last executing test programs: 2.998458544s ago: executing program 2 (id=20): prctl$PR_SET_MM(0x23, 0x6, &(0x7f0000ae4000/0x3000)=nil) prctl$PR_SET_MM(0x23, 0x7, &(0x7f0000d35000/0x3000)=nil) mremap(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1000, 0x0, &(0x7f00008b5000/0x1000)=nil) brk(0x200000ffc000) r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) bind$bt_rfcomm(r0, &(0x7f0000007400)={0x1f, @none, 0x9}, 0xa) 2.998163254s ago: executing program 2 (id=21): openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) syz_ublk_setup_io_uring(0x41d, &(0x7f0000000480)={0x0, 0xfd6, 0x0, 0xffffffff, 0x158}, 0x0, 0x0, 0x0) mount(0x0, 0x0, &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x16c01, 0x89) syz_open_dev$mouse(&(0x7f0000000300), 0x4, 0x410080) linkat(r0, &(0x7f0000000340)='./file0\x00', r0, &(0x7f0000000380)='./file0\x00', 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0xc0686611, &(0x7f0000000180)={0x67, 0x4, 0x18, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000240)={[0x5836, 0x8, 0x7, 0x4000000000000e51, 0xfffffffffffffffe, 0x5479, 0x1035, 0x200000000006, 0x0, 0x32a, 0xfffffffffffffffe, 0xffffffff, 0xbf4, 0xfff, 0x8000000000005, 0x800000068], 0x2000, 0x80cd4}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 2.887331667s ago: executing program 2 (id=22): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040)) prlimit64(0x0, 0x0, &(0x7f00000000c0)={0x9, 0x401}, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x39, 0x7, 0x3, 0x180, 0x100, 0x10, 0xf1, 0xf, 0x10, 0x5, 0x0, 0x26, 0x0, 0xa, 0x0, 0xbd9], 0x4000, 0x43180}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x7, 0x6, 0x4, 0x200000000000043, 0x2000004, 0x0, 0x2004cb, 0x0, 0xa3c, 0x200, 0x8, 0x8000000009, 0x803, 0x0, 0x9, 0x9], 0xeeee8000, 0x202}) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f00000001c0)={{0x3000, 0x10000, 0x8, 0x0, 0xb, 0xe6, 0x40, 0x0, 0x0, 0x81, 0x80}, {0x5000, 0x33000, 0x3, 0x0, 0x42, 0x5, 0x6, 0x6, 0x36, 0xd, 0x6, 0x89}, {0x0, 0x0, 0x9, 0x5, 0x3, 0x7, 0x0, 0x9, 0x1, 0xa4, 0x5, 0x5}, {0x0, 0xeeee0000, 0x9, 0x6, 0x5, 0x42, 0xb, 0x0, 0x8, 0x4, 0xf}, {0xf000, 0x1000, 0xf, 0x3, 0x17, 0x7, 0x9, 0x8, 0x7, 0x9, 0xf7, 0x97}, {0xeeefa000, 0xffff1000, 0xc, 0xa0, 0xb1, 0x8, 0x3, 0x6, 0x82, 0x2f, 0x1, 0x7}, {0x54000, 0x10000, 0xf, 0x5, 0x7, 0x5, 0x7, 0x3, 0x8, 0x1, 0x40, 0x70}, {0x9000, 0x4000, 0xa, 0x5, 0xcd, 0x7, 0xff, 0x9, 0x2, 0xc, 0xb0, 0x83}, {0xeeee0000, 0x30}, {0xf000, 0x7}, 0xe0040010, 0x0, 0x3000, 0x2024, 0x3, 0x0, 0x100000, [0x6800000000000000, 0x5, 0x2, 0x20008]}) ioctl$KVM_RUN(r2, 0xae80, 0x300000000000000) 2.822722969s ago: executing program 2 (id=23): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) syz_usb_connect$uac3(0x0, 0xa0, &(0x7f0000000180)=ANY=[@ANYBLOB="12011003000000201e04403040000102030109028e000301062005080b00010101304b0904000000010130000a2401052a00060000001324030506030604ff0c0000ffb8c5ca58d7b40e2409040100000000"], &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0}) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r0, 0x8982, &(0x7f0000002800)={0x1, 'vlan0\x00'}) (async) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r0, 0x8982, &(0x7f0000002800)={0x1, 'vlan0\x00'}) r1 = socket$inet(0x2, 0x3, 0x8d) connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e23, @private=0xa010101}, 0x10) 1.696413747s ago: executing program 1 (id=30): r0 = socket$inet6(0xa, 0x3, 0x8000000003c) r1 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x2}}, {{0xa, 0x0, 0xffffffff, @remote}}}, 0x108) r2 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r2, 0x29, 0x2a, &(0x7f0000000080)={0x20, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) setsockopt$inet6_group_source_req(r2, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0xffff, 0x0, @mcast1={0xff, 0x7}, 0x10000}}, {{0xa, 0x0, 0x0, @mcast1}}}, 0x108) r3 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x2a, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x2, &(0x7f00000001c0)=[{0x6, 0x0, 0x0, 0x7fff0000}, {0x7fff, 0xf5, 0x6, 0x3}]}) close_range(r4, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000140)={'syztnl0\x00', &(0x7f0000000040)={'ip6_vti0\x00', 0x0, 0xcbd4734c110a32c4, 0xa, 0x76, 0xffff8000, 0x19, @local, @loopback, 0x20, 0x10, 0x3c7, 0xfffffff8}}) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4ea4, 0x0, @local, 0x9}, 0x1c) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x953a, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0xffd0}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 1.694113177s ago: executing program 1 (id=31): openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) syz_ublk_setup_io_uring(0x41d, &(0x7f0000000480)={0x0, 0xfd6, 0x0, 0xffffffff, 0x158}, 0x0, 0x0, 0x0) mount(0x0, 0x0, &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x16c01, 0x89) syz_open_dev$mouse(&(0x7f0000000300), 0x4, 0x410080) linkat(r0, &(0x7f0000000340)='./file0\x00', r0, &(0x7f0000000380)='./file0\x00', 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0xc0686611, &(0x7f0000000180)={0x67, 0x4, 0x18, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000240)={[0x5836, 0x8, 0x7, 0x4000000000000e51, 0xfffffffffffffffe, 0x5479, 0x1035, 0x200000000006, 0x0, 0x32a, 0xfffffffffffffffe, 0xffffffff, 0xbf4, 0xfff, 0x8000000000005, 0x800000068], 0x2000, 0x80cd4}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1.59478965s ago: executing program 2 (id=33): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r3, &(0x7f0000000380)={0x2, 0x0, @remote}, 0x10) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x810) r4 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, 0x0}) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r4, 0x4068aea3, &(0x7f0000005000)={0xa3, 0x0, 0x0}) ioctl$KVM_SET_NESTED_STATE(r4, 0x4080aebf, &(0x7f0000007000)=@vmx={0x4, 0x0, 0x1078, {0x1002000, 0xffffffffffffffff}, {"d07ee51100"}}) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000240)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r5, 0xffffffffffffffff, 0x0) 1.554187921s ago: executing program 1 (id=34): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001480)=ANY=[@ANYBLOB="200000001000010700000000000000000a0000000c0002006e6c3830323131"], 0x20}}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000001500), r0) recvmmsg(r0, &(0x7f0000001700)=[{{0x0, 0x52, &(0x7f0000000000)=[{&(0x7f0000000200)=""/200, 0xc8}, {&(0x7f00000003c0)=""/152, 0x98}, {&(0x7f0000000480)=""/4096, 0x1000}], 0x3}, 0xfffffffe}], 0x1, 0x2120, 0x0) 1.507440642s ago: executing program 1 (id=35): openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x141442, 0x40) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080), 0x80382, 0x0) r1 = socket$inet6_icmp(0xa, 0x2, 0x3a) sendmsg$inet6(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="aabfd9ac49284dff", 0x8}], 0x1, &(0x7f0000001240)=ANY=[], 0x1058}, 0x4001) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000040)={0x5, 0x13, 0x7, 0x3, 0xa, 0x0, 0x3, 0x54, 0x2d22b85d880a5550}) 1.444584233s ago: executing program 1 (id=37): mount$bpf(0x0, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000100), 0x800000, &(0x7f0000006240)={[{}]}) (async) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x25, &(0x7f00000004c0)=0x9, 0x4) 1.444305973s ago: executing program 2 (id=38): r0 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), r0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl1\x00', r1, 0x4, 0x0, 0x0, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x1a}, @dev={0xfe, 0x80, '\x00', 0x30}, 0x80, 0x0, 0x1, 0x1}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000180)={'ip6tnl0\x00', r2, 0x0, 0x0, 0x0, 0x4, 0x8, @empty, @empty, 0x0, 0x1, 0xfffffffe, 0x1}}) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x240, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)=0xf) ioctl$TCFLSH(r3, 0x400455c8, 0x4) ioctl$TCFLSH(r3, 0x800455ca, 0x4000000) 1.430557184s ago: executing program 1 (id=40): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000140)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x1e7d, 0x2d51, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x80, 0x71, "", [{{0x9, 0x4, 0x0, 0xfe, 0x1, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x81, 0x3, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x2, 0xc1, 0x1}}}}}]}}]}}, 0x0) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r1, 0x8983, &(0x7f0000000000)={0x6, 'dummy0\x00', {}, 0x4}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000040)={0x0, 'veth0_vlan\x00', {0xffe}}) syz_usb_connect$uac2(0x4, 0xd9, &(0x7f0000000780)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x20, 0xd8c, 0x201, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xc7, 0x3, 0x1, 0x8, 0xb0, 0x9, {0x8, 0xb, 0x0, 0x0, 0x1, 0xc, 0x20, 0x30}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x6, 0x1, 0x27, 0x40}, [@selector_unit={0x8, 0x24, 0xb, 0x2, 0x3, "f776f1"}, @mixer_unit={0x7, 0x24, 0x4, 0x1, 0x17, 'U4'}, @processing_unit={0xf, 0x24, 0x8, 0x3, 0x5, [0x1, 0x1, 0x0, 0x3, 0x1]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x0, 0x1, 0x8, {0x8, 0x25, 0x1, 0x2, 0x33, 0x40, 0xd04f}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_discrete={0xb, 0x24, 0x2, 0x1, 0x2, 0x2, 0x1, 0x3, "957bb1"}, @format_type_ii_discrete={0xc, 0x24, 0x2, 0x2, 0x9, 0x267d, 0x5, "7801ed"}, @as_header={0x10, 0x24, 0x1, 0x4, 0x8, 0x3, 0x3, 0x2, 0x1}, @format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x6, 0xb91, 0x5}, @format_type_i_discrete={0xa, 0x24, 0x2, 0x1, 0x6, 0x3, 0x1, 0xa, "5ae2"}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x2, 0x5}]}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0xdf, 0x0, 0x8, {0x8, 0x25, 0x1, 0x80, 0x30, 0x5, 0x81}}}}}}}}]}}, &(0x7f0000000180)={0xa, &(0x7f0000000280)={0xa, 0x6, 0x200, 0xf4, 0x8, 0x7f, 0x8, 0x4}, 0xc6, &(0x7f00000003c0)={0x5, 0xf, 0xc6, 0x6, [@ss_cap={0x0, 0x10, 0x3, 0x2, 0xe, 0xf7, 0x9, 0x2}, @ss_container_id={0x14, 0x10, 0x4, 0xfd, "2296d93a1886b544d3bc57573c90fa2f"}, @generic={0x72, 0x10, 0x3, "c69c4b1a8b7b374dce8af250a5ab7b875b0a1d809bf631842b274e8c16b7a2ffc9006a9b11c2e7214c788583333061994588cf096f64e1da9203e303961cb0c34a14e3b6b915f2830f969b4e32a5b272ab677b0ba0fe386a0adc4da2f470ed437bec405004391eeccffcab31f8c8c0"}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x9, 0x4, 0x0, 0x8}, @generic={0x24, 0x10, 0x1, "fc6291e3a9ad9ea823814c06c32e138d8cd1d2baf056b3244e3995094ed41790c8"}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0x0, 0xb, 0xc1}]}, 0x7}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000000c0)={0x2c, &(0x7f0000000540)={0x40, 0xb, 0x1c, {0x1c, 0x2, "c26313852642692c3cbdeace918d0fb74237973661d67a0c5544"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 1.332464976s ago: executing program 0 (id=42): r0 = syz_open_dev$loop(&(0x7f00000000c0), 0x6, 0x80) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fc, 0x0, 0x0, 0x6}, 0x10) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000440)=@req={0x203fc, 0x7, 0xfffffffe, 0x40}, 0x10) recvmmsg$unix(r1, &(0x7f0000001f40)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000480)=""/4081, 0xff1}], 0x1}}], 0x1, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000040)=""/40, 0x28}], 0x1}, 0x7}], 0x1, 0x40000182, 0x0) close(r2) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x180, 0x0) ioctl$PPPIOCATTCHAN(r3, 0x40047438, &(0x7f0000000040)=0x4) ioctl$LOOP_SET_CAPACITY(r0, 0x4c07) 1.297673907s ago: executing program 3 (id=45): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040)) prlimit64(0x0, 0x0, &(0x7f00000000c0)={0x9, 0x401}, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x39, 0x7, 0x3, 0x180, 0x100, 0x10, 0xf1, 0xf, 0x10, 0x5, 0x0, 0x26, 0x0, 0xa, 0x0, 0xbd9], 0x4000, 0x43180}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x7, 0x6, 0x4, 0x200000000000043, 0x2000004, 0x0, 0x2004cb, 0x0, 0xa3c, 0x200, 0x8, 0x8000000009, 0x803, 0x0, 0x9, 0x9], 0xeeee8000, 0x202}) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f00000001c0)={{0x3000, 0x10000, 0x8, 0x0, 0xb, 0xe6, 0x40, 0x0, 0x0, 0x81, 0x80}, {0x5000, 0x33000, 0x3, 0x0, 0x42, 0x5, 0x6, 0x6, 0x36, 0xd, 0x6, 0x89}, {0x0, 0x0, 0x9, 0x5, 0x3, 0x7, 0x0, 0x9, 0x1, 0xa4, 0x5, 0x5}, {0x0, 0xeeee0000, 0x9, 0x6, 0x5, 0x42, 0xb, 0x0, 0x8, 0x4, 0xf}, {0xf000, 0x1000, 0xf, 0x3, 0x17, 0x7, 0x9, 0x8, 0x7, 0x9, 0xf7, 0x97}, {0xeeefa000, 0xffff1000, 0xc, 0xa0, 0xb1, 0x8, 0x3, 0x6, 0x82, 0x2f, 0x1, 0x7}, {0x54000, 0x10000, 0xf, 0x5, 0x7, 0x5, 0x7, 0x3, 0x8, 0x1, 0x40, 0x70}, {0x9000, 0x4000, 0xa, 0x5, 0xcd, 0x7, 0xff, 0x9, 0x2, 0xc, 0xb0, 0x83}, {0xeeee0000, 0x30}, {0xf000, 0x7}, 0xe0040010, 0x0, 0x3000, 0x2024, 0x3, 0x0, 0x100000, [0x6800000000000000, 0x5, 0x2, 0x20008]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 483.941428ms ago: executing program 0 (id=46): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000400)={0x2, 0x4e23, @multicast1}, 0x10) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x43, &(0x7f0000000340)=0x5c0d, 0x4) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x1c1842, 0x0) ioctl$FS_IOC_GETFLAGS(r2, 0x80086601, 0x0) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000000)={0x2, 0x24e23, @loopback}, 0x10) r3 = socket(0x10, 0x803, 0x0) setsockopt$sock_int(r3, 0x1, 0x2f, &(0x7f0000000040)=0xffffffff, 0x4) sendmsg$IPVS_CMD_SET_SERVICE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB="a8000000", @ANYRES16, @ANYBLOB="000229bd7040fbdbdf250200000038000180060002002b00000008000800fcffffff080008000000000014000300ff010000000000000000000000010001060001000a0000002c0001801200080009000000060001000200000006000200ff0000000600020004000000060001000a00000030000380080005007f00000114000600fc020000000000000000000008000000050008000f"], 0xa8}, 0x1, 0x0, 0x0, 0xc010}, 0x20000840) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), r4) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r4, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000180)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010326bd6000000000002d9300000c000180080001"], 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040814) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000040)=0x500, 0x4) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r6, 0x1, 0x12, &(0x7f0000000140)=0xfffff21c, 0x4) r7 = socket(0x10, 0x803, 0x0) sendto(r7, &(0x7f0000000080)="120000001200e7ef00341618a585107b462e", 0x12, 0x10, 0x0, 0x0) recvmmsg(r7, &(0x7f0000000fc0)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000003d40)=""/4053, 0xfd5}, {&(0x7f00000008c0)=""/212, 0xd4}, {&(0x7f00000000c0)=""/110, 0x6e}, {&(0x7f0000002c00)=""/4100, 0x1004}, {&(0x7f00000003c0)=""/249, 0xf9}, {&(0x7f0000000500)=""/286, 0x11e}, {&(0x7f0000000140)=""/79, 0x4f}, {&(0x7f0000000cc0)=""/246, 0xf6}, {&(0x7f0000000280)=""/129, 0x81}], 0x9}, 0x72}, {{0x0, 0x0, 0x0}, 0x800}, {{0x0, 0x0, 0x0}, 0x1f77}, {{0x0, 0x0, 0x0}, 0x9}, {{0x0, 0x0, 0x0}, 0xfffffffd}, {{0x0, 0x0, 0x0}, 0x2090d2}, {{0x0, 0x0, 0x0}, 0xe4f}, {{0x0, 0x0, 0x0}, 0x1}], 0x8, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000540)='v', 0x1, 0x4040, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) 483.638088ms ago: executing program 0 (id=47): r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) r1 = syz_genetlink_get_family_id$gtp(&(0x7f00000003c0), r0) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1003080a}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x24, r1, 0x9e4c936630f6ffb1, 0x70bd28, 0x25dfdbff, {}, [@GTPA_FLOW={0x6, 0x6, 0x1}, @GTPA_FAMILY={0x5, 0xd, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x8814}, 0x4) recvmmsg(r0, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000280)=""/227, 0xe3}, {&(0x7f0000001a40)=""/217, 0xd9}, {&(0x7f0000003500)=""/4096, 0x9ec}, {&(0x7f0000001d80)=""/161, 0xa1}, {&(0x7f0000000680)=""/134, 0x86}, {&(0x7f0000002c40)=""/146, 0x92}, {&(0x7f0000002d00)=""/128, 0x37}, {&(0x7f0000000000)=""/260, 0x104}, {&(0x7f0000000140)=""/88, 0x58}], 0x9}, 0xe}, {{0x0, 0x0, 0x0}, 0xa}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}, 0xffffffff}, {{0x0, 0x0, 0x0}, 0xfffffffe}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}}], 0x7, 0x40000100, 0x0) 471.081558ms ago: executing program 0 (id=48): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8905, &(0x7f0000000340)={'pim6reg0\x00', @remote}) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r2, &(0x7f0000002080)={0x1f, 0x5}, 0xe) r3 = socket(0x10, 0x3, 0x0) write(r3, &(0x7f0000002480)="3c00000058001f000307f4f9002304000a04d6490800010002010002070003800500000099db973b91aa057972513500b0406700912deb5b85932234", 0x3c) r4 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r4, &(0x7f0000000140)={0x18, 0x2, {0x0, @local}}, 0x1e) connect$pptp(r4, &(0x7f0000000080)={0x18, 0x2, {0x0, @rand_addr=0x64010102}}, 0x1e) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0001, 0x0) ioctl$PPPIOCATTCHAN(r5, 0x40047438, &(0x7f0000000340)=0x1) write$ppp(r5, &(0x7f0000000040)="9b7a", 0x2) r6 = ioctl$USERFAULTFD_IOC_NEW(0xffffffffffffffff, 0xaa00) sendfile(r1, r6, &(0x7f0000000140)=0x8, 0x1) setsockopt$bt_BT_DEFER_SETUP(r2, 0x112, 0xf, &(0x7f0000000080), 0xa6) r7 = open$dir(&(0x7f0000000000)='./tracefs_dir/free_buffer\x00', 0x2100, 0x124) mkdirat(r7, &(0x7f0000000040)='./tracefs_dir\x00', 0xfd) mount(0x0, &(0x7f00000000c0)='./tracefs_dir\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_SUBVOL_CREATE(r0, 0x5000940e, &(0x7f00000003c0)={{}, "2d7992bee6fad663fbe9ceffc647550463de885f9024b7b062b9373394b47d514c9eea7c255e3f08de94cd51f065b54adf06b2f54101e692de173065c5a91aa36644d05fb7ef5b05112e44726760eb4700b200332b49ab345742f3dcbc8aee578af48946fa0bfa212871d60b5c5162cb303731d0ec222cef56e4a5c971f096f42147b2833b389c02490006ffa0abf3cc604908cb31c78576bbee5e3925123007a58681b64924b05b4e74a7f2c375e53eda5e4fa0c7f69f30f66c8643b3382485ece7e9d88114b2c2819a33f449211c75e04770957577fa9b33dd47e542e989feeb5a56d710699364abbcea8020e76da5a38f9538ad513b36846cd6645af400dd8ad8a4a0e0ed775b199ffdcbdceb21af5746982b5b55353f3e6845d80f952c900f38d78277c45cfba566264c125ef7b7d1ef81f958806d020bdc5c1bbfeb430324589f15558a4593ad3db2153e3ee29a9c06195d311156f116ddb209771db34420197a5fcc9e937e0244c42084f73e897f822931bce6ded01d44c02de344e7749c5f9fa2ec027a3a626ab2dac38439f3654601a263f933b8040e43be4c938ef52161bdc59f1142c76b3eb50cd4e26a979d8c7d6ad387c1af900a1dbd060dba8125b634a6c1b73c239b12e3ea3a0cfc05a712a6559984761e487ee330b16c3d855e477d0ebef74bb8146661472ad61092635c599bd699bd856af727d28b399f6674cbfcd4b4f7dfe9616a32b551b48995f31f056a9524dd85260c3642f9d4b550ec2b0d0a78a9e3a22e4f04cb28bfdf3f811d3fc350df2edaba115bd3ab76f903ea39d64ba41987893e22ba1f25dc8ff7ce06a043fb3132ae6796254993ebac10142fc50058087551dae4dd7851cd221622a9780b84834ef5383a7759d502498a286afe4e90fbefbd64eb95b193988fc77a4f54e1a3d295585192cf7883de27a03835a6b991bffe45e74881aa1f37da8ea82194e80f4a4699095f1b7197c339f48b27d37876cda8ea2066167a0e68d8eab8568620c8eda7920841dc55dad1001e4d5995e28d3687c01f4e7d84dba5399ecf6613aed6436e07a773a087595bdeb618e413a2bf86f40bfa11eaeb48717779c4c46cc3ca5328d556e7ade5ee753a767ddcf7867f47e75f2059007f64154a96975dc182827345177f763446b5b2bdca9ad7f54f2de443d996a5927cba181b9c928071849ce0500cf61587151426ba1ad073a78131728c4c4d64610134b49b0357ad5b21568d48b3b920bcec0e7d5d314efa2bf0cfe07ff45b5e8789b7ccba1a7aaa6357cefdfdfa99c106559cd69bb3201a64aa6be866429604a80eb76678c4a65193d8cbe7b015239952f8c8d27cfba722816187a2c948ddcd80a069d54db976b5588f5e559ec62fe094f9bef6dd754a58f97323432709fdbb1b9fd914c466654efcf8dcc1ef8bcf620dc9186a9b5a008c2cb2c0180ad9465c807569c3f27b43964fe62a8135841617cef0f802f39d2ff96b2d7b0777c4e83ad1e8f1eb7be2882332910bf5662fdd0389b2eca19ba9dd146b7f7acd2c5a7ee1bd5e1dc6442027f473cbe8eb69add0be771db6597f90688f54267b7bc9b17728cad8ca9dbcad3ad5de3ca60ef7b25983a75bd6ea05882f64b7d4cb3a2f7603beebe5acedbddf4f8ebd7ccffdba3a05b7313200b1cfa45350f5077156863c1d54e02c322cce6abac05d5fdb9e96cdd8bb4d3bfa64778df36b52ebe040398bf90012a3c5eae89ea4202d05e5d5970183552655a2b26076237503e88a4d1202b2c59227924dbd57c49e399d45b89b799bcd339f7d00b4fd9c0b088eb7db07d6d3500d2c01f2f8437b95753bfd06b2143961ce1738a3b77ea2160fc5b4d36c56eb2d92dd59d1edabf4b61a341b229a7f05c48facb9f209c83c1d06c0c892b6857e5a88655825406b0ff1c341c3e8d4d3ce1e6817bafb7c5d053b963351ddf763bebaa9c08f2ed34355d5531f7aa4501f99250eb94d0413398a315c5d838d6e180b59030b7020809ce6f0e73a471051afed3705a19769b858b744ddea6012d651e09734ec4b1c4e6225c5d492e7c1627c51a469f453ec479ede61418ed267eae4323abc82f09568cf3a4f8da97928f4f2acb6ec2021231c3799d010fde565c9f3600adfde215ccdda2086cdd2e68848acc4b91b2ffe2e01dd712949a585acfb317e44dbeb06f6c45b4e2fe3d37668f02a702649d5ff7deda065fcf7fcdec74f90e1ba0137ed865c2e33fba66d1a529a9c377f2750d336463704ed293e77432b973a216468c17e596e163816e282b71e85e78c24a0cff38040f83ba3835acec21b2f4e94d2daac77c0f35421c1b487620e7b8daba2c282cb033cc003ce27f16839596b0dffa4c8e79b5dbcc36753e9bd4c1c950cefad0cca5db151706108736ad091ab962267dc8ae04c2a0fc6d6cac0a70f58b5ea45caacb7f279eb500db173daa51c7c3492109a8174bc9ee79dca1a4368d995926cf61e9733f22358e3a99ff7b0989b980edf036bc6574ce0faa0a0cfaa923de090f101212a168d3f286dc46500a4e64e5bcd98bb9dcf8924441c7ad3eccb7fd54f7e84b8c6a11bc413aff4e92a82c90fbfe81c92c09301ddd275c9d2e6080fa3ea4dfc7fa436e430bb2d554c61c9a7b99e918e0bd63e8a6ff613bdc7646ec1e169767bf57a1ec7cebd898ef2d5f4b92593c836fbd66e77a18a0de2fb7cfe66cc75922a1ad7031ad69421dd4d3b0e6b0573b02ec0b957f51ff1c1706efee918c7f2ae9023b9637c8bfa096e3ca6a4fb6415ed77d94e74933349dd4638eff9c2501ee439901be35d60a4cd2e7f62b8184518190e028d459965f45ed10cffb3d5ca39a64924b3d01921740be2269d6be505b3ec9304871b2d6a6835588d2fb5393302c737baafa342adf3d1f18067de7e88fcde5326e6fea875008bea16096a993a3aa36c771ddf5d5b8c2f00ac0da94e706bb84dbf07544a94ec08a2a0a017a3eb32db20b562d090e7429c6929ddc6e73100b7271d067208cab903d919067df9a6e79f6f00341fe4101bf1443b0b4059c7d82ed1ca255ef23d36aeb3fe181fc9b8a281689cf8cd6b5569d99dc4b57d355353d2c15e167d7135282fbd14cd625e3f3cbae832ade2956c621d59ab906252d9464b1ca75ccf46fe43188e56c8cb45cb58952e7015f2f8ee020bf8768783cb9cfd95a42de53ca412e806dbaa0d0e5adac8e41c4bc29014c0575d972a780cb37a932042a7e076386c0b3257febcaa5b92127d4a4455f77c35ddd305e938c5d8a00f8da784e5be6a1877b37900d81dc9c453a99645a0d24fb62774658f32869e2b4ad524e033bbc6fb26a6726986a33bba66894f80b22bac2d3e8cff52383cb0b2ca3647e60cafb18a87e26b13bc1aa6772201d8523493b131387e68d9bdedcb5573805b0dcfbd43282d96c531078b16a9455ce7986c412206ec2b98de81e22e89a1bf13282ffaaa3dca32ac83cdc52120a150526595faad2c627e7c1fde751cfdd0cac5be7138528c7f1fe5be195143bb50c24196c6239d0488d10a644b81f0d8938e9104de8c9482fbe5077474ed50412f27b07c30ff133933c55416b87813ce8bf6a4d5a2b7af0682c8cb951490d4a6282444fb0a5d013276796efea3b80f7080895799b9e92bc512230cf4e3fb16f685481dc267421f0ee5a532dcb9f062e1dd61ab238b39384314f88064430751d8d194f9d7b14ddd3b0709cd10d46ba9efa7fa8dd79bdf95146297192e08726fb27902f0f68a4e5ca45c7963d3f23aa2a3567628be51dc09b2bc22947244572706f8dff778ec2d19d0572e42d3da55fc8261921befecb6d60f0e8ecc38f525cd6165c17575f9bfe1edd9345c8949b4f722d7c86d58d89ec567303b97829cd71b049c40caf9de55496e7ec45af1fe73181cea218d66f4b961d4b23bd02283143a9359fc2a8ad149e1fe5c99a9bdf2aa41a314f085c6f9a1343b68f1da217917b75088732952b838241223dc735bf8666a1bf245cca0cb515c454b04d036cae8836706aefa6c8cb1d82dd10b9a9477af98138c2a7602ff0c540714c04f3fea14cb2bc5faac6eb39ffa8fa0ac23f971f682e4f8143bda4de9b9e86d5f0889bb30febb6cf13ee3ce181573e8688152f4e1137f3f2186d5b5f466d357d57a3bf0bcfff54cecbcc891a092302621b1c6f8e38271db1cc02b34b3283f76ca97c876160f630bb113cd1a98e4149b0ee10574a5d89897aca78225aa4a69d0454818a3f02b1a24af1aa1ec8acffde69915556f672c8f85f84d9ab6227e760443f5627d151d5e78d1baf9a817bf4eff4a195204b19edb536d245a847c87ac30081d768213cae2f366561ac1a7ce97b9e410b9979514881a4d329b8b0ac4a431099a8dac3c22badd33dc92c46855e41656681bb8bac117f698b3d8f82134d412d87f0e81c8f1c73a3da6a601124688cd68d708b8fee3572169cf4f2663a67d576b423789469dab083d1045384f1c3062dc5eab41caa07e45c38bf8cdfade2897f55d644d0ad798c85ce3ee18d5034c798ab2332c539ddd57f80f4802c9e3a729a786f5ce49bb5405d5f4717811ee304944db6c341f05b75d9988afacafad47abb43dea77e457529a88a332d1814ea6e233193a53469382904c6e6b7ef53c8c207a0b5aac976e256f7d7139c7cff2d6a54617d0b77a977ff093c1a6b07e26ceddcc830e78d212039dc8e31e19666961e08c91672b7a35a1ab61be2eb9870efed35167ad91b29ab1c8e54711f1d47942688cfb9901c5580cdc6b9ad04c253d0820e679ec30f34e1b1321228422d91f906dbc9572b9c36b05b7c0039f47364eaf7aa88a501f704e6bca4bbc88874a75c95acbc73a9df3618ff0d4dedb979494683432132894c532a72d3f2f18a9a627af333189d514e51d64c33e5ee3fa6ddc180cc9ca9c48f77e63d70366c3e7fd5883544ca0f8ec502eb46940b0425b32fa5c8f51cd969c32db71a99c7d56c7c22295af2c0731cb8a649773205d59273854a67c5c6f09f7523ce06e4d14ff0b112663aed141043d2f084a412fa8a6ecf00f69a03c0f8ee6c7dda3300461db3f9492c1dcbed1f7b4506aaab0454a08c864d039a728a5355757945a51c503abb88885f497e8a7d715be421fa9167ffd346f4b7d865eee78af1e23d0de966442e70b743d5339397e9ececfa188377ba701a98550988b33188684a55f6c0edbc54615cd08938a6121e633f869b9fde647934befa7d3f5597476bfae3fc3cc67a243ed79abbe9d4ecce256dc283fe0182739dd7a3a87b3400b9d05ac58a169e460f541f5aa81e4d1829b2c4fa0cda7538d278d7ab0ef9684293e89fc37f17986e89278625c39edfd0f613db1203534944a50a5eab98b0d91543ba3232cf4570e762e2a84ce302f909b5d943093d87e9517c8efb84f0a34c7104ef8840e1f35a121b7db2158ad7ca843adeb7e3b3cb8b30e8beddc3d7619a949dc0ca2043254771b89170bb26cc063f87cebd925a6bf3182a0f514a56fa342536e83e3b19c1b4f47cd2645f0c49e2fa6f2469d14649f3d15c00ed95109d648b150b1d26c696b55950e6a0a65dc2af25e92bc2651c12b3d944c5514a059fb38f3d481e4c14e000fd81b0c8e5834ce8e5a39cecc8aaa5d9db3c881f59992388a7ebf3171ef4a62653a01596ee8f61d25f9ce080b6419a5092c9743f06f520b34f0f2ea9819ec892fdad89c57d47cb7d1221d9f18ec0ccf541e7d26e0978f4c1592d593e4de5f654c3ef078541deb14e2a5395908e76a533a09e30b429197fbccd9"}) r8 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./tracefs_dir/free_buffer\x00', 0x1, 0x0) write$selinux_create(r8, 0x0, 0x0) 440.197039ms ago: executing program 0 (id=49): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x422b80, 0x0) syz_io_uring_setup(0x420b, &(0x7f0000000080)={0x0, 0x0, 0x20, 0x2, 0x8000000, 0x0, 0x0}, 0x0, 0x0, &(0x7f0000000000)) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1a) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000000)={0x60000, 0x0, 0x1}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r2, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc}) ioctl$KVM_SET_GSI_ROUTING(r2, 0x4008ae6a, &(0x7f0000000280)={0x1, 0x0, [{0x8001, 0x4, 0x0, 0x0, @sint={0xffffff33, 0x9}}]}) 384.51204ms ago: executing program 0 (id=50): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='1', 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) write(r1, &(0x7f0000000300)='1', 0x1) 383.30214ms ago: executing program 3 (id=51): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x143802, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r0, 0xb522f000) futex(&(0x7f0000000040)=0x2, 0x84, 0x2, 0x0, 0x0, 0x22) ioctl$BLKFLSBUF(r0, 0x1261, &(0x7f0000000080)=0x1) fstatfs(r0, &(0x7f00000000c0)=""/202) madvise(&(0x7f0000000000/0x400000)=nil, 0x40001e, 0x15) r1 = socket$inet6_icmp(0xa, 0x2, 0x11) r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g_uac2/functions/uac2.usb0/p_chmask\x00', 0x1, 0x0) write(r2, &(0x7f0000000900)='3\n', 0x2) close(r2) preadv(r1, &(0x7f0000003540)=[{&(0x7f0000000840)=""/150, 0x96}, {&(0x7f0000000940)=""/160, 0xa0}, {&(0x7f0000002500)=""/4096, 0x1000}, {&(0x7f0000003500)=""/51, 0x33}], 0x4, 0x800, 0x77) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000000)={&(0x7f000095b000/0x2000)=nil, &(0x7f000062f000/0x800000)=nil, 0x2000, 0x1}) recvmmsg$unix(r2, &(0x7f0000002440)=[{{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f00000001c0)=""/151, 0x97}, {&(0x7f0000000280)=""/51, 0x33}, {&(0x7f00000002c0)=""/97, 0x61}, {&(0x7f0000000340)=""/157, 0x9d}, {&(0x7f0000000400)=""/98, 0x62}, {&(0x7f0000000480)=""/222, 0xde}, {&(0x7f0000000580)}], 0x7, &(0x7f0000000640)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xa0}}, {{0x0, 0x0, &(0x7f0000002300)=[{&(0x7f0000000700)=""/75, 0x4b}, {&(0x7f0000001180)=""/4096, 0x1000}, {&(0x7f0000002180)=""/134, 0x86}, {&(0x7f0000002240)=""/87, 0x57}, {&(0x7f00000022c0)=""/16, 0x10}], 0x5, &(0x7f0000002380)=[@rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x88}}], 0x2, 0x42, &(0x7f00000024c0)={0x77359400}) 321.830962ms ago: executing program 3 (id=52): r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet6(0xa, 0x802, 0x0) getsockopt$inet6_opts(r1, 0x29, 0x3b, 0x0, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ptype\x00') r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x800, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_msfilter(r6, 0x0, 0x29, &(0x7f0000000000)={@multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x7, [@private=0xa010101, @private=0xa0100fe, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x1e}, @dev={0xac, 0x14, 0x14, 0x22}, @remote, @empty]}, 0x2c) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000003, 0x13, r5, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f00000000c0)={[0x6, 0x1100000000000000, 0x6, 0x10000109e93, 0xffffffffffffffff, 0x400000, 0x3, 0xfffffffffffffffc, 0x2, 0x7fffffffffffffff, 0xc1, 0x2, 0x6, 0x5, 0x8000000000000001, 0xfffffffffffffffc], 0xd5d5c004, 0x1354}) ioctl$KVM_RUN(r5, 0xae80, 0x0) preadv(r2, &(0x7f0000000640)=[{&(0x7f0000000280)=""/182, 0xb6}], 0x1, 0x4f, 0x0) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000640)={&(0x7f0000000080)=ANY=[@ANYBLOB="02030003120000002cbd7000fbdbdf2504000900c00000001c8737af296d02eef9dc348f2bb1dbf11af7fd90168a530a05df4563305e191b58a5d6dd050006006c0000000a004e2400000008ff010000000000000000000000000001000000000000000002000100000000004000070c000000c005000500000000000a004e2400000009000000000000000000000000000000000600000000000000"], 0x90}, 0x1, 0x7}, 0x0) 276.548143ms ago: executing program 3 (id=53): r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./proc/sys/net/ipv6/conf/syz_tun/addr_gen_mode\x00', 0x1, 0x0) syz_ublk_setup_io_uring(0x41d, &(0x7f0000000480)={0x0, 0xfd6, 0x0, 0xffffffff, 0x158, 0x0, r0}, 0x0, 0x0, 0x0) mount(0x0, 0x0, &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x16c01, 0x89) syz_open_dev$mouse(&(0x7f0000000300), 0x4, 0x410080) linkat(r1, &(0x7f0000000340)='./file0\x00', r1, &(0x7f0000000380)='./file0\x00', 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0xc0686611, &(0x7f0000000180)={0x67, 0x4, 0x18, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000240)={[0x5836, 0x8, 0x7, 0x4000000000000e51, 0xfffffffffffffffe, 0x5479, 0x1035, 0x200000000006, 0x0, 0x32a, 0xfffffffffffffffe, 0xffffffff, 0xbf4, 0xfff, 0x8000000000005, 0x800000068], 0x2000, 0x80cd4}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 161.907206ms ago: executing program 3 (id=54): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1a2) mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r0 = fsopen(&(0x7f0000000140)='pipefs\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) close(r0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1881, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r0]) chdir(&(0x7f00000003c0)='./bus\x00') mkdir(&(0x7f00000003c0)='./file0\x00', 0x25) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0x82, 0x0) mount$9p_tcp(&(0x7f0000000180), &(0x7f0000000200)='./file2\x00', &(0x7f00000002c0), 0x1102080, &(0x7f0000000400)={'trans=tcp,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@uname={'uname', 0x3d, '{]/::)'}}, {@debug={'debug', 0x3d, 0x8000000000000000}}, {@version_9p2000}, {@debug={'debug', 0x3d, 0x6}}, {@version_u}]}}) 0s ago: executing program 3 (id=55): r0 = syz_open_dev$tty1(0xc, 0x4, 0x3) ioctl$GIO_UNISCRNMAP(r0, 0x4b69, &(0x7f0000000000)=""/235) r1 = accept$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @initdev}, &(0x7f0000000140)=0x10) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e22, @private=0xa010101}, 0x10) r2 = accept(r1, &(0x7f00000001c0)=@vsock={0x28, 0x0, 0x0, @host}, &(0x7f0000000240)=0x80) ioctl$TIOCMBIS(r0, 0x5416, &(0x7f0000000280)) getsockopt$inet_mtu(r2, 0x0, 0xa, &(0x7f00000002c0), &(0x7f0000000300)=0x4) recvmsg$can_raw(r2, &(0x7f0000000740)={&(0x7f0000000340)=@isdn, 0x80, &(0x7f0000000680)=[{&(0x7f00000003c0)=""/74, 0x4a}, {&(0x7f0000000440)=""/12, 0xc}, {&(0x7f0000000480)=""/167, 0xa7}, {&(0x7f0000000540)=""/214, 0xd6}, {&(0x7f0000000640)=""/30, 0x1e}], 0x5, &(0x7f0000000700)=""/48, 0x30}, 0x40002023) setxattr$trusted_overlay_origin(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800), 0x2, 0x1) socket$vsock_stream(0x28, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000880)={0x0, 0x0}) futimesat(r1, &(0x7f0000000840)='./file0\x00', &(0x7f00000008c0)={{r3, r4/1000+60000}}) r5 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r2, &(0x7f0000000900)={0x20000005}) clock_gettime(0x0, &(0x7f0000000a00)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000940)={0x1, 0x80, 0x1, 0x5, 0x8, 0x0, 0x6ccff6fd, 0xffff}, &(0x7f0000000980)={0x990, 0x2, 0x100, 0xffff, 0x3, 0x8, 0x9, 0x9b}, &(0x7f00000009c0)={0x2, 0x8, 0xff, 0x6, 0x5, 0x2, 0x7fffffffffffffff, 0x9}, &(0x7f0000000a40)={r6, r7+10000000}, &(0x7f0000000ac0)={&(0x7f0000000a80)={[0x9]}, 0x8}) clock_gettime(0x0, &(0x7f0000000bc0)={0x0, 0x0}) rt_sigtimedwait(&(0x7f0000000b00), &(0x7f0000000b40), &(0x7f0000000c00)={r8, r9+10000000}, 0x8) r10 = socket$igmp(0x2, 0x3, 0x2) getsockopt$IPT_SO_GET_ENTRIES(r10, 0x0, 0x41, &(0x7f0000000c40)={'mangle\x00', 0xbf, "fa2ab3b575e9ba0d4a978808e500adb15376ec4b0816e2d81e16ff3e12416fb515df0dc8e79f8b005b6ca59c24d59b708a7c644c989dadb400a2edf62b86af8470e48c5e79f276315feaa9d3d7ab6b58e98d103ce5fc1b3103d533c27ed51f3682292b92da0db836cbc0744d7290181853601b3596299b81c7777317d0e45858e2a0201b61d4baf469a19a1aeadd7f895cd25ff4c10cfb1d33e3f6089666f9b625177ba6e33392cfa4048590cb8943f0c04f86eaa66f725e41d48695b639fa"}, &(0x7f0000000d40)=0xe3) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000ec0)={&(0x7f0000000d80)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000e80)={&(0x7f0000000dc0)={0xb4, 0x0, 0x300, 0x70bd27, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x8c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xea2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xb8f4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}]}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7b41}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x14}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}]}, @TIPC_NLA_MEDIA={0x14, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x8084}, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000f00), r2) recvfrom$inet(r2, &(0x7f0000000f40)=""/4096, 0x1000, 0x104, 0x0, 0x0) r11 = creat(&(0x7f0000001f40)='./file0\x00', 0x10) write$FUSE_NOTIFY_POLL(r11, &(0x7f0000001f80)={0x18, 0x1, 0x0, {0x8}}, 0x18) socket$xdp(0x2c, 0x3, 0x0) clock_nanosleep(0x5, 0x0, &(0x7f0000001fc0)={0x0, 0x989680}, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r10, 0x0, 0x2a, &(0x7f0000002000)={0x6, {{0x2, 0x4e23, @private=0xa010100}}}, 0x88) getsockopt$inet6_mreq(r11, 0x29, 0x1b, &(0x7f00000020c0)={@loopback, 0x0}, &(0x7f0000002100)=0x14) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r11, 0x89f1, &(0x7f00000021c0)={'syztnl0\x00', &(0x7f0000002140)={'syztnl1\x00', r12, 0x2f, 0x7, 0x2, 0x80000000, 0x65, @loopback, @private1={0xfc, 0x1, '\x00', 0x1}, 0x7, 0x10, 0x3264, 0xc207}}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.219' (ED25519) to the list of known hosts. [ 24.624780][ T36] audit: type=1400 audit(1786041705.760:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 24.628793][ T286] cgroup: Unknown subsys name 'net' [ 24.647537][ T36] audit: type=1400 audit(1786041705.770:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.674839][ T36] audit: type=1400 audit(1786041705.790:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.675237][ T286] cgroup: Unknown subsys name 'devices' [ 24.797419][ T286] cgroup: Unknown subsys name 'hugetlb' [ 24.803120][ T286] cgroup: Unknown subsys name 'rlimit' [ 24.898584][ T36] audit: type=1400 audit(1786041706.040:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 24.921821][ T36] audit: type=1400 audit(1786041706.040:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 24.946652][ T36] audit: type=1400 audit(1786041706.040:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 24.970849][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 24.979690][ T36] audit: type=1400 audit(1786041706.120:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.005216][ T36] audit: type=1400 audit(1786041706.120:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.038378][ T36] audit: type=1400 audit(1786041706.180:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.064022][ T36] audit: type=1400 audit(1786041706.180:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.064706][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.361266][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.368400][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.375545][ T295] bridge_slave_0: entered allmulticast mode [ 26.381918][ T295] bridge_slave_0: entered promiscuous mode [ 26.388535][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.395650][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.402803][ T295] bridge_slave_1: entered allmulticast mode [ 26.409229][ T295] bridge_slave_1: entered promiscuous mode [ 26.449342][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.456449][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.463534][ T293] bridge_slave_0: entered allmulticast mode [ 26.469935][ T293] bridge_slave_0: entered promiscuous mode [ 26.488512][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.495631][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.502714][ T293] bridge_slave_1: entered allmulticast mode [ 26.509113][ T293] bridge_slave_1: entered promiscuous mode [ 26.521349][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.528497][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.535668][ T296] bridge_slave_0: entered allmulticast mode [ 26.541930][ T296] bridge_slave_0: entered promiscuous mode [ 26.551271][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.558577][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.565701][ T296] bridge_slave_1: entered allmulticast mode [ 26.572029][ T296] bridge_slave_1: entered promiscuous mode [ 26.587588][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.594673][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.601845][ T294] bridge_slave_0: entered allmulticast mode [ 26.608152][ T294] bridge_slave_0: entered promiscuous mode [ 26.617535][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.624655][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.631874][ T294] bridge_slave_1: entered allmulticast mode [ 26.638241][ T294] bridge_slave_1: entered promiscuous mode [ 26.779351][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.786544][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.793862][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.800931][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.826202][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.833306][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.840626][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.847692][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.864114][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.871231][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.878647][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.885716][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.913184][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.920312][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.927657][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.934712][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.952277][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.959715][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.967366][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.974589][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.982391][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.989807][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.997133][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.004322][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.025773][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.032847][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.040557][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.047665][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.065084][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.072201][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.084544][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.091665][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.107755][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.114833][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.129196][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.136321][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.154539][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.161656][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.176361][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.183431][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.235548][ T294] veth0_vlan: entered promiscuous mode [ 27.246145][ T295] veth0_vlan: entered promiscuous mode [ 27.253959][ T296] veth0_vlan: entered promiscuous mode [ 27.263634][ T293] veth0_vlan: entered promiscuous mode [ 27.279585][ T296] veth1_macvtap: entered promiscuous mode [ 27.289066][ T295] veth1_macvtap: entered promiscuous mode [ 27.308813][ T293] veth1_macvtap: entered promiscuous mode [ 27.315939][ T294] veth1_macvtap: entered promiscuous mode [ 27.365966][ T296] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 27.435776][ T318] fuse: Bad value for 'fd' [ 27.446624][ T318] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 27.476946][ T322] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=770 sclass=netlink_route_socket pid=322 comm=syz.3.4 [ 27.490676][ T320] netlink: 288 bytes leftover after parsing attributes in process `syz.0.1'. [ 27.500447][ T320] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1'. [ 27.537412][ T327] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000 conventional PCI endpoint [ 27.603341][ T333] fuse: Bad value for 'group_id' [ 27.608716][ T333] fuse: Bad value for 'group_id' [ 27.765126][ T46] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 27.916832][ T46] usb 3-1: unable to get BOS descriptor or descriptor too short [ 27.925054][ T46] usb 3-1: not running at top speed; connect to a high speed hub [ 27.932898][ T311] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 27.940945][ T46] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 27.951411][ T46] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 27.966055][ T46] usb 3-1: New USB device found, idVendor=dead, idProduct=beef, bcdDevice= 1.00 [ 27.975185][ T46] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.983221][ T46] usb 3-1: Product: syz [ 27.988094][ T46] usb 3-1: Manufacturer: syz [ 27.992733][ T46] usb 3-1: SerialNumber: syz [ 28.014967][ T66] usb 1-1: new low-speed USB device number 2 using dummy_hcd [ 28.025013][ T9] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 28.094984][ T311] usb 4-1: device descriptor read/64, error -71 [ 28.155943][ T9] usb 2-1: device descriptor read/64, error -71 [ 28.176964][ T66] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 28.187237][ T66] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 28.196288][ T66] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 28.210089][ T324] r8152 3-1:1.0: Expected endpoints are not found [ 28.211843][ T66] usb 1-1: string descriptor 0 read error: -22 [ 28.222881][ T46] usb 3-1: USB disconnect, device number 2 [ 28.222980][ T66] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 28.240834][ T66] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.251639][ T66] cdc_ncm 1-1:1.0: CDC Union missing and no IAD found [ 28.258604][ T66] cdc_ncm 1-1:1.0: bind() failure [ 28.365010][ T311] usb 4-1: device descriptor read/64, error -71 [ 28.394966][ T9] usb 2-1: device descriptor read/64, error -71 [ 28.452100][ T350] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 28.460813][ T350] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 28.473323][ T46] usb 1-1: USB disconnect, device number 2 [ 28.605014][ T311] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 28.634970][ T9] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 28.734972][ T311] usb 4-1: device descriptor read/64, error -71 [ 28.765646][ T9] usb 2-1: device descriptor read/64, error -71 [ 28.841465][ T356] kvm: MWAIT instruction emulated as NOP! [ 28.974965][ T311] usb 4-1: device descriptor read/64, error -71 [ 29.005045][ T9] usb 2-1: device descriptor read/64, error -71 [ 29.085054][ T311] usb usb4-port1: attempt power cycle [ 29.091266][ T363] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000 conventional PCI endpoint [ 29.115025][ T9] usb usb2-port1: attempt power cycle [ 29.434966][ T311] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 29.454953][ T9] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 29.456509][ T311] usb 4-1: device descriptor read/8, error -71 [ 29.476163][ T9] usb 2-1: device descriptor read/8, error -71 [ 29.505093][ T46] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 29.596060][ T311] usb 4-1: device descriptor read/8, error -71 [ 29.606121][ T9] usb 2-1: device descriptor read/8, error -71 [ 29.654921][ T46] usb 1-1: Using ep0 maxpacket: 8 [ 29.661242][ T46] usb 1-1: config 0 has no interfaces? [ 29.669037][ T46] usb 1-1: New USB device found, idVendor=12d1, idProduct=fae2, bcdDevice=70.8b [ 29.678204][ T46] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.686302][ T46] usb 1-1: Product: syz [ 29.690494][ T46] usb 1-1: Manufacturer: syz [ 29.695148][ T46] usb 1-1: SerialNumber: syz [ 29.700743][ T46] usb 1-1: config 0 descriptor?? [ 29.791722][ T36] kauditd_printk_skb: 60 callbacks suppressed [ 29.791741][ T36] audit: type=1400 audit(1786041710.930:134): avc: denied { create } for pid=364 comm="syz.2.18" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 29.802347][ T365] Unsupported ieee802154 address type: 0 [ 29.817674][ T36] audit: type=1400 audit(1786041710.930:135): avc: denied { setopt } for pid=364 comm="syz.2.18" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 29.842393][ T36] audit: type=1400 audit(1786041710.930:136): avc: denied { ioctl } for pid=364 comm="syz.2.18" path="socket:[3700]" dev="sockfs" ino=3700 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 29.868409][ T9] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 29.875054][ T311] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 29.876504][ T36] audit: type=1400 audit(1786041710.930:137): avc: denied { bind } for pid=364 comm="syz.2.18" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 29.903432][ T36] audit: type=1400 audit(1786041710.930:138): avc: denied { read write } for pid=364 comm="syz.2.18" name="vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 29.927901][ T36] audit: type=1400 audit(1786041710.940:139): avc: denied { open } for pid=364 comm="syz.2.18" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 29.934349][ T46] usb 1-1: USB disconnect, device number 3 [ 29.952472][ T36] audit: type=1400 audit(1786041710.940:140): avc: denied { ioctl } for pid=364 comm="syz.2.18" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 29.958110][ T311] usb 4-1: device descriptor read/8, error -71 [ 29.999632][ T9] usb 2-1: device descriptor read/8, error -71 [ 30.006048][ T36] audit: type=1400 audit(1786041710.940:141): avc: denied { bind } for pid=364 comm="syz.2.18" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 30.025920][ T36] audit: type=1400 audit(1786041710.960:142): avc: denied { setopt } for pid=364 comm="syz.2.18" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 30.046130][ T36] audit: type=1400 audit(1786041711.150:143): avc: denied { bind } for pid=369 comm="syz.2.20" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 30.136106][ T9] usb 2-1: device descriptor read/8, error -71 [ 30.136830][ T311] usb 4-1: device descriptor read/8, error -71 [ 30.245150][ T9] usb usb2-port1: unable to enumerate USB device [ 30.255146][ T311] usb usb4-port1: unable to enumerate USB device [ 30.466055][ T46] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 30.614920][ T46] usb 3-1: Using ep0 maxpacket: 32 [ 30.625934][ T46] usb 3-1: unable to get BOS descriptor or descriptor too short [ 30.634393][ T46] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 30.644614][ T46] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 30.655773][ T46] usb 3-1: New USB device found, idVendor=041e, idProduct=3040, bcdDevice= 0.40 [ 30.665010][ T46] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.673093][ T46] usb 3-1: Product: syz [ 30.677395][ T46] usb 3-1: Manufacturer: syz [ 30.682072][ T46] usb 3-1: SerialNumber: syz [ 30.928808][ T46] usb 3-1: unit 255 not found! [ 30.941928][ T402] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000 conventional PCI endpoint [ 30.958505][ T46] usb 3-1: USB disconnect, device number 3 [ 30.986583][ T317] udevd[317]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 31.248543][ T406] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 31.551745][ T423] binder: Bad value for 'max' [ 31.575084][ T426] TCP: TCP_TX_DELAY enabled [ 31.630353][ T310] Bluetooth: hci0: Frame reassembly failed (-84) [ 31.874983][ T10] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 32.024983][ T10] usb 2-1: Using ep0 maxpacket: 8 [ 32.031394][ T10] usb 2-1: config 0 interface 0 has no altsetting 0 [ 32.038283][ T10] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2d51, bcdDevice= 0.00 [ 32.047560][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.056466][ T10] usb 2-1: config 0 descriptor?? [ 32.552755][ T455] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=455 comm=syz.0.47 [ 32.582693][ T457] netlink: 'syz.0.48': attribute type 3 has an invalid length. [ 32.670716][ T10] usbhid 2-1:0.0: can't add hid device: -71 [ 32.678499][ T10] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 32.691527][ T10] usb 2-1: USB disconnect, device number 6 [ 32.821966][ T471] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000 conventional PCI endpoint [ 32.936562][ T473] 9pnet_fd: Insufficient options for proto=fd [ 33.007510][ T294] ------------[ cut here ]------------ [ 33.013082][ T294] WARNING: CPU: 1 PID: 294 at fs/overlayfs/util.c:605 ovl_dir_modified+0x15a/0x190 [ 33.022496][ T294] Modules linked in: [ 33.026633][ T294] CPU: 1 UID: 0 PID: 294 Comm: syz-executor Not tainted syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 33.038447][ T294] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 33.048591][ T294] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 33.054271][ T294] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 ae 82 97 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d e9 4c eb 5d 03 cc e8 26 be 3e ff <0f> 0b e9 3e ff ff ff e8 1a be 3e ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 33.073951][ T294] RSP: 0018:ffffc9000b61fb88 EFLAGS: 00010293 [ 33.080098][ T294] RAX: ffffffff8248b39a RBX: 0000000000000000 RCX: ffff888103fdb900 [ 33.088144][ T294] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 33.096169][ T294] RBP: ffffc9000b61fbb0 R08: ffff88811dbec0bf R09: 1ffff11023b7d817 [ 33.104184][ T294] R10: dffffc0000000000 R11: ffffed1023b7d818 R12: 0000000000000000 [ 33.112451][ T294] R13: dffffc0000000000 R14: ffff88811dbec020 R15: ffff8881136d3880 [ 33.120732][ T294] FS: 000055556b8ed500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 33.129770][ T294] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 33.136410][ T294] CR2: 00007ffee5964dc0 CR3: 000000013089a000 CR4: 00000000003526b0 [ 33.144431][ T294] Call Trace: [ 33.147773][ T294] [ 33.150760][ T294] ovl_do_remove+0x824/0xd10 [ 33.155451][ T294] ? ovl_set_redirect+0x780/0x780 [ 33.160529][ T294] ? ovl_rmdir+0x11/0x30 [ 33.164826][ T294] ovl_rmdir+0x1e/0x30 [ 33.168982][ T294] vfs_rmdir+0x3de/0x560 [ 33.173281][ T294] incfs_kill_sb+0x102/0x220 [ 33.177947][ T294] deactivate_locked_super+0xd5/0x270 [ 33.183372][ T294] deactivate_super+0xb8/0xe0 [ 33.188247][ T294] cleanup_mnt+0x438/0x4d0 [ 33.192726][ T294] __cleanup_mnt+0x1d/0x40 [ 33.197304][ T294] task_work_run+0x1e8/0x260 [ 33.201956][ T294] ? __cfi_task_work_run+0x10/0x10 [ 33.207155][ T294] ? __x64_sys_umount+0x12e/0x180 [ 33.212218][ T294] ? __cfi___x64_sys_umount+0x10/0x10 [ 33.217669][ T294] ? fpregs_restore_userregs+0x11c/0x260 [ 33.223355][ T294] resume_user_mode_work+0x35/0x50 [ 33.228553][ T294] syscall_exit_to_user_mode+0x63/0xb0 [ 33.234060][ T294] do_syscall_64+0x63/0xf0 [ 33.238570][ T294] ? clear_bhb_loop+0x50/0xa0 [ 33.243308][ T294] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 33.249302][ T294] RIP: 0033:0x7fb34c99f317 [ 33.253756][ T294] Code: a2 c7 05 dc 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 33.273431][ T294] RSP: 002b:00007ffee5965418 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 33.281939][ T294] RAX: 0000000000000000 RBX: 00007fb34ca34474 RCX: 00007fb34c99f317 [ 33.289989][ T294] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffee59654d0 [ 33.298009][ T294] RBP: 00007ffee59654d0 R08: 00007ffee59664d0 R09: 00000000ffffffff [ 33.306074][ T294] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffee59665c0 [ 33.314224][ T294] R13: 00007fb34ca34474 R14: 00000000000080a1 R15: 00007ffee5967690 [ 33.322304][ T294] [ 33.325401][ T294] ---[ end trace 0000000000000000 ]--- [ 33.331152][ T294] ------------[ cut here ]------------ [ 33.336719][ T294] WARNING: CPU: 0 PID: 294 at fs/overlayfs/util.c:605 ovl_dir_modified+0x15a/0x190 [ 33.346354][ T294] Modules linked in: [ 33.350284][ T294] CPU: 0 UID: 0 PID: 294 Comm: syz-executor Tainted: G W syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 33.363644][ T294] Tainted: [W]=WARN [ 33.367626][ T294] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 33.377846][ T294] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 33.383550][ T294] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 ae 82 97 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d e9 4c eb 5d 03 cc e8 26 be 3e ff <0f> 0b e9 3e ff ff ff e8 1a be 3e ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 33.403278][ T294] RSP: 0018:ffffc9000b61fb88 EFLAGS: 00010293 [ 33.409434][ T294] RAX: ffffffff8248b39a RBX: 0000000000000000 RCX: ffff888103fdb900 [ 33.417474][ T294] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 33.425576][ T294] RBP: ffffc9000b61fbb0 R08: ffff88811dbec0bf R09: 1ffff11023b7d817 [ 33.433587][ T294] R10: dffffc0000000000 R11: ffffed1023b7d818 R12: 0000000000000000 [ 33.441614][ T294] R13: dffffc0000000000 R14: ffff88811dbec020 R15: ffff8881136d3880 [ 33.449660][ T294] FS: 000055556b8ed500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 33.458663][ T294] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 33.465314][ T294] CR2: 00007f0f317ef2f8 CR3: 000000013089a000 CR4: 00000000003526b0 [ 33.473368][ T294] Call Trace: [ 33.476753][ T294] [ 33.479745][ T294] ovl_do_remove+0x824/0xd10 [ 33.484372][ T294] ? ovl_set_redirect+0x780/0x780 [ 33.489468][ T294] ? __cfi_down_write+0x10/0x10 [ 33.494369][ T294] ovl_rmdir+0x1e/0x30 [ 33.498526][ T294] vfs_rmdir+0x3de/0x560 [ 33.502815][ T294] incfs_kill_sb+0x197/0x220 [ 33.507603][ T294] deactivate_locked_super+0xd5/0x270 [ 33.513035][ T294] deactivate_super+0xb8/0xe0 [ 33.517897][ T294] cleanup_mnt+0x438/0x4d0 [ 33.522368][ T294] __cleanup_mnt+0x1d/0x40 [ 33.526868][ T294] task_work_run+0x1e8/0x260 [ 33.531510][ T294] ? __cfi_task_work_run+0x10/0x10 [ 33.536732][ T294] ? __x64_sys_umount+0x12e/0x180 [ 33.541803][ T294] ? __cfi___x64_sys_umount+0x10/0x10 [ 33.547261][ T294] ? fpregs_restore_userregs+0x11c/0x260 [ 33.552946][ T294] resume_user_mode_work+0x35/0x50 [ 33.558141][ T294] syscall_exit_to_user_mode+0x63/0xb0 [ 33.563641][ T294] do_syscall_64+0x63/0xf0 [ 33.568137][ T294] ? clear_bhb_loop+0x50/0xa0 [ 33.572863][ T294] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 33.578858][ T294] RIP: 0033:0x7fb34c99f317 [ 33.583312][ T294] Code: a2 c7 05 dc 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 33.603015][ T294] RSP: 002b:00007ffee5965418 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 33.611511][ T294] RAX: 0000000000000000 RBX: 00007fb34ca34474 RCX: 00007fb34c99f317 [ 33.619549][ T294] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffee59654d0 [ 33.627588][ T294] RBP: 00007ffee59654d0 R08: 00007ffee59664d0 R09: 00000000ffffffff [ 33.635626][ T294] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffee59665c0 [ 33.643623][ T294] R13: 00007fb34ca34474 R14: 00000000000080a1 R15: 00007ffee5967690 [ 33.651662][ T294] [ 33.654710][ T294] ---[ end trace 0000000000000000 ]--- [ 33.664976][ T432] Bluetooth: hci0: command 0x1003 tx timeout [ 33.671082][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -110