50c4927f03338e99e27ae972fe075a13aceed883e5ca1c79f4a80658d568e96156cc2122d93f7a8d850accf140483b05d6f3f49ed7854c0369f96c087112cbbedfa29f94d057cae28d6365a9f8b68734988f79ea9b4a966231a0a0c8ac1772c7fb9b8f908d47f9412ba47291fd14dbe2283b2e26ea8a7c23c5dfb8f5bf5fc92a362c29c4ac4aa5964c51dd4210083c8a8473e154db255626de070c7b68f14868305b2f022304d785a2cd75a3ef59408d04f11a2f7237aae85f7fe4d243ed22795d79d601e1df3c1063d91cec4494d6f49837ceb10c020ce6045160607dfddade8539bbb4394efe01ad038aceddc2dfc472bb864e44040a7af63d47760435c9e515ebb6aa82be2f902b2f5f2ff9f267696e016107050118b1a0456a41d56631807249825428e935f0ec7d894f8563827237d711c8cb0e8edd0a6272ac7f7980005861f303a091e5d176c4cf688e446914be737732f27511bf3e75a2de28963a352751e268c13cee10c0de0dd5cb542bea7e1b1c018c9a309bc368f1827e0a0628465a51650b5a02ad2164d1a03a4aae7cd3bafc24cab2fd782533a60d72d997acdbc01b6b052e76fe5cb0902e04fe5a810f9820bda34365e089cf13fa351f6ca8cd4e54ef372eb98832805059e01628b1a008a3635f53bc0b66cc0cd4c94cea29210184fbc17f13c28cf1d791effd0e0169ddf6967782d588dac098daab9352d76d67595fbae7771207ad8cd8ff99c9f3da2bd8153f73020d3fdd9af7049fbe89f719fb58454c340c64f80dbf7408fb7ccac0da44554394cd0840028400c3d9b522aa75086eb71718caddb13174e907add094fddeb4774fc33b65665ce6dae3bad851f27b66800ef43a27e7a1e583aae72400d4c733deb6e2b9c636e23db5b682b69f3ef6400728b6a68f5932caba0fdc1b3bf929ea585d6ca78d6d42b206088e1e724fcd7b94958bdc8bdd9ec4fa0d2f3b55aab7b69c90a79efd783c4576c5561c9f29ad059c859185fc61110f100194e3fc743e79b4517f67eb750fb9aa405eddc9cc4fae04ea085c430f1ddd06d76f9c03565f2117a5f2c9996c408238653f5c98e0199b4f0778564f648834eb2057c88896cb9665cfd792ec7fd0c52213276cb02cb9f47b8466e65cc9df8bdb9457c1c6ca085b5132385dc4588bbd4ee680b686751492544442d1920edf46e0884b71a9f9ba0c79310d561254b6663ecf1c99863f809de3077bf29b945f4f4d4451bb3a58f87c7f32af39a468bd0716041c31a654fdb168cfa25f4215bb46c027ee5ac7680904cfe43319193cd9ac4bbb683d0e3f99bacf2ad33176f5fb871c1bc70196a541428d54d3017e690535ff2f35811dbe6bf3a4ad5085abd244917161437139a0b548353849f9767edf1c153948ee356180987c6272e4398bb05a67261419daed9702ac7d103c025182f674b2b32fb86f5c8d971501a259c7703edcba75d77c56845d002f9148694a99a7a094eea51c77cefa50ed0257e2465fe6edd3b32f0f148c0db186ea33f330922c7604b65845c18c876f13be2a35554888cb4f4f5eac1ded9668dc1f026a6dba7398b8f6b2ca09b4a1848b39bae2ea534f3031a948719c7ef4a0f046588d9299ff0dd73c6ab7939e44b18b96a74764dcc60293cfdd0ceba9404636d8e262c6167f1f754a98d0d0d7c01be7ae10ca4ab1c3b3f88bfd3bedf3100a92653997d3dbd66ad6f318f4110bc151818ffbe91f4e89e0e6543556e5f24aa9866617bb8d10f947f418e3b02fe0bd70ecdfd853a9499a2bf15484e85e4bd8f5e90900527b3eb663f6458668a7692b9838599b19a1167c04a4ee08da6f25f91e3eb4fe1b960de70432d614002a5b21e391b48da97b5aaaa93477ea1a5af1824bd055eecdf2ff0a274cb17dfc5fc390f8bae22e43100d9803e5a1b9afa5e2a42c61dd579675d881ee0aace83ec6b83c9ee0326f67f2a1a694f0817e48969f19715c1d253ab3af7563579d5a742b91fa7806d7a3226c1e749365980235bfefef76eae85b00d2212bad83495652207efd8588086bf1420cf7076ae7f4928add50f2293dc06480b1ef92d091123cbc8ad718858500cdf622291abc922e71ed8e8af401bb3363a627658dfc17fa8953965b194ce6a92d76d3d021354fdf4bba34", 0x1000}], 0x5, &(0x7f0000000b40)=[@cred={{0x1c}}], 0x20, 0x44004811}}, {{0x0, 0x0, &(0x7f0000000e40)=[{&(0x7f00000003c0)="22ac4b9af26ee5beb48e797e4c67303b658c6b9362700e08f6e580c507814bb61559290b327ab92e03371f07b3b53b64e2283ec324b96c2f289bba009a413a82959df61690f00674b4006b99999c481687ac6f01384380633acbd3b499947949bddec3c2465e0334141db0495bec7bfce1f67340b7e6d9a48b73d8abb5a5affe1db1fd462c61db2ce320abb8d0e1203c1803aebbb02ac85fdd129367f63000562749c110313f168ba80298406d2af95dda23e63394dc92f22f496f43f6f2466bce1fb0227b509751b5cf44c6f0098ce0916a50b79223ae6802b153d1246d31c543eced376b3c770f6722f853a8b7fb006e7b", 0xf2}, {&(0x7f0000000c80)="0c510c8680ede0597073602b553f9473e37d3a05dfd55523c36038760b0b9773e857efbe070ab835b05d75c2cd34d4bffaa868a30f8796420b2639bfefc84f0451b96e2c1fce2cefb7e71278e2539ae4074a21bcd21714ab4375b16caff8e899dbc05c6282f26ba4c1e8fa93840c339230fd63927ddce14d9c7a1b036d83a66673bfe08cab9389cb4af727e520bc2c7c", 0x90}, {&(0x7f0000000d40)="14f2657a514a95307d6648", 0xb}, {&(0x7f0000000d80)="bef9521ed35a2d3339bd978d2e40b529319f02007fb2dc899599585c08b1ffa82affe6a9d5b96b1aad43b32d44643119649a5d208b7c3bfe5d2d6061aa8d726e79d4121a50f6b583d91ef2ce26db8faaa93369d0a876fb3e2ac3f4b5d97cc2603d3243cac91fb936b413fbf8cf8814aa5938b5b3f6c1b17ba6c240760f7344168782331a0c2be978578f9b3b8d25b276b1716fb4540d1307da5551ee771e", 0x9e}], 0x4, &(0x7f0000001000)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r3, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r3, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000028000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32=r5, @ANYRES32, @ANYRES32, @ANYRES32=r4, @ANYBLOB="00000001000000020000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0xc8, 0x40000}}, {{&(0x7f0000001100)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000001280)=[{&(0x7f0000001180)="7dd45029d765cf3c7b5aa01815da77a5ef457611c9a8bba9eb90df956960139182ef593785e5de076ebc1e7b7bc3aacf83e0d0053115809e246490e2baa1975eb203560dc8965727afa48aab0c5320748071291d5d6b7d40fee4d6ac52b36a7d123dd6611fdb57089e16fa6404842235d8195d33b7060ee33d3732b29d59c3936c00d244c18bec6b35435de06b5a02efcd7e80066f682511085fc8f83d0303d128dc65f7555301d7f8c728f2144c88ff6ba2f150fc20fb5acb5a56392931aafa6f13f98618af204f791217465a8296b030ae7de369a445398a3f55e6cb97381508e9", 0xe2}], 0x1, &(0x7f0000001380)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x80}}, {{&(0x7f0000001400)=@abs={0x1, 0x0, 0x4e21}, 0x6e, &(0x7f0000001680)=[{&(0x7f0000001480)="5e2291ddcc00a23aa11eb236fce2794de6560d4497e2197e2c5c52a20c0c5a09b4fa15d1dae5d25b921d10e58aa99c9349a67ad3646812ca7a982ff2af4d6258f39b5a2978fb8274c32ccaafff399f5d36e0ec058302d472cf1ba4787dab2350b5251136b436d4c6b7a0db9c9e6538153dd84a2723b6a565851e", 0x7a}, {&(0x7f0000001500)="723675b84821107fd5bcc4f4e83232aed1c1db9ca7ee48a527b7382f6e4e06e9a85c05bf1d6d19ce07b3f8012385a802203d6114bd34031c746da485797643c6ab63694a5b203709c654e9d6ecb454850189c0ead3e3a4c3ac9179bf952ba6d627ad1e9ea5a7d4b0ccf9437009ca9a494a671df98c5fd2b90adde09cbea35accdf68ccac8a84188450f30c8e6042ad845b171a7fe244c7b5e65ed6f2a72d957334142beb4019a0b098b45d40b848bed84f693a750ffd", 0xb6}, {&(0x7f00000015c0)="65d9cbfa4221ede97295d14ca94cfc41ce0a20cd9a06ea7775556d3f2459951bedd271e327247a5a90d887688ae77596fc5a8b7f3bf4f190c369ab38bcc26662b4b7305be51527deba1fe0d5115f2f0d1a112787a68bd70afd", 0x59}, {&(0x7f0000001640)="75087c6c6851f597f7adbae1f96ed23ddf944064ca5c8c19a5b06600f122a398", 0x20}], 0x4, 0x0, 0x0, 0x40044}}, {{0x0, 0x0, &(0x7f0000001980)=[{&(0x7f00000016c0)="757c9e3478946a8d7e0a19f9c153f8333fb374734c590435ea04e3bd8020796bed97ca3f1d186f02dd1a7b36d6f6da377ef6b6f8db908f37934949da58b88ec94cc6ae9b369abedda0c064da52115a1335a1fae2da778718c9cb2753542111882a75de81fa5af0b3af19193a613de242e73f27cfb252ed9a4a3da279d34897b86298b8ffe4c83db30d4349ae6bbebc69a7af53f4c4b3e023a0f2d377fe1df05a38558ff1231a2406f3a8772f94ac22ca8e1529b7de2147004b9a7764c00996a739be46d5404070bfc47104c65ba875c842d794aa567956d83a62f0e0c64aee03fee12b7ec046f7e65a3e304ebf42629714d799773191225c8951a747", 0xfc}, {&(0x7f00000017c0)="e18f7adcd21ab1d774004cd7f941cb2fada2db01bdfd6f4adcc4f3c3621ad1d3cdf004a85da57e08d5f7c5a18bacc9c5a02325c7398e2401175fe3d998a3f0c5e2ea76f7d97e8493af74f55e060f5cd50336f04b28117a6069410a0bbffb8a1b20671f77e6962ffc89a18ab6fa37f8e5bd19a33574ada0301761ceb8bee236edae3c2ab031994d9c370167372ed9a5", 0x8f}, {&(0x7f0000001880)="423477a33f951c1cdaefd33383430c5db43db43771373c3abb71b6bcc5d3d6b80e48361fb98e591b1e94b748355dba7fec55e1ff9df9976a860f8662c5a9ef0c12894117612d593159435170a7a5b7974cf762455d63cd4d8fcf300420e00af1d1520fa6e4c1527733c698d9a7b8f9936f6218b22582b31ff3fcdf037735f29647aa38b830d9b62f202dac0ba1fb3dc8b302896489", 0x95}], 0x3, &(0x7f00000019c0)=[@cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff}}}], 0x20, 0x801}}], 0x7, 0x1) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) msgctl$MSG_INFO(0x0, 0xc, 0x0) syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x2) ioctl$DVB_DVR_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, 0x0) mmap$snddsp(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x8, 0x30, 0xffffffffffffffff, 0x6000) ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r1, 0x7a6, &(0x7f0000000000)={0x9, 0x8e, 0x2, 0x3, 0x0, 0x5}) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r1, 0x7ab, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20, 0xfeffffff, @loopback, 0x4}, 0x1c) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r6, &(0x7f00000002c0)=ANY=[], 0x138) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) 4.230246999s ago: executing program 0 (id=3149): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)='\x00', 0x1) r1 = accept(r0, 0x0, 0x0) rename(0x0, &(0x7f0000000140)='./file0/../file0/file0\x00') r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_sys\x00', 0x275a, 0x0) fcntl$lock(r2, 0x26, &(0x7f0000000080)={0x1, 0x0, 0x2007, 0x1fd}) fcntl$lock(r2, 0x7, &(0x7f0000000280)={0x1, 0x0, 0x2c, 0x9}) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x802, 0x0) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x15) write$uinput_user_dev(r3, &(0x7f0000001300)={'syz1\x00', {0x9, 0x7, 0x5, 0x5}, 0x3f, [0x9, 0x2, 0x18, 0x2, 0x2, 0x10000, 0x7ffffffe, 0x0, 0x8, 0x0, 0x9, 0x1, 0xfffffffe, 0x39, 0x747d5e13, 0x800, 0xfffffb9a, 0xfffffffe, 0x0, 0xfffffffb, 0x2004, 0x10003, 0x0, 0xf250, 0x80, 0x4800, 0x2ffffd, 0x7, 0xe, 0x4623f, 0x0, 0x10001, 0x5, 0x8000, 0x0, 0x3, 0xc, 0x3, 0xba55, 0x8da8, 0x2, 0x8, 0x2, 0x100004, 0xd, 0x4, 0x2, 0x6f, 0x8, 0x9, 0x0, 0x19a0, 0x6, 0x2, 0x9, 0xffffffff, 0x4, 0x6, 0x1000, 0x5, 0x3c, 0x8, 0xa, 0x5], [0x7, 0x1e, 0x400, 0x8000, 0xfffffffd, 0x3, 0x0, 0x25, 0x7, 0xfffffdfc, 0xc, 0x7fff, 0x72c, 0x1c32, 0xbd7f, 0x5, 0xfffd, 0x3, 0x7ffd, 0x3, 0x2, 0x297, 0x5, 0x0, 0x981, 0x4, 0x0, 0x3ff, 0x0, 0xfffffffe, 0x8, 0x1000001, 0x10, 0xfffffff9, 0xfffffffd, 0xa, 0x1, 0xffffffff, 0x6, 0x2000008, 0x800, 0xffff, 0x6, 0x96, 0xfffffff9, 0x2, 0x0, 0x2, 0x2000009, 0x4c, 0x3, 0x379, 0x9, 0xe, 0x5, 0x10007, 0x6, 0x2, 0x1, 0x1, 0x8, 0x7, 0x200], [0xfffffeef, 0x8000c584, 0xffff, 0x2, 0x7, 0x1f, 0x402, 0x4, 0x4008, 0xc, 0x7, 0x9, 0xe88, 0x5, 0x80000001, 0x8, 0x3f92, 0x1000, 0x0, 0x10, 0x7, 0xfffffff9, 0x2, 0x1000, 0x80040101, 0x5, 0x4, 0x5, 0xa, 0x2, 0x9, 0x80, 0x9, 0x8001, 0x0, 0x80000000, 0x3, 0x400004, 0x3, 0x6d7e, 0x3, 0x88, 0x5, 0xbf23, 0x5, 0xa, 0x956, 0x0, 0x3ff, 0xe, 0x6, 0x100fffd, 0x2005, 0x9, 0x4, 0xea, 0x1000009, 0x20000005, 0x3, 0xd9, 0x0, 0x7d, 0x401, 0x5], [0x108e, 0xfffd, 0x3, 0x3, 0x88, 0x2, 0x4000000, 0x3, 0x50, 0x4, 0x763, 0xb, 0x402, 0x2, 0x5, 0x1000, 0x7f, 0x5, 0x3fa6, 0x4, 0x0, 0x5, 0x3, 0x4, 0xe48, 0x7a, 0x3, 0x4, 0x203, 0x2851, 0x3b, 0xb, 0x5, 0x5, 0xa80a, 0x65f413f9, 0x4, 0x20008, 0x8a5, 0x86, 0x20044, 0x409, 0x6, 0x0, 0x4, 0xe, 0x4, 0xffffffff, 0x7fff, 0xffff8a33, 0xfffffff8, 0x401, 0x3, 0xe, 0x7, 0x4, 0xfffffffd, 0xa, 0xe, 0xff, 0xf, 0xf, 0x136, 0x6]}, 0x45c) ioctl$UI_DEV_CREATE(r3, 0x5501) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="040efc07140c"], 0xff) sendmsg$TEAM_CMD_PORT_LIST_GET(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000001700)={&(0x7f0000000100)=ANY=[], 0xfffffdcc}, 0x1, 0x0, 0x0, 0x4000}, 0x8004) r4 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) write$binfmt_register(r4, &(0x7f0000000080)={0x3a, 'syz0', 0x3a, 'M', 0x3a, 0x0, 0x3a, '{', 0x3a, '\x00'}, 0x22) recvmmsg$unix(r1, &(0x7f0000006580)=[{{0x0, 0xffffffffffffff96, &(0x7f00000003c0)=[{&(0x7f0000000140)=""/174, 0xae}, {&(0x7f0000000240)=""/230, 0xe6}, {&(0x7f0000000340)=""/65, 0x41}], 0x3}}], 0x1, 0x40000142, 0x0) 3.499900227s ago: executing program 2 (id=3151): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0x1, 0x4, 0x201, 0x0, 0x0, {0x7, 0x0, 0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x20024005}, 0x10) 3.412778287s ago: executing program 2 (id=3152): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000040)=0x90000) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, 0x0, 0x20050800) memfd_create(0x0, 0x0) r3 = socket$xdp(0x2c, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000001800090000000000000000001c140000fe0000010000000014001200"], 0x30}}, 0x0) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/59, 0x304000, 0x0, 0x0, 0x3}, 0x20) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000080)) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000240)={@hyper}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r1, 0x7a8, &(0x7f0000000300)={{@hyper, 0x800000}, @my=0x1, 0x0, 0x0, 0x2, 0xfffffffffffffffe}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r1, 0x7a8, &(0x7f00000000c0)={{@host, 0xffffffff}, @any, 0x3, 0xa, 0x1, 0x4, 0x0, 0x9}) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet6(0xa, 0x1, 0x10001) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0) syz_open_dev$vivid(&(0x7f0000000100), 0x0, 0x2) setsockopt$inet6_mreq(r5, 0x29, 0x1b, &(0x7f0000000000)={@remote}, 0x14) close(0x4) socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000008280), r6) sendmsg$DEVLINK_CMD_SB_POOL_GET(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000008480)={&(0x7f00000082c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01002bbd7000fddbdf050f0000000e0001006e657464657673696d000000006e657464657673698d00000008000b0001800000a50011008d5d0000"], 0x44}, 0x1, 0x0, 0x0, 0x24000084}, 0x20400d0) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000380)='\x00', 0x89901) fchdir(r8) r9 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='\x00', 0x89901) r10 = open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x81100) move_mount(r10, 0x0, r9, 0x0, 0x46) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) 3.270961774s ago: executing program 2 (id=3153): syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) truncate(0x0, 0x2) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) lseek(r0, 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000003c0)=ANY=[], 0x48) prlimit64(0x0, 0xc, &(0x7f0000000180)={0x6, 0x1}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = getpid() getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102399, 0x18fff) setpgid(r1, 0x0) prlimit64(0x0, 0xa, 0x0, 0x0) r3 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000001018610f4205ae06d6c011703010902240001010000000904690202ff5aa30009050402100000fa000905820240"], 0x0) syz_usb_control_io$printer(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$rtl8150(r3, 0x0, &(0x7f0000000680)={0x2c, &(0x7f0000000580)=ANY=[@ANYBLOB="40010a00000003"], 0x0, 0x0, 0x0, 0x0}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(0xffffffffffffffff, 0x40505412, &(0x7f00000000c0)={0x4, 0x9dc8, 0x0, 0x0, 0xd}) writev(r0, &(0x7f0000000480)=[{&(0x7f0000000240)="ad91e17a535ff70a7a2f790bc0d1580a4ea68c488fa6b2157d817597f30eeb4e4d33f42bbf5f3b47bbf0950999669f981a6d4af0da96034534fcd02ae353d9c36b03cffa78f11a35f1513f7eeff4a631d6ed8f44b20fe5a04b87504fbabb92b797a251a02b99", 0x66}, {&(0x7f0000000380)}], 0x2) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYRES32=r2], 0x14}, 0x1, 0x0, 0x0, 0x4080}, 0x4000) recvmsg(r0, &(0x7f0000000340)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x80, &(0x7f00000007c0)=[{&(0x7f0000000080)=""/18, 0x12}, {&(0x7f0000000540)=""/182, 0xb6}, {&(0x7f0000000380)=""/245, 0xf5}, {&(0x7f0000000700)=""/135, 0x87}], 0x4, &(0x7f0000000840)=""/147, 0x93}, 0x40012101) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ff9000/0x4000)=nil, 0x4000, &(0x7f0000000000)) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0) 3.195068012s ago: executing program 0 (id=3155): socket$nl_xfrm(0x10, 0x3, 0x6) prctl$PR_SCHED_CORE(0x4d, 0x1, 0x0, 0x0, 0x0) close(0x4) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000005500)={0x18, 0x43, 0x107, 0xfffffffe, 0x25dfdbfc, {0x1, 0x7c}, [@nested={0x4, 0x145}]}, 0x18}, 0x1, 0x0, 0x0, 0xc004}, 0xc000) openat$binderfs(0xffffffffffffff9c, 0x0, 0x800, 0x0) syz_io_uring_setup(0x110, 0x0, &(0x7f00000000c0)=0x0, &(0x7f0000000480)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, 0x0, 0x0, 0x4) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x6101}) r3 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000001a40)=""/102392, 0x18ff8) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x23, &(0x7f0000000180)={&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000100)=""/24, 0x18, 0x1, &(0x7f00000005c0)=""/4096, 0x1000}, &(0x7f0000000200)=0x40) r6 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/compact_memory\x00', 0x1, 0x0) sendfile(r6, r5, &(0x7f00000000c0)=0x58, 0x5) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') landlock_create_ruleset(&(0x7f0000000000)={0x4810, 0x1, 0x1}, 0x18, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x61d0, 0x0) 3.038264322s ago: executing program 1 (id=3156): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(0x0, r0) sendmsg$IEEE802154_LLSEC_ADD_KEY(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0706000000000000000027000000050031000400000008000200", @ANYRES32=r0], 0x24}, 0x1, 0x0, 0x0, 0x20004080}, 0x24060884) 2.910708482s ago: executing program 1 (id=3157): ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x0, 0x100000000, 0x0, 0x81, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x0, 0x2, 0xffffffffffffffff], 0x0, 0x200}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1a00000007"], 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket(0x10, 0x80002, 0x0) getsockopt$sock_buf(r1, 0x1, 0x37, 0x0, &(0x7f0000000280)) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) writev(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) sendmsg$NFT_MSG_GETOBJ(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x38, 0x13, 0xa, 0x401, 0x0, 0x0, {0x5, 0x0, 0xa}, [@NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000001}, 0x44000) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) 2.550254504s ago: executing program 1 (id=3159): r0 = socket$inet(0xa, 0x801, 0x84) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[], 0xb8}}, 0x20004000) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0xb8}, 0x1, 0x0, 0x0, 0x80c0}, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYRESHEX=r1, @ANYRES8=r1, @ANYBLOB="66393737fdde493c8322bc255f2ef0fe2e04147675d033a16b1f01299bc5dcaa2d4c83fe6b1894c9808d79279c542fa81566474c2865aafea1d8f244e43e3638e0e322a1c6d826620e751406069431485d82e1ac5c219cf1f5af7107a478603f5fdc8064cbce7fe6d4f669b8dc90d469ab388e57270863d750f24c55a58bbc532b3672b3762391fa43a2ef0bf2f83f655ef55ea4b677bdb98c1bb20fe8fe74f6701ab5e44ee82e50550a1cf4d8104f9c343c733ac349f4732a98d7d6a16b32a9aae4417af806b8b85a9633da3fbd9d3c6949d9737b3d7d930e780fc09c234443926628a4cd3f443fc34f5d274dc3cfc921bf14", @ANYRES8=r0], 0xb8}, 0x1, 0x0, 0x0, 0x800}, 0x4000) r3 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r4 = socket(0x10, 0x803, 0x0) getsockname$packet(r4, 0x0, 0xffffffffffffffff) pwrite64(0xffffffffffffffff, &(0x7f0000000000)=':', 0x1, 0x1) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r5, &(0x7f0000000000), 0xd) connect$bt_rfcomm(r3, &(0x7f00000001c0)={0x1f, @any, 0x6}, 0xa) close(r3) setsockopt$bt_BT_CHANNEL_POLICY(r5, 0x112, 0xa, &(0x7f00000000c0)=0x80000001, 0x4) r6 = fsopen(&(0x7f0000000080)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreq(r7, 0x0, 0x15, &(0x7f0000002440)={@dev={0xac, 0x14, 0x14, 0xa}, @local}, 0x8) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) r8 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r8, 0xa) 2.016890732s ago: executing program 1 (id=3160): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x3ff}, 0x8) (async) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) r2 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) r3 = dup2(r2, r2) sendmsg$NL80211_CMD_UPDATE_FT_IES(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="58b0"], 0x58}, 0x1, 0x0, 0x0, 0x4000000}, 0x4) (async) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r3, 0xc058534b, &(0x7f0000000280)={0x8139, 0x1, 0x86, 0x6fb83790, 0x800, 0x3}) (async) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000180)={{{@in=@rand_addr=0x64010102, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x4e20, 0x0, 0x4e22, 0xc, 0x2, 0x0, 0x0, 0x89, 0x0, 0xee01}, {0x2e6, 0xfffffffffffffffe, 0xfffffffffffffffe, 0x0, 0x4, 0x2, 0x101, 0x1}, {0x1, 0x0, 0xf, 0x1ffffffffe}, 0x20, 0x0, 0x1, 0x0, 0x2}, {{@in=@loopback, 0x0, 0x33}, 0x0, @in=@broadcast, 0x0, 0x3, 0x0, 0x0, 0xff7ffc01, 0xfd3, 0x86}}, 0xe8) (async) listen(r1, 0x0) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'geneve1\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0x401, 0xfffffffc, 0x80, {0x0, 0x0, 0x0, 0x0, 0x17b93}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r5}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x44}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$devlink(&(0x7f0000000600), 0xffffffffffffffff) syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @broadcast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @empty, @empty}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0) 1.555539489s ago: executing program 1 (id=3162): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)={0x64, 0x2, 0x6, 0x1, 0x6000000, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty=0x80ffffff}}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x64}}, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000040)=0x14) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[], 0x0) socket(0x5, 0xb, 0x9) 1.499124995s ago: executing program 3 (id=3118): r0 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000b80)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="200010000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/comedi4\x00', 0x101000, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f00000008c0)=0x1e, 0x4) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) syz_usb_connect(0x0, 0x6b, &(0x7f0000000100)=ANY=[@ANYRES8=r2], &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x7, [{0x7d, &(0x7f0000000940)=@string={0x7d, 0x3, "f7e2c12de3cc1594dc73d8662f49a845517e56e697c226ef6b8d379bd972a37dd05dbe5a37374f7360405fdf46a25831335a61c5e29b82a7081b5930ef199c7d56d311b201e4cdd655313d4a2a6ac34f11705cb97c3e71e4d9e924238dd0102052ee470adc0bc189e789a4e4fa9a4ce9d15da57eaab14253558d72"}}, {0x0, 0x0}, {0x9b, &(0x7f0000000c00)=ANY=[@ANYBLOB="6540fa935f365a9c1cade70b2da75fb0f08fa804479885ad3499f9872d68a7ffee798a96c8d098bbc8ba3967a5e230cb8dd3b63efdee981f55426bcabc6d416c82575c69e283540782043326cb1b56a5812ee82e798676e29ced376a34801c8d70fe03510a14d877b937ae8423743c047cd3226f8c0455489e1cdcca9eb234580ba3963830912f33b5acea489125749c3dd7fde37c9ec94e84f1d8ebd1423df80b45705968a2784fdfd66ea27a12037cb79e96500780729d82504993a10dc3b81e0cd62f9293", @ANYRES32=r0, @ANYRESOCT=r1, @ANYBLOB="7d6360335993a708f4b0cc6bb74f05a3a6cd1d376def4f564ea47807ae7cc36e5c3c365b940418427733f0330fe16f2a0d502a1126a227847ddea6b6928aa788d9eb0c74d982145a5020a801beda030067c8c949345b065558c24beacfd10f1a9d2181d5ae61cd5c5fb0ec8c8b0ed42049b525e8efc761c2a9038649209a3a10546a47df41d4630dbf66fbc23e6d60", @ANYRES16=r0, @ANYRES64=r0, @ANYRESHEX=r2]}, {0x0, 0x0}, {0x4a, &(0x7f00000005c0)=@string={0x4a, 0x3, "7dc9aea16df8cfe19083242e6492d081111b6ce1dd39b1b38889458f2cee9579a9a07df29cd836a490edc7a0e187fe42af254b1fe19c309a203ea0945fad03636cda51dbb5634377"}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0xc01}}, {0xe5, &(0x7f0000000640)=@string={0xe5, 0x3, "5c8bae4d4da330c0871d4a70dc1b12023b63a74e1a7cbe69b351f44f3d252dd5ccee89e7a5b22373b87ef966756a49edd098a7aa8531968d1c62f893818f633407170fe9203fe79538f2f689a4e1a72735adbb36f2c3c1593e8f8bccc4e51990894c195092b754012966b0052f142b5e3a3f136c53ce65350870bf86073805c43235d41131fcb16f4d3f78d61545887e98ecde57a9f40486cca7e4360d69c6e1ab49bf8acf0e7d757500e6fd846f75cf7903b8c4d1cbc1ae914e56c4cb9979cb55937d95df1d421920c452cd40fa796e376d623341bf692f00"/227}}]}) setsockopt(r2, 0x84, 0x7f, &(0x7f0000000040)="020000000980ffff", 0x8) syz_usb_control_io(r0, &(0x7f0000000300)={0x2c, &(0x7f0000000200)={0x0, 0x21, 0xe4, {0xe4, 0x2, "e307e31fdcd30669f9124f3c65bbeefe9fd33330c203e1843f27c8cb152e130f4179fb9a30c172fc9b72b9c44e0c9d2d3372db0987d2de631a211e265bb8a29ef79eded290dea70840768d7ed0bad34bc7fe867e0a69a98a2fb9c5abbd2167facd386288ea4d006b3392ca7ed6857ffb73e318307e93686483074c0bc98b2bdd7571d8e1a67726daf41fd6a7b3c364d69cba789919b8593ba3795b4afbd955e6e0d149e600b4f905a8b03b5bd09a622f4029f84920f37849e1ea850197d49238ccdeca04475efb4c53c4f40b16def4397a676267ad07b46cd7260404f29f546152c3"}}, &(0x7f0000000000)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x402}}, &(0x7f0000000080)={0x0, 0xf, 0x33, {0x5, 0xf, 0x33, 0x3, [@ext_cap={0x7, 0x10, 0x2, 0x12, 0x7, 0x6, 0x8}, @ptm_cap={0x3}, @ssp_cap={0x24, 0x10, 0xa, 0xff, 0x6, 0x0, 0xf0f, 0xfff5, [0x3fff, 0xc0, 0xc000, 0xc0, 0x60, 0xa8f021e286e5a4be]}]}}, &(0x7f0000000100)={0x20, 0x29, 0xf, {0xf, 0x29, 0x80, 0x1, 0x2, 0x5, "aac45538", "c5fcd504"}}, &(0x7f0000000140)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x5, 0x2, 0x8, 0x7f, 0x4, 0x8001, 0x6}}}, &(0x7f0000000800)={0x84, &(0x7f00000003c0)={0x0, 0x14, 0xa6, "d297dc6ae647d8eda87dba7caa1a17670aeddaac8aa8a228fdec7ab55fd89641b30cc2a83a952fd695321ef9435e18b70c115d227003f048db8f5dbd46f4940fecca551bdf88ebcbe239a952ae3175c5d1b2c27281404c8bb691367063ba2e7d6b7d647f547add6ba21b6df52c7e89438e5bee8f0c3975948658b0aaac677560d32eef6c77db20c435b85425a634dfeeb424f6848b54d7ced5590718d9b98c57bebdd2141750"}, &(0x7f0000000340)={0x0, 0xa, 0x1}, &(0x7f0000000480)={0x0, 0x8, 0x1, 0x7}, &(0x7f00000004c0)={0x20, 0x0, 0x4}, &(0x7f0000000500)={0x20, 0x0, 0x8, {0x200, 0x20, [0xf000]}}, &(0x7f0000000540)={0x40, 0x7, 0x2, 0x7}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0xf2}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "67f5"}, &(0x7f0000000600)={0x40, 0xf, 0x2}, &(0x7f0000000640)={0x40, 0x13, 0x6}, &(0x7f0000000680)={0x40, 0x17, 0x6, @local}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "659e"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x7}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x1}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x8}}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0xb, 0x3}) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r5 = dup3(r4, r3, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) socket$l2tp6(0xa, 0x2, 0x73) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) memfd_secret(0x0) r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000680)='/sys/power/disk', 0x2, 0x0) io_setup(0x20, &(0x7f0000001140)=0x0) io_submit(r8, 0x1, &(0x7f00000001c0)=[&(0x7f00000002c0)={0xf, 0x400000000000, 0x0, 0x1, 0x0, r7, &(0x7f00000000c0)="fc", 0x1}]) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000240)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@handle={0x73682a85, 0x1800}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) ioctl$COMEDI_CMD(r1, 0x80506409, &(0x7f0000000180)={0x0, 0x1, 0x2, 0x6dd, 0x40, 0x200, 0x10, 0x3, 0x20, 0xffffffff, 0x20, 0x7, &(0x7f00000000c0)=[0x4], 0x1, 0x0}) 1.487245996s ago: executing program 0 (id=3163): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x3) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa0086dd6000000000140600fe8000000000000000000000000000bbfe8000000000000000000000000000aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="0100000000000000"], 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd60f9682b00140600fe8000000000000000000000000000aafe8000000000000000000000000000aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5002a6d06fe13485d3d4000090780000"], 0x0) listen(r1, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r3, 0xa7ba) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) getsockopt$IP6T_SO_GET_INFO(r3, 0x29, 0x40, &(0x7f0000000000)={'security\x00', 0x0, [0xc77, 0x337d, 0xe, 0x1, 0xfffffffd]}, &(0x7f0000000080)=0x54) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r5, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) bind$inet6(r7, 0x0, 0x0) sendto$inet6(r7, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0xa, 0x4e22, 0xa9a3, @remote, 0x100}, 0x1c) listen(r6, 0x0) shutdown(r5, 0x1) r8 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r8, &(0x7f00000000c0)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a0677bc45ff810500000000000058000b480400945f64009400050028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010002081000418e00000004fcff", 0x58}], 0x1) 1.406995862s ago: executing program 0 (id=3164): socket$inet_smc(0x2b, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x38, 0x2000c850) socket$inet_udp(0x2, 0x2, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x3, 0x8, 0x3, 0x0, 0x100000009, 0x0, 0xfffff60000000001, 0xc, 0x1000}, 0x0) r1 = fsopen(&(0x7f0000000040)='cgroup\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x10) socket$alg(0x26, 0x5, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000240)=[{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000000c0)="5bdbd57a0e656889964df9937f561de9b944d1e381fed329742e239cb13cf2af711d48d2f15b3118abd8fd087f117830209a631f9dfbec5cbbbb2216a2d87dfb0d7dd906125a10053c8e288ac4445ff0e999d423cc250e", 0x57}], 0x1, 0x0, 0x0, 0x240001d1}], 0x1, 0x8044) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='status\x00') socket$rxrpc(0x21, 0x2, 0xa) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000100)) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r4 = dup3(r3, r2, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000044c0)=ANY=[@ANYBLOB="4c0000001f0001009e0e0000fedbdf25e0000002000000000000000000000000000004d50a0033011302000000000000000000000000000008000000000000000c0015005c07350005000000"], 0x4c}}, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x22, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x10, 0x0, &(0x7f0000000fc0)=[@clear_death], 0x0, 0x0, 0x0}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) read$FUSE(r4, &(0x7f0000001000)={0x2020}, 0x2020) 1.361702309s ago: executing program 4 (id=3165): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0xc00) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000140)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x3}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_MSG_GETSETELEM(r0, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000200)={&(0x7f00000003c0)={0x50, 0xd, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x8}, [@NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x20, 0x3, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x8}]}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x44034}, 0x40c1) sendmsg$NFT_MSG_GETSET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000c80)=ANY=[@ANYBLOB="2c0000000a0a050000000000000000000a0000090900010073797a3100000000090002b073797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x24048014}, 0x4000) 1.301581724s ago: executing program 4 (id=3166): r0 = socket(0x2, 0x80805, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@deltfilter={0x2c, 0x2d, 0x8, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xf, 0xfff2}, {0xe, 0x10}, {0x0, 0x4}}, [@TCA_RATE={0x6, 0x5, {0x7f, 0x1}}]}, 0x2c}}, 0x10) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000100)=ANY=[@ANYBLOB="60b80000", @ANYRES16, @ANYBLOB="050427bd7000fedbdf250100000008000100", @ANYRES32, @ANYBLOB="4400028040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005"], 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x4040084) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000180)=0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000840)={{{@in=@initdev, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@empty}}, &(0x7f0000000200)=0xe8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0xffffffffffffffff, r6) sendmmsg$unix(r4, &(0x7f0000006ec0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0, r6}}}], 0x20}}], 0x1, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000940)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) r8 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(r9, r9, r9) ioctl$SIOCAX25DELUID(0xffffffffffffffff, 0x89e2, &(0x7f0000000600)={0x3, @default, r9}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000002980)={{0x1, 0x1, 0x18, r0, {0x0, 0xee01}}, './file0\x00'}) r11 = accept$inet(r0, &(0x7f00000029c0)={0x2, 0x0, @dev}, &(0x7f0000002a00)=0x10) sendmmsg$unix(r1, &(0x7f0000002e80)=[{{&(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f00000007c0)=[{&(0x7f0000000400)="5e394e75c4062c6f7e52e5176d5878d4195922136e5db989568f4821ecaf5dfcb20d5d1e6e52e40cf302cd4c48720b6ae76c5fc3b48d309eb585ff37b33f260cc3b1fd61250ea02f49e9c1eec7f0d0b7cf4977589fec1a555a19081d53604788042c4576fb58446dc3776935868325f6c1b7a6bce30463af8000d0e1a37f6ee56ed2792efc87c8c38426aad03ba5469f1df2ca0ef4a59da1b3d7979a0eda3a9548804af64b794700a7ea7800b3b5ca5d9c5ae90bc1bda8791067b6408d03d1a8bf44b589bfee1fd0db", 0xc9}, {&(0x7f0000000500)="4139211853df2735d4c924ba0d353bf784692b1b9dcebd1ab2811d4ebb4aa73b8225a9899b1b7fe37c920becf5bbe8edb50ce6c71acd8d65f4589663ba4058b3e179dfcfae8e0bcce4402eea8d64e1f7b2bae6a28d2fb07b85592406310a23252f2f804df84c66df7e787ba7109ce721717275f1e1a39cfbfd3d1393d3a98d39cddef3d429d2a6718eb6c3bdbb1b4bc28e82a9f959feadcacfd5b19d23389740371312a632d5571a8c7fbaf661", 0xad}, {&(0x7f00000005c0)="e9bdff46089d59b9ac5563453458ba30a500cd3b31e48600e58aea644e5d5cf43118cffdeb0cb6e3573864c4e593428618b986d0c408baf969753d54ff401af7ef26d6d8d9fe3526fca52e07d02b8fb1ab078f8b299beb970955a47a8604d08673f5fcf0961c384122f8a7aaf9fe5d98d21836f8082bf0b83fd7a945e49ded465e7e53adfe79359cce8ff8fad6335d259dd069f6572222cd77821b49a55a46d0b5e583be33bc1c60f230c82b174413a510ff91a0a225aa2ce9673d68d6a782840b5b60175213f3e9d15095045f9864eb861311e197", 0xd5}, {&(0x7f0000000040)="10b9e5bf2a24a03a20d6a7510e78476b77bb254110a133b91b0757c3527b111b27885f072d6c5a84ef940fc4b38ff4c66c718badf82ea84748", 0x39}, {&(0x7f00000006c0)="b268610d46dcf319ca34906e6fcc0c91ed2e46ac0f86b9344d104b24e502d09f47636455d0718ebedeeeb096e660418afd0a7fb651aee201cb6975a17a141c98907fba192b6054ae08a00c323019edfd5da3cae81ed11929a130d40b2bba9519e2612a2ce7c09a5b8290986c730cad7e7853223b3286d7502f5c9da1fb29dcf007e785f659760908618c73eb296f78293a0dabe2bb9753f7754e078709d7fdd79e5bf2f12a17ead560523b970f3c1b2e6e60405cae07b5f9b37ee304aab5e4fb33d2f6707cdc3c8bc047851af86cda2baf25a82492a61da00083d782b400a556e01a452caca6a5", 0xe7}], 0x5, &(0x7f0000002a40)=[@cred={{0x1c, 0x1, 0x2, {r2, r3, r6}}}, @cred={{0x1c, 0x1, 0x2, {r7, r9, r10}}}, @rights={{0x1c, 0x1, 0x1, [r1, r11, r1]}}], 0x60, 0x4008000}}, {{&(0x7f0000002ac0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000002e40)=[{&(0x7f0000002b40)="49ce08c6d22ccc14f09c8290588c8da45c27177228367e574f669dd94713df833419eb4ceeade0af54a49225df809c89c04c18c4f659f7dfb76db426799262824579fef9f67d8808c0f55f797156a86d136f9a58d4d1b208c6bd6f693705e439695c7a7f661777e0fef09c11ee25f43652339539999b3eb5f219e6ed10465a1cede1346086f78d77610ef0b4628640c77eefd9ca68655185a3c9dec75cf161e672f66c954329d364eeb11e5c018c31a19bcf411e83b481d71939a35b4c9abea00193baa4f005ffd7908c09e38d1ba5179fca1b720f7a3f", 0xd7}, {&(0x7f0000002c40)="5817804eb7648bb7a2cbda963889fa4f374d96f02146eab3acfdf5434b14c7c6bf0f43a51479120b7660c084eaa4da551e6d162c7f002973b3730808efe3a6a2af20f9dcb7d02aa96d01b3a55e8c18d41eabb6d8bd6197bf3e9e7b5f2f79e6afd3df1c0a9f72b04abdf96e23544e7961775e9c90fbf14669511a92c4ddec80bfa21fc7e2982bd34503aaa76d573080e85031429dcbeb190e66146a48e5d9e5bd79c1caad3793b6ff5c69f969e3f8b1ad5db0ae22a531c9ccc9bedd478bf1677798dc87e9137d52ca0c7bf4fcd7711108cca2bca19c8e23f00b388a2e91993045be130fb9c4b78452a5b55b9451", 0xed}, {&(0x7f0000002d40)="4d729e74921c3cabd9048617b0f89bfd98c88f9e916fc4fdbf341a8b71785336a055be32e030dda3acefd25c8c40ba925562cdc5b8bc091c14880ea1e8053d8785eded10491ec08bb39ce8cbb5f75e8f195c2b722228be8edc3c1fbafce4cead52c9229a116eadf9", 0x68}, {&(0x7f0000002dc0)="d370ec8d1f339adf184e6f58bd146edce44a1b8d0fde5c36573c2a8fc3d441f2d761a1a367064286896845bf4f3023475ed9cd880350faab5586f553eab72be126c4a7961ec198442221ff04045b55c24bf83a7d77e358416736f7dfcec452c2f1499b6565d4d64311a4ebaac7c6c03b654f4be6", 0x74}], 0x4, 0x0, 0x0, 0x400c085}}], 0x2, 0x20000800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x20004055) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/consoles\x00', 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmmsg(0xffffffffffffffff, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x4, 0xc0000000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x3, 0x8}, {0xa, 0xe}, {0x0, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_MEMORY_LIMIT={0x8, 0x8, 0x10}, @TCA_FQ_PIE_TARGET={0x8, 0x3, 0x4}]}}]}, 0x44}}, 0x20004015) getpid() sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r12 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r12, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.22343578s ago: executing program 4 (id=3167): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_ifreq(r0, 0x8910, &(0x7f0000000000)={'veth0_vlan\x00', @ifru_ivalue=0x4}) ioctl$sock_netdev_private(r0, 0x89f4, &(0x7f0000000000)) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x3, 0x0}}]}, &(0x7f0000000180)=0x10) pwritev2(r0, &(0x7f0000000100)=[{&(0x7f0000000080)="da43dd7ea956286e10e82dbdcdfc4f2330edef1ea508099dfc8c4ec2c4ec6fecb06dea6ee09ac247521e7f7dab2e557b08353144e92bd4df291fb324461185af0b14478d6bea730da41b56d1032bba08a38be9549416df6d66d69d7dde30ca3b", 0x60}, {&(0x7f00000001c0)="f41985810a1c2e578f10dc3c068f82e2eeff82931820e8a1725362d7f4b5a769c3df4d715c5f01015a7ad8647df2c60c685bb78ac48b0b4c4be9cb47a2d856041b0148b886299abc61421c238aec2526cf8d1a837fe3c7e9cf1f8b688ad56d9db78bb729d41a658daffa84075c835649619a0541158b84b84d91be9e5bb07ec4837753294bf4d67bfbe9e1de4994c25ffbc4c3b90a3d2c2b81cf957b20b26fcfe4248c030943eac6b5741c62d16a8b0c7c4e6bb71bc06ca79acda19ea873ec2174d90786b4b9d2834aeb6a2e8dd873912d5719cb76a60ec1dbc08f9c6f35cf", 0xdf}, {&(0x7f00000002c0)="f117ab9aa331ecc97180d111a9d1a878b47b43b1eb6ae27fc04cd7ad1c4a68803c4d432aed1c12c5a1a422eb584621addd7c3cd084f43ab2c396e101a7fdb33c800c033ab0bd0ecc60bc2776e1b45ae53698467b0a958001d34042f4d1160ea01c8ebb4a3206df4a4b32766e76dc18d31003079000bd0f6452ce1ff9655542cbf6b9a1b9f5afa6ffaf08c0", 0x8b}, {&(0x7f0000000540)="1412b5128161fa91445c660bb82e39bce9c2fc3ed1e586ab2d52554e9165daba54e28cc104e7eeb6cac6b11ee0082082de601e79682483b779e0bcdff09123a503e202c98ab644d963b2b3254861f0f17abe18fe0b3514474a9cdba037b8b5dc197466abd12a82c90843963d166e73506b02822d4fce2b794fbc7f9d3ff02f33d2718209e34aa5b004cd6cd15a14ee287bfea0228c2cdfa838dfcfe37cc59c3bf0708ada4acf78b0e1ff358e5590d5c626bc7025cf5a50019f68083f9f1632ece7df10603623eed4031f510fc83bbe6e204559443c62d1dc98abbbdce3cede25ab25808af491e8b0e410148748454d6bf69e541b1f", 0xf5}, {&(0x7f0000000640)="ceeba1595da1db5354c45e0eda895b680208d6a4be68eb44d4628312718362550c1cc0e3fd7e3ba217a14cc0c9dc32d294f99af726e769f6bc9c9a12ea9fa44ff8e7ea3c0b052fef0ff9e49d5d300d52d7044846b55d2fdb30bb0bd7e4f043f3d3e8b910a89eab528c80002e8a90ed62d8083a3650b67c38546c9eb2a0a8a57eb2e921dfd2d8ce6e152fbc8d6b7cfa", 0x8f}, {&(0x7f0000000700)="38a050afbf13575f748c4dcd115b2520303e3ce5216b76e6b5bce3f9d37a76da7e775668e61115f7f73e941c52c39b4b2dc367c821031d4087e6cbdd1b2bc12f0578756f7b7578d8f6bcfbd955da9d749f2320710c66e7d5c19df627cdb45b58f79389001946a5e872c4b4e2aefa7686b43772a08b6f19d31b91eba42a23429182825a059f8f8fd5d162488a47693462c4fe1aa01d452a0bfaca8d7b18e257df5d03d8cf954942342f070bfce3121ce02c11669dc382c9cca0a1a3eb5db3b44ab60935705b71bb06b2855753dfb451860d09c8365244eee6cd8d38df82874f39f3723ee25b", 0xe5}], 0x6, 0x7, 0x969, 0x8) r3 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x84, &(0x7f0000000440)={r4, @in={{0x2, 0x4e21, @empty}}, 0xfffc, 0x86}, &(0x7f0000000500)=0x90) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r1, 0x84, 0x23, &(0x7f0000000040)={r4, 0xd}, 0x8) 1.215289454s ago: executing program 4 (id=3168): syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4, &(0x7f0000006680)) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, 0x0, 0x0) r3 = semget$private(0x0, 0x4000, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r4, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r4, 0x2) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) sendmsg$NFT_MSG_GETSETELEM(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000340)={&(0x7f00000004c0)={0x50, 0xd, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8}, [@NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_LIST_SET_ID={0x8}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x2}]}, 0x50}, 0x1, 0x0, 0x0, 0x44000}, 0x7c408223ef12d628) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5", 0x4) r6 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000600)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0x1, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) semctl$SETALL(r3, 0x0, 0x14, &(0x7f0000000740)) mkdirat(0xffffffffffffff9c, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000013c0)='./file0/file0\x00', 0x42, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x400, &(0x7f0000000500)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@metacopy_on}]}) chdir(&(0x7f00000001c0)='./bus\x00') 491.428396ms ago: executing program 0 (id=3169): pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x8000000) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x118, &(0x7f0000000000)=0x5a, 0x0, 0x4) pipe(&(0x7f0000000080)={0xffffffffffffffff}) close(0x4) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000100), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect(0x0, 0x24, &(0x7f0000000380)=ANY=[@ANYBLOB="120100004b41460860163209ea800102030109021e0001000000000904"], 0x0) r6 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) writev(r6, &(0x7f0000000740)=[{&(0x7f0000000040)="02", 0x1}], 0x1) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(r5, &(0x7f0000000400)={0x0, 0xa7, &(0x7f00000003c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="5a309cff144d0dacc9bebcd9b99b2f99e5f2a023db41364df7b6a352a0bbbfd651bec312f688b1aa3ca6ed6c2f474d82d7c986c26a59b6b9b3", @ANYRES16=r4, @ANYBLOB="01000000000000000000420000000e0001006e657464657673696d0000000f0002006e657464657673696d3000000d0087006c325f64726f70730000000008008e0001000000"], 0x4c}}, 0x0) futex_waitv(&(0x7f0000001080)=[{0x3, 0x0, 0x82}], 0x1, 0x0, &(0x7f0000001100), 0x1) connect$inet(r3, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000180)=0x1, 0x4) sendmmsg$inet(r3, &(0x7f00000060c0)=[{{0x0, 0x0, &(0x7f0000000a40)=[{&(0x7f0000000140)='@', 0x1}, {&(0x7f00000007c0)}, {&(0x7f0000000340)="b9", 0x1}], 0x3}}], 0x1, 0x4000000) write(r3, &(0x7f00000001c0)="fc0000001d000724ab09254ec100070007ab08001b000000f03994d81bb8afec4f95c442000000000000000000000000000e150039000000039815fad151ba0101099cec9ef3ffff4f5a56148edfb5a4897194f62ed03ab8fdd233c2f770c94508eec43468608cd424e6328529df3f6945f27ada693a886c3d6ff4f7b2dfa00939aa918ab85ba1b17c3848ae47894cf9127df70d73e19225fc6dc93b92a69394343515421952359a204489e12a92d96dbceea2c988b0c1f5563d9799d17c3241f6c12c8c13b5040e9f003051a520bc5c64a9f28742ae0fef62bd671340fb6d35992bd8281d36e0c858dfbdfa13514fb672f8d024a3d2fe4b22d2d9c0266433165003e8274504889c8b6dfeafb20af6c6b4d83c24e1b5afd659d91a3c47", 0x11d) splice(r2, 0x0, r0, 0x0, 0x1100000000f336, 0x8) 150.884024ms ago: executing program 4 (id=3170): r0 = gettid() close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r1, &(0x7f0000000280)='\x00', 0x1) (async) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) syz_open_procfs$namespace(r0, &(0x7f0000000240)='ns/time\x00') (async) r2 = syz_open_procfs(r0, &(0x7f0000000040)='oom_score_adj\x00') openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) (async) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1) (async) r3 = syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_S_OUTPUT(r3, 0xc004562f, &(0x7f00000000c0)=0x1) (async) ioctl$VIDIOC_S_DV_TIMINGS(r3, 0xc0845657, &(0x7f0000000380)={0x0, @bt={0x2d0, 0x190, 0x1, 0x0, 0xdd9f83, 0x1, 0x9, 0x1, 0x2, 0x5, 0x722, 0x13, 0x7, 0x7f, 0x2e, 0xb763599953cb093e, {0x3, 0x6fd8e84b}, 0xb, 0xed}}) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001280)={0x18, 0x3, &(0x7f0000000940)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000440)='GPL\x00'}, 0x80) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r5}, 0x8) setsockopt$sock_attach_bpf(r4, 0x1, 0x14, &(0x7f0000000040)=r6, 0x3b) (async) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r2, 0xc018937b, &(0x7f0000000100)={{0x1, 0x1, 0x18, r2, {0x0, 0x0}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r6, 0xc018937b, &(0x7f0000000140)={{0x1, 0x1, 0x18, r3, {0xee01, r7}}, './file0\x00'}) (async) r8 = inotify_init1(0x800) inotify_add_watch(r8, &(0x7f0000000080)='.