last executing test programs: 2.537463594s ago: executing program 0 (id=71): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1f4) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='tracefs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@xino_on}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@xino_on}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) lstat(&(0x7f0000000100)='./mnt\x00', &(0x7f00000001c0)) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x33, &(0x7f0000000100)=0x9, 0x4) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x3f, &(0x7f00000001c0)=0x9, 0x1) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x300000a, 0x12, r0, 0x852ac000) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000000)=0x397, 0x4) recvmmsg(r0, &(0x7f0000000140)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000fc0)=""/4110, 0x100e}, 0x7ffffffe}], 0x1, 0x40002000, 0x0) unshare(0x62040200) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000003c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r1, &(0x7f00000021c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(r1, &(0x7f0000006380)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000810a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea2105600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000efff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b60000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ca8e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000364800000000000000000000000000000000000000000000000000000000004000", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20, 0x0, 0x7fb, {0x0, 0x7f69ff17f1e1ab77}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setresgid(r3, 0x0, r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) write$FUSE_INIT(r4, &(0x7f0000000400)={0x50, 0xfffffffffffffffe, r2, {0x7, 0x2d, 0xf5d, 0x4000000, 0x0, 0xe, 0xb956, 0xd171, 0x0, 0x0, 0x10, 0x7}}, 0x50) socket$inet_tcp(0x2, 0x1, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00') renameat2(r5, &(0x7f00000006c0)='./cgroup\x00', r5, &(0x7f00000003c0)='./mnt\x00', 0x0) getrlimit(0x1d, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$KVM_IRQFD(r7, 0x4020ae76, &(0x7f0000000040)={0xffffffffffffffff, 0x8001}) 2.398976821s ago: executing program 3 (id=73): r0 = socket(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f00000000c0)={&(0x7f0000000040)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000080)}, 0x80) write(r0, &(0x7f0000000280)="240000005f80004000000000000002000000010000000000080008000100000303ffd2b67377027c066bed5b08b704138523cc2eae12ac1fa349b2abf9f2d25b09aea7750105c7a12754a1f34c97cab974d0ad59894a61c5d9406cb82fe9b7cc939102ea30eaa20f4b58f2f5491a4b8fd7bd218c03dbb7379e1b4804d84f673b3b7d1a39f1754f2fb5746f7a1d70af4d74bf91fd7706f5c172cd4ac645352b31fd0c726b47f270775ddad2f0ac2973b067662c3551dab139bd284807beb755662ba738b1543a7d3982030bc1263472273738f5400d481b05a832d39138681fe7b578abe63877e456eaa6b6fcc82eea3f6ce78cdbb189b9e11f5a8a27f33ec1111b40618009d01c037a51640dc35cc719d0b0cd836654e4ae1ea7e6bcf0001ef7404863e67467ed1876ba", 0x12a) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) r4 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r4, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) write$tun(r1, &(0x7f0000000240)={@val={0x0, 0x6005}, @void, @eth={@multicast, @remote, @val={@val={0x88a8, 0x2, 0x0, 0x1}, {0x88a8, 0x0, 0x0, 0xfff}}, {@ipv4={0x800, @generic={{0x5, 0x4, 0x1, 0x22, 0x14, 0x68, 0x0, 0x9, 0x11, 0x0, @broadcast, @multicast1}}}}}}, 0x2e) r5 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$F2FS_IOC_START_ATOMIC_WRITE(r5, 0xf501, 0x0) sendmsg$AUDIT_ADD_RULE(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f00000003c0)={0x428, 0x3f3, 0x4, 0x70bd2c, 0x25dfdbfb, {0x7, 0x1, 0x3a, [0x10000, 0xc, 0x7fff, 0x76c44ec2, 0xffff, 0x5, 0x81, 0x2, 0x8, 0x8, 0x5, 0x6c, 0x4, 0xff, 0x7f, 0xffffff86, 0x2, 0xfff, 0x6, 0x3, 0x7, 0x4, 0x100, 0x1, 0xe, 0xd, 0x10000, 0xfffffff7, 0x4, 0xe60b2e9c, 0xee5e, 0x8, 0x5, 0x2f8, 0x2, 0x7ff, 0xfffffffe, 0x7fffffff, 0x6b2dd1da, 0x5, 0x95fa, 0x5, 0x108d, 0xc75, 0x2, 0xc, 0xffff, 0x9, 0x9, 0x0, 0x80000001, 0xb04, 0x8, 0x28, 0x2, 0x0, 0x4, 0xffffffff, 0x9, 0x2, 0x6, 0x8, 0x40, 0x1], [0x6, 0x8000, 0xd0f, 0xa2, 0x9, 0x56e1, 0x2, 0x3, 0x7fff, 0x4, 0xfffffff9, 0xe, 0xb, 0x9, 0x9, 0x2, 0x9, 0x4, 0x9, 0x5, 0x4, 0x1, 0x8, 0x9, 0x7, 0x10000, 0xfffffff9, 0x7, 0xe92, 0x7, 0x4382, 0x7, 0x1, 0x9, 0x8, 0x5, 0x2, 0x2000000, 0x3, 0x7, 0x5, 0x2, 0x7708, 0x0, 0x6, 0x2, 0x574, 0x3, 0x4, 0x400, 0x2, 0x4, 0x7ff, 0x2, 0x2, 0x39, 0x8, 0x1, 0x0, 0xfffffffc, 0xfffffeff, 0x3, 0x3], [0x401, 0x4, 0xad, 0x1, 0x0, 0x5, 0x3, 0xe4c7, 0x8, 0x4, 0x101, 0x5, 0x8, 0x40, 0x7d62ec56, 0x2, 0x4, 0x9, 0x2, 0x1, 0x7b, 0xfffffffa, 0x800000, 0x80000001, 0xfffffff8, 0x7fff, 0x0, 0x5, 0xf5b, 0x4, 0x8000, 0x2, 0x1, 0x100, 0x9, 0x0, 0x8, 0xf4, 0x8, 0x2, 0x4, 0x833, 0x8, 0xffff, 0x0, 0x6, 0x636a, 0x364, 0x7, 0x10000, 0x7, 0x1b, 0x1, 0x1, 0x68338df9, 0x1, 0x7, 0x4, 0x7, 0x7, 0xfe89, 0x4, 0x81, 0x2], [0x0, 0xdcc, 0xc0, 0x6, 0x80000000, 0x6, 0x2, 0x3, 0x5, 0x9, 0xfffffffe, 0x60f, 0xffffff3d, 0xa, 0x0, 0x80, 0xff, 0x0, 0xfffffff2, 0xb, 0xf4, 0xffffffff, 0x5, 0xfff, 0x6, 0x101, 0x7, 0x5, 0x9, 0x6, 0xd57, 0x7, 0xcd, 0x0, 0x5ef6, 0x800, 0x1000, 0xfffff0ee, 0x6, 0xca26, 0x6, 0xe, 0xffff, 0x10000, 0x4, 0x6, 0x401, 0x9, 0x5, 0x5, 0x9, 0xd, 0x3, 0x80000001, 0x1ff, 0x5, 0x754, 0x6, 0x8000, 0x6, 0xfffffff8, 0x5, 0xfff, 0xf5b], 0x5, ['\'\xe2\x00', '\x00', '\x00']}, ["", ""]}, 0x428}, 0x1, 0x0, 0x0, 0x800}, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r6, 0x29, 0x4b, &(0x7f0000000100)=0x401, 0x4) bind$inet6(r6, &(0x7f00000010c0)={0xa, 0x4e22, 0x800003, @remote, 0x8}, 0x1c) listen(r6, 0x7) 2.357991633s ago: executing program 0 (id=74): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f000048a000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000080)={0x0, &(0x7f0000000140)=[@rdmsr={0x66, 0x18, {0x40000101}}], 0x18}) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000040)={0x1, 0x0, [{0x40000001, 0x4, 0x0, 0x31237648, 0x8, 0x100002, 0x80}]}) ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(r3, 0x4068aea3, &(0x7f00000000c0)={0xc7, 0x0, 0x1}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = socket(0x2, 0x2, 0x0) sendmsg$inet(r4, &(0x7f0000000200)={&(0x7f0000000180)={0x2, 0x4e23, @rand_addr=0x64010102}, 0x10, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYRES32=r4, @ANYRES16=0x0], 0x18}, 0x0) prctl$PR_CAPBSET_DROP(0x18, 0xfffffffffffffffd) 2.313177516s ago: executing program 3 (id=75): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = memfd_create(&(0x7f00000000c0)='-B\xd5N4\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\x8a\xd7Uw\x00\xbc\xa92\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8b\x066\xb8G\xd1c\xe1$\xff\x97\x8f~\xb90a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x19\xea\xef\xe3\xe1@\x84\x13\xefZb:\x8f\t\x01B\xec\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@Ip]D\xd6\r\xac\v#co\xd5\xb9\xc806\xa8\x99\xffs7\xa1b1\xb1;i)j\x0e\x1e\xedI\xa2\x80\x89\x1d\xd9p!\xc86s\xe07(\xee\xf9<\"\xf0\xc8\xae\x96J\xe2]\x01\x86\xb7.<\xf5N\xd3\x94W1\xff\x18z>\xa7q,\xf7\x96\xb8{\x8e\xbf4\xe0\x95\x1ce\xe4\x85\xcdi\xed\xd3>\xeb\xa5\xaf\x87\x90@\xd1\xbd`^\xfa\xb6\x9cj\x13/\xc5\\W\x04\br\x17X\xe3\xfb\xc8\xd4\xaeX\xc9s\xd18\xd9L\xbf\xa0\xa6\xdf2\a\x99i\xb1/\x19@\x1cq\xeb?