last executing test programs: 471.830288ms ago: executing program 3 (id=4): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000845, &(0x7f0000b63fe4), 0x1c) r1 = socket$netlink(0x10, 0x3, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0x3, 0xf, 0x8, 0x80, 0x2, 0x3, 0x7f, 0x20000006, 0x20000000, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0x0, 0x5, 0x4, 0x0, 0xa, 0x3c1b, 0x1, 0x24, 0x800000d, 0x1, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x3, 0xc, 0x0, 0x8071, 0x7, 0x6, 0xffffffff, 0x7, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x5, 0x4, 0x8, 0x3ff, 0x80, 0xfffffff9, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012d, 0x8004, 0x5, 0xfffffff3, 0x129432e2, 0xc8, 0xf9, 0x3, 0xaff, 0x1, 0x9, 0xfffffffc, 0x4, 0x10001, 0x0, 0x3, 0x2f, 0xe, 0x6, 0x78, 0xea4, 0x0, 0x3, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0x7, 0x5, 0x1000005, 0x5f31, 0x1000d, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x4, 0xf, 0xffff8001, 0x47, 0x31f3, 0x1, 0xfe000000, 0xfffe, 0x202, 0x4, 0x5, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x3, 0x42, 0x3], [0x5, 0x408, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x0, 0x2, 0x5, 0x8, 0x4, 0x5, 0xffffffff, 0x4, 0x1ef, 0x2, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0xc, 0x2, 0x2, 0x3, 0x20000008, 0x4004, 0xffffff11, 0x6, 0x38, 0x800003, 0x200, 0x83, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x3, 0xa9, 0x5, 0x6, 0xac8, 0xbf, 0x4002, 0x3, 0x7ff, 0x12b, 0x4, 0x40000001, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x9a09, 0x1, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x2, 0x938, 0x6, 0x6, 0x0, 0xb9, 0x9, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10000, 0x9, 0x7fff, 0xffff, 0xa620, 0x1, 0x78b, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x1, 0xc8, 0x1, 0xfffff000, 0x5, 0x3, 0x0, 0x100, 0x9602, 0x7, 0xaf, 0x6fcb, 0x6, 0x1, 0x5, 0x5, 0x8, 0x30b1d693, 0xa1f, 0xf44, 0x7, 0x1, 0x6c1e, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3440, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) sendmsg$netlink(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000580)=ANY=[@ANYBLOB="3400200013000100000100dffddbdf25070000f61600000008000000", @ANYRES32, @ANYBLOB="14000c8008"], 0x34}], 0x1, 0x0, 0x0, 0x4000}, 0x0) 436.105179ms ago: executing program 2 (id=3): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r1 = epoll_create(0x7) r2 = epoll_create1(0x0) r3 = epoll_create(0x7) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000000)) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000040)={0x201c}) r4 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000080)) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r1, &(0x7f00000000c0)={0x60000000}) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000100)={0xa000001c}) setsockopt$bt_BT_POWER(r0, 0x112, 0x9, 0x0, 0x0) 382.878991ms ago: executing program 3 (id=5): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f0000000640)) prlimit64(0x0, 0xf, &(0x7f0000000040)={0x0, 0x100}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e21, @local}, 0x47) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000400)='/sys/power/sync_on_suspend', 0x40202, 0x105) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) write$tcp_mem(r2, &(0x7f0000000440)={0xfffffffffffffffa, 0x20, 0x48001, 0x20, 0x3ff}, 0x48) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_TIME_STAMP(r3, 0x0, 0x3, &(0x7f0000000080), 0x4) 382.443101ms ago: executing program 2 (id=6): r0 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet6(r0, &(0x7f0000000180)=[{{&(0x7f0000000240)={0xa, 0x4e22, 0x6, @private0, 0x7}, 0x1c, 0x0, 0x30}}, {{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000002c0)="1ce02c7a", 0x4}], 0x1}}, {{0x0, 0x0, &(0x7f0000001ac0)=[{&(0x7f0000001a00)="561b273c2e5900cda24f3f4a7bfe419577cc9eba96a4cddc22f7ff909a8a2720b243b32ddf012d4ae8caf94a42ec915e058011561da38aaefda1f35824c1b67163240c14c7f538bfd054ea3e2575066a2b13bd0f489021ad163e4ecf0644a13f12fd6586ba26f805a152c2baa906ea4aa7d0444cc097e4dbacc8e96ed1476e91ee223634ecc0b0d260eca80f366363407d1c6adb3c8dcf11f8e493542477c5c6d40c86c564c695276ea5711b7b931daf4828b28ad6f3e086", 0xb8}], 0x1}}], 0x3, 0x1c005) capset(&(0x7f0000000540)={0x20071026}, &(0x7f0000000580)={0x200000, 0x200000}) ppoll(&(0x7f0000000340)=[{r0, 0x240}], 0x1, 0x0, 0x0, 0x0) shutdown(r0, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f000000f000/0x3000)=nil, 