\x00', 0x2000775) 150.293853ms ago: executing program 2 (id=3171): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) shutdown(0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) openat(r1, &(0x7f0000000180)='./file0\x00', 0x24c01, 0x0) r2 = inotify_init1(0x0) inotify_add_watch(r2, &(0x7f00000001c0)='./file0\x00', 0x4000064f) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) connect$unix(r3, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e22}, 0x6e) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_io_uring_setup(0x497, &(0x7f00000000c0)={0x0, 0x4c0f, 0x400, 0x3, 0x288}, &(0x7f0000000240)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) setsockopt$MRT_ADD_VIF(r1, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@remote, @dev={0xac, 0x14, 0x14, 0xff}}, 0x10) socket$igmp(0x2, 0x3, 0x2) syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r8, &(0x7f0000000380)="5929631cff0458695da1aa4c426c0e8f6649632eabbc69bc42bc639a89694df7d3e7ccde361453883b4107b75a2a60bc73ccd0b99781cf2bc8b37417a37d005020466d6ea04d405a28ad15402107e6c453c6ee8aeeed4c0c96cf7d488840b90a36dca9d94345b775a5df211fef4f3b4573b8d19b62317206e1a9deb53c36bfc7944052ad30c158cf1de6573ca58566da9c18f8c6c0e6676380b8d3e542ebf9a7b82a236185", 0xa5) bpf$MAP_CREATE(0x700000000000000, 0x0, 0x50) setsockopt$inet_mreq(0xffffffffffffffff, 0x0, 0x23, 0x0, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000200)=@IORING_OP_FADVISE={0x18, 0x1a, 0x0, @fd_index=0x6, 0x3, 0x0, 0x4, 0xe42c9dbac536b9e8, 0x1}) io_uring_enter(r5, 0x12a8f, 0xf264, 0x40, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) shutdown(0xffffffffffffffff, 0x1) socket$inet6_sctp(0xa, 0x1, 0x84) 0s ago: executing program 4 (id=3172): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$netlink(0x10, 0x3, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$MSR(&(0x7f0000000100), 0xffffffffffffffff, 0x0) io_setup(0x3ff, &(0x7f0000000500)=0x0) io_submit(r4, 0x2, &(0x7f0000000080)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x0, r2}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x8, 0x0, r3, &(0x7f00000001c0)='m', 0x1, 0xffffffffffffffff}]) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r6, r6, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f0000000340)="67400f07c40249af4b8bb9800000c00f3235010200000f300f20a366450f769e00000100440f20c03588001d00405b66baf80cb88cf4b684ef66bafc0ced460f01c9c4827d24c366ba4cf0ff07ef87f345a57a43e16806a4", 0x58}], 0x1, 0x7c, 0x0, 0x30) r8 = getpgrp(0x0) r9 = syz_pidfd_open(r8, 0x0) r10 = epoll_create(0x1) epoll_ctl$EPOLL_CTL_ADD(r10, 0x1, r9, &(0x7f0000000180)) r11 = gettid() kcmp$KCMP_EPOLL_TFD(r8, r11, 0x7, r9, &(0x7f0000000040)={r10, r9}) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r7, 0x4138ae84, &(0x7f00000001c0)={{0x1000, 0xeeee0000, 0x4, 0x9, 0xfb, 0xe4, 0x40, 0x7, 0x0, 0x2b, 0x16}, {0x2000, 0x10000, 0x3, 0x0, 0x40, 0x5, 0x7d, 0x6, 0x5, 0x3, 0x3, 0xb5}, {0xeeef0000, 0xf000, 0x0, 0x6, 0x3, 0x7, 0x0, 0xad, 0x1, 0xa8, 0x4, 0x4}, {0x80a0000, 0xeeef0000, 0x9, 0x6, 0x4, 0x0, 0xb, 0xff, 0x8, 0x7, 0xe}, {0x10000, 0xe000, 0xb, 0x3, 0x3, 0x6, 0xab, 0x7f, 0x7, 0x2, 0xdb}, {0xffffffff, 0x100000, 0xc, 0x7, 0xb1, 0x8, 0x21, 0x84, 0x80, 0x0, 0x1}, {0x3000, 0x8000000, 0x4, 0x1, 0x7, 0x5, 0x7, 0x3, 0x5, 0x81, 0x1, 0x70}, {0x100000, 0x1000, 0x9, 0x5, 0xf, 0x7, 0xc, 0x34, 0x2, 0xc, 0xb0, 0x9}, {0x54000, 0x1000}, {0x2000, 0x7}, 0x80000031, 0x0, 0x8000000, 0x2024, 0x3, 0x3000, 0x3000, [0xf90000000000, 0x4, 0x80, 0xfff]}) r12 = syz_open_dev$MSR(&(0x7f0000000240), 0xfffffffffffffffa, 0x0) read$msr(r12, &(0x7f0000032680)=""/102395, 0x18ffb) bind$inet6(0xffffffffffffffff, 0x0, 0x0) kernel console output (not intermixed with test programs): ? __pfx_snd_pcm_oss_write2+0x10/0x10 [ 884.875977][T16743] ? snd_pcm_kernel_ioctl+0x14a/0x2e0 [ 884.876006][T16743] snd_pcm_oss_write+0x729/0xa30 [ 884.876026][T16743] ? security_file_permission+0x76/0x210 [ 884.876057][T16743] vfs_write+0x2aa/0x1070 [ 884.876085][T16743] ? __pfx_snd_pcm_oss_write+0x10/0x10 [ 884.876105][T16743] ? __pfx_vfs_write+0x10/0x10 [ 884.876129][T16743] ? find_held_lock+0x2b/0x80 [ 884.876150][T16743] ? __fget_files+0x215/0x3d0 [ 884.876167][T16743] ? __fget_files+0x215/0x3d0 [ 884.876189][T16743] ? __fget_files+0x21f/0x3d0 [ 884.876214][T16743] ksys_write+0x12a/0x250 [ 884.876240][T16743] ? __pfx_ksys_write+0x10/0x10 [ 884.876275][T16743] do_syscall_64+0x106/0xf80 [ 884.876297][T16743] ? clear_bhb_loop+0x40/0x90 [ 884.876317][T16743] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 884.876335][T16743] RIP: 0033:0x7fd7b619c799 [ 884.876351][T16743] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 884.876366][T16743] RSP: 002b:00007fd7b70a4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 884.876384][T16743] RAX: ffffffffffffffda RBX: 00007fd7b6415fa0 RCX: 00007fd7b619c799 [ 884.876395][T16743] RDX: 000000000000fc36 RSI: 0000200000000500 RDI: 0000000000000003 [ 884.876405][T16743] RBP: 00007fd7b70a4090 R08: 0000000000000000 R09: 0000000000000000 [ 884.876419][T16743] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 884.876429][T16743] R13: 00007fd7b6416038 R14: 00007fd7b6415fa0 R15: 00007ffe6f415238 [ 884.876455][T16743] [ 885.176770][ T5883] usb 1-1: new high-speed USB device number 89 using dummy_hcd [ 885.380632][ T5864] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 885.401808][T14642] usb 4-1: config 8 has an invalid interface number: 193 but max is 0 [ 885.559096][T14642] usb 4-1: config 8 has no interface number 0 [ 885.583587][T14642] usb 4-1: config 8 interface 193 has no altsetting 0 [ 885.614875][ T5883] usb 1-1: Using ep0 maxpacket: 8 [ 885.637504][T14642] usb 4-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.01 [ 885.664437][T14642] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 885.679306][T14642] usb 4-1: Product: syz [ 885.683801][ T5883] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 885.716412][ T5883] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 885.748171][ T5883] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 885.754065][T14642] usb 4-1: Manufacturer: syz [ 885.775262][T14658] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 885.793704][T14642] usb 4-1: SerialNumber: syz [ 885.839673][ T5883] usb 1-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 885.861342][ T5883] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 885.881129][ T5883] usb 1-1: Product: syz [ 885.891904][ T5883] usb 1-1: Manufacturer: syz [ 885.897872][ T5883] usb 1-1: SerialNumber: syz [ 885.918797][ T5883] usb 1-1: config 0 descriptor?? [ 885.935758][T16744] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 885.948066][T14658] usb 3-1: Using ep0 maxpacket: 16 [ 885.969073][T14658] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 885.991841][T14658] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 886.018557][T14658] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 886.035007][ T5883] rc_core: IR keymap rc-streamzap not found [ 886.041237][ T5883] Registered IR keymap rc-empty [ 886.074663][ T5942] usb 2-1: new high-speed USB device number 79 using dummy_hcd [ 886.075147][ T5883] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 886.093912][T14658] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 886.123539][T14658] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 886.138239][T14658] usb 3-1: config 0 descriptor?? [ 886.143453][ T5883] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input65 [ 886.268620][ T5942] usb 2-1: config index 0 descriptor too short (expected 8192, got 18) [ 886.293358][ T5942] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 886.331986][ T29] audit: type=1326 audit(1773398760.073:1789): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16753 comm="syz.4.2772" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f87c139c799 code=0x0 [ 886.338152][T14642] usb 4-1: USB disconnect, device number 91 [ 886.361106][ T5942] usb 2-1: config 0 has no interfaces? [ 886.398772][ T5942] usb 2-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 886.413612][ T5942] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 886.449440][ T5942] usb 2-1: Product: syz [ 886.470397][ T5942] usb 2-1: Manufacturer: syz [ 886.475576][ T5942] usb 2-1: SerialNumber: syz [ 886.483174][ T5942] usb 2-1: config 0 descriptor?? [ 886.493685][ T5871] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 886.664807][ T5883] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 886.771109][T16748] netdevsim netdevsim1 netdevsim0: left promiscuous mode [ 886.787263][T16748] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 886.811717][ T5883] usb 5-1: device descriptor read/64, error -71 [ 886.871264][ T5942] usb 2-1: USB disconnect, device number 79 [ 886.900194][T16759] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 886.907434][T16759] IPv6: NLM_F_CREATE should be set when creating new route [ 886.914665][T16759] IPv6: NLM_F_CREATE should be set when creating new route [ 886.921881][T16759] IPv6: NLM_F_CREATE should be set when creating new route [ 887.089620][ T5883] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 887.315257][ T5883] usb 5-1: device descriptor read/64, error -71 [ 887.594070][ T5883] usb usb5-port1: attempt power cycle [ 887.608269][ T5942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 887.778148][T14658] usbhid 3-1:0.0: can't add hid device: -71 [ 887.795028][T14658] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 887.823614][T14658] usb 3-1: USB disconnect, device number 90 [ 888.009234][ T5883] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 888.034051][ T5883] usb 5-1: device descriptor read/8, error -71 [ 889.298718][ T5942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 889.306897][T14658] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 890.322655][ T5883] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 890.325293][ T661] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 890.338949][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 890.432948][ T5883] usb 5-1: device descriptor read/8, error -71 [ 890.448614][ T5942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 890.909008][T16779] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2780'. [ 890.925458][ T5883] usb usb5-port1: unable to enumerate USB device [ 890.935790][ T5942] usb 1-1: USB disconnect, device number 89 [ 891.703912][ T5871] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 892.015774][ T5942] usb 1-1: new high-speed USB device number 90 using dummy_hcd [ 892.232272][ T5942] usb 1-1: config index 0 descriptor too short (expected 23569, got 27) [ 892.263488][ T5942] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 892.303449][ T5942] usb 1-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 892.345804][ T5942] usb 1-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 892.379382][ T5942] usb 1-1: Manufacturer: syz [ 892.423073][ T5942] usb 1-1: config 0 descriptor?? [ 892.559638][ T5942] rc_core: IR keymap rc-hauppauge not found [ 892.592826][ T5942] Registered IR keymap rc-empty [ 892.608479][ T5942] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 892.682469][ T5942] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input66 [ 892.706567][T16799] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 892.758853][T16799] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 892.820113][ T5942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 893.710831][T16816] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 893.720106][T16816] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 893.728840][T16816] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 893.737361][T16816] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 893.745925][T16816] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 893.754539][T16816] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 893.763984][T16816] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 893.772798][T16816] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 893.783392][T16816] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 893.792105][T16816] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 894.446206][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 894.452893][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 894.546388][ T5883] usb 1-1: USB disconnect, device number 90 [ 894.751486][T16819] x_tables: duplicate underflow at hook 3 [ 895.342157][T16839] xt_CT: You must specify a L4 protocol and not use inversions on it [ 895.380551][ T29] audit: type=1400 audit(1773398768.532:1790): avc: denied { append } for pid=16837 comm="syz.3.2791" name="pfkey" dev="proc" ino=4026532910 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 895.675919][ T29] audit: type=1400 audit(1773398768.804:1791): avc: denied { view } for pid=16843 comm="syz.3.2795" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 895.973506][T16852] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 897.540523][T14658] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 897.896142][T14658] usb 5-1: config index 0 descriptor too short (expected 23569, got 27) [ 897.907595][T14658] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 898.068283][T14658] usb 5-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 898.160818][T14658] usb 5-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 898.191051][T14658] usb 5-1: Manufacturer: syz [ 898.277904][T14658] usb 5-1: config 0 descriptor?? [ 898.375134][T14658] rc_core: IR keymap rc-hauppauge not found [ 898.427572][T14658] Registered IR keymap rc-empty [ 898.440653][T14658] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 898.464957][T14658] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input67 [ 898.652172][T16869] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 898.738052][T16869] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 898.749846][T16873] netlink: 'syz.2.2801': attribute type 1 has an invalid length. [ 898.757866][T16873] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2801'. [ 898.954272][T16881] FAULT_INJECTION: forcing a failure. [ 898.954272][T16881] name failslab, interval 1, probability 0, space 0, times 0 [ 898.968289][T16881] CPU: 0 UID: 0 PID: 16881 Comm: syz.1.2799 Tainted: G L syzkaller #0 PREEMPT(full) [ 898.968308][T16881] Tainted: [L]=SOFTLOCKUP [ 898.968312][T16881] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 898.968319][T16881] Call Trace: [ 898.968323][T16881] [ 898.968328][T16881] dump_stack_lvl+0x100/0x190 [ 898.968351][T16881] should_fail_ex.cold+0x5/0xa [ 898.968366][T16881] ? inotify_handle_inode_event+0x1a5/0x6a0 [ 898.968382][T16881] should_failslab+0xc2/0x120 [ 898.968393][T16881] __kmalloc_noprof+0xe0/0x850 [ 898.968408][T16881] ? __pfx_timestamp_truncate+0x10/0x10 [ 898.968421][T16881] ? lockdep_hardirqs_on+0x78/0x100 [ 898.968439][T16881] inotify_handle_inode_event+0x1a5/0x6a0 [ 898.968458][T16881] ? __pfx_inotify_handle_inode_event+0x10/0x10 [ 898.968474][T16881] fsnotify_handle_inode_event.isra.0+0x1e3/0x410 [ 898.968489][T16881] fsnotify+0x187d/0x3550 [ 898.968505][T16881] ? __pfx_fsnotify+0x10/0x10 [ 898.968521][T16881] ? inc_nlink+0x4a/0x180 [ 898.968534][T16881] vfs_mkdir+0x4de/0x850 [ 898.968552][T16881] filename_mkdirat+0x48b/0x5e0 [ 898.968566][T16881] ? __pfx_filename_mkdirat+0x10/0x10 [ 898.968578][T16881] ? strncpy_from_user+0x19d/0x2d0 [ 898.968598][T16881] ? do_getname+0x191/0x390 [ 898.968613][T16881] __x64_sys_mkdir+0x6b/0x90 [ 898.968626][T16881] do_syscall_64+0x106/0xf80 [ 898.968640][T16881] ? clear_bhb_loop+0x40/0x90 [ 898.968653][T16881] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 898.968665][T16881] RIP: 0033:0x7f6a8999c799 [ 898.968675][T16881] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 898.968685][T16881] RSP: 002b:00007f6a8a7f9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 898.968696][T16881] RAX: ffffffffffffffda RBX: 00007f6a89c16180 RCX: 00007f6a8999c799 [ 898.968702][T16881] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000300 [ 898.968709][T16881] RBP: 00007f6a8a7f9090 R08: 0000000000000000 R09: 0000000000000000 [ 898.968715][T16881] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 898.968721][T16881] R13: 00007f6a89c16218 R14: 00007f6a89c16180 R15: 00007ffeb7a1f718 [ 898.968736][T16881] [ 899.194330][T14658] net_ratelimit: 1275 callbacks suppressed [ 899.194342][T14658] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 899.827749][ T5871] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 899.964778][ T29] audit: type=1400 audit(1773398772.818:1792): avc: denied { bind } for pid=16904 comm="syz.2.2808" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 899.976903][ T5942] usb 1-1: new high-speed USB device number 91 using dummy_hcd [ 900.565032][ T5942] usb 1-1: Using ep0 maxpacket: 32 [ 900.572188][ T5942] usb 1-1: config 0 has an invalid interface number: 61 but max is 1 [ 900.580776][ T5942] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 900.589941][ T5942] usb 1-1: config 0 has no interface number 0 [ 901.111152][ T5871] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 901.123930][ T29] audit: type=1800 audit(1773398773.520:1793): pid=16913 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.1.2809" name="bus" dev="overlay" ino=3034 res=0 errno=0 [ 901.229513][ T5942] usb 1-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=b5.f6 [ 901.242337][ T5942] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 901.251641][ T5942] usb 1-1: Product: syz [ 901.256395][ T5942] usb 1-1: Manufacturer: syz [ 901.261848][ T5942] usb 1-1: SerialNumber: syz [ 901.386011][ T5942] usb 1-1: config 0 descriptor?? [ 901.467576][ T5871] usb 5-1: USB disconnect, device number 92 [ 901.579982][ T5942] viperboard 1-1:0.61: version 0.00 found at bus 001 address 091 [ 901.597070][ T5942] viperboard-i2c viperboard-i2c.2.