last executing test programs: 2.094243538s ago: executing program 1 (id=2): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) write$tun(0xffffffffffffffff, &(0x7f0000000200)={@val={0xa, 0x9000}, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @random="0eb6ff7fffff", @void, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x9a, 0x3a, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @mcast2, {[], @dest_unreach={0x1, 0x3, 0x0, 0x72, '\x00', {0x1, 0x6, "dc46d9", 0x5, 0x2b, 0x0, @dev={0xfe, 0x80, '\x00', 0x16}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, [@srh={0x33, 0x0, 0x4, 0x0, 0x3, 0x78, 0xbc4}], "e81fbf0c76a59ef4d149441be036dedc5f77215e917aa8420ae014346a2db9a9665a4575dd3c5ccc6e9a55b8c9d977aa6ce29d35217242873a48d4932f8e2a644f564da9754b357ff3ef7800b3d46366d937caa88b5e61ba0878069cce18b4466704"}}}}}}}}, 0xd4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, 0x0, 0x0) setns(0xc9, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40e41, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'syzkaller1\x00', 0xc201}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) connect$unix(r4, &(0x7f0000000180)=@file={0x1, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r2, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000001400000060ec97000fc83c00fe8000000000000000000000000000aaff02000000000000000000000000000111"], 0xffe) sendto$packet(r0, &(0x7f00000002c0)="05031c00d3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) 1.98230834s ago: executing program 3 (id=4): fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = timerfd_create(0x8, 0x80000) timerfd_settime(r0, 0x3, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) timerfd_gettime(r0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) 1.912482252s ago: executing program 0 (id=5): r0 = socket(0x10, 0x80000, 0x80000000) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000001100)={'veth1\x00', &(0x7f0000000040)=@ethtool_link_settings={0x4c, 0x100, 0x0, 0x4, 0x40, 0x7, 0x2c, 0x4b, 0x1, 0x4, [0x6, 0x8, 0xffff, 0xc1e, 0x47a3, 0x40d9e, 0x1d, 0x1]}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000140)={'ip6gre0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x0, 0x8, 0x0, 0x5c8c, 0x0, @mcast2, @mcast1, 0x80, 0x700, 0x0, 0x20000000}}) r1 = socket$xdp(0x2c, 0x3, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x13, r1, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000008300), 0x2, 0x0) ioctl$FUSE_DEV_IOC_CLONE(r2, 0x8004e500, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)}], 0x1}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x0) r5 = socket$key(0xf, 0x3, 0x2) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000c00)=@newsa={0x138, 0x10, 0x633, 0x0, 0x0, {{@in=@multicast2, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x4000, 0x0, 0x8004}, {@in=@dev={0xac, 0x14, 0x14, 0x3f}, 0x0, 0x32}, @in6=@private2, {0x327, 0x9, 0x0, 0x4, 0x20000000000000, 0x0, 0x1, 0x7}, {0x0, 0x0, 0x2, 0x40000000000}, {0x8f, 0x0, 0x8}, 0x70bd29, 0x3502, 0x2, 0x1}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x20008001}, 0x0) sendmsg$key(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[], 0x10}}, 0x0) sendmsg$key(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020a000002"], 0x10}}, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) r7 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) r8 = syz_kvm_setup_syzos_vm$x86(r7, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000080)={0xc, 0x0, 0xfec00000, 0x0, &(0x7f0000000000/0x1000)=nil}) r9 = syz_kvm_add_vcpu$x86(r8, &(0x7f0000000100)={0x0, &(0x7f0000000000)=[@code={0xa, 0x18, {"b80000c0fe3acb80"}}], 0xd3}) ioctl$KVM_RUN(r9, 0xae80, 0x0) unshare(0x60000600) r10 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r10, 0x89f1, &(0x7f0000000440)={'tunl0\x00', &(0x7f0000000580)={'syztnl0\x00', 0x0, 0x700, 0x8, 0x4000006, 0x4, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x67, 0x0, 0x8, 0x2f, 0x0, @empty, @broadcast}}}}) r11 = socket(0x10, 0x803, 0x0) sendto(r11, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x804, 0x0, 0x0) 1.910771583s ago: executing program 2 (id=3): rt_sigprocmask(0x0, &(0x7f00000000c0)={[0xfffffeffffffffff]}, 0x0, 0x8) (async) r0 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x12, 0x4, @tid=r0}, &(0x7f0000000380)=0x0) r2 = gettid() timer_settime(r1, 0x1, &(0x7f0000000080)={{0x77359400}, {0x0, 0x989680}}, 0x0) tkill(r2, 0x22) r3 = gettid() tkill(r3, 0x16) (async) socket$netlink(0x10, 0x3, 0x0) 1.910163903s ago: executing program 3 (id=6): mount$overlay(0x0, &(0x7f0000000580)='.\x00', &(0x7f0000000000), 0x880, &(0x7f00000000c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x5c}, {@redirect_dir_follow}]}) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000100)=0x0) r1 = socket$packet(0x11, 0x2, 0x300) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'vlan1\x00', 0x0}) sendto$packet(r2, 0x0, 0x0, 0x240058d4, &(0x7f0000000300)={0x11, 0x4, r3, 0x1, 0x85, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2e}}, 0x14) mount$cgroup(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x2000000, &(0x7f0000000140)={[{@name}, {@subsystem='pids'}, {@subsystem='cpuset'}, {@favordynmods}, {@release_agent={'release_agent', 0x3d, './file0'}}, {@nofavordynmods}, {@favordynmods}], [{@fsmagic={'fsmagic', 0x3d, 0x3}}, {@smackfsroot={'smackfsroot', 0x3d, '^\x99%'}}, {@appraise}, {@fowner_gt={'fowner>', 0xee00}}, {@smackfsdef={'smackfsdef', 0x3d, '*\x05\'$'}}, {@fowner_eq={'fowner', 0x3d, r0}}, {@audit}, {@hash}, {@context={'context', 0x3d, 'system_u'}}, {@smackfshat={'smackfshat', 0x3d, '){:'}}]}) 1.908908103s ago: executing program 1 (id=7): r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000440)={0x28, 0x0, 0x0, @local}, 0x10) listen(r0, 0xa) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000000)={0x28, 0x0, 0x0, @local}, 0x10) r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000a40)=ANY=[@ANYBLOB="2800000014001901000000000000000228"], 0x28}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r3 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) recvmmsg$unix(r3, &(0x7f0000000800)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000980)=""/4096, 0x1000}], 0x1}}, {{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000002980)=""/131, 0x83}], 0x1}}, {{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000002bc0)=""/238, 0xee}], 0x1}}, {{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000280)=""/97, 0x61}], 0x1}}], 0x4, 0x400122a0, 0x0) sendmmsg(r3, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) ioctl$BTRFS_IOC_WAIT_SYNC(r2, 0x40089416, &(0x7f0000000040)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100), 0x6ad01, 0x0) writev(r6, &(0x7f0000000300)=[{&(0x7f0000000200)="13000000010203", 0x7}, {&(0x7f0000000340)="a4", 0x1}], 0x2) r7 = dup(r5) syz_ublk_setup_queues(r7, r4, 0x0, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x40040001, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 1.866315624s ago: executing program 2 (id=8): r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1c0002, 0x0) write$vga_arbiter(r0, &(0x7f00000002c0)=@other={'decodes', ' ', 'mem'}, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1bc) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x55, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002020000402505a7a400010000000109024300020100c001090400000102020100052400100104240202052401000105240600010705810308000a09040100020a00000007058202000200070503020002"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/ttyACM0\x00', 0x1aff80, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r2) r4 = socket$tipc(0x1e, 0x5, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000280), 0x80000, 0x0) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, &(0x7f0000000080)={0x24, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x22, 0xf, {[@main=@item_4={0x3, 0x0, 0x8, '\t\x00'}, @local=@item_4={0x3, 0x2, 0x0, "112000"}, @main=@item_4={0x3, 0x0, 0xb, "7488dffc"}]}}, 0x0}, 0x0) r6 = syz_usb_connect$uac2(0x5, 0xa0, &(0x7f0000000280)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x582, 0x4c, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x8e, 0x3, 0x1, 0x5, 0x30, 0x9, {0x8, 0xb, 0x0, 0x1, 0x1, 0x7, 0x20, 0x8c}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x4000, 0x4, 0x15, 0x7}, [@output_terminal={0xc, 0x24, 0x3, 0x2, 0x307, 0x0, 0x4, 0x0, 0x7, 0x81}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x3, 0xb, 0x4, {0x8, 0x25, 0x1, 0x0, 0x0, 0x40, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x4, 0x1ccc, 0x5}, @as_header={0x10, 0x24, 0x1, 0x2, 0x1, 0x0, 0x4, 0x8, 0xb8, 0x3}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x40, 0x6, 0x3, {0x8, 0x25, 0x1, 0x82, 0x3, 0xf3, 0x6}}}}}}}}]}}, 0x0) syz_usb_connect$midi(0x0, 0x32, &(0x7f0000000200)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x644, 0x800f, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x20, 0x1, 0x1, 0x6, 0xa0, 0x7f, "", {{{0x9, 0x4, 0x0, 0x0, 0x1, 0x1, 0x3, 0x0, 0xd, [], [{{0x9, 0x5, 0xe, 0x2, 0x10, 0x5, 0x9, 0xca, {0x5, 0x25, 0x1, 0x1, "91"}}}]}}}}}]}}, 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_control_io$uac2(r6, 0x0, 0x0) syz_usb_control_io(r6, 0x0, &(0x7f0000001100)={0x84, &(0x7f0000000c80)={0x20, 0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGCOLLECTIONINDEX(r2, 0x40184810, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/drivers/virtio-pci/new_id\x00', 0x1, 0x0) write(r7, &(0x7f0000000000)='8086 7', 0x6) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r7, &(0x7f0000000500)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x64, 0x0, 0x300, 0x70bd25, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r8}, @val={0xc, 0x99, {0x1, 0x4c}}}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x64}, 0x1, 0x0, 0x0, 0x4091}, 0x14008885) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r2, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, r3, 0x4, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r8}, @val={0xc, 0x99, {0xffffffc6, 0x1e}}}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x400c885}, 0x0) syz_usb_disconnect(r1) 1.855430144s ago: executing program 3 (id=9): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x0, &(0x7f0000000080)=0x3, 0x4) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) r1 = fcntl$dupfd(r0, 0x0, r0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) sendmsg$IPVS_CMD_GET_CONFIG(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[], 0x14}}, 0x4000) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000140)=@gcm_256={{0x303}, "0044edf41400", "7fce684d28de517314d3bdc79f590500a462b3dfca502b1e47c4ae00", "f2aa3fe6", "9a27032dad5456bb"}, 0x38) recvmsg$unix(r1, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000c40)=[{&(0x7f0000000680)=""/214, 0xd6}], 0x1}, 0x0) recvmsg$unix(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000400)=""/159, 0x9f}], 0x1}, 0x10040) r2 = syz_usb_connect$uac2(0x5, 0x83, &(0x7f0000000180)=ANY=[@ANYBLOB="120100020000000882052500400001020301090271000301f81005080b020001052008090400000001012000092401fdff0a11004708240a0000057f00090401000001022000090401010101022000090501"], 0x0) syz_usb_control_io$uac2(r2, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0003040000000403"]}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r3) sendmsg$TIPC_NL_PEER_REMOVE(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000640)=ANY=[@ANYBLOB="3aac0afb", @ANYRES16=r4, @ANYBLOB="010025bd7000fedbdf25140000000c0007800800020000000000"], 0x20}}, 0x20040010) r5 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00') lseek(r5, 0x0, 0x1) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) ioctl$HCIINQUIRY(r6, 0x800448f0, 0x0) syz_usb_control_io$uac2(r2, 0x0, 0x0) syz_usb_control_io$uac2(r2, 0x0, &(0x7f0000000740)={0x44, &(0x7f0000000240)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) accept$nfc_llcp(r5, &(0x7f0000000400), &(0x7f0000000480)=0x60) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) syz_ublk_setup_io_uring(0x582b, &(0x7f0000000500)={0x0, 0x5947, 0x1000, 0x1, 0x2a2, 0x0, r5}, &(0x7f0000000580), &(0x7f00000005c0), &(0x7f0000000600)) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') read$FUSE(r7, &(0x7f0000002580)={0x2020}, 0x6d) read$FUSE(r5, &(0x7f00000007c0)={0x2020}, 0x2020) 1.685956658s ago: executing program 0 (id=10): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'pim6reg1\x00', 0x2}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x7) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000140)={'pim6reg1\x00', @link_local}) r2 = add_key$fscrypt_v1(&(0x7f0000002a00), &(0x7f0000000500)={'fscrypt:', @desc2}, &(0x7f0000000580)={0x0, "f1a1173fb9462d3589e67197f90be6e423ceb0ab4912f9f6a31854ec98e950cfed21fcad7ff0fbcb566a0982f8938caa00", 0x29}, 0x48, 0xffffffffffffffff) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x0, 0x10000, 0x7}) keyctl$KEYCTL_MOVE(0x4, r2, r2, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={0x0, 0xf4}}, 0x0) syz_clone(0x80842111, 0x0, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x3ff, &(0x7f0000000500)=0x0) io_submit(r6, 0xf000, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r4, 0x0}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r5, &(0x7f00000001c0)='m', 0xfffffdfc}]) io_destroy(r6) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x681, 0x0) r7 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001a00), 0x109000, 0x0) ioctl$BLKRRPART(r7, 0x125f, 0x0) r8 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r8, r9, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text16={0x10, 0x0}], 0x1, 0x6d, 0x0, 0x0) ioctl$KVM_SET_MSRS(r9, 0x4008ae89, &(0x7f00000002c0)={0x1, 0x0, [{0x40000073, 0x0, 0x81}]}) r10 = socket(0x10, 0x803, 0x0) accept$inet(r10, 0x0, 0x0) 1.558423681s ago: executing program 1 (id=11): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x5f, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000480)=[{0x0}, {0x0}, {0x0}, {0x0}, {&(0x7f0000000680)}], 0x5, 0x4, 0x5) (async) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) (async) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x43, 0x0, 0x0) (async) ioctl$KVM_RUN(r4, 0xae80, 0x0) (async) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000340)={[0x100000000005, 0x4, 0xe9b, 0x22, 0x20000008, 0x7, 0x1000, 0x7, 0x8, 0x10009c2, 0xd, 0x0, 0xc, 0xb, 0x8000, 0xffffffffffffffff], 0x100000, 0xc2302}) ioctl$KVM_SET_VCPU_EVENTS(r4, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x1, 0xc, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x0, 0x0, 0x5, 0xfffffff8, 0x0, 0xff, 0xff}) (async) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r6, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={0x1c, r5, 0x10ada85e65c25359, 0x70bd2a, 0x25dfdbfd, {{0x6b}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x10200, 0x6, 0xffff1000, 0x2000, &(0x7f0000ff5000/0x2000)=nil}) (async) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioperm(0x1, 0x3, 0x163f) (async) r7 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace$ARCH_SET_CPUID(0x1e, r7, 0x0, 0x1012) 1.418842595s ago: executing program 1 (id=12): r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f00000001c0)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000740)={0x7, {{0xa, 0x4e23, 0x81, @mcast1, 0x5}}}, 0x88) r1 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r1, 0xe3) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'veth1\x00'}) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r5, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x1000}, 0x0) r7 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f00000005c0)={'vlan0\x00', 0x0}) bind$packet(r7, &(0x7f00000000c0)={0x11, 0x3, r8, 0x1, 0x0, 0x6, @remote}, 0x14) sendmsg$ETHTOOL_MSG_WOL_GET(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={0x20, r4, 0x1, 0x70bd2a, 0x25dfdbfd, {0x1b}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x810}, 0x800) setsockopt$inet6_group_source_req(r0, 0x29, 0x2b, &(0x7f00000005c0)={0x1, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x4e20, 0x0, @empty}}}, 0x108) 1.364632076s ago: executing program 0 (id=13): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x20880, 0x0) mprotect(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000002) socket$packet(0x11, 0x3, 0x300) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PAGEMAP_SCAN(r1, 0xc0606610, &(0x7f00000003c0)={0x60, 0xf4e3d86cb4743d6d, &(0x7f0000ffc000/0x1000)=nil, &(0x7f000027e000/0x1000)=nil, 0x9, &(0x7f0000000340)=[{0x1000000000000000, 0x5, 0x5}, {0x7, 0xc77, 0x80}, {0x1, 0x1, 0x9}], 0x3, 0x26b2, 0x90, 0x60, 0x21, 0x10}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x2, &(0x7f00000001c0)=0x7ff, 0x4) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x8000002, 0x2004}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x22008041, &(0x7f0000000200)={0xa, 0x2, 0x2, @loopback, 0xfffffffd}, 0x20) sendto$inet6(r2, &(0x7f0000000080)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090000006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5753444fe05f33e5f91045540836c3cd6af10f0cd018f0c6f57f926ac959a5628c45088fbe0c87fbe6cbcda4662d2a12f6d00"/215, 0xd0d0c2ac, 0x1, 0x0, 0x0) syz_create_resource$binfmt(&(0x7f0000000000)='./file0\x00') read$FUSE(0xffffffffffffffff, 0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x20842, 0x110) socket(0x5, 0x0, 0x1ff) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000020, 0x11, r3, 0xa64c000) splice(r2, 0x0, r1, 0x0, 0x406f413, 0x0) syz_clone(0x11, 0x0, 0xb, 0x0, 0x0, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x100) setresuid(r4, r4, r4) setfsuid(0x0) r5 = socket(0x1f, 0x5, 0xdc) ioprio_set$uid(0x0, 0x0, 0x4007) ioctl$TCSBRKP(r0, 0x5425, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r5, 0x660c) 1.363723456s ago: executing program 1 (id=14): r0 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x44f, 0xb605, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x60, 0x0, "", [{{0x9, 0x4, 0x0, 0x2, 0x1, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x1, 0x7, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x2, 0x81, 0xc3}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000080)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\b('], 0x0, 0x0, 0x0, 0x0}, 0x0) (async) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x20, 0x1477, 0x1024, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x8, 0xa8, 0x4, "", [{{0x9, 0x4, 0x0, 0xbd, 0x2, 0x3, 0x1, 0x1, 0x1a, {0x9, 0x21, 0x0, 0x9, 0x1, {0x22, 0x966}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0xe, 0xb, 0xba}}}}}]}}]}}, &(0x7f00000004c0)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x310, 0x7, 0x4, 0x0, 0x40, 0xf}, 0x7e, &(0x7f0000000140)={0x5, 0xf, 0x7e, 0x5, [@wireless={0xb, 0x10, 0x1, 0xc, 0x84, 0x0, 0x8, 0xd6, 0x5}, @ss_container_id={0x14, 0x10, 0x4, 0xf, "dbac9c19ed793d6e77e880547661e11c"}, @wireless={0xb, 0x10, 0x1, 0x8, 0xc8, 0x1, 0x80, 0x7, 0xfc}, @generic={0x4c, 0x10, 0x1, "849b94343f7463dd71a5611843fa7cde94147196ef6c2d2ce1c87b8d50de96f551c4ea62087911c4d41e4111361112043cf29f4e1695be14606e6d4dfa3414a3517cb9528cbdca5875"}, @ptm_cap={0x3}]}, 0x8, [{0x5e, &(0x7f00000001c0)=@string={0x5e, 0x3, "4169162e24bae932b1c96e4780cbcf879c23c8bbe7b59c4cbdc0826c34a094ecc7bbb0224e3c3714bd390cfd291762c4ea52eef3b22ce38385726d1a47acd9a33ffcdf7cc7d9ee4bbf53aecf4f8ee51d8509a9456a1b1a6987884652"}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x82c}}, {0x1f, &(0x7f0000000280)=@string={0x1f, 0x3, "463d66546e28c1b5e384fcad10f16b02d1ead507e71f50d5cdf6a2af5e"}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x410}}, {0x43, &(0x7f0000000300)=@string={0x43, 0x3, "6716be3f1aba62199a64d9811c0725abc32fd7c3c32f49b53ec8c11c7662ce8c621f52d8930f9e7842df7bf8dbc48a34bfb5625a89df1b7316d21123c556fe6ee3"}}, {0xb9, &(0x7f0000000540)=@string={0xb9, 0x3, "0f3868c2f7b12f4487cf200c746456219dbc437bbb8bb5b30d1f1de2989825e765ebe7c66eeaae4c31afdbad94efe6769aef97f2a3d4f7612649b2c755484a24f33ed14a167c79465a8d42e265d983d2bf9d67d12477a880a327db0dcf9ceef9369bfec271fc2ca0a80d317e46fb9144fa1d5d74475c2a9c5ebb74c84aab2e9068187862f5a58fc5175e464543a4271328de052047c9a840bd110ec6ea0141197d60c1b317e411493c7658c2bc03cb1e7cd83025f26e5c"}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x4ff}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x41d}}]}) 1.146584452s ago: executing program 0 (id=15): mount(0x0, &(0x7f0000000240)='./cgroup\x00', &(0x7f0000000040)='exfat\x00', 0x800041, &(0x7f00000001c0)='discard') r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}}, 0x1c) r2 = open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x2) fcntl$setlease(r2, 0x400, 0x0) unlink(&(0x7f0000000100)='./file0\x00') r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x40801, 0x0) ioctl$TIOCSSOFTCAR(r3, 0x541a, &(0x7f0000000100)=0x4) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8916, &(0x7f0000000200)={'syzkaller1\x00', {0x2, 0x0, @dev={0xac, 0x14, 0x0, 0x1}}}) r5 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) r6 = fcntl$dupfd(r5, 0x0, r5) ioctl$USBDEVFS_SUBMITURB(r6, 0x8038550a, 0x0) write$tun(r6, &(0x7f0000000080)=ANY=[@ANYBLOB="03051c00010000000000000186dd06100009aabaaaaaaaaaff020000000000000000000000000001aaaaaaaaaa0cfe000000bb00"/62], 0x3e) 1.009129385s ago: executing program 0 (id=16): socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) mkdir(&(0x7f0000000300)='./bus\x00', 0x63) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x8, &(0x7f0000000080)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) mount_setattr(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000040)={0x10000f, 0xf2, 0x80000, {r0}}, 0x20) setxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)='system.posix_acl_access\x00', &(0x7f0000000280)={{}, {}, [], {0x4, 0x7}}, 0x24, 0x1) lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='system.posix_acl_access\x00', 0x0, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000845, &(0x7f0000b63fe4), 0x1c) getsockopt$inet6_buf(r1, 0x29, 0x3d, 0x0, &(0x7f00000000c0)=0x37) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}], 0x60}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) syz_ublk_setup_queues(r8, r6, &(0x7f00000004c0)={0x0, 0xbd, 0x10, 0x1, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe708, 0x42, 0x1000002, 0x91, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) 920.561988ms ago: executing program 0 (id=17): syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12013f00000000407f04ffff0000000000010902"], 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}], 0x40}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)) r5 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, 0x0, 0x0) syz_ublk_setup_queues(r4, r2, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0x1, 0x1f4}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x40040001, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) r6 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f0000000040)={0x8, 0x0, 0xfffffffd}, 0x24) write(r6, &(0x7f0000000080)="240000001a007f0214f9f4070009040803000000000000000002000008000f40fe00000e", 0x24) r7 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) syz_usb_disconnect(r7) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r7, 0x41015500, 0x0) 57.094939ms ago: executing program 2 (id=18): r0 = socket(0x2, 0x3, 0xff) setsockopt$sock_int(r0, 0x1, 0x29, &(0x7f0000000000)=0x97b, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000700)=0xcce, 0x4) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0xfffffffffffffce9) sendto$inet(r2, &(0x7f0000000180)="cbd0d12a2aaf397769d4fd867e04a39a071ecfc6348f2397cefb9c081242842f30b0c2cf36b01e14f8761589208d5587bc527a58e4cd15135271ad3d51579aa5d18930f0b421bfa9ff81cfad20309d6554f473c1976657e87093d21a6c7cdea0a532038946c5e2e50215175a2a3bffc9b01716e6019dd6a65cfe66dac77cd469fac8cae96c8647a8d8317c20e209bb310916738116775b5f258d93c18dd5de08cf3f9eee8fe4fefe040e61e01b847fbb34a87b9ea30de988238adcc1b6d03c", 0xbf, 0x801, &(0x7f0000000240)={0x2, 0x4e20, @multicast2}, 0x10) sendmsg$inet(r0, &(0x7f0000000880)={&(0x7f0000000100)={0x2, 0x4e20, @multicast2}, 0x10, &(0x7f00000007c0)=[{&(0x7f0000000140)="25daecdbdce723b7b21e8d5c32e71c33b09147ca", 0x14}], 0x1, &(0x7f0000000840)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x5}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x57}}], 0x30}, 0x40) 0s ago: executing program 2 (id=19): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x202, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r1, 0xae03, 0x4c) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='setgroups\x00') read$FUSE(r3, &(0x7f0000000c40)={0x2020}, 0x2020) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) ioctl$TUNSETOFFLOAD(r4, 0x400454d0, 0x0) dup(0xffffffffffffffff) (async) r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2}) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='./tracefs/instances/foo\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x6000) quotactl$Q_QUOTAON(0xffffffff80000202, &(0x7f0000000100)=@nullb, r6, &(0x7f0000000180)='./tracefs/instances/foo\x00') (async) r7 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) (async) r9 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_int(r9, 0x29, 0x4, 0x0, &(0x7f0000000000)=0xfffffffffffffe26) (async) syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYRES16=r7, @ANYRES32, @ANYRESDEC=r8, @ANYBLOB="37c44492082f2491bb78", @ANYRESDEC=r8, @ANYRES16=r8], 0x0) kernel console output (not intermixed with test programs): cess permissive=1 [ 21.432469][ T36] audit: type=1400 audit(1786944429.580:63): avc: denied { siginh } for pid=274 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.158' (ED25519) to the list of known hosts. [ 29.410831][ T36] audit: type=1400 audit(1786944437.570:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 29.414122][ T286] cgroup: Unknown subsys name 'net' [ 29.433507][ T36] audit: type=1400 audit(1786944437.570:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.460856][ T36] audit: type=1400 audit(1786944437.600:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.461405][ T286] cgroup: Unknown subsys name 'devices' [ 29.581273][ T286] cgroup: Unknown subsys name 'hugetlb' [ 29.586905][ T286] cgroup: Unknown subsys name 'rlimit' [ 29.682218][ T36] audit: type=1400 audit(1786944437.840:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 29.705427][ T36] audit: type=1400 audit(1786944437.840:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 29.730328][ T36] audit: type=1400 audit(1786944437.840:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 29.751233][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 