last executing test programs: 3.117355753s ago: executing program 1 (id=2): r0 = socket(0x11, 0x3, 0x0) bind$packet(r0, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x14) (async, rerun: 64) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x541c1, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) ioctl$KVM_GET_TSC_KHZ_cpu(r4, 0xaea3) (async) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000002ac0)=ANY=[@ANYBLOB="2802000000110001002f6465762f726e756c6d623000"/40], 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) 3.116527973s ago: executing program 2 (id=3): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x140) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000240)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@uuid_on}]}) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) capset(&(0x7f0000000080)={0x20080522}, &(0x7f0000000180)={0x200000, 0x200000}) (async) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) (async) openat$selinux_access(0xffffffffffffff9c, &(0x7f00000077c0), 0x2, 0x0) (async) r0 = inotify_init1(0x80000) inotify_add_watch(r0, &(0x7f00000000c0)='./file0\x00', 0x90000003) socket$nl_route(0x10, 0x3, 0x0) epoll_create(0x3) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000007800)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000007840), 0x10e682, 0x0) (async) socket$nl_xfrm(0x10, 0x3, 0x6) (async) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000007880), 0x0, 0x0) (async) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0xc03, 0x0) ioctl$UI_DEV_SETUP(r3, 0x405c5503, &(0x7f0000000180)={{0x0, 0x7, 0x0, 0x9}, 'syz0\x00', 0x2a}) (async) ioctl$UI_SET_FFBIT(r3, 0x4004556b, 0x51) (async) ioctl$UI_DEV_CREATE(r3, 0x5501) (async) getsockopt$inet_udp_int(r2, 0x11, 0x66, &(0x7f0000000140), &(0x7f00000002c0)=0x4) (async) pread64(0xffffffffffffffff, &(0x7f0000000480)=""/250, 0xfa, 0x3) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000021c0)=[{&(0x7f00000018c0)={0x14, 0x25, 0x1, 0x70bd2b, 0x25dfdbfd, "", [@generic='&']}, 0x14}], 0x1, 0x0, 0x0, 0x4050}, 0xc0) (async) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r5, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) (async) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000280)=@req3={0xfffffffc, 0xfffffff7, 0x80, 0x9, 0x106, 0x474, 0xffffff54}, 0x1c) (async) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'erspan0\x00', 0xc201}) (async) write$tun(r6, &(0x7f00000000c0)=ANY=[@ANYRES64=r1], 0xffe) socket$inet_udp(0x2, 0x2, 0x0) 3.060393425s ago: executing program 1 (id=7): r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) ioctl$INCFS_IOC_READ_FILE_SIGNATURE(r0, 0x8010671f, &(0x7f0000000440)={&(0x7f0000000280)=""/208, 0xd0}) write$vga_arbiter(r0, &(0x7f0000000040)=@other={'trylock', ' ', 'io+mem'}, 0xf) rt_sigpending(0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) r2 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r2, &(0x7f0000000240)={&(0x7f0000000140)={0x1d, r3}, 0x10, &(0x7f0000000200)={&(0x7f0000000180)={0x3, 0x120, 0x4, {0x77359400}, {}, {0x3}, 0x1, @can={{0x3, 0x1, 0x0, 0x1}, 0x6, 0x0, 0x0, 0x0, "70b47471a6ad3ff1"}}, 0x48}, 0x1, 0x0, 0x0, 0x20000084}, 0x20008000) ioctl$TIOCGPKT(r1, 0x80045438, &(0x7f0000000100)) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r4, &(0x7f0000000040)={0x1f, @none}, 0x8) bind$bt_sco(r4, &(0x7f0000000000)={0x1f, @none}, 0x8) r5 = syz_usb_connect$printer(0x2, 0x2d, &(0x7f0000000100)=ANY=[], 0x0) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000480)={0x2, 0xc6, 0x7, 0x0, 0x1b, "2211e95921077ff6"}) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x10) syz_usb_control_io$printer(r5, 0x0, &(0x7f0000000500)={0x34, 0x0, 0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="2000860000000084fa1342dc371ee507c30c32fb43645304717efc54257c71cf50edcc05000000af96adc421cb0ea88e7dfb76449fd33a92ee77e434ba120b32e576a7e9abfaac54cf5a6f7a4973d12aaf74082987967008a8711d219f1f471aeedf7433508c4db5f836384a84a48001b3db2e14eb1a8aeec4e781ffab42855288383a05a1e9a543cd3a664c"], 0x0, 0x0}) 3.059668065s ago: executing program 2 (id=8): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x2000) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f00005fb000/0x400000)=nil) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/packet\x00') r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.controllers\x00', 0x275a, 0x0) write$P9_RLERROR(r0, &(0x7f0000000040)={0xb, 0x7, 0x1, {0x2, '%{'}}, 0xb) write$binfmt_script(r1, &(0x7f0000000080), 0x4) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x10012, r1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) fallocate(r1, 0x3, 0x10003, 0x2d22) r2 = syz_open_dev$loop(&(0x7f0000000240), 0x7, 0x184a81) clock_adjtime(0x0, &(0x7f0000000340)={0x0, 0x4, 0x9, 0x4, 0xffffffffffffffff, 0x3, 0x8, 0x9, 0x9, 0xffffffff, 0x3, 0x3, 0x8000, 0x58cc, 0x4, 0x1, 0x4, 0x0, 0xa, 0x2, 0x8, 0x268, 0x1, 0x4, 0x280, 0x2}) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f0000000280)={r3, 0x800, {0x0, 0x0, 0x0, 0x7, 0x4000000000000ffd, 0x0, 0x0, 0xd, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "6c5237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffceb, 0x7fffffffffffffff]}}) mremap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000009000/0x4000)=nil) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) lseek(r0, 0x2000, 0x0) 2.960379917s ago: executing program 2 (id=9): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x5543, 0x81, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x80, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x9, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x4, 0x9, 0x1, {0x22, 