last executing test programs: 5.215475806s ago: executing program 3 (id=17): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000280)={0xa, 0x2, 0x0, @empty}, 0x1c) listen(r0, 0x2) accept4(r0, &(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @empty}, &(0x7f00000000c0)=0x80, 0x80000) 4.373554247s ago: executing program 3 (id=29): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_buf(r0, 0x0, 0x20, 0x0, 0x0) 4.319055889s ago: executing program 3 (id=30): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) (async) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x40980, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) (async) ioctl$TCFLSH(r1, 0x400455cb, 0x1f) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) (async) r4 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$KDFONTOP_GET(r4, 0x4b72, &(0x7f0000000040)={0x1, 0x1, 0x1d, 0xc, 0x151, &(0x7f0000000880)}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) (async) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) (async) syz_usb_control_io$hid(r5, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000"], 0x0}, 0x0) (async) r6 = syz_open_procfs(0x0, &(0x7f0000000100)='net/xfrm_stat\x00') ftruncate(r6, 0x3119c976) r7 = syz_open_dev$hiddev(&(0x7f0000000540), 0x3, 0x3) ppoll(&(0x7f0000000480)=[{r7, 0x10}], 0x1, &(0x7f00000004c0), 0x0, 0x0) write$tun(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="0a009100ffffffffffffaaa2aaaaaaaa74dd694fd2cd00c83a00fe8000000000000000800000000000bbff0200000000000000000000000000010300907802000000620000ef00092ffffe8000080000000000000000000000aafc01000000000000000000000000000016110000001600000b878a8bd4c5ad5703b712c63ac2f8206d5b5c5c37d364f835247dcdbccbb594d123b9683d87fb7fa16a054b11e106b35d1b322aa0017ffdef0f04de33be1aec47f5c43396006c7c67da4730d5bfdc0d4a1a975017a80eadd3244bd4bdc446fcdbd26e17907a90cbe4b7d5d252e75cd32cc11815b20a61d63e97cb2417c46c165c863fe1f9a1609f00000000000000ea012c36e0c262e69ef955dc03d600"], 0x102) 2.847002331s ago: executing program 3 (id=33): mount(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='incremental-fs\x00', 0x220089a, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x20003, 0x8) 2.845807581s ago: executing program 3 (id=34): r0 = syz_usb_connect$midi(0x0, 0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010002000000108c0d0201400001020301090212000101056001090400000001032002ed1cb268778cfb60780da7c24c1495472fcbd75afec0364d9eb82536467eb5e24ad259a9b3f6aca2a056c2d0e25ed1390cb3efb94645b9fca436ab6fc9aee460f7039635c95757c85930fe4e3ac4a9c19126a4c35925e8aeada79ad81caf4feb2acdf40ca017d62b8a6b8314ef77e636ec597e9e85d5ebc6d0f7ee3e6484311d099e58a3a328f7773068138b04089f39e80cb193afa94c8c50e61c1bb0631c54866a6657b42cee9157dcced8518ec7a23ce24ead668265aa7fc980b480164b179e9f1df47175"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000380)={0x24, 0x0, &(0x7f0000000280)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000180)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_control_io(r0, &(0x7f0000000240)={0x2c, 0x0, &(0x7f00000000c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x3401}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000140)={0x14, &(0x7f0000000040)={0x20, 0x25, 0x2f, {0x2f, 0x8, "b4acb06de93f80c17183862c6b51d17995f9bf99497a31d5587035f46ade457c086f8500e9db067302a9120caf"}}, 0x0}, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) 1.893746628s ago: executing program 0 (id=39): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r1, 0x107, 0x7, 0x0, 0x0) ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000240)={{0x2, 0x4a24, @initdev={0xac, 0x1e, 0xfe, 0x0}}, {0x0, @broadcast}, 0xa, {0x2, 0x4e28, @rand_addr=0x64010100}, 'veth1_macvtap\x00'}) syz_usb_connect(0x2, 0x32, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000083ef0840e07d6e67db7700000003090220000100ac31000904000000ef"], 0x0) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000)={0x1, 0x10}, 0x8) 1.831185721s ago: executing program 1 (id=40): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) (async) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f00000005c0), 0x2010800, 0x0) (async) mount$binderfs(0x0, &(0x7f0000000080)='./binderfs\x00', 0x0, 0x2010860, &(0x7f0000000200)=ANY=[@ANYBLOB="636f6e746578743d7379737465225f75dd47d0b90b893a03ffdf"]) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) futex(0x0, 0xb, 0x2, &(0x7f00000001c0), &(0x7f0000000100)=0x1, 0x2) (async) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) (async) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) 1.728146806s ago: executing program 1 (id=41): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x21c0, 0x103) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) renameat2(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./file7\x00', 0x0) socket(0x21, 0x1, 0x100) r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000040f30455070000000000010902240001000040b10904000001030001000921010100012205000905810344d58fb142c296c520a37bf13d86f0"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000340)={0x2c, &(0x7f0000000700)=ANY=[@ANYBLOB=' \n\a'], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_usb_connect$hid(0x5, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000400620180100000000000109022400010000000009040000010300000009210000000122070009058103"], 0x0) syz_usb_connect$cdc_ecm(0x6, 0x9e, &(0x7f0000000480)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x8c, 0x1, 0x1, 0x8, 0x70, 0x0, "", [{{0x9, 0x4, 0x0, 0x1, 0x2, 0x2, 0x6, 0x0, 0xd, {{0x5}, {0x5, 0x24, 0x0, 0x1}, {0xd, 0x24, 0xf, 0x1, 0x7, 0x7, 0x9, 0x7f}, [@country_functional={0xe, 0x24, 0x7, 0x8, 0x9, [0x19c9, 0x4, 0x4, 0x1]}, @mdlm={0x15, 0x24, 0x12, 0x5484}, @country_functional={0x12, 0x24, 0x7, 0xd, 0xffc0, [0x5, 0x5, 0x7f2, 0x7, 0x8, 0x100]}, @country_functional={0xe, 0x24, 0x7, 0x5, 0x8, [0x3, 0x101, 0x2, 0xb5d1]}, @obex={0x5, 0x24, 0x15, 0x4}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x200, 0x1, 0x2, 0xeb}}], {{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x4c, 0x8, 0x5}}, {{0x9, 0x5, 0x3, 0x2, 0x8, 0x8, 0xfc}}}}}]}}]}}, &(0x7f0000000680)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x0, 0xa, 0x81, 0x1, 0x40, 0xf3}, 0x1a, &(0x7f0000000240)={0x5, 0xf, 0x1a, 0x2, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x0, 0xa4, 0x6}, @wireless={0xb, 0x10, 0x1, 0x8, 0x20, 0x1, 0x15, 0x5, 0x9}]}}) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$rtl8150(r1, &(0x7f0000000080)={0x14, &(0x7f0000000100)={0x0, 0xb, 0xdb, {0xdb, 0xc, "7f7f9b57b4f40ef9dc33ce8da06310452b0b0c79e8aea737a1942f7c4ecd9aa962ed3b2c4aa2aed99d2dce4e6dab39a1891ac891347d6bdc8a16bc5ccc66947db14bac74740e4ab639e90b48aa2202aff9f0e7b07d1cd09cd3761f6931efd7a79b6c132a051afb9e1d75f1c4a5630079cd6781ed07c86705a9e0d509a14545af3c748c9385789a09ee9a996d9ff1809f2119120c3a3d93738fb3ed815db6c3a9af13c3892c92be4022fbc65d03fcf3f851b806405d82c4b160faa33635654d400c3a9173d8ea36b9313a77e42a9ec130505160f0e3f5f737a9"}}, &(0x7f0000000740)=ANY=[@ANYBLOB="0400120000000000000000000000000000f955f44310dda9c434f3140531b3181adac94eafe7e8a430700b87c06225c233caaff5c22e3fdbdffb9a092080345e021b91aa7d3585770147bf965b7acbce1879ec21e80983dba6ca76c0225559a3861a89cb2f38d74396f91d8060a93062bdb67cd0865cc1a8c87d0e1d51aa707a028490cb2d6ea75260a7f78b35debdf13313a8035995ddfb5ae7660a555967e1da"]}, &(0x7f0000000440)={0x2c, &(0x7f0000000280)={0x20, 0x3, 0xcd, "acff217778e441315fb8130c25034f3f76fe10ad3e04859c4380d3aecbbd3536d7f675a1de774b5f222bdd748221a51a9cd0a0a2e87bb55f82b838fd8f9a7113d8acae81d3375e4b6510b7a41b073d5c062871ac3c5ae6b576da5fdbb36942786d60c4db699bab559788c0e7ee8cdcbe3692ba6a6897e66df05659978df5d1a1f6e60cb2b7dbf70fbf8206d9e894c9baf15d229d9e64ab0b84b9bb6be53e8353a8408a1be29896c297bd46e46d5d75fdf2cd57f261826520e4078ddf8c6a5340c25b8a3e29d502958beb2d636c"}, &(0x7f00000006c0)={0x0, 0xa, 0x1}, &(0x7f0000000380)={0x0, 0x8, 0x1, 0x6}, &(0x7f00000003c0)=ANY=[@ANYBLOB="c00502000000d5b5"], 0x0}) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x81, 0x0) 1.383200832s ago: executing program 2 (id=42): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b6c, &(0x7f00000000c0)={0x12c, 