0x3000}, 0x5}) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r2, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="2000fdfffffffedbdf25030000005800018044000400200001000a000000000000000000000000002e00000000000000000100000000200002000a0000000000000100020000000000000000000000000000000000800d0001007564703a73797a3000000000"], 0x6c}, 0x1, 0x0, 0x0, 0x20040804}, 0x0) ioctl$NILFS_IOCTL_RESIZE(r1, 0x40086e8b, &(0x7f00000005c0)=0x4) mkdir(&(0x7f0000000640)='./file0\x00', 0x39) setxattr$system_posix_acl(&(0x7f0000000400)='./bus\x00', &(0x7f0000000440)='system.posix_acl_access\x00', &(0x7f0000000480)={{}, {}, [], {0x4, 0x1}, [{0x8, 0x3}], {0x10, 0x1}}, 0x2c, 0x3) getxattr(&(0x7f00000004c0)='./bus\x00', &(0x7f0000000500)=@known='system.posix_acl_access\x00', 0x0, 0xed) r4 = userfaultfd(0x801) syz_usb_connect$midi(0x5, 0x53, &(0x7f0000000380)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x582, 0x2b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x41, 0x1, 0x1, 0xf, 0xf0, 0x14, "", {{{0x9, 0x4, 0x0, 0x0, 0x3, 0x1, 0x3, 0x20, 0x44, [], [{{0x9, 0x5, 0x6, 0x2, 0x200, 0x4, 0x6, 0x1, {0x7, 0x25, 0x1, 0x3, "5ecea7"}}}, {{0x9, 0x5, 0x1, 0x3, 0x200, 0x6, 0x2, 0x8, {0x8, 0x25, 0x1, 0x4, "d7e26abe"}}}, {{0x9, 0x5, 0xe, 0x12, 0x8, 0x8, 0x2, 0xc0, {0x5, 0x25, 0x1, 0x1, "ec"}}}]}}}}}]}}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$UFFDIO_ZEROPAGE(r4, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ffe000/0x1000)=nil, 0x1000}}) 361.849911ms ago: executing program 3 (id=9): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="30000000200021002bbd7000000000000a060000000000000000000014"], 0x30}}, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000080)='cgroup.procs\x00', 0x2, 0x0) r3 = syz_create_resource$futex(0x0) futex(0x0, 0xb, 0x1, 0x0, r3, 0x2) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$KVM_CAP_X86_USER_SPACE_MSR(0xffffffffffffffff, 0x4068aea3, 0x0) write$cgroup_pid(r2, &(0x7f00000001c0), 0x12) io_setup(0x66, 0x0) openat$tcp_mem(0xffffffffffffff9c, 0x0, 0x1, 0x0) io_submit(0x0, 0x0, 0x0) epoll_create(0x3) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) ppoll(0x0, 0x0, &(0x7f0000000500)={0x0, 0x3938700}, 0x0, 0x0) mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000380)='sysfs\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) add_key$keyring(&(0x7f0000000300), &(0x7f00000006c0)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, &(0x7f0000000580)={0x10001, 0x0, "fd3f80efce48cda2d21fcb87eb6d42396da192a089ac531c9cfac395700df376a3fd4b203131f7b9c8337162700887206dde910dd30db495fcdadc0f3b2945dd525aa6bdbbee7cb713485074ac397c85ec8ad2e0c86cb928e159e5d942b5d6a074f2b149cfee672d1c5a008242e8eab94b8b87e07aa5db9972557c64942f2a5222d9de3d730ad9b5474b2d0e17de342400e09d188d9fca3a174f5ce007fc551a6237866b3a7f41d80c0586cdfee7da7fb447dc495f12c73949987196d8aa8d912be8ee44bb8894ed34e510c73c3133c779d96c4c8cf8e39097321cb81f2d26a7ee881919ca2280d5ca6684fedc1917e9ed0bd009c0ad1ebe4085e794e512cc0d"}) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000003c0)=0xf) write$tun(0xffffffffffffffff, &(0x7f0000000440)=ANY=[@ANYRESOCT], 0x16) socket$inet_tcp(0x2, 0x1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) 264.262374ms ago: executing program 3 (id=12): r0 = syz_ublk_setup_io_uring(0x61b, &(0x7f0000000040)={0x0, 0xe230, 0x10389, 0x0, 0x215}, &(0x7f00000000c0)=0x0, &(0x7f00000002c0)=0x0, &(0x7f0000000340)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000400)={0x2e, 0x10, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000003c0)=@any_dev={0x2, 0x430, 0x0, 0x0, 0x1000, 0x7, 0xffffffffffffffff, 0x0, 0x2}}}, &(0x7f0000000480)) (async) writev(0xffffffffffffffff, 0x0, 0x0) (async) mmap$IORING_OFF_SQ_RING(0x0, 0xa000005, 0x1000004, 0x10010, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./proc\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000240)='./proc\x00', &(0x7f0000000280)='proc\x00', 0x4000, 0x0) (async) write(0xffffffffffffffff, &(0x7f0000000300)='27', 0x2) (async) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) (async) r5 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) recvmsg(r5, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x40014041) exit(0x9) write(r4, &(0x7f00000004c0)='3', 0x4e) (async) unshare(0x40000000) (async) socketpair$unix(0x1, 0x3, 0x0, 0x0) (async) splice(r0, &(0x7f0000000000)=0x42d, r0, &(0x7f00000001c0)=0x5, 0x3, 0x4) (async) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) (async) recvmsg$unix(0xffffffffffffffff, 0x0, 0x80) (async) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) getsockopt$ARPT_SO_GET_INFO(r7, 0x0, 0x60, &(0x7f0000000100)={'filter\x00', 0x0, [0x10001, 0x1, 0xb]}, &(0x7f0000000180)=0x44) (async) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0) syz_ublk_setup_queues(r7, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0) 245.390044ms ago: executing program 0 (id=14): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$UI_END_FF_ERASE(r0, 0x400c55cb, &(0x7f0000001340)={0x0, 0x9, 0x9}) 222.336515ms ago: executing program 0 (id=15): r0 = openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) writev(r0, &(0x7f0000000340)=[{&(0x7f0000000380)="03620c9149502e2f69eeeb7bfe96cd0b38", 0x11}], 0x1) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000002c0)=ANY=[], 0x18}], 0x1, 0x0, 0x0, 0x4000001}, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) getsockopt$bt_BT_DEFER_SETUP(r3, 0x112, 0x7, 0x0, &(0x7f0000000240)) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000440)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./sys/devices/system/cpu/cpuidle/current_governor\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) write$P9_RREADDIR(r4, &(0x7f00000004c0)={0xb, 0x29, 0x1, {0x9}}, 0xb) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000002c0)='./proc/bus/pci/00/00.0\x00', &(0x7f0000000080)='omfs\x00', 0x800, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0) write$9p(r5, &(0x7f0000000100)="ad810b2330bcff1924a78889a3641c34627851565d2bd9d7664aa341f86aa5", 0x1f) read$FUSE(r5, &(0x7f0000001380)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) sendmsg$nl_xfrm(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000001240)={&(0x7f0000001280)=ANY=[@ANYRES32=r6, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000400000000000000000000010000000000000000080000000000000000000000000000000000000000000000000000001d000000000000007f00000000000000990c0000000000000000000000000000dd020000000000000000000000000000010100020000000084010500ac141439000000000000000000000000000004d32b"], 0x23c}}, 0x40044) mount(&(0x7f0000000140)=@sg0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='reiserfs\x00', 0x800000, &(0x7f0000000200)=')\x00') 160.068476ms ago: executing program 0 (id=16): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000700)=@polexpire={0xcc, 0x1b, 0x1, 0x0, 0x0, {{{@in6=@mcast2, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x300, 0x5}, {}, 0x0, 0x0, 0x1, 0x1, 0x1, 0x3}}, [@sec_ctx={0xc, 0x8, {0x8}}]}, 0xcc}, 0x1, 0x0, 0x0, 0x8001}, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x4, 0x7, 0xe1, 0x81, 0x9, 0xd9, 0x40, 0x41, 0xfb, 0x1, 0xc, 0x2, 0x2, 0x41, 0x1, 0xf0}}) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = syz_open_dev$evdev(&(0x7f00000001c0), 0x200000000, 0x608c42) ioctl$EVIOCSCLOCKID(r5, 0x400445a0, &(0x7f0000000200)=0x7) setsockopt$inet6_tcp_int(r4, 0x6, 0x24, &(0x7f0000000080)=0x1, 0x4) shutdown(r4, 0x0) recvmmsg(r4, &(0x7f00000000c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=""/12, 0xc}}], 0x1, 0x0, 0x0) write$binfmt_elf64(r3, 0x0, 0x0) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r3, 0x4010ae68, &(0x7f0000000040)={0x9000, 0x1000, 0x1}) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f00000004c0)={0x1, 0x0, @pic={0xb7, 0xf5, 0x1, 0x10, 0x6, 0x5, 0x4, 0xa, 0xd2, 0x81, 0x4f, 0x8e, 0x1, 0x4, 0xd0, 0x1}}) 159.446686ms ago: executing program 1 (id=17): socket$inet_icmp(0x2, 0x2, 0x1) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) sendmsg$inet(r1, &(0x7f0000000280)={&(0x7f00000002c0)={0x2, 0xf00, @multicast1}, 0x10, &(0x7f0000000300)=[{&(0x7f0000000340)="be38", 0xffdf}], 0x1, &(0x7f0000000380)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @private}}}, @ip_retopts={{0x1c, 0x0, 0x7, {[@timestamp={0x44, 0x4, 0x73}, @noop]}}}], 0x40}, 0x0) 138.595826ms ago: executing program 1 (id=18): r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x100}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f0000000200)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000280)={@flat=@binder={0x73622a85, 0x0, 0xfffffffffffffffe, 0x1}, @flat=@binder={0x73622a85, 0x1101, 0x3, 0x2}, @flat=@weak_binder={0x77622a85, 0x1000, 0x0, 0x3}}}}]}) 82.902047ms ago: executing program 1 (id=19): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./mnt\x00', &(0x7f0000000300)='ext4\x00', 0x8410, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./mnt\x00', 0x0, 0x21) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, 0x0) 82.746867ms ago: executing program 1 (id=20): mkdir(&(0x7f0000000000)='./file0\x00', 0x60) mount$incfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x80, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0, 0x8c) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = openat$incfs(r0, &(0x7f0000000340)='.pending_reads\x00', 0x22000, 0x1b4) ioctl$TIOCL_GETKMSGREDIRECT(r1, 0xc058671e, 0x0) 77.790948ms ago: executing program 1 (id=21): socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000100), 0x8400, 0x0) ioctl$PTP_PEROUT_REQUEST(r0, 0x40383d03, 0x0) 55.363169ms ago: executing program 1 (id=22): io_setup(0x66, &(0x7f0000000000)=0x0) r1 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) io_submit(r0, 0x1, &(0x7f00000000c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0xe, r1, &(0x7f0000000140)='-5', 0x12, 0x0, 0x0, 0x4}]) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_int(r2, 0x6, 0x210000000013, &(0x7f0000000300)=0x100000001, 0x4) connect$inet(r2, &(0x7f0000000380)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_int(r2, 0x6, 0x18, &(0x7f00000003c0)=0xfefffff9, 0x4) openat$selinux_member(0xffffffffffffff9c, 0x0, 0x2, 0x0) clock_gettime(0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000400)=[@timestamp, @sack_perm, @window={0x3, 0x9, 0x2}, @mss={0x2, 0x400}, @mss={0x2, 0xcb2}, @mss={0x2, 0x3}, @timestamp, @sack_perm], 0x8) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, 0x0, 0x0) 6.83541ms ago: executing program 0 (id=23): r0 = socket$inet_tcp(0x2, 0x1, 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x6) bind$inet(r0, &(0x7f0000000cc0)={0x2, 0x4e24, @loopback}, 0x10) listen(r0, 0x5) connect$inet(r1, &(0x7f0000000d00)={0x2, 0x4e24, @loopback}, 0x10) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000d40), 0x4) setsockopt$inet_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000d80)=@gcm_128={{0x304}, "0700568a12080078", "12345678123456781234567812345678", "4aa45678", "1234567817345678"}, 0x28) sendto$inet(r1, &(0x7f0000000dc0)='\x00', 0xffffff5a, 0x40, 0x0, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) 6.66342ms ago: executing program 0 (id=24): mkdir(&(0x7f00000000c0)='./bus\x00', 0x13e) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r0, r0) setpgid(0x0, r0) tkill(r0, 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000600)='./tracing\x00', &(0x7f0000000640)='tracefs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./tracing/events/sched/filter\x00', 0x1, 0x15d) write(r1, &(0x7f00000006c0)="636f6d6d01d000006964203e2030", 0xe) 0s ago: executing program 0 (id=25): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="30000000200021002bbd7000000000000a060000000000000000000014"], 0x30}}, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000080)='cgroup.procs\x00', 0x2, 0x0) r3 = syz_create_resource$futex(0x0) futex(0x0, 0xb, 0x1, 0x0, r3, 0x2) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$KVM_CAP_X86_USER_SPACE_MSR(0xffffffffffffffff, 0x4068aea3, 0x0) write$cgroup_pid(r2, &(0x7f00000001c0), 0x12) io_setup(0x66, 0x0) openat$tcp_mem(0xffffffffffffff9c, 0x0, 0x1, 0x0) io_submit(0x0, 0x0, 0x0) epoll_create(0x3) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000380)='sysfs\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) add_key$keyring(&(0x7f0000000300), &(0x7f00000006c0)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, &(0x7f0000000580)={0x10001, 0x0, "fd3f80efce48cda2d21fcb87eb6d42396da192a089ac531c9cfac395700df376a3fd4b203131f7b9c8337162700887206dde910dd30db495fcdadc0f3b2945dd525aa6bdbbee7cb713485074ac397c85ec8ad2e0c86cb928e159e5d942b5d6a074f2b149cfee672d1c5a008242e8eab94b8b87e07aa5db9972557c64942f2a5222d9de3d730ad9b5474b2d0e17de342400e09d188d9fca3a174f5ce007fc551a6237866b3a7f41d80c0586cdfee7da7fb447dc495f12c73949987196d8aa8d912be8ee44bb8894ed34e510c73c3133c779d96c4c8cf8e39097321cb81f2d26a7ee881919ca2280d5ca6684fedc1917e9ed0bd009c0ad1ebe4085e794e512cc0d"}) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000003c0)=0xf) write$tun(0xffffffffffffffff, &(0x7f0000000440)=ANY=[@ANYRESOCT], 0x16) socket$inet_tcp(0x2, 0x1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.85' (ED25519) to the list of known hosts. [ 