\xc1z:\x913\xfa8\xac\xd3q\xe4vPGU', 0x1) r3 = dup(r2) execveat(r3, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) ioctl$sock_SIOCBRDELBR(r1, 0x89a1, &(0x7f0000000100)='batadv0\x00') setsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000080)={0x1, 0xc, 0x5, 0xc, 0x80, 0x8, 0x5}, 0xc) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89fc, &(0x7f0000000000)={'ip6tnl0\x00', 0x0}) syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x2000c040) r4 = socket$netlink(0x10, 0x3, 0xf) preadv(r0, &(0x7f00000007c0)=[{&(0x7f0000000840)=""/5, 0x5}], 0x1, 0x47a, 0x0) r5 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) openat$selinux_policy(0xffffff9c, 0x0, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$selinux_load(r5, &(0x7f0000000000)=ANY=[@ANYBLOB="8cfb7cf92b0000005345204c757855bcc91e208327ff45a77529803a7205d4d1b6f934273f4a559820c63f"], 0x2d) fsync(r0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) 2.22318331s ago: executing program 0 (id=76): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e24, 0x7, @private0, 0x1}, 0x18) 2.22291681s ago: executing program 0 (id=77): timer_create(0x1, &(0x7f0000000200)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x1}) r0 = syz_clone(0x0, 0x0, 0xfffffffffffffead, 0x0, 0x0, 0x0) r1 = syz_pidfd_open(r0, 0x0) fsetxattr$security_evm(r1, &(0x7f0000000000), &(0x7f0000000100)=ANY=[], 0x13, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x2e, &(0x7f0000000180)=0x7b, 0x4) shutdown(r2, 0x0) ioctl$BTRFS_IOC_SCRUB(r1, 0xc400941b, &(0x7f0000000340)={0x0, 0xe7b5, 0x10001}) ioctl$BTRFS_IOC_DEV_INFO(r2, 0xd000941e, &(0x7f0000000740)={r3, "c2f650a747ebce1e55ac89e626a37084"}) recvmmsg(r2, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) socket(0xa, 0x4, 0x80) 2.162562573s ago: executing program 3 (id=78): r0 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x02\x00', &(0x7f00000001c0)={0x8102, 0x8, 0x22}, 0x18) mkdirat(r0, &(0x7f0000000180)='.\x02\x00', 0x92) r1 = landlock_create_ruleset(&(0x7f0000000140)={0x4000}, 0x18, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r2, &(0x7f0000000540)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f00000001c0)=@gcm_256={{0x304}, '\x00', "acba84f0a6731f234db1cc7f3f382ad796bd667cb12ea99509873931d2873103", "0f9dafb4", "ec3fff9afd96e6c0"}, 0x3) mount$9p_unix(0x0, 0x0, &(0x7f00000001c0), 0x281080, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x101}, 0x37, [0xfffffff8, 0x8, 0x5, 0x9, 0x7f, 0x155f, 0x6, 0x4, 0x80000001, 0x1, 0xb4, 0x7fff, 0xa2b9, 0x6, 0x4, 0xe4, 0x6, 0xfc000000, 0x3, 0xbbf, 0x4a732f64, 0x1, 0x8, 0xd, 0x4, 0x12a3, 0x6, 0x1, 0x2, 0x6, 0x3, 0x81, 0x8a, 0x7c, 0x2, 0x10000, 0x0, 0x91, 0x4, 0x4, 0x16, 0x2, 0x5, 0x401, 0xfffffff5, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x80, 0x4, 0x2, 0x2, 0x7, 0x5, 0x5, 0x4, 0x4007f, 0xffffffff, 0x9, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0xc66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x7, 0x7, 0x2, 0x809, 0x4, 0xa7, 0x1000, 0x7596, 0x200b398, 0x400001, 0x0, 0x4, 0x19, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x400, 0x6, 0x4c2b36d3, 0x4, 0x0, 0xfffffff8, 0x401, 0x46, 0x8f1, 0x4, 0xab00060, 0x3, 0x6, 0x2, 0x5, 0x3ff, 0x1ff, 0x1, 0x8000, 0x1, 0x1cb, 0x1, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x95, 0x7fffffff, 0x4, 0xfffffff9, 0x1, 0x1000, 0xfffff801, 0x5], [0x2, 0xfffffffe, 0xffff, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x48d, 0x8d3, 0x200006, 0x7, 0x500, 0x2, 0x400, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x8000003, 0x1, 0x9, 0x3, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x8000, 0x400, 0x3655, 0x5, 0xd3, 0x8, 0x3437, 0x3, 0xd, 0x7, 0x601, 0x101, 0xdd80, 0x60a0, 0x7f, 0x6, 0x10001, 0x1, 0x2, 0x2, 0x6, 0x8000, 0xf45, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x8, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbfc, 0x8, 0xfffffffb, 0x7f, 0x55, 0x40, 0xff, 0x1005, 0x1, 0x7, 0x1e, 0x9, 0x81, 0x3, 0x9d86, 0xd, 0xfffffff7, 0x80000008, 0x140f2, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x0, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x9, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x40000, 0x8004, 0x7fff, 0x9, 0x6, 0xf, 0xe, 0x5337, 0x26d, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x8003, 0x8, 0x14000, 0x1, 0x7]}, 0x45c) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0x0, 0x40000000000180, 0x2, 0x80000000, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x0, 0x5, 0x4, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) r7 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r8 = dup(r7) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x41000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r7, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) r10 = syz_open_procfs(0x0, &(0x7f0000000040)='stat\x00') preadv(r10, &(0x7f0000000340)=[{&(0x7f0000000180)=""/109, 0x6d}], 0x1, 0x0, 0x0) landlock_restrict_self(r1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000640)='.\x00', 0x0, 0x0) fcntl$getown(r1, 0x9) 2.083392497s ago: executing program 1 (id=79): pwritev(0xffffffffffffffff, 0x0, 0x0, 0xfffffffffffffffc, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x20802, 0x0) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000e40)='\b', 0x17ff}], 0x5) 1.984631262s ago: executing program 0 (id=80): r0 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt(r0, 0x28, 0x2, &(0x7f0000000040)=""/59, &(0x7f0000000180)=0x65) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000240)={0x24, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000300)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB=' ', @ANYRESHEX=0x0, @ANYRESOCT=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000001200)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000040)={0x20, 0x0, 0x4, {0x1}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000840)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="000e04000000e2"], 0x0, 0x0, 0x0, 0x0}) 1.871093127s ago: executing program 3 (id=81): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040), 0x4ee97ffd, 0x8e00) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x121400, 0x0) ioctl$KDSKBENT(r2, 0x4b47, 0x0) ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f0000000080)={0x11, 0x0, 0x0}) ioctl$EVIOCGMASK(r1, 0x80104592, &(0x7f00000000c0)={0x11, 0x2e, 0x0}) getsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000000000)={@local, @multicast1}, &(0x7f0000000040)=0xc) recvfrom(r0, 0x0, 0x0, 0x2023, 0x0, 0x0) 1.584660712s ago: executing program 1 (id=82): capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x5381}) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x1, 0x1, 0xfffc, 0x8003}, 0x1e) 1.505550355s ago: executing program 3 (id=83): r0 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e21, @broadcast}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000140)=0x2, 0x4) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) keyctl$set_reqkey_keyring(0xe, 0x2) request_key(&(0x7f0000000040)='asymmetric\x00', &(0x7f0000000080)={'syz', 0x1}, &(0x7f00000000c0)='.