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 901.612676][ T5942] viperboard-i2c viperboard-i2c.2.auto: probe with driver viperboard-i2c failed with error -5 [ 901.750801][ T29] audit: type=1400 audit(1773398774.447:1794): avc: denied { connect } for pid=16914 comm="syz.2.2810" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 902.222830][ T5871] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 902.499452][ T5883] usb 1-1: USB disconnect, device number 91 [ 903.522260][ T5942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 903.792104][ T1108] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 903.800333][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 904.064221][T16949] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 904.187173][ T5883] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 904.347439][ T5883] usb 3-1: Using ep0 maxpacket: 32 [ 904.394510][ T5883] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 904.410742][ T5883] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 904.436682][ T5883] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 904.457007][ T5883] usb 3-1: Product: syz [ 904.464698][ T5883] usb 3-1: Manufacturer: syz [ 904.476511][ T5883] usb 3-1: SerialNumber: syz [ 904.495288][ T5883] usb 3-1: config 0 descriptor?? [ 904.505719][T16948] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 904.519433][ T5883] hub 3-1:0.0: bad descriptor, ignoring hub [ 904.532023][ T5883] hub 3-1:0.0: probe with driver hub failed with error -5 [ 904.616500][ T5942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 904.737820][T16946] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 904.753080][T16946] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 905.284207][ T5942] usb 3-1: USB disconnect, device number 91 [ 906.574096][ T5942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 907.232739][ T9998] usb 2-1: new high-speed USB device number 80 using dummy_hcd [ 907.692914][ T9998] usb 2-1: config index 0 descriptor too short (expected 23569, got 27) [ 907.692984][ T5942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 907.701301][ T9998] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 907.782234][ T9998] usb 2-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 907.810550][ T9998] usb 2-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 907.842594][ T9998] usb 2-1: Manufacturer: syz [ 907.859505][ T9998] usb 2-1: config 0 descriptor?? [ 907.980870][ T9998] rc_core: IR keymap rc-hauppauge not found [ 908.059568][ T9998] Registered IR keymap rc-empty [ 908.117500][ T9998] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 908.142799][ T9998] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input68 [ 908.195173][T16986] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 908.228158][T16986] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 908.721724][ T29] audit: type=1400 audit(1773398781.007:1795): avc: denied { append } for pid=16988 comm="syz.3.2823" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 909.003903][T14642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 909.462742][ T5883] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 909.917718][T11702] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 909.925993][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 910.087833][ T5871] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 910.313966][T17013] pimreg: entered allmulticast mode [ 910.328465][T17013] pimreg: left allmulticast mode [ 910.928637][ T5871] usb 2-1: USB disconnect, device number 80 [ 911.048130][ T29] audit: type=1400 audit(1773398783.187:1796): avc: denied { write } for pid=17022 comm="syz.4.2836" name="random" dev="devtmpfs" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:random_device_t tclass=chr_file permissive=1 [ 911.200836][ T5864] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 911.478074][ T29] audit: type=1400 audit(1773398783.580:1797): avc: denied { accept } for pid=17027 comm="syz.4.2837" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 911.766998][ T5864] usb 5-1: new full-speed USB device number 93 using dummy_hcd [ 912.971083][ T5864] usb 5-1: device descriptor read/64, error -71 [ 913.021566][ T5942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 913.195932][T17040] netlink: 'syz.2.2840': attribute type 21 has an invalid length. [ 913.238351][ T5864] usb 5-1: new full-speed USB device number 94 using dummy_hcd [ 913.398699][ T5864] usb 5-1: device descriptor read/64, error -71 [ 913.523418][ T5864] usb usb5-port1: attempt power cycle [ 914.544833][ T5942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 914.849660][T17065] ipt_REJECT: ECHOREPLY no longer supported. [ 915.737355][ T5942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 915.878167][ T1154] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 915.886502][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 916.839885][ T5864] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 917.952868][ T5942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 918.752268][ T5864] usb 1-1: new high-speed USB device number 92 using dummy_hcd [ 918.770088][T17109] FAULT_INJECTION: forcing a failure. [ 918.770088][T17109] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 918.774059][T14642] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 918.792039][T17109] CPU: 0 UID: 0 PID: 17109 Comm: syz.2.2858 Tainted: G L syzkaller #0 PREEMPT(full) [ 918.792066][T17109] Tainted: [L]=SOFTLOCKUP [ 918.792072][T17109] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 918.792081][T17109] Call Trace: [ 918.792086][T17109] [ 918.792091][T17109] dump_stack_lvl+0x100/0x190 [ 918.792112][T17109] should_fail_ex.cold+0x5/0xa [ 918.792127][T17109] _copy_from_user+0x2e/0xd0 [ 918.792144][T17109] ucma_get_event+0xcb/0x730 [ 918.792159][T17109] ? __pfx_ucma_get_event+0x10/0x10 [ 918.792173][T17109] ? find_held_lock+0x2b/0x80 [ 918.792187][T17109] ? __might_fault+0xc5/0x140 [ 918.792201][T17109] ? __might_fault+0xc5/0x140 [ 918.792219][T17109] ? __pfx_ucma_get_event+0x10/0x10 [ 918.792233][T17109] ucma_write+0x1fb/0x330 [ 918.792245][T17109] ? __pfx_ucma_write+0x10/0x10 [ 918.792257][T17109] ? bpf_lsm_file_permission+0x9/0x10 [ 918.792279][T17109] ? security_file_permission+0x76/0x210 [ 918.792295][T17109] ? rw_verify_area+0xce/0x6d0 [ 918.792311][T17109] vfs_write+0x2aa/0x1070 [ 918.792328][T17109] ? __pfx_ucma_write+0x10/0x10 [ 918.792341][T17109] ? __pfx_vfs_write+0x10/0x10 [ 918.792356][T17109] ? find_held_lock+0x2b/0x80 [ 918.792369][T17109] ? __fget_files+0x215/0x3d0 [ 918.792380][T17109] ? __fget_files+0x215/0x3d0 [ 918.792393][T17109] ? __fget_files+0x21f/0x3d0 [ 918.792408][T17109] ksys_write+0x1f8/0x250 [ 918.792424][T17109] ? __pfx_ksys_write+0x10/0x10 [ 918.792444][T17109] do_syscall_64+0x106/0xf80 [ 918.792458][T17109] ? clear_bhb_loop+0x40/0x90 [ 918.792472][T17109] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 918.792483][T17109] RIP: 0033:0x7fd7b619c799 [ 918.792494][T17109] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 918.792504][T17109] RSP: 002b:00007fd7b70a4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 918.792517][T17109] RAX: ffffffffffffffda RBX: 00007fd7b6415fa0 RCX: 00007fd7b619c799 [ 918.792524][T17109] RDX: 0000000000000010 RSI: 0000200000000280 RDI: 000000000000000a [ 918.792530][T17109] RBP: 00007fd7b70a4090 R08: 0000000000000000 R09: 0000000000000000 [ 918.792537][T17109] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 918.792543][T17109] R13: 00007fd7b6416038 R14: 00007fd7b6415fa0 R15: 00007ffe6f415238 [ 918.792557][T17109] [ 918.912540][ T5864] usb 1-1: Using ep0 maxpacket: 32 [ 919.051136][ T5864] usb 1-1: config 1 interface 0 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 919.070624][ T5942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 919.105044][ T5864] usb 1-1: config 1 interface 0 has no altsetting 0 [ 919.166977][T14642] usb 4-1: Using ep0 maxpacket: 16 [ 919.312397][T14642] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 919.324597][T14642] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 919.337451][ T5864] usb 1-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.40 [ 919.346938][ T5864] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 919.357717][T14642] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 919.369255][ T5864] usb 1-1: Product: syz [ 919.373972][T14642] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 919.384105][ T5864] usb 1-1: Manufacturer: syz [ 919.388748][ T5864] usb 1-1: SerialNumber: syz [ 919.414634][T14642] usb 4-1: Product: syz [ 919.419389][T14642] usb 4-1: Manufacturer: syz [ 919.424061][T14642] usb 4-1: SerialNumber: syz [ 919.440838][T14642] usb 4-1: config 0 descriptor?? [ 919.449585][T14642] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 919.463291][T14642] em28xx 4-1:0.0: Audio interface 0 found (Vendor Class) [ 919.492258][ T5883] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 919.727383][T17133] dlm: plock device version mismatch: kernel (1.2.0), user (0.0.0) [ 919.827162][T17134] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2867'. [ 920.102225][T14642] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 920.111327][T14642] em28xx 4-1:0.0: Config register raw data: 0xdf [ 920.185373][ T5871] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 920.236086][ T5864] usbhid 1-1:1.0: can't add hid device: -71 [ 920.248109][ T5864] usbhid 1-1:1.0: probe with driver usbhid failed with error -71 [ 920.324538][ T5864] usb 1-1: USB disconnect, device number 92 [ 921.573136][ T5942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 921.582264][T14642] em28xx 4-1:0.0: AC97 chip type couldn't be determined [ 921.589350][T14642] em28xx 4-1:0.0: No AC97 audio processor [ 921.637614][ T5871] usb 2-1: new full-speed USB device number 81 using dummy_hcd [ 921.711366][T17153] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2869'. [ 921.935688][T14642] usb 4-1: USB disconnect, device number 92 [ 922.014166][ T5871] usb 2-1: config index 0 descriptor too short (expected 28277, got 36) [ 922.022982][T14642] em28xx 4-1:0.0: Disconnecting em28xx [ 922.227634][ T7891] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 922.236297][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 922.256013][T17156] netlink: 156 bytes leftover after parsing attributes in process `syz.0.2870'. [ 922.298544][ T5871] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 922.325070][T14642] em28xx 4-1:0.0: Freeing device [ 922.344679][ T5871] usb 2-1: config 0 has no interfaces? [ 922.354762][ T5871] usb 2-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 922.370177][ T5871] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 922.387944][ T5871] usb 2-1: config 0 descriptor?? [ 923.469400][ T5871] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 923.488902][T17147] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 923.497949][T17147] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 924.379410][T17176] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2877'. [ 924.388645][T17176] bond0: ARP target 8.4.0.0 is already present [ 924.394861][T17176] bond0: option arp_ip_target: invalid value (1032) [ 924.595649][ T29] audit: type=1400 audit(1773398795.783:1798): avc: denied { connect } for pid=17172 comm="syz.3.2877" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 925.380363][T14642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 925.430995][ T29] audit: type=1400 audit(1773398795.783:1799): avc: denied { write } for pid=17172 comm="syz.3.2877" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 925.794755][ T5883] usb 2-1: USB disconnect, device number 81 [ 926.561502][T14642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 926.752462][ T5128] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 926.764896][ T5128] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 926.777023][ T5128] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 926.785773][ T5128] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 926.799384][ T5128] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 926.841120][ T29] audit: type=1400 audit(1773398797.973:1800): avc: denied { mounton } for pid=17195 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 927.283325][ T29] audit: type=1400 audit(1773398798.375:1801): avc: denied { create } for pid=17195 comm="syz-executor" name="tun" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=chr_file permissive=1 [ 927.427703][ T29] audit: type=1400 audit(1773398798.375:1802): avc: denied { setattr } for pid=17195 comm="syz-executor" name="tun" dev="devtmpfs" ino=4367 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=chr_file permissive=1 [ 927.664399][ T29] audit: type=1400 audit(1773398798.375:1803): avc: denied { read write } for pid=17195 comm="syz-executor" name="tun" dev="devtmpfs" ino=4367 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=chr_file permissive=1 [ 927.696844][ T29] audit: type=1400 audit(1773398798.375:1804): avc: denied { open } for pid=17195 comm="syz-executor" path="/dev/net/tun" dev="devtmpfs" ino=4367 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=chr_file permissive=1 [ 927.720090][T14642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 927.739336][ T29] audit: type=1400 audit(1773398798.384:1805): avc: denied { ioctl } for pid=17195 comm="syz-executor" path="/dev/net/tun" dev="devtmpfs" ino=4367 ioctlcmd=0x54ca scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=chr_file permissive=1 [ 927.863819][T17195] chnl_net:caif_netlink_parms(): no params data found [ 928.050048][T14642] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 928.284973][T14642] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 929.122192][ T5128] Bluetooth: hci5: command tx timeout [ 929.130645][ T7891] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 929.138840][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 929.164651][T14642] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 929.182043][ T5871] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 929.190725][T14642] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 929.200432][T14642] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 929.215085][T14642] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 929.227971][T14642] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 929.242132][T14642] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 929.252562][T14642] usb 5-1: Product: syz [ 929.259043][T14642] usb 5-1: Manufacturer: syz [ 929.275170][T14642] cdc_wdm 5-1:1.0: skipping garbage [ 929.280794][T14642] cdc_wdm 5-1:1.0: skipping garbage [ 929.289024][T14642] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 929.289263][T17195] bridge0: port 1(bridge_slave_0) entered blocking state [ 929.295019][T14642] cdc_wdm 5-1:1.0: Unknown control protocol [ 929.363591][T17195] bridge0: port 1(bridge_slave_0) entered disabled state [ 929.370834][T17195] bridge_slave_0: entered allmulticast mode [ 929.428580][T17195] bridge_slave_0: entered promiscuous mode [ 929.439625][T17195] bridge0: port 2(bridge_slave_1) entered blocking state [ 929.446739][T17195] bridge0: port 2(bridge_slave_1) entered disabled state [ 929.481147][T17195] bridge_slave_1: entered allmulticast mode [ 929.523043][T17195] bridge_slave_1: entered promiscuous mode [ 929.599174][ T29] audit: type=1400 audit(1773398800.546:1806): avc: denied { read write } for pid=17207 comm="syz.4.2881" name="cdc-wdm0" dev="devtmpfs" ino=4369 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 929.616490][T17220] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 929.653845][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 929.660684][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 929.667338][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 929.673935][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 929.681849][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 929.688457][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 929.695183][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 929.696088][T17195] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 929.701800][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 929.701998][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 929.716085][ T29] audit: type=1400 audit(1773398800.546:1807): avc: denied { open } for pid=17207 comm="syz.4.2881" path="/dev/cdc-wdm0" dev="devtmpfs" ino=4369 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 929.716887][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 929.750523][T17195] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 929.755354][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 929.768937][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 929.770199][T17220] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 929.775796][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 929.791064][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 929.798728][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 929.805338][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 929.811965][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 929.818567][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 929.825483][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 929.832089][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 929.839451][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 929.848276][T14642] usb 5-1: USB disconnect, device number 96 [ 929.870554][T17220] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 929.896113][T17220] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 929.940346][T17220] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 929.943361][T17195] team0: Port device team_slave_0 added [ 929.974216][T17195] team0: Port device team_slave_1 added [ 929.978085][T17220] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 930.017694][T17220] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 930.042796][T17195] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 930.058614][T17195] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 930.070583][T17220] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 930.114030][T17195] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 930.155873][T17195] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 930.162855][T17195] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 930.206459][T17220] UDF-fs: warning (device nbd1): udf_fill_super: No partition found (1) [ 930.306030][T14642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 930.448068][T17195] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 930.517712][ T9998] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 930.564876][T17195] hsr_slave_0: entered promiscuous mode [ 930.571101][T17195] hsr_slave_1: entered promiscuous mode [ 930.577048][T17195] debugfs: 'hsr0' already exists in 'hsr' [ 930.583825][T17195] Cannot create hsr debugfs directory [ 930.678011][ T9998] usb 3-1: device descriptor read/64, error -71 [ 930.699263][T14642] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 930.759051][ T7891] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 930.849938][ T7891] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 930.863304][T14642] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 930.881234][T14642] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 930.891695][T14642] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 930.900736][T14642] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 930.939840][T17233] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 930.955982][ T9998] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 930.962519][T14642] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 930.973172][ T7891] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 931.114699][T17236] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2890'. [ 931.219831][ T7891] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 931.288051][ T5128] Bluetooth: hci5: command tx timeout [ 931.302449][T14658] usb 4-1: USB disconnect, device number 93 [ 931.319055][ T9998] usb 3-1: device descriptor read/64, error -71 [ 931.368743][T17243] syzkaller0: entered promiscuous mode [ 931.385016][T17243] syzkaller0: entered allmulticast mode [ 931.442147][ T9998] usb usb3-port1: attempt power cycle [ 931.459327][ T5871] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 931.607571][ T29] audit: type=1400 audit(1773398802.418:1808): avc: denied { execute } for pid=17232 comm="syz.3.2884" path=2F6465762F6D69646933202864656C6574656429 dev="devtmpfs" ino=4375 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sound_device_t tclass=chr_file permissive=1 [ 931.876472][ T9998] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 931.886873][ T7891] bridge_slave_1: left allmulticast mode [ 931.907568][ T9998] usb 3-1: device descriptor read/8, error -71 [ 931.919658][ T7891] bridge_slave_1: left promiscuous mode [ 931.941818][ T7891] bridge0: port 2(bridge_slave_1) entered disabled state [ 931.972819][ T7891] bridge_slave_0: left allmulticast mode [ 932.837101][ T5942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 932.856237][ T7891] bridge_slave_0: left promiscuous mode [ 932.875265][ T7891] bridge0: port 1(bridge_slave_0) entered disabled state [ 932.954549][ T9998] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 932.990595][ T9998] usb 3-1: device descriptor read/8, error -71 [ 933.135990][ T9998] usb usb3-port1: unable to enumerate USB device [ 933.145135][ T29] audit: type=1326 audit(1773398803.868:1809): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17267 comm="syz.3.2897" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fab3879c799 code=0x0 [ 933.235406][T17271] 9p: Bad value for 'rfdno' [ 933.512668][ T5128] Bluetooth: hci5: command tx timeout [ 933.644395][ T7891] bond0 (unregistering): left promiscuous mode [ 933.656462][ T7891] bond_slave_0: left promiscuous mode [ 933.662135][ T7891] bond_slave_1: left promiscuous mode [ 933.667802][ T7891] dummy0: left promiscuous mode [ 933.687109][ T7891] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 933.701332][ T7891] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 933.739703][ T7891] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 933.759136][ T7891] bond0 (unregistering): Released all slaves [ 933.779411][ T7891] bond1 (unregistering): Released all slaves [ 933.802321][ T7891] bond2 (unregistering): Released all slaves [ 933.823457][ T7891] bond3 (unregistering): Released all slaves [ 933.969712][ T5871] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 934.718553][ T5871] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 934.910589][ T5871] usb 4-1: Using ep0 maxpacket: 32 [ 934.939236][ T5871] usb 4-1: config index 0 descriptor too short (expected 35577, got 27) [ 935.044486][ T5871] usb 4-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 935.073969][T14642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 935.082807][ T5871] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 935.092215][ T5871] usb 4-1: config 1 has no interface number 0 [ 935.100019][ T5871] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 935.117399][T17325] binder: 17321:17325 ioctl 4018620d 0 returned -22 [ 935.125331][T17325] binder: 17321:17325 ioctl c0306201 0 returned -14 [ 935.222467][ T5871] usb 4-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 935.238280][ T5871] usb 4-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 935.250232][ T5871] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 935.289412][T11702] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 935.297812][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 935.450923][ T5871] snd_usb_pod 4-1:1.1: Line 6 Pocket POD found [ 935.732468][ T5128] Bluetooth: hci5: command tx timeout [ 935.745692][ T5871] snd_usb_pod 4-1:1.1: Line 6 Pocket POD now attached [ 936.273319][T10180] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 936.435778][ T7891] macvlan0: left promiscuous mode [ 936.540322][ T9998] usb 4-1: USB disconnect, device number 94 [ 936.557334][ T9998] snd_usb_pod 4-1:1.1: Line 6 Pocket POD now disconnected [ 936.609450][ T7891] hsr_slave_0: left promiscuous mode [ 936.630787][ T7891] hsr_slave_1: left promiscuous mode [ 936.702337][ T7891] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 936.753224][T17347] overlayfs: failed to resolve './file1': -2 [ 936.771569][ T7891] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 936.794448][ T7891] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 936.803350][ T7891] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 936.940147][ T29] audit: type=1400 audit(1773398807.377:1810): avc: denied { append } for pid=17340 comm="syz.1.2914" name="tun" dev="devtmpfs" ino=4367 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=chr_file permissive=1 [ 936.978072][ T7891] veth1_macvtap: left promiscuous mode [ 936.987042][ T7891] veth0_macvtap: left promiscuous mode [ 936.995343][ T7891] veth1_vlan: left promiscuous mode [ 937.010342][ T7891] veth0_vlan: left promiscuous mode [ 937.129054][ T7891] batadv1 (unregistering): left allmulticast mode [ 937.145693][ T7891] team0 (unregistering): Port device batadv1 removed [ 937.383476][ T5871] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 937.404637][ T7891] team_slave_1 (unregistering): left allmulticast mode [ 937.422690][ T7891] team0 (unregistering): Port device team_slave_1 removed [ 937.632619][T17195] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 937.685607][T17195] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 937.724909][T17195] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 937.756325][T17195] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 938.471386][T10180] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 938.507651][T17195] 8021q: adding VLAN 0 to HW filter on device bond0 [ 938.923372][T17195] 8021q: adding VLAN 0 to HW filter on device team0 [ 939.009449][ T1108] bridge0: port 1(bridge_slave_0) entered blocking state [ 939.016594][ T1108] bridge0: port 1(bridge_slave_0) entered forwarding state [ 939.082862][ T1108] bridge0: port 2(bridge_slave_1) entered blocking state [ 939.090027][ T1108] bridge0: port 2(bridge_slave_1) entered forwarding state [ 939.600481][T17195] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 939.638008][T10180] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 940.243319][T17195] veth0_vlan: entered promiscuous mode [ 940.272341][ T7891] IPVS: stop unused estimator thread 0... [ 940.287704][T17195] veth1_vlan: entered promiscuous mode [ 940.445692][T17195] veth0_macvtap: entered promiscuous mode [ 940.491263][T17195] veth1_macvtap: entered promiscuous mode [ 940.564985][T17195] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 940.608690][T17195] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 940.657186][ T7891] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 940.692576][ T7891] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 940.727097][ T7891] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 940.776334][ T5942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 940.785041][ T7891] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 941.377803][T11702] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 941.386203][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 941.564549][T17427] overlayfs: missing 'workdir' [ 941.607661][T11702] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 941.620072][T11702] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 941.698057][T11702] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 941.719013][T11702] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 941.728872][T10180] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 941.791081][ T29] audit: type=1400 audit(1773398811.963:1811): avc: denied { mounton } for pid=17195 comm="syz-executor" path="/root/syzkaller.ykRIYd/syz-tmp" dev="sda1" ino=2047 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 941.890778][T14642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 941.901830][ T29] audit: type=1400 audit(1773398811.982:1812): avc: denied { mounton } for pid=17195 comm="syz-executor" path="/root/syzkaller.ykRIYd/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=61109 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 941.937742][T10180] usb 5-1: Using ep0 maxpacket: 16 [ 941.953905][T10180] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 941.983675][T10180] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 942.037916][T10180] usb 5-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.00 [ 942.047083][ T29] audit: type=1400 audit(1773398812.000:1813): avc: denied { mounton } for pid=17195 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2786 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 942.071008][T10180] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 942.103789][T10180] usb 5-1: config 0 descriptor?? [ 942.158297][ T29] audit: type=1400 audit(1773398812.000:1814): avc: denied { mount } for pid=17195 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 942.422357][T14642] usb 2-1: new high-speed USB device number 82 using dummy_hcd [ 942.547407][T17443] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 942.557378][T17443] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 942.582207][T17480] overlayfs: missing 'lowerdir' [ 942.587533][T14642] usb 2-1: device descriptor read/64, error -71 [ 942.615388][T10180] hid_parser_main: 28 callbacks suppressed [ 942.615411][T10180] hid-multitouch 0003:1FD2:6007.0013: unknown main item tag 0x0 [ 942.635314][T10180] hid-multitouch 0003:1FD2:6007.0013: unknown main item tag 0x1 [ 942.643415][T10180] hid-multitouch 0003:1FD2:6007.0013: item fetching failed at offset 4/5 [ 942.676305][T10180] hid-multitouch 0003:1FD2:6007.0013: probe with driver hid-multitouch failed with error -22 [ 942.722051][T17485] overlayfs: missing 'lowerdir' [ 942.913478][T14642] usb 2-1: new high-speed USB device number 83 using dummy_hcd [ 942.933798][ T9998] usb 5-1: USB disconnect, device number 97 [ 942.998886][ T5883] usb 1-1: new high-speed USB device number 93 using dummy_hcd [ 943.001376][ T5864] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 943.074289][T14642] usb 2-1: device descriptor read/64, error -71 [ 943.214828][T14642] usb usb2-port1: attempt power cycle [ 943.268782][ T5883] usb 1-1: config 0 has an invalid interface number: 64 but max is 0 [ 943.300095][ T5883] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 943.354144][ T5883] usb 1-1: config 0 has no interface number 0 [ 943.396128][ T5883] usb 1-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice= 0.07 [ 943.445054][ T5883] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 943.458525][ T5883] usb 1-1: Product: syz [ 943.462728][ T5883] usb 1-1: Manufacturer: syz [ 943.474013][ T5883] usb 1-1: SerialNumber: syz [ 943.550693][ T5883] usb 1-1: config 0 descriptor?? [ 943.582215][T14642] usb 2-1: new high-speed USB device number 84 using dummy_hcd [ 943.875884][T14642] usb 2-1: device descriptor read/8, error -71 [ 944.110907][ T5871] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 944.131589][T14642] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 944.153684][T14642] usb 2-1: device descriptor read/8, error -71 [ 944.271411][T14642] usb usb2-port1: unable to enumerate USB device [ 945.222138][ T5871] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 945.582071][ T5883] uvcvideo 1-1:0.64: Found UVC 0.08 device syz (046d:0823) [ 945.589424][ T5883] uvcvideo 1-1:0.64: No valid video chain found. [ 945.613552][ T5883] usb 1-1: USB disconnect, device number 93 [ 946.344746][T14642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 947.444502][ T5871] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 947.530171][ T7891] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 947.538551][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 948.556503][ T5871] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 949.667138][T14642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 950.790075][T14642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 951.890029][ T5871] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 952.916035][ T7891] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 952.924273][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 953.002759][ T5871] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 953.193993][ T29] audit: type=1400 audit(1773398822.640:1815): avc: denied { module_load } for pid=17502 comm="syz.0.2942" path="/sys/kernel/oops_count" dev="sysfs" ino=57514 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=system permissive=1 [ 953.335799][T17503] orangefs_devreq_write_iter: userspace claims version768, minimum version required: 20903. [ 953.940440][ T5883] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 954.132059][T14642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 954.312792][T17527] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2948'. [ 954.345107][ T5883] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 954.361679][ T5883] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 954.377758][ T5883] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 954.426148][ T5818] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 954.444237][ T5818] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 954.477518][ T5818] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 954.488336][ T5883] usb 2-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 954.512045][ T5883] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 954.512250][ T5818] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 954.547847][ T5818] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 954.561975][ T5883] usb 2-1: config 0 descriptor?? [ 954.826931][ T5883] usb 2-1: USB disconnect, device number 86 [ 955.016266][T17523] chnl_net:caif_netlink_parms(): no params data found [ 955.236354][ T5871] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 955.240439][T17523] bridge0: port 1(bridge_slave_0) entered blocking state [ 955.266469][T17523] bridge0: port 1(bridge_slave_0) entered disabled state [ 955.277481][T17523] bridge_slave_0: entered allmulticast mode [ 956.676357][ T29] audit: type=1400 audit(1773398825.027:1816): avc: denied { create } for pid=17550 comm="syz.0.2952" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 956.676657][T17523] bridge_slave_0: entered promiscuous mode [ 956.705602][T17523] bridge0: port 2(bridge_slave_1) entered blocking state [ 956.709809][ T5871] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 956.712851][T17523] bridge0: port 2(bridge_slave_1) entered disabled state [ 956.727965][T17523] bridge_slave_1: entered allmulticast mode [ 956.735300][T17523] bridge_slave_1: entered promiscuous mode [ 956.762506][ T5128] Bluetooth: hci0: command tx timeout [ 956.809372][T17523] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 956.826152][T17523] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 956.867762][ T29] audit: type=1400 audit(1773398825.092:1817): avc: denied { sys_admin } for pid=17550 comm="syz.0.2952" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 956.887107][T17523] team0: Port device team_slave_0 added [ 956.910355][T17523] team0: Port device team_slave_1 added [ 956.956224][ T29] audit: type=1400 audit(1773398826.159:1818): avc: denied { ioctl } for pid=17558 comm="syz.1.2954" path="socket:[61697]" dev="sockfs" ino=61697 ioctlcmd=0x5864 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 956.959949][T17523] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 957.026654][T17523] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 957.173308][T17523] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 957.200822][ T29] audit: type=1400 audit(1773398826.374:1819): avc: denied { setopt } for pid=17558 comm="syz.1.2954" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 957.230859][T17523] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 957.269694][T17523] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 957.363739][T17523] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 957.450861][T17523] hsr_slave_0: entered promiscuous mode [ 957.458450][T17523] hsr_slave_1: entered promiscuous mode [ 957.464732][T17523] debugfs: 'hsr0' already exists in 'hsr' [ 957.470662][T17523] Cannot create hsr debugfs directory [ 957.804340][ T5864] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 958.304251][T11707] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 958.312589][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 958.917224][ T5864] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 958.999836][ T5128] Bluetooth: hci0: command tx timeout [ 959.376509][T17523] netdevsim netdevsim2 netdevsim0 (unregistering): left allmulticast mode [ 959.395959][T17523] bridge0: port 3(netdevsim0) entered disabled state [ 959.714184][T17523] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 959.740918][T17523] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 959.758943][T17523] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 959.779594][T17523] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 959.843438][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 960.011644][ T5864] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 960.153315][ T29] audit: type=1400 audit(1773398829.144:1820): avc: denied { mount } for pid=17621 comm="syz.1.2967" name="/" dev="hugetlbfs" ino=62087 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 960.186455][T17523] 8021q: adding VLAN 0 to HW filter on device bond0 [ 960.650233][T17523] 8021q: adding VLAN 0 to HW filter on device team0 [ 960.711089][T17630] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 960.995261][ T29] audit: type=1400 audit(1773398829.696:1821): avc: denied { accept } for pid=17627 comm="syz.4.2968" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 961.048754][T11702] bridge0: port 1(bridge_slave_0) entered blocking state [ 961.055846][T11702] bridge0: port 1(bridge_slave_0) entered forwarding state [ 961.142017][ T5864] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 961.151748][ T1108] bridge0: port 2(bridge_slave_1) entered blocking state [ 961.158970][ T1108] bridge0: port 2(bridge_slave_1) entered forwarding state [ 961.218807][T14642] usb 5-1: new high-speed USB device number 98 using dummy_hcd [ 961.226536][ T5128] Bluetooth: hci0: command tx timeout [ 962.122941][T17647] sctp: [Deprecated]: syz.0.2972 (pid 17647) Use of int in max_burst socket option. [ 962.122941][T17647] Use struct sctp_assoc_value instead [ 962.250726][ T5942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 962.479056][T17523] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 962.915393][T17665] input: syz0 as /devices/virtual/input/input69 [ 962.941646][T17523] veth0_vlan: entered promiscuous mode [ 963.166137][T17665] net veth1_virt_wifi c@0: renamed from virt_wifi0 [ 963.286272][T17523] veth1_vlan: entered promiscuous mode [ 963.318268][T17523] veth0_macvtap: entered promiscuous mode [ 963.327401][T17523] veth1_macvtap: entered promiscuous mode [ 963.471328][ T5864] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 963.483207][ T5128] Bluetooth: hci0: command tx timeout [ 963.965327][T11702] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 963.973762][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 964.080277][T17523] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 964.128417][T17523] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 964.161163][T11702] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 964.181898][T11702] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 964.219302][T11702] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 964.238916][T11702] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 964.279889][T17676] 9p: Bad value for 'rfdno' [ 964.328791][T14642] usb 5-1: unable to get BOS descriptor or descriptor too short [ 964.338870][T14642] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 964.346522][T14642] usb 5-1: can't read configurations, error -71 [ 964.593098][ T5864] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 964.600654][T17684] netlink: 'syz.1.2982': attribute type 1 has an invalid length. [ 964.626697][T11702] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 964.682785][T11702] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 965.628067][T17689] netlink: 232 bytes leftover after parsing attributes in process `syz.1.2984'. [ 965.739750][T10180] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 965.785345][ T7891] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 965.793212][ T7891] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 965.995663][ T9998] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 966.658267][ T9998] usb 2-1: Using ep0 maxpacket: 16 [ 966.948279][ T5871] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 967.049783][ T9998] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 967.049827][ T9998] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 967.049852][ T9998] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 967.049871][ T9998] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 967.049891][ T9998] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 967.060360][ T9998] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 967.060393][ T9998] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 967.060412][ T9998] usb 2-1: Manufacturer: syz [ 967.074217][ T9998] usb 2-1: config 0 descriptor?? [ 967.674364][ T9998] rc_core: IR keymap rc-hauppauge not found [ 967.674386][ T9998] Registered IR keymap rc-empty [ 967.674489][ T9998] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 967.694328][ T9998] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 967.727119][ T9998] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 968.103922][T10180] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 968.680884][ T9998] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input70 [ 968.696269][ T9998] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 968.714720][ T9998] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 968.732638][ T9998] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 968.762957][ T9998] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 968.795072][ T9998] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 968.816669][ T9998] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 968.848872][ T9998] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 968.860504][ T29] audit: type=1400 audit(1773398837.295:1822): avc: denied { setopt } for pid=17732 comm="syz.4.2993" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 968.869810][ T9998] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 968.902452][ T9998] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 969.011992][ T9998] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 969.040449][T17734] bridge3: entered allmulticast mode [ 969.041782][ T9998] mceusb 2-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 969.041796][ T9998] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 969.050553][T17734] team0: Port device bridge3 added [ 969.572434][T14642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 969.688917][T17728] ceph: No mds server is up or the cluster is laggy [ 969.695807][T17729] ceph: No mds server is up or the cluster is laggy [ 971.025222][T11702] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 971.033497][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 971.048153][T14642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 971.178407][T14642] usb 2-1: USB disconnect, device number 87 [ 971.341492][T17753] netlink: 'syz.0.2995': attribute type 4 has an invalid length. [ 971.633141][T17760] Bluetooth: MGMT ver 1.23 [ 971.738290][T17763] netlink: 'syz.0.2995': attribute type 4 has an invalid length. [ 972.342678][T10180] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 972.631067][ T5818] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 972.664270][ T5818] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 972.674122][ T5818] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 972.683621][ T5818] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 972.695007][ T5818] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 972.843514][ T1154] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 972.879092][T17769] lo speed is unknown, defaulting to 1000 [ 972.887431][T17769] lo speed is unknown, defaulting to 1000 [ 972.899058][T17769] lo speed is unknown, defaulting to 1000 [ 972.937080][T17772] loop5: detected capacity change from 0 to 7 [ 972.952789][T17772] Dev loop5: unable to read RDB block 7 [ 972.958835][T17772] loop5: unable to read partition table [ 972.985497][T17772] loop5: partition table beyond EOD, truncated [ 973.000795][T17769] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 973.032794][ T1154] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 973.090945][T17772] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 973.119356][T17769] lo speed is unknown, defaulting to 1000 [ 973.199233][T17769] lo speed is unknown, defaulting to 1000 [ 973.822592][ T29] audit: type=1400 audit(1773398841.918:1823): avc: denied { create } for pid=17779 comm="syz.3.3005" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 973.911602][ T1154] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 973.927624][ T29] audit: type=1400 audit(1773398841.927:1824): avc: denied { bind } for pid=17779 comm="syz.3.3005" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 973.952095][T17769] lo speed is unknown, defaulting to 1000 [ 973.961317][T17766] lo speed is unknown, defaulting to 1000 [ 973.970187][T17769] lo speed is unknown, defaulting to 1000 [ 973.982046][T17769] lo speed is unknown, defaulting to 1000 [ 974.072453][T17769] lo speed is unknown, defaulting to 1000 [ 974.843650][T10180] usb 1-1: new high-speed USB device number 94 using dummy_hcd [ 974.967689][T17792] vlan2: entered allmulticast mode [ 974.972490][ T5818] Bluetooth: hci3: command tx timeout [ 974.982229][T17792] dummy0: entered allmulticast mode [ 975.001402][T17792] bridge0: port 3(vlan2) entered blocking state [ 975.009068][T17792] bridge0: port 3(vlan2) entered disabled state [ 975.036278][T17799] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 975.229305][T17792] vlan2: entered promiscuous mode [ 975.234405][T17792] dummy0: entered promiscuous mode [ 975.239665][T10180] usb 1-1: device descriptor read/64, error -71 [ 975.556992][T17766] chnl_net:caif_netlink_parms(): no params data found [ 975.559552][T10180] usb 1-1: new high-speed USB device number 95 using dummy_hcd [ 975.869326][ T29] audit: type=1400 audit(1773398843.836:1825): avc: denied { getopt } for pid=17809 comm="syz.2.3010" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 975.897469][T10180] usb 1-1: device descriptor read/64, error -71 [ 976.040397][T10180] usb usb1-port1: attempt power cycle [ 976.249731][ T1154] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 976.307498][ T1154] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 976.360838][ T1154] bond0 (unregistering): Released all slaves [ 976.365448][ T1154] bond1 (unregistering): Released all slaves [ 976.530258][ T1154] bond2 (unregistering): Released all slaves [ 976.631819][ T1154] bond3 (unregistering): Released all slaves [ 976.656931][T10180] usb 1-1: new high-speed USB device number 96 using dummy_hcd [ 976.683178][T10180] usb 1-1: device descriptor read/8, error -71 [ 976.950107][T10180] usb 1-1: new high-speed USB device number 97 using dummy_hcd [ 977.013432][T10180] usb 1-1: device descriptor read/8, error -71 [ 977.105470][T17830] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 977.140131][T10180] usb usb1-port1: unable to enumerate USB device [ 977.177741][T17830] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 977.207416][ T5818] Bluetooth: hci3: command tx timeout [ 977.220770][T17766] bridge0: port 1(bridge_slave_0) entered blocking state [ 977.238173][T17766] bridge0: port 1(bridge_slave_0) entered disabled state [ 977.255384][T17830] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 977.286516][T17766] bridge_slave_0: entered allmulticast mode [ 977.295640][T17830] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 977.312490][T17766] bridge_slave_0: entered promiscuous mode [ 977.343613][T17830] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 977.356418][T17766] bridge0: port 2(bridge_slave_1) entered blocking state [ 977.374688][T17830] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 977.385199][T17766] bridge0: port 2(bridge_slave_1) entered disabled state [ 977.400896][T17766] bridge_slave_1: entered allmulticast mode [ 977.428586][T17766] bridge_slave_1: entered promiscuous mode [ 977.566697][T17766] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 977.582078][T17766] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 977.677448][T17766] team0: Port device team_slave_0 added [ 977.716204][T17766] team0: Port device team_slave_1 added [ 978.025424][T10180] usb 4-1: new high-speed USB device number 95 using dummy_hcd [ 978.082029][T17766] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 978.082040][T17766] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 978.082054][T17766] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 978.089046][T17766] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 978.089058][T17766] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 978.089072][T17766] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 978.190425][ T1154] dummy0: left promiscuous mode [ 978.214526][T10180] usb 4-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 978.234055][ T1154] hsr_slave_0: left promiscuous mode [ 978.280896][T10180] usb 4-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 978.280925][T10180] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 978.280944][T10180] usb 4-1: Product: syz [ 978.281012][T10180] usb 4-1: Manufacturer: syz [ 978.281045][T10180] usb 4-1: SerialNumber: syz [ 978.290489][ T1154] hsr_slave_1: left promiscuous mode [ 978.302538][T10180] usb 4-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 978.428228][ T1154] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 978.493642][ T1154] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 978.493740][T17859] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3017'. [ 978.494562][ T1154] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 978.518668][ T1154] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 978.548815][ T1154] veth1_macvtap: left promiscuous mode [ 978.554844][ T1154] veth0_macvtap: left promiscuous mode [ 978.560824][ T1154] veth1_vlan: left promiscuous mode [ 978.567052][ T1154] veth0_vlan: left promiscuous mode [ 979.074518][T17766] hsr_slave_0: entered promiscuous mode [ 979.080970][T17766] hsr_slave_1: entered promiscuous mode [ 979.098947][T17766] debugfs: 'hsr0' already exists in 'hsr' [ 979.110752][T17766] Cannot create hsr debugfs directory [ 979.133283][T17843] lo speed is unknown, defaulting to 1000 [ 979.476474][T17873] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 979.503256][T10180] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 979.591146][T17873] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 979.640436][T10180] dvbdev: DVB: registering new adapter (774 Friio White ISDB-T USB2.0) [ 979.649586][T10180] usb 4-1: media controller created [ 979.680538][T10180] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 979.815128][T10180] usb 4-1: USB disconnect, device number 95 [ 980.562185][T17897] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 80:00:00:00:00:85 [ 980.711024][T17897] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3023'. [ 981.577296][T17766] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 981.675522][T17766] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 981.742115][T17766] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 982.096279][T17766] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 982.734573][T17935] 9p: Bad value for 'rfdno' [ 982.924536][T17766] 8021q: adding VLAN 0 to HW filter on device bond0 [ 983.004396][T17766] 8021q: adding VLAN 0 to HW filter on device team0 [ 983.164273][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 983.171436][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 983.192042][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 983.199149][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 983.648564][ T5864] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 983.714864][T17960] netlink: 312 bytes leftover after parsing attributes in process `syz.4.3032'. [ 983.811180][ T5864] usb 4-1: Using ep0 maxpacket: 32 [ 983.824206][ T5864] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 983.835981][ T5864] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xB7, changing to 0x87 [ 983.869216][ T5864] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 983.914816][T17766] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 983.962829][ T5864] usb 4-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 983.973342][ T5864] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 983.983983][ T5864] usb 4-1: Product: syz [ 984.011083][ T5864] usb 4-1: Manufacturer: syz [ 984.028706][ T5864] usb 4-1: SerialNumber: syz [ 984.085284][ T5864] usb 4-1: config 0 descriptor?? [ 984.152450][T17766] veth0_vlan: entered promiscuous mode [ 984.175738][ T5864] input: Generic X-Box pad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input71 [ 984.261868][T17766] veth1_vlan: entered promiscuous mode [ 984.398448][T17766] veth0_macvtap: entered promiscuous mode [ 984.424416][T17766] veth1_macvtap: entered promiscuous mode [ 984.522595][T17766] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 984.598491][T17766] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 984.662595][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 984.674552][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 984.752803][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 984.961402][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 985.261863][ T29] audit: type=1400 audit(1773398852.642:1826): avc: denied { ioctl } for pid=17982 comm="syz.2.3036" path="/12/file0/file0" dev="fuse" ino=64 ioctlcmd=0x922 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 985.390212][ T54] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 985.464244][ T54] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 985.688949][ T54] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 985.703134][ T54] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 987.082702][T14658] usb 4-1: USB disconnect, device number 96 [ 987.082758][ C1] xpad 4-1:0.0: xpad_irq_out - usb_submit_urb failed with result -19 [ 987.442272][T18021] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3038'. [ 988.195436][T10180] hid (null): unknown global tag 0xe [ 988.213608][T10180] hid-generic 0004:A35D:0000.0014: unknown main item tag 0x7 [ 988.243559][T10180] hid-generic 0004:A35D:0000.0014: unknown main item tag 0x7 [ 988.255631][T18032] FAULT_INJECTION: forcing a failure. [ 988.255631][T18032] name failslab, interval 1, probability 0, space 0, times 0 [ 988.281408][T10180] hid-generic 0004:A35D:0000.0014: unknown global tag 0xe [ 988.302971][T10180] hid-generic 0004:A35D:0000.0014: item 0 4 1 14 parsing failed [ 988.312362][T18032] CPU: 1 UID: 0 PID: 18032 Comm: syz.2.3042 Tainted: G L syzkaller #0 PREEMPT(full) [ 988.312395][T18032] Tainted: [L]=SOFTLOCKUP [ 988.312402][T18032] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 988.312412][T18032] Call Trace: [ 988.312418][T18032] [ 988.312425][T18032] dump_stack_lvl+0x100/0x190 [ 988.312459][T18032] should_fail_ex.cold+0x5/0xa [ 988.312483][T18032] should_failslab+0xc2/0x120 [ 988.312502][T18032] kmem_cache_alloc_node_noprof+0x81/0x6f0 [ 988.312528][T18032] ? __alloc_skb+0x140/0x710 [ 988.312553][T18032] __alloc_skb+0x140/0x710 [ 988.312572][T18032] ? __alloc_skb+0x5b7/0x710 [ 988.312591][T18032] ? __pfx___alloc_skb+0x10/0x10 [ 988.312609][T18032] ? is_bpf_text_address+0x8a/0x1a0 [ 988.312634][T18032] ? is_bpf_text_address+0x8a/0x1a0 [ 988.312659][T18032] ? bpf_ksym_find+0x128/0x1c0 [ 988.312679][T18032] alloc_skb_with_frags+0xe0/0x810 [ 988.312703][T18032] ? __lock_acquire+0x4a5/0x2630 [ 988.312733][T18032] ? arch_stack_walk+0xa6/0xf0 [ 988.312757][T18032] sock_alloc_send_pskb+0x801/0x980 [ 988.312784][T18032] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 988.312809][T18032] ? __lock_acquire+0x4a5/0x2630 [ 988.312839][T18032] __ip_append_data+0x227d/0x4690 [ 988.312870][T18032] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 988.312893][T18032] ? find_held_lock+0x2b/0x80 [ 988.312913][T18032] ? ip_dst_mtu_maybe_forward.constprop.0+0x3df/0x750 [ 988.312957][T18032] ? ip_dst_mtu_maybe_forward.constprop.0+0x3e9/0x750 [ 988.312991][T18032] ? __pfx___ip_append_data+0x10/0x10 [ 988.313024][T18032] ip_make_skb+0x28b/0x310 [ 988.313052][T18032] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 988.313078][T18032] ? __pfx_ip_make_skb+0x10/0x10 [ 988.313118][T18032] ? udp_sendmsg+0x17b6/0x2890 [ 988.313141][T18032] udp_sendmsg+0x17b6/0x2890 [ 988.313167][T18032] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 988.313192][T18032] ? __pfx_udp_sendmsg+0x10/0x10 [ 988.313216][T18032] ? tomoyo_supervisor+0x1e7/0x1340 [ 988.313248][T18032] ? __pfx_tomoyo_supervisor+0x10/0x10 [ 988.313280][T18032] ? up_write+0x290/0x4f0 [ 988.313313][T18032] ? __lock_acquire+0x4a5/0x2630 [ 988.313344][T18032] udpv6_sendmsg+0x156c/0x2f60 [ 988.313366][T18032] ? find_held_lock+0x2b/0x80 [ 988.313397][T18032] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 988.313449][T18032] ? __local_bh_enable_ip+0x9e/0x120 [ 988.313474][T18032] ? lockdep_hardirqs_on+0x78/0x100 [ 988.313496][T18032] ? inet_autobind+0x145/0x1a0 [ 988.313520][T18032] ? __local_bh_enable_ip+0x9e/0x120 [ 988.313541][T18032] ? inet_autobind+0x14a/0x1a0 [ 988.313565][T18032] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 988.313587][T18032] ? inet6_sendmsg+0x105/0x140 [ 988.313608][T18032] inet6_sendmsg+0x105/0x140 [ 988.313630][T18032] ____sys_sendmsg+0x704/0xb70 [ 988.313660][T18032] ? __pfx_____sys_sendmsg+0x10/0x10 [ 988.313699][T18032] ___sys_sendmsg+0x190/0x1e0 [ 988.313728][T18032] ? __pfx____sys_sendmsg+0x10/0x10 [ 988.313788][T18032] __sys_sendmsg+0x170/0x220 [ 988.313811][T18032] ? __pfx___sys_sendmsg+0x10/0x10 [ 988.313850][T18032] do_syscall_64+0x106/0xf80 [ 988.313871][T18032] ? clear_bhb_loop+0x40/0x90 [ 988.313894][T18032] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 988.313912][T18032] RIP: 0033:0x7fe407d9c799 [ 988.313934][T18032] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 988.313952][T18032] RSP: 002b:00007fe408b8c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 988.313969][T18032] RAX: ffffffffffffffda RBX: 00007fe408015fa0 RCX: 00007fe407d9c799 [ 988.313980][T18032] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000003 [ 988.313990][T18032] RBP: 00007fe408b8c090 R08: 0000000000000000 R09: 0000000000000000 [ 988.314000][T18032] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 988.314011][T18032] R13: 00007fe408016038 R14: 00007fe408015fa0 R15: 00007ffec83abab8 [ 988.314036][T18032] [ 988.774590][T10180] hid-generic 0004:A35D:0000.0014: probe with driver hid-generic failed with error -22 [ 989.057956][T18042] ip6gre1: entered promiscuous mode [ 989.126834][T18042] ip6gre1: entered allmulticast mode [ 989.284043][T18038] Mount JFS Failure: -5 [ 989.379140][T18062] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3051'. [ 989.594455][T18056] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3049'. [ 989.701495][T18066] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 990.646695][T18097] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3057'. [ 991.069002][T18121] gfs2: path_lookup on c::;NL;o$: returned error -2 [ 991.131611][T17507] udevd[17507]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 991.151164][T18120] genev1: entered allmulticast mode [ 991.253340][T17507] udevd[17507]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 991.502604][ T5128] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 991.515960][ T5128] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 991.531653][ T5128] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 991.540813][ T5128] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 991.550503][ T5128] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 991.689982][T18129] lo speed is unknown, defaulting to 1000 [ 992.034149][ T9998] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 992.225839][ T9998] usb 4-1: Using ep0 maxpacket: 8 [ 992.241578][ T9998] usb 4-1: unable to get BOS descriptor or descriptor too short [ 992.250345][ T9998] usb 4-1: config 1 interface 0 has no altsetting 0 [ 992.400675][ T9998] usb 4-1: New USB device found, idVendor=0c45, idProduct=760b, bcdDevice= 0.40 [ 992.410253][ T9998] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 992.423564][ T9998] usb 4-1: Product: syz [ 992.427755][ T9998] usb 4-1: Manufacturer: syz [ 992.462474][T18129] chnl_net:caif_netlink_parms(): no params data found [ 992.469721][ T9998] usb 4-1: SerialNumber: syz [ 992.894168][T11703] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 992.907020][T11703] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 993.142079][T18129] bridge0: port 1(bridge_slave_0) entered blocking state [ 993.158626][T18129] bridge0: port 1(bridge_slave_0) entered disabled state [ 993.169630][T18129] bridge_slave_0: entered allmulticast mode [ 993.192162][T18129] bridge_slave_0: entered promiscuous mode [ 993.204390][T18129] bridge0: port 2(bridge_slave_1) entered blocking state [ 993.229125][T18129] bridge0: port 2(bridge_slave_1) entered disabled state [ 993.245194][T18129] bridge_slave_1: entered allmulticast mode [ 993.256095][T18129] bridge_slave_1: entered promiscuous mode [ 993.282915][ T9998] usbhid 4-1:1.0: can't add hid device: -71 [ 993.289777][ T9998] usbhid 4-1:1.0: probe with driver usbhid failed with error -71 [ 993.314611][T11703] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 993.324509][ T9998] usb 4-1: USB disconnect, device number 97 [ 993.346697][T11703] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 993.501486][T11703] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 993.600295][T11703] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 993.661089][T18129] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 993.697164][T11703] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 993.711232][T11703] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 993.753068][T18129] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 993.778954][ T5128] Bluetooth: hci4: command tx timeout [ 993.836712][T18129] team0: Port device team_slave_0 added [ 993.873946][T18129] team0: Port device team_slave_1 added [ 994.017257][T18129] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 994.025686][T18129] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 994.124255][T18129] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 994.342832][T18180] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3067'. [ 995.187569][T18178] netlink: 'syz.1.3068': attribute type 49 has an invalid length. [ 995.195492][ T9999] usb 4-1: new high-speed USB device number 98 using dummy_hcd [ 995.361812][T18129] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 995.372859][T18129] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 995.400775][ T9999] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 995.414001][ T9999] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 995.423727][T18129] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 995.434968][ T9999] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 995.456297][ T9999] usb 4-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 995.479755][ T9999] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 995.720041][ T9999] usb 4-1: Product: syz [ 995.731989][ T9999] usb 4-1: Manufacturer: syz [ 995.745120][ T9999] usb 4-1: SerialNumber: syz [ 995.750143][T18129] hsr_slave_0: entered promiscuous mode [ 995.778720][T18129] hsr_slave_1: entered promiscuous mode [ 995.785612][ T9999] usb 4-1: config 0 descriptor?? [ 995.799538][T18129] debugfs: 'hsr0' already exists in 'hsr' [ 995.825175][T18129] Cannot create hsr debugfs directory [ 995.875474][T11703] bridge_slave_1: left allmulticast mode [ 995.891681][T11703] bridge_slave_1: left promiscuous mode [ 995.901959][T11703] bridge0: port 2(bridge_slave_1) entered disabled state [ 996.003365][ T5128] Bluetooth: hci4: command tx timeout [ 996.044719][ T9999] adutux 4-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 996.084540][T11703] bridge_slave_0: left allmulticast mode [ 996.104577][T11703] bridge_slave_0: left promiscuous mode [ 996.138151][T11703] bridge0: port 1(bridge_slave_0) entered disabled state [ 996.155314][T18191] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 996.205702][T11703] batman_adv: batadv0: Interface deactivated: gretap1 [ 997.545653][T10180] usb 4-1: USB disconnect, device number 98 [ 998.230515][ T5128] Bluetooth: hci4: command tx timeout [ 998.252965][T18224] trusted_key: encrypted_key: master key parameter 'ed:syz' is invalid [ 998.321937][T18224] trusted_key: encrypted_key: keylen parameter is missing [ 998.482021][T18231] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3078'. [ 998.828531][T11703] batman_adv: batadv0: Removing interface: gretap1 [ 999.004820][T11703] bond2 (unregistering): (slave gretap2): Releasing active interface [ 999.383676][T11703] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 999.440695][T11703] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 999.478680][T11703] bond0 (unregistering): Released all slaves [ 999.526128][T11703] bond1 (unregistering): Released all slaves [ 999.886320][T11703] bond2 (unregistering): Released all slaves [ 1000.833097][ T5128] Bluetooth: hci4: command tx timeout [ 1000.853140][ T29] audit: type=1400 audit(1773398866.754:1827): avc: denied { getopt } for pid=18244 comm="syz.2.3082" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1000.900735][T11703] : left promiscuous mode [ 1001.084294][T11703] tipc: Left network mode [ 1001.133794][ T5878] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 1001.147995][T11703] IPVS: stopping backup sync thread 16132 ... [ 1001.376773][ T5878] usb 3-1: Using ep0 maxpacket: 8 [ 1001.448526][ T5878] usb 3-1: New USB device found, idVendor=0471, idProduct=0313, bcdDevice=81.d5 [ 1001.461943][ T5878] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1002.101053][T18272] overlayfs: failed to resolve './file1': -2 [ 1002.119202][ T5878] usb 3-1: Product: syz [ 1002.123382][ T5878] usb 3-1: Manufacturer: syz [ 1002.179998][ T29] audit: type=1400 audit(1773398868.476:1828): avc: denied { mounton } for pid=18269 comm="syz.1.3087" path="/" dev="autofs" ino=65271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=dir permissive=1 [ 1002.243449][ T5878] usb 3-1: SerialNumber: syz [ 1002.259856][ T5878] usb 3-1: config 0 descriptor?? [ 1002.310028][ T5878] pwc: Philips PCVC720K/40 (ToUCam XS) USB webcam detected. [ 1002.519232][ T5878] pwc: send_video_command error -71 [ 1002.542722][ T5878] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 1002.550310][ T5878] Philips webcam 3-1:0.0: probe with driver Philips webcam failed with error -71 [ 1002.550404][ T29] audit: type=1400 audit(1773398868.822:1829): avc: denied { getopt } for pid=18283 comm="syz.0.3090" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1002.568048][ T5878] usb 3-1: USB disconnect, device number 96 [ 1002.648594][T11703] dummy0: left promiscuous mode [ 1002.813710][T11703] hsr_slave_0: left promiscuous mode [ 1002.822220][T11703] hsr_slave_1: left promiscuous mode [ 1002.829373][T11703] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1002.841104][T11703] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1002.850391][T11703] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1003.114884][T11703] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1003.313857][T11703] veth1_macvtap: left promiscuous mode [ 1003.319418][T11703] veth0_macvtap: left promiscuous mode [ 1003.652233][T11703] batadv1 (unregistering): left allmulticast mode [ 1003.694743][T11703] team0 (unregistering): Port device batadv1 removed [ 1004.707228][T11703] team_slave_1 (unregistering): left allmulticast mode [ 1004.742630][T11703] team0 (unregistering): Port device team_slave_1 removed [ 1004.829567][T11703] team_slave_0 (unregistering): left allmulticast mode [ 1004.880774][T11703] team0 (unregistering): Port device team_slave_0 removed [ 1005.352155][ T5878] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 1005.609160][ T5878] usb 2-1: Using ep0 maxpacket: 8 [ 1005.728573][ T29] audit: type=1400 audit(1773398871.798:1830): avc: denied { shutdown } for pid=18320 comm="syz.0.3101" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1005.731961][ T5878] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1006.101172][ T5878] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1006.135714][ T5878] usb 2-1: New USB device found, idVendor=07c0, idProduct=1504, bcdDevice=30.22 [ 1006.151355][ T5878] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1006.213052][ T5878] usb 2-1: config 0 descriptor?? [ 1006.232125][ T5878] iowarrior 2-1:0.0: no interrupt-out endpoint found [ 1006.554569][ T29] audit: type=1400 audit(1773398872.565:1831): avc: denied { bind } for pid=18336 comm="syz.2.3104" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 1006.613971][T18342] libceph: resolve 'c' (ret=-3): failed [ 1006.811704][T18129] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1006.839561][T18344] fuse: Bad value for 'group_id' [ 1006.849756][T18344] fuse: Bad value for 'group_id' [ 1006.892085][T18129] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1006.904741][T11703] IPVS: stop unused estimator thread 0... [ 1006.934856][T18343] block device autoloading is deprecated and will be removed. [ 1006.954522][T18129] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1006.994024][T18129] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1007.144718][T18129] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1007.171570][T18129] 8021q: adding VLAN 0 to HW filter on device team0 [ 1007.194098][T11707] bridge0: port 1(bridge_slave_0) entered blocking state [ 1007.201217][T11707] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1007.282026][ T1108] bridge0: port 2(bridge_slave_1) entered blocking state [ 1007.289167][ T1108] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1008.398378][ T5864] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 1008.468022][T18129] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1008.579718][ T5864] usb 4-1: Using ep0 maxpacket: 16 [ 1008.588317][ T5864] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1008.632215][ T5864] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1008.661042][ T5864] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1008.689736][ T5864] usb 4-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 1008.712467][ T5864] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1008.745867][ T5864] usb 4-1: config 0 descriptor?? [ 1008.867140][T18410] netlink: 'syz.0.3115': attribute type 1 has an invalid length. [ 1008.907949][T18410] team0: Device gtp0 is of different type [ 1009.040872][ T29] audit: type=1400 audit(1773398874.895:1832): avc: denied { write } for pid=18387 comm="syz.2.3114" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 1009.065257][T18388] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3114'. [ 1009.090078][T18129] veth0_vlan: entered promiscuous mode [ 1009.098540][T18388] IPv6: NLM_F_CREATE should be specified when creating new route [ 1009.111029][T18129] veth1_vlan: entered promiscuous mode [ 1009.161607][T18129] veth0_macvtap: entered promiscuous mode [ 1009.183411][T18129] veth1_macvtap: entered promiscuous mode [ 1009.261169][ T29] audit: type=1400 audit(1773398875.101:1833): avc: denied { lock } for pid=18415 comm="syz.2.3116" path="socket:[66669]" dev="sockfs" ino=66669 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 1009.285802][T18416] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=18416 comm=syz.2.3116 [ 1009.316219][ T5864] shield 0003:0955:7214.0015: unknown main item tag 0x0 [ 1009.327503][T18129] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1009.334803][ T5864] shield 0003:0955:7214.0015: unknown main item tag 0x0 [ 1009.347510][ T5864] shield 0003:0955:7214.0015: unknown main item tag 0x0 [ 1009.357022][ T5864] shield 0003:0955:7214.0015: unknown main item tag 0x0 [ 1009.368346][ T5864] shield 0003:0955:7214.0015: unknown main item tag 0x0 [ 1009.379145][T18129] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1009.392697][ T5864] input: HID 0955:7214 Haptics as /devices/virtual/input/input72 [ 1009.427487][ T5864] shield 0003:0955:7214.0015: Registered Thunderstrike controller [ 1009.438417][ T5864] shield 0003:0955:7214.0015: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.3-1/input0 [ 1009.455675][ T54] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1009.465033][ T54] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1009.489490][ T54] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1009.500498][ T54] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1009.551515][T14664] usb 3-1: new high-speed USB device number 97 using dummy_hcd [ 1009.660210][ T1108] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1009.708972][T14642] usb 2-1: USB disconnect, device number 88 [ 1009.736875][ T1108] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1009.738955][T14664] usb 3-1: New USB device found, idVendor=093a, idProduct=2476, bcdDevice= d.5b [ 1009.764434][T14664] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1009.800711][T14664] usb 3-1: Product: syz [ 1009.819056][T14664] usb 3-1: Manufacturer: syz [ 1009.824456][T11702] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1009.843902][T14664] usb 3-1: SerialNumber: syz [ 1009.849088][T11702] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1010.136384][T18430] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 1010.136384][T18430] program syz.4.3061 not setting count and/or reply_len properly [ 1010.137575][T14664] gspca_main: pac207-2.14.0 probing 093a:2476 [ 1010.441449][T14664] gspca_pac207: Failed to read a register (index 0x0000, error -71) [ 1010.451555][T14664] uvcvideo 3-1:13.0: probe with driver uvcvideo failed with error -22 [ 1010.481772][T14664] usb 3-1: USB disconnect, device number 97 [ 1010.637468][T10180] shield 0003:0955:7214.0015: Failed to output Thunderstrike HOSTCMD request HID report due to -ESHUTDOWN [ 1010.663316][T10180] shield 0003:0955:7214.0015: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 1010.771360][T10180] shield 0003:0955:7214.0015: Failed to output Thunderstrike HOSTCMD request HID report due to -EPIPE [ 1010.802758][ T5864] usb 4-1: reset high-speed USB device number 99 using dummy_hcd [ 1010.836984][T10180] shield 0003:0955:7214.0015: Failed to output Thunderstrike HOSTCMD request HID report due to -EPIPE [ 1011.032219][ T5864] usb 4-1: device descriptor read/64, error -32 [ 1011.194369][ T29] audit: type=1400 audit(1773398876.907:1834): avc: denied { read } for pid=18441 comm="syz.2.3120" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 1011.371191][ T5864] usb 4-1: reset high-speed USB device number 99 using dummy_hcd [ 1011.562236][ T5864] usb 4-1: device descriptor read/64, error -32 [ 1011.839017][ T5818] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1011.851305][ T5818] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1011.860078][ T5818] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1011.867724][ T5818] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1011.875381][ T5818] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1011.903936][ T5864] usb 4-1: reset high-speed USB device number 99 using dummy_hcd [ 1012.143922][T18457] lo speed is unknown, defaulting to 1000 [ 1012.159716][ T5864] usb 4-1: device descriptor read/8, error -32 [ 1012.287637][T14664] usb 1-1: new high-speed USB device number 98 using dummy_hcd [ 1012.581277][ T5864] usb 4-1: reset high-speed USB device number 99 using dummy_hcd [ 1012.619408][ T5864] usb 4-1: device descriptor read/8, error -32 [ 1012.939954][ T5864] raw-gadget.1 gadget.3: failed to queue suspend event [ 1012.970812][T14664] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1012.970839][T14664] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1012.985311][T14664] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1012.985331][T14664] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1012.985342][T14664] usb 1-1: SerialNumber: syz [ 1012.995626][T14642] usb 4-1: USB disconnect, device number 99 [ 1013.080976][T14642] raw-gadget.1 gadget.3: failed to queue reset event [ 1013.152845][T14642] raw-gadget.1 gadget.3: failed to queue resume event [ 1013.201260][T18418] raw-gadget.1 gadget.3: failed to queue suspend event [ 1013.201496][T18418] raw-gadget.1 gadget.3: failed to queue disconnect event [ 1013.250872][T14642] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 1013.382658][T11703] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1013.428986][T18457] chnl_net:caif_netlink_parms(): no params data found [ 1013.553452][T11703] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1013.902308][T18476] loop8: detected capacity change from 0 to 7 [ 1013.997450][T18476] Dev loop8: unable to read RDB block 7 [ 1014.009963][T18476] loop8: AHDI p1 p2 [ 1014.015430][T11703] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1014.026591][T18476] loop8: partition table partially beyond EOD, truncated [ 1014.034934][T18476] loop8: p1 start 1702000233 is beyond EOD, truncated [ 1014.041949][ T5818] Bluetooth: hci2: command tx timeout [ 1014.103856][T18457] bridge0: port 1(bridge_slave_0) entered blocking state [ 1014.129489][T18457] bridge0: port 1(bridge_slave_0) entered disabled state [ 1014.160790][T18457] bridge_slave_0: entered allmulticast mode [ 1014.185030][T18457] bridge_slave_0: entered promiscuous mode [ 1014.264291][T11703] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1014.625664][T18457] bridge0: port 2(bridge_slave_1) entered blocking state [ 1014.658185][T18457] bridge0: port 2(bridge_slave_1) entered disabled state [ 1014.666024][T18457] bridge_slave_1: entered allmulticast mode [ 1014.677681][T18457] bridge_slave_1: entered promiscuous mode [ 1014.755824][ T976] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 1014.815869][T18457] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1014.846059][T18457] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1014.939350][ T976] usb 2-1: Using ep0 maxpacket: 32 [ 1014.961459][ T976] usb 2-1: config 0 has an invalid interface number: 35 but max is 0 [ 1014.986715][T18457] team0: Port device team_slave_0 added [ 1015.005854][ T976] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1015.037157][T18457] team0: Port device team_slave_1 added [ 1015.052271][ T976] usb 2-1: config 0 has no interface number 0 [ 1015.068955][T14664] usb 1-1: 0:2 : does not exist [ 1015.077453][ T976] usb 2-1: config 0 interface 35 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1015.088149][T14664] usb 1-1: unit 5: unexpected type 0x0b [ 1015.184413][ T976] usb 2-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 1015.218223][ T976] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1015.251414][T18457] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1015.259899][ T976] usb 2-1: Product: syz [ 1015.273486][ T976] usb 2-1: Manufacturer: syz [ 1015.283515][T18457] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1015.315853][ T976] usb 2-1: SerialNumber: syz [ 1015.334970][ T976] usb 2-1: config 0 descriptor?? [ 1015.372422][T14664] usb 1-1: USB disconnect, device number 98 [ 1015.384583][T18457] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1015.505713][T11703] bridge_slave_1: left allmulticast mode [ 1015.523315][T17507] udevd[17507]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1015.543645][T11703] bridge_slave_1: left promiscuous mode [ 1015.610753][T11703] bridge0: port 2(bridge_slave_1) entered disabled state [ 1015.787632][T11703] bridge_slave_0: left allmulticast mode [ 1015.832376][ T29] audit: type=1800 audit(1773398881.249:1835): pid=18485 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=set_data cause=unavailable-hash-algorithm comm="syz.1.3128" name="/newroot/19/pids.events" dev="tmpfs" ino=117 res=0 errno=0 [ 1015.835088][T18501] netlink: 64 bytes leftover after parsing attributes in process `syz.0.3131'. [ 1015.872307][T11703] bridge_slave_0: left promiscuous mode [ 1015.880231][T11703] bridge0: port 1(bridge_slave_0) entered disabled state [ 1015.968370][T14658] usb 2-1: USB disconnect, device number 89 [ 1016.262822][ T5818] Bluetooth: hci2: command tx timeout [ 1016.326468][ T5864] usb 1-1: new high-speed USB device number 99 using dummy_hcd [ 1016.522022][ T5864] usb 1-1: Using ep0 maxpacket: 32 [ 1016.535722][ T5864] usb 1-1: config index 0 descriptor too short (expected 65535, got 36) [ 1016.582688][ T5864] usb 1-1: config 127 has too many interfaces: 255, using maximum allowed: 32 [ 1016.622170][ T5864] usb 1-1: config 127 has 1 interface, different from the descriptor's value: 255 [ 1016.651977][T11703] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 1016.675213][ T5864] usb 1-1: config 127 has no interface number 0 [ 1016.698695][ T5864] usb 1-1: config 127 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 1016.749043][ T5864] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1016.892297][ T5864] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1017.427711][T11703] team0: Port device bridge3 removed [ 1017.474514][T11703] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1017.493499][T11703] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1017.516651][T11703] bond0 (unregistering): Released all slaves [ 1017.538523][T11703] bond1 (unregistering): Released all slaves [ 1017.676770][T18457] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1017.728262][T18457] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1017.787821][T18457] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1017.905264][ T5864] usb 1-1: string descriptor 0 read error: -71 [ 1017.928960][ T5864] hub 1-1:127.2: bad descriptor, ignoring hub [ 1017.965502][T11703] hma224): left promiscuous mode [ 1017.965876][ T5864] hub 1-1:127.2: probe with driver hub failed with error -5 [ 1018.077442][T18527] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3135'. [ 1018.090825][ T5864] usb 1-1: USB disconnect, device number 99 [ 1018.213666][T11703] tipc: Left network mode [ 1018.372777][T18457] hsr_slave_0: entered promiscuous mode [ 1018.396479][T18457] hsr_slave_1: entered promiscuous mode [ 1018.434859][T18457] debugfs: 'hsr0' already exists in 'hsr' [ 1018.440622][T18457] Cannot create hsr debugfs directory [ 1018.485090][ T5818] Bluetooth: hci2: command tx timeout [ 1018.613265][ T5864] usb 1-1: new high-speed USB device number 100 using dummy_hcd [ 1018.833947][ T5864] usb 1-1: config index 0 descriptor too short (expected 65535, got 36) [ 1018.867698][ T5864] usb 1-1: config 127 has too many interfaces: 255, using maximum allowed: 32 [ 1018.913067][ T5864] usb 1-1: config 127 has 1 interface, different from the descriptor's value: 255 [ 1018.949544][ T5864] usb 1-1: config 127 has no interface number 0 [ 1018.981778][ T5864] usb 1-1: config 127 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 1019.002721][ T5864] usb 1-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice= 0.40 [ 1019.015031][ T5864] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1019.481837][ T5864] usb 1-1: string descriptor 0 read error: -71 [ 1019.532725][ T5864] ttusbir 1-1:127.2: cannot find expected altsetting [ 1019.570895][ T5864] usb 1-1: USB disconnect, device number 100 [ 1019.581236][T11703] hsr_slave_0: left promiscuous mode [ 1019.623636][T11703] hsr_slave_1: left promiscuous mode [ 1019.653619][T11703] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1019.654706][T18552] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3140'. [ 1019.670234][ T976] usb 2-1: new full-speed USB device number 90 using dummy_hcd [ 1019.701511][T11703] batadv0: mtu less than device minimum [ 1019.725385][T11703] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1019.736765][T11703] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1019.747686][T11703] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1019.758490][T11703] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1019.769459][T11703] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1019.780860][T11703] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1019.792279][T11703] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1019.803575][T11703] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1019.814964][T11703] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1019.853869][T11703] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1019.862847][T11703] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1019.891402][T11703] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1019.941070][ T976] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1019.952848][ T976] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1019.969482][T11703] batman_adv: batadv0: Interface deactivated: dummy0 [ 1019.973242][ T976] usb 2-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 1019.985345][T11703] batman_adv: batadv0: Removing interface: dummy0 [ 1019.998884][ T976] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1020.022334][ T976] usb 2-1: config 0 descriptor?? [ 1020.036919][T11703] batadv_slave_1: left promiscuous mode [ 1020.051487][T11703] veth1_macvtap: left promiscuous mode [ 1020.069546][T11703] veth0_macvtap: left promiscuous mode [ 1020.075337][T11703] veth1_vlan: left promiscuous mode [ 1020.346129][T18562] sctp: [Deprecated]: syz.2.3141 (pid 18562) Use of int in max_burst socket option deprecated. [ 1020.346129][T18562] Use struct sctp_assoc_value instead [ 1020.771252][ T5818] Bluetooth: hci2: command tx timeout [ 1021.216335][ T976] usbhid 2-1:0.0: can't add hid device: -71 [ 1021.226199][ T976] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1021.381249][ T976] usb 2-1: USB disconnect, device number 90 [ 1021.474545][T11703] team0 (unregistering): Port device team_slave_1 removed [ 1021.479650][T11703] team0 (unregistering): Port device team_slave_0 removed [ 1021.583307][T18560] netlink: 'syz.4.3137': attribute type 1 has an invalid length. [ 1022.285507][ T29] audit: type=1400 audit(1773398887.285:1836): avc: denied { ioctl } for pid=18596 comm="syz.1.3147" path="socket:[67349]" dev="sockfs" ino=67349 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1022.294040][T11703] IPVS: stop unused estimator thread 0... [ 1022.319890][T18457] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1022.471958][T18457] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1022.592480][ T29] audit: type=1400 audit(1773398887.575:1837): avc: denied { connect } for pid=18596 comm="syz.1.3147" lport=5037 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1022.598949][T18457] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1022.738745][T18457] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1022.888621][T18616] "syz.0.3149" (18616) uses obsolete ecb(arc4) skcipher [ 1022.951453][T18616] input: syz1 as /devices/virtual/input/input74 [ 1022.968251][ T29] audit: type=1400 audit(1773398887.922:1838): avc: denied { setattr } for pid=18615 comm="syz.4.3150" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 1023.017921][ T5871] IPVS: starting estimator thread 0... [ 1023.027829][T18619] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=18619 comm=syz.4.3150 [ 1023.099441][T18457] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1023.133572][T18620] IPVS: using max 46 ests per chain, 110400 per kthread [ 1023.186322][T18457] 8021q: adding VLAN 0 to HW filter on device team0 [ 1023.230578][ T1108] bridge0: port 1(bridge_slave_0) entered blocking state [ 1023.237761][ T1108] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1023.256674][T11702] bridge0: port 2(bridge_slave_1) entered blocking state [ 1023.263837][T11702] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1023.665728][T18629] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3152'. [ 1023.676489][T18457] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1023.753039][T18457] veth0_vlan: entered promiscuous mode [ 1023.803089][T18457] veth1_vlan: entered promiscuous mode [ 1023.869770][T18457] veth0_macvtap: entered promiscuous mode [ 1023.923009][T18457] veth1_macvtap: entered promiscuous mode [ 1024.010555][T18457] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1024.051154][T18457] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1024.112452][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1024.183712][T18645] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2579 sclass=netlink_route_socket pid=18645 comm=syz.1.3157 [ 1024.210439][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1024.238696][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1024.277205][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1024.481735][T18650] netlink: 'syz.4.3158': attribute type 10 has an invalid length. [ 1024.498216][T11707] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1024.507850][T18650] bridge0: port 2(bridge_slave_1) entered disabled state [ 1024.515360][T18650] bridge0: port 1(bridge_slave_0) entered disabled state [ 1024.523046][ T5878] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 1024.547572][T18653] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3158'. [ 1024.560050][T11707] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1024.587359][T18650] bridge0: port 2(bridge_slave_1) entered blocking state [ 1024.594488][T18650] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1024.601872][T18650] bridge0: port 1(bridge_slave_0) entered blocking state [ 1024.608972][T18650] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1024.666461][T14642] libceph: connect (1)[c::]:6789 error -101 [ 1024.680936][T14642] libceph: mon0 (1)[c::]:6789 connect error [ 1024.682233][T18650] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 1024.715174][ T5878] usb 3-1: Using ep0 maxpacket: 16 [ 1024.740000][ T5878] usb 3-1: config 1 has an invalid interface number: 105 but max is 0 [ 1024.756659][ T5878] usb 3-1: config 1 has no interface number 0 [ 1024.784409][T18653] bridge_slave_1: left allmulticast mode [ 1024.789819][ T5878] usb 3-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 1024.826356][ T5878] usb 3-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 1024.833262][T18653] bridge_slave_1: left promiscuous mode [ 1024.842036][T18655] ceph: No mds server is up or the cluster is laggy [ 1024.874278][ T5878] usb 3-1: config 1 interface 105 has no altsetting 0 [ 1024.883541][T18653] bridge0: port 2(bridge_slave_1) entered disabled state [ 1024.900128][ T5878] usb 3-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 1024.936456][ T5878] usb 3-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 1024.966540][T18653] bridge_slave_0: left allmulticast mode [ 1024.972352][ T5878] usb 3-1: Product: syz [ 1024.976520][T18653] bridge_slave_0: left promiscuous mode [ 1025.006221][T18653] bridge0: port 1(bridge_slave_0) entered disabled state [ 1025.026494][ T5878] usb 3-1: Manufacturer: syz [ 1025.044907][ T5878] usb 3-1: SerialNumber: syz [ 1025.056422][ T29] audit: type=1400 audit(1773398889.878:1839): avc: denied { ioctl } for pid=18664 comm="syz.1.3160" path="socket:[68607]" dev="sockfs" ino=68607 ioctlcmd=0x534b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 1025.101077][T18653] bond0: (slave bridge0): Releasing backup interface [ 1025.108057][T18631] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1025.141702][T18631] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1025.222476][T18665] geneve1: entered promiscuous mode [ 1025.243992][T18665] macsec1: entered promiscuous mode [ 1025.254835][T18665] macsec1: entered allmulticast mode [ 1025.264188][T18665] geneve1: entered allmulticast mode [ 1025.280064][T18665] geneve1: left allmulticast mode [ 1025.292211][T18665] geneve1: left promiscuous mode [ 1025.335716][T11702] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1025.344815][T11702] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1025.498243][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 1025.526903][T18670] Invalid argument reading file caps for ./file0 [ 1025.541253][T18670] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3161'. [ 1025.604912][T18631] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1025.615045][T18631] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1025.674650][ T29] audit: type=1400 audit(1773398890.458:1840): avc: denied { nlmsg_read } for pid=18676 comm="syz.0.3164" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 1025.721678][T18679] binder: 18676:18679 ioctl c0306201 2000000004c0 returned -14 [ 1025.763163][ T5871] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 1025.837521][T14664] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 1025.901444][ T5871] usb 2-1: device descriptor read/64, error -71 [ 1026.008018][T14664] usb 4-1: Using ep0 maxpacket: 16 [ 1026.017620][T14664] usb 4-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 1026.032253][T14664] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1026.049465][T14664] usb 4-1: Product: syz [ 1026.059180][ T5878] aqc111 3-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 1026.071396][T14664] usb 4-1: Manufacturer: syz [ 1026.074116][ T5878] aqc111 3-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 1026.076792][ T5878] aqc111 3-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 1026.105708][T14664] usb 4-1: SerialNumber: syz [ 1026.119424][T14664] usb 4-1: config 0 descriptor?? [ 1026.123804][ T5878] aqc111 3-1:1.105 eth1: register 'aqc111' at usb-dummy_hcd.2-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter, 6e:64:f8:81:de:46 [ 1026.157652][ T5871] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 1026.160617][ T5878] usb 3-1: USB disconnect, device number 98 [ 1026.210337][ T5878] aqc111 3-1:1.105 eth1: unregister 'aqc111' usb-dummy_hcd.2-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter [ 1026.307239][ T5871] usb 2-1: device descriptor read/64, error -71 [ 1026.330839][ T5878] aqc111 3-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 1026.353782][ T5878] aqc111 3-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 1026.371111][ T5878] aqc111 3-1:1.105 eth1 (unregistered): Failed to write(0x61) reg index 0x0000: -19 [ 1026.437522][ T5871] usb usb2-port1: attempt power cycle [ 1026.584712][T14664] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 1026.608988][T14664] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1026.623666][ T29] audit: type=1400 audit(1773398891.347:1841): avc: denied { map } for pid=18700 comm="syz.0.3169" path="pipe:[69661]" dev="pipefs" ino=69661 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 1026.669254][T14664] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 1026.691423][T14664] usb 4-1: media controller created [ 1026.743491][T14664] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1026.809731][ T5871] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 1026.851967][ T5871] usb 2-1: device descriptor read/8, error -71 [ 1026.890844][T14664] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 1026.901313][T14664] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 1026.912185][ T29] audit: type=1326 audit(1773398891.618:1842): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18708 comm="syz.4.3170" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f3755d9c799 code=0x0 [ 1026.916320][ T5878] usb 1-1: new high-speed USB device number 101 using dummy_hcd [ 1027.108732][ T5871] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 1027.162108][ T5878] usb 1-1: Using ep0 maxpacket: 8 [ 1027.173423][ T5871] usb 2-1: device descriptor read/8, error -71 [ 1027.180776][ T5878] usb 1-1: config index 0 descriptor too short (expected 30, got 18) [ 1027.204925][ T5818] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 1027.215168][ T5818] Bluetooth: hci4: Injecting HCI hardware error event [ 1027.224928][ T5878] usb 1-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 1027.224950][ T5128] Bluetooth: hci4: hardware error 0x00 [ 1027.268524][T18675] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1027.282766][ T5878] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1027.313022][T18675] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1027.325308][ T5878] usb 1-1: Product: syz [ 1027.337130][ T5878] usb 1-1: Manufacturer: syz [ 1027.349073][ T5878] usb 1-1: SerialNumber: syz [ 1027.364493][ T5871] usb usb2-port1: unable to enumerate USB device [ 1027.386707][ T5878] usb 1-1: config 0 descriptor?? [ 1027.411410][ T5878] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 1027.443334][ T5878] usb 1-1: setting power ON [ 1027.447880][ T5878] dvb-usb: bulk message failed: -22 (2/0) [ 1027.491777][ T5878] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1027.525668][ T5878] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 1027.553749][ T5878] usb 1-1: media controller created [ 1027.602231][ T5878] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1027.643926][T18701] ------------[ cut here ]------------ [ 1027.649428][T18701] usb 4-1: BOGUS control dir, pipe 80006580 doesn't match bRequestType c0 [ 1027.658106][T18701] WARNING: drivers/usb/core/urb.c:411 at usb_submit_urb+0x1573/0x1910, CPU#0: syz.0.3169/18701 [ 1027.668470][T18701] Modules linked in: [ 1027.672958][T18701] CPU: 0 UID: 0 PID: 18701 Comm: syz.0.3169 Tainted: G L syzkaller #0 PREEMPT(full) [ 1027.684098][T18701] Tainted: [L]=SOFTLOCKUP [ 1027.688464][T18701] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 1027.698541][T18701] RIP: 0010:usb_submit_urb+0x157e/0x1910 [ 1027.704545][T18701] Code: d2 74 5d 48 89 54 24 40 e8 1f ed b7 fa 4c 89 ef e8 17 ab de fe 48 89 c6 48 8d 3d 2d 7b 95 09 48 8b 54 24 40 45 89 f8 44 89 f1 <67> 48 0f b9 3a e9 c7 ed ff ff e8 f3 ec b7 fa 89 ee bf ff 00 00 00 [ 1027.724432][T18701] RSP: 0018:ffffc9000457f760 EFLAGS: 00010283 [ 1027.730558][T18701] RAX: ffffffff8c80d5c0 RBX: ffff8880354ebf00 RCX: 0000000080006580 [ 1027.738609][T18701] RDX: ffff888077aeae20 RSI: ffffffff8c80d5c0 RDI: ffffffff90e645c0 [ 1027.746996][T18701] RBP: ffff88807bc5c058 R08: 00000000000000c0 R09: 0000000000000000 [ 1027.755314][T18701] R10: 0000000000000001 R11: 0000000000000000 R12: ffff888037751400 [ 1027.763539][T18701] R13: ffff88807bc5c0b0 R14: 0000000080006580 R15: 00000000000000c0 [ 1027.771598][T18701] FS: 00007fdb060ad6c0(0000) GS:ffff888124345000(0000) knlGS:0000000000000000 [ 1027.780825][T18701] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1027.787628][T18701] CR2: 000000110c436ad5 CR3: 0000000069b64000 CR4: 00000000003526f0 [ 1027.795629][T18701] Call Trace: [ 1027.798907][T18701] [ 1027.801834][T18701] ? __init_swait_queue_head+0xca/0x150 [ 1027.807560][T18701] usb_start_wait_urb+0x106/0x4c0 [ 1027.812604][T18701] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 1027.818178][T18701] ? __asan_memset+0x23/0x50 [ 1027.822771][T18701] usb_control_msg+0x326/0x4a0 [ 1027.827574][T18701] ? __pfx_usb_control_msg+0x10/0x10 [ 1027.832847][T18701] ? __kmalloc_node_track_caller_noprof+0x304/0x850 [ 1027.839459][T18701] dtv5100_i2c_msg+0x1be/0x340 [ 1027.844215][T18701] dtv5100_i2c_xfer+0x131/0x3d0 [ 1027.849126][T18701] __i2c_transfer+0x5d9/0x17f0 [ 1027.853913][T18701] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 1027.859764][T18701] ? __pfx___i2c_transfer+0x10/0x10 [ 1027.864978][T18701] ? rt_mutex_slowtrylock+0x93/0x100 [ 1027.870284][T18701] i2c_transfer+0x15f/0x380 [ 1027.874778][T18701] i2c_transfer_buffer_flags+0x10c/0x190 [ 1027.880441][T18701] ? __pfx_i2c_transfer_buffer_flags+0x10/0x10 [ 1027.886632][T18701] ? _copy_from_user+0x59/0xd0 [ 1027.891691][T18701] i2cdev_write+0x11e/0x240 [ 1027.896187][T18701] ? __pfx_i2cdev_write+0x10/0x10 [ 1027.901451][T18701] vfs_writev+0x5ea/0xe10 [ 1027.905784][T18701] ? __pfx_vfs_writev+0x10/0x10 [ 1027.910665][T18701] ? __fget_files+0x21f/0x3d0 [ 1027.915324][T18701] ? do_writev+0x13e/0x340 [ 1027.919747][T18701] do_writev+0x13e/0x340 [ 1027.924036][T18701] ? __pfx_do_writev+0x10/0x10 [ 1027.928788][T18701] do_syscall_64+0x106/0xf80 [ 1027.933407][T18701] ? clear_bhb_loop+0x40/0x90 [ 1027.938101][T18701] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1027.944046][T18701] RIP: 0033:0x7fdb0519c799 [ 1027.948454][T18701] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1027.968098][T18701] RSP: 002b:00007fdb060ad028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 1027.976581][T18701] RAX: ffffffffffffffda RBX: 00007fdb05415fa0 RCX: 00007fdb0519c799 [ 1027.984558][T18701] RDX: 0000000000000001 RSI: 0000200000000740 RDI: 0000000000000009 [ 1027.992561][T18701] RBP: 00007fdb05232c99 R08: 0000000000000000 R09: 0000000000000000 [ 1028.000926][T18701] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1028.009084][T18701] R13: 00007fdb05416038 R14: 00007fdb05415fa0 R15: 00007ffd79fe7c78 [ 1028.017080][T18701] [ 1028.020093][T18701] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1028.027364][T18701] CPU: 0 UID: 0 PID: 18701 Comm: syz.0.3169 Tainted: G L syzkaller #0 PREEMPT(full) [ 1028.038299][T18701] Tainted: [L]=SOFTLOCKUP [ 1028.042623][T18701] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 1028.052658][T18701] Call Trace: [ 1028.055918][T18701] [ 1028.058833][T18701] dump_stack_lvl+0x100/0x190 [ 1028.063511][T18701] vpanic+0x552/0x970 [ 1028.067472][T18701] ? __pfx_vpanic+0x10/0x10 [ 1028.071958][T18701] panic+0xd1/0xe0 [ 1028.075667][T18701] ? __pfx_panic+0x10/0x10 [ 1028.080082][T18701] check_panic_on_warn.cold+0x19/0x34 [ 1028.085445][T18701] ? usb_submit_urb+0x1573/0x1910 [ 1028.090446][T18701] __warn.cold+0x191/0x348 [ 1028.094857][T18701] __report_bug+0x296/0x3d0 [ 1028.099352][T18701] ? usb_submit_urb+0x1573/0x1910 [ 1028.104354][T18701] ? __pfx___report_bug+0x10/0x10 [ 1028.109357][T18701] ? mark_held_locks+0x40/0x70 [ 1028.114112][T18701] report_bug_entry+0xe1/0x290 [ 1028.118857][T18701] ? usb_submit_urb+0x157e/0x1910 [ 1028.123863][T18701] handle_bug+0x1cd/0x2a0 [ 1028.128192][T18701] exc_invalid_op+0x17/0x50 [ 1028.132688][T18701] asm_exc_invalid_op+0x1a/0x20 [ 1028.137526][T18701] RIP: 0010:usb_submit_urb+0x157e/0x1910 [ 1028.143153][T18701] Code: d2 74 5d 48 89 54 24 40 e8 1f ed b7 fa 4c 89 ef e8 17 ab de fe 48 89 c6 48 8d 3d 2d 7b 95 09 48 8b 54 24 40 45 89 f8 44 89 f1 <67> 48 0f b9 3a e9 c7 ed ff ff e8 f3 ec b7 fa 89 ee bf ff 00 00 00 [ 1028.162741][T18701] RSP: 0018:ffffc9000457f760 EFLAGS: 00010283 [ 1028.168803][T18701] RAX: ffffffff8c80d5c0 RBX: ffff8880354ebf00 RCX: 0000000080006580 [ 1028.176761][T18701] RDX: ffff888077aeae20 RSI: ffffffff8c80d5c0 RDI: ffffffff90e645c0 [ 1028.184721][T18701] RBP: ffff88807bc5c058 R08: 00000000000000c0 R09: 0000000000000000 [ 1028.192685][T18701] R10: 0000000000000001 R11: 0000000000000000 R12: ffff888037751400 [ 1028.200646][T18701] R13: ffff88807bc5c0b0 R14: 0000000080006580 R15: 00000000000000c0 [ 1028.208635][T18701] ? __init_swait_queue_head+0xca/0x150 [ 1028.214190][T18701] usb_start_wait_urb+0x106/0x4c0 [ 1028.219215][T18701] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 1028.224759][T18701] ? __asan_memset+0x23/0x50 [ 1028.229350][T18701] usb_control_msg+0x326/0x4a0 [ 1028.234108][T18701] ? __pfx_usb_control_msg+0x10/0x10 [ 1028.239385][T18701] ? __kmalloc_node_track_caller_noprof+0x304/0x850 [ 1028.245960][T18701] dtv5100_i2c_msg+0x1be/0x340 [ 1028.250710][T18701] dtv5100_i2c_xfer+0x131/0x3d0 [ 1028.255555][T18701] __i2c_transfer+0x5d9/0x17f0 [ 1028.260313][T18701] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 1028.266101][T18701] ? __pfx___i2c_transfer+0x10/0x10 [ 1028.271285][T18701] ? rt_mutex_slowtrylock+0x93/0x100 [ 1028.276570][T18701] i2c_transfer+0x15f/0x380 [ 1028.281067][T18701] i2c_transfer_buffer_flags+0x10c/0x190 [ 1028.286682][T18701] ? __pfx_i2c_transfer_buffer_flags+0x10/0x10 [ 1028.292818][T18701] ? _copy_from_user+0x59/0xd0 [ 1028.297566][T18701] i2cdev_write+0x11e/0x240 [ 1028.302053][T18701] ? __pfx_i2cdev_write+0x10/0x10 [ 1028.307055][T18701] vfs_writev+0x5ea/0xe10 [ 1028.311372][T18701] ? __pfx_vfs_writev+0x10/0x10 [ 1028.316226][T18701] ? __fget_files+0x21f/0x3d0 [ 1028.320902][T18701] ? do_writev+0x13e/0x340 [ 1028.325303][T18701] do_writev+0x13e/0x340 [ 1028.329529][T18701] ? __pfx_do_writev+0x10/0x10 [ 1028.334281][T18701] do_syscall_64+0x106/0xf80 [ 1028.338852][T18701] ? clear_bhb_loop+0x40/0x90 [ 1028.343507][T18701] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1028.349378][T18701] RIP: 0033:0x7fdb0519c799 [ 1028.353773][T18701] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1028.373363][T18701] RSP: 002b:00007fdb060ad028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 1028.381755][T18701] RAX: ffffffffffffffda RBX: 00007fdb05415fa0 RCX: 00007fdb0519c799 [ 1028.389719][T18701] RDX: 0000000000000001 RSI: 0000200000000740 RDI: 0000000000000009 [ 1028.397686][T18701] RBP: 00007fdb05232c99 R08: 0000000000000000 R09: 0000000000000000 [ 1028.405645][T18701] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1028.413596][T18701] R13: 00007fdb05416038 R14: 00007fdb05415fa0 R15: 00007ffd79fe7c78 [ 1028.421553][T18701] [ 1028.424765][T18701] Kernel Offset: disabled [ 1028.429070][T18701] Rebooting in 86400 seconds..