33.274152][ T36] audit: type=1400 audit(1792434940.850:64): avc: denied { mounton } for pid=287 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 33.277855][ T287] cgroup: Unknown subsys name 'net' [ 33.296854][ T36] audit: type=1400 audit(1792434940.850:65): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 33.324746][ T36] audit: type=1400 audit(1792434940.890:66): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 33.325306][ T287] cgroup: Unknown subsys name 'devices' [ 33.450776][ T287] cgroup: Unknown subsys name 'hugetlb' [ 33.456406][ T287] cgroup: Unknown subsys name 'rlimit' [ 33.571593][ T36] audit: type=1400 audit(1792434941.150:67): avc: denied { setattr } for pid=287 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 33.594842][ T36] audit: type=1400 audit(1792434941.150:68): avc: denied { mounton } for pid=287 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 33.619631][ T36] audit: type=1400 audit(1792434941.150:69): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 33.659042][ T289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 33.667880][ T36] audit: type=1400 audit(1792434941.240:70): avc: denied { relabelto } for pid=289 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 33.693698][ T36] audit: type=1400 audit(1792434941.240:71): avc: denied { write } for pid=289 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 33.746755][ T36] audit: type=1400 audit(1792434941.320:72): avc: denied { read } for pid=287 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 33.748348][ T287] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 33.772589][ T36] audit: type=1400 audit(1792434941.320:73): avc: denied { open } for pid=287 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 34.647982][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.655306][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.662579][ T294] bridge_slave_0: entered allmulticast mode [ 34.669138][ T294] bridge_slave_0: entered promiscuous mode [ 34.676862][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.684009][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.691192][ T294] bridge_slave_1: entered allmulticast mode [ 34.697490][ T294] bridge_slave_1: entered promiscuous mode [ 34.729062][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.736160][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.743289][ T295] bridge_slave_0: entered allmulticast mode [ 34.749656][ T295] bridge_slave_0: entered promiscuous mode [ 34.757887][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.765115][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.772422][ T295] bridge_slave_1: entered allmulticast mode [ 34.778785][ T295] bridge_slave_1: entered promiscuous mode [ 34.836495][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.843855][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.851005][ T296] bridge_slave_0: entered allmulticast mode [ 34.857285][ T296] bridge_slave_0: entered promiscuous mode [ 34.863895][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.870985][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.878173][ T296] bridge_slave_1: entered allmulticast mode [ 34.884594][ T296] bridge_slave_1: entered promiscuous mode [ 34.924181][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.931312][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.938430][ T297] bridge_slave_0: entered allmulticast mode [ 34.944676][ T297] bridge_slave_0: entered promiscuous mode [ 34.951299][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.958372][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.965462][ T297] bridge_slave_1: entered allmulticast mode [ 34.971825][ T297] bridge_slave_1: entered promiscuous mode [ 35.092636][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.099736][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.107039][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.114172][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.122874][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.129985][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.137284][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.144369][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.175071][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.182179][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.189516][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.196570][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.222270][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.229372][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.236964][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.244077][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.267446][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.274888][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.282509][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.290210][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.297550][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.304961][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.312323][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.319693][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.350121][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.357218][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.365821][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.372952][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.381499][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.388602][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.414361][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.421570][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.429463][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.436602][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.444436][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.452140][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.463910][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.471002][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.494815][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.501944][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.534449][ T294] veth0_vlan: entered promiscuous mode [ 35.545174][ T296] veth0_vlan: entered promiscuous mode [ 35.565952][ T294] veth1_macvtap: entered promiscuous mode [ 35.582814][ T296] veth1_macvtap: entered promiscuous mode [ 35.589892][ T295] veth0_vlan: entered promiscuous mode [ 35.608869][ T297] veth0_vlan: entered promiscuous mode [ 35.629394][ T295] veth1_macvtap: entered promiscuous mode [ 35.645218][ T297] veth1_macvtap: entered promiscuous mode [ 35.662334][ T296] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 35.715894][ T315] overlayfs: missing 'lowerdir' [ 35.781201][ T327] capability: warning: `syz.2.6' uses deprecated v2 capabilities in a way that may be insecure [ 35.950762][ T349] Zero length message leads to an empty skb [ 35.980489][ T351] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 36.042305][ T363] No source specified [ 36.063142][ T365] incfs: Backing dir is not set, filesystem can't be mounted. [ 36.070901][ T365] incfs: mount failed -2 [ 36.088329][ T31] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 36.161767][ T294] ------------[ cut here ]------------ [ 36.167324][ T294] WARNING: CPU: 0 PID: 294 at fs/inode.c:340 drop_nlink+0xce/0x110 [ 36.175326][ T294] Modules linked in: [ 36.179352][ T294] CPU: 0 UID: 0 PID: 294 Comm: syz-executor Not tainted syzkaller #0 d636eca9d172ec8b7f35b39457632062ecba35ed [ 36.191231][ T294] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 36.201372][ T294] RIP: 0010:drop_nlink+0xce/0x110 [ 36.206422][ T294] Code: 04 00 00 be 08 00 00 00 e8 ff 0b ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d e9 88 fb b5 03 cc e8 62 93 94 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c [ 36.226239][ T294] RSP: 0018:ffffc9000b68fc88 EFLAGS: 00010293 [ 36.232558][ T294] RAX: ffffffff81f4b95e RBX: ffff888112d2c7e0 RCX: ffff88812ebf13c0 [ 36.240706][ T294] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 36.248735][ T294] RBP: ffffc9000b68fcb0 R08: 0000000000000003 R09: 0000000000000004 [ 36.256736][ T294] R10: dffffc0000000000 R11: fffff520016d1f80 R12: dffffc0000000000 [ 36.260340][ T31] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0xE has invalid maxpacket 8 [ 36.264819][ T294] R13: 1ffff110225a5905 R14: ffff888112d2c828 R15: 0000000000000000 [ 36.277700][ T31] usb 3-1: New USB device found, idVendor=0582, idProduct=002b, bcdDevice= 0.40 [ 36.282742][ T294] FS: 000055556ba54500(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 [ 36.293637][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.300515][ T294] CS: 0010 DS: 0000 ES: