last executing test programs: 15.221699586s ago: executing program 3 (id=87): socket$nl_route(0x10, 0x3, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) syz_pidfd_open(r0, 0x0) (async) r1 = socket(0x1e, 0x1, 0x0) connect$tipc(r1, &(0x7f0000000800)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}}}, 0x10) (async) write$binfmt_misc(r1, &(0x7f0000000840), 0x2000011a) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000880), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(r2, &(0x7f00000008c0)={0x0, 0xa1, &(0x7f0000000900)={&(0x7f0000000940)={0x24, r3, 0x201, 0x400000, 0x0, {{}, {}, {0x8, 0x11, 0x4}}}, 0x24}}, 0x0) (async) r4 = socket(0x10, 0x803, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000700), r4) sendmsg$BATADV_CMD_SET_VLAN(r4, &(0x7f00000007c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000780)={&(0x7f0000000000)={0x2c, r5, 0x10, 0x70bd2c, 0x25dfdbfb, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x4}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x3ff}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}]}, 0xff67}, 0x1, 0x0, 0x0, 0x840}, 0x40080) (async) faccessat(0xffffffffffffffff, 0x0, 0x3) (async) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) (async) unshare(0x64000600) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000380)='/sys/kernel/cpu_byteorder', 0x20600, 0x180) read$FUSE(r8, &(0x7f0000002e80)={0x2020}, 0x2020) sendmsg$inet(r7, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r6, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=[@cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x78}, 0x80) (async) socketpair$unix(0x1, 0x2, 0x0, 0x0) (async) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) r12 = dup(r11) syz_ublk_setup_queues(r12, r10, &(0x7f0000000140)={0x0, 0x4c86, 0x8000, 0x1, 0x98, 0x0, r12}, &(0x7f0000000480)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7e59, 0x80, 0x2, 0x167}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x222c, 0x10000, 0x1, 0x10a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc090, 0x800, 0xfffffff9, 0x270, 0x0, r9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xa367, 0x0, 0x0, 0x231, 0x0, r9}}], 0x4, &(0x7f0000002dc0)={0x2e, 0x27, 0x0, r9, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x3}, 0x0, 0x0, '\x00', {0x1, 0xfc1, 0x0, &(0x7f0000001dc0)=@buf_512="2766084e0153a964c45eee1f5c331b73cbeea7b743ee5b5313ae89a36a581f4b4641d0c5f3ebb327542c60540e8fc0ec7d23f8821764992543f32e89c8a25d2ae5e87c6f7b24a6631cf5ca24f16eb1f437cd8b3184c145a0612d9bc5b7a4fba127793a4c14ca2da66109147d78caca75970cce577548d7cad45f1b2963074b790959076cf6dad52835cc695ea25b5b09b9c2adb5181913f2616c74e37d7b23a66f5770c9f830ea454c8c5cf20e4f3808d316b38ad5255a965adb659ddc666005a1aa18a5a69b4c6fcf5756518857b10f75b793f4f6e9b51963a575b5eb88af85880843b132fd1bc3b98632b25b0e777566b5f59671b65149cfbf47ebc718d2274d09062c090719b90500000000000000f6881190e14dc8562aabfcc34d21ca312129ad497688e19b37d0dea6cbbf4f6c29ad6c2bb094544c0f266a0ba56e6f0c5c84f69156eca40819704ffab55863d08c6e97cef829eadcc8a7844b639393f8df84cbe81f5eb6a83986d7db24ba314c0e729aac1bccff8da42e76de6897c5c2517787d38e7fc4109cb7dee5e5020b0709ebdd89785ac01f50ce21d5b48851caeea729c481f819cb35573604ae1854b88f91fc63fc838ec129cf63b387e88b2720cff86a4c9b69dbd7b6bb38f28730588d9d0f3102a50f9c1cf02e77a666b71b18c15df0b25fba0c4d23741260258c121700"}}, &(0x7f0000002e40)) 15.133152406s ago: executing program 3 (id=89): r0 = syz_open_dev$usbmon(&(0x7f0000000840), 0x0, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0xe9ac0000) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) r2 = landlock_create_ruleset(&(0x7f00000001c0)={0x40, 0x1, 0x2}, 0x30, 0x0) landlock_restrict_self(r2, 0x0) r3 = socket$unix(0x1, 0x2, 0x0) bind$unix(r3, &(0x7f0000000200)=@abs={0x1, 0x0, 0x4e24}, 0x6d) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000280)={0x1, &(0x7f00000002c0)=[{0x6, 0xc0, 0x2, 0x7fff0000}]}) r4 = landlock_create_ruleset(&(0x7f0000000300)={0x2000, 0x0, 0x1}, 0x30, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) landlock_restrict_self(r4, 0x0) connect$unix(r3, &(0x7f0000000340)=@abs={0x1, 0x0, 0x4e24}, 0x6d) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="ec00000021000100feffffff00000000fc020000000000000000000000000005ac14141d00000000000000000000000000000000000000040200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="be6b6e00000000009c0011000a0101010000000000000000000000007f000001000000000000000000000000ff010000000000000000000000000001fc00000000000000000000000000000133040000843500080a000a000a0101010000000000000000000000007f00000100000000000000000000000000000000000000000000ffffe0000002ffffffff00000000000000000000000033040000033500000a000200e872ae93d041a8fd8e072a1ebd2e13ef8f4f7e5443e23a30e9758f425012f7122c26d0a9d46ffc4047b5e38d9edb3df3459d26724ab631ab2f2f78665fbcb53b"], 0xec}, 0x1, 0x0, 0x0, 0x6a8dd86ef567f079}, 0x4020800) r5 = openat$selinux_policy(0xffffff9c, &(0x7f0000000880), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1800003, 0x12, r5, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$UFFDIO_COPY(r5, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000752000/0x1000)=nil, &(0x7f0000235000/0x1000)=nil, 0x1000}) ioctl$MON_IOCG_STATS(r0, 0xc0109207, &(0x7f00000008c0)) 14.862153923s ago: executing program 3 (id=91): mkdirat(0xffffffffffffff9c, &(0x7f0000000740)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000007c0)='./dev\x00', &(0x7f0000000800)='devtmpfs\x00', 0x84, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x6142, 0xbc) mkdir(&(0x7f0000000080)='./bus\x00', 0xde) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x1d0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x8, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0x40, 0x83) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000200)={0x90, 0x200, 0x4, 0x5, 0xf34}) fdatasync(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000840)='./mnt\x00', 0x1ff) mount(&(0x7f0000000880)=@filename='./dev/sda1\x00', &(0x7f00000008c0)='./mnt\x00', &(0x7f0000000900)='ext4\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r1 = socket(0x11, 0x2, 0x0) setsockopt(r1, 0x107, 0x12, &(0x7f0000000000)="11106e00", 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./mnt\x00', 0x101000, 0x90) getdents(r2, &(0x7f0000000240)=""/39, 0x27) 14.842310185s ago: executing program 3 (id=92): r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) r1 = syz_open_dev$usbfs(&(0x7f0000000240), 0x1ff, 0x301) stat(&(0x7f00000002c0)='./proc\x00', &(0x7f0000000300)) ioctl$USBDEVFS_CONTROL(r1, 0xc0105500, &(0x7f0000000280)={0x80, 0x6, 0x301, 0x0, 0xe0, 0x101, 0x0}) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x4000, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x2, 0x8) write(r2, &(0x7f0000000180)='27', 0x2) mount(0x0, &(0x7f00000001c0)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x4000, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x2, 0x0, 0x2}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) (async) syz_open_dev$usbfs(&(0x7f0000000240), 0x1ff, 0x301) (async) stat(&(0x7f00000002c0)='./proc\x00', &(0x7f0000000300)) (async) ioctl$USBDEVFS_CONTROL(r1, 0xc0105500, &(0x7f0000000280)={0x80, 0x6, 0x301, 0x0, 0xe0, 0x101, 0x0}) (async) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x4000, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x2, 0x8) (async) write(r2, &(0x7f0000000180)='27', 0x2) (async) mount(0x0, &(0x7f00000001c0)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x4000, 0x0) (async) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x2, 0x0, 0x2}) (async) 13.733528038s ago: executing program 3 (id=94): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) move_mount(0xffffffffffffff9c, &(0x7f0000000300)='.\x00', 0xffffffffffffff9c, 0x0, 0x267) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./dev\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') open(&(0x7f0000000040)='./bus\x00', 0x1cd27e, 0x10) r0 = open(&(0x7f0000000040)='./cgroup.cpu/cpuset.cpus\x00', 0x1a1342, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) socket$key(0xf, 0x3, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x2) sched_setscheduler(r1, 0x2, &(0x7f00000001c0)=0x7) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$setregs(0xd, r2, 0x0, &(0x7f00000003c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44cc4c7b3664e29fb") sendmsg$key(0xffffffffffffffff, &(0x7f0000000480)={0x40000000, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="02020409100000000000004c"], 0x80}}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) ptrace$getregset(0x4205, r2, 0x200, &(0x7f0000000540)={0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000240)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r4, &(0x7f00000002c0), 0x0, 0x4040901) recvmmsg(r3, &(0x7f0000000300), 0x4000087, 0x2, 0x0) r5 = fsopen(&(0x7f0000000340)='cgroup\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000380)='name', &(0x7f00000002c0)='ccnA\xf6gr\xe7lo_', 0x0) fallocate(r0, 0x0, 0xfffc, 0x401) 13.7073819s ago: executing program 3 (id=95): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000b40), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$selinux_access(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000100)="84af6c", 0x3}], 0x1) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fcf000/0x18000)=nil, &(0x7f0000000b80)=[@textreal={0x8, 0x0}], 0x1, 0x68, 0x0, 0x0) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000bc0)={"04dfc86351907bcbc9293982262169af775bedfb0a63cb8031c328f61ac038da9e81e6847961e656af1a9f48ac011b67d68f8725991345a1f8ed6450a11246c6424cd7837f6bfc47209662ba0d0f44149fcefbbf6fa5b40644bce6cf7210107f57b850d0c9af06c766af1c637aa057167a6910e2e185b8d972e49eeda481d9a58394ef43958ce7407e73d6460653fc672aa4ab6a26bd1a631fa3a0f2b025ba137b8e3f933af28e1ea9984bc0438ea00b5f5b16a93a22bb83ff1c92407a946d4dc7d347d526db0e71bb38f873937ca7343fb7248867adf5decd52e74f05c768c3b1c8282b9b1b1bc0f7ae08917b2abe3d3305e32b8db562d19dd7c83fde6dbe03ef72aa7ddc00144895b2a1981105046a28ca0852521a65d4000000000000e36417a251af7100392b6cdb0bbed4670d746c45fb5589f279cfd594911cb11f2a7336af10b2332e731f2eec8287c735f2346449f1629fde95d6c78bed90645bb280e222976d5721ee6dd6068cfd6174d2382e524672a2656eed5cf34eff27c2974deebf2aa6226e3fa2f15ea8db5891a062d422607a06000000dfaaeadfb2498e79fe9e47089b2a8bbdbdcbb076ebbd9c8fdc6246c00a34176a1c46a924ab4c3877215e5666c7b384e9238b3ad6ac559d90e22170d6915c7150a1858eb3f20a1847642018840b49c335074496991fb3193914f5213846ff8bf5b389298d797dfdd4a1d116caec17f13152c9699caab72a96d364134266030e67ada0de8d2bb05091f7d855fe1c435574856b0f8de9dc6af14ce179e3c0b6b563ccb8e02900fa9412784b0e5fa71a6e4499fecd1343d289daeb929d0cbd96f9f4501bc9d6d9d0b4f462aaf2d56ce92ae6438bb3e3aa258c8c4ba6646f99f5a3d4f14f677353722cc81a8ef1f68d41ad1bef785b248faee830613461239487bee1b53724eb28301420ced16a8110a8680c91c665f8eff65e2d48f95db7ad4f30d079a39a2286fb3df3472d330f6f11fc7d1939a923c502630004314037ec808df7cec279df5785fa2124d1650563799defc378cb9506ee7142eb108b3f4125ade3d9a73646bfdac795c753895b2ad51d358eff496d1c1a885c30b85b50eca89bf14ee50ae3301805f1691b3a391d7575c9a0a514710ad3e590491c60bdab122222c66cbb155452a01cb9750d14ffdc77ad11d4495c53bf38c8185c769c1409ebac8101d6784c9510790dd1df8fa6f2b4dbdbde3bdcbf6bfc456f68b680f2595853178e89a32e9c56d66fd2210fb0fc0e3cda61e6980e16e47ae8071182af80950c43ba221fe072e6945107a6edcd38bfeb201a657969bf340960a67e30987e56c953a177404fdf67b5d99bbc06d705a0fc9659336b458ea0d575ddfe59706738d1e65c50527200"}) ioctl$KVM_SET_TSC_KHZ_cpu(r2, 0xaea2, 0x7) prctl$PR_SET_SECCOMP(0x16, 0x1, &(0x7f0000000000)={0x2, &(0x7f0000000040)=[{0x54, 0x0, 0x2, 0xaf44}, {0x6, 0x0, 0x2}]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 4.11686223s ago: executing program 1 (id=144): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x41, 0x0) r1 = dup(r0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43, 0x9, 0x1, {0x23, 0x4, 0x4, 0x0, 0x7f, 0x20005, 0x7, 0x200, 0x6}}, 0x43) (async) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000180)={0x0, 0x4, 0x0, 0x0, 0x1b, "0098ba7d82070071ec25f2f792f6b4ffff6304"}) (async) syz_open_pts(r1, 0x8040) (async) r2 = syz_open_pts(r0, 0x80) dup3(r2, r0, 0x80000) read(r0, &(0x7f00000001c0)=""/227, 0x25) (async) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x860100, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_INTERRUPT(r5, 0x4004ae86, &(0x7f0000000080)=0x5) r6 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$selinux_load(r6, &(0x7f0000000780)=ANY=[@ANYBLOB="8cbea40bdc6d19b5668a0312faeb6c225a7cf9080000005345284c696e757879"], 0xb) 3.931361149s ago: executing program 1 (id=145): madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) madvise(&(0x7f0000e3a000/0x2000)=nil, 0x2000, 0x16) r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x1, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000000040)='blkio.bfq.io_merged\x00', 0x275a, 0x0) openat$cgroup(r1, &(0x7f0000000400)='syz0\x00', 0x200002, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/thread-self/fail-nth\x00', 0x2002, 0x2) socket$netlink(0x10, 0x3, 0x0) r3 = fsopen(&(0x7f00000001c0)='cgroup2\x00', 0x0) syz_open_procfs$pagemap(0x0, &(0x7f0000000200)) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fsmount(r3, 0x0, 0x8) socket$key(0xf, 0x3, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='.\x00', 0x121000, 0x0) sendmsg$IPSET_CMD_TEST(r1, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0xf8, 0xb, 0x6, 0x6e564cd15eb52420, 0x0, 0x0, {0x7, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_ADT={0x50, 0x8, 0x0, 0x1, [{0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x20}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x4}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x79}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x4}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x6}}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_ADT={0x58, 0x8, 0x0, 0x1, [{0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_COMMENT={0xc, 0x1a, '}@[&:[/\x00'}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0xb4}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0xb9}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_PACKETS={0xc, 0x19, 0x1, 0x0, 0x4d44}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x80000000}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_COMMENT={0xc, 0x1a, 'pagemap\x00'}}]}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}]}]}, 0xf8}, 0x1, 0x0, 0x0, 0x4894}, 0x850) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000780)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000800)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000840)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000880)={0x0, 0xfffffffe, 0x18, 0xfffffffe, 0x2f6}, 0x0, 0x1, 0x0, 0x0) syz_usb_connect(0x2, 0xb3, &(0x7f0000000280)=ANY=[@ANYBLOB="12010002ef0201405a22d4e1ada7f5d200010902a1000201008032080b00020e03000009040000000e0100000d240100012700006cdc020101112402010102000000000000000002000009240302010100010009040100000e0200000e240101470081000200000001001b240401015955593200001000800000aa00389b711001000000001e240501008002e0010000000000000000006009001516050001151605000924", @ANYRES32=r4], &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0}) ioctl$SIOCGETMIFCNT_IN6(r2, 0x89e0, &(0x7f0000000440)) r8 = fsopen(&(0x7f0000000140)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r8, 0x6, 0x0, 0x0, 0x0) fsmount(r8, 0x0, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000480)={{{@in=@dev, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@broadcast}}, &(0x7f0000000580)=0xe8) setresuid(0xee01, 0xee00, r9) 2.671678258s ago: executing program 0 (id=151): r0 = socket$inet_tcp(0x2, 0x1, 0x0) recvfrom(r0, &(0x7f00000003c0)=""/164, 0xa4, 0x42, &(0x7f0000000480)=@vsock={0x28, 0x0, 0x0, @host, 0x1}, 0x80) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x161) (async) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x4000, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./proc\x00', 0x1ff) (async) mount(0x0, &(0x7f00000005c0)='./proc\x00', &(0x7f0000000600)='proc\x00', 0x0, 0x0) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r1, &(0x7f0000000680)='6', 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)) (async) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r2, &(0x7f0000000100)='100', 0x3) (async) socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x181) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x140) (async) mount$overlay(0x0, &(0x7f00000001c0)='./bus\x00', &(0x7f0000000240), 0x8, &(0x7f0000000280)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) chdir(&(0x7f00000002c0)='./bus\x00') (async) removexattr(&(0x7f0000000300)='./file0\x00', &(0x7f0000000380)=ANY=[@ANYBLOB="f15a14"]) r3 = creat(&(0x7f0000000200)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_elf64(r3, &(0x7f0000000700)=ANY=[@ANYBLOB="7f454c4603000305090000000000000003003e00f9ffffff040100000000000040000000000000008e0000000000330d00000100380001000000010000000000006e00000000000000000000000000000002008000000000000000000000000000040000000000000000000000000000000000000000d8f3d9d45813a65962babb8858405510ae15e23fa4ca87eea791848152b33cfbc5bbc26d5c31b90792acede3db7481f12dd27651598bade492e1ceacd57500337fe862c3d5a1bfb611018513625a0144adb0431be5c613a1acda2d68a2f3940ffc54539100b986cabaf58d3ccc94b286a8188f9593576e32ae480b6356d6cfbaf7ec18afe1e49555689ad23f616d5d42cbf79b32403220bd6e6d4b926c87240b15d876bedc0d1dd02525a391508c72bca443f2a290853fbe350ab83e53d94f2428cd7118cba2c12459dd110317641ebb5205c411109ef7b26dbe328def56fb69383bc1bc46514771942af74ccd30fa1f0eaf08b9bd909ef95f4e9b04a14748b87ad82123173c7329327061b7fadcbf2597081f979923b0629886b010f76fbc7b3b7f6bb5bf195ba92e74f96de13b1035ac5053cb7e6476fd10af01527220d392edd91af5ffc71006e0470c29cd25bf650c687051000b84f4b233fa1fa1c9d8bd24b569427d0acb45d36583fd2c97bfecf29f6c35032a63df537e79d780a2ca1dd0e269529dc7a05c35234651f3a052d2149c1a6c5450adf2f58791c9cb3d0eb213aaf98098f9ad80889c002f2f51e04fc1b97c731753c82939e7ac6a807fec0f5eacccd3de4eeae9aac39a20c64dbb38ee828ab930bf9fa967ffe4bce52555f4a26091dc3f6a42f815070007bb771677580509cea552f245c2e90000f82781ea17fcbf8f113d4a5235d2e4fd7ceae5b140d38382d5f32eefdac3dfe1bacc03c9d9922ac3631d24851254bf5d02c0fe93bd1f0ec9b4bbc70c4cf2880bceb7ab1762ee3c57e90f8e4d9787a27fc3e859de421778f3854c5919de9ee4d08150f029d92e780263c338ff723ca18fb40ca815c9421189269da07fb6abae36a338d5e5b0032253bf8527e83bec428f84f054c02f0a66197baf09afe3e87bb0e2003b0013d6"], 0x78) close(r3) (async) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) 2.659991659s ago: executing program 1 (id=152): pipe2(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$XFS_IOC_PATH_TO_HANDLE(r0, 0xc0385869, &(0x7f0000001240)={r1, &(0x7f0000000080)='wfdno', 0x100, &(0x7f00000000c0)={@_ha_fsid={[0x0, 0x7]}, {0x9, 0x2, 0x80000000, 0x92c}}, 0x6, &(0x7f0000000100), &(0x7f0000000140)=0x4}) ioctl$BTRFS_IOC_START_SYNC(r1, 0x80089418, &(0x7f0000001280)=0x0) ioctl$BTRFS_IOC_BALANCE_V2(r0, 0xc4009420, &(0x7f0000001340)={0x18, 0x3, {0x5, @struct={0x10000}, 0x0, 0x9, 0x62, 0x100, 0xe80, 0xffffffffffffff14, 0x1, @usage=0xee, 0x855a, 0xc18e, [0x2, 0x80000000, 0xecdc, 0x8, 0x1, 0x80000000]}, {0x6, @usage=0xe9b9, 0x0, 0x9, 0x2, 0x8, 0x200, 0xc8, 0x10, @struct={0x3, 0x7}, 0x3, 0x6, [0x80000001, 0x3, 0x1, 0x5, 0x0, 0x401]}, {0x0, @struct={0xcd, 0x6}, 0x0, 0x8, 0xffffffffffffffff, 0x7, 0x40, 0x0, 0x0, @struct={0x1, 0x8}, 0x1000, 0x0, [0x7, 0x7, 0x3, 0x7, 0x4, 0x8]}, {0x4, 0xd, 0x80}}) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r1, 0x50009417, &(0x7f0000001740)={{r2}, r3, 0x4, @inherit={0x58, &(0x7f00000012c0)={0x1, 0x2, 0x3, 0x4, {0x10, 0x8, 0x8, 0x400, 0x4}, [0x239, 0xf0]}}, @devid=r4}) socket(0x840000000002, 0x3, 0xff) socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000040)='net/raw\x00') pread64(r5, &(0x7f0000000240)=""/4094, 0xffe, 0xe9) mount$9p_fd(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000200), 0x0, &(0x7f0000000000)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 2.200576015s ago: executing program 0 (id=153): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x80001) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000040), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0) chdir(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x715}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000240)={&(0x7f00006c6000/0x400000)=nil, &(0x7f000018b000/0x3000)=nil, 0x400000, 0x0, 0x6040000}) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r4, 0x4138ae84, &(0x7f0000000100)={{0xffff0000, 0xeeee8000, 0xf000, 0x7, 0x7, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81}, {0x1, 0xddccb000, 0xf, 0x0, 0x0, 0x7, 0x0, 0x0, 0x4, 0x1}, {0x118004, 0xdddd8000, 0x18, 0x1e, 0x0, 0x4, 0x81, 0x0, 0x3, 0xe, 0x3, 0x6}, {0xdddd0000, 0x2000, 0xc, 0xfd, 0x5, 0x0, 0x3}, {0x2, 0x25000, 0xd, 0x7, 0x70, 0x81, 0x0, 0x0, 0xfd, 0x1c, 0x7, 0xa8}, {0x100026fff, 0x80a0000, 0x8, 0x4, 0x1, 0x8, 0x0, 0x0, 0x6, 0xfc, 0x86, 0xfe}, {0xeeee8000, 0x26000, 0xf, 0x6, 0x5, 0x0, 0x0, 0x81, 0x0, 0x4}, {0xd000, 0x41000, 0x8, 0x82, 0xfc, 0x10, 0x0, 0xe, 0x0, 0x2}, {0x4000, 0x800}, {0x1, 0xfffe}, 0x40040011, 0x0, 0x0, 0x10, 0x1000010000000001, 0x0, 0x900, [0x0, 0x0, 0x6, 0x5]}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$KVM_SET_MSRS(r4, 0x4140aecd, &(0x7f0000000100)) 2.200122095s ago: executing program 1 (id=154): mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) r1 = dup(r0) connect$unix(r1, &(0x7f0000000000)=@abs={0x1, 0x0, 0x4e20}, 0x6e) r2 = socket$packet(0x11, 0x2, 0x300) bind$packet(r2, &(0x7f0000000380)={0x11, 0x0, 0x1, 0x1, 0x0, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14) write(r2, 0x0, 0x0) 2.168275439s ago: executing program 1 (id=155): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000017c0)={0x1, &(0x7f0000001800)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000d80)=ANY=[@ANYBLOB="2400000001040102000000c9fd0000000000000008000340000104000500010001"], 0x24}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) ioctl$F2FS_IOC_DECOMPRESS_FILE(r1, 0xf517, 0x0) 2.141992151s ago: executing program 1 (id=156): ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, 0x0) r0 = getpgid(0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r1) r2 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1b1c, 0x1b1c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x1, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f0000000080)={0x24, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0022180000000501150091a60906a101090182008c0508950129309102c0"], 0x0}, 0x0) ioctl$EVIOCGLED(0xffffffffffffffff, 0x80404519, 0x0) syz_usb_ep_write(r1, 0x81, 0x2, &(0x7f0000000100)="40a6") r3 = syz_pidfd_open(r0, 0x0) r4 = pidfd_getfd(r3, r3, 0x0) setns(r4, 0x66020000) mount$9p_fd(0x0, &(0x7f0000000840)='.\x00', 0x0, 0x104000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./file0\x00', 0x0) syz_clone(0x498144eef6e2e149, 0x0, 0xffffffffffffff11, 0x0, 0x0, 0x0) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000c40)='./file0\x00', 0x80001) move_mount(r5, &(0x7f0000000c80)='.\x00', 0xffffffffffffff9c, &(0x7f0000000cc0)='./file0\x00', 0x0) mount$bind(&(0x7f0000000d00)='.\x00', &(0x7f0000000d40)='./file0/../file0\x00', 0x0, 0x145091, 0x0) umount2(&(0x7f0000000d80)='./file0/../file0\x00', 0x2) mount$bpf(0x0, &(0x7f0000001140)='./file0/../file0\x00', &(0x7f0000003200), 0x8080, 0x0) 1.980767728s ago: executing program 0 (id=157): r0 = socket$inet_udplite(0x2, 0x2, 0x88) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000100)={'syztnl1\x00', &(0x7f0000000080)={'gretap0\x00', r1, 0x8, 0x700, 0x6, 0x4, {{0xc, 0x4, 0x3, 0x1, 0x30, 0x68, 0x0, 0x7f, 0x2f, 0x0, @multicast2, @local, {[@timestamp_addr={0x44, 0xc, 0xd1, 0x1, 0x5, [{@dev={0xac, 0x14, 0x14, 0x3f}, 0x80}]}, @generic={0x83, 0xf, "945c4b48a08374bfd624a177a7"}]}}}}}) r3 = syz_open_dev$hiddev(&(0x7f0000000140), 0xffff, 0x6ac00) ioctl$EXT4_IOC_CHECKPOINT(r3, 0x4004662b, &(0x7f0000000180)=0x2) r4 = openat$incfs(r3, &(0x7f00000001c0)='.log\x00', 0x1, 0x124) setsockopt$inet6_tcp_int(r4, 0x6, 0x24, &(0x7f0000000200)=0x4, 0x4) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0x541c, &(0x7f0000000240)) ioctl$TIOCL_SETSEL(r4, 0x541c, &(0x7f0000000280)={0x2, {0x2, 0x7ff, 0xff, 0x1ff, 0x3, 0x10}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000340)={'ip_vti0\x00', &(0x7f00000002c0)={'ip_vti0\x00', r2, 0x40, 0x700, 0x5, 0x100, {{0x12, 0x4, 0x0, 0x9, 0x48, 0x65, 0x0, 0x87, 0x2b, 0x0, @loopback, @private=0xa010102, {[@ra={0x94, 0x4}, @noop, @lsrr={0x83, 0x7, 0xf1, [@private=0xa010102]}, @lsrr={0x83, 0x27, 0x5f, [@rand_addr=0x64010102, @private=0xa010101, @multicast2, @multicast1, @rand_addr=0x64010102, @broadcast, @local, @private=0xa010100, @initdev={0xac, 0x1e, 0x1, 0x0}]}]}}}}}) ioctl$ASHMEM_GET_SIZE(r4, 0x7704, 0x0) nanosleep(&(0x7f0000000380)={0x0, 0x989680}, 0x0) setsockopt$inet_int(r4, 0x0, 0x2, &(0x7f00000003c0)=0x4, 0x4) r5 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000400), 0x181080, 0x0) r6 = getpid() fcntl$lock(r5, 0x0, &(0x7f0000000440)={0x1, 0x1, 0x8000, 0x6, r6}) mmap$IORING_OFF_SQ_RING(0x0, 0xffffffff, 0x3000004, 0x1010, r4, 0x0) r7 = syz_open_procfs(r6, &(0x7f0000000480)='net/kcm\x00') write$UHID_INPUT2(r7, &(0x7f00000004c0)={0xc, {0x26, "c1cbc6ac5fa3e0d95b9969a51183569ddc71034a04aa4246913120aec237317358475590e6d9"}}, 0x2c) setsockopt$MRT_ASSERT(r4, 0x0, 0xcf, &(0x7f0000000500)=0x1, 0x4) r8 = signalfd4(r5, &(0x7f0000000540)={[0x5]}, 0x8, 0x80000) syz_open_dev$loop(&(0x7f0000000580), 0x647, 0x120c2) ioctl$SNDRV_TIMER_IOCTL_START(r8, 0x54a0) setpriority(0x328fdd7f2109a92a, r6, 0x7) socket$inet(0x2, 0xa, 0x7) ioctl$SNDRV_TIMER_IOCTL_START(r4, 0x54a0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$RFKILL_IOC_MAX_SIZE(r8, 0x2, &(0x7f00000005c0)=0x9) gettid() quotactl_fd$Q_GETQUOTA(r4, 0xffffffff80000702, 0x0, &(0x7f0000000600)) 1.972610169s ago: executing program 0 (id=158): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000300)={0x0, &(0x7f0000000340)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @guest32=0x4810, 0x6, 0x83}}], 0x68}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xc0a80, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) (async) r6 = memfd_create(&(0x7f0000000080)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xecz\xabq\x95t*T9\xa9\b X \x04\"\x17\xbf\xcb\xccF\xda\xcf\xdd^\xa0\x15\xc0\xcb^h>\x1b\xb5d\xc7\x7f0\x9a&\xb0\x12#\x9c`\xa6\xed\x05\x95g\a\xccYb\xaf\xe9\xb6G?\x9f\xf5\xfe\xc1\xc0JJ\xc8\xd9d\x80\x13\x8fX\xb4\x19\xc4\\\xcb\x89-)\x90\x01\v\xac^\xdbBQ|\xaej;\x92\\\xf8u\x19Y\xee\x99EI\xf1t\xadn<\x9b\xc9\x87\xd0\xa7\x1a\x81\xb9\xc87sq\xd7\x15\xd6\x91O\x9c\x99!9>\xff\xa8\xfa\xe6=d\xcf\xca\xa9\xc61!\xc6P\x13\xd0\x88gZ\xbe\xdfl\xfa\xff\xb0m;d07tx\xbb\xabd\xe5\x16\xc4\xae\xf0', 0x0) ioctl$XFS_IOC_START_COMMIT(r6, 0x7709, 0x0) write(r6, &(0x7f00000001c0)="c6d0feaaeedf1dd187c45dd03d378e5581ecb7aaa52ee3b9689616a6ec86d06343224dbf338d28236bff89e269411dce1f20559f4cf1ce4fbc852f5887264a1989e3963fc5a43d95b6c828b55f822aa747f9b40aa13e450638f0d5a6145a82b86bb87f80fe8542cd87e0b6fab6445809a34b4ca64df33fc1ef68c63cab61fe7dc99fad9405c7646add9483512da5599ac568450385518b9b5bc794cf631d21871c90326e77b599cccf1fa331509734f1b9987fb93d038bf67e34651c6c29c7066f276499fdc5aac73404c79bb51e052a724df8c12dbba4c81a", 0xd9) (async) ioctl$KVM_IOEVENTFD(r5, 0x4040ae79, &(0x7f0000000040)={0x27800000000, 0x200000}) (async) userfaultfd(0x80000) 1.811400435s ago: executing program 0 (id=159): r0 = socket$inet6(0xa, 0x3, 0xff) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}, 0x5}) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e21, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x8000}, 0x1c) 1.752558801s ago: executing program 0 (id=160): r0 = syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c00020100e0000904000001020d0000052406000105240000800d240f0101010000000000000006241a0000150905810308003600000904010000020d000009040101"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000280)={0x2c, &(0x7f0000000000)={0x40, 0x11, 0xdd, {0xdd, 0xe, "80df51b2d6a255e2899eab425ec1c5b96ad35570f07f93fbfd631818f7ea92ea3b4c67e2025d70be862c59463dd7e2236f52851fb7519b7652f9c6244e6044eac75b5daf3c1ac7009b9c0b4fea416c603d334de85b4682e97aab6bdba68be473ce35974376c03e3052e7f759cf44baa7a4869ce0f5f63a51da4b6135e7c820d69743c095efc8e45b21f6f371de81b4e3fabbc3d0c4353b145efa2c1deab08aeed6ea3032c9edabccfee71f6691e1b018876c97f3779580abd8e583c4eee08cc7810451742639f852c5f0161eb369ac75db616d18cb4730a915cfa7"}}, &(0x7f0000000100)={0x0, 0x3, 0x8a, @string={0x8a, 0x3, "b142d99b234bdee5e66e8c6bd34675ea66c68579381cbcbdee35a7540f5e8709f6033bd3311ce6772a48e52018a77f12c9868007c70c600c2a8931d2644688fafb7b14df226c8f78feeebf405a2fdebf349872a4aa5a2f4e72a93a94d9b1ac5c0cb7a24ca5d34d971fa16437f755f4d712ed9fd31dab4594aa55d9594d39f5b6f3abe599a3bb013b"}}, &(0x7f00000001c0)={0x0, 0xf, 0x2b, {0x5, 0xf, 0x2b, 0x3, [@ss_container_id={0x14, 0x10, 0x4, 0x2, "a8ec4c05528e02a16e92b7dbbb18b74c"}, @ext_cap={0x7, 0x10, 0x2, 0x0, 0x8, 0x3, 0x8}, @wireless={0xb, 0x10, 0x1, 0x0, 0x8, 0xa8, 0x1, 0x100, 0x9}]}}, &(0x7f0000000200)={0x20, 0x29, 0xf, {0xf, 0x29, 0x3, 0x4, 0x6, 0x1, "1b260b40", "b49df50c"}}, &(0x7f0000000240)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xef, 0x0, 0xc, 0x4, 0x0, 0x8, 0x8}}}, &(0x7f00000009c0)={0x84, &(0x7f0000000400)={0x40, 0xd, 0xfe, "44084b25f2f02a6ca4f522dfa1c7e7af9516e4a6c2a30fbfd1b1f706277239ad95b4897abfcb5ed5cbcf053c8ad715786ef73bc694fcfc7ffc0d86a029929526a5a3ccbc038cfaa9e4207a4023f3676c49ca73a87c4dd3179fe227a2d849a68f74b7649f7676738dce325697371a12f35f8a481bd51836b7fe9f028a86cd6528fc906e72b93e18aad332acd4407851b5262e40386e9ef346336da0e06752be088343bc6e7ad237a9f2ae25f9c8a59a544ad5e9a73fae7505346e66f8624841281340e0e5f042256686f40fb3ae0c1ae5165d34e3541c01adf5716d7540d99f8a3538cd087924722b016aa86afcb0069b1b1cb99fd19e8f508f5ac9bfe56d"}, &(0x7f0000000540)={0x0, 0xa, 0x1, 0x7}, &(0x7f0000000580)={0x0, 0x8, 0x1, 0x1}, &(0x7f00000005c0)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f0000000600)={0x20, 0x0, 0x8, {0x140, 0x0, [0xff]}}, &(0x7f0000000640)={0x40, 0x7, 0x2, 0x8}, &(0x7f0000000680)={0x40, 0x9, 0x1, 0xc}, &(0x7f00000006c0)={0x40, 0xb, 0x2, "45f5"}, &(0x7f0000000700)={0x40, 0xf, 0x2, 0xfff8}, &(0x7f0000000740)={0x40, 0x13, 0x6}, &(0x7f0000000780)={0x40, 0x17, 0x6, @local}, &(0x7f00000007c0)={0x40, 0x19, 0x2, "9933"}, &(0x7f0000000840)={0x40, 0x1a, 0x2, 0xa}, &(0x7f0000000880)={0x40, 0x1c, 0x1, 0x31}, &(0x7f00000008c0)={0x40, 0x1e, 0x1}, &(0x7f0000000900)={0x40, 0x21, 0x1, 0xf7}}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) r1 = openat$udambuf(0xffffffffffffff9c, &(0x7f00000002c0), 0x2) r2 = memfd_create(&(0x7f0000000a80)='y\x105\xfb\xf7u\x83%:Ml\x9a\x9a\xb8\xe0>(\x13A-\x9a=\xb4r\xf1\x12y\xec;\x90\x06\x7f@\xf4\xe0\xc2\xb9x\xa4\x98S7\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00Q\xcdO\xe3i\xbd\x01\x85\x0e\x19\xce\x82\xd52\x9e\x95\xa7xbh\xf6\xa4c\x8a\xa5,\xdd\x81Z\x04\xf5\xf9\xa1\xe1\xad\xc2`\xf15\xf2$\xf2\x1c\xb0\x87pI\xab.}W\xd3o\xd3n\x9d\xb3>r\x1c<\x1b\xa5\xe27\x9f\x10\xe5\\\x1d\xcd\x91i\xc4\xad\xeb\xe5h[\xf6_\xbeW\b1\x06V\x89\r\x19:S\xf4\x7f8\xcf\xe6\xe1Tl\x00{Z\xb1\x92?\xb2\xd8\xc0\xaf\x96\xff\xe4v\xe8\x04<\xa2\x91Y\xee\xd8Rr\xe1\xdb!Z\xda\x06\xd6\x02\xb4\xfb4\xbb;7\x94\xb6_\xda\x108\x86\xfa\x97\xc2,\x8c\xf4\xaf\xb9\xfd\x8d\xff(\xd3\xbc\xdf}:4\xb9\xa00?\xac\x86@\x87\xb9\x81\xeak\x8d\x8b>\x89I\x0e\xfa\xa7\x1c\xe9\xf1U\xfc=pm6\x10vk90\x99\x15\x96\xa3\xb8_\n\xd1K\xf7m\x1as\xbd\xc4\x19Q\xc2Ge\x0e$\xdd\xec\f:\\g\xc3RnC\xe4\xc1!\xae\xd9h\xa5\xe4K\xcf\xf3\xf7\xe5o\xae\xfa\xa8\xd90Kj\x12\xcd@W\xe5\xfat`\x83\xac\xc8\xc8\xf0\xf1)\xf6A\t\xdc\xbfQ\xa9\xaer\x1d\xa5fY\x9d{\xa6\xeb\xc0\v\\\xb5cv i\b\xfc\xb9\xaf\x1aA~2\xe7\xedj\x89\x1a\x9d\xef5n\x80\xbfu\xdbi\xc7\x9c\x17\xa7`\xf5\x01\xe1v\xb4\xd9\rn\xe1\x86A\x9b \'u\x05\xa6a3\x84z\x8e\xf1\xcd\xce\r\xf8Y3h\xd9\xed\xe8\xb5\x00\x8eCH\xf1\x00\xcfLo\x92y\xafg\xdf\xa8\x9e\xbb\xf0I5\xfb\x03\x18\xf0:\xff\xed\x02\x17\x84WSgi\xecJ\x82\xc9\xf3k\x8d\xf8\xfcE\xa9\xca\xafq\xe9\x9d^\xf2', 0x2) ftruncate(r2, 0xffff) fcntl$addseals(r2, 0x409, 0x7) r3 = ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000c80)={r2, 0x0, 0x0, 0x1000}) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0xc0086202, &(0x7f0000000cc0)=0x1) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000940)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000800)={0x20, 0x80, 0x1c, {0x7ff, 0x9, 0x9, 0x1, 0xffff, 0x7, 0x400, 0x4, 0x8, 0x3, 0xe, 0x800}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 976.722201ms ago: executing program 2 (id=163): r0 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x2) ioctl$TIOCSERGETLSR(r0, 0x5459, &(0x7f0000000000)) (async) ioctl$TIOCSERGETLSR(r0, 0x5459, &(0x7f0000000000)) ioctl(r0, 0x9, &(0x7f0000000040)="8550a2002a06d2cb7a31ed7877870e9426b7f1aa75fac667b3a8c976df8cabb06e47b81d71dc743e77d1d09cd14b97e851e2bd6b5bd4774dd49c27d75c2a33aa38015e09804d48aaf550aa395241339f900832460de9b6bee93f1be77888a04190e03a7bd97da8bbf3dc8a3868b5782c786f55da93a02e41a3c0cc90019f6978c3f5326efe9087138946246b527124df90df5a6d348d5ae0798f54a2a38d12a597ded0552c2a1b0c16a2ee0c6d2879f45b4b924e4daad88ea67eea002059f5c2bf5c9dd091a525c7a6a82c311c405672ee67ea2d1c65ef6453fe9cfb06239093227aa86363fe7558d3c22f169931d656e96296cf06f4") mount(&(0x7f0000000140)=@sg0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='affs\x00', 0x8000, 0x0) accept4$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0x0, @local}, &(0x7f0000000240)=0x1c, 0x180000) (async) r1 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0x0, @local}, &(0x7f0000000240)=0x1c, 0x180000) getpeername$inet6(r1, &(0x7f0000000280)={0xa, 0x0, 0x0, @dev}, &(0x7f00000002c0)=0x1c) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340), &(0x7f0000000380), 0x2, 0x0) fsmount(0xffffffffffffffff, 0x0, 0xfe) (async) r2 = fsmount(0xffffffffffffffff, 0x0, 0xfe) write$P9_RLOPEN(r2, &(0x7f00000003c0)={0x18, 0xd, 0x1, {{0x4, 0x3, 0x4}, 0x8}}, 0x18) (async) write$P9_RLOPEN(r2, &(0x7f00000003c0)={0x18, 0xd, 0x1, {{0x4, 0x3, 0x4}, 0x8}}, 0x18) write$P9_RFLUSH(r2, &(0x7f0000000400)={0x7, 0x6d, 0x2}, 0x7) ioctl$TIOCNXCL(r2, 0x540d) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000440)={[0x3, 0x6, 0x1, 0x4, 0x5, 0x7f, 0x8, 0x2, 0x62, 0x9, 0x0, 0x3, 0x8000000000000001, 0xe039, 0x6, 0x440000000000], 0x1ffe}) getsockopt$EBT_SO_GET_INIT_ENTRIES(r2, 0x0, 0x83, &(0x7f0000001540)={'filter\x00', 0x0, 0x3, 0x1000, [0x8b, 0xfffffffffffff000, 0x9, 0x3, 0x2, 0xfffffffffffffffa], 0x2, &(0x7f0000000500)=[{}, {}], &(0x7f0000000540)=""/4096}, &(0x7f00000015c0)=0x78) (async) getsockopt$EBT_SO_GET_INIT_ENTRIES(r2, 0x0, 0x83, &(0x7f0000001540)={'filter\x00', 0x0, 0x3, 0x1000, [0x8b, 0xfffffffffffff000, 0x9, 0x3, 0x2, 0xfffffffffffffffa], 0x2, &(0x7f0000000500)=[{}, {}], &(0x7f0000000540)=""/4096}, &(0x7f00000015c0)=0x78) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r2, 0x5000943f, &(0x7f0000001680)={{r0}, 0x0, 0x4, @inherit={0x50, &(0x7f0000001600)={0x1, 0x1, 0x1, 0x283a, {0x15, 0x6, 0xfffffffffffffff8, 0x5be0, 0x3}, [0x0]}}, @name="0b264bb8bab38a53005c64359da3ca2098f5da91cf2cb6a19cfd684a15c0964509a5814dc2e130a0123ca9cbfa2bd3918bade14eddf51aa705aa1b44436aa5fcc777b6edd51d588d5452c578bf743db1cd6de2d1bdc72627140c831fb5ce698732e9fb956dddaa0f437dd605df79d66404da0eb244dd7bcb5f056b60fe85d3c1030ef6376b784cb3a9a76b72d2056cb77f379e13017c1f6d339887a1121c9346aeed20ac025ef059d0e158dc818065f448578210145854c0feaab7d662b3e9085ed8829133ca5c0b0b9d5f6c1b6dfcd45834ab1363acfb301a09421245919dae8841049f4bff6f93dcb7583ffa7a04eb066daa328401e0c95b33e11f8f7ff7af227caa685cb7dbf8187bbb8b6c4dc036c65983a1249272f2c44f02f286e2e5bd5f09e462dd8c26221f315114abd254827abdb221233b5b655a1b6fbef4f5f72ce3abaabf5a31a06c5b826252c92d28839c8ae2bf3fd6dc8152f9e836fcd2237ccd76fdf4a0e6da834ece41093a215b664d8ccf528da53a6e8c9707adfedc645504aff7363ce943bc6fe054a398fbbcc464679def24a65c7a98908785424f457eb9d76510978503194bbc7085b46d2461342eb8104aa479f43c7a753f6497d96673541c758bbf5e64699e4b9fd99212d136ef9bceadc933ae048f0879abb687440e18378c37cabc022498a2b74129411576608233790b9e7996cfd543d5e8cf2c266bc5442a145187ef2e8e673b3b0ff187ff4e5a2d393ad19c76a4425b240bf1b0ee2113e409e1b867c9c45f71819d2177072d7cb49f28ad394e34ec782a00c6e2eee9919295862032fc76848f874c96fd82a043c43ee277f2ba371be7569733a9e7429d72c929dcdeb72e86dac6f3bb71a708cc2156877780b61857cad067650bceda9234bd464daa366201d8d26def03e6fed52c569149678b25970d3df7843c1b55730c7d33b0cd5e0946fa800013eb9ca922d8bead1725cfdc26541df4574b2fc326eef5b3bd71137f54b93bfcde4181076052078bbd6ad5ff4a24ac5315df2d270746f97ddc557002db7e176e077cad2c39085737f09bab39b5d4d56ff002970c84926a656e5aeeab56c33adc1883a97bda9d7fd55031a605f01b24436eca099181248a45456efbe3c0af57f964265c0185bfdf39fbc2aadb0af00f3025637ca6787c23330464928e2f677d1506338c216e93735fe254141c050387376f13a7eafdfa9f37faf2ae45a369a88c5e8c2d88672fe5bcee2be1a9b468bf8453c45609e6584779a7a8d2cbc4291f52e223bef0fdce9023a06919f457f7cfff519bada65907ccc3eccbcaddeec535c1940e1edb944ae9ff86aab69405181dfcce8ae8904a08b241fce666d91648af8341e31b8250cc2963405479c07e311d90018d38b8444a96c4fa9dbe789745e170b77d7d1c4cada374166cdcf6442bc49627dee1bec4bf0b7083ac0b30ee22f837a31ebaa757290c5ea1e9d02e0fee9da1506d9f1e0799fbe33eee7d45de822df6795e66d83e4b57384ad577758e77379b087c5ee8394f7ce25d9465621d333224a686e5af20841b9dc9d33ad5641737a93c71f9d14c83e4fb4e10e27b57401379be6e620118373470d37097f0a0c8749a3d4dae406d70109d23b7f0401b3606e1fb5af1d2be8581f4b2f6ddbe44ee29e534d10c4f839354b1559ddf9e83df4466fcd33cf06a97e944b5a602e6c5455d696a7c51bc4e5e73c5dd3dd83c6ecb0cd96d7592b4b1a0902ac2b3febda3e7af148f10beaeb70e12760e76b77a99519f0d93e78b0ee49adbdf2c86c35686d53d66add2d2f129c9e15342747523f0c42cd881c4880496826c2396538831850b174f82d3e2e1954cdccacfb56825e84aea7ce2d275ff710e25b84e14edc76a8ad643d5a7866d1f38c8338ebad752f4a5e53e18b5a998f090876c7d08ce1a36f3a323263e936a428ae98af8b87f91999ff44f2de6edd36ecb58352cf416d2977c838243c800e326a37c7adfcf5457a0f8c2d9c1994e33004ca90c60ce93fb312a672c4577016a4fe2b8865944850c26c1042f19c1f37be2f6f2360569bae5a10b16b37aa4be3aeb0acfe43664eca64f6dd1bbf59805b8eb331a61f1bee68da42e4f5f9dc37f790cf91a38d2947ec2e7c33992374d01bb7c4732b3df286a0e726850f0a8418de416b15dc7abf764b11cbc96d174ccad663b12c868fdf8097b3c0dc1fa626a54d20d49c46809fd2c9f79348f59339e5633adbeb01c1e4975e75605dbeb091b8bb94907d320560c8c850d4cfb8dc053c4d21bc2addea06bb11c7eb83b0d1cfa736d57fc010b188939bc3d2e2a4641e1e5eb934fe88b73c8e78f7f374145bccc04f46d6aaf9723aa39f455c572fde0a9a13e2f7edbc74f5644e2ced794ca561f8187837c2f06a0c530b12f634e0eb22a2721ee6a808259931ae9235d6b41a112933fffc7f14147e7e51126b484d522dca5d7711f7ba355ce548d6fc4080f08a3d87228fbd03d19e2ff02c4ab104bba8f963efe8eedcc2fb053c2b110a86e64449d844ed1f98751bfc6eeedb7cf4dc3e531f87cfff6136eaede29f67926014dc688fbc4afd8a6a5d634774648e62e6ff51e06729e73861c08bad08629491e69f14c0d41c035be93d6c40e38f5126fd3952a6f5424e7ffa61a63135a4ab2a8609244ed9bfc16ef53168ea1e1aa90bdd1a4fe0af0c320975ea1babec7557ead1a24c27b37701ab841dbedcfd96ab3241731cb76039223fdab1172a47f2b0948a56617c077f8b26a8226a93888b415ac80ffb772180ae8ad0f6ee066a4d286744c46956aabd8f4783ad924b48818ac98278ee6020b57fc1e355dba7d8eaa36c89d23c0cc7aee9a5a72a925f585319dc9a857d7d9bfd207300caddd302c2bd755c2bbfae520b7144711b4bc7984b540c23057c0807b4107fef10ba468fa036b49f1821f1d034be42c775b542d97c8351b99537e732fde10ca658c64d9a696a884f2ef6e2bff8cd6461b9acaa293bfbb816c6badc955737414e7fee4367789e6bbb0617a4021b1ec92f70acb7fd0f01c27750ef97f00646414e85c91caafa2a4f22726760b53b42c29948b4033f357aeb14c70577039e78d3801b6c343d4b555bd3fa2ea157ed6b2790a38967ff07ab9c99b6939328225d653d5334227f1c4c132a6f46c0e6f1a160136492a1d95ce19c856323128ba936467402268a4ebc95d69652c82546cbaee20c96f52104200a817723e61ef4a56b5e9b1b78cf4cc19fcf3e82adf5a55eed9a8f53c5e0d947a398a7feadce850a03a6eda2b9de0d7eff6e1d4c397bf476d824fe6d71dcb1c7fd88d259759913d7fee39fbcce8c4f2a0d83ebf72c5a76fff1c2aac648e2884b6e16214892d6dbaed5905f66e5c7bb23c2e1fc609effb9a4efbc5d3aeedd2ee46d7a9a1e25af64017c55b40d534c2f8f6f16aedfd0abd2ed90a0aea1dd4d81296d114e8462ce9aac63b48314f5bc75d3c7618a3987e98306ea6200fc5c5fc39e72429526a123f3a65d659936e4bf0caa2231a5cdf57d42f9814296963d424d1818293d7a5fe5dd28fb174a2f007f273137c33ec18ad6898d44ca5432ef1420e9fee759b31a285e78fb89a323b13d13c4b494d7e89ffd9e7fdc0370f5af014a9e2c57df3a09df8643d9be816d6a302df1bef85d0155488c144197547ffdf26f984881e70bbc5a217448cb8ada054ab75534776b1e664d47fd7d961e320c16df690698095974b8479773029d78a94ba535c0ca41d0e6f4d24ce346bbab3e8e031f2fe5e7786896b3ca24cedd17816e7d65990c82cc1ff5d4224443cb69503cc8b2d118bbd6b71399c3fa36f974ef67a6fba1ac40356722b76800d57e3fcf1ef8719bde2835061d30ca4838e1ef4fc3c851fa3d48acdaa34f126f8cd635fed1be1e6c99928565f583994acfd86fb2e84c67674aab94eb15112ffb846ffe324fa4921c5c8a44488e750260d4d5c0671c6f7645c2d188646215c9a09c3d2c8bb044cf515e4b7b7bc81febe50966a5281e1d96a146c7160af0c127b3fd13140f438d1f9e345b7013d0e1c26ac5997afa3cbf056eded4af210325d06655528ffb197ac1d6bb9b512d5af2a34c08a196f158d86f38452ab75f1a173521f2666369829358ce68c8efaf7bfee5e3c0f965794bfd027d4d3220e46d1d8bff133c4ee443366afe7b66086523cdc315e3f099e59f56c636bd1fe8213e039b96a50d425777b31501d2f4d30c32c18d08603c53f78a42bb53984eb724cfc21086a573c0bc6ea835dc945b6e5c3ea4bb68139a29822e611d351b69633138e31449e971a5ad4401a988b5cf0e5385b184e48ea955baa8137bf39696122ddb956f7461c132103abae1c8daf982bc5808632f39d311db985a6700f72c40e8ceb1a13e8b9fa3f7653635bfeec1170bd829bc3efe1c23933674c4e2dd05e646ad6e268cbef8788f2b16adecc891fed78f7c215a097913cd1ede3f56be943b4ecbdaceb6cd0e40984be6f4c7077f2486d56de0f3b35fc093877442511b6a1e282b90408d4830e767e8d435845448fe8b15d1564779fd4199ab986ae26989cc45ad113b6924160ca0b5085d6e401684a078c5769e242db69e0cad73df53b3dbd7ee8fb4c3b40b7ad20a9972a14b00a75dd899e6ef53bd052f39d441426f606b643060f90f337cfa564ad14235e0e22076cb0ced5b435e611d443fb355c8fb26310afdb25a52be7874b319af5a1bcbac3f5e95dd9856510105e88cb52f1187c425fb6a77f0056fd1e399a6c6f0938c82367c57fc7106fb528c33dcad805b73bc2c2cf815409efc5e6347c881216d114e64cbbfcefb627f6f94fe916c70ce40f650ed491cbd872604c401de2f9da22a1ff36eb7cfc81d62366eb5d2984b8e2d7a25580d11ee06d76f0420a71276ac9b8def19fdfb0616b33b2426ee4314690379f1a0e637bb9a09f85b046d7f267dbab72738406d441acb075589243092890775aeb7adf768f487873921656bdc98336357d6d47375bd2984b6df0d16bfe36bf5046b64890a1ba291485594c2bca867c58f21f376dcffcd6299bd11180f55d9135e8a5693826885b5d8c06931965aac07690297f62296a6a602b77e7d3798d2f06bf17f2c831c171d7fae2e59497a8fd402dab6c29b8a3ef1f054b6ebd269f6bdcb299091e5f2bc98969ded55535f69d731edb1dc93f9f4b70686c3cc27b77f4f1a0a2b3430cc949f9a5fd06a377a40fd4e695078469099019d2e68df26b9e312deb51fe65b67c169aba4fb92771ca539424f044c1ffa3a7a9578e589ef8c82e22b5d307aaa0e9f42564ad4db0ba657daf96dc2403124bdc7072943c43dbab90972f1f7072a426b53533c8deb3811bd8e4b0ca891aac8b51b1ebd63b68746a66b8ee81751bba6a4917d8b14917b08d1f70ad5c1ac02f75d3c3ce0c0772c3664bd62906d6caae30c7e17921a7f6815ea798c13f0f4b7b02f13c2864438954a2673e5e8b75bba3e1188b0ac2a1fc8484030d905d86e803011464753ff60c8a9d5e41463c3b6061884853cd196fcdcc48a7d88c806fbd54463c9dcc651432e5e85aae22fa01c2f4272696a20261dd7f353beadbfe7c38a81cdaa882704ff7bcf4e76e8a8e1407db6628cab43e56972a34c299f36a190fd46ba5dad78427bfdfac8d1564a5454eb0c58adb26e0a06e6f0daf7adeb2c3bdd297e3430f7a755a94c9cb8b8427a8fc757297"}) openat(r2, &(0x7f0000002680)='./file0\x00', 0x100500, 0x20) (async) r3 = openat(r2, &(0x7f0000002680)='./file0\x00', 0x100500, 0x20) r4 = syz_kvm_add_vcpu$x86(0x0, &(0x7f00000028c0)={0x0, &(0x7f00000026c0)=[@cpuid={0x64, 0x18, {0x45ee}}, @nested_amd_clgi={0x17f, 0x10}, @code={0xa, 0x67, {"0f35430f01c2470f0177bcc744240002000000c74424029e000000c7442406000000000f011c24c421f9f7e436f3450f1efa66b837010f00d0440f20c0350c000000440f22c0b8010000000f01d9360f29bd00800000"}}, @code={0xa, 0x4e, {"0f01df65644d0fc75daf0f0666440f01bd879e0000c4e27d2ab51343e6dd26450f0666bad10466b8000066ef360fc76ca10bf336f2420f35c4a111e933"}}, @wr_crn={0x67, 0x20, {0x3, 0xb7}}, @cpuid={0x64, 0x18, {0x0, 0x1}}, @in_dx={0x69, 0x20, {0x6c5a, 0x3}}, @wrmsr={0x65, 0x20, {0x40000082, 0x2}}, @wr_drn={0x68, 0x20, {0x3, 0xfffffffffffffffa}}, @nested_amd_clgi={0x17f, 0x10}, @uexit={0x0, 0x18, 0x5}, @cpuid={0x64, 0x18, {0x0, 0x8}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x3, @control_area=0x25, 0x5, 0xfffffffffffffff8, 0x7}}, @nested_amd_clgi={0x17f, 0x10}], 0x1fd}) ioctl$KVM_GET_CPUID2(r4, 0xc008ae91, &(0x7f0000002900)={0x4, 0x0, [{}, {}, {}, {}]}) ioctl$KVM_GET_SREGS(r2, 0x8138ae83, &(0x7f00000029c0)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$P9_RLOCK(r3, &(0x7f0000002b00)={0x8, 0x35, 0x1}, 0x8) ioctl$XFS_IOC_GETPARENTS_BY_HANDLE(r1, 0xc040583f, &(0x7f0000002c40)={{@_ha_fsid={[0x3, 0x79]}, {0xcaf7, 0x2, 0x51c, 0xf}}, {{[0x4, 0x8, 0x9, 0x101]}, 0x0, 0x2, 0x101, 0x0, &(0x7f0000002b40)=[{{@_ha_fsid={[0xe, 0x505]}, {0x1, 0x9e03, 0x0, 0x5}}, 0xffffffdb, 0x0, '$\'\x00'}, {{@_ha_fsid={[0x9653, 0x65]}, {0x98, 0x1, 0x8, 0x7}}, 0x6, 0x0, 'filter\x00'}, {{@_ha_fsid={[0x2000, 0x377]}, {0xa, 0x7, 0x7}}, 0x101, 0x0, '\x00'}, {{@_ha_fsid={[0x3ff, 0x4]}, {0x5, 0x7f, 0x9, 0x7}}, 0x7fff, 0x0, '($[\x00'}, {{@align=0x200, {0x7, 0x665d, 0x200, 0x2}}, 0x80000000, 0x0, '\x00'}, {{@align=0x4, {0x3, 0x1, 0x6, 0x7}}, 0x1, 0x0, '%%A\x00'}]}}) write$binfmt_misc(r2, &(0x7f0000002c80)="3366a061cc84acd18e1c4fa91346c4b8e1364f7bff77ac9416fb2d20f8023e51fe5ce663a5d6ea073eeb639a8aaccc843422f3e7a676c1e08a9befd4f6e8e5f0e28a525557e06ace036cf7bea7bfa568fb2e0037199a2ca60574d1a895d1a690e8205ce90a9f11e6015cc00bc8cd2c4ca912be74baf44ceff38aabec2e2c1574527a9b75b850a17a12c1f8fb0d6cbbc37ed99aac2fb74cc05e1ba3d4a769d2372c061441737f4f63a4097b03f2b18eea4db92ce056dd86baf1e5c0a69ce757b9cc6e", 0xc2) (async) write$binfmt_misc(r2, &(0x7f0000002c80)="3366a061cc84acd18e1c4fa91346c4b8e1364f7bff77ac9416fb2d20f8023e51fe5ce663a5d6ea073eeb639a8aaccc843422f3e7a676c1e08a9befd4f6e8e5f0e28a525557e06ace036cf7bea7bfa568fb2e0037199a2ca60574d1a895d1a690e8205ce90a9f11e6015cc00bc8cd2c4ca912be74baf44ceff38aabec2e2c1574527a9b75b850a17a12c1f8fb0d6cbbc37ed99aac2fb74cc05e1ba3d4a769d2372c061441737f4f63a4097b03f2b18eea4db92ce056dd86baf1e5c0a69ce757b9cc6e", 0xc2) write$binfmt_misc(r3, &(0x7f0000002d80)="59c28f3e022c61217b0b50b6615f3f654dd0e6a94f0160ad6be47499a79441559bd86930de0f08faaeeb1b823d7ad5e2ce38792f6fc70cc663004960714e430229b8adc47a4fe626e41b8e5a75d75fdcf5d3364b4ad1f08ffcab8f914d82771157326f52a36b526d9bc975dce00554676c44c0f696c0c765bbd10bcd41e11a5a93f983b980fc9679328c1cdeba908845ac072d0e289144f37b12ba2eb5063c1c49d66129c9b69d7ccd87179e5df49caf0c3f86e3ddd7", 0xb6) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000002e40)=0x4) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000002e40)=0x4) ioctl$KVM_GET_STATS_FD_cpu(r3, 0xaece) (async) r5 = ioctl$KVM_GET_STATS_FD_cpu(r3, 0xaece) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f0000002e80)=[@sack_perm], 0x1) ioctl$KVM_GET_FPU(r3, 0x81a0ae8c, &(0x7f0000002ec0)) r6 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000003080), 0x2, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r6) ioctl$KVM_SET_ONE_REG(0xffffffffffffffff, 0x4010aeac, &(0x7f0000003100)=@arm64_sve_vls={0x606000000015ffff, &(0x7f00000030c0)=0x3d9f}) (async) ioctl$KVM_SET_ONE_REG(0xffffffffffffffff, 0x4010aeac, &(0x7f0000003100)=@arm64_sve_vls={0x606000000015ffff, &(0x7f00000030c0)=0x3d9f}) 976.373641ms ago: executing program 2 (id=164): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="50000000210001000000000000000004fc020000000000000000000000000001fe80000000000000000000000000002000008000000200000a0000a02e000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x50}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r1, &(0x7f0000000880)={&(0x7f0000000000), 0x6e, &(0x7f00000007c0)=[{&(0x7f0000000080)=""/203, 0xcb}, {&(0x7f0000000280)=""/255, 0xff}, {&(0x7f0000000380)=""/225, 0xe1}, {&(0x7f0000000480)=""/226, 0xe2}, {&(0x7f0000000580)=""/212, 0xd4}, {&(0x7f0000000680)=""/54, 0x36}, {&(0x7f00000006c0)=""/250, 0xfa}], 0x7, &(0x7f0000000840)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x18}, 0x40000000) 962.149692ms ago: executing program 2 (id=165): r0 = socket(0x10, 0x3, 0x0) setitimer(0x2, &(0x7f0000000000)={{0x0, 0x2710}, {0x0, 0x2710}}, 0x0) unshare(0x64000600) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_NL_PUBL_GET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="03471b00003fba10e40007"], 0x44}}, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000280)={0x3ffe, 0x5, 0x0, 0x2}, 0x10) recvfrom$unix(r0, 0x0, 0x0, 0x40012000, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="200000001600010a"], 0x20}, 0x1, 0x0, 0x0, 0xc8001}, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f0000000480)={{r0, &(0x7f0000000240)='TIPCv2\x00', 0x610302, &(0x7f00000002c0)={@_ha_fsid={[0x8, 0xfffffff9]}, {0x7, 0x80, 0x1, 0x48b}}, 0x2, &(0x7f0000000300)={@_ha_fsid}, &(0x7f0000000340)=0x5}, {[0x80000000, 0x89, 0x7]}, 0xf77b, 0x8b, &(0x7f00000003c0)=""/139}) connect$unix(r3, &(0x7f0000000500)=@file={0x0, './file0\x00'}, 0x6e) 113.118888ms ago: executing program 2 (id=166): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000480)={0x38, 0x13, 0x1, 0x70bd2b, 0x25dfdbfb, "", [@nested={0x4, 0x4f}, @nested={0x4, 0x71}, @nested={0x20, 0xbc, 0x0, 0x1, [@nested={0x4, 0xc3}, @nested={0x18, 0x2e, 0x0, 0x1, [@typed={0x14, 0x10b, 0x0, 0x0, @ipv6=@local}]}]}]}, 0x38}], 0x1, 0x0, 0x0, 0x8800}, 0x8880) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 32) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/wake_lock', 0x2202, 0x130) (rerun: 32) copy_file_range(r2, 0x0, r2, &(0x7f0000000040)=0xf160, 0x4, 0x0) (async) fchdir(r1) (async) recvmsg$unix(r2, &(0x7f0000000400)={&(0x7f0000000180)=@abs, 0x6e, &(0x7f00000002c0)=[{&(0x7f0000000200)=""/157, 0x9d}], 0x1, &(0x7f0000000700)=[@rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xd0}, 0x2001) (async) r3 = fsopen(&(0x7f00000004c0)='ext3\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000500)='auto_da_alloc', &(0x7f0000000540)='0\x00\xfa\xb8F\n9\xea\xbe\x92\x1eY\xbe\xd7\b\xa7\xc4\x19\'\xaaF\xc6< \x06\xccf\xa7\x10[1\xbc\xd5*\xb2\\\xa8\xb1p\x99X\xd0\x96\x87\xf9\x18\x94\xca-\xe9T\xf1\f4\x19\x9b\xda\xd0\x1fJ\xb4\xc8S\xadbo\x1b2\xfd\x1c6\x9c=\x89D\xafIhg\a\xae\x9cn{\x18\':\xf0\xbe\xa7\xedxmh@\\\x91\xc13\x17T\xc7\xe0\xe2\x02\x15ur\xae\xdeB<\x16\x02\xebg\xd9x\xb1L\x82\xdcI~r\x85\xd5\x1d\xb18\x88\x1d\x11\xb3-AR]53n\n\x81K\x7fA\xb2x\x94\xa9\xfe\xa11\x12\x18l\x7f\xd5k\xb5$\xc7I\xbc\xf3\\\xe8\x16I\x95A\x05\xcd\xdf\xd2\x02e\xab/N\x9fb\x19O\\\x19w\xebW\xfb\xef\xcf\xd0\xa9\x98:\x81\xbf\xae\xe5n\x0eo\xbe\f\xe0\x96\x047\x15!\xff\xf4\xe7\xe7\xa6\xc6&$\x0e3\xa1z1n\xa3\xf9\xa0A\x85_\x98f\xae\xd3]f\x97\x80?\xaa\x80|b\t\x02\xd1a\xf2\xdf>\xea\v\xa5\"\xfeI\xcd\x87\xea\xde\xd6?)\x1bt\xbe\x11\x89\xb5+.\xf5E\x87\xf4\xb1tH,|\xa4\xba\x81\xa1\x88\xac\x1b\xa8U\xa2\xc1\x89XO\xccK\xcd\xa2Xo-\xcb\x11KQy\x8c\xb9\x9f \xf1\xce\x06\xc1\x89\xfe\x0fP\xbb\x8ee\x11\xdaA\xd8\x1f&\xe0\xd2\xb4ksA\xae\"$\x03wU\xfc\x96\xd2n\xcc\xc6\xb4\x05\xe6s\xe7G\x98\x88\x80\x82\xd9\x9e\xf2B\xb4I\xe0L\a\b_\x15\x14\\a\xbf\xf3\x02\x03\xd3F\x19\x0eQ\x1d\xdd\xfa1\v\xdc\x87\x17\x85\xd0bUx\x87\x971]n\xb1\xcfjF\x10LmQE\xb8', 0x0) (async) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c00000001a201020000000000000000010000060500010004000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4000041}, 0x10) 24.907818ms ago: executing program 2 (id=167): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002540)='./file0\x00', 0x0) mount$bind(&(0x7f0000002580)='.\x00', &(0x7f00000025c0)='./file0/../file0\x00', 0x0, 0x101091, 0x0) chroot(&(0x7f0000002600)='./file0/../file0\x00') mount$bind(&(0x7f0000002840)='./file0\x00', &(0x7f0000002680)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f00000026c0)='./file0\x00', &(0x7f0000002700)='./file0/../file0\x00') r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) write$cgroup_freezer_state(r1, &(0x7f0000000040)='FROZEN\x00', 0x7) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)}, 0x4) close(0xffffffffffffffff) socket$inet6_tcp(0xa, 0x1, 0x0) syz_io_uring_setup(0x5de7, &(0x7f0000000300)={0x0, 0x85ae, 0x2, 0x2, 0xa2}, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000380)='fdinfo/4\x00') read$FUSE(r4, &(0x7f0000002880)={0x2020}, 0x2020) r5 = accept$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, @multicast2}, &(0x7f0000000200)=0x10) r6 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000240), 0x210202, 0x0) poll(&(0x7f0000000280)=[{r1, 0xe}, {r3}, {r2, 0xc109}, {r2, 0x110b7}, {r2, 0x408}, {r1, 0x294}, {r5}, {r6, 0x44}, {r0, 0x3000}], 0x9, 0xc195) mkdirat$cgroup(r0, &(0x7f0000000080)='syz1\x00', 0x1ff) socket$packet(0x11, 0x3, 0x300) socket$packet(0x11, 0x3, 0x300) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002400)='net/ptype\x00') preadv(r7, &(0x7f0000002440)=[{&(0x7f0000002480)=""/187, 0xbb}], 0x1, 0x25, 0x0) openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002740)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000002780)='./proc\x00', &(0x7f00000027c0)='proc\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000002800)='./proc/irq/default_smp_affinity\x00', 0x1, 0x0) write(r8, 0x0, 0x3c) 0s ago: executing program 2 (id=168): r0 = socket(0x10, 0x2, 0x4) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000000)={'ip6tnl0\x00', &(0x7f00000000c0)={'syztnl1\x00', 0x0, 0x4, 0x0, 0x2, 0x0, 0x0, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7800, 0x7800, 0xfffffffc, 0xd864}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000140)={'syztnl1\x00', &(0x7f0000000200)={'syztnl0\x00', r1, 0x29, 0x0, 0x6, 0x7f, 0x42, @ipv4={'\x00', '\xff\xff', @multicast1}, @mcast1, 0x0, 0x40, 0x6, 0x41}}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$IPSET_CMD_DESTROY(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14, 0x3, 0x6, 0x3, 0x0, 0x0, {0x2, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x4000011}, 0x4800) bind$netlink(r2, &(0x7f00000001c0)={0x10, 0x0, 0x25dfdbfe, 0x1000000}, 0xc) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000280)={'syztnl1\x00', 0x0}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.20' (ED25519) to the list of known hosts. [ 23.288273][ T36] audit: type=1400 audit(1793889872.050:64): avc: denied { mounton } for pid=285 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.311440][ T36] audit: type=1400 audit(1793889872.080:65): avc: denied { mount } for pid=285 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.314754][ T285] cgroup: Unknown subsys name 'net' [ 23.339485][ T36] audit: type=1400 audit(1793889872.100:66): avc: denied { unmount } for pid=285 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.340003][ T285] cgroup: Unknown subsys name 'devices' [ 23.473389][ T285] cgroup: Unknown subsys name 'hugetlb' [ 23.479046][ T285] cgroup: Unknown subsys name 'rlimit' [ 23.644690][ T36] audit: type=1400 audit(1793889872.410:67): avc: denied { setattr } for pid=285 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.667961][ T36] audit: type=1400 audit(1793889872.410:68): avc: denied { mounton } for pid=285 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.692985][ T36] audit: type=1400 audit(1793889872.410:69): avc: denied { mount } for pid=285 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.705895][ T287] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 23.724954][ T36] audit: type=1400 audit(1793889872.490:70): avc: denied { relabelto } for pid=287 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.750491][ T36] audit: type=1400 audit(1793889872.490:71): avc: denied { write } for pid=287 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.755971][ T285] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.776758][ T36] audit: type=1400 audit(1793889872.520:72): avc: denied { read } for pid=285 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.810631][ T36] audit: type=1400 audit(1793889872.520:73): avc: denied { open } for pid=285 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.156262][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.163377][ T292] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.170479][ T292] bridge_slave_0: entered allmulticast mode [ 25.176996][ T292] bridge_slave_0: entered promiscuous mode [ 25.185574][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.192745][ T292] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.199930][ T292] bridge_slave_1: entered allmulticast mode [ 25.206331][ T292] bridge_slave_1: entered promiscuous mode [ 25.276099][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.283416][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.290512][ T293] bridge_slave_0: entered allmulticast mode [ 25.296934][ T293] bridge_slave_0: entered promiscuous mode [ 25.306793][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.313915][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.321214][ T293] bridge_slave_1: entered allmulticast mode [ 25.327515][ T293] bridge_slave_1: entered promiscuous mode [ 25.399157][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.406287][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.413497][ T294] bridge_slave_0: entered allmulticast mode [ 25.419805][ T294] bridge_slave_0: entered promiscuous mode [ 25.429129][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.436247][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.443436][ T294] bridge_slave_1: entered allmulticast mode [ 25.449765][ T294] bridge_slave_1: entered promiscuous mode [ 25.498449][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.505566][ T292] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.512895][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.519958][ T292] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.545775][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.553343][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.560437][ T295] bridge_slave_0: entered allmulticast mode [ 25.567211][ T295] bridge_slave_0: entered promiscuous mode [ 25.573792][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.580935][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.588188][ T295] bridge_slave_1: entered allmulticast mode [ 25.594470][ T295] bridge_slave_1: entered promiscuous mode [ 25.637409][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.644517][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.651847][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.658988][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.721921][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.729258][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.736815][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.744450][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.762587][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.769665][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.777333][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.784420][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.802099][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.809163][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.817602][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.824708][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.877888][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.885001][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.893811][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.900870][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.932791][ T294] veth0_vlan: entered promiscuous mode [ 25.940262][ T292] veth0_vlan: entered promiscuous mode [ 25.963364][ T293] veth0_vlan: entered promiscuous mode [ 25.973626][ T294] veth1_macvtap: entered promiscuous mode [ 25.987511][ T292] veth1_macvtap: entered promiscuous mode [ 26.002466][ T293] veth1_macvtap: entered promiscuous mode [ 26.012264][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.019320][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.032874][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.039935][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.091790][ T292] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 26.121291][ T314] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 26.158711][ T295] veth0_vlan: entered promiscuous mode [ 26.179550][ T295] veth1_macvtap: entered promiscuous mode [ 26.234715][ T334] pci 0000:00:01.0: MSI/MSI-X disallowed for future drivers [ 26.411100][ T9] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 26.551151][ T311] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 26.561069][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 26.567422][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 26.578801][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 26.588840][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 26.602015][ T9] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 26.611242][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.620475][ T9] usb 1-1: config 0 descriptor?? [ 26.691281][ T311] usb 4-1: device descriptor read/64, error -71 [ 26.931059][ T311] usb 4-1: device descriptor read/64, error -71 [ 27.034494][ T324] ======================================================= [ 27.034494][ T324] WARNING: The mand mount option has been deprecated and [ 27.034494][ T324] and is ignored by this kernel. Remove the mand [ 27.034494][ T324] option from the mount to silence this warning. [ 27.034494][ T324] ======================================================= [ 27.081506][ T324] overlayfs: missing 'lowerdir' [ 27.090922][ T324] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 27.100629][ T324] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 27.145451][ T344] process 'syz.1.7' launched './file1' with NULL argv: empty string added [ 27.157723][ T347] 9p: Unknown access argument 18446744073709551615: -34 [ 27.167027][ T9] usbhid 1-1:0.0: can't add hid device: -71 [ 27.171201][ T311] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 27.174978][ T9] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 27.195412][ T9] usb 1-1: USB disconnect, device number 2 [ 27.236355][ T350] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=64347 sclass=netlink_route_socket pid=350 comm=syz.1.9 [ 27.331084][ T311] usb 4-1: device descriptor read/64, error -71 [ 27.458388][ T362] Zero length message leads to an empty skb [ 27.571153][ T311] usb 4-1: device descriptor read/64, error -71 [ 27.681142][ T311] usb usb4-port1: attempt power cycle [ 27.712170][ T312] rust_binder: 373: undelivered TRANSACTION_COMPLETE [ 27.763333][ T380] fuse: Unknown parameter '' [ 28.021085][ T311] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 28.042274][ T311] usb 4-1: device descriptor read/8, error -71 [ 28.172204][ T311] usb 4-1: device descriptor read/8, error -71 [ 28.350916][ T36] kauditd_printk_skb: 86 callbacks suppressed [ 28.350937][ T36] audit: type=1400 audit(1793889877.110:160): avc: denied { mount } for pid=392 comm="syz.0.23" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 28.431118][ T311] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 28.438734][ T312] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 28.462515][ T311] usb 4-1: device descriptor read/8, error -71 [ 28.482123][ T36] audit: type=1326 audit(1793889877.250:161): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=395 comm="syz.1.24" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f76ba19fb19 code=0x7ffc0000 [ 28.508144][ T36] audit: type=1326 audit(1793889877.250:162): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=395 comm="syz.1.24" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f76ba19fb19 code=0x7ffc0000 [ 28.591361][ T312] usb 3-1: Using ep0 maxpacket: 32 [ 28.595231][ T404] overlayfs: failed to resolve './bus': -2 [ 28.598471][ T311] usb 4-1: device descriptor read/8, error -71 [ 28.609160][ T312] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 28.622373][ T312] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 28.632341][ T312] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 28.641685][ T312] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.652306][ T312] usb 3-1: config 0 descriptor?? [ 28.722466][ T311] usb usb4-port1: unable to enumerate USB device [ 28.805043][ T36] audit: type=1400 audit(1793889877.570:163): avc: denied { unmount } for pid=292 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 28.833013][ T36] audit: type=1400 audit(1793889877.600:164): avc: denied { read write } for pid=420 comm="syz.1.27" name="uinput" dev="devtmpfs" ino=194 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 28.874461][ T36] audit: type=1400 audit(1793889877.600:165): avc: denied { open } for pid=420 comm="syz.1.27" path="/dev/uinput" dev="devtmpfs" ino=194 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 28.908411][ T36] audit: type=1400 audit(1793889877.620:166): avc: denied { ioctl } for pid=420 comm="syz.1.27" path="/dev/uinput" dev="devtmpfs" ino=194 ioctlcmd=0x5564 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 28.937567][ T36] audit: type=1400 audit(1793889877.640:167): avc: denied { create } for pid=420 comm="syz.1.27" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 28.957401][ T36] audit: type=1400 audit(1793889877.640:168): avc: denied { bind } for pid=420 comm="syz.1.27" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 28.977771][ T36] audit: type=1400 audit(1793889877.640:169): avc: denied { create } for pid=420 comm="syz.1.27" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 29.029926][ T434] capability: warning: `syz.1.29' uses 32-bit capabilities (legacy support in use) [ 29.102400][ T312] savu 0003:1E7D:2D5A.0001: hiddev96,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.2-1/input0 [ 29.115433][ T440] capability: warning: `syz.1.30' uses deprecated v2 capabilities in a way that may be insecure [ 29.184713][ T440] overlayfs: conflicting options: nfs_export=on,metacopy=on [ 29.219363][ T446] incfs: Error accessing: ./file0. [ 29.224709][ T446] incfs: mount failed -2 [ 29.501204][ T9] usb 2-1: new low-speed USB device number 2 using dummy_hcd [ 29.652226][ T9] usb 2-1: unable to get BOS descriptor set [ 29.659072][ T9] usb 2-1: config 0 has no interfaces? [ 29.666979][ T9] usb 2-1: string descriptor 0 read error: -22 [ 29.673373][ T9] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 29.682527][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.691748][ T9] usb 2-1: config 0 descriptor?? [ 29.899414][ T469] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 29.908296][ T469] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 29.916672][ T9] usb 2-1: USB disconnect, device number 2 [ 30.671105][ T327] usb 3-1: reset high-speed USB device number 2 using dummy_hcd [ 30.741089][ T9] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 30.894279][ T9] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 30.904102][ T9] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 30.915598][ T9] usb 2-1: New USB device found, idVendor=108c, idProduct=0159, bcdDevice= 0.01 [ 30.924967][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.933245][ T9] usb 2-1: Product: syz [ 30.937578][ T9] usb 2-1: Manufacturer: syz [ 30.942528][ T9] usb 2-1: SerialNumber: syz [ 31.173519][ T9] usb 2-1: USB disconnect, device number 3 [ 31.198202][ T499] netlink: 8 bytes leftover after parsing attributes in process `syz.2.49'. [ 31.221058][ T312] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 31.372555][ T312] usb 1-1: config 1 interface 0 altsetting 6 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 31.385751][ T312] usb 1-1: config 1 interface 0 has no altsetting 0 [ 31.393898][ T312] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 31.407913][ T312] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 31.416009][ T312] usb 1-1: Product: syz [ 31.420210][ T312] usb 1-1: Manufacturer: syz [ 31.424863][ T312] usb 1-1: SerialNumber: syz [ 31.451844][ T310] usb 3-1: USB disconnect, device number 2 [ 31.637025][ T312] usb 1-1: bad CDC descriptors [ 31.643480][ T312] usb 1-1: USB disconnect, device number 3 [ 31.961120][ T311] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 32.112808][ T311] usb 2-1: unable to get BOS descriptor or descriptor too short [ 32.121485][ T311] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 64 [ 32.132798][ T311] usb 2-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 0.40 [ 32.142038][ T311] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.150221][ T311] usb 2-1: Product: syz [ 32.154970][ T311] usb 2-1: Manufacturer: syz [ 32.159729][ T311] usb 2-1: SerialNumber: syz [ 32.169842][ T509] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 32.257139][ T515] netlink: 24 bytes leftover after parsing attributes in process `syz.0.54'. [ 32.288694][ T519] netlink: 4 bytes leftover after parsing attributes in process `syz.2.55'. [ 32.379990][ T509] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 32.388672][ T509] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 32.396922][ T509] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 32.405568][ T509] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 32.413806][ T509] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 32.422437][ T509] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 32.430637][ T509] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 32.439584][ T509] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 32.447804][ T509] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 32.456399][ T509] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 32.470003][ T311] usb 2-1: MIDIStreaming interface descriptor not found [ 32.484532][ T311] usb 2-1: USB disconnect, device number 4 [ 32.496037][ T322] udevd[322]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 32.511218][ T312] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 32.551367][ T31] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 32.611104][ T329] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 32.661073][ T312] usb 1-1: Using ep0 maxpacket: 8 [ 32.667391][ T312] usb 1-1: config index 0 descriptor too short (expected 74, got 45) [ 32.675590][ T312] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 32.686853][ T312] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 32.697137][ T312] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 32.708423][ T312] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 32.718662][ T31] usb 3-1: Using ep0 maxpacket: 8 [ 32.723756][ T312] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 32.736806][ T312] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 32.745993][ T312] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.754853][ T31] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 32.765281][ T31] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 32.774608][ T31] usb 3-1: config 1 has no interface number 0 [ 32.780865][ T31] usb 3-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 32.792662][ T329] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 32.802603][ T329] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 32.813547][ T31] usb 3-1: New USB device found, idVendor=0582, idProduct=00a3, bcdDevice= 0.40 [ 32.822817][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.830845][ T31] usb 3-1: Product: syz [ 32.835126][ T31] usb 3-1: Manufacturer: syz [ 32.839894][ T31] usb 3-1: SerialNumber: syz [ 32.844818][ T329] usb 4-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01 [ 32.854014][ T329] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.862583][ T329] usb 4-1: Product: syz [ 32.867091][ T329] usb 4-1: Manufacturer: syz [ 32.871799][ T329] usb 4-1: SerialNumber: syz [ 32.879993][ T329] ums-karma 4-1:1.0: USB Mass Storage device detected [ 32.889600][ T329] ums-karma 4-1:1.0: This device (045a,5210,0101 S 06 P f5) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel syzkaller) [ 32.889600][ T329] Please send a copy of this message to and [ 32.920751][ T325] udevd[325]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.1/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 32.943574][ T329] ums-karma 4-1:1.0: probe with driver ums-karma failed with error -5 [ 33.079206][ T329] usb 3-1: USB disconnect, device number 3 [ 33.152575][ T310] usb 4-1: USB disconnect, device number 6 [ 33.188577][ T538] overlayfs: failed to create directory ./bus/work (errno: 13); mounting read-only [ 33.361057][ T36] kauditd_printk_skb: 85 callbacks suppressed [ 33.361120][ T36] audit: type=1326 audit(1793889882.120:255): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=522 comm="syz.3.57" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f5309d6034e code=0x7ffc0000 [ 33.461301][ T36] audit: type=1326 audit(1793889882.230:256): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=522 comm="syz.3.57" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f5309d6034e code=0x7ffc0000 [ 33.471206][ T327] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 33.561535][ T36] audit: type=1326 audit(1793889882.330:257): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=522 comm="syz.3.57" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f5309d6034e code=0x7ffc0000 [ 33.621068][ T327] usb 2-1: device descriptor read/64, error -71 [ 33.658632][ T541] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 33.672926][ T36] audit: type=1326 audit(1793889882.440:258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=522 comm="syz.3.57" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f5309d9fb19 code=0x7ffc0000 [ 33.681717][ T541] overlayfs: overlay with incompat feature 'volatile' cannot be mounted [ 33.861132][ T327] usb 2-1: device descriptor read/64, error -71 [ 33.933484][ T36] audit: type=1400 audit(1793889882.700:259): avc: denied { create } for pid=544 comm="syz.3.63" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 33.986159][ T36] audit: type=1400 audit(1793889882.730:260): avc: denied { mounton } for pid=544 comm="syz.3.63" path="/7/file0" dev="tmpfs" ino=66 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 34.111639][ T327] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 34.176386][ T36] audit: type=1400 audit(1793889882.940:261): avc: denied { ioctl } for pid=544 comm="syz.3.63" path="socket:[4769]" dev="sockfs" ino=4769 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 34.261375][ T327] usb 2-1: device descriptor read/64, error -71 [ 34.303176][ T36] audit: type=1400 audit(1793889883.070:262): avc: denied { create } for pid=552 comm="syz.3.65" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 34.339770][ T36] audit: type=1400 audit(1793889883.100:263): avc: denied { setopt } for pid=552 comm="syz.3.65" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 34.381022][ T36] audit: type=1400 audit(1793889883.100:264): avc: denied { bind } for pid=552 comm="syz.3.65" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 34.511033][ T327] usb 2-1: device descriptor read/64, error -71 [ 34.621064][ T310] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 34.628824][ T327] usb usb2-port1: attempt power cycle [ 34.771049][ T329] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 34.781031][ T310] usb 4-1: Using ep0 maxpacket: 16 [ 34.787622][ T310] usb 4-1: unable to get BOS descriptor or descriptor too short [ 34.796201][ T310] usb 4-1: config 1 has an invalid descriptor of length 245, skipping remainder of the config [ 34.806678][ T310] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 34.815840][ T310] usb 4-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 34.830621][ T310] usb 4-1: New USB device found, idVendor=0763, idProduct=1033, bcdDevice= 0.40 [ 34.839891][ T310] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.847987][ T310] usb 4-1: Product: syz [ 34.852351][ T310] usb 4-1: Manufacturer: syz [ 34.856955][ T310] usb 4-1: SerialNumber: syz [ 34.921039][ T329] usb 3-1: Using ep0 maxpacket: 8 [ 34.927513][ T329] usb 3-1: config 0 has no interfaces? [ 34.934954][ T329] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 34.944095][ T329] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.952151][ T329] usb 3-1: Product: syz [ 34.956365][ T329] usb 3-1: Manufacturer: syz [ 34.961040][ T329] usb 3-1: SerialNumber: syz [ 34.967028][ T329] usb 3-1: config 0 descriptor?? [ 34.981077][ T327] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 35.002158][ T327] usb 2-1: device descriptor read/8, error -71 [ 35.067004][ T310] usb 4-1: 0:2 : does not exist [ 35.075835][ T310] usb 4-1: USB disconnect, device number 7 [ 35.086798][ T325] udevd[325]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 35.132405][ T327] usb 2-1: device descriptor read/8, error -71 [ 35.173496][ T493] usb 3-1: USB disconnect, device number 4 [ 35.318090][ T310] usb 1-1: USB disconnect, device number 4 [ 35.371156][ T327] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 35.400361][ T327] usb 2-1: device descriptor read/8, error -71 [ 35.532125][ T327] usb 2-1: device descriptor read/8, error -71 [ 35.580843][ T568] netlink: 8 bytes leftover after parsing attributes in process `syz.3.70'. [ 35.591100][ T568] device-mapper: table: 252:1: verity: Not enough arguments (-EINVAL) [ 35.599506][ T568] device-mapper: ioctl: error adding target to table [ 35.641197][ T327] usb usb2-port1: unable to enumerate USB device [ 35.861083][ T31] usb 4-1: new full-speed USB device number 8 using dummy_hcd [ 36.013124][ T574] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 36.021833][ T574] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 36.032932][ T31] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 36.040594][ T31] usb 4-1: can't read configurations, error -71 [ 36.541058][ T329] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 36.593039][ T601] No source specified [ 36.597563][ T601] ./dev/sda1: Can't lookup blockdev [ 36.624193][ T611] Bluetooth: ISO socket layer initialized [ 36.681053][ T312] usb 1-1: new low-speed USB device number 5 using dummy_hcd [ 36.691049][ T329] usb 2-1: Using ep0 maxpacket: 16 [ 36.698896][ T329] usb 2-1: config 1 has an invalid interface number: 105 but max is 0 [ 36.707240][ T329] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 36.718343][ T329] usb 2-1: config 1 has no interface number 0 [ 36.724587][ T329] usb 2-1: config 1 interface 105 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 36.737844][ T329] usb 2-1: config 1 interface 105 has no altsetting 0 [ 36.746349][ T329] usb 2-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 36.755727][ T329] usb 2-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 36.764257][ T329] usb 2-1: Product: syz [ 36.768589][ T329] usb 2-1: Manufacturer: syz [ 36.773278][ T329] usb 2-1: SerialNumber: syz [ 36.823154][ T619] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 36.831272][ T312] usb 1-1: Invalid ep0 maxpacket: 32 [ 36.961057][ T312] usb 1-1: new low-speed USB device number 6 using dummy_hcd [ 37.111072][ T312] usb 1-1: Invalid ep0 maxpacket: 32 [ 37.111076][ T310] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 37.124132][ T312] usb usb1-port1: attempt power cycle [ 37.262210][ T310] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 37.272476][ T310] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 37.284928][ T310] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 37.294040][ T310] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.302095][ T310] usb 3-1: Product: syz [ 37.306298][ T310] usb 3-1: Manufacturer: syz [ 37.310914][ T310] usb 3-1: SerialNumber: syz [ 37.318744][ T310] cdc_ncm 3-1:1.0: NCM or ECM functional descriptors missing [ 37.326258][ T310] cdc_ncm 3-1:1.0: bind() failure [ 37.461085][ T312] usb 1-1: new low-speed USB device number 7 using dummy_hcd [ 37.481693][ T312] usb 1-1: Invalid ep0 maxpacket: 32 [ 37.504519][ T634] tipc: Started in network mode [ 37.509766][ T634] tipc: Node identity 4, cluster identity 4711 [ 37.515987][ T634] tipc: Node number set to 4 [ 37.524319][ T31] usb 3-1: USB disconnect, device number 5 [ 37.552088][ T329] aqc111 2-1:1.105: probe with driver aqc111 failed with error -22 [ 37.564396][ T329] usb 2-1: USB disconnect, device number 9 [ 37.611160][ T312] usb 1-1: new low-speed USB device number 8 using dummy_hcd [ 37.631458][ T312] usb 1-1: Invalid ep0 maxpacket: 32 [ 37.636946][ T312] usb usb1-port1: unable to enumerate USB device [ 37.869091][ T655] ./dev/sda1: Can't lookup blockdev [ 38.011184][ T31] usb 1-1: new low-speed USB device number 9 using dummy_hcd [ 38.161050][ T31] usb 1-1: Invalid ep0 maxpacket: 32 [ 38.271069][ T329] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 38.291057][ T31] usb 1-1: new low-speed USB device number 10 using dummy_hcd [ 38.422186][ T329] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 38.433314][ T329] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 38.442450][ T31] usb 1-1: Invalid ep0 maxpacket: 32 [ 38.447851][ T329] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 38.455922][ T31] usb usb1-port1: attempt power cycle [ 38.462093][ T329] usb 3-1: config 0 descriptor?? [ 38.670741][ T329] usbhid 3-1:0.0: can't add hid device: -71 [ 38.676844][ T329] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 38.685604][ T329] usb 3-1: USB disconnect, device number 6 [ 38.801096][ T31] usb 1-1: new low-speed USB device number 11 using dummy_hcd [ 38.821507][ T31] usb 1-1: Invalid ep0 maxpacket: 32 [ 38.951095][ T31] usb 1-1: new low-speed USB device number 12 using dummy_hcd [ 38.971439][ T31] usb 1-1: Invalid ep0 maxpacket: 32 [ 38.976879][ T31] usb usb1-port1: unable to enumerate USB device [ 39.036119][ T36] kauditd_printk_skb: 26 callbacks suppressed [ 39.036136][ T36] audit: type=1400 audit(1793889887.800:291): avc: denied { rmdir } for pid=294 comm="syz-executor" name="proc" dev="sda1" ino=1264 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 39.111060][ T312] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 39.272252][ T312] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 39.283384][ T312] usb 3-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 39.292494][ T312] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.301322][ T312] usb 3-1: config 0 descriptor?? [ 39.461052][ T669] fuse: Bad value for 'fd' [ 39.484710][ T36] audit: type=1400 audit(1793889888.250:292): avc: denied { read } for pid=670 comm="syz.0.97" name="ppp" dev="devtmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 39.509679][ T36] audit: type=1400 audit(1793889888.270:293): avc: denied { create } for pid=670 comm="syz.0.97" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 39.533039][ T36] audit: type=1400 audit(1793889888.300:294): avc: denied { sys_admin } for pid=670 comm="syz.0.97" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 39.646446][ T671] cgroup: fork rejected by pids controller in /syz0 [ 39.712205][ T664] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 39.737818][ T664] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 39.884977][ T36] audit: type=1400 audit(1793889888.650:295): avc: denied { getopt } for pid=708 comm="syz.0.98" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 40.018893][ T36] audit: type=1400 audit(1793889888.780:296): avc: denied { setattr } for pid=294 comm="syz-executor" path="/21/dev/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 40.169524][ T109] udevd[109]: could not touch /run/udev/queue: No such file or directory [ 40.180283][ T312] aiptek 3-1:0.0: Aiptek using 400 ms programming speed [ 40.187701][ T36] audit: type=1400 audit(1793889888.940:297): avc: denied { search } for pid=710 comm="syz.0.99" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 40.209983][ T109] udevd[109]: could not touch /run/udev/queue: No such file or directory [ 40.219366][ T312] input: Aiptek as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input5 [ 40.231196][ T109] udevd[109]: could not touch /run/udev/queue: No such file or directory [ 40.257061][ T36] audit: type=1400 audit(1793889889.020:298): avc: denied { read } for pid=94 comm="acpid" name="event3" dev="devtmpfs" ino=476 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 40.301016][ T36] audit: type=1400 audit(1793889889.020:299): avc: denied { open } for pid=94 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=476 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 40.324265][ T36] audit: type=1400 audit(1793889889.020:300): avc: denied { ioctl } for pid=94 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=476 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 40.550634][ C1] aiptek 3-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 40.558882][ T312] usb 3-1: USB disconnect, device number 7 [ 40.987170][ T724] can0: slcan on ptm0. [ 41.028801][ T724] can0 (unregistered): slcan off ptm0. [ 41.266359][ T738] netlink: 8 bytes leftover after parsing attributes in process `syz.0.105'. [ 41.362303][ T734] FAULT_INJECTION: forcing a failure. [ 41.362303][ T734] name fail_futex, interval 1, probability 0, space 0, times 1 [ 41.376159][ T734] CPU: 0 UID: 0 PID: 734 Comm: syz.2.102 Not tainted syzkaller #0 fb4d83c2a69de87362621e77e54386714fae73a9 [ 41.376191][ T734] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 41.376212][ T734] Call Trace: [ 41.376219][ T734] [ 41.376227][ T734] __dump_stack+0x21/0x30 [ 41.376254][ T734] dump_stack_lvl+0x140/0x1c0 [ 41.376275][ T734] ? __cfi_dump_stack_lvl+0x10/0x10 [ 41.376296][ T734] ? unwind_get_return_address+0x51/0x90 [ 41.376337][ T734] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 41.376361][ T734] dump_stack+0x19/0x20 [ 41.376381][ T734] should_fail_ex+0x3c2/0x510 [ 41.376402][ T734] should_fail+0xf/0x20 [ 41.376421][ T734] get_futex_key+0x22c/0x940 [ 41.376444][ T734] ? __cfi_get_futex_key+0x10/0x10 [ 41.376466][ T734] ? kasan_save_track+0x4f/0x80 [ 41.376490][ T734] futex_wake+0x150/0x950 [ 41.376519][ T734] ? __cfi_futex_wake+0x10/0x10 [ 41.376548][ T734] ? perf_lock_task_context+0x398/0x450 [ 41.376570][ T734] ? __perf_event_period+0x490/0x490 [ 41.376591][ T734] ? mutex_unlock+0x90/0x240 [ 41.376621][ T734] do_futex+0x37d/0x510 [ 41.376646][ T734] ? __kasan_check_read+0x15/0x20 [ 41.376678][ T734] ? __cfi_do_futex+0x10/0x10 [ 41.376702][ T734] ? __kasan_check_write+0x18/0x20 [ 41.376736][ T734] mm_release+0x15f/0x300 [ 41.376765][ T734] ? exit_mm_release+0x50/0x50 [ 41.376796][ T734] ? futex_exit_release+0x11d/0x1f0 [ 41.376821][ T734] exit_mm_release+0x29/0x50 [ 41.376850][ T734] do_exit+0x832/0x2850 [ 41.376884][ T734] ? futex_wake+0x666/0x950 [ 41.376912][ T734] ? __cfi_do_exit+0x10/0x10 [ 41.376943][ T734] ? futex_wait+0x2b8/0x7c0 [ 41.376971][ T734] ? __cfi_futex_wait+0x10/0x10 [ 41.377001][ T734] ? __kasan_check_write+0x18/0x20 [ 41.377035][ T734] ? _raw_spin_lock_irq+0x93/0x120 [ 41.377059][ T734] do_group_exit+0x21f/0x2f0 [ 41.377092][ T734] ? __kasan_check_write+0x18/0x20 [ 41.377121][ T734] ? recalc_sigpending+0x16c/0x1d0 [ 41.377150][ T734] get_signal+0x134c/0x1490 [ 41.377174][ T734] arch_do_signal_or_restart+0xbc/0x700 [ 41.377200][ T734] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 41.377235][ T734] syscall_exit_to_user_mode+0x57/0xb0 [ 41.377269][ T734] do_syscall_64+0x63/0xf0 [ 41.377292][ T734] ? clear_bhb_loop+0x50/0xa0 [ 41.377330][ T734] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 41.377360][ T734] RIP: 0033:0x7f3d85b9fb19 [ 41.377387][ T734] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 41.377406][ T734] RSP: 002b:00007f3d86a7a0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 41.377430][ T734] RAX: fffffffffffffe00 RBX: 00007f3d85e26098 RCX: 00007f3d85b9fb19 [ 41.377446][ T734] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f3d85e26098 [ 41.377459][ T734] RBP: 00007f3d85e26090 R08: 0000000000000000 R09: 0000000000000000 [ 41.377472][ T734] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 41.377485][ T734] R13: 00007f3d85e26128 R14: 00007ffede9d98a0 R15: 00007ffede9d9988 [ 41.377505][ T734] [ 41.703302][ T746] rust_binder: Error in use_page_slow: ESRCH [ 41.711282][ T746] rust_binder: use_range failure ESRCH [ 41.716955][ T746] rust_binder: 744:746 transaction call to 744:0 failed ESRCH, code 1 size 22-0 line process.rs:1128 [ 41.772028][ T749] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=749 comm=syz.0.109 [ 41.942662][ T312] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 42.122167][ T312] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 42.139867][ T312] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 42.161221][ T312] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 1.00 [ 42.170417][ T312] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 42.187237][ T312] usb 3-1: Product: syz [ 42.195940][ T312] usb 3-1: Manufacturer: syz [ 42.200599][ T312] usb 3-1: SerialNumber: syz [ 42.220720][ T312] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 42.232472][ T312] cdc_wdm 3-1:1.0: Unknown control protocol [ 42.417067][ T745] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 42.431221][ T745] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 42.444665][ T745] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 42.471251][ T745] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 42.491843][ T745] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 42.509038][ T745] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 42.527625][ T745] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 42.541209][ T745] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 42.550343][ T745] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 42.570119][ T745] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 42.589765][ T9] rust_binder: 744: undelivered TRANSACTION_ERROR: 29201 [ 42.599864][ T9] usb 3-1: USB disconnect, device number 8 [ 43.211072][ T310] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 43.259543][ T785] netlink: 12 bytes leftover after parsing attributes in process `syz.2.119'. [ 43.363853][ T310] usb 2-1: config 1 has an invalid interface number: 158 but max is 0 [ 43.380609][ T310] usb 2-1: config 1 has no interface number 0 [ 43.392432][ T310] usb 2-1: New USB device found, idVendor=22b8, idProduct=3010, bcdDevice= 0.01 [ 43.396385][ T790] raw_sendmsg: syz.0.121 forgot to set AF_INET. Fix it! [ 43.408731][ T310] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 43.431193][ T310] usb 2-1: Product: syz [ 43.435597][ T310] usb 2-1: Manufacturer: syz [ 43.440401][ T310] usb 2-1: SerialNumber: syz [ 43.521048][ T312] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 43.669747][ T777] device-mapper: ioctl: populate_table: target parameters not NUL-terminated [ 43.678751][ T312] usb 3-1: Using ep0 maxpacket: 32 [ 43.685687][ T312] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 43.696953][ T312] usb 3-1: New USB device found, idVendor=056a, idProduct=00b1, bcdDevice= 0.00 [ 43.706225][ T312] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 43.715308][ T312] usb 3-1: config 0 descriptor?? [ 43.743267][ T310] usb-storage 2-1:1.158: USB Mass Storage device detected [ 43.762402][ T310] usb-storage 2-1:1.158: Quirks match for vid 22b8 pid 3010: 30 [ 43.832380][ T310] usb 2-1: USB disconnect, device number 10 [ 44.138218][ T788] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 44.150495][ T788] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 44.164782][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.172490][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.179588][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.186818][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.193916][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.200958][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.208083][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.217012][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.224219][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.231402][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.238467][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.245817][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.252994][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.267840][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.281194][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.289366][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.297845][ T36] kauditd_printk_skb: 33 callbacks suppressed [ 44.297865][ T36] audit: type=1400 audit(1793889893.060:334): avc: denied { write } for pid=800 comm="syz.1.124" name="igmp6" dev="proc" ino=4026532346 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 44.334032][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.347081][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.354451][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.364775][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.371869][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.380414][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.389893][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.396986][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.404235][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.411433][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.418494][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.425720][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.432943][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.439947][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.447245][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.454556][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.461908][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.468980][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.476333][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.483549][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.490641][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.497896][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.505134][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.512382][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.519540][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.526810][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.534110][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.541312][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.548428][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.555675][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.562933][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.569995][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.577303][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.584582][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.591778][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.598769][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.606032][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.611175][ T310] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 44.613895][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.627771][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.634952][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.642148][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.649137][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.656481][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.663664][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.670775][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.677987][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.685188][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.692339][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.699477][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.706698][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.713897][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.720885][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.728154][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.735339][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.742534][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.749514][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.756804][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.764072][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.771282][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.772892][ T310] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 44.778394][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.795627][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.802787][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.802993][ T310] usb 1-1: New USB device found, idVendor=050d, idProduct=011b, bcdDevice=6f.a4 [ 44.810141][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.826381][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.833633][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.840264][ T310] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 44.841730][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.855849][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.863068][ T310] usb 1-1: config 0 descriptor?? [ 44.869551][ T310] usb 1-1: bad CDC descriptors [ 44.888999][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.896378][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.903671][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.912388][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.919645][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.927281][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.934747][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.947349][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.954963][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.962201][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.969293][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.976531][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.984136][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.991387][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 44.998440][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.009795][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.024449][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.037159][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.051291][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.059532][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.070005][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.079561][ T36] audit: type=1400 audit(1793889893.840:335): avc: denied { bind } for pid=804 comm="syz.0.125" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 45.086778][ T805] netlink: 37 bytes leftover after parsing attributes in process `syz.0.125'. [ 45.100002][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.121578][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.130843][ T36] audit: type=1400 audit(1793889893.840:336): avc: denied { name_bind } for pid=804 comm="syz.0.125" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 45.144301][ T805] overlayfs: workdir and upperdir must reside under the same mount [ 45.152706][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.175419][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.182685][ T36] audit: type=1400 audit(1793889893.840:337): avc: denied { node_bind } for pid=804 comm="syz.0.125" saddr=ff02::1 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 45.188065][ T310] usb 1-1: USB disconnect, device number 13 [ 45.205046][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.229093][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.241900][ T36] audit: type=1400 audit(1793889893.890:338): avc: denied { ioctl } for pid=814 comm="syz.2.128" path="socket:[10289]" dev="sockfs" ino=10289 ioctlcmd=0x8922 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 45.271055][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.281277][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.298663][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.305902][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.313090][ T36] audit: type=1400 audit(1793889893.910:339): avc: denied { getattr } for pid=804 comm="syz.0.125" name="/" dev="incremental-fs" ino=251 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 45.336425][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x1 [ 45.343661][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.350726][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.358064][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.365311][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.372478][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x1 [ 45.379579][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.386849][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.394080][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.401297][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.408409][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.415677][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x3 [ 45.423194][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.430214][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.437589][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.444807][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.461295][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x3 [ 45.468394][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.478732][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.493182][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.500270][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.507529][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.514770][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.523219][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.530325][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.537573][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.556668][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.571067][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.585616][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x4 [ 45.601077][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.611188][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.630266][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.641743][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.651235][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.658263][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.671051][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x3 [ 45.681467][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.689626][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.701032][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.707974][ T312] wacom 0003:056A:00B1.0002: unknown main item tag 0x0 [ 45.725113][ T312] wacom 0003:056A:00B1.0002: item fetching failed at offset 233/234 [ 45.741300][ T312] wacom 0003:056A:00B1.0002: parse failed [ 45.747222][ T312] wacom 0003:056A:00B1.0002: probe with driver wacom failed with error -22 [ 45.779535][ T312] usb 3-1: USB disconnect, device number 9 [ 45.973748][ T36] audit: type=1400 audit(1793889894.740:340): avc: denied { mounton } for pid=834 comm="syz.2.133" path="/30/file0" dev="tmpfs" ino=205 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 46.411052][ T310] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 46.582500][ T310] usb 2-1: unable to get BOS descriptor or descriptor too short [ 46.601392][ T310] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 46.621022][ T310] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 50, changing to 7 [ 46.641013][ T310] usb 2-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 46.672448][ T310] usb 2-1: New USB device found, idVendor=2b53, idProduct=0024, bcdDevice= 0.40 [ 46.685633][ T310] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=2 [ 46.711051][ T310] usb 2-1: Product: syz [ 46.715289][ T310] usb 2-1: Manufacturer: syz [ 46.719957][ T310] usb 2-1: SerialNumber: syz [ 46.938381][ T310] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 46.957816][ T310] snd-usb-audio 2-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 46.992858][ T310] snd-usb-audio 2-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 47.018501][ T310] usb 2-1: USB disconnect, device number 11 [ 47.044840][ T391] udevd[391]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.2/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 47.361017][ T45] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 47.521051][ T45] usb 3-1: Using ep0 maxpacket: 16 [ 47.561399][ T45] usb 3-1: config 32 has an invalid interface number: 64 but max is 0 [ 47.594702][ T45] usb 3-1: config 32 has an invalid descriptor of length 0, skipping remainder of the config [ 47.621014][ T45] usb 3-1: config 32 has no interface number 0 [ 47.631542][ T45] usb 3-1: New USB device found, idVendor=0bd3, idProduct=0569, bcdDevice= 0.5b [ 47.652611][ T45] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 47.877407][ T45] usb 3-1: USB disconnect, device number 10 [ 48.480391][ T36] audit: type=1400 audit(1793889897.240:341): avc: denied { create } for pid=877 comm="syz.2.142" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_dnrt_socket permissive=1 [ 48.636794][ T882] SELinux: policydb magic number 0xba4be8c does not match expected magic number 0xf97cff8c [ 48.647099][ T36] audit: type=1400 audit(1793889897.400:342): avc: denied { load_policy } for pid=881 comm="syz.1.144" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 48.671092][ T882] SELinux: failed to load policy [ 48.831039][ T45] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 48.921360][ T889] input: syz0 as /devices/virtual/input/input6 [ 48.981075][ T45] usb 3-1: device descriptor read/64, error -71 [ 49.081027][ T312] usb 2-1: new full-speed USB device number 12 using dummy_hcd [ 49.104198][ T896] netlink: 68 bytes leftover after parsing attributes in process `syz.0.148'. [ 49.113782][ T36] audit: type=1400 audit(1793889897.880:343): avc: denied { create } for pid=895 comm="syz.0.148" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 49.221106][ T45] usb 3-1: device descriptor read/64, error -71 [ 49.248312][ T312] usb 2-1: not running at top speed; connect to a high speed hub [ 49.258674][ T312] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 49.279739][ T312] usb 2-1: New USB device found, idVendor=225a, idProduct=e1d4, bcdDevice=a7.ad [ 49.289181][ T312] usb 2-1: New USB device strings: Mfr=245, Product=210, SerialNumber=0 [ 49.303400][ T312] usb 2-1: Product: syz [ 49.307610][ T312] usb 2-1: Manufacturer: syz [ 49.321574][ T312] usb 2-1: Found UVC 1.00 device syz (225a:e1d4) [ 49.481056][ T45] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 49.527627][ T312] usb 2-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 49.538893][ T312] uvcvideo 2-1:1.1: Failed to query (129) UVC probe control : -71 (exp. 26). [ 49.548093][ T312] uvcvideo 2-1:1.1: Failed to initialize the device (-71). [ 49.564619][ T312] usb 2-1: USB disconnect, device number 12 [ 49.611049][ T45] usb 3-1: device descriptor read/64, error -71 [ 49.851043][ T45] usb 3-1: device descriptor read/64, error -71 [ 49.961151][ T45] usb usb3-port1: attempt power cycle [ 50.081129][ T913] FAULT_INJECTION: forcing a failure. [ 50.081129][ T913] name failslab, interval 1, probability 0, space 0, times 1 [ 50.094146][ T913] CPU: 1 UID: 0 PID: 913 Comm: syz.0.151 Not tainted syzkaller #0 fb4d83c2a69de87362621e77e54386714fae73a9 [ 50.094178][ T913] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 50.094193][ T913] Call Trace: [ 50.094200][ T913] [ 50.094207][ T913] __dump_stack+0x21/0x30 [ 50.094233][ T913] dump_stack_lvl+0x140/0x1c0 [ 50.094253][ T913] ? __cfi_dump_stack_lvl+0x10/0x10 [ 50.094275][ T913] dump_stack+0x19/0x20 [ 50.094295][ T913] should_fail_ex+0x3c2/0x510 [ 50.094316][ T913] ? security_inode_init_security+0x11c/0x600 [ 50.094344][ T913] should_failslab+0xac/0x100 [ 50.094369][ T913] __kmalloc_noprof+0x69/0x510 [ 50.094403][ T913] ? security_inode_init_security+0x11c/0x600 [ 50.094431][ T913] ? __cfi_inode_set_ctime_current+0x10/0x10 [ 50.094461][ T913] ? __cfi_shmem_initxattrs+0x10/0x10 [ 50.094518][ T913] security_inode_init_security+0x11c/0x600 [ 50.094545][ T913] ? __cfi_security_inode_init_security+0x10/0x10 [ 50.094571][ T913] ? shmem_get_inode+0x81c/0xc10 [ 50.094594][ T913] shmem_tmpfile+0x9a/0x150 [ 50.094621][ T913] vfs_tmpfile+0x381/0x580 [ 50.094647][ T913] kernel_tmpfile_open+0x54/0x90 [ 50.094672][ T913] ovl_fill_super+0x3352/0x51a0 [ 50.094694][ T913] ? shrinker_alloc+0x68/0xa60 [ 50.094725][ T913] ? kasan_save_track+0x3e/0x80 [ 50.094745][ T913] ? __se_sys_mount+0x2bf/0x480 [ 50.094765][ T913] ? __cfi_ovl_fill_super+0x10/0x10 [ 50.094787][ T913] ? __kasan_check_write+0x18/0x20 [ 50.094817][ T913] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 50.094839][ T913] ? __cfi__raw_spin_lock_irqsave+0x10/0x10 [ 50.094859][ T913] ? xas_find_marked+0xc97/0xda0 [ 50.094883][ T913] ? xas_nomem+0x71/0x2c0 [ 50.094905][ T913] ? ida_alloc_range+0xa44/0xa80 [ 50.094934][ T913] ? __kmalloc_cache_noprof+0x23c/0x470 [ 50.094966][ T913] ? __kasan_check_write+0x18/0x20 [ 50.094997][ T913] ? mutex_unlock+0x90/0x240 [ 50.095024][ T913] ? __cfi_mutex_unlock+0x10/0x10 [ 50.095049][ T913] ? __kasan_check_write+0x18/0x20 [ 50.095081][ T913] ? sget_fc+0x97e/0xa70 [ 50.095107][ T913] ? __cfi_set_anon_super_fc+0x10/0x10 [ 50.095138][ T913] get_tree_nodev+0xce/0x170 [ 50.095169][ T913] ? __cfi_ovl_fill_super+0x10/0x10 [ 50.095191][ T913] ovl_get_tree+0x20/0x30 [ 50.095212][ T913] vfs_get_tree+0x9e/0x290 [ 50.095244][ T913] do_new_mount+0x251/0xb40 [ 50.095279][ T913] ? security_capable+0x44/0x130 [ 50.095303][ T913] path_mount+0x66a/0xff0 [ 50.095341][ T913] ? putname+0x113/0x150 [ 50.095363][ T913] __se_sys_mount+0x2bf/0x480 [ 50.095385][ T913] ? __x64_sys_mount+0xf0/0xf0 [ 50.095407][ T913] ? __kasan_check_write+0x18/0x20 [ 50.095438][ T913] ? fpregs_restore_userregs+0x11c/0x260 [ 50.095470][ T913] __x64_sys_mount+0xc3/0xf0 [ 50.095499][ T913] x64_sys_call+0x2021/0x2ee0 [ 50.095524][ T913] do_syscall_64+0x57/0xf0 [ 50.095547][ T913] ? clear_bhb_loop+0x50/0xa0 [ 50.095580][ T913] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 50.095609][ T913] RIP: 0033:0x7f4b2a39fb19 [ 50.095629][ T913] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 50.095647][ T913] RSP: 002b:00007f4b2b293028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 50.095672][ T913] RAX: ffffffffffffffda RBX: 00007f4b2a625fa0 RCX: 00007f4b2a39fb19 [ 50.095688][ T913] RDX: 0000200000000240 RSI: 00002000000001c0 RDI: 0000000000000000 [ 50.095703][ T913] RBP: 00007f4b2a437b70 R08: 0000200000000280 R09: 0000000000000000 [ 50.095718][ T913] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000000 [ 50.095731][ T913] R13: 00007f4b2a626038 R14: 00007f4b2a625fa0 R15: 00007ffd5afe8b18 [ 50.095751][ T913] [ 50.100365][ T913] overlayfs: upper fs does not support tmpfile. [ 50.512274][ T36] kauditd_printk_skb: 3 callbacks suppressed [ 50.512292][ T36] audit: type=1400 audit(1793889899.280:347): avc: denied { connect } for pid=920 comm="syz.1.154" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 50.538300][ T45] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 50.588488][ T45] usb 3-1: device descriptor read/8, error -71 [ 50.705144][ T928] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 50.722667][ T45] usb 3-1: device descriptor read/8, error -71 [ 50.732042][ T928] syz.0.157 uses obsolete (PF_INET,SOCK_PACKET) [ 50.831049][ T312] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 50.962166][ T45] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 50.989020][ T312] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 51.000100][ T45] usb 3-1: device descriptor read/8, error -71 [ 51.006520][ T312] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 51.015980][ T312] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 51.026174][ T312] usb 2-1: config 0 descriptor?? [ 51.142146][ T45] usb 3-1: device descriptor read/8, error -71 [ 51.191022][ T31] usb 1-1: new full-speed USB device number 14 using dummy_hcd [ 51.238577][ T312] usbhid 2-1:0.0: can't add hid device: -71 [ 51.245132][ T312] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 51.256887][ T45] usb usb3-port1: unable to enumerate USB device [ 51.264055][ T312] usb 2-1: USB disconnect, device number 13 [ 51.352260][ T31] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 51.364264][ T31] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 51.373705][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 51.382023][ T31] usb 1-1: Product: syz [ 51.386336][ T31] usb 1-1: Manufacturer: syz [ 51.391173][ T31] usb 1-1: SerialNumber: syz [ 51.592117][ T36] audit: type=1400 audit(1793889900.360:348): avc: denied { setopt } for pid=941 comm="syz.2.162" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 51.751059][ T312] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 51.796515][ T950] netlink: 48 bytes leftover after parsing attributes in process `syz.2.165'. [ 51.807258][ T36] audit: type=1400 audit(1793889900.570:349): avc: denied { setopt } for pid=949 comm="syz.2.165" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 51.922311][ T312] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 51.933523][ T312] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 51.943103][ T312] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 51.952540][ T312] usb 2-1: config 0 descriptor?? [ 52.029420][ T31] cdc_ncm 1-1:1.0: failed GET_NTB_PARAMETERS [ 52.036590][ T31] cdc_ncm 1-1:1.0: bind() failure [ 52.043700][ T31] cdc_ncm 1-1:1.1: CDC Union missing and no IAD found [ 52.050703][ T31] cdc_ncm 1-1:1.1: bind() failure [ 52.361681][ T312] keytouch 0003:0926:3333.0003: fixing up Keytouch IEC report descriptor [ 52.380491][ T312] input: HID 0926:3333 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0926:3333.0003/input/input7 [ 52.470323][ T312] keytouch 0003:0926:3333.0003: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.1-1/input0 [ 52.491430][ T953] udevd[953]: failed to execute '/lib/udev/fido_id' 'fido_id': No such file or directory [ 52.616518][ T955] netlink: 'syz.2.166': attribute type 46 has an invalid length. [ 52.675825][ T36] audit: type=1400 audit(1793889901.440:350): avc: denied { sqpoll } for pid=959 comm="syz.2.167" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 SYZFAIL: SIGBUS pc-offset:0xfffffffffffe2cad pc:0x7f1186071a63 addr:0x7f11817ffffc code=2 (errno 11: Resource temporarily unavailable) [ 52.746478][ T36] audit: type=1400 audit(1793889901.510:351): avc: denied { write } for pid=285 comm="syz-executor" path="pipe:[2766]" dev="pipefs" ino=2766 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 52.864751][ T312] usb 1-1: USB disconnect, device number 14 [ 52.922237][ T425] bridge_slave_1: left allmulticast mode [ 52.927993][ T425] bridge_slave_1: left promiscuous mode [ 52.941208][ T425] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.952569][ T425] bridge_slave_0: left allmulticast mode [ 52.958277][ T425] bridge_slave_0: left promiscuous mode [ 52.971085][ T425] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.144515][ T425] veth1_macvtap: left promiscuous mode [ 53.150132][ T425] veth0_vlan: left promiscuous mode [ 53.192261][ T310] usb 2-1: USB disconnect, device number 14 [ 53.443887][ T425] bridge_slave_1: left allmulticast mode [ 53.449578][ T425] bridge_slave_1: left promiscuous mode [ 53.455311][ T425] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.463125][ T425] bridge_slave_0: left allmulticast mode [ 53.468800][ T425] bridge_slave_0: left promiscuous mode [ 53.474490][ T425] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.482650][ T425] bridge_slave_1: left allmulticast mode [ 53.488310][ T425] bridge_slave_1: left promiscuous mode [ 53.494246][ T425] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.501874][ T425] bridge_slave_0: left allmulticast mode [ 53.507527][ T425] bridge_slave_0: left promiscuous mode [ 53.513284][ T425] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.521112][ T425] bridge_slave_1: left allmulticast mode [ 53.526772][ T425] bridge_slave_1: left promiscuous mode [ 53.532562][ T425] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.540101][ T425] bridge_slave_0: left allmulticast mode [ 53.545886][ T425] bridge_slave_0: left promiscuous mode [ 53.551577][ T425] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.804448][ T425] tipc: Left network mode [ 53.811052][ T425] veth1_macvtap: left promiscuous mode [ 53.816596][ T425] veth0_vlan: left promiscuous mode [ 53.822257][ T425] veth1_macvtap: left promiscuous mode [ 53.827979][ T425] veth0_vlan: left promiscuous mode [ 53.834334][ T425] veth1_macvtap: left promiscuous mode [ 53.839876][ T425] veth0_vlan: left promiscuous mode