0x27}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0xb, 0xfe}}}}}]}}]}}, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r1, &(0x7f00000000c0)={0x1d, r2}, 0x10) sendmsg$can_bcm(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="01000000000000000000000000000080", @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000000010000000000000000000000a5976ac6acd41fd8"], 0x48}}, 0x4008004) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000001200)=@newsa={0x240, 0x10, 0x633, 0x0, 0x0, {{@in=@dev={0xac, 0x14, 0x14, 0x24}, @in=@initdev={0xac, 0x1e, 0x0, 0x0}}, {@in=@multicast1, 0x0, 0x32}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, {0xfffffffffffffffd, 0x0, 0x0, 0x2dcd}, {}, {0x8000000}, 0x70bd2d, 0x0, 0x2, 0x4}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @algo_auth={0x108, 0x1, {{'md5\x00'}, 0x600, "fd03480f2e2ebb04183ebca2030000000e847303000000000000002e34b339e1b0cd2b29cd33e8eb58cf85e6c1348f664a091c8ed7b5b2247fe438734b6b8a3542814ec68d748f75a367ecbd1fa068ce385485c44af5d318da074bd970644caa971ba6a9c9849f55737118e601f68e7aeef382822da5a1cac03cd6d7ea23cd1f3686413f6e3184a4dcef59aee63c77085556b5db947aa690fa6a719d97c12f33f4242e0f0eaa0fb342e0ea87f29ac97d29247d0d7749a186625adb2935d4ae54"}}]}, 0x240}, 0x1, 0x0, 0x0, 0x24000884}, 0x0) r4 = openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000080), 0x129401, 0x0) process_mrelease(r4, 0x0) sendmsg$can_bcm(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="01000000220900"/16, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYBLOB="0000000001"], 0x80}}, 0x0) sendmsg$can_bcm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000480)={0x2, 0x410, 0x8, {0x0, 0xea60}, {0x0, 0xea60}, {0x3, 0x1, 0x1, 0x1}, 0x1, @can={{0x1, 0x0, 0x1}, 0x6, 0x0, 0x0, 0x0, "7aab5a7dd119f209"}}, 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x8000) syz_usb_control_io$hid(r0, 0x0, 0x0) r5 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f00000000c0)={'wg2\x00', 0x0}) syz_usb_control_io(r0, &(0x7f0000000140)={0x2c, &(0x7f0000000180)=ANY=[@ANYBLOB="0006290000002931da0ba381030000000000000000cb4fdca0560fb30d54f365c5b1d43ee44fbf6fc93f080825c99017ed95df48c9354d9f5eb29c452a106435781b983d71c6f9b91deb2c28fde35f4d900278c9cd1c6c1d32cc000000000000d8d18ea7032e069460e23112feb6c42b10ecc9df790f5defbfad21fff07c465e069bf70e9dacc3d4d7ab42f2ac251f356e6c23366840986fbebff387362fea003b44d48a4b6df6fc8ebe898836627f474c28cbd17f42725065d4e7ede036acaf66c52aafa2518a83ef4be310264628", @ANYRESHEX=r2, @ANYRES64=r5], 0x0, 0x0, 0x0, 0x0}, 0x0) 2.002034818s ago: executing program 0 (id=10): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x10200, 0x0, 0x60000, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f000000e000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x73, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$EXT4_IOC_SETFSUUID(r1, 0x4008662c, &(0x7f0000000000)={0x0, 0x0, "26811b5f320a95f065721a60949c426d"}) (async) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(r3, 0x4068aea3, &(0x7f0000000200)={0xc5, 0x0, r3}) ioctl$KVM_SET_NESTED_STATE(0xffffffffffffffff, 0x4080aebf, &(0x7f0000005700)=@vmx={0x0, 0x0, 0x2080, {0xb000, 0x351000}, {"00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000169500", "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a5f2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fe00"}}) (async) modify_ldt$write2(0x11, &(0x7f0000000180)={0x3, 0x1000, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1}, 0x10) syz_clone(0xa38a1500, 0x0, 0x13, 0x0, 0x0, 0x0) (async) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) (async) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000016000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f00000000c0)="460f21478f6868a23b9a2e66420f23d466baa100ecc482cddc990f00000026f3d89e0080000066baf80cb8681d0e8cef66bafc0cb800480000efc40279254a0166bad104ec0f20e035000020000f22e0", 0x50}], 0x1, 0x0, &(0x7f0000000180), 0x0) (async) sendmsg(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f00000005c0)=[{}], 0x1, 0x0, 0x0, 0x11000000}, 0x0) (async) sendto$packet(0xffffffffffffffff, &(0x7f0000000000)="4d01", 0x2, 0x4000085, 0x0, 0x0) r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r4) ptrace$setregs(0xd, r4, 0x0, &(0x7f0000000540)) (async) ptrace$cont(0x20, r4, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 1.788564334s ago: executing program 0 (id=11): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000cc0)={'filter\x00', 0x6002, 0x4, 0x3d0, 0xf0, 0xf0, 0x200, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@empty, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0xc, 0x5, {@empty, {[0xff, 0x0, 0xff, 0xff, 0xff]}}, {@mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xf}, {[0x0, 0x0, 0x0, 0xff, 0x0, 0xff]}}, 0x1, 0x3ff, 0x2, 0xcd8, 0x7, 0x1, 'macvlan1\x00', 'ip_vti0\x00', {}, {0xff}, 0x0, 0x1}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x7, 0x2}}}, {{@arp={@multicast1, @remote, 0x0, 0x0, 0x0, 0x0, {}, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x34}}, 0x0, 0x0, 0x0, 0x6171, 0x0, 0xffff, 'veth1_vlan\x00', 'nicvf0\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @empty, @private, 0x0, 0x1}}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1, 0xffffff, 0xff, 0x6, 0x5, {@empty, {[0x0, 0xff, 0xff, 0x0, 0x0, 0x1c3ae9812108cb68]}}, {@empty, {[0xff, 0x0, 0x0, 0xff, 0x0, 0xff]}}, 0x0, 0x8, 0x46b, 0xc, 0x4, 0xc703, 'team_slave_1\x00', 'sit0\x00', {0xff}, {0xff}, 0x0, 0x1}, 0xc0, 0xe8}, @unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x3, 0x1, 0x1}}}], {{'\x00', 0xc0, 0xe8}, {0x28, '\x00', 0x0, 0xfffffffb}}}}, 0x420) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) bind$802154_dgram(r2, &(0x7f0000000100)={0x24, @long={0x3, 