^$\'#{@\\\x00', 0x0) sendto$inet(r1, &(0x7f0000000000), 0xffffffffffffff94, 0x201, 0x0, 0x0) brk(0x55555ede6001) shutdown(r1, 0x1) ppoll(&(0x7f0000000540)=[{r1, 0x200}], 0x1, 0x0, 0x0, 0x0) recvfrom$inet(r1, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/binder-control\x00', 0x2, 0x0) ioctl$BINDER_CTL_ADD(r2, 0xc1086201, 0x0) timer_create(0xfffffffc, 0x0, &(0x7f0000000040)=0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xa, 0x31, 0xffffffffffffffff, 0x0) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x380}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000040)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00001b1000/0x4000)=nil, 0x400000, 0x2, 0x2}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) timer_settime(r3, 0x1, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) write(r5, &(0x7f0000000600)="fc0000001a000700ab092500090007000aab0700a90100001d60369321000100ff0500000005d0000000edff00039815fa2c1ec28656aaa7a70a4b46fe000000bc0003000500000014000027000089fee1434f1e596534d07302ade0bbc91a3e3280772c05defd5a32e280fc83ab82f605f70c9ddef2fe082038f4f8b29d3ef3d92c83170e5bba4a46d284a710af333ae4f5566f91cf190201800015b2ccd243f295ed94e0ad91bd0734babc7c3f2eeb00d43dd16b17e583df150c3b880f411f46a6b567b4d5715587e658a1ad0a4f01731d6f0f350b0041f0d48a99c03f080548deac270e33429fd3000175e63fb8d38a8700"/252, 0xfc) syz_usb_connect(0x3, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000229639010861a2d754d2d0102030109021b0001000000000904010001e90cbd00090503", @ANYRES16], 0x0) timer_gettime(r3, &(0x7f0000000100)) ioctl$FIONREAD(r0, 0x541b, 0x0) ioctl$BTRFS_IOC_BALANCE_CTL(r4, 0x40049421, 0x0) socket$netlink(0x10, 0x3, 0x7) 1.505375835s ago: executing program 1 (id=84): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) r1 = openat$kvm(0x0, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r2, 0x4010ae67, &(0x7f00000000c0)={0xffff1000, 0xed842453d8e147ca}) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r2, 0x4010ae68, &(0x7f0000000040)) clock_adjtime(0x0, &(0x7f0000000680)={0x4000019b1, 0x0, 0x0, 0xe1, 0x0, 0x9, 0xffffffffbfffffff, 0x0, 0xfffffffffffffff9, 0x10000e5, 0x0, 0x200, 0x400000, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0xfde, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x6, 0x253}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @multicast}) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCINQ(r5, 0x541b, &(0x7f0000000040)) write$tun(r0, &(0x7f0000000100)={@void, @void, @eth={@multicast, @random, @val={@void}, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x2, 0x7, 0x38, 0x65, 0x0, 0x7, 0x1, 0x0, @empty=0x1c, @local}, @time_exceeded={0xb, 0x0, 0x0, 0x0, 0x1, 0x0, {0x5, 0x4, 0x2, 0x0, 0xd, 0x7, 0xbd, 0x31, 0x11, 0x4, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}}, "2822f329564ebcce"}}}}}}, 0x4a) setresgid(0xee00, 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x400, 0x103) mkdir(&(0x7f00000000c0)='./file1\x00', 0x107) syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001180), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="275fa3bc559224588cb2a6e46451291c52c12d618170a5ad14e45b96686b778c769ba00226c9bfae17499202775bb77ef83e366ea2e37fe3b2be4e7e1405aecb9f0d1c33804d921ed561125af37659d2674903279b06fab1f03fafd0646c6bc7834f9c375ff6cb1add7c70137ddfe265aa3eaaf3a91b7bfd9754707b86ad03d3a44b2b1961b3d41ebaaadd932af839db418cbe466dfb6d1aff7c08599ea08a6a9db944d11f6ab8bff3ee649ab3c4058f87c96a", @ANYRESHEX=r6, @ANYBLOB="2c726f6f746d6f64653d30303030303030303030303030303030303130301b30302c757365725f69643d", @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f696475f92ba296585198bd283d81e8e3e21bb233c9dcc1a33c502f221cd1efa581237e58cb4613", @ANYRES64=r6, @ANYBLOB=',\x00']) r7 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x80001) madvise(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x64) fstat(r7, 0x0) 1.288139276s ago: executing program 1 (id=85): mount$binderfs(&(0x7f00000000c0), &(0x7f0000000100)='./binderfs\x00', 0x0, 0x105840, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = landlock_create_ruleset(&(0x7f0000000140)={0x4000}, 0x18, 0x0) landlock_restrict_self(r0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000640)='.\x00', 0x0, 0x0) renameat2(r1, &(0x7f00000001c0)='./file0\x00', r1, &(0x7f0000000200)='.\x02\x00', 0x4) renameat2(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', r1, &(0x7f00000000c0)='.\x02\x00', 0x2) 1.260661928s ago: executing program 1 (id=86): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="8fbf2bbd7000fcdbdf25160000001c0001d0460001106574683a76658f68315f746f84d86174610f7a5d"], 0x30}, 0x1, 0x0, 0x0, 0x20000800}, 0x0) r1 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000004000010da090a00000000000001090224000100008000090400000903000096178b640000012229000905810300000000e9"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = memfd_create(&(0x7f00000001c0)='\xa3\x9fn\xb4dR\x04i5\x02\xac\xce\xe1\x88\x9d[@8\xd7\xce\x1f 9I\x7f\x15\x1d\x93=\xb5\xe7\\\'L\xe6\xd2\x8e\xbc)JtTDq\x81\xcf\x81\xba\xe51\xf5 \xc8\x10>\xc9\\\x85\x17L\xbf\xcf\x91\xdfM\xf3\x02^T*\x00\x02\xb9~B\x9f\xacl\x1d3\x06o\xf8\x16H\xaa*\x02\xf7\xfb\x06\xf1\x83\x92\xa8\xc2\xcb\xae\xb0\xb4\x93\xb8\x04\xf1\x99\xc2yY+\xd9y\x8a\xd5b\xe8\"q\x1b0\xbc]\x12\xc0D\x9f\x80\x8f\xfe\xf2\xc2)\xccm\xacz\xc1\xad\xe4\x9b6a\xf3\xdds\xbb\x88\xff\b\x85\xb3s\x00\x0e\xbcfvi\x85\xfc.|\xd4h\xec\x82o\x8e\x93\x11\xc1\xd4\xae\x05\x17=\xd9R\xd0\xd4\x90\xcf\x9b\xdc\xaeV\x88\x94\x9f\xe3\xefqi\xed\xa8w\xbe\xd0\xd0-tBl\x9e+\xd3\xed\xce\x9f\x83\x86\xf9\x12\x16Ts\x80\x13]C\xfb`\xc2`\xf7\x1a\x00\x00\x00\x00\x00\x00\x00k\xae\xcb\x1a.\xc2\x8f\xd1x4]PZ\x9e\xd5Y\xf0L\xa4\xbc\x84\xf6\x04L\xff0\x8b\\*\xf9,\xb6\r\x97\xedy\xe0\x8a\xe2\x8ck\xc6S\xc3g\xb9\x1a\xf8\x8f \x9d\x00u7\xd8\'\xf1E\xa4(Q\x80Fy\xb5\xe4q\xc9\xff \xd8\x9d\xad\x11\xf8m\xd3\xbc\x9e\x10D\x7f!\xca\x0ev\x15h$\x01\xdd\xe5\xce\xf8*\xb3\x01\x85\a\xe4qv&\x9c\xac\x9aN~o\xe5\x89\xd5\a\x9f\f\x1f\xc2e/\x8d\x1e\n\xd0_\xbd!^\xa46\xb8j\xc0x\n\xdb\xe1\xa3\xd6\xae;\r\x92@\xa5I\x88Z1F\xf0\x1at\t\xd0\x8a\x04m\x06\xf3BL\xffS\x9eY\xf4\xb0U \xf8\xd00\x88y\xebX\x92\xd5\xbb\xa1h7\xf3\xe0\x0f\xbd\x02\xe4%\xf9\xb1\x87\x8aM\xfeG\xb2L\xbd\x92-\xcd\x1f\xf4\xe1,\xb7G|\xec\"\xa2\xab\xf6\x84\xe0\xcf1\x9a', 0x0) ioctl$KVM_SET_CPUID(0xffffffffffffffff, 0x4008ae8a, &(0x7f0000000180)={0x2, 0x0, [{0x7, 0x3e16, 0x4, 0x2, 0x81}, {0xc0000001, 0x2, 0x6, 0x4, 0x7ff}]}) write$binfmt_elf32(r3, &(0x7f0000000140)=ANY=[@ANYBLOB="7f454c466000002ed8e4f97765ce27b90300060000000000000000b738000000000035f4c38422a3bc8220000500000004020300b300000000002a002400b3d7c52ebf31a8d5c8c3c6cb00000009e500d5ffffff05ffffff03"], 0xd8) execveat(r3, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) ptrace(0x10, r2) mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x180) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x8, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) r4 = openat2$dir(0xffffff9c, &(0x7f00000000c0)='./file0/file1\x00', &(0x7f0000000140)={0x40, 0x110, 0x2}, 0x18) ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, 0x0) ptrace$setsig(0x4203, r2, 0x82, &(0x7f00000000c0)={0x1f, 0x400, 0x2000007}) sched_getscheduler(0x0) r5 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000), 0x80402, 0x0) pwritev(r5, &(0x7f00000004c0)=[{&(0x7f0000000100)="1b2847d0", 0x4}, {0x0}], 0x2, 0x9c, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f00000005c0), 0x2010800, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8c) r7 = openat$incfs(r6, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) poll(&(0x7f0000000100)=[{r7, 0x9123}], 0x1, 0x7) r8 = fcntl$getown(0xffffffffffffffff, 0x9) r9 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz0\x00', 0x200002, 0x0) syz_clone3(&(0x7f00000002c0)={0x2020000, &(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080), {0x8}, &(0x7f00000000c0)=""/255, 0xff, &(0x7f00000003c0)=""/142, &(0x7f0000000240)=[r2, r8, 0x0, 0xffffffffffffffff], 0x4, {r9}}, 0x58) close(0xffffffffffffffff) 1.165832362s ago: executing program 2 (id=89): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, 0xffffffffffffffff, 0x4000000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mlock2(&(0x7f0000247000/0x1000)=nil, 0x1000, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x19) r0 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x3) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d03, 0x0, 0x1}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = fsmount(r0, 0x0, 0x0) r5 = openat$cgroup(r4, &(0x7f0000000040)='syz0\x00', 0x200002, 0x0) r6 = openat$cgroup_int(r5, &(0x7f00000001c0)='pids.max\x00', 0x2, 0x0) write$cgroup_int(r6, &(0x7f0000000000)=0x1000000000001, 0x12) 853.969938ms ago: executing program 2 (id=90): r0 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') execveat$binfmt(0xffffffffffffff9c, r0, &(0x7f0000000080), &(0x7f00000000c0), 0x0) r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff) close(r1) execveat$binfmt(0xffffffffffffff9c, r0, &(0x7f0000000100), &(0x7f0000000140), 0x0) r2 = openat$binfmt(0xffffffffffffff9c, r0, 0x2, 0x0) write(r2, &(0x7f0000000180)="01010101", 0x4) close(r2) execveat$binfmt(0xffffffffffffff9c, r0, &(0x7f00000001c0)={[], 0x80100}, &(0x7f0000000200), 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x0) close(r3) execveat$binfmt(0xffffffffffffff9c, r0, &(0x7f0000000280), &(0x7f00000002c0), 0x0) fchmodat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x1ff) execveat$binfmt(0xffffffffffffff9c, r0, &(0x7f0000000340), &(0x7f0000000380), 0x0) 751.950093ms ago: executing program 2 (id=91): r0 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r0, &(0x7f0000000380)={&(0x7f0000000280)=@id={0x1e, 0x3, 0x3, {0x4e21, 0x18000000}}, 0x10, &(0x7f0000000340)=[{&(0x7f0000000580)="bfa5309bfa49", 0x6}], 0x1, 0x0, 0x0, 0x4c000}, 0x20008048) 751.716603ms ago: executing program 2 (id=92): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x42902, 0x0) ioctl$BLKROTATIONAL(r0, 0x127e, &(0x7f0000000380)) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000240)=ANY=[@ANYBLOB="30400000e7ddc2ccfd96e74c3d599d7a186acc7eeee6c6ac7b5416f455307d6bebb249b24754f698cae25704e28d9f0f6d64b61c68d81f0abb23c36e492ffba63c23abd7bea46d5774d4fccae3e9730279a0a970c6e572b576b9e431e76c69a58af6dd59cea567e0e1d9e83a6dc17ec6ebe04e0467a9d55fdedd43959fc29a995e3e07303b41185997528954225c6a58bea8145ca0564230619d346d97ba9d9cac6d7c00dfeb07c33de2c0a10be584e3ec2f8b50471d2a4422c69679574279c86521d297f66b2123c1282b3b0a5435117d4329c4f17d7c", @ANYRES16=r1, @ANYBLOB="010000000000fcdbdf250100000000000000014100000014001700000017000000006574683a6c6f0000"], 0x30}, 0x1, 0x0, 0x0, 0x20084}, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000000), 0xbe, 0x982) ioctl$USBDEVFS_BULK(r2, 0xc0185502, &(0x7f0000000040)={{{0xa, 0x1}}, 0xeb, 0x7ffd, &(0x7f0000000100)="b9d5f031e8c67b945abc79c4e0fabe346d8cbff38cdf3747921a7d2d5da4cbdc0790a996ceffd49d57518c772d0d5fb8d55395123b5e15861e503695a2f32d3a9e981a0027a2815eea9a0c299b1f61b3b1b25f2d7753267c4ee875d89f636438d1133d85625c1b8cbf133a099c9d80cbfe0f79df5c3d450d155bb59f5b6fbc6cdbc08db76a55d61fd0cbd4c661ca3dba7e092ec2bfcdad538177f3917868f7027c317f78a1b64d4eff1454515b5ee40d46b37a7a112d7e0ef9283a77b2cc0dacdc3e81f1e0b3d71df8ed9c2799d5e191bd3e5beac046c1b333e4dee75688798ba62258f87bb91c3d4b931a"}) pipe2(0x0, 0xc0000) prlimit64(0x0, 0xb, &(0x7f0000000180)={0x0, 0xfffffffffffffffd}, 0x0) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8) r3 = gettid() tkill(r3, 0x12) tkill(r3, 0x14) io_setup(0xb, &(0x7f0000000080)=0x0) io_submit(r4, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe7030003, 0x8, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0xfffffffffffffda4, 0x3, 0x0, 0x2}]) 679.859736ms ago: executing program 2 (id=93): ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) capset(&(0x7f0000000040)={0x19980330, r0}, &(0x7f0000000080)={0x4, 0x0, 0x0, 0x0, 0x0, 0x5381}) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x1, 0x1, 0xfffc, 0x8003}, 0x20) 640.738908ms ago: executing program 2 (id=94): r0 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000780)={0x0, 0x0}) ppoll(&(0x7f0000000040)=[{r0, 0x440c}], 0x1, &(0x7f00000000c0)={r1, r2+60000000}, &(0x7f0000000140)={[0x74e]}, 0x8) r3 = socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff002, 0x0, 0x2000000000032, 0xffffffffffffffff, 0x0) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f0000000180)=0xfffffffffffffffb) getsockopt$bt_BT_DEFER_SETUP(r4, 0x112, 0x7, 0x0, 0x0) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), 0xffffffffffffffff) r6 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r6, &(0x7f0000000240)={&(0x7f00000002c0)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @dev}}, 0x80, &(0x7f0000000680)=[{&(0x7f0000000380)=""/78, 0x4e}, {&(0x7f0000000400)=""/132, 0x84}, {&(0x7f00000004c0)=""/108, 0x6c}, {&(0x7f0000000540)=""/169, 0xa9}, {&(0x7f0000000600)=""/78, 0x4e}, {&(0x7f00000001c0)=""/44, 0x2c}], 0x6, &(0x7f0000000700)=""/77, 0x4d}, 0x2122) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000340)={'bridge0\x00', 0x0}) sendmsg$ETHTOOL_MSG_TSINFO_GET(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01003dbd70000000000000000c000180080001000000", @ANYRES32=r7], 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x0) 77.451686ms ago: executing program 0 (id=95): madvise(&(0x7f00003d3000/0x3000)=nil, 0x3000, 0xe) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/icmp6\x00') fstat(r0, &(0x7f0000000d40)) mlock2(&(0x7f0000381000/0x4000)=nil, 0x4000, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$MPTCP_PM_CMD_GET_ADDR(r1, &(0x7f0000000c00)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x80000}, 0x4, &(0x7f0000000bc0)={&(0x7f0000000880)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16, @ANYBLOB="000125bd7000fbdbdf250300000008000300000000002400068008000300ac1414bb08000600120000000500020081000000060005004e230000050005000700e2ff07000300f09300000500050006000000040001803e4a1b271ba738699e98581045fcc1e532561705f4eaf00b58091270a016aa094fd9823a358b082ff9047785b755226a97833c0f267bc5e9b8232125357f5376e06a66fa5a23c3d9249f50671d6eed1adac1d83d9369d073de90001f08550f278fcd21c1bebd0231549ae6db80444c32601603107df3bf47a0a7f9db0ad7a142d62966d4e891c85861ae715782", @ANYRES64=0x0], 0x5c}, 0x1, 0x0, 0x0, 0x4000091}, 0x4004084) getsockopt$ARPT_SO_GET_INFO(r1, 0x0, 0x60, &(0x7f0000000100)={'filter\x00', 0x0, [0x800, 0x6, 0x400]}, &(0x7f0000000080)=0x44) r2 = memfd_secret(0x0) r3 = epoll_create(0x3) ioctl$BTRFS_IOC_QGROUP_CREATE(r3, 0x4010942a, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2, 0x13, r2, 0x8000000) mmap$KVM_VCPU(&(0x7f0000ffc000/0x4000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mremap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f0000000000/0x2000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2000002, 0x13, r2, 0x8000000) openat$kvm(0xffffffffffffff9c, 0x0, 0x241, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) recvfrom(r4, 0x0, 0x0, 0x0, 0x0, 0x0) 69.805116ms ago: executing program 3 (id=96): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="440000001600010000000000000000000a0000000000000014000100f90100000000000000000000d800000117000280"], 0x44}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, 0x0, 0x5, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0xffffffff, 0x13}}}}, [@NL80211_ATTR_SCAN_FREQUENCIES={0x4}]}, 0x24}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_IRQ_LINE_STATUS(r2, 0xc008ae67, &(0x7f0000000100)={0x4de5}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = userfaultfd(0x80801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x100}) ioctl$UFFDIO_ZEROPAGE(r3, 0xc020aa08, 0x0) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f0000000040)={0x0, 0x302000, 0x1000, 0xe9, 0x7}, 0x20) 0s ago: executing program 1 (id=97): capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x5381}) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x1, 0x1, 0xfffc, 0x8003}, 0x21) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.101' (ED25519) to the list of known hosts. [ 25.715982][ T36] audit: type=1400 audit(1774072304.530:64): avc: denied { mounton } for pid=283 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.719799][ T283] cgroup: Unknown subsys name 'net' [ 25.738886][ T36] audit: type=1400 audit(1774072304.530:65): avc: denied { mount } for pid=283 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.766571][ T36] audit: type=1400 audit(1774072304.560:66): avc: denied { unmount } for pid=283 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.767030][ T283] cgroup: Unknown subsys name 'devices' [ 25.972227][ T283] cgroup: Unknown subsys name 'hugetlb' [ 25.977879][ T283] cgroup: Unknown subsys name 'rlimit' [ 26.133456][ T36] audit: type=1400 audit(1774072304.950:67): avc: denied { setattr } for pid=283 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 26.156871][ T36] audit: type=1400 audit(1774072304.950:68): avc: denied { mounton } for pid=283 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 26.181866][ T36] audit: type=1400 audit(1774072304.950:69): avc: denied { mount } for pid=283 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 26.207216][ T285] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 26.216218][ T36] audit: type=1400 audit(1774072305.030:70): avc: denied { relabelto } for pid=285 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 26.241868][ T36] audit: type=1400 audit(1774072305.030:71): avc: denied { write } for pid=285 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 26.343357][ T36] audit: type=1400 audit(1774072305.160:72): avc: denied { read } for pid=283 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 26.369209][ T36] audit: type=1400 audit(1774072305.160:73): avc: denied { open } for pid=283 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 26.371658][ T283] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 27.234020][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.241179][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.248435][ T290] bridge_slave_0: entered allmulticast mode [ 27.255489][ T290] bridge_slave_0: entered promiscuous mode [ 27.263479][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.270661][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.277867][ T290] bridge_slave_1: entered allmulticast mode [ 27.284517][ T290] bridge_slave_1: entered promiscuous mode [ 27.333899][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.341049][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.348462][ T291] bridge_slave_0: entered allmulticast mode [ 27.354881][ T291] bridge_slave_0: entered promiscuous mode [ 27.364535][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.371768][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.378943][ T291] bridge_slave_1: entered allmulticast mode [ 27.385368][ T291] bridge_slave_1: entered promiscuous mode [ 27.466983][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.474177][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.481493][ T293] bridge_slave_0: entered allmulticast mode [ 27.487835][ T293] bridge_slave_0: entered promiscuous mode [ 27.497620][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.504819][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.512026][ T293] bridge_slave_1: entered allmulticast mode [ 27.518349][ T293] bridge_slave_1: entered promiscuous mode [ 27.561455][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.568760][ T292] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.575937][ T292] bridge_slave_0: entered allmulticast mode [ 27.582443][ T292] bridge_slave_0: entered promiscuous mode [ 27.589030][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.596158][ T292] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.603350][ T292] bridge_slave_1: entered allmulticast mode [ 27.609976][ T292] bridge_slave_1: entered promiscuous mode [ 27.668445][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.675683][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.683509][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.690782][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.730830][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.738104][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.745461][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.752581][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.820638][ T44] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.828400][ T44] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.836292][ T44] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.844020][ T44] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.861313][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.868424][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.893754][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.900881][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.909114][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.916334][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.924863][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.931965][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.977665][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.984886][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.003054][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.010157][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.017913][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.025214][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.034569][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.041683][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.060019][ T291] veth0_vlan: entered promiscuous mode [ 28.074434][ T290] veth0_vlan: entered promiscuous mode [ 28.085533][ T291] veth1_macvtap: entered promiscuous mode [ 28.116742][ T292] veth0_vlan: entered promiscuous mode [ 28.141527][ T290] veth1_macvtap: entered promiscuous mode [ 28.155294][ T291] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 28.172171][ T292] veth1_macvtap: entered promiscuous mode [ 28.195772][ T293] veth0_vlan: entered promiscuous mode [ 28.238942][ T293] veth1_macvtap: entered promiscuous mode [ 28.302532][ T342] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2050 sclass=netlink_route_socket pid=342 comm=syz.0.6 [ 28.399143][ T358] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 28.430967][ T359] input: syz0 as /devices/virtual/input/input4 [ 28.453731][ T358] SELinux: failed to load policy [ 28.589559][ T331] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 28.687175][ T366] capability: warning: `syz.3.14' uses deprecated v2 capabilities in a way that may be insecure [ 28.740138][ T331] usb 1-1: Using ep0 maxpacket: 16 [ 28.748518][ T331] usb 1-1: New USB device found, idVendor=0582, idProduct=003b, bcdDevice= 0.40 [ 28.757694][ T331] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.765913][ T331] usb 1-1: Product: syz [ 28.770486][ T331] usb 1-1: Manufacturer: syz [ 28.775141][ T331] usb 1-1: SerialNumber: syz [ 28.986526][ T331] usb 1-1: 1:1: invalid format type 0x9978 is detected, processed as PCM [ 28.995273][ T331] usb 1-1: 1:1 : unsupported sample bitwidth 76 in 64 bytes [ 29.003961][ T331] usb 1-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 29.015269][ T331] usb 1-1: USB disconnect, device number 2 [ 29.030268][ T345] udevd[345]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 29.322952][ T380] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 29.351283][ T382] process 'syz.2.20' launched './file1' with NULL argv: empty string added [ 29.409514][ T65] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 29.571244][ T65] usb 4-1: config 1 has an invalid interface number: 7 but max is 0 [ 29.579619][ T65] usb 4-1: config 1 has no interface number 0 [ 29.585752][ T65] usb 4-1: config 1 interface 7 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 1023 [ 29.596000][ T65] usb 4-1: config 1 interface 7 altsetting 0 endpoint 0xA has an invalid bInterval 245, changing to 11 [ 29.609156][ T65] usb 4-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 29.619361][ T65] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.627733][ T65] usb 4-1: Product: syz [ 29.632770][ T65] usb 4-1: Manufacturer: syz [ 29.649532][ T65] usb 4-1: SerialNumber: syz [ 29.664902][ T370] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 29.891596][ T370] SELinux: policydb magic number 0x0 does not match expected magic number 0xf97cff8c [ 29.907002][ T370] SELinux: failed to load policy [ 30.059515][ T31] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 30.189518][ T31] usb 1-1: device descriptor read/64, error -71 [ 30.429462][ T31] usb 1-1: device descriptor read/64, error -71 [ 30.679468][ T31] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 30.779470][ T331] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 30.809465][ T31] usb 1-1: device descriptor read/64, error -71 [ 30.939516][ T331] usb 3-1: Using ep0 maxpacket: 8 [ 30.945806][ T331] usb 3-1: invalid descriptor for config index 0: type = 0x2, length = 41 [ 30.954523][ T331] usb 3-1: can't read configurations, error -22 [ 31.049463][ T31] usb 1-1: device descriptor read/64, error -71 [ 31.099471][ T331] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 31.159762][ T31] usb usb1-port1: attempt power cycle [ 31.249466][ T331] usb 3-1: Using ep0 maxpacket: 8 [ 31.259706][ T331] usb 3-1: invalid descriptor for config index 0: type = 0x2, length = 41 [ 31.268664][ T331] usb 3-1: can't read configurations, error -22 [ 31.275414][ T331] usb usb3-port1: attempt power cycle [ 31.341990][ T36] kauditd_printk_skb: 84 callbacks suppressed [ 31.342009][ T36] audit: type=1400 audit(1774072310.160:158): avc: denied { nlmsg_read } for pid=447 comm="syz.1.46" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 31.499471][ T31] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 31.520560][ T31] usb 1-1: device descriptor read/8, error -71 [ 31.649481][ T331] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 31.661555][ T31] usb 1-1: device descriptor read/8, error -71 [ 31.669996][ T331] usb 3-1: Using ep0 maxpacket: 8 [ 31.676450][ T331] usb 3-1: invalid descriptor for config index 0: type = 0x2, length = 41 [ 31.685552][ T331] usb 3-1: can't read configurations, error -22 [ 31.839567][ T331] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 31.851731][ T424] usb 4-1: USB disconnect, device number 2 [ 31.869863][ T459] overlay: Unknown parameter 'uid' [ 31.875263][ T36] audit: type=1400 audit(1774072310.680:159): avc: denied { setattr } for pid=458 comm="syz.3.51" name="UDPLITEv6" dev="sockfs" ino=4598 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 31.899477][ T31] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 31.907433][ T331] usb 3-1: Using ep0 maxpacket: 8 [ 31.913800][ T331] usb 3-1: invalid descriptor for config index 0: type = 0x2, length = 41 [ 31.922676][ T331] usb 3-1: can't read configurations, error -22 [ 31.929893][ T31] usb 1-1: device descriptor read/8, error -71 [ 31.937184][ T331] usb usb3-port1: unable to enumerate USB device [ 32.061828][ T31] usb 1-1: device descriptor read/8, error -71 [ 32.179573][ T31] usb usb1-port1: unable to enumerate USB device [ 32.269478][ T424] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 32.427326][ T424] usb 4-1: device descriptor read/64, error -71 [ 32.492684][ T472] rust_binder: Error while translating object. [ 32.492760][ T472] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 32.499051][ T36] audit: type=1400 audit(1774072311.310:160): avc: denied { call } for pid=470 comm="syz.1.55" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 32.527600][ T472] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:67 [ 32.528095][ T36] audit: type=1400 audit(1774072311.310:161): avc: denied { transfer } for pid=470 comm="syz.1.55" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 32.679487][ T424] usb 4-1: device descriptor read/64, error -71 [ 32.919519][ T424] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 33.059502][ T424] usb 4-1: device descriptor read/64, error -71 [ 33.287167][ T36] audit: type=1400 audit(1774072312.100:162): avc: denied { create } for pid=482 comm="syz.1.59" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 33.307304][ T36] audit: type=1400 audit(1774072312.110:163): avc: denied { bind } for pid=482 comm="syz.1.59" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 33.327728][ T424] usb 4-1: device descriptor read/64, error -71 [ 33.334394][ T36] audit: type=1400 audit(1774072312.110:164): avc: denied { write } for pid=482 comm="syz.1.59" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 33.355175][ T36] audit: type=1400 audit(1774072312.110:165): avc: denied { nlmsg_write } for pid=482 comm="syz.1.59" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 33.459689][ T424] usb usb4-port1: attempt power cycle [ 33.556298][ T36] audit: type=1400 audit(1774072312.370:166): avc: denied { ioctl } for pid=486 comm="syz.2.61" path="socket:[3719]" dev="sockfs" ino=3719 ioctlcmd=0x950 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 33.609445][ T36] audit: type=1400 audit(1774072312.420:167): avc: denied { ioctl } for pid=488 comm="syz.0.62" path="socket:[3789]" dev="sockfs" ino=3789 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 33.731646][ T495] can0: slcan on ptm0. [ 33.799776][ T424] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 33.824626][ T424] usb 4-1: device descriptor read/8, error -71 [ 33.961331][ T424] usb 4-1: device descriptor read/8, error -71 [ 34.071319][ T512] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=14385 sclass=netlink_route_socket pid=512 comm=syz.2.65 [ 34.199658][ T424] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 34.220575][ T424] usb 4-1: device descriptor read/8, error -71 [ 34.229821][ T493] can0 (unregistered): slcan off ptm0. [ 34.362349][ T424] usb 4-1: device descriptor read/8, error -71 [ 34.389502][ T10] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 34.482938][ T424] usb usb4-port1: unable to enumerate USB device [ 34.540773][ T10] usb 2-1: config 0 has an invalid interface number: 64 but max is 0 [ 34.548959][ T10] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 34.559261][ T10] usb 2-1: config 0 has no interface number 0 [ 34.567266][ T10] usb 2-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice=39.48 [ 34.576469][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.584659][ T10] usb 2-1: Product: syz [ 34.588915][ T10] usb 2-1: Manufacturer: syz [ 34.593732][ T10] usb 2-1: SerialNumber: syz [ 34.599266][ T10] usb 2-1: config 0 descriptor?? [ 34.809827][ T10] usb 2-1: USB disconnect, device number 2 [ 34.890884][ T550] ======================================================= [ 34.890884][ T550] WARNING: The mand mount option has been deprecated and [ 34.890884][ T550] and is ignored by this kernel. Remove the mand [ 34.890884][ T550] option from the mount to silence this warning. [ 34.890884][ T550] ======================================================= [ 34.927321][ T550] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 34.936448][ T550] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 34.981615][ T555] Zero length message leads to an empty skb [ 34.988058][ T555] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=32863 sclass=netlink_route_socket pid=555 comm=syz.3.73 [ 35.009042][ T555] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1011 sclass=netlink_route_socket pid=555 comm=syz.3.73 [ 35.169203][ T565] SELinux: policydb magic number 0xf97cfb8c does not match expected magic number 0xf97cff8c [ 35.182085][ T565] SELinux: failed to load policy [ 35.189482][ T441] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 35.361082][ T441] usb 3-1: unable to get BOS descriptor or descriptor too short [ 35.380045][ T441] usb 3-1: New USB device found, idVendor=041e, idProduct=30df, bcdDevice= 0.40 [ 35.392346][ T441] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.411577][ T441] usb 3-1: Product: 㮝þ놄뱯䲿襳ᡚ苎㈟쯉繃ꅐ⛯꫚⬷뽑ꕡ䕐솖滔䣚챸ૐ꼈騠゙常⷟১흆䅙➄ޘ뫒燗广ᣭ䚼孙鐻塬坆ᐜꊟ瀺銡嵂㓣﯇鿲ឞ割⹪ᇄ❣・἞㙯➱啨褑瘸븉 [ 35.436155][ T441] usb 3-1: Manufacturer: 花읰ﱳ枋餇궟绲腢഼﹅晇諶ꌌϞ᜘㽝ྵ仯ㄓક沒龗鱴塥꒍瀑榟侸Ｔ壅 [ 35.451768][ T441] usb 3-1: SerialNumber: ᐁ [ 35.639491][ T31] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 35.665774][ T552] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 35.676551][ T552] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 35.688643][ T441] usb 3-1: 1:1 : bogus bTerminalLink 8 [ 35.695436][ T441] usb 3-1: 3:0: failed to get current value for ch 0 (-71) [ 35.703516][ T441] usb 3-1: unit 13 not found! [ 35.720465][ T441] usb 3-1: USB disconnect, device number 6 [ 35.799490][ T31] usb 1-1: Using ep0 maxpacket: 32 [ 35.805885][ T31] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 35.817075][ T31] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 35.856073][ T31] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 35.880836][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 35.897581][ T31] usb 1-1: config 0 descriptor?? [ 35.922027][ T31] hub 1-1:0.0: USB hub found [ 35.931736][ T583] syzkaller1: entered promiscuous mode [ 35.937286][ T583] syzkaller1: entered allmulticast mode [ 35.945770][ T583] fuse: Unknown parameter ''_U$XdQ)R-ap[hkwv&ɿIw[~>6n㲾N~˟3MaZvYgI'?dlkǃO7_|p}e>{Tp{ӤK+aݓ*9AFmm|YjDjdj0x0000000000000009' [ 36.103016][ T581] netlink: 'syz.3.83': attribute type 3 has an invalid length. [ 36.143785][ T31] hub 1-1:0.0: 1 port detected [ 36.359832][ T424] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 36.419502][ T331] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 36.509481][ T424] usb 4-1: Using ep0 maxpacket: 16 [ 36.515717][ T424] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 36.524161][ T424] usb 4-1: config 0 has no interface number 0 [ 36.530434][ T424] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 36.544292][ T424] usb 4-1: New USB device found, idVendor=1a86, idProduct=752d, bcdDevice=2d.4d [ 36.558960][ T424] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.569956][ T331] usb 2-1: Using ep0 maxpacket: 16 [ 36.575373][ T424] usb 4-1: Product: syz [ 36.580143][ T424] usb 4-1: Manufacturer: syz [ 36.585063][ T424] usb 4-1: SerialNumber: syz [ 36.589969][ T331] usb 2-1: config 0 has an invalid descriptor of length 23, skipping remainder of the config [ 36.601243][ T424] usb 4-1: config 0 descriptor?? [ 36.606623][ T331] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 36.621905][ T331] usb 2-1: New USB device found, idVendor=09da, idProduct=000a, bcdDevice= 0.00 [ 36.633648][ T331] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.644562][ T331] usb 2-1: config 0 descriptor?? [ 36.662407][ T36] kauditd_printk_skb: 34 callbacks suppressed [ 36.662425][ T36] audit: type=1400 audit(1790849760.476:202): avc: denied { write } for pid=603 comm="syz.2.92" name="rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 36.746305][ T606] capability: warning: `syz.2.93' uses 32-bit capabilities (legacy support in use) [ 36.756961][ T424] hub 1-1:0.0: hub_ext_port_status failed (err = -71) [ 36.764507][ T597] usb 1-1: USB disconnect, device number 7 [ 36.770613][ T424] usb 1-1: Failed to suspend device, error -19 [ 36.842140][ T36] audit: type=1400 audit(1790849760.656:203): avc: denied { getopt } for pid=607 comm="syz.2.94" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 36.843146][ T609] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 36.873893][ T36] audit: type=1400 audit(1790849760.696:204): avc: denied { create } for pid=587 comm="syz.1.86" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 36.900158][ T36] audit: type=1400 audit(1790849760.716:205): avc: denied { setcheckreqprot } for pid=587 comm="syz.1.86" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 36.920592][ T36] audit: type=1400 audit(1790849760.716:206): avc: denied { read } for pid=587 comm="syz.1.86" name=".pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 36.944536][ T36] audit: type=1400 audit(1790849760.716:207): avc: denied { open } for pid=587 comm="syz.1.86" path="/34/file0/.pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 37.329599][ T597] usb 4-1: USB disconnect, device number 7 [ 37.365095][ T36] audit: type=1400 audit(1790849761.176:208): avc: denied { create } for pid=613 comm="syz.3.96" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 37.384663][ T36] audit: type=1400 audit(1790849761.176:209): avc: denied { setopt } for pid=613 comm="syz.3.96" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 37.421002][ T36] audit: type=1400 audit(1790849761.236:210): avc: denied { unmount } for pid=290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 37.421780][ T290] ------------[ cut here ]------------ [ 37.446904][ T290] WARNING: CPU: 0 PID: 290 at fs/overlayfs/util.c:602 ovl_dir_modified+0x15a/0x190 [ 37.456831][ T290] Modules linked in: [ 37.460841][ T290] CPU: 0 UID: 0 PID: 290 Comm: syz-executor Not tainted syzkaller #0 27d789fd165073930717a3126c57ec3d616cfd74 [ 37.472547][ T290] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 37.482801][ T290] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 37.488507][ T290] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 4e 78 97 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d e9 8c bb 5a 03 cc e8 c6 4f 3f ff <0f> 0b e9 3e ff ff ff e8 ba 4f 3f ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 37.508588][ T290] RSP: 0018:ffffc90007e07b48 EFLAGS: 00010293 [ 37.514780][ T290] RAX: ffffffff8248559a RBX: 0000000000000000 RCX: ffff88810669b900 [ 37.522977][ T290] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 37.531039][ T290] RBP: ffffc90007e07b70 R08: ffff8881165e8b9f R09: 1ffff11022cbd173 [ 37.539305][ T290] R10: dffffc0000000000 R11: ffffed1022cbd174 R12: 0000000000000000 [ 37.547375][ T290] R13: dffffc0000000000 R14: ffff8881165e8b00 R15: ffff88811659d770 [ 37.555444][ T290] FS: 000055558a438500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 37.564469][ T290] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.571310][ T290] CR2: 000055558a463988 CR3: 00000001231f8000 CR4: 00000000003526b0 [ 37.579380][ T290] Call Trace: [ 37.582773][ T290] [ 37.585739][ T290] ovl_do_remove+0x81b/0xda0 [ 37.590420][ T290] ? ovl_set_redirect+0x780/0x780 [ 37.595503][ T290] ? down_write+0xee/0x2b0 [ 37.600444][ T290] ? __cfi_down_write+0x10/0x10 [ 37.605354][ T290] ovl_rmdir+0x1e/0x30 [ 37.609554][ T290] vfs_rmdir+0x3e3/0x560 [ 37.613847][ T290] incfs_kill_sb+0x109/0x230 [ 37.618503][ T290] deactivate_locked_super+0xd5/0x2a0 [ 37.623981][ T290] deactivate_super+0xb8/0xe0 [ 37.628711][ T290] cleanup_mnt+0x406/0x4a0 [ 37.633231][ T290] __cleanup_mnt+0x1d/0x40 [ 37.637721][ T290] task_work_run+0x1e8/0x260 [ 37.642429][ T290] ? __cfi_task_work_run+0x10/0x10 [ 37.648114][ T290] ? __x64_sys_umount+0x12e/0x180 [ 37.653248][ T290] ? __cfi___x64_sys_umount+0x10/0x10 [ 37.658952][ T290] ? __kasan_check_read+0x15/0x20 [ 37.664485][ T290] resume_user_mode_work+0x35/0x50 [ 37.669683][ T290] syscall_exit_to_user_mode+0x63/0xb0 [ 37.675368][ T290] do_syscall_64+0x63/0xf0 [ 37.680333][ T290] ? clear_bhb_loop+0x50/0xa0 [ 37.685240][ T290] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 37.691371][ T290] RIP: 0033:0x7fe07af9d9d7 [ 37.695849][ T290] Code: a2 c7 05 1c fd 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 37.715635][ T290] RSP: 002b:00007ffcbe436648 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 37.724917][ T290] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fe07af9d9d7 [ 37.733098][ T290] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffcbe436700 [ 37.741586][ T290] RBP: 00007ffcbe436700 R08: 00007ffcbe437700 R09: 00000000ffffffff [ 37.749882][ T290] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcbe437790 [ 37.757993][ T290] R13: 00007fe07b032050 R14: 000000000000902f R15: 00007ffcbe4377d0 [ 37.766059][ T290] [ 37.769116][ T290] ---[ end trace 0000000000000000 ]--- [ 37.777344][ T290] ------------[ cut here ]------------ [ 37.783035][ T290] WARNING: CPU: 1 PID: 290 at fs/overlayfs/util.c:602 ovl_dir_modified+0x15a/0x190 [ 37.792430][ T290] Modules linked in: [ 37.796390][ T290] CPU: 1 UID: 0 PID: 290 Comm: syz-executor Tainted: G W syzkaller #0 27d789fd165073930717a3126c57ec3d616cfd74 [ 37.809875][ T290] Tainted: [W]=WARN [ 37.813744][ T290] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 37.823877][ T290] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 37.830071][ T290] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 4e 78 97 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d e9 8c bb 5a 03 cc e8 c6 4f 3f ff <0f> 0b e9 3e ff ff ff e8 ba 4f 3f ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 37.849858][ T290] RSP: 0018:ffffc90007e07b48 EFLAGS: 00010293 [ 37.856003][ T290] RAX: ffffffff8248559a RBX: 0000000000000000 RCX: ffff88810669b900 [ 37.864065][ T290] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 37.872120][ T290] RBP: ffffc90007e07b70 R08: ffff8881165e8b9f R09: 1ffff11022cbd173 [ 37.880292][ T290] R10: dffffc0000000000 R11: ffffed1022cbd174 R12: 0000000000000000 [ 37.888310][ T290] R13: dffffc0000000000 R14: ffff8881165e8b00 R15: ffff88811659d770 [ 37.896461][ T290] FS: 000055558a438500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 37.905639][ T290] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.912296][ T290] CR2: 00007f76f29e92f8 CR3: 00000001231f8000 CR4: 00000000003526b0 [ 37.920526][ T290] Call Trace: [ 37.923954][ T290] [ 37.926949][ T290] ovl_do_remove+0x81b/0xda0 [ 37.931649][ T290] ? ovl_set_redirect+0x780/0x780 [ 37.936739][ T290] ? down_write+0xee/0x2b0 [ 37.941231][ T290] ? __cfi_down_write+0x10/0x10 [ 37.946144][ T290] ovl_rmdir+0x1e/0x30 [ 37.950301][ T290] vfs_rmdir+0x3e3/0x560 [ 37.954603][ T290] incfs_kill_sb+0x1a0/0x230 [ 37.959251][ T290] deactivate_locked_super+0xd5/0x2a0 [ 37.964721][ T290] deactivate_super+0xb8/0xe0 [ 37.969487][ T290] cleanup_mnt+0x406/0x4a0 [ 37.974027][ T290] __cleanup_mnt+0x1d/0x40 [ 37.978496][ T290] task_work_run+0x1e8/0x260 [ 37.983249][ T290] ? __cfi_task_work_run+0x10/0x10 [ 37.988619][ T290] ? __x64_sys_umount+0x12e/0x180 [ 37.993763][ T290] ? __cfi___x64_sys_umount+0x10/0x10 [ 37.999195][ T290] ? __kasan_check_read+0x15/0x20 [ 38.004297][ T290] resume_user_mode_work+0x35/0x50 [ 38.009507][ T290] syscall_exit_to_user_mode+0x63/0xb0 [ 38.015025][ T290] do_syscall_64+0x63/0xf0 [ 38.019602][ T290] ? clear_bhb_loop+0x50/0xa0 [ 38.024363][ T290] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 38.030364][ T290] RIP: 0033:0x7fe07af9d9d7 [ 38.034936][ T290] Code: a2 c7 05 1c fd 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 38.054748][ T290] RSP: 002b:00007ffcbe436648 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 38.063504][ T290] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fe07af9d9d7 [ 38.072008][ T290] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffcbe436700 [ 38.080342][ T290] RBP: 00007ffcbe436700 R08: 00007ffcbe437700 R09: 00000000ffffffff [ 38.088383][ T290] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcbe437790 [ 38.096534][ T290] R13: 00007fe07b032050 R14: 000000000000902f R15: 00007ffcbe4377d0 [ 38.104578][ T290] [ 38.107640][ T290] ---[ end trace 0000000000000000 ]--- [ 41.880329][ T331] usb 2-1: string descriptor 0 read error: -32 [ 41.888941][ T331] usbhid 2-1:0.0: couldn't find an input interrupt endpoint