0x8, &(0x7f00000005c0)="8ffe7843b6ab149f249ff5eb671b1c60d2bb037a39967d7aab81a210fd53611acd465b8c6413ca437d06fef2e6afe5898419e142c1aee5de95e61956fc1b6dec81f826cce56538e13363650e03eeb9294df5af43b488a3b850c7b766d6f156d2456c40d15e52363d17700804763b2081b5c77933d448f7f872126264be8d915f659b31f8af48c74f8648f0620dd8272ff99b868b5e2c22e84c20079bd45d615faad02985141727dbe420caabbb73ad31efffa6902103532e90907ca91dde7d2e5248367d74d6049049782d6211fc9ee19f3ec3749bc737eb56f42695a410bdba48b498fd600ac856de4a6bc55aa81641618ae7f6a51975e2fe50c0cec549a667b9ca72d3decf90a3c8ff527032b32b8b4ee50e6680ee73057c48bca1c9a357ff84b59855797d91c4e261a5c8c1eec3a5f2d72a03cc7578b35c5d45c162fde9a22dc2a67480b4ead8280984e1934b7df64f043191b7c509fca60b456e54eb3d84536f4cb1ad91eda04e1959034896ed22dbf45682ec335b6ea1472d88f088a9822320ac59eb3546c2bf9cb0d8e93cf2490c0cc490e24721e688fc05a1f0f216c33e78192631a257c50a4b380a781e1a8677787c83d5d5c958c7bd894993667be5c81e63b129877a7b9b67c0926539b2c629cc33c41866bc1716b06de482cb1d75560dd369c096f1b455827fbe60f61099a5b8ff61d8f17b81c0fede48658a1aab4032d765987bda6408f1373dac1e9c38c56fa1aa28cdbcdd85fc99b48cad02083ba4ff0c595272b5d02eac2a463baf2c5079ccae171cabb3731ecf755dd00b05453ec198926485b4d463073b2063944762c47f6a483119ae45c3e58689b5a00cf5c847e83ccb642d9b9cf6ad89714b104056ea85482b0b9921f1295756a9b1ba693680bb95b777d9759f3a1337d6122e9c04636d08d014dca9d9f3adf45628734232d8a9f61b295549ed0b0890a91c63b9eebccdaed55ba78cc2b20ffccff160f2b84adad50c13e0c8d0c10084b4e731ad425237f92180ed8dfdcc7e1ff69817615ac5e30ce0b5426007127bbdaafa1611dc993295e37f3dd45d1d531cc255ba6ace3e1378ffcc5fa28aaa99bb13bc0aabe7c2f868eba96bf5859a541b294cee80fbed16812d5d0655b25eabb02b8fa146fe199ad4913ec9a9f6c3503a03f6f8e1e8772cb9df738afedfe32a1d73116d902d3466b2074684059431cd85c6cb4d11d5975e3ad9d4e1ad9734183ab441eff1032fc8d7afd1e075583dbf51e070cfc5d9ab6303d9efeefbc7b9eb451a4fa49193394d300d6ad336ba609c1020783ff04278e321f3a93ce52dba86f8724d787874c38f6e0017cf608f5c5ff3cd2e6fd2059f6a5f9c75aac0e6c5faa6e9f1cc54493a370e317bb428f558b2892e370b52599c3d6c40e33f8a3ed6b5bb1140a52325eba72a2ec63e3e65a8026ed36d39"}) r2 = syz_kvm_add_vcpu$x86(r1, &(0x7f0000000280)={0x0, &(0x7f0000000080)=[@cpuid={0x64, 0x18, {0xfffffffc, 0x8000}}], 0x18}) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000140)={0x2, 0x0, [{0x0, 0xffff0002, 0x4, 0xd, 0x4, 0x3, 0x80}, {0xc0000000, 0x9, 0x3, 0xdd9, 0x2, 0x6, 0xc867}]}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(r4, 0x4068aea3, &(0x7f0000000000)={0xa8, 0x0, 0x3}) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x3d70000000, &(0x7f0000ffe000/0x2000)=nil}) r5 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r5, &(0x7f0000000000), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) bind$can_raw(r5, &(0x7f00000001c0)={0x1d, r6}, 0x10) r7 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r9 = openat$cgroup_netprio_ifpriomap(r8, &(0x7f0000000240), 0x2, 0x0) read(r9, &(0x7f00000004c0)=""/4096, 0x1000) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000100)={r7, 0x1, 0x5, 0x9}) accept$packet(r11, 0x0, &(0x7f00000009c0)) ioctl$KVM_CREATE_VM(r10, 0xae03, 0x24) ioctl$KVM_CLEAR_DIRTY_LOG(r4, 0xc018aec0, &(0x7f0000000140)={0x0, 0x240, 0x180, &(0x7f0000000180)=[0x6bd1a312, 0xec66, 0xff, 0x8, 0x98bd, 0x80000000000000c, 0x0, 0x4, 0x10000, 0x466c, 0x9004, 0x9, 0x8, 0x9, 0x5, 0x49, 0x3, 0x5, 0x2, 0x1, 0x8, 0x7, 0xc1, 0x1, 0x2, 0xffffffffffffffff, 0xa, 0x7f, 0x96, 0xffffffff, 0x9, 0x0, 0x5, 0x7, 0x4, 0x3, 0x9, 0x8891, 0x1, 0x6, 0xf, 0x0, 0x3, 0xa3e2, 0x2cc0000000000000, 0x8, 0x5, 0x400, 0x6, 0xffffffffffffffb7, 0xfffffffffffffffa, 0x2, 0x1, 0x6, 0x4, 0xe6, 0x200000000000101, 0x5, 0x9, 0x66, 0x6, 0x7, 0x40000005, 0xfffffffeffffffff, 0x9, 0xd, 0x10001, 0xbbd9, 0x80000000, 0xfffffffffffffc00, 0x2, 0x7, 0x5e7, 0xcdc, 0x4000000007, 0x2, 0x3, 0x2, 0x2, 0xfff, 0x6, 0x4, 0x1, 0xab6, 0x100, 0x4, 0x0, 0xffffffffffffff81, 0x9, 0xff, 0x6, 0x28000000, 0x80000005, 0x8061d, 0x0, 0x7, 0xf6, 0x4, 0x6, 0x204, 0x7, 0xe53e, 0x4, 0x8, 0x2293332f, 0x6, 0x5, 0x1e, 0xd, 0x2, 0x4, 0xfffffffffffffffb, 0x80000001, 0x7, 0xdfd4, 0xfff9, 0x10, 0x40000000000005, 0x8, 0x1, 0x53e0f0fe, 0xeb4, 0x3, 0xfffffffffffffffe, 0xb68e, 0xcc, 0x8, 0x1000003]}) r12 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r13 = ioctl$KVM_CREATE_VM(r12, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r13, 0xae60) ioctl$KVM_CREATE_PIT2(r13, 0x4040ae77, &(0x7f0000000180)={0x1}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r13, &(0x7f0000002000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000040)="0f01cb650f741065666765f36f0f330f09660f3a0cb9000000752066b9800000c00f326635004000000f300f01d7ba4100ed", 0x32}], 0x1, 0x4498bda7e2139f51, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(r13, 0xae41, 0x0) ioctl$KVM_SET_PIT(r13, 0x8048ae66, &(0x7f0000000240)={[{0x2, 0x5, 0x9b, 0x1, 0x0, 0x5f, 0x3, 0x20, 0xa6, 0x2, 0x5, 0x9, 0x3}, {0xfffffff9, 0xfffa, 0x0, 0x0, 0x0, 0x2, 0xce, 0x0, 0x4, 0xff, 0x4, 0x0, 0x800000000000000}, {0xffffff01, 0x35, 0x0, 0x0, 0x4, 0x1, 0x7, 0xfe, 0x7, 0x8, 0x7e, 0x4, 0x1000000000000004}], 0xcc78}) 1.071352568s ago: executing program 2 (id=43): ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0xfffffffffffffffe, 0x400, 0x5da88e8f, 0x180, 0x3, 0x10, 0xf1, 0x0, 0x7fffffffffffe, 0x5, 0x0, 0x9, 0xfffffffffffffffc, 0x5, 0xfffffffffffffffe, 0x7], 0x1, 0x38c210}) writev(0xffffffffffffffff, &(0x7f00000003c0)=[{&(0x7f0000000080)="f36b4e96df5d3a7c5469b7868c00000080000000007a2db044da73248f00000000000000000049", 0x27}], 0x1) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000e40)={0x30, 0x5, 0x0, {0x0, 0x7f, 0xfff}}, 0x30) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_buf(r1, 0x0, 0x40, &(0x7f0000000080)="8c5d7b87b32ecae06ac8cfe890364ab911d8c33439477a7591f6914e91c6821ee7163f8ae1896184d48797997716158aad89f66dd67480ce8ff178ef748cfcdcf54127d5ff95cbcaebf10a3b7cddafa2c0fa6aa2eaef0d457680203c02d0c623", 0x67) 1.0149604s ago: executing program 2 (id=44): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = socket$netlink(0x10, 0x3, 0x0) mount$binderfs(0x0, &(0x7f0000000100)='./binderfs\x00', 0x0, 0x5c04c, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="280000001c00010000000200ffdbdf2507000000080000000400001e0a0002"], 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x0) close(0x3) r2 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$sock_int(r0, 0x1, 0x20, &(0x7f0000001740)=0x7ffffffd, 0x4) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) connect$bt_sco(r3, &(0x7f0000000280), 0x8) r4 = socket$netlink(0x10, 0x3, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r5, 0x8923, &(0x7f00000000c0)={'bond_slave_0\x00', @random="013105b310fe"}) sendmsg$netlink(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000300)=ANY=[@ANYBLOB="300000002400df1e02000000fadbdf25000000001000000000000800", @ANYRES32], 0x30}], 0x1}, 0x0) fcntl$F_GET_FILE_RW_HINT(r4, 0x40d, &(0x7f00000001c0)) connect$netlink(r2, &(0x7f0000000140)=@kern={0x10, 0x0, 0x0, 0x4000000}, 0xc) write$binfmt_script(r0, 0x0, 0x6f4000) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r6, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000001400000060ec97000fc81100fe800000"], 0xffe) 978.251502ms ago: executing program 2 (id=45): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x800, 0x0) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000340)='.\x00', 0x400007f) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000140)={0x0, 0x0, 0xe82c, 0x0, 0x209}) r2 = openat$urandom(0xffffffffffffff9c, &(0x7f0000005180), 0x0, 0x0) ioctl$RNDGETENTCNT(r2, 0x5207, 0x0) openat(r0, &(0x7f0000000100)='.\x00', 0x515401, 0x408) mkdirat(r0, &(0x7f0000000000)='./file0\x00', 0x140) 967.542883ms ago: executing program 2 (id=46): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="020300021000000000000000040000000200080008000000a30000000000000005000600000000000a00000000000000ff01000000000000000000000000000100000000000000000200010000000000070009fffb00004005000500003000000a"], 0x80}, 0x1, 0x7}, 0x0) socket$nl_route(0x10, 0x3, 0x0) 910.998055ms ago: executing program 2 (id=47): arch_prctl$ARCH_GET_CPUID(0x1011) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000401e04012800000000000109022400010000000009040100010300000009210000000122070009058103"], 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) arch_prctl$ARCH_GET_CPUID(0x1011) writev(r1, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190028000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) arch_prctl$ARCH_GET_CPUID(0x1011) syz_usb_control_io$hid(r0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) r3 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$selinux_access(r3, &(0x7f0000000200)=ANY=[@ANYBLOB="7379737465ed49d56cbce51aa5b52e23d9fe3c386d5f753a6f626a6563745f723a6661696c6c6f675f743a7330202f7573722f7362686e2f6e7470642030"], 0x43) getrandom(&(0x7f0000000580)=""/265, 0xffffff3f, 0x3) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) r4 = syz_open_procfs$pagemap(0x0, &(0x7f00000001c0)) ioctl$PAGEMAP_SCAN(r4, 0xc0606610, &(0x7f00000004c0)={0x60, 0x0, &(0x7f0000165000/0x4000)=nil, &(0x7f000075c000/0x3000)=nil, 0x9, 0x0, 0x0, 0x8000e5, 0x0, 0x0, 0x4, 0xe4}) r5 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r5, &(0x7f0000000380)={&(0x7f0000000280)=@id={0x1e, 0x3, 0x3, {0x4e21}}, 0x10, &(0x7f0000000340)=[{&(0x7f0000000580)="bfa5309bfa49", 0x6}], 0x1, 0x0, 0x0, 0x4c000}, 0x20008048) r6 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x56a, 0x18, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x5, 0x90, 0x5, "", [{{0x9, 0x4, 0x0, 0x60, 0x2, 0x3, 0x1, 0x2, 0x1, {0x9, 0x21, 0x3, 0xde, 0x1, {0x22, 0x139}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0xc, 0xf2}}, [{{0x9, 0x5, 0x2, 0x3, 0x3ff, 0xc, 0x7, 0x4}}]}}}]}}]}}, &(0x7f0000000200)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x200, 0xe6, 0x5a, 0x2, 0x40, 0x8}, 0x3a, &(0x7f0000000080)={0x5, 0xf, 0x3a, 0x4, [@ssp_cap={0x14, 0x10, 0xa, 0x0, 0x2, 0x7, 0xf000, 0xe, [0x11, 0xff0000]}, @ssp_cap={0x14, 0x10, 0xa, 0x36, 0x2, 0x4, 0xf000, 0x726, [0xff3f60, 0xff00f0]}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x1, 0xa, 0x401}, @ptm_cap={0x3}]}, 0x1, [{0x9, &(0x7f0000000180)=@string={0x9, 0x3, "dc7c3d2e109c0c"}}]}) syz_usb_control_io$hid(r6, &(0x7f00000001c0)={0x24, &(0x7f0000000100)={0x40, 0x21, 0x55, {0x55, 0xa, "2cece303010000008819661e04000000bf070000a51bf9d8f45d2d90de9100792b36d2d40bdfcd4e9a1dcbdfa05c534f61293fc9eab99b85c98cc5cdc5859ffa36101b6905b9fb0468756774ad33837fb36525"}}, 0x0, 0x0, 0x0}, 0x0) 660.239707ms ago: executing program 3 (id=48): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000280)={0xa, 0x2, 0x0, @empty}, 0x1c) listen(r0, 0x2) accept4(r0, &(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @empty}, &(0x7f00000000c0)=0x80, 0x80000) 482.146406ms ago: executing program 0 (id=49): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x17, &(0x7f0000000200)=0x22, 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000000, 0x40010, 0xffffffffffffffff, 0x6a855000) r1 = landlock_create_ruleset(&(0x7f0000000240)={0x1fff}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGSKNS(r2, 0x894c, 0x0) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x4e22, @rand_addr=0x64010102}, 0x10) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, &(0x7f0000000b40)='./file7\x00') r3 = socket$xdp(0x2c, 0x3, 0x0) symlink(&(0x7f0000000040)='.\x00', &(0x7f0000000100)='./file0\x00') r4 = landlock_create_ruleset(&(0x7f0000000140)={0x4000}, 0x18, 0x0) landlock_restrict_self(r4, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file7\x00', 0x40000, 0x0) mkdirat(r5, &(0x7f0000000280)='.\x02\x00', 0x102) renameat2(0xffffffffffffff9c, &(0x7f0000000100)='.\x02\x00', r5, &(0x7f0000000000)='./file0\x00', 0x2) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/48, 0x304000, 0x800, 0x1}, 0x20) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) setxattr$incfs_size(&(0x7f0000000040)='./file7\x00', &(0x7f0000000080), &(0x7f00000000c0)=0x10, 0x8, 0x0) 411.21496ms ago: executing program 0 (id=50): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r1, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r1, 0x4138ae84, &(0x7f0000000340)={{0x1, 0x2000, 0x10, 0xad, 0x3, 0x4, 0x7f, 0x5, 0x0, 0x2b, 0x89}, {0x2, 0x2, 0xf, 0x2e, 0x8, 0x0, 0x7f, 0x3, 0x3, 0xb0, 0x9}, {0x2, 0x5000, 0x8, 0x8, 0x1, 0x2, 0x0, 0xb, 0x3, 0x5, 0xb, 0x9}, {0xdddd0000, 0xffff1000, 0x0, 0xe7, 0x2, 0x2, 0x1, 0x86, 0x7, 0x8b, 0xc, 0xed}, {0x4, 0x25000, 0xd, 0x3, 0x5, 0x86, 0x9, 0x80, 0xa, 0x0, 0xf2, 0x8}, {0x70000, 0x6000, 0xb, 0x7c, 0xb1, 0x24, 0x7b, 0x4, 0x83, 0xc, 0x8, 0x3d}, {0x50000, 0x40000, 0x0, 0x2, 0x7, 0x5, 0x1, 0x3, 0x5, 0x7f, 0x5}, {0x5000, 0xffff1000, 0x5, 0x5, 0x9, 0xf, 0x3, 0x37, 0x0, 0x4, 0xf0}, {0x200000, 0x2070}, {0x4000, 0x7}, 0x80000033, 0x0, 0xeeef0000, 0x2104, 0x4, 0x0, 0x80a0000, [0x4, 0x7, 0x9, 0x9]}) ioctl$KVM_RUN(r1, 0xae80, 0x0) 410.3736ms ago: executing program 0 (id=51): mprotect(&(0x7f0000ff2000/0xd000)=nil, 0xd000, 0x2000004) (async) r0 = socket$inet(0x2, 0x80000, 0x6) getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000000)={@broadcast, @private, 0x0}, &(0x7f0000000040)=0xc) r2 = dup2(r0, r0) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/pm_trace', 0x400, 0x1) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f00000000c0)={0x645, 0x2, 0x3, 0x1}, 0x14) (async) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r0, 0x89f9, &(0x7f0000000140)={'sit0\x00', &(0x7f0000000100)={@mcast2, @loopback, 0x1a, 0x17}}) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r2, 0xae04) mmap$KVM_VCPU(&(0x7f0000ffe000/0x1000)=nil, r4, 0x4, 0x10, r3, 0x0) (async) r5 = syz_clone3(&(0x7f0000000440)={0x10800, &(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000000200), {0x1e}, &(0x7f0000000240)=""/150, 0x96, &(0x7f0000000300)=""/193, &(0x7f0000000400)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x3, {r2}}, 0x58) r6 = syz_open_procfs(r5, &(0x7f00000004c0)='attr\x00') (async) recvfrom$packet(r3, &(0x7f0000000500)=""/199, 0xc7, 0x40000000, &(0x7f0000000600)={0x11, 0x8, r1, 0x1, 0xe, 0x6, @multicast}, 0x14) readlinkat(r2, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)=""/4096, 0x1000) (async) bind$inet6(r2, &(0x7f0000001680)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x4}, 0x1c) (async) ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000016c0)=0x5) (async) ioctl$VFAT_IOCTL_READDIR_SHORT(r2, 0x82307202, &(0x7f0000001700)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) (async) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000001940)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f0000001980)=@abs={0x0, 0x0, 0x4e24}, 0x6e) (async) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000001a40)={0x2, &(0x7f0000001a00)=[{0x81, 0x7, 0x7, 0x7}, {0x4, 0x7, 0x3, 0x6}]}, 0x10) (async) lsetxattr$trusted_overlay_redirect(&(0x7f0000001a80)='./file0\x00', &(0x7f0000001ac0), &(0x7f0000001b00)='./file0\x00', 0x8, 0x1) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000001b40)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) (async) ioctl$VFAT_IOCTL_READDIR_BOTH(r3, 0x82307201, &(0x7f0000001b80)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) (async) getresgid(&(0x7f0000001dc0)=0x0, &(0x7f0000001e00)=0x0, &(0x7f0000001e40)=0x0) setgid(r9) (async) read$FUSE(r6, &(0x7f0000001e80)={0x2020, 0x0, 0x0}, 0x2020) r12 = geteuid() (async) getresuid(&(0x7f0000003ec0), &(0x7f0000003f00), &(0x7f0000003f40)=0x0) (async) statx(r2, &(0x7f0000003f80)='./file0\x00', 0x4000, 0x400, &(0x7f0000003fc0)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f00000040c0)='./file0\x00', &(0x7f0000004100)={0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_DIRENTPLUS(r3, &(0x7f0000004180)={0x288, 0x0, r11, [{{0x2, 0x3, 0xb, 0xcd6, 0x6, 0x1, {0x4, 0xffffffffffffffff, 0x9, 0x40, 0x2, 0x0, 0x1, 0x1e3e, 0x1ffe, 0xa000, 0xff, r12, r9, 0x31b474b0, 0x4}}, {0x3, 0x7, 0x5, 0x40, 'attr\x00'}}, {{0x3, 0x2, 0x6, 0x10000, 0x0, 0xdfbc, {0x6, 0x8, 0x6, 0x4, 0x1, 0xb, 0xe, 0x80000001, 0x47c, 0x4000, 0x1ff, r13, r9, 0x9, 0x10000}}, {0x0, 0x0, 0x5, 0x5, 'sit0\x00'}}, {{0x5, 0x1, 0x4, 0x5, 0x2, 0x5, {0x5, 0x100000001, 0x61a7, 0x8000, 0x7, 0xb8f1, 0x200, 0x200, 0x6, 0x8000, 0x7f, r14, r8, 0x3, 0x7}}, {0x0, 0xffffffff, 0x0, 0x2604fedb}}, {{0x2, 0x2, 0x81, 0x5, 0x1, 0xfe, {0x1, 0x2, 0x7, 0x8, 0x3, 0x9, 0x0, 0x7fff, 0x0, 0x0, 0xef62, r15, r10, 0x8, 0x9}}, {0x5, 0xb3d4, 0x1, 0x4, '\x00'}}]}, 0x288) 410.18207ms ago: executing program 0 (id=52): getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000100)={@local, 0x9, 0x1, 0x3, 0x2, 0x1}, 0x0) r0 = dup(0xffffffffffffffff) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000200)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$XFS_IOC_GETBMAPX(r1, 0xc0205838, &(0x7f0000000000)={0x0, 0x800, 0x0, 0x6, 0x3, 0x10, 0x7}) io_setup(0x3ff, &(0x7f0000000500)=0x0) io_submit(r3, 0x1, &(0x7f0000000300)=[&(0x7f0000002240)={0x0, 0x0, 0x8, 0x0, 0x0, r2, 0x0, 0x0, 0x3d95}]) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000400)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000340)={0xc0, 0x0, 0x1, 0x801, 0x0, 0x0, {0x0, 0x0, 0x9}, [@CTA_SYNPROXY={0x1c, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x1}, @CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0xfffffff9}, @CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x380000}]}, @CTA_FILTER={0x2c, 0x19, 0x0, 0x1, [@CTA_FILTER_REPLY_FLAGS={0x8}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x2}, @CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0xe00}, @CTA_FILTER_REPLY_FLAGS={0x8}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x800}]}, @CTA_TUPLE_REPLY={0x64, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @private0}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x20000000}, 0x1) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r4, 0x400452c8, &(0x7f0000000100)) 343.280053ms ago: executing program 0 (id=53): r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @local}, r1}, 0x14) ioctl$ASHMEM_GET_PROT_MASK(r0, 0x7706, &(0x7f00000000c0)) ioctl$PPPIOCATTCHAN(r0, 0x40047438, &(0x7f0000000100)=0x3) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e23, 0xff, @empty, 0x5}, 0x1c) sendto$inet6(r0, &(0x7f0000000180)="c24589baea28c5001d68ccc064dfdd1235c50088606509b2b6e861f12c889d59eae198ab2fc13f9b5b0e7c34606712ad3bf88afcc792703d0d022873d071080e3419fc2e7fa63fff5a0984f70a8e38328d2014cf4a8f94fdc2116c77b119a8199f501163020a81fb8ada728a7ce8987070bc9a1cb83687db1194cec7589e008f6d55437949de1121", 0x88, 0x4, &(0x7f0000000240)={0xa, 0x4e20, 0x10000, @dev={0xfe, 0x80, '\x00', 0x14}, 0x5}, 0x1c) syz_usb_connect(0x7, 0x443, &(0x7f0000000280)={{0x12, 0x1, 0x0, 0x30, 0x55, 0x15, 0x20, 0xe8d, 0x7103, 0x8c25, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x431, 0x1, 0x4, 0x9, 0x20, 0x0, "", [{{0x9, 0x4, 0x6e, 0x2, 0xe, 0xff, 0x0, 0x0, 0x5, [], [{{0x9, 0x5, 0x4, 0xc, 0x3ff, 0x5, 0x24, 0x67, [@generic={0x5, 0x22, "ea9ff2"}, @generic={0xf9, 0x6, "9c8f3ef4d57ee63409bb71a3e217722047bd5bf1f839ae04918e30f2b3e84ea57622bfd381a384d6b2492e15a07e99dbb7d9abe365c1f886a78d53eef604b541f9df3e44e463a26c5bf9b9fae8d9c834b95c894d0ab7011464be92a2c25c6f89eebe0991e228e4bf9d019b341155a355436f52deaf327a55fa063250773ebf961f68a39b5749bdfe7ea88bfdcf4cac8ef6b879e3e70fa000fb8914d39bcda00a3d4ebd3bcca528d26560b4921d31f28d0aeacb4383de383c421fd0d3a4dcd29251cfb087775e44414b887be6a87ff0711c45131ada661ef388b406fecfb6a1060d339a1d23ebb07a78c536476575e8965cb5e64d726231"}]}}, {{0x9, 0x5, 0x9, 0x10, 0x3ff, 0x3, 0x8, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x9, 0x9}]}}, {{0x9, 0x5, 0xa, 0x0, 0x200, 0x8, 0x8, 0x10, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0xf, 0xca1}]}}, {{0x9, 0x5, 0xa, 0x0, 0x10, 0x8, 0x8, 0xe}}, {{0x9, 0x5, 0x9, 0x10, 0x20, 0x9, 0x6, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x2, 0x3}, @generic={0xbe, 0x7, "52f5c3af26944c937c6b9d6a47fec5370f58c9f54a12ab82f614ee46254a88a2aebf79d5e85d5f5a40724861e589918e99582187fd28174d646c53658e3227e53e724e443cca9f7fa149b6bab4062576bd8db030bfbb37efdfeef232222294df7c6491467b4e0ab07b16657bf165c766ed2e68d5cc3fd622ab4727d0f8231e82263d18f532a46ae0668579043f37d6e0cc3593fa158fab4fe2dde2e04a86b1b9bb2b6072f0b8f0c7c43ba93d1f77ae2755c696056b8b23d282112cfc"}]}}, {{0x9, 0x5, 0x80, 0x10, 0x10, 0x0, 0x8, 0xe, [@generic={0xf, 0x23, "0f2d043fa394b9785183f2ce8a"}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x8, 0x8}]}}, {{0x9, 0x5, 0x5, 0x3, 0x200, 0x6, 0xf, 0x2}}, {{0x9, 0x5, 0x7, 0x8, 0x400, 0x1, 0x8, 0x9}}, {{0x9, 0x5, 0xd, 0x0, 0x200, 0x5, 0x1, 0xff, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x15, 0x2}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x5, 0xfff9}]}}, {{0x9, 0x5, 0x9, 0x777eb8e2f4bed1e8, 0x8, 0x9, 0x7, 0x3, [@generic={0xa1, 0x21, "74ee32aeb4773a73f0f25b4c2df9f4b0541cf3e60ffa1909186056e1ac99825094e453d94e4b226b31b5fe0ca01f26b5d4640da339f937d61372df88fd1659f00f813a973e2a723235ebab1acfb691bcd990c6dd77ee7043828d50175f7f7e2b25b455136c80356f53b9312e085589df2a469c303cf7f0ec0336d6a3a2b2d446f51e8bfaa129daf3af025aa4a30eaa1fcf4e4211da46ea5909fdf6eed32d7c"}, @generic={0x70, 0xd, "b9b17684b7b9cf088b4ad442ad5b819231d9d56f93d308c419981ea64c52e50522e71d7fbc8852db72f4a4844c89f02d4fcfc6b2a80960002c7a0b36b996bed37c43add5f2f9af0a5bcf0ea2178d1994cfa8f4ddad6f1920000e090a53b7af6f2456e66346e57935c971b36081f2"}]}}, {{0x9, 0x5, 0x7, 0x1, 0x200, 0x5, 0x81, 0x1}}, {{0x9, 0x5, 0xb, 0x8, 0x0, 0x1, 0x2, 0x7, [@generic={0x14, 0x23, "538d70cfdc139c70251e0eed689ca5c55ad8"}]}}, {{0x9, 0x5, 0x1, 0x1, 0x10, 0x9, 0x5, 0x2, [@generic={0x87, 0x5, "bf854702a09db09d84598ec6d6ad3c9f00a2dc4f55a511af432c4f2c9405e8b71cf0ad89a8a126c9947ccfa9cdd7d1e10b35685241266b3a85a643be53fb3734f138c61eb0ca69a208a153b07a25495fd0cf06d7fe12031ea0023a5d73db841c951c3d061f3ddcb84f3a68993b8d1d4ae65847ac3daf5e42a37b4e44b947c28e309e6a604b"}]}}, {{0x9, 0x5, 0x4, 0x0, 0x400, 0x9, 0x1f, 0x7}}]}}]}}]}}, &(0x7f0000000900)={0xa, &(0x7f0000000700)={0xa, 0x6, 0x300, 0x1, 0xfb, 0x5a, 0x40, 0x92}, 0x8b, &(0x7f0000000740)={0x5, 0xf, 0x8b, 0x5, [@generic={0x5c, 0x10, 0x4, "ae66a4e373cac8e3bfcf6ee89e1e13be4284908cd554f196967ce94617cc7afa9a1438b92d01a9c869dc342495fa91dda29b1423462c6d7e96869f0d4518f98dbf1ebff0ccf148e0718aacbdab05e762ea3f0a0ac61a05496a"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0xd, 0x10, 0xe, 0x8001}, @wireless={0xb, 0x10, 0x1, 0x4, 0x2, 0x6b, 0x8, 0x3f, 0xe3}, @wireless={0xb, 0x10, 0x1, 0x8, 0x0, 0x4, 0x80, 0xb38, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x2, 0x6, 0xfe, 0xb}]}, 0x3, [{0x4, &(0x7f0000000800)=@lang_id={0x4, 0x3, 0x180c}}, {0x4, &(0x7f0000000840)=@lang_id={0x4, 0x3, 0x419}}, {0x66, &(0x7f0000000880)=@string={0x66, 0x3, "2b9be45593af5ec142742e2a1a1cf620feaaa1aaf32eab64a16731231e3fc5f361c625d6640da2d6500b80f0811d2de6532e34a3a40a418f8fcb325ae588912aab5e1dd9f89bd6e416a898ac277f7ff9642e8b9c4b647b76553fa5653b527100f5dd127d"}}]}) ioctl$INCFS_IOC_PERMIT_FILL(r0, 0x40046721, &(0x7f0000000940)={r0}) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000980)={0x1, 0x5cb8}, 0x8) ioctl$ASHMEM_GET_PIN_STATUS(r0, 0x7709, 0x0) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000009c0), 0x1, 0x0) ioctl$PPPIOCBRIDGECHAN(r2, 0x40047435, &(0x7f0000000a00)=0xffffff7f) sendto$inet6(r2, &(0x7f0000000a40)="ca50f75875ffbc0ea81a8c15527ec715b3b15a6556a8536133818284520429bd5127e781c04f5aa47ca6fc806bd32bbee108d2b2978e6058b6fa410bacb8b79a92369cd31c95663abbf29f63da188fdbc57792ceeada6fc80cd6fa814a2c60922d54e555e5467adf9d9d563e8f5facd57a9f6e09f81080bd4864", 0x7a, 0x4000800, &(0x7f0000000ac0)={0xa, 0x4e21, 0x10001, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x3}, 0x1c) ioctl$PPPIOCATTCHAN(r0, 0x40047438, &(0x7f0000000b00)=0x1) r3 = timerfd_create(0x3, 0x100000) fcntl$F_GET_FILE_RW_HINT(r3, 0x40d, &(0x7f0000000b40)) ioctl$EXT4_IOC_GROUP_EXTEND(r2, 0x40086607, &(0x7f0000000b80)=0x1) ioctl$PPPIOCSFLAGS1(r2, 0x40047459, &(0x7f0000000bc0)=0x9000000) r4 = openat(r2, &(0x7f0000000c00)='./file0\x00', 0x80080, 0x12c) ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, &(0x7f0000000c40)={{0x0, 0x1, 0xa8f, 0x3}}) sendmsg$802154_raw(r2, &(0x7f0000000dc0)={&(0x7f0000000c80)={0x24, @short={0x2, 0x2, 0xaaa0}}, 0x14, &(0x7f0000000d80)={&(0x7f0000000cc0)="651931722a2955320b133a6cd72c61813b686f41fea97cdf19282d7c66239f0f6139be52a33f1979af1dc942b53c610e738f8e6ccb6f24a4e917f1a32e91ea3e8a2e5b16a04d54b5f43fdd72b1ce5f48bfaa50f4fb35050d85108eec997bbc17abfa472055ce4f28d0ef0890387ae02a4c82abd026dcc96ce7c8d32be294fbc2af995a73cae9026578cebec0e793b7", 0x8f}, 0x1, 0x0, 0x0, 0x4000}, 0x10) mount_setattr(r4, &(0x7f0000000e00)='./file0\x00', 0x100, &(0x7f0000000e40)={0x100071, 0x80, 0x60000, {r2}}, 0x20) lseek(r0, 0x8, 0x0) r5 = openat2(0xffffffffffffff9c, &(0x7f0000000e80)='./file1\x00', &(0x7f0000000ec0)={0x2, 0x0, 0x25}, 0x18) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r4, 0x8916, &(0x7f0000000f00)={@mcast1, 0xa, r1}) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r2, &(0x7f0000001080)={&(0x7f0000000f40)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000001040)={&(0x7f0000000f80)={0xb0, 0x0, 0x300, 0x70bd2c, 0x25dfdbfc, {}, [@ETHTOOL_A_CHANNELS_HEADER={0x94, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg2\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'hsr0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'sit0\x00'}]}, @ETHTOOL_A_CHANNELS_OTHER_COUNT={0x8, 0x8, 0x593}]}, 0xb0}, 0x1, 0x0, 0x0, 0x4000040}, 0x1) ioctl$F2FS_IOC_GET_COMPRESS_OPTION(r5, 0x8002f515, &(0x7f00000010c0)) sendmsg$IPCTNL_MSG_EXP_GET(r2, &(0x7f00000011c0)={&(0x7f0000001100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001180)={&(0x7f0000001140)={0x24, 0x1, 0x2, 0x5, 0x0, 0x0, {0x0, 0x0, 0x1}, [@CTA_EXPECT_CLASS={0x8, 0x9, 0x1, 0x0, 0x8000}, @CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000044}, 0x2) 172.205971ms ago: executing program 1 (id=54): pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000380)={0x30, 0x5, 0x0, {0x0, 0x1, 0x2, 0x7}}, 0x30) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFBR(r2, 0x8941, &(0x7f00000001c0)=@add_del={0x3, &(0x7f0000000080)='bridge0\x00', 0x2a0ffffffff}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r3, 0xae03, 0xcc) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) (async) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r6, 0x4138ae84, &(0x7f00000001c0)={{0x30000, 0x1000, 0xc, 0xf0, 0x0, 0xfd, 0xd4, 0xd4, 0x0, 0x4, 0x7, 0x10}, {0x2, 0x1000, 0x3, 0x9, 0x8, 0xb, 0x9, 0xa, 0x5, 0x0, 0x3, 0xc4}, {0xd000, 0x98ddb7fb0f345f3, 0xb, 0x0, 0x2, 0x7, 0x4, 0x0, 0xc, 0x0, 0x6, 0x3}, {0xb000, 0x80a0000, 0x8, 0xfc, 0x40, 0x4f, 0x2, 0xd, 0x2, 0x3, 0x3}, {0x2, 0x26000, 0x9, 0x1, 0x7, 0x9, 0x9, 0x5, 0x5, 0x46, 0xe, 0x4b}, {0x1000, 0xd000, 0x0, 0x0, 0x6, 0x6c, 0x1, 0x8, 0x4, 0x8d, 0x21, 0x3}, {0x6000, 0xeeef0000, 0x8, 0x9d, 0xd, 0xfe, 0x0, 0xf, 0x5, 0x7, 0x0, 0xf8}, {0x100000, 0xd000, 0xd, 0x17, 0x3, 0x2, 0xff, 0x0, 0x14, 0x6, 0x2, 0x7}, {0x40000, 0x5}, {0x2, 0x9}, 0x40010002, 0x0, 0xf000, 0x300, 0x5, 0x2000, 0xeeef0000, [0xffffffffffffff47, 0x401, 0x8, 0x5]}) (async) socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0xfffffffffffffffe) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) (async) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) (async) chdir(&(0x7f0000000140)='./file0\x00') (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpu.stat\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r7, 0xc0189436, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x18, 0x3}) (async) close_range(r1, 0xffffffffffffffff, 0x0) (async) io_setup(0x9b6, &(0x7f0000000000)=0x0) io_pgetevents(r8, 0x1, 0x1, &(0x7f0000000040)=[{}], &(0x7f0000000080)={0x0, 0x989680}, 0x0) (async) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000200)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x7c0, 0x1125, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x4, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x3, 0x1, 0x3, 0x1, 0x7, 0x12, {0x9, 0x21, 0x5, 0x5, 0x1, {0x22, 0x78}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x97, 0x8, 0x5}}}}}]}}]}}, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0}) (async) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000c40)='net/xfrm_stat\x00') write$rfkill(r9, 0x0, 0x0) r10 = accept$nfc_llcp(r1, &(0x7f0000000080), &(0x7f0000000100)=0x60) ioctl$F2FS_IOC_MOVE_RANGE(r10, 0xc020f509, &(0x7f0000000140)={r1, 0x7, 0x6, 0x100000001}) (async) ioctl$EXT4_IOC_GETFSUUID(r9, 0x8008662c, &(0x7f0000000040)) 83.122506ms ago: executing program 1 (id=55): r0 = userfaultfd(0x0) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000604000/0x3000)=nil, 0x3000}}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.controllers\x00', 0x275a, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='./file1\x00', &(0x7f00000001c0), 0x40, &(0x7f0000000200)={[{@read_timeout_ms={'read_timeout_ms', 0x3d, 0x7fff}}]}) r2 = socket$inet_udp(0x2, 0x2, 0x0) sendmmsg$inet(r2, &(0x7f0000000680)=[{{&(0x7f0000000200)={0x2, 0x4e23, @remote}, 0x10, 0x0}}], 0x1, 0x8000) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000240)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r3, 0xffffffffffffffff, 0x0) r4 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_FLUSH(r4, 0x29, 0xd1, &(0x7f0000000000)=0x9, 0x4) ioctl$BLKGETSIZE64(r4, 0x80081272, 0x0) write$binfmt_script(r1, &(0x7f00000004c0)={'#! ', './file1'}, 0xb) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000002, 0x10012, r1, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) openat2(0xffffffffffffff9c, 0x0, &(0x7f00000000c0)={0x20900, 0x16a, 0x19}, 0x31) r5 = syz_open_procfs(0x0, &(0x7f0000000480)='maps\x00') syz_io_uring_setup(0xdaf, &(0x7f0000000180)={0x0, 0x2, 0x13291, 0x0, 0x3b3}, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0xc0686611, &(0x7f0000000180)={0x68, 0x0, 0x17, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) 82.389456ms ago: executing program 1 (id=56): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x101800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0xa) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f00009b3000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000240)="b9800000c00f3235004000000f30b9fa000000130f01d9300d76c4020a1bf7b805000000b90000c0fe0f3cae0a41d941d9000f32ba00e500000f30660fc775022e0fba600c9864660ffc76002f3166b85766baa00066ed00d0", 0x59}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000300)) ioctl$KVM_RUN(r2, 0xae80, 0x0) 0s ago: executing program 1 (id=57): symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000280), 0x80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000cc0)='./file0/file1\x00', 0x0, 0x2000) umount2(&(0x7f00000002c0)='./file0\x00', 0x2) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000500)={{{@in=@initdev, @in6=@empty}}, {{@in=@remote}, 0x0, @in=@private}}, &(0x7f0000000140)=0xe8) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000001c0), 0x28000c, &(0x7f0000000100)={[], [{@fsuuid={'fsuuid', 0x3d, {[0x32, 0x64, 0x35, 0x33, 0x63, 0x7, 0x62, 0x62], 0x2d, [0x36, 0x31, 0x0, 0x33], 0x2d, [0x33, 0x30, 0x5f, 0x61], 0x2d, [0x31, 0x31, 0x12bb1e8542deaf8f, 0x66], 0x2d, [0x66, 0x30, 0x32, 0x35, 0x61, 0x64, 0x39, 0x35]}}}], 0x2c}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.88' (ED25519) to the list of known hosts. [ 18.844126][ T36] audit: type=1400 audit(1774002120.290:64): avc: denied { mounton } for pid=283 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 18.845366][ T283] cgroup: Unknown subsys name 'net' [ 18.866895][ T36] audit: type=1400 audit(1774002120.290:65): avc: denied { mount } for pid=283 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 18.894402][ T283] cgroup: Unknown subsys name 'devices' [ 18.894437][ T36] audit: type=1400 audit(1774002120.320:66): avc: denied { unmount } for pid=283 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.021650][ T283] cgroup: Unknown subsys name 'hugetlb' [ 19.027255][ T283] cgroup: Unknown subsys name 'rlimit' [ 19.179370][ T36] audit: type=1400 audit(1774002120.620:67): avc: denied { setattr } for pid=283 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 19.202590][ T36] audit: type=1400 audit(1774002120.620:68): avc: denied { mounton } for pid=283 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 19.209219][ T285] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 19.227485][ T36] audit: type=1400 audit(1774002120.620:69): avc: denied { mount } for pid=283 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 19.259028][ T36] audit: type=1400 audit(1774002120.690:70): avc: denied { relabelto } for pid=285 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.262131][ T283] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 19.284546][ T36] audit: type=1400 audit(1774002120.690:71): avc: denied { write } for pid=285 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.318853][ T36] audit: type=1400 audit(1774002120.710:72): avc: denied { read } for pid=283 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.344404][ T36] audit: type=1400 audit(1774002120.710:73): avc: denied { open } for pid=283 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.053695][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.060819][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.067899][ T290] bridge_slave_0: entered allmulticast mode [ 20.074220][ T290] bridge_slave_0: entered promiscuous mode [ 20.080762][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.087789][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.094924][ T290] bridge_slave_1: entered allmulticast mode [ 20.101100][ T290] bridge_slave_1: entered promiscuous mode [ 20.181345][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.188401][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.195700][ T291] bridge_slave_0: entered allmulticast mode [ 20.201960][ T291] bridge_slave_0: entered promiscuous mode [ 20.214192][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.221280][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.228321][ T293] bridge_slave_0: entered allmulticast mode [ 20.234675][ T293] bridge_slave_0: entered promiscuous mode [ 20.240972][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.247995][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.255176][ T291] bridge_slave_1: entered allmulticast mode [ 20.261419][ T291] bridge_slave_1: entered promiscuous mode [ 20.270302][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.277329][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.284454][ T293] bridge_slave_1: entered allmulticast mode [ 20.290732][ T293] bridge_slave_1: entered promiscuous mode [ 20.320877][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.327933][ T292] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.335139][ T292] bridge_slave_0: entered allmulticast mode [ 20.341316][ T292] bridge_slave_0: entered promiscuous mode [ 20.347662][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.354773][ T292] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.361912][ T292] bridge_slave_1: entered allmulticast mode [ 20.368046][ T292] bridge_slave_1: entered promiscuous mode [ 20.424175][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.431239][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.438534][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.445590][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.521017][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.528065][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.535335][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.542361][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.550880][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.558256][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.565976][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.573254][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.583015][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.590069][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.601551][ T62] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.608582][ T62] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.650695][ T62] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.657724][ T62] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.670801][ T62] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.677861][ T62] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.694928][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.701974][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.716915][ T290] veth0_vlan: entered promiscuous mode [ 20.726195][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.733235][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.741462][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.748477][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.756482][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.763534][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.791908][ T290] veth1_macvtap: entered promiscuous mode [ 20.818204][ T293] veth0_vlan: entered promiscuous mode [ 20.836001][ T292] veth0_vlan: entered promiscuous mode [ 20.852416][ T290] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 20.872889][ T291] veth0_vlan: entered promiscuous mode [ 20.879366][ T293] veth1_macvtap: entered promiscuous mode [ 20.895247][ T292] veth1_macvtap: entered promiscuous mode [ 20.911713][ T291] veth1_macvtap: entered promiscuous mode [ 21.169817][ T45] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 21.249764][ T31] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 21.264615][ T356] fuse: Unknown parameter 'fB._%CclP' [ 21.265133][ T357] Invalid ELF header type: 2 != 1 [ 21.319809][ T45] usb 2-1: Using ep0 maxpacket: 16 [ 21.329580][ T45] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 21.342829][ T45] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 21.353302][ T45] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 21.366314][ T45] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 21.377537][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 21.387616][ T45] usb 2-1: config 0 descriptor?? [ 21.399844][ T31] usb 4-1: Using ep0 maxpacket: 8 [ 21.407034][ T31] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 21.418045][ T31] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 21.427570][ T31] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 21.442579][ T31] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 21.452984][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 21.461264][ T31] usb 4-1: Manufacturer: ᥢ꺠瘿䓻蠏泍ㆍ䅹쒆鼙犅ꀏ뻟鴚䙧ⅼ촣偈㙁呓읗ଌ䍇䀴苾綷䤍朁鱧뗉쮘鿈￫Ⓩ蟸맏᯻쌲钧욢 [ 21.478375][ T31] usb 4-1: SerialNumber: syz [ 21.570888][ T374] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 21.690066][ T351] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 21.706061][ T351] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 21.714933][ T351] sit0: entered promiscuous mode [ 21.723177][ T351] netlink: 'syz.3.7': attribute type 1 has an invalid length. [ 21.730953][ T351] netlink: 1 bytes leftover after parsing attributes in process `syz.3.7'. [ 21.742362][ T351] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=351 comm=syz.3.7 [ 21.758156][ T31] cdc_ncm 4-1:1.0: CDC Union missing and no IAD found [ 21.765346][ T31] cdc_ncm 4-1:1.0: bind() failure [ 21.779613][ T31] usb 4-1: USB disconnect, device number 2 [ 21.795476][ T45] microsoft 0003:045E:07DA.0001: invalid report_count -352038851 [ 21.803595][ T45] microsoft 0003:045E:07DA.0001: item 0 4 1 9 parsing failed [ 21.811377][ T45] microsoft 0003:045E:07DA.0001: parse failed [ 21.817595][ T45] microsoft 0003:045E:07DA.0001: probe with driver microsoft failed with error -22 [ 22.019051][ T340] usb 2-1: USB disconnect, device number 2 [ 22.119810][ T45] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 22.249718][ T45] usb 3-1: device descriptor read/64, error -71 [ 22.489750][ T45] usb 3-1: device descriptor read/64, error -71 [ 22.588904][ T403] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 22.597859][ T403] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 22.607117][ T403] SELinux: Context nfc is not valid (left unmapped). [ 22.617545][ T403] netlink: 'syz.1.24': attribute type 1 has an invalid length. [ 22.625818][ T403] overlayfs: overlapping lowerdir path [ 22.714295][ T412] ======================================================= [ 22.714295][ T412] WARNING: The mand mount option has been deprecated and [ 22.714295][ T412] and is ignored by this kernel. Remove the mand [ 22.714295][ T412] option from the mount to silence this warning. [ 22.714295][ T412] ======================================================= [ 22.749286][ T45] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 22.749933][ T340] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 22.899865][ T45] usb 3-1: device descriptor read/64, error -71 [ 22.909783][ T340] usb 1-1: device descriptor read/64, error -71 [ 23.029729][ T66] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 23.139715][ T45] usb 3-1: device descriptor read/64, error -71 [ 23.149761][ T340] usb 1-1: device descriptor read/64, error -71 [ 23.191050][ T66] usb 2-1: too many endpoints for config 1 interface 0 altsetting 13: 255, using maximum allowed: 30 [ 23.202035][ T66] usb 2-1: config 1 interface 0 altsetting 13 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 23.215172][ T66] usb 2-1: config 1 interface 0 has no altsetting 0 [ 23.223783][ T66] usb 2-1: string descriptor 0 read error: -22 [ 23.230109][ T66] usb 2-1: New USB device found, idVendor=0458, idProduct=5017, bcdDevice= 0.40 [ 23.239137][ T66] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 23.249874][ T45] usb usb3-port1: attempt power cycle [ 23.389723][ T31] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 23.389723][ T340] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 23.529710][ T340] usb 1-1: device descriptor read/64, error -71 [ 23.540674][ T31] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 23.551614][ T31] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 23.561372][ T31] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 23.574282][ T31] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 23.583339][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 23.591669][ T45] usb 3-1: new full-speed USB device number 4 using dummy_hcd [ 23.599374][ T31] usb 4-1: config 0 descriptor?? [ 23.620609][ T45] usb 3-1: device descriptor read/8, error -71 [ 23.689096][ T66] input: HID 0458:5017 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/0003:0458:5017.0002/input/input4 [ 23.702554][ T66] input: HID 0458:5017 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/0003:0458:5017.0002/input/input5 [ 23.715130][ T66] input: HID 0458:5017 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/0003:0458:5017.0002/input/input6 [ 23.730828][ T66] kye 0003:0458:5017.0002: input,hiddev96,hidraw0: USB HID v0.02 Mouse [HID 0458:5017] on usb-dummy_hcd.1-1/input0 [ 23.750677][ T45] usb 3-1: device descriptor read/8, error -71 [ 23.779931][ T340] usb 1-1: device descriptor read/64, error -71 [ 23.807075][ T31] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 23.814696][ T31] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 23.822134][ T31] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 23.829523][ T31] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 23.836918][ T31] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 23.844353][ T31] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 23.852974][ T31] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 23.860477][ T31] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 23.861395][ T384] usb 2-1: USB disconnect, device number 3 [ 23.867997][ T31] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 23.881444][ T31] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 23.888853][ T31] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 23.896283][ T31] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 23.899802][ T340] usb usb1-port1: attempt power cycle [ 23.903725][ T31] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 23.916468][ T31] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 23.923889][ T31] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 23.931452][ T31] plantronics 0003:047F:FFFF.0003: No inputs registered, leaving [ 23.943972][ T31] plantronics 0003:047F:FFFF.0003: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 24.007168][ T426] usb 4-1: USB disconnect, device number 3 [ 24.009768][ T45] usb 3-1: new full-speed USB device number 5 using dummy_hcd [ 24.041000][ T45] usb 3-1: device descriptor read/8, error -71 [ 24.170798][ T45] usb 3-1: device descriptor read/8, error -71 [ 24.239734][ T340] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 24.260657][ T340] usb 1-1: device descriptor read/8, error -71 [ 24.279966][ T45] usb usb3-port1: unable to enumerate USB device [ 24.394262][ T340] usb 1-1: device descriptor read/8, error -71 [ 24.595185][ T438] mmap: syz.1.32 (438) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 24.649753][ T340] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 24.670788][ T340] usb 1-1: device descriptor read/8, error -71 [ 24.705173][ T445] netlink: 8 bytes leftover after parsing attributes in process `syz.1.35'. [ 24.738378][ T447] syzkaller1: entered promiscuous mode [ 24.743895][ T447] syzkaller1: entered allmulticast mode [ 24.800759][ T340] usb 1-1: device descriptor read/8, error -71 [ 24.879775][ T428] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 24.909813][ T340] usb usb1-port1: unable to enumerate USB device [ 25.029737][ T428] usb 4-1: Using ep0 maxpacket: 16 [ 25.037482][ T428] usb 4-1: New USB device found, idVendor=0d8c, idProduct=0102, bcdDevice= 0.40 [ 25.046747][ T428] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.054786][ T428] usb 4-1: Product: syz [ 25.058975][ T428] usb 4-1: Manufacturer: syz [ 25.063645][ T428] usb 4-1: SerialNumber: syz [ 25.249727][ T45] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 25.399704][ T45] usb 3-1: Using ep0 maxpacket: 16 [ 25.405299][ T45] usb 3-1: too many configurations: 17, using maximum allowed: 8 [ 25.420322][ T36] kauditd_printk_skb: 81 callbacks suppressed [ 25.420337][ T36] audit: type=1400 audit(1774002126.870:155): avc: denied { create } for pid=450 comm="syz.2.38" anonclass=[userfaultfd] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 25.447837][ T36] audit: type=1400 audit(1774002126.890:156): avc: denied { ioctl } for pid=450 comm="syz.2.38" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=4501 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 25.472385][ T442] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 25.482425][ T442] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 25.562166][ T45] usb 3-1: string descriptor 0 read error: -71 [ 25.568418][ T45] usb 3-1: New USB device found, idVendor=04e8, idProduct=a101, bcdDevice= 4.48 [ 25.577492][ T45] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.588716][ T45] r8152-cfgselector 3-1: Unknown version 0x0000 [ 25.595104][ T45] r8152-cfgselector 3-1: rejected 8 configurations due to insufficient available bus power [ 25.605155][ T45] r8152-cfgselector 3-1: no configuration chosen from 8 choices [ 25.613921][ T45] r8152-cfgselector 3-1: USB disconnect, device number 6 [ 25.628147][ T36] audit: type=1400 audit(1774002127.070:157): avc: denied { setopt } for pid=452 comm="syz.0.39" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 25.684264][ T456] incfs: Can't find or create .index dir in ./binderfs [ 25.684351][ T36] audit: type=1400 audit(1774002127.130:158): avc: denied { write } for pid=454 comm="syz.1.40" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 25.691563][ T455] SELinux: security_context_str_to_sid (syste_uGй :) failed with errno=-22 [ 25.713566][ T456] incfs: mount failed -1 [ 25.736314][ T36] audit: type=1400 audit(1774002127.180:159): avc: denied { create } for pid=459 comm="syz.1.41" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 25.756831][ T36] audit: type=1400 audit(1774002127.190:160): avc: denied { rename } for pid=459 comm="syz.1.41" name="file0" dev="tmpfs" ino=133 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 25.779229][ T36] audit: type=1400 audit(1774002127.190:161): avc: denied { create } for pid=459 comm="syz.1.41" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 25.960590][ T340] usb 1-1: new full-speed USB device number 6 using dummy_hcd [ 25.979743][ T31] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 26.124242][ T340] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 26.135647][ T31] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 54596, setting to 64 [ 26.146848][ T340] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 26.147207][ T31] usb 2-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 26.168005][ T31] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.177023][ T31] usb 2-1: config 0 descriptor?? [ 26.182486][ T340] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 26.185533][ T460] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 26.210206][ T340] usb 1-1: New USB device found, idVendor=7de0, idProduct=676e, bcdDevice=77.db [ 26.219292][ T340] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.232457][ T36] audit: type=1400 audit(1774002127.680:162): avc: denied { create } for pid=461 comm="syz.2.42" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 26.232842][ T340] usb 1-1: config 0 descriptor?? [ 26.255130][ T36] audit: type=1400 audit(1774002127.700:163): avc: denied { bind } for pid=461 comm="syz.2.42" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 26.275680][ T36] audit: type=1400 audit(1774002127.700:164): avc: denied { ioctl } for pid=461 comm="syz.2.42" path="socket:[4578]" dev="sockfs" ino=4578 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 26.321639][ T462] kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 26.335541][ T428] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 26.346590][ T428] usb 4-1: USB disconnect, device number 4 [ 26.461897][ T467] : renamed from bond_slave_0 [ 26.467983][ T467] netlink: 12 bytes leftover after parsing attributes in process `syz.2.44'. [ 26.501367][ T340] usb 1-1: string descriptor 0 read error: -71 [ 26.516460][ T340] usb 1-1: USB disconnect, device number 6 [ 26.606184][ T31] hid-generic 0003:04F3:0755.0004: unknown main item tag 0x0 [ 26.613721][ T31] hid-generic 0003:04F3:0755.0004: unknown main item tag 0x0 [ 26.621292][ T31] hid-generic 0003:04F3:0755.0004: unknown main item tag 0x0 [ 26.628695][ T31] hid-generic 0003:04F3:0755.0004: unknown main item tag 0x0 [ 26.636103][ T31] hid-generic 0003:04F3:0755.0004: unknown main item tag 0x0 [ 26.644975][ T31] hid-generic 0003:04F3:0755.0004: hidraw0: USB HID v1.01 Device [HID 04f3:0755] on usb-dummy_hcd.1-1/input0 [ 26.799743][ T428] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 26.811161][ T460] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 26.820182][ T460] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 26.829429][ T31] usb 2-1: USB disconnect, device number 4 [ 26.960741][ T428] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 26.968759][ T428] usb 3-1: config 0 has no interface number 0 [ 26.974873][ T428] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 26.985764][ T428] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 26.995507][ T428] usb 3-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00 [ 27.004568][ T428] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.013070][ T428] usb 3-1: config 0 descriptor?? [ 27.219323][ T473] netlink: 'syz.2.47': attribute type 40 has an invalid length. [ 27.387454][ T495] incfs: Error accessing: ./file0. [ 27.392680][ T495] incfs: mount failed -2 [ 27.523608][ T501] ------------[ cut here ]------------ [ 27.529136][ T501] WARNING: CPU: 0 PID: 501 at fs/overlayfs/util.c:602 ovl_dir_modified+0x15a/0x190 [ 27.538498][ T501] Modules linked in: [ 27.542452][ T501] CPU: 0 UID: 0 PID: 501 Comm: syz.1.57 Not tainted syzkaller #0 bfa4ef08944cc8c0b1f298cf0b8aa2c2bde491d0 [ 27.552890][ T499] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 27.553789][ T501] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 27.570265][ T499] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 27.572182][ T501] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 27.585645][ T501] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 4e 79 97 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 86 52 3f ff <0f> 0b e9 3e ff ff ff e8 7a 52 3f ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 27.605302][ T501] RSP: 0018:ffffc9000ddd7b48 EFLAGS: 00010283 [ 27.611425][ T501] RAX: ffffffff824850ca RBX: 0000000000000000 RCX: 0000000000080000 [ 27.619423][ T501] RDX: ffffc90001a72000 RSI: 0000000000000742 RDI: 0000000000000743 [ 27.627465][ T501] RBP: ffffc9000ddd7b70 R08: ffff88812d949a1f R09: 1ffff11025b29343 [ 27.635548][ T501] R10: dffffc0000000000 R11: ffffed1025b29344 R12: 0000000000000000 [ 27.643610][ T501] R13: dffffc0000000000 R14: ffff88812d949980 R15: ffff888115068330 [ 27.651617][ T501] FS: 00007ff92768a6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 27.660596][ T501] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.667279][ T501] CR2: 0000200000540000 CR3: 0000000117078000 CR4: 00000000003526b0 [ 27.675313][ T501] Call Trace: [ 27.678604][ T501] [ 27.681567][ T501] ovl_do_remove+0x81b/0xda0 [ 27.686186][ T501] ? ovl_set_redirect+0x780/0x780 [ 27.691265][ T501] ? down_write+0xee/0x2b0 [ 27.695713][ T501] ? __cfi_down_write+0x10/0x10 [ 27.700666][ T501] ovl_rmdir+0x1e/0x30 [ 27.704764][ T501] vfs_rmdir+0x3e0/0x560 [ 27.709039][ T501] incfs_kill_sb+0x109/0x230 [ 27.713715][ T501] deactivate_locked_super+0xd5/0x2a0 [ 27.719112][ T501] deactivate_super+0xb8/0xe0 [ 27.723848][ T501] cleanup_mnt+0x406/0x4a0 [ 27.728296][ T501] __cleanup_mnt+0x1d/0x40 [ 27.732785][ T501] task_work_run+0x1e8/0x260 [ 27.737395][ T501] ? __cfi_task_work_run+0x10/0x10 [ 27.742557][ T501] ? __x64_sys_umount+0x12e/0x180 [ 27.747600][ T501] ? __cfi___x64_sys_umount+0x10/0x10 [ 27.753022][ T501] resume_user_mode_work+0x35/0x50 [ 27.758154][ T501] syscall_exit_to_user_mode+0x63/0xb0 [ 27.763715][ T501] do_syscall_64+0x63/0xf0 [ 27.768155][ T501] ? clear_bhb_loop+0x50/0xa0 [ 27.772886][ T501] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 27.778799][ T501] RIP: 0033:0x7ff92679c799 [ 27.783284][ T501] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 27.803138][ T501] RSP: 002b:00007ff92768a028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 27.811574][ T501] RAX: 0000000000000000 RBX: 00007ff926a15fa0 RCX: 00007ff92679c799 [ 27.819555][ T501] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00002000000002c0 [ 27.827547][ T501] RBP: 00007ff926832c99 R08: 0000000000000000 R09: 0000000000000000 [ 27.835545][ T501] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 27.843622][ T501] R13: 00007ff926a16038 R14: 00007ff926a15fa0 R15: 00007fffbd27deb8 [ 27.851614][ T501] [ 27.854630][ T501] ---[ end trace 0000000000000000 ]--- [ 27.860595][ T501] ------------[ cut here ]------------ [ 27.860963][ T428] usbhid 3-1:0.1: can't add hid device: -71 [ 27.866078][ T501] WARNING: CPU: 1 PID: 501 at fs/overlayfs/util.c:602 ovl_dir_modified+0x15a/0x190 [ 27.872068][ T428] usbhid 3-1:0.1: probe with driver usbhid failed with error -71 [ 27.881280][ T501] Modules linked in: [ 27.881299][ T501] CPU: 1 UID: 0 PID: 501 Comm: syz.1.57 Tainted: G W syzkaller #0 bfa4ef08944cc8c0b1f298cf0b8aa2c2bde491d0 [ 27.890912][ T428] usb 3-1: USB disconnect, device number 7 [ 27.892901][ T501] Tainted: [W]=WARN [ 27.915239][ T501] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 27.925330][ T501] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 27.931011][ T501] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 4e 79 97 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 86 52 3f ff <0f> 0b e9 3e ff ff ff e8 7a 52 3f ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 27.950645][ T501] RSP: 0018:ffffc9000ddd7b48 EFLAGS: 00010246 [ 27.956715][ T501] RAX: ffffffff824850ca RBX: 0000000000000000 RCX: 0000000000080000 [ 27.964708][ T501] RDX: ffffc90001a72000 RSI: 000000000007ffff RDI: 0000000000080000 [ 27.972701][ T501] RBP: ffffc9000ddd7b70 R08: ffff88812d949a1f R09: 1ffff11025b29343 [ 27.980692][ T501] R10: dffffc0000000000 R11: ffffed1025b29344 R12: 0000000000000000 [ 27.988660][ T501] R13: dffffc0000000000 R14: ffff88812d949980 R15: ffff888115068330 [ 27.996658][ T501] FS: 00007ff92768a6c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 28.005603][ T501] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 28.012211][ T501] CR2: 0000200001000000 CR3: 0000000117078000 CR4: 00000000003526b0 [ 28.020237][ T501] Call Trace: [ 28.023504][ T501] [ 28.026502][ T501] ovl_do_remove+0x81b/0xda0 [ 28.031112][ T501] ? ovl_set_redirect+0x780/0x780 [ 28.036150][ T501] ? down_write+0xee/0x2b0 [ 28.040600][ T501] ? __cfi_down_write+0x10/0x10 [ 28.045460][ T501] ovl_rmdir+0x1e/0x30 [ 28.049513][ T501] vfs_rmdir+0x3e0/0x560 [ 28.053764][ T501] incfs_kill_sb+0x1a0/0x230 [ 28.058356][ T501] deactivate_locked_super+0xd5/0x2a0 [ 28.063736][ T501] deactivate_super+0xb8/0xe0 [ 28.068417][ T501] cleanup_mnt+0x406/0x4a0 [ 28.072871][ T501] __cleanup_mnt+0x1d/0x40 [ 28.077289][ T501] task_work_run+0x1e8/0x260 [ 28.081897][ T501] ? __cfi_task_work_run+0x10/0x10 [ 28.087041][ T501] ? __x64_sys_umount+0x12e/0x180 [ 28.092088][ T501] ? __cfi___x64_sys_umount+0x10/0x10 [ 28.097463][ T501] resume_user_mode_work+0x35/0x50 [ 28.102583][ T501] syscall_exit_to_user_mode+0x63/0xb0 [ 28.108042][ T501] do_syscall_64+0x63/0xf0 [ 28.112490][ T501] ? clear_bhb_loop+0x50/0xa0 [ 28.117260][ T501] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 28.123206][ T501] RIP: 0033:0x7ff92679c799 [ 28.127618][ T501] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 28.147245][ T501] RSP: 002b:00007ff92768a028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 28.155689][ T501] RAX: 0000000000000000 RBX: 00007ff926a15fa0 RCX: 00007ff92679c799 [ 28.163678][ T501] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00002000000002c0 [ 28.171673][ T501] RBP: 00007ff926832c99 R08: 0000000000000000 R09: 0000000000000000 [ 28.179687][ T501] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 28.187658][ T501] R13: 00007ff926a16038 R14: 00007ff926a15fa0 R15: 00007fffbd27deb8 [ 28.195656][ T501] [ 28.198668][ T501] ---[ end trace 0000000000000000 ]---