0xffff, {0xaaaaaaaaaaaa0102}}}, 0x14) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x82042, 0x0) mmap(&(0x7f000030d000/0x2000)=nil, 0x2000, 0x1000008, 0x13, r3, 0x74e25000) sendmsg$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0xffffffffffffff23, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYRES32=0x0], 0x128}, 0x1) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x42800, 0x0) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(r4, 0x8008ae9d, &(0x7f0000000040)) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000080)={0x101ff, 0x3, 0x8000000, 0x1000, &(0x7f0000ffe000/0x1000)=nil}) ioctl$KVM_CREATE_DEVICE(r6, 0xc00caee0, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x2102) 1.783254485s ago: executing program 0 (id=12): unshare(0x60000600) socket$inet_udp(0x2, 0x2, 0x0) (async) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000440)={'tunl0\x00', &(0x7f0000000480)={'syztnl0\x00', 0x0, 0x700, 0x8, 0x4000006, 0x8, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x67, 0x0, 0x9, 0x4, 0x0, @multicast1, @empty}}}}) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f00000003c0), 0x101002, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r2, 0x81f8943c, &(0x7f0000000d00)) recvmmsg(r1, &(0x7f0000000600)=[{{0x0, 0x0, 0x0}, 0xd47}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000001180)=""/4059, 0xfdb}, {&(0x7f0000000ac0)=""/200, 0xc8}, {&(0x7f0000000980)=""/284, 0x11c}, {&(0x7f0000000040)=""/182, 0xb6}, {&(0x7f0000000880)=""/216, 0xd8}, {&(0x7f0000000100)=""/101, 0x65}, {&(0x7f00000002c0)=""/224, 0xe0}, {&(0x7f0000000240)=""/109, 0x6d}, {&(0x7f00000004c0)=""/94, 0x5e}, {&(0x7f0000000000)=""/21, 0x15}], 0xa}, 0x120a}], 0x3, 0x40000020, 0x0) (async) recvmmsg(r1, &(0x7f0000000600)=[{{0x0, 0x0, 0x0}, 0xd47}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000001180)=""/4059, 0xfdb}, {&(0x7f0000000ac0)=""/200, 0xc8}, {&(0x7f0000000980)=""/284, 0x11c}, {&(0x7f0000000040)=""/182, 0xb6}, {&(0x7f0000000880)=""/216, 0xd8}, {&(0x7f0000000100)=""/101, 0x65}, {&(0x7f00000002c0)=""/224, 0xe0}, {&(0x7f0000000240)=""/109, 0x6d}, {&(0x7f00000004c0)=""/94, 0x5e}, {&(0x7f0000000000)=""/21, 0x15}], 0xa}, 0x120a}], 0x3, 0x40000020, 0x0) 1.750171575s ago: executing program 0 (id=13): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x143a00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x7, 0x12, r0, 0xe854000) madvise(&(0x7f00000b3000/0x2000)=nil, 0x2000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x121640, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_setup_syzos_vm$x86(r2, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$x86(r3, &(0x7f0000000080)={0x0, &(0x7f00000001c0)=[@enable_nested={0x12c, 0x18}], 0x18}) ioctl$KVM_SET_CPUID2(r4, 0x4008ae90, &(0x7f0000000000)) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 1.572368241s ago: executing program 0 (id=15): r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x8000) ioctl$NILFS_IOCTL_GET_SUINFO(r0, 0x80186e84, &(0x7f00000000c0)={&(0x7f0000000040)=[{0x7ff, 0xb6000000}, {0x5, 0x8}, {0xc25, 0x200000}, {0x53a, 0x9, 0x1}, {0x9, 0x4, 0x2}, {0xaf, 0x6, 0x1}], 0x6, 0x10, 0x6, 0x5}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) r1 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x80840) syz_usb_disconnect(r1) syz_usb_connect(0x4, 0x24, &(0x7f00000000c0)=ANY=[], 0x0) ioctl$EVIOCRMFF(r1, 0xc0085508, &(0x7f0000000080)=0x6) syz_usb_connect$printer(0x5, 0x2d, &(0x7f0000000180)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x20, 0x3f0, 0x4, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x9, 0x40, 0x9, "", [{{0x9, 0x4, 0x0, 0xa, 0x2, 0x7, 0x1, 0x1, 0x5, "", {{{0x9, 0x5, 0x1, 0x2, 0x200, 0x1, 0x6, 0x1}}}}}]}}]}}, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_pidfd_open(r2, 0x0) write$cgroup_pid(r0, &(0x7f0000000100)=r2, 0x12) 1.384138937s ago: executing program 2 (id=16): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000207d1e5a2d00000000000109022400010000000009040000010300000009210000000122080009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000740)={0x24, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="002208000000a20100c3"], 0x0}, 0x0) (async) r1 = syz_open_dev$hiddev(&(0x7f0000000100), 0x2, 0x880) ioctl$HIDIOCGUSAGE(r1, 0xc018480b, &(0x7f0000000080)={0x3, 0x200, 0x2, 0x4, 0x9, 0x7}) 816.602504ms ago: executing program 3 (id=17): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000), 0x101000, 0x800, 0x3, 0x1}, 0x20) r1 = socket$inet(0x2, 0x2, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r2, 0x6, 0x9, 0x0, &(0x7f0000000040)) r3 = socket$inet(0x2, 0x1, 0x0) r4 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r4, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) listen(r4, 0x0) r5 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r5, &(0x7f0000000240)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x41}}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r6, 0xffffffffffffffff, 0x200000000000000) setsockopt$sock_int(r3, 0x1, 0x2b, &(0x7f0000000600)=0x1801, 0x4) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x4, 0x0, 0x0, 0xfffffffe}) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r7, &(0x7f0000000000)={0x1f, 0x1, @none}, 0xe) setsockopt$inet_msfilter(r1, 0x0, 0x29, 0x0, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) (async) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000), 0x101000, 0x800, 0x3, 0x1}, 0x20) (async) socket$inet(0x2, 0x2, 0x0) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) getsockopt$inet_tcp_int(r2, 0x6, 0x9, 0x0, &(0x7f0000000040)) (async) socket$inet(0x2, 0x1, 0x0) (async) socket$tipc(0x1e, 0x5, 0x0) (async) bind$tipc(r4, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) (async) listen(r4, 0x0) (async) socket$tipc(0x1e, 0x5, 0x0) (async) sendmsg$tipc(r5, &(0x7f0000000240)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x41}}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) (async) close_range(r6, 0xffffffffffffffff, 0x200000000000000) (async) setsockopt$sock_int(r3, 0x1, 0x2b, &(0x7f0000000600)=0x1801, 0x4) (async) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x4, 0x0, 0x0, 0xfffffffe}) (async) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) (async) bind$bt_l2cap(r7, &(0x7f0000000000)={0x1f, 0x1, @none}, 0xe) (async) setsockopt$inet_msfilter(r1, 0x0, 0x29, 0x0, 0x0) (async) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) (async) 814.486784ms ago: executing program 3 (id=18): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0xfffffffffffffffe) ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, &(0x7f0000000a40)={0x0, [{0x2, 0x8, 0x4, &(0x7f00000004c0)="01"}, {0x2, 0x0, 0x2, 0x0}, {0x2, 0x0, 0x6, 0x0}, {0x2, 0x0, 0x912b, 0x0}, {0x1, 0x0, 0x3cb3, 0x0}, {0x3, 0x0, 0x3fe, 0x0}, {0x1, 0x0, 0x2, 0x0}, {0x3, 0x0, 0xfffffffe, 0x0}, {0x2, 0x0, 0xb, 0x0}, {0x1, 0x0, 0x3, 0x0}, {0x0, 0x0, 0x9, 0x0}, {0x3, 0x0, 0xa, 0x0}, {0x1, 0x0, 0x0, 0x0}, {0x1, 0x0, 0x7fffffff, 0x0}, {0x1, 0x0, 0x2, 0x0}, {0x1, 0x0, 0x8001, 0x0}]}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 801.416955ms ago: executing program 3 (id=19): pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TID_CONFIG(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)={0x30, r2, 0x1, 0x0, 0x25dfdc01, {{0x5}, {@void, @val={0xc, 0x99, {0x7}}}}, [@NL80211_ATTR_TID_CONFIG={0x10, 0x11d, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE={0x8, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x4}]}]}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x24000004}, 0x8044000) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_LEAVE_OCB(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2a, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r3}, @void}}, [""]}, 0x1c}}, 0x20000000) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8916, &(0x7f0000000000)={'ip_vti0\x00', {0x2, 0x4e22, @private=0x101}}) 781.125326ms ago: executing program 3 (id=20): openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x85) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='map_files\x00') lseek(r0, 0x1, 0x1) (async) lseek(r0, 0x1, 0x1) getdents64(r0, &(0x7f0000000000)=""/121, 0x79) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_HEADER(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x74, 0xc, 0x6, 0x407, 0x0, 0x0, {0x5, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x74}, 0x1, 0x0, 0x0, 0x20000000}, 0x40001) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@msize}], [], 0x6b}}) (async) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@msize}], [], 0x6b}}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r4, 0xae03, 0xd4) dup2(r3, r3) 724.697877ms ago: executing program 3 (id=21): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x189040, 0x2) truncate(&(0x7f0000000340)='./file1\x00', 0x9) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/resume', 0x8080, 0x40) quotactl_fd$Q_QUOTAON(r1, 0xffffffff80000201, 0x0, 0x0) ioctl$UI_END_FF_ERASE(r1, 0x400c55cb, &(0x7f0000000000)={0x4, 0x9, 0x7}) finit_module(r0, 0x0, 0x1) 724.529827ms ago: executing program 3 (id=22): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x40, &(0x7f0000000280)=0xe6e8, 0x4) (async) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x3f, &(0x7f0000000040)=0x401, 0x4) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xb) syz_usb_connect$uac2(0x5, 0x87, &(0x7f0000000300)=ANY=[@ANYBLOB="1201070000000008351210004000010203010902750003010a7003080b0002010a204009040000000101200009240100000215000f0c240301050700010705000509040100000102200009040101010102200009050109ff03010703082501853504010409040200000102200009040201010102200009058209ff03921108082501c33f10ff005bb2a65464f50fb8aab0f7630498a59842"], &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0}) (async) r1 = accept4$inet(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000040)=0x10, 0x800) recvfrom$inet(r1, &(0x7f00000001c0)=""/236, 0xec, 0x40002103, &(0x7f00000002c0)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x32}}, 0x10) 215.850833ms ago: executing program 0 (id=23): io_setup(0x8, &(0x7f0000004200)=0x0) syz_usb_connect$hid(0x5, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x7c0, 0x1125, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x80, 0x0, "", [{{0x9, 0x4, 0x0, 0x80, 0x9, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x25}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x10, 0xa, 0xff}}}}}]}}]}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000300)='cgroup2\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000000c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x20100, 0x44) ioctl$FS_IOC_FSSETXATTR(r1, 0x401c5820, &(0x7f0000000480)={0xd6f0, 0x0, 0x0, 0xffffff7d}) r2 = syz_open_procfs(0x0, &(0x7f0000000300)='comm\x00') io_submit(r0, 0x1, &(0x7f0000000100)=[&(0x7f0000004280)={0x0, 0x0, 0x0, 0x2, 0xfffe, r2, 0x0, 0x0, 0x200000000000, 0x0, 0x2}]) 59.506888ms ago: executing program 1 (id=24): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newsa={0x154, 0x10, 0x1, 0x70bd30, 0x0, {{@in=@remote, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x64}, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x32}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, {0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x4}, {0x0, 0x0, 0x8000000, 0x200}, {0x0, 0x0, 0x2}, 0x0, 