last executing test programs: 2m1.854598075s ago: executing program 1 (id=684): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x101800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x6) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) ioctl$KVM_HAS_DEVICE_ATTR_vcpu(r2, 0x4018aee3, &(0x7f0000000000)=@attr_pmu_init) ioctl$KVM_SET_TSC_KHZ_cpu(r2, 0xaea2, 0x7) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$FUSE_INIT(r3, &(0x7f0000000100)={0x50, 0x0, 0x0, {0x7, 0x2d, 0x8, 0x461980, 0x5, 0x4a27, 0x7, 0x4, 0x0, 0x0, 0x1, 0x3}}, 0x50) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r5 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) ioctl$EVIOCSFF(r5, 0x40304580, 0x0) sendmsg$NL80211_CMD_GET_WIPHY(r4, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x24048890}, 0x44) 2m1.756580779s ago: executing program 1 (id=686): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000000)={r0, 0x9, 0x9, 0x9}) ioctl$UBLK_U_IO_NEED_GET_DATA(r1, 0xc0107522, &(0x7f00000013c0)={0x0, 0x15b, 0x0, &(0x7f00000003c0)=@buf_512="6bcc0fca5d8ddf3f355290c2162c27d3977590fc42414baa65da4dcf78e60797ff1e5703ecc6c8f734cd8e4d50b6f2e2e588bc6bb4720da88026dbe2646bb12713051a1321df11312761fbffcbc57f467ecc8c15129fbaffbe4eedf4550948a4f5fd6af77162fcc1b6bf8b6dba89df27c351e67d5b4c2e70a744a9a3262f1301e108a67032f5ae02f9c7087ea3c380116ba0c084a4adeaca71d78bc46da72d0dbf3faf529ca8dafafcff9c569363aa65cff18128f2bb362c1e012c9057018e6ce2f3dfed200cae763027ac36e69a4453cb4aa00cef459eb9b1b595215603f7d04bb16e82a8731be611343d5306d8d7887a0cc59f749f75f9acbacef0a3d64f63dd580e1533b0690e093aba2486b0152195a0b7546473c9890765e1be107007cbf0bcd00928c4cf82d5c02f01867df08865ece9a096eb51b65d339b7d55a48bb91fd1f29df4a3714da1d5c2ce8546c94c55bc4b053feaee3fc538c923535d199045a8163c3e10596d2cd3baed97214d6d89a3fa54642ea9a39b4be57c37360f3ba221aebac5259f6a862471f4086bd06be05bf826c4642c2b35681f0907061ead72ef123c2284b02e32db50c03288f5a4347ab99cccc23b41b99e2a21dcd3733474453921196f14860c6ed3912f947a342ac398657987f7e4b1b9d7bfa4ebfc892c66d8faf771c4eb3375348513287cc3adebafb5cf29d668aba795075555c7aa"}) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) socket$packet(0x11, 0x3, 0x300) (async, rerun: 64) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) (rerun: 64) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) (async) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x50}, 0x80) (async) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x0, 0x0, 0x0) (async) socket(0x400000000010, 0x3, 0x0) (async) socket$unix(0x1, 0x5, 0x0) (async) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) (async, rerun: 32) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) (rerun: 32) r7 = dup(r6) ioctl$BTRFS_IOC_QUOTA_RESCAN(r4, 0x4040942c, &(0x7f00000000c0)={0x0, 0xc96b, [0x6, 0xfffffffffffffff5, 0x1, 0x100000001, 0xffffffffffffffff, 0x7]}) (async) syz_usb_connect(0x3, 0x3f, &(0x7f0000000200)={{0x12, 0x1, 0x200, 0x5e, 0xba, 0x7, 0x40, 0x110a, 0x1130, 0xc460, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x6, 0x7f, 0x40, 0x1, "", [{{0x9, 0x4, 0xf0, 0x44, 0x3, 0x3, 0xb1, 0xdb, 0x2, [], [{{0x9, 0x5, 0x6, 0x4, 0x0, 0xea, 0x1, 0xf4}}, {{0x9, 0x5, 0x7, 0x3, 0x3ff, 0x6, 0x5, 0x2}}, {{0x9, 0x5, 0xd, 0x10, 0x400, 0xff, 0x7f}}]}}]}}]}}, 0x0) (async) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x40000001, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) (async, rerun: 32) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) (async, rerun: 32) sendmmsg$inet(r0, &(0x7f00000001c0)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000380)="5e80", 0x2}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x6880) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000fe8000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f00000025c0)=""/4110, 0x100e, 0x0, 0x0}, &(0x7f0000000340)=0x40) 1m58.656001764s ago: executing program 1 (id=715): socket(0x1e, 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000100)={'bridge_slave_1\x00', &(0x7f0000000080)=@ethtool_cmd={0x24, 0x0, 0x3, 0x6, 0xff, 0x0, 0x0, 0xff, 0x0, 0xfa, 0x20000000, 0x7883, 0x0, 0x1, 0x1, 0x6162b9dd, [0x47cb, 0x80000001]}}) r2 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000700)={0x0, 0x40, 0x1, 0x40002, 0x1df}, &(0x7f0000000500)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(0xffffffffffffffff, r3, r4, r5, &(0x7f00000002c0)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@new_dev={0x3, 0xf14, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x164}}}, &(0x7f0000000280)) r6 = openat(0xffffffffffffff9c, &(0x7f0000009180)='./mnt/trace_pipe\x00', 0x0, 0x0) read(r6, &(0x7f00000091c0)=""/16384, 0x4000) lsetxattr$security_selinux(&(0x7f00000001c0)='.\x00', &(0x7f0000000240), &(0x7f00000000c0)='system_u:object_r:usbmon_device_t:s0\x00', 0x1001, 0x2) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000580)={0x2e, 0x10, 0x0, r6, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, 0x0) r7 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x26020480) unshare(0x26020480) mkdir(&(0x7f0000000080)='dir0\x00', 0x29) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000500)='dir0/per_cpu/cpu0/trace_pipe\x00', 0x800, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='dir0/per_cpu/cpu0/trace_pipe\x00', 0x800, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r9, 0x4138ae84, &(0x7f0000000c40)=@x86={0x29, 0x0, 0x54, 0x0, 0x7, 0x7, 0x7, 0xa0, 0x2, 0x2, 0x10, 0x8e, 0x0, 0x9, 0xffffffff, 0x9, 0x6, 0x23, 0x46, '\x00', 0x7e, 0x8}) socket$inet6_tcp(0xa, 0x1, 0x0) r10 = socket(0x840000000002, 0x3, 0xff) r11 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x26) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000340)={{{@in6=@private1, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000180)=0xe8) quotactl$Q_GETINFO(0xffffffff80000502, &(0x7f0000000200)=@sr0, r12, &(0x7f0000000480)) ioctl$KVM_SET_USER_MEMORY_REGION(r11, 0x4020ae46, &(0x7f0000000640)={0x1ff, 0x1, 0x6000, 0x1000, &(0x7f0000fff000/0x1000)=nil}) sendmsg$inet(r10, &(0x7f0000000900)={&(0x7f00000006c0)={0x2, 0x4e23, @multicast1}, 0x10, &(0x7f00000007c0)=[{&(0x7f0000000600)="9745010000004000012c8cc5ffff", 0x5aa}], 0x1, &(0x7f00000008c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x16}, @rand_addr=0x64010100}}}], 0x20}, 0x400c804) ioctl$KVM_SET_VCPU_EVENTS(r9, 0x4400ae8f, &(0x7f0000000140)=@x86={0x5, 0x2, 0x9c, 0x0, 0x2, 0x7f, 0x9, 0x5, 0x2, 0x5, 0x5, 0x5, 0x0, 0x9, 0x8, 0xe, 0x6, 0x8, 0x7, '\x00', 0x0, 0x3f92}) ioctl$KVM_RUN(r9, 0xae80, 0x0) 1m58.358360808s ago: executing program 1 (id=718): symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) (async) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0xa14000, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) (async) chdir(&(0x7f00000003c0)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./file7\x00', 0x1c0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c00000010008100000000000080000000000000", @ANYRES32=0x0, @ANYBLOB="0a043cbf", @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file7/file0\x00', 0x0) (async) mkdir(&(0x7f0000000000)='./dev\x00', 0x1fe) (async, rerun: 32) mount(0x0, &(0x7f0000000240)='./dev\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) (async, rerun: 32) mkdirat(0xffffffffffffff9c, &(0x7f0000004000)='./mnt\x00', 0x1ff) (async) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000001d40), 0x0, 0x0, 0x0, 0x4020}, 0x0) (async, rerun: 32) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000a00)='/sys/kernel/profiling', 0x2a41, 0x4) (rerun: 32) ioperm(0x1, 0x3, 0x163f) (async) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) write$cgroup_subtree(r1, &(0x7f0000000ac0)={[{0x2d, 'hugetlb'}]}, 0x9) socketpair$unix(0x1, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0xc0c0583b, 0x0) (async) rename(&(0x7f0000000140)='./file7/file0\x00', &(0x7f0000000180)='./file0\x00') 1m58.31225032s ago: executing program 1 (id=719): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r2, @ANYRES64=r0], 0x50}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x140) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x70000, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000200)={[0x1, 0x9, 0xfffffffffffffffd, 0x2, 0x2, 0x0, 0x401, 0x1004, 0x8000000000000000, 0xc595, 0x6, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0xb3, 0x8d], 0xeeee8000, 0x2010d3}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r4 = syz_usb_connect$hid(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000000000404c05f20dafd60000000109022400010000000009040000010300010009210101000122050009058103"], 0x0) syz_usb_control_io(r4, 0x0, 0x0) (async) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io(r4, &(0x7f00000003c0)={0x2c, &(0x7f0000000000)=ANY=[@ANYBLOB="000657"], 0x0, 0x0, 0x0, 0x0}, 0x0) (async) syz_usb_control_io(r4, &(0x7f00000003c0)={0x2c, &(0x7f0000000000)=ANY=[@ANYBLOB="000657"], 0x0, 0x0, 0x0, 0x0}, 0x0) openat$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000040), 0x2, 0x0) (async) r5 = openat$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000040), 0x2, 0x0) write$cgroup_freezer_state(r5, &(0x7f0000000100)='FREEZING\x00', 0x9) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0xfffffffffffffffd) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x48a241, 0x0) (async) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x48a241, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x10}) (async) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x10}) r9 = dup(r7) ioctl$KVM_CHECK_EXTENSION_VM(r9, 0xae03, 0x2c) (async) ioctl$KVM_CHECK_EXTENSION_VM(r9, 0xae03, 0x2c) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x81, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r9, 0x4068aea3, &(0x7f0000000340)={0x79}) r12 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r12, 0x8916, &(0x7f0000000440)={@empty, 0x80, r13}) (async) ioctl$sock_inet6_SIOCSIFADDR(r12, 0x8916, &(0x7f0000000440)={@empty, 0x80, r13}) ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x1) (async) ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x1) ioctl$KVM_SET_GSI_ROUTING(r11, 0x4008ae6a, &(0x7f0000000000)={0x1, 0x0, [{0x0, 0x4, 0x0, 0x0, @sint={0x0, 0xfff}}]}) (async) ioctl$KVM_SET_GSI_ROUTING(r11, 0x4008ae6a, &(0x7f0000000000)={0x1, 0x0, [{0x0, 0x4, 0x0, 0x0, @sint={0x0, 0xfff}}]}) syz_usb_control_io(r4, 0x0, &(0x7f0000000e40)={0x84, &(0x7f0000000180)=ANY=[@ANYBLOB="001e1400000009"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1m58.208169305s ago: executing program 1 (id=721): mprotect(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x5) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) munmap(&(0x7f0000c75000/0x4000)=nil, 0x4000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0x28f41000) read(r0, &(0x7f0000000180)=""/145, 0x91) r1 = memfd_secret(0x80000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x13, r1, 0x0) ioctl$UFFDIO_MOVE(r0, 0xc028aa05, &(0x7f0000000140)={&(0x7f0000eca000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x2000, 0x1}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x200000b, 0x204031, 0xffffffffffffffff, 0x42795000) openat$dir(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x40, 0x16f) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(&(0x7f0000000140)=@filename='\x00', &(0x7f00000001c0)='./dev\x00', 0x0, 0x2010, 0x0) execve(&(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000080)={[&(0x7f0000000140)=' wO\xd5\xce\x82\x89r\xa0\r\xc4Z\x15\xfds\xee\x9f\a0\xc3\x80\xbf\x80j$\xe6Z\xde\xf1pc\x96\x8f\xb5\x9d\xe3\x11m\x88~\xe3\xc7\xe3\t\xab\xbb@\xd9\xf8\xa2N\x03\xcf\xe4\xd6\x0ew\x10\xc2\xaa\x84bC\xc8\xd0\xe07\xa1\rIa\xb1^\xc5\x19\b\x00\x00\xd3\x91\x84x\x9d\x8eg\x85\xeb\x9e;\x8f\xa3\xcf]@\x82\xcf\x01$;\xd5\xc0\xa8\xc8\xfdS=I\x16R\xcer\x0e_\xac\xef\xf5\r\xd5Q\v\b#E\xcf@a\xa2\xaa#\x13S\x04\x12$\xcb\xbeV)\x1d\xc7\x84_\\ \xc7oh$\xc9\x06m\x00', &(0x7f0000000440)='\xa1\xed\x03( wO\xd5\xce\x82\x89r\xa0\r\xc4Z\x15\x80j$\xe6Z\xde\xf1pC\x96\x8f\xb5\x9d\xe3\x11m\x88~\xe3\xc7\xe3\t\xab\xbb\x00\x00\x00\x00\x00\x00\x00\x00\xd6\x0e\xc8\xd0\xe07\xa1\rIa\xb1^\xc5WG\xccV\xd3\x91\x84x\x9d\x8eg\x84\xeb\x9e;\x8f\xa3\xcf]@\x82\xcf\x01$;\xd5\xc0\xa8\xc8r\x0e_\xac\xef\xf5\r\xd5Q\v\b#E\xcf@a\xa2\xaa#\x13S\x04\x12$\xcb\xbeV)\x1d\xc7\x84_\\ \xc7oh$\xc9\x06m\x00'/152]}) 1m58.112620109s ago: executing program 32 (id=721): mprotect(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x5) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) munmap(&(0x7f0000c75000/0x4000)=nil, 0x4000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0x28f41000) read(r0, &(0x7f0000000180)=""/145, 0x91) r1 = memfd_secret(0x80000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x13, r1, 0x0) ioctl$UFFDIO_MOVE(r0, 0xc028aa05, &(0x7f0000000140)={&(0x7f0000eca000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x2000, 0x1}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x200000b, 0x204031, 0xffffffffffffffff, 0x42795000) openat$dir(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x40, 0x16f) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(&(0x7f0000000140)=@filename='\x00', &(0x7f00000001c0)='./dev\x00', 0x0, 0x2010, 0x0) execve(&(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000080)={[&(0x7f0000000140)=' wO\xd5\xce\x82\x89r\xa0\r\xc4Z\x15\xfds\xee\x9f\a0\xc3\x80\xbf\x80j$\xe6Z\xde\xf1pc\x96\x8f\xb5\x9d\xe3\x11m\x88~\xe3\xc7\xe3\t\xab\xbb@\xd9\xf8\xa2N\x03\xcf\xe4\xd6\x0ew\x10\xc2\xaa\x84bC\xc8\xd0\xe07\xa1\rIa\xb1^\xc5\x19\b\x00\x00\xd3\x91\x84x\x9d\x8eg\x85\xeb\x9e;\x8f\xa3\xcf]@\x82\xcf\x01$;\xd5\xc0\xa8\xc8\xfdS=I\x16R\xcer\x0e_\xac\xef\xf5\r\xd5Q\v\b#E\xcf@a\xa2\xaa#\x13S\x04\x12$\xcb\xbeV)\x1d\xc7\x84_\\ \xc7oh$\xc9\x06m\x00', &(0x7f0000000440)='\xa1\xed\x03( wO\xd5\xce\x82\x89r\xa0\r\xc4Z\x15\x80j$\xe6Z\xde\xf1pC\x96\x8f\xb5\x9d\xe3\x11m\x88~\xe3\xc7\xe3\t\xab\xbb\x00\x00\x00\x00\x00\x00\x00\x00\xd6\x0e\xc8\xd0\xe07\xa1\rIa\xb1^\xc5WG\xccV\xd3\x91\x84x\x9d\x8eg\x84\xeb\x9e;\x8f\xa3\xcf]@\x82\xcf\x01$;\xd5\xc0\xa8\xc8r\x0e_\xac\xef\xf5\r\xd5Q\v\b#E\xcf@a\xa2\xaa#\x13S\x04\x12$\xcb\xbeV)\x1d\xc7\x84_\\ \xc7oh$\xc9\x06m\x00'/152]}) 53.24608516s ago: executing program 4 (id=1532): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x26e1, 0x0) r1 = openat$kvm(0xffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x1e, &(0x7f0000000000)=0xfffffffd, 0x4) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x2710, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f00000000c0)={[0x38, 0xfff, 0x3fff9, 0x17e, 0x2, 0x0, 0xf1, 0x0, 0x81, 0x5, 0x4005, 0x8, 0x0, 0x45, 0xffffffffffffeffd, 0xbdb], 0xdddd0000, 0x1c6017}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_PIT(r2, 0x8048ae66, &(0x7f00000000c0)={[{0x4, 0x200, 0x8, 0x84, 0x0, 0x7, 0xc4, 0x1, 0x0, 0x9, 0xf, 0x8, 0x9}, {0x8, 0xaff2, 0xa, 0x5, 0xc, 0x1, 0x9, 0x3, 0x4, 0x13, 0x1, 0x6, 0x12005}, {0x2, 0x7, 0xa, 0xf, 0x1, 0x14, 0x0, 0xfb, 0x72, 0xfb, 0x1, 0x3, 0x2}], 0x8}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000b40)={[0x1, 0x64, 0xfffffffffffffffd, 0x0, 0x8000000000010002, 0xfffffffffffffffb, 0x4002004c0, 0xffe, 0xffffffffffffffff, 0x2a, 0x20000000014, 0xffff, 0x0, 0x0, 0x7f, 0x7], 0xeeee8000, 0x2}) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) getsockopt$WPAN_WANTLQI(r0, 0x0, 0x3, &(0x7f0000000080), &(0x7f00000000c0)=0x5f) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000000)={0xcca, 0x1, 0x1000, 0x6, 0x17}) 53.24584203s ago: executing program 4 (id=1533): mkdir(&(0x7f0000000000)='./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000100)=0x20a, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) socket$inet6(0xa, 0x2, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001000)=ANY=[@ANYRESDEC=r2, @ANYRES16=0x0, @ANYRES32=r4, @ANYBLOB="f998870f53678038957a01b6daad6d236fea790faa2b2b31f1714e979d884ccfb960a16afaaa24381e49e9b151b75af4d261fd6c82c073329fa373219571f5e2d58a35b6df6b8a2eef66b7627e6e1b068bfe29a518068c5f1d277d2b543a9908e073fa7b6b1a0d552af4e0b9a9f707ef7f2c381cc22b265bbe4115dd3574ee99d5014a73ac7338cb417aecc51a021aafd10b93bb2db96a"], 0x20}}, 0x0) sendto$packet(r0, &(0x7f00000002c0)="05071600d3fc140000004788031c09102c28", 0x12, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r1, 0x1, 0x0, 0x6, @local}, 0x14) 53.24529224s ago: executing program 4 (id=1534): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_IRQ_LINE_STATUS(r1, 0xc008ae67, &(0x7f0000000080)={0x2, 0x6}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000040)="0f20e035004000000f22e08d972700c0fe40c174feeac2f2defc42da8f0000000066b88d008ee0660f0059c766b8ed008ec8670f782a0ff2ed", 0x39}], 0x1, 0x54, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f00006d8000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 53.238425501s ago: executing program 4 (id=1535): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x82f41, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fsopen(&(0x7f0000001340)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) r5 = openat$cgroup_procs(r4, &(0x7f0000000080)='cgroup.threads\x00', 0x2, 0x0) sendfile(r5, r5, 0x0, 0x200) r6 = dup(r2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @multicast}) write$tun(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="0a009000aaaaaaaaaaaa0000000000000800452200680064000000019078ac1414bbac1414aa0b00907800660000430d000700660200018400070a010102ffffffff890f1f7f000001ac1414aaac1e01014429a79000000003000000040000000300000003000000b5000000000000000700000a2b00008fa700"], 0x7a) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_int(r7, 0x29, 0x19, 0x0, &(0x7f00000000c0)) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x200) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(0xffffffffffffffff, 0xc0505405, &(0x7f0000000300)={{0x1, 0x0, 0x4, 0x0, 0xfffffffd}, 0x8c07, 0x0, 0x4}) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r9, 0xae60) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r10, 0x4400ae8f, &(0x7f00000000c0)=@x86={0x60, 0x4, 0xc, 0x0, 0x7, 0x0, 0x10, 0xe, 0x0, 0x82, 0xb, 0xfd, 0x0, 0x0, 0x8, 0x0, 0xef, 0xf1, 0x0, '\x00', 0x0, 0x1}) r11 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000005c00), 0x0, 0x0) ioctl$TIOCGSERIAL(r11, 0x541e, 0x0) io_setup(0x5, &(0x7f0000000540)=0x0) io_submit(r12, 0x2, &(0x7f0000000300)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x4, r0, 0x0, 0x0, 0x4, 0x0, 0x0, r0}, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x8, 0xce1e, r0, &(0x7f00000001c0)="e64e1a002bb4", 0x6, 0x6}]) 53.165794804s ago: executing program 4 (id=1536): openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) (async) r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) r1 = openat$selinux_context(0xffffffffffffff9c, &(0x7f0000001ec0), 0x2, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000001f00)=0x3) (async) ioctl$int_in(r1, 0x5452, &(0x7f0000001f00)=0x3) write$UHID_CREATE2(r0, &(0x7f0000000500)=ANY=[@ANYRES32=r0, @ANYRES32=r0], 0x119) (async) write$UHID_CREATE2(r0, &(0x7f0000000500)=ANY=[@ANYRES32=r0, @ANYRES32=r0], 0x119) r2 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000480)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c0002010000000904000001020d0000052406000105240000000d240f0100000000000000000006241a0000000905810300020000000904010000020d00000904010102020d0000090582020002000000098f02005e7a3b0503"], 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) (async) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$cdc_ncm(r2, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r2, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) (async) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/functions/uac2.0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/functions/uac2.0/c_chmask\x00', 0x2, 0x0) (async) r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/functions/uac2.0/c_chmask\x00', 0x2, 0x0) read$FUSE(r3, &(0x7f00000007c0)={0x2020}, 0x2020) syz_usb_ep_write(r2, 0x82, 0x5, &(0x7f0000002340)='hello') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r0, 0x4000) r4 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000100)={0x0, &(0x7f00000003c0)=[@wrmsr={0x65, 0x20, {0x2a4, 0x40}}, @wrmsr={0x65, 0x20, {0x91f, 0x8}}], 0x40}) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) (async) r5 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) dup3(r5, r5, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) mount(0x0, &(0x7f0000000280)='./config/usb_gadget/g1\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@sg0, &(0x7f0000000140)='./mnt\x00', &(0x7f00000001c0)='ecryptfs\x00', 0x82c010, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') (async) chdir(&(0x7f0000000140)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x18d042, 0x15) 52.534410843s ago: executing program 4 (id=1545): r0 = socket(0xa, 0x2400000001, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x10000000000030, &(0x7f0000034000)=""/144, &(0x7f0000e5f000)=0x90) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getpeername(r1, 0x0, 0x0) r2 = socket(0xa, 0x3, 0x3a) r3 = socket$netlink(0x10, 0x3, 0x6) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) setsockopt$MRT6_ADD_MIF(r2, 0x29, 0xca, &(0x7f0000000040)={0x0, 0x0, 0x1, r4, 0xfffffffd}, 0xc) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f00000001c0)={@ipv4={'\x00', '\xff\xff', @multicast2}, 0x60, r4}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_GET_MSRS_cpu(r7, 0xc008ae88, &(0x7f0000000080)={0x1, 0x0, [{0x400000b5}]}) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_vcan(r8, 0x8933, &(0x7f0000000440)={'vcan0\x00', 0x0}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) r10 = openat$selinux_create(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) pwrite64(r10, &(0x7f0000000000)="3703c70f70e244b7878fedf0c0c6c2ff2f524255d61dbfb25921e3d3686454b93e5842722103c5c67b0da4173b9e63544ee1f32fc67080b7b83c0a31241a900518bef75ab52d7df9d091c4c601dc1cb4f1c7ed7a1d442806cc98e325464360", 0x5f, 0x0) setreuid(0xee00, 0x0) setpriority(0x2, 0x0, 0xd2f4) r11 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) ioctl$RFKILL_IOC_MAX_SIZE(r11, 0x2, &(0x7f00000000c0)=0x1) socket$pppl2tp(0x18, 0x1, 0x1) r12 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) ioctl$sock_SIOCBRADDBR(r12, 0x89a0, &(0x7f0000000200)='wg0\x00') setsockopt(r8, 0x6, 0x3, &(0x7f0000000100)="dfb149c472e5c58e05b2dbb986cff6d2d6ece69a339a50eeb906d7960282bfdde93a4e6170e3547ef9e5c7e2b97713db8bb5567644b78f2a96cab561d88dff936e40caec517a554506a79b0f7fce26a03f88ae798b69d7ae61619b48ed4038de5b46734f98f10257ad01b89307af12c96d789ad7c9eb51f60a6052e8390d8ea9108638277361cbefb25ad1cceb4bc25b7deb5d440c596fae333cc6c2db3c25562388903c262cf27127cae44838e6a5906eb2923d47db8715c5377966", 0xbc) sendto$packet(r8, &(0x7f0000000280)="5f5fde21e3135fd58627e9f1844a64432b9b62", 0x13, 0x20008884, &(0x7f0000000080)={0x11, 0xd, r9, 0x1, 0xfd, 0x6, @multicast}, 0x14) 37.320136642s ago: executing program 33 (id=1545): r0 = socket(0xa, 0x2400000001, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x10000000000030, &(0x7f0000034000)=""/144, &(0x7f0000e5f000)=0x90) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getpeername(r1, 0x0, 0x0) r2 = socket(0xa, 0x3, 0x3a) r3 = socket$netlink(0x10, 0x3, 0x6) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) setsockopt$MRT6_ADD_MIF(r2, 0x29, 0xca, &(0x7f0000000040)={0x0, 0x0, 0x1, r4, 0xfffffffd}, 0xc) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f00000001c0)={@ipv4={'\x00', '\xff\xff', @multicast2}, 0x60, r4}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_GET_MSRS_cpu(r7, 0xc008ae88, &(0x7f0000000080)={0x1, 0x0, [{0x400000b5}]}) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_vcan(r8, 0x8933, &(0x7f0000000440)={'vcan0\x00', 0x0}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) r10 = openat$selinux_create(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) pwrite64(r10, &(0x7f0000000000)="3703c70f70e244b7878fedf0c0c6c2ff2f524255d61dbfb25921e3d3686454b93e5842722103c5c67b0da4173b9e63544ee1f32fc67080b7b83c0a31241a900518bef75ab52d7df9d091c4c601dc1cb4f1c7ed7a1d442806cc98e325464360", 0x5f, 0x0) setreuid(0xee00, 0x0) setpriority(0x2, 0x0, 0xd2f4) r11 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) ioctl$RFKILL_IOC_MAX_SIZE(r11, 0x2, &(0x7f00000000c0)=0x1) socket$pppl2tp(0x18, 0x1, 0x1) r12 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) ioctl$sock_SIOCBRADDBR(r12, 0x89a0, &(0x7f0000000200)='wg0\x00') setsockopt(r8, 0x6, 0x3, &(0x7f0000000100)="dfb149c472e5c58e05b2dbb986cff6d2d6ece69a339a50eeb906d7960282bfdde93a4e6170e3547ef9e5c7e2b97713db8bb5567644b78f2a96cab561d88dff936e40caec517a554506a79b0f7fce26a03f88ae798b69d7ae61619b48ed4038de5b46734f98f10257ad01b89307af12c96d789ad7c9eb51f60a6052e8390d8ea9108638277361cbefb25ad1cceb4bc25b7deb5d440c596fae333cc6c2db3c25562388903c262cf27127cae44838e6a5906eb2923d47db8715c5377966", 0xbc) sendto$packet(r8, &(0x7f0000000280)="5f5fde21e3135fd58627e9f1844a64432b9b62", 0x13, 0x20008884, &(0x7f0000000080)={0x11, 0xd, r9, 0x1, 0xfd, 0x6, @multicast}, 0x14) 5.647330617s ago: executing program 2 (id=2213): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev\x00', 0x1ff) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mmap(&(0x7f0000dab000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0xffffb000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='proc/sys/net/ipv4/conf/default/forwarding\x00', 0x1, 0xb0) write(r1, &(0x7f0000000280)='1', 0x1) write$selinux_create(r0, &(0x7f0000000140)=@objname={'system_u:object_r:udev_rules_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x0, 0x20, 'proc/sys/net/ipv4/conf/default/forwarding\x00'}, 0x78) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000002c80)={0xa, 0x14e24, 0x0, @rand_addr, 0x80}, 0x1c) connect$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) recvmmsg(r2, &(0x7f0000005280)=[{{0x0, 0x0, &(0x7f00000003c0)=[{0x0, 0x12}, {&(0x7f0000000180)=""/244, 0xf4}], 0x2}, 0x10009}], 0x1, 0x10000, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r2, &(0x7f0000000c00)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000004f80)="000000f5b8ac2bb992ebd4c7b3ba4f60bfed002da6280c91950619c2a0e39042e0e7800ae7b041ff132d7fb40180000014c56dc066ca", 0x36}], 0x1}}, {{0x0, 0x0, &(0x7f0000000b00)=[{&(0x7f0000000a40)="a603418c14260a2a66d792cf7e1960", 0xf}], 0x1}}], 0x2, 0x20e8086) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x81, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r4, 0xae03, 0xec) getdents64(r1, &(0x7f0000000100)=""/50, 0x32) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x20002, 0x0) write(r5, &(0x7f0000000000)='3', 0x4e) inotify_init() mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f00000001c0)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f000000a000/0x4000)=nil, 0x4000, 0x0) chdir(&(0x7f0000000140)='./file0\x00') 4.804528586s ago: executing program 2 (id=2219): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd/3\x00') 3.906185828s ago: executing program 2 (id=2228): mkdir(&(0x7f0000000000)='./dev\x00', 0x1fe) mount(0x0, &(0x7f0000000240)='./dev\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f0000000080)='./dev\x00', 0xe80802, 0x4b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x9, 0x12, r0, 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) r1 = fspick(r0, &(0x7f0000000100)='./dev/file0\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) ioctl$EVIOCSABS2F(r0, 0x401845ef, &(0x7f0000000140)={0xc0, 0x8b53, 0x0, 0xfffffffe, 0x401}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_VENDOR(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001740)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01070000000081000000670004000800c3"], 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r4, 0x10e, 0xc, &(0x7f0000000080)=0x4, 0x4) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, 0x0, 0x4004054) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) write$P9_RUNLINKAT(r0, &(0x7f00000000c0)={0xffffff90, 0x4d, 0x9}, 0xffffffd7) 3.895672129s ago: executing program 2 (id=2229): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000000000040de28421100000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendto$inet6(r1, &(0x7f0000000400)="2ae0e710", 0x4, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1}, 0x1c) setsockopt$inet6_int(r1, 0x29, 0x31, &(0x7f00000000c0)=0x6, 0x4) recvmmsg(r1, &(0x7f0000006700)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=""/45, 0x2d}, 0x1aa}], 0x1, 0x10162, 0x0) syz_usb_control_io(r0, &(0x7f00000001c0)={0x2c, &(0x7f0000000340)=ANY=[@ANYBLOB="40150500"], 0x0, 0x0, 0x0, 0x0}, 0x0) r2 = add_key$keyring(&(0x7f0000000680), &(0x7f0000000000)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) add_key$fscrypt_v1(0x0, &(0x7f00000000c0)={'fscrypt:', @desc4}, 0x0, 0x0, r2) add_key$fscrypt_v1(0x0, 0x0, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x3e}, 0x48, r2) add_key$fscrypt_v1(0x0, 0x0, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r2) add_key$fscrypt_v1(&(0x7f0000000080), 0x0, 0x0, 0x0, r2) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000340)="0f01b90080000067f00fbb7bfc400f20c548b800080000000000000f23c00f21f83503000f000f23f8c4211c56b600000000c7442400d7000000c74424024e8dcb07ff1c24f20f891900000066410f3815148a66baf80cb830634986ef66bafc0c66ed0f00552c", 0x67}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0, 0x43}], 0x1, 0x55, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000001580)={0x0, 0xffffffffffffffb8, &(0x7f0000000300)=[{&(0x7f0000000080)="3bfdd75fa5717852d59a9367444a2130e72cd4dabc8854532cca0c32a5b9f844a4610c7525650ce3d3b76b15026d93e6dee896115e9364066aa3d14e33ef732b4681335c576902153114bdb9c74b538a71115fb1d1a63d1b04129661b29aab89d0be999a6b7c9bea755adedbf305a79f70b71d3d4c98577b49db4963ce89b0def5e840f459659cb6f86d56b069a5de11d601d348ff88ca6e5e2cfe40176880b33e9e8dbc32ba2e6a99b1b50276dc4f06166000", 0xb3}, {&(0x7f0000000200)="a68cde0d56b170df7710b54f17d9a39c4f98f3547190", 0x16}, {&(0x7f00000025c0)="87fb74cf4d67adbbd062637f514c1f5eb18d7b442e6457a356c6cb1f71a43dfae773c8489cce5145f92615d4bdb13ef54d6ae90ec7733180fcf5adf3e13fdb05b57b748bd14eda042a97fdd84498304a504a0a159b972e8200c2d0f536a3465ec498ed12b924bd134057df36129d3ebe3dd3ce9f0671e5278143e4afa3d43f444681de1b5f9725fca34fa357fe2154981666fb9dc202fc17a0199eb1c25bdd1005e590e84783ee9894c888998dc25a83c14aeee31d114acfa0bcd235d571cd765f4b9259ba43e6fc30291d8a642146c4771898030b736aeee6b247abb0784b154e104e7dcda401f9b1736fea30a41a4153fe6a9a525bd0a3487571f914f05b590e242341ade289d8f5b842c6be4a93c2755dfd47174def782a2f8f61c068b5a012f02c0801601e860def788121e8808c01fed4c920a3698d0d684920918c95b17f76bbcb4f265c931d8f79560ff8114b70f4dd6791e2ed70cfeb89905791b88be26efe1c5c66b7b50b3d2be0dbc066dfc31618f9507f6f340b85a2f76a6dcac9d6ccc289ace5e5fecd25afe22ffa451f5e365ab33cc985f2e9d7f7fb1be4794740a94215d7db14b0ffcec19e5e3c5ae0d8578ef3b65d2a7a77a11e390a6c3a6b391061c886b961e3c2f42d62047bfe1356a44b840d3d956105f4c0fa95db08c4933f00de77cdc057c28b41fecfc8398c442be1ad065954f6c9dfeb2fd7207e8548a00a1d50bdf522d2abfdafd71723616a34830fbfa8fc81e0c2639cc12f363a4919b7a00ac8189dad3e7e54122a2ef430f623658d5e281c9a19442995bb9b0e3f7d13e3016b6f9523be196bf23bbcc5ec802f43ef8b651d688d9d5a44f35c9847e4c32bce3e9ebed2326adadc76f06a195db32c80b3090d7cd65c9d8518ba4e528c5eb5c7a1c5695b21595fa8a8621734bfda8afddd65e1f37a1990220a00fa9bd2c22b0117ceb08ae6af3c944c2eca924abfddad065d1472d0c3f742a49b1e78c669471873706ad157d831d7482b773f07b0673a6ce1e227a7a4d13744bf459434c0ab1c323a38b1a84cbf1ce9741f2b8fdcc2e073e56171603d035aacd83e71d5132831f4f1e8bf517979f132a33fd03783272e9b8c96dfa4e1d320a58d82acfc8d3d53a5a52daafe4dc8be08f4ad53e11cc21374b6ff4ff5ea2ecc5d3f7c057f74f0098e57d990090475cdaffdef0da917653ed10fb70b94b72e5b4d95cbea0fc1dd2579635ad6ab545ba4d7b6d2f5442bdb78beb6c8ed62942a439117025b4566b48d9f3a17fdf4577e8606a4bc4c26557e58312fd2d1a541ebec3e5ae28eef8b2ab0597083716dd12889335570ee7839530eee879d9b137606cd4dd7103991671b4464bb68529eb19fb7a8845e3491bfbac688a87cf0744f429ea112014402915c4c1f6bae08d689d3cb7d641d7befe8fc74a2242310a9a367a39531b4c86da5b39df524e52f33ff9c40b48cb196ffc9ca855b6e698ade8a83e52b9ddc5031ff09e1907e4f8b0d07e64e1fb8e427f8819a7be907aa216bf8e2a4c7cc87ed53bf9490d4cc788b91f3b9f705e984a7e62c7a495e8421b97c39dc954b35468f17c6682334f4e16308448f457faeffff6d1f818522fa441d3a48168bdb12ffebace436a3915b63076cb6a655718647f87eaaf313b5bbd430421eed3a2215e439600a56eac8c65291eb103326a8034662bd337ab51577d9110ec7151be5cc9c54b2a30891acac5ad006ed537dbeb8f16eecbde7cf4e71373faf3c36b772f6d7ea9346875c8cf1049d49d4f8eb01b946c11e8c8e3ab2015f282167acddcc77fff03e1be9134252af0abfe538b4d25fc4ff874b52b9fb0996b5f32b4141dbd30578ff46e13ef6c63fc1620f62cb11a3dce401993976c272a5f62fde3f2a0e654d19e7a39dcdb622b9526d2a15cc18e6f817c916a00775353dd9c8954e66d0445b59bb0f5e6e3b46447232f52a0e398b057d123ef503afcbd48544db6434d2025bfc8dab72262a4fa5426a03061e7f8966e0086ff8ab5a91ab59f19b830394ee8bc76d6fb4816b8f4cde35b7eb9d3811228d51c54828f97fd1e648196c81bc73ed56249a59f318704e84656a6cedd2b8c1e1808d1cc648749abc643131e494c01336d4a14b8609656f2c972dc23c5c2e43fe40119fb88b5ec2aade35c03646e347354c493de8ab3672ccf94af0df333c6678299129d79be0eec281c5b3858ce3995566a390b674635b356692e3e9c53a089638ba0d69e772b7b410a5ae03de12e7de755ee559e1707b7b8003aabc8e2ce03c01e3183ff2d93262f6d5ceaafecdae66bc7cb3952c5a6571d864d502f281db5a228695badca5d022fdb6da56ab15dc377d1c1f8581ff56e28c2b2a84edb629547d28275c2ed571103b4ca7cdeb0776ba9f9dffcd78d21c3d4caa9289ed199672f4e7b912068c49c817114c37d37ea03954bae87d1ddae3da2ad85feb2fbb735b75a51f7bee5c8d88cc7bf64700d1a46ec6b631ae22ac7b06730a86a26bdcb992e1c7b50142de96b14a8468e4514068a30896fc677fddefaebb125c693a8d460469c7fe535f844781940f66d6abd091191c3122d584f5b0f5b0d443713d7d5186124d73de28aca30b719d4a55e09d259bddbf16995aeb1000880890afbd24d4066b0398985a40999de22ce176348e1c1f57eaf75b92a1e4f1482e89a00ac2cc36b20e36af9ec310599c19a5b1d6f8fadba104c58c801c6633315f82ebfa88faddd0b693e2f827f586c1cc5538e93bcf10f81af6dd7ee727df3b5018c0b4e31e40d040a47503b6ace4d29a1162ce487351825255f5584aff7cbd421f85c3d9fbb3784abd9848f16028b68f0d32ed8bb80106e8cc4acb939ff88bd39976d166b2addebf628b3fcd056da2f60e1b90f7a32702954921908ebccb683622a1f574ceba6951bef5e751c338c8279318dc28e36b9fc2bb17c3ad08aceb00fc388e6db112a738f86a4a1eb11526e1b9d73250b326285ed47c4398d93a3933d9a784249b65ad7d78a1f81d96ef36493ed693045a2150a8eb43cecc0c93e7d20b15b39a0646b081c2923b816365b7fbb41683a41732d942c5aa12faf876ec7f036becde8f3295af6dacff38d076d8e06260fee167703bb610745374a2758a6b88e465ca77d1f3105ae8b6b04a1eb509fb178d6249dbbc84d5d1d069278449a89d03e4a9a395d8170c329a296cfc329798cb9b9f1078d098cf3f989fd4ec53e013fbe917df35292d44fb1f3da4da4432a1847d4721514ade8cda5e5c0b51183580fc35266a970ebba74faeda56d4dcb5", 0x91b}, {0x0}, {&(0x7f0000000b00)="1b080b7a30aec939ce8e26e0cbbe37fc064ceef965fd5e3b6739c966492dbdf71c04423d8a403e56dfd224e4e55918a5e31e683fec5cc9460882a0d1628d02d51a8da997073f856e2cd00586c6e8c89c71cf8be6121b0b3a85d597a1afb0cc311f30cc26183c8e594ce5ff62661c9e32cbc9dd9a72985e9857f3bddb52382b6c27ca85d5774cf17b92e2d2097f12a8687e70f90d46381a47706a9124a2cf61b84f26aae22fd4da84ae35b93f7be9fdfdfbf33c59f5c657e9f7e81b81b786082f88af4de07808ff", 0xc7}], 0x5}, 0x0) recvmsg$unix(r8, &(0x7f0000001140)={0x0, 0x2, &(0x7f0000001040)=[{&(0x7f00000015c0)=""/4096, 0x7ffff000}], 0x1}, 0x40000100) add_key$keyring(0x0, 0x0, 0x0, 0x0, r2) syz_open_dev$hidraw(&(0x7f0000000280), 0x0, 0x402) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000023c0)='/proc/cgroups\x00', 0x0, 0x0) read(r9, &(0x7f0000000140)=""/59, 0x3b) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000001140)={0x34, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) 1.859010613s ago: executing program 3 (id=2257): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x4008032, 0xffffffffffffffff, 0xd1994000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3) madvise(&(0x7f0000000000/0x600000)=nil, 0x600707, 0x18) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x0, {0x7, 0x1f, 0x2, 0xfffffffff7110f4c, 0xba64, 0x2, 0x200, 0xffefffff, 0x0, 0x0, 0x2}}, 0x50) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x1f4) socket$igmp(0x2, 0x3, 0x2) socket$nl_route(0x10, 0x3, 0x0) userfaultfd(0x80801) syz_usb_connect(0x0, 0x62, &(0x7f00000000c0)=ANY=[@ANYBLOB="12090000005d7d086d04c308166b0102030109025000010000000009041f0000ff0100000a24010400050200020724070500000508240805040504960d24060101030200010006ff060924030505030605810924030601030405050724040501", @ANYRESOCT], 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x28000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f0000000000)="660f72d700ffe20f20d835200000000f22d86736decb0f30c4e14c5d4922c4c36148f4d3c4e1f917a989bb00003e0faa66b897000f00d0"}], 0x1, 0x11, 0x0, 0xfffffffffffffd37) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.047157771s ago: executing program 3 (id=2263): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201002905000040701700ff00000000000109022400010000d00009040000020300000009210000ff0122180009058103ff03000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0900a1"], 0x0}, 0x0) 926.815517ms ago: executing program 5 (id=2265): r0 = socket$packet(0x11, 0x2, 0x300) (async) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0xa3d, @loopback, 0x2}, 0x1c) (async) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000080)=@req3={0x8000, 0x200, 0x80, 0x20000, 0x0, 0x100, 0x8}, 0x1c) (async) mmap(&(0x7f0000568000/0x2000)=nil, 0x2000, 0x3000009, 0x4010, r0, 0x0) (async) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendto(r2, 0x0, 0x0, 0x20040804, 0x0, 0x0) (async) prctl$PR_SET_IO_FLUSHER(0x39, 0x0) (async) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x3000, 0x2, &(0x7f0000671000/0x3000)=nil) (async) r3 = socket$inet6(0xa, 0x3, 0x3a) setsockopt$inet6_int(r3, 0x29, 0x4e, &(0x7f0000000040)=0x9, 0x4) bind$inet6(r3, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback={0xfec0ffff00000000}}, 0x1c) (async) getsockname$inet6(r3, 0x0, &(0x7f0000000200)) (async) syz_clone3(&(0x7f0000000680)={0x100a43080, 0x0, 0x0, 0x0, {0x5}, 0x0, 0x0, 0x0, 0x0}, 0x58) 862.94759ms ago: executing program 2 (id=2266): socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x102) socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) fsopen(&(0x7f00000001c0)='binfmt_misc\x00', 0x1) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}], 0x40}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f00000004c0)={0x0, 0x42cc, 0x10, 0x1, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe706, 0x1000, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x4, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93e9, 0x2000, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x230}}], 0x1, 0x0, 0x0) 862.34665ms ago: executing program 5 (id=2267): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=@newsa={0x110, 0x10, 0x7, 0x0, 0x0, {{@in=@private=0xa010100, @in=@multicast2, 0x4e20, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x0, 0x2, 0x2, 0xfffffffffffffffd, 0x10000000, 0xffffffffffffffff}, {0x0, 0x200000, 0x7}, {0x40000, 0xfffffffd, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x34}, [@coaddr={0x14, 0xe, @in6=@remote}, @mark={0xc, 0x15, {0x35075b, 0x7}}]}, 0x110}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=@newsa={0x104, 0x1a, 0x7, 0x70bd2a, 0x0, {{@in6=@dev={0xfe, 0x80, '\x00', 0x1b}, @in=@multicast1, 0xffff, 0x0, 0x4e22, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x5a, 0xb400, 0x2, 0xfeffff7f00000001, 0x0, 0x60000}, {0x0, 0x200000, 0x7, 0xfffffffffffffffd}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x104}}, 0x0) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000401904000600e1ffffff0009022400010000f80009040010020300030009210000090581030000000000f535086dee37e5cc7e9bc80104d353aa885b2b7bbde5f8f721e1fac9e8bac05e37b76368a5d9f52f7d967c7a9c2b44009c1e2282213f"], 0x0) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000100000)=""/8192, 0x2000, 0x800, 0x0, 0x3}, 0x20) setsockopt$XDP_TX_RING(r3, 0x11b, 0x3, &(0x7f0000000040)=0x10, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r3, 0x11b, 0x6, &(0x7f0000000080)=0x10, 0x4) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000140)=0x10, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000340)={'veth1_vlan\x00', 0x0}) bind$xdp(r3, &(0x7f00000003c0)={0x2c, 0x2, r5, 0x0, r3}, 0x10) mmap$xdp(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x11, r3, 0x80000000) io_cancel(0x0, &(0x7f00000001c0)={0x0, 0x300, 0x0, 0x3, 0x5, r3, 0x0, 0x0, 0x4, 0x0, 0x3}, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0x3, 0xf, 0x8, 0x80, 0x2, 0x3, 0x7f, 0x20000006, 0x20000000, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0x0, 0x5, 0x4, 0x0, 0xa, 0x3c1b, 0x1, 0x24, 0x800000d, 0x1, 0x0, 0xffffffff, 0xe661, 0x8, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x3, 0xc, 0x0, 0x8071, 0x7, 0x6, 0xffffffff, 0x7, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x5, 0x4, 0x8, 0x3ff, 0x80, 0xfffffff9, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012d, 0x8004, 0x5, 0xfffffff3, 0x129432e2, 0xc8, 0xf9, 0xe, 0x2ff, 0x1, 0x9, 0xfffffffc, 0x4, 0x10001, 0x0, 0x3, 0x33, 0xe, 0x6, 0x78, 0xea4, 0x0, 0x3, 0x7, 0x7fef, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0x1000d, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x4, 0xf, 0xffff8001, 0x47, 0x31f3, 0x1, 0xfe000000, 0xfffe, 0x202, 0x4, 0x9, 0x3, 0x7, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x4, 0x42, 0x3], [0x5, 0x408, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x2, 0x5, 0x8, 0x4, 0x5, 0x5, 0x4, 0x1ef, 0x2, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0xc, 0x2, 0x2, 0x3, 0x20000008, 0x4004, 0xffffff11, 0x6, 0x38, 0x800003, 0x200, 0x83, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x3, 0xa9, 0x5, 0x6, 0xac8, 0xbf, 0x4002, 0x3, 0x7ff, 0x12b, 0x4, 0x40000001, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x1, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0x9, 0x2001ff, 0x2, 0x57, 0x5, 0x3, 0x101, 0x11000, 0x9, 0x8001, 0xffff, 0xa620, 0x1, 0x788, 0x8, 0x2, 0x14c, 0x60a7, 0x1006, 0x16, 0xffffffff, 0x80000000, 0x5, 0x1, 0x0, 0x1, 0xfffff000, 0x5, 0x3, 0x0, 0x100, 0x9602, 0xb, 0x80000000, 0x8, 0x6, 0x1, 0x5, 0x5, 0x8, 0x30b1d693, 0xa1f, 0xf44, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff343e, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00221800000091f106000000ee0aff358203e91be30a512a1b2495e76524"], 0x0}, 0x0) 851.21579ms ago: executing program 2 (id=2268): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000106a05310300000000000109022400010000800009040002010300010009210000000122f80409058103"], 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x1e, &(0x7f0000000000), &(0x7f0000000100)=0x4) syz_usb_connect$printer(0x5, 0x0, 0x0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x55, &(0x7f0000000280)=ANY=[@ANYBLOB="5503a7bd621bcfa48a677754116d85702ae773addd739c30148b95e8ca1e0ceabd58d51ad6e7eb52431176081a2ce220973bbe51da2a787e2771b9e81417906ba5dd650782c1d778cebd904944c330009a43818166"]}]}) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) mmap(&(0x7f0000ffc000/0x1000)=nil, 0xfffffffffffff002, 0x0, 0x32, 0xffffffffffffffff, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x89a0, &(0x7f0000000040)={'syzkaller0\x00'}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000c40)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0xc0}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) (async) r2 = socket$packet(0x11, 0x3, 0x300) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) (async) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r3, &(0x7f00000001c0)='L)3', 0x3) syz_usb_connect$uac1(0x5, 0xe7, &(0x7f0000000440)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x20, 0x763, 0x1033, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xd5, 0x3, 0x1, 0x7, 0x50, 0x80, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xff, 0x37}, [@feature_unit={0xf, 0x24, 0x6, 0x5, 0x4, 0x4, [0x2, 0x1, 0x3, 0x7], 0xd}, @processing_unit={0xc, 0x24, 0x7, 0x2, 0x5, 0x1, "90c04a1896"}, @processing_unit={0x9, 0x24, 0x7, 0x6, 0x3, 0x65, "1e5e"}, @mixer_unit={0x9, 0x24, 0x4, 0x5, 0x4f, "5ed50a91"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0xf8, 0x3, 0x5}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x2, 0x2, 0x0, 0x10}, @as_header={0x7, 0x24, 0x1, 0x4, 0x5, 0x1}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0xc, 0x24, 0x9, {0x7, 0x25, 0x1, 0xc, 0x2, 0x1}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0x10, 0x24, 0x2, 0x1, 0x6c, 0x4, 0x8b, 0xe, "c28d4fce0fc6d4ca"}, @format_type_i_discrete={0xc, 0x24, 0x2, 0x1, 0xff, 0x3, 0xfc, 0x9, "b3d79bfb"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0xd9, 0x0, 0x5, 0x10}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x37be, 0x0, 0x3d, 0x8}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0xb1, 0x40, 0xd6, {0x7, 0x25, 0x1, 0xc, 0x6, 0x401}}}}}}}}]}}, &(0x7f0000000940)={0xa, &(0x7f0000000540)={0xa, 0x6, 0x310, 0x1e, 0x3, 0x9, 0xff, 0x4}, 0x42, &(0x7f0000000580)={0x5, 0xf, 0x42, 0x4, [@ptm_cap={0x3}, @wireless={0xb, 0x10, 0x1, 0x4, 0x0, 0x81, 0x1, 0x4, 0x8}, @ssp_cap={0x24, 0x10, 0xa, 0x8, 0x6, 0x8, 0xf00, 0x0, [0x60, 0xc000, 0xff3f30, 0xfffe70, 0xff0030, 0x0]}, @wireless={0xb, 0x10, 0x1, 0x4, 0x66, 0x0, 0xd, 0xfffa, 0x80}]}, 0x6, [{0xf9, &(0x7f0000000600)=@string={0xf9, 0x3, "9ca2d88f6ef5b698ce1880f78679a1f93659b5ef4a2557ed38597cd13172628295add7895bb2e743fa7d0e0f2ba6ab981a136002cb5962197d81dd8f26ee5327d4f59b034e2eb0e06abea37fba1274d250173c4a4619358a32f1f75565aa022e4d64f84a3248675926d0afac0fb2eea1c778efdddd1ec258ba4623c5e33496b1061048e1d054de09b945c15897126e65e7747ef64fbfde05a3c657837bde46d366ffef4b0b1feab98a0c5ab40c6f73fae62e072a8784009c2582c6e28f77a66b61564c0a23dff4f0c4b314169f0d970f52ff37cc5c35a099aba759dab58acb695217699fff97d67dcb1665487c2b2e7e4904bfc24aeac6"}}, {0xd2, &(0x7f0000000700)=@string={0xd2, 0x3, "682f0dd64c287c4dea228fca5279772dbbb8982ac06ab29f6339b1eb7c28b692ac9b5f77ede597d5119d299dbd2e6eeed50349c66b8869fb3d334de22ed97f3ce3b0597c170009118677a57b272e236d0d4da12138bd72791aa9f3100de55461eb0259af003e2038ebe55964de81993a034dd1a7ae139a4e82897b25af7a267f2679483fe47469c9377cf3efdfdb2e910005d0e51640db9eac3a01067ac78c3d522c8c101170717f95481ee96380069575880c53f27151536794b3034a4efdaed39d231be709f37265d8f38ce4616573"}}, {0x4, &(0x7f0000000800)=@lang_id={0x4, 0x3, 0x1801}}, {0x4, &(0x7f0000000840)=@lang_id={0x4, 0x3, 0x1001}}, {0x4, &(0x7f0000000880)=@lang_id={0x4, 0x3, 0x448}}, {0x64, &(0x7f00000008c0)=@string={0x64, 0x3, "2ec3451fcf36dc73e96f8af78ba3bc1c2155ac863f3b8022dd8bf69097e6e9696a38da7b27642716369a1ac48d2ab84e8982437c3713d63388e4a274b7396b7f282f8a342c582708c8e3339eb67b88a997a022e4b8074657e76961f45adee795a6f5"}}]}) (async) r4 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_opts(r4, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000180)='bridge0\x00', 0x10) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000000280)) connect$inet(r4, &(0x7f0000000040)={0x2, 0x4e23, @multicast1}, 0x10) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x89a1, &(0x7f0000000040)={'syzkaller0\x00'}) (async) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) socket$inet(0x2, 0x3, 0x2) (async) ioctl$TIOCSETD(r5, 0x5423, &(0x7f00000000c0)=0xf) (async) ioctl$TCFLSH(r5, 0x400455cb, 0x0) (async, rerun: 64) r6 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (rerun: 64) write$binfmt_aout(r6, &(0x7f0000000e00)=ANY=[@ANYBLOB="0801fc1ba402000093030000050000002a01000007000000000000000000000021e86c567ff146dd6b1cca63c5498b6205ef0f3721ea20f2a43409cefbd461a30ffcb835227fc46202339846c393b1c64034d312388f2e95426c683ced46041ddf62447ffb88a2cd32c716d2c62471775cf6b34c40a065ebd6b6585b0a0e61b51dbbf61a6f52661c3f9ebeee2f3add3e5b97e9ff7f000000000000c78680d7b374f91d45000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000014555865b9f4369bf91e7f80835515b2ca3d62a2036a4db890d20dc611"], 0x8a4) 682.072618ms ago: executing program 0 (id=2269): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./debug\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./debug/regulator/supply_map\x00', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000240)='attr/prev\x00') r1 = getpid() syz_pidfd_open(r1, 0x0) r2 = syz_open_procfs(r1, &(0x7f0000000000)='net/ip_tables_matches\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000180), 0x2000090, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@noxattr}, {@version_u}, {@nodevmap}]}}) 619.950821ms ago: executing program 0 (id=2270): r0 = socket(0x10, 0x803, 0x0) setsockopt$sock_int(r0, 0x1, 0x10, &(0x7f0000000040)=0x3, 0x4) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) unshare(0x60040000) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r2, &(0x7f00000005c0)={0xa, 0x0, 0x1, @mcast2, 0x4}, 0x1c) sendmmsg$inet6(r2, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000140)='0x0}) syz_open_procfs$namespace(r1, &(0x7f00000001c0)='ns/net\x00') mount(&(0x7f0000000000), &(0x7f00000000c0)='./cgroup\x00', 0x0, 0x1001, 0x0) cachestat(r0, &(0x7f0000000040)={0x85a, 0x100000000}, &(0x7f0000000080), 0x0) mount$bind(0x0, &(0x7f0000000180)='./cgroup\x00', 0x0, 0x2108cff, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x24, &(0x7f00000000c0)=0x100000001, 0x4) recvfrom$inet(r2, 0x0, 0x0, 0x40000022, 0x0, 0x0) ioctl$XFS_IOC_READLINK_BY_HANDLE(r2, 0xc038586c, &(0x7f0000000300)={r0, &(0x7f0000000000)='ns/net\x00', 0x0, &(0x7f0000000240)={@_ha_fsid={[0x5, 0x8]}, {0xfff9, 0x7d47, 0x6, 0x6}}, 0xf208, &(0x7f0000000280), &(0x7f00000002c0)=0x5}) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) (async) fchdir(r0) (async) ioctl$UBLK_U_CMD_END_USER_RECOVERY(0xffffffffffffffff, 0xc0207511, &(0x7f0000000100)) (async) syz_open_procfs$namespace(r1, &(0x7f00000001c0)='ns/net\x00') (async) mount(&(0x7f0000000000), &(0x7f00000000c0)='./cgroup\x00', 0x0, 0x1001, 0x0) (async) cachestat(r0, &(0x7f0000000040)={0x85a, 0x100000000}, &(0x7f0000000080), 0x0) (async) mount$bind(0x0, &(0x7f0000000180)='./cgroup\x00', 0x0, 0x2108cff, 0x0) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) setsockopt$inet_tcp_int(r2, 0x6, 0x24, &(0x7f00000000c0)=0x100000001, 0x4) (async) recvfrom$inet(r2, 0x0, 0x0, 0x40000022, 0x0, 0x0) (async) ioctl$XFS_IOC_READLINK_BY_HANDLE(r2, 0xc038586c, &(0x7f0000000300)={r0, &(0x7f0000000000)='ns/net\x00', 0x0, &(0x7f0000000240)={@_ha_fsid={[0x5, 0x8]}, {0xfff9, 0x7d47, 0x6, 0x6}}, 0xf208, &(0x7f0000000280), &(0x7f00000002c0)=0x5}) (async) 419.03158ms ago: executing program 3 (id=2277): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe7000/0x18000)=nil, &(0x7f00000002c0)=[@text16={0x10, &(0x7f0000000000)="360f7883b81e2626660fc7350ff4650666b95c030010dada32f4656df30f09e3650f01ef66b9720500000f32f8000f0d35", 0x31}], 0x1, 0x2, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000000580)=@vmx={0x108, 0x0, 0x2080, {0x0, 0x8000000}, {'\x00', "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008bc584c800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001f6f38740000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a4900"}}) ioctl$KVM_RUN(r2, 0xae80, 0x0) timer_create(0x7, &(0x7f0000000180)={0x0, 0x2a, 0x1, @thr={0x0, 0x0}}, &(0x7f00000001c0)=0x0) timer_settime(r3, 0x1, &(0x7f0000000240)={{0x77359400}}, &(0x7f0000000280)) timer_settime(r3, 0x0, 0x0, 0x0) syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000005, 0x401d031, 0xffffffffffffffff, 0x0) syz_clone(0x8100411, 0x0, 0x0, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x100000d, 0xd031, 0xffffffffffffffff, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_clone(0x1048200, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) fchown(r5, 0xffffffffffffffff, 0x0) syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000001300)=ANY=[@ANYBLOB="12010000000000205804115000000000000109022400010000000009040000050300000009210000000122940309058103"], 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_control_io$hid(r6, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) r7 = eventfd2(0x50, 0x0) open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x1) pipe2$9p(&(0x7f0000001240)={0xffffffffffffffff}, 0x80000) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r7}}) 374.720692ms ago: executing program 5 (id=2278): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000a00)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r2, 0x0, r1, 0x0, 0x10000008ebc, 0x0) splice(r0, 0x0, r3, 0x0, 0x25a5, 0x0) r4 = syz_create_resource$binfmt(&(0x7f0000000000)='./file1\x00') r5 = openat$binfmt(0xffffffffffffff9c, r4, 0x42, 0x1ff) write$binfmt_script(r5, &(0x7f0000000080)={'#! ', './file1', [{}]}, 0x2) write$binfmt_misc(r5, &(0x7f0000000b40)="0931bceaececf9", 0x7) close(r5) execveat$binfmt(0xffffffffffffff9c, r4, 0x0, 0x0, 0x0) r6 = memfd_create(&(0x7f0000000000)='\x00', 0x6) ioctl$BTRFS_IOC_SCRUB_CANCEL(r6, 0x941c, 0x0) 306.107616ms ago: executing program 5 (id=2279): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x481, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000340)=[@text64={0x40, &(0x7f0000000000)="2e41d16cd5f466b822000f00d0460f06f245dd48f526263ef2a585f6b92e030000b800000000ba008000000f3041ab0fc73a0fc71f", 0xfffffffffffffdb6}], 0x1, 0x70, &(0x7f0000000300)=[@vmwrite={0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x81a00000c}], 0x1) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) landlock_create_ruleset(&(0x7f0000000200)={0x6246, 0x2, 0x3}, 0x18, 0x0) (async) r4 = landlock_create_ruleset(&(0x7f0000000200)={0x6246, 0x2, 0x3}, 0x18, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(r4, 0x2, &(0x7f0000000240)={0x0, 0x1000}, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) (async) close_range(r3, 0xffffffffffffffff, 0x0) 246.953068ms ago: executing program 5 (id=2280): mremap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x101800, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) clock_nanosleep(0x1, 0xca9a3b, &(0x7f00000001c0)={0x77359400}, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x6) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000002c0)={0xe5, 0x0, [{0x80000001, 0x2, 0x4, 0x8001}]}) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, &(0x7f0000000840)={'gre0\x00', &(0x7f00000007c0)={'sit0\x00', 0x0, 0x80, 0x7800, 0x6, 0x3b4f, {{0x5, 0x4, 0x3, 0x18, 0x14, 0x68, 0x0, 0x5, 0x2f, 0x0, @loopback, @private=0xa010100}}}}) r4 = fsopen(&(0x7f0000000280)='configfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x0, 0x1) fchdir(r5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x115) getdents(r6, 0x0, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r7, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000001100010000000000ffdbdf252c00000031"], 0x3c}], 0x1, 0x0, 0x0, 0xc010}, 0x40080) 14.506419ms ago: executing program 0 (id=2281): r0 = socket$inet6(0xa, 0x3, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) (async) ioctl$F2FS_IOC_RESERVE_COMPRESS_BLOCKS(r0, 0x8008f513, &(0x7f0000000000)) (async) setsockopt$sock_int(r0, 0x1, 0x31, &(0x7f00000000c0)=0xa, 0x4) r1 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_SET(r1, &(0x7f0000001880)={0x0, 0x0, &(0x7f0000001840)={&(0x7f0000001800)={0x3c, 0x3f6, 0x10, 0x70bd2c, 0x25dfdbfb, {0x1, 0x0, 0x1, 0x0, 0x5, 0x0, 0x9, 0x72, 0x0, 0x9}}, 0x3c}, 0x1, 0x0, 0x0, 0x20040000}, 0x20000010) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) setsockopt$sock_int(r3, 0x1, 0x10, &(0x7f0000000380)=0x38800000, 0x4) sendmmsg(r3, &(0x7f0000001c00), 0x0, 0x20000005) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_int(r4, &(0x7f0000000100)='cpuset.cpus\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) write$cgroup_subtree(r5, &(0x7f0000000080)=ANY=[], 0x31) (async) unshare(0x2040400) (async) listen(r3, 0x2) r6 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000140), 0x1, 0x0) ioctl$EVIOCSCLOCKID(r6, 0x400445a0, &(0x7f0000000180)=0x7fff) (async) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) (async) r7 = syz_open_dev$evdev(&(0x7f0000002a80), 0x66, 0x42502) ioctl$EVIOCGVERSION(r7, 0x80044501, &(0x7f0000003080)=""/81) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22, 0x0, @empty, 0x80002}, 0x1c) 0s ago: executing program 5 (id=2282): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80040, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) dup(r1) (async) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x3, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x3, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r3, &(0x7f0000000000)='7', 0x1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r5 = fsopen(&(0x7f0000000000)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0x9) fchdir(r6) r7 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x101000, 0x108) getdents64(r7, &(0x7f0000000f80)=""/4096, 0x1000) getdents(r7, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) (async) r8 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r8, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000001480)={0x0}}, 0x20004015) (async) sendmsg$key(r8, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000001480)={0x0}}, 0x20004015) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, &(0x7f0000000340)="3e360fae4202bac30c0cb8d371c58866efbafc3a0c0c04eeba200066b80200000066ef0f326635000800008fe980388038780addb6e88fb9e88fb9f021520b3ed9ff660f6d5400260f231d", 0x4b}], 0x1, 0x51, 0x0, 0x0) mount$tmpfs(0x0, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000100), 0x81, &(0x7f0000000040)={[{@nr_inodes={'nr_inodes', 0x3d, [0x25]}}]}) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0) (async) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) kernel console output (not intermixed with test programs): s, different from the descriptor's value: 3 [ 89.346349][ T9] usb 2-1: New USB device found, idVendor=17cc, idProduct=1000, bcdDevice= 0.40 [ 89.355519][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.364013][ T9] usb 2-1: Product: syz [ 89.368257][ T9] usb 2-1: Manufacturer: syz [ 89.372877][ T9] usb 2-1: SerialNumber: syz [ 89.589737][ T9] usb 2-1: USB disconnect, device number 41 [ 90.145997][ T36] audit: type=1400 audit(1789979182.620:407): avc: denied { execmem } for pid=2087 comm="syz.1.440" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 90.436511][ T988] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 90.456669][ T36] audit: type=1400 audit(1789979182.930:408): avc: denied { module_load } for pid=2089 comm="syz.3.441" path=2F7365637265746D656D202864656C6574656429 dev="secretmem" ino=23831 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=system permissive=1 [ 90.604993][ T988] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 90.619066][ T988] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 90.628520][ T988] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 90.636828][ T988] usb 2-1: SerialNumber: syz [ 90.885253][ T36] audit: type=1400 audit(1789979183.360:409): avc: denied { execute_no_trans } for pid=2091 comm="syz.0.442" path="/85/file0" dev="tmpfs" ino=482 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 91.074932][ T988] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -71 [ 91.085376][ T988] usb 2-1: USB disconnect, device number 42 [ 91.708854][ T2109] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 91.717830][ T2109] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 91.899741][ T36] audit: type=1326 audit(1789979184.370:410): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2062 comm="syz.2.432" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0a25b9e159 code=0x7fc00000 [ 91.943882][ T988] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 92.083710][ T988] usb 2-1: device descriptor read/64, error -71 [ 92.323809][ T988] usb 2-1: device descriptor read/64, error -71 [ 92.452313][ T2132] __vm_enough_memory: pid: 2132, comm: syz.2.455, bytes: 11727572324352 not enough memory for the allocation [ 92.464497][ T2132] __vm_enough_memory: pid: 2132, comm: syz.2.455, bytes: 11727572324352 not enough memory for the allocation [ 92.563684][ T988] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 92.690073][ T2138] overlayfs: failed to clone upperpath [ 92.696458][ T2138] overlayfs: failed to clone upperpath [ 92.703773][ T988] usb 2-1: device descriptor read/64, error -71 [ 92.719460][ T36] audit: type=1326 audit(1789979185.190:411): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2139 comm="syz.3.458" exe="/root/ci2-android-6-12-rust/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7271d9e159 code=0x0 [ 92.770504][ T36] audit: type=1400 audit(1789979185.240:412): avc: denied { connect } for pid=2139 comm="syz.3.458" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 92.770618][ T2141] netlink: 92 bytes leftover after parsing attributes in process `syz.3.458'. [ 92.953718][ T988] usb 2-1: device descriptor read/64, error -71 [ 93.063308][ T2143] overlayfs: failed to clone upperpath [ 93.069554][ T988] usb usb2-port1: attempt power cycle [ 93.164620][ T2159] netlink: 36 bytes leftover after parsing attributes in process `syz.2.463'. [ 93.413713][ T988] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 93.434895][ T988] usb 2-1: device descriptor read/8, error -71 [ 93.564953][ T988] usb 2-1: device descriptor read/8, error -71 [ 93.756422][ T36] audit: type=1400 audit(1789979186.230:413): avc: denied { shutdown } for pid=2200 comm="syz.2.475" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 93.813704][ T988] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 93.845065][ T988] usb 2-1: device descriptor read/8, error -71 [ 93.984838][ T988] usb 2-1: device descriptor read/8, error -71 [ 94.016687][ T2210] FAULT_INJECTION: forcing a failure. [ 94.016687][ T2210] name failslab, interval 1, probability 0, space 0, times 0 [ 94.029712][ T2210] CPU: 0 UID: 0 PID: 2210 Comm: syz.0.477 Not tainted syzkaller #0 e67cc5743245539115c479145c763e2a95730d6f [ 94.029741][ T2210] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 94.029751][ T2210] Call Trace: [ 94.029756][ T2210] [ 94.029762][ T2210] __dump_stack+0x21/0x30 [ 94.029783][ T2210] dump_stack_lvl+0x140/0x1c0 [ 94.029799][ T2210] ? __cfi_dump_stack_lvl+0x10/0x10 [ 94.029815][ T2210] ? __cfi_trace_clock_local+0x10/0x10 [ 94.029827][ T2210] ? kvm_sched_clock_read+0x15/0x30 [ 94.029842][ T2210] ? sched_clock_noinstr+0xd/0x30 [ 94.029855][ T2210] dump_stack+0x19/0x20 [ 94.029868][ T2210] should_fail_ex+0x3c2/0x510 [ 94.029884][ T2210] should_failslab+0xac/0x100 [ 94.029898][ T2210] kmem_cache_alloc_noprof+0x42/0x410 [ 94.029910][ T2210] ? vm_area_dup+0x3f/0x560 [ 94.029922][ T2210] vm_area_dup+0x3f/0x560 [ 94.029934][ T2210] ? __split_vma+0x1b8/0xc10 [ 94.029945][ T2210] __split_vma+0x1ce/0xc10 [ 94.029957][ T2210] ? vms_gather_munmap_vmas+0xd90/0xd90 [ 94.029970][ T2210] ? trace_buffer_unlock_commit_regs+0x14a/0x600 [ 94.029983][ T2210] vma_modify+0x364/0x1540 [ 94.029996][ T2210] vma_modify_flags+0x182/0x1c0 [ 94.030009][ T2210] mlock_fixup+0x1c9/0x740 [ 94.030024][ T2210] apply_vma_lock_flags+0x28a/0x3b0 [ 94.030039][ T2210] ? do_mlock+0xa10/0xa10 [ 94.030054][ T2210] ? __cfi_down_write_killable+0x10/0x10 [ 94.030068][ T2210] ? __kasan_check_read+0x15/0x20 [ 94.030079][ T2210] ? ring_buffer_unlock_commit+0x473/0x5e0 [ 94.030092][ T2210] do_mlock+0x71d/0xa10 [ 94.030106][ T2210] ? trace_buffer_unlock_commit_regs+0x14a/0x600 [ 94.030119][ T2210] ? lru_gen_add_folio+0x880/0x880 [ 94.030134][ T2210] ? trace_event_raw_event_sys_enter+0xf5/0x130 [ 94.030151][ T2210] __x64_sys_mlock+0x64/0x80 [ 94.030165][ T2210] x64_sys_call+0x670/0x2ee0 [ 94.030175][ T2210] do_syscall_64+0x57/0xf0 [ 94.030185][ T2210] ? clear_bhb_loop+0x50/0xa0 [ 94.030199][ T2210] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 94.030212][ T2210] RIP: 0033:0x7f74c3d9e159 [ 94.030223][ T2210] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.030233][ T2210] RSP: 002b:00007f74c27e3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000095 [ 94.030248][ T2210] RAX: ffffffffffffffda RBX: 00007f74c4025fa0 RCX: 00007f74c3d9e159 [ 94.030257][ T2210] RDX: 0000000000000000 RSI: 0000000000003000 RDI: 0000200000001000 [ 94.030273][ T2210] RBP: 00007f74c3e3506b R08: 0000000000000000 R09: 0000000000000000 [ 94.030282][ T2210] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.030290][ T2210] R13: 00007f74c4026038 R14: 00007f74c4025fa0 R15: 00007ffcc18376d8 [ 94.030300][ T2210] [ 94.305470][ T988] usb usb2-port1: unable to enumerate USB device [ 94.369866][ T36] audit: type=1400 audit(1789979186.840:414): avc: denied { mounton } for pid=2218 comm="syz.0.481" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 94.442882][ T2240] futex_wake_op: syz.2.484 tries to shift op by 32; fix this program [ 94.483244][ T2248] FAULT_INJECTION: forcing a failure. [ 94.483244][ T2248] name failslab, interval 1, probability 0, space 0, times 0 [ 94.496008][ T2248] CPU: 0 UID: 0 PID: 2248 Comm: syz.0.486 Not tainted syzkaller #0 e67cc5743245539115c479145c763e2a95730d6f [ 94.496030][ T2248] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 94.496038][ T2248] Call Trace: [ 94.496044][ T2248] [ 94.496049][ T2248] __dump_stack+0x21/0x30 [ 94.496070][ T2248] dump_stack_lvl+0x140/0x1c0 [ 94.496086][ T2248] ? __cfi_dump_stack_lvl+0x10/0x10 [ 94.496102][ T2248] ? trace_event_raw_event_timer_class+0x134/0x1e0 [ 94.496115][ T2248] ? init_srcu_struct_fields+0x3a8/0xac0 [ 94.496126][ T2248] ? __cfi_trace_event_raw_event_timer_class+0x10/0x10 [ 94.496138][ T2248] dump_stack+0x19/0x20 [ 94.496152][ T2248] should_fail_ex+0x3c2/0x510 [ 94.496172][ T2248] should_failslab+0xac/0x100 [ 94.496187][ T2248] __kmalloc_cache_noprof+0x41/0x470 [ 94.496200][ T2248] ? kvm_init_irq_routing+0x62/0x1c0 [ 94.496216][ T2248] ? init_srcu_struct_fields+0x74f/0xac0 [ 94.496228][ T2248] kvm_init_irq_routing+0x62/0x1c0 [ 94.496242][ T2248] ? kvm_dev_ioctl+0x4f6/0x14c0 [ 94.496252][ T2248] kvm_dev_ioctl+0x520/0x14c0 [ 94.496263][ T2248] ? __cfi_kvm_dev_ioctl+0x10/0x10 [ 94.496273][ T2248] ? bpf_lsm_file_ioctl+0xd/0x20 [ 94.496287][ T2248] ? security_file_ioctl+0x3e/0x110 [ 94.496298][ T2248] ? __cfi_kvm_dev_ioctl+0x10/0x10 [ 94.496314][ T2248] __se_sys_ioctl+0x123/0x1b0 [ 94.496328][ T2248] __x64_sys_ioctl+0x7f/0xa0 [ 94.496341][ T2248] x64_sys_call+0x1878/0x2ee0 [ 94.496351][ T2248] do_syscall_64+0x57/0xf0 [ 94.496364][ T2248] ? clear_bhb_loop+0x50/0xa0 [ 94.496379][ T2248] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 94.496393][ T2248] RIP: 0033:0x7f74c3d9e159 [ 94.496405][ T2248] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.496415][ T2248] RSP: 002b:00007f74c27e3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 94.496431][ T2248] RAX: ffffffffffffffda RBX: 00007f74c4025fa0 RCX: 00007f74c3d9e159 [ 94.496440][ T2248] RDX: 0000000000000000 RSI: 000000000000ae01 RDI: 0000000000000005 [ 94.496449][ T2248] RBP: 00007f74c3e3506b R08: 0000000000000000 R09: 0000000000000000 [ 94.496456][ T2248] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.496465][ T2248] R13: 00007f74c4026038 R14: 00007f74c4025fa0 R15: 00007ffcc18376d8 [ 94.496476][ T2248] [ 94.876183][ T36] audit: type=1400 audit(1789979187.350:415): avc: denied { cmd } for pid=2256 comm="syz.0.487" path="/dev/ublk-control" dev="devtmpfs" ino=82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=io_uring permissive=1 [ 94.885137][ T2253] netlink: 'syz.3.489': attribute type 15 has an invalid length. [ 94.908225][ T2253] netlink: 24 bytes leftover after parsing attributes in process `syz.3.489'. [ 98.363344][ T36] audit: type=1400 audit(1789979190.830:416): avc: denied { create } for pid=2269 comm="syz.3.494" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_nflog_socket permissive=1 [ 98.633691][ T985] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 98.665155][ T2289] ./dev/sda1: Can't lookup blockdev [ 98.803719][ T985] usb 2-1: Using ep0 maxpacket: 8 [ 98.819882][ T985] usb 2-1: New USB device found, idVendor=0499, idProduct=5008, bcdDevice= 0.40 [ 98.839527][ T985] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.853695][ T985] usb 2-1: Product: syz [ 98.863727][ T985] usb 2-1: Manufacturer: syz [ 98.869914][ T985] usb 2-1: SerialNumber: syz [ 98.968619][ T2294] netlink: 24 bytes leftover after parsing attributes in process `syz.2.501'. [ 99.083650][ T985] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 99.099048][ T985] snd-usb-audio 2-1:1.1: probe with driver snd-usb-audio failed with error -2 [ 99.126547][ T985] snd-usb-audio 2-1:1.2: probe with driver snd-usb-audio failed with error -2 [ 99.146073][ T985] usb 2-1: USB disconnect, device number 47 [ 99.164540][ T2304] udevd[2304]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.2/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 99.190767][ T2305] netlink: 4 bytes leftover after parsing attributes in process `syz.2.502'. [ 99.391933][ T2311] ./dev/sda1: Can't lookup blockdev [ 99.427036][ T2313] netlink: 'syz.3.506': attribute type 1 has an invalid length. [ 99.440404][ T2313] netlink: 'syz.3.506': attribute type 2 has an invalid length. [ 99.450192][ T2313] netlink: 12 bytes leftover after parsing attributes in process `syz.3.506'. [ 99.551590][ T36] audit: type=1400 audit(1789979448.014:417): avc: denied { create } for pid=2325 comm="syz.0.508" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 99.843721][ T985] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 100.003715][ T985] usb 2-1: Using ep0 maxpacket: 16 [ 100.009387][ T2355] ªªªªªª: renamed from vlan0 (while UP) [ 100.021778][ T985] usb 2-1: config 0 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 128, changing to 11 [ 100.039029][ T2355] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=2355 comm=syz.3.516 [ 100.055147][ T985] usb 2-1: config 0 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 100.090636][ T985] usb 2-1: config 0 interface 0 has no altsetting 0 [ 100.110910][ T985] usb 2-1: New USB device found, idVendor=046d, idProduct=c29a, bcdDevice= 0.00 [ 100.143756][ T985] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 100.165123][ T985] usb 2-1: config 0 descriptor?? [ 100.405921][ T985] input: HID 046d:c29a as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:046D:C29A.0006/input/input9 [ 100.442655][ T36] audit: type=1400 audit(1789979448.894:418): avc: denied { search } for pid=95 comm="acpid" name="dev" dev="sda1" ino=1262 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:mnt_t tclass=dir permissive=1 [ 100.466849][ T985] logitech 0003:046D:C29A.0006: input,hiddev96,hidraw0: USB HID v0.04 Device [HID 046d:c29a] on usb-dummy_hcd.1-1/input0 [ 100.473562][ T2364] udevd[2364]: open /dev/null failed: No such file or directory [ 100.512203][ T985] logitech 0003:046D:C29A.0006: missing HID_OUTPUT_REPORT 0 [ 100.540715][ T985] logitech 0003:046D:C29A.0006: probe with driver logitech failed with error -1 [ 100.565469][ T985] usb 2-1: USB disconnect, device number 48 [ 101.074153][ T36] audit: type=1400 audit(1789979449.544:419): avc: denied { accept } for pid=2378 comm="syz.2.525" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 101.174675][ T985] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 101.343745][ T985] usb 2-1: Using ep0 maxpacket: 16 [ 101.353480][ T985] usb 2-1: unable to get BOS descriptor or descriptor too short [ 101.366088][ T985] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 101.380887][ T985] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 101.400132][ T985] usb 2-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 101.429004][ T985] usb 2-1: New USB device found, idVendor=17cc, idProduct=0839, bcdDevice= 0.40 [ 101.441694][ T985] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 101.458903][ T985] usb 2-1: Product: syz [ 101.467803][ T985] usb 2-1: Manufacturer: syz [ 101.472414][ T985] usb 2-1: SerialNumber: syz [ 101.691862][ T985] usb 2-1: unit 5 not found! [ 101.715010][ T2304] udevd[2304]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 101.724015][ T985] usb 2-1: USB disconnect, device number 49 [ 101.880849][ T36] audit: type=1400 audit(1789979450.344:420): avc: denied { create } for pid=2398 comm="syz.3.534" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 101.901413][ T36] audit: type=1400 audit(1789979450.344:421): avc: denied { read } for pid=2398 comm="syz.3.534" name="file0" dev="tmpfs" ino=1017 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 101.923654][ T36] audit: type=1400 audit(1789979450.344:422): avc: denied { open } for pid=2398 comm="syz.3.534" path="/172/file0" dev="tmpfs" ino=1017 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 101.946369][ T36] audit: type=1400 audit(1789979450.394:423): avc: denied { ioctl } for pid=2398 comm="syz.3.534" path="/172/file0" dev="tmpfs" ino=1017 ioctlcmd=0xaee1 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 102.226148][ T2411] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 102.244048][ T2410] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 102.342493][ T36] audit: type=1400 audit(1789979450.804:424): avc: denied { setopt } for pid=2415 comm="syz.0.539" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 102.633746][ T985] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 102.665709][ T36] audit: type=1400 audit(1789979451.134:425): avc: denied { unlink } for pid=296 comm="syz-executor" name="file0" dev="tmpfs" ino=1017 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 102.793776][ T985] usb 2-1: Using ep0 maxpacket: 32 [ 102.800308][ T985] usb 2-1: config 0 has an invalid descriptor of length 114, skipping remainder of the config [ 102.812388][ T985] usb 2-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 102.821765][ T985] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 102.829808][ T985] usb 2-1: Product: syz [ 102.834281][ T985] usb 2-1: Manufacturer: syz [ 102.838878][ T985] usb 2-1: SerialNumber: syz [ 102.847999][ T985] usb 2-1: config 0 descriptor?? [ 102.859190][ T985] usb 2-1: bad CDC descriptors [ 102.866713][ T985] usb 2-1: unsupported MDLM descriptors [ 103.061260][ T985] usb 2-1: USB disconnect, device number 50 [ 103.238163][ T2446] ./dev/sda1: Can't lookup blockdev [ 103.386754][ T2450] ./dev/sda1: Can't lookup blockdev [ 103.394133][ T2452] overlay: Unknown parameter '' [ 103.626705][ T36] kauditd_printk_skb: 1 callbacks suppressed [ 103.626725][ T36] audit: type=1400 audit(1789979452.094:427): avc: denied { ioctl } for pid=2460 comm="syz.1.555" path="socket:[25359]" dev="sockfs" ino=25359 ioctlcmd=0x9439 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 103.819385][ T2478] ./dev/sda1: Can't lookup blockdev [ 103.835386][ T2478] fuse: Unknown parameter 'rootm‚Á¯G£®­‘0000000000000040000' [ 103.923723][ T985] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 104.075653][ T985] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 104.093668][ T985] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 104.113194][ T985] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 104.127844][ T985] usb 2-1: config 0 descriptor?? [ 104.346427][ T985] usbhid 2-1:0.0: can't add hid device: -71 [ 104.353748][ T985] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 104.380401][ T985] usb 2-1: USB disconnect, device number 51 [ 104.402031][ T2527] netlink: 252 bytes leftover after parsing attributes in process `syz.0.569'. [ 104.429286][ T2527] IPv6: NLM_F_CREATE should be specified when creating new route [ 104.873715][ T985] usb 2-1: new full-speed USB device number 52 using dummy_hcd [ 104.999455][ T2557] fuse: Bad value for 'fd' [ 105.044773][ T985] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 105.086698][ T985] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 105.120666][ T985] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.147027][ T985] usb 2-1: config 0 descriptor?? [ 105.156315][ T2558] cgroup: fork rejected by pids controller in /syz0 [ 105.368524][ T2467] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 105.390647][ T2467] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 105.619811][ T2467] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 105.647742][ T2467] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 105.669714][ T2467] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 105.688493][ T2467] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 106.090712][ T2623] netlink: 4 bytes leftover after parsing attributes in process `syz.0.585'. [ 106.109776][ T985] usbhid 2-1:0.0: can't add hid device: -71 [ 106.117316][ T2622] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=60 sclass=netlink_route_socket pid=2622 comm=syz.0.585 [ 106.133740][ T985] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 106.153227][ T985] usb 2-1: USB disconnect, device number 52 [ 106.314982][ T36] audit: type=1400 audit(1789979454.784:428): avc: denied { name_bind } for pid=2628 comm="syz.3.588" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 106.641847][ T2641] ./dev/sda1: Can't lookup blockdev [ 106.664557][ T2641] ./dev/sda1: Can't lookup blockdev [ 106.673883][ T2641] ./dev/sda1: Can't lookup blockdev [ 106.683870][ T2641] ./dev/sda1: Can't lookup blockdev [ 106.693974][ T2641] ./dev/sda1: Can't lookup blockdev [ 106.707920][ T2641] ./dev/sda1: Can't lookup blockdev [ 106.718043][ T2641] ./dev/sda1: Can't lookup blockdev [ 106.733759][ T2641] ./dev/sda1: Can't lookup blockdev [ 106.747860][ T2641] ./dev/sda1: Can't lookup blockdev [ 106.768660][ T2641] ./dev/sda1: Can't lookup blockdev [ 106.784213][ T2641] ./dev/sda1: Can't lookup blockdev [ 106.801642][ T2641] ./dev/sda1: Can't lookup blockdev [ 106.820192][ T2641] ./dev/sda1: Can't lookup blockdev [ 106.828943][ T2653] netlink: 12 bytes leftover after parsing attributes in process `syz.0.592'. [ 106.843955][ T2641] ./dev/sda1: Can't lookup blockdev [ 106.854015][ T2641] ./dev/sda1: Can't lookup blockdev [ 106.871590][ T2641] ./dev/sda1: Can't lookup blockdev [ 106.887506][ T2641] ./dev/sda1: Can't lookup blockdev [ 106.912750][ T2641] ./dev/sda1: Can't lookup blockdev [ 106.933947][ T2641] ./dev/sda1: Can't lookup blockdev [ 106.953029][ T2641] ./dev/sda1: Can't lookup blockdev [ 106.963158][ T2657] netlink: 12 bytes leftover after parsing attributes in process `syz.0.594'. [ 106.988113][ T2641] ./dev/sda1: Can't lookup blockdev [ 107.003907][ T2641] ./dev/sda1: Can't lookup blockdev [ 107.023932][ T2641] ./dev/sda1: Can't lookup blockdev [ 107.044690][ T2641] ./dev/sda1: Can't lookup blockdev [ 107.072318][ T2641] ./dev/sda1: Can't lookup blockdev [ 107.089844][ T2641] ./dev/sda1: Can't lookup blockdev [ 107.113563][ T2641] ./dev/sda1: Can't lookup blockdev [ 107.122278][ T36] audit: type=1400 audit(1789979455.594:429): avc: denied { getopt } for pid=2656 comm="syz.0.594" lport=28196 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 107.133917][ T2641] ./dev/sda1: Can't lookup blockdev [ 107.193877][ T2641] ./dev/sda1: Can't lookup blockdev [ 107.210784][ T36] audit: type=1400 audit(1789979455.674:430): avc: denied { create } for pid=2674 comm="syz.0.600" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 107.214817][ T2641] ./dev/sda1: Can't lookup blockdev [ 107.293017][ T36] audit: type=1400 audit(1789979455.754:431): avc: denied { bind } for pid=2678 comm="syz.3.603" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 107.293296][ T2680] netlink: 68 bytes leftover after parsing attributes in process `syz.0.604'. [ 107.331101][ T2641] ./dev/sda1: Can't lookup blockdev [ 107.345538][ T2641] ./dev/sda1: Can't lookup blockdev [ 107.360395][ T2641] ./dev/sda1: Can't lookup blockdev [ 107.468304][ T36] audit: type=1400 audit(1789979455.934:432): avc: denied { read write } for pid=2721 comm="syz.1.609" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 107.495628][ T36] audit: type=1400 audit(1789979455.934:433): avc: denied { open } for pid=2721 comm="syz.1.609" path="/dev/raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 107.519420][ T36] audit: type=1400 audit(1789979455.934:434): avc: denied { ioctl } for pid=2721 comm="syz.1.609" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 107.569814][ T36] audit: type=1326 audit(1789979456.034:435): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2737 comm="syz.0.611" exe="/root/ci2-android-6-12-rust/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f74c3d9e159 code=0x0 [ 107.703807][ T985] usb 2-1: new low-speed USB device number 53 using dummy_hcd [ 107.854791][ T985] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 107.874064][ T985] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 107.893881][ T985] usb 2-1: New USB device found, idVendor=0c70, idProduct=f0b6, bcdDevice= 0.00 [ 107.912927][ T985] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 107.931243][ T985] usb 2-1: config 0 descriptor?? [ 108.065154][ T2853] fuse: Bad value for 'fd' [ 108.345159][ T985] hid-generic 0003:0C70:F0B6.0007: unknown main item tag 0x0 [ 108.354093][ T985] hid-generic 0003:0C70:F0B6.0007: item fetching failed at offset 5/7 [ 108.371507][ T985] hid-generic 0003:0C70:F0B6.0007: probe with driver hid-generic failed with error -22 [ 108.555200][ T2723] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 108.580548][ T2723] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 108.590873][ T36] audit: type=1326 audit(1789979457.064:436): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2845 comm="syz.2.612" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0a25b9e159 code=0x7fc00000 [ 108.725344][ T36] audit: type=1400 audit(1789979457.194:437): avc: denied { read } for pid=2871 comm="syz.2.621" path="socket:[26574]" dev="sockfs" ino=26574 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 108.739329][ T2869] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=2869 comm=syz.0.620 [ 108.947195][ T2887] netlink: 92 bytes leftover after parsing attributes in process `syz.2.628'. [ 108.976010][ T2888] netlink: 92 bytes leftover after parsing attributes in process `syz.2.628'. [ 109.026586][ T2894] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 109.076522][ T2900] netlink: 12 bytes leftover after parsing attributes in process `syz.2.632'. [ 109.094325][ T36] audit: type=1400 audit(1789979457.564:438): avc: denied { associate } for pid=2899 comm="syz.0.631" name="core" scontext=root:object_r:etc_runtime_t tcontext=system_u:object_r:root_t tclass=filesystem permissive=1 [ 109.104813][ T2900] netlink: 1 bytes leftover after parsing attributes in process `syz.2.632'. [ 109.126875][ T2894] x86/PAT: syz.0.631:2894 freeing invalid memtype [mem 0xfe004000-0xfe005fff] [ 109.762359][ T36] audit: type=1400 audit(1789979458.224:439): avc: denied { write } for pid=2909 comm="syz.0.634" name="file1" dev="tmpfs" ino=795 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 109.767764][ T2910] overlayfs: failed to clone upperpath [ 110.176655][ T2942] netlink: 12 bytes leftover after parsing attributes in process `syz.2.637'. [ 110.403811][ T36] audit: type=1400 audit(1789979458.864:440): avc: denied { create } for pid=2957 comm="syz.2.642" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 110.487946][ T985] usb 2-1: USB disconnect, device number 53 [ 110.572545][ T36] audit: type=1400 audit(1789979459.034:441): avc: denied { mounton } for pid=2966 comm="syz.1.645" path="/100/file0" dev="tmpfs" ino=606 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 110.796439][ T36] audit: type=1400 audit(1789979459.264:442): avc: denied { append } for pid=2975 comm="syz.1.646" name="uprobe_events" dev="tracefs" ino=1045 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 110.870231][ T2979] netlink: 328 bytes leftover after parsing attributes in process `syz.3.647'. [ 112.869116][ T36] audit: type=1400 audit(1789979461.334:443): avc: denied { map } for pid=3005 comm="syz.1.655" path="socket:[27142]" dev="sockfs" ino=27142 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_stream_socket permissive=1 [ 112.999184][ T2304] udevd[2304]: inotify_add_watch(7, /dev/loop5, 10) failed: No such file or directory [ 113.076043][ T3014] mmap: syz.1.657 (3014): VmData 29073408 exceed data ulimit 1587. Update limits or use boot option ignore_rlimit_data. [ 113.373768][ T985] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 113.418060][ T3031] ./dev/sda1: Can't lookup blockdev [ 113.523697][ T985] usb 2-1: Using ep0 maxpacket: 32 [ 113.534795][ T985] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 113.563928][ T3036] overlayfs: failed to resolve './cgroup': -2 [ 113.580322][ T985] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 113.601048][ T985] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2d51, bcdDevice= 0.00 [ 113.622474][ T985] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 113.641971][ T985] usb 2-1: config 0 descriptor?? [ 113.779546][ T3049] netlink: 16 bytes leftover after parsing attributes in process `syz.3.667'. [ 114.062290][ T985] usbhid 2-1:0.0: can't add hid device: -71 [ 114.080664][ T985] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 114.115636][ T985] usb 2-1: USB disconnect, device number 54 [ 114.278452][ T3063] 9pnet_fd: Insufficient options for proto=fd [ 114.478859][ T3088] fuse: Bad value for 'group_id' [ 114.488753][ T3088] fuse: Bad value for 'group_id' [ 114.640948][ T3098] kvm: user requested TSC rate below hardware speed [ 114.860574][ T3113] netlink: 132 bytes leftover after parsing attributes in process `syz.0.687'. [ 115.231366][ T3119] netlink: 'syz.2.690': attribute type 4 has an invalid length. [ 115.292324][ T3121] tipc: Failed to remove unknown binding: 66,0,0/0:995570390/995570392 [ 115.316365][ T3121] tipc: Failed to remove unknown binding: 66,0,0/0:995570390/995570391 [ 115.347747][ T3121] tipc: Failed to remove unknown binding: 66,0,0/0:995570390/995570392 [ 115.376033][ T3121] tipc: Failed to remove unknown binding: 66,0,0/0:995570390/995570391 [ 115.415981][ T3124] ./dev/sda1: Can't lookup blockdev [ 115.444181][ T36] audit: type=1400 audit(2000000000.239:444): avc: denied { mount } for pid=3125 comm="syz.0.693" name="/" dev="ramfs" ino=27865 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 115.466714][ T36] audit: type=1400 audit(2000000000.239:445): avc: denied { create } for pid=3125 comm="syz.0.693" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=chr_file permissive=1 [ 115.509019][ T36] audit: type=1400 audit(2000000000.249:446): avc: denied { link } for pid=3125 comm="syz.0.693" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="ramfs" ino=27866 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=chr_file permissive=1 [ 115.583086][ T36] audit: type=1400 audit(2000000000.369:447): avc: denied { name_bind } for pid=3129 comm="syz.0.695" src=65530 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=rawip_socket permissive=1 [ 115.637894][ T36] audit: type=1400 audit(2000000000.429:448): avc: denied { setattr } for pid=3132 comm="syz.0.696" name="NETLINK" dev="sockfs" ino=27886 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 116.410494][ T36] audit: type=1326 audit(2000000001.199:449): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3140 comm="syz.3.698" exe="/root/ci2-android-6-12-rust/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7271d9e159 code=0x0 [ 116.995320][ T3158] netlink: 1412 bytes leftover after parsing attributes in process `syz.2.702'. [ 117.112598][ T36] audit: type=1326 audit(2000000001.899:450): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3159 comm="syz.2.703" exe="/root/ci2-android-6-12-rust/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f0a25b9e159 code=0x0 [ 117.163417][ T3161] tc_dump_action: action bad kind [ 117.180008][ T3161] sock: sock_set_timeout: `syz.2.703' (pid 3161) tries to set negative timeout [ 117.239357][ T3165] netlink: 72 bytes leftover after parsing attributes in process `syz.3.704'. [ 117.289017][ T3170] netlink: 68 bytes leftover after parsing attributes in process `syz.0.706'. [ 117.340933][ T36] audit: type=1326 audit(2000000002.129:451): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3169 comm="syz.0.706" exe="/root/ci2-android-6-12-rust/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f74c3d9e159 code=0x0 [ 117.516055][ T36] audit: type=1400 audit(2000000002.309:452): avc: denied { create } for pid=3194 comm="syz.3.710" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 117.594021][ T3198] netlink: 80 bytes leftover after parsing attributes in process `syz.3.711'. [ 117.904943][ T36] audit: type=1400 audit(2000000002.699:453): avc: denied { associate } for pid=3210 comm="syz.1.715" name="111" dev="tmpfs" ino=663 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:usbmon_device_t:s0" [ 117.991615][ T3211] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 118.278292][ T481] bridge_slave_1: left allmulticast mode [ 118.293920][ T481] bridge_slave_1: left promiscuous mode [ 118.299598][ T481] bridge0: port 2(bridge_slave_1) entered disabled state [ 118.323314][ T481] bridge_slave_0: left allmulticast mode [ 118.329060][ T481] bridge_slave_0: left promiscuous mode [ 118.335150][ T481] bridge0: port 1(bridge_slave_0) entered disabled state [ 118.460154][ T481] tipc: Left network mode [ 118.469850][ T481] veth1_macvtap: left promiscuous mode [ 118.619021][ T3236] bridge0: port 1(bridge_slave_0) entered blocking state [ 118.631103][ T3236] bridge0: port 1(bridge_slave_0) entered disabled state [ 118.638633][ T3236] bridge_slave_0: entered allmulticast mode [ 118.645607][ T3236] bridge_slave_0: entered promiscuous mode [ 118.652724][ T3236] bridge0: port 2(bridge_slave_1) entered blocking state [ 118.660100][ T3236] bridge0: port 2(bridge_slave_1) entered disabled state [ 118.667584][ T3236] bridge_slave_1: entered allmulticast mode [ 118.674378][ T3236] bridge_slave_1: entered promiscuous mode [ 118.762007][ T3236] bridge0: port 2(bridge_slave_1) entered blocking state [ 118.769147][ T3236] bridge0: port 2(bridge_slave_1) entered forwarding state [ 118.776533][ T3236] bridge0: port 1(bridge_slave_0) entered blocking state [ 118.783594][ T3236] bridge0: port 1(bridge_slave_0) entered forwarding state [ 118.844328][ T477] bridge0: port 1(bridge_slave_0) entered disabled state [ 118.854012][ T477] bridge0: port 2(bridge_slave_1) entered disabled state [ 118.867460][ T477] bridge0: port 1(bridge_slave_0) entered blocking state [ 118.874611][ T477] bridge0: port 1(bridge_slave_0) entered forwarding state [ 118.896301][ T477] bridge0: port 2(bridge_slave_1) entered blocking state [ 118.903476][ T477] bridge0: port 2(bridge_slave_1) entered forwarding state [ 119.011279][ T3236] veth0_vlan: entered promiscuous mode [ 119.059255][ T3236] veth1_macvtap: entered promiscuous mode [ 119.149874][ T3300] Bluetooth: ISO socket layer initialized [ 120.025331][ T3352] EXT4-fs: Value of option "test_dummy_encryption" is unrecognized [ 120.551121][ T3369] netlink: 36 bytes leftover after parsing attributes in process `syz.2.748'. [ 120.616498][ T3370] fuse: Bad value for 'user_id' [ 120.625858][ T3370] fuse: Bad value for 'user_id' [ 120.699514][ T3373] 9p: Unknown access argument useY: -22 [ 120.811018][ T3378] rust_binder: 3377:3378 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch [ 120.847760][ T312] rust_binder: 3377: undelivered death notification, 00000000000000fc [ 120.880491][ T3380] batadv_slave_1: entered promiscuous mode [ 120.907777][ T3379] batadv_slave_1: left promiscuous mode [ 120.976919][ T3388] tipc: Started in network mode [ 120.981944][ T3388] tipc: Node identity 52a333f31724, cluster identity 4711 [ 120.990118][ T3388] tipc: Enabled bearer , priority 0 [ 120.999398][ T3388] tipc: Disabling bearer [ 121.603367][ T3406] fuse: Unknown parameter 'groud' [ 121.901833][ T3439] netlink: 1351 bytes leftover after parsing attributes in process `syz.0.768'. [ 121.911235][ T3438] netlink: 1351 bytes leftover after parsing attributes in process `syz.0.768'. [ 121.959211][ T3448] netlink: 32 bytes leftover after parsing attributes in process `syz.4.767'. [ 122.597347][ T36] kauditd_printk_skb: 23 callbacks suppressed [ 122.597367][ T36] audit: type=1400 audit(2000000007.389:477): avc: denied { mount } for pid=3465 comm="syz.3.775" name="/" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 122.597893][ T3468] ./dev/sda1: Can't lookup blockdev [ 122.675840][ T3476] fuse: Bad value for 'fd' [ 122.770627][ T36] audit: type=1400 audit(2000000007.559:478): avc: denied { bpf } for pid=3491 comm="syz.4.785" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 122.945385][ T36] audit: type=1400 audit(2000000007.739:479): avc: denied { getopt } for pid=3504 comm="syz.4.790" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 123.235312][ T36] audit: type=1400 audit(2000000008.029:480): avc: denied { append } for pid=3514 comm="syz.4.794" name="tun" dev="sda1" ino=2053 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:mnt_t tclass=chr_file permissive=1 [ 123.427440][ T3532] netlink: 20 bytes leftover after parsing attributes in process `syz.2.799'. [ 123.553705][ T3546] netlink: 8 bytes leftover after parsing attributes in process `syz.3.802'. [ 123.574197][ T3546] fuse: Unknown parameter 'roo00000000000000000000' [ 124.827234][ T3592] 9pnet_fd: Insufficient options for proto=fd [ 124.833658][ T3593] 9pnet_fd: Insufficient options for proto=fd [ 124.940294][ T36] audit: type=1400 audit(2000000009.729:481): avc: denied { rename } for pid=3611 comm="syz.4.823" name="file0" dev="tmpfs" ino=198 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 125.328668][ T36] audit: type=1400 audit(2000000010.119:482): avc: denied { nlmsg_read } for pid=3616 comm="syz.2.826" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 125.353677][ T36] audit: type=1326 audit(2000000010.119:483): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3616 comm="syz.2.826" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0a25b9e159 code=0x7ffc0000 [ 125.384376][ T3622] netlink: 104 bytes leftover after parsing attributes in process `syz.4.825'. [ 125.403690][ T36] audit: type=1326 audit(2000000010.119:484): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3616 comm="syz.2.826" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f0a25b9e159 code=0x7ffc0000 [ 125.443694][ T36] audit: type=1326 audit(2000000010.119:485): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3616 comm="syz.2.826" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0a25b9e159 code=0x7ffc0000 [ 125.474977][ T3626] ./dev/sda1: Can't lookup blockdev [ 125.514867][ T3629] tipc: Enabled bearer , priority 0 [ 125.521653][ T3631] overlay: Bad value for 'xino' [ 125.547787][ T3634] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=261 sclass=netlink_xfrm_socket pid=3634 comm=syz.2.832 [ 125.596346][ T3629] syzkaller0: entered promiscuous mode [ 125.601867][ T3629] syzkaller0: entered allmulticast mode [ 125.627510][ T3639] fuse: Bad value for 'fd' [ 125.627948][ T3629] tipc: Resetting bearer [ 125.636896][ T3639] fuse: Bad value for 'fd' [ 125.655609][ T3628] tipc: Resetting bearer [ 125.684299][ T3628] tipc: Disabling bearer [ 125.780395][ T36] audit: type=1400 audit(2000000010.569:486): avc: denied { bind } for pid=3643 comm="syz.4.836" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 125.804286][ T3645] netlink: 8 bytes leftover after parsing attributes in process `syz.4.836'. [ 125.817061][ T3647] netlink: 'syz.4.836': attribute type 28 has an invalid length. [ 127.260817][ T3681] 9pnet_fd: Insufficient options for proto=fd [ 127.268249][ T3682] tipc: Cannot configure node identity twice [ 127.402114][ T3705] tmpfs: Cannot disable swap on remount [ 127.471761][ T3712] overlayfs: failed to resolve '/ÿÿ': -2 [ 127.617529][ T36] kauditd_printk_skb: 3 callbacks suppressed [ 127.617549][ T36] audit: type=1400 audit(2000000012.409:490): avc: denied { remount } for pid=3728 comm="syz.0.867" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=filesystem permissive=1 [ 127.664817][ T3736] overlayfs: failed to resolve './file0': -2 [ 128.197595][ T3765] netlink: 'syz.3.877': attribute type 17 has an invalid length. [ 128.216875][ T3765] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1795 sclass=netlink_route_socket pid=3765 comm=syz.3.877 [ 128.523237][ T3773] ffs_data_put(): freeing [ 128.527967][ T3774] ffs_data_put(): freeing [ 128.533723][ T3773] overlayfs: failed to clone upperpath [ 128.556329][ T36] audit: type=1400 audit(2000000013.349:491): avc: denied { nlmsg_write } for pid=3775 comm="syz.0.881" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 128.769046][ T36] audit: type=1400 audit(2000000013.559:492): avc: denied { nlmsg_read } for pid=3791 comm="syz.3.887" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 128.864616][ T36] audit: type=1400 audit(2000000013.659:493): avc: denied { accept } for pid=3796 comm="syz.4.889" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 129.229680][ T3813] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=3813 comm=syz.0.893 [ 129.245070][ T3813] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=3813 comm=syz.0.893 [ 129.258300][ T3813] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=3813 comm=syz.0.893 [ 129.271480][ T3813] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=3813 comm=syz.0.893 [ 129.293103][ T3813] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=3813 comm=syz.0.893 [ 129.318831][ T3813] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=3813 comm=syz.0.893 [ 129.343762][ T3813] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=3813 comm=syz.0.893 [ 129.373943][ T3813] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=3813 comm=syz.0.893 [ 129.465144][ T3826] syz.0.899: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz0,mems_allowed=0 [ 129.481147][ T3826] CPU: 0 UID: 0 PID: 3826 Comm: syz.0.899 Not tainted syzkaller #0 e67cc5743245539115c479145c763e2a95730d6f [ 129.481184][ T3826] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 129.481200][ T3826] Call Trace: [ 129.481210][ T3826] [ 129.481220][ T3826] __dump_stack+0x21/0x30 [ 129.481255][ T3826] dump_stack_lvl+0x140/0x1c0 [ 129.481285][ T3826] ? __cfi_dump_stack_lvl+0x10/0x10 [ 129.481314][ T3826] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 129.481339][ T3826] dump_stack+0x19/0x20 [ 129.481366][ T3826] warn_alloc+0x1e7/0x2c0 [ 129.481394][ T3826] ? stack_depot_save_flags+0x38/0x800 [ 129.481422][ T3826] ? __cfi_warn_alloc+0x10/0x10 [ 129.481449][ T3826] ? kasan_save_track+0x3e/0x80 [ 129.481472][ T3826] ? kasan_save_alloc_info+0x3a/0x50 [ 129.481493][ T3826] ? xsk_init_queue+0xb2/0x120 [ 129.481514][ T3826] ? xsk_setsockopt+0x411/0x760 [ 129.481548][ T3826] ? do_sock_setsockopt+0x27c/0x410 [ 129.481578][ T3826] ? __x64_sys_setsockopt+0x18c/0x220 [ 129.481652][ T3826] ? x64_sys_call+0x2adc/0x2ee0 [ 129.481673][ T3826] ? do_syscall_64+0x57/0xf0 [ 129.481694][ T3826] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 129.481724][ T3826] __vmalloc_node_range_noprof+0x136/0x1300 [ 129.481761][ T3826] ? __cfi___vmalloc_node_range_noprof+0x10/0x10 [ 129.481791][ T3826] ? trace_event_raw_event_kmalloc+0xac/0xf0 [ 129.481821][ T3826] ? kasan_save_alloc_info+0x3a/0x50 [ 129.481841][ T3826] ? __kasan_kmalloc+0x96/0xb0 [ 129.481867][ T3826] ? __kmalloc_cache_noprof+0x23c/0x470 [ 129.481891][ T3826] vmalloc_user_noprof+0x77/0x90 [ 129.481911][ T3826] ? xskq_create+0xdb/0x290 [ 129.481933][ T3826] xskq_create+0xdb/0x290 [ 129.481956][ T3826] xsk_init_queue+0xb2/0x120 [ 129.481979][ T3826] xsk_setsockopt+0x411/0x760 [ 129.482001][ T3826] ? __cfi_xsk_setsockopt+0x10/0x10 [ 129.482024][ T3826] ? bpf_lsm_socket_setsockopt+0xd/0x20 [ 129.482049][ T3826] ? security_socket_setsockopt+0x3d/0x100 [ 129.482079][ T3826] ? __cfi_xsk_setsockopt+0x10/0x10 [ 129.482102][ T3826] do_sock_setsockopt+0x27c/0x410 [ 129.482129][ T3826] ? trace_buffer_unlock_commit_regs+0x14a/0x600 [ 129.482154][ T3826] ? __cfi_do_sock_setsockopt+0x10/0x10 [ 129.482182][ T3826] ? __fget_files+0x2bc/0x330 [ 129.482209][ T3826] __x64_sys_setsockopt+0x18c/0x220 [ 129.482237][ T3826] x64_sys_call+0x2adc/0x2ee0 [ 129.482258][ T3826] do_syscall_64+0x57/0xf0 [ 129.482277][ T3826] ? clear_bhb_loop+0x50/0xa0 [ 129.482303][ T3826] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 129.482328][ T3826] RIP: 0033:0x7f74c3d9e159 [ 129.482348][ T3826] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 129.482367][ T3826] RSP: 002b:00007f74c27e3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 129.482393][ T3826] RAX: ffffffffffffffda RBX: 00007f74c4025fa0 RCX: 00007f74c3d9e159 [ 129.482410][ T3826] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 129.482425][ T3826] RBP: 00007f74c3e3506b R08: 0000000000000004 R09: 0000000000000000 [ 129.482442][ T3826] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 129.482457][ T3826] R13: 00007f74c4026038 R14: 00007f74c4025fa0 R15: 00007ffcc18376d8 [ 129.482477][ T3826] [ 129.482501][ T3826] Mem-Info: [ 129.808903][ T3826] active_anon:20548 inactive_anon:11122 isolated_anon:0 [ 129.808903][ T3826] active_file:10491 inactive_file:11643 isolated_file:0 [ 129.808903][ T3826] unevictable:16422 dirty:45 writeback:0 [ 129.808903][ T3826] slab_reclaimable:6831 slab_unreclaimable:72328 [ 129.808903][ T3826] mapped:23732 shmem:26734 pagetables:1301 [ 129.808903][ T3826] sec_pagetables:0 bounce:0 [ 129.808903][ T3826] kernel_misc_reclaimable:0 [ 129.808903][ T3826] free:1466404 free_pcp:9225 free_cma:0 [ 129.831809][ T36] audit: type=1326 audit(2000000014.629:494): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3830 comm="syz.4.901" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0b3319e159 code=0x7ffc0000 [ 129.855180][ T3826] Node 0 active_anon:82192kB inactive_anon:44488kB active_file:41964kB inactive_file:46572kB unevictable:65688kB isolated(anon):0kB isolated(file):0kB mapped:94928kB dirty:180kB writeback:0kB shmem:106936kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:6832kB pagetables:5204kB sec_pagetables:0kB all_unreclaimable? no [ 129.855258][ T3826] DMA32 free:2956204kB boost:0kB min:19080kB low:23848kB high:28616kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3145324kB managed:2963376kB mlocked:0kB bounce:0kB free_pcp:7172kB local_pcp:7172kB free_cma:0kB [ 129.855315][ T3826] lowmem_reserve[]: 0 3921 3921 [ 129.855351][ T3826] Normal free:2935300kB boost:0kB min:25972kB low:32464kB high:38956kB reserved_highatomic:0KB free_highatomic:0KB active_anon:82192kB inactive_anon:44488kB active_file:41964kB inactive_file:46572kB unevictable:65688kB writepending:180kB present:5242880kB managed:4015864kB mlocked:0kB bounce:0kB free_pcp:4156kB local_pcp:1476kB free_cma:0kB [ 129.855407][ T3826] lowmem_reserve[]: 0 0 0 [ 129.855439][ T3826] DMA32: 3*4kB (M) 2*8kB (M) 3*16kB (M) 5*32kB (M) 5*64kB (M) 5*128kB (M) 5*256kB (M) 5*512kB (M) [ 129.889770][ T36] audit: type=1326 audit(2000000014.629:495): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3830 comm="syz.4.901" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0b3319e159 code=0x7ffc0000 [ 129.921210][ T3826] 6*1024kB [ 129.950087][ T36] audit: type=1326 audit(2000000014.679:496): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3830 comm="syz.4.901" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f0b3319e159 code=0x7ffc0000 [ 129.981932][ T3826] (UM) [ 129.985069][ T36] audit: type=1326 audit(2000000014.679:497): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3830 comm="syz.4.901" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0b3319e159 code=0x7ffc0000 [ 130.022383][ T3826] 4*2048kB [ 130.023777][ T36] audit: type=1326 audit(2000000014.679:498): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3830 comm="syz.4.901" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0b3319e159 code=0x7ffc0000 [ 130.049482][ T3826] (M) [ 130.051682][ T36] audit: type=1326 audit(2000000014.679:499): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3830 comm="syz.4.901" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7f0b3319e159 code=0x7ffc0000 [ 130.077783][ T3826] 717*4096kB (M) = 2956204kB [ 130.139030][ T3826] Normal: 1603*4kB (UME) 1562*8kB (UME) 1053*16kB (UME) 899*32kB (UME) 449*64kB (UME) 276*128kB (UME) 98*256kB (ME) 29*512kB (UME) 24*1024kB (UME) 18*2048kB (UME) 659*4096kB (UM) = 2929228kB [ 130.158370][ T3826] 67349 total pagecache pages [ 130.163167][ T3826] 18 pages in swap cache [ 130.167529][ T3826] Free swap = 105756kB [ 130.171973][ T3826] Total swap = 124996kB [ 130.176252][ T3826] 2097051 pages RAM [ 130.180167][ T3826] 0 pages HighMem/MovableOnly [ 130.185165][ T3826] 352241 pages reserved [ 130.189436][ T3826] 0 pages cma reserved [ 130.191130][ T3834] tmpfs: Unknown parameter '0x000000000000000800000000000000000000' [ 130.196138][ T3826] Memory allocations: [ 130.205816][ T3826] 0 B 0 init/main.c:1477 func:do_initcalls [ 130.213133][ T3826] 0 B 0 init/do_mounts.c:186 func:mount_root_generic [ 130.221580][ T3826] 0 B 0 init/do_mounts.c:158 func:do_mount_root [ 130.229370][ T3826] 0 B 0 init/do_mounts.c:352 func:mount_nodev_root [ 130.256411][ T3826] 0 B 0 init/do_mounts_rd.c:241 func:rd_load_image [ 130.264690][ T3826] 0 B 0 init/do_mounts_rd.c:72 func:identify_ramdisk_image [ 130.274247][ T3826] 0 B 0 init/initramfs.c:507 func:unpack_to_rootfs [ 130.282411][ T3826] 0 B 0 init/initramfs.c:508 func:unpack_to_rootfs [ 130.290537][ T3826] 0 B 0 init/initramfs.c:509 func:unpack_to_rootfs [ 130.308365][ T3826] 0 B 0 init/initramfs.c:101 func:find_link [ 130.366035][ T3851] netlink: 32 bytes leftover after parsing attributes in process `syz.0.908'. [ 130.375255][ T3851] tipc: Invalid UDP bearer configuration [ 130.375288][ T3851] tipc: Enabling of bearer rejected, failed to enable media [ 131.304495][ T3900] overlayfs: failed to resolve './file2': -2 [ 131.311934][ T3901] overlayfs: failed to resolve './file2': -2 [ 131.486869][ T3904] ./dev/sda1: Can't lookup blockdev [ 131.571667][ T3915] binder: Bad value for 'max' [ 131.577089][ T3916] binder: Bad value for 'max' [ 131.584590][ T3916] overlay: filesystem on ./file0 not supported as upperdir [ 132.349548][ T3934] netlink: 12 bytes leftover after parsing attributes in process `syz.2.934'. [ 132.375646][ T3938] fuse: Unknown parameter 'al' [ 133.289230][ T3963] overlay: Unknown parameter 'smackfsfloor' [ 134.446298][ T36] kauditd_printk_skb: 35 callbacks suppressed [ 134.446319][ T36] audit: type=1326 audit(2000000019.242:535): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3999 comm="syz.4.954" exe="/root/ci2-android-6-12-rust/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f0b3319e159 code=0x0 [ 144.472051][ T4012] netlink: 'syz.4.959': attribute type 12 has an invalid length. [ 144.513423][ T4021] fuse: Bad value for 'rootmode' [ 144.608566][ T4032] fuse: Unknown parameter 'qser_id' [ 144.684222][ T4015] selinux_netlink_send: 57 callbacks suppressed [ 144.684240][ T4015] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=4015 comm=syz.0.958 [ 144.919435][ T4015] netlink: 'syz.0.958': attribute type 16 has an invalid length. [ 145.004220][ T4043] overlay: Unknown parameter '/dev/kvm' [ 145.449281][ T4066] x_tables: unsorted underflow at hook 4 [ 145.922349][ T4091] overlayfs: failed to clone upperpath [ 146.926015][ T4122] netlink: 32 bytes leftover after parsing attributes in process `syz.3.989'. [ 147.624067][ T4134] netlink: 16 bytes leftover after parsing attributes in process `syz.3.993'. [ 147.696719][ T4138] tipc: Enabling of bearer rejected, failed to enable media [ 148.601302][ T4147] netlink: 24 bytes leftover after parsing attributes in process `syz.3.998'. [ 148.683538][ T4149] ./dev/sda1: Can't lookup blockdev [ 148.764275][ T4151] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1000'. [ 149.411575][ T36] audit: type=1400 audit(2000000034.202:536): avc: denied { accept } for pid=4168 comm="syz.4.1006" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 149.451247][ T4173] SELinux: failed to load policy [ 149.538776][ T36] audit: type=1400 audit(2000000034.332:537): avc: denied { write } for pid=4181 comm="syz.4.1011" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 149.575756][ T4186] overlayfs: failed to clone lowerpath [ 150.558467][ T4218] IPv6: NLM_F_CREATE should be specified when creating new route [ 150.662134][ T4220] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1023'. [ 150.757127][ T36] audit: type=1400 audit(2000000035.552:538): avc: denied { map } for pid=4228 comm="syz.2.1025" path="socket:[31394]" dev="sockfs" ino=31394 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 150.967302][ T36] audit: type=1400 audit(2000000035.762:539): avc: denied { append } for pid=4236 comm="syz.4.1028" name="pfkey" dev="proc" ino=4026532370 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 150.971263][ T4237] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=4237 comm=syz.4.1028 [ 151.020981][ T4237] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=4237 comm=syz.4.1028 [ 151.200506][ T36] audit: type=1400 audit(2000000035.992:540): avc: denied { ioctl } for pid=4256 comm="syz.4.1035" path="mnt:[4026532107]" dev="nsfs" ino=4026532107 ioctlcmd=0xb703 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 151.236189][ T36] audit: type=1400 audit(2000000036.022:541): avc: denied { read write } for pid=4256 comm="syz.4.1035" name="mtrr" dev="proc" ino=4026532004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 151.260358][ T36] audit: type=1400 audit(2000000036.022:542): avc: denied { open } for pid=4256 comm="syz.4.1035" path="/104/proc/mtrr" dev="proc" ino=4026532004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 151.284060][ T36] audit: type=1400 audit(2000000036.022:543): avc: denied { ioctl } for pid=4256 comm="syz.4.1035" path="/104/proc/mtrr" dev="proc" ino=4026532004 ioctlcmd=0x4d06 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 151.348618][ T4259] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1036'. [ 151.598216][ T4265] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1038'. [ 151.631904][ T4267] netlink: 'syz.0.1039': attribute type 1 has an invalid length. [ 151.645999][ T4268] netlink: 'syz.0.1039': attribute type 30 has an invalid length. [ 151.673686][ T36] audit: type=1400 audit(2000000036.462:544): avc: denied { name_bind } for pid=4266 comm="syz.0.1039" src=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=udp_socket permissive=1 [ 151.677251][ T4268] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1794 sclass=netlink_route_socket pid=4268 comm=syz.0.1039 [ 152.232694][ T4298] netlink: 'syz.2.1050': attribute type 29 has an invalid length. [ 152.398171][ T4301] ./dev/sda1: Can't lookup blockdev [ 152.562661][ T4306] ./dev/sda1: Can't lookup blockdev [ 152.675054][ T4309] ./dev/sda1: Can't lookup blockdev [ 152.692862][ T4309] SELinux: Context system_u:object_r:auditd_unit_file_t:s0 is not valid (left unmapped). [ 152.724516][ T36] audit: type=1400 audit(2000000037.522:545): avc: denied { relabelto } for pid=4308 comm="syz.2.1056" name="mnt" dev="tmpfs" ino=1479 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:auditd_unit_file_t:s0" [ 152.904066][ T4333] overlayfs: failed to clone upperpath [ 153.258696][ T4358] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1070'. [ 153.566928][ T4366] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1072'. [ 153.623388][ T4368] netlink: 76 bytes leftover after parsing attributes in process `syz.2.1073'. [ 154.397255][ T4399] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1082'. [ 154.834658][ T4421] netlink: 'syz.3.1088': attribute type 27 has an invalid length. [ 154.850408][ T4426] 9pnet_fd: Insufficient options for proto=fd [ 154.860256][ T4421] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 154.896560][ T36] kauditd_printk_skb: 2 callbacks suppressed [ 154.896578][ T36] audit: type=1400 audit(2000000039.692:548): avc: denied { connect } for pid=4420 comm="syz.3.1088" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 154.944127][ T4431] netlink: 'syz.3.1092': attribute type 49 has an invalid length. [ 154.995582][ T4431] team_slave_1: entered promiscuous mode [ 155.012977][ T4431] team_slave_1: entered allmulticast mode [ 155.111890][ T4444] overlayfs: failed to clone upperpath [ 155.360525][ T4471] overlayfs: unescaped trailing colons in lowerdir mount option. [ 155.768464][ T4501] ./dev/sda1: Can't lookup blockdev [ 156.079695][ T36] audit: type=1400 audit(2000000040.872:549): avc: denied { write } for pid=4522 comm="syz.0.1119" path="socket:[33133]" dev="sockfs" ino=33133 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 156.766668][ T36] audit: type=1400 audit(2000000041.562:550): avc: denied { accept } for pid=4553 comm="syz.4.1126" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 156.776990][ T4561] tipc: Enabling of bearer rejected, failed to enable media [ 157.462614][ T36] audit: type=1400 audit(2000000042.252:551): avc: denied { mount } for pid=4585 comm="syz.0.1137" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 157.622519][ T4603] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1141'. [ 157.732066][ T36] audit: type=1400 audit(2000000042.522:552): avc: denied { create } for pid=4608 comm="syz.4.1142" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 158.603692][ T4638] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1150'. [ 158.612972][ T4639] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1150'. [ 158.629929][ T4638] netlink: 'syz.4.1150': attribute type 19 has an invalid length. [ 158.638252][ T4639] netlink: 'syz.4.1150': attribute type 19 has an invalid length. [ 158.664909][ T36] audit: type=1400 audit(2000000043.462:553): avc: denied { mounton } for pid=4647 comm="syz.4.1153" path="/120/sys" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 158.747276][ T4659] FAULT_INJECTION: forcing a failure. [ 158.747276][ T4659] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 158.764660][ T4659] CPU: 1 UID: 0 PID: 4659 Comm: syz.4.1157 Not tainted syzkaller #0 e67cc5743245539115c479145c763e2a95730d6f [ 158.764695][ T4659] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 158.764708][ T4659] Call Trace: [ 158.764716][ T4659] [ 158.764726][ T4659] __dump_stack+0x21/0x30 [ 158.764757][ T4659] dump_stack_lvl+0x140/0x1c0 [ 158.764782][ T4659] ? __cfi_dump_stack_lvl+0x10/0x10 [ 158.764808][ T4659] ? getname_flags+0xcc/0x6b0 [ 158.764832][ T4659] dump_stack+0x19/0x20 [ 158.764856][ T4659] should_fail_ex+0x3c2/0x510 [ 158.764881][ T4659] should_fail+0xf/0x20 [ 158.764902][ T4659] should_fail_usercopy+0x1e/0x30 [ 158.764926][ T4659] strncpy_from_user+0x29/0x280 [ 158.764949][ T4659] getname_flags+0x106/0x6b0 [ 158.764970][ T4659] ? trace_event_raw_event_sys_enter+0xf5/0x130 [ 158.764999][ T4659] __x64_sys_mkdirat+0x7e/0xa0 [ 158.765025][ T4659] x64_sys_call+0x2ba8/0x2ee0 [ 158.765044][ T4659] do_syscall_64+0x57/0xf0 [ 158.765064][ T4659] ? clear_bhb_loop+0x50/0xa0 [ 158.765088][ T4659] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 158.765112][ T4659] RIP: 0033:0x7f0b3319e159 [ 158.765130][ T4659] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 158.765148][ T4659] RSP: 002b:00007f0b34109028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 158.765173][ T4659] RAX: ffffffffffffffda RBX: 00007f0b33425fa0 RCX: 00007f0b3319e159 [ 158.765190][ T4659] RDX: 000000000000017b RSI: 00002000000001c0 RDI: ffffffffffffff9c [ 158.765206][ T4659] RBP: 00007f0b3323506b R08: 0000000000000000 R09: 0000000000000000 [ 158.765221][ T4659] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 158.765235][ T4659] R13: 00007f0b33426038 R14: 00007f0b33425fa0 R15: 00007ffddd18b658 [ 158.765253][ T4659] [ 158.885551][ T4674] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1163'. [ 159.501823][ T36] audit: type=1400 audit(2000000044.292:554): avc: denied { listen } for pid=4701 comm="syz.2.1171" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 159.501847][ T4706] netlink: 'syz.0.1172': attribute type 4 has an invalid length. [ 159.531795][ T36] audit: type=1400 audit(2000000044.332:555): avc: denied { execute } for pid=4701 comm="syz.2.1171" path="/memory.swap.current" dev="ramfs" ino=33808 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=file permissive=1 [ 159.537408][ T4706] netlink: 17 bytes leftover after parsing attributes in process `syz.0.1172'. [ 159.585511][ T4708] netlink: 'syz.0.1172': attribute type 27 has an invalid length. [ 159.630608][ T4706] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=4706 comm=syz.0.1172 [ 159.652169][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.664618][ T4721] overlayfs: failed to clone upperpath [ 159.672603][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.682875][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.689979][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.696189][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.701988][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.714815][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.722266][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.728362][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.735313][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.740835][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.746691][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.752214][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.759521][ T4727] SELinux: Context system_u:object_r:tty_device_t:s0 is not valid (left unmapped). [ 159.759721][ T36] audit: type=1400 audit(2000000044.552:556): avc: denied { relabelfrom } for pid=4726 comm="syz.2.1179" name="RAWv6" dev="sockfs" ino=33854 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 159.771459][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.797683][ T36] audit: type=1400 audit(2000000044.572:557): avc: denied { relabelto } for pid=4726 comm="syz.2.1179" name="RAWv6" dev="sockfs" ino=33854 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=rawip_socket permissive=1 trawcon="system_u:object_r:tty_device_t:s0" [ 159.825914][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.829219][ T4728] overlayfs: failed to clone upperpath [ 159.832623][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.843408][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.852734][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.858560][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.864489][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.870015][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.875892][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.881422][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.887166][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.892673][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.898295][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.904376][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.909906][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.916266][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.921723][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.927730][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.933087][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.938858][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.944789][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.950411][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.956119][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.961574][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.967148][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.972674][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.978141][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.984064][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.989430][ T4719] ./dev/sda1: Can't lookup blockdev [ 159.995149][ T4719] ./dev/sda1: Can't lookup blockdev [ 160.000479][ T4719] ./dev/sda1: Can't lookup blockdev [ 160.006185][ T4719] ./dev/sda1: Can't lookup blockdev [ 160.011716][ T4719] ./dev/sda1: Can't lookup blockdev [ 160.017313][ T4719] ./dev/sda1: Can't lookup blockdev [ 160.022669][ T4719] ./dev/sda1: Can't lookup blockdev [ 160.029332][ T4719] ./dev/sda1: Can't lookup blockdev [ 160.034998][ T4719] ./dev/sda1: Can't lookup blockdev [ 160.040450][ T4719] ./dev/sda1: Can't lookup blockdev [ 160.046062][ T4719] ./dev/sda1: Can't lookup blockdev [ 160.051534][ T4719] ./dev/sda1: Can't lookup blockdev [ 160.057051][ T4719] ./dev/sda1: Can't lookup blockdev [ 160.062581][ T4719] ./dev/sda1: Can't lookup blockdev [ 160.068301][ T4719] ./dev/sda1: Can't lookup blockdev [ 160.073922][ T4719] ./dev/sda1: Can't lookup blockdev [ 160.079440][ T4719] ./dev/sda1: Can't lookup blockdev [ 160.085278][ T4719] ./dev/sda1: Can't lookup blockdev [ 160.090625][ T4719] ./dev/sda1: Can't lookup blockdev [ 160.096327][ T4719] ./dev/sda1: Can't lookup blockdev [ 160.101668][ T4719] ./dev/sda1: Can't lookup blockdev [ 160.107459][ T4719] ./dev/sda1: Can't lookup blockdev [ 160.112782][ T4719] ./dev/sda1: Can't lookup blockdev [ 160.118612][ T4719] ./dev/sda1: Can't lookup blockdev [ 160.288313][ T4742] ./dev/sda1: Can't lookup blockdev [ 160.724148][ T4765] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 160.736039][ T4765] overlayfs: option "index=on" is useless in a non-upper mount, ignore [ 160.750400][ T4765] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 161.313763][ T4785] netlink: 96 bytes leftover after parsing attributes in process `syz.0.1199'. [ 161.335334][ T4787] overlayfs: failed to clone upperpath [ 161.386899][ T4793] ./dev/sda1: Can't lookup blockdev [ 162.177989][ T4823] futex_wake_op: syz.4.1211 tries to shift op by 144; fix this program [ 162.201650][ T36] audit: type=1400 audit(2000000302.989:558): avc: denied { create } for pid=4825 comm="syz.4.1212" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 162.640271][ T4829] ./dev/sda1: Can't lookup blockdev [ 162.796488][ T4838] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1217'. [ 162.817006][ T4838] netlink: 11 bytes leftover after parsing attributes in process `syz.3.1217'. [ 162.870640][ T4844] ./dev/sda1: Can't lookup blockdev [ 163.310871][ T4862] tipc: Enabling of bearer rejected, failed to enable media [ 163.657793][ T4883] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1235'. [ 163.707034][ T4883] netlink: 96 bytes leftover after parsing attributes in process `syz.2.1235'. [ 163.740224][ T4892] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 163.765745][ T4895] ./dev/sda1: Can't lookup blockdev [ 163.772841][ T4895] ./dev/sda1: Can't lookup blockdev [ 163.981614][ T4899] netlink: 'syz.4.1241': attribute type 4 has an invalid length. [ 163.990986][ T4899] netlink: 'syz.4.1241': attribute type 4 has an invalid length. [ 164.003723][ T36] audit: type=1400 audit(2000000304.799:559): avc: denied { connect } for pid=4898 comm="syz.4.1241" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 165.582970][ T4951] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1256'. [ 165.592909][ T36] audit: type=1400 audit(2000000306.379:560): avc: denied { view } for pid=4950 comm="syz.4.1256" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 165.613112][ T4951] netlink: 964 bytes leftover after parsing attributes in process `syz.4.1256'. [ 165.945057][ T4965] incfs: Backing dir is not set, filesystem can't be mounted. [ 165.983625][ T4965] incfs: mount failed -2 [ 166.019301][ T36] audit: type=1400 audit(2000000306.809:561): avc: denied { map } for pid=4971 comm="syz.0.1261" path="socket:[34410]" dev="sockfs" ino=34410 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 166.042693][ T36] audit: type=1400 audit(2000000306.809:562): avc: denied { read } for pid=4971 comm="syz.0.1261" path="socket:[34410]" dev="sockfs" ino=34410 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 166.396530][ T4984] fuse: Bad value for 'user_id' [ 166.405838][ T4984] fuse: Bad value for 'user_id' [ 166.608423][ T4995] fuse: Unknown parameter '0x0000000000000003' [ 166.708742][ T36] audit: type=1400 audit(2000000307.499:563): avc: denied { ioctl } for pid=5005 comm="syz.0.1272" path="socket:[34467]" dev="sockfs" ino=34467 ioctlcmd=0x890b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 167.009915][ T5022] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=82 sclass=netlink_tcpdiag_socket pid=5022 comm=syz.2.1273 [ 167.034501][ T5022] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=82 sclass=netlink_tcpdiag_socket pid=5022 comm=syz.2.1273 [ 167.358526][ T5052] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1282'. [ 167.418971][ T36] audit: type=1400 audit(2000000308.210:564): avc: denied { getopt } for pid=5055 comm="syz.4.1284" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 167.824889][ T36] audit: type=1400 audit(2000000308.620:565): avc: denied { map } for pid=5074 comm="syz.3.1291" path="socket:[34529]" dev="sockfs" ino=34529 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 168.014498][ T5086] FAULT_INJECTION: forcing a failure. [ 168.014498][ T5086] name failslab, interval 1, probability 0, space 0, times 0 [ 168.027408][ T5086] CPU: 1 UID: 0 PID: 5086 Comm: syz.4.1295 Not tainted syzkaller #0 e67cc5743245539115c479145c763e2a95730d6f [ 168.027458][ T5086] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 168.027475][ T5086] Call Trace: [ 168.027484][ T5086] [ 168.027495][ T5086] __dump_stack+0x21/0x30 [ 168.027533][ T5086] dump_stack_lvl+0x140/0x1c0 [ 168.027575][ T5086] ? __cfi_dump_stack_lvl+0x10/0x10 [ 168.027619][ T5086] dump_stack+0x19/0x20 [ 168.027646][ T5086] should_fail_ex+0x3c2/0x510 [ 168.027673][ T5086] ? security_sk_alloc+0x65/0x260 [ 168.027728][ T5086] should_failslab+0xac/0x100 [ 168.027769][ T5086] __kmalloc_noprof+0x69/0x510 [ 168.027800][ T5086] ? security_sk_alloc+0x65/0x260 [ 168.027830][ T5086] security_sk_alloc+0x65/0x260 [ 168.027866][ T5086] sk_prot_alloc+0x123/0x3a0 [ 168.027895][ T5086] sk_alloc+0x40/0x590 [ 168.027936][ T5086] netlink_create+0x3d0/0x630 [ 168.027976][ T5086] ? __cfi_rtnetlink_bind+0x10/0x10 [ 168.028018][ T5086] __sock_create+0x3a2/0x810 [ 168.028044][ T5086] __sys_socket+0xe1/0x1c0 [ 168.028069][ T5086] __x64_sys_socket+0x7e/0x90 [ 168.028107][ T5086] x64_sys_call+0x2608/0x2ee0 [ 168.028128][ T5086] do_syscall_64+0x57/0xf0 [ 168.028179][ T5086] ? clear_bhb_loop+0x50/0xa0 [ 168.028220][ T5086] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 168.028260][ T5086] RIP: 0033:0x7f0b3319e159 [ 168.028280][ T5086] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 168.028313][ T5086] RSP: 002b:00007f0b34109028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 168.028340][ T5086] RAX: ffffffffffffffda RBX: 00007f0b33425fa0 RCX: 00007f0b3319e159 [ 168.028384][ T5086] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000010 [ 168.028401][ T5086] RBP: 00007f0b3323506b R08: 0000000000000000 R09: 0000000000000000 [ 168.028417][ T5086] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 168.028433][ T5086] R13: 00007f0b33426038 R14: 00007f0b33425fa0 R15: 00007ffddd18b658 [ 168.028454][ T5086] [ 168.407509][ T5091] netlink: 236 bytes leftover after parsing attributes in process `syz.0.1297'. [ 168.688407][ T5100] netlink: 'syz.2.1300': attribute type 20 has an invalid length. [ 168.877601][ T4940] udevd[4940]: inotify_add_watch(7, /dev/sda, 10) failed: No such file or directory [ 168.894620][ T4940] udevd[4940]: inotify_add_watch(7, /dev/sda1, 10) failed: No such file or directory [ 169.422769][ T5122] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1307'. [ 169.467283][ T5132] No source specified [ 169.548854][ T5147] bridge0: entered allmulticast mode [ 169.678017][ T5151] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1316'. [ 169.692933][ T5157] netlink: 'syz.3.1319': attribute type 58 has an invalid length. [ 169.763696][ T5163] netlink: 'syz.3.1322': attribute type 29 has an invalid length. [ 169.843999][ T36] audit: type=1400 audit(2000000310.640:566): avc: denied { shutdown } for pid=5176 comm="syz.4.1326" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 169.929613][ T5186] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=5186 comm=syz.4.1330 [ 169.943459][ T5186] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1330'. [ 169.964247][ T5186] netlink: 'syz.4.1330': attribute type 27 has an invalid length. [ 169.977885][ T5200] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1316'. [ 169.980336][ T5186] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 170.336628][ T5188] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1331'. [ 170.349772][ T5188] netlink: 43 bytes leftover after parsing attributes in process `syz.3.1331'. [ 170.367522][ T5188] netlink: 'syz.3.1331': attribute type 6 has an invalid length. [ 170.397218][ T5188] netlink: 'syz.3.1331': attribute type 5 has an invalid length. [ 170.416903][ T5188] netlink: 43 bytes leftover after parsing attributes in process `syz.3.1331'. [ 171.957046][ T5313] overlayfs: failed to clone upperpath [ 171.978175][ T36] audit: type=1400 audit(2000000312.770:567): avc: denied { map } for pid=5314 comm="syz.2.1355" path="socket:[36035]" dev="sockfs" ino=36035 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 172.677953][ T5343] ./dev/sda1: Can't lookup blockdev [ 173.225034][ T36] audit: type=1400 audit(2000000314.020:568): avc: denied { read } for pid=5350 comm="syz.3.1367" name="file0" dev="tmpfs" ino=2167 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 173.247528][ T36] audit: type=1400 audit(2000000314.020:569): avc: denied { open } for pid=5350 comm="syz.3.1367" path="/374/file0" dev="tmpfs" ino=2167 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 173.495059][ T5358] overlayfs: failed to resolve './cgroup': -2 [ 173.509543][ T5358] ./dev/sda1: Can't lookup blockdev [ 174.586779][ T5415] ./dev/sda1: Can't lookup blockdev [ 174.615209][ T5419] fuse: Bad value for 'group_id' [ 174.620267][ T5419] fuse: Bad value for 'group_id' [ 175.520838][ T5448] ./dev/sda1: Can't lookup blockdev [ 175.743280][ T5457] ./dev/sda1: Can't lookup blockdev [ 176.473663][ T5485] 9pnet_fd: Insufficient options for proto=fd [ 176.558612][ T5489] overlayfs: failed to clone lowerpath [ 176.589647][ T5489] ./dev/sda1: Can't lookup blockdev [ 176.639639][ T5496] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1426'. [ 176.822183][ T5499] overlayfs: failed to clone upperpath [ 176.828070][ T5499] overlayfs: missing 'lowerdir' [ 177.080205][ T5518] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 177.482840][ T5532] overlayfs: failed to clone upperpath [ 177.707609][ T5543] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1443'. [ 177.770048][ T36] audit: type=1400 audit(2000000318.561:570): avc: denied { read } for pid=5549 comm="syz.2.1446" lport=4 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 177.948520][ T5555] overlayfs: failed to clone lowerpath [ 178.284510][ T5560] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1450'. [ 178.379268][ T5568] SELinux: Context system_u:object_r:vhost_device_t:s0 is not valid (left unmapped). [ 178.389370][ T36] audit: type=1400 audit(2000000319.191:571): avc: denied { relabelto } for pid=5567 comm="syz.0.1453" name="file0" dev="tmpfs" ino=2174 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sock_file permissive=1 trawcon="system_u:object_r:vhost_device_t:s0" [ 178.416467][ T36] audit: type=1400 audit(2000000319.191:572): avc: denied { associate } for pid=5567 comm="syz.0.1453" name="file0" dev="tmpfs" ino=2174 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:vhost_device_t:s0" [ 178.443884][ T36] audit: type=1400 audit(2000000319.191:573): avc: denied { unlink } for pid=293 comm="syz-executor" name="file0" dev="tmpfs" ino=2174 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sock_file permissive=1 trawcon="system_u:object_r:vhost_device_t:s0" [ 178.944296][ T36] audit: type=1400 audit(2000000319.741:574): avc: denied { ioctl } for pid=5580 comm="syz.0.1458" path="socket:[36830]" dev="sockfs" ino=36830 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 178.969196][ T36] audit: type=1400 audit(2000000319.751:575): avc: denied { getattr } for pid=5580 comm="syz.0.1458" path="socket:[36830]" dev="sockfs" ino=36830 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 179.279066][ T5603] fuse: Bad value for 'fd' [ 179.299618][ T5603] fuse: blksize only supported for fuseblk [ 179.362570][ T5606] tipc: Trying to set illegal importance in message [ 180.069424][ T5634] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1478'. [ 180.078483][ T5634] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1478'. [ 180.088967][ T5634] rust_binder: Failed to allocate buffer. len:16, is_oneway:false [ 180.089220][ T10] rust_binder: 5633: undelivered TRANSACTION_ERROR: 29189 [ 180.432864][ T5644] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 180.601926][ T5656] overlayfs: failed to clone upperpath [ 180.696002][ T5663] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=31 sclass=netlink_route_socket pid=5663 comm=syz.4.1489 [ 180.708601][ T5663] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=27 sclass=netlink_route_socket pid=5663 comm=syz.4.1489 [ 180.721571][ T5663] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=23 sclass=netlink_route_socket pid=5663 comm=syz.4.1489 [ 180.737162][ T5665] ./dev/sda1: Can't lookup blockdev [ 180.796650][ T5671] ./dev/sda1: Can't lookup blockdev [ 180.914946][ T5675] futex_wake_op: syz.2.1494 tries to shift op by 144; fix this program [ 181.037413][ T5684] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=61 sclass=netlink_route_socket pid=5684 comm=syz.0.1497 [ 181.064924][ T5684] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=56 sclass=netlink_route_socket pid=5684 comm=syz.0.1497 [ 181.090121][ T5684] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=35 sclass=netlink_route_socket pid=5684 comm=syz.0.1497 [ 181.116703][ T5684] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1497'. [ 181.149757][ T5690] overlay: ./file1 is not a directory [ 181.163435][ T5690] ./dev/sda1: Can't lookup blockdev [ 181.400069][ T5702] netlink: 'syz.0.1504': attribute type 3 has an invalid length. [ 181.602190][ T5704] netlink: 'syz.2.1505': attribute type 27 has an invalid length. [ 181.641692][ T5704] netlink: 140 bytes leftover after parsing attributes in process `syz.2.1505'. [ 181.769282][ T5721] netlink: 'syz.2.1510': attribute type 20 has an invalid length. [ 182.029527][ T5734] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1513'. [ 182.124389][ T5742] af_packet: tpacket_rcv: packet too big, clamped from 65526 to 4. macoff=68 [ 182.137512][ T5743] erofs: dax options not supported [ 183.052792][ T5844] ./dev/sda1: Can't lookup blockdev [ 183.254712][ T5862] syzkaller1: entered promiscuous mode [ 183.260236][ T5862] syzkaller1: entered allmulticast mode [ 183.326084][ T36] audit: type=1400 audit(2000000324.122:576): avc: denied { mounton } for pid=5863 comm="syz.4.1536" path="/197/config" dev="configfs" ino=2575 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 183.349671][ T36] audit: type=1400 audit(2000000324.122:577): avc: denied { write } for pid=5863 comm="syz.4.1536" name="c_chmask" dev="configfs" ino=37419 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 183.659706][ T36] audit: type=1400 audit(2000000324.452:578): avc: denied { execute } for pid=5866 comm="syz.2.1537" path="pipe:[37426]" dev="pipefs" ino=37426 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 183.945882][ T36] audit: type=1400 audit(2000000324.742:579): avc: denied { getattr } for pid=3236 comm="syz-executor" path="/197/config/usb_gadget/g1/webusb/landingPage" dev="configfs" ino=35221 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 183.973753][ T36] audit: type=1400 audit(2000000324.742:580): avc: denied { remove_name } for pid=3236 comm="syz-executor" name="landingPage" dev="configfs" ino=35222 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 183.997956][ T36] audit: type=1400 audit(2000000324.742:581): avc: denied { unlink } for pid=3236 comm="syz-executor" name="landingPage" dev="configfs" ino=35222 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 184.021911][ T36] audit: type=1400 audit(2000000324.742:582): avc: denied { setattr } for pid=3236 comm="syz-executor" path="/197/config/usb_gadget/g1/webusb/landingPage" dev="configfs" ino=35223 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 185.002071][ T5922] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1559'. [ 185.014999][ T5923] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1559'. [ 185.840545][ T5956] sit0: entered promiscuous mode [ 185.857025][ T5956] netlink: 'syz.3.1570': attribute type 1 has an invalid length. [ 185.892730][ T5956] netlink: 1 bytes leftover after parsing attributes in process `syz.3.1570'. [ 185.988099][ T5967] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1574'. [ 186.029005][ T5969] fuse: Unknown parameter 'fdC000000000000000000000030000000000000000000300000000000000000003' [ 186.051489][ T5969] overlayfs: failed to clone upperpath [ 186.328011][ T5988] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=771 sclass=netlink_route_socket pid=5988 comm=syz.0.1581 [ 186.615995][ T5995] overlayfs: failed to clone upperpath [ 186.623773][ T5995] tipc: Trying to set illegal importance in message [ 187.093752][ T5997] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1584'. [ 187.847494][ T6007] overlayfs: failed to clone upperpath [ 187.999183][ T6012] ./dev/sda1: Can't lookup blockdev [ 188.046427][ T6014] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 188.441128][ T6018] overlay: Unknown parameter 'dont_appraise' [ 188.488923][ T6022] ./dev/sda1: Can't lookup blockdev [ 189.154325][ T6031] fuse: Unknown parameter '' [ 189.211350][ T6035] overlayfs: failed to clone upperpath [ 189.298615][ T6035] overlayfs: failed to clone upperpath [ 189.513974][ T36] audit: type=1400 audit(2000000330.312:583): avc: denied { getattr } for pid=6043 comm="syz.0.1603" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=108603 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 190.310404][ T6116] tmpfs: Bad value for 'nr_blocks' [ 190.342344][ T6117] ./dev/sda1: Can't lookup blockdev [ 190.368133][ T6119] ./dev/sda1: Can't lookup blockdev [ 190.435123][ T6124] ./dev/sda1: Can't lookup blockdev [ 190.845540][ T6137] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1633'. [ 190.966122][ T36] audit: type=1400 audit(2000000331.762:584): avc: denied { connect } for pid=6141 comm="syz.2.1635" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 191.417144][ T36] audit: type=1326 audit(2000016972.213:585): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6160 comm="syz.3.1642" exe="/root/ci2-android-6-12-rust/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7271d9e159 code=0x0 [ 191.868228][ T36] audit: type=1326 audit(2000016972.663:586): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6180 comm="syz.0.1649" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74c3d9e159 code=0x7ffc0000 [ 191.896476][ T6183] ./dev/sda1: Can't lookup blockdev [ 191.921388][ T36] audit: type=1326 audit(2000016972.693:587): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6180 comm="syz.0.1649" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74c3d9e159 code=0x7ffc0000 [ 191.953848][ T36] audit: type=1326 audit(2000016972.693:588): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6180 comm="syz.0.1649" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f74c3d9e159 code=0x7ffc0000 [ 191.979700][ T36] audit: type=1326 audit(2000016972.693:589): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6180 comm="syz.0.1649" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74c3d9e159 code=0x7ffc0000 [ 192.010783][ T36] audit: type=1326 audit(2000016972.693:590): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6180 comm="syz.0.1649" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74c3d9e159 code=0x7ffc0000 [ 192.038024][ T36] audit: type=1326 audit(2000016972.693:591): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6180 comm="syz.0.1649" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f74c3d9e159 code=0x7ffc0000 [ 192.063697][ T36] audit: type=1326 audit(2000016972.693:592): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6180 comm="syz.0.1649" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74c3d9e159 code=0x7ffc0000 [ 192.277909][ T6209] ./dev/sda1: Can't lookup blockdev [ 193.197004][ T6236] netlink: 388 bytes leftover after parsing attributes in process `syz.2.1664'. [ 193.465995][ T6248] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=23 sclass=netlink_route_socket pid=6248 comm=syz.0.1667 [ 195.833346][ T6339] overlayfs: failed to clone upperpath [ 197.010404][ T6368] ./dev/sda1: Can't lookup blockdev [ 197.122634][ T6385] overlayfs: failed to clone upperpath [ 198.547091][ T6440] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1732'. [ 199.281856][ T6446] Invalid ELF header type: 2 != 1 [ 199.386452][ T6448] netlink: 'syz.3.1736': attribute type 11 has an invalid length. [ 199.445590][ T6450] netlink: 'syz.3.1736': attribute type 11 has an invalid length. [ 199.770481][ T6453] bridge0: port 1(bridge_slave_0) entered blocking state [ 199.777556][ T6453] bridge0: port 1(bridge_slave_0) entered disabled state [ 199.785272][ T6453] bridge_slave_0: entered allmulticast mode [ 199.793581][ T6453] bridge_slave_0: entered promiscuous mode [ 199.803251][ T6453] bridge0: port 2(bridge_slave_1) entered blocking state [ 199.810419][ T6453] bridge0: port 2(bridge_slave_1) entered disabled state [ 199.817587][ T6453] bridge_slave_1: entered allmulticast mode [ 199.824828][ T6453] bridge_slave_1: entered promiscuous mode [ 199.831310][ T60] bridge_slave_1: left allmulticast mode [ 199.836960][ T60] bridge_slave_1: left promiscuous mode [ 199.843139][ T60] bridge0: port 2(bridge_slave_1) entered disabled state [ 199.851482][ T60] bridge_slave_0: left allmulticast mode [ 199.857137][ T60] bridge_slave_0: left promiscuous mode [ 199.863753][ T60] bridge0: port 1(bridge_slave_0) entered disabled state [ 199.982949][ T60] tipc: Left network mode [ 199.997234][ T60] veth1_macvtap: left promiscuous mode [ 200.002851][ T60] veth0_vlan: left promiscuous mode [ 200.141313][ T6453] bridge0: port 2(bridge_slave_1) entered blocking state [ 200.148420][ T6453] bridge0: port 2(bridge_slave_1) entered forwarding state [ 200.155803][ T6453] bridge0: port 1(bridge_slave_0) entered blocking state [ 200.162892][ T6453] bridge0: port 1(bridge_slave_0) entered forwarding state [ 200.201863][ T457] bridge0: port 1(bridge_slave_0) entered disabled state [ 200.209772][ T457] bridge0: port 2(bridge_slave_1) entered disabled state [ 200.226265][ T457] bridge0: port 1(bridge_slave_0) entered blocking state [ 200.233398][ T457] bridge0: port 1(bridge_slave_0) entered forwarding state [ 200.244892][ T2927] bridge0: port 2(bridge_slave_1) entered blocking state [ 200.252013][ T2927] bridge0: port 2(bridge_slave_1) entered forwarding state [ 200.303515][ T6453] veth0_vlan: entered promiscuous mode [ 200.322337][ T6453] veth1_macvtap: entered promiscuous mode [ 200.366588][ T36] kauditd_printk_skb: 54 callbacks suppressed [ 200.366608][ T36] audit: type=1400 audit(2000016981.163:647): avc: denied { mounton } for pid=6453 comm="syz-executor" path="/root/syzkaller.pW36ho/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=216619 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 200.404496][ T36] audit: type=1400 audit(2000016981.203:648): avc: denied { mount } for pid=6453 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 200.478850][ T36] audit: type=1326 audit(2000016981.273:649): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6472 comm="syz.5.1742" exe="/root/ci2-android-6-12-rust/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f80f699e159 code=0x0 [ 200.601775][ T6475] overlayfs: failed to clone upperpath [ 200.810703][ T36] audit: type=1400 audit(2000016981.613:650): avc: denied { create } for pid=6481 comm="syz.3.1745" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 201.560819][ T6498] af_packet: packet size is too long (25449 > 2016) [ 202.084800][ T6506] futex_wake_op: syz.0.1753 tries to shift op by 144; fix this program [ 202.338349][ T6512] x_tables: unsorted underflow at hook 2 [ 203.092459][ T6526] bridge0: port 2(bridge_slave_1) entered disabled state [ 203.099899][ T6526] netlink: 'syz.3.1760': attribute type 1 has an invalid length. [ 203.108125][ T6526] netlink: 9 bytes leftover after parsing attributes in process `syz.3.1760'. [ 203.220343][ T6532] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1763'. [ 203.235890][ T6532] overlayfs: failed to clone upperpath [ 203.420972][ T36] audit: type=1400 audit(2000016984.223:651): avc: denied { getopt } for pid=6542 comm="syz.0.1767" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 203.511054][ T6553] overlayfs: failed to clone upperpath [ 203.520318][ T36] audit: type=1400 audit(2000016984.313:652): avc: denied { unmount } for pid=6453 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 203.618091][ T6575] overlayfs: failed to resolve './file2': -2 [ 203.828944][ T6580] 9pnet_fd: p9_fd_create_tcp (6580): problem connecting socket to 127.0.0.1 [ 204.079601][ T6589] ./dev/sda1: Can't lookup blockdev [ 204.841671][ T6619] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1791'. [ 205.077139][ T6636] overlayfs: failed to clone upperpath [ 205.145405][ T6642] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1797'. [ 205.720453][ T6676] ./dev/sda1: Can't lookup blockdev [ 205.763282][ T6679] futex_wake_op: syz.2.1812 tries to shift op by 144; fix this program [ 205.776089][ T6679] futex_wake_op: syz.2.1812 tries to shift op by 144; fix this program [ 205.784765][ T6672] ./dev/sda1: Can't lookup blockdev [ 205.900980][ T6702] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1820'. [ 205.911011][ T6702] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6702 comm=syz.5.1820 [ 205.983933][ T6716] netlink: 112 bytes leftover after parsing attributes in process `syz.5.1824'. [ 206.056519][ T6718] TCP: TCP_TX_DELAY enabled [ 206.459462][ T6731] fuse: Invalid rootmode [ 206.481888][ T6737] overlayfs: failed to clone upperpath [ 206.505401][ T6731] fuse: Invalid rootmode [ 206.509740][ T6731] fuse: Invalid rootmode [ 206.552995][ T6731] fuse: Unknown parameter 'åÕd*$ rejected, failed to enable media [ 228.063983][ T7908] tipc: Enabling of bearer rejected, failed to enable media [ 228.148098][ T7922] fuseblk: Bad value for 'fd' [ 228.154169][ T7922] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2171'. [ 228.296165][ T7927] netlink: 'syz.3.2173': attribute type 27 has an invalid length. [ 228.855278][ T7953] futex_wake_op: syz.3.2183 tries to shift op by 144; fix this program [ 228.863694][ T7953] futex_wake_op: syz.3.2183 tries to shift op by 144; fix this program [ 229.280319][ T36] audit: type=1400 audit(2000017010.083:677): avc: denied { unmount } for pid=6453 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 229.968977][ T36] audit: type=1400 audit(2000017010.763:678): avc: denied { accept } for pid=7991 comm="syz.5.2196" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 230.020721][ T7988] netlink: 'syz.2.2195': attribute type 4 has an invalid length. [ 230.523327][ T8007] bridge0: port 1(bridge_slave_0) entered blocking state [ 230.539094][ T8007] bridge0: port 1(bridge_slave_0) entered disabled state [ 230.546357][ T8007] bridge_slave_0: entered allmulticast mode [ 230.558614][ T8007] bridge_slave_0: entered promiscuous mode [ 230.571482][ T8014] netlink: 176 bytes leftover after parsing attributes in process `syz.5.2204'. [ 230.582250][ T8007] bridge0: port 2(bridge_slave_1) entered blocking state [ 230.589302][ T8007] bridge0: port 2(bridge_slave_1) entered disabled state [ 230.599659][ T8007] bridge_slave_1: entered allmulticast mode [ 230.606665][ T8007] bridge_slave_1: entered promiscuous mode [ 230.613420][ T8014] wg0: entered promiscuous mode [ 230.711911][ T8007] bridge0: port 2(bridge_slave_1) entered blocking state [ 230.719061][ T8007] bridge0: port 2(bridge_slave_1) entered forwarding state [ 230.726466][ T8007] bridge0: port 1(bridge_slave_0) entered blocking state [ 230.733533][ T8007] bridge0: port 1(bridge_slave_0) entered forwarding state [ 230.773707][ T471] bridge0: port 1(bridge_slave_0) entered disabled state [ 230.782615][ T471] bridge0: port 2(bridge_slave_1) entered disabled state [ 230.803620][ T471] bridge0: port 1(bridge_slave_0) entered blocking state [ 230.810745][ T471] bridge0: port 1(bridge_slave_0) entered forwarding state [ 230.818493][ T471] bridge0: port 2(bridge_slave_1) entered blocking state [ 230.825590][ T471] bridge0: port 2(bridge_slave_1) entered forwarding state [ 230.857153][ T8007] veth0_vlan: entered promiscuous mode [ 230.871345][ T8007] veth1_macvtap: entered promiscuous mode [ 230.892972][ T8041] ./dev/sda1: Can't lookup blockdev [ 230.909098][ T8043] overlay: ./file0 is not a directory [ 231.676528][ T36] audit: type=1326 audit(2000017012.473:679): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8065 comm="syz.2.2219" exe="/root/ci2-android-6-12-rust/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f0a25b9e159 code=0x0 [ 232.018988][ T8073] cgroup2: Unknown parameter 'f¿ö:ÀæV¬ìavorddn ods' [ 232.500888][ T8090] bridge0: port 1(bridge_slave_0) entered blocking state [ 232.507942][ T8090] bridge0: port 1(bridge_slave_0) entered disabled state [ 232.516647][ T8090] bridge_slave_0: entered allmulticast mode [ 232.523773][ T8090] bridge_slave_0: entered promiscuous mode [ 232.531626][ T8095] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2228'. [ 232.541877][ T8090] bridge0: port 2(bridge_slave_1) entered blocking state [ 232.548932][ T8090] bridge0: port 2(bridge_slave_1) entered disabled state [ 232.556388][ T8090] bridge_slave_1: entered allmulticast mode [ 232.563469][ T8090] bridge_slave_1: entered promiscuous mode [ 232.679090][ T2931] bridge0: port 1(bridge_slave_0) entered blocking state [ 232.686220][ T2931] bridge0: port 1(bridge_slave_0) entered forwarding state [ 232.686625][ T8101] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2230'. [ 232.705520][ T8105] overlayfs: lower data-only dirs require metacopy support. [ 232.713732][ T36] audit: type=1400 audit(2000017013.503:680): avc: denied { connect } for pid=8104 comm="syz.5.2231" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 232.719987][ T8101] netlink: 'syz.3.2230': attribute type 6 has an invalid length. [ 232.741864][ T8101] netlink: 'syz.3.2230': attribute type 5 has an invalid length. [ 232.747241][ T472] bridge0: port 2(bridge_slave_1) entered blocking state [ 232.749622][ T8101] netlink: 'syz.3.2230': attribute type 4 has an invalid length. [ 232.756703][ T472] bridge0: port 2(bridge_slave_1) entered forwarding state [ 232.786344][ T8112] SELinux: Context system_u:object_r:apt_var_log_t:s0 is not valid (left unmapped). [ 232.817068][ T36] audit: type=1400 audit(2000017013.613:681): avc: denied { relabelto } for pid=8099 comm="syz.3.2230" name="cgroup" dev="tmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=lnk_file permissive=1 trawcon="system_u:object_r:apt_var_log_t:s0" [ 232.850168][ T8090] veth0_vlan: entered promiscuous mode [ 232.874932][ T8090] veth1_macvtap: entered promiscuous mode [ 232.880875][ T36] audit: type=1400 audit(2000017013.613:682): avc: denied { associate } for pid=8099 comm="syz.3.2230" name="cgroup" dev="tmpfs" ino=54 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:apt_var_log_t:s0" [ 232.964194][ T8133] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 232.982174][ T8133] netlink: 5 bytes leftover after parsing attributes in process `syz.0.2227'. [ 233.001965][ T8133] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 233.034510][ T8141] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 233.053498][ T8133] overlayfs: inode number too big (/, ino=4611686018427387905, xinobits=3) [ 233.090587][ T36] audit: type=1400 audit(2000017013.893:683): avc: denied { create } for pid=8146 comm="syz.0.2234" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 233.092366][ T8147] vlan0: entered allmulticast mode [ 233.134993][ T8147] veth0_vlan: entered allmulticast mode [ 233.150731][ T8147] vlan0: entered promiscuous mode [ 233.159531][ T8146] vlan0: left promiscuous mode [ 233.164716][ T8146] vlan0: left allmulticast mode [ 233.169912][ T8146] veth0_vlan: left allmulticast mode [ 233.680012][ T36] audit: type=1400 audit(2000017014.473:684): avc: denied { unlink } for pid=8007 comm="syz-executor" name="cgroup" dev="tmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=lnk_file permissive=1 trawcon="system_u:object_r:apt_var_log_t:s0" [ 233.770032][ T36] audit: type=1400 audit(2000017014.563:685): avc: denied { read } for pid=8173 comm="syz.3.2241" dev="sockfs" ino=222407 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 233.881356][ T36] audit: type=1400 audit(2000017014.683:686): avc: denied { setattr } for pid=8189 comm="syz.3.2244" name="XDP" dev="sockfs" ino=222666 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 234.496592][ T8210] No source specified [ 234.516298][ T8212] fuse: Bad value for 'fd' [ 234.529077][ T36] audit: type=1400 audit(2000017015.323:687): avc: denied { unmount } for pid=8007 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 234.644394][ T36] audit: type=1400 audit(2000017015.443:688): avc: denied { create } for pid=8224 comm="syz.0.2256" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 235.252181][ T8242] No source specified [ 235.260010][ T8248] fuse: Bad value for 'fd' [ 235.489337][ T8256] bridge0: port 4(veth1_macvtap) entered blocking state [ 235.496375][ T8256] bridge0: port 4(veth1_macvtap) entered disabled state [ 235.503576][ T8256] veth1_macvtap: entered allmulticast mode [ 235.509848][ T8256] veth1_macvtap: left allmulticast mode [ 235.516648][ T8256] bridge0: port 4(veth1_macvtap) entered blocking state [ 235.523683][ T8256] bridge0: port 4(veth1_macvtap) entered disabled state [ 235.530832][ T8256] veth1_macvtap: entered allmulticast mode [ 235.537143][ T8256] veth1_macvtap: left allmulticast mode [ 235.824396][ T8278] page size migration: [8278 (syz.0.2270)] madvise_vma_pad_pages:326: Invalid attempt to madvise padding on MAP_SHARED vma [ 235.828915][ T8280] page size migration: [8280 (syz.0.2270)] madvise_vma_pad_pages:326: Invalid attempt to madvise padding on MAP_SHARED vma [ 235.910334][ T8292] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2274'. [ 235.934112][ T8290] device-mapper: ioctl: name not supplied when creating device [ 235.961220][ T8292] sd 0:0:1:0: PR command failed: 1026 [ 235.966840][ T8292] sd 0:0:1:0: Sense Key : 0x5 [current] [ 235.972649][ T8292] sd 0:0:1:0: ASC=0x20 ASCQ=0x0 [ 236.360704][ T8312] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2280'. [ 236.484940][ T8320] FAULT_INJECTION: forcing a failure. [ 236.484940][ T8320] name failslab, interval 1, probability 0, space 0, times 0 [ 236.497929][ T8320] CPU: 1 UID: 0 PID: 8320 Comm: syz.5.2282 Not tainted syzkaller #0 e67cc5743245539115c479145c763e2a95730d6f [ 236.497963][ T8320] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 236.497976][ T8320] Call Trace: [ 236.497985][ T8320] [ 236.497994][ T8320] __dump_stack+0x21/0x30 [ 236.498026][ T8320] dump_stack_lvl+0x140/0x1c0 [ 236.498052][ T8320] ? __cfi_dump_stack_lvl+0x10/0x10 [ 236.498078][ T8320] ? ring_buffer_unlock_commit+0x473/0x5e0 [ 236.498102][ T8320] dump_stack+0x19/0x20 [ 236.498126][ T8320] should_fail_ex+0x3c2/0x510 [ 236.498150][ T8320] should_failslab+0xac/0x100 [ 236.498175][ T8320] __kmalloc_node_track_caller_noprof+0x65/0x4f0 [ 236.498198][ T8320] ? kstrdup_const+0x45/0x60 [ 236.498216][ T8320] kstrdup+0x4d/0x130 [ 236.498234][ T8320] ? kstrdup_const+0x3a/0x60 [ 236.498252][ T8320] kstrdup_const+0x45/0x60 [ 236.498270][ T8320] __kernfs_new_node+0xaa/0x740 [ 236.498294][ T8320] ? mutex_unlock+0x90/0x240 [ 236.498318][ T8320] ? pcpu_alloc_noprof+0x1440/0x1440 [ 236.498341][ T8320] ? kernfs_new_node+0x280/0x280 [ 236.498365][ T8320] ? pcpu_alloc_noprof+0xd93/0x1440 [ 236.498388][ T8320] kernfs_new_node+0x154/0x280 [ 236.498411][ T8320] kernfs_create_dir_ns+0x4b/0x130 [ 236.498435][ T8320] cgroup_mkdir+0x396/0x1600 [ 236.498458][ T8320] ? __kasan_check_write+0x18/0x20 [ 236.498478][ T8320] ? __cfi_cgroup_mkdir+0x10/0x10 [ 236.498501][ T8320] kernfs_iop_mkdir+0x1be/0x2d0 [ 236.498525][ T8320] vfs_mkdir+0x591/0x810 [ 236.498551][ T8320] do_mkdirat+0x240/0x530 [ 236.498576][ T8320] ? __cfi_do_mkdirat+0x10/0x10 [ 236.498601][ T8320] ? __kasan_check_write+0x18/0x20 [ 236.498620][ T8320] ? getname_flags+0x203/0x6b0 [ 236.498641][ T8320] ? trace_event_raw_event_sys_enter+0xf5/0x130 [ 236.498670][ T8320] __x64_sys_mkdirat+0x8b/0xa0 [ 236.498696][ T8320] x64_sys_call+0x2ba8/0x2ee0 [ 236.498715][ T8320] do_syscall_64+0x57/0xf0 [ 236.498734][ T8320] ? clear_bhb_loop+0x50/0xa0 [ 236.498759][ T8320] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 236.498781][ T8320] RIP: 0033:0x7f80f699e159 [ 236.498800][ T8320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 236.498820][ T8320] RSP: 002b:00007f80f7857028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 236.498847][ T8320] RAX: ffffffffffffffda RBX: 00007f80f6c25fa0 RCX: 00007f80f699e159 [ 236.498863][ T8320] RDX: 00000000000001ff RSI: 0000200000000000 RDI: ffffffffffffff9c [ 236.498878][ T8320] RBP: 00007f80f6a3506b R08: 0000000000000000 R09: 0000000000000000 [ 236.498900][ T8320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 236.498914][ T8320] R13: 00007f80f6c26038 R14: 00007f80f6c25fa0 R15: 00007ffc6370d628 [ 236.498931][ T8320] [ 236.499018][ T8320] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI [ 236.780310][ T8320] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] [ 236.788736][ T8320] CPU: 1 UID: 0 PID: 8320 Comm: syz.5.2282 Not tainted syzkaller #0 e67cc5743245539115c479145c763e2a95730d6f [ 236.800295][ T8320] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 236.810368][ T8320] RIP: 0010:trace_event_raw_event_cgroup_rstat+0x14b/0x3b0 [ 236.817583][ T8320] Code: 00 48 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 88 5f 62 00 44 89 64 24 18 48 8b 1b 48 83 c3 0c 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 8c 01 00 00 44 8b 23 49 8d 5d 08 48 89 [ 236.837205][ T8320] RSP: 0018:ffffc9000b08fae0 EFLAGS: 00010003 [ 236.843297][ T8320] RAX: 0000000000000001 RBX: 000000000000000c RCX: ffff888115780000 [ 236.851283][ T8320] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000000 [ 236.859274][ T8320] RBP: ffffc9000b08fbc8 R08: ffff888115780000 R09: 0000000000000002 [ 236.867262][ T8320] R10: fffffffffffffff5 R11: 0000000000000000 R12: 0000000000000000 [ 236.875344][ T8320] R13: ffff88811fb67354 R14: 1ffff92001611f60 R15: dffffc0000000000 [ 236.883330][ T8320] FS: 00007f80f78576c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 236.892274][ T8320] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 236.898873][ T8320] CR2: 00007f80f7835ff8 CR3: 000000011a134000 CR4: 00000000003526b0 [ 236.906871][ T8320] Call Trace: [ 236.910175][ T8320] [ 236.913121][ T8320] ? __cfi_trace_event_raw_event_cgroup_rstat+0x10/0x10 [ 236.920076][ T8320] ? __cfi__raw_spin_trylock+0x10/0x10 [ 236.925551][ T8320] __cgroup_rstat_lock+0x11e/0x280 [ 236.930682][ T8320] cgroup_rstat_flush+0x22/0x150 [ 236.935638][ T8320] cgroup_rstat_exit+0x33/0x1e0 [ 236.940504][ T8320] ? kernfs_create_dir_ns+0x10a/0x130 [ 236.945899][ T8320] cgroup_mkdir+0xd96/0x1600 [ 236.950512][ T8320] ? __kasan_check_write+0x18/0x20 [ 236.955653][ T8320] ? __cfi_cgroup_mkdir+0x10/0x10 [ 236.960698][ T8320] kernfs_iop_mkdir+0x1be/0x2d0 [ 236.965576][ T8320] vfs_mkdir+0x591/0x810 [ 236.969849][ T8320] do_mkdirat+0x240/0x530 [ 236.974211][ T8320] ? __cfi_do_mkdirat+0x10/0x10 [ 236.979086][ T8320] ? __kasan_check_write+0x18/0x20 [ 236.984216][ T8320] ? getname_flags+0x203/0x6b0 [ 236.989002][ T8320] ? trace_event_raw_event_sys_enter+0xf5/0x130 [ 236.995270][ T8320] __x64_sys_mkdirat+0x8b/0xa0 [ 237.000056][ T8320] x64_sys_call+0x2ba8/0x2ee0 [ 237.004747][ T8320] do_syscall_64+0x57/0xf0 [ 237.009184][ T8320] ? clear_bhb_loop+0x50/0xa0 [ 237.013876][ T8320] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 237.019786][ T8320] RIP: 0033:0x7f80f699e159 [ 237.024208][ T8320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 237.043826][ T8320] RSP: 002b:00007f80f7857028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 237.052260][ T8320] RAX: ffffffffffffffda RBX: 00007f80f6c25fa0 RCX: 00007f80f699e159 [ 237.060684][ T8320] RDX: 00000000000001ff RSI: 0000200000000000 RDI: ffffffffffffff9c [ 237.068674][ T8320] RBP: 00007f80f6a3506b R08: 0000000000000000 R09: 0000000000000000 [ 237.076656][ T8320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 237.084641][ T8320] R13: 00007f80f6c26038 R14: 00007f80f6c25fa0 R15: 00007ffc6370d628 [ 237.092629][ T8320] [ 237.095660][ T8320] Modules linked in: [ 237.099593][ T8320] ---[ end trace 0000000000000000 ]--- [ 237.105048][ T8320] RIP: 0010:trace_event_raw_event_cgroup_rstat+0x14b/0x3b0 [ 237.112303][ T8320] Code: 00 48 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 88 5f 62 00 44 89 64 24 18 48 8b 1b 48 83 c3 0c 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 8c 01 00 00 44 8b 23 49 8d 5d 08 48 89 [ 237.131922][ T8320] RSP: 0018:ffffc9000b08fae0 EFLAGS: 00010003 [ 237.138005][ T8320] RAX: 0000000000000001 RBX: 000000000000000c RCX: ffff888115780000 [ 237.145986][ T8320] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000000 [ 237.153990][ T8320] RBP: ffffc9000b08fbc8 R08: ffff888115780000 R09: 0000000000000002 [ 237.161972][ T8320] R10: fffffffffffffff5 R11: 0000000000000000 R12: 0000000000000000 [ 237.169948][ T8320] R13: ffff88811fb67354 R14: 1ffff92001611f60 R15: dffffc0000000000 [ 237.177932][ T8320] FS: 00007f80f78576c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 237.186869][ T8320] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 237.193464][ T8320] CR2: 00007f80f7835ff8 CR3: 000000011a134000 CR4: 00000000003526b0 [ 237.201453][ T8320] Kernel panic - not syncing: Fatal exception [ 237.207936][ T8320] Kernel Offset: disabled [ 237.212250][ T8320] Rebooting in 86400 seconds..