last executing test programs: 20.02791095s ago: executing program 0 (id=468): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="4c010000100001002cbc700000000008fc000000000000000000000000000001fe8800000000000000000000000000010000ecdf000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000ffffe0000001000000003200000000000000000000000000000000000000fefffffffffffffffeffffffffffffff030000000000000000000000000000000000000000000300fcffffffffffffff0000000000000000090000000000000001000000000000000008400000000000090000000000000092020000000000000010000000000000000000000000000007350000020004002c00000000000000590002006362632874776f666973682900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000880000006e000b000018002000000000000000407f000000"], 0x14c}}, 0x44050) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000000000000100000001000000200000000076616c006270665f7370696e5f6c6f636b"], 0x0, 0x80, 0x0, 0x0, 0x9}, 0x28) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x1, 0x4, 0x8, 0xbc0, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, r2, 0x1, 0x3}, 0x50) recvmmsg(0xffffffffffffffff, &(0x7f0000000d40), 0x0, 0x40, &(0x7f0000000e00)={0x77359400}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x3, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x5, 0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x5, 0x2, 0x6}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000880) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r10, {0x0, 0x3}, {}, {0xfff3, 0xffff}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000d4}, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) r12 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=@newqdisc={0x434, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r13, {0x8}, {}, {0x5, 0x1}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x0, 0x62b9, 0x5, 0xfffffff7, 0x5, 0x3, 0xe1cb, 0x5, 0x1, 0x3, 0x0, 0x1, 0x2, 0x6, 0xacd, 0x0, 0x364, 0x1, 0x2, 0xffffff44, 0x3, 0x2, 0x8, 0x3, 0x6, 0xffffffc0, 0xb, 0x688, 0xffff, 0x0, 0x2, 0xfffffeff, 0x0, 0xb, 0x5, 0x0, 0x5, 0xffffadc0, 0x8001, 0xf, 0x1, 0x8d2a00, 0x8, 0xf, 0x4ba, 0x1, 0x80, 0xffff, 0x1, 0x7, 0x0, 0x400, 0xe5, 0x93, 0x2, 0x45a5, 0x8, 0x6, 0x4, 0x0, 0x59, 0x3, 0x80, 0x9, 0x5, 0x9, 0x5, 0x3, 0x9, 0x2, 0x3, 0x4, 0x7f, 0x101, 0xde, 0x10, 0x7, 0x6, 0x7f, 0xfff, 0x6, 0x9, 0xf7, 0x5, 0x2, 0x81, 0x0, 0x6, 0x7, 0x1, 0x437, 0x6, 0x3, 0x2, 0x7000000, 0x5, 0x9, 0xecc, 0x6, 0x4, 0x8, 0x3fc, 0x7a5, 0x9, 0x9, 0x0, 0x9, 0x8, 0x0, 0x3, 0x7ff, 0x5, 0x6, 0x4, 0x7, 0x10, 0x4001d1da, 0x8, 0xbdb, 0x1, 0x8, 0x8001, 0xe3c8, 0xffffffff, 0xd, 0x6, 0x4, 0x9, 0x7fffffff, 0x3, 0xb8b4, 0x723, 0x15, 0x9367, 0x81, 0x400000, 0x9, 0x6, 0x75, 0x1ff, 0x5, 0x4, 0xf, 0x7, 0x3, 0x0, 0x3ff, 0x8000, 0xff, 0x4, 0x0, 0x6496, 0x7f, 0x3, 0x0, 0xf528, 0x6, 0x80000000, 0x6, 0x157b, 0x7, 0x40, 0x1, 0x10001, 0x3, 0x9, 0x1, 0x98de, 0x2450, 0x86d, 0x2, 0x7, 0x7, 0xfffffffa, 0x800, 0xfffffffb, 0x4, 0xb6, 0x5, 0x7fff, 0x9f4c, 0x1, 0x8, 0xe, 0x11d, 0x7fff, 0xf, 0x8, 0x3, 0xa, 0x9, 0x9, 0x2, 0x4, 0x2, 0x8, 0x5, 0x5, 0x401, 0x9, 0x4b8, 0xa78, 0xec8, 0x1, 0xfffffffa, 0x80020000, 0x0, 0x0, 0x7f, 0x8c1, 0x5, 0xfffffffa, 0x6, 0x175b, 0x7fffffff, 0x4, 0x4, 0xffff8001, 0x8001, 0xffff, 0x5, 0x0, 0x401, 0x5, 0x10, 0x7fff, 0xffffff00, 0x3, 0x8, 0x9268, 0x80000000, 0x2, 0x7, 0x4, 0x3, 0x4, 0xced, 0x5, 0xa524, 0x7, 0x81f, 0x3, 0x14, 0x80, 0x1ff, 0x1109, 0x9, 0x1, 0x0, 0x2, 0x0, 0x8, 0x3, 0x3, 0x6, 0x4]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0x2004009c}, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000a80), 0x407f, r3, 0x4}, 0x38) r14 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r14, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000600)=ANY=[@ANYBLOB="1c000000020303000000000000000000000100000800010001"], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20004010) sendmsg$NFQNL_MSG_CONFIG(r14, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000020303000000000000000021000000100800010001"], 0x1c}}, 0x0) sendmsg$NFQNL_MSG_VERDICT_BATCH(r14, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="200000000303011e00000000000000000000fffd0c0002000000000000010002"], 0x20}, 0x1, 0x0, 0x0, 0x94f7cfd7d57deaec}, 0x0) 17.035431237s ago: executing program 0 (id=471): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) socket$inet6(0xa, 0x80003, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x4}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) recvmmsg(r3, &(0x7f0000000400)=[{{0x0, 0xf5ffffff, 0x0, 0x0, 0x0, 0x4000000, 0xfff5}}], 0xf00, 0x0, 0x0) shutdown(r3, 0x0) 16.645713255s ago: executing program 1 (id=472): r0 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r0, &(0x7f0000000000)={&(0x7f0000000100)=@l2tp6={0xa, 0x0, 0x2, @remote}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000180)='S\x00', 0x5a0}], 0x1, 0x0, 0x0, 0x900}, 0x7916) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x20, 0x4, &(0x7f0000000580)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2ff99f06, 0x0, 0x0, 0x0, 0x9}, [@generic={0x73, 0x1, 0x1, 0x4}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000040)={'bridge0\x00', &(0x7f0000000100)=@ethtool_ringparam={0x10, 0x0, 0x20000000, 0x0, 0x1, 0xfe000000}}) socket$tipc(0x1e, 0x2, 0x0) r2 = socket$tipc(0x1e, 0x2, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'macvlan1\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe, 0xa93}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newtfilter={0x80, 0x2c, 0xf3f, 0x70bd27, 0x25dddbb9, {0x0, 0x0, 0x0, r5, {0x2, 0x3da48c8682330ab8}, {}, {0x7, 0xfffa}}, [@filter_kind_options=@f_basic={{0xa}, {0x50, 0x2, [@TCA_BASIC_EMATCHES={0x4c, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x40, 0x2, 0x0, 0x1, [@TCF_EM_U32={0x1c, 0x1, 0x0, 0x0, {{0x2002, 0x3, 0x5}, {0x9, 0xfffffff9, 0x0, 0x3}}}, @TCF_EM_IPT={0x20, 0x2, 0x0, 0x0, {{0x3, 0x9, 0x5}, [@TCA_EM_IPT_MATCH_NAME={0xb}, @TCA_EM_IPT_HOOK={0x8, 0x1, 0x4}]}}]}]}]}}]}, 0x80}, 0x1, 0x0, 0x0, 0x200058c0}, 0x4004880) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000900)={0x41, 0x4}, 0x10) socket$tipc(0x1e, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[], 0x50) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, 0x0) r6 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x17ef, 0x60a4, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x90, 0x27, "", [{{0x9, 0x4, 0x0, 0xfe, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0xc1, 0xfe, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x9, 0xc0, 0x1}}}}}]}}]}}, 0x0) syz_usb_control_io(r6, &(0x7f0000000080)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="58000000020601020000000000000010000000000900020073797a3100000000050004000000000011000300686173683a6e65742c6e6574000000000c00078008000640000000cd050005000a0000000500010006"], 0x58}}, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000200)) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="640000000906010800000000000000000600000505000100070000003c0007801800148014000240fc0000000000000000000000000000011800018014000240ff01000000000000000000000000000105000300070000000900020073797a31"], 0x64}, 0x1, 0x0, 0x0, 0x4008414}, 0x4800) 15.61143888s ago: executing program 3 (id=473): r0 = fsopen(&(0x7f0000000080)='fuseblk\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@gettaction={0x48, 0x32, 0x200, 0x70bd2a, 0x25dfdbfb, {}, [@action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1}}, @action_gd=@TCA_ACT_TAB={0x28, 0x1, [{0xc, 0xc, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0xc, 0x2, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x81f7}}, {0x20, 0x1f, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x400c004}, 0x24048840) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5c000000100003040000fff30000ea0000000400", @ANYRES32=0x0, @ANYBLOB="60bc010004a701003c00128009000100626f6e64000000002c"], 0x5c}, 0x1, 0x0, 0x0, 0x11}, 0x4000044) fchdir(r1) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) io_setup(0x8, &(0x7f0000004200)=0x0) io_submit(r4, 0x1, &(0x7f0000000000)=[&(0x7f0000000040)={0x0, 0x0, 0x20, 0x1, 0x1fff, r3, 0x0, 0xfe, 0x3}]) r5 = signalfd(0xffffffffffffffff, &(0x7f00000001c0), 0x8) close(r5) socket$inet_smc(0x2b, 0x1, 0x0) fcntl$setstatus(r5, 0x4, 0x6c00) syz_genetlink_get_family_id$devlink(&(0x7f0000000440), r5) mmap$IORING_OFF_SQ_RING(0x0, 0x3, 0xb, 0x2172, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0e00000000000000000000000080000000", @ANYRES32], 0x50) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r6, &(0x7f0000000380)={0x2, 0x4e20, @local}, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x4008800) getsockopt$inet_mptcp_buf(r6, 0x11c, 0x4, &(0x7f00000000c0)=""/191, 0x0) 14.944592958s ago: executing program 4 (id=475): r0 = socket$igmp(0x2, 0x3, 0x2) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r1, 0x0, 0xc8, &(0x7f0000000100), 0x4) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreq(r2, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, 0x0, 0x0) r3 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r3, 0x0, 0xd2, &(0x7f0000000040)={@empty, @empty, 0x0, "028a3f6c58b274e6d8451697efe42811ee1df06e9264f7d866b1970548fc3c7b", 0xb2, 0x80000000, 0x6, 0x6}, 0x3c) syz_emit_ethernet(0x36, &(0x7f0000002180)={@local, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x20, 0x20, 0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1=0xe0000300}, @timestamp={0xd, 0x0, 0x0, 0xb386, 0x2, 0xd, 0x7, 0x5}}}}}, 0x0) (fail_nth: 4) 14.603758733s ago: executing program 0 (id=476): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) write(0xffffffffffffffff, &(0x7f0000000040)="1400000052004f030e789e7e27286d000a4149", 0x13) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x40000000000032a, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x9, @loopback, 0x5}, 0x1c) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x15) mkdir(&(0x7f0000000000)='./tracefs\x00', 0x1ff) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, 0x0, 0x20000810) r5 = syz_open_procfs(0x0, &(0x7f00000042c0)='mounts\x00') pread64(r5, &(0x7f0000002240)=""/237, 0xed, 0x4eb) sendmmsg$inet6(r3, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) 14.195288344s ago: executing program 3 (id=477): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="4c010000100001002cbc700000000008fc000000000000000000000000000001fe8800000000000000000000000000010000ecdf000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000ffffe0000001000000003200000000000000000000000000000000000000fefffffffffffffffeffffffffffffff030000000000000000000000000000000000000000000300fcffffffffffffff0000000000000000090000000000000001000000000000000008400000000000090000000000000092020000000000000010000000000000000000000000000007350000020004002c00000000000000590002006362632874776f666973682900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000880000006e000b000018002000000000000000407f000000"], 0x14c}}, 0x44050) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x1, 0x4, 0x8, 0xbc0, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x3}, 0x50) recvmmsg(0xffffffffffffffff, &(0x7f0000000d40), 0x0, 0x40, &(0x7f0000000e00)={0x77359400}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x3, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x5, 0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x5, 0x2, 0x6}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000880) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40000d4}, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=@newqdisc={0x434, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r11, {0x8}, {}, {0x5, 0x1}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x0, 0x62b9, 0x5, 0xfffffff7, 0x5, 0x3, 0xe1cb, 0x5, 0x1, 0x3, 0x0, 0x1, 0x2, 0x6, 0xacd, 0x0, 0x364, 0x1, 0x2, 0xffffff44, 0x3, 0x2, 0x8, 0x3, 0x6, 0xffffffc0, 0xb, 0x688, 0xffff, 0x0, 0x2, 0xfffffeff, 0x0, 0xb, 0x5, 0x0, 0x5, 0xffffadc0, 0x8001, 0xf, 0x1, 0x8d2a00, 0x8, 0xf, 0x4ba, 0x1, 0x80, 0xffff, 0x1, 0x7, 0x0, 0x400, 0xe5, 0x93, 0x2, 0x45a5, 0x8, 0x6, 0x4, 0x0, 0x59, 0x3, 0x80, 0x9, 0x5, 0x9, 0x5, 0x3, 0x9, 0x2, 0x3, 0x4, 0x7f, 0x101, 0xde, 0x10, 0x7, 0x6, 0x7f, 0xfff, 0x6, 0x9, 0xf7, 0x5, 0x2, 0x81, 0x0, 0x6, 0x7, 0x1, 0x437, 0x6, 0x3, 0x2, 0x7000000, 0x5, 0x9, 0xecc, 0x6, 0x4, 0x8, 0x3fc, 0x7a5, 0x9, 0x9, 0x0, 0x9, 0x8, 0x0, 0x3, 0x7ff, 0x5, 0x6, 0x4, 0x7, 0x10, 0x4001d1da, 0x8, 0xbdb, 0x1, 0x8, 0x8001, 0xe3c8, 0xffffffff, 0xd, 0x6, 0x4, 0x9, 0x7fffffff, 0x3, 0xb8b4, 0x723, 0x15, 0x9367, 0x81, 0x400000, 0x9, 0x6, 0x75, 0x1ff, 0x5, 0x4, 0xf, 0x7, 0x3, 0x0, 0x3ff, 0x8000, 0xff, 0x4, 0x0, 0x6496, 0x7f, 0x3, 0x0, 0xf528, 0x6, 0x80000000, 0x6, 0x157b, 0x7, 0x40, 0x1, 0x10001, 0x3, 0x9, 0x1, 0x98de, 0x2450, 0x86d, 0x2, 0x7, 0x7, 0xfffffffa, 0x800, 0xfffffffb, 0x4, 0xb6, 0x5, 0x7fff, 0x9f4c, 0x1, 0x8, 0xe, 0x11d, 0x7fff, 0xf, 0x8, 0x3, 0xa, 0x9, 0x9, 0x2, 0x4, 0x2, 0x8, 0x5, 0x5, 0x401, 0x9, 0x4b8, 0xa78, 0xec8, 0x1, 0xfffffffa, 0x80020000, 0x0, 0x0, 0x7f, 0x8c1, 0x5, 0xfffffffa, 0x6, 0x175b, 0x7fffffff, 0x4, 0x4, 0xffff8001, 0x8001, 0xffff, 0x5, 0x0, 0x401, 0x5, 0x10, 0x7fff, 0xffffff00, 0x3, 0x8, 0x9268, 0x80000000, 0x2, 0x7, 0x4, 0x3, 0x4, 0xced, 0x5, 0xa524, 0x7, 0x81f, 0x3, 0x14, 0x80, 0x1ff, 0x1109, 0x9, 0x1, 0x0, 0x2, 0x0, 0x8, 0x3, 0x3, 0x6, 0x4]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0x2004009c}, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000a80), 0x407f, r2, 0x4}, 0x38) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r12, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000600)=ANY=[@ANYBLOB="1c000000020303000000000000000000000100000800010001"], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20004010) sendmsg$NFQNL_MSG_CONFIG(r12, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000020303000000000000000021000000100800010001"], 0x1c}}, 0x0) sendmsg$NFQNL_MSG_VERDICT_BATCH(r12, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="200000000303011e00000000000000000000fffd0c0002000000000000010002"], 0x20}, 0x1, 0x0, 0x0, 0x94f7cfd7d57deaec}, 0x0) 14.038290914s ago: executing program 2 (id=478): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) close(0xffffffffffffffff) socket$key(0xf, 0x3, 0x2) openat$dsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x109801, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) ppoll(&(0x7f0000000300)=[{r1, 0xc226}], 0x1, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000020c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000002100)={0xffffffffffffffff}, 0x13f, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300), 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0xfffb, 0x5, @empty, 0xa098}, {0xa, 0x4ea5, 0x5, @mcast1, 0xff}, r2, 0x8001}}, 0x48) writev(r0, &(0x7f0000000040)=[{0x0}], 0x1) 13.79997375s ago: executing program 4 (id=479): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="4c010000100001002cbc700000000008fc000000000000000000000000000001fe8800000000000000000000000000010000ecdf0000000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000ffffe0000001000000003200000000000000000000000000000000000000fefffffffffffffffeffffffffffffff030000000000000000000000000000000000000000000300fcffffffffffffff0000000000000000090000000000000001000000000000000008400000000000090000000000000092020000000000000010000000000000000000000000000007350000020004002c00000000000000590002006362632874776f666973682900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000880000006e000b000018002000000000000000407f000000"], 0x14c}}, 0x44050) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000000000000100000001000000200000000076616c006270665f7370696e5f6c6f636b006c6f636b0066"], 0x0, 0x80, 0x0, 0x0, 0x9}, 0x28) recvmmsg(0xffffffffffffffff, &(0x7f0000000d40), 0x0, 0x40, &(0x7f0000000e00)={0x77359400}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x3, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x5, 0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x5, 0x2, 0x6}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000880) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r8, {0x0, 0x3}, {}, {0xfff3, 0xffff}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000d4}, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=@newqdisc={0x434, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r10, {0x8}, {}, {0x5, 0x1}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x0, 0x62b9, 0x5, 0xfffffff7, 0x5, 0x3, 0xe1cb, 0x5, 0x1, 0x3, 0x0, 0x1, 0x2, 0x6, 0xacd, 0x0, 0x364, 0x1, 0x2, 0xffffff44, 0x3, 0x2, 0x8, 0x3, 0x6, 0xffffffc0, 0xb, 0x688, 0xffff, 0x0, 0x2, 0xfffffeff, 0x0, 0xb, 0x5, 0x0, 0x5, 0xffffadc0, 0x8001, 0xf, 0x1, 0x8d2a00, 0x8, 0xf, 0x4ba, 0x1, 0x80, 0xffff, 0x1, 0x7, 0x0, 0x400, 0xe5, 0x93, 0x2, 0x45a5, 0x8, 0x6, 0x4, 0x0, 0x59, 0x3, 0x80, 0x9, 0x5, 0x9, 0x5, 0x3, 0x9, 0x2, 0x3, 0x4, 0x7f, 0x101, 0xde, 0x10, 0x7, 0x6, 0x7f, 0xfff, 0x6, 0x9, 0xf7, 0x5, 0x2, 0x81, 0x0, 0x6, 0x7, 0x1, 0x437, 0x6, 0x3, 0x2, 0x7000000, 0x5, 0x9, 0xecc, 0x6, 0x4, 0x8, 0x3fc, 0x7a5, 0x9, 0x9, 0x0, 0x9, 0x8, 0x0, 0x3, 0x7ff, 0x5, 0x6, 0x4, 0x7, 0x10, 0x4001d1da, 0x8, 0xbdb, 0x1, 0x8, 0x8001, 0xe3c8, 0xffffffff, 0xd, 0x6, 0x4, 0x9, 0x7fffffff, 0x3, 0xb8b4, 0x723, 0x15, 0x9367, 0x81, 0x400000, 0x9, 0x6, 0x75, 0x1ff, 0x5, 0x4, 0xf, 0x7, 0x3, 0x0, 0x3ff, 0x8000, 0xff, 0x4, 0x0, 0x6496, 0x7f, 0x3, 0x0, 0xf528, 0x6, 0x80000000, 0x6, 0x157b, 0x7, 0x40, 0x1, 0x10001, 0x3, 0x9, 0x1, 0x98de, 0x2450, 0x86d, 0x2, 0x7, 0x7, 0xfffffffa, 0x800, 0xfffffffb, 0x4, 0xb6, 0x5, 0x7fff, 0x9f4c, 0x1, 0x8, 0xe, 0x11d, 0x7fff, 0xf, 0x8, 0x3, 0xa, 0x9, 0x9, 0x2, 0x4, 0x2, 0x8, 0x5, 0x5, 0x401, 0x9, 0x4b8, 0xa78, 0xec8, 0x1, 0xfffffffa, 0x80020000, 0x0, 0x0, 0x7f, 0x8c1, 0x5, 0xfffffffa, 0x6, 0x175b, 0x7fffffff, 0x4, 0x4, 0xffff8001, 0x8001, 0xffff, 0x5, 0x0, 0x401, 0x5, 0x10, 0x7fff, 0xffffff00, 0x3, 0x8, 0x9268, 0x80000000, 0x2, 0x7, 0x4, 0x3, 0x4, 0xced, 0x5, 0xa524, 0x7, 0x81f, 0x3, 0x14, 0x80, 0x1ff, 0x1109, 0x9, 0x1, 0x0, 0x2, 0x0, 0x8, 0x3, 0x3, 0x6, 0x4]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0x2004009c}, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000a80), 0x407f, 0xffffffffffffffff, 0x4}, 0x38) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r11, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000600)=ANY=[@ANYBLOB="1c000000020303000000000000000000000100000800010001"], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20004010) sendmsg$NFQNL_MSG_CONFIG(r11, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000020303000000000000000021000000100800010001"], 0x1c}}, 0x0) sendmsg$NFQNL_MSG_VERDICT_BATCH(r11, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="200000000303011e00000000000000000000fffd0c0002000000000000010002"], 0x20}, 0x1, 0x0, 0x0, 0x94f7cfd7d57deaec}, 0x0) 12.186751618s ago: executing program 3 (id=480): mkdir(&(0x7f0000000100)='./debug\x00', 0x1ef) mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/usb/devices\x00', 0x0, 0x60) pread64(r0, &(0x7f0000000200)=""/244, 0xf4, 0x7c2) 12.093490225s ago: executing program 2 (id=481): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, 0x0, 0x0) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = io_uring_setup(0x70c3, &(0x7f0000000180)={0x0, 0x2c41, 0x2, 0x3, 0x2}) syz_usb_connect(0x0, 0x36, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000068e04d206f0e2c586831010203010902240001000000000904000002ff47d000090509e702008000040905", @ANYRES32], 0x0) syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) 11.284987446s ago: executing program 1 (id=482): syz_emit_ethernet(0xbe, &(0x7f0000000380)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa000800000000019078640101b8ac1414aa0b009078032c00004500fffdfffc000000890000ac1414bbac14142a8804c8fc070fd6ffffffff0000000000000000441c4f60000005dc00000008feff00000000f00a00000000000000098802444cd8617f0000010000c2b87f00000100000001ac1414bb00000008ac1414bb000004e8000000000000000cffffffff00000005ac1414240000000f00000000000008b8e00000020000ffff0000004961c4957161f16c59938923a6853912fdb1393990bb7b7fac9ca31b552ea035e0614d70c98a080e97c2d27072b790900c9b4836d73c25940e592484d95b67f22a28201653abc73536407aa6da4522811b8c3572a3f5f1127df3d4c5b30bf1dd0b52f21bc87aed7bd2ed16d58c434702406762c763dfd17f6fa4b5324075ececc21de957349905392362f427ae830658a5663ab1df423dd956b70d550736d41e4460e235eebb81d5fcb0479b21873d78d3a2433a3224a8b249d84ec793720bb1429578bafc5380a992999d5ba30edfa23b633f336409683d8cc1bab969bd536da2277aebc7679346"], 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)="240000001a005f0214f9f407000904", 0xf) ioctl(0xffffffffffffffff, 0xc138fd02, &(0x7f0000000000)="0400000000000000") mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff0007058102"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000080)=ANY=[@ANYBLOB="290a020000009c"], 0x0, 0x0}) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x6004, 0x1) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x9801) move_mount(r1, 0x0, 0xffffffffffffff9c, 0x0, 0x44) sendto$inet6(0xffffffffffffffff, &(0x7f0000000640)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @loopback={0xfec0ffffffffffff, 0x1c9ae7fffe9a6f34}}, 0x1c) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x6) 9.880392167s ago: executing program 3 (id=483): syz_usb_connect(0x1, 0x3d, &(0x7f0000000680)=ANY=[@ANYBLOB="1201d08ea8b9a3082e0c200729d40102030109022b00010804400309046d00027854990109050308000200050907058e33"], &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x57, 0xec}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) socket$inet(0x2, 0x2, 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x17, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018", @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bf8200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe89}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x4, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r3, 0x2000000, 0xd, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b9", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r4 = getpgrp(0x0) sched_setaffinity(r4, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r5 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000000340)=""/102400, 0x19000) r7 = semget$private(0x0, 0x20000000102, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x40000) sendmsg$NFT_BATCH(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x20, 0x0, 0x0, {0x7}}}, 0x6c}, 0x1, 0x0, 0x0, 0x8010}, 0x4000800) semop(r7, &(0x7f0000000240)=[{0x3, 0x0, 0x1800}], 0x1) semctl$SETALL(r7, 0x0, 0x11, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)={0x34, r1, 0x1, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_MESH_CONFIG={0x4}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x568c}]}, 0x34}, 0x1, 0x0, 0x0, 0x85}, 0x4c040) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, &(0x7f0000000100)=@l={0x92, 0x0, 0xc0, 0x2, 0x0, 0x7, 0x9}) 9.446935107s ago: executing program 4 (id=484): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) socket$inet6(0xa, 0x80003, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x4}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) recvmmsg(r3, &(0x7f0000000400)=[{{0x0, 0xf5ffffff, 0x0, 0x0, 0x0, 0x4000000, 0xfff5}}], 0xf00, 0x0, 0x0) shutdown(r3, 0x0) 9.235592023s ago: executing program 0 (id=485): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r5, 0x0, 0x0, 0x20000845, &(0x7f0000000000)={0xa, 0x4e22, 0x8, @remote, 0x6}, 0x1c) getsockopt$inet6_buf(r5, 0x29, 0x18, 0x0, &(0x7f0000000040)) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x7) syz_emit_ethernet(0x22, &(0x7f00000003c0)=ANY=[@ANYBLOB="0180c2450100140000fb727affa3f9d64600000029907800000000ffffffffb9e28c6a534377fa69774f78dc08ad38829b10638f777d8d26a58288f6513b4485b5653af705955e054433e53b0f94bc663f98deb244dcc384fa7e32b8c4ec45aa8ffede6e170ebe2372b4a1414f9e399c62919b26f6b1b37974bb8923f5d4643792e8adcc7221e07fe40dd377"], 0x0) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x1a, &(0x7f00000000c0)={0x2, &(0x7f0000000040)=[{0x40, 0x25, 0x2, 0x8}, {0x6, 0x0, 0x6, 0x5}]}, 0x10) write(r6, &(0x7f0000000000), 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) waitid(0x2, r3, &(0x7f00000000c0), 0x1, &(0x7f0000000500)) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, 0x0) pipe2(&(0x7f00000004c0)={0xffffffffffffffff}, 0x800) ioctl$int_in(r7, 0x5452, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) 8.369160175s ago: executing program 0 (id=486): r0 = io_uring_setup(0x136a, &(0x7f0000000400)={0x0, 0x1f8a, 0x40, 0x1, 0x100028c}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x121040, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xf) (async) r3 = socket$netlink(0x10, 0x3, 0x10) (async) r4 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000000)={0x58, r4, 0x405, 0x70b927, 0x25dfdbfc, {}, [{{0x8, 0x1, r5}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x81}}}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4040df5}, 0x4040084) (async) ioctl$TCFLSH(r2, 0x400455c8, 0x1) listen(r1, 0x10) syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100003441eb4023398a716af6b593a0010902240001000040000904ee0202949da000090504021f00000000090588"], 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff) (async) mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,,ers=3.0,nodfs\x00') close_range(r0, 0xffffffffffffffff, 0x0) 8.018335064s ago: executing program 4 (id=487): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(r0, &(0x7f0000000000)=':', 0x1, 0x3) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000740)=ANY=[@ANYBLOB="58010000100005000100000000000000000000000000000000000000000000010000000000000000000000000000000100000000000000000a00808000000000", @ANYRES32=0x80, @ANYBLOB="00000000000000fd00000000000000010000123433000000000000000000000000000000000000010000000000000000ffffffffffffffffffffffffffffffffffffffb8ffffffff0000000000000000000098000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000a000000800000000000000048000100686d61632873686131290000000000000000000000000000000000000000000000000000007100000000000000000000000000000000000000000000000000000000000020001700010004"], 0x158}}, 0x0) 7.991514322s ago: executing program 2 (id=488): r0 = fsopen(&(0x7f0000000080)='fuseblk\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@gettaction={0x48, 0x32, 0x200, 0x70bd2a, 0x25dfdbfb, {}, [@action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1}}, @action_gd=@TCA_ACT_TAB={0x28, 0x1, [{0xc, 0xc, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0xc, 0x2, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x81f7}}, {0x20, 0x1f, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x400c004}, 0x24048840) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5c000000100003040000fff30000ea0000000400", @ANYRES32=0x0, @ANYBLOB="60bc010004a701003c00128009000100626f6e64000000002c"], 0x5c}, 0x1, 0x0, 0x0, 0x11}, 0x4000044) fchdir(r1) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) io_setup(0x8, &(0x7f0000004200)=0x0) io_submit(r4, 0x1, &(0x7f0000000000)=[&(0x7f0000000040)={0x0, 0x0, 0x20, 0x1, 0x1fff, r3, 0x0, 0xfe, 0x3}]) r5 = signalfd(0xffffffffffffffff, &(0x7f00000001c0), 0x8) close(r5) socket$inet_smc(0x2b, 0x1, 0x0) fcntl$setstatus(r5, 0x4, 0x6c00) syz_genetlink_get_family_id$devlink(&(0x7f0000000440), r5) mmap$IORING_OFF_SQ_RING(0x0, 0x3, 0xb, 0x2172, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0e00000000000000000000000080000000", @ANYRES32], 0x50) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_mptcp_buf(r6, 0x11c, 0x4, &(0x7f00000000c0)=""/191, 0x0) 7.692551449s ago: executing program 4 (id=489): syz_usb_connect(0x1, 0x3d, &(0x7f0000000680)=ANY=[@ANYBLOB="1201d08ea8b9a3082e0c200729d40102030109022b00010804400309046d00027854990109050308000200050907058e33"], &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x57, 0xec}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) socket$inet(0x2, 0x2, 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x17, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018", @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bf8200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe89}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x4, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r3, 0x2000000, 0xd, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b9", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r4 = getpgrp(0x0) sched_setaffinity(r4, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r5 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000000340)=""/102400, 0x19000) r7 = semget$private(0x0, 0x20000000102, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x40000) sendmsg$NFT_BATCH(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWRULE={0x30, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x4}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x20, 0x0, 0x0, {0x7}}}, 0x58}, 0x1, 0x0, 0x0, 0x8010}, 0x4000800) semop(r7, &(0x7f0000000240)=[{0x3, 0x0, 0x1800}], 0x1) semctl$SETALL(r7, 0x0, 0x11, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)={0x34, r1, 0x1, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_MESH_CONFIG={0x4}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x568c}]}, 0x34}, 0x1, 0x0, 0x0, 0x85}, 0x4c040) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, &(0x7f0000000100)=@l={0x92, 0x0, 0xc0, 0x2, 0x0, 0x7, 0x9}) 7.516820268s ago: executing program 1 (id=490): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$unix(0x1, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000580)="d4fa0c511aad03aa5ed217677bc41c027d9c830c439c7f821ddd78b6915cb170e7603acf9e433c2903bb6773f4b0130668a1e5b5e08d21d0b69c28ca3455aed65855c86f3d1e5789d26375a0d85eaf5e92e19c9affcf76e7a94e76556d2b104ebf645747fadc91460f4b3c94e1a89b51be4a6aa4c65285f988329a8163b69c51b801500a5bacd0463976e2960e2679ef2feee5e6ce6bb78a51fb0e15820d13e4a5aa9e0742a6f8d677ad28fea356657bb550c8311b682d9003c82267a15aa7334bc53b65b9119a1a7d905c7dd365b85c230bbad0d5d0a79819e112637819d9a187cfdf782c6127d2d4281926ab0e22f7346b616fe28ed0b9f4a0c9fdac6d3a90a9c38b5e31448a45546388c95045bc22fe88c43b82a0a5d3eb61c238a5159ea98db9c00aeef644ae98a8cb8dffff3b7ba14d7971910b559623af8295", 0x13c}], 0x2, 0x0, 0x48}, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x68, r2, 0x1, 0x0, 0x0, {{}, {0x0, 0x410c}, {0x4c, 0x14, {0xfffffff0, @link='broadcast-link\x00'}}}}, 0x68}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000400)="14", 0x2, 0x0, 0x4}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8b18, &(0x7f0000000000)={'wlan0\x00'}) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000100)={'\x00', 0x1}) ioctl$VHOST_SET_OWNER(r3, 0xaf01, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r5, &(0x7f0000000000)=[{&(0x7f00000004c0)='4', 0x1}], 0x1) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000340)={@fallback=r3, 0x10, 0x1, 0xa43a, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x0, &(0x7f00000001c0)=[0x0], 0x0, &(0x7f0000000280)=[0x0, 0x0, 0x0], 0x0}, 0x40) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000440)={'wg0\x00', 0x0}) r8 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x6, 0x2, &(0x7f0000000480)=@raw=[@map_idx={0x18, 0x2, 0x5, 0x0, 0xc}], &(0x7f0000000500)='GPL\x00', 0x7, 0x85, &(0x7f00000006c0)=""/133, 0x40f00, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000780)={0x9, 0x2}, 0x8, 0x10, &(0x7f00000007c0)={0x4, 0x7, 0x7fffffff, 0x8}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000800)=[0x1, 0x1], 0x0, 0x10, 0x6}, 0x94) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000003c0)={@ifindex=r7, r5, 0x1d, 0x10, 0x0, @void, @value=r8, @void, @void, r6}, 0x20) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000300)) r9 = syz_open_procfs(0x0, &(0x7f0000002500)='net/wireless\x00') read$FUSE(r9, &(0x7f00000046c0)={0x2020}, 0x2021) ioctl$SNDRV_PCM_IOCTL_REWIND(r9, 0x40084146, &(0x7f0000000040)=0x8) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000400)={0x1, 0x0, 0x0, &(0x7f0000020000), 0x0}) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000600)={0x1, r4}) r10 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r10, 0xffffffffffffffff, 0x0) 6.306754811s ago: executing program 2 (id=491): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) close(0xffffffffffffffff) socket$key(0xf, 0x3, 0x2) openat$dsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x109801, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) ppoll(&(0x7f0000000300)=[{r1, 0xc226}], 0x1, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000020c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000002100)={0xffffffffffffffff}, 0x13f, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300), 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0xfffb, 0x5, @empty, 0xa098}, {0xa, 0x4ea5, 0x5, @mcast1, 0xff}, r2, 0x8001}}, 0x48) writev(r0, &(0x7f0000000040)=[{0x0}], 0x1) 5.815250442s ago: executing program 1 (id=492): r0 = fsopen(&(0x7f0000000080)='fuseblk\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@gettaction={0x48, 0x32, 0x200, 0x70bd2a, 0x25dfdbfb, {}, [@action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1}}, @action_gd=@TCA_ACT_TAB={0x28, 0x1, [{0xc, 0xc, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0xc, 0x2, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x81f7}}, {0x20, 0x1f, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x400c004}, 0x24048840) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5c000000100003040000fff30000ea0000000400", @ANYRES32=0x0, @ANYBLOB="60bc010004a701003c00128009000100626f6e64000000002c"], 0x5c}, 0x1, 0x0, 0x0, 0x11}, 0x4000044) fchdir(r1) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) io_setup(0x8, &(0x7f0000004200)=0x0) io_submit(r4, 0x1, &(0x7f0000000000)=[&(0x7f0000000040)={0x0, 0x0, 0x20, 0x1, 0x1fff, r3, 0x0, 0xfe, 0x3}]) r5 = signalfd(0xffffffffffffffff, &(0x7f00000001c0), 0x8) close(r5) socket$inet_smc(0x2b, 0x1, 0x0) fcntl$setstatus(r5, 0x4, 0x6c00) syz_genetlink_get_family_id$devlink(&(0x7f0000000440), r5) mmap$IORING_OFF_SQ_RING(0x0, 0x3, 0xb, 0x2172, 0xffffffffffffffff, 0x0) io_uring_setup(0x1694, 0x0) fsopen(0x0, 0x1) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_mptcp_buf(r6, 0x11c, 0x4, &(0x7f00000000c0)=""/191, 0x0) 5.559127515s ago: executing program 2 (id=493): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="4c010000100001002cbc700000000008fc000000000000000000000000000001fe8800000000000000000000000000010000ecdf00000000020000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000ffffe0000001000000003200000000000000000000000000000000000000fefffffffffffffffeffffffffffffff030000000000000000000000000000000000000000000300fcffffffffffffff0000000000000000090000000000000001000000000000000008400000000000090000000000000092020000000000000010000000000000000000000000000007350000020004002c00000000000000590002006362632874776f666973682900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000880000006e000b000018002000000000000000407f000000"], 0x14c}}, 0x44050) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000000000000100000001000000200000000076616c006270665f7370696e5f6c6f636b006c6f636b0066"], 0x0, 0x80, 0x0, 0x0, 0x9}, 0x28) recvmmsg(0xffffffffffffffff, &(0x7f0000000d40), 0x0, 0x40, &(0x7f0000000e00)={0x77359400}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x3, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x5, 0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x5, 0x2, 0x6}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000880) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r8, {0x0, 0x3}, {}, {0xfff3, 0xffff}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000d4}, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=@newqdisc={0x434, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r10, {0x8}, {}, {0x5, 0x1}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x0, 0x62b9, 0x5, 0xfffffff7, 0x5, 0x3, 0xe1cb, 0x5, 0x1, 0x3, 0x0, 0x1, 0x2, 0x6, 0xacd, 0x0, 0x364, 0x1, 0x2, 0xffffff44, 0x3, 0x2, 0x8, 0x3, 0x6, 0xffffffc0, 0xb, 0x688, 0xffff, 0x0, 0x2, 0xfffffeff, 0x0, 0xb, 0x5, 0x0, 0x5, 0xffffadc0, 0x8001, 0xf, 0x1, 0x8d2a00, 0x8, 0xf, 0x4ba, 0x1, 0x80, 0xffff, 0x1, 0x7, 0x0, 0x400, 0xe5, 0x93, 0x2, 0x45a5, 0x8, 0x6, 0x4, 0x0, 0x59, 0x3, 0x80, 0x9, 0x5, 0x9, 0x5, 0x3, 0x9, 0x2, 0x3, 0x4, 0x7f, 0x101, 0xde, 0x10, 0x7, 0x6, 0x7f, 0xfff, 0x6, 0x9, 0xf7, 0x5, 0x2, 0x81, 0x0, 0x6, 0x7, 0x1, 0x437, 0x6, 0x3, 0x2, 0x7000000, 0x5, 0x9, 0xecc, 0x6, 0x4, 0x8, 0x3fc, 0x7a5, 0x9, 0x9, 0x0, 0x9, 0x8, 0x0, 0x3, 0x7ff, 0x5, 0x6, 0x4, 0x7, 0x10, 0x4001d1da, 0x8, 0xbdb, 0x1, 0x8, 0x8001, 0xe3c8, 0xffffffff, 0xd, 0x6, 0x4, 0x9, 0x7fffffff, 0x3, 0xb8b4, 0x723, 0x15, 0x9367, 0x81, 0x400000, 0x9, 0x6, 0x75, 0x1ff, 0x5, 0x4, 0xf, 0x7, 0x3, 0x0, 0x3ff, 0x8000, 0xff, 0x4, 0x0, 0x6496, 0x7f, 0x3, 0x0, 0xf528, 0x6, 0x80000000, 0x6, 0x157b, 0x7, 0x40, 0x1, 0x10001, 0x3, 0x9, 0x1, 0x98de, 0x2450, 0x86d, 0x2, 0x7, 0x7, 0xfffffffa, 0x800, 0xfffffffb, 0x4, 0xb6, 0x5, 0x7fff, 0x9f4c, 0x1, 0x8, 0xe, 0x11d, 0x7fff, 0xf, 0x8, 0x3, 0xa, 0x9, 0x9, 0x2, 0x4, 0x2, 0x8, 0x5, 0x5, 0x401, 0x9, 0x4b8, 0xa78, 0xec8, 0x1, 0xfffffffa, 0x80020000, 0x0, 0x0, 0x7f, 0x8c1, 0x5, 0xfffffffa, 0x6, 0x175b, 0x7fffffff, 0x4, 0x4, 0xffff8001, 0x8001, 0xffff, 0x5, 0x0, 0x401, 0x5, 0x10, 0x7fff, 0xffffff00, 0x3, 0x8, 0x9268, 0x80000000, 0x2, 0x7, 0x4, 0x3, 0x4, 0xced, 0x5, 0xa524, 0x7, 0x81f, 0x3, 0x14, 0x80, 0x1ff, 0x1109, 0x9, 0x1, 0x0, 0x2, 0x0, 0x8, 0x3, 0x3, 0x6, 0x4]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0x2004009c}, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000a80), 0x407f, 0xffffffffffffffff, 0x4}, 0x38) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r11, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000600)=ANY=[@ANYBLOB="1c000000020303000000000000000000000100000800010001"], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20004010) sendmsg$NFQNL_MSG_CONFIG(r11, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000020303000000000000000021000000100800010001"], 0x1c}}, 0x0) sendmsg$NFQNL_MSG_VERDICT_BATCH(r11, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="200000000303011e00000000000000000000fffd0c0002000000000000010002"], 0x20}, 0x1, 0x0, 0x0, 0x94f7cfd7d57deaec}, 0x0) 5.034652197s ago: executing program 0 (id=494): prlimit64(0x0, 0xf, &(0x7f0000000140)={0x8, 0x60}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) setns(0xc9, 0x0) r3 = socket$phonet(0x23, 0x2, 0x1) ioctl$SIOCPNADDRESOURCE(r3, 0x89ee, &(0x7f0000000140)=0x1) ioctl$SIOCPNADDRESOURCE(r3, 0x89ef, &(0x7f0000000200)=0x1) request_key(0x0, &(0x7f0000000380)={'syz', 0x1}, &(0x7f0000000200)='q\xa9', 0x0) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)=ANY=[@ANYRES32=0x0, @ANYRES32, @ANYBLOB="cc0ca1c2142f4c8400000000", @ANYRES32=0x0, @ANYRES64=0x0], 0x20) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8923, &(0x7f00000000c0)={'bond_slave_0\x00', @random="013301300108"}) syz_open_dev$tty1(0xc, 0x4, 0x1) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f00000003c0)={'bridge_slave_1\x00', &(0x7f00000001c0)=@ethtool_sset_info={0x4b, 0x21, 0xfffffffffffffffe}}) r4 = syz_open_dev$dvb_frontend(0x0, 0x0, 0x2) ioctl$FE_SET_PROPERTY(r4, 0x40106f52, &(0x7f0000000100)={0x2, &(0x7f00000006c0)}) timerfd_create(0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x20010, 0xffffffffffffffff, 0x0) r5 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000), 0x424801, 0x0) writev(r5, &(0x7f0000000480)=[{&(0x7f0000000200)='\f7', 0x2}], 0x1) write$binfmt_script(r5, &(0x7f0000000b40)={'#! ', './file0', [{0x20, 'e(*'}, {0x20, '[)'}], 0xa, "29a84928b7a0728ada5c2cd0186b0e9cbd7319c068ce412a6bc3e1d9fb1861ea1a4c12fadb67addc8c51b45025e8a41d339674eee524c13b5531abd75a1bfa37240dec465045747e4904641e10ce02e15550680e84a228c0527e0c0c0fa6c04d01a481e1473449c16f6c8cc48e56bae5498177f2848f074e713b47cbe075541102d12fddef7deeb3d8c8324bf87a64f7bba0ef85e8451f649dbc0c0d578f9a98919e7c7231a52c1e6eef4b5a02a6f5c9a5de50dacd44e3cf7cfb5e5061cdcb0b317d00a8ded09c5c6a67c25fb6b5e10dcfe9978e588bbf9f9948a6bbe01ddf6a45da963678f93ebe41cfbf4b35cf9f30dcb48ece4c8002aae09756634f239ccba906b2ff31b30777008597154e7d7aa7b45191c965979e3f1bb0629fa6bdf99117e03f2f1d9d4d07ef73a970a09bb02142ca91e14bf434297f7910f4f01f9cbac124532643054122ee551915771254f12a090c001a16eb9f278407d992c1e7c8e97d0e756e262ab30bdbb8452612caa7f61d95cd4c541b055fecec0e87bb4f683b177dd9f2e2ecc1adaabfacee121fc5d2161d802c052ec333cbfad8f9364baa286e81bdc9d85ac27f6bdc4a7387c08b55408adf90b467f946fcc4cb37908905dde80cd655620b5504df9b91693ea65ad50bd895edce8be5ae1067e18e87f26868bf0ae48d7ea4251ccc0dd6e36806501a8040da116ae507cc280c21d3b29894986b888d36907f1e3351b78128cd5a387a75eac6cc2beeaff95a5c9a76d7c0eaa8e3d3549b4c411a141035327c29ffb40fff65a67d6c579512ef037ab284651a61044c78d9fb930b18d37576dcfc8ea5c5b3c088762f450404b78d89e0ad6f7e9a7332c4a18da1c6fc53552044a15da43b023e7644af509676edb5b45d87fde4f309187134f931a856133d12f72bd982ffb00563fdb31d41f3588219c8e94a44d3be5c6ec6a18378c898e90aa6fb18a1fb907c065ff299ac408c77ebf133d5c22fd722d214d975d665d2c05222f276d38655db90665cb07d904cab7b07be4fa82b05e9c813dc8164aee05b5f5bf37eae085845f22aade242e129da65657d0198ee97f372803d8954f617830fc8c97c3e72e84555d11960fc1992a2184ef4d88cb67a1dc99669885917bcba124f57e590d33f722cdf5aebda62bacc15505b94448ea636de9fbb2b9964d23b384a52b441cff0d398f8dba673a36f36c59a78c837ab78b2f13c7ea746899ccddc065a5423d02b3d985b40ccbd765ff2fcdd3d3274857b325b1491b74009205d564f0ea93faf85eb63656922b02267082d3193e69ba752d648683fd50c970c6df92c1ddb744ee0bf7785b240aafcd0727ccb8dc4011e0906ea2c8aa6a588f8d29dfebbdacbe0c5a46e262fdfd5c352e1480e715ab2ea042fcd73521e5e274ff9998e278422be498615cd419fb530a8b85496a79ea71c8a150fcb846f62adbd734dec260956d879778326e737cf50bae3baa052ce59267ebf9ab8dd6e65dbb4240b56f44eae978f100b97224f36697e9d499a42bf4e50de2400aa838008a76f90af7e56acafc4ce80474885c3f7c271f40febe3e64dad577d092978f9d9c55af05f92f4b042ad963e7f1d2a2da0a1e63643b3c745fc07a47fd8e49c5ae0cdac916f25dcf24274eb22b0c86c27c9300c9b0fdab4280b43fbfdc45ff8743b8497dde42ac039ac4e67db4d78ae43dac425964ea79c9c75e880a4600427783dfe52f0b61d293200045c804a9a7d201c923dad3025fba0ced5f836d96757d835e90064d874e8f45a62f0672d80919411b7a969c183d86b57e11ab74cb650b9684e19b25f50ae499937999075016531afee25a96580c2e8392efa4b8b5c9cbe9ca1110d05ac162554af020f25f7685affb286302bcaa69d79b4805723e71986fd16c5def93c19f0c8a695d04ead8dc5613181d5f62c7fef9b46b8400185d1d9b90f4681bcd868215835f3ad4f228a74126b67723f536b8167bdca5fd4e9a583455d5bf9869b9958183c7ad05f33d077bc9b99c1e2cbb92180e8abc9c16bf3068c9b6c45e5628ff6f8fb1694f6a0066c17aabb5c775df2f8e524005917cb1ff4cd7691019ca9fcc06da0251800a0d0e4ef9cf14fcef4509eb77c36b895dc51bd2a3def93fc3ece3b4f53c05c9c428a08fa9df12e966c5a839bad3939d06c569d2b1e25a396de5e4db938a0923dfff7fbb638c0957eec15b067a33e83bdffa80ab9a8c0c3a8215b8dc8fed26872bb3b7182ee83591c7707c91059decf837815c7824fab20be524ec95bc23a95246587cfb7a6cf1974a1dac00d53bca59cd21cf0731fa5cec11c36d6c714bd3b66e8bca12a74f300220ea6c148d7f58e652c91f050c79073c934a11918f6cdd6f6f738dbecc3faa493c85be7a8f6607a7be3b3d81e2c2c4840387768e64e69f312472febc9fd8f7b31c848dca44f7920be6e9adf31729b1aee6c0e35a57b62807641f9c095b4add5b464eef9c71120fefc9dfab0b19c2d6075abe69212a29ee68002031bed36d9ff6eb167da7f4b5185bb95b7c68c917ad55957a507d2038887b17eb0316150b4734b327bd4353adc0196647834f9092977b3a71f16b4c424891d3a1fc59cf755f1e9a4c12a63c135acd0ca93715a83535bcd046b622b01c00b50140c277e2bb86da497bea6aa767a874c751eef1dd1592e6a23ea73f8a6e331a60104ccdf98c90b4f83056f04c160489803a759433b81f8ad3834fb714ae61b85ce8790a2d7f8bb3d70d11bcd994df1bd107e36f1b2a2f4e0adb9238e3ec7af2709a9150a9f012275bf2812af9e8f6a78e421e8fa0f7f4c5399eaa01297fdc84349e3ad4b99e5da6d59ed75f270db37691bc53e1df1ad33704ebc063542e18031cc14b74c4b5d0f2b2fcc677bbd6c605273088fb6597cbf61fea85fd596e04726c102ce7047eef2334c4f8b2bd35c9f52d0737ea7f351511c47f2e8755b52dca2664868d0ea58f76c0345d692ea7cb9656ff749028b8b522fb8df117e241dd2ee5bd28d0e4cb1e9c72888060f653a9078a7b23745a3cf4e4c03e478de4b08b7864370d528de67d71a80d35117362aa1304f0bbe74a05b712cab11ce6ed72ad303d4742948c6959e70b50244544f1a6a939b9509df4ef7b70d8c3a2ddd082f715645df35dcc0cc1795ba6dc6774ae3648144f91c35af6dc33eac96ef266cd9f65335854b5ded10a15afa5b3277082662f5d4393375db0caf0e0f73066bc046d22ea1f6b102179541fbcb3665fd95bc5d64e5a533e478939d48a298b2b6e5b07fa8815ed18d46d5ae88a9da4caf4fb69eb6c0a134410c61dc5f4181f5078e53d2e14b90093355c806b50a40baf996594f799d17fa04fe4bcda35396587931d1fcbc698ae580dc8bf90496925e5dd0aad968a5215f1e89210b406d2f5b0a97eceb0e29d81488fa161a81c7d71ab2bb4d9f1bff786ade51561a7f399688153bc047db5014a8b5ca914415eed5758fa483fa9d9646cfac9b2163a3db172e45155b6b7e9fc2133498bc9c4ecb33e5a4588f7be77435fd0635ee363b7f2e656d5b7c8a658610d8b5febabd47441b9ab187b572f9fb8ec887dfe6bdda8ef6cc7d5e23ab307c65dc0a6d97491fe02a41a0b9b104e2acd8e864a40b76eeb5efc4a3c544e4660dfbafd2e59a095d71b44750454f2963c96a59e10c922847724aede4ac18f9e7996eedcd26e6cf364cb77465e2c6bceda68aaefae0883954721175fcdb168b1b8e546345620e76fd6fba1116e691246fc5f8413ffd9becf7acf568f43d17d09b6b7492a60d7b555790f85b2e66373fbc81a88007d94c336173af4c750497ef05646748553649c31dc510297392f526b7d39a1634401dc0fdf5ff5399ad7671557024541b5e85e98b2be226937fa5d41230d708b604e7089f33431230ac1015bf584a5ddb6d0d09b60ed1469c97fcadd9714485791170e76859128a72db5ab9466d24d78e1d7d5673dcd34b1c98c8b747c685452b0224a4d65a0d0849cf2b0849c1e1b5a830bca1315c7c660f8629c628602a305f40a9d9b5f360dbb42a3ba35fe915c746f1aded23a3a5c2f50a0f0ece20cce3c9d9d5f5deaa532235acb5f45ee4588cc6902284048ad70f0bb8387a70c1c139dbd9005718952270f7c76539a6ce96868814ab2396d2f9a5b7abdbce913c9fb59e08e9da96d885ffe98138198b4d8bdbd5cfe0013ea22ea8e2cf53118c1d5e6b46a004ed16b31d8a5a448eb18f41b81bf2bf3a21568f545c234386df1776d043de3d69c556bb87ecbe806bb3feeb455f03cd1e69d0764df6cd7e4c2c1437c328af32878c434d96e7815ddfd7feed19fa500a5686d53dcea22ef5d6f7508c3dd172b08020328a0a19607803475709d9badee79e7370093fb160d84b127d7ebee8eb9766f72060c1e9c18c118f4d3839df2e1afdf11dd18e1262699c359eedb29da72dae887c1a70222019b6408a33fdd7506023f5d508ecf3dbe6b097a136ccbc31d1071139f44f7bd4509c9f886c71931e76e25dc8cddc73b647f0c803112778921b3df396e0c0dd52d0a5c368ff2a6ddc85d820274d4debe2af3e26bf15fb85bb5d0934744f172a84f95a6f9fe181a3ce5517025cd1c53470ec69fe768882f8188eab32ce4cf7499a3b14214a8c0977505992c0554f16b552f6bf2735a66b4c394f0180dd80c3c3fa656e51907c80185ff9f5a55254760a79778396ab98044d3a6dca537bd591684fa5672c6874e15830f7990c4c14b19e99064d16782e1290bec6f03ea6b41b705e71ee0b6ac7dc9a55f8a11d05f2a65e81be39ea0091beb2f19f01654a305b01eebc23e3a3c3c441bb248321644f668cbae9d0fd06107928d97405f94fe31035c206effa5983ec75eced73386db55b5f01fe17c4ffb29cd0d4c850985129a8919df2ea4fb219d96e69400861963ba2b5e861de73e434e3f347b27bb6cb7a70829797a49d0a18a1c116dee10dbf4b5f23e2bd74cb31611a5d7cceac30977f42bcfbd52610cc0d0e0b0cc4b24105c7f2aff4750aa65ee942a77f3a342999db4f00378b0f4a74c081401c19513f220b29a6924e76fb6fefe8c7b964e60b5870ded14f072912d864b3f70d758f21e2cf32b5acd5847fa338b8bf9599bdf0c8d301701e04ba4b01bd8e155edd2fc0b5f4aae8eeaa9d03432def8cccdd85e56b9cd928bb619537d81a8b0ebc4725d7a319d28af6c5b473"}, 0xe75) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) syz_open_dev$hiddev(0x0, 0x0, 0x6402) syz_usb_connect(0x0, 0x36, &(0x7f00000004c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001", @ANYRES32], &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) 4.857820791s ago: executing program 3 (id=495): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="4c010000100001002cbc700000000008fc000000000000000000000000000001fe8800000000000000000000000000010000ecdf000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000ffffe0000001000000003200000000000000000000000000000000000000fefffffffffffffffeffffffffffffff030000000000000000000000000000000000000000000300fcffffffffffffff0000000000000000090000000000000001000000000000000008400000000000090000000000000092020000000000000010000000000000000000000000000007350000020004002c00000000000000590002006362632874776f666973682900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000880000006e000b000018002000000000000000407f000000"], 0x14c}}, 0x44050) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000000000000100000001000000200000000076616c006270665f7370696e5f6c6f636b006c6f63"], 0x0, 0x80, 0x0, 0x0, 0x9}, 0x28) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x1, 0x4, 0x8, 0xbc0, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, r2, 0x1, 0x3}, 0x50) recvmmsg(0xffffffffffffffff, &(0x7f0000000d40), 0x0, 0x40, &(0x7f0000000e00)={0x77359400}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x3, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x5, 0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x5, 0x2, 0x6}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000880) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r10, {0x0, 0x3}, {}, {0xfff3, 0xffff}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000d4}, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) r12 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=@newqdisc={0x434, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r13, {0x8}, {}, {0x5, 0x1}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x0, 0x62b9, 0x5, 0xfffffff7, 0x5, 0x3, 0xe1cb, 0x5, 0x1, 0x3, 0x0, 0x1, 0x2, 0x6, 0xacd, 0x0, 0x364, 0x1, 0x2, 0xffffff44, 0x3, 0x2, 0x8, 0x3, 0x6, 0xffffffc0, 0xb, 0x688, 0xffff, 0x0, 0x2, 0xfffffeff, 0x0, 0xb, 0x5, 0x0, 0x5, 0xffffadc0, 0x8001, 0xf, 0x1, 0x8d2a00, 0x8, 0xf, 0x4ba, 0x1, 0x80, 0xffff, 0x1, 0x7, 0x0, 0x400, 0xe5, 0x93, 0x2, 0x45a5, 0x8, 0x6, 0x4, 0x0, 0x59, 0x3, 0x80, 0x9, 0x5, 0x9, 0x5, 0x3, 0x9, 0x2, 0x3, 0x4, 0x7f, 0x101, 0xde, 0x10, 0x7, 0x6, 0x7f, 0xfff, 0x6, 0x9, 0xf7, 0x5, 0x2, 0x81, 0x0, 0x6, 0x7, 0x1, 0x437, 0x6, 0x3, 0x2, 0x7000000, 0x5, 0x9, 0xecc, 0x6, 0x4, 0x8, 0x3fc, 0x7a5, 0x9, 0x9, 0x0, 0x9, 0x8, 0x0, 0x3, 0x7ff, 0x5, 0x6, 0x4, 0x7, 0x10, 0x4001d1da, 0x8, 0xbdb, 0x1, 0x8, 0x8001, 0xe3c8, 0xffffffff, 0xd, 0x6, 0x4, 0x9, 0x7fffffff, 0x3, 0xb8b4, 0x723, 0x15, 0x9367, 0x81, 0x400000, 0x9, 0x6, 0x75, 0x1ff, 0x5, 0x4, 0xf, 0x7, 0x3, 0x0, 0x3ff, 0x8000, 0xff, 0x4, 0x0, 0x6496, 0x7f, 0x3, 0x0, 0xf528, 0x6, 0x80000000, 0x6, 0x157b, 0x7, 0x40, 0x1, 0x10001, 0x3, 0x9, 0x1, 0x98de, 0x2450, 0x86d, 0x2, 0x7, 0x7, 0xfffffffa, 0x800, 0xfffffffb, 0x4, 0xb6, 0x5, 0x7fff, 0x9f4c, 0x1, 0x8, 0xe, 0x11d, 0x7fff, 0xf, 0x8, 0x3, 0xa, 0x9, 0x9, 0x2, 0x4, 0x2, 0x8, 0x5, 0x5, 0x401, 0x9, 0x4b8, 0xa78, 0xec8, 0x1, 0xfffffffa, 0x80020000, 0x0, 0x0, 0x7f, 0x8c1, 0x5, 0xfffffffa, 0x6, 0x175b, 0x7fffffff, 0x4, 0x4, 0xffff8001, 0x8001, 0xffff, 0x5, 0x0, 0x401, 0x5, 0x10, 0x7fff, 0xffffff00, 0x3, 0x8, 0x9268, 0x80000000, 0x2, 0x7, 0x4, 0x3, 0x4, 0xced, 0x5, 0xa524, 0x7, 0x81f, 0x3, 0x14, 0x80, 0x1ff, 0x1109, 0x9, 0x1, 0x0, 0x2, 0x0, 0x8, 0x3, 0x3, 0x6, 0x4]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0x2004009c}, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000a80), 0x407f, r3, 0x4}, 0x38) r14 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r14, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000600)=ANY=[@ANYBLOB="1c000000020303000000000000000000000100000800010001"], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20004010) sendmsg$NFQNL_MSG_CONFIG(r14, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000020303000000000000000021000000100800010001"], 0x1c}}, 0x0) sendmsg$NFQNL_MSG_VERDICT_BATCH(r14, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="200000000303011e00000000000000000000fffd0c0002000000000000010002"], 0x20}, 0x1, 0x0, 0x0, 0x94f7cfd7d57deaec}, 0x0) 2.982914962s ago: executing program 1 (id=496): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="4c010000100001002cbc700000000008fc000000000000000000000000000001fe8800000000000000000000000000010000ecdf000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000ffffe0000001000000003200000000000000000000000000000000000000fefffffffffffffffeffffffffffffff030000000000000000000000000000000000000000000300fcffffffffffffff0000000000000000090000000000000001000000000000000008400000000000090000000000000092020000000000000010000000000000000000000000000007350000020004002c00000000000000590002006362632874776f666973682900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000880000006e000b000018002000000000000000407f000000"], 0x14c}}, 0x44050) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000000000000100000001000000200000000076616c006270665f7370696e5f6c6f636b006c6f636b0066"], 0x0, 0x80, 0x0, 0x0, 0x9}, 0x28) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x1, 0x4, 0x8, 0xbc0, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, r2, 0x1, 0x3}, 0x50) recvmmsg(0xffffffffffffffff, &(0x7f0000000d40), 0x0, 0x40, &(0x7f0000000e00)={0x77359400}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x3, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x5, 0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x5, 0x2, 0x6}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000880) r7 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, 0x0, {0x0, 0x3}, {}, {0xfff3, 0xffff}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000d4}, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=@newqdisc={0x434, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r9, {0x8}, {}, {0x5, 0x1}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x0, 0x62b9, 0x5, 0xfffffff7, 0x5, 0x3, 0xe1cb, 0x5, 0x1, 0x3, 0x0, 0x1, 0x2, 0x6, 0xacd, 0x0, 0x364, 0x1, 0x2, 0xffffff44, 0x3, 0x2, 0x8, 0x3, 0x6, 0xffffffc0, 0xb, 0x688, 0xffff, 0x0, 0x2, 0xfffffeff, 0x0, 0xb, 0x5, 0x0, 0x5, 0xffffadc0, 0x8001, 0xf, 0x1, 0x8d2a00, 0x8, 0xf, 0x4ba, 0x1, 0x80, 0xffff, 0x1, 0x7, 0x0, 0x400, 0xe5, 0x93, 0x2, 0x45a5, 0x8, 0x6, 0x4, 0x0, 0x59, 0x3, 0x80, 0x9, 0x5, 0x9, 0x5, 0x3, 0x9, 0x2, 0x3, 0x4, 0x7f, 0x101, 0xde, 0x10, 0x7, 0x6, 0x7f, 0xfff, 0x6, 0x9, 0xf7, 0x5, 0x2, 0x81, 0x0, 0x6, 0x7, 0x1, 0x437, 0x6, 0x3, 0x2, 0x7000000, 0x5, 0x9, 0xecc, 0x6, 0x4, 0x8, 0x3fc, 0x7a5, 0x9, 0x9, 0x0, 0x9, 0x8, 0x0, 0x3, 0x7ff, 0x5, 0x6, 0x4, 0x7, 0x10, 0x4001d1da, 0x8, 0xbdb, 0x1, 0x8, 0x8001, 0xe3c8, 0xffffffff, 0xd, 0x6, 0x4, 0x9, 0x7fffffff, 0x3, 0xb8b4, 0x723, 0x15, 0x9367, 0x81, 0x400000, 0x9, 0x6, 0x75, 0x1ff, 0x5, 0x4, 0xf, 0x7, 0x3, 0x0, 0x3ff, 0x8000, 0xff, 0x4, 0x0, 0x6496, 0x7f, 0x3, 0x0, 0xf528, 0x6, 0x80000000, 0x6, 0x157b, 0x7, 0x40, 0x1, 0x10001, 0x3, 0x9, 0x1, 0x98de, 0x2450, 0x86d, 0x2, 0x7, 0x7, 0xfffffffa, 0x800, 0xfffffffb, 0x4, 0xb6, 0x5, 0x7fff, 0x9f4c, 0x1, 0x8, 0xe, 0x11d, 0x7fff, 0xf, 0x8, 0x3, 0xa, 0x9, 0x9, 0x2, 0x4, 0x2, 0x8, 0x5, 0x5, 0x401, 0x9, 0x4b8, 0xa78, 0xec8, 0x1, 0xfffffffa, 0x80020000, 0x0, 0x0, 0x7f, 0x8c1, 0x5, 0xfffffffa, 0x6, 0x175b, 0x7fffffff, 0x4, 0x4, 0xffff8001, 0x8001, 0xffff, 0x5, 0x0, 0x401, 0x5, 0x10, 0x7fff, 0xffffff00, 0x3, 0x8, 0x9268, 0x80000000, 0x2, 0x7, 0x4, 0x3, 0x4, 0xced, 0x5, 0xa524, 0x7, 0x81f, 0x3, 0x14, 0x80, 0x1ff, 0x1109, 0x9, 0x1, 0x0, 0x2, 0x0, 0x8, 0x3, 0x3, 0x6, 0x4]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0x2004009c}, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000a80), 0x407f, r3, 0x4}, 0x38) 2.887430105s ago: executing program 2 (id=497): mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x30) openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x42, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$sock_cred(r1, 0x1, 0x11, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, 0x0, 0x40000) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = epoll_create1(0x80000) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/wakeup_count', 0x0, 0x10) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r6, &(0x7f00000000c0)={0xe000001a}) read$FUSE(r6, &(0x7f0000000b00)={0x2020}, 0x2020) r7 = socket$inet_tcp(0x2, 0x1, 0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r7, &(0x7f0000000300)={0x60000018}) epoll_pwait(r5, &(0x7f0000000240), 0x0, 0xdf4, 0x0, 0x0) 118.556076ms ago: executing program 1 (id=498): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) socket$inet6(0xa, 0x80003, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x4}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) recvmmsg(r3, &(0x7f0000000400)=[{{0x0, 0xf5ffffff, 0x0, 0x0, 0x0, 0x4000000, 0xfff5}}], 0xf00, 0x0, 0x0) shutdown(r3, 0x0) 3.242091ms ago: executing program 4 (id=499): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(r0, &(0x7f0000000000)=':', 0x1, 0x3) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000740)=ANY=[@ANYBLOB="58010000100005000100000000000000000000000000000000000000000000010000000000000000000000000000000100000000000000000a00808000000000", @ANYRES32=0x80, @ANYBLOB="00000000000000fd00000000000000010000123433000000000000000000000000000000000000010000000000000000ffffffffffffffffffffffffffffffffffffffb8ffffffff0000000000000000000098000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000a000000800000000000000048000100686d61632873686131290000000000000000000000000000000000000000000000000000007100000000000000000000000000000000000000000000000000000000000020001700010004"], 0x158}}, 0x0) 0s ago: executing program 3 (id=500): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) syz_io_uring_setup(0x3bd4, 0x0, 0x0, 0x0, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) listen(r1, 0x5) io_uring_register$IORING_UNREGISTER_IOWQ_AFF(0xffffffffffffffff, 0x12, 0x0, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) r2 = socket(0x2b, 0x80801, 0x1) connect$inet6(r2, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000040)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/dlm/cluster/comms/1/addr\x00', 0x1, 0x0) write(r3, &(0x7f0000000280)="02", 0x1) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_DELETE(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x20, 0x2, 0x2, 0x801, 0x0, 0x0, {0x5, 0x0, 0x4}, [@CTA_EXPECT_HELP_NAME={0xa, 0x6, 'Q.931\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000010}, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB='\a\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="2005316e822b04e36b346e8196c785f42b5321dfd6326a0d58e4f04c88f493e00046d522a32db8bd821a54e9cb1d9c37e8c33bc2627b29411eb50083ef9c0b26949709c8ce19adea74fe874e1cd30a8254752c4f478b29f6b97289ef578872749dc4b295fd3e1f1a961ab7e75f8543802dfe59f31b68a1000f4a1aecfdd96dff70e1fef83302a2e24d9280e2e9f0807fde", @ANYRES32=0x0, @ANYBLOB, @ANYRES64=0x0], 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000700)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000600)={0xffffffffffffffff, &(0x7f0000000640), &(0x7f0000000680)=@tcp=r0}, 0x20) sendto(r0, &(0x7f0000000800)="01", 0xfdef, 0x2d, 0x0, 0x0) kernel console output (not intermixed with test programs): _t tclass=rds_socket permissive=1 [ 159.782425][ T6640] netlink: 24 bytes leftover after parsing attributes in process `syz.3.217'. [ 159.814171][ T31] audit: type=1400 audit(1789829303.483:509): avc: denied { mounton } for pid=6636 comm="syz.0.218" path="/37/file0" dev="tmpfs" ino=218 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 159.857322][ T31] audit: type=1400 audit(1789829303.523:510): avc: denied { create } for pid=6641 comm="syz.4.204" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 159.858413][ T31] audit: type=1400 audit(1789829303.523:511): avc: denied { ioctl } for pid=6641 comm="syz.4.204" path="socket:[12141]" dev="sockfs" ino=12141 ioctlcmd=0x89ee scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 159.885679][ T6645] FAULT_INJECTION: forcing a failure. [ 159.885679][ T6645] name failslab, interval 1, probability 0, space 0, times 0 [ 159.885706][ T6645] CPU: 0 UID: 0 PID: 6645 Comm: syz.0.218 Not tainted syzkaller #0 PREEMPT(full) [ 159.885724][ T6645] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 159.885733][ T6645] Call Trace: [ 159.885739][ T6645] [ 159.885745][ T6645] dump_stack_lvl+0x100/0x190 [ 159.885774][ T6645] should_fail_ex.cold+0x5/0xa [ 159.885797][ T6645] should_failslab+0xc2/0x120 [ 159.885818][ T6645] __kmalloc_noprof+0xfc/0x840 [ 159.885835][ T6645] ? rcu_is_watching+0x13/0xc0 [ 159.885856][ T6645] ? tomoyo_encode2+0xfb/0x3c0 [ 159.885880][ T6645] tomoyo_encode2+0xfb/0x3c0 [ 159.885902][ T6645] tomoyo_encode+0x29/0x50 [ 159.885920][ T6645] tomoyo_realpath_from_path+0x18c/0x690 [ 159.885945][ T6645] tomoyo_path_perm+0x276/0x460 [ 159.885960][ T6645] ? tomoyo_path_perm+0x262/0x460 [ 159.885978][ T6645] ? __pfx_tomoyo_path_perm+0x10/0x10 [ 159.885993][ T6645] ? __pfx_stack_trace_save+0x10/0x10 [ 159.886016][ T6645] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 159.886038][ T6645] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 159.886071][ T6645] ? __pfx_cred_has_capability.isra.0+0x10/0x10 [ 159.886098][ T6645] tomoyo_sb_umount+0x8c/0xd0 [ 159.886119][ T6645] ? __pfx_tomoyo_sb_umount+0x10/0x10 [ 159.886145][ T6645] security_sb_umount+0xc4/0x210 [ 159.886162][ T6645] path_umount+0x328/0x1270 [ 159.886186][ T6645] ? putname+0xb1/0x110 [ 159.886208][ T6645] ? __pfx_path_umount+0x10/0x10 [ 159.886231][ T6645] ? putname+0xb6/0x110 [ 159.886253][ T6645] __x64_sys_umount+0x16a/0x1a0 [ 159.886275][ T6645] ? __pfx___x64_sys_umount+0x10/0x10 [ 159.886303][ T6645] do_syscall_64+0x123/0x790 [ 159.886328][ T6645] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 159.886345][ T6645] RIP: 0033:0x7f4b7479e159 [ 159.886359][ T6645] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 159.886374][ T6645] RSP: 002b:00007f4b755ef028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 159.886390][ T6645] RAX: ffffffffffffffda RBX: 00007f4b74a26180 RCX: 00007f4b7479e159 [ 159.886401][ T6645] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000200000000380 [ 159.886410][ T6645] RBP: 00007f4b755ef090 R08: 0000000000000000 R09: 0000000000000000 [ 159.886420][ T6645] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 159.886430][ T6645] R13: 00007f4b74a26218 R14: 00007f4b74a26180 R15: 00007fff89975728 [ 159.886452][ T6645] [ 159.886466][ T6645] ERROR: Out of memory at tomoyo_realpath_from_path. [ 159.914711][ T31] audit: type=1400 audit(1789829303.553:512): avc: denied { unmount } for pid=6636 comm="syz.0.218" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 160.132794][ T2279] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 160.297882][ T2279] usb 4-1: unable to get BOS descriptor or descriptor too short [ 160.297924][ T2279] usb 4-1: New USB device found, idVendor=8086, idProduct=0ad2, bcdDevice= 0.00 [ 160.298912][ T2279] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 160.301174][ T2279] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 160.301197][ T2279] usb 4-1: Product: syz [ 160.301210][ T2279] usb 4-1: Manufacturer: syz [ 160.419482][ T2279] uvcvideo 4-1:1.0: Found UVC 1.00 device syz (8086:0ad2) [ 160.434398][ T1214] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 161.008110][ T2279] uvcvideo 4-1:1.0: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 161.008450][ T2279] uvcvideo 4-1:1.1: Failed to query (GET_CUR) UVC probe control : -71 (exp. 26). [ 161.008497][ T2279] uvcvideo 4-1:1.1: Failed to initialize the device (-71). [ 161.015539][ T2279] uvcvideo 4-1:1.0: probe with driver uvcvideo failed with error -71 [ 161.020305][ T2279] usb 4-1: USB disconnect, device number 6 [ 161.065343][ T1214] usb 5-1: Using ep0 maxpacket: 8 [ 161.067207][ T1214] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 161.068059][ T1214] usb 5-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 161.068080][ T1214] usb 5-1: config 255 has 0 interfaces, different from the descriptor's value: 1 [ 161.068859][ T1214] usb 5-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 161.068880][ T1214] usb 5-1: config 255 has 0 interfaces, different from the descriptor's value: 1 [ 161.069701][ T1214] usb 5-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 161.069720][ T1214] usb 5-1: config 255 has 0 interfaces, different from the descriptor's value: 1 [ 161.076887][ T1214] usb 5-1: string descriptor 0 read error: -22 [ 161.076977][ T1214] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 161.089613][ T1214] usb 5-1: rejected 3 configurations due to insufficient available bus power [ 161.089634][ T1214] usb 5-1: no configuration chosen from 3 choices [ 161.184061][ T983] usb 2-1: new full-speed USB device number 14 using dummy_hcd [ 161.338957][ T983] usb 2-1: New USB device found, idVendor=1044, idProduct=7001, bcdDevice= 5.20 [ 161.340110][ T983] usb 2-1: config 4 has an invalid interface number: 44 but max is 0 [ 161.340132][ T983] usb 2-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 161.340149][ T983] usb 2-1: config 4 has no interface number 0 [ 161.340180][ T983] usb 2-1: config 4 interface 44 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 161.354219][ T983] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 161.354243][ T983] usb 2-1: Product: syz [ 161.354256][ T983] usb 2-1: Manufacturer: syz [ 161.354269][ T983] usb 2-1: SerialNumber: syz [ 161.426537][ T1214] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 161.454618][ T31] audit: type=1400 audit(1789829305.123:513): avc: denied { listen } for pid=6658 comm="syz.2.223" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 161.454878][ T31] audit: type=1400 audit(1789829305.123:514): avc: denied { getopt } for pid=6658 comm="syz.2.223" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 161.595125][ T1214] usb 1-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 161.596004][ T1214] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 161.596040][ T1214] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 161.596060][ T1214] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 161.596081][ T1214] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 161.600726][ T1214] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 161.600751][ T1214] usb 1-1: Product: syz [ 161.600765][ T1214] usb 1-1: Manufacturer: syz [ 161.600779][ T1214] usb 1-1: SerialNumber: syz [ 161.993403][ T6655] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 162.024896][ T6655] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 162.084013][ T983] dvb-usb: found a 'Gigabyte U7000' in warm state. [ 162.273535][ T983] dvb-usb: will use the device's hardware PID filter (table count: 32). [ 162.298534][ T983] dvbdev: DVB: registering new adapter (Gigabyte U7000) [ 162.299383][ T983] usb 2-1: media controller created [ 162.438722][ T983] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 162.870810][ T6669] netlink: 8 bytes leftover after parsing attributes in process `syz.3.226'. [ 162.904290][ T1214] usb 1-1: Cannot retrieve CPort count: -71 [ 162.904438][ T1214] usb 1-1: Cannot retrieve CPort count: -71 [ 162.904566][ T1214] es2_ap_driver 1-1:1.0: probe with driver es2_ap_driver failed with error -71 [ 164.417018][ T1214] usb 1-1: USB disconnect, device number 5 [ 164.465294][ T5726] usb 5-1: USB disconnect, device number 11 [ 164.499024][ T983] DVB: Unable to find symbol dib7000p_attach() [ 164.499039][ T983] dvb-usb: no frontend was attached by 'Gigabyte U7000' [ 164.616709][ T31] audit: type=1400 audit(1789829308.283:515): avc: denied { write } for pid=6676 comm="syz.2.230" name="mtd0" dev="devtmpfs" ino=702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 164.616757][ T31] audit: type=1400 audit(1789829308.283:516): avc: denied { open } for pid=6676 comm="syz.2.230" path="/dev/mtd0" dev="devtmpfs" ino=702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 164.618536][ T31] audit: type=1400 audit(1789829308.283:517): avc: denied { ioctl } for pid=6676 comm="syz.2.230" path="/dev/mtd0" dev="devtmpfs" ino=702 ioctlcmd=0x4d02 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 164.700458][ T983] rc_core: IR keymap rc-dib0700-rc5 not found [ 164.700477][ T983] Registered IR keymap rc-empty [ 164.700676][ T983] dvb-usb: could not initialize remote control. [ 164.700686][ T983] dvb-usb: Gigabyte U7000 successfully initialized and connected. [ 164.728312][ T983] usb 2-1: USB disconnect, device number 14 [ 164.743997][ T983] dvb-usb: Gigabyte U7000 successfully deinitialized and disconnected. [ 164.815991][ T31] audit: type=1400 audit(1789829308.483:518): avc: denied { write } for pid=6678 comm="syz.1.229" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 164.957877][ T6684] FAULT_INJECTION: forcing a failure. [ 164.957877][ T6684] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 164.957909][ T6684] CPU: 0 UID: 0 PID: 6684 Comm: syz.3.231 Not tainted syzkaller #0 PREEMPT(full) [ 164.957935][ T6684] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 164.957946][ T6684] Call Trace: [ 164.957953][ T6684] [ 164.957960][ T6684] dump_stack_lvl+0x100/0x190 [ 164.957989][ T6684] should_fail_ex.cold+0x5/0xa [ 164.958006][ T6684] ? prepare_alloc_pages+0x16d/0x5b0 [ 164.958030][ T6684] should_fail_alloc_page+0xeb/0x140 [ 164.958051][ T6684] prepare_alloc_pages+0x1f0/0x5b0 [ 164.958068][ T6684] ? is_bpf_text_address+0x8a/0x1a0 [ 164.958087][ T6684] ? lock_release+0x24d/0x310 [ 164.958105][ T6684] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 164.958121][ T6684] ? kernel_text_address+0x8d/0x100 [ 164.958143][ T6684] ? __kernel_text_address+0xd/0x30 [ 164.958165][ T6684] ? unwind_get_return_address+0x59/0xa0 [ 164.958186][ T6684] ? arch_stack_walk+0xa6/0xf0 [ 164.958212][ T6684] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 164.958226][ T6684] ? stack_trace_save+0x8e/0xc0 [ 164.958240][ T6684] ? __pfx_stack_trace_save+0x10/0x10 [ 164.958257][ T6684] ? check_noncircular+0x97/0x160 [ 164.958273][ T6684] ? add_lock_to_list+0x9d/0x1d0 [ 164.958289][ T6684] ? check_prev_add+0x354/0xe60 [ 164.958302][ T6684] ? lockdep_hardirqs_on+0x7d/0x110 [ 164.958322][ T6684] ? __pfx_flush_tlb_func+0x10/0x10 [ 164.958341][ T6684] ? __lock_acquire+0xe8b/0x1f40 [ 164.958355][ T6684] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 164.958373][ T6684] ? policy_nodemask+0xed/0x4f0 [ 164.958394][ T6684] alloc_pages_mpol+0x201/0x550 [ 164.958414][ T6684] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 164.958433][ T6684] ? do_raw_spin_lock+0x128/0x260 [ 164.958451][ T6684] ? find_held_lock+0x2b/0x80 [ 164.958471][ T6684] ? swap_cache_alloc_folio+0x374/0xc50 [ 164.958489][ T6684] folio_alloc_mpol_noprof+0x36/0x260 [ 164.958512][ T6684] swap_cache_alloc_folio+0x3d7/0xc50 [ 164.958530][ T6684] ? __pfx_swap_cache_alloc_folio+0x10/0x10 [ 164.958546][ T6684] ? swap_cache_get_folio+0x28d/0x360 [ 164.958560][ T6684] ? __pfx_swap_cache_get_folio+0x10/0x10 [ 164.958576][ T6684] ? __lock_acquire+0x5c0/0x1f40 [ 164.958594][ T6684] swap_cache_read_folio+0x47/0x140 [ 164.958612][ T6684] swap_cluster_readahead+0x369/0x5d0 [ 164.958631][ T6684] ? __pfx_swap_cluster_readahead+0x10/0x10 [ 164.958651][ T6684] ? swap_table_get+0x10d/0x2c0 [ 164.958683][ T6684] shmem_swapin_folio+0x2377/0x2d60 [ 164.958715][ T6684] ? __pfx_shmem_swapin_folio+0x10/0x10 [ 164.958740][ T6684] ? filemap_get_entry+0x237/0x450 [ 164.958760][ T6684] ? __pfx_filemap_get_entry+0x10/0x10 [ 164.958783][ T6684] ? xas_load+0x44/0x5c0 [ 164.958808][ T6684] shmem_get_folio_gfp+0x600/0x1980 [ 164.958835][ T6684] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 164.958859][ T6684] ? filemap_map_pages+0x1155/0x2060 [ 164.958881][ T6684] shmem_fault+0x1fb/0xa30 [ 164.958903][ T6684] ? __pfx_shmem_fault+0x10/0x10 [ 164.958927][ T6684] ? __pfx_filemap_map_pages+0x10/0x10 [ 164.958953][ T6684] ? find_held_lock+0x2b/0x80 [ 164.958974][ T6684] ? __pfx_filemap_map_pages+0x10/0x10 [ 164.958991][ T6684] __do_fault+0x10b/0x440 [ 164.959008][ T6684] do_fault+0xb3f/0x1830 [ 164.959028][ T6684] ? __pfx_do_fault+0x10/0x10 [ 164.959044][ T6684] ? rcu_read_unlock+0x2d/0xb0 [ 164.959064][ T6684] ? rcu_read_unlock+0x2d/0xb0 [ 164.959085][ T6684] ? __pte_offset_map+0x179/0x310 [ 164.959104][ T6684] __handle_mm_fault+0x150b/0x2f60 [ 164.959129][ T6684] ? __pfx___handle_mm_fault+0x10/0x10 [ 164.959148][ T6684] ? __pfx_mt_find+0x10/0x10 [ 164.959172][ T6684] ? find_vma+0xbf/0x140 [ 164.959187][ T6684] ? __pfx_find_vma+0x10/0x10 [ 164.959205][ T6684] handle_mm_fault+0x363/0xa20 [ 164.959229][ T6684] do_user_addr_fault+0x745/0x12f0 [ 164.959254][ T6684] exc_page_fault+0x6f/0xd0 [ 164.959275][ T6684] asm_exc_page_fault+0x26/0x30 [ 164.959288][ T6684] RIP: 0010:__get_user_1+0x14/0x40 [ 164.959306][ T6684] Code: 00 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 ba 00 f0 ff ff ff 7f 00 00 48 39 d0 48 0f 47 c2 0f 01 cb <0f> b6 10 31 c0 0f 01 ca c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 [ 164.959320][ T6684] RSP: 0018:ffffc9000d81fce8 EFLAGS: 00050287 [ 164.959333][ T6684] RAX: 0000200000000000 RBX: ffff88806ad50000 RCX: 0000000000000000 [ 164.959342][ T6684] RDX: 00007ffffffff000 RSI: ffffffff826172c1 RDI: ffffffff8c623480 [ 164.959351][ T6684] RBP: 000000004001af84 R08: 0000000000068eec R09: 00000000000001d0 [ 164.959360][ T6684] R10: 0000000000000200 R11: 0000000000000001 R12: 0000200000000000 [ 164.959369][ T6684] R13: 1ffff92001b03fa6 R14: dffffc0000000000 R15: ffff88806ad50008 [ 164.959384][ T6684] ? __might_fault+0x111/0x140 [ 164.959409][ T6684] vhost_dev_ioctl+0x421/0xe70 [ 164.959425][ T6684] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 164.959443][ T6684] ? do_vfs_ioctl+0x226/0x13e0 [ 164.959457][ T6684] ? __pfx_vhost_dev_ioctl+0x10/0x10 [ 164.959472][ T6684] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 164.959491][ T6684] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 164.959514][ T6684] vhost_vsock_dev_ioctl+0x320/0xb70 [ 164.959530][ T6684] ? __pfx_vhost_vsock_dev_ioctl+0x10/0x10 [ 164.959548][ T6684] ? selinux_file_ioctl+0x13b/0x290 [ 164.959563][ T6684] ? selinux_file_ioctl+0xb6/0x290 [ 164.959580][ T6684] ? __pfx_vhost_vsock_dev_ioctl+0x10/0x10 [ 164.959596][ T6684] __x64_sys_ioctl+0x18e/0x210 [ 164.959613][ T6684] do_syscall_64+0x123/0x790 [ 164.959635][ T6684] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 164.959649][ T6684] RIP: 0033:0x7ff03179e159 [ 164.959661][ T6684] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 164.959674][ T6684] RSP: 002b:00007ff032715028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 164.959686][ T6684] RAX: ffffffffffffffda RBX: 00007ff031a25fa0 RCX: 00007ff03179e159 [ 164.959695][ T6684] RDX: 0000200000000000 RSI: 000000004001af84 RDI: 0000000000000003 [ 164.959704][ T6684] RBP: 00007ff032715090 R08: 0000000000000000 R09: 0000000000000000 [ 164.959713][ T6684] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 164.959721][ T6684] R13: 00007ff031a26038 R14: 00007ff031a25fa0 R15: 00007fff39ab24f8 [ 164.959741][ T6684] [ 165.959160][ T6677] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=6677 comm=syz.2.230 [ 166.494084][ T983] usb 1-1: new low-speed USB device number 6 using dummy_hcd [ 166.650198][ T983] usb 1-1: unable to get BOS descriptor or descriptor too short [ 166.650249][ T983] usb 1-1: New USB device found, idVendor=0c2e, idProduct=0720, bcdDevice=d4.29 [ 166.651128][ T983] usb 1-1: config 8 has an invalid interface number: 109 but max is 0 [ 166.651150][ T983] usb 1-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 166.651168][ T983] usb 1-1: config 8 has no interface number 0 [ 166.651200][ T983] usb 1-1: config 8 interface 109 altsetting 0 endpoint 0x3 has invalid maxpacket 512, setting to 8 [ 166.651226][ T983] usb 1-1: config 8 interface 109 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 166.651250][ T983] usb 1-1: config 8 interface 109 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 166.653677][ T983] usb 1-1: string descriptor 0 read error: -22 [ 166.653777][ T983] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 166.755302][ T983] metro_usb 1-1:8.109: Metrologic USB to Serial converter detected [ 166.764130][ T983] usb 1-1: Metrologic USB to Serial converter now attached to ttyUSB0 [ 166.884034][ T9] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 166.928380][ T6745] netlink: 8 bytes leftover after parsing attributes in process `syz.2.242'. [ 167.175143][ T9] usb 2-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice= 0.00 [ 167.261324][ T9] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 167.261376][ T9] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 167.261397][ T9] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 167.261431][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 168.267556][ T9] usb 2-1: probing VID:PID(0424:012C) [ 168.269028][ T9] usb 2-1: vub300 testing BULK IN EndPoint(0) 81 [ 168.269051][ T9] usb 2-1: vub300 testing UNKNOWN EndPoint(1) 02 [ 168.269068][ T9] usb 2-1: vub300 ignoring EndPoint(1) 02 [ 168.269084][ T9] usb 2-1: Could not find two sets of bulk-in/out endpoint pairs [ 168.270500][ T9] vub300 2-1:1.0: probe with driver vub300 failed with error -22 [ 168.536672][ T5726] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 169.114130][ T5726] usb 5-1: Using ep0 maxpacket: 32 [ 169.115418][ T5726] usb 5-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 169.116466][ T5726] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 169.118634][ T5726] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 169.118657][ T5726] usb 5-1: Product: syz [ 169.118671][ T5726] usb 5-1: Manufacturer: syz [ 169.118686][ T5726] usb 5-1: SerialNumber: syz [ 169.121891][ T5726] usb 5-1: config 0 descriptor?? [ 169.123529][ T5726] hub 5-1:0.0: bad descriptor, ignoring hub [ 169.123551][ T5726] hub 5-1:0.0: probe with driver hub failed with error -5 [ 169.591264][ T6768] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 169.694266][ T5726] usb 5-1: USB disconnect, device number 12 [ 169.718516][ T6761] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 170.405390][ T30] usb 2-1: USB disconnect, device number 15 [ 170.627857][ T6784] FAULT_INJECTION: forcing a failure. [ 170.627857][ T6784] name failslab, interval 1, probability 0, space 0, times 0 [ 170.627900][ T6784] CPU: 0 UID: 0 PID: 6784 Comm: syz.2.250 Not tainted syzkaller #0 PREEMPT(full) [ 170.627927][ T6784] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 170.627938][ T6784] Call Trace: [ 170.627944][ T6784] [ 170.627951][ T6784] dump_stack_lvl+0x100/0x190 [ 170.627983][ T6784] should_fail_ex.cold+0x5/0xa [ 170.628009][ T6784] should_failslab+0xc2/0x120 [ 170.628035][ T6784] kmem_cache_alloc_noprof+0x92/0x6a0 [ 170.628055][ T6784] ? __pfx_map_id_range_down+0x10/0x10 [ 170.628076][ T6784] ? rcu_is_watching+0x13/0xc0 [ 170.628100][ T6784] ? security_inode_alloc+0x3b/0x2c0 [ 170.628125][ T6784] security_inode_alloc+0x3b/0x2c0 [ 170.628145][ T6784] inode_init_always_gfp+0xc6f/0xfb0 [ 170.628173][ T6784] alloc_inode+0x8e/0x250 [ 170.628190][ T6784] sock_alloc+0x44/0x280 [ 170.628213][ T6784] ? security_socket_create+0x7f/0x250 [ 170.628243][ T6784] __sock_create+0xc2/0x860 [ 170.628275][ T6784] __sys_socket+0x14d/0x260 [ 170.628292][ T6784] ? fput+0x7c/0x100 [ 170.628315][ T6784] ? __pfx___sys_socket+0x10/0x10 [ 170.628331][ T6784] ? ksys_write+0x1ac/0x250 [ 170.628350][ T6784] ? __pfx_ksys_write+0x10/0x10 [ 170.628367][ T6784] ? trace_irq_enable.constprop.0+0x2f/0x160 [ 170.628397][ T6784] __x64_sys_socket+0x72/0xb0 [ 170.628413][ T6784] ? lockdep_hardirqs_on+0x7d/0x110 [ 170.628440][ T6784] do_syscall_64+0x123/0x790 [ 170.628469][ T6784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 170.628488][ T6784] RIP: 0033:0x7fc65939e159 [ 170.628503][ T6784] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 170.628520][ T6784] RSP: 002b:00007fc65a199028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 170.628539][ T6784] RAX: ffffffffffffffda RBX: 00007fc659626180 RCX: 00007fc65939e159 [ 170.628551][ T6784] RDX: 0000000000000002 RSI: 0000000000000005 RDI: 0000000000000023 [ 170.628562][ T6784] RBP: 00007fc65a199090 R08: 0000000000000000 R09: 0000000000000000 [ 170.628573][ T6784] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 170.628584][ T6784] R13: 00007fc659626218 R14: 00007fc659626180 R15: 00007ffe9c5dea98 [ 170.628608][ T6784] [ 170.628851][ T6784] socket: no more sockets [ 171.954143][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 172.634453][ T6792] FAULT_INJECTION: forcing a failure. [ 172.634453][ T6792] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 172.634483][ T6792] CPU: 0 UID: 0 PID: 6792 Comm: syz.3.253 Not tainted syzkaller #0 PREEMPT(full) [ 172.634504][ T6792] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 172.634515][ T6792] Call Trace: [ 172.634522][ T6792] [ 172.634529][ T6792] dump_stack_lvl+0x100/0x190 [ 172.634561][ T6792] should_fail_ex.cold+0x5/0xa [ 172.634592][ T6792] _copy_to_user+0x32/0xd0 [ 172.634615][ T6792] simple_read_from_buffer+0xcb/0x170 [ 172.634640][ T6792] proc_fail_nth_read+0x1af/0x230 [ 172.634664][ T6792] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 172.634688][ T6792] ? rw_verify_area+0xce/0x6d0 [ 172.634713][ T6792] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 172.634734][ T6792] vfs_read+0x1e4/0xb40 [ 172.634754][ T6792] ? lock_acquire+0x1d1/0x380 [ 172.634772][ T6792] ? __fget_files+0x34/0x3d0 [ 172.634801][ T6792] ? __pfx_vfs_read+0x10/0x10 [ 172.634817][ T6792] ? find_held_lock+0x2b/0x80 [ 172.634842][ T6792] ? __fget_files+0x215/0x3d0 [ 172.634868][ T6792] ? __fget_files+0x21f/0x3d0 [ 172.634897][ T6792] ksys_read+0x12a/0x250 [ 172.634916][ T6792] ? __pfx_ksys_read+0x10/0x10 [ 172.634942][ T6792] do_syscall_64+0x123/0x790 [ 172.634971][ T6792] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 172.634990][ T6792] RIP: 0033:0x7ff03175e98e [ 172.635007][ T6792] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 172.635025][ T6792] RSP: 002b:00007ff0326f3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 172.635044][ T6792] RAX: ffffffffffffffda RBX: 00007ff0326f46c0 RCX: 00007ff03175e98e [ 172.635056][ T6792] RDX: 000000000000000f RSI: 00007ff0326f40a0 RDI: 0000000000000004 [ 172.635067][ T6792] RBP: 00007ff0326f4090 R08: 0000000000000000 R09: 0000000000000000 [ 172.635078][ T6792] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 172.635090][ T6792] R13: 00007ff031a26128 R14: 00007ff031a26090 R15: 00007fff39ab24f8 [ 172.635116][ T6792] [ 172.705058][ T6794] FAULT_INJECTION: forcing a failure. [ 172.705058][ T6794] name failslab, interval 1, probability 0, space 0, times 0 [ 172.705086][ T6794] CPU: 0 UID: 0 PID: 6794 Comm: syz.2.254 Not tainted syzkaller #0 PREEMPT(full) [ 172.705104][ T6794] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 172.705114][ T6794] Call Trace: [ 172.705120][ T6794] [ 172.705126][ T6794] dump_stack_lvl+0x100/0x190 [ 172.705155][ T6794] should_fail_ex.cold+0x5/0xa [ 172.705179][ T6794] should_failslab+0xc2/0x120 [ 172.705200][ T6794] __kmalloc_noprof+0xfc/0x840 [ 172.705219][ T6794] ? tomoyo_encode2+0xfb/0x3c0 [ 172.705243][ T6794] tomoyo_encode2+0xfb/0x3c0 [ 172.705267][ T6794] tomoyo_encode+0x29/0x50 [ 172.705285][ T6794] tomoyo_realpath_from_path+0x18c/0x690 [ 172.705311][ T6794] tomoyo_path_perm+0x276/0x460 [ 172.705327][ T6794] ? tomoyo_path_perm+0x262/0x460 [ 172.705345][ T6794] ? __pfx_tomoyo_path_perm+0x10/0x10 [ 172.705385][ T6794] ? __d_lookup+0x25c/0x4a0 [ 172.705411][ T6794] tomoyo_path_rmdir+0x91/0xe0 [ 172.705432][ T6794] ? __pfx_tomoyo_path_rmdir+0x10/0x10 [ 172.705455][ T6794] ? lookup_dcache+0x66/0x170 [ 172.705481][ T6794] security_path_rmdir+0x145/0x2b0 [ 172.705500][ T6794] filename_rmdir+0x29d/0x5c0 [ 172.705523][ T6794] ? __pfx_filename_rmdir+0x10/0x10 [ 172.705553][ T6794] ? do_getname+0x191/0x390 [ 172.705581][ T6794] __x64_sys_unlinkat+0xf5/0x130 [ 172.705604][ T6794] do_syscall_64+0x123/0x790 [ 172.705630][ T6794] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 172.705647][ T6794] RIP: 0033:0x7fc65939e159 [ 172.705660][ T6794] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 172.705675][ T6794] RSP: 002b:00007fc65a1db028 EFLAGS: 00000246 ORIG_RAX: 0000000000000107 [ 172.705692][ T6794] RAX: ffffffffffffffda RBX: 00007fc659625fa0 RCX: 00007fc65939e159 [ 172.705703][ T6794] RDX: 0000000000000200 RSI: 0000200000000380 RDI: ffffffffffffff9c [ 172.705713][ T6794] RBP: 00007fc65a1db090 R08: 0000000000000000 R09: 0000000000000000 [ 172.705723][ T6794] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 172.705733][ T6794] R13: 00007fc659626038 R14: 00007fc659625fa0 R15: 00007ffe9c5dea98 [ 172.705757][ T6794] [ 172.705791][ T6794] ERROR: Out of memory at tomoyo_realpath_from_path. [ 175.863023][ T31] audit: type=1400 audit(1789829319.523:519): avc: denied { write } for pid=6806 comm="syz.3.259" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 175.930702][ T6822] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 175.931085][ T6822] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 175.972814][ T31] audit: type=1400 audit(1789829319.633:520): avc: denied { read } for pid=6821 comm="syz.0.261" name="nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 175.973190][ T31] audit: type=1400 audit(1789829319.633:521): avc: denied { open } for pid=6821 comm="syz.0.261" path="/dev/nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 176.131142][ T5719] usb 1-1: USB disconnect, device number 6 [ 176.165228][ T5719] metro-usb ttyUSB0: Metrologic USB to Serial converter now disconnected from ttyUSB0 [ 176.165539][ T5719] metro_usb 1-1:8.109: device disconnected [ 176.388178][ T6832] FAULT_INJECTION: forcing a failure. [ 176.388178][ T6832] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 176.388201][ T6832] CPU: 1 UID: 0 PID: 6832 Comm: syz.3.262 Not tainted syzkaller #0 PREEMPT(full) [ 176.388214][ T6832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 176.388221][ T6832] Call Trace: [ 176.388225][ T6832] [ 176.388229][ T6832] dump_stack_lvl+0x100/0x190 [ 176.388249][ T6832] should_fail_ex.cold+0x5/0xa [ 176.388266][ T6832] _copy_from_iter+0x1f4/0x1690 [ 176.388280][ T6832] ? __asan_memset+0x23/0x50 [ 176.388291][ T6832] ? __pfx__copy_from_iter+0x10/0x10 [ 176.388303][ T6832] ? __pfx___alloc_skb+0x10/0x10 [ 176.388322][ T6832] netlink_sendmsg+0x808/0xda0 [ 176.388337][ T6832] ? __pfx_netlink_sendmsg+0x10/0x10 [ 176.388352][ T6832] ? selinux_socket_sendmsg+0x198/0x2f0 [ 176.388375][ T6832] ____sys_sendmsg+0xa4d/0xbe0 [ 176.388399][ T6832] ? __pfx_netlink_sendmsg+0x10/0x10 [ 176.388413][ T6832] ? __pfx_____sys_sendmsg+0x10/0x10 [ 176.388433][ T6832] ? lock_acquire+0x1d1/0x380 [ 176.388445][ T6832] ? get_pid_task+0x2a/0x250 [ 176.388461][ T6832] ___sys_sendmsg+0x190/0x1e0 [ 176.388472][ T6832] ? __pfx____sys_sendmsg+0x10/0x10 [ 176.388482][ T6832] ? get_pid_task+0x106/0x250 [ 176.388502][ T6832] ? find_held_lock+0x2b/0x80 [ 176.388526][ T6832] __sys_sendmsg+0x160/0x210 [ 176.388540][ T6832] ? __pfx___sys_sendmsg+0x10/0x10 [ 176.388561][ T6832] do_syscall_64+0x123/0x790 [ 176.388579][ T6832] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 176.388591][ T6832] RIP: 0033:0x7ff03179e159 [ 176.388600][ T6832] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 176.388611][ T6832] RSP: 002b:00007ff0326f4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 176.388623][ T6832] RAX: ffffffffffffffda RBX: 00007ff031a26090 RCX: 00007ff03179e159 [ 176.388630][ T6832] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000009 [ 176.388636][ T6832] RBP: 00007ff0326f4090 R08: 0000000000000000 R09: 0000000000000000 [ 176.388643][ T6832] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 176.388649][ T6832] R13: 00007ff031a26128 R14: 00007ff031a26090 R15: 00007fff39ab24f8 [ 176.388663][ T6832] [ 176.561916][ T6828] bridge0: port 2(bridge_slave_1) entered disabled state [ 176.562525][ T6828] bridge0: port 1(bridge_slave_0) entered disabled state [ 176.711042][ T6828] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 176.725890][ T6828] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 176.936071][ T5737] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 176.985902][ T5839] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 176.991923][ T43] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 176.991992][ T43] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 176.992053][ T43] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.130569][ T5737] usb 3-1: Using ep0 maxpacket: 16 [ 177.139686][ T5737] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 177.145777][ T5737] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 177.145905][ T5737] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 177.145936][ T5737] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 177.145960][ T5737] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 177.145987][ T5737] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 177.241178][ T5737] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 177.241210][ T5737] usb 3-1: Manufacturer: syz [ 177.328781][ T5737] usb 3-1: config 0 descriptor?? [ 177.526900][ T54] netdevsim netdevsim10 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 177.959049][ T31] audit: type=1400 audit(1789829321.623:522): avc: denied { sqpoll } for pid=6835 comm="syz.2.264" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 177.991714][ T6854] FAULT_INJECTION: forcing a failure. [ 177.991714][ T6854] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 177.991742][ T6854] CPU: 1 UID: 0 PID: 6854 Comm: syz.3.266 Not tainted syzkaller #0 PREEMPT(full) [ 177.991763][ T6854] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 177.991774][ T6854] Call Trace: [ 177.991781][ T6854] [ 177.991788][ T6854] dump_stack_lvl+0x100/0x190 [ 177.991819][ T6854] should_fail_ex.cold+0x5/0xa [ 177.991846][ T6854] _copy_from_user+0x2e/0xd0 [ 177.991868][ T6854] copy_msghdr_from_user+0x9f/0x4c0 [ 177.991899][ T6854] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 177.991935][ T6854] ? lock_acquire+0x1d1/0x380 [ 177.991954][ T6854] ? get_pid_task+0x2a/0x250 [ 177.991982][ T6854] ___sys_sendmsg+0x106/0x1e0 [ 177.992001][ T6854] ? __pfx____sys_sendmsg+0x10/0x10 [ 177.992019][ T6854] ? get_pid_task+0x106/0x250 [ 177.992053][ T6854] ? find_held_lock+0x2b/0x80 [ 177.992095][ T6854] __sys_sendmsg+0x160/0x210 [ 177.992118][ T6854] ? __pfx___sys_sendmsg+0x10/0x10 [ 177.992155][ T6854] do_syscall_64+0x123/0x790 [ 177.992188][ T6854] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 177.992207][ T6854] RIP: 0033:0x7ff03179e159 [ 177.992223][ T6854] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 177.992240][ T6854] RSP: 002b:00007ff032715028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 177.992264][ T6854] RAX: ffffffffffffffda RBX: 00007ff031a25fa0 RCX: 00007ff03179e159 [ 177.992276][ T6854] RDX: 0000000004008094 RSI: 0000200000000100 RDI: 0000000000000004 [ 177.992287][ T6854] RBP: 00007ff032715090 R08: 0000000000000000 R09: 0000000000000000 [ 177.992298][ T6854] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 177.992308][ T6854] R13: 00007ff031a26038 R14: 00007ff031a25fa0 R15: 00007fff39ab24f8 [ 177.992334][ T6854] [ 178.074004][ T25] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 178.177450][ T5737] rc_core: IR keymap rc-hauppauge not found [ 178.177468][ T5737] Registered IR keymap rc-empty [ 178.177772][ T5737] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 178.197375][ T5737] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 178.712366][ T6857] syz_tun: entered allmulticast mode [ 179.100892][ T31] audit: type=1400 audit(1789829322.343:523): avc: denied { create } for pid=6855 comm="syz.3.267" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 179.108113][ T25] usb 5-1: Using ep0 maxpacket: 8 [ 179.127751][ T5737] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 179.134840][ T25] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 179.148421][ T5737] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input9 [ 179.152890][ T25] usb 5-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 179.152918][ T25] usb 5-1: config 255 has 0 interfaces, different from the descriptor's value: 1 [ 179.174121][ T5737] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 179.175156][ T25] usb 5-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 179.175178][ T25] usb 5-1: config 255 has 0 interfaces, different from the descriptor's value: 1 [ 179.202817][ T25] usb 5-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 179.202836][ T25] usb 5-1: config 255 has 0 interfaces, different from the descriptor's value: 1 [ 179.212019][ T5737] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 179.224603][ T5737] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 179.249040][ T5737] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 179.264680][ T5737] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 179.287259][ T5737] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 179.305384][ T5737] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 179.324094][ T5737] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 179.345976][ T5737] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 179.364065][ T5737] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 179.472212][ T25] usb 5-1: string descriptor 0 read error: -71 [ 179.472326][ T25] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 179.473384][ T5737] mceusb 3-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 179.473404][ T5737] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 179.499487][ T25] usb 5-1: rejected 3 configurations due to insufficient available bus power [ 179.499512][ T25] usb 5-1: no configuration chosen from 3 choices [ 179.560152][ T25] usb 5-1: USB disconnect, device number 13 [ 179.642380][ T6836] FAULT_INJECTION: forcing a failure. [ 179.642380][ T6836] name failslab, interval 1, probability 0, space 0, times 0 [ 179.642415][ T6836] CPU: 1 UID: 0 PID: 6836 Comm: syz.2.264 Not tainted syzkaller #0 PREEMPT(full) [ 179.642439][ T6836] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 179.642453][ T6836] Call Trace: [ 179.642460][ T6836] [ 179.642469][ T6836] dump_stack_lvl+0x100/0x190 [ 179.642505][ T6836] should_fail_ex.cold+0x5/0xa [ 179.642533][ T6836] should_failslab+0xc2/0x120 [ 179.642557][ T6836] __kmalloc_noprof+0xfc/0x840 [ 179.642575][ T6836] ? rcu_is_watching+0x13/0xc0 [ 179.642600][ T6836] ? tomoyo_realpath_from_path+0xb6/0x690 [ 179.642630][ T6836] tomoyo_realpath_from_path+0xb6/0x690 [ 179.642659][ T6836] tomoyo_check_open_permission+0x2af/0x3c0 [ 179.642682][ T6836] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 179.642712][ T6836] ? hook_file_open+0x248/0x8e0 [ 179.642759][ T6836] ? path_get+0x61/0x80 [ 179.642788][ T6836] tomoyo_file_open+0x6b/0x90 [ 179.642817][ T6836] security_file_open+0xb5/0x1e0 [ 179.642843][ T6836] do_dentry_open+0x588/0x14d0 [ 179.642872][ T6836] vfs_open+0x82/0x3f0 [ 179.642904][ T6836] path_openat+0x19fa/0x2440 [ 179.642934][ T6836] ? __pfx_path_openat+0x10/0x10 [ 179.642965][ T6836] do_file_open+0x20e/0x430 [ 179.642993][ T6836] ? __pfx_do_file_open+0x10/0x10 [ 179.643038][ T6836] ? _raw_spin_unlock+0x28/0x50 [ 179.643064][ T6836] ? alloc_fd+0x471/0x7a0 [ 179.643097][ T6836] do_sys_openat2+0x10f/0x1e0 [ 179.643124][ T6836] ? __pfx_do_sys_openat2+0x10/0x10 [ 179.643161][ T6836] ? fd_install+0x252/0x580 [ 179.643189][ T6836] __x64_sys_openat+0x12d/0x210 [ 179.643218][ T6836] ? __pfx___x64_sys_openat+0x10/0x10 [ 179.643256][ T6836] do_syscall_64+0x123/0x790 [ 179.643289][ T6836] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 179.643310][ T6836] RIP: 0033:0x7fc65935e98e [ 179.643328][ T6836] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 179.643347][ T6836] RSP: 002b:00007fc65a1daf18 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 179.643369][ T6836] RAX: ffffffffffffffda RBX: 00007fc65a1db6c0 RCX: 00007fc65935e98e [ 179.643382][ T6836] RDX: 0000000000000000 RSI: 00007fc6594347a6 RDI: ffffffffffffff9c [ 179.643394][ T6836] RBP: 00007fc65943506b R08: 0000000000000000 R09: 0000000000000000 [ 179.643406][ T6836] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 179.643418][ T6836] R13: 00007fc659626038 R14: 00007fc659625fa0 R15: 00007ffe9c5dea98 [ 179.643445][ T6836] [ 179.643481][ T6836] ERROR: Out of memory at tomoyo_realpath_from_path. [ 179.833123][ T6844] usb 3-1: USB disconnect, device number 7 [ 180.238050][ T6872] bond1 (unregistering): Released all slaves [ 181.188735][ T6894] netlink: 8 bytes leftover after parsing attributes in process `syz.2.276'. [ 181.188891][ T6894] netlink: 8 bytes leftover after parsing attributes in process `syz.2.276'. [ 182.364066][ T6844] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 182.515114][ T6844] usb 5-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 182.516093][ T6844] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 182.516133][ T6844] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 182.516156][ T6844] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 182.516179][ T6844] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 182.517893][ T6844] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 182.517916][ T6844] usb 5-1: Product: syz [ 182.517930][ T6844] usb 5-1: Manufacturer: syz [ 182.517944][ T6844] usb 5-1: SerialNumber: syz [ 182.576753][ T5699] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 182.722840][ T6844] usb 5-1: Not enough endpoints found in device, aborting! [ 182.753973][ T5699] usb 1-1: Using ep0 maxpacket: 32 [ 182.754471][ T5699] usb 1-1: New USB device found, idVendor=0e41, idProduct=4159, bcdDevice=b8.da [ 182.755494][ T5699] usb 1-1: config 0 interface 0 has no altsetting 0 [ 182.759393][ T5699] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 182.759418][ T5699] usb 1-1: Product: syz [ 182.759432][ T5699] usb 1-1: Manufacturer: syz [ 182.759445][ T5699] usb 1-1: SerialNumber: syz [ 182.761725][ T5699] usb 1-1: config 0 descriptor?? [ 182.931570][ T6844] usb 5-1: USB disconnect, device number 14 [ 182.984480][ T6899] FAULT_INJECTION: forcing a failure. [ 182.984480][ T6899] name failslab, interval 1, probability 0, space 0, times 0 [ 182.984511][ T6899] CPU: 1 UID: 0 PID: 6899 Comm: syz.0.277 Not tainted syzkaller #0 PREEMPT(full) [ 182.984535][ T6899] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 182.984548][ T6899] Call Trace: [ 182.984555][ T6899] [ 182.984564][ T6899] dump_stack_lvl+0x100/0x190 [ 182.984598][ T6899] should_fail_ex.cold+0x5/0xa [ 182.984628][ T6899] should_failslab+0xc2/0x120 [ 182.984654][ T6899] kmem_cache_alloc_noprof+0x92/0x6a0 [ 182.984678][ T6899] ? skb_clone+0x190/0x400 [ 182.984708][ T6899] skb_clone+0x190/0x400 [ 182.984734][ T6899] netlink_broadcast_filtered+0xb22/0xf20 [ 182.984775][ T6899] netlink_broadcast+0x39/0x50 [ 182.984799][ T6899] kobject_uevent_env+0xcdd/0x18b0 [ 182.984828][ T6899] ? gadget_unbind_driver+0x371/0x4f0 [ 182.984852][ T6899] ? __pfx_dummy_udc_async_callbacks+0x10/0x10 [ 182.984884][ T6899] ? __pfx_gadget_unbind_driver+0x10/0x10 [ 182.984908][ T6899] device_remove+0xcb/0x180 [ 182.984932][ T6899] device_release_driver_internal+0x44e/0x620 [ 182.984963][ T6899] driver_detach+0xd8/0x1b0 [ 182.984989][ T6899] bus_remove_driver+0x13b/0x2e0 [ 182.985013][ T6899] driver_unregister+0x76/0xb0 [ 182.985038][ T6899] usb_gadget_unregister_driver+0x49/0x70 [ 182.985059][ T6899] raw_release+0x19b/0x260 [ 182.985079][ T6899] ? __pfx_raw_release+0x10/0x10 [ 182.985104][ T6899] __fput+0x3ff/0xb50 [ 182.985136][ T6899] fput_close_sync+0x118/0x250 [ 182.985164][ T6899] ? __pfx_fput_close_sync+0x10/0x10 [ 182.985199][ T6899] __x64_sys_close+0x8b/0x120 [ 182.985230][ T6899] do_syscall_64+0x123/0x790 [ 182.985259][ T6899] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 182.985277][ T6899] RIP: 0033:0x7f4b7475e98e [ 182.985293][ T6899] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 182.985310][ T6899] RSP: 002b:00007f4b75630f98 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 182.985330][ T6899] RAX: ffffffffffffffda RBX: 00007f4b756316c0 RCX: 00007f4b7475e98e [ 182.985344][ T6899] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005 [ 182.985356][ T6899] RBP: 00007f4b7483506b R08: 0000000000000000 R09: 0000000000000000 [ 182.985369][ T6899] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 182.985381][ T6899] R13: 00007f4b74a26038 R14: 00007f4b74a25fa0 R15: 00007fff89975728 [ 182.985409][ T6899] [ 182.989368][ T5699] snd_usb_podhd 1-1:0.0: Line 6 POD HD500X found [ 182.990763][ T5699] snd_usb_podhd 1-1:0.0: set_interface failed [ 182.992044][ T5699] snd_usb_podhd 1-1:0.0: Line 6 POD HD500X now disconnected [ 182.993174][ T5699] snd_usb_podhd 1-1:0.0: probe with driver snd_usb_podhd failed with error -71 [ 183.205527][ T5699] usb 1-1: USB disconnect, device number 7 [ 183.565553][ T6844] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 183.614116][ T5699] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 183.633307][ T6923] netlink: 48 bytes leftover after parsing attributes in process `syz.4.282'. [ 183.754140][ T5699] usb 1-1: device descriptor read/64, error -71 [ 184.004158][ T5699] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 184.151203][ T5699] usb 1-1: device descriptor read/64, error -71 [ 184.181026][ T6844] usb 3-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 184.182042][ T6844] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 184.182084][ T6844] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 184.182117][ T6844] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 184.182142][ T6844] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 184.182177][ T6844] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 184.187444][ T6912] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 184.187523][ T6912] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 184.189007][ T6844] keyspan 3-1:1.0: Keyspan 2 port adapter converter detected [ 184.191372][ T6844] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 84 [ 184.191428][ T6844] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 2 [ 184.195768][ T6844] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 184.198536][ T6844] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 88 [ 184.198595][ T6844] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 6 [ 184.206472][ T6844] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 184.271908][ T31] audit: type=1400 audit(1789829327.933:524): avc: denied { ioctl } for pid=6931 comm="syz.4.285" path="socket:[13685]" dev="sockfs" ino=13685 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 184.298134][ T5699] usb usb1-port1: attempt power cycle [ 184.514006][ T6844] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 184.668294][ T5699] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 184.738067][ T5699] usb 1-1: device descriptor read/8, error -71 [ 184.995923][ T5699] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 185.021334][ T5699] usb 1-1: device descriptor read/8, error -71 [ 185.097631][ T6844] usb 4-1: Using ep0 maxpacket: 8 [ 185.097900][ T6938] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(3) [ 185.097919][ T6938] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 185.098817][ T6938] vhci_hcd vhci_hcd.0: Device attached [ 185.131383][ T6844] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 185.132269][ T6844] usb 4-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 185.132291][ T6844] usb 4-1: config 255 has 0 interfaces, different from the descriptor's value: 1 [ 185.133293][ T6844] usb 4-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 185.133312][ T6844] usb 4-1: config 255 has 0 interfaces, different from the descriptor's value: 1 [ 185.135940][ T5699] usb usb1-port1: unable to enumerate USB device [ 185.154408][ T6844] usb 4-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 185.154434][ T6844] usb 4-1: config 255 has 0 interfaces, different from the descriptor's value: 1 [ 185.211853][ T6844] usb 4-1: string descriptor 0 read error: -22 [ 185.211957][ T6844] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 185.228766][ T6844] usb 4-1: rejected 3 configurations due to insufficient available bus power [ 185.228791][ T6844] usb 4-1: no configuration chosen from 3 choices [ 185.235206][ T5802] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 185.414205][ T5777] usb 35-1: new low-speed USB device number 2 using vhci_hcd [ 185.434108][ T5802] usb 2-1: Using ep0 maxpacket: 16 [ 185.453316][ T6940] usb 35-1: recv xbuf, 0 [ 185.493531][ T503] vhci_hcd vhci_hcd.1: stop threads [ 185.493551][ T503] vhci_hcd vhci_hcd.1: release socket [ 185.506532][ T503] vhci_hcd vhci_hcd.1: disconnect device [ 185.621689][ T5777] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 185.921125][ T31] audit: type=1400 audit(1789829329.583:525): avc: denied { setopt } for pid=6950 comm="syz.4.290" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 186.366073][ T6844] usb 3-1: USB disconnect, device number 8 [ 186.428335][ T6844] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 186.441757][ T6844] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 186.451156][ T6844] keyspan 3-1:1.0: device disconnected [ 186.625594][ T31] audit: type=1400 audit(1789829330.283:526): avc: denied { read } for pid=6953 comm="syz.2.291" name="event2" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 186.671228][ T3214] usb 4-1: USB disconnect, device number 7 [ 186.984018][ T6846] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 187.060498][ T6962] i2c i2c-0: Frontend requested software zigzag, but didn't set the frequency step size [ 187.136918][ T6846] usb 1-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 187.139270][ T6846] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 187.139312][ T6846] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 187.139333][ T6846] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 187.139354][ T6846] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 187.146512][ T6846] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 187.146535][ T6846] usb 1-1: Product: syz [ 187.146548][ T6846] usb 1-1: Manufacturer: syz [ 187.146561][ T6846] usb 1-1: SerialNumber: syz [ 187.245435][ T31] audit: type=1800 audit(1789829330.913:527): pid=6964 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.2.295" name=8006 dev="sda1" ino=2048 res=0 errno=0 [ 187.247228][ T6964] EXT4-fs warning (device sda1): verify_group_input:136: Cannot add at group 1597403241 (only 8 groups) [ 187.362762][ T31] audit: type=1400 audit(1789829331.023:528): avc: denied { ioctl } for pid=6963 comm="syz.2.295" path="socket:[13742]" dev="sockfs" ino=13742 ioctlcmd=0x5872 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 187.412541][ T6846] usb 1-1: Not enough endpoints found in device, aborting! [ 187.576462][ T6846] usb 1-1: USB disconnect, device number 12 [ 187.655316][ T5802] usb 2-1: unable to get BOS descriptor or descriptor too short [ 187.655363][ T5802] usb 2-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 0.00 [ 187.655394][ T5802] usb 2-1: no configurations [ 187.655406][ T5802] usb 2-1: can't read configurations, error -22 [ 187.864233][ T6969] bond1 (unregistering): Released all slaves [ 187.955613][ T6976] FAULT_INJECTION: forcing a failure. [ 187.955613][ T6976] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 187.955717][ T6976] CPU: 0 UID: 0 PID: 6976 Comm: syz.3.298 Not tainted syzkaller #0 PREEMPT(full) [ 187.955738][ T6976] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 187.955749][ T6976] Call Trace: [ 187.955755][ T6976] [ 187.955762][ T6976] dump_stack_lvl+0x100/0x190 [ 187.955794][ T6976] should_fail_ex.cold+0x5/0xa [ 187.955820][ T6976] _copy_to_user+0x32/0xd0 [ 187.955843][ T6976] simple_read_from_buffer+0xcb/0x170 [ 187.955869][ T6976] proc_fail_nth_read+0x1af/0x230 [ 187.955893][ T6976] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 187.955918][ T6976] ? rw_verify_area+0xce/0x6d0 [ 187.955944][ T6976] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 187.955967][ T6976] vfs_read+0x1e4/0xb40 [ 187.955986][ T6976] ? lock_acquire+0x1d1/0x380 [ 187.956005][ T6976] ? __fget_files+0x34/0x3d0 [ 187.956027][ T6976] ? __pfx_vfs_read+0x10/0x10 [ 187.956043][ T6976] ? find_held_lock+0x2b/0x80 [ 187.956068][ T6976] ? __fget_files+0x215/0x3d0 [ 187.956094][ T6976] ? __fget_files+0x21f/0x3d0 [ 187.956124][ T6976] ksys_read+0x12a/0x250 [ 187.956143][ T6976] ? __pfx_ksys_read+0x10/0x10 [ 187.956160][ T6976] ? v4l2_ioctl+0x1c5/0x250 [ 187.956200][ T6976] do_syscall_64+0x123/0x790 [ 187.956233][ T6976] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 187.956252][ T6976] RIP: 0033:0x7ff03175e98e [ 187.956268][ T6976] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 187.956286][ T6976] RSP: 002b:00007ff032714fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 187.956305][ T6976] RAX: ffffffffffffffda RBX: 00007ff0327156c0 RCX: 00007ff03175e98e [ 187.956317][ T6976] RDX: 000000000000000f RSI: 00007ff0327150a0 RDI: 0000000000000004 [ 187.956328][ T6976] RBP: 00007ff032715090 R08: 0000000000000000 R09: 0000000000000000 [ 187.956339][ T6976] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 187.956350][ T6976] R13: 00007ff031a26038 R14: 00007ff031a25fa0 R15: 00007fff39ab24f8 [ 187.956376][ T6976] [ 188.096611][ T5777] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 188.293992][ T5777] usb 5-1: Using ep0 maxpacket: 32 [ 188.296129][ T5777] usb 5-1: New USB device found, idVendor=0e41, idProduct=4159, bcdDevice=b8.da [ 188.298550][ T5777] usb 5-1: config 0 interface 0 has no altsetting 0 [ 188.312095][ T5777] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 188.312123][ T5777] usb 5-1: Product: syz [ 188.312137][ T5777] usb 5-1: Manufacturer: syz [ 188.312152][ T5777] usb 5-1: SerialNumber: syz [ 188.323640][ T5777] usb 5-1: config 0 descriptor?? [ 188.719949][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 188.720001][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 188.786239][ T6982] netlink: 'syz.0.300': attribute type 2 has an invalid length. [ 188.894712][ T6984] netlink: 32 bytes leftover after parsing attributes in process `syz.1.301'. [ 188.897219][ T6972] FAULT_INJECTION: forcing a failure. [ 188.897219][ T6972] name failslab, interval 1, probability 0, space 0, times 0 [ 188.897251][ T6972] CPU: 1 UID: 0 PID: 6972 Comm: syz.4.297 Not tainted syzkaller #0 PREEMPT(full) [ 188.897275][ T6972] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 188.897289][ T6972] Call Trace: [ 188.897296][ T6972] [ 188.897306][ T6972] dump_stack_lvl+0x100/0x190 [ 188.897342][ T6972] should_fail_ex.cold+0x5/0xa [ 188.897371][ T6972] should_failslab+0xc2/0x120 [ 188.897399][ T6972] __kmalloc_cache_noprof+0x91/0x6d0 [ 188.897428][ T6972] ? lock_acquire+0x1d1/0x380 [ 188.897448][ T6972] ? kobject_uevent_env+0x263/0x18b0 [ 188.897479][ T6972] kobject_uevent_env+0x263/0x18b0 [ 188.897504][ T6972] ? kobject_put+0xb9/0x640 [ 188.897523][ T6972] ? _raw_spin_unlock+0x28/0x50 [ 188.897559][ T6972] device_release_driver_internal+0x51d/0x620 [ 188.897592][ T6972] driver_detach+0xd8/0x1b0 [ 188.897621][ T6972] bus_remove_driver+0x13b/0x2e0 [ 188.897644][ T6972] driver_unregister+0x76/0xb0 [ 188.897671][ T6972] usb_gadget_unregister_driver+0x49/0x70 [ 188.897695][ T6972] raw_release+0x19b/0x260 [ 188.897715][ T6972] ? __pfx_raw_release+0x10/0x10 [ 188.897734][ T6972] __fput+0x3ff/0xb50 [ 188.897766][ T6972] fput_close_sync+0x118/0x250 [ 188.897794][ T6972] ? __pfx_fput_close_sync+0x10/0x10 [ 188.897829][ T6972] __x64_sys_close+0x8b/0x120 [ 188.897858][ T6972] do_syscall_64+0x123/0x790 [ 188.897890][ T6972] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 188.897910][ T6972] RIP: 0033:0x7f5f68f5e98e [ 188.897926][ T6972] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 188.897945][ T6972] RSP: 002b:00007f5f69eb2f98 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 188.897965][ T6972] RAX: ffffffffffffffda RBX: 00007f5f69eb36c0 RCX: 00007f5f68f5e98e [ 188.897977][ T6972] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005 [ 188.897989][ T6972] RBP: 00007f5f6903506b R08: 0000000000000000 R09: 0000000000000000 [ 188.898001][ T6972] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 188.898012][ T6972] R13: 00007f5f69226038 R14: 00007f5f69225fa0 R15: 00007fffe4694f88 [ 188.898039][ T6972] [ 188.901153][ T5777] snd_usb_podhd 5-1:0.0: Line 6 POD HD500X found [ 188.901522][ T5777] snd_usb_podhd 5-1:0.0: set_interface failed [ 188.901748][ T5777] snd_usb_podhd 5-1:0.0: Line 6 POD HD500X now disconnected [ 188.901886][ T5777] snd_usb_podhd 5-1:0.0: probe with driver snd_usb_podhd failed with error -71 [ 188.903474][ T5777] usb 5-1: USB disconnect, device number 15 [ 189.544027][ T5777] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 189.684115][ T5777] usb 5-1: device descriptor read/64, error -71 [ 189.842439][ T31] audit: type=1400 audit(1789829333.503:529): avc: denied { create } for pid=6993 comm="syz.3.304" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 189.870560][ T31] audit: type=1400 audit(1789829333.533:530): avc: denied { bind } for pid=6993 comm="syz.3.304" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 189.874124][ T31] audit: type=1400 audit(1789829333.533:531): avc: denied { read } for pid=6993 comm="syz.3.304" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 189.879762][ T31] audit: type=1400 audit(1789829333.543:532): avc: denied { node_bind } for pid=6998 comm="syz.0.306" saddr=::1 src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 189.880203][ T31] audit: type=1400 audit(1789829333.543:533): avc: denied { write } for pid=6998 comm="syz.0.306" laddr=::1 lport=20004 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 189.882552][ T31] audit: type=1400 audit(1789829333.543:534): avc: denied { name_connect } for pid=6998 comm="syz.0.306" dest=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 189.887045][ T31] audit: type=1400 audit(1789829333.553:535): avc: denied { bind } for pid=6998 comm="syz.0.306" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 189.887784][ T31] audit: type=1400 audit(1789829333.553:536): avc: denied { ioctl } for pid=6998 comm="syz.0.306" path="socket:[13807]" dev="sockfs" ino=13807 ioctlcmd=0x5864 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 189.940994][ T5777] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 189.942423][ T31] audit: type=1400 audit(1789829333.603:537): avc: denied { write } for pid=6993 comm="syz.3.304" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 189.958959][ T7002] netlink: 4 bytes leftover after parsing attributes in process `syz.3.304'. [ 189.978636][ T6995] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=60 sclass=netlink_route_socket pid=6995 comm=syz.3.304 [ 190.060390][ T31] audit: type=1400 audit(1789829333.723:538): avc: denied { read } for pid=6998 comm="syz.0.306" dev="sockfs" ino=13806 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 190.064021][ T6846] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 190.114010][ T5777] usb 5-1: device descriptor read/64, error -71 [ 190.215050][ T6846] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 190.216388][ T6846] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 190.216417][ T6846] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 190.216437][ T6846] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 190.216474][ T6846] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 190.220377][ T6846] usb 3-1: config 0 descriptor?? [ 190.233249][ T5777] usb usb5-port1: attempt power cycle [ 190.634062][ T5777] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 190.640417][ T6846] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 190.640457][ T6846] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 190.640477][ T6846] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 190.640498][ T6846] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 190.640518][ T6846] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 190.640530][ T6846] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 190.640543][ T6846] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 190.640556][ T6846] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 190.640568][ T6846] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 190.640581][ T6846] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 190.659626][ T6846] plantronics 0003:047F:FFFF.0001: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 190.668371][ T5777] usb 5-1: device descriptor read/8, error -71 [ 190.794613][ T5607] Bluetooth: hci1: command 0x0406 tx timeout [ 190.796280][ T5607] Bluetooth: hci3: command 0x0406 tx timeout [ 190.796305][ T5607] Bluetooth: hci4: command 0x0406 tx timeout [ 190.796381][ T5612] Bluetooth: hci2: command 0x0406 tx timeout [ 190.908740][ T3214] usb 3-1: USB disconnect, device number 9 [ 190.924715][ T5777] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 190.961417][ T7015] FAULT_INJECTION: forcing a failure. [ 190.961417][ T7015] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 190.961449][ T7015] CPU: 1 UID: 0 PID: 7015 Comm: syz.3.310 Tainted: G L syzkaller #0 PREEMPT(full) [ 190.961475][ T7015] Tainted: [L]=SOFTLOCKUP [ 190.961481][ T7015] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 190.961492][ T7015] Call Trace: [ 190.961498][ T7015] [ 190.961505][ T7015] dump_stack_lvl+0x100/0x190 [ 190.961537][ T7015] should_fail_ex.cold+0x5/0xa [ 190.961567][ T7015] _copy_from_iter+0x1f4/0x1690 [ 190.961597][ T7015] ? __asan_memset+0x23/0x50 [ 190.961617][ T7015] ? __pfx__copy_from_iter+0x10/0x10 [ 190.961638][ T7015] ? __pfx___alloc_skb+0x10/0x10 [ 190.961659][ T7015] ? __pfx_selinux_socket_getpeersec_dgram+0x10/0x10 [ 190.961679][ T7015] ? sock_has_perm+0x25a/0x2f0 [ 190.961707][ T7015] ? __pfx_sock_has_perm+0x10/0x10 [ 190.961740][ T7015] netlink_sendmsg+0x808/0xda0 [ 190.961767][ T7015] ? __pfx_netlink_sendmsg+0x10/0x10 [ 190.961791][ T7015] ? selinux_socket_sendmsg+0x198/0x2f0 [ 190.961814][ T7015] ____sys_sendmsg+0xa4d/0xbe0 [ 190.961840][ T7015] ? __pfx_netlink_sendmsg+0x10/0x10 [ 190.961863][ T7015] ? __pfx_____sys_sendmsg+0x10/0x10 [ 190.961896][ T7015] ? lock_acquire+0x1d1/0x380 [ 190.961916][ T7015] ? get_pid_task+0x2a/0x250 [ 190.961942][ T7015] ___sys_sendmsg+0x190/0x1e0 [ 190.961962][ T7015] ? __pfx____sys_sendmsg+0x10/0x10 [ 190.961980][ T7015] ? get_pid_task+0x106/0x250 [ 190.962014][ T7015] ? find_held_lock+0x2b/0x80 [ 190.962055][ T7015] __sys_sendmsg+0x160/0x210 [ 190.962079][ T7015] ? __pfx___sys_sendmsg+0x10/0x10 [ 190.962115][ T7015] do_syscall_64+0x123/0x790 [ 190.962145][ T7015] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 190.962164][ T7015] RIP: 0033:0x7ff03179e159 [ 190.962179][ T7015] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 190.962196][ T7015] RSP: 002b:00007ff032715028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 190.962214][ T7015] RAX: ffffffffffffffda RBX: 00007ff031a25fa0 RCX: 00007ff03179e159 [ 190.962226][ T7015] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000004 [ 190.962238][ T7015] RBP: 00007ff032715090 R08: 0000000000000000 R09: 0000000000000000 [ 190.962248][ T7015] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 190.962259][ T7015] R13: 00007ff031a26038 R14: 00007ff031a25fa0 R15: 00007fff39ab24f8 [ 190.962284][ T7015] [ 191.144012][ T5777] usb 5-1: device not accepting address 19, error -71 [ 191.144234][ T5777] usb usb5-port1: unable to enumerate USB device [ 194.724441][ T5777] usb 5-1: new full-speed USB device number 20 using dummy_hcd [ 194.879086][ T5777] usb 5-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 194.882158][ T5777] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 194.882229][ T5777] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 194.882283][ T5777] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 194.882323][ T5777] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid maxpacket 2670, setting to 64 [ 194.882363][ T5777] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 194.973059][ T5777] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 194.973116][ T5777] usb 5-1: Product: syz [ 194.973132][ T5777] usb 5-1: Manufacturer: syz [ 194.973160][ T5777] usb 5-1: SerialNumber: syz [ 195.013279][ T31] kauditd_printk_skb: 8 callbacks suppressed [ 195.013302][ T31] audit: type=1400 audit(1789829338.673:547): avc: denied { mount } for pid=7065 comm="syz.1.321" name="/" dev="ramfs" ino=13913 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 195.176338][ T7069] 0x000000000000-0x000000010000 : "" [ 195.213328][ T5777] usb 5-1: config 0 descriptor?? [ 195.554140][ T7071] netlink: 16 bytes leftover after parsing attributes in process `syz.1.321'. [ 195.574987][ T7069] ftl_cs: FTL header not found. [ 195.585839][ T31] audit: type=1400 audit(1789829338.843:548): avc: denied { read } for pid=7063 comm="syz.2.322" name="mtd0" dev="devtmpfs" ino=702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 196.020804][ T7060] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 196.159738][ T7074] FAULT_INJECTION: forcing a failure. [ 196.159738][ T7074] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 196.159769][ T7074] CPU: 0 UID: 0 PID: 7074 Comm: syz.2.324 Tainted: G L syzkaller #0 PREEMPT(full) [ 196.159795][ T7074] Tainted: [L]=SOFTLOCKUP [ 196.159801][ T7074] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 196.159812][ T7074] Call Trace: [ 196.159819][ T7074] [ 196.159827][ T7074] dump_stack_lvl+0x100/0x190 [ 196.159858][ T7074] should_fail_ex.cold+0x5/0xa [ 196.159883][ T7074] _copy_to_user+0x32/0xd0 [ 196.159905][ T7074] simple_read_from_buffer+0xcb/0x170 [ 196.159931][ T7074] proc_fail_nth_read+0x1af/0x230 [ 196.159954][ T7074] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 196.159977][ T7074] ? rw_verify_area+0xce/0x6d0 [ 196.160003][ T7074] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 196.160025][ T7074] vfs_read+0x1e4/0xb40 [ 196.160043][ T7074] ? lock_acquire+0x1d1/0x380 [ 196.160063][ T7074] ? __fget_files+0x34/0x3d0 [ 196.160084][ T7074] ? __pfx_vfs_read+0x10/0x10 [ 196.160100][ T7074] ? find_held_lock+0x2b/0x80 [ 196.160126][ T7074] ? __fget_files+0x215/0x3d0 [ 196.160152][ T7074] ? __fget_files+0x21f/0x3d0 [ 196.160181][ T7074] ksys_read+0x12a/0x250 [ 196.160199][ T7074] ? __pfx_ksys_read+0x10/0x10 [ 196.160226][ T7074] do_syscall_64+0x123/0x790 [ 196.160255][ T7074] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 196.160274][ T7074] RIP: 0033:0x7fc65935e98e [ 196.160290][ T7074] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 196.160307][ T7074] RSP: 002b:00007fc65a1dafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 196.160325][ T7074] RAX: ffffffffffffffda RBX: 00007fc65a1db6c0 RCX: 00007fc65935e98e [ 196.160336][ T7074] RDX: 000000000000000f RSI: 00007fc65a1db0a0 RDI: 0000000000000004 [ 196.160347][ T7074] RBP: 00007fc65a1db090 R08: 0000000000000000 R09: 0000000000000000 [ 196.160358][ T7074] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 196.160368][ T7074] R13: 00007fc659626038 R14: 00007fc659625fa0 R15: 00007ffe9c5dea98 [ 196.160393][ T7074] [ 196.764143][ T5777] radio-si470x 5-1:0.0: si470x_get_report: usb_control_msg returned -110 [ 196.764608][ T5777] radio-si470x 5-1:0.0: probe with driver radio-si470x failed with error -5 [ 197.434244][ T6844] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 197.434587][ C0] raw-gadget.1 gadget.1: ignoring, device is not running [ 197.574068][ T6844] usb 2-1: device descriptor read/64, error -32 [ 197.824261][ T6844] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 197.909286][ T7059] syzkaller1: entered promiscuous mode [ 197.909310][ T7059] syzkaller1: entered allmulticast mode [ 197.986687][ T6844] usb 2-1: Using ep0 maxpacket: 16 [ 197.987467][ T6844] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 197.988484][ T6844] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 32, changing to 9 [ 197.988513][ T6844] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 197.988548][ T6844] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 197.991878][ T6844] usb 2-1: config 0 descriptor?? [ 197.995287][ T5777] usb 1-1: new low-speed USB device number 13 using dummy_hcd [ 198.006531][ T5737] usb 5-1: USB disconnect, device number 20 [ 198.108342][ T31] audit: type=1400 audit(1789829341.773:549): avc: denied { setattr } for pid=7098 comm="syz.4.330" name="sg0" dev="devtmpfs" ino=1102 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 198.190126][ T5777] usb 1-1: unable to get BOS descriptor or descriptor too short [ 198.190215][ T5777] usb 1-1: New USB device found, idVendor=0c2e, idProduct=0720, bcdDevice=d4.29 [ 198.191305][ T5777] usb 1-1: config 8 has an invalid interface number: 109 but max is 0 [ 198.191342][ T5777] usb 1-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 198.191373][ T5777] usb 1-1: config 8 has no interface number 0 [ 198.191434][ T5777] usb 1-1: config 8 interface 109 altsetting 0 endpoint 0x3 has invalid maxpacket 512, setting to 8 [ 198.191474][ T5777] usb 1-1: config 8 interface 109 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 198.191526][ T5777] usb 1-1: config 8 interface 109 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 198.280396][ T5777] usb 1-1: string descriptor 0 read error: -22 [ 198.280598][ T5777] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 198.314006][ T6842] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 198.318254][ T5777] metro_usb 1-1:8.109: Metrologic USB to Serial converter detected [ 198.345114][ T5777] usb 1-1: Metrologic USB to Serial converter now attached to ttyUSB0 [ 198.377181][ T31] audit: type=1400 audit(1789829342.043:550): avc: denied { create } for pid=7105 comm="syz.2.332" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 198.381335][ T31] audit: type=1400 audit(1789829342.043:551): avc: denied { connect } for pid=7105 comm="syz.2.332" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 198.464571][ T6842] usb 4-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 198.465631][ T6842] usb 4-1: config 1 has an invalid interface number: 3 but max is 0 [ 198.465654][ T6842] usb 4-1: config 1 has no interface number 0 [ 198.472291][ T6842] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 198.472316][ T6842] usb 4-1: Product: syz [ 198.472350][ T6842] usb 4-1: Manufacturer: syz [ 198.472365][ T6842] usb 4-1: SerialNumber: syz [ 198.491040][ T31] audit: type=1400 audit(1789829342.153:552): avc: denied { write } for pid=7105 comm="syz.2.332" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 198.500646][ T6844] hid_parser_main: 5 callbacks suppressed [ 198.500665][ T6844] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 198.500690][ T6844] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 198.500709][ T6844] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 198.500727][ T6844] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 198.500745][ T6844] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 198.500764][ T6844] microsoft 0003:045E:07DA.0002: ignoring exceeding usage max [ 198.501613][ T6842] usb 4-1: 3:0 : does not exist [ 198.501629][ T6842] usb 4-1: 3:0 : does not exist [ 198.503845][ T6844] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 198.503866][ T6844] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 198.507271][ T6844] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 198.507293][ T6844] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 198.507310][ T6844] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 198.543647][ T6844] input: HID 045e:07da as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:045E:07DA.0002/input/input10 [ 199.707744][ T6844] microsoft 0003:045E:07DA.0002: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.1-1/input0 [ 199.710495][ T31] audit: type=1400 audit(1789829343.373:553): avc: denied { create } for pid=7096 comm="syz.3.329" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 199.724716][ T6844] usb 2-1: USB disconnect, device number 19 [ 199.760515][ T31] audit: type=1400 audit(1789829343.423:554): avc: denied { connect } for pid=7096 comm="syz.3.329" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 199.891041][ T5737] usb 1-1: USB disconnect, device number 13 [ 199.932609][ T6846] usb 4-1: USB disconnect, device number 8 [ 199.938955][ T5737] metro-usb ttyUSB0: Metrologic USB to Serial converter now disconnected from ttyUSB0 [ 199.939387][ T5737] metro_usb 1-1:8.109: device disconnected [ 200.188691][ T31] audit: type=1400 audit(1789829343.853:555): avc: denied { read } for pid=7114 comm="syz.4.334" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 200.368962][ T7118] netlink: 92 bytes leftover after parsing attributes in process `syz.1.335'. [ 201.697722][ T7123] netlink: 8 bytes leftover after parsing attributes in process `syz.3.336'. [ 202.745031][ T7124] netlink: 8 bytes leftover after parsing attributes in process `syz.1.339'. [ 202.745055][ T7124] netlink: 8 bytes leftover after parsing attributes in process `syz.1.339'. [ 203.936531][ T7134] FAULT_INJECTION: forcing a failure. [ 203.936531][ T7134] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 203.936595][ T7134] CPU: 1 UID: 0 PID: 7134 Comm: syz.4.341 Tainted: G L syzkaller #0 PREEMPT(full) [ 203.936624][ T7134] Tainted: [L]=SOFTLOCKUP [ 203.936630][ T7134] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 203.936642][ T7134] Call Trace: [ 203.936648][ T7134] [ 203.936655][ T7134] dump_stack_lvl+0x100/0x190 [ 203.936687][ T7134] should_fail_ex.cold+0x5/0xa [ 203.936710][ T7134] ? prepare_alloc_pages+0x16d/0x5b0 [ 203.936736][ T7134] should_fail_alloc_page+0xeb/0x140 [ 203.936762][ T7134] prepare_alloc_pages+0x1f0/0x5b0 [ 203.936790][ T7134] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 203.936814][ T7134] ? lock_acquire+0x1d1/0x380 [ 203.936833][ T7134] ? is_bpf_text_address+0x25/0x1a0 [ 203.936860][ T7134] ? find_held_lock+0x2b/0x80 [ 203.936884][ T7134] ? is_bpf_text_address+0x8a/0x1a0 [ 203.936907][ T7134] ? is_bpf_text_address+0x8a/0x1a0 [ 203.936930][ T7134] ? bpf_ksym_find+0x128/0x1c0 [ 203.936957][ T7134] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 203.936977][ T7134] ? kernel_text_address+0x8d/0x100 [ 203.937005][ T7134] ? __kernel_text_address+0xd/0x30 [ 203.937031][ T7134] ? unwind_get_return_address+0x59/0xa0 [ 203.937057][ T7134] ? arch_stack_walk+0xa6/0xf0 [ 203.937087][ T7134] ? __lock_acquire+0x5c0/0x1f40 [ 203.937107][ T7134] ? stack_trace_save+0x8e/0xc0 [ 203.937124][ T7134] ? __pfx_stack_trace_save+0x10/0x10 [ 203.937140][ T7134] ? stack_depot_save_flags+0x27/0x9f0 [ 203.937156][ T7134] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 203.937171][ T7134] ? policy_nodemask+0xed/0x4f0 [ 203.937187][ T7134] alloc_pages_mpol+0x201/0x550 [ 203.937202][ T7134] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 203.937217][ T7134] ? __update_page_owner_handle+0x390/0x530 [ 203.937236][ T7134] folio_alloc_mpol_noprof+0x36/0x260 [ 203.937254][ T7134] vma_alloc_folio_noprof+0xed/0x1d0 [ 203.937271][ T7134] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 203.937292][ T7134] do_anonymous_page+0xac9/0x2050 [ 203.937318][ T7134] ? __pfx_do_anonymous_page+0x10/0x10 [ 203.937333][ T7134] ? rcu_read_unlock+0x2d/0xb0 [ 203.937349][ T7134] ? rcu_read_unlock+0x2d/0xb0 [ 203.937365][ T7134] ? __pte_offset_map+0x179/0x310 [ 203.937379][ T7134] __handle_mm_fault+0x1ff3/0x2f60 [ 203.937398][ T7134] ? __pfx___handle_mm_fault+0x10/0x10 [ 203.937414][ T7134] ? pte_offset_map_lock+0x174/0x320 [ 203.937427][ T7134] ? find_held_lock+0x2b/0x80 [ 203.937442][ T7134] ? find_held_lock+0x2b/0x80 [ 203.937457][ T7134] ? follow_page_pte+0x536/0x1050 [ 203.937478][ T7134] handle_mm_fault+0x363/0xa20 [ 203.937497][ T7134] __get_user_pages+0x8ae/0x2c30 [ 203.937513][ T7134] ? kasan_save_stack+0x30/0x50 [ 203.937525][ T7134] ? kasan_save_track+0x14/0x30 [ 203.937538][ T7134] ? __pfx___get_user_pages+0x10/0x10 [ 203.937555][ T7134] ? __lock_acquire+0x5c0/0x1f40 [ 203.937571][ T7134] __gup_longterm_locked+0x279/0x16f0 [ 203.937588][ T7134] ? __pfx___gup_longterm_locked+0x10/0x10 [ 203.937604][ T7134] ? lock_acquire+0x1d1/0x380 [ 203.937615][ T7134] ? xdp_umem_create+0x6dc/0x1200 [ 203.937633][ T7134] pin_user_pages+0x13c/0x160 [ 203.937647][ T7134] ? __pfx_pin_user_pages+0x10/0x10 [ 203.937662][ T7134] ? xdp_umem_create+0x666/0x1200 [ 203.937678][ T7134] xdp_umem_create+0x741/0x1200 [ 203.937696][ T7134] xsk_setsockopt+0x7d8/0xab0 [ 203.937711][ T7134] ? __pfx_xsk_setsockopt+0x10/0x10 [ 203.937724][ T7134] ? find_held_lock+0x2b/0x80 [ 203.937739][ T7134] ? __fget_files+0x215/0x3d0 [ 203.937755][ T7134] ? selinux_socket_setsockopt+0x6a/0x80 [ 203.937767][ T7134] ? __pfx_xsk_setsockopt+0x10/0x10 [ 203.937781][ T7134] do_sock_setsockopt+0xf3/0x1d0 [ 203.937799][ T7134] __sys_setsockopt+0x195/0x220 [ 203.937818][ T7134] __x64_sys_setsockopt+0xbd/0x160 [ 203.937834][ T7134] ? do_syscall_64+0xae/0x790 [ 203.937850][ T7134] ? lockdep_hardirqs_on+0x7d/0x110 [ 203.937866][ T7134] do_syscall_64+0x123/0x790 [ 203.937883][ T7134] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 203.937895][ T7134] RIP: 0033:0x7f5f68f9e159 [ 203.937904][ T7134] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 203.937915][ T7134] RSP: 002b:00007f5f69eb3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 203.937927][ T7134] RAX: ffffffffffffffda RBX: 00007f5f69225fa0 RCX: 00007f5f68f9e159 [ 203.937934][ T7134] RDX: 0000000000000004 RSI: 000000000000011b RDI: 0000000000000003 [ 203.937940][ T7134] RBP: 00007f5f69eb3090 R08: 0000000000000020 R09: 0000000000000000 [ 203.937947][ T7134] R10: 00002000000000c0 R11: 0000000000000246 R12: 0000000000000001 [ 203.937954][ T7134] R13: 00007f5f69226038 R14: 00007f5f69225fa0 R15: 00007fffe4694f88 [ 203.937968][ T7134] [ 204.725988][ T3214] usb 3-1: new low-speed USB device number 10 using dummy_hcd [ 204.895907][ T3214] usb 3-1: unable to get BOS descriptor or descriptor too short [ 204.895980][ T3214] usb 3-1: New USB device found, idVendor=0c2e, idProduct=0720, bcdDevice=d4.29 [ 204.897317][ T3214] usb 3-1: config 8 has an invalid interface number: 109 but max is 0 [ 204.897353][ T3214] usb 3-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 204.897387][ T3214] usb 3-1: config 8 has no interface number 0 [ 204.897445][ T3214] usb 3-1: config 8 interface 109 altsetting 0 endpoint 0x3 has invalid maxpacket 512, setting to 8 [ 204.897483][ T3214] usb 3-1: config 8 interface 109 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 204.897535][ T3214] usb 3-1: config 8 interface 109 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 204.902546][ T3214] usb 3-1: string descriptor 0 read error: -22 [ 204.902721][ T3214] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 204.933667][ T31] audit: type=1400 audit(1789829348.593:556): avc: denied { create } for pid=7143 comm="syz.3.347" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 204.934249][ T31] audit: type=1400 audit(1789829348.603:557): avc: denied { connect } for pid=7143 comm="syz.3.347" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 205.056543][ T3214] metro_usb 3-1:8.109: Metrologic USB to Serial converter detected [ 205.062834][ T3214] usb 3-1: Metrologic USB to Serial converter now attached to ttyUSB0 [ 205.363939][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 205.604696][ T5737] usb 4-1: new low-speed USB device number 9 using dummy_hcd [ 206.093935][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 206.393933][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 206.693931][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 206.962940][ T5737] usb 4-1: unable to get BOS descriptor or descriptor too short [ 206.962983][ T5737] usb 4-1: New USB device found, idVendor=0c2e, idProduct=0720, bcdDevice=d4.29 [ 206.964807][ T5737] usb 4-1: config 8 has an invalid interface number: 109 but max is 0 [ 206.964828][ T5737] usb 4-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 206.964844][ T5737] usb 4-1: config 8 has no interface number 0 [ 206.964874][ T5737] usb 4-1: config 8 interface 109 altsetting 0 endpoint 0x3 has invalid maxpacket 512, setting to 8 [ 206.964897][ T5737] usb 4-1: config 8 interface 109 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 206.964918][ T5737] usb 4-1: config 8 interface 109 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 206.968239][ T5737] usb 4-1: string descriptor 0 read error: -22 [ 206.968336][ T5737] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 206.982500][ T5737] metro_usb 4-1:8.109: Metrologic USB to Serial converter detected [ 207.002397][ T5737] usb 4-1: Metrologic USB to Serial converter now attached to ttyUSB1 [ 207.160909][ T7157] netlink: 932 bytes leftover after parsing attributes in process `syz.4.350'. [ 207.545769][ T7165] netlink: 8 bytes leftover after parsing attributes in process `syz.0.351'. [ 208.708285][ T51] Bluetooth: hci1: unexpected event for opcode 0x203b [ 208.855097][ T5737] usb 3-1: USB disconnect, device number 10 [ 209.059166][ T5737] metro-usb ttyUSB0: Metrologic USB to Serial converter now disconnected from ttyUSB0 [ 209.087222][ T5737] metro_usb 3-1:8.109: device disconnected [ 209.166046][ T6846] usb 4-1: USB disconnect, device number 9 [ 209.231527][ T6846] metro-usb ttyUSB1: Metrologic USB to Serial converter now disconnected from ttyUSB1 [ 209.259631][ T6846] metro_usb 4-1:8.109: device disconnected [ 209.302802][ T7173] FAULT_INJECTION: forcing a failure. [ 209.302802][ T7173] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 209.302838][ T7173] CPU: 0 UID: 0 PID: 7173 Comm: syz.0.354 Tainted: G L syzkaller #0 PREEMPT(full) [ 209.302865][ T7173] Tainted: [L]=SOFTLOCKUP [ 209.302872][ T7173] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 209.302883][ T7173] Call Trace: [ 209.302890][ T7173] [ 209.302897][ T7173] dump_stack_lvl+0x100/0x190 [ 209.302927][ T7173] should_fail_ex.cold+0x5/0xa [ 209.302954][ T7173] _copy_from_user+0x2e/0xd0 [ 209.302975][ T7173] map_update_elem+0x99b/0xb50 [ 209.303008][ T7173] ? __pfx_map_update_elem+0x10/0x10 [ 209.303033][ T7173] ? selinux_bpf+0x11a/0x150 [ 209.303064][ T7173] __sys_bpf+0x1f8a/0x4a30 [ 209.303088][ T7173] ? __pfx___sys_bpf+0x10/0x10 [ 209.303105][ T7173] ? find_held_lock+0x2b/0x80 [ 209.303129][ T7173] ? get_pid_task+0xfc/0x250 [ 209.303152][ T7173] ? get_pid_task+0xfc/0x250 [ 209.303183][ T7173] ? find_held_lock+0x2b/0x80 [ 209.303212][ T7173] ? rcu_read_lock_any_held+0x6a/0x90 [ 209.303237][ T7173] ? find_held_lock+0x2b/0x80 [ 209.303259][ T7173] ? ksys_write+0x190/0x250 [ 209.303276][ T7173] ? ksys_write+0x190/0x250 [ 209.303293][ T7173] ? lock_acquire+0x1d1/0x380 [ 209.303327][ T7173] ? fput+0x7c/0x100 [ 209.303354][ T7173] ? ksys_write+0x1ac/0x250 [ 209.303374][ T7173] ? __x64_sys_bpf+0xce/0x140 [ 209.303391][ T7173] __x64_sys_bpf+0xce/0x140 [ 209.303409][ T7173] ? do_syscall_64+0xae/0x790 [ 209.303436][ T7173] do_syscall_64+0x123/0x790 [ 209.303462][ T7173] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 209.303479][ T7173] RIP: 0033:0x7f4b7479e159 [ 209.303495][ T7173] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 209.303511][ T7173] RSP: 002b:00007f4b75631028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 209.303529][ T7173] RAX: ffffffffffffffda RBX: 00007f4b74a25fa0 RCX: 00007f4b7479e159 [ 209.303540][ T7173] RDX: 0000000000000020 RSI: 0000200000000180 RDI: 0000000000000002 [ 209.303550][ T7173] RBP: 00007f4b75631090 R08: 0000000000000000 R09: 0000000000000000 [ 209.303560][ T7173] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 209.303570][ T7173] R13: 00007f4b74a26038 R14: 00007f4b74a25fa0 R15: 00007fff89975728 [ 209.303594][ T7173] [ 209.812661][ T7176] netlink: 8 bytes leftover after parsing attributes in process `syz.1.355'. [ 209.812685][ T7176] netlink: 8 bytes leftover after parsing attributes in process `syz.1.355'. [ 210.863359][ T31] audit: type=1400 audit(1789829354.523:558): avc: denied { write } for pid=7182 comm="syz.3.358" name="001" dev="devtmpfs" ino=744 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 211.059284][ T7186] faux_driver vgem: [drm] Unknown color mode 11176; guessing buffer size. [ 211.235090][ T3214] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 211.399598][ T7191] netlink: 8 bytes leftover after parsing attributes in process `syz.0.362'. [ 211.399637][ T7191] netlink: 8 bytes leftover after parsing attributes in process `syz.0.362'. [ 211.405013][ T3214] usb 5-1: Using ep0 maxpacket: 8 [ 211.413205][ T3214] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 211.414671][ T3214] usb 5-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 211.414704][ T3214] usb 5-1: config 255 has 0 interfaces, different from the descriptor's value: 1 [ 211.415790][ T3214] usb 5-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 211.415822][ T3214] usb 5-1: config 255 has 0 interfaces, different from the descriptor's value: 1 [ 211.416997][ T3214] usb 5-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 211.417028][ T3214] usb 5-1: config 255 has 0 interfaces, different from the descriptor's value: 1 [ 211.426827][ T3214] usb 5-1: string descriptor 0 read error: -22 [ 211.426997][ T3214] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 211.436489][ T3214] usb 5-1: rejected 3 configurations due to insufficient available bus power [ 211.436527][ T3214] usb 5-1: no configuration chosen from 3 choices [ 213.524977][ T7195] bond1 (unregistering): Released all slaves [ 214.062327][ T6846] usb 5-1: USB disconnect, device number 21 [ 214.706593][ T6844] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 214.724554][ T51] Bluetooth: hci4: unexpected event for opcode 0x203b [ 214.896073][ T6844] usb 3-1: Using ep0 maxpacket: 8 [ 214.899076][ T6844] usb 3-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 214.901036][ T6844] usb 3-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 214.901086][ T6844] usb 3-1: config 255 has 0 interfaces, different from the descriptor's value: 1 [ 214.903422][ T6844] usb 3-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 214.903468][ T6844] usb 3-1: config 255 has 0 interfaces, different from the descriptor's value: 1 [ 214.970683][ T6844] usb 3-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 214.970718][ T6844] usb 3-1: config 255 has 0 interfaces, different from the descriptor's value: 1 [ 215.002378][ T6844] usb 3-1: string descriptor 0 read error: -22 [ 215.002740][ T6844] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 215.087053][ T6844] usb 3-1: rejected 3 configurations due to insufficient available bus power [ 215.087422][ T6844] usb 3-1: no configuration chosen from 3 choices [ 216.444151][ T6846] usb 4-1: new low-speed USB device number 10 using dummy_hcd [ 216.616575][ T6846] usb 4-1: unable to get BOS descriptor or descriptor too short [ 216.616864][ T6846] usb 4-1: New USB device found, idVendor=0c2e, idProduct=0720, bcdDevice=d4.29 [ 216.621855][ T6846] usb 4-1: config 8 has an invalid interface number: 109 but max is 0 [ 216.622137][ T6846] usb 4-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 216.622415][ T6846] usb 4-1: config 8 has no interface number 0 [ 216.622762][ T6846] usb 4-1: config 8 interface 109 altsetting 0 endpoint 0x3 has invalid maxpacket 512, setting to 8 [ 216.623085][ T6846] usb 4-1: config 8 interface 109 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 216.623327][ T6846] usb 4-1: config 8 interface 109 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 216.733952][ T6846] usb 4-1: string descriptor 0 read error: -22 [ 216.735568][ T6846] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 216.818521][ T6846] metro_usb 4-1:8.109: Metrologic USB to Serial converter detected [ 216.930491][ T6846] usb 4-1: Metrologic USB to Serial converter now attached to ttyUSB0 [ 217.653619][ T5699] usb 3-1: USB disconnect, device number 11 [ 218.597249][ T6844] usb 4-1: USB disconnect, device number 10 [ 218.602611][ T6844] metro-usb ttyUSB0: Metrologic USB to Serial converter now disconnected from ttyUSB0 [ 218.603099][ T6844] metro_usb 4-1:8.109: device disconnected [ 218.823039][ T7230] netlink: 92 bytes leftover after parsing attributes in process `syz.0.370'. [ 218.894423][ T5699] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 219.202322][ T5699] usb 3-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 219.316362][ T5699] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 219.318459][ T5699] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 219.319241][ T5699] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 219.323273][ T5699] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 219.794300][ T5699] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 219.794788][ T5699] usb 3-1: Product: syz [ 219.794884][ T5699] usb 3-1: Manufacturer: syz [ 219.796294][ T5699] usb 3-1: SerialNumber: syz [ 220.921311][ T5699] usb 3-1: Not enough endpoints found in device, aborting! [ 221.168741][ T6846] usb 3-1: USB disconnect, device number 12 [ 221.695093][ T7243] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 221.697087][ T7243] CIFS: Attempting to mount //127.0.0.1/share [ 224.248424][ T7243] CIFS: VFS: cifs_mount failed w/return code = -112 [ 226.263439][ T7263] netlink: 8 bytes leftover after parsing attributes in process `syz.0.380'. [ 226.263479][ T7263] netlink: 8 bytes leftover after parsing attributes in process `syz.0.380'. [ 228.308791][ T7277] netlink: 8 bytes leftover after parsing attributes in process `syz.4.386'. [ 229.849117][ T7287] netlink: 8 bytes leftover after parsing attributes in process `syz.1.388'. [ 229.849141][ T7287] netlink: 8 bytes leftover after parsing attributes in process `syz.1.388'. [ 231.039278][ T31] audit: type=1400 audit(1789829374.703:559): avc: denied { connect } for pid=7296 comm="syz.4.389" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 232.172758][ T7299] process 'syz.4.389' launched './file2' with NULL argv: empty string added [ 232.187340][ T31] audit: type=1400 audit(1789829375.833:560): avc: denied { execute } for pid=7296 comm="syz.4.389" name="file2" dev="tmpfs" ino=392 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 232.187386][ T31] audit: type=1400 audit(1789829375.833:561): avc: denied { execute_no_trans } for pid=7296 comm="syz.4.389" path="/68/file2" dev="tmpfs" ino=392 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 232.311031][ T7310] netlink: 8 bytes leftover after parsing attributes in process `syz.2.391'. [ 232.548323][ T7301] bond1 (unregistering): Released all slaves [ 233.114553][ T5601] Bluetooth: hci3: command 0x0406 tx timeout [ 233.510547][ T7316] netlink: 8 bytes leftover after parsing attributes in process `syz.3.394'. [ 233.510597][ T7316] netlink: 8 bytes leftover after parsing attributes in process `syz.3.394'. [ 235.070569][ T31] audit: type=1400 audit(1789829378.733:562): avc: denied { create } for pid=7315 comm="syz.2.393" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 235.098726][ T31] audit: type=1400 audit(1789829378.763:563): avc: denied { write } for pid=7315 comm="syz.2.393" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 235.241470][ T7324] Zero length message leads to an empty skb [ 237.394246][ T6842] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 237.545216][ T6842] usb 5-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 237.546194][ T6842] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 237.546232][ T6842] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 237.546252][ T6842] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 237.546275][ T6842] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 237.550243][ T6842] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 237.550265][ T6842] usb 5-1: Product: syz [ 237.550279][ T6842] usb 5-1: Manufacturer: syz [ 237.550293][ T6842] usb 5-1: SerialNumber: syz [ 237.650883][ T7348] bond1 (unregistering): Released all slaves [ 237.777483][ T31] audit: type=1400 audit(1789829381.443:564): avc: denied { bind } for pid=7354 comm="syz.1.401" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 237.784073][ T31] audit: type=1400 audit(1789829381.443:565): avc: denied { ioctl } for pid=7354 comm="syz.1.401" path="socket:[13305]" dev="sockfs" ino=13305 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 237.862653][ T6842] usb 5-1: Not enough endpoints found in device, aborting! [ 238.130072][ T5737] usb 5-1: USB disconnect, device number 22 [ 238.357032][ T6842] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 238.514661][ T6842] usb 1-1: Using ep0 maxpacket: 8 [ 238.515216][ T6842] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 238.517201][ T6842] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 238.517223][ T6842] usb 1-1: config 0 has no interface number 0 [ 238.517254][ T6842] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 238.517274][ T6842] usb 1-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 238.517295][ T6842] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 238.517318][ T6842] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 238.517351][ T6842] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 238.551059][ T7370] netlink: 92 bytes leftover after parsing attributes in process `syz.3.406'. [ 240.762798][ T6842] usb 1-1: config 0 descriptor?? [ 242.438831][ T6842] usb 1-1: can't set config #0, error -71 [ 242.447569][ T6842] usb 1-1: USB disconnect, device number 14 [ 242.714738][ T7391] netlink: 121460 bytes leftover after parsing attributes in process `syz.0.409'. [ 242.909931][ T5699] usb 3-1: new low-speed USB device number 13 using dummy_hcd [ 242.947847][ T7400] netlink: 92 bytes leftover after parsing attributes in process `syz.3.413'. [ 243.099375][ T5699] usb 3-1: unable to get BOS descriptor or descriptor too short [ 243.101634][ T5699] usb 3-1: New USB device found, idVendor=0c2e, idProduct=0720, bcdDevice=d4.29 [ 243.770844][ T5699] usb 3-1: config 8 has an invalid interface number: 109 but max is 0 [ 243.773000][ T5699] usb 3-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 243.801769][ T5699] usb 3-1: config 8 has no interface number 0 [ 243.802102][ T5699] usb 3-1: config 8 interface 109 altsetting 0 endpoint 0x3 has invalid maxpacket 512, setting to 8 [ 243.802396][ T5699] usb 3-1: config 8 interface 109 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 243.802496][ T5699] usb 3-1: config 8 interface 109 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 244.712760][ T5699] usb 3-1: string descriptor 0 read error: -22 [ 244.779628][ T5699] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 244.966515][ T5699] metro_usb 3-1:8.109: Metrologic USB to Serial converter detected [ 244.971096][ T5699] usb 3-1: Metrologic USB to Serial converter now attached to ttyUSB0 [ 245.190658][ T7405] mmap: syz.3.416 (7405) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 246.325670][ T7411] netlink: 8 bytes leftover after parsing attributes in process `syz.3.418'. [ 246.325692][ T7411] netlink: 8 bytes leftover after parsing attributes in process `syz.3.418'. [ 247.997379][ T5737] usb 3-1: USB disconnect, device number 13 [ 248.001585][ T5737] metro-usb ttyUSB0: Metrologic USB to Serial converter now disconnected from ttyUSB0 [ 248.002075][ T5737] metro_usb 3-1:8.109: device disconnected [ 248.028333][ T7415] netlink: 8 bytes leftover after parsing attributes in process `syz.4.419'. [ 248.028369][ T7415] netlink: 8 bytes leftover after parsing attributes in process `syz.4.419'. [ 250.084350][ T7423] netlink: 92 bytes leftover after parsing attributes in process `syz.1.424'. [ 250.156992][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 250.157044][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 251.924135][ T5737] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 252.072298][ T7434] netlink: 92 bytes leftover after parsing attributes in process `syz.3.420'. [ 252.084657][ T5737] usb 1-1: Using ep0 maxpacket: 8 [ 252.085156][ T5737] usb 1-1: New USB device found, idVendor=17ef, idProduct=60a4, bcdDevice= 0.00 [ 252.086120][ T5737] usb 1-1: config 0 interface 0 has no altsetting 0 [ 252.086149][ T5737] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 252.088326][ T5737] usb 1-1: config 0 descriptor?? [ 253.136340][ T5737] usbhid 1-1:0.0: can't add hid device: -71 [ 253.136600][ T5737] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 253.169905][ T5737] usb 1-1: USB disconnect, device number 15 [ 253.524294][ T7443] netlink: 8 bytes leftover after parsing attributes in process `syz.3.428'. [ 253.651670][ T6838] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 253.815513][ T6838] usb 2-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice= 1.00 [ 253.817724][ T6838] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 253.817792][ T6838] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 253.817900][ T6838] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 253.889087][ T7438] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 253.889352][ T7438] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 253.966816][ C0] port100 2-1:1.0: NFC: Urb failure (status -71) [ 253.971725][ C0] port100 2-1:1.0: NFC: Urb failure (status -71) [ 253.999376][ T6838] port100 2-1:1.0: NFC: Could not get supported command types [ 254.400531][ T5737] usb 2-1: USB disconnect, device number 20 [ 254.652262][ T7438] comedi comedi3: unsupported base address 0x6 [ 255.266529][ T5777] usb 1-1: new low-speed USB device number 16 using dummy_hcd [ 256.019263][ T5777] usb 1-1: unable to get BOS descriptor or descriptor too short [ 256.019925][ T5777] usb 1-1: New USB device found, idVendor=0c2e, idProduct=0720, bcdDevice=d4.29 [ 256.364029][ T5777] usb 1-1: config 8 has an invalid interface number: 109 but max is 0 [ 256.364316][ T5777] usb 1-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 256.366478][ T5777] usb 1-1: config 8 has no interface number 0 [ 256.369004][ T5777] usb 1-1: config 8 interface 109 altsetting 0 endpoint 0x3 has invalid maxpacket 512, setting to 8 [ 256.369135][ T5777] usb 1-1: config 8 interface 109 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 256.369501][ T5777] usb 1-1: config 8 interface 109 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 257.011212][ T5777] usb 1-1: string descriptor 0 read error: -22 [ 257.046934][ T5777] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 257.115546][ T5777] metro_usb 1-1:8.109: Metrologic USB to Serial converter detected [ 257.152400][ T5777] usb 1-1: Metrologic USB to Serial converter now attached to ttyUSB0 [ 257.246992][ T31] audit: type=1400 audit(1789829400.913:566): avc: denied { append } for pid=7463 comm="syz.4.433" name="sg0" dev="devtmpfs" ino=1102 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 257.339598][ T31] audit: type=1400 audit(1789829401.003:567): avc: denied { connect } for pid=7463 comm="syz.4.433" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 257.367541][ T7464] syz_tun: entered allmulticast mode [ 257.542568][ T7463] syz_tun: left allmulticast mode [ 261.438861][ T6842] usb 1-1: USB disconnect, device number 16 [ 261.458086][ T6842] metro-usb ttyUSB0: Metrologic USB to Serial converter now disconnected from ttyUSB0 [ 261.458568][ T6842] metro_usb 1-1:8.109: device disconnected [ 261.705252][ T7480] bond1 (unregistering): Released all slaves [ 261.721033][ T31] audit: type=1400 audit(1789829405.383:568): avc: denied { write } for pid=7483 comm="syz.3.439" name="core" dev="configfs" ino=3593 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 261.800261][ T7485] FAULT_INJECTION: forcing a failure. [ 261.800261][ T7485] name failslab, interval 1, probability 0, space 0, times 0 [ 261.800293][ T7485] CPU: 0 UID: 0 PID: 7485 Comm: syz.3.439 Tainted: G L syzkaller #0 PREEMPT(full) [ 261.800318][ T7485] Tainted: [L]=SOFTLOCKUP [ 261.800324][ T7485] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 261.800335][ T7485] Call Trace: [ 261.800341][ T7485] [ 261.800348][ T7485] dump_stack_lvl+0x100/0x190 [ 261.800380][ T7485] should_fail_ex.cold+0x5/0xa [ 261.800411][ T7485] should_failslab+0xc2/0x120 [ 261.800435][ T7485] kmem_cache_alloc_noprof+0x92/0x6a0 [ 261.800455][ T7485] ? do_getname+0x35/0x390 [ 261.800486][ T7485] do_getname+0x35/0x390 [ 261.800514][ T7485] __x64_sys_rmdir+0x36/0x70 [ 261.800539][ T7485] do_syscall_64+0x123/0x790 [ 261.800567][ T7485] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 261.800585][ T7485] RIP: 0033:0x7ff03179e159 [ 261.800600][ T7485] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 261.800616][ T7485] RSP: 002b:00007ff032715028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 261.800634][ T7485] RAX: ffffffffffffffda RBX: 00007ff031a25fa0 RCX: 00007ff03179e159 [ 261.800646][ T7485] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000001640 [ 261.800656][ T7485] RBP: 00007ff032715090 R08: 0000000000000000 R09: 0000000000000000 [ 261.800667][ T7485] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 261.800677][ T7485] R13: 00007ff031a26038 R14: 00007ff031a25fa0 R15: 00007fff39ab24f8 [ 261.800701][ T7485] [ 262.029615][ T31] audit: type=1400 audit(1789829405.693:569): avc: denied { listen } for pid=7487 comm="syz.1.440" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 262.055246][ T31] audit: type=1400 audit(1789829405.703:570): avc: denied { accept } for pid=7487 comm="syz.1.440" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 262.322015][ T7498] netlink: 8 bytes leftover after parsing attributes in process `syz.3.443'. [ 262.573993][ T6842] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 263.845683][ T5737] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 263.887818][ T7505] bond1 (unregistering): Released all slaves [ 264.094619][ T5737] usb 5-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 264.132856][ T5737] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 264.133023][ T5737] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 264.133085][ T5737] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 264.133134][ T5737] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 264.168424][ T5737] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 264.168529][ T5737] usb 5-1: Product: syz [ 264.168570][ T5737] usb 5-1: Manufacturer: syz [ 264.168585][ T5737] usb 5-1: SerialNumber: syz [ 264.678167][ T7506] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 264.720676][ T5737] usb 5-1: Not enough endpoints found in device, aborting! [ 264.961105][ T6846] usb 5-1: USB disconnect, device number 23 [ 265.111310][ T31] audit: type=1400 audit(1789829408.773:571): avc: denied { mounton } for pid=7535 comm="syz.3.450" path="/file0" dev="ramfs" ino=15307 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=dir permissive=1 [ 265.501577][ T7533] bond1 (unregistering): Released all slaves [ 269.463408][ T7562] netlink: 92 bytes leftover after parsing attributes in process `syz.2.453'. [ 270.073951][ T6842] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 270.403933][ T6842] usb 2-1: Using ep0 maxpacket: 8 [ 270.985940][ T6842] usb 2-1: New USB device found, idVendor=17ef, idProduct=60a4, bcdDevice= 0.00 [ 271.014585][ T6842] usb 2-1: config 0 interface 0 has no altsetting 0 [ 271.014621][ T6842] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 271.042857][ T6842] usb 2-1: config 0 descriptor?? [ 272.089471][ T6842] usbhid 2-1:0.0: can't add hid device: -71 [ 272.089551][ T6842] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 272.091593][ T6842] usb 2-1: USB disconnect, device number 22 [ 272.302105][ T7576] bond1 (unregistering): Released all slaves [ 272.660374][ T7580] bond1 (unregistering): Released all slaves [ 272.752552][ T6842] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 272.915135][ T6842] usb 5-1: Using ep0 maxpacket: 32 [ 272.921031][ T6842] usb 5-1: New USB device found, idVendor=06cd, idProduct=0112, bcdDevice=d2.a2 [ 272.952406][ T6842] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 272.952438][ T6842] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 272.990883][ T5601] Bluetooth: hci1: unexpected event for opcode 0x203b [ 273.002137][ T6842] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 273.002162][ T6842] usb 5-1: Product: syz [ 273.002175][ T6842] usb 5-1: Manufacturer: syz [ 273.002189][ T6842] usb 5-1: SerialNumber: syz [ 273.027425][ T6842] usb 5-1: config 0 descriptor?? [ 273.040262][ T6842] keyspan 5-1:0.0: Keyspan 1 port adapter converter detected [ 273.040430][ T6842] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 87 [ 273.040482][ T6842] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 7 [ 273.041526][ T6842] keyspan 5-1:0.0: unsupported endpoint type 0 [ 273.041585][ T6842] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 1 [ 273.041641][ T6842] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 2 [ 273.041698][ T6842] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 85 [ 273.041755][ T6842] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 5 [ 273.109332][ T6842] usb 5-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 275.465459][ T5737] usb 5-1: USB disconnect, device number 24 [ 275.483575][ T5737] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 275.496741][ T5737] keyspan 5-1:0.0: device disconnected [ 275.515344][ T6842] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 275.665641][ T6842] usb 2-1: Using ep0 maxpacket: 32 [ 275.672410][ T6842] usb 2-1: New USB device found, idVendor=0e41, idProduct=4159, bcdDevice=b8.da [ 275.706747][ T6842] usb 2-1: config 0 interface 0 has no altsetting 0 [ 275.737641][ T6842] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 275.737693][ T6842] usb 2-1: Product: syz [ 275.737748][ T6842] usb 2-1: Manufacturer: syz [ 275.737763][ T6842] usb 2-1: SerialNumber: syz [ 275.809159][ T6842] usb 2-1: config 0 descriptor?? [ 276.699853][ T6842] snd_usb_podhd 2-1:0.0: Line 6 POD HD500X found [ 276.701107][ T6842] snd_usb_podhd 2-1:0.0: set_interface failed [ 276.701540][ T6842] snd_usb_podhd 2-1:0.0: Line 6 POD HD500X now disconnected [ 276.702032][ T6842] snd_usb_podhd 2-1:0.0: probe with driver snd_usb_podhd failed with error -71 [ 276.752780][ T6842] usb 2-1: USB disconnect, device number 23 [ 278.223960][ T6842] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 278.363964][ T6842] usb 2-1: device descriptor read/64, error -71 [ 278.389983][ T7629] netlink: 92 bytes leftover after parsing attributes in process `syz.4.470'. [ 278.604065][ T6842] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 278.834061][ T31] audit: type=1400 audit(1789829422.453:572): avc: denied { create } for pid=7631 comm="syz.2.466" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 278.834182][ T31] audit: type=1400 audit(1789829422.483:573): avc: denied { read append } for pid=7631 comm="syz.2.466" name="ppp" dev="devtmpfs" ino=708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 278.896779][ T7632] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 278.897783][ T7633] IPv6: addrconf: prefix option has invalid lifetime [ 280.451996][ T7640] bond1 (unregistering): Released all slaves [ 280.757823][ T5699] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 280.793397][ T7651] bond1 (unregistering): Released all slaves [ 280.935323][ T5699] usb 2-1: Using ep0 maxpacket: 8 [ 280.937681][ T5699] usb 2-1: New USB device found, idVendor=17ef, idProduct=60a4, bcdDevice= 0.00 [ 280.939097][ T5699] usb 2-1: config 0 interface 0 has no altsetting 0 [ 280.939159][ T5699] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 280.946330][ T5699] usb 2-1: config 0 descriptor?? [ 281.110700][ T7655] FAULT_INJECTION: forcing a failure. [ 281.110700][ T7655] name failslab, interval 1, probability 0, space 0, times 0 [ 281.110747][ T7655] CPU: 1 UID: 0 PID: 7655 Comm: syz.4.475 Tainted: G L syzkaller #0 PREEMPT(full) [ 281.110776][ T7655] Tainted: [L]=SOFTLOCKUP [ 281.110783][ T7655] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 281.110794][ T7655] Call Trace: [ 281.110800][ T7655] [ 281.110807][ T7655] dump_stack_lvl+0x100/0x190 [ 281.110840][ T7655] should_fail_ex.cold+0x5/0xa [ 281.110862][ T7655] ? irqentry_exit+0x24d/0xa10 [ 281.110892][ T7655] should_failslab+0xc2/0x120 [ 281.110917][ T7655] kmem_cache_alloc_noprof+0x92/0x6a0 [ 281.110936][ T7655] ? inet_lookup_ifaddr_rcu+0x105/0x160 [ 281.110962][ T7655] ? dst_alloc+0x99/0x1a0 [ 281.110988][ T7655] dst_alloc+0x99/0x1a0 [ 281.111010][ T7655] rt_dst_alloc+0x35/0x3a0 [ 281.111038][ T7655] ip_route_input_rcu.part.0+0x5e0/0xe20 [ 281.111061][ T7655] ? __pfx_ip_route_input_rcu.part.0+0x10/0x10 [ 281.111088][ T7655] ip_route_input_noref+0x1c3/0x2e0 [ 281.111109][ T7655] ? __pfx_ip_route_input_noref+0x10/0x10 [ 281.111133][ T7655] ? __pfx_ip_rcv_finish+0x10/0x10 [ 281.111154][ T7655] ? __pfx_nf_hook.constprop.0+0x10/0x10 [ 281.111185][ T7655] ip_rcv_finish_core+0x459/0x2c30 [ 281.111213][ T7655] ip_rcv+0x1c0/0x3c0 [ 281.111234][ T7655] ? __pfx_ip_rcv+0x10/0x10 [ 281.111253][ T7655] __netif_receive_skb_one_core+0x197/0x1e0 [ 281.111275][ T7655] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 281.111296][ T7655] ? lock_acquire+0x1d1/0x380 [ 281.111320][ T7655] ? lockdep_hardirqs_on+0x7d/0x110 [ 281.111348][ T7655] __netif_receive_skb+0x1f/0x120 [ 281.111369][ T7655] netif_receive_skb+0x139/0x7d0 [ 281.111389][ T7655] ? __pfx_netif_receive_skb+0x10/0x10 [ 281.111415][ T7655] ? netif_receive_skb+0x4/0x7d0 [ 281.111436][ T7655] tun_rx_batched.isra.0+0x3f6/0x750 [ 281.111461][ T7655] ? __pfx_tun_rx_batched.isra.0+0x10/0x10 [ 281.111487][ T7655] ? tun_get_user+0x1e1e/0x3cc0 [ 281.111515][ T7655] tun_get_user+0x1f53/0x3cc0 [ 281.111547][ T7655] ? __lock_acquire+0x5c0/0x1f40 [ 281.111567][ T7655] ? __pfx_tun_get_user+0x10/0x10 [ 281.111590][ T7655] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 281.111625][ T7655] ? find_held_lock+0x2b/0x80 [ 281.111651][ T7655] ? tun_get+0x191/0x370 [ 281.111668][ T7655] ? tun_get+0x191/0x370 [ 281.111695][ T7655] tun_chr_write_iter+0xdc/0x200 [ 281.111719][ T7655] vfs_write+0x6af/0x1050 [ 281.111738][ T7655] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 281.111762][ T7655] ? __pfx_vfs_write+0x10/0x10 [ 281.111779][ T7655] ? find_held_lock+0x2b/0x80 [ 281.111822][ T7655] ksys_write+0x12a/0x250 [ 281.111841][ T7655] ? __pfx_ksys_write+0x10/0x10 [ 281.111867][ T7655] do_syscall_64+0x123/0x790 [ 281.111894][ T7655] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 281.111912][ T7655] RIP: 0033:0x7f5f68f5e98e [ 281.111927][ T7655] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 281.111943][ T7655] RSP: 002b:00007f5f69eb2fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 281.111961][ T7655] RAX: ffffffffffffffda RBX: 00007f5f69eb36c0 RCX: 00007f5f68f5e98e [ 281.111973][ T7655] RDX: 0000000000000036 RSI: 0000200000002180 RDI: 00000000000000c8 [ 281.111983][ T7655] RBP: 00007f5f69eb3090 R08: 0000000000000000 R09: 0000000000000000 [ 281.111994][ T7655] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 281.112004][ T7655] R13: 00007f5f69226038 R14: 00007f5f69225fa0 R15: 00007fffe4694f88 [ 281.112029][ T7655] [ 282.880329][ T5699] usbhid 2-1:0.0: can't add hid device: -71 [ 282.881125][ T5699] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 283.136579][ T5699] usb 2-1: USB disconnect, device number 26 [ 283.340880][ T7670] netlink: 92 bytes leftover after parsing attributes in process `syz.4.479'. [ 283.687470][ T31] audit: type=1400 audit(1789829427.273:574): avc: denied { mount } for pid=7671 comm="syz.3.480" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 285.574083][ T31] audit: type=1400 audit(1789829429.243:575): avc: denied { unmount } for pid=5599 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 285.775745][ T6842] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 285.783971][ T5737] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 285.884021][ T6844] usb 4-1: new low-speed USB device number 11 using dummy_hcd [ 285.923950][ T6842] usb 3-1: Using ep0 maxpacket: 32 [ 285.924524][ T6842] usb 3-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 285.925971][ T6842] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 285.926000][ T6842] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 285.926023][ T6842] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 285.926047][ T6842] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 285.928033][ T6842] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 285.928053][ T6842] usb 3-1: Product: syz [ 285.928065][ T6842] usb 3-1: Manufacturer: syz [ 285.928078][ T6842] usb 3-1: SerialNumber: syz [ 285.932833][ T6842] usb 3-1: config 0 descriptor?? [ 285.933509][ T7676] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 285.939628][ T5737] usb 2-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 285.940662][ T5737] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 285.940699][ T5737] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 285.940720][ T5737] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 285.940741][ T5737] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 286.041972][ T5737] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 286.042061][ T5737] usb 2-1: Product: syz [ 286.042076][ T5737] usb 2-1: Manufacturer: syz [ 286.042089][ T5737] usb 2-1: SerialNumber: syz [ 286.053170][ T6844] usb 4-1: unable to get BOS descriptor or descriptor too short [ 286.053210][ T6844] usb 4-1: New USB device found, idVendor=0c2e, idProduct=0720, bcdDevice=d4.29 [ 286.100537][ T6844] usb 4-1: config 8 has an invalid interface number: 109 but max is 0 [ 286.100565][ T6844] usb 4-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 286.100582][ T6844] usb 4-1: config 8 has no interface number 0 [ 286.100614][ T6844] usb 4-1: config 8 interface 109 altsetting 0 endpoint 0x3 has invalid maxpacket 512, setting to 8 [ 286.100637][ T6844] usb 4-1: config 8 interface 109 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 286.100666][ T6844] usb 4-1: config 8 interface 109 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 286.189533][ T6844] usb 4-1: string descriptor 0 read error: -22 [ 286.189633][ T6844] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 286.220084][ T6842] input: Generic X-Box pad as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input12 [ 286.244201][ T31] audit: type=1400 audit(1789829429.903:576): avc: denied { read } for pid=4953 comm="acpid" name="js0" dev="devtmpfs" ino=2969 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 286.244294][ T31] audit: type=1400 audit(1789829429.903:577): avc: denied { open } for pid=4953 comm="acpid" path="/dev/input/js0" dev="devtmpfs" ino=2969 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 286.317837][ T6842] usb 3-1: USB disconnect, device number 14 [ 286.317907][ C0] xpad 3-1:0.0: xpad_irq_in - usb_submit_urb failed with result -19 [ 286.317944][ C0] xpad 3-1:0.0: xpad_irq_out - usb_submit_urb failed with result -19 [ 286.331460][ T31] audit: type=1400 audit(1789829429.993:578): avc: denied { ioctl } for pid=4953 comm="acpid" path=2F6465762F696E7075742F6A7330202864656C6574656429 dev="devtmpfs" ino=2969 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 286.378694][ T6844] metro_usb 4-1:8.109: Metrologic USB to Serial converter detected [ 286.383013][ T6844] usb 4-1: Metrologic USB to Serial converter now attached to ttyUSB0 [ 286.415369][ T5737] usb 2-1: Not enough endpoints found in device, aborting! [ 287.155235][ T6842] usb 2-1: USB disconnect, device number 27 [ 287.728833][ T7701] netlink: 104 bytes leftover after parsing attributes in process `syz.4.487'. [ 287.824137][ T7698] bond1 (unregistering): Released all slaves [ 288.074935][ T5802] usb 5-1: new low-speed USB device number 25 using dummy_hcd [ 288.866370][ T5802] usb 5-1: unable to get BOS descriptor or descriptor too short [ 288.866410][ T5802] usb 5-1: New USB device found, idVendor=0c2e, idProduct=0720, bcdDevice=d4.29 [ 288.889999][ T5802] usb 5-1: config 8 has an invalid interface number: 109 but max is 0 [ 288.890097][ T5802] usb 5-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 288.891044][ T5802] usb 5-1: config 8 has no interface number 0 [ 288.891342][ T5802] usb 5-1: config 8 interface 109 altsetting 0 endpoint 0x3 has invalid maxpacket 512, setting to 8 [ 288.891475][ T5802] usb 5-1: config 8 interface 109 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 288.891575][ T5802] usb 5-1: config 8 interface 109 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 289.290509][ T5802] usb 5-1: string descriptor 0 read error: -22 [ 289.342404][ T5802] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 289.397216][ T5802] metro_usb 5-1:8.109: Metrologic USB to Serial converter detected [ 289.422003][ T5802] usb 5-1: Metrologic USB to Serial converter now attached to ttyUSB1 [ 289.515092][ T5601] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 289.831061][ T6842] usb 4-1: USB disconnect, device number 11 [ 289.863765][ T6842] metro-usb ttyUSB0: Metrologic USB to Serial converter now disconnected from ttyUSB0 [ 289.864284][ T6842] metro_usb 4-1:8.109: device disconnected [ 289.954302][ T7716] bond1 (unregistering): Released all slaves [ 290.082169][ T7721] netlink: 92 bytes leftover after parsing attributes in process `syz.2.493'. [ 292.627463][ T6842] usb 5-1: USB disconnect, device number 25 [ 292.656743][ T6842] metro-usb ttyUSB1: Metrologic USB to Serial converter now disconnected from ttyUSB1 [ 292.669901][ T6842] metro_usb 5-1:8.109: device disconnected [ 293.236081][ T5802] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 294.701025][ T5802] usb 1-1: Using ep0 maxpacket: 8 [ 295.911576][ T7759] [ 295.915321][ T7759] ============================= [ 295.920585][ T7759] WARNING: suspicious RCU usage [ 295.925886][ T7759] syzkaller #0 Tainted: G L [ 295.932378][ T7759] ----------------------------- [ 295.937662][ T7759] net/netfilter/nf_conntrack_netlink.c:3395 suspicious rcu_dereference_check() usage! [ 295.948036][ T7759] [ 295.948036][ T7759] other info that might help us debug this: [ 295.948036][ T7759] [ 295.959142][ T7759] [ 295.959142][ T7759] rcu_scheduler_active = 2, debug_locks = 1 [ 295.967926][ T7759] locks held by syz.3.500/7759: 2, last CPU#1: [ 295.974650][ T7759] #0: ffffffff9be02c20 (nfnl_subsys_ctnetlink_exp){+.+.}-{4:4}, at: nfnetlink_rcv_msg+0x8ad/0x11e0 [ 295.986425][ T7759] #1: ffffffff8ea64d58 (nf_conntrack_expect_lock){+...}-{3:3}, at: nf_ct_expect_iterate_net+0x38/0x1a0 [ 295.998579][ T7759] [ 295.998579][ T7759] stack backtrace: [ 296.005020][ T7759] CPU: 1 UID: 0 PID: 7759 Comm: syz.3.500 Tainted: G L syzkaller #0 PREEMPT(full) [ 296.015799][ T7759] Tainted: [L]=SOFTLOCKUP [ 296.020120][ T7759] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 296.030181][ T7759] Call Trace: [ 296.033462][ T7759] [ 296.036396][ T7759] dump_stack_lvl+0x100/0x190 [ 296.041090][ T7759] lockdep_rcu_suspicious.cold+0x4f/0xb2 [ 296.046742][ T7759] expect_iter_name+0x102/0x130 [ 296.051603][ T7759] nf_ct_expect_iterate_net+0x141/0x1a0 [ 296.057147][ T7759] ? __pfx_expect_iter_name+0x10/0x10 [ 296.062539][ T7759] ctnetlink_del_expect+0x4ec/0x6c0 [ 296.067749][ T7759] ? __pfx_ctnetlink_del_expect+0x10/0x10 [ 296.073479][ T7759] nfnetlink_rcv_msg+0x9d5/0x11e0 [ 296.078499][ T7759] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 296.083951][ T7759] ? __lock_acquire+0x5c0/0x1f40 [ 296.088889][ T7759] ? avc_has_perm_noaudit+0x145/0x3b0 [ 296.094254][ T7759] netlink_rcv_skb+0x159/0x420 [ 296.099004][ T7759] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 296.104456][ T7759] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 296.109734][ T7759] ? ns_capable+0xd2/0xf0 [ 296.114056][ T7759] nfnetlink_rcv+0x1b3/0x440 [ 296.118639][ T7759] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 296.123743][ T7759] ? netlink_deliver_tap+0x1ae/0xcc0 [ 296.129015][ T7759] netlink_unicast+0x585/0x850 [ 296.133765][ T7759] ? __pfx_netlink_unicast+0x10/0x10 [ 296.139040][ T7759] netlink_sendmsg+0x8b0/0xda0 [ 296.143791][ T7759] ? __pfx_netlink_sendmsg+0x10/0x10 [ 296.149063][ T7759] ? selinux_socket_sendmsg+0x198/0x2f0 [ 296.154607][ T7759] ____sys_sendmsg+0xa4d/0xbe0 [ 296.159359][ T7759] ? __pfx_netlink_sendmsg+0x10/0x10 [ 296.164628][ T7759] ? __pfx_____sys_sendmsg+0x10/0x10 [ 296.169913][ T7759] ___sys_sendmsg+0x190/0x1e0 [ 296.174579][ T7759] ? __pfx____sys_sendmsg+0x10/0x10 [ 296.179758][ T7759] ? futex_wait+0x11e/0x370 [ 296.184257][ T7759] ? find_held_lock+0x2b/0x80 [ 296.188934][ T7759] __sys_sendmsg+0x160/0x210 [ 296.193516][ T7759] ? __pfx___sys_sendmsg+0x10/0x10 [ 296.198640][ T7759] do_syscall_64+0x123/0x790 [ 296.203222][ T7759] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 296.209096][ T7759] RIP: 0033:0x7ff03179e159 [ 296.213493][ T7759] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 296.233084][ T7759] RSP: 002b:00007ff0326f4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 296.241478][ T7759] RAX: ffffffffffffffda RBX: 00007ff031a26090 RCX: 00007ff03179e159 [ 296.249435][ T7759] RDX: 0000000000000000 RSI: 0000200000000600 RDI: 0000000000000006 [ 296.257388][ T7759] RBP: 00007ff03183506b R08: 0000000000000000 R09: 0000000000000000 [ 296.265337][ T7759] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 296.273292][ T7759] R13: 00007ff031a26128 R14: 00007ff031a26090 R15: 00007fff39ab24f8 [ 296.281257][ T7759] [ 296.649963][ T7766] netlink: 104 bytes leftover after parsing attributes in process `syz.4.499'. [ 296.734077][ T5802] usb 1-1: device descriptor read/all, error -71