0x0, 0x2, 0x1, 0xff, 0xcd}, [@algo_crypt={0x48, 0x2, {{'cbc(aes)\x00'}}}, @replay_esn_val={0x1c, 0x17, {0x0, 0x70bd25, 0x0, 0x0, 0x70bd28, 0xeaa}}]}, 0x154}, 0x1, 0x0, 0x0, 0x4044011}, 0x0) 564.4µs ago: executing program 1 (id=25): r0 = socket$nl_generic(0x10, 0x3, 0x10) munmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000) mincore(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0) r1 = signalfd4(r0, &(0x7f0000000000)={[0x8]}, 0x8, 0x180000) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r0) sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000600)=ANY=[@ANYBLOB="c0011700", @ANYRES16=r2, @ANYBLOB="020025bd7000fedbdf25170000001400028008000200b20000000800020000050000b80004804c00078008000400030000000800020009ab000008000300f7ffffff080003000900000008000400ff03000008000300040000000800030007000000080004000000000008000400070000000900010073797a31000000000900010073797a31000000001c00078008000300470200000800020001000000080004000300000000000780000004000200000000000300ff0700000000020000010000000002000900000000000400000000001300010062726f6164636173742d6c696e6b00001300010062726f6164636173742d6c696e6b00000c0002800800010003000000680004800900010073797a31000000000900010073797a31000000004c0007800000010014000000080004000200000008000300020000000800040004000000080002000100010008000400f1d00000080001001d000000080003000700000008000300300000005400058014000280080002000900000008000400bc0e00003c00028008000400ff7f0000080001000700000008000300190a000008000200ffffffff080003000300000008000400c300000008000300040000000400048014000780080001004db900000800010005000000"], 0x1c0}, 0x1, 0x0, 0x0, 0x44000}, 0x8080) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) fallocate(r4, 0x0, 0x4, 0x3) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) r5 = syz_open_dev$loop(&(0x7f00000001c0), 0x3, 0x141400) ioctl$IOC_PR_REGISTER(r5, 0x401870c8, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001080)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000003000000580001800d0001007564703a73797a32e1ce"], 0x6c}}, 0x4004090) 0s ago: executing program 1 (id=26): r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000005c0), 0x2, 0x0) r1 = openat$selinux_policy(0xffffff9c, &(0x7f00000000c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r1, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_CAP_HYPERV_SYNIC2(r4, 0x4068aea3, &(0x7f0000000140)) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x40000092, 0x0, 0x7}]}) write$selinux_load(r0, &(0x7f0000001400)=ANY=[@ANYBLOB="8cff7cf9080000005345204c08007578"], 0x10) ioctl$KVM_RUN(r4, 0xae80, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000001380), 0x0) preadv2(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) write$selinux_load(r0, &(0x7f0000000000)=ANY=[], 0x190ec) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.106' (ED25519) to the list of known hosts. [ 28.361683][ T36] audit: type=1400 audit(1778999001.640:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 28.362695][ T286] cgroup: Unknown subsys name 'net' [ 28.384898][ T36] audit: type=1400 audit(1778999001.640:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 28.413007][ T36] audit: type=1400 audit(1778999001.670:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 28.413224][ T286] cgroup: Unknown subsys name 'devices' [ 28.593251][ T286] cgroup: Unknown subsys name 'hugetlb' [ 28.600062][ T286] cgroup: Unknown subsys name 'rlimit' [ 28.772849][ T36] audit: type=1400 audit(1778999002.050:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 28.796544][ T36] audit: type=1400 audit(1778999002.050:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 28.810662][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 28.822606][ T36] audit: type=1400 audit(1778999002.050:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 28.856634][ T36] audit: type=1400 audit(1778999002.110:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.880041][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 28.885349][ T36] audit: type=1400 audit(1778999002.110:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.922517][ T36] audit: type=1400 audit(1778999002.160:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.949137][ T36] audit: type=1400 audit(1778999002.160:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.754686][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.762131][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.770310][ T295] bridge_slave_0: entered allmulticast mode [ 29.777346][ T295] bridge_slave_0: entered promiscuous mode [ 29.785954][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.795085][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.802475][ T295] bridge_slave_1: entered allmulticast mode [ 29.809404][ T295] bridge_slave_1: entered promiscuous mode [ 29.835661][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.843086][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.850197][ T294] bridge_slave_0: entered allmulticast mode [ 29.856786][ T294] bridge_slave_0: entered promiscuous mode [ 29.866358][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.873595][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.880797][ T294] bridge_slave_1: entered allmulticast mode [ 29.887193][ T294] bridge_slave_1: entered promiscuous mode [ 29.929158][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.936463][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.943941][ T293] bridge_slave_0: entered allmulticast mode [ 29.950129][ T293] bridge_slave_0: entered promiscuous mode [ 29.961687][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.968942][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.976661][ T293] bridge_slave_1: entered allmulticast mode [ 29.983104][ T293] bridge_slave_1: entered promiscuous mode [ 30.042195][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.049375][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.056832][ T296] bridge_slave_0: entered allmulticast mode [ 30.063423][ T296] bridge_slave_0: entered promiscuous mode [ 30.073541][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.080609][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.087906][ T296] bridge_slave_1: entered allmulticast mode [ 30.094402][ T296] bridge_slave_1: entered promiscuous mode [ 30.198928][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.206375][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.213862][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.222510][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.235976][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.243539][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.252246][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.260447][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.269948][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.278256][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.286234][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.294748][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.334646][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.343072][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.351540][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.359483][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.397893][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.405821][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.413864][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.421526][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.429118][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.436809][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.445296][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.453335][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.465387][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.472768][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.484698][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.492381][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.516081][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.523589][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.533016][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.541112][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.559623][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.567311][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.575900][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.583306][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.598722][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.606500][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.627771][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.635947][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.672417][ T296] veth0_vlan: entered promiscuous mode [ 30.684252][ T295] veth0_vlan: entered promiscuous mode [ 30.711778][ T296] veth1_macvtap: entered promiscuous mode [ 30.719197][ T295] veth1_macvtap: entered promiscuous mode [ 30.737697][ T294] veth0_vlan: entered promiscuous mode [ 30.764954][ T293] veth0_vlan: entered promiscuous mode [ 30.778486][ T296] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 30.804296][ T294] veth1_macvtap: entered promiscuous mode [ 30.821199][ T293] veth1_macvtap: entered promiscuous mode [ 30.829195][ T313] overlayfs: missing 'lowerdir' [ 30.966869][ T339] loop7: detected capacity change from 0 to 7 [ 30.977274][ T339] Buffer I/O error on dev loop7, logical block 0, async page read [ 30.987062][ T339] Buffer I/O error on dev loop7, logical block 0, async page read [ 30.996901][ T339] loop7: unable to read partition table [ 31.005567][ T311] Buffer I/O error on dev loop7, logical block 0, async page read [ 31.015798][ T339] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 31.021664][ T311] Buffer I/O error on dev loop7, logical block 0, async page read [ 31.040929][ T311] Buffer I/O error on dev loop7, logical block 0, async page read [ 31.050971][ T311] Buffer I/O error on dev loop7, logical block 0, async page read [ 31.067177][ T311] Buffer I/O error on dev loop7, logical block 0, async page read [ 31.111182][ T45] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 31.161748][ T310] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 31.201213][ T31] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 31.261184][ T45] usb 1-1: Using ep0 maxpacket: 8 [ 31.269193][ T45] usb 1-1: New USB device found, idVendor=0763, idProduct=1002, bcdDevice= 0.40 [ 31.278762][ T45] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 31.287284][ T45] usb 1-1: Product: syz [ 31.291865][ T45] usb 1-1: Manufacturer: syz [ 31.296903][ T45] usb 1-1: SerialNumber: syz [ 31.311368][ T64] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 31.332614][ T310] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 31.344155][ T310] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 31.351193][ T31] usb 2-1: device descriptor read/64, error -71 [ 31.355766][ T310] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 31.371998][ T310] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 31.381559][ T310] usb 4-1: SerialNumber: syz [ 31.390639][ T310] usb 4-1: 0:2 : does not exist [ 31.461130][ T64] usb 3-1: Using ep0 maxpacket: 8 [ 31.467792][ T64] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 31.479576][ T64] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 31.492606][ T64] usb 3-1: New USB device found, idVendor=5543, idProduct=0081, bcdDevice= 0.00 [ 31.501943][ T64] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.514936][ T64] usb 3-1: config 0 descriptor?? [ 31.600961][ T45] usb 1-1: 1:1 : bogus bTerminalLink 0 [ 31.607487][ T45] usb 1-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 31.618146][ T45] usb 1-1: unit 3 not found! [ 31.623917][ T31] usb 2-1: device descriptor read/64, error -71 [ 31.631020][ T45] usb 1-1: unit 9 not found! [ 31.642595][ T45] usb 1-1: USB disconnect, device number 2 [ 31.665151][ T311] udevd[311]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card1/controlC1/../uevent} for writing: No such file or directory [ 31.795794][ T10] usb 4-1: USB disconnect, device number 2 [ 31.861210][ T31] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 31.991302][ T31] usb 2-1: device descriptor read/64, error -71 [ 32.027548][ T348] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 32.127557][ T64] usb 3-1: string descriptor 0 read error: -71 [ 32.134678][ T64] uclogic 0003:5543:0081.0001: failed retrieving string descriptor #200: -71 [ 32.143718][ T64] uclogic 0003:5543:0081.0001: failed retrieving pen parameters: -71 [ 32.152212][ T64] uclogic 0003:5543:0081.0001: failed probing pen v2 parameters: -71 [ 32.161001][ T64] uclogic 0003:5543:0081.0001: failed probing parameters: -71 [ 32.169230][ T64] uclogic 0003:5543:0081.0001: probe with driver uclogic failed with error -71 [ 32.181841][ T64] usb 3-1: USB disconnect, device number 2 [ 32.241257][ T31] usb 2-1: device descriptor read/64, error -71 [ 32.351818][ T31] usb usb2-port1: attempt power cycle [ 32.691216][ T31] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 32.712372][ T31] usb 2-1: device descriptor read/8, error -71 [ 32.842416][ T31] usb 2-1: device descriptor read/8, error -71 [ 32.851159][ T314] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 32.881184][ T10] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 33.001178][ T314] usb 1-1: Using ep0 maxpacket: 32 [ 33.007930][ T314] usb 1-1: unable to get BOS descriptor or descriptor too short [ 33.016847][ T314] usb 1-1: config 1 interface 0 altsetting 10 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 33.030327][ T314] usb 1-1: config 1 interface 0 has no altsetting 0 [ 33.039219][ T314] usb 1-1: string descriptor 0 read error: -22 [ 33.045612][ T314] usb 1-1: New USB device found, idVendor=03f0, idProduct=0004, bcdDevice= 0.40 [ 33.051108][ T10] usb 3-1: Using ep0 maxpacket: 32 [ 33.055261][ T314] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.061339][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 33.069849][ T314] usblp0: Disabling reads from problematic bidirectional printer [ 33.080891][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 33.091141][ T31] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 33.098355][ T10] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 33.118117][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.127153][ T10] usb 3-1: config 0 descriptor?? [ 33.133367][ T31] usb 2-1: device descriptor read/8, error -71 [ 33.177719][ T372] capability: warning: `syz.3.17' uses deprecated v2 capabilities in a way that may be insecure [ 33.262766][ T31] usb 2-1: device descriptor read/8, error -71 [ 33.264193][ T385] Invalid ELF header len 9 [ 33.371546][ T31] usb usb2-port1: unable to enumerate USB device [ 33.450061][ T314] usblp 1-1:1.0: usblp0: USB Unidirectional printer dev 3 if 0 alt 10 proto 1 vid 0x03F0 pid 0x0004 [ 33.462955][ T314] usb 1-1: USB disconnect, device number 3 [ 33.469657][ T314] usblp0: removed [ 33.539424][ T10] savu 0003:1E7D:2D5A.0002: hiddev96,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.2-1/input0 [ 33.551705][ T64] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 33.711160][ T64] usb 4-1: Using ep0 maxpacket: 8 [ 33.717567][ T64] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 146, changing to 7 [ 33.730720][ T64] usb 4-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 33.739889][ T64] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.748037][ T64] usb 4-1: Product: syz [ 33.749005][ T314] usb 3-1: USB disconnect, device number 3 [ 33.754830][ T64] usb 4-1: Manufacturer: syz [ 33.764688][ T64] usb 4-1: SerialNumber: syz [ 33.972914][ T64] usb 4-1: selecting invalid altsetting 1 [ 33.979142][ T64] usb 4-1: unit 7 not found! [ 33.985558][ T64] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 33.996231][ T64] usb 4-1: selecting invalid altsetting 1 [ 34.002228][ T36] kauditd_printk_skb: 75 callbacks suppressed [ 34.002243][ T36] audit: type=1400 audit(1778999007.270:149): avc: denied { append } for pid=398 comm="syz.1.25" name="loop3" dev="devtmpfs" ino=52 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 34.027413][ T401] SELinux: policydb magic number 0x0 does not match expected magic number 0xf97cff8c [ 34.033879][ T64] usb 4-1: unit 7 not found! [ 34.043731][ T401] SELinux: failed to load policy [ 34.048430][ T36] audit: type=1400 audit(1778999007.300:150): avc: denied { load_policy } for pid=400 comm="syz.1.26" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 34.053573][ T31] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 34.073911][ T64] snd-usb-audio 4-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 34.085315][ T401] ------------[ cut here ]------------ [ 34.090754][ T64] usb 4-1: selecting invalid altsetting 1 [ 34.095698][ T401] WARNING: CPU: 1 PID: 401 at mm/page_alloc.c:5285 __alloc_pages_noprof+0x109/0x7e0 [ 34.102049][ T64] usb 4-1: unit 7 not found! [ 34.111199][ T401] Modules linked in: [ 34.111220][ T401] CPU: 1 UID: 0 PID: 401 Comm: syz.1.26 Not tainted syzkaller #0 d58365df94cd5f4886b4f3ec3f08a458f2157066 [ 34.111252][ T401] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 34.111266][ T401] RIP: 0010:__alloc_pages_noprof+0x109/0x7e0 [ 34.119449][ T64] snd-usb-audio 4-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 34.119844][ T401] Code: 00 0f 1f 44 00 00 83 fb 0b 72 28 b8 00 20 00 00 23 44 24 40 75 1d 80 3d 52 2c 0c 06 00 0f 85 c2 00 00 00 c6 05 45 2c 0c 06 01 <0f> 0b 31 c0 e9 b4 00 00 00 83 fb 0a 0f 87 a9 00 00 00 44 8b 64 24 [ 34.135082][ T64] usb 4-1: USB disconnect, device number 3 [ 34.142150][ T401] RSP: 0018:ffffc9000d877560 EFLAGS: 00010246 [ 34.190827][ T311] udevd[311]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.2/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 34.191154][ T401] RAX: 0000000000000000 RBX: 0000000000000016 RCX: 0000000000000000 [ 34.214915][ T401] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000d877618 [ 34.223044][ T401] RBP: ffffc9000d8776a0 R08: ffffc9000d877617 R09: 0000000000000000 [ 34.231174][ T401] R10: ffffc9000d877600 R11: fffff52001b0eec3 R12: ffffc9000d8775a0 [ 34.239159][ T401] R13: dffffc0000000000 R14: 1ffff92001b0eeb0 R15: 0000000000000000 [ 34.247252][ T401] FS: 00007f28ab41e6c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 34.256511][ T401] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 34.263216][ T401] CR2: 0000200000019000 CR3: 0000000114c88000 CR4: 00000000003526b0 [ 34.271326][ T401] Call Trace: [ 34.274611][ T401] [ 34.277542][ T401] ? vfs_write+0x3c8/0xf90 [ 34.281986][ T401] ? ksys_write+0x145/0x260 [ 34.286609][ T401] ? x64_sys_call+0x271c/0x2ee0 [ 34.291531][ T401] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 34.297321][ T401] ? hashtab_init+0xdb/0x1f0 [ 34.301977][ T401] ___kmalloc_large_node+0x81/0x210 [ 34.307296][ T401] ? hashtab_init+0xdb/0x1f0 [ 34.312012][ T401] __kmalloc_large_node_noprof+0x1e/0xd0 [ 34.317776][ T401] ? hashtab_init+0xdb/0x1f0 [ 34.322610][ T401] __kmalloc_noprof+0x326/0x500 [ 34.327481][ T401] ? kasan_save_alloc_info+0x40/0x50 [ 34.332805][ T401] hashtab_init+0xdb/0x1f0 [ 34.337342][ T401] ? common_read+0x175/0x490 [ 34.342131][ T401] symtab_init+0x44/0x70 [ 34.346516][ T401] common_read+0x1e6/0x490 [ 34.351109][ T401] ? hashtab_init+0xdb/0x1f0 [ 34.355741][ T401] ? __cfi_common_read+0x10/0x10 [ 34.360878][ T401] ? hashtab_init+0x105/0x1f0 [ 34.365695][ T401] policydb_read+0xabb/0x28b0 [ 34.370400][ T401] ? __kasan_kmalloc+0x96/0xb0 [ 34.375485][ T401] ? __cfi_policydb_read+0x10/0x10 [ 34.380807][ T401] ? security_load_policy+0x130/0x12d0 [ 34.386405][ T401] security_load_policy+0x16a/0x12d0 [ 34.391831][ T401] ? irqentry_exit+0x4a/0x60 [ 34.396436][ T401] ? asm_exc_page_fault+0x2b/0x30 [ 34.401493][ T401] ? __cfi_security_load_policy+0x10/0x10 [ 34.407331][ T401] ? rep_movs_alternative+0x4a/0xa0 [ 34.412591][ T401] sel_write_load+0x2a7/0x5f0 [ 34.417361][ T401] ? __cfi_futex_wake+0x10/0x10 [ 34.422247][ T401] ? __cfi_sel_write_load+0x10/0x10 [ 34.427458][ T401] ? bpf_lsm_file_permission+0xd/0x20 [ 34.432863][ T401] ? __cfi_sel_write_load+0x10/0x10 [ 34.438076][ T401] vfs_write+0x3c8/0xf90 [ 34.442353][ T401] ? __cfi_vfs_write+0x10/0x10 [ 34.447137][ T401] ? __kasan_check_write+0x18/0x20 [ 34.452294][ T401] ? mutex_lock+0x97/0x1d0 [ 34.456829][ T401] ? __cfi_mutex_lock+0x10/0x10 [ 34.461730][ T401] ? __fget_files+0x2c5/0x340 [ 34.466545][ T401] ksys_write+0x145/0x260 [ 34.470908][ T401] ? xfd_validate_state+0x68/0x140 [ 34.476176][ T401] ? __cfi_ksys_write+0x10/0x10 [ 34.481464][ T401] ? __kasan_check_write+0x18/0x20 [ 34.486661][ T401] ? fpregs_restore_userregs+0x11c/0x260 [ 34.492713][ T401] __x64_sys_write+0x7f/0x90 [ 34.497385][ T401] x64_sys_call+0x271c/0x2ee0 [ 34.502194][ T401] do_syscall_64+0x57/0xf0 [ 34.506840][ T401] ? clear_bhb_loop+0x50/0xa0 [ 34.511735][ T401] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 34.517661][ T401] RIP: 0033:0x7f28aa59ce59 [ 34.522244][ T401] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.541940][ T401] RSP: 002b:00007f28ab41e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 34.550566][ T401] RAX: ffffffffffffffda RBX: 00007f28aa815fa0 RCX: 00007f28aa59ce59 [ 34.558612][ T401] RDX: 00000000000190ec RSI: 0000200000000000 RDI: 0000000000000003 [ 34.566750][ T401] RBP: 00007f28aa632d6f R08: 0000000000000000 R09: 0000000000000000 [ 34.575002][ T401] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 34.583228][ T401] R13: 00007f28aa816038 R14: 00007f28aa815fa0 R15: 00007ffef9806d48 [ 34.591555][ T401] [ 34.594702][ T401] ---[ end trace 0000000000000000 ]--- [ 34.600544][ T401] SELinux: failed to load policy [ 34.761186][ T31] usb 1-1: Using ep0 maxpacket: 32 [ 34.767527][ T31] usb 1-1: config 0 interface 0 altsetting 128 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 34.780690][ T31] usb 1-1: config 0 interface 0 has no altsetting 0 [ 34.787345][ T31] usb 1-1: New USB device found, idVendor=07c0, idProduct=1125, bcdDevice= 0.00 [ 34.796455][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.805461][ T31] usb 1-1: config 0 descriptor?? [ 35.014721][ T36] audit: type=1400 audit(1778999008.290:151): avc: denied { mounton } for pid=393 comm="syz.0.23" path="/6/file0" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 35.014813][ T394] overlayfs: failed to resolve '/ $': -2 [ 35.049122][ T31] usbhid 1-1:0.0: can't add hid device: -71 [ 35.055671][ T31] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 35.065159][ T31] usb 1-1: USB disconnect, device number 4