last executing test programs: 19m43.094246349s ago: executing program 4 (id=3322): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x2, 0x2, &(0x7f0000000080)=@raw=[@call={0x85, 0x0, 0x0, 0x8d}, @exit], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2a}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) (async) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) (async) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000001040)=0x6) sendto$inet6(0xffffffffffffffff, &(0x7f0000000080)="4c00000012001f15b9409b849ac00a00a5784002000000000000030038c88cc055c5ac27a6c5b068d0bf46d323452536005ad94a461cdbfee9bdb942352359a351d1", 0x42, 0x0, 0x0, 0x0) r3 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000000)={r3, r3, r3}, 0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)={'sha384\x00'}}) (async) keyctl$dh_compute(0x17, &(0x7f0000000000)={r3, r3, r3}, 0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)={'sha384\x00'}}) 19m42.711746142s ago: executing program 4 (id=3323): r0 = socket$netlink(0x10, 0x3, 0x2) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000dc0)={0x0, 0x6, 0x0, 0x0, 0x0, "0062ba7d82000000000000000000f7ffffff00"}) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r3, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f0000000080)=@sack_info={r4, 0x10000, 0x101}, &(0x7f00000000c0)=0xc) ppoll(&(0x7f0000000080)=[{r1, 0x2000}], 0x1, 0x0, 0x0, 0x0) syz_open_pts(r1, 0x0) r5 = socket(0x10, 0x3, 0x0) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000140), 0x80080, 0x0) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_VFIO_IOAS$SET(0xffffffffffffffff, 0x3b88, &(0x7f0000000200)={0xc, r7}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r6, 0x3ba0, &(0x7f0000000180)={0x48, 0x2, r7}) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x52, 0x1, 0x0, 0x0, {0x2}}, 0x14}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 19m42.502314885s ago: executing program 4 (id=3325): r0 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r1, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010003"], 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r1], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x700, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00030000000000001c0012800c0001006d6163766c616e000c000280080001000800000008000500", @ANYRES32=r5, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r5], 0x4c}}, 0x884) 19m41.538457113s ago: executing program 4 (id=3327): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x40000001, &(0x7f0000000240)={0xffffffffffffffff}, 0x106, 0x1}}, 0x20) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0xd4}, [@initr0]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6b00}, 0x80) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000040)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e23, 0x13, @local, 0x10}, r1}}, 0x30) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_GUEST_MEMFD(r3, 0xc040aed4, &(0x7f0000000080)={0x200001fe0000, 0x3}) ioctl$KVM_SET_USER_MEMORY_REGION2(r3, 0x40a0ae49, &(0x7f0000000180)={0x4, 0x4, 0x6000, 0xa7000, &(0x7f0000ffc000/0x2000)=nil, 0x0, r4}) close(r4) r5 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x1d34, 0xa, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x90, 0x27, "", [{{0x9, 0x4, 0x0, 0xfe, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0xc1, 0xfe, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x9, 0xc0, 0x4}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io(r5, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000006c0)=ANY=[@ANYBLOB="34000000180001000000000000000000020000000000000900000000060015000600000010001680224d"], 0x34}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000006c0)=ANY=[@ANYBLOB="340000001100050026bd7000ffdbdf25070fef93", @ANYRES32=r7, @ANYBLOB="cfe819000000000014001a80100005"], 0x34}, 0x1, 0x0, 0x0, 0x2800c895}, 0x20040854) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000180)={0x3, 0x40, 0xfa02, {{0x6000000, 0x4f24, 0x40000, @private0={0xfc, 0x0, '\x00', 0x1}}, {0x2, 0xfff9, 0xc60, @empty, 0x100}, r1, 0x9dff7ffc}}, 0x4d) 19m37.784729707s ago: executing program 4 (id=3339): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000140)={r1, 0x0, 0x25, 0x0, @val=@tracing={0x0, 0x4}}, 0x20) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000d00), 0x8) r2 = socket$kcm(0x10, 0x2, 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x25, &(0x7f0000000000)=""/4102, &(0x7f0000001040)=0x1006) socketpair$nbd(0x1, 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() ptrace$ARCH_SHSTK_DISABLE(0x1e, 0x0, 0x1, 0x5002) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) clock_adjtime(0x0, &(0x7f0000000000)={0xa1f, 0x0, 0xd, 0x7, 0x0, 0xfffffffffffffffd, 0x77, 0x0, 0x0, 0x0, 0x3, 0x6, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x6, 0x5, 0x0, 0x8}) r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r4) ptrace$setregs(0xd, r4, 0x0, 0x0) ptrace$getregset(0x4205, r4, 0x2, &(0x7f0000000180)={0x0}) sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000011c0)=[{&(0x7f0000000180)="5c00000011006bec9e3be35c6e17ab31076b876c0d000000ba0900ec150af3653c001ac0040002020800050003000a002c000000eab556a705251e618294ff0051f60a84c9f4d4938037e786a6d0000300000000000000ffffc6c95372714d71f7fc846b1dd1d53374a154d11b17ce56d1b9cd73359740624f136b31703d9f2a2e124607dd9b404ae6ab1cbfe66efe3e3715816e6722910a61938f72294c903b071edb65a2318c067a8f6a17a859ecfe7f5e88d7152670af24322a49dc8927f0b561bca870d06810d735ab6e62b5da2c820cd23caf44d19a1e4a29e8572cf678d6cac65a3b523dc17f4ddd1e", 0xec}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000200)="b805000000b9008000000f01d9c4c33d6c8e00300000b20f01cf0f4ff90ffccb26470f001cd5b5ad09a366baf80cb8723ccf8bef66bafc0cec4c0fc72d0300000066baf80cb8be796d86ef66bafc0cec450f011d644f0000"}], 0x25, 0x43, 0x0, 0x0) 19m37.011970689s ago: executing program 4 (id=3343): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000780)=ANY=[@ANYBLOB="12010000772904202404019957c2010203010902240001000010000904430002317d1500090546d99666b3593e5236010202000202"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000540)={0x27, &(0x7f0000000900)={0x40, 0xd, 0xa9, "66d7e852c4b99d0abf1b259609e89cb76eda5f6c5ba4cf107eeda09d66879f39fa4c53bcd254e8c93cb470ff7ccdc1416ebfd4b4cdc236a49440e25704a8df8bdec886d27111c19b18640f7b7a649a209530fb72cf6dd89985825a7f000000aed8d6d473833ab71a0fbaac5e5ff16458be80acfd13a254055fb82004f99ab56c2c04386a631d38874b065a22a7f5cdd66f00"/169}, 0x0, 0x0, 0x0, 0x0}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb010018000000000000002400000024000000060000000300000002000013"], 0x0, 0x42}, 0x28) r1 = fsopen(&(0x7f0000000500)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000240)='/sys/power/pm_debug_messages', 0x2, 0x93) sendfile(r2, r2, 0x0, 0x6) r3 = fsmount(r1, 0x1, 0xf4) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000180), 0x200, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffc000/0x3000)=nil, &(0x7f000012d000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f00005a4000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f000012d000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$inet6(r4, &(0x7f0000003a00)=[{{&(0x7f0000000580)={0xa, 0x20, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9}, 0x1c, &(0x7f0000000040)=[{&(0x7f0000000200)="c5df6a3b", 0x34000}], 0x1}}, {{&(0x7f0000000b40)={0xa, 0x4e21, 0x900000, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x3}, 0x1c, &(0x7f0000001600)=[{&(0x7f0000000e40)="af", 0x1}], 0x1}}], 0x2, 0xc0c0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ppoll(&(0x7f0000000240)=[{r4, 0x2}], 0x1, &(0x7f0000000300), 0x0, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x382, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000080)=0xf) ioctl$TCFLSH(r6, 0x400455c8, 0xffffffffd) ioctl$sock_bt_hci(r5, 0x800448d2, &(0x7f0000000000)='0') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) syz_usb_control_io$rtl8150(r0, &(0x7f0000000600)={0x14, &(0x7f0000000340)={0x40, 0xf, 0xc9, {0xc9, 0xf, "3dbd1de567db52fc75fd4617489888be3dc8779f5bbc77420dac9ec66a09404a157c6223661742b3885625ee438ed9f8cb7011c1d7077e007679f7ebfe1d94fcaac71118ab060b95c216d4ba46726c93c9259663d83a7bb0142106f1db1ea3256bff7ab5a91d60cc7965e2c503063dfb9e083a6ba3f52ff823d359461d06896ed5efb0714821b0dc3d9221c2225c523986d61f80cf74652d10713649d10eaf6107ee5d3779714968662a4b97d68f10e314dd802559ae543db9f111793679fb0c440f8009eddb1e"}}, &(0x7f0000000840)=ANY=[@ANYBLOB="8e0bbbcc5cd6acd3063f1c29f041c861d23ce93482c16556d01602efcf3b6008375f84311c646519fbc32d0ac1ef"]}, &(0x7f0000000800)={0x2c, &(0x7f0000000640)={0x0, 0x10, 0xaa, "bceb68b880bcf3dadc9bf98be1dab4dc45cff666b39d46eb135baf46a815b9e32b802a708abc400ce4ae13cc47bfb4ce4cff68c58284218c7c95c0ab1d735c5297b8619c8d10c9e5c4b5b90db301c7acd52d7900b90239639b54dc752098ab957440458d853339238c31c92d4c3aa996799a1fb6cb742d0e1f020d0ed00865b8f67b63877529bcc757bd2ed833c4c3682879b5c5418d1b8fd8440e88d4e301c257c0b781e2e2c28ac6bf"}, &(0x7f0000000700)={0x0, 0xa, 0x1, 0x7c}, &(0x7f0000000740)={0x0, 0x8, 0x1, 0x1}, &(0x7f00000005c0)=ANY=[@ANYBLOB="7efc73caf93326c00505000f000000000000"], &(0x7f0000000880)=ANY=[@ANYBLOB="40050300000023e726d6073eb2f0f37ada24f4d4af3ae2da8acc52a07accb619766d3bf325578a1153ef918af00e1d53c8d6ae863e4d7e5566d4010224c5b2c3df564b9b7fffe28544edf57e0b1224d2deac397738ce24103dc0890f7ff795"]}) ioctl$CEC_S_MODE(r3, 0x40046109, &(0x7f0000000000)=0x3) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r7}, 0x2c, {[{@version_9p2000}]}}) write$P9_RVERSION(r9, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r8], 0x15) fchdir(r3) mknod$loop(&(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x4, 0x1) syz_usb_control_io$uac2(r0, 0x0, 0x0) 19m20.843279986s ago: executing program 32 (id=3343): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000780)=ANY=[@ANYBLOB="12010000772904202404019957c2010203010902240001000010000904430002317d1500090546d99666b3593e5236010202000202"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000540)={0x27, &(0x7f0000000900)={0x40, 0xd, 0xa9, "66d7e852c4b99d0abf1b259609e89cb76eda5f6c5ba4cf107eeda09d66879f39fa4c53bcd254e8c93cb470ff7ccdc1416ebfd4b4cdc236a49440e25704a8df8bdec886d27111c19b18640f7b7a649a209530fb72cf6dd89985825a7f000000aed8d6d473833ab71a0fbaac5e5ff16458be80acfd13a254055fb82004f99ab56c2c04386a631d38874b065a22a7f5cdd66f00"/169}, 0x0, 0x0, 0x0, 0x0}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb010018000000000000002400000024000000060000000300000002000013"], 0x0, 0x42}, 0x28) r1 = fsopen(&(0x7f0000000500)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000240)='/sys/power/pm_debug_messages', 0x2, 0x93) sendfile(r2, r2, 0x0, 0x6) r3 = fsmount(r1, 0x1, 0xf4) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000180), 0x200, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffc000/0x3000)=nil, &(0x7f000012d000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f00005a4000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f000012d000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$inet6(r4, &(0x7f0000003a00)=[{{&(0x7f0000000580)={0xa, 0x20, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9}, 0x1c, &(0x7f0000000040)=[{&(0x7f0000000200)="c5df6a3b", 0x34000}], 0x1}}, {{&(0x7f0000000b40)={0xa, 0x4e21, 0x900000, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x3}, 0x1c, &(0x7f0000001600)=[{&(0x7f0000000e40)="af", 0x1}], 0x1}}], 0x2, 0xc0c0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ppoll(&(0x7f0000000240)=[{r4, 0x2}], 0x1, &(0x7f0000000300), 0x0, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x382, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000080)=0xf) ioctl$TCFLSH(r6, 0x400455c8, 0xffffffffd) ioctl$sock_bt_hci(r5, 0x800448d2, &(0x7f0000000000)='0') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) syz_usb_control_io$rtl8150(r0, &(0x7f0000000600)={0x14, &(0x7f0000000340)={0x40, 0xf, 0xc9, {0xc9, 0xf, "3dbd1de567db52fc75fd4617489888be3dc8779f5bbc77420dac9ec66a09404a157c6223661742b3885625ee438ed9f8cb7011c1d7077e007679f7ebfe1d94fcaac71118ab060b95c216d4ba46726c93c9259663d83a7bb0142106f1db1ea3256bff7ab5a91d60cc7965e2c503063dfb9e083a6ba3f52ff823d359461d06896ed5efb0714821b0dc3d9221c2225c523986d61f80cf74652d10713649d10eaf6107ee5d3779714968662a4b97d68f10e314dd802559ae543db9f111793679fb0c440f8009eddb1e"}}, &(0x7f0000000840)=ANY=[@ANYBLOB="8e0bbbcc5cd6acd3063f1c29f041c861d23ce93482c16556d01602efcf3b6008375f84311c646519fbc32d0ac1ef"]}, &(0x7f0000000800)={0x2c, &(0x7f0000000640)={0x0, 0x10, 0xaa, "bceb68b880bcf3dadc9bf98be1dab4dc45cff666b39d46eb135baf46a815b9e32b802a708abc400ce4ae13cc47bfb4ce4cff68c58284218c7c95c0ab1d735c5297b8619c8d10c9e5c4b5b90db301c7acd52d7900b90239639b54dc752098ab957440458d853339238c31c92d4c3aa996799a1fb6cb742d0e1f020d0ed00865b8f67b63877529bcc757bd2ed833c4c3682879b5c5418d1b8fd8440e88d4e301c257c0b781e2e2c28ac6bf"}, &(0x7f0000000700)={0x0, 0xa, 0x1, 0x7c}, &(0x7f0000000740)={0x0, 0x8, 0x1, 0x1}, &(0x7f00000005c0)=ANY=[@ANYBLOB="7efc73caf93326c00505000f000000000000"], &(0x7f0000000880)=ANY=[@ANYBLOB="40050300000023e726d6073eb2f0f37ada24f4d4af3ae2da8acc52a07accb619766d3bf325578a1153ef918af00e1d53c8d6ae863e4d7e5566d4010224c5b2c3df564b9b7fffe28544edf57e0b1224d2deac397738ce24103dc0890f7ff795"]}) ioctl$CEC_S_MODE(r3, 0x40046109, &(0x7f0000000000)=0x3) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r7}, 0x2c, {[{@version_9p2000}]}}) write$P9_RVERSION(r9, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r8], 0x15) fchdir(r3) mknod$loop(&(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x4, 0x1) syz_usb_control_io$uac2(r0, 0x0, 0x0) 10m1.218587457s ago: executing program 3 (id=4919): socket$inet6_sctp(0xa, 0x5, 0x84) r0 = socket$inet(0x2, 0x2, 0x1) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000100)={'sit0\x00', &(0x7f0000000000)={'gretap0\x00', 0x0, 0x7, 0x40, 0x9, 0x100, {{0xb, 0x4, 0x3, 0x4, 0x2c, 0x66, 0x0, 0xfc, 0x4, 0x0, @empty, @private=0xa010100, {[@lsrr={0x83, 0x7, 0xa9, [@remote]}, @generic={0x94, 0xe, "a92f6ddfa82e64b59584b290"}, @noop]}}}}}) setsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000000180)={@loopback, @remote, r1}, 0xc) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000200)={0x2, 0x4, @broadcast}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000500)="08002b1e3cd19e9f09c572f999ef20b66846b8dda20c21db1067ac19a5b551d576b1995a1dab44ef5c8de02cda405ba4950ef4471cb20a1f4be5b8da329a8964bc9c9c1759561a513fa69491ecd2c78f0db42cdc3aef0afc6df4e70a6ed8f29729c9ed5674e7e19fe93cad5f34647e21b4356337a28efd9ba9d90eede32935e885ec08e5f401882cd6b00ada85c89eef8615fe359b8268b09816fc1aae50c40e41d73a83c091085ea6ca57a1dd23ed919c2668928dca49f41b7367d18007d7a826e2947ef989602cc3", 0xc9}, {&(0x7f0000000300)="96bc91701aaf", 0x6}], 0x2, &(0x7f0000000200)}, 0x24048894) creat(&(0x7f0000000000)='./file1\x00', 0x40) fanotify_init(0x20, 0x1) syz_open_dev$video(&(0x7f0000000280), 0x6, 0x2) socket$alg(0x26, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$TIPC_MCAST_BROADCAST(r2, 0x10f, 0x85) socket$inet6(0xa, 0x3, 0x5) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000014c0)=@raw={'raw\x00', 0x8, 0x3, 0x278, 0x0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x1a8, 0xffffffff, 0xffffffff, 0x1a8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [0x0, 0x62], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @local, [], [], 'wg1\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0xa8, 0xd8}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x2d8) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x2004c000) sendmmsg(0xffffffffffffffff, &(0x7f00000092c0), 0x4ff, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x124) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) mount$fuse(0x0, 0x0, 0x0, 0x404, &(0x7f0000000340)=ANY=[]) preadv2(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000001200)=""/4096, 0x1fee00}], 0x2, 0x0, 0x0, 0x0) r4 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x101001, 0x0) ioctl$FBIOBLANK(r4, 0x4611, 0x2) unshare(0x62020600) 9m55.220270757s ago: executing program 3 (id=4929): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) getsockopt(0xffffffffffffffff, 0x114, 0x2718, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r1, 0x0, 0x33, 0x0, 0x0) listen(r1, 0x3) ioctl$DRM_IOCTL_MODE_GETCRTC(0xffffffffffffffff, 0xc06864a1, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x40002182) r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, &(0x7f00000000c0)={'8255\x00', [0x4f27, 0x5, 0x2, 0x401, 0x1, 0xcc7, 0xfff, 0x0, 0x5, 0x3ff, 0x802, 0x1600, 0x1, 0x1, 0x9, 0xe1cb, 0x12d, 0x4, 0x3, 0x0, 0x0, 0xfffffffd, 0x0, 0xfffffff5, 0xffffeadb, 0x3, 0x3c, 0xa, 0x4, 0x8000000, 0xdffffffa]}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x4000) r3 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x7, 0x2) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0x1, 0x8, 0x7fffffff, 0x2, 0xa, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x5, 0x3, 0x0, 0x5, 0x24, 0x1, 0x0, 0x3c5b, 0x4, 0x24, 0x6, 0x1, 0x5, 0xffffffff, 0xe661, 0x4, 0x7, 0x89d2, 0x8, 0x4c74, 0x80000000, 0x40000, 0x5, 0x0, 0x0, 0x80008071, 0x7, 0x17, 0xd, 0x407, 0x5, 0x3a, 0x8f, 0x4006, 0x6, 0x80000000, 0x0, 0x4, 0x8, 0x400, 0x80, 0x0, 0x4, 0x7, 0x8, 0x4, 0xfffffffe, 0x40], [0x10000007, 0xf0000000, 0x8000012f, 0x8004, 0x5, 0x6, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0x10, 0x315, 0xd, 0xea4, 0xffffffff, 0x4, 0x7, 0x7fff, 0x5a7c, 0x420, 0x401, 0x6, 0x0, 0xff, 0x1, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x20009, 0x8, 0x9, 0x8, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0xfffffffe, 0x7, 0xc, 0x5, 0x3, 0x4, 0x1, 0x3, 0x6c0, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x8004, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x5, 0x9, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x10000, 0x3, 0x5, 0x2, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x4, 0x800003, 0x200, 0x7e, 0x7, 0x4, 0x2950bfaf, 0xffe, 0xa2, 0x7, 0xa9, 0x5, 0x9, 0xac8, 0x2000af, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0x0, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2004, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0x8000b, 0x8, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0x9, 0x2, 0x57, 0x451, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0xffff, 0x85, 0x2, 0x5, 0x1, 0x2, 0x5, 0xe7, 0x6, 0x16, 0xfffffffe, 0x80000003, 0x6, 0x4, 0xc8, 0x9, 0xfffff000, 0x10003, 0x3, 0x7e, 0xfd, 0x9602, 0x7, 0xaf, 0x8, 0x6, 0xffffffff, 0x5, 0x5, 0x8, 0x30b1d693, 0x5, 0xf40, 0x7, 0x1, 0x1000, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b0000000000e000000000000080000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1f, 0x14, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000018110000", @ANYRES32=r4, @ANYBLOB="0011cdc6da7800000000020000007b000007020000f8ffec3770cb76668a7206ffb703000008000000b7040000010000108500003f9e7b7bcfc12fd4923708bff2000000000000409e59484e47de5c197a52a5857db2e2c0ef21002e8b3033a508faf52d33e48a432e15f802395c9666b32926bf008336f6ff25b5a51e189c675e9dcd833f10c3dd5d214a30751619619ac795"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) mmap(&(0x7f0000956000/0x2000)=nil, 0x2000, 0x280000b, 0x28011, r3, 0x80c00100000000) 9m54.033352868s ago: executing program 3 (id=4933): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0xb, 0x7ff}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'veth0\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0x14, &(0x7f0000000180)=0x19ca, 0x4) r5 = socket$kcm(0xa, 0x5, 0x0) setsockopt$sock_attach_bpf(r5, 0x0, 0x31, 0x0, 0x1) socket$kcm(0x2, 0x200000000000001, 0x106) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0xb4) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = syz_open_dev$dvb_demux(&(0x7f0000001900), 0x0, 0x40400) ioctl$DVB_DEMUX_DMX_GET_STC(r7, 0xc0106f32, 0x0) openat$cgroup_procs(r6, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0}, 0x20040000) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x2, &(0x7f0000000100)=[{&(0x7f0000000180)="5c00000013006bcd9e3fe3dc4e48aa31086b8703410000004000000000000000040014000d000a00100000009ee517d34460bc08eab556a705251e6182949a3651f60a84c9f5d1938837e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bridge0\x00'}) socket$netlink(0x10, 0x3, 0x0) 9m51.930780239s ago: executing program 3 (id=4940): mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) r0 = socket$key(0xf, 0x3, 0x2) write(r0, 0x0, 0x0) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000600)={0x2, {{0x2, 0x0, @multicast2}}, 0x0, 0x2, [{{0x2, 0x0, @private=0xa010101}}, {{0x2, 0x4e22, @empty}}]}, 0x190) setsockopt$inet_group_source_req(r1, 0x0, 0x2b, &(0x7f00000004c0)={0x2, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @empty}}}, 0x108) mount$bpf(0x0, 0x0, 0x0, 0x2142005, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080), 0x20242, 0x0) read$rfkill(r2, &(0x7f0000000100), 0x8) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0/../file0\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bpf(0x200000000000, &(0x7f0000000200)='.\x00', 0x0, 0x8b7840, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x84000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x200000000000, &(0x7f0000000440)='./file0/../file0\x00', 0x0, 0x2042, 0x0) 9m51.170622238s ago: executing program 3 (id=4942): mkdir(0x0, 0x22) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = socket$netlink(0x10, 0x3, 0x0) (async) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x24000084) (async) r5 = socket$netlink(0x10, 0x3, 0x0) fchmodat(0xffffffffffffffff, &(0x7f0000000380)='./file0\x00', 0x40) (async) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) (async) socket$netlink(0x10, 0x3, 0x0) (async) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=@newqdisc={0x24, 0x29, 0x4ee4e6a52ff56541, 0x5001, 0xfffffdfb, {0x0, 0x0, 0x0, r7, {0x4}, {0xffff, 0xffff}, {0x0, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x400dc}, 0x4000080) (async) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@newtaction={0x64, 0x30, 0xffff, 0x0, 0x0, {}, [{0x50, 0x1, [@m_ife={0x4c, 0x1, 0x0, 0x0, {{0x8}, {0x24, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0xa, 0x80, 0x3, 0x0, 0x10}}}, @TCA_IFE_METALST={0x4}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x0) (async) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) (async) r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r9, @ANYRES32=r0, @ANYRESDEC=r9], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="0000000002000000b705000008000000850000006900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x180) (async) r11 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r11, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) openat2$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/../file0\x00', &(0x7f0000000200)={0x200000, 0x0, 0x2b}, 0x18) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b70800000c300000638af8ff00000000b5080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018240000", @ANYRES32=r10, @ANYBLOB="0000000000000000b703"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r12 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x16, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000280)=@generic={&(0x7f0000000180)='./file0\x00', r12}, 0x18) 9m49.922019787s ago: executing program 3 (id=4945): syz_open_dev$ttys(0xc, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x7, 0x0, 0x7fff0006}]}) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2}, &(0x7f0000000340)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$cec(&(0x7f0000000000), 0xffffffffffffffff, 0x0) ioctl$CEC_DQEVENT(r1, 0xc0506107, 0x0) ioctl$CEC_DQEVENT(r1, 0xc0506107, 0x0) 9m49.511962814s ago: executing program 33 (id=4945): syz_open_dev$ttys(0xc, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x7, 0x0, 0x7fff0006}]}) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2}, &(0x7f0000000340)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$cec(&(0x7f0000000000), 0xffffffffffffffff, 0x0) ioctl$CEC_DQEVENT(r1, 0xc0506107, 0x0) ioctl$CEC_DQEVENT(r1, 0xc0506107, 0x0) 11.950575419s ago: executing program 1 (id=6443): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000680)={{r3}, &(0x7f00000007c0), &(0x7f0000000640)=r2}, 0x20) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000002c0)={{r3}, &(0x7f0000000240), &(0x7f0000000280)='%pS \x00'}, 0x20) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) io_uring_setup(0x1028, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000000)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@xino_auto}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) chdir(&(0x7f0000000640)='./file0\x00') openat$dir(0xffffffffffffff9c, 0x0, 0x4000, 0x0) r4 = syz_open_dev$media(&(0x7f0000000040), 0x7fdffffe, 0x0) r5 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000d80)={0x0, &(0x7f0000000800)=[@nested_amd_vmload={0x182, 0x18}, @nested_vmresume={0x130, 0x18, 0x3}, @wr_crn={0x67, 0x20, {0x8, 0x4}}, @wrmsr={0x65, 0x20, {0x389, 0x9}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @control64=0x2012, 0x3, 0xff, 0x8001}}, @cpuid={0x64, 0x18, {0x2, 0x7ffe}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x3, @host32=0x4c00, 0x6, 0xcafb, 0x3}}, @rdmsr={0x66, 0x18, {0x254}}, @wr_crn={0x67, 0x20, {0x4, 0x9}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x2, @save_area=0x4d5, 0x4, 0x3e5, 0x3}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x1, @save_area=0x574, 0x1, 0x3, 0x7}}, @nested_vmresume={0x130, 0x18, 0x1}, @in_dx={0x69, 0x20, {0x79d9, 0x4}}, @cpuid={0x64, 0x18, {0x8, 0x2}}, @nested_amd_clgi={0x17f, 0x10}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x2, @guest_nat=0x6804, 0xb, 0x2, 0xd32}}, @enable_nested={0x12c, 0x18}, @wr_drn={0x68, 0x20, {0x5, 0x2}}, @cpuid={0x64, 0x18, {0x6, 0x4}}, @code={0xa, 0x5b, {"66460f38805b3d0f350f20d835080000000f22d80f186f45c4c26d3bc42e0f01d12e2e66f30fbd4607263e400f5d630066baf80cb86492c18cef66bafc0cb8d3000000ef8f8870cdcc00"}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0x1, 0x614a}}, @nested_load_syzos={0x136, 0x110, {0x2, 0x9, [@nested_load_syzos={0x136, 0x20, {0x2, 0x8001}}, @wrmsr={0x65, 0x20, {0x29f, 0xfff}}, @nested_amd_stgi={0x17e, 0x10}, @rdmsr={0x66, 0x18, {0xbd9}}, @nested_amd_clgi={0x17f, 0x10}, @wr_crn={0x67, 0x20, {0x8}}, @set_irq_handler={0xc8, 0x20, {0x36, 0x1}}, @nested_load_syzos={0x136, 0x20, {0x2, 0x97b8}}, @uexit={0x0, 0x18, 0x100000001}]}}, @wr_crn={0x67, 0x20, {0x2, 0x8}}, @wr_drn={0x68, 0x20, {0x1, 0x3}}, @nested_amd_vmsave={0x183, 0x18}, @nested_amd_vmsave={0x183, 0x18, 0x3}, @nested_load_syzos={0x136, 0xa8, {0x2, 0x3, [@nested_amd_vmcb_write_mask={0x17c, 0x38, {0x0, @control_area=0x7a, 0x0, 0x5, 0x9}}, @cpuid={0x64, 0x18, {0x80, 0x1000}}, @nested_load_syzos={0x136, 0x20, {0x0, 0xa7}}, @nested_create_vm={0x12d, 0x18}]}}, @nested_vmresume={0x130, 0x18}, @set_irq_handler={0xc8, 0x20, {0x37, 0x2}}], 0x573}) ioctl$KVM_GET_DEVICE_ATTR_vcpu(r5, 0x4018aee2, &(0x7f00000001c0)=@attr_pmu_irq={0x0, 0x1, 0x1, &(0x7f0000000dc0)=0xc}) ioctl$MEDIA_IOC_REQUEST_ALLOC(r4, 0x80047c05, &(0x7f0000000080)=0xffffffffffffffff) r7 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_G_EXT_CTRLS(r7, 0xc0205648, &(0x7f0000000000)={0xf010000, 0x0, 0x0, r6, 0x0, 0x0}) close(r6) 8.998658283s ago: executing program 0 (id=6449): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x20040040) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000080)={'gretap0\x00', &(0x7f0000000000)=@ethtool_sfeatures={0x3b, 0x2, [{0xf5f, 0x620a326a}, {0x1000, 0xffffffff}]}}) sendmsg$nl_generic(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b00)=ANY=[@ANYBLOB="2c0000003f00070100000000fddbdf25027c00001800378013000100717472283414d6bba919736d34"], 0x2c}, 0x1, 0x0, 0x0, 0xc880}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r6 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TCSETSW2(r6, 0x402c542c, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x13, 0x0, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$XFS_IOC_START_COMMIT(r3, 0x80585882, &(0x7f0000000300)) sendmsg$TIPC_NL_BEARER_ENABLE(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x54, 0x0, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @loopback}}, {0x14, 0x2, @in={0x2, 0x0, @multicast2}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) ioctl$BTRFS_IOC_BALANCE(r7, 0x5000940c, 0x0) sendmsg$TIPC_NL_KEY_SET(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={0x54, 0x0, 0x1, 0x70bd2d, 0x0, {}, [@TIPC_NLA_NODE={0x40, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "e3de3d7b4cd07ec3ee777de774fc7987cca41989"}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x4}, 0x4000004) 8.868698611s ago: executing program 6 (id=6450): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x1012c0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) socket(0x2c, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$KVM_TPR_ACCESS_REPORTING(0xffffffffffffffff, 0xc028ae92, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) bind$inet(r4, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r4, &(0x7f0000000140)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000080)=[{&(0x7f0000000340)="b92014c222ee", 0x6}], 0x1}}], 0x1, 0x20000840) ioctl$KDSKBENT(r3, 0x4b47, &(0x7f0000000180)={0x2, 0x3, 0x40}) ioctl$TIOCSWINSZ(r3, 0x5414, &(0x7f0000000040)={0x9, 0x2, 0x1000, 0x6}) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r6, {0x0, 0x1}, {0xffff, 0xffff}, {0x9, 0x9}}, [@TCA_INGRESS_BLOCK={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x3c, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xb, 0xfff3}, {}, {0x7, 0xfff1}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_CT_ZONE={0x6, 0x5d, 0x9}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20041090}, 0xd0) semop(0x0, 0x0, 0x0) semctl$IPC_RMID(0x0, 0x0, 0x0) pipe(0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x6, 0x0) 8.605532353s ago: executing program 6 (id=6453): r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) ioctl$EVIOCSMASK(r0, 0x40104593, 0x0) r1 = dup(r0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000140)={@multicast2, @empty, 0x0}, &(0x7f0000000180)=0xc) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f00000001c0)={@ipv4={""/10, ""/2, @private}, 0x0}, &(0x7f0000000200)=0x14) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000c00)=@newtfilter={0x34, 0x2c, 0xf3f, 0x70bd24, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xfff3, 0xffe0}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x8848}, 0x24000804) ioctl$KVM_X86_SET_MCE(r1, 0x4040ae9e, &(0x7f0000000e80)={0x5800000000000000, 0x50000, 0x7, 0x1, 0x10}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'ip6tnl0\x00', 0x0, 0x2f, 0x2, 0x3, 0xfffffb55, 0x50, @rand_addr=' \x01\x00', @private1={0xfc, 0x1, '\x00', 0x1}, 0x7800, 0x20, 0x8, 0x7ff}}) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r1, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000380)={0x104, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x48, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @loopback}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010101}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x1c}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r3}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x18}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x30, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r6}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x24, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x81}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @private=0xa010100}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x36}}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r7}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x1000}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_ADDR={0x4}]}, 0x104}, 0x1, 0x0, 0x0, 0x4000}, 0x200440d4) sendmsg$TIPC_NL_MON_PEER_GET(r5, &(0x7f0000000600)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x20, 0x0, 0x2, 0x70bd26, 0x25dfdbfd, {}, [@TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x810) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000080)=[{0x9, 0x22, 0x0, 0x7ff}]}) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x43, &(0x7f0000000e40), 0x10) r9 = syz_usb_connect(0x0, 0x1b, &(0x7f0000000080)={{0x12, 0x1, 0x250, 0xbc, 0xc7, 0x60, 0x20, 0x12d1, 0x1413, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9, 0x0, 0x1, 0x2, 0x0, 0x21}}]}}, &(0x7f0000000340)={0x0, 0x0, 0x19, &(0x7f0000000000)=ANY=[@ANYBLOB="050f19"]}) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r10, &(0x7f0000004240)={0x0, 0x0, &(0x7f0000004200)={&(0x7f00000041c0)={0x1c, 0x4, 0x8, 0x301, 0x0, 0x0, {0x7, 0x0, 0xa}, [@CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x6558}]}, 0x1c}, 0x1, 0x0, 0x0, 0x14008000}, 0x24004800) syz_usb_control_io(r9, &(0x7f0000000880)={0x2c, &(0x7f0000000680)={0x40, 0x31, 0xdf, {0xdf, 0xe, "2a5ba0ec1e5460d3e33a43566d2a51f485b0e775ab50d90c1c9d26cb10f32361655d48613701abe36dd1b0af0e00b45b4848e57abe0c2167bdf8de7b953a3410396f160deb88319f581e30f191f80e64a8e13f698219ddaf86ba729aff47a82628db06bff02fc39796f2a59ca788635343807ba9fd238b421d53c2a86bafda927db06901a925151ef4ef9b2b71da64f6685741145c6b95a63d21a4924ee880477f52ba925b89b5d395403ecec570ccd2b081a0c8218b77ecf55cbeae3eeb59072d4aa591a55545433399c89982140b660bd01c3abe59244ab3774faf48"}}, &(0x7f0000000780)={0x0, 0x3, 0x2c, @string={0x2c, 0x3, "820f0d41de7ed5e2d699914ec24d7a105478d0d45adf077224277abe8d0d6fbdd3bcfff875559073c4a8"}}, &(0x7f00000007c0)={0x0, 0xf, 0x1a, {0x5, 0xf, 0x1a, 0x2, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x9, 0x2, 0x5}, @wireless={0xb, 0x10, 0x1, 0xc, 0x0, 0x3, 0xf, 0x542}]}}, &(0x7f0000000800)={0x20, 0x29, 0xf, {0xf, 0x29, 0xfa, 0x10, 0x12, 0x58, "66fb6d89", "22875576"}}, &(0x7f0000000840)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x93, 0x2, 0x0, 0xb, 0x7, 0x5, 0x80}}}, &(0x7f0000000d80)={0x84, &(0x7f00000008c0)={0x40, 0xa, 0x9e, "5777a2993856439745a991b7202b2c91f988f9f8f021877219c08f8f1edb8dafe2be614c79ba2a7e4a3e3ad604058e3b1c8ebd72f23303edc83e186d44476e2088bf3c38b51593a42fbf68b7db6b1dff6dcfc2cf38a890764671e54ed123c4885017cce174cb95a0c3175adb76446ccf91d4b39094b620280a9565faf56bc54901b87d5c7e073383153e3d8813ac1fcf6b024d21264e599faec936c3a452"}, &(0x7f0000000980)={0x0, 0xa, 0x1, 0x19}, &(0x7f00000009c0)={0x0, 0x8, 0x1, 0xa7}, &(0x7f0000000a00)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000a40)={0x20, 0x0, 0x4, {0x400, 0x20}}, &(0x7f0000000a80)={0x40, 0x7, 0x2, 0x1ff}, &(0x7f0000000ac0)={0x40, 0x9, 0x1, 0x6}, &(0x7f0000000b00)={0x40, 0xb, 0x2, "27df"}, &(0x7f0000000b40)={0x40, 0xf, 0x2, 0xb}, &(0x7f0000000b80)={0x40, 0x13, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, &(0x7f0000000bc0)={0x40, 0x17, 0x6, @local}, &(0x7f0000000c40)={0x40, 0x19, 0x2, '\'M'}, &(0x7f0000000c80)={0x40, 0x1a, 0x2}, &(0x7f0000000cc0)={0x40, 0x1c, 0x1}, &(0x7f0000000d00)={0x40, 0x1e, 0x1, 0xf9}, &(0x7f0000000d40)={0x40, 0x21, 0x1, 0xf2}}) r11 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') pread64(r11, &(0x7f0000001240)=""/102400, 0x19000, 0xffffffff8) ioctl$TIOCEXCL(r11, 0x540c) close_range(r8, 0xffffffffffffffff, 0x0) 8.555630865s ago: executing program 5 (id=6454): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010007000000000000010000000a20000000000a03000000000000000000010000000900010073797a300000000048000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0c00098008000140000100075c0000000e0a01020000080000000000010000000900020073797a32000000000900010073797a30"], 0xec}, 0x1, 0x0, 0x0, 0x4004}, 0x40) openat$userio(0xffffff9c, 0x0, 0x84180, 0x0) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000180)={0x0, 0x205f, 0x1, 0x0, 0x851}, &(0x7f0000000300)=0x0, &(0x7f0000000200)=0x0, &(0x7f00000000c0)=0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="200000002700090026bd7000fddbdf25080000000b0001006175746f"], 0x20}, 0x1, 0x0, 0x0, 0x4000002}, 0x4000080) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r7 = syz_open_dev$sndctrl(&(0x7f0000000440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r7, 0x40045532, &(0x7f0000000040)) r8 = syz_open_dev$sndpcmp(0x0, 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_XRUN(r8, 0x4148, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r9 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x38, 0x1403, 0xc23, 0x70bd2b, 0x25dfdbff, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'syz_tun\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x14f7325d9d03b00}, 0x4000) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x40, 0x0, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x7c65, 0x95f7, 0x1, 0x0, 0x0) r10 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x200002, 0x0) fchdir(r10) mkdirat(0xffffffffffffff9c, 0x0, 0x0) rename(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000200)='./file0\x00') 8.213531892s ago: executing program 2 (id=6455): r0 = timerfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setpgid(r1, r1) add_key$fscrypt_v1(&(0x7f00000002c0), 0x0, &(0x7f0000000440)={0x0, "8527d2100090af54bfbca283be11c0de7af30e90937920fcba13d90af61beaa44d66a6535daf1bc35fb3af1e9197e31d26589d073c10184095fb00", 0x14}, 0x48, 0xffffffffffffffff) unshare(0x2c020400) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r4, 0x0, 0x48810) ioctl$TFD_IOC_SET_TICKS(r0, 0x40085400, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b4050000000000006910a40000000000bc001000000000009500000000000000ef4f7c81f5427c16bd2aacf32cdbb47063fd9a7bb1f3ad622c3261f324e081c0ea39bd16d9869302cc08fbd94867708cb208e22cc0ad536525e3b39869285c126353f6a49bc5abc6b9a4eab313655286ee33a56f03b665dd5f1739bda6accc3b9b0d26450d3161263aed01194269a5fba4553bb18fa1f37e2f68a8ef81f090829d0ee04b52611a41642b31a6fe2653171379cc327fc11e38418b589777f8c8ddcbf88df947a05937ea"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_open_procfs(0x0, &(0x7f0000000480)='net/fib_triestat\x00') getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000440), 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) 7.053372918s ago: executing program 5 (id=6456): socket$alg(0x26, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="00000000000000efff4000000000000000f3ffff73698cb35dcb4329c0a40e27bbc9c8e764698d845c0e03b509d67a", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x40, 0x1ff) socket$inet6(0xa, 0x80000, 0xe6a2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x40980, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205647, &(0x7f00000002c0)={0x9e0000, 0x9, 0x9, r0, 0x0, 0x0}) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r4, 0x400455c8, 0x4) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000019080)=0x30) socket$netlink(0x10, 0x3, 0x8000000004) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuset.memory_pressure\x00', 0x275a, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r5) sendmsg$NL80211_CMD_TRIGGER_SCAN(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="050000000000000000002100000008000300", @ANYBLOB="10007d8005", @ANYRES8=0x0, @ANYRES32=r5], 0x2c}, 0x1, 0x0, 0x0, 0x8080}, 0x0) 6.451888845s ago: executing program 2 (id=6457): r0 = socket$igmp6(0xa, 0x3, 0x2) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='net/ptype\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000700)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r3, &(0x7f0000000100)={0x20000014}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000180)={0x38, 0x5, 0x8, 0x5, 0x0, 0x9, 0x0, 0x2, 0xfa11, 0xffffffff}, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) poll(&(0x7f0000000140)=[{r2, 0x2141}, {r2, 0x1}], 0x2, 0x8000004) recvmmsg(0xffffffffffffffff, &(0x7f00000051c0)=[{{0x0, 0x0, 0x0}, 0x40}], 0x1, 0x2, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[], 0x64}}, 0x0) r5 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r5, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0x0, 0x3}, 0x20) r6 = socket$kcm(0x10, 0x2, 0x10) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000280)=ANY=[], 0x20}}, 0x0) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) connect$l2tp6(r5, 0x0, 0x0) sendmmsg$inet6(r5, &(0x7f0000000ac0)=[{{&(0x7f0000000180)={0xa, 0x0, 0x0, @empty}, 0x1b, 0x0}}], 0x17fd147c801ae9af, 0xff00) r7 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmmsg$inet(r8, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="1c0000004400090000000000000000000500000008", @ANYRES32=r1, @ANYBLOB="ca20419e9287a26425a3486c7d5c56d9a49e036c611573cbe4ed30384af023a533c889458b311204cd89dc21eae6569404bcfb2a41a5983f487cbbf5aea686925bd96a79d6211f51a403f7aaed329bb6591f038bc33b6279270e1228dd070a9e5b4bebfce822a49c1fe3302c59bb1c88306052d48f3a5617e33c0dd5e71e805973bc70e0b896a6"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000044) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000ec0)=@raw={'raw\x00', 0x8, 0x3, 0x410, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x340, 0xffffffff, 0xffffffff, 0x340, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @private=0xa010102}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', [0x0, 0xffffffff, 0x164d2c527ac5db29], [], 'team_slave_1\x00', 'vlan1\x00', {}, {}, 0x0, 0x40}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @dev={0xfe, 0x80, '\x00', 0x2e}, [0x0, 0xff], [], 'wg1\x00', 'gre0\x00', {}, {}, 0x2b}, 0x0, 0x230, 0x270, 0x0, {}, [@common=@srh={{0x30}, {0xd1, 0x8, 0x8, 0x8, 0xf, 0x4c, 0x400}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x52, 0x1, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0x4, 0x1, 0x9, 0x9, 0x80000000, 0x5, 0x0, 0x80000000]}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x470) r9 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r9, 0x8993, &(0x7f0000000080)={'bond0\x00', &(0x7f00000000c0)=@ethtool_coalesce={0x1, 0xf0, 0x200, 0x9, 0x6, 0x0, 0x2, 0x80000001, 0x5, 0x4, 0x5, 0x1, 0x2000, 0x4, 0x9, 0xa5, 0x5, 0x8000dff, 0xff, 0x452, 0x1000, 0xb, 0x4}}) pipe(&(0x7f0000000040)) 6.142690298s ago: executing program 6 (id=6458): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, 0x0, 0x0) r1 = socket$kcm(0xa, 0x2, 0x0) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, 0x0, 0x0) setreuid(0x0, 0x0) statx(0xffffffffffffff9c, &(0x7f0000019300)='./file0\x00', 0x2000, 0x2, &(0x7f0000022540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f0000019340)="dc07e3eddd06223f828c5fffe5d3151bc1d79717e59b236ff76bd33ae878d8af5729a3e6192cd5df208c8214a847a5e74f91bec36631e469ced5ca7372603fac4a4a2962aa7a95a78ebfbe04bdb97e9e5c0dc897c311e0edab21ef4cf9f4f511345123e122802c7e3df57cd79e8e0881e780dd890e75837b79660c857b33f4461b625fcabb2575334c8f90b93d3029cb5d649df87d3d9beeeb8fdd85da2dfaed8f1cdb7e5ad278fc14988aeb43ff7a44dcaaf3301ccb7d96f5e4bc05b3ddc5adde2653472816957128ebdfbae836dd97427fa9039e2be2229b1e0e0f998c75ac8a7a5397181a0496ed30ce3a0e49f81f23bb592e5afe818a42ab793adfc2642babe53b27c021f631b8d56ee084c636446de6c79b65a43c908e8466044a4bc38b7a97612ebd1ceb57a8f8900c9cca8f5459d080916d0b42a9345e4b29505cfadfde4000cc2a58b58ee0054e4284d4c2ba0d13904a727fe98d9346dac60e1c5e5c73af421e78378f60a45f31216b8ce2067e27a48f9cd5a52a04a7c87a8231375e9039fc638ed02906491bfc8ad7ecdce237613e20c2930b58bde739cb6600c5e146ef37458714372a5a8a4ae5e2cdc2f7f4903852f6061a51512ed8378069c9f7218ce466c7f109ca8bedb850d1fbacaf12bc22ed3b43d7f85a23730e6f38466af2a02e5f767aded7b1880ef1ca64804328f6f1a2e1e4d56074f7eb4cd8b0527f7e026408d9b44015d5d6fc0f3501bced1b99b3b711f146209e2597a7c45bf8b16df2204d1e55c8b70cbf23bc883d50dfcca93f6577eef242a7a8ee82f93767777904683f923d38cd1712c1396821ba733efb0a400f877abd5d5b8f2ce4659e9fc2f0006e5095be6c1af346c09923371f330ac728ba9ca786cb77991a99433c3a2f210ebebb71b5c5b786bc70c2271986f04efc62957339f7db148e6eeb1698272d60c3e99b573a99177bebf785e59f22ee0e86fa566701e34c49d744dad7dff74818715bd223855847cd0576c689ebb078fe16f3db4a6d823197723383c642c7127187dd13b1772488eadcb13e9803a4ce8f98ab9d1169c9678e0de81fc5510f5f04754c7459e0e9f8ffe32e4c53f52e2a723280d3574a36fa91dcb0ecfbae9b146fe1dbcea6626f0c7de080dea1f23a3116f5be78017763d61acebd49fde9db591f41587f7b84e07276e2fcccf1568b33d232c23d13c77b78914da1fccc4d65587922cb6205b93293cc3b14f31aa90c86898b66128d254cf080f8900c5dafb2b794388444a5f34f7e5c8336e42998950bb0b27bc9fe1ae92302b00cccbc07f7c6f11b27bb4b011afc2a561342aed1a63bbeaa366884e5cee0f241fa13e34112d2312dff32e6c8a6427e6b42d0bcdd5d1feda70e30784d89000f4888a8fee87bea7462a4c40450b79d2d22491f60a87928519249701f09340bc1b643b204794a9406d420c0d53cc453b174f0b6e2bc459f98576b528fab3218d1376498154a17bb0fd8fa72dd22d523b2e1aeac98abc157365c1c1fa69fbd92808c4fb8240be5da60766c3956d929ece40c9921c94012d24bc1223d55dcf9d85dc2bbad1e71d58d97da0c767e289c5275a082a2b8ba68ff0b3134bda82557582b73006febcc16ffa6d7aabbda45310c143d80ce5d3c7c5cf7fab07237e89bf76dde7d6d4ba0119973f045b801cc32fce53c192e872f46f2d1322aaf35085f758c573b78e14d93963c2cfbcb27f0ffc226b2db1e4b03741d9959e79cd96c931ddb9805860df70d7e2eab637fe63d0510bd7f0aafc184d8cae6d7f817fefc2ccb2c9b0e60b888d5d9eb3b2da1abb821b0f7b93b28512668581a012b87c1b8880e2af64ec795d9055d11f3298ed8e7f2001e47fded83c6c316d102b444e05f536d96e66574ee60be33de1370ce97ca27a86f31cae8bcc9da74730c137ea31f40b7f9cc2b5e73d9a0174798367c1e3fd4f8bb8c0e0ea34c9b47c018ae63c1b4232e2e258d7d5153cfd7e0e700db201832d538ac51a16226fd2df5654fac333e1b4cdbd1867db838969c9d507a2bf7175a11da69aa6ec3d7d3e4cc352d59807d44c3498638e67bed88c0149c952f68689c2bb1a04a5522eed31d22a23e89f173e180bab7bf39cdfebb09551d9d8d9028ebf0a1117c2e1ea202bd31a974629ad06107c0c94cc7b7b84bcae60d92431918f956223fdebc325ec3948422a4b2867a9913f2f1cc1e6a64f89a861a34114f67fa06796dc60ba5f2f9f2051f24a1dc61e80149a6f0fbd5ffb0387875c7b99597fd8190e006c51d67880fc528848fd8ccd5e95eb2e3ce62065de14993cce8bb6773f22cea830e1bb978386eb2eac5275157a52f20242359ba07aa20ba8a8b8597d8d510ddd1252812ab0534fd07a67addaab261876476ad47005ea3619ea6855c2bff5874f350becb0ae25dc08dcf08f0f0b8d49517c9df98656bbed9acac821ccfb963cc29f0a1e4ec94f149593e55c0c0c89eb110362238ed7af4cc5e19ce227ff5bd3b861c75495ab2030590d5752b2058ce1e7fc7ce303c75ae7762762ecccc4743d9f7d3f6fdaa1cfc10bcc84c788d85ad5db8c00ac6f5ffc080edcba2863dbfc6ce0f1822de8191f36db60d7ee385d59f7ef3d302b371279e699f0adfe171a5815456b180aec99610718dc5b5c1632a1d9e41be4df341744af3c92f48fa7dcca29adb34f4ca5e78e2741b8da144759de87ab119e720178a2b9841c2ad1a5175ed2d0da8e91cd0d9add4ff6aebd9046fbb7551c086e6458a18a4cb9f70a2861ae42c6f203f87bc746ab7e042c6c51425cc83d367295ee2527a943dac0edce9ac45e3a3ba157be025836d3c6e61a54bfddff0497a4470bbcc7cf22479568896f874f053725c2066e3df44789158e96e5bc744b93e550be5f8037d3187edd03dfac2798d429ea21508abdcd0e2f3738f16ce7bc073c17fbdbfb991402530e8a43e26f8b3daaedee317a2ff09de3e8406f8778607dc16dde7d7af91fb463669d326e71bac12760471a3d113cb3ada41e8326fcd1b0d6acb78afa3a3b4a7ddae18856afc5a731d1187c696eea550a9e10e6fbd6fb94599ed64e59216856bf59b4bef0baf85570ce1131daa4f3a1d24961b9a1cdd29e3a79955494f748e9402e95b944fc13a6f280ef60bb29d34a36b458be5ccc7fad1269d68050736a09baa39b7400f5091ee20a2975104655a65fd658219cc6906fd741d2500e00df9c205397a5bdbb116728cef75f0c984999f57003bf880d86600ba5d7e09457eebfdee84e9c7cfba94770a5fee43b9904d3978dd89118fda426ddb030dd4e1578852ffc22df3e2f76c6157ad13af0912cf96e6f0b143f0362ed5139c58d8e40019d801be79c333fda27d267190ebdd3f66717257c2a24566e27b43b2791f1a3389f906a7892c0c67a1120b15e874c0606b011f6b34c5e322bc64391210474684ba48d6e6a1d53ecc88db231b7f58534924044f7a71ea6dfe83870b7d08b286495a19fe963b9def728fa991703065badc39445665137832908088626a8341fe7ccc7d9ee8122e7fa7fcef9c85154b7923c341df1fd79fbbc169790e382cc3e94528087f4edb6f46da12f01945f7d2d5df78e49c09a836d02c729d59d1798e9594230941de1b1f24f0f9a68876d2e8c125c1b1c303a9b54aa221bdd6edb168d7f63d5b166189cef4339458e8bb2990411ec6eaf84ac00ce42c71b0d113798fa22d8c251f7ce9253343a98bf6797f381c5c9272c2701a4107ec3bf7890b6a93690fc65341af51841bd2a9811d58bb24fbeb167c6d96bd58a8ccda6291c8d5a10600859beac4a95abd96fc6a421d29b3475062f9ccddde185b46a99eb80bf22eea4e905b6d23a158051a11f98c7c21dac55184355be7c8aa6b0a80fa750a20d4086f8317f36eeb7d748c049d9ae9301930a3cc765fac58cf9e38ed95dd016ba862ff8eb9dc2b0fe34e4118755b2255d61323634c9e9be9f74d6fbdb98a6e8e464763737acdf79ef8f70b9c9aab4fdd2b2bc9388e4fcdc3e7e61fc22044f17bda1e62c16beb7a43b805dc90425f6d3eb6ce325b3ac1997a5638fb3009760dbc099e3ae1cb2472a59bbefb9efea0460342143bcde4265a7569fd9a4363e97483c4b7085a80f6ab37e9fc9c644557774f2324b6493e31cac0e15e5d4084852a2c9d7c843e153f9a8a9f4f142d3210a578deb4d5976b8c9b079a91ec6c0f069bf50eb3602863b746a11215fdc3cf1048f7cf6d51bf02b22fc5e6bfe89554ac059c3c0e4e4b8adce414d4120c1c8b0f5e7fe0347370a3822734ce9f30f13eb0aa31769deaeca35d0081969c261311b05c5abef28603dd334e157ce1d1c823f364d4db206d3d61e3da38d869dd194f2abbd3482280a8cae0e170d0897894fe052f91dba7f847d67761fb428fe20f5ea65a3cf5fde2a3a18bc31aff796f569f7a8c3127fcf63adb889c08c0304aec4a4e6de091e8161f7ed4cda976c83098f8cf19d498d737440ec241799959f741ccdabb5d44e978ba1e839f61828c1d593b3309e0271a61125f9fba99b515f3b62840afbb6ebc426e3660ffa66fcbc1c5fe4589351a0c41fbb6e876c03add3a77628886d3126b45d2ead4d287a9ff51f54cdb7adc60de34a501b104b4e1b96869b2ac672a972824cbb8219a3dbca1ec6fae54e5ff85e1ba0f5b672c82f2649c9b335cda5d78c700e3b8803c19dcdc45c5cc1ca38a440d82e17100d5a61a96f2cb55a0143e992ca4a29849ab85a3e3e9d78f594a8fdcb8a6989b39cb5fe45d8e162ee73548c17f746ea683cf31997a7c78ec6011029ff58b9b80cc9aa6684092e4b2c2cf62444b5f43d87772945630ee0477b8dcb327f55c91ed7572c5a18164ca4448ad45006210c694db86295fb91b1785bd55957ba6abe3a598c757675f1d60b9a971c0ae59769bd4f81a11d1b045fc2c36fcb859a99d0d92a9069a646b6abf654549cc4955d92622105de0bed5219d60d70b4a8a1bc5c6c8960bbb834564974cc42a9e00172872d6cc72e5123ffaedefddd905a61c663a0a52ac3a8dd1ce1f8053ccc3b45b78259cf66fc613ded1aba2ce52e811d8ef649bff224e2edaa015d5151472f895cc8494a0c6bc66032b47775a3c514ce8782f7f7d5d8097b00075e7edd82bc34f294a1ac26e99ff154eccc6d918ace6ac6b18cba70466cdc08e8d2949bad0f525f969cfcee116883a09b6d71696ab83b188c126b2af4bfe334a3e2e328c25d6a89d2772cee5434f191662cf73d988edf8a9e73df5d6c8b942c87abedffa4b935e4a4c6e69b2c6d1d6b5bddb45da99bca49352247101db411c9d904b99168da170c81be25f527c629504628f7e1ae1a3809ae8e9638af739b516ed771c34503402d5e34a68f78d48a19e9fca56a551b861298812916527fa06f5222d9e9847c1e98a9d9a09f91b064e96cd640988e7d0f5562f0e12b6a9a34d56343428a2645357abda386d87cb4e80cfedf04ff274512c3bce369854a776ce6cdef4df84d47971b3305119ba19228320aec9cced5e0c7e5f84b2464460fe9bb18228a1379173e68f249907c0e04312855baaccd4ffdd77076a6aa475fcad7b055e56ec5530d72854210ad237532ee80bda9879c168de7c4039603e2ecaa1dd2f444a05bc9b0861664f6a0c27704336bab5dad0e299401ffacb1808101b0663ba677faba81ee51ce86cc99605580b30211449284c3e83fe02b5915525f3fec65f48aa3cc41a43b4462ec36f8ce9b155cd9babcdb2b0f6dfe67a7c12c05eec660257493b1653ab2ffcfe802da237d8400321582a57f2f05ff71d46a0a45e86700efc13add5d13da91b78406cf2747ec5ebb70c3f722c80191e747043290b10b2171cb21aeef28c7a9f119aa87d67e770bc5cbccde42bf0e0abbe83fd5448ebf1a3a001968fa1b985a4fb7a210c573fd04653517a8a4869634b2a24bb56efbbe3275a71be3fcc95a9fc9b0b3061dbffd9c27db8933da1194f57d49f6752ce042e5df2c771a485b807c75bfbced72de0efaaf61d63b1a347747932f66e72f430d2c4e4fe95a0d7bf3988c999fa1f98550f19927e16562bd06ddd0e1e78e2038b566e4f46d54e22e7202574847799740d14292fbc84c5b113ec9b84249a37462c7ad08c7ba619450e412b54e42fd89135a223dd9d23d5d2f83f81206f8208e45475d04ebb6fb8f862b97bd97d991c07f38ad39e7b2d8f7952d79104dcca632c2a95b363d3408fa72f55fd68dc68d172adaf51e272576ca753b502b2a2ffcf786ddc92eafb5415a6147b7d46c87d195a9681be07aa8a7e609610b5b20d31cbb0a595047a7bf3dfdda0153d8398ab86a46f8ad118aa633391f9d077333360d8d7aa6cb8b65c3d67b713cc80a9ed5a81755225dd27beb4cfb003178b79a1402fd6c89172d29855f4258ad6981239b64fb507b52e6eb0d2947d4fc7a4f36e0ff7cc145b6d707ed3472d53258fe7e056cc10eb973006c9083e2c9f285986b2b3423a523d587435791fce13793c05904b0b7b7ce72faa5c5e3f5964090c445df54adff5f00aa3884542baeee0ab4ab774da14147589197607ae3bf6656f0d2fa28d1ace53d37edb3f48d22d9906557369b41482f8315e3186f1868615d07a7a9cc7bdd8af079b1e88ab18d650b383df4537a7b970feeb14524706050b99c3e66cdca0caa57ed1b5805bbb0ab189f51e00a54a76904d10baee205ff7be89aec7c1b7965687a783339856bf0b98e111dbb1c8c04766c8748441685897bf8b04a641a26c66f5c6debe4e558936a712059aae986ea60fe4c44d229d5e88d501bdce90a60b992e10a02df09f29264c62af24d0ebf6a6d6d82603bc75607dabf92f4f3325d03f4989f8776d8ef733668355548ae0222afc3376d7e71c66428dac327403403b4e40cb2e40fc36ff93edd3a53e7d8da0ef0f8288bade701328cbefcac39978666a83c5d0efc42a955c1cdaf484c8179a2ef7839002a1f15bbfc91d2bf0abafe08f5284ac054acb00c7b26ab4a9532dfc60fc8da4bef35ba45757702305e7298b1d89bfb95bcc4aaabf80e5165c0373d02b9e44f9ff44faae939cb666c0822cd0df29f320514a9550b5f526651699336446a86919db9f3fa9750d4a8411ab29359cda50c3c999e77dd414055381c09c39ee24fd70693caeeb9aeb5a2036665e3d04ab8a60b82d003e73c6599a68543415956a47ba04618198f99e7f960ffca795635e8d35646b73892dfe54e789d0a878f61d7048ac471e920ebedf25968461a8b39ccfcccbcc0ca63ddba0e6e9c4b947f17caf7b01d47985c637e042b5354aa2fc5d7f005c010cc438b8b3cf218faa64fe9b898ed92ef1cabeb6a28da7c60269d7876bb809216f04d5fbceae77fb272bc7befde00a44a42f09d3f6c8a9f43223ec6a9f16e901ae4a8502a22897e0fb3e01a6a336c10908410f2e8d14b9e91e4124fe1c1f38471728479af129cf7496afc8108824a643d11c66856fa101de560c144d4387a286b815fa29902ac94953e3a69bc56416109fec886ed7ecc05e6066df6cf6b3f1c4f7b89d23e07821dcb0d4ce51bc444ed88df8fcfc74205c20eb8b9c3dee7a525a208c31dbb05b48d7bdeffb2cd21176ccc40b48b802fb282c3d0e6ebcfc2e9702d0543921c47ad32ff208b797601dee692a957c3f986e768fcf5276011ddc6ba0fea0d229e70412a02cf078d58483bdd2618a6f31e702034660eaad879301fc67252430410cf71787e92c650bfd43a02588b191812d43b1b737756b92ed3ddc4044371cdc793545379522326ef359f55a14d61674cd65c1104766c1c67793fbec9f645de92312ddd0844d39a78f1fc029a3d7f165c6e1d57e5425014cbc8d6e724399ced03919f42fdab708a2f1027bfd2a0f6d6b4c9612f2d5706c6655213160ba5f6d6e8434ef342e8b052366f6f8eb738b555489a0fa4ead8ffec1720e8fe42942ed23628bb98f8431340656c91a9104959a7b5fc206710d5ac94bf09baa5d4a991f4d0b84bbc5652c336b2c656b45ed6a409442fbe0326cf6b341f7184aefa79e5bd5d901c2aba465bcbdbb213ded39f83e51bff601b9358f4e060ae8ef305b8e88c41870d3abbf56071ed03f491af934e31066a27b79309cc934d7c80facccc58d326817076bff28f21b0eee1255c60a6ffc1e2f6b90d9927fb26f505a021e4c8ec944eef56b7445014b5450c1ecb65d1bff76cad9e0395bd5a5609840302e78d2bf133ddcfcaa1ce4fe2dc7d212a14c6cc599e30d2753c722a7b8db032947af121093e4770d30d616109c172a39a2c98efa823d1e0e75528a22439e3e0f13bb25467e591591fd769f86e6185160008fc75cc46469109c997e778df94fd2a7febf2ba6280c5955b4f58fb006ab4a49d307f739cce21b2c44982a1f1d2963fe8b8e200c63d890063b47708646f1d8e7a39ad0f63521ae3641a2aa370e7b5e7a6ad3efac07cebea831bb211780b5b43ba3468abf419d10b92d13034d6741196f3356a78b39d16d81e7342a51c5323942480425a0dea6d6bd752a0ff87a8f10f59833560130cf9880526703362c22bb8c8e7e75cc4735565522cd944c50b8e710e69f27f78e51c20c9e67d2e800bec8e2c0fa0002c5f5147116aed13b0908164abe29e6fbdf1ba34985361501ae3517ff5d24df7554f4be74f29c8ea39703ca9effb3b10d600da35caffa194103c8e1e70420ec2853d869b7fec35c14558b94f9cf600175b99344c8a43b707a08f67ae215690bc1b81be1c9c11a4bb0e26766aab7418c2c290011a63168fe2017099dee53df18c107b1852005fdba7e152a1b1bd4c7fd5cb0c5a6df6a47f97451a07ff414e632b2b379dc18727dabbdc2ddff4d5bf0520f7a06023ded994068b8ad2f84afc798a26c6c3e6435292b439cb5d9d79e1ddd2763894b3c7a32e6303567c80834eaf34d02ea0527cf5871eb255d7d4a145297e69ff2f4ad5c409dd4966bb11cf3f706ca7208825ed6d33e9bf7ad8b8e6ff262170a30f43d6331bdc04e5fce21b9bb4716666ff535c938a5665cb054648e2768ce6bc06904753df1de6583ba28baff2a7be64047ff31545bb28134f65ab9c3342a055083859cfdf024e6682de16694f9e583e0e60bea4cf34b7d323e2af425fcf038c64cb7e0d2b762db1c093038b2c4c94b3875633153ab9d5e271c58149a5d72d799affbbf8ce3d3cf762baae3318b61c6c1613f5ee2d5f2c323477db33f8c5bbe0cce900d012db2690d27d255522a1ef1963247d517b85d921bacbb13d0d4fb7bfc7379aca5b07234759c7d726e13124911c08cde256af4ab94e132db2397fb1bc09336e3f170f1a1da9921909f12d883b0ac21c0608d0515afdae4729b82409be0896a92002504cd31efd392959240bee0ee6a677229374f5e54675410bc78e5fef0479ccd6ed288183ce2e204f3af03c1168bd20a8a42964d94a1c7e1f6b9cda94ce566043c5b714a16b754bac6fa1f19c199346e39fa2cfdb3eb0a4d8fd800262a6c42004da18195319c4ed49b51e5f73a3e546e764f66a5bb09e4e9bf24d7ee94255e4a94af66400e207800c3b14a4050adbe1ca0395e6470fb0ae5a644f50a89057acf5cdee93e055de7bf0145779fd690ab59b21019cfb7df14e17f531e023d64afd438d0672f09009b2b92dbad001d78766623c69c4f90704470cbc4d8eff12ad4d899bb952b88f6190ed54b75f7d806b38fae32cfa028f411e3ae8cdf86ed9abb00c845b245348aac0a3eeeacda45be93be43c1b9a7098df170bdf5ca091d689d4da35f9f18678952485dbe63eb26bfa00db9942f0662513479ea93a2f76e73cc70de20ad48698898cdab69c14f0823b9a49f3409fcd986a9b6d2d02b145625cbf22e8759fb1e6da65263f648f65cf4a4e866aa52d5f9c0c3b7a206124efcb07c464ddcd320cd75090e65a5641eedc679b9fd16e35d9ac8e4ad2ac801cdc6edaaaf4087a18b45d69003ca2a25db1673516e1bd9102768fa82e3af3a0bc457b66363bb8d2c2200ef91d8aaca8c94666eb75a7297f783871e9af99d69745cfcdc045a39f33cc8fa74a1d0d19285392e500caaca5cdfdda93c36a66a94574388e607e1411740f7737d473c02a02312cdc3b1735e5a615e00485a8006b9eb1f54f1634430783755257cfc058306078a96fc8e07424ef4814b43adea43797ff62209b111ff5a6fc927f3f146526e444e182fd35a75f4d0882ddc241b0e47494ab99b23dea86d65f8d06c1c3cf790b1197fbe98f52a7ee6ae63737d63ca49f5383df8c113baeec28fb7dbc4b766a5c728dacebb0688e42968c1955600c8324fb10453cab6156e61fa14ee82aba74ae1c367fb5be3a96d8555764f2320dccb504f4858739f109c6f42c4b7ce1d3594324603ac25d9b22233e72ce4d850fc82b820bac4b94c0ad9d706a4001e5daae8aac50abaf9a5939757acc304594814c69c0e3ea91f6989b49be53a90fb37ebe1332ed4333fbaf15be7f7d6875ec69021a360767d98ea44c5896a5e9b74ed5bb4ba0897ca58870acdc8c7c669ecc8c95bf5f8b56ad427c2d77a7c7864518335b87157fcd5995f43cffa97bd39d6a0d331f532e8d42f9ba0273a0512d9e7630aba218e094d5967a062156f85c2dcd931c299ce821c0b3b55c9964d37b5bbdb212d341bf8de067aa8eaf424e0ec54af4b089c369ba73e9a26362c93f05a630269898257d4bef86aea1e6b3a80bda5547cd25f38e832ed8a6b0268a3c21da1871624c1ac44ed41d94962716802886e712447e32ef77ff273b58542005c35f23ef660a0a5e7337db762ed3671ce89ae4926acb671b2b569392d35239d835308247239a2b38290173a4299dc03e0bd74ab71f7a58ae43797fb471e7ee7e6675f09901cb509cf2ed80b813b481189f9941256d010b6e59c25927a4796c23c683abe5a4e942448c2159f84a2b423b8ae0abb178dfcf93e04b7db7784c66e140575d840f644c3f69a488df601863b4d6d5aed1cf5d976806c918adfd7b73aec82c75fdf384d2fcb10234e8a494be290e49fff54a0245725a9ef05d417b31c18d233a71e9057b5656f01b38ff7bf5a6f1575714ab3d43cf2f89ca1d850163ca69dfa9de52eecdef68127170851b0cb173f806cd10b5dffa50500fbc80bf12843c740d516ec70befcb3857b57dfed0495b336ba714511a5f9b1ea9326c4e84a6051345594076f1d6c0e9813a7b28a99eca773e5efc389ea0cf53027d7b2dca0bbaedaa940a33da8370a11491d7b06aacbbfb75b8c493d70ce887be2e45941ed12a8573ffa01961b70df42b92ad1f459c795b04e84f65dd3cd682b9e531f88efb4b4e5f59d4abbd12d7ebfa9365e7b9df573cb05fae357bb408e848c53806ce4d6c15bb6a1d6fe7140d9f39c58a89f7ea4d84a91bbd431029a9f37e62604c6c346e268d5b7c5f8212cbe0933d5cfae7155ee7206d913c24089950ba1dbc9fcd23356787f2b6b41dd894c5f3c03edc09cfe83762b5f7efd6efa02bc7de19f9ee881d21aa29a062655deab80a8e6bd30d21598768bdeb3220c653b4dacb28473de5ef8b69f44f39ce663f11bd4b191fe690805a6b128f340584f5a9804150f564cb78e2e", 0x2000, &(0x7f0000022780)={&(0x7f000001b340)={0x50, 0x0, 0x5a1b, {0x7, 0x2d, 0xf, 0x80, 0x5, 0x5, 0x0, 0x400, 0x0, 0x0, 0x1, 0x401}}, &(0x7f000001b3c0)={0x18, 0x0, 0x6, {0x5}}, &(0x7f000001b400)={0x18, 0x0, 0xe, {0xacbc}}, &(0x7f000001b440)={0x18, 0x0, 0x8, {0x95b9fc3d}}, &(0x7f000001b480)={0x18, 0x0, 0x6, {0x200}}, &(0x7f000001b500)={0x28, 0x0, 0xffffffffffffffff, {{0x60e, 0x0, 0x1}}}, &(0x7f000001b540)={0x60, 0xffffffffffffffda, 0xffffffff00000000, {{0x1ff, 0x2, 0x2, 0x5, 0xe, 0x6, 0x1, 0x8}}}, &(0x7f000001b5c0)={0x18, 0x0, 0x7, {0x3}}, &(0x7f000001b700)=ANY=[@ANYBLOB="1f000000feffff2f6465762f6370752f232f6d73720062a163cc162b867727ed090f83d121c0390e6b50c1c597b9b65702e04056be5d3fae3ff562a0c72df1677ee804d4a6640a9382fda25b7aee3fa35255a35d7e3a7491953ac9bfbc988810a686b572131ffd3bd1"], &(0x7f000001b640)={0x20, 0xfffffffffffffff5, 0x99, {0x0, 0x5}}, &(0x7f000001b680)={0x78, 0x0, 0x0, {0x4000000, 0x9, 0x0, {0x6, 0x3, 0xff, 0x7df, 0xd, 0x5, 0x6, 0x3, 0x28, 0x4000, 0x4, 0x0, 0x0, 0x4d2273c3, 0xffffffb7}}}, &(0x7f000001b7c0)={0x90, 0xfffffffffffffffe, 0x16e, {0x0, 0x2, 0xc, 0x7, 0x8000, 0x0, {0x4, 0x6, 0xfffffffffffffffd, 0x7fff, 0x4, 0x1, 0x4000008, 0x8, 0xc, 0x2000, 0x800, 0x0, 0x0, 0x7f, 0x31b}}}, &(0x7f000001b8c0)=ANY=[@ANYBLOB="400000000000000008000000000000000600000000000000060000000000000013000000020000002f6465762f736e642f636f6e74726f6c4323000000000000f187e1d71bce7725faa928bd991aa7aa75826e31f1951333c23ac94669f288fa60ae171328feac7c7de1c862883aa7de21049899764c1e5c7430af87f74ac2971c2eec4ab133aa80f84aa403b2c985b8f1a3feee24ed3ceb8993e2b5b22a61076ebe83b006f04333c292148af33fe85ce0033d2f9e1b8edd541094dce1af1c0c3679e70f597b804221ebe760"], &(0x7f000001b9c0)=ANY=[@ANYBLOB="10050000feffffff010000000100000004000000000000000000000000000000d00f00000000000002000000000000000300000004000000030000000000000000000000000000000400000000000000ff03000000000000410e00000000000004000000000000001000000006000000ff0000000040000000004074051860699a6f5420a8597154f5a88bece090ca5ef11e5f0c86cc23a3582cf86da91030808b04360d52a7a1398c7a68ef3da3d23be699378c82c41850371a0b5974757c4388a43ec4e6989824061beb1888371b9c", @ANYRES32=0x0, @ANYRES32=r3, @ANYBLOB="0600000000800000000000000600000000000000070000000000000001000000fffeffff2400000000000000010000000000000003000000000000000700000000000000030000000000000004000000010000800500000000000000070000000000000000000000000000000100000000000000080000000000000000ffffffffffffff080000006e020000060000000060000003000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="03000000090000000000000002000000000000000a000000000000000500000007000000252d2d2efc00000000000000000000000000000000000000040000000000000001000000000000000400000000000000010000000000000006000000000000000600000000000000fa0300000000000006000000000000000d00000000000000020000004f6bffff0101000000c0000007000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffff7f81000000000000000400000000000000040000000000000002000000070000002d25000000000000060000000000000001000000000000000600000000000000040000000000000056000000520900000500000000000000070000000000000004000000000000000500000000000000c0ffffffffffffff800000000000000005000000030000003f0c00000080000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000080e50d0000000000000000000000000000ffffffffffffffff06000000feffffffffffffffffff0000000000000000000002000000000000000400000000000000ffffffffffffffff05000000050000000200000000000000ffffffffffffffff02000000000000009ffb0000000000009407000000000000010000000000000007000000070000000000000000c0000006000000", @ANYRES32=0xee00, @ANYRES32=0x0, @ANYBLOB="09000000020000000000000003000000000000000f000000000000000000000009000000010000000000000002000000000000000400000000000000030000000000000000000000070000000500000000000000080000000000000006000000000000000008000000000000ffffff7f0000000002000000000000000e000000ae0c00000100000000a0000006000000", @ANYRES32=0xee01, @ANYRES32=0x0, @ANYBLOB="2a0000000180ffff00000000060000000000000007000000000000000000000006000000060000000000000002000000000000000700000000000000090000000000000003000000030000000000000000000000008000000000000007000000000000000500000000000000080000000000000007000000000000000100000001000000ffffff7f0040000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="08000000020000000000000002000000000000000104000000000000080000000600000073797a5f74756e0001000000000000000000000000000000c3b00000000000000500000000000000060000001401000001000000000000000100008000000000ff0f00000000000000000000000000000900000000000000020000000000000003000000350f00000700000000400000ff030000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0900000000fcffff000000000200000000000000050000000000000013000000038000002f6465762f736e642f636f6e74726f6c4323000000000000"], &(0x7f0000022400)={0xa0, 0x0, 0x28f, {{0x4, 0x1, 0x9, 0x3, 0x6, 0xffffffff, {0x2, 0x6, 0x3, 0xdf8, 0x3bf, 0x7, 0xff, 0x0, 0x6, 0x1000, 0x40, 0x0, 0x0, 0x5, 0x5}}, {0x0, 0x10}}}, &(0x7f00000224c0)={0x20, 0x0, 0xf, {0x8, 0x0, 0x5, 0x3}}, &(0x7f0000022640)={0x130, 0x0, 0x1, {0x5, 0x3, 0x0, '\x00', {0x8000, 0x7ffe, 0x7f, 0x2, 0x0, r4, 0x2000, '\x00', 0x5, 0x2, 0xfffffffffffffffd, 0x8, {0x4, 0x7}, {0x0, 0xffffc97b}, {0x100, 0x3}, {0x6, 0x6}, 0x5, 0xa, 0x10001, 0x9}}}}) r5 = socket(0x1e, 0x4, 0x7ffc) setsockopt$packet_tx_ring(r5, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x2, 0x180000, 0x1}, 0x1c) recvmsg$unix(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/247, 0xf7}], 0x1}, 0x20) sendmmsg(r5, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0xcf77) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) recvmsg$unix(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/254, 0xfe}], 0x1}, 0x20) sched_setscheduler(0x0, 0x2, 0x0) r6 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f0000000000)={0xfffffffb}, 0x10) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1f006d008000970211bd01e5350f6e725bf00000", @ANYRES32=0x0, @ANYBLOB="1001000000000000"], 0x20}}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r7 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r7, &(0x7f0000000300)=""/102400, 0x19000) sendmsg$sock(r1, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$SNAPSHOT_FREE(0xffffffffffffffff, 0x3305) sendmsg$NFC_CMD_DEV_UP(r8, 0x0, 0x840) ioctl$sock_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={0x0, @rc={0x1f, @none, 0xfb}, @ax25={0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x8}, @l2tp={0x2, 0x0, @multicast1, 0x1}, 0x9, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000280)='syz_tun\x00', 0xb, 0x9, 0x2}) syz_open_dev$sndctrl(&(0x7f0000000e00), 0x0, 0x0) syz_open_dev$evdev(0x0, 0x2a, 0x1002) 6.13989231s ago: executing program 1 (id=6459): r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) r2 = socket(0xa, 0x5, 0x0) sendto$inet6(r2, &(0x7f0000000040), 0x0, 0x44004, &(0x7f0000000100)={0xa, 0x4e24, 0xb, @loopback, 0xc5f}, 0x1c) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r3, &(0x7f0000000300)=""/102400, 0x19000) ioctl$VIDIOC_G_FMT(0xffffffffffffffff, 0xc0d05604, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) setsockopt$RDS_CANCEL_SENT_TO(0xffffffffffffffff, 0x114, 0x1, &(0x7f0000000100)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, 0x0, &(0x7f0000000080)) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f00000000c0)={0x1d, r4}, 0x10) sendmsg$can_bcm(r0, 0x0, 0x4008004) close(r0) r5 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0) syz_usb_control_io$hid(r5, &(0x7f0000000c40)={0x24, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x180c}}, 0x0, 0x0}, 0x0) syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r6, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec778000) r7 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x84, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r7, 0x40045542, &(0x7f0000000b00)) syz_open_dev$dmmidi(&(0x7f0000000080), 0x200, 0x40002) 5.91142567s ago: executing program 0 (id=6460): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) bind$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioprio_set$pid(0x2, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x3f00) r4 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') r5 = openat$binfmt(0xffffffffffffff9c, r4, 0x42, 0x1ff) write$binfmt_script(r5, 0x0, 0x0) close(r5) execveat$binfmt(0xffffffffffffff9c, r4, 0x0, 0x0, 0x0) keyctl$update(0x2, 0x0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x800) r6 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0xa0602, 0x0) writev(r6, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r8 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r7, @ANYBLOB="00000000100000001c001a80080002802d07420008000200", @ANYBLOB="35874207"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) mount(&(0x7f0000000100)=@nullb, &(0x7f0000000040)='.\x00', &(0x7f0000000180)='securityfs\x00', 0x5, 0x0) 5.133556283s ago: executing program 6 (id=6461): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008200122010009058103"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) pipe2$watch_queue(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x1048001, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x2, &(0x7f0000000400)) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x2, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) ppoll(&(0x7f0000000100)=[{r3, 0x8004}, {r2, 0x8}, {r3, 0x5308c49eca93dd2e}], 0x3, &(0x7f0000000140), &(0x7f0000000340)={[0x5]}, 0x8) r5 = open(&(0x7f0000000280)='.\x00', 0x0, 0x20) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r5, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) fchownat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0xffffffffffffffff, 0x0, 0x1000) chdir(&(0x7f0000000080)='./file1\x00') r6 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x40, 0x0) r7 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r8 = open(&(0x7f0000000000)='.\x00', 0x0, 0x244) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r7, 0xc0189379, &(0x7f0000000200)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r6, 0xc0189378, &(0x7f0000000280)={{0x1, 0x1, 0x18, r9, {0x8}}, './file0\x00'}) syz_usb_control_io(r0, 0x0, &(0x7f0000000180)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB=' '], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000040)={0x2c, &(0x7f00000003c0)=ANY=[@ANYBLOB="409451e400041800000c8ac351df56c1b256442db19e0800b3750000000095468f4678"], 0x0, 0x0, 0x0, 0x0}) 4.899151067s ago: executing program 2 (id=6462): socket(0x15, 0x5, 0x0) socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x7, 0x100}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r0, &(0x7f0000019540)=""/102400, 0x19000) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x2c240, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000280), 0x4, 0x1c3200) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f0000000440)={r1, 0x0, {0x0, 0x0, 0x0, 0xe08, 0xfff, 0x0, 0x0, 0x7, 0x1c, "339f020bbe78b39843d601010000000000080d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c18e8438ef2a565ef1e83323695c58d66500", "a1163939c787a16c1ca43f8539f3d3289737f0374c72a964a0193b3e8772fd29f35239d200", "24431a1e77a68e174f000000000000000010e200000000000000000000000200"}}) r3 = socket(0x10, 0x80002, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000019480)={0x6, 0x4, &(0x7f0000019440)=ANY=[], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000d00)={r4, 0x0, 0xb, 0x0, &(0x7f0000000100)="178d048604bf0bfb1945d7", 0x0, 0x505, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x50) r5 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='blkio.bfq.group_wait_time\x00', 0x0, 0x0) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c0000005e00679a3601ffc4910700004f78d4c1a0731cccff"], 0x1c}}, 0x0) recvmmsg$unix(r3, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000001340)=[{&(0x7f0000001380)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x1000000}}], 0x14, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=ANY=[@ANYBLOB="300000001800090000000000000000001c140000fe000001000000000a00120002"], 0x30}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000019300)={0x12, 0xd, &(0x7f00000193c0)=ANY=[@ANYBLOB="db24c57bbbd389cfadcad7a64c1e7080917547b16e16e26a91915f3b7a0a41305a016f2178befe950b77f26c3678703c49d49ab37b0d76e6f2e0af5f48ae4f2a80ee2e400e642ac40b47f1bc82e892e67f241a2b22692dc626d305952b85afa826e3da54eff943bcc6", @ANYRES16=r4], &(0x7f0000000800)='syzkaller\x00', 0x3ff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock_addr=0x35, r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r5, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = dup3(0xffffffffffffffff, r7, 0x0) getsockname$packet(r8, 0x0, &(0x7f00000011c0)) r9 = socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) setsockopt$IPT_SO_SET_REPLACE(r9, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x260, 0x128, 0x43, 0xa0, 0x128, 0x98, 0x1c8, 0x178, 0x178, 0x1c8, 0x178, 0x49, 0x0, {[{{@ip={@loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, 0xffffff00, 0xffffffff, 'veth0_vlan\x00', 'bond0\x00', {0xff}, {}, 0x0, 0x2}, 0x12a, 0xc8, 0x128, 0x0, {0x0, 0x7a010000}, [@inet=@rpfilter={{0x28}, {0x1}}, @common=@addrtype={{0x30}, {0x1}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0xe7b34dc4353f5976, 0x4, 0x6, 0x1, 0x6], 0x6, 0x4}, {0xffffffffffffffff, [0x2, 0x7, 0x7, 0x0, 0x4, 0x1], 0x3, 0x1}}}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0xffffffffffffffff, 0x6}, {0x4, 0x1, 0x4}, 0x8, 0x1cc32a6}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x2c0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) 4.224939381s ago: executing program 5 (id=6463): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000fddbdf250200000008000300", @ANYRES32=r4, @ANYBLOB="080026007f17000008009f0008"], 0x2c}, 0x1, 0x0, 0x0, 0x4011}, 0x20004810) 4.086080595s ago: executing program 0 (id=6464): r0 = add_key$user(&(0x7f0000000000), &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000240)="bc", 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), 0x0, 0x0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r1, r0, r0}, 0x0, 0x0, 0x0) 4.080886992s ago: executing program 1 (id=6465): r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x2, 0x0, @remote}, 0xff0f, &(0x7f0000000440)=[{&(0x7f0000000880)=""/4092, 0xffc}], 0x1, 0x0, 0x0, 0x20000800}, 0x0) 3.972462823s ago: executing program 1 (id=6466): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010007000000000000010000000a20000000000a03000000000000000000010000000900010073797a300000000048000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0c00098008000140000100075c0000000e0a01020000080000000000010000000900020073797a32000000000900010073797a30"], 0xec}, 0x1, 0x0, 0x0, 0x4004}, 0x40) openat$userio(0xffffff9c, 0x0, 0x84180, 0x0) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000180)={0x0, 0x205f, 0x1, 0x0, 0x851}, &(0x7f0000000300)=0x0, &(0x7f0000000200)=0x0, &(0x7f00000000c0)=0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="200000002700090026bd7000fddbdf25080000000b0001006175746f"], 0x20}, 0x1, 0x0, 0x0, 0x4000002}, 0x4000080) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r7 = syz_open_dev$sndctrl(&(0x7f0000000440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r7, 0x40045532, &(0x7f0000000040)) r8 = syz_open_dev$sndpcmp(0x0, 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_XRUN(r8, 0x4148, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r9 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x38, 0x1403, 0xc23, 0x70bd2b, 0x25dfdbff, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'syz_tun\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x14f7325d9d03b00}, 0x4000) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x40, 0x0, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x7c65, 0x95f7, 0x1, 0x0, 0x0) r10 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x200002, 0x0) fchdir(r10) mkdirat(0xffffffffffffff9c, 0x0, 0x0) rename(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000200)='./file0\x00') 3.922168168s ago: executing program 0 (id=6467): r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000005500)={0x2020}, 0x2020) sendmsg$AUDIT_DEL_RULE(r0, &(0x7f0000000900)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000440)={0x44c, 0x3f4, 0x20, 0x70bd29, 0x25dfdbff, {0x1, 0x0, 0x18, [0x70dd, 0x80000000, 0x7, 0x2, 0x9, 0x8, 0xcc9, 0x7fff, 0x7, 0xce7, 0x1, 0x4, 0x7fff, 0x101, 0x8000, 0x36, 0x1, 0x3ff, 0x6, 0xf0b, 0x5, 0x3, 0x7, 0x6, 0x6, 0x24, 0x8, 0x0, 0x9, 0xa, 0xfffffffa, 0xf58, 0x10, 0x4, 0xfffffff9, 0x3, 0x7b, 0x8, 0x3, 0x9b0, 0x7ff, 0x97c7, 0x81, 0x6, 0x7f, 0x1, 0x7, 0x6, 0x7, 0xd, 0x40, 0x2, 0x9, 0x101, 0x96a3, 0x6, 0x2, 0x9, 0x8, 0x9, 0x3, 0x2, 0x80000000, 0xcf9c], [0x3ff, 0x2, 0x10, 0xfffffffc, 0x82da, 0x6, 0x2, 0x3, 0xb, 0x8, 0x490, 0xfffff789, 0x6, 0x0, 0x6, 0x7, 0xf, 0x8, 0x9, 0x80, 0x9, 0xfffffb04, 0x8, 0x5, 0x8, 0x9, 0x8, 0xef8b, 0x1, 0xcb8, 0xf4, 0x80000000, 0x4, 0x551, 0x1, 0x4, 0x8, 0x8, 0xf5c, 0x2, 0x8, 0xff, 0x1, 0x1, 0x2, 0xfffffffc, 0x5, 0x4, 0x80, 0x37cc, 0x8, 0x4, 0xfee, 0x2, 0x6, 0x3b, 0xc5ad, 0x3, 0x9, 0x9, 0x504, 0x7, 0x800, 0x40], [0x7ff, 0x4, 0x1, 0xc000000, 0x800, 0x8001, 0x100, 0x5, 0x8, 0x2, 0x1, 0x8, 0x80000000, 0x4, 0x2, 0x1, 0x579, 0x9, 0x559, 0xffffffff, 0x800, 0xfffffd3d, 0xe9, 0x508d7f57, 0x1, 0x1, 0x7f, 0x9, 0x7, 0xe9, 0x10, 0x7, 0x0, 0x7fff, 0xf48, 0x2, 0x2, 0x813a, 0x4, 0x4, 0x1, 0x0, 0x100, 0x6, 0xe3, 0x4, 0x401, 0x8, 0xc0a4, 0x1, 0x8, 0x8000, 0xc0, 0x3, 0x6, 0x3, 0x3, 0x38000, 0x4, 0x4, 0xfffffffd, 0x81, 0x80000000, 0x4], [0x9, 0x1, 0xfffffff8, 0x1, 0x7, 0x7, 0x7, 0x3, 0xfffffff7, 0x1, 0x7fff, 0x2, 0x8, 0xf9358e7, 0x400, 0xe, 0xffffff7f, 0xffff, 0x7, 0x5, 0xd, 0x9, 0x8, 0xde78, 0x1a8, 0x3, 0x4, 0x2, 0x80000001, 0x9, 0x8b2e, 0x4, 0x400, 0x1, 0xb9b1, 0xe84, 0x2, 0xa447, 0x80, 0x8, 0x8, 0x4, 0xfffffffb, 0x6, 0x4, 0x9, 0x2, 0x7fff, 0x0, 0x8, 0x2, 0x4b1, 0xffffff80, 0x2, 0x7, 0x800, 0x101, 0x8000, 0x6, 0xf, 0x86e5, 0x68caa4b0, 0x5, 0x3], 0x2a, ['/dev/vbi#\x00', '\x00', '\x00', '/dev/vbi#\x00', '@\x00', '\x00', '/dev/vbi#\x00', '\x00', '(^-$\x00', '\x00']}, ["", "", "", "", "", "", "", ""]}, 0x44c}, 0x1, 0x0, 0x0, 0x4000000}, 0x800) r1 = syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000000)=0x1) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x8936, 0x0) r2 = socket(0x2, 0x805, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e20, @rand_addr=0x64010102}]}, &(0x7f00000007c0)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r2, 0x84, 0x6c, &(0x7f0000000800)={r3}, &(0x7f0000000180)=0x8) r4 = creat(&(0x7f00000002c0)='./file0\x00', 0x104) write$P9_RVERSION(r4, &(0x7f0000000c40)=ANY=[], 0x13) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000040)=0xffffffffffffffff) ioctl$vim2m_VIDIOC_DQBUF(r4, 0xc0585611, &(0x7f00000000c0)=@mmap={0x8, 0x3, 0x4, 0x4000, 0x0, {}, {0x1, 0x8, 0x8, 0x26, 0xc7, 0x9, "d99570d2"}, 0x8, 0x1, {}, 0x2, 0x0, r5}) ioctl$VIDIOC_S_DV_TIMINGS(r1, 0xc0845657, &(0x7f0000000380)={0x0, @bt={0x2d0, 0x191, 0x1, 0x0, 0xdd9f83, 0x1, 0x2f, 0xf3, 0x22, 0x8, 0x722, 0x6, 0x7, 0x7f, 0x27, 0x20, {0x10000001, 0x6fd8e84b}, 0x3, 0xed}}) 3.860709548s ago: executing program 5 (id=6468): r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) ioctl$EVIOCSMASK(r0, 0x40104593, 0x0) r1 = dup(r0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000140)={@multicast2, @empty, 0x0}, &(0x7f0000000180)=0xc) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f00000001c0)={@ipv4={""/10, ""/2, @private}, 0x0}, &(0x7f0000000200)=0x14) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000c00)=@newtfilter={0x34, 0x2c, 0xf3f, 0x70bd24, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xfff3, 0xffe0}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x8848}, 0x24000804) ioctl$KVM_X86_SET_MCE(r1, 0x4040ae9e, &(0x7f0000000e80)={0x5800000000000000, 0x50000, 0x7, 0x1, 0x10}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'ip6tnl0\x00', 0x0, 0x2f, 0x2, 0x3, 0xfffffb55, 0x50, @rand_addr=' \x01\x00', @private1={0xfc, 0x1, '\x00', 0x1}, 0x7800, 0x20, 0x8, 0x7ff}}) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r1, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000380)={0x104, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x48, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @loopback}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010101}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x1c}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r3}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x18}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x30, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r6}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x24, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x81}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @private=0xa010100}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x36}}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r7}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x1000}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_ADDR={0x4}]}, 0x104}, 0x1, 0x0, 0x0, 0x4000}, 0x200440d4) sendmsg$TIPC_NL_MON_PEER_GET(r5, &(0x7f0000000600)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x20, 0x0, 0x2, 0x70bd26, 0x25dfdbfd, {}, [@TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x810) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000080)=[{0x9, 0x22, 0x0, 0x7ff}]}) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x43, &(0x7f0000000e40), 0x10) r9 = syz_usb_connect(0x0, 0x1b, &(0x7f0000000080)={{0x12, 0x1, 0x250, 0xbc, 0xc7, 0x60, 0x20, 0x12d1, 0x1413, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9, 0x0, 0x1, 0x2, 0x0, 0x21}}]}}, &(0x7f0000000340)={0x0, 0x0, 0x19, &(0x7f0000000000)=ANY=[@ANYBLOB="050f19"]}) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r10, &(0x7f0000004240)={0x0, 0x0, &(0x7f0000004200)={&(0x7f00000041c0)={0x1c, 0x4, 0x8, 0x301, 0x0, 0x0, {0x7, 0x0, 0xa}, [@CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x6558}]}, 0x1c}, 0x1, 0x0, 0x0, 0x14008000}, 0x24004800) syz_usb_control_io(r9, &(0x7f0000000880)={0x2c, &(0x7f0000000680)={0x40, 0x31, 0xdf, {0xdf, 0xe, "2a5ba0ec1e5460d3e33a43566d2a51f485b0e775ab50d90c1c9d26cb10f32361655d48613701abe36dd1b0af0e00b45b4848e57abe0c2167bdf8de7b953a3410396f160deb88319f581e30f191f80e64a8e13f698219ddaf86ba729aff47a82628db06bff02fc39796f2a59ca788635343807ba9fd238b421d53c2a86bafda927db06901a925151ef4ef9b2b71da64f6685741145c6b95a63d21a4924ee880477f52ba925b89b5d395403ecec570ccd2b081a0c8218b77ecf55cbeae3eeb59072d4aa591a55545433399c89982140b660bd01c3abe59244ab3774faf48"}}, &(0x7f0000000780)={0x0, 0x3, 0x2c, @string={0x2c, 0x3, "820f0d41de7ed5e2d699914ec24d7a105478d0d45adf077224277abe8d0d6fbdd3bcfff875559073c4a8"}}, &(0x7f00000007c0)={0x0, 0xf, 0x1a, {0x5, 0xf, 0x1a, 0x2, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x9, 0x2, 0x5}, @wireless={0xb, 0x10, 0x1, 0xc, 0x0, 0x3, 0xf, 0x542}]}}, &(0x7f0000000800)={0x20, 0x29, 0xf, {0xf, 0x29, 0xfa, 0x10, 0x12, 0x58, "66fb6d89", "22875576"}}, &(0x7f0000000840)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x93, 0x2, 0x0, 0xb, 0x7, 0x5, 0x80}}}, &(0x7f0000000d80)={0x84, &(0x7f00000008c0)={0x40, 0xa, 0x9e, "5777a2993856439745a991b7202b2c91f988f9f8f021877219c08f8f1edb8dafe2be614c79ba2a7e4a3e3ad604058e3b1c8ebd72f23303edc83e186d44476e2088bf3c38b51593a42fbf68b7db6b1dff6dcfc2cf38a890764671e54ed123c4885017cce174cb95a0c3175adb76446ccf91d4b39094b620280a9565faf56bc54901b87d5c7e073383153e3d8813ac1fcf6b024d21264e599faec936c3a452"}, &(0x7f0000000980)={0x0, 0xa, 0x1, 0x19}, &(0x7f00000009c0)={0x0, 0x8, 0x1, 0xa7}, &(0x7f0000000a00)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000a40)={0x20, 0x0, 0x4, {0x400, 0x20}}, &(0x7f0000000a80)={0x40, 0x7, 0x2, 0x1ff}, &(0x7f0000000ac0)={0x40, 0x9, 0x1, 0x6}, &(0x7f0000000b00)={0x40, 0xb, 0x2, "27df"}, &(0x7f0000000b40)={0x40, 0xf, 0x2, 0xb}, &(0x7f0000000b80)={0x40, 0x13, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, &(0x7f0000000bc0)={0x40, 0x17, 0x6, @local}, &(0x7f0000000c40)={0x40, 0x19, 0x2, '\'M'}, &(0x7f0000000c80)={0x40, 0x1a, 0x2}, &(0x7f0000000cc0)={0x40, 0x1c, 0x1}, &(0x7f0000000d00)={0x40, 0x1e, 0x1, 0xf9}, &(0x7f0000000d40)={0x40, 0x21, 0x1, 0xf2}}) r11 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') pread64(r11, &(0x7f0000001240)=""/102400, 0x19000, 0xffffffff8) ioctl$TIOCEXCL(r11, 0x540c) close_range(r8, 0xffffffffffffffff, 0x0) 3.273709407s ago: executing program 0 (id=6469): r0 = syz_open_procfs(0x0, &(0x7f0000000380)='clear_refs\x00') writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000000)='4', 0x1}], 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f00000007c0)=[@in={0x2, 0x4e20, @multicast2}], 0x10) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000040)={0x42}, 0x10) setsockopt$TIPC_GROUP_LEAVE(r1, 0x10f, 0x88) connect$tipc(r1, &(0x7f00000000c0)=@name, 0x10) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r6, 0x0, 0x2a, &(0x7f0000000600)={0x2, {{0x2, 0x4e23, @multicast2}}}, 0x88) close(r6) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) 3.226724235s ago: executing program 1 (id=6470): bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(0xffffffffffffffff, 0x3) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={0xffffffffffffffff, r1, 0x25, 0x0, @val=@perf_event={0x2}}, 0x18) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x4040084) openat$nullb(0xffffffffffffff9c, 0x0, 0x1c3902, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0xa2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) r3 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_int(r3, 0x29, 0x0, &(0x7f0000000000)=0x84, 0x4) r4 = socket(0x10, 0x3, 0x0) write(r4, &(0x7f0000000000)="240000001a005f0214f9f407000901000000000000000005000000000800040001000000", 0x24) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20004015) write$uinput_user_dev(r0, &(0x7f0000000a00)={'syz1\x00', {0x6ec9, 0x7, 0x5, 0x5}, 0x3e, [0x9, 0x5, 0x8, 0x2, 0x5334, 0x400, 0x80000000, 0x8ef7, 0x8, 0x0, 0x6, 0xf5, 0x5, 0x39, 0x747d5a13, 0x8, 0xfffffb9a, 0xfffffffc, 0x4, 0xfffffffb, 0x4, 0x3, 0x4, 0xf252, 0x4, 0x800, 0x300000, 0x7, 0xe, 0x5, 0x0, 0x0, 0x1ff, 0x8000, 0x3ff, 0x3, 0xd, 0x3, 0xba55, 0x1000, 0x2, 0x200, 0x2, 0x400008, 0x8, 0x4, 0x2, 0x0, 0x8, 0x1009, 0x1, 0x199f, 0x8, 0x2, 0x9, 0x1, 0x4, 0x6, 0x1000, 0x5, 0x40, 0x9, 0x7, 0x5], [0x6, 0x1e, 0x3, 0x8000, 0xfffffffe, 0x3, 0x2000000, 0x5, 0x27, 0xfffffffc, 0x4, 0x7fff, 0x72c, 0x1c32, 0x3, 0x9, 0x10000, 0x400, 0x8001, 0x3, 0x1, 0x297, 0x5, 0x0, 0x981, 0x4, 0x100, 0x3ff, 0x0, 0xfffffffe, 0x0, 0x1000001, 0x10, 0xfffffff9, 0x0, 0x5, 0x1, 0xffffffff, 0x6, 0x5, 0x800, 0xffff, 0x6, 0x96, 0xfffffffd, 0x101, 0x0, 0x2, 0xffffffff, 0xc, 0x3, 0x379, 0x9, 0xe, 0x5, 0xb, 0x6, 0x2, 0x1, 0x1, 0x8, 0x800, 0x200, 0x3], [0x401, 0xc584, 0x34711b8a, 0xcd4, 0xffff, 0x20, 0x7, 0x4, 0x8, 0x10, 0x7, 0x9, 0xe8b, 0x5, 0x80000001, 0x8, 0x3, 0x1000, 0x2, 0xe, 0x1, 0xfffffff9, 0xe55, 0x10, 0x80000001, 0x4, 0x4, 0x7, 0x9, 0x2, 0x20000005, 0x80, 0x9, 0xb, 0x47, 0x2, 0x3, 0x4, 0x7, 0x6d7e, 0x3, 0x8, 0x8001, 0xbf23, 0x6, 0x8, 0x95a, 0xffffffff, 0x4, 0x3, 0x6, 0x100fffd, 0x2005, 0x7, 0x4, 0xea, 0x9, 0x5, 0x2, 0xd9, 0x0, 0x7ff, 0x401, 0x5], [0x108e, 0x7fff, 0x3, 0x3, 0x88, 0x2, 0x6, 0x4, 0x40, 0x2, 0x763, 0xb, 0x402, 0x800, 0x2, 0x1000, 0x7f, 0x5, 0x3fa6, 0x4, 0x8e8, 0x5, 0x9, 0x4, 0xe47, 0x4, 0x0, 0x4, 0x200, 0x1000, 0x3b, 0x2, 0x5, 0x800, 0xa80a, 0x65f413f9, 0x4, 0x8, 0x8a8, 0x2, 0x40, 0x7, 0x2, 0x4, 0x4, 0x10, 0x0, 0x0, 0x401, 0x1, 0xfffffff8, 0x401, 0x1, 0x200, 0x7, 0x4edf, 0xfffffffd, 0x7, 0xe, 0x2, 0xe, 0xf, 0x133, 0x6]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) write$input_event(r0, &(0x7f0000000000)={{0x77359400}, 0x15}, 0xfe4f) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000300), 0x121002, 0x0) socket$nl_route(0x10, 0x3, 0x0) 2.219571944s ago: executing program 0 (id=6471): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000680)={{r3}, &(0x7f00000007c0), &(0x7f0000000640)=r2}, 0x20) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000002c0)={{r3}, &(0x7f0000000240), &(0x7f0000000280)='%pS \x00'}, 0x20) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) io_uring_setup(0x1028, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000000)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@xino_auto}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) chdir(&(0x7f0000000640)='./file0\x00') r4 = openat$dir(0xffffffffffffff9c, 0x0, 0x4000, 0x0) r5 = syz_open_dev$media(&(0x7f0000000040), 0x7fdffffe, 0x0) r6 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000d80)={0x0, &(0x7f0000000800)=[@nested_amd_vmload={0x182, 0x18}, @nested_vmresume={0x130, 0x18, 0x3}, @wr_crn={0x67, 0x20, {0x8, 0x4}}, @wrmsr={0x65, 0x20, {0x389, 0x9}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @control64=0x2012, 0x3, 0xff, 0x8001}}, @cpuid={0x64, 0x18, {0x2, 0x7ffe}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x3, @host32=0x4c00, 0x6, 0xcafb, 0x3}}, @rdmsr={0x66, 0x18, {0x254}}, @wr_crn={0x67, 0x20, {0x4, 0x9}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x2, @save_area=0x4d5, 0x4, 0x3e5, 0x3}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x1, @save_area=0x574, 0x1, 0x3, 0x7}}, @nested_vmresume={0x130, 0x18, 0x1}, @in_dx={0x69, 0x20, {0x79d9, 0x4}}, @cpuid={0x64, 0x18, {0x8, 0x2}}, @nested_amd_clgi={0x17f, 0x10}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x2, @guest_nat=0x6804, 0xb, 0x2, 0xd32}}, @enable_nested={0x12c, 0x18}, @wr_drn={0x68, 0x20, {0x5, 0x2}}, @cpuid={0x64, 0x18, {0x6, 0x4}}, @code={0xa, 0x5b, {"66460f38805b3d0f350f20d835080000000f22d80f186f45c4c26d3bc42e0f01d12e2e66f30fbd4607263e400f5d630066baf80cb86492c18cef66bafc0cb8d3000000ef8f8870cdcc00"}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0x1, 0x614a}}, @nested_load_syzos={0x136, 0x110, {0x2, 0x9, [@nested_load_syzos={0x136, 0x20, {0x2, 0x8001}}, @wrmsr={0x65, 0x20, {0x29f, 0xfff}}, @nested_amd_stgi={0x17e, 0x10}, @rdmsr={0x66, 0x18, {0xbd9}}, @nested_amd_clgi={0x17f, 0x10}, @wr_crn={0x67, 0x20, {0x8}}, @set_irq_handler={0xc8, 0x20, {0x36, 0x1}}, @nested_load_syzos={0x136, 0x20, {0x2, 0x97b8}}, @uexit={0x0, 0x18, 0x100000001}]}}, @wr_crn={0x67, 0x20, {0x2, 0x8}}, @wr_drn={0x68, 0x20, {0x1, 0x3}}, @nested_amd_vmsave={0x183, 0x18}, @nested_amd_vmsave={0x183, 0x18, 0x3}, @nested_load_syzos={0x136, 0xa8, {0x2, 0x3, [@nested_amd_vmcb_write_mask={0x17c, 0x38, {0x0, @control_area=0x7a, 0x0, 0x5, 0x9}}, @cpuid={0x64, 0x18, {0x80, 0x1000}}, @nested_load_syzos={0x136, 0x20, {0x0, 0xa7}}, @nested_create_vm={0x12d, 0x18}]}}, @nested_vmresume={0x130, 0x18}, @set_irq_handler={0xc8, 0x20, {0x37, 0x2}}], 0x573}) ioctl$KVM_GET_DEVICE_ATTR_vcpu(r6, 0x4018aee2, &(0x7f00000001c0)=@attr_pmu_irq={0x0, 0x1, 0x1, &(0x7f0000000dc0)=0xc}) ioctl$MEDIA_IOC_REQUEST_ALLOC(r5, 0x80047c05, &(0x7f0000000080)=0xffffffffffffffff) r8 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_G_EXT_CTRLS(r8, 0xc0205648, &(0x7f0000000000)={0xf010000, 0x0, 0x0, r7, 0x0, 0x0}) close(r7) r9 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x101000, 0xdb) getdents64(r9, &(0x7f0000000f80)=""/4096, 0x1000) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000440)={{{@in6=@loopback, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@local}}, &(0x7f0000000540)=0xe8) quotactl_fd$Q_QUOTAON(r4, 0xffffffff80000202, r10, &(0x7f00000006c0)='./file0\x00') process_vm_writev(0x0, 0x0, 0x0, &(0x7f0000002c80)=[{0x0}, {&(0x7f0000000580)=""/84, 0x54}, {0x0}, {0x0}], 0x4, 0x0) 2.14976398s ago: executing program 2 (id=6472): socket(0x2, 0x80805, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4}, 0x6e) mount$tmpfs(0x0, &(0x7f0000000540)='./cgroup\x00', &(0x7f0000000580), 0x0, &(0x7f0000000000)={[{@mpol={'mpol', 0x3d, {'default', '=static', @void}}}]}) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x40980, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e99925bd700000000000fc000000000000000000000000000000ac1e000100000000000000000000000000000000000000000a00"], 0xb8}}, 0x0) syz_emit_ethernet(0x56, &(0x7f0000000180)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2a}, @void, {@canfd={0xd, {{0x1, 0x0, 0x0, 0x1}, 0x34, 0x2, 0x0, 0x0, "d2c093e861ff581a22ef13b146bd10ffd936697f37b9fa8f7fcc3ca5dbad6e302008a620a85bc9c8801daf44a09d792b0606218e285ad5555a2b285863a7e8bc"}}}}, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000400), 0x0, 0x0) read$msr(r3, &(0x7f000001aa40)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x100) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x2500, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB="6501000014"], 0x188}}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) socket$unix(0x1, 0x1, 0x0) 1.485086249s ago: executing program 2 (id=6473): mkdir(&(0x7f00000003c0)='./file0\x00', 0x21) pipe2(&(0x7f0000001440)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$FS_IOC_GET_ENCRYPTION_NONCE(r1, 0x8010661b, &(0x7f0000000000)) splice(r2, 0x0, r1, 0x0, 0x6, 0x0) write(r1, &(0x7f00000002c0)="fe", 0xfdef) read$watch_queue(r0, &(0x7f0000000780)=""/221, 0xfdef) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) connect$netlink(r1, &(0x7f0000000100)=@proc={0x10, 0x0, 0x25dfdbfe, 0x8000}, 0xc) sendmsg$NFNL_MSG_CTHELPER_GET(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000010901"], 0x14}}, 0x0) 1.316300566s ago: executing program 6 (id=6474): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/mem_sleep', 0x101a02, 0x0) mmap$IORING_OFF_CQ_RING(0x7fffffffb000, 0x4000, 0x1000003, 0x14852, r0, 0x8000000) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000d40)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r2, &(0x7f0000000f40)={0x0, 0x0, &(0x7f0000000f00)={&(0x7f00000000c0)=ANY=[@ANYRESDEC=r1, @ANYRES16=r1, @ANYBLOB="01002cbd7000800000004f00000008000300", @ANYRES32=r3, @ANYBLOB="10007a800c0003008f03638d46498572"], 0x2c}, 0x1, 0x0, 0x0, 0xc019}, 0x20000040) ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000000)={r2, 0x1, 0xc7b7, 0x10000}) accept4$llc(r4, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f0000000080)=0x10, 0x80800) 1.199288379s ago: executing program 6 (id=6475): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000280)={0xa, 0x4e22, 0x9, @loopback, 0x6}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x23, &(0x7f0000000100)=0xe4, 0x4) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000005c0)="17000000140081044e81f782db44b904021f0802190000", 0x17}], 0x1, 0x0, 0x0, 0x7400}, 0x0) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003380)=[{{0x0, 0x0, &(0x7f00000031c0)=[{&(0x7f0000002140)='$|', 0x2}], 0x1}}], 0x1, 0x4000801) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r2, &(0x7f0000000140)={0xa, 0x4e23, 0xd, @local, 0x9}, 0x1c) ioctl$RTC_SET_TIME(0xffffffffffffffff, 0x4024700a, &(0x7f0000000040)={0x0, 0xb, 0x0, 0x1b, 0x0, 0x4f, 0x0, 0xe7}) syz_usb_connect(0x0, 0x24, &(0x7f0000000400)=ANY=[@ANYBLOB="12010000e4c5ad101d0620c0159c01020301090212"], 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r3 = socket$inet(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r3, 0x0, 0x48b, &(0x7f0000000400)={0x0, 'wg2\x00', 0x3}, 0x18) getsockopt$inet6_mptcp_buf(r2, 0x11c, 0x4, &(0x7f0000000040)=""/173, &(0x7f00000002c0)=0xad) recvmmsg(r0, &(0x7f0000001500)=[{{0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x8}], 0x1, 0x10100, 0x0) 1.08489856s ago: executing program 2 (id=6476): socket$inet6_sctp(0xa, 0x5, 0x84) r0 = socket$inet(0x2, 0x2, 0x1) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000100)={'sit0\x00', &(0x7f0000000000)={'gretap0\x00', 0x0, 0x7, 0x40, 0x9, 0x100, {{0xb, 0x4, 0x3, 0x4, 0x2c, 0x66, 0x0, 0xfc, 0x4, 0x0, @empty, @private=0xa010100, {[@lsrr={0x83, 0x7, 0xa9, [@remote]}, @generic={0x94, 0xe, "a92f6ddfa82e64b59584b290"}]}}}}}) setsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000000180)={@loopback, @remote, r1}, 0xc) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000200)={0x2, 0x4, @broadcast}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000500)="08002b1e3cd19e9f09c572f999ef20b66846b8dda20c21db1067ac19a5b551d576b1995a1dab44ef5c8de02cda405ba4950ef4471cb20a1f4be5b8da329a8964bc9c9c1759561a513fa69491ecd2c78f0db42cdc3aef0afc6df4e70a6ed8f29729c9ed5674e7e19fe93cad5f34647e21b4356337a28efd9ba9d90eede32935e885ec08e5f401882cd6b00ada85c89eef8615fe359b8268b09816fc1aae50c40e41d73a83c091085ea6ca57a1dd23ed919c2668928dca49f41b7367d18007d7a826e2947ef989602cc3", 0xc9}, {&(0x7f0000000300)="96bc91701aaf", 0x6}], 0x2, &(0x7f0000000200)}, 0x24048894) creat(&(0x7f0000000000)='./file1\x00', 0x40) fanotify_init(0x20, 0x1) r2 = syz_open_dev$video(&(0x7f0000000280), 0x6, 0x2) socket$alg(0x26, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$TIPC_MCAST_BROADCAST(r3, 0x10f, 0x85) socket$inet6(0xa, 0x3, 0x5) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000014c0)=@raw={'raw\x00', 0x8, 0x3, 0x278, 0x0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x1a8, 0xffffffff, 0xffffffff, 0x1a8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [0x0, 0x62], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @local, [], [], 'wg1\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0xa8, 0xd8}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x2d8) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x2004c000) sendmmsg(0xffffffffffffffff, &(0x7f00000092c0), 0x4ff, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x124) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) mount$fuse(0x0, 0x0, 0x0, 0x404, &(0x7f0000000340)=ANY=[]) r5 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x101001, 0x0) ioctl$FBIOBLANK(r5, 0x4611, 0x2) unshare(0x62020600) ioctl$VIDIOC_QUERYSTD(r2, 0x8008563f, &(0x7f0000000040)) 978.254241ms ago: executing program 5 (id=6477): add_key$user(&(0x7f0000000000), &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000240)="bc", 0x1, 0xfffffffffffffffe) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, 0x0, 0x0, 0x0, 0x0) 270.268115ms ago: executing program 5 (id=6478): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x0, '\x00', 0x0, @fallback=0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) r1 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r0, 0x0, 0x30, 0x0, @val=@uprobe_multi={0x0, 0x0}}, 0x40) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000c00)='/proc/sys/net/ipv4/tcp_sack\x00', 0x1, 0x0) ftruncate(r2, 0x2ce7ee34) r3 = socket$igmp6(0xa, 0x3, 0x2) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x408001) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r4, 0x40505412, 0xfffffffffffffffd) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x63b5, &(0x7f0000006680)) clock_settime(0x0, &(0x7f0000000240)={0x77359400}) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) r5 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') pread64(r5, &(0x7f0000001240)=""/102400, 0x19000, 0xffffffff8) r6 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/devices.allow\x00', 0x2, 0x48) write$cgroup_devices(r6, &(0x7f0000000040)=ANY=[@ANYBLOB='b *:2'], 0x9) sendmsg$inet6(r3, &(0x7f0000001840)={&(0x7f00000000c0)={0xa, 0x2, 0x9, @empty, 0x6}, 0x1b, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0000000000001a044576e4409ca7000000000000"], 0x18}, 0x20040810) fsetxattr$security_capability(r1, &(0x7f0000000100), &(0x7f0000000140)=@v1={0x1000000, [{0x1a15, 0x5}]}, 0xc, 0x0) 0s ago: executing program 1 (id=6479): sendmsg$NL80211_CMD_DEL_KEY(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={0x0}, 0x1, 0x0, 0x0, 0x8000}, 0x8c0) sendmsg$NL80211_CMD_FLUSH_PMKSA(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000006c0)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x4000800}, 0x24048001) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f00000002c0)="f973085a6ea39ea1b25a1c6b351e11245900557d1c8e9f86bae5e5c64e50ef25afb0295d0c303850b4bff4d088bf9df67e013836e2882dad3f7698b52997f7efa9eb96f09be1c3019445927c6b2fe32d38ae2bcad2ac0d85ebd42914fb18b7d0670f8b3be16755ead6a6fb713fa618ce2cf424ea7cc84b04016b9a2afbfaf68803f1c1acb74fef", 0x87}, {&(0x7f0000000380)="82f294054d05973abfac6a6f31050418457d017c5fd68b034cf51b9f6a6d71daa5c776bca90037bc7c3d88b151fbf856f69ebd05e750f13f02af646b284953b6640a08c827c6f2ff4ad8e84077f9f03f94792aa17c4743cba3f355bb9c5b04b91ed70d253db68e17cdd561fab504479f723388dda974e2a9fb1bcda474c08d6222179b19e902009ea3cb3e42408bab6c1f29cb62", 0x94}, {&(0x7f0000000480)="4ce09043b6aa2ae5946f67306c7f73ed469dfcfc5e1f4d8123a4a8a7b9be82f67f89605cd9bbf7254c156b00437f753a248daf68c5ebdc4a6346d336a6502e98eae72777956d1ebeeb855fae46b3ccb9fb3d593651b95ee00afe0816b3c6e7f3cb3b18fb5198643daa6b9cafde584957dd72ba27cef6604f5df59f0bee60bca63d75a9d812eb699c2d665b7179b22027cf748ac63bcc212703d44cb083e962eee9b5d212523c162b42377ebd0bc624bf9425f6f4772e36c6c2fd4f69b65cc435f93c1a490cb75162251e15", 0xcb}, {&(0x7f0000000780)="8ff2f15bd0017ce4b36b6bc4335634254cffcc40c0312f5ff35991272b79d76712dc0c3cfdc0d70ce8004884e6917bed9ffee1584df7f06c7bccac71daf78bf3c68b8d5e56357654784bdbc700bceb1049c6a47d53c5ac29f83aed3a", 0x5c}, {&(0x7f0000000900)="a9be9b2ff3a19d5a1226e5243d37d1fd2894c1ae880dc2316aa2d5ad08944c7135eb", 0x22}], 0x5}}, {{0x0, 0x0, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000ac0)="3eb85e3024a2953147f5444738e1388e15fef01893884c2eeb5c559f4a030ee6b08fca1e38ee56dac9cbbea3d6d43e34d9daf81d45289d", 0x37}], 0x2}}], 0x2, 0x20000044) socket$alg(0x26, 0x5, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000700)=0x2) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f0000000100)={0x2, @pix_mp={0x0, 0xfff, 0x49323159, 0x0, 0x8, [{0x1, 0x5}, {0x8, 0xbfe}, {0x5, 0x4}, {0x1ff, 0x7}, {0xfffffffa, 0xf1}, {0xffe, 0x9}, {0xff, 0xd}, {0x8001, 0x200}], 0xc3, 0x0, 0x7, 0x0, 0x1}}) r2 = socket$inet6(0xa, 0x80802, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYRES32=r0, @ANYRESHEX], 0x48) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) fcntl$setstatus(r3, 0x4, 0x2400) syz_init_net_socket$x25(0x9, 0x5, 0x0) setreuid(0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @sched_cls}, 0x94) timer_create(0x0, 0x0, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) timer_settime(r4, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) ioctl$XFS_IOC_SCRUBV_METADATA(r2, 0xc0285840, &(0x7f0000000740)={0x8000000000000, 0x0, 0x1fa, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000580)=[{0x1b, 0x1ff, 0xffffffa4}, {0xd, 0x1ff, 0xf}, {0xe, 0xfe, 0x1}, {0x997b46a786060730, 0x101, 0xfff}, {0x2, 0xfe, 0x3}, {0xa, 0xfe, 0x7fff}, {0x13, 0x56453d900c7fb82d, 0x1}, {0x7, 0xfe, 0x5}]}) kernel console output (not intermixed with test programs): cast mode [ 1918.963140][T29112] bridge_slave_1: left promiscuous mode [ 1918.999828][T29112] bridge0: port 2(bridge_slave_1) entered disabled state [ 1919.035202][T29112] bond0: (slave bond_slave_0): Releasing backup interface [ 1919.132007][T29121] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6044'. [ 1919.153665][T29112] bond0: (slave bond_slave_1): Releasing backup interface [ 1919.845424][T29112] team0: Port device team_slave_0 removed [ 1919.871292][T29112] team0: Port device team_slave_1 removed [ 1919.886037][T29112] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1919.923490][T29117] tipc: Started in network mode [ 1919.929798][T29117] tipc: Node identity aaaaaaaaaa1a, cluster identity 4711 [ 1919.957295][T29117] tipc: Enabled bearer , priority 0 [ 1919.986195][ T6364] tipc: Resetting bearer [ 1920.257522][T29135] netlink: 24 bytes leftover after parsing attributes in process `syz.5.6048'. [ 1920.588496][T29140] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6047'. [ 1921.136517][T29142] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6050'. [ 1921.148475][ T5741] tipc: Node number set to 11578026 [ 1921.335777][T29147] CIFS mount error: No usable UNC path provided in device string! [ 1921.335777][T29147] [ 1921.368890][T29147] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 1921.758302][ T5801] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 1922.090732][T29160] netlink: 4 bytes leftover after parsing attributes in process `syz.6.6051'. [ 1922.286010][ T5801] usb 2-1: Using ep0 maxpacket: 32 [ 1922.311030][ T5801] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1922.347797][ T5801] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1922.374223][ T5801] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 1922.451273][ T5801] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1922.849266][ T5801] usb 2-1: config 0 descriptor?? [ 1923.222230][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 1923.259448][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 1923.966272][ T30] audit: type=1400 audit(1782685474.674:2203): avc: denied { write } for pid=29172 comm="syz.6.6058" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 1924.149986][ T30] audit: type=1400 audit(1782685474.843:2204): avc: denied { write } for pid=29176 comm="syz.6.6059" path="socket:[133033]" dev="sockfs" ino=133033 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1924.284327][T29182] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1924.295394][T29182] batadv0: mtu less than device minimum [ 1924.304961][T29182] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1924.318868][T29182] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1924.330132][T29182] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1924.341365][T29182] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1924.352597][T29182] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1924.363815][T29182] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1924.375038][T29182] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1924.386268][T29182] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1924.397476][T29182] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1924.453623][T29182] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1924.473722][T29182] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1924.513239][T29182] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1924.525453][T29182] batman_adv: batadv0: Interface deactivated: dummy0 [ 1924.532922][T29182] batman_adv: batadv0: Removing interface: dummy0 [ 1924.569552][T14378] usb 6-1: new high-speed USB device number 82 using dummy_hcd [ 1924.596449][ T30] audit: type=1400 audit(1782685475.254:2205): avc: denied { setopt } for pid=29181 comm="syz.6.6061" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1924.627980][T29189] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6062'. [ 1924.740579][T14378] usb 6-1: Using ep0 maxpacket: 32 [ 1924.747454][T14378] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1924.766183][T14378] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1924.777626][T14378] usb 6-1: New USB device found, idVendor=1e7d, idProduct=2d51, bcdDevice= 0.00 [ 1924.786823][T14378] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1924.798879][T14378] usb 6-1: config 0 descriptor?? [ 1924.836791][T24847] usb 1-1: new high-speed USB device number 67 using dummy_hcd [ 1924.975952][T24847] usb 1-1: device descriptor read/64, error -71 [ 1925.026052][ T5801] usbhid 2-1:0.0: can't add hid device: -71 [ 1925.036898][ T5801] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1925.063669][ T5801] usb 2-1: USB disconnect, device number 96 [ 1925.096437][T20927] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 1925.232422][T24847] usb 1-1: new high-speed USB device number 68 using dummy_hcd [ 1925.352949][T20927] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1925.369766][T20927] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1925.373810][T14378] koneplus 0003:1E7D:2D51.0069: hidraw0: USB HID v0.00 Device [HID 1e7d:2d51] on usb-dummy_hcd.5-1/input0 [ 1925.382551][T20927] usb 3-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 1925.426187][T29198] lo speed is unknown, defaulting to 1000 [ 1925.577213][T24847] usb 1-1: device descriptor read/64, error -71 [ 1925.616180][T20927] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1925.733092][T14378] koneplus 0003:1E7D:2D51.0069: couldn't init struct koneplus_device [ 1925.754360][T14378] koneplus 0003:1E7D:2D51.0069: couldn't install mouse [ 1925.767127][T20927] usb 3-1: Product: syz [ 1925.771830][T20927] usb 3-1: Manufacturer: syz [ 1925.776344][T14378] koneplus 0003:1E7D:2D51.0069: probe with driver koneplus failed with error -71 [ 1925.778583][T20927] usb 3-1: SerialNumber: syz [ 1925.803780][T24847] usb usb1-port1: attempt power cycle [ 1925.829021][T14378] usb 6-1: USB disconnect, device number 82 [ 1925.923616][T29202] netlink: 8 bytes leftover after parsing attributes in process `syz.6.6066'. [ 1925.943588][T29202] netlink: 8 bytes leftover after parsing attributes in process `syz.6.6066'. [ 1925.994274][T29198] wlan0 speed is unknown, defaulting to 1000 [ 1926.001453][T29198] wg0 speed is unknown, defaulting to 1000 [ 1926.109951][T29193] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6063'. [ 1926.136748][T29193] veth0_macvtap: Device is already in use. [ 1926.183783][T24847] usb 1-1: new high-speed USB device number 69 using dummy_hcd [ 1926.217424][T24847] usb 1-1: device descriptor read/8, error -71 [ 1926.395235][ T30] audit: type=1400 audit(1782685476.938:2206): avc: denied { set_context_mgr } for pid=29214 comm="syz.1.6068" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 1926.421873][T29215] binder: BINDER_SET_CONTEXT_MGR already set [ 1926.445807][T29215] binder: 29214:29215 ioctl 4018620d 200000000240 returned -16 [ 1926.463324][ T30] audit: type=1400 audit(1782685476.975:2207): avc: denied { map } for pid=29214 comm="syz.1.6068" path="/dev/binderfs/binder0" dev="binder" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 1926.504395][T24847] usb 1-1: new high-speed USB device number 70 using dummy_hcd [ 1926.526146][T24847] usb 1-1: device descriptor read/8, error -71 [ 1926.643853][T24847] usb usb1-port1: unable to enumerate USB device [ 1927.052492][T29221] netlink: 8 bytes leftover after parsing attributes in process `syz.6.6069'. [ 1927.737332][T20927] usb 3-1: USB disconnect, device number 82 [ 1927.878052][T24420] udevd[24420]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1927.937053][T29233] netlink: 'syz.2.6074': attribute type 12 has an invalid length. [ 1927.967730][T29234] loop4: detected capacity change from 0 to 7 [ 1927.970075][T29233] netlink: 'syz.2.6074': attribute type 29 has an invalid length. [ 1928.002806][T29227] netlink: 20 bytes leftover after parsing attributes in process `syz.6.6071'. [ 1928.019489][T29233] netlink: 148 bytes leftover after parsing attributes in process `syz.2.6074'. [ 1928.021167][T29234] Dev loop4: unable to read RDB block 7 [ 1928.036514][T29233] netlink: 'syz.2.6074': attribute type 1 has an invalid length. [ 1928.045333][T29234] loop4: unable to read partition table [ 1928.063057][T29233] netlink: 'syz.2.6074': attribute type 2 has an invalid length. [ 1928.084159][T29233] netlink: 11 bytes leftover after parsing attributes in process `syz.2.6074'. [ 1928.100537][T29234] loop4: partition table beyond EOD, truncated [ 1928.113683][T29234] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾x³˜CÖ) failed (rc=-5) [ 1928.128782][T29240] netlink: 'syz.2.6074': attribute type 12 has an invalid length. [ 1928.171014][T29240] netlink: 'syz.2.6074': attribute type 29 has an invalid length. [ 1928.192231][T29240] netlink: 148 bytes leftover after parsing attributes in process `syz.2.6074'. [ 1928.213423][T29240] netlink: 'syz.2.6074': attribute type 1 has an invalid length. [ 1928.234475][T29240] netlink: 'syz.2.6074': attribute type 2 has an invalid length. [ 1928.242671][T29240] netlink: 11 bytes leftover after parsing attributes in process `syz.2.6074'. [ 1928.278919][T24847] usb 6-1: new full-speed USB device number 83 using dummy_hcd [ 1928.296192][T29234] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6073'. [ 1928.399634][T29234] SET target dimension over the limit! [ 1928.452587][T24847] usb 6-1: config 0 has an invalid interface number: 255 but max is 0 [ 1928.467531][T29233] lo speed is unknown, defaulting to 1000 [ 1928.475807][T24847] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1928.514855][T24847] usb 6-1: config 0 has no interface number 0 [ 1928.650773][T24847] usb 6-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 1928.686508][T24847] usb 6-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 1929.716978][T24847] usb 6-1: config 0 interface 255 has no altsetting 0 [ 1929.736087][T24847] usb 6-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 1929.753400][T24847] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1929.984512][ T5801] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 1929.994511][T24847] usb 6-1: Product: syz [ 1929.998758][T24847] usb 6-1: Manufacturer: syz [ 1930.003496][T24847] usb 6-1: SerialNumber: syz [ 1930.031909][T24847] usb 6-1: config 0 descriptor?? [ 1930.087536][T24847] CoreChips 6-1:0.255: probe with driver CoreChips failed with error -22 [ 1930.150045][ T5801] usb 3-1: Using ep0 maxpacket: 8 [ 1930.195452][T29255] SET target dimension over the limit! [ 1930.227431][ T5801] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1930.267412][ T5801] usb 3-1: config 4 has an invalid interface number: 147 but max is 0 [ 1930.312572][ T5801] usb 3-1: config 4 has an invalid descriptor of length 128, skipping remainder of the config [ 1930.326487][ T30] audit: type=1400 audit(1782685480.614:2208): avc: denied { map } for pid=29256 comm="syz.0.6079" path="socket:[134203]" dev="sockfs" ino=134203 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 1930.351182][ T5801] usb 3-1: config 4 has no interface number 0 [ 1930.357703][ T30] audit: type=1400 audit(1782685480.623:2209): avc: denied { cmd } for pid=29256 comm="iou-wrk-29257" path="socket:[134203]" dev="sockfs" ino=134203 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 1930.441267][ T5801] usb 3-1: New USB device found, idVendor=04f2, idProduct=b746, bcdDevice=8e.6e [ 1931.002702][T29233] wlan0 speed is unknown, defaulting to 1000 [ 1931.050864][T29233] wg0 speed is unknown, defaulting to 1000 [ 1932.041463][ T5801] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1932.753333][ T5741] usb 6-1: USB disconnect, device number 83 [ 1933.469029][T29270] netlink: 'syz.1.6083': attribute type 12 has an invalid length. [ 1933.478533][ T30] audit: type=1400 audit(1782685483.233:2210): avc: denied { ioctl } for pid=29256 comm="syz.0.6079" path="/dev/fuse" dev="devtmpfs" ino=99 ioctlcmd=0xe500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 1933.503784][T29270] netlink: 'syz.1.6083': attribute type 29 has an invalid length. [ 1933.503819][T29270] __nla_validate_parse: 2 callbacks suppressed [ 1933.503844][T29270] netlink: 148 bytes leftover after parsing attributes in process `syz.1.6083'. [ 1933.503863][T29270] netlink: 'syz.1.6083': attribute type 1 has an invalid length. [ 1933.503889][T29270] netlink: 'syz.1.6083': attribute type 2 has an invalid length. [ 1933.503916][T29270] netlink: 11 bytes leftover after parsing attributes in process `syz.1.6083'. [ 1933.513486][T29272] netlink: 20 bytes leftover after parsing attributes in process `syz.6.6084'. [ 1933.519517][ T5801] usb 3-1: Product: syz [ 1933.663294][T29269] lo speed is unknown, defaulting to 1000 [ 1933.884474][ T5801] usb 3-1: Manufacturer: syz [ 1933.889140][ T5801] usb 3-1: SerialNumber: syz [ 1933.909213][ T5801] usb 3-1: can't set config #4, error -71 [ 1933.930238][ T30] audit: type=1400 audit(1782685483.981:2211): avc: denied { accept } for pid=29275 comm="syz.5.6085" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 1934.005942][ T5801] usb 3-1: USB disconnect, device number 83 [ 1934.064540][ T30] audit: type=1400 audit(1782685484.019:2212): avc: denied { mount } for pid=29278 comm="syz.2.6086" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 1934.185557][ T30] audit: type=1400 audit(1782685484.028:2213): avc: denied { mounton } for pid=29278 comm="syz.2.6086" path="/555/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 1934.244534][T24847] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 1934.252687][ T30] audit: type=1400 audit(1782685484.028:2214): avc: denied { mount } for pid=29278 comm="syz.2.6086" name="/" dev="overlay" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 1934.307117][ T30] audit: type=1400 audit(1782685484.337:2215): avc: denied { read write } for pid=29283 comm="syz.0.6088" name="file0" dev="fuse" ino=64 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 1934.345358][T29293] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=29293 comm=syz.6.6087 [ 1934.407457][ T30] audit: type=1400 audit(1782685484.337:2216): avc: denied { open } for pid=29283 comm="syz.0.6088" path="/500/file0/file0" dev="fuse" ino=64 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 1934.450419][T24847] usb 2-1: Using ep0 maxpacket: 8 [ 1934.463472][T24847] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1934.480954][ T30] audit: type=1400 audit(1782685484.374:2217): avc: denied { watch_sb watch_reads } for pid=29283 comm="syz.0.6088" path="/500/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="tmpfs" ino=2648 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 1934.529611][T24847] usb 2-1: config 4 has an invalid interface number: 147 but max is 0 [ 1934.541061][T24847] usb 2-1: config 4 has an invalid descriptor of length 128, skipping remainder of the config [ 1934.563928][T24847] usb 2-1: config 4 has no interface number 0 [ 1934.630600][T29298] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.6089'. [ 1934.640940][T24847] usb 2-1: New USB device found, idVendor=04f2, idProduct=b746, bcdDevice=8e.6e [ 1934.662921][T24847] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1934.682020][T24847] usb 2-1: Product: syz [ 1934.699205][T29298] net_ratelimit: 30 callbacks suppressed [ 1934.700037][T29298] openvswitch: netlink: Message has 512 unknown bytes. [ 1934.735442][T24847] usb 2-1: Manufacturer: syz [ 1934.746150][T24847] usb 2-1: SerialNumber: syz [ 1934.837824][T29301] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1935.045329][T29269] wlan0 speed is unknown, defaulting to 1000 [ 1935.067130][T29269] wg0 speed is unknown, defaulting to 1000 [ 1935.239308][T29309] netlink: 48 bytes leftover after parsing attributes in process `syz.5.6093'. [ 1936.603627][T29320] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6096'. [ 1936.639093][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 1936.639160][ T30] audit: type=1400 audit(1782685486.507:2220): avc: denied { read } for pid=29317 comm="syz.5.6096" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1937.322250][T24847] uvcvideo 2-1:4.147: Found multiple Units with ID 6 [ 1937.369339][T24847] uvcvideo 2-1:4.147: Found UVC 0.02 device syz (04f2:b746) [ 1937.407825][T24847] uvcvideo 2-1:4.147: No streaming interface found for terminal 32774. [ 1937.471694][T24847] usb 2-1: USB disconnect, device number 97 [ 1937.480572][T29326] loop5: detected capacity change from 0 to 6 [ 1937.762065][T29332] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6098'. [ 1937.762135][T29326] Dev loop5: unable to read RDB block 6 [ 1937.811893][T29326] loop5: unable to read partition table [ 1937.826282][T29326] loop5: partition table beyond EOD, truncated [ 1937.843966][T29326] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1938.301132][T29338] comedi comedi3: 8255: I/O base address not correctly aligned [ 1938.848237][T29342] netlink: 'syz.6.6102': attribute type 21 has an invalid length. [ 1938.881776][T29342] netlink: 128 bytes leftover after parsing attributes in process `syz.6.6102'. [ 1938.924091][T29342] netlink: 'syz.6.6102': attribute type 4 has an invalid length. [ 1938.924184][T29346] netlink: 12 bytes leftover after parsing attributes in process `syz.6.6102'. [ 1939.031363][T29342] netlink: 'syz.6.6102': attribute type 5 has an invalid length. [ 1939.103396][T29342] netlink: 3 bytes leftover after parsing attributes in process `syz.6.6102'. [ 1939.177853][T29352] netlink: 536 bytes leftover after parsing attributes in process `syz.5.6103'. [ 1939.202574][T29352] netlink: 'syz.5.6103': attribute type 1 has an invalid length. [ 1939.210400][T29352] netlink: 756 bytes leftover after parsing attributes in process `syz.5.6103'. [ 1939.220179][T29344] lo speed is unknown, defaulting to 1000 [ 1939.373854][T29362] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=29362 comm=syz.2.6104 [ 1940.124943][ T30] audit: type=1400 audit(1782685489.781:2221): avc: denied { read } for pid=5274 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 1940.165747][T29344] wlan0 speed is unknown, defaulting to 1000 [ 1940.181960][T29344] wg0 speed is unknown, defaulting to 1000 [ 1940.515028][T29373] netlink: 8 bytes leftover after parsing attributes in process `syz.6.6108'. [ 1940.531850][T29373] SET target dimension over the limit! [ 1940.969956][T29384] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6111'. [ 1940.985706][T29383] SET target dimension over the limit! [ 1941.329610][T29379] netlink: 20 bytes leftover after parsing attributes in process `syz.6.6110'. [ 1941.345903][T29382] loop4: detected capacity change from 0 to 7 [ 1941.384766][T29382] Dev loop4: unable to read RDB block 7 [ 1941.418258][T29382] loop4: unable to read partition table [ 1941.460846][T29382] loop4: partition table beyond EOD, truncated [ 1941.485202][T29382] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾x³˜CÖ) failed (rc=-5) [ 1943.795374][T29391] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1943.806956][ T30] audit: type=1400 audit(1782685493.233:2222): avc: denied { mounton } for pid=29405 comm="syz.6.6117" path="/file0" dev="ramfs" ino=134541 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=dir permissive=1 [ 1943.848310][ T30] audit: type=1400 audit(1782685493.233:2223): avc: denied { bind } for pid=29400 comm="syz.2.6116" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1943.875547][T29391] netlink: 'syz.5.6114': attribute type 21 has an invalid length. [ 1943.895949][T29407] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 1943.907460][T29391] netlink: 128 bytes leftover after parsing attributes in process `syz.5.6114'. [ 1943.917708][T29410] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 1943.928558][T29410] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1943.930868][T29391] netlink: 'syz.5.6114': attribute type 4 has an invalid length. [ 1943.947675][T29407] overlayfs: failed to set xattr on upper [ 1943.974791][T29407] overlayfs: ...falling back to redirect_dir=nofollow. [ 1943.987436][T29391] netlink: 'syz.5.6114': attribute type 5 has an invalid length. [ 1944.001477][T29399] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6114'. [ 1944.026969][T29407] overlayfs: ...falling back to index=off. [ 1944.053398][T29407] overlayfs: ...falling back to uuid=null. [ 1944.084892][T29407] overlayfs: NFS export requires "index=on", falling back to nfs_export=off. [ 1944.254944][T29420] loop4: detected capacity change from 0 to 7 [ 1944.288528][T29420] Dev loop4: unable to read RDB block 7 [ 1944.294841][T29420] loop4: unable to read partition table [ 1944.302267][T29420] loop4: partition table beyond EOD, truncated [ 1944.345484][T29427] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=29427 comm=syz.1.6121 [ 1944.380389][T29420] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾x³˜CÖ) failed (rc=-5) [ 1944.501603][T29431] lo speed is unknown, defaulting to 1000 [ 1944.605313][T29431] wlan0 speed is unknown, defaulting to 1000 [ 1944.612509][T29431] wg0 speed is unknown, defaulting to 1000 [ 1945.466827][T29420] __nla_validate_parse: 1 callbacks suppressed [ 1945.466849][T29420] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6120'. [ 1945.509204][T29445] netlink: 12 bytes leftover after parsing attributes in process `syz.6.6127'. [ 1945.675909][T29420] SET target dimension over the limit! [ 1945.833317][T29450] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6128'. [ 1945.912064][T29450] SET target dimension over the limit! [ 1947.328196][T29465] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1947.339120][T29465] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1947.663543][ T30] audit: type=1400 audit(1782685496.432:2224): avc: denied { unlink } for pid=29453 comm="syz.6.6130" name="#234" dev="tmpfs" ino=1502 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 1948.752551][T29472] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6135'. [ 1948.810935][T29473] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6135'. [ 1949.167524][T29479] lo speed is unknown, defaulting to 1000 [ 1949.531949][T29479] wlan0 speed is unknown, defaulting to 1000 [ 1949.540747][T29479] wg0 speed is unknown, defaulting to 1000 [ 1951.301438][T29486] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6139'. [ 1951.735265][T29493] netlink: 'syz.6.6140': attribute type 12 has an invalid length. [ 1951.821698][T29493] netlink: 'syz.6.6140': attribute type 29 has an invalid length. [ 1951.835858][T29496] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=29496 comm=syz.2.6141 [ 1951.946328][T29493] netlink: 148 bytes leftover after parsing attributes in process `syz.6.6140'. [ 1952.024187][T29493] netlink: 'syz.6.6140': attribute type 1 has an invalid length. [ 1952.047451][T29493] netlink: 'syz.6.6140': attribute type 2 has an invalid length. [ 1952.061626][T29493] netlink: 11 bytes leftover after parsing attributes in process `syz.6.6140'. [ 1952.079981][T29497] netlink: 'syz.6.6140': attribute type 12 has an invalid length. [ 1952.088617][T29497] netlink: 'syz.6.6140': attribute type 29 has an invalid length. [ 1952.099281][T29497] netlink: 148 bytes leftover after parsing attributes in process `syz.6.6140'. [ 1952.125426][T29497] netlink: 'syz.6.6140': attribute type 1 has an invalid length. [ 1952.224575][ T30] audit: type=1400 audit(1782685501.099:2225): avc: denied { create } for pid=29505 comm="syz.5.6143" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 1952.257264][T29497] netlink: 'syz.6.6140': attribute type 2 has an invalid length. [ 1952.268881][T24847] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 1952.297367][T29497] netlink: 11 bytes leftover after parsing attributes in process `syz.6.6140'. [ 1952.436761][T29511] netlink: 'syz.1.6144': attribute type 12 has an invalid length. [ 1952.447093][T29511] netlink: 'syz.1.6144': attribute type 29 has an invalid length. [ 1952.457566][T29511] netlink: 148 bytes leftover after parsing attributes in process `syz.1.6144'. [ 1952.461558][T24847] usb 3-1: Using ep0 maxpacket: 32 [ 1952.467277][T29511] netlink: 11 bytes leftover after parsing attributes in process `syz.1.6144'. [ 1952.488558][T29500] lo speed is unknown, defaulting to 1000 [ 1952.513194][T24847] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1952.522756][T24847] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 1952.532624][T24847] usb 3-1: can't read configurations, error -71 [ 1952.575866][ T30] audit: type=1400 audit(1782685501.436:2226): avc: denied { getopt } for pid=29513 comm="syz.0.6145" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1952.752939][T29517] fuse: Unknown parameter '{±ë%0x0000000000000009' [ 1952.889367][T29511] lo speed is unknown, defaulting to 1000 [ 1952.898157][T29500] wlan0 speed is unknown, defaulting to 1000 [ 1952.909837][T29500] wg0 speed is unknown, defaulting to 1000 [ 1952.920899][ T5741] usb 2-1: new high-speed USB device number 98 using dummy_hcd [ 1953.113294][ T5741] usb 2-1: Using ep0 maxpacket: 8 [ 1953.144760][ T5741] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1953.215891][ T5741] usb 2-1: config 4 has an invalid interface number: 147 but max is 0 [ 1953.251814][ T5741] usb 2-1: config 4 has an invalid descriptor of length 128, skipping remainder of the config [ 1953.302865][ T5741] usb 2-1: config 4 has no interface number 0 [ 1953.350047][ T5741] usb 2-1: New USB device found, idVendor=04f2, idProduct=b746, bcdDevice=8e.6e [ 1953.395867][T29524] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6148'. [ 1953.413292][T29524] netlink: 60 bytes leftover after parsing attributes in process `syz.2.6148'. [ 1953.415168][ T5741] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1953.479175][ T5741] usb 2-1: Product: syz [ 1953.504532][ T5741] usb 2-1: Manufacturer: syz [ 1953.523578][T29511] wlan0 speed is unknown, defaulting to 1000 [ 1953.532767][ T5741] usb 2-1: SerialNumber: syz [ 1953.547304][T29511] wg0 speed is unknown, defaulting to 1000 [ 1954.331283][T29533] netlink: 8 bytes leftover after parsing attributes in process `syz.6.6150'. [ 1954.599412][T29524] 9p: Bad value for 'wfdno' [ 1955.010759][T29539] siw: device registration error -23 [ 1955.062788][ T5741] uvcvideo 2-1:4.147: Found multiple Units with ID 6 [ 1955.070592][ T30] audit: type=1400 audit(1782685503.765:2227): avc: denied { map } for pid=29540 comm="syz.2.6152" path="/dev/bus/usb/006/001" dev="devtmpfs" ino=737 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 1955.135486][ T5741] uvcvideo 2-1:4.147: Found UVC 0.02 device syz (04f2:b746) [ 1955.145040][ T5741] uvcvideo 2-1:4.147: No streaming interface found for terminal 32774. [ 1955.188760][ T5741] usb 2-1: USB disconnect, device number 98 [ 1956.213696][T29546] bridge1: the hash_elasticity option has been deprecated and is always 16 [ 1956.412708][T29549] lo speed is unknown, defaulting to 1000 [ 1956.516804][T29549] wlan0 speed is unknown, defaulting to 1000 [ 1956.524159][T29549] wg0 speed is unknown, defaulting to 1000 [ 1957.034839][T29560] loop4: detected capacity change from 0 to 7 [ 1957.078767][T29562] __nla_validate_parse: 1 callbacks suppressed [ 1957.078799][T29562] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6157'. [ 1957.097373][T29562] SET target dimension over the limit! [ 1957.332585][T29560] Dev loop4: unable to read RDB block 7 [ 1957.339098][T29560] loop4: unable to read partition table [ 1957.345967][T29560] loop4: partition table beyond EOD, truncated [ 1957.352649][T29560] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾x³˜CÖ) failed (rc=-5) [ 1957.629051][T29567] comedi comedi4: bad chanlist[0]=0x00000009 chan=9 range length=2 [ 1958.061267][T29574] loop5: detected capacity change from 0 to 6 [ 1958.073792][T29574] Dev loop5: unable to read RDB block 6 [ 1958.090413][T29574] loop5: unable to read partition table [ 1958.097128][T29574] loop5: partition table beyond EOD, truncated [ 1958.104528][T29581] netlink: 40 bytes leftover after parsing attributes in process `syz.6.6164'. [ 1958.558745][T29574] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1958.674705][ T5741] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 1958.739238][T29591] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6163'. [ 1958.879672][T29578] orangefs_mount: mount request failed with -4 [ 1959.102849][ T30] audit: type=1400 audit(1782685507.544:2228): avc: denied { ioctl } for pid=29600 comm="syz.0.6168" path="socket:[134997]" dev="sockfs" ino=134997 ioctlcmd=0x587a scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1959.333737][ T5741] usb 3-1: device not accepting address 86, error -71 [ 1959.336623][T29604] lo speed is unknown, defaulting to 1000 [ 1959.604922][T29609] fuse: Bad value for 'fd' [ 1959.885934][T29616] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6171'. [ 1959.903647][T29616] SET target dimension over the limit! [ 1960.950168][T29613] loop4: detected capacity change from 0 to 7 [ 1960.995814][T29613] Dev loop4: unable to read RDB block 7 [ 1961.010439][T29613] loop4: unable to read partition table [ 1961.038625][T29613] loop4: partition table beyond EOD, truncated [ 1961.060603][T29613] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾x³˜CÖ) failed (rc=-5) [ 1961.214359][T29604] wlan0 speed is unknown, defaulting to 1000 [ 1961.228877][T29604] wg0 speed is unknown, defaulting to 1000 [ 1961.293345][T22869] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 1961.345050][ T5741] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 1961.551847][ T5741] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1961.642129][ T5741] usb 3-1: config 0 has no interfaces? [ 1961.653438][T29626] evm: overlay not supported [ 1961.676318][ T5741] usb 3-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 1961.709325][ T5741] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1961.742774][ T5741] usb 3-1: Product: syz [ 1961.747512][ T5741] usb 3-1: Manufacturer: syz [ 1961.764921][ T5741] usb 3-1: SerialNumber: syz [ 1962.268616][ T5741] usb 3-1: config 0 descriptor?? [ 1962.360346][T29632] orangefs_mount: mount request failed with -4 [ 1962.396865][T29638] lo speed is unknown, defaulting to 1000 [ 1962.500281][T29638] wlan0 speed is unknown, defaulting to 1000 [ 1962.506877][T29638] wg0 speed is unknown, defaulting to 1000 [ 1963.051858][T29646] netlink: 36 bytes leftover after parsing attributes in process `syz.6.6179'. [ 1963.084064][T24847] usb 3-1: USB disconnect, device number 88 [ 1963.373483][T29660] comedi comedi4: bad chanlist[0]=0x00000009 chan=9 range length=2 [ 1963.413937][T29662] netlink: 8 bytes leftover after parsing attributes in process `syz.6.6183'. [ 1963.436396][T29655] SET target dimension over the limit! [ 1964.103561][T29671] lo speed is unknown, defaulting to 1000 [ 1964.689132][T29680] orangefs_mount: mount request failed with -4 [ 1965.054943][ T5801] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 1965.167792][T29689] netlink: 36 bytes leftover after parsing attributes in process `syz.0.6192'. [ 1965.234182][T29671] wlan0 speed is unknown, defaulting to 1000 [ 1965.239159][ T5801] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1965.259432][ T5801] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 1965.267032][T29671] wg0 speed is unknown, defaulting to 1000 [ 1965.278076][ T5801] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 64 [ 1965.294727][ T5801] usb 3-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 1965.311584][ T5801] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1965.333894][ T5801] usb 3-1: Product: syz [ 1965.340362][ T5801] usb 3-1: Manufacturer: syz [ 1965.358685][ T5801] usb 3-1: SerialNumber: syz [ 1965.380615][ T5801] usb 3-1: config 0 descriptor?? [ 1965.410246][T29687] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1965.427041][T29687] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1965.447813][ T5801] usb 3-1: ucan: probing device on interface #0 [ 1965.578855][T24847] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 1965.685552][T14378] usb 1-1: new high-speed USB device number 71 using dummy_hcd [ 1965.762594][T24847] usb 2-1: config 2 has an invalid interface number: 65 but max is 0 [ 1965.784279][T24847] usb 2-1: config 2 has no interface number 0 [ 1965.800442][T29687] syzkaller0: entered promiscuous mode [ 1965.805936][T29687] syzkaller0: entered allmulticast mode [ 1965.813943][T24847] usb 2-1: New USB device found, idVendor=12d6, idProduct=0444, bcdDevice=99.c6 [ 1965.836733][T24847] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1965.853064][T24847] usb 2-1: Product: syz [ 1965.857388][T14378] usb 1-1: Using ep0 maxpacket: 32 [ 1965.867322][T24847] usb 2-1: Manufacturer: syz [ 1965.877133][T24847] usb 2-1: SerialNumber: syz [ 1965.882524][T29687] tipc: Started in network mode [ 1965.887516][T29687] tipc: Node identity aa37a3f0374f, cluster identity 4711 [ 1965.895431][T29687] tipc: Enabled bearer , priority 0 [ 1965.904661][ T5801] usb 3-1: ucan: could not read protocol version, ret=0 [ 1965.914402][T14378] usb 1-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 1965.928448][ T5801] usb 3-1: ucan: probe failed; try to update the device firmware [ 1965.938115][T14378] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1965.957210][T14378] usb 1-1: Product: syz [ 1965.969164][T14378] usb 1-1: Manufacturer: syz [ 1965.977369][T14378] usb 1-1: SerialNumber: syz [ 1965.994441][T14378] usb 1-1: config 0 descriptor?? [ 1966.009447][T14378] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 1966.024811][T14378] dvb-usb: bulk message failed: -22 (2/0) [ 1966.039384][T14378] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1966.057702][T14378] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 1966.072777][T14378] usb 1-1: media controller created [ 1966.095865][T14378] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1966.122873][T14378] usb 1-1: selecting invalid altsetting 7 [ 1966.135065][T14378] cxusb: set interface failed [ 1966.145085][T14378] dvb-usb: bulk message failed: -22 (1/0) [ 1966.180661][T14378] DVB: Unable to find symbol lgdt330x_attach() [ 1966.194651][T14378] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 1966.236839][T24847] ems_usb 2-1:2.65 (unnamed net_device) (uninitialized): couldn't initialize controller: -22 [ 1966.257032][T24847] ems_usb 2-1:2.65: probe with driver ems_usb failed with error -22 [ 1966.283170][T24847] usb 2-1: USB disconnect, device number 99 [ 1966.326721][T14378] rc_core: IR keymap rc-dvico-portable not found [ 1966.341113][T14378] Registered IR keymap rc-empty [ 1966.361213][T14378] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 1966.384959][T14378] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input89 [ 1966.405595][T14378] dvb-usb: schedule remote query interval to 100 msecs. [ 1966.413331][T14378] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 1966.436432][T29698] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1966.448099][T29698] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1966.531773][T24847] dvb-usb: bulk message failed: -22 (1/0) [ 1966.564556][T24847] usb 1-1: USB disconnect, device number 71 [ 1966.613072][T24847] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 1967.009506][T29713] loop4: detected capacity change from 0 to 7 [ 1967.019180][T29713] Dev loop4: unable to read RDB block 7 [ 1967.025811][T29713] loop4: unable to read partition table [ 1967.031829][T29713] loop4: partition table beyond EOD, truncated [ 1967.042481][T29713] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾x³˜CÖ) failed (rc=-5) [ 1967.076163][ T5741] tipc: Node number set to 2641929200 [ 1967.083200][T29713] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6201'. [ 1967.095939][T29713] SET target dimension over the limit! [ 1967.263548][T29715] validate_nla: 2 callbacks suppressed [ 1967.263580][T29715] netlink: 'syz.6.6202': attribute type 12 has an invalid length. [ 1967.278059][T29715] netlink: 'syz.6.6202': attribute type 29 has an invalid length. [ 1967.286605][T29715] netlink: 148 bytes leftover after parsing attributes in process `syz.6.6202'. [ 1967.299151][T29715] netlink: 'syz.6.6202': attribute type 1 has an invalid length. [ 1967.307872][T29715] netlink: 'syz.6.6202': attribute type 2 has an invalid length. [ 1967.318072][T29715] netlink: 11 bytes leftover after parsing attributes in process `syz.6.6202'. [ 1967.332149][T29717] netlink: 'syz.6.6202': attribute type 12 has an invalid length. [ 1967.343710][T29717] netlink: 'syz.6.6202': attribute type 29 has an invalid length. [ 1967.352288][T29717] netlink: 148 bytes leftover after parsing attributes in process `syz.6.6202'. [ 1967.362286][T29717] netlink: 'syz.6.6202': attribute type 1 has an invalid length. [ 1967.370574][T29717] netlink: 'syz.6.6202': attribute type 2 has an invalid length. [ 1967.380548][T29717] netlink: 11 bytes leftover after parsing attributes in process `syz.6.6202'. [ 1967.525475][T29715] lo speed is unknown, defaulting to 1000 [ 1967.742297][ T5801] usb 1-1: new full-speed USB device number 72 using dummy_hcd [ 1967.942858][ T5801] usb 1-1: config 0 has an invalid interface number: 255 but max is 0 [ 1967.954394][ T5801] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1968.000721][ T5801] usb 1-1: config 0 has no interface number 0 [ 1968.025179][ T5801] usb 1-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 1968.042088][ T5801] usb 1-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 1968.068878][ T5801] usb 1-1: config 0 interface 255 has no altsetting 0 [ 1968.076532][T29687] tipc: Resetting bearer [ 1968.577048][ T5801] usb 1-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 1968.590955][ T5801] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1968.622463][T29687] tipc: Disabling bearer [ 1968.628665][ T5801] usb 1-1: Product: syz [ 1968.634932][ T5801] usb 1-1: Manufacturer: syz [ 1968.644967][ T5801] usb 1-1: SerialNumber: syz [ 1968.659228][T29715] wlan0 speed is unknown, defaulting to 1000 [ 1968.686153][T29715] wg0 speed is unknown, defaulting to 1000 [ 1968.703636][T24847] usb 3-1: USB disconnect, device number 89 [ 1968.734756][ T5801] usb 1-1: config 0 descriptor?? [ 1968.759559][ T5801] CoreChips 1-1:0.255: probe with driver CoreChips failed with error -22 [ 1970.187243][ T30] audit: type=1400 audit(1782685517.908:2229): avc: denied { open } for pid=29741 comm="syz.2.6209" path="/dev/ttyq9" dev="devtmpfs" ino=384 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 1970.225798][T29746] FAULT_INJECTION: forcing a failure. [ 1970.225798][T29746] name failslab, interval 1, probability 0, space 0, times 0 [ 1970.238616][T29746] CPU: 1 UID: 0 PID: 29746 Comm: syz.5.6210 Tainted: G L syzkaller #0 PREEMPT(full) [ 1970.238644][T29746] Tainted: [L]=SOFTLOCKUP [ 1970.238650][T29746] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1970.238660][T29746] Call Trace: [ 1970.238666][T29746] [ 1970.238672][T29746] dump_stack_lvl+0x100/0x190 [ 1970.238699][T29746] should_fail_ex.cold+0x5/0xa [ 1970.238724][T29746] should_failslab+0xc2/0x120 [ 1970.238747][T29746] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 1970.238766][T29746] ? __alloc_skb+0x5b7/0x710 [ 1970.238782][T29746] ? __alloc_skb+0x140/0x710 [ 1970.238801][T29746] __alloc_skb+0x140/0x710 [ 1970.238816][T29746] ? __alloc_skb+0x5b7/0x710 [ 1970.238838][T29746] ? __pfx___alloc_skb+0x10/0x10 [ 1970.238859][T29746] netlink_alloc_large_skb+0x69/0x150 [ 1970.238884][T29746] netlink_sendmsg+0x680/0xda0 [ 1970.238910][T29746] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1970.238933][T29746] ? __might_fault+0x60/0x140 [ 1970.238958][T29746] ____sys_sendmsg+0xa4d/0xbe0 [ 1970.238976][T29746] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1970.239000][T29746] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1970.239031][T29746] ___sys_sendmsg+0x190/0x1e0 [ 1970.239048][T29746] ? __pfx____sys_sendmsg+0x10/0x10 [ 1970.239062][T29746] ? __lock_acquire+0x49f/0x1a40 [ 1970.239076][T29746] ? get_pid_task+0x106/0x250 [ 1970.239102][T29746] __sys_sendmsg+0x160/0x210 [ 1970.239114][T29746] ? __pfx___sys_sendmsg+0x10/0x10 [ 1970.239133][T29746] do_syscall_64+0x115/0x870 [ 1970.239149][T29746] ? clear_bhb_loop+0x40/0x90 [ 1970.239163][T29746] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1970.239174][T29746] RIP: 0033:0x7f19b699ce59 [ 1970.239185][T29746] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1970.239195][T29746] RSP: 002b:00007f19b78a5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1970.239207][T29746] RAX: ffffffffffffffda RBX: 00007f19b6c15fa0 RCX: 00007f19b699ce59 [ 1970.239214][T29746] RDX: 0000000000000000 RSI: 00002000000006c0 RDI: 0000000000000006 [ 1970.239221][T29746] RBP: 00007f19b78a5090 R08: 0000000000000000 R09: 0000000000000000 [ 1970.239227][T29746] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1970.239233][T29746] R13: 00007f19b6c16038 R14: 00007f19b6c15fa0 R15: 00007ffd678c1398 [ 1970.239248][T29746] [ 1970.542903][T29753] tipc: Enabling of bearer rejected, already enabled [ 1970.557522][T24847] usb 1-1: USB disconnect, device number 72 [ 1970.592291][ T5801] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 1970.731359][ T5801] usb 3-1: device descriptor read/64, error -71 [ 1970.956364][T24847] usb 1-1: new high-speed USB device number 73 using dummy_hcd [ 1970.989715][ T5801] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 1971.228560][ T5801] usb 3-1: device descriptor read/64, error -71 [ 1971.272533][T24847] usb 1-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 1971.303564][T24847] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1971.333096][T24847] usb 1-1: Product: syz [ 1971.338629][T29768] netlink: 48 bytes leftover after parsing attributes in process `syz.1.6217'. [ 1971.358471][T24847] usb 1-1: Manufacturer: syz [ 1971.367151][T24847] usb 1-1: SerialNumber: syz [ 1971.375561][ T5801] usb usb3-port1: attempt power cycle [ 1971.412395][T24847] usb 1-1: config 0 descriptor?? [ 1971.504626][T29769] siw: device registration error -23 [ 1972.080633][T24847] usb 1-1: USB disconnect, device number 73 [ 1972.126555][ T5801] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 1972.187889][ T5801] usb 3-1: device descriptor read/8, error -71 [ 1972.198019][T29772] fuse: Bad value for 'fd' [ 1972.213195][T29772] netlink: 116 bytes leftover after parsing attributes in process `syz.6.6218'. [ 1972.241010][T29772] netlink: 116 bytes leftover after parsing attributes in process `syz.6.6218'. [ 1972.276735][T29776] netlink: 7 bytes leftover after parsing attributes in process `syz.5.6220'. [ 1972.296278][T29776] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6220'. [ 1972.328396][T29776] 9pnet_fd: Insufficient options for proto=fd [ 1972.336615][ T30] audit: type=1400 audit(1782685519.920:2230): avc: denied { mount } for pid=29773 comm="syz.1.6219" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 1972.364785][ T30] audit: type=1400 audit(1782685519.938:2231): avc: denied { watch watch_reads } for pid=29773 comm="syz.1.6219" path="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=dir permissive=1 [ 1972.396015][ T30] audit: type=1400 audit(1782685519.976:2232): avc: denied { unmount } for pid=18253 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 1972.463210][ T5801] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 1972.491530][ T30] audit: type=1400 audit(1782685520.060:2233): avc: denied { append } for pid=29781 comm="syz.1.6222" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1972.506529][ T5801] usb 3-1: device descriptor read/8, error -71 [ 1972.808466][ T5801] usb usb3-port1: unable to enumerate USB device [ 1973.641588][T29797] FAULT_INJECTION: forcing a failure. [ 1973.641588][T29797] name failslab, interval 1, probability 0, space 0, times 0 [ 1973.654390][T29797] CPU: 0 UID: 0 PID: 29797 Comm: syz.5.6226 Tainted: G L syzkaller #0 PREEMPT(full) [ 1973.654416][T29797] Tainted: [L]=SOFTLOCKUP [ 1973.654422][T29797] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1973.654432][T29797] Call Trace: [ 1973.654438][T29797] [ 1973.654446][T29797] dump_stack_lvl+0x100/0x190 [ 1973.654473][T29797] should_fail_ex.cold+0x5/0xa [ 1973.654499][T29797] should_failslab+0xc2/0x120 [ 1973.654524][T29797] __kmalloc_cache_noprof+0x91/0x6c0 [ 1973.654552][T29797] ? find_held_lock+0x2b/0x80 [ 1973.654569][T29797] ? alloc_fs_context+0x57/0xf40 [ 1973.654598][T29797] alloc_fs_context+0x57/0xf40 [ 1973.654621][T29797] ? __get_fs_type+0xe3/0x200 [ 1973.654646][T29797] path_mount+0xdbd/0x23d0 [ 1973.654674][T29797] ? __pfx_path_mount+0x10/0x10 [ 1973.654694][T29797] ? lockdep_hardirqs_on+0x78/0x100 [ 1973.654723][T29797] ? putname+0xb1/0x110 [ 1973.654742][T29797] ? kmem_cache_free+0x127/0x6b0 [ 1973.654768][T29797] ? __x64_sys_mount+0x293/0x310 [ 1973.654789][T29797] __x64_sys_mount+0x293/0x310 [ 1973.654812][T29797] ? __pfx___x64_sys_mount+0x10/0x10 [ 1973.654842][T29797] do_syscall_64+0x115/0x870 [ 1973.654867][T29797] ? clear_bhb_loop+0x40/0x90 [ 1973.654888][T29797] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1973.654906][T29797] RIP: 0033:0x7f19b699ce59 [ 1973.654922][T29797] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1973.654939][T29797] RSP: 002b:00007f19b7884028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 1973.654957][T29797] RAX: ffffffffffffffda RBX: 00007f19b6c16090 RCX: 00007f19b699ce59 [ 1973.654969][T29797] RDX: 0000200000000080 RSI: 0000200000000040 RDI: 0000200000000000 [ 1973.654980][T29797] RBP: 00007f19b7884090 R08: 0000000000000000 R09: 0000000000000000 [ 1973.654991][T29797] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000002 [ 1973.655001][T29797] R13: 00007f19b6c16128 R14: 00007f19b6c16090 R15: 00007ffd678c1398 [ 1973.655025][T29797] [ 1974.618654][T29801] comedi comedi4: bad chanlist[0]=0x00000009 chan=9 range length=2 [ 1974.690692][T29804] netlink: 8 bytes leftover after parsing attributes in process `syz.6.6228'. [ 1974.946888][T29800] SET target dimension over the limit! [ 1975.043290][T29807] loop5: detected capacity change from 0 to 7 [ 1976.387057][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1976.396497][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1977.339910][T29807] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1977.358876][ T30] audit: type=1400 audit(1782685524.007:2234): avc: denied { map } for pid=29808 comm="syz.2.6230" path="socket:[136696]" dev="sockfs" ino=136696 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1977.571694][T29807] Buffer I/O error on dev loop5, logical block 0, async page read [ 1977.612958][T29821] netlink: 'syz.1.6231': attribute type 12 has an invalid length. [ 1977.633380][ T30] audit: type=1400 audit(1782685524.007:2235): avc: denied { read } for pid=29808 comm="syz.2.6230" path="socket:[136696]" dev="sockfs" ino=136696 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1977.671637][T29807] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1977.708240][T29821] netlink: 'syz.1.6231': attribute type 29 has an invalid length. [ 1977.748309][T29807] Buffer I/O error on dev loop5, logical block 0, async page read [ 1977.841119][T29807] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1977.880238][T29821] netlink: 148 bytes leftover after parsing attributes in process `syz.1.6231'. [ 1977.951217][T29807] Buffer I/O error on dev loop5, logical block 0, async page read [ 1977.969923][T29821] netlink: 'syz.1.6231': attribute type 1 has an invalid length. [ 1978.038212][T29807] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1978.061892][T29820] netlink: 20 bytes leftover after parsing attributes in process `syz.6.6232'. [ 1978.084393][T29821] netlink: 'syz.1.6231': attribute type 2 has an invalid length. [ 1978.128128][T29807] Buffer I/O error on dev loop5, logical block 0, async page read [ 1978.191152][T29807] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1978.209435][T29821] netlink: 11 bytes leftover after parsing attributes in process `syz.1.6231'. [ 1978.275734][T29807] Buffer I/O error on dev loop5, logical block 0, async page read [ 1978.359957][T29807] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1978.442252][T29807] Buffer I/O error on dev loop5, logical block 0, async page read [ 1978.457907][T29824] netlink: 'syz.1.6231': attribute type 12 has an invalid length. [ 1978.503334][T29807] ldm_validate_partition_table(): Disk read failed. [ 1978.559813][T29807] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1978.585232][T29824] netlink: 'syz.1.6231': attribute type 29 has an invalid length. [ 1978.612233][T29807] Buffer I/O error on dev loop5, logical block 0, async page read [ 1978.638433][T29807] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1978.655431][T29824] netlink: 148 bytes leftover after parsing attributes in process `syz.1.6231'. [ 1978.680653][T29807] Buffer I/O error on dev loop5, logical block 0, async page read [ 1978.855414][ T995] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 1978.870941][T29824] netlink: 'syz.1.6231': attribute type 1 has an invalid length. [ 1978.879972][T29807] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1978.905756][T29824] netlink: 'syz.1.6231': attribute type 2 has an invalid length. [ 1979.695054][ T30] audit: type=1800 audit(1782685526.159:2236): pid=29840 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.6.6236" name="file0" dev="overlay" ino=1662 res=0 errno=0 [ 1979.734500][T29807] Buffer I/O error on dev loop5, logical block 0, async page read [ 1979.743890][T29824] netlink: 11 bytes leftover after parsing attributes in process `syz.1.6231'. [ 1979.756455][T29807] Dev loop5: unable to read RDB block 0 [ 1979.778355][T29844] FAULT_INJECTION: forcing a failure. [ 1979.778355][T29844] name failslab, interval 1, probability 0, space 0, times 0 [ 1979.793726][T29807] loop5: unable to read partition table [ 1979.883519][T29807] loop5: partition table beyond EOD, truncated [ 1979.903750][T29807] loop_reread_partitions: partition scan of loop5 (úù) failed (rc=-5) [ 1980.085782][ T995] usb 2-1: Using ep0 maxpacket: 8 [ 1980.092751][T29844] CPU: 1 UID: 0 PID: 29844 Comm: syz.6.6239 Tainted: G L syzkaller #0 PREEMPT(full) [ 1980.092783][T29844] Tainted: [L]=SOFTLOCKUP [ 1980.092790][T29844] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1980.092801][T29844] Call Trace: [ 1980.092808][T29844] [ 1980.092815][T29844] dump_stack_lvl+0x100/0x190 [ 1980.092846][T29844] should_fail_ex.cold+0x5/0xa [ 1980.092873][T29844] should_failslab+0xc2/0x120 [ 1980.092899][T29844] __kmalloc_cache_noprof+0x91/0x6c0 [ 1980.092929][T29844] ? nft_netdev_hook_alloc+0x243/0x430 [ 1980.092958][T29844] nft_netdev_hook_alloc+0x243/0x430 [ 1980.092982][T29844] ? __nla_parse+0x40/0x60 [ 1980.093013][T29844] nft_chain_parse_hook+0x71b/0x1200 [ 1980.093046][T29844] ? __pfx_nft_chain_parse_hook+0x10/0x10 [ 1980.093073][T29844] ? arch_stack_walk+0xa6/0xf0 [ 1980.093102][T29844] nf_tables_addchain.constprop.0+0x23e/0x1ca0 [ 1980.093128][T29844] ? nf_tables_table_notify+0x411/0x530 [ 1980.093160][T29844] ? nft_chain_lookup+0x59c/0xa60 [ 1980.093189][T29844] ? __kasan_kmalloc+0xaa/0xb0 [ 1980.093211][T29844] ? __pfx_nf_tables_addchain.constprop.0+0x10/0x10 [ 1980.093260][T29844] ? nla_strcmp+0xff/0x130 [ 1980.093288][T29844] ? nft_table_lookup.part.0+0x1e3/0x230 [ 1980.093317][T29844] nf_tables_newchain+0x17c3/0x2d30 [ 1980.093341][T29844] ? __pfx_net_generic+0x1/0x10 [ 1980.093371][T29844] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1980.093396][T29844] ? __nla_validate_parse+0x1e7/0x28b0 [ 1980.093427][T29844] ? __pfx_nf_tables_newchain+0x10/0x10 [ 1980.093452][T29844] ? __pfx___nla_validate_parse+0x10/0x10 [ 1980.093490][T29844] ? __nla_parse+0x40/0x60 [ 1980.093520][T29844] nfnetlink_rcv_batch+0x1410/0x2880 [ 1980.093555][T29844] ? __pfx_nfnetlink_rcv_batch+0x10/0x10 [ 1980.093576][T29844] ? find_held_lock+0x2b/0x80 [ 1980.093608][T29844] ? avc_has_perm_noaudit+0x145/0x3b0 [ 1980.093660][T29844] ? __nla_parse+0x40/0x60 [ 1980.093692][T29844] nfnetlink_rcv+0x3bd/0x440 [ 1980.093712][T29844] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1980.093739][T29844] netlink_unicast+0x585/0x850 [ 1980.093770][T29844] ? __pfx_netlink_unicast+0x10/0x10 [ 1980.093803][T29844] netlink_sendmsg+0x8b0/0xda0 [ 1980.093834][T29844] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1980.093858][T29844] ? __might_fault+0x60/0x140 [ 1980.093885][T29844] ____sys_sendmsg+0xa4d/0xbe0 [ 1980.093909][T29844] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1980.093937][T29844] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1980.093973][T29844] ___sys_sendmsg+0x190/0x1e0 [ 1980.094000][T29844] ? __pfx____sys_sendmsg+0x10/0x10 [ 1980.094023][T29844] ? __lock_acquire+0x49f/0x1a40 [ 1980.094046][T29844] ? get_pid_task+0x106/0x250 [ 1980.094093][T29844] __sys_sendmsg+0x160/0x210 [ 1980.094114][T29844] ? __pfx___sys_sendmsg+0x10/0x10 [ 1980.094148][T29844] do_syscall_64+0x115/0x870 [ 1980.094173][T29844] ? clear_bhb_loop+0x40/0x90 [ 1980.094195][T29844] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1980.094214][T29844] RIP: 0033:0x7f4f2c39ce59 [ 1980.094231][T29844] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1980.094248][T29844] RSP: 002b:00007f4f2d2a0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1980.094267][T29844] RAX: ffffffffffffffda RBX: 00007f4f2c615fa0 RCX: 00007f4f2c39ce59 [ 1980.094279][T29844] RDX: 0000000000000010 RSI: 0000200000000080 RDI: 0000000000000003 [ 1980.094290][T29844] RBP: 00007f4f2d2a0090 R08: 0000000000000000 R09: 0000000000000000 [ 1980.094301][T29844] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1980.094312][T29844] R13: 00007f4f2c616038 R14: 00007f4f2c615fa0 R15: 00007ffe4f6edf88 [ 1980.094338][T29844] [ 1980.528207][T29817] lo speed is unknown, defaulting to 1000 [ 1980.726545][T29817] wlan0 speed is unknown, defaulting to 1000 [ 1980.733770][T29817] wg0 speed is unknown, defaulting to 1000 [ 1981.419199][T29849] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1981.463260][T29860] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6243'. [ 1981.595339][ T30] audit: type=1400 audit(1782685528.581:2237): avc: denied { listen } for pid=29859 comm="syz.0.6243" laddr=::ffff:172.20.20.10 lport=45569 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1981.655026][ T30] audit: type=1400 audit(1782685528.581:2238): avc: denied { write } for pid=29859 comm="syz.0.6243" path="socket:[136780]" dev="sockfs" ino=136780 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 1981.828852][ T30] audit: type=1400 audit(1782685528.581:2239): avc: denied { setopt } for pid=29859 comm="syz.0.6243" laddr=::ffff:172.20.20.10 lport=45569 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 1981.918054][T29870] netlink: 48 bytes leftover after parsing attributes in process `syz.0.6245'. [ 1981.928817][ T30] audit: type=1400 audit(1782685528.619:2240): avc: denied { getopt } for pid=29854 comm="syz.5.6241" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1982.140952][T29874] siw: device registration error -23 [ 1984.370585][ T995] usb 2-1: device descriptor read/all, error -71 [ 1984.757424][ T5853] usb 6-1: new high-speed USB device number 84 using dummy_hcd [ 1984.874425][T29904] netlink: 48 bytes leftover after parsing attributes in process `syz.0.6255'. [ 1984.972639][ T5853] usb 6-1: Using ep0 maxpacket: 16 [ 1985.395020][ T5853] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1985.414264][ T5853] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 1985.433902][ T5853] usb 6-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 1985.471544][ T5853] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1985.511579][ T5853] usb 6-1: Product: syz [ 1985.530437][ T5853] usb 6-1: Manufacturer: syz [ 1985.535285][ T5853] usb 6-1: SerialNumber: syz [ 1986.531784][ T5853] usb 6-1: Audio class v2/v3 interfaces need an interface association [ 1986.543046][T29929] loop4: detected capacity change from 0 to 7 [ 1986.563868][ T5853] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 1986.627948][ T995] usb 2-1: new high-speed USB device number 102 using dummy_hcd [ 1986.651778][T29929] Dev loop4: unable to read RDB block 7 [ 1986.699840][T29932] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6262'. [ 1986.711762][T29929] loop4: unable to read partition table [ 1986.718494][T29930] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6260'. [ 1986.721538][T29934] netlink: 'syz.6.6263': attribute type 4 has an invalid length. [ 1986.728115][T29932] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6262'. [ 1986.748573][T29929] loop4: partition table beyond EOD, truncated [ 1986.754898][T29932] netlink: 'syz.0.6262': attribute type 15 has an invalid length. [ 1986.763987][T29929] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾x³˜CÖ) failed (rc=-5) [ 1986.788731][ T1125] netdevsim netdevsim0 netdevsim0: set [0, 1] type 1 family 0 port 256 - 0 [ 1986.797610][ T1125] netdevsim netdevsim0 netdevsim1: set [0, 1] type 1 family 0 port 256 - 0 [ 1986.806700][T29932] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6262'. [ 1986.812844][T29929] SET target dimension over the limit! [ 1986.822291][T29932] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6262'. [ 1986.832353][T29932] netlink: 'syz.0.6262': attribute type 15 has an invalid length. [ 1986.847036][ T1125] netdevsim netdevsim0 netdevsim2: set [0, 1] type 1 family 0 port 256 - 0 [ 1986.857262][ T1125] netdevsim netdevsim0 netdevsim3: set [0, 1] type 1 family 0 port 256 - 0 [ 1986.890152][ T995] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 1986.924808][ T995] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1986.943983][ T995] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1986.955845][ T995] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 1986.956705][ T5801] libceph: connect (1)[c::]:6789 error -101 [ 1987.011830][ T5801] libceph: mon0 (1)[c::]:6789 connect error [ 1987.031946][T29890] ceph: No mds server is up or the cluster is laggy [ 1987.046337][ T995] usb 2-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 1987.061676][ T995] usb 2-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 1987.102905][ T995] usb 2-1: Manufacturer: syz [ 1987.133358][ T995] usb 2-1: config 0 descriptor?? [ 1987.587708][ T995] appleir 0003:05AC:8243.006A: unknown main item tag 0x0 [ 1987.657309][ T5853] usb 6-1: USB disconnect, device number 84 [ 1987.781730][ T995] appleir 0003:05AC:8243.006A: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.1-1/input0 [ 1987.870630][T24422] udevd[24422]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1987.915370][ T995] usb 2-1: USB disconnect, device number 102 [ 1988.231109][T29950] fido_id[29950]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 1988.306225][T29954] netlink: 48 bytes leftover after parsing attributes in process `syz.6.6268'. [ 1988.746481][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 1988.841231][ T995] usb 1-1: new high-speed USB device number 74 using dummy_hcd [ 1989.097744][T24847] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 1989.162231][ T995] usb 1-1: Using ep0 maxpacket: 16 [ 1989.487358][ T5853] usb 2-1: new full-speed USB device number 103 using dummy_hcd [ 1989.538028][ T995] usb 1-1: too many endpoints for config 0 interface 0 altsetting 14: 69, using maximum allowed: 30 [ 1989.556279][ T995] usb 1-1: config 0 interface 0 altsetting 14 has 0 endpoint descriptors, different from the interface descriptor's value: 69 [ 1989.570637][ T995] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1989.577827][ T995] usb 1-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 1989.579236][T24847] usb 3-1: Using ep0 maxpacket: 16 [ 1989.587942][ T995] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1989.647558][ T995] usb 1-1: config 0 descriptor?? [ 1989.674875][ T5853] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 11 [ 1989.685330][T24847] usb 3-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 1989.694791][ T5853] usb 2-1: config 1 interface 0 altsetting 3 endpoint 0xB has invalid wMaxPacketSize 0 [ 1989.704870][T24847] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1989.713046][ T5853] usb 2-1: config 1 interface 0 altsetting 3 endpoint 0x8A has invalid wMaxPacketSize 0 [ 1989.723294][T24847] usb 3-1: Product: syz [ 1989.727461][T24847] usb 3-1: Manufacturer: syz [ 1989.735686][ T5853] usb 2-1: config 1 interface 0 has no altsetting 0 [ 1989.743918][T24847] usb 3-1: SerialNumber: syz [ 1989.749645][ T5853] usb 2-1: New USB device found, idVendor=04e6, idProduct=0003, bcdDevice= 1.77 [ 1989.759452][ T5853] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1989.764071][ T995] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 1989.791266][ T5853] ums-sddr09 2-1:1.0: USB Mass Storage device detected [ 1990.004871][T24847] usb 3-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 1990.021226][ T5853] scsi host1: usb-storage 2-1:1.0 [ 1990.031630][T24847] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1990.055892][T24847] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 1990.067122][T24847] usb 3-1: media controller created [ 1990.091110][T24847] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1990.220015][T24847] zl10353_read_register: readreg error (reg=127, ret==-71) [ 1990.260997][T14378] usb 2-1: USB disconnect, device number 103 [ 1990.286488][T24847] dvb_usb_gl861 3-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 1990.302164][T24847] usb 3-1: USB disconnect, device number 94 [ 1990.411676][ T30] audit: type=1400 audit(1782685536.822:2241): avc: denied { ioctl } for pid=29983 comm="syz.5.6275" path="socket:[137948]" dev="sockfs" ino=137948 ioctlcmd=0xf50c scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1990.873852][ T5741] usb 6-1: new high-speed USB device number 85 using dummy_hcd [ 1990.935273][ T30] audit: type=1400 audit(1782685537.309:2242): avc: denied { setopt } for pid=29995 comm="syz.1.6281" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 1991.001320][T29999] netlink: 48 bytes leftover after parsing attributes in process `syz.2.6282'. [ 1991.027455][ T30] audit: type=1400 audit(1782685537.402:2243): avc: denied { append } for pid=30000 comm="syz.1.6283" name="frontend0" dev="devtmpfs" ino=929 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 1991.055215][ T5741] usb 6-1: Using ep0 maxpacket: 16 [ 1991.063207][ T5741] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1991.072379][ T5741] usb 6-1: config 9 has an invalid interface number: 42 but max is 0 [ 1991.084361][ T5741] usb 6-1: config 9 has no interface number 0 [ 1991.092116][ T5741] usb 6-1: config 9 interface 42 has no altsetting 0 [ 1991.129991][ T5741] usb 6-1: New USB device found, idVendor=15c2, idProduct=0041, bcdDevice=39.52 [ 1991.141166][ T5741] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1991.153738][ T5741] usb 6-1: Product: syz [ 1991.159094][ T5741] usb 6-1: Manufacturer: syz [ 1991.166275][ T5741] usb 6-1: SerialNumber: syz [ 1991.530172][T29988] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1991.573332][T29988] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1991.867274][ T995] gspca_sonixj: reg_r err -32 [ 1991.877117][ T995] sonixj 1-1:0.0: probe with driver sonixj failed with error -32 [ 1992.395286][ T30] audit: type=1400 audit(1782685538.684:2244): avc: denied { bind } for pid=30016 comm="syz.1.6287" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1992.434538][ T30] audit: type=1400 audit(1782685538.684:2245): avc: denied { listen } for pid=30016 comm="syz.1.6287" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1992.472637][ T30] audit: type=1400 audit(1782685538.684:2246): avc: denied { connect } for pid=30016 comm="syz.1.6287" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1992.513877][ T30] audit: type=1400 audit(1782685538.684:2247): avc: denied { write } for pid=30016 comm="syz.1.6287" path="socket:[137046]" dev="sockfs" ino=137046 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1992.560664][ T30] audit: type=1400 audit(1782685538.684:2248): avc: denied { accept } for pid=30016 comm="syz.1.6287" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1992.595446][ T30] audit: type=1400 audit(1782685538.684:2249): avc: denied { read } for pid=30016 comm="syz.1.6287" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1992.637965][ T5741] imon 6-1:9.42: unable to register, err -19 [ 1992.660524][ T5741] usb 6-1: USB disconnect, device number 85 [ 1992.967522][T24847] usb 1-1: USB disconnect, device number 74 [ 1992.978496][T14378] usb 3-1: new full-speed USB device number 95 using dummy_hcd [ 1993.612943][T14378] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1993.992844][T14378] usb 3-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 1994.002665][T14378] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1994.010944][T14378] usb 3-1: Product: syz [ 1994.015206][T14378] usb 3-1: Manufacturer: syz [ 1994.020144][T14378] usb 3-1: SerialNumber: syz [ 1994.029332][T14378] usb 3-1: config 0 descriptor?? [ 1994.041961][T14378] CoreChips 3-1:0.0: probe with driver CoreChips failed with error -22 [ 1994.227548][T30040] loop4: detected capacity change from 0 to 7 [ 1994.284898][T30040] Dev loop4: unable to read RDB block 7 [ 1994.357142][T30040] loop4: unable to read partition table [ 1994.373499][T30040] loop4: partition table beyond EOD, truncated [ 1994.398812][T30040] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾x³˜CÖ) failed (rc=-5) [ 1994.570512][T30040] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6292'. [ 1994.717527][T30040] SET target dimension over the limit! [ 1994.972257][T30059] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6297'. [ 1994.988564][T30059] SET target dimension over the limit! [ 1996.557048][T30065] orangefs_mount: mount request failed with -4 [ 1996.829174][ T5741] usb 3-1: USB disconnect, device number 95 [ 1997.537177][T30081] netlink: 12 bytes leftover after parsing attributes in process `syz.6.6305'. [ 1997.598545][T14378] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 1997.772432][T30090] lo speed is unknown, defaulting to 1000 [ 1998.140825][T30090] wlan0 speed is unknown, defaulting to 1000 [ 1998.150401][T30090] wg0 speed is unknown, defaulting to 1000 [ 1998.170606][T14378] usb 2-1: Using ep0 maxpacket: 16 [ 1998.188244][T14378] usb 2-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 1998.197811][T14378] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1998.216908][T14378] usb 2-1: Product: syz [ 1998.222038][T14378] usb 2-1: Manufacturer: syz [ 1998.226654][T14378] usb 2-1: SerialNumber: syz [ 1998.261942][T30093] lo speed is unknown, defaulting to 1000 [ 1998.369131][T30093] wlan0 speed is unknown, defaulting to 1000 [ 1998.376330][T30093] wg0 speed is unknown, defaulting to 1000 [ 1998.707074][T14378] usb 2-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 1998.767751][T14378] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1998.807134][T14378] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 1998.828790][T14378] usb 2-1: media controller created [ 1998.868089][T14378] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1998.960344][T30102] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=30102 comm=syz.6.6311 [ 1999.049676][T30100] loop5: detected capacity change from 0 to 6 [ 1999.069261][T14378] zl10353_read_register: readreg error (reg=127, ret==-71) [ 1999.080126][T30100] Dev loop5: unable to read RDB block 6 [ 1999.110110][T30103] netlink: 20 bytes leftover after parsing attributes in process `syz.5.6310'. [ 1999.143743][T30100] loop5: unable to read partition table [ 1999.157302][T30100] loop5: partition table beyond EOD, truncated [ 1999.167722][T14378] dvb_usb_gl861 2-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 1999.179445][T30100] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1999.230001][T14378] usb 2-1: USB disconnect, device number 104 [ 1999.387898][T30109] lo speed is unknown, defaulting to 1000 [ 2002.179023][T30136] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6318'. [ 2003.458609][T30146] xt_hashlimit: max too large, truncated to 1048576 [ 2003.503418][ T30] audit: type=1400 audit(1782685549.076:2250): avc: denied { getopt } for pid=30145 comm="syz.2.6321" lport=49591 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 2004.279650][T30158] netlink: 36 bytes leftover after parsing attributes in process `syz.5.6326'. [ 2004.439533][T14378] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 2004.611437][T14378] usb 3-1: Using ep0 maxpacket: 16 [ 2005.130011][T14378] usb 3-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 2005.147725][T14378] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2005.155913][T14378] usb 3-1: Product: syz [ 2005.160134][T14378] usb 3-1: Manufacturer: syz [ 2005.164771][T14378] usb 3-1: SerialNumber: syz [ 2005.186788][T30153] lo speed is unknown, defaulting to 1000 [ 2005.210603][T30109] wlan0 speed is unknown, defaulting to 1000 [ 2005.237688][T30109] wg0 speed is unknown, defaulting to 1000 [ 2005.406675][T14378] usb 3-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 2005.498703][T14378] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 2005.544871][T14378] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 2005.574774][T14378] usb 3-1: media controller created [ 2005.630763][T14378] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2005.671308][ T30] audit: type=1400 audit(1782685551.106:2251): avc: denied { setopt } for pid=30175 comm="syz.6.6332" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 2005.711515][T30181] netlink: 20 bytes leftover after parsing attributes in process `syz.5.6333'. [ 2005.756015][ T30] audit: type=1400 audit(1782685551.124:2252): avc: denied { connect } for pid=30175 comm="syz.6.6332" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 2005.787369][T14378] zl10353_read_register: readreg error (reg=127, ret==-71) [ 2005.865128][T14378] dvb_usb_gl861 3-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 2005.897675][T14378] usb 3-1: USB disconnect, device number 96 [ 2006.040302][T30185] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_hsr, syncid = 4, id = 0 [ 2006.097015][T30153] wlan0 speed is unknown, defaulting to 1000 [ 2006.119958][T30153] wg0 speed is unknown, defaulting to 1000 [ 2006.409767][T30189] FAULT_INJECTION: forcing a failure. [ 2006.409767][T30189] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2006.423254][T30189] CPU: 0 UID: 0 PID: 30189 Comm: syz.2.6334 Tainted: G L syzkaller #0 PREEMPT(full) [ 2006.423283][T30189] Tainted: [L]=SOFTLOCKUP [ 2006.423289][T30189] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2006.423299][T30189] Call Trace: [ 2006.423306][T30189] [ 2006.423312][T30189] dump_stack_lvl+0x100/0x190 [ 2006.423341][T30189] should_fail_ex.cold+0x5/0xa [ 2006.423361][T30189] ? prepare_alloc_pages+0x16d/0x5f0 [ 2006.423387][T30189] should_fail_alloc_page+0xeb/0x140 [ 2006.423411][T30189] prepare_alloc_pages+0x1f0/0x5f0 [ 2006.423438][T30189] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 2006.423461][T30189] ? rcu_is_watching+0x12/0xc0 [ 2006.423488][T30189] ? trace_mm_page_alloc+0x164/0x1c0 [ 2006.423511][T30189] ? __alloc_frozen_pages_noprof+0x2d1/0x2dc0 [ 2006.423533][T30189] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 2006.423553][T30189] ? is_bpf_text_address+0x8a/0x1a0 [ 2006.423577][T30189] ? bpf_ksym_find+0x128/0x1c0 [ 2006.423602][T30189] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 2006.423623][T30189] ? is_bpf_text_address+0x94/0x1a0 [ 2006.423646][T30189] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 2006.423664][T30189] ? __kernel_text_address+0xd/0x30 [ 2006.423700][T30189] alloc_pages_bulk_noprof+0x5de/0x13c0 [ 2006.423725][T30189] ? policy_nodemask+0xed/0x4f0 [ 2006.423750][T30189] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 2006.423786][T30189] __kasan_populate_vmalloc+0xf0/0x210 [ 2006.423811][T30189] alloc_vmap_area+0x95d/0x2bb0 [ 2006.423839][T30189] ? kasan_save_track+0x14/0x30 [ 2006.423858][T30189] ? __kasan_kmalloc+0xaa/0xb0 [ 2006.423877][T30189] ? __pfx_alloc_vmap_area+0x10/0x10 [ 2006.423899][T30189] ? __get_vm_area_node+0x101/0x330 [ 2006.423924][T30189] __get_vm_area_node+0x1ca/0x330 [ 2006.423951][T30189] __vmalloc_node_range_noprof+0x228/0x1630 [ 2006.423976][T30189] ? bpf_prog_alloc_no_stats+0x59/0x630 [ 2006.423997][T30189] ? find_held_lock+0x2b/0x80 [ 2006.424016][T30189] ? __lock_acquire+0x49f/0x1a40 [ 2006.424039][T30189] ? bpf_prog_alloc_no_stats+0x59/0x630 [ 2006.424067][T30189] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 2006.424091][T30189] ? find_held_lock+0x2b/0x80 [ 2006.424106][T30189] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 2006.424124][T30189] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 2006.424147][T30189] ? avc_has_perm_noaudit+0x145/0x3b0 [ 2006.424166][T30189] ? bpf_prog_alloc_no_stats+0x59/0x630 [ 2006.424187][T30189] __vmalloc_node_noprof+0xad/0xf0 [ 2006.424211][T30189] ? bpf_prog_alloc_no_stats+0x59/0x630 [ 2006.424235][T30189] __vmalloc_noprof+0xa3/0x120 [ 2006.424258][T30189] ? __pfx___vmalloc_noprof+0x10/0x10 [ 2006.424285][T30189] ? rcu_is_watching+0x12/0xc0 [ 2006.424309][T30189] ? cap_capable+0x107/0x430 [ 2006.424330][T30189] bpf_prog_alloc_no_stats+0x59/0x630 [ 2006.424351][T30189] ? security_capable+0x80/0x260 [ 2006.424374][T30189] bpf_prog_alloc+0x3b/0x200 [ 2006.424394][T30189] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 2006.424416][T30189] bpf_prog_load+0x4a9/0x2fa0 [ 2006.424438][T30189] ? __pfx_bpf_prog_load+0x10/0x10 [ 2006.424456][T30189] ? avc_has_perm_noaudit+0x145/0x3b0 [ 2006.424496][T30189] __sys_bpf+0x18dc/0x4e80 [ 2006.424520][T30189] ? __pfx___sys_bpf+0x10/0x10 [ 2006.424537][T30189] ? find_held_lock+0x2b/0x80 [ 2006.424553][T30189] ? get_pid_task+0xfc/0x250 [ 2006.424568][T30189] ? get_pid_task+0xfc/0x250 [ 2006.424591][T30189] ? find_held_lock+0x2b/0x80 [ 2006.424612][T30189] ? rcu_read_lock_any_held+0x6a/0xa0 [ 2006.424629][T30189] ? find_held_lock+0x2b/0x80 [ 2006.424644][T30189] ? ksys_write+0x190/0x250 [ 2006.424659][T30189] ? ksys_write+0x190/0x250 [ 2006.424691][T30189] ? fput+0x79/0x100 [ 2006.424714][T30189] ? __x64_sys_bpf+0xce/0x140 [ 2006.424732][T30189] __x64_sys_bpf+0xce/0x140 [ 2006.424750][T30189] ? do_syscall_64+0x90/0x870 [ 2006.424780][T30189] do_syscall_64+0x115/0x870 [ 2006.424803][T30189] ? clear_bhb_loop+0x40/0x90 [ 2006.424824][T30189] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2006.424841][T30189] RIP: 0033:0x7fc08019ce59 [ 2006.424856][T30189] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2006.424872][T30189] RSP: 002b:00007fc0810b8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2006.424889][T30189] RAX: ffffffffffffffda RBX: 00007fc080416180 RCX: 00007fc08019ce59 [ 2006.424900][T30189] RDX: 0000000000000048 RSI: 0000200000000200 RDI: 0000000000000005 [ 2006.424910][T30189] RBP: 00007fc0810b8090 R08: 0000000000000000 R09: 0000000000000000 [ 2006.424920][T30189] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2006.424930][T30189] R13: 00007fc080416218 R14: 00007fc080416180 R15: 00007ffe38ddca68 [ 2006.424955][T30189] [ 2006.425144][T30189] syz.2.6334: vmalloc error: size 4096, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=syz2,mems_allowed=0-1 [ 2006.911629][T30189] CPU: 0 UID: 0 PID: 30189 Comm: syz.2.6334 Tainted: G L syzkaller #0 PREEMPT(full) [ 2006.911653][T30189] Tainted: [L]=SOFTLOCKUP [ 2006.911659][T30189] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2006.911670][T30189] Call Trace: [ 2006.911676][T30189] [ 2006.911682][T30189] dump_stack_lvl+0x100/0x190 [ 2006.911710][T30189] warn_alloc.cold+0x94/0xa8 [ 2006.911729][T30189] ? __pfx_warn_alloc+0x10/0x10 [ 2006.911747][T30189] ? lockdep_hardirqs_on+0x78/0x100 [ 2006.911778][T30189] ? __get_vm_area_node+0x2cd/0x330 [ 2006.911804][T30189] ? __get_vm_area_node+0x208/0x330 [ 2006.911829][T30189] __vmalloc_node_range_noprof+0xccd/0x1630 [ 2006.911854][T30189] ? find_held_lock+0x2b/0x80 [ 2006.911872][T30189] ? __lock_acquire+0x49f/0x1a40 [ 2006.911895][T30189] ? bpf_prog_alloc_no_stats+0x59/0x630 [ 2006.911927][T30189] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 2006.911952][T30189] ? find_held_lock+0x2b/0x80 [ 2006.911969][T30189] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 2006.911989][T30189] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 2006.912013][T30189] ? avc_has_perm_noaudit+0x145/0x3b0 [ 2006.912035][T30189] ? bpf_prog_alloc_no_stats+0x59/0x630 [ 2006.912057][T30189] __vmalloc_node_noprof+0xad/0xf0 [ 2006.912082][T30189] ? bpf_prog_alloc_no_stats+0x59/0x630 [ 2006.912108][T30189] __vmalloc_noprof+0xa3/0x120 [ 2006.912132][T30189] ? __pfx___vmalloc_noprof+0x10/0x10 [ 2006.912158][T30189] ? rcu_is_watching+0x12/0xc0 [ 2006.912184][T30189] ? cap_capable+0x107/0x430 [ 2006.912208][T30189] bpf_prog_alloc_no_stats+0x59/0x630 [ 2006.912229][T30189] ? security_capable+0x80/0x260 [ 2006.912252][T30189] bpf_prog_alloc+0x3b/0x200 [ 2006.912272][T30189] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 2006.912296][T30189] bpf_prog_load+0x4a9/0x2fa0 [ 2006.912320][T30189] ? __pfx_bpf_prog_load+0x10/0x10 [ 2006.912338][T30189] ? avc_has_perm_noaudit+0x145/0x3b0 [ 2006.912380][T30189] __sys_bpf+0x18dc/0x4e80 [ 2006.912405][T30189] ? __pfx___sys_bpf+0x10/0x10 [ 2006.912424][T30189] ? find_held_lock+0x2b/0x80 [ 2006.912439][T30189] ? get_pid_task+0xfc/0x250 [ 2006.912456][T30189] ? get_pid_task+0xfc/0x250 [ 2006.912480][T30189] ? find_held_lock+0x2b/0x80 [ 2006.912503][T30189] ? rcu_read_lock_any_held+0x6a/0xa0 [ 2006.912520][T30189] ? find_held_lock+0x2b/0x80 [ 2006.912536][T30189] ? ksys_write+0x190/0x250 [ 2006.912552][T30189] ? ksys_write+0x190/0x250 [ 2006.912585][T30189] ? fput+0x79/0x100 [ 2006.912608][T30189] ? __x64_sys_bpf+0xce/0x140 [ 2006.912625][T30189] __x64_sys_bpf+0xce/0x140 [ 2006.912643][T30189] ? do_syscall_64+0x90/0x870 [ 2006.912668][T30189] do_syscall_64+0x115/0x870 [ 2006.912690][T30189] ? clear_bhb_loop+0x40/0x90 [ 2006.912710][T30189] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2006.912728][T30189] RIP: 0033:0x7fc08019ce59 [ 2006.912744][T30189] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2006.912761][T30189] RSP: 002b:00007fc0810b8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2006.912785][T30189] RAX: ffffffffffffffda RBX: 00007fc080416180 RCX: 00007fc08019ce59 [ 2006.912797][T30189] RDX: 0000000000000048 RSI: 0000200000000200 RDI: 0000000000000005 [ 2006.912808][T30189] RBP: 00007fc0810b8090 R08: 0000000000000000 R09: 0000000000000000 [ 2006.912818][T30189] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2006.912829][T30189] R13: 00007fc080416218 R14: 00007fc080416180 R15: 00007ffe38ddca68 [ 2006.912854][T30189] [ 2006.912883][T30189] Mem-Info: [ 2007.262016][T30189] active_anon:47936 inactive_anon:0 isolated_anon:0 [ 2007.262016][T30189] active_file:41 inactive_file:65810 isolated_file:0 [ 2007.262016][T30189] unevictable:768 dirty:435 writeback:0 [ 2007.262016][T30189] slab_reclaimable:8851 slab_unreclaimable:118128 [ 2007.262016][T30189] mapped:45533 shmem:35736 pagetables:1892 [ 2007.262016][T30189] sec_pagetables:0 bounce:0 [ 2007.262016][T30189] kernel_misc_reclaimable:0 [ 2007.262016][T30189] free:1206620 free_pcp:8011 free_cma:0 [ 2007.309067][T30189] Node 0 active_anon:191744kB inactive_anon:0kB active_file:164kB inactive_file:263036kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:182132kB dirty:1736kB writeback:0kB shmem:141408kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:15272kB pagetables:7444kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 2007.344300][T30189] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:124kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 2007.377494][T30189] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2007.408401][T30189] lowmem_reserve[]: 0 2475 2476 2476 2476 [ 2007.415358][T30189] Node 0 DMA32 free:876256kB boost:0kB min:34036kB low:42544kB high:51052kB reserved_highatomic:0KB free_highatomic:0KB active_anon:191788kB inactive_anon:0kB active_file:164kB inactive_file:263036kB unevictable:1536kB writepending:1736kB zspages:0kB present:3129332kB managed:2535236kB mlocked:0kB bounce:0kB free_pcp:32100kB local_pcp:14052kB free_cma:0kB [ 2007.449130][T30189] lowmem_reserve[]: 0 0 0 0 0 [ 2007.453929][T30189] Node 0 Normal free:8kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:764kB mlocked:0kB bounce:0kB free_pcp:24kB local_pcp:12kB free_cma:0kB [ 2007.483977][T30189] lowmem_reserve[]: 0 0 0 0 0 [ 2007.488852][T30189] Node 1 Normal free:3934856kB boost:0kB min:55852kB low:69812kB high:83772kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2007.520943][T30189] lowmem_reserve[]: 0 0 0 0 0 [ 2007.526502][T30189] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 2007.539402][T30189] Node 0 DMA32: 3*4kB (UE) 1609*8kB (ME) 2621*16kB (UME) 1416*32kB (UME) 910*64kB (UME) 468*128kB (UME) 222*256kB (UME) 60*512kB (UME) 33*1024kB (UME) 12*2048kB (UME) 125*4096kB (UM) = 876196kB [ 2007.559258][T30189] Node 0 Normal: 2*4kB (U) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 8kB [ 2007.571354][T30189] Node 1 Normal: 2*4kB (UM) 2*8kB (UM) 7*16kB (UM) 4*32kB (UM) 8*64kB (UM) 3*128kB (UM) 4*256kB (UM) 3*512kB (UM) 1*1024kB (M) 1*2048kB (U) 959*4096kB (UM) = 3934856kB [ 2007.588940][T30189] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2007.598551][T30189] Node 0 hugepages_total=4 hugepages_free=2 hugepages_surp=2 hugepages_size=2048kB [ 2007.608008][T30189] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2007.618075][T30189] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2007.627417][T30189] 101583 total pagecache pages [ 2007.632663][T30189] 0 pages in swap cache [ 2007.637175][T30189] Free swap = 124996kB [ 2007.641323][T30189] Total swap = 124996kB [ 2007.645489][T30189] 2097051 pages RAM [ 2007.649812][T30189] 0 pages HighMem/MovableOnly [ 2007.654484][T30189] 431436 pages reserved [ 2007.658754][T30189] 0 pages cma reserved [ 2008.065194][T30183] lo speed is unknown, defaulting to 1000 [ 2008.297337][ T30] audit: type=1400 audit(1782685553.547:2253): avc: denied { create } for pid=30193 comm="syz.2.6336" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 2008.337026][ T30] audit: type=1400 audit(1782685553.585:2254): avc: denied { read write } for pid=30193 comm="syz.2.6336" name="ppp" dev="devtmpfs" ino=710 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 2008.376464][ T30] audit: type=1400 audit(1782685553.585:2255): avc: denied { open } for pid=30193 comm="syz.2.6336" path="/dev/ppp" dev="devtmpfs" ino=710 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 2008.404365][ T30] audit: type=1400 audit(1782685553.585:2256): avc: denied { ioctl } for pid=30193 comm="syz.2.6336" path="/dev/ppp" dev="devtmpfs" ino=710 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 2008.472082][T30183] wlan0 speed is unknown, defaulting to 1000 [ 2008.570166][T30183] wg0 speed is unknown, defaulting to 1000 [ 2008.736363][ T5853] usb 6-1: new full-speed USB device number 86 using dummy_hcd [ 2008.757866][T30201] binder: 30200:30201 ioctl 4018620d 0 returned -22 [ 2008.824045][T30202] openvswitch: netlink: Key 0 has unexpected len 4 expected 0 [ 2008.898862][ T5853] usb 6-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 2008.926973][ T5853] usb 6-1: config 1 interface 0 has no altsetting 0 [ 2008.955836][ T5853] usb 6-1: string descriptor 0 read error: -22 [ 2008.973231][ T5853] usb 6-1: New USB device found, idVendor=046d, idProduct=c288, bcdDevice= 0.40 [ 2008.986681][T30205] netlink: 8 bytes leftover after parsing attributes in process `syz.6.6340'. [ 2008.999166][ T5853] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2009.021130][ T5853] usbhid 6-1:1.0: couldn't find an input interrupt endpoint [ 2009.107196][T30201] lo speed is unknown, defaulting to 1000 [ 2009.318828][T30207] netlink: 12 bytes leftover after parsing attributes in process `syz.6.6341'. [ 2009.464572][T30209] SELinux: Context system_u:object_r:hwdata_t:s0 is not valid (left unmapped). [ 2009.514834][ T30] audit: type=1400 audit(1782685554.660:2257): avc: denied { relabelto } for pid=30196 comm="syz.5.6337" name="566" dev="tmpfs" ino=2969 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:hwdata_t:s0" [ 2009.675799][ T30] audit: type=1400 audit(1782685554.660:2258): avc: denied { associate } for pid=30196 comm="syz.5.6337" name="566" dev="tmpfs" ino=2969 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:hwdata_t:s0" [ 2010.099047][T24847] usb 6-1: USB disconnect, device number 86 [ 2010.560060][T30221] FAULT_INJECTION: forcing a failure. [ 2010.560060][T30221] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2010.573144][T30201] wlan0 speed is unknown, defaulting to 1000 [ 2010.581596][T30201] wg0 speed is unknown, defaulting to 1000 [ 2010.582236][T30221] CPU: 1 UID: 0 PID: 30221 Comm: syz.1.6346 Tainted: G L syzkaller #0 PREEMPT(full) [ 2010.582262][T30221] Tainted: [L]=SOFTLOCKUP [ 2010.582267][T30221] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2010.582277][T30221] Call Trace: [ 2010.582283][T30221] [ 2010.582289][T30221] dump_stack_lvl+0x100/0x190 [ 2010.582316][T30221] should_fail_ex.cold+0x5/0xa [ 2010.582339][T30221] _copy_to_user+0x32/0xd0 [ 2010.582361][T30221] simple_read_from_buffer+0xcb/0x170 [ 2010.582380][T30221] proc_fail_nth_read+0x1af/0x230 [ 2010.582404][T30221] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2010.582428][T30221] ? rw_verify_area+0xce/0x6d0 [ 2010.582449][T30221] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2010.582471][T30221] vfs_read+0x1e4/0xb40 [ 2010.582496][T30221] ? __pfx_vfs_read+0x10/0x10 [ 2010.582518][T30221] ? __fget_files+0x215/0x3d0 [ 2010.582539][T30221] ? __fget_files+0x21f/0x3d0 [ 2010.582560][T30221] ksys_read+0x12a/0x250 [ 2010.582582][T30221] ? __pfx_ksys_read+0x10/0x10 [ 2010.582604][T30221] ? v4l2_ioctl+0x1c5/0x250 [ 2010.582628][T30221] do_syscall_64+0x115/0x870 [ 2010.582650][T30221] ? clear_bhb_loop+0x40/0x90 [ 2010.582669][T30221] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2010.582685][T30221] RIP: 0033:0x7efc0f95d68e [ 2010.582699][T30221] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2010.582714][T30221] RSP: 002b:00007efc10842fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2010.582730][T30221] RAX: ffffffffffffffda RBX: 00007efc108436c0 RCX: 00007efc0f95d68e [ 2010.582741][T30221] RDX: 000000000000000f RSI: 00007efc108430a0 RDI: 0000000000000004 [ 2010.582750][T30221] RBP: 00007efc10843090 R08: 0000000000000000 R09: 0000000000000000 [ 2010.582759][T30221] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2010.582769][T30221] R13: 00007efc0fc16038 R14: 00007efc0fc15fa0 R15: 00007ffcf04fa9c8 [ 2010.582791][T30221] [ 2011.081082][T14378] usb 1-1: new high-speed USB device number 75 using dummy_hcd [ 2011.108851][ T30] audit: type=1400 audit(1782685556.176:2259): avc: denied { write } for pid=30225 comm="syz.1.6348" name="sg0" dev="devtmpfs" ino=816 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 2011.341524][ T30] audit: type=1400 audit(1782685556.400:2260): avc: denied { map } for pid=30225 comm="syz.1.6348" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 2011.463143][T14378] usb 1-1: Using ep0 maxpacket: 16 [ 2011.502035][T14378] usb 1-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 2011.544706][T14378] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2011.564029][T14378] usb 1-1: Product: syz [ 2011.568423][T14378] usb 1-1: Manufacturer: syz [ 2011.590738][T14378] usb 1-1: SerialNumber: syz [ 2012.313791][T30238] FAULT_INJECTION: forcing a failure. [ 2012.313791][T30238] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2012.327531][T30238] CPU: 0 UID: 0 PID: 30238 Comm: syz.5.6351 Tainted: G L syzkaller #0 PREEMPT(full) [ 2012.327563][T30238] Tainted: [L]=SOFTLOCKUP [ 2012.327570][T30238] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2012.327580][T30238] Call Trace: [ 2012.327588][T30238] [ 2012.327595][T30238] dump_stack_lvl+0x100/0x190 [ 2012.327622][T30238] should_fail_ex.cold+0x5/0xa [ 2012.327649][T30238] _copy_from_user+0x2e/0xd0 [ 2012.327671][T30238] generic_map_update_batch+0x4bb/0x800 [ 2012.327696][T30238] ? __pfx_generic_map_update_batch+0x10/0x10 [ 2012.327718][T30238] ? __pfx_generic_map_update_batch+0x10/0x10 [ 2012.327736][T30238] bpf_map_do_batch+0x66f/0x6d0 [ 2012.327761][T30238] __sys_bpf+0x4ce/0x4e80 [ 2012.327778][T30238] ? mark_held_locks+0x40/0x70 [ 2012.327805][T30238] ? __pfx___sys_bpf+0x10/0x10 [ 2012.327821][T30238] ? __rcu_read_unlock+0x26a/0x5e0 [ 2012.327843][T30238] ? rcu_is_watching+0x12/0xc0 [ 2012.327870][T30238] ? __rcu_read_unlock+0x27f/0x5e0 [ 2012.327897][T30238] ? find_held_lock+0x2b/0x80 [ 2012.327918][T30238] ? rcu_read_lock_any_held+0x6a/0xa0 [ 2012.327935][T30238] ? find_held_lock+0x2b/0x80 [ 2012.327950][T30238] ? ksys_write+0x190/0x250 [ 2012.327965][T30238] ? ksys_write+0x190/0x250 [ 2012.327997][T30238] ? fput+0x79/0x100 [ 2012.328021][T30238] ? __x64_sys_bpf+0xce/0x140 [ 2012.328037][T30238] __x64_sys_bpf+0xce/0x140 [ 2012.328056][T30238] ? do_syscall_64+0x90/0x870 [ 2012.328082][T30238] do_syscall_64+0x115/0x870 [ 2012.328105][T30238] ? clear_bhb_loop+0x40/0x90 [ 2012.328126][T30238] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2012.328143][T30238] RIP: 0033:0x7f19b699ce59 [ 2012.328162][T30238] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2012.328178][T30238] RSP: 002b:00007f19b7884028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2012.328195][T30238] RAX: ffffffffffffffda RBX: 00007f19b6c16090 RCX: 00007f19b699ce59 [ 2012.328206][T30238] RDX: 0000000000000038 RSI: 0000200000000200 RDI: 000000000000001a [ 2012.328216][T30238] RBP: 00007f19b7884090 R08: 0000000000000000 R09: 0000000000000000 [ 2012.328227][T30238] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2012.328236][T30238] R13: 00007f19b6c16128 R14: 00007f19b6c16090 R15: 00007ffd678c1398 [ 2012.328260][T30238] [ 2013.334630][T14378] usb 1-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 2013.526984][T14378] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 2013.538529][T14378] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 2013.574012][T14378] usb 1-1: media controller created [ 2013.612753][T14378] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2013.696036][T14378] zl10353_read_register: readreg error (reg=127, ret==-71) [ 2013.715349][T14378] dvb_usb_gl861 1-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 2013.737401][T14378] usb 1-1: USB disconnect, device number 75 [ 2015.907768][T30251] fuse: Bad value for 'fd' [ 2017.377511][ T30] audit: type=1400 audit(1782685561.835:2261): avc: denied { map } for pid=30258 comm="syz.0.6359" path="/543/file0" dev="tmpfs" ino=2876 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 2017.491466][T30263] lo speed is unknown, defaulting to 1000 [ 2018.705571][ T4929] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 2018.730624][ T4929] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 2018.738726][ T4929] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 2018.749359][ T4929] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 2018.757691][ T4929] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 2018.803748][ T30] audit: type=1400 audit(1782685563.378:2262): avc: denied { mounton } for pid=30282 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 2018.871990][T30263] wlan0 speed is unknown, defaulting to 1000 [ 2018.878614][T30263] wg0 speed is unknown, defaulting to 1000 [ 2019.710294][T30282] lo speed is unknown, defaulting to 1000 [ 2020.010198][T30304] loop4: detected capacity change from 0 to 7 [ 2020.069116][T30305] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6366'. [ 2020.106212][T30304] Dev loop4: unable to read RDB block 7 [ 2020.113042][T30304] loop4: unable to read partition table [ 2020.119148][T30304] loop4: partition table beyond EOD, truncated [ 2020.125547][T30304] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾x³˜CÖ) failed (rc=-5) [ 2020.748745][ T30] audit: type=1400 audit(1782685565.202:2263): avc: denied { read write } for pid=30306 comm="syz.5.6367" name="usbmon7" dev="devtmpfs" ino=738 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 2020.786891][T30282] wlan0 speed is unknown, defaulting to 1000 [ 2020.834793][ T30] audit: type=1400 audit(1782685565.202:2264): avc: denied { open } for pid=30306 comm="syz.5.6367" path="/dev/usbmon7" dev="devtmpfs" ino=738 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 2020.874933][T30282] wg0 speed is unknown, defaulting to 1000 [ 2020.987987][ T4929] Bluetooth: hci1: command tx timeout [ 2022.274215][T30312] netlink: 48 bytes leftover after parsing attributes in process `syz.5.6367'. [ 2022.432360][T30319] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.6369'. [ 2022.484520][T30319] openvswitch: netlink: Message has 512 unknown bytes. [ 2022.566176][T30326] binder: BINDER_SET_CONTEXT_MGR already set [ 2022.590728][T30326] binder: 30325:30326 ioctl 4018620d 200000000240 returned -16 [ 2022.601969][T30327] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 2022.814624][ T30] audit: type=1400 audit(1782685567.129:2265): avc: denied { write } for pid=30335 comm="syz.5.6375" name="binder0" dev="binder" ino=19 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 2022.819287][T30336] binder: BINDER_SET_CONTEXT_MGR already set [ 2022.866105][T30336] binder: 30335:30336 ioctl 4018620d 200000004a80 returned -16 [ 2023.017131][T30282] bridge0: port 1(bridge_slave_0) entered blocking state [ 2023.086266][T30282] bridge0: port 1(bridge_slave_0) entered disabled state [ 2023.121160][T30282] bridge_slave_0: entered allmulticast mode [ 2023.134394][T30282] bridge_slave_0: entered promiscuous mode [ 2023.158325][T30282] bridge0: port 2(bridge_slave_1) entered blocking state [ 2023.222256][ T4929] Bluetooth: hci1: command tx timeout [ 2023.722936][T30282] bridge0: port 2(bridge_slave_1) entered disabled state [ 2024.100250][T30282] bridge_slave_1: entered allmulticast mode [ 2024.129799][T30282] bridge_slave_1: entered promiscuous mode [ 2024.271539][T30282] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2025.119696][T30282] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2025.164814][T30351] fuse: Bad value for 'fd' [ 2025.207301][T30282] team0: Port device team_slave_0 added [ 2025.217716][T30282] team0: Port device team_slave_1 added [ 2025.267174][T30282] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2025.274133][T30282] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2025.310358][T30282] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2025.383025][T30282] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2025.390627][T30282] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2025.416505][T30282] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2025.465923][ T4929] Bluetooth: hci1: command tx timeout [ 2025.614276][T30282] hsr_slave_0: entered promiscuous mode [ 2025.625518][T30282] hsr_slave_1: entered promiscuous mode [ 2025.636252][T30282] debugfs: 'hsr0' already exists in 'hsr' [ 2025.645454][T30282] Cannot create hsr debugfs directory [ 2025.656726][T30369] netlink: 8 bytes leftover after parsing attributes in process `syz.6.6384'. [ 2025.670361][T20927] usb 2-1: new high-speed USB device number 105 using dummy_hcd [ 2025.697329][T30369] SET target dimension over the limit! [ 2025.734589][T30371] netlink: 48 bytes leftover after parsing attributes in process `syz.5.6385'. [ 2025.852399][T20927] usb 2-1: Using ep0 maxpacket: 8 [ 2026.298075][T20927] usb 2-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 2026.323617][T20927] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2026.361089][T20927] pvrusb2: Hardware description: Terratec Grabster AV400 [ 2026.368690][T20927] pvrusb2: ********** [ 2026.392093][T20927] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 2026.431157][T20927] pvrusb2: Important functionality might not be entirely working. [ 2026.441238][T30374] netlink: 20 bytes leftover after parsing attributes in process `syz.6.6386'. [ 2026.457855][T20927] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 2026.494424][T20927] pvrusb2: ********** [ 2026.599932][ T2366] pvrusb2: Invalid write control endpoint [ 2026.609667][T30282] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 2026.740169][ T2366] pvrusb2: Invalid write control endpoint [ 2026.752158][ T2366] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 2026.769412][T30382] loop4: detected capacity change from 0 to 7 [ 2026.770164][ T2366] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 2026.836763][T30382] Dev loop4: unable to read RDB block 7 [ 2026.864228][ T2366] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 2026.868362][T30383] netlink: 20 bytes leftover after parsing attributes in process `syz.5.6387'. [ 2026.902132][T30363] netlink: 'syz.1.6380': attribute type 21 has an invalid length. [ 2026.914802][ T2366] pvrusb2: Device being rendered inoperable [ 2026.916979][T30382] loop4: unable to read partition table [ 2026.930753][ T2366] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 2026.932480][T30363] netlink: 156 bytes leftover after parsing attributes in process `syz.1.6380'. [ 2026.941717][ T2366] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 2026.975617][T30382] loop4: partition table beyond EOD, truncated [ 2026.983182][ T2366] pvrusb2: Attached sub-driver cx25840 [ 2026.990312][T30382] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾x³˜CÖ) failed (rc=-5) [ 2026.994533][ T2366] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 2027.016897][ T2366] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 2027.094262][T14378] usb 2-1: USB disconnect, device number 105 [ 2027.114311][T30382] SET target dimension over the limit! [ 2027.680111][ T4929] Bluetooth: hci1: command tx timeout [ 2028.000417][T30282] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 2028.137133][T30396] FAULT_INJECTION: forcing a failure. [ 2028.137133][T30396] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2028.164893][T30396] CPU: 0 UID: 0 PID: 30396 Comm: syz.6.6391 Tainted: G L syzkaller #0 PREEMPT(full) [ 2028.164923][T30396] Tainted: [L]=SOFTLOCKUP [ 2028.164930][T30396] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2028.164940][T30396] Call Trace: [ 2028.164946][T30396] [ 2028.164959][T30396] dump_stack_lvl+0x100/0x190 [ 2028.164985][T30396] should_fail_ex.cold+0x5/0xa [ 2028.165008][T30396] _copy_from_user+0x2e/0xd0 [ 2028.165030][T30396] __sys_bpf+0x2f5/0x4e80 [ 2028.165056][T30396] ? __pfx___sys_bpf+0x10/0x10 [ 2028.165074][T30396] ? find_held_lock+0x2b/0x80 [ 2028.165090][T30396] ? get_pid_task+0xfc/0x250 [ 2028.165106][T30396] ? get_pid_task+0xfc/0x250 [ 2028.165129][T30396] ? find_held_lock+0x2b/0x80 [ 2028.165150][T30396] ? rcu_read_lock_any_held+0x6a/0xa0 [ 2028.165167][T30396] ? find_held_lock+0x2b/0x80 [ 2028.165183][T30396] ? ksys_write+0x190/0x250 [ 2028.165198][T30396] ? ksys_write+0x190/0x250 [ 2028.165231][T30396] ? fput+0x79/0x100 [ 2028.165255][T30396] ? __x64_sys_bpf+0xce/0x140 [ 2028.165273][T30396] __x64_sys_bpf+0xce/0x140 [ 2028.165292][T30396] ? do_syscall_64+0x90/0x870 [ 2028.165318][T30396] do_syscall_64+0x115/0x870 [ 2028.165347][T30396] ? clear_bhb_loop+0x40/0x90 [ 2028.165369][T30396] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2028.165387][T30396] RIP: 0033:0x7f4f2c39ce59 [ 2028.165401][T30396] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2028.165418][T30396] RSP: 002b:00007f4f2d2a0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2028.165436][T30396] RAX: ffffffffffffffda RBX: 00007f4f2c615fa0 RCX: 00007f4f2c39ce59 [ 2028.165448][T30396] RDX: 0000000000000040 RSI: 00002000000005c0 RDI: 000000000000001c [ 2028.165458][T30396] RBP: 00007f4f2d2a0090 R08: 0000000000000000 R09: 0000000000000000 [ 2028.165467][T30396] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2028.165477][T30396] R13: 00007f4f2c616038 R14: 00007f4f2c615fa0 R15: 00007ffe4f6edf88 [ 2028.165500][T30396] [ 2028.169685][T30282] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 2028.516111][T24847] bridge0: entered promiscuous mode [ 2028.668361][T30282] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 2028.894816][T30411] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 2028.994014][T30414] fuse: Bad value for 'fd' [ 2029.586379][T30282] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 2029.640721][T30282] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 2029.680375][T30282] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 2029.705257][T30282] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 2029.732984][T30282] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 2029.759803][T30282] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 2029.782839][T30282] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 2029.815716][T30282] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 2030.020962][T30420] orangefs_mount: mount request failed with -4 [ 2030.521322][T30282] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2031.417021][T30282] 8021q: adding VLAN 0 to HW filter on device team0 [ 2031.473887][T30282] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 2031.504323][T30282] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 2031.562545][T27021] bridge0: port 1(bridge_slave_0) entered blocking state [ 2031.569680][T27021] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2031.612331][T27021] bridge0: port 2(bridge_slave_1) entered blocking state [ 2031.619492][T27021] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2031.669073][T30451] loop4: detected capacity change from 0 to 7 [ 2031.718709][T30451] Dev loop4: unable to read RDB block 7 [ 2031.751012][T30451] loop4: unable to read partition table [ 2031.775329][T30451] loop4: partition table beyond EOD, truncated [ 2031.800098][T30451] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾x³˜CÖ) failed (rc=-5) [ 2031.903894][T30451] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6402'. [ 2031.940320][T30452] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6403'. [ 2031.979939][T30451] SET target dimension over the limit! [ 2031.991500][T30452] SET target dimension over the limit! [ 2033.579466][T30282] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2033.790273][T30282] veth0_vlan: entered promiscuous mode [ 2033.841632][T30282] veth1_vlan: entered promiscuous mode [ 2033.880759][T30490] lo speed is unknown, defaulting to 1000 [ 2033.988929][T30475] openvswitch: netlink: Actions may not be safe on all matching packets [ 2034.014164][T30282] veth0_macvtap: entered promiscuous mode [ 2034.048141][T30282] veth1_macvtap: entered promiscuous mode [ 2034.090705][T30475] IPv6: NLM_F_CREATE should be specified when creating new route [ 2034.146025][T30282] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2034.191664][T30282] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2034.299937][T24847] usb 6-1: new high-speed USB device number 87 using dummy_hcd [ 2034.425353][T29867] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2034.444579][T29867] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2034.455552][T29867] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2034.581966][T29867] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2034.629998][T24847] usb 6-1: Using ep0 maxpacket: 8 [ 2034.657696][T24847] usb 6-1: unable to get BOS descriptor or descriptor too short [ 2034.698603][T24847] usb 6-1: config 4 has an invalid interface number: 147 but max is 0 [ 2034.744224][T30490] wlan0 speed is unknown, defaulting to 1000 [ 2034.748175][T24847] usb 6-1: config 4 has an invalid descriptor of length 128, skipping remainder of the config [ 2034.777651][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2034.793473][T30490] wg0 speed is unknown, defaulting to 1000 [ 2034.816724][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2034.843794][T24847] usb 6-1: config 4 has no interface number 0 [ 2034.918098][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2034.947377][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2034.961009][T24847] usb 6-1: New USB device found, idVendor=04f2, idProduct=b746, bcdDevice=8e.6e [ 2034.971373][T24847] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2034.980411][T24847] usb 6-1: Product: syz [ 2034.985403][T24847] usb 6-1: Manufacturer: syz [ 2034.990068][T24847] usb 6-1: SerialNumber: syz [ 2035.024639][ T30] audit: type=1400 audit(1782685578.550:2266): avc: denied { mounton } for pid=30282 comm="syz-executor" path="/root/syzkaller.TLVOpD/syz-tmp" dev="sda1" ino=2064 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 2035.337743][ T30] audit: type=1400 audit(1782685578.550:2267): avc: denied { mounton } for pid=30282 comm="syz-executor" path="/root/syzkaller.TLVOpD/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 2035.368192][ T30] audit: type=1400 audit(1782685578.550:2268): avc: denied { mounton } for pid=30282 comm="syz-executor" path="/root/syzkaller.TLVOpD/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=140831 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 2035.838460][ T30] audit: type=1400 audit(1782685578.588:2269): avc: denied { mounton } for pid=30282 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2784 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 2035.946179][ T30] audit: type=1400 audit(1782685578.588:2270): avc: denied { mount } for pid=30282 comm="syz-executor" name="/" dev="gadgetfs" ino=7630 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 2036.011870][ T30] audit: type=1400 audit(1782685578.588:2271): avc: denied { mounton } for pid=30282 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 2036.463364][T30490] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma? [ 2036.546058][T24847] uvcvideo 6-1:4.147: Found multiple Units with ID 6 [ 2036.570235][T24847] uvcvideo 6-1:4.147: Found UVC 0.02 device syz (04f2:b746) [ 2036.598612][T24847] uvcvideo 6-1:4.147: No streaming interface found for terminal 32774. [ 2036.619517][T30519] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=30519 comm=syz.2.6414 [ 2036.680559][T24847] usb 6-1: USB disconnect, device number 87 [ 2037.013757][T23326] usb 3-1: new high-speed USB device number 97 using dummy_hcd [ 2037.184733][T23326] usb 3-1: Using ep0 maxpacket: 32 [ 2037.574710][T23326] usb 3-1: unable to get BOS descriptor or descriptor too short [ 2037.599676][T23326] usb 3-1: config 1 has no interfaces? [ 2037.614885][T23326] usb 3-1: New USB device found, idVendor=12d1, idProduct=1413, bcdDevice= 0.00 [ 2037.634159][T23326] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2037.652429][T23326] usb 3-1: Product: syz [ 2037.665618][T23326] usb 3-1: Manufacturer: syz [ 2037.697109][T23326] usb 3-1: SerialNumber: syz [ 2037.801643][T30537] netlink: 212408 bytes leftover after parsing attributes in process `syz.6.6420'. [ 2037.815198][T30504] usb 2-1: new high-speed USB device number 106 using dummy_hcd [ 2037.844324][T30537] openvswitch: netlink: Message has 512 unknown bytes. [ 2038.509423][T30543] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 2038.553802][T30504] usb 2-1: Using ep0 maxpacket: 16 [ 2038.566476][T30504] usb 2-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 2038.609472][T30504] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2038.634617][T30504] usb 2-1: Product: syz [ 2038.649865][T30504] usb 2-1: Manufacturer: syz [ 2038.661155][ T995] usb 3-1: USB disconnect, device number 97 [ 2038.681530][T30504] usb 2-1: SerialNumber: syz [ 2040.193772][T30504] usb 2-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 2040.704268][T30504] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 2040.716275][T30504] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 2040.724785][T30504] usb 2-1: media controller created [ 2040.739183][T30504] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2040.757391][T30504] zl10353_read_register: readreg error (reg=127, ret==-71) [ 2040.785194][T30504] dvb_usb_gl861 2-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 2040.796827][T30504] usb 2-1: USB disconnect, device number 106 [ 2040.959850][T30560] loop4: detected capacity change from 0 to 7 [ 2041.015344][T30560] Dev loop4: unable to read RDB block 7 [ 2041.042302][T30557] netlink: 20 bytes leftover after parsing attributes in process `syz.6.6426'. [ 2041.067134][T30560] loop4: unable to read partition table [ 2041.122401][T30560] loop4: partition table beyond EOD, truncated [ 2041.132485][T30560] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾x³˜CÖ) failed (rc=-5) [ 2041.226672][T30560] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6424'. [ 2041.405878][T30560] Cannot find add_set index 0 as target [ 2044.379627][T30591] lo speed is unknown, defaulting to 1000 [ 2044.485932][T30591] wlan0 speed is unknown, defaulting to 1000 [ 2044.493172][T30591] wg0 speed is unknown, defaulting to 1000 [ 2044.839545][T30600] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=30600 comm=syz.0.6435 [ 2045.124385][T30606] netlink: 212408 bytes leftover after parsing attributes in process `syz.6.6436'. [ 2045.180674][T30504] usb 1-1: new high-speed USB device number 76 using dummy_hcd [ 2045.225285][T30606] openvswitch: netlink: Message has 512 unknown bytes. [ 2045.437230][T30504] usb 1-1: Using ep0 maxpacket: 32 [ 2045.478471][T30504] usb 1-1: config 1 has no interfaces? [ 2045.517320][T30504] usb 1-1: New USB device found, idVendor=12d1, idProduct=1413, bcdDevice= 0.00 [ 2045.563196][T30504] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2045.589200][T30608] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 2045.594786][T30504] usb 1-1: Product: syz [ 2045.624964][T30504] usb 1-1: Manufacturer: syz [ 2045.657899][T30504] usb 1-1: SerialNumber: syz [ 2046.471206][ T993] usb 1-1: USB disconnect, device number 76 [ 2046.527947][T30504] usb 6-1: new high-speed USB device number 88 using dummy_hcd [ 2047.027417][T30622] loop5: detected capacity change from 0 to 6 [ 2047.056183][T30622] Dev loop5: unable to read RDB block 6 [ 2047.062382][T30622] loop5: unable to read partition table [ 2047.083872][T30504] usb 6-1: Using ep0 maxpacket: 16 [ 2047.097819][T30504] usb 6-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 2047.107544][T30504] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2047.128154][T30622] loop5: partition table beyond EOD, truncated [ 2047.142007][T30504] usb 6-1: Product: syz [ 2047.163463][T30504] usb 6-1: Manufacturer: syz [ 2047.178362][T30622] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 2047.189390][T30504] usb 6-1: SerialNumber: syz [ 2047.452269][T30504] usb 6-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 2047.522962][T30504] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 2047.685823][T30504] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 2048.030748][T30635] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6442'. [ 2048.056295][T30504] usb 6-1: media controller created [ 2048.087192][T30504] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2048.148922][T30504] zl10353_read_register: readreg error (reg=127, ret==-71) [ 2048.368471][T30639] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 2048.552101][T30504] dvb_usb_gl861 6-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 2049.143572][T30504] usb 6-1: USB disconnect, device number 88 [ 2050.021224][T30652] lo speed is unknown, defaulting to 1000 [ 2050.128287][T30652] wlan0 speed is unknown, defaulting to 1000 [ 2050.135558][T30652] wg0 speed is unknown, defaulting to 1000 [ 2050.416614][T30658] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6448'. [ 2051.016465][T30676] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=30676 comm=syz.6.6453 [ 2051.070400][T30677] netlink: 48 bytes leftover after parsing attributes in process `syz.5.6454'. [ 2052.702545][T30689] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6456'. [ 2052.891886][T27013] Bluetooth: hci5: Frame reassembly failed (-84) [ 2053.164452][T30693] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.6457'. [ 2053.317770][T30698] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 2053.346158][T30693] openvswitch: netlink: Message has 512 unknown bytes. [ 2053.779924][ T30] audit: type=1400 audit(1782685596.098:2272): avc: denied { mount } for pid=30703 comm="syz.0.6460" name="/" dev="securityfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 2053.809050][T20927] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 2053.979033][T20927] usb 2-1: Using ep0 maxpacket: 16 [ 2053.996714][T20927] usb 2-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 2054.019362][T20927] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2054.038947][T20927] usb 2-1: Product: syz [ 2054.049942][T20927] usb 2-1: Manufacturer: syz [ 2054.060521][T20927] usb 2-1: SerialNumber: syz [ 2054.297786][T20927] usb 2-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 2054.329636][T20927] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 2054.341542][T20927] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 2054.398116][T20927] usb 2-1: media controller created [ 2054.424356][T20927] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2054.434353][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 2054.512199][T20927] zl10353_read_register: readreg error (reg=127, ret==-71) [ 2054.572713][T20927] dvb_usb_gl861 2-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 2054.601724][T30716] loop4: detected capacity change from 0 to 7 [ 2054.635403][T20927] usb 2-1: USB disconnect, device number 107 [ 2054.656913][T30716] Dev loop4: unable to read RDB block 7 [ 2054.672524][T30716] loop4: unable to read partition table [ 2054.702545][T30716] loop4: partition table beyond EOD, truncated [ 2054.715153][T30716] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾x³˜CÖ) failed (rc=-5) [ 2054.838234][T30716] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6462'. [ 2054.874310][T30716] Cannot find add_set index 0 as target [ 2055.026967][T22869] Bluetooth: hci5: command 0x1003 tx timeout [ 2055.027440][ T4929] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 2055.243760][ T30] audit: type=1400 audit(1782685597.474:2273): avc: denied { unmount } for pid=18543 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 2055.462289][T30727] netlink: 48 bytes leftover after parsing attributes in process `syz.1.6466'. [ 2055.629626][T30730] siw: device registration error -23 [ 2056.159649][T30738] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=30738 comm=syz.5.6468 [ 2056.560227][T30504] usb 6-1: new high-speed USB device number 89 using dummy_hcd [ 2056.614350][T30745] input: syz1 as /devices/virtual/input/input90 [ 2057.015482][T30504] usb 6-1: Using ep0 maxpacket: 32 [ 2057.022868][T30504] usb 6-1: config 1 has no interfaces? [ 2057.030610][T30504] usb 6-1: New USB device found, idVendor=12d1, idProduct=1413, bcdDevice= 0.00 [ 2057.040354][T30504] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2057.048931][T30504] usb 6-1: Product: syz [ 2057.053120][T30504] usb 6-1: Manufacturer: syz [ 2057.057712][T30504] usb 6-1: SerialNumber: syz [ 2057.144915][ T30] audit: type=1400 audit(1782685598.849:2274): avc: denied { connect } for pid=30736 comm="syz.0.6469" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 2057.545625][T30752] netlink: 277 bytes leftover after parsing attributes in process `syz.2.6472'. [ 2057.753560][ T5741] usb 6-1: USB disconnect, device number 89 [ 2057.893794][T30753] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 2059.049222][T30769] lo speed is unknown, defaulting to 1000 [ 2059.645019][T30769] wlan0 speed is unknown, defaulting to 1000 [ 2059.652278][T30769] wg0 speed is unknown, defaulting to 1000 [ 2171.864306][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 2171.871273][ C0] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P30779/1:b..l [ 2171.879889][ C0] rcu: (detected by 0, t=10506 jiffies, g=229717, q=197 ncpus=2) [ 2171.887680][ C0] task:syz.1.6479 state:R running task stack:26056 pid:30779 tgid:30776 ppid:25432 task_flags:0x400140 flags:0x00080000 [ 2171.901975][ C0] Call Trace: [ 2171.905251][ C0] [ 2171.908175][ C0] __schedule+0x125c/0x6730 [ 2171.912689][ C0] ? stack_depot_save_flags+0x27/0x9d0 [ 2171.918149][ C0] ? __pfx___schedule+0x10/0x10 [ 2171.922996][ C0] ? mark_held_locks+0x40/0x70 [ 2171.927757][ C0] preempt_schedule_irq+0x50/0x90 [ 2171.932776][ C0] irqentry_exit+0x205/0xa00 [ 2171.937367][ C0] asm_sysvec_reschedule_ipi+0x1a/0x20 [ 2171.942826][ C0] RIP: 0010:lock_acquire+0x5e/0x370 [ 2171.948020][ C0] Code: 05 bb ef 4e 12 83 f8 07 0f 87 da 00 00 00 48 0f a3 05 06 a2 16 0f 0f 82 ac 02 00 00 8b 35 ce d5 16 0f 85 f6 0f 85 c7 00 00 00 <48> 8b 44 24 30 65 48 2b 05 5d ef 4e 12 0f 85 ec 02 00 00 48 83 c4 [ 2171.967620][ C0] RSP: 0018:ffffc90005906c38 EFLAGS: 00000206 [ 2171.973678][ C0] RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000000 [ 2171.981636][ C0] RDX: 0000000000000000 RSI: ffffffff8e137c0e RDI: ffffffff8c3e9b80 [ 2171.989601][ C0] RBP: ffffffff8e9e60c0 R08: 000000000fc43284 R09: 0000000000000007 [ 2171.997561][ C0] R10: 0000000000000200 R11: 0000000000000000 R12: 0000000000000002 [ 2172.005520][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2172.013494][ C0] ? unwind_next_frame+0x3be/0x2090 [ 2172.018686][ C0] ? unwind_next_frame+0x3be/0x2090 [ 2172.023874][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 2172.030034][ C0] unwind_next_frame+0xd1/0x2090 [ 2172.034961][ C0] ? unwind_next_frame+0xbd/0x2090 [ 2172.040068][ C0] ? mmap_region+0x35d/0x620 [ 2172.044652][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 2172.050797][ C0] arch_stack_walk+0x94/0xf0 [ 2172.055383][ C0] ? mmap_region+0x35d/0x620 [ 2172.059982][ C0] stack_trace_save+0x8e/0xc0 [ 2172.064651][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 2172.070015][ C0] ? __lock_acquire+0x49f/0x1a40 [ 2172.074956][ C0] save_stack+0x162/0x1e0 [ 2172.079285][ C0] ? __pfx_save_stack+0x10/0x10 [ 2172.084141][ C0] ? free_unref_folios+0xa44/0x1710 [ 2172.089328][ C0] ? folios_put_refs+0x585/0xaa0 [ 2172.094262][ C0] ? free_pages_and_swap_cache+0x30b/0x3b0 [ 2172.100058][ C0] ? __tlb_batch_free_encoded_pages+0xe9/0x280 [ 2172.106208][ C0] ? tlb_finish_mmu+0x1b0/0x810 [ 2172.111054][ C0] ? unmap_region+0x2d9/0x3b0 [ 2172.115728][ C0] ? __mmap_region+0x1aec/0x2db0 [ 2172.120653][ C0] ? mmap_region+0x35d/0x620 [ 2172.125251][ C0] ? page_ext_put+0x3e/0xd0 [ 2172.129756][ C0] __reset_page_owner+0x84/0x190 [ 2172.134689][ C0] free_unref_folios+0xa44/0x1710 [ 2172.139710][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 2172.145515][ C0] folios_put_refs+0x585/0xaa0 [ 2172.150281][ C0] ? __pfx_folios_put_refs+0x10/0x10 [ 2172.155565][ C0] ? __pfx_native_flush_tlb_one_user+0x10/0x10 [ 2172.161726][ C0] free_pages_and_swap_cache+0x30b/0x3b0 [ 2172.167354][ C0] ? __pfx_free_pages_and_swap_cache+0x10/0x10 [ 2172.173550][ C0] __tlb_batch_free_encoded_pages+0xe9/0x280 [ 2172.179538][ C0] tlb_finish_mmu+0x1b0/0x810 [ 2172.184230][ C0] unmap_region+0x2d9/0x3b0 [ 2172.188744][ C0] ? __pfx_unmap_region+0x10/0x10 [ 2172.193784][ C0] __mmap_region+0x1aec/0x2db0 [ 2172.198543][ C0] ? sched_clock_cpu+0x6c/0x570 [ 2172.203387][ C0] ? __pfx___mmap_region+0x10/0x10 [ 2172.208507][ C0] ? pick_task_fair+0xe6/0x1bf0 [ 2172.213373][ C0] ? find_held_lock+0x2b/0x80 [ 2172.218038][ C0] ? __schedule+0x31d8/0x6730 [ 2172.222713][ C0] ? rcu_is_watching+0x12/0xc0 [ 2172.227484][ C0] ? trace_sched_exit_tp+0x120/0x160 [ 2172.232774][ C0] ? __schedule+0x126e/0x6730 [ 2172.237491][ C0] mmap_region+0x35d/0x620 [ 2172.241905][ C0] ? __pfx_mmap_region+0x10/0x10 [ 2172.246833][ C0] ? shmem_get_unmapped_area+0x141/0x960 [ 2172.252464][ C0] ? selinux_mmap_addr+0x2b/0x110 [ 2172.257482][ C0] ? bpf_lsm_mmap_addr+0x9/0x30 [ 2172.262320][ C0] ? security_mmap_addr+0x71/0x1e0 [ 2172.267604][ C0] ? __get_unmapped_area+0x255/0x3e0 [ 2172.272888][ C0] do_mmap+0xc63/0x12f0 [ 2172.277044][ C0] ? __pfx_do_mmap+0x10/0x10 [ 2172.281718][ C0] ? __pfx_down_write_killable+0x10/0x10 [ 2172.287338][ C0] ? __pfx_futex_wait+0x10/0x10 [ 2172.292184][ C0] vm_mmap_pgoff+0x29e/0x470 [ 2172.296792][ C0] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 2172.301903][ C0] ? __pfx_do_futex+0x10/0x10 [ 2172.306581][ C0] ksys_mmap_pgoff+0xe4/0x610 [ 2172.311255][ C0] ? __x64_sys_futex+0x358/0x4d0 [ 2172.316191][ C0] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 2172.321470][ C0] ? xfd_validate_state+0x129/0x190 [ 2172.326671][ C0] __x64_sys_mmap+0x125/0x190 [ 2172.331347][ C0] do_syscall_64+0x115/0x870 [ 2172.335934][ C0] ? clear_bhb_loop+0x40/0x90 [ 2172.340609][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2172.346515][ C0] RIP: 0033:0x7efc0f99ce59 [ 2172.350921][ C0] RSP: 002b:00007efc10822028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 2172.359326][ C0] RAX: ffffffffffffffda RBX: 00007efc0fc16090 RCX: 00007efc0f99ce59 [ 2172.367298][ C0] RDX: 000000000300000b RSI: 0000000000200000 RDI: 0000200000000000 [ 2172.375274][ C0] RBP: 00007efc0fa32e6f R08: ffffffffffffffff R09: 00000000ec776000 [ 2172.383237][ C0] R10: 0000000000204031 R11: 0000000000000246 R12: 0000000000000000 [ 2172.391201][ C0] R13: 00007efc0fc16128 R14: 00007efc0fc16090 R15: 00007ffcf04fa9c8 [ 2172.399179][ C0] [ 2172.402191][ C0] rcu: rcu_preempt kthread timer wakeup didn't happen for 10505 jiffies! g229717 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 [ 2172.414601][ C0] rcu: Possible timer handling issue on cpu=1 timer-softirq=120285 [ 2172.422560][ C0] rcu: rcu_preempt kthread starved for 10506 jiffies! g229717 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=1 [ 2172.433998][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 2172.443952][ C0] rcu: RCU grace-period kthread stack dump: [ 2172.449830][ C0] task:rcu_preempt state:I stack:28008 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 [ 2172.461755][ C0] Call Trace: [ 2172.465022][ C0] [ 2172.467944][ C0] __schedule+0x125c/0x6730 [ 2172.472505][ C0] ? __pfx___schedule+0x10/0x10 [ 2172.477347][ C0] ? find_held_lock+0x2b/0x80 [ 2172.482014][ C0] ? schedule+0x225/0x2c0 [ 2172.486342][ C0] schedule+0xdd/0x2c0 [ 2172.490839][ C0] schedule_timeout+0x127/0x280 [ 2172.495683][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 2172.501049][ C0] ? __pfx_process_timeout+0x10/0x10 [ 2172.506332][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 2172.512149][ C0] ? prepare_to_swait_event+0xdf/0x4a0 [ 2172.517604][ C0] rcu_gp_fqs_loop+0x1a9/0x900 [ 2172.522363][ C0] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 2172.527655][ C0] ? __pfx_rcu_gp_init+0x10/0x10 [ 2172.532588][ C0] ? rcu_is_watching+0x12/0xc0 [ 2172.537351][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 2172.543169][ C0] rcu_gp_kthread+0x179/0x230 [ 2172.547838][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 2172.553027][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 2172.558831][ C0] ? __kthread_parkme+0x18c/0x230 [ 2172.563857][ C0] ? kthread+0x13a/0x450 [ 2172.568086][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 2172.573284][ C0] kthread+0x370/0x450 [ 2172.577343][ C0] ? __pfx_kthread+0x10/0x10 [ 2172.581924][ C0] ret_from_fork+0x72b/0xd50 [ 2172.586516][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 2172.591625][ C0] ? __switch_to+0x800/0x10f0 [ 2172.596295][ C0] ? __pfx_kthread+0x10/0x10 [ 2172.600877][ C0] ret_from_fork_asm+0x1a/0x30 [ 2172.605644][ C0] [ 2172.608652][ C0] rcu: Stack dump where RCU GP kthread last ran: [ 2172.614963][ C0] Sending NMI from CPU 0 to CPUs 1: [ 2172.620160][ C1] NMI backtrace for cpu 1 [ 2172.620174][ C1] CPU: 1 UID: 0 PID: 30775 Comm: syz.5.6478 Tainted: G L syzkaller #0 PREEMPT(full) [ 2172.620193][ C1] Tainted: [L]=SOFTLOCKUP [ 2172.620198][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2172.620207][ C1] RIP: 0010:__kasan_check_byte+0x0/0x50 [ 2172.620226][ C1] Code: c9 5b 48 8d 74 15 00 5d ba fe 00 00 00 41 5c 41 5d e9 e4 2a 00 00 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <0f> 1f 40 d6 41 54 49 89 f4 55 48 89 fd 53 e8 7d 1e 00 00 89 c3 84 [ 2172.620240][ C1] RSP: 0018:ffffc90000a08cd8 EFLAGS: 00000002 [ 2172.620251][ C1] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000000 [ 2172.620260][ C1] RDX: 0000000000000000 RSI: ffffffff8b9fc44a RDI: ffffffff9b6c4430 [ 2172.620269][ C1] RBP: ffffffff9b6c4430 R08: 0000000000000001 R09: 0000000000000000 [ 2172.620278][ C1] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 [ 2172.620286][ C1] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000 [ 2172.620295][ C1] FS: 00007f19b78a56c0(0000) GS:ffff8881241e0000(0000) knlGS:0000000000000000 [ 2172.620310][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2172.620320][ C1] CR2: 000020000001ec00 CR3: 000000007e86f000 CR4: 00000000003526f0 [ 2172.620329][ C1] DR0: 00000000000000d8 DR1: 0000000000000000 DR2: 0000000000000000 [ 2172.620338][ C1] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 2172.620347][ C1] Call Trace: [ 2172.620352][ C1] [ 2172.620357][ C1] lock_acquire+0x132/0x370 [ 2172.620374][ C1] ? __pfx_debug_objects_fill_pool+0x10/0x10 [ 2172.620394][ C1] _raw_spin_lock_irqsave+0x3a/0x60 [ 2172.620411][ C1] ? debug_object_activate+0x144/0x4b0 [ 2172.620427][ C1] debug_object_activate+0x144/0x4b0 [ 2172.620445][ C1] ? __pfx_debug_object_activate+0x10/0x10 [ 2172.620468][ C1] ? do_raw_spin_lock+0x128/0x260 [ 2172.620489][ C1] enqueue_hrtimer+0x75/0x2f0 [ 2172.620509][ C1] __hrtimer_run_queues+0x6ed/0x9c0 [ 2172.620538][ C1] hrtimer_interrupt+0x3e5/0x940 [ 2172.620557][ C1] __sysvec_apic_timer_interrupt+0x109/0x470 [ 2172.620579][ C1] sysvec_apic_timer_interrupt+0x9e/0xc0 [ 2172.620599][ C1] [ 2172.620604][ C1] [ 2172.620609][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2172.620624][ C1] RIP: 0010:its_return_thunk+0x0/0x10 [ 2172.620644][ C1] Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 e9 0b 29 d5 f5 cc [ 2172.620656][ C1] RSP: 0018:ffffc9000397fd00 EFLAGS: 00000283 [ 2172.620667][ C1] RAX: 0000000000000120 RBX: 1ffff9200072ffa1 RCX: ffffc9001b177000 [ 2172.620676][ C1] RDX: 0000000000080000 RSI: ffffffff858b13ce RDI: ffffc9000397fe90 [ 2172.620686][ C1] RBP: 000005437efc129c R08: 0000000000000007 R09: 0000000000000000 [ 2172.620694][ C1] R10: 000000001dfff6de R11: 0000000000000000 R12: ffffc9000397fe90 [ 2172.620703][ C1] R13: 0000000000000010 R14: 000000000cf3f45e R15: 000000001d5ca29c [ 2172.620716][ C1] ? add_device_randomness+0x7e/0x110 [ 2172.620737][ C1] add_device_randomness+0x7e/0x110 [ 2172.620754][ C1] ? __pfx_add_device_randomness+0x10/0x10 [ 2172.620772][ C1] ? rcu_is_watching+0x12/0xc0 [ 2172.620792][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 2172.620811][ C1] do_settimeofday64+0x3ef/0x4d0 [ 2172.620829][ C1] ? __pfx_do_settimeofday64+0x10/0x10 [ 2172.620845][ C1] ? security_capable+0x80/0x260 [ 2172.620860][ C1] ? siw_cm_queue_work+0x667/0x6a0 [ 2172.620877][ C1] ? capable+0xd3/0xf0 [ 2172.620895][ C1] do_sys_settimeofday64+0x1dc/0x260 [ 2172.620913][ C1] __x64_sys_clock_settime+0x1c1/0x2a0 [ 2172.620928][ C1] ? __pfx___x64_sys_clock_settime+0x10/0x10 [ 2172.620946][ C1] do_syscall_64+0x115/0x870 [ 2172.620964][ C1] ? clear_bhb_loop+0x40/0x90 [ 2172.620980][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2172.620994][ C1] RIP: 0033:0x7f19b699ce59 [ 2172.621006][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2172.621018][ C1] RSP: 002b:00007f19b78a5028 EFLAGS: 00000246 ORIG_RAX: 00000000000000e3 [ 2172.621031][ C1] RAX: ffffffffffffffda RBX: 00007f19b6c15fa0 RCX: 00007f19b699ce59 [ 2172.621041][ C1] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000000 [ 2172.621049][ C1] RBP: 00007f19b6a32e6f R08: 0000000000000000 R09: 0000000000000000 [ 2172.621058][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2172.621067][ C1] R13: 00007f19b6c16038 R14: 00007f19b6c15fa0 R15: 00007ffd678c1398 [ 2172.621083][ C1]