29.762760][ T36] audit: type=1400 audit(1786944437.930:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.788198][ T36] audit: type=1400 audit(1786944437.930:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.811711][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 29.814384][ T36] audit: type=1400 audit(1786944437.970:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.848336][ T36] audit: type=1400 audit(1786944437.970:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.814701][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.821855][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.828999][ T293] bridge_slave_0: entered allmulticast mode [ 30.835313][ T293] bridge_slave_0: entered promiscuous mode [ 30.844685][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.851814][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.858957][ T293] bridge_slave_1: entered allmulticast mode [ 30.865220][ T293] bridge_slave_1: entered promiscuous mode [ 30.906250][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.913371][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.920522][ T294] bridge_slave_0: entered allmulticast mode [ 30.926791][ T294] bridge_slave_0: entered promiscuous mode [ 30.934450][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.941538][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.948620][ T294] bridge_slave_1: entered allmulticast mode [ 30.955014][ T294] bridge_slave_1: entered promiscuous mode [ 31.024884][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.032008][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.039172][ T296] bridge_slave_0: entered allmulticast mode [ 31.045461][ T296] bridge_slave_0: entered promiscuous mode [ 31.054839][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.062044][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.069639][ T296] bridge_slave_1: entered allmulticast mode [ 31.075914][ T296] bridge_slave_1: entered promiscuous mode [ 31.121301][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.128413][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.135614][ T295] bridge_slave_0: entered allmulticast mode [ 31.141966][ T295] bridge_slave_0: entered promiscuous mode [ 31.151313][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.158409][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.165530][ T295] bridge_slave_1: entered allmulticast mode [ 31.171866][ T295] bridge_slave_1: entered promiscuous mode [ 31.271021][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.278116][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.285479][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.292554][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.304588][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.311672][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.318999][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.326056][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.340705][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.347808][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.355126][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.362177][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.395093][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.402198][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.409511][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.416572][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.444321][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.452134][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.459763][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.466989][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.475989][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.483239][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.491497][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.511004][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.518071][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.525882][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.532935][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.540761][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.547822][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.579145][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.586254][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.604104][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.611220][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.632599][ T295] veth0_vlan: entered promiscuous mode [ 31.640196][ T294] veth0_vlan: entered promiscuous mode [ 31.660606][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.667685][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.675476][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.682554][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.696421][ T295] veth1_macvtap: entered promiscuous mode [ 31.728671][ T294] veth1_macvtap: entered promiscuous mode [ 31.737733][ T293] veth0_vlan: entered promiscuous mode [ 31.772017][ T293] veth1_macvtap: entered promiscuous mode [ 31.783297][ T295] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 31.825426][ T296] veth0_vlan: entered promiscuous mode [ 31.841942][ T317] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 31.865796][ T318] tipc: Started in network mode [ 31.872352][ T318] tipc: Node identity 427dc9f227f7, cluster identity 4711 [ 31.879675][ T318] tipc: Enabled bearer , priority 0 [ 31.894989][ T318] tipc: Disabling bearer [ 31.905817][ T296] veth1_macvtap: entered promiscuous mode [ 31.995004][ T332] overlayfs: failed to resolve './file0redirect_dir=follow': -2 [ 32.070675][ T342] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=io+mem:owns=io+mem [ 32.167198][ T350] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 32.358919][ T31] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 32.373363][ T311] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 32.520027][ T31] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 32.538893][ T311] usb 4-1: Using ep0 maxpacket: 8 [ 32.542295][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.546959][ T311] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 32.576420][ T311] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 32.586010][ T311] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 32.597415][ T311] usb 4-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 32.609219][ T311] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.617335][ T311] usb 4-1: Product: syz [ 32.629819][ T311] usb 4-1: Manufacturer: syz [ 32.634480][ T311] usb 4-1: SerialNumber: syz [ 32.765033][ T407] ======================================================= [ 32.765033][ T407] WARNING: The mand mount option has been deprecated and [ 32.765033][ T407] and is ignored by this kernel. Remove the mand [ 32.765033][ T407] option from the mount to silence this warning. [ 32.765033][ T407] ======================================================= [ 32.801539][ T31] cdc_acm 3-1:1.0: ttyACM0: USB ACM device [ 32.808114][ T407] No source specified [ 32.809030][ T9] usb 2-1: new low-speed USB device number 2 using dummy_hcd [ 32.999945][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 33.010883][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 33.017556][ T9] usb 2-1: New USB device found, idVendor=044f, idProduct=b605, bcdDevice= 0.00 [ 33.027104][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.036226][ T9] usb 2-1: config 0 descriptor?? [ 33.041740][ T392] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 33.057384][ T421] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.066281][ T421] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.075652][ T421] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.084334][ T421] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.093399][ T421] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.101984][ T421] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.123509][ T420] usb 3-1: USB disconnect, device number 2 [ 33.179039][ T10] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 33.275156][ T311] usb 4-1: clock source 0 is not valid, cannot use [ 33.329934][ T10] usb 1-1: config 0 has no interfaces? [ 33.335503][ T10] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 33.344616][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.353469][ T10] usb 1-1: config 0 descriptor?? [ 33.452422][ T423] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.454947][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.461804][ T423] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.475818][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.485771][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.493355][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.501509][ T311] usb 4-1: 1:1: cannot get freq (v2/v3): err -71 [ 33.507973][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.515678][ T311] usb 4-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 33.524488][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.535305][ T311] usb 4-1: USB disconnect, device number 2 [ 33.541332][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.551634][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.556758][ T348] udevd[348]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 33.559542][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.583321][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.590900][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.598495][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.616272][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.624060][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.633681][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.641372][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.649276][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.656840][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.664498][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.672087][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.679809][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.687292][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.695239][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.702861][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.710449][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.717980][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.725531][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.733099][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.740920][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.748421][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.756138][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.763679][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.771645][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.779190][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.786688][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.794279][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.801975][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.809579][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.817093][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.824611][ T9] thrustmaster 0003:044F:B605.0001: unknown main item tag 0x0 [ 33.833123][ T9] thrustmaster 0003:044F:B605.0001: hidraw0: USB HID v0.01 Device [HID 044f:b605] on usb-dummy_hcd.1-1/input0 [ 33.844853][ T9] thrustmaster 0003:044F:B605.0001: no inputs found [ 33.845260][ T419] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.856780][ T9] usb 2-1: USB disconnect, device number 2 [ 33.869035][ T419] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.881918][ T10] usb 1-1: USB disconnect, device number 2 [ 33.920149][ T424] fido_id[424]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 33.922002][ T429] ------------[ cut here ]------------ [ 33.939885][ T429] failed to allocate ring buffer on CPU 1 [ 33.947742][ T429] WARNING: CPU: 0 PID: 429 at kernel/trace/ring_buffer.c:7702 trace_rb_cpu_prepare+0x2c2/0x2f0 [ 33.958211][ T429] Modules linked in: [ 33.962202][ T429] CPU: 0 UID: 0 PID: 429 Comm: syz.2.19 Not tainted syzkaller #0 119f1c0cd44458c2ddc7f806e6d4d2dd11ae7dae [ 33.973582][ T429] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 33.983747][ T429] RIP: 0010:trace_rb_cpu_prepare+0x2c2/0x2f0 [ 33.989915][ T429] Code: 31 c0 48 83 c4 38 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 0d df fc ff 48 c7 c7 e0 b1 2f 86 8b 75 d4 e8 2e b7 79 ff <0f> 0b b8 f4 ff ff ff eb cf e8 f0 de fc ff e9 33 ff ff ff 66 2e 0f [ 34.009657][ T429] RSP: 0018:ffffc9000d9e7848 EFLAGS: 00010246 [ 34.015794][ T429] RAX: 856ac25cd50abc00 RBX: ffff8881154b2010 RCX: ffff888115bb8000 [ 34.023870][ T429] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 [ 34.032002][ T429] RBP: ffffc9000d9e78a8 R08: ffff8881f6e294d3 R09: 1ffff1103edc529a [ 34.040036][ T429] R10: dffffc0000000000 R11: ffffed103edc529b R12: 0000000000000000 [ 34.048032][ T429] R13: ffff88811576aa88 R14: ffff88811576aa88 R15: ffff8881154b2050 [ 34.056067][ T429] FS: 00007f623cf7e6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 34.065229][ T429] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 34.071893][ T429] CR2: 00007f623abf7d58 CR3: 0000000114b50000 CR4: 00000000003526b0 [ 34.080505][ T429] Call Trace: [ 34.083821][ T429] [ 34.086783][ T429] cpuhp_invoke_callback+0x699/0xf90 [ 34.092173][ T429] ? __cfi_trace_rb_cpu_prepare+0x10/0x10 [ 34.097935][ T429] cpuhp_issue_call+0x3c4/0x710 [ 34.102852][ T429] ? mutex_lock+0x97/0x1d0 [ 34.107321][ T429] ? __cfi_mutex_lock+0x10/0x10 [ 34.112268][ T429] ? __kasan_kmalloc+0x96/0xb0 [ 34.117066][ T429] __cpuhp_state_add_instance_cpuslocked+0x178/0x470 [ 34.123812][ T429] __cpuhp_state_add_instance+0xbf/0x190 [ 34.129519][ T429] alloc_buffer+0x14f3/0x1aa0 [ 34.134213][ T429] __ring_buffer_alloc+0x61/0x120 [ 34.139286][ T429] ? allocate_trace_buffers+0x2ac/0xb40 [ 34.144880][ T429] allocate_trace_buffers+0x2cc/0xb40 [ 34.150340][ T429] ? __kmalloc_node_track_caller_noprof+0x24e/0x4f0 [ 34.157048][ T429] ? tracing_release_options+0x110/0x110 [ 34.162741][ T429] ? __asan_memcpy+0x5a/0x80 [ 34.167372][ T429] ? kstrdup+0x7b/0x130 [ 34.171662][ T429] trace_array_create_systems+0x385/0xe80 [ 34.177427][ T429] instance_mkdir+0xde/0x130 [ 34.182108][ T429] tracefs_syscall_mkdir+0xa7/0xe0 [ 34.187260][ T429] vfs_mkdir+0x591/0x810 [ 34.191599][ T429] do_mkdirat+0x240/0x530 [ 34.196075][ T429] ? __cfi_do_mkdirat+0x10/0x10 [ 34.201022][ T429] ? __kasan_check_write+0x18/0x20 [ 34.206196][ T429] ? getname_flags+0x203/0x6b0 [ 34.211044][ T429] ? __kasan_check_write+0x18/0x20 [ 34.216191][ T429] __x64_sys_mkdirat+0x8b/0xa0 [ 34.221023][ T429] x64_sys_call+0x2ba8/0x2ee0 [ 34.225732][ T429] do_syscall_64+0x57/0xf0 [ 34.230222][ T429] ? clear_bhb_loop+0x50/0xa0 [ 34.234961][ T429] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 34.240920][ T429] RIP: 0033:0x7f623c19e0d9 [ 34.245362][ T429] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.265044][ T429] RSP: 002b:00007f623cf7e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 34.273536][ T429] RAX: ffffffffffffffda RBX: 00007f623c426090 RCX: 00007f623c19e0d9 [ 34.281582][ T429] RDX: 00000000000001ff RSI: 0000200000000140 RDI: ffffffffffffff9c [ 34.289627][ T429] RBP: 00007f623c235024 R08: 0000000000000000 R09: 0000000000000000 [ 34.297626][ T429] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 34.305684][ T429] R13: 00007f623c426128 R14: 00007f623c426090 R15: 00007ffc9afdc5b8 [ 34.313737][ T429] [ 34.316768][ T429] ---[ end trace 0000000000000000 ]--- [ 34.420312][ T36] kauditd_printk_skb: 105 callbacks suppressed [ 34.420351][ T36] audit: type=1400 audit(1786944442.580:179): avc: denied { unmount } for pid=296 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1