last executing test programs: 23.485004256s ago: executing program 1 (id=6): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x143802, 0x0) ioctl$XFS_IOC_GETPARENTS(r0, 0xc028583e, &(0x7f0000000080)={{[0x49, 0x2, 0x5, 0x1]}, 0x0, 0x0, 0xf8, 0x0, &(0x7f0000000000)=[{{@align=0x30e3800000000, {0x5, 0x4, 0xf, 0x9}}, 0x6, 0x0, '/dev/rnullb0\x00'}, {{@_ha_fsid={[0x4, 0x80000001]}, {0x6, 0x5, 0x10, 0x10}}, 0x2, 0x0, '/dev/rnullb0\x00'}, {{@align=0x1, {0x34c, 0xfffa, 0x101, 0x6}}, 0x0, 0x0, '[$\x00'}]}) ioctl$BLKRRPART(r0, 0x125f, 0x0) signalfd(r0, &(0x7f00000000c0)={[0x8]}, 0x8) 23.420032108s ago: executing program 1 (id=8): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1000000) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f00000000c0)="440f20c03507000000440f22c067420f8f04000000c443ad68b60080000095c4828947b600000000b99d090000b82f624a48baf4e055500f30263636f3430fc73636f2360fa5a10050aa37f39066b817018ec8c4c1795a5100", 0x59}], 0x1, 0x11, 0x0, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x4, 0x4, 0x4000, 0x2000, &(0x7f000000f000/0x2000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) (async) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000007c0)=[@text64={0x40, 0x0}], 0x1, 0x38, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 23.419755178s ago: executing program 1 (id=9): setuid(0xee01) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x2200, 0x0) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x9}) (async) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x9, 0xffffffff, 0x4e, 0x567}, 0x13) (async) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x18, 0x16, 0xa01, 0x0, 0x0, {0x10}, [@generic='\x00']}, 0x18}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x8971, &(0x7f0000000440)={'sit0\x00', 0x0}) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) (async) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) socket(0x10, 0x3, 0x0) (async) socket$netlink(0x10, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x0) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) socket$netlink(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x723080, 0x0) syz_usb_connect$uac1(0x2, 0xdc, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c240208000103000000ff000924060506020100000924030003030005490c240206", @ANYRES8=r5, @ANYBLOB='\a'], 0x0) (async) syz_io_uring_setup(0x3409, &(0x7f0000000080)={0x0, 0xe962, 0x8, 0xfffffffd, 0x136}, 0x0, 0x0, 0x0) (async) syz_clone3(&(0x7f0000000140)={0x4000, 0x0, 0x0, 0x0, {0x1f}, 0x0, 0x0, 0x0, &(0x7f0000000080)}, 0x58) 22.11147715s ago: executing program 1 (id=19): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) r1 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x458, 0x5005, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xf0, 0x7e, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x7ffd, 0x0, 0x1, {0x22, 0xeb}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0xfc}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) (async) syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 64) syz_usb_control_io(r1, 0x0, 0x0) (rerun: 64) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x74, 0x0, 0x0) (async) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f00000000c0)={0x2, 0x4e20, @broadcast}, 0x10) (async, rerun: 64) sendto$inet(r2, &(0x7f0000000100)="ed", 0x1, 0x20008005, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) (rerun: 64) recvfrom(r2, 0x0, 0x0, 0x143, 0x0, 0x0) (async) tgkill(r0, r0, 0x5) ptrace$peeksig(0x4209, r0, &(0x7f0000000140)={0x0, 0x0, 0x4e}, &(0x7f0000000fc0)) clock_gettime(0xfffffffffffffff1, &(0x7f0000000000)) 19.039632255s ago: executing program 1 (id=30): syz_open_procfs$pagemap(0x0, &(0x7f0000000200)) (async) r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000000200)) capset(&(0x7f0000000080)={0x20080522}, &(0x7f00000000c0)={0x200004, 0x200004, 0x3}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/kallsyms\x00', 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) (async) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$TCFLSH(r1, 0x400455c8, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r2, 0x800448d3, &(0x7f0000000180)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, 0xfffffffffffffffe, 0x0, 0xfffffc76, 0xfffffffffffffffe, 0x2f, 0x62, 0x18, 0x20}) (async) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, 0xfffffffffffffffe, 0x0, 0xfffffc76, 0xfffffffffffffffe, 0x2f, 0x62, 0x18, 0x20}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x103002, 0x0) syz_open_procfs(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x7fffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x440, 0x0) timer_create(0x7, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000001100)=0x0) r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r5) ptrace$peekuser(0x3, r5, 0x118) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) (async) timer_settime(r4, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) (async) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x1802, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000000)={0x6, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x2}], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000000)={0x6, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x2}], 0x0, 0x0, 0x0}) preadv(r3, &(0x7f0000001040)=[{&(0x7f0000000040)=""/4096, 0x1000}], 0x1, 0x6, 0x0) (async) preadv(r3, &(0x7f0000001040)=[{&(0x7f0000000040)=""/4096, 0x1000}], 0x1, 0x6, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x40240, 0x0) 18.905709758s ago: executing program 1 (id=32): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000772904202404019957c2010203010902240001000010000904430002317d5500090502020002220000090582020002"], 0x0) syz_usb_connect$cdc_ecm(0x2, 0x5a, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020000102505a1a440000000010109024800010106000009040000ff02020000052406800005240002000d240f010000000000000000000424020009058103200000000a09058202200000000009050302", @ANYRESHEX=0x0], 0x0) (async, rerun: 64) syz_usb_control_io$hid(r0, 0x0, 0x0) (rerun: 64) syz_usb_control_io(r0, 0x0, 0x0) mount(0x0, &(0x7f0000000080)='./cgroup\x00', 0x0, 0x10, 0x0) (async) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r1 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_FLUSH(r1, 0x29, 0xd1, &(0x7f0000000080)=0x2, 0x4) (async) syz_usb_control_io$printer(r0, 0x0, 0x0) (async) syz_usb_control_io$uac2(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000140)={0x20, 0x3, 0x4, "07f23d0a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) 18.499725278s ago: executing program 3 (id=33): prctl$PR_SET_MM(0x23, 0x0, &(0x7f0000ffb000/0x3000)=nil) r0 = accept(0xffffffffffffffff, &(0x7f0000000100)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @dev}}}}, &(0x7f0000000180)=0x80) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000001c0)={&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000000000)="c6a4f7f6302234eb5c36cffb5783b41d77dd58a9ec7f1c39e05507fd370549cf2f539200559d94a52ad8b4464fd72ada859bcacb1f6fac02bcf55bbe7918daf90813db02cd1e40f1f4ae9f120a989176573552525af113a137fe6f84285740bbf8bb75ab4dedfcf6f9814bf3015f2fada99579686e46dc11a6bc3a10124d07c4b25df051b58c9e7b5e989f57dfb74b0eb716678e0cf11460234040d597d1764c3808cec13564f25ddf0cd42d4d09f838b254e985a02a27937499142d2ca24b5afdee8416cd18fb3fa11382ab392747b2888882693d8334aa57182a", 0xdb, r1}, 0x68) sendto$inet6(r0, &(0x7f0000000240)="f06a2c8ef0d9d7fdaa4d2b7613155dcd71bd7fbc6adb254ca7f16192362f09ecaba5d65f4986b82a30217483472c7b235aed56b9a6b31203a1b307e5609d7432bbc0b849d246ea90bfe25984ef9dbd5c8c1737f8856e1ccb627559581527de64dd479834dda3557d3a7321099c76428c3c5b17ab61276e3893ade59beaa450ef0295cee732e20d89655836a514243e38dbc974000ffccfbb83d707f723f2a20566636acc2d5cd900e53a80fb3b4c08e8376ddee8f0e1dcd08bcd82f5bc22110dc7f899d9c4d82e997032947251c5bb3b250e47cf220a9450afd413c5dae1fcfd0a7329cd5623fb5e5e9aaf", 0xeb, 0x1, 0x0, 0x0) madvise(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x10) munmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x3000)=nil, 0x3000, &(0x7f0000000340)='\x00') r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r2, &(0x7f0000000500)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000004c0)={&(0x7f0000000400)={0x9c, r3, 0x200, 0x70bd26, 0x25dfdbfb, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @ipv4={'\x00', '\xff\xff', @private=0xa010100}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @remote}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth0_macvtap\x00'}, @NLBL_UNLABEL_A_SECCTX={0x27, 0x7, 'system_u:object_r:apt_var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'pimreg1\x00'}]}, 0x9c}, 0x1, 0x0, 0x0, 0x10}, 0x80) mprotect(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x4) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ff8000/0x2000)=nil, 0x2000, &(0x7f0000000540)='veth0_macvtap\x00') write$bt_hci(r1, &(0x7f0000000580)={0x1, @disconn_logical_link={{0x43a, 0x2}, {0x3}}}, 0x6) mmap(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x2000001, 0x2010, r0, 0x12f66000) mkdir(&(0x7f00000005c0)='./file0\x00', 0x100) getsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x8) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r1, 0x4058587a, &(0x7f00000007c0)={{r0, &(0x7f0000000680)='veth0_macvtap\x00', 0x8002, &(0x7f00000006c0)={@align=0x194db506, {0x1, 0x8001, 0x66, 0x10001}}, 0x8, &(0x7f0000000700)={@_ha_fsid}, &(0x7f0000000740)=0x8}, {[0xf1, 0x8, 0x3, 0x7fffffff]}, 0x0, 0x39, &(0x7f0000000780)=""/57}) ioctl$KVM_TDX_INIT_MEM_REGION(r4, 0xc008aeba, &(0x7f0000000880)={0x3, 0x1, &(0x7f0000000840)={&(0x7f0000ff8000/0x3000)=nil, 0x40000, 0xe}}) madvise(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0xd) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, &(0x7f00000008c0)={0x0, 0x0, {}, {0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) r5 = syz_open_procfs$userns(0x0, &(0x7f0000000cc0)) ioctl$NILFS_IOCTL_CLEAN_SEGMENTS(r5, 0x40786e88, &(0x7f0000000f40)={{&(0x7f0000000d00)=[{0x2, 0xb, 0x0, {0xffffffff, 0x7}, 0xfffffffffffffff7, 0x2, 0x7}], 0x1, 0x40, 0x45}, {&(0x7f0000000d40)=[{0x1ff, 0xb}, {0x7fffffffffffffff, 0x9}, {0x2, 0x5}, {0x1, 0x6}, {0x5, 0x8000000000000001}, {0xc40, 0xffff}], 0x6, 0x10, 0x4, 0x9}, {&(0x7f0000000dc0)=[0x5], 0x1, 0x8, 0x3, 0xffffffffffffffff}, {&(0x7f0000000e00)=[{0x6, 0x9c, 0x7, 0x9, 0xffff}, {0xba, 0x7eaa, 0x88, 0x2, 0x7}, {0x80000001, 0xd, 0xb8ed, 0x8, 0xf}, {0x0, 0x7, 0xb, 0x7, 0x2}, {0x1, 0x7, 0x29d, 0x3, 0x5}, {0x8001, 0x2a, 0x8, 0xfffffffffffffc01, 0x2}], 0x6, 0x28, 0x9, 0x6}, {&(0x7f0000000f00)=[0x9, 0x2d, 0x10, 0x6], 0x4, 0x8, 0x2, 0x156}}) r6 = socket$pptp(0x18, 0x1, 0x2) ioctl$PPPIOCGCHAN(r6, 0x80047437, &(0x7f0000000fc0)) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$getown(r4, 0x9) sendmsg$NLBL_UNLABEL_C_ACCEPT(r2, &(0x7f0000001100)={&(0x7f0000001000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000010c0)={&(0x7f0000001040)={0x58, r3, 0x100, 0x70bd2d, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth0_vlan\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @private=0xa010100}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @remote}]}, 0x58}, 0x1, 0x0, 0x0, 0x20004010}, 0x81) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000001140)={0xffffffffffffffff}) recvmmsg(r7, &(0x7f00000066c0)=[{{&(0x7f0000001180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, 0x80, &(0x7f00000016c0)=[{&(0x7f0000001200)=""/230, 0xe6}, {&(0x7f0000001300)=""/145, 0x91}, {&(0x7f00000013c0)=""/122, 0x7a}, {&(0x7f0000001440)=""/227, 0xe3}, {&(0x7f0000001540)=""/31, 0x1f}, {&(0x7f0000001580)=""/200, 0xc8}, {&(0x7f0000001680)=""/36, 0x24}], 0x7, &(0x7f0000001740)=""/211, 0xd3}, 0xea84}, {{&(0x7f0000001840)=@in6={0xa, 0x0, 0x0, @dev}, 0x80, &(0x7f0000001a00)=[{&(0x7f00000018c0)=""/70, 0x46}, {&(0x7f0000001940)=""/42, 0x2a}, {&(0x7f0000001980)=""/66, 0x42}], 0x3, &(0x7f0000001a40)=""/23, 0x17}, 0x5}, {{&(0x7f0000001a80)=@x25={0x9, @remote}, 0x80, &(0x7f0000001c80)=[{&(0x7f0000001b00)=""/120, 0x78}, {&(0x7f0000001b80)=""/199, 0xc7}], 0x2, &(0x7f0000001cc0)=""/28, 0x1c}, 0x3ee}, {{0x0, 0x0, &(0x7f0000001f40)=[{&(0x7f0000001d00)=""/187, 0xbb}, {&(0x7f0000001dc0)=""/224, 0xe0}, {&(0x7f0000001ec0)=""/109, 0x6d}], 0x3, &(0x7f0000001f80)=""/152, 0x98}, 0x4}, {{&(0x7f0000002040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, 0x80, &(0x7f0000003100)=[{&(0x7f00000020c0)=""/1, 0x1}, {&(0x7f0000002100)=""/4096, 0x1000}], 0x2, &(0x7f0000003140)=""/34, 0x22}}, {{&(0x7f0000003180)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000004440)=[{&(0x7f0000003200)=""/4096, 0x1000}, {&(0x7f0000004200)=""/123, 0x7b}, {&(0x7f0000004280)=""/110, 0x6e}, {&(0x7f0000004300)=""/51, 0x33}, {&(0x7f0000004340)=""/239, 0xef}], 0x5}, 0xff00}, {{&(0x7f00000044c0)=@ethernet={0x0, @link_local}, 0x80, &(0x7f0000005680)=[{&(0x7f0000004540)=""/23, 0x17}, {&(0x7f0000004580)=""/32, 0x20}, {&(0x7f00000045c0)=""/178, 0xb2}, {&(0x7f0000004680)=""/4096, 0x1000}], 0x4, &(0x7f00000056c0)=""/4096, 0x1000}, 0x5}], 0x7, 0x22, &(0x7f0000006880)={0x0, 0x3938700}) 17.644233359s ago: executing program 3 (id=39): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) r1 = syz_open_dev$evdev(0x0, 0x10001, 0x109200) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), r1) sendmsg$TIPC_NL_LINK_GET(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000300)={0x2c, r3, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@TIPC_NLA_LINK={0x18, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x8080) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x40082, 0x0) ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000140)) ioctl$PPPIOCATTACH(r0, 0x4004743d, &(0x7f0000000540)) dup(0xffffffffffffffff) r5 = socket$inet_tcp(0x2, 0x1, 0x0) dup2(r5, r0) memfd_secret(0x0) 17.552200311s ago: executing program 3 (id=40): r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) syz_usb_disconnect(r0) (async) syz_usb_connect$rtl8150(0x2, 0x3f, &(0x7f0000000240)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) ioctl$EVIOCRMFF(r0, 0xc0085508, 0x0) r1 = syz_io_uring_setup(0x48cc, &(0x7f0000000140)={0x0, 0xd350, 0x3201, 0x3, 0x19a}, &(0x7f0000000080)=0x0, &(0x7f0000000200)=0x0, &(0x7f0000000000)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000340)={0x2e, 0xb, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x1, 0x3b7, 0x0, 0x0, 0x1000, 0x7}}}, 0x0) (async) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x9, 0x4, 0x6, 0xfffa}, 0x1d, [0x1, 0xc95a, 0xfffffff3, 0x9, 0x80, 0x2, 0x3, 0x7f, 0x6, 0x4d, 0x39cc191a, 0x2, 0x9, 0x5, 0x2, 0x0, 0x6, 0x3, 0x0, 0x2ab, 0x4, 0x7, 0x4, 0x3c5b, 0x4, 0xb, 0x9, 0x1, 0x1f461e2c, 0x7, 0xe661, 0x7fff, 0xb, 0x3, 0x7fff, 0x4c74, 0x80000000, 0x800242, 0xffffffff, 0xe, 0x0, 0x71, 0x2, 0x6, 0x3, 0x50, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x3, 0x80092a3, 0x4, 0x0, 0x20000000, 0x82, 0x0, 0x7, 0x9, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x401, 0x12f, 0x6, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xd, 0x2bf, 0x5, 0x7ff, 0xfffffffc, 0x334000, 0x0, 0x7, 0x5, 0x2f, 0xe, 0x312, 0x1, 0x0, 0xfffffffe, 0x8, 0x4, 0x7ffc, 0x5, 0x3fe, 0x401, 0x6, 0x4, 0xfb, 0x5, 0x8000, 0x5f31, 0xbcf5, 0x1, 0x2, 0x2, 0x9, 0x3000000, 0x9, 0x8, 0x9, 0x6, 0xb, 0xa, 0x1, 0x9, 0x9, 0x2, 0x7f, 0x9, 0x1, 0x3, 0x9, 0xffffffff, 0x7, 0x4, 0x9, 0x48c93690, 0x42, 0x400004], [0x6, 0x6, 0x80000001, 0x2, 0xff, 0x100, 0x2c, 0x9, 0x5, 0x7fff, 0x0, 0x1, 0xb, 0x4, 0x5, 0x1005, 0x0, 0x1f0, 0xfffffffd, 0x2, 0x86, 0x1, 0x1, 0x3e7, 0x9, 0x5, 0x102, 0x2, 0x800, 0x8, 0x5, 0x8001, 0x7, 0x38, 0x800003, 0x200, 0x80, 0x2, 0x3, 0x950bfaf, 0x1000, 0xfffffff6, 0x7, 0x3, 0xfffffff9, 0x6, 0xb8d, 0xbf, 0x10002, 0x403, 0x7ff, 0x3, 0xfffffffc, 0x1, 0xffff, 0x5, 0x6, 0x1c, 0x120000, 0x8001, 0x6, 0xaaed, 0x4, 0xff], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0x1, 0x6, 0x1, 0x0, 0x3, 0x80ce7, 0x1ff, 0x3, 0x7, 0x5, 0x1003, 0x101, 0x10000, 0x6, 0x7fff, 0xffff, 0xe620, 0x2, 0x2, 0x1, 0x4, 0x14c, 0x60a7, 0x6, 0x4, 0xffffffff, 0x80000000, 0x7, 0x8, 0xc8, 0xee1, 0x0, 0xffff, 0x3, 0x7f, 0x100, 0x9602, 0x5, 0x2, 0xffff, 0x6, 0x1, 0x10080, 0x6, 0x8, 0x30b1d693, 0x5a2b, 0xc, 0x7, 0x1, 0x6c1b, 0x5, 0x4, 0x5, 0xb1c, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) (async) r5 = userfaultfd(0x801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x80}) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='blkio.throttle.io_service_bytes_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) (async) ioctl$UFFDIO_COPY(r5, 0xc028aa03, 0x0) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 16.596016975s ago: executing program 3 (id=42): syz_usb_connect$uac2(0x2, 0x87, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x499, 0x104e, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x75, 0x3, 0x1, 0x80, 0xa0, 0xe, {0x8, 0xb, 0x1, 0x1, 0x1, 0xa, 0x20, 0x76}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x0, 0x3, 0x15, 0xde}, [@output_terminal={0xc, 0x24, 0x3, 0xfd, 0x504, 0xa8, 0x4, 0x6, 0x6, 0x22}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x5, 0x4, 0x0, {0x8, 0x25, 0x1, 0x1, 0x9, 0x9, 0x2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x9, 0x4, 0x2, {0x8, 0x25, 0x1, 0x3, 0x3c, 0xa, 0x2}}}}}}}}]}}, 0x0) 15.379496004s ago: executing program 3 (id=46): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/memory/memory0/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='offline', 0x7) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x4c) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r3 = dup(r2) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0700000000000000000005000000180001801400020073797a5f74756e22e89e871811e7d1e57be81583b3f300000000000000000005000700040000007b92cda96e7d2e9892452744d2335743e0f5d0a7fed62f"], 0x34}}, 0x0) ptrace(0x10, r4) wait4(r4, 0x0, 0x8, 0x0) waitid(0x2, r4, &(0x7f0000000300), 0x4, &(0x7f0000000500)) ptrace$poke(0x1, r4, 0x0, 0x180000000000103) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x10800, &(0x7f00000000c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB="2c77c09d08ff6e05000afe62fb920734e76565148d94c8370313ab1d5928adc4e09fb2ccf1ce67018534795863bd8cdfd92d0bbde612ce9601df7b5c3c21b3ae0ff899c1bac0555f238c1e802a19b73f2a9a3433a94ab8af901f62adc2fe4db8484fd8e26d142c0a32f29ffef180563aa4d8f30238b3cf5efee1a073c966fc3d675c98d8c8ce9357c9388ca2d6acf808e0ea2d5e1996705ee3eb40594bf9", @ANYRESHEX=r3, @ANYBLOB=',afid=0x0000000000000003,\x00']) 15.247720277s ago: executing program 3 (id=47): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000340)={0x1, 0x0, [{0x4b564d01, 0x0, 0x200}]}) ioctl$KVM_GET_CLOCK(r1, 0x8030ae7c, &(0x7f0000000000)) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup\x00', 0x450002, 0x181) 3.850581386s ago: executing program 32 (id=32): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000772904202404019957c2010203010902240001000010000904430002317d5500090502020002220000090582020002"], 0x0) syz_usb_connect$cdc_ecm(0x2, 0x5a, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020000102505a1a440000000010109024800010106000009040000ff02020000052406800005240002000d240f010000000000000000000424020009058103200000000a09058202200000000009050302", @ANYRESHEX=0x0], 0x0) (async, rerun: 64) syz_usb_control_io$hid(r0, 0x0, 0x0) (rerun: 64) syz_usb_control_io(r0, 0x0, 0x0) mount(0x0, &(0x7f0000000080)='./cgroup\x00', 0x0, 0x10, 0x0) (async) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r1 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_FLUSH(r1, 0x29, 0xd1, &(0x7f0000000080)=0x2, 0x4) (async) syz_usb_control_io$printer(r0, 0x0, 0x0) (async) syz_usb_control_io$uac2(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000140)={0x20, 0x3, 0x4, "07f23d0a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) 2.122471698s ago: executing program 4 (id=96): ioprio_set$uid(0x3, 0x0, 0x64) (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x0) fsetxattr$system_posix_acl(r0, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f00000002c0)=ANY=[@ANYBLOB="020000000100060000000000040005000000000008000600", @ANYRES32=0x0, @ANYBLOB='\b\x00\x00\x00', @ANYRES32=0xee00, @ANYBLOB="100003000000000020"], 0x34, 0x1) (async) setreuid(0xffffffffffffffff, 0xee01) mknod$loop(&(0x7f0000000540)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x100, 0x1) (async) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000000000407d1ef62c00000000000109022400010000000009040000010300020009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) (async) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xb, 0xa2b9, 0x6, 0x6, 0xe1, 0x6, 0x45f, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0xffffff80, 0x6, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x0, 0x8a, 0x79, 0x2, 0x10080, 0xfffffffe, 0x83f4, 0x129, 0x1, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0x0, 0x81, 0x9, 0xf9a6, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007b, 0xfffbffff, 0x1, 0x2], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0x2, 0xb, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x6, 0x0, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x7, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffff7fff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x3ff], [0x2, 0xfffffffe, 0x9, 0xc, 0x0, 0x2e6bf783, 0x80000001, 0x5, 0x40000005, 0x491, 0x9, 0x200026, 0x7f, 0x403, 0x102, 0x1, 0x41, 0x6, 0xee4e, 0x2000104, 0x1, 0x9, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x100006, 0x2, 0x400, 0xd0c3, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x9, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x3, 0xfffffffa, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x3, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x80000000, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x2, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)=ANY=[@ANYBLOB="38000000020901010000000000000000000000040002000c000480080001407fffffff080088c8b30e31d4"], 0x38}, 0x1, 0x0, 0x0, 0x44800}, 0x4004054) (async) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) sendmsg$IEEE802154_LLSEC_LIST_DEV(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x4000800}, 0x4) (async) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000000)={[0x2000000035, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x5, 0xf2, 0xd, 0x7fffffffffffe, 0xcd3, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$KVM_RUN(r5, 0xae80, 0x0) (async) r6 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r7 = dup(r6) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) (async) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) (async) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) (async) ioctl$KVM_RUN(r8, 0xae80, 0x0) (async) r9 = openat$full(0xffffffffffffff9c, &(0x7f0000000040), 0x80401, 0x0) write$cgroup_subtree(r9, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000400)={0x18, &(0x7f0000000940)=ANY=[@ANYBLOB='\x000\b'], 0x0, 0x0, 0x0, 0x0}, 0x0) (async) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000000)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="200182"], 0x0}) 1.896020614s ago: executing program 0 (id=97): syz_usb_connect(0x3, 0x24, &(0x7f0000000580)=ANY=[@ANYBLOB="12011001a662ca40fd07040034860000000109021200000000007f0904000000ff"], 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) 1.592619631s ago: executing program 4 (id=98): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000300)) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x1c0) mount$incfs(&(0x7f0000000440)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000200), 0x80, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0xc2c02e4d8eb3a414, 0x4) r1 = openat$incfs(r0, &(0x7f0000000280)='.pending_reads\x00', 0x1, 0x130) ioctl$TIOCL_GETKMSGREDIRECT(r1, 0x40106726, 0x0) 1.559240382s ago: executing program 4 (id=99): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text16={0x10, &(0x7f00000000c0)="f2af660f3566b9800000c00f326635001000000f30660f38811f660ff159000f20d86635080000000f22d866b9800000c00f326635008000000f30d93465362e2e3e0f10d3640f01c3", 0x49}], 0x1, 0x3c, 0x0, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000040)=0x1000) (async) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNSETSNDBUF(r3, 0x400454d4, &(0x7f00000000c0)) r4 = add_key(0x0, 0x0, &(0x7f0000000200)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f86fde300a06082a8648ce3d040302303a3138303606035504030c2f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793020170d3234303431333232313632365a180f32313234303332303232313632365a303a3138303606035504030c2f43657274696669636174652076657269666963617428a2e0861e1ae90d412073656c662d74657374696e67206b65793059301306072a8648ce3d020106082a8648ce3d0a01070342000407e56b51affc19412c88926b775771039ee2fe6e6a714ec7299f90e177189fc2e70a82d08ae181a9717c5a73fb25b95b1e248c739ff838f848b4ad1619c022c64e00305b301d0603551d0e041604142900bcea1deb7bc8479a84a23d758efdfdd2b2d3301f0603551d230418301680142900bcea1deb7bc8479a84a23d758efdfdd2b2d3300c0603551d130101", 0x171, 0xfffffffffffffffd) (async, rerun: 32) r5 = socket$igmp(0x2, 0x3, 0x2) (rerun: 32) setsockopt$inet_MCAST_JOIN_GROUP(r5, 0x0, 0x2a, &(0x7f0000000380)={0x2, {{0x2, 0x4e21, @multicast2}}}, 0x88) (async, rerun: 64) memfd_create(&(0x7f0000000080)='/dev/kvm\x00', 0x9) (async, rerun: 64) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x1d, 0x2, 0x4, '\x00', 0x4}) ioctl$KVM_SMI(r2, 0xaeb7) setgroups(0x0, 0x0) (async) getgroups(0x1, &(0x7f0000000080)=[0xee00]) (async) r7 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) flock(r7, 0x2) (async) keyctl$KEYCTL_WATCH_KEY(0x20, r4, r7, 0xe1) (async, rerun: 32) setregid(r6, r6) (async, rerun: 32) fchmodat(0xffffffffffffff9c, &(0x7f0000000300)='.\x00', 0xa2) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.291910588s ago: executing program 4 (id=100): prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffb000/0x4000)=nil, 0x4000, &(0x7f0000000080)) syz_usb_connect(0x3, 0x24, &(0x7f0000000580)=ANY=[@ANYBLOB="12011001a662ca40fd07040034860000000109021200000000007f0904000000ff"], 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ff9000/0x7000)=nil, 0x7000, &(0x7f0000000000)='\x00\x00\xad\xddP\x04Do\x90\x986\xc7\"K3\xaf\xf3\xe7\xf7Dm\xebD\x04\xf9A\x86_\x8d\x93\xe2\x13\xbf\xc5\xc7c\xe3\xf9(\xfe\x8a\x1c\xa8\x15\xf6\x81\xf6\xfcAM\x86\xc1\xb1\xdaJoI\xef\xf0\xe6U\xc2\r!\x16\xda\x16Y\xc0\x13\xba\xacX\a9@\x00\xac\xd0\xf1\xb3\xa8\xa7\x86h3|\x03\x95@\xebM\xa6i\xb3S\x84\xa0yum\xcbZ$8\xd2e\x19\xdb\xeb\xf3\x1eK\x1a\xad\xc4w\xe5\xcd&f\x9e\xc4') madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x10, 0x5ac, 0x23f, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x10, 0x20, 0x86, "", [{{0x9, 0x4, 0x0, 0xa6, 0x1, 0x3, 0x1, 0x1, 0x6c, {0x9, 0x21, 0xb4af, 0x54, 0x1, {0x22, 0x903}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x2, 0x4, 0x80}}}}}]}}]}}, &(0x7f0000000580)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x200, 0x40, 0x9, 0xe8, 0x8}, 0xeb, &(0x7f0000000140)={0x5, 0xf, 0xeb, 0x5, [@ptm_cap={0x3}, @ext_cap={0x7, 0x10, 0x2, 0x2, 0x5, 0x8, 0x8000}, @ext_cap={0x7, 0x10, 0x2, 0x10, 0x6, 0xf, 0x9}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x9, 0x1, 0xff, 0x7}, @generic={0xcb, 0x10, 0x1, "d97a0a422e916880f270bec68cce725db37fee72fdb099e1b13e4d24d4352c46676265768d73601bfde8f53ec81d69f2dad7755e85b4ede04855f3f540634d0e8ccbc313919c89036ab547cbf27a98e80eca0f01c73e090c6051c7d76606c97880ad77cdba97f9c675108804a0ba224dbdc86b1b6a49e99df71c22c3c20ff41e638c58e254618b76c90610a628a33f7b47277f15170a549242fc8dfa53de522b38279b5f488682272ef15c2885fe363053e2989b9e21ad7da72e794127e194c1e44f4d44790306d7"}]}, 0xa, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x1007}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x801}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x1409}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x404}}, {0xa, &(0x7f0000000340)=@string={0xa, 0x3, "d1e206cbc0e6f74e"}}, {0x63, &(0x7f0000000380)=ANY=[@ANYBLOB="63037bed9f26e41bb79083977d9ef8d771b3b647c9f6668cfc0d0427013da22ea1ffa72a52eefb7651908d3c12247e865d0bf92364506cde9a8115829499865976ca40b49790dd99777fcc95b69ca9c291556ec360e7d559760a78963c19df6e08b03e"]}, {0x9f, &(0x7f0000000400)=@string={0x9f, 0x3, "538fd3511a11c315831aaf1ebbc34f7b25af929307b74192b92d6543e602e60115310a06aeb17d6ce6d8be5512ce09d0b27e8f24a3194e9aeafe91a5bacbf0bffa3efa1a52da01e9b6d84b72462f611b375907acad40e749a08359330f0ba280ff6675d942dc566cc13d5c5aa9593ca213fee75de5bfab3bed325fe5bfb93fb087991606debc923c34b613ae6b1d35ec52f6ad4d1695488f50223f58e6"}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x11ab3acd14b01ec7}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x42b}}, {0x4, &(0x7f0000000540)=@lang_id={0x4, 0x3, 0x812}}]}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="00222200000096010006010083000000002a90a027b3ff82e875988b147043022effffb3"], 0x0}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) 1.126223453s ago: executing program 2 (id=101): socket(0x80000000000000a, 0x2, 0x0) socket$inet6(0xa, 0x800000000000002, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000200)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x19}}, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='veth0_macvtap\x00', 0x10) r1 = fcntl$dupfd(r0, 0x0, r0) sendmsg$TIPC_NL_NAME_TABLE_GET(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x4001) sendmsg$NFT_BATCH(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000640)={0x0, 0x28}, 0x1, 0x0, 0x0, 0x240088c8}, 0x4000000) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)=ANY=[], 0x7c70}, 0x1, 0x0, 0x0, 0x90}, 0x8080) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 1.089705573s ago: executing program 2 (id=102): syz_ublk_setup_io_uring(0x20, 0x0, 0x0, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x3, {0x41}}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r1, 0x0, 0x0) r2 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r2, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x1, {0x42}}, 0x10) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000010)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000020)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000030)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000050)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000060)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000070)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000090)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000a0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000b0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000c0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000d0)) r3 = socket$nl_sock_diag(0x10, 0x3, 0x4) write(r3, &(0x7f0000000200)="580000001400010300000000000000001e000000ffffffff00000000000000000000000000000000000000000000000000000000000000000200"/88, 0x58) 995.882046ms ago: executing program 2 (id=103): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x143802, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x3ac9, &(0x7f0000000080)={0x0, 0x127c, 0x0, 0x6, 0x2e8}, &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) getsockopt$packet_int(r2, 0x107, 0xb, &(0x7f0000000040), &(0x7f0000000000)=0x4) mmap(&(0x7f0000232000/0x4000)=nil, 0x4000, 0xb, 0x13, r0, 0xb522f000) mlock(&(0x7f0000ffe000/0x2000)=nil, 0x2000) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x3}, 0x1c) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000000380)=0x10, 0x1c) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[], 0x56c}, 0x1, 0x0, 0x0, 0x4855}, 0x8811) shutdown(0xffffffffffffffff, 0x1) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_INTERFACE(r4, 0x0, 0x4) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) clock_gettime(0x6, &(0x7f0000004100)) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_STATION(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="28000000689d234ab3aa8c893802e1e3428a971873e9af17278c76ac069a552995df70da262e0bb1b1b694fa6ec65f71a90e24a05d6716f89f504983", @ANYRES16=r6, @ANYRES16=r1, @ANYRES64=r5, @ANYRESOCT=r8], 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x14014) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(r10, 0x26, &(0x7f0000000140)={0x1}) dup3(0xffffffffffffffff, r9, 0x0) fcntl$lock(r10, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x3}) fcntl$lock(r10, 0x26, &(0x7f0000000180)) sendmsg$NL80211_CMD_GET_SCAN(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x28, r5, 0x205, 0x70bd28, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r8}, @val={0xc, 0x99, {0x2, 0x7d}}}}, ["", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x20040804}, 0x40000) madvise(&(0x7f00002a0000/0x4000)=nil, 0x4000, 0x16) 962.716006ms ago: executing program 2 (id=104): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, 0x0}) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r3, 0x4068aea3, &(0x7f0000005000)={0xa3, 0x0, 0x0}) ioctl$KVM_SET_NESTED_STATE(r3, 0x4080aebf, &(0x7f0000007000)=@vmx={0x10d, 0x0, 0x2080, {0x1002000, 0xffffffffffffffff}, {"d07ee51100", "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200"}}) 879.771288ms ago: executing program 2 (id=105): r0 = syz_kvm_add_vcpu$x86(0x0, &(0x7f00000007c0)={0x0, &(0x7f0000000440)=[@nested_amd_inject_event={0x180, 0x38, {0x2, 0x5d, 0x4, 0xff, 0x1}}, @nested_amd_inject_event={0x180, 0x38, {0x0, 0x48, 0x6, 0x200, 0x3}}, @nested_load_syzos={0x136, 0x88, {0x1, 0x80, [@nested_vmresume={0x130, 0x18}, @enable_nested={0x12c, 0x18}, @cpuid={0x64, 0x18, {0xc1, 0x10000}}, @set_irq_handler={0xc8, 0x20, {0xd2, 0x2}}]}}, @nested_amd_clgi={0x17f, 0x10}, @nested_create_vm={0x12d, 0x18, 0x2}, @wr_crn={0x67, 0x20, {0x2, 0x8}}, @rdmsr={0x66, 0x18, {0xad7}}, @nested_amd_clgi={0x17f, 0x10}, @code={0xa, 0x79, {"660ff682e90000000f78e536470f23214181c6bcde58e136d38c7b3c000000b8010000000f01d9c7442400c9000000c744240201000000ff1c24c744240073dbbf38c744240238000000c7442406000000000f011c24460f0093efcce74bc4427958acc5f77b96ab"}}, @nested_amd_vmsave={0x183, 0x18, 0x1}, @nested_load_syzos={0x136, 0x38, {0x3, 0x899, [@nested_vmlaunch={0x12f, 0x18, 0x2}]}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x1, @ro64=0x2400, 0x8, 0x4, 0x9}}, @out_dx={0x6a, 0x28, {0xfe5d, 0x5, 0x3}}, @enable_nested={0x12c, 0x18}, @code={0xa, 0x50, {"f2abc4c29592040e67420fc79d8f8700000f01c8c4e29590346c660f38804f1166ba4300b066eec442fd202cd7b9800000c00f3235004000000f303e80d986"}}, @nested_amd_invlpga={0x17d, 0x20, {0xa000, 0xffdc}}, @nested_amd_vmload={0x182, 0x18, 0x1}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x0, @save_area=0x457, 0x5, 0x7}}], 0x369}) ioctl$KVM_RUN(r0, 0xae80, 0x0) mmap$KVM_VCPU(&(0x7f0000eb3000/0x1000)=nil, 0x930, 0x0, 0x20031, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000f0f000/0x2000)=nil, 0x2000) munmap(&(0x7f0000f2a000/0x2000)=nil, 0x2000) munmap(&(0x7f00004a0000/0x2000)=nil, 0x2000) munmap(&(0x7f000075a000/0xb000)=nil, 0xb000) munmap(&(0x7f0000482000/0x2000)=nil, 0x2000) munmap(&(0x7f00004ff000/0x1000)=nil, 0x1000) munmap(&(0x7f0000e76000/0x12000)=nil, 0x12000) mmap$KVM_VCPU(&(0x7f0000ffc000/0x2000)=nil, 0x930, 0x0, 0x24132, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000f1a000/0x4000)=nil, 0x930, 0x0, 0x9032, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000fed000/0x3000)=nil, 0x930, 0x0, 0x4030031, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000e8b000/0x4000)=nil, 0x4000) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x1e}, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x20}, {0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x4, 0x2}, {0x0, 0x0, 0xfffffffffffffff7, 0x4}, 0x0, 0x6e6bb9, 0x1}, {{@in=@broadcast, 0xfffffffc, 0x6c}, 0x0, @in=@empty, 0x2000000, 0x0, 0x2, 0x7, 0x200}}, 0xe8) sendmmsg(r2, &(0x7f0000000480), 0x2e9, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[@ANYBLOB="f8000000160033060000000000000080ff0100000000000000000000000000017f00000100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffffff000000000000000000000000000004d23200000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000ffffffffffffffff00000000000000000500000000c537a36fae5b62cc1f70c7b20edd2d7600000004000000020000000000000006000000020000000a0004181900000000000000"], 0xf8}}, 0x0) 767.901851ms ago: executing program 2 (id=106): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x28}, 0x1, 0x0, 0x0, 0x40000c0}, 0x80) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) utime(0x0, 0x0) mmap(&(0x7f0000ff4000/0xc000)=nil, 0xc000, 0x2000000, 0x20031, 0xffffffffffffffff, 0x2000) remap_file_pages(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x9, 0x10000) write(0xffffffffffffffff, &(0x7f0000000000)="fc0000001c000705ab092509b86813000aab080102000000b85b0e93210001c0f0060848050000010000000000039815fa2c53c28648000000b937799f377a00bc000c00f0036cdf0d", 0x49) syz_usb_connect(0x0, 0x63, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404c17aa5500010102030109025100010100c03209040000020806500007050102000200070582020002000904000104080662000705010200020003"], 0x0) r2 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000040)=0xe, 0x80c00) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@dev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@remote}}, &(0x7f0000000300)=0xe8) r4 = syz_open_dev$loop(&(0x7f0000000180), 0xae, 0x40) ioctl$LOOP_CHANGE_FD(r4, 0x4c06, r0) chown(&(0x7f00000001c0)='./mnt\x00', r3, 0xee00) ioctl$FS_IOC_GETFSSYSFSPATH(r2, 0x80811501, &(0x7f0000000080)={0x80}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_int(r6, 0x11, 0x65, &(0x7f0000002b40)=0x9, 0x4) r7 = dup(r5) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @multicast}) write$tun(r0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0a0090000180c200000300000000000086dd694fd2cd02303afffe8000000000000000000000000000bbff0200000000000000000000000000018406000000000000071000000000021009008100000000000000c20400000008c20400000009c910fe80000000000000000000000000003b290100000000000005020ada050200077304021000000000ff020000000000000000000000000001fc020000000000000000000000000001000e04070028050000000000000000000000ffffac1e010100000000000000000000000000000001fc0000000000000000000000000000010000000000000000000000000000000000000000000000000000fffffffffffffc020000000000000000000000000000fe8800000000000000000000000001012e210000000000000106000000000000c20459c0d6fd0738000000000caaff0f060000000000000003000000000000000900000000000000060000000000000008000000000000000400000000000000c20400000009c204fffffffa0db2d4a8f916137c37a69b4caf7f279df47664a3e8c98d2c572a3ad86a7b024f7e90630b03ec62893f424b94a63b044e9a6103a7c50cfb058303f34c815b9c60e13b1ceb4aae9e9d0a333a07c4781553a562e2b29ba5eb028efd171c9636b5507f47abeae165604eed1a07074ffc1b0cff0e64a442285acd5fd61fb3aa0fbddd04c1a3f735ee394a11a09783fd23663a37f4363a6bbf699e1c27f7f1e243a69a86fd9329ebc4b2f5b4b5b686992db66d539c624d0200907800000500670d98c510002f00fe800000000000000000000000000036fe8000000000000000000000000000390400000000000000"], 0x26a) 753.880931ms ago: executing program 0 (id=107): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000300)) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x1c0) mount$incfs(&(0x7f0000000440)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000200), 0x80, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0xc2c02e4d8eb3a414, 0x4) r1 = openat$incfs(r0, &(0x7f0000000280)='.pending_reads\x00', 0x1, 0x130) ioctl$TIOCL_GETKMSGREDIRECT(r1, 0x40106726, 0x0) 731.198892ms ago: executing program 0 (id=108): r0 = socket$tipc(0x1e, 0x2, 0x0) getrandom(0xfffffffffffffffd, 0x0, 0x3) (async) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) (async) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) write(r1, &(0x7f0000000200)="580000001400010300000000000000001e000000ffffffff00"/88, 0x58) (async) r2 = gettid() timer_create(0x2, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)=0x0) timer_settime(r3, 0x0, &(0x7f00000002c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) clock_nanosleep(0x2, 0x0, &(0x7f0000000040)={0x0, 0x989680}, 0x0) (async) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) (async) setsockopt$TIPC_DEST_DROPPABLE(r0, 0x10f, 0x81, &(0x7f0000000000)=0x3, 0x4) (async) openat(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup/../file0\x00', 0x480c2, 0x0) (async) clock_getres(0x0, &(0x7f0000000080)) 616.943655ms ago: executing program 0 (id=109): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e21, 0x659, @empty, 0xff}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00') r2 = openat$cgroup_int(r1, &(0x7f0000000080)='io.max\x00', 0x2, 0x0) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000280), 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff) r3 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_mtu(r3, 0x29, 0x17, &(0x7f0000002480)=0x5, 0x4) sendto$inet6(r3, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x0, @mcast2}, 0x1c) sendto$inet6(r3, &(0x7f00000024c0)="6e832595ff6471618c2f6df7c4e7cddec61e561ec1ba5224f09414b33bc1a8e5ab11aee8219b14b2552ed855bb70b7d201933081e8bb1337088d23d544d99cf89f9dd9691d976ae78fe769c62de701aac318651dc239655b06d3a33b294ee5758385c2c3c59eadfb068581ccecda0bb65b95a5c970274d3804f00c218d63fb7bef144a0673521e5e25462a44a55d50ea6bdc8a23d5d6a4a7e19fc5e781aeea8642f09f8ccfee557406e3e57b2102aed24903249723a64f11a79da1077be3ec7585ac7e3165b329966c285820009d7bfa22c96f5b11bb9d9f7c9cb65a2ec4a3c1f36b4b5fcb509032d7995797bcb3d6ab7c91e835e6ff03a5e91c832308af1de71374516dc3479acc480507692d97e53990ff349e4ee50f0577d7a5423545231a6c1f860035ecaef34c88ef584eabb4a73fba67761dbb35541a596ef8b6b3afa07a07264c5bac67c4bd4de52459f447103752ee7d7016f41d15c2084cbf116de8f963674000845a01d75a478504937d640a0b3416977cc95d78f346c9cce35cb0ace790b99e22ab8a66d4b75b32aa858d1be4f64792d41579ca4a507fdbc5bc2f9709c2ffdf1eecba3bb66297e76a2de65bebd48d59ab4e8524a8ec25236a61be04a54fc5740a8e9bd7a685757d0fa21a21153c406a28ae928e7ab475c993f3fe1529c1b91ab2d6ab9c4a44220ecf1e23e37c7e37402557114cc4ea5534baebc810617fc2fd0b005388691bdc55d8abee93309be74e81d229ea5fc5c2e69ec53fbe1279a6e9c237d277e0a9fb7dd4c5851f7b1a11a2808bb016f51e65d7d2b6f2a0166345f2d5c4b2aed08ec4b921a8115c445b7d5db56309fcab6f2505559bb6935de8eee2e278804c83b9cc338cef33074f8129fa52a94b95eb0d8347ac792975b9f356b2ac2e1f8c5149023a83b55e43dc687975b15ab41889aafc34cea3252af54e13defdbca46034117e66dd708048fd2784384579f28edff28be5ccdfb16c1daf992c06a7540aa675d9ff2f21bc54aa6fbfedc142928be3c813d9798a922e6b1caf938986d3d9b8bf59d2197d5edba04c978fbf5ab74a6131c5d1f856601482084e2595995df532400c57e38c34cb35f9a3684d1da7f1297196bf414d309a1261019a77173e51437fc65f6198e8082d6e8b618761b46e2d3bd7c02096b9f06adae66233b362496d8ddb18ad7e3383894c4944f67baece32f39673d708bb86aeb21ec4f781ac0f04159dbceb8e2bb5c7fb36d4f1e7ef57f1c5ef1257a75b528e50b716a846f5d385445c2efc54b8e4dd2f1111e8014978fa49ffb5ea2330666a29c425dd761702feae04f07cdfdb771973be2ad31ad1666980d08fd4c669e3af3d27099246514cd565f61f6330eabca1344716f6641f48516f41bc5cdfcda4e4640de1994ba867433efbbd5f06a67625b3af84a802511e29389b1f8f4915689d9f2cb57c7a966eadf8192fffdfb14ce81061f9741abe05e1576377b9a191da1afa6dadf6e8f44e769feea5625c6e46d652cc29490aa6b905b84959525fae12cae7893e3732fefeb25049a7df4479356fa21b0bb945ff2734c3c19504768e94034c4a5545490318ea0e486f1ec59beb2295009f96206c0bd5c6fb3b822a4d3e2f6de5f80bc35fd000ed42c3d7ddc6d76da0f237a1585ceaf2ea1b2ee4eef4cf472222e6d69ab01907be03205efb8074c1e8867989e673c37223b4598b337238600755a0a35367542036b45c7f07ceb964d83879b2dddc3c5a58aca3988da6a3aff7e7f34415f0719153aac572ba23aa0d5dd9bf3c4e6432114073ca6184319cc43991ac404d63852fa79f788f1091128f21d7722f6e09756139dee50fb04bcffc823d68a0c825647aba56929875f53c49d9e82eef8974d8178a796830f48bda6386e556b01de35f795f8b63d6b13a4e5e61764998ef7d5f30782242fd4058fc3ebdc8b1a5163a3168401ba5213941c48ea6b59872ec3a2d8981cd8abc4f5fad4d233078b7d571af8b9b255dd46a337bacbacf6c5ac0318d0bd8ae635991cd31b2530226eb04a2c977cd03c9", 0x5ad, 0x44, 0x0, 0x0) mount(0x0, &(0x7f0000000440)='./dev\x00', &(0x7f0000000480)='devtmpfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r4, 0xc138fd03, 0x0) write$cgroup_int(r2, &(0x7f0000000240)=0x5, 0x12) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) setresuid(0xee01, r5, r5) quotactl$Q_QUOTAOFF(0xffffffff80000300, &(0x7f0000000040)=@rnullb, r5, 0x0) ioctl$MON_IOCG_STATS(r1, 0x80089203, &(0x7f0000000200)) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r6, 0x40046208, 0x0) ioctl(r4, 0xc178fd0b, &(0x7f0000000138)="0400000000000000000000007801000038010000010000000000000000000000000000000000000000000000000000006361") 597.364495ms ago: executing program 0 (id=110): socket(0x80000000000000a, 0x2, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000200)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x19}}, 0x6}, 0x1c) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='veth0_macvtap\x00', 0x10) r2 = fcntl$dupfd(r1, 0x0, r1) sendmsg$TIPC_NL_NAME_TABLE_GET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x4001) sendmsg$NFT_BATCH(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000640)={0x0, 0x28}, 0x1, 0x0, 0x0, 0x240088c8}, 0x4000000) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, 0x0, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)=ANY=[], 0x7c70}, 0x1, 0x0, 0x0, 0x90}, 0x8080) close_range(r0, 0xffffffffffffffff, 0x0) 542.229257ms ago: executing program 0 (id=111): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000200)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x19}}, 0x6}, 0x1c) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/net/ipv4/conf/all/rp_filter\x00', 0x1, 0x0) write$cgroup_pid(r1, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='veth0_macvtap\x00', 0x10) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='veth0_macvtap\x00', 0x10) r2 = fcntl$dupfd(r0, 0x0, r0) sendmsg$TIPC_NL_NAME_TABLE_GET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x4001) (async) sendmsg$TIPC_NL_NAME_TABLE_GET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x4001) syz_genetlink_get_family_id$ipvs(&(0x7f0000000340), r2) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, 0x0, 0x0) (async) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, 0x0, 0x0) sendmsg$TIPC_NL_NAME_TABLE_GET(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000400)={0x14, 0x0, 0x8, 0x70bd2a, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x4090) (async) sendmsg$TIPC_NL_NAME_TABLE_GET(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000400)={0x14, 0x0, 0x8, 0x70bd2a, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x4090) 15.98867ms ago: executing program 4 (id=112): syz_ublk_setup_io_uring(0x20, 0x0, 0x0, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x3, {0x41}}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r1, 0x0, 0x0) r2 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r2, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x1, {0x42}}, 0x10) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000010)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000020)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000030)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000050)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000060)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000070)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000090)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000a0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000b0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000c0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000d0)) r3 = socket$nl_sock_diag(0x10, 0x3, 0x4) write(r3, &(0x7f0000000200)="580000001400010300000000000000001e000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000100"/88, 0x58) 15.74325ms ago: executing program 33 (id=47): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000340)={0x1, 0x0, [{0x4b564d01, 0x0, 0x200}]}) ioctl$KVM_GET_CLOCK(r1, 0x8030ae7c, &(0x7f0000000000)) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup\x00', 0x450002, 0x181) 0s ago: executing program 4 (id=114): r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r1 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2) ftruncate(r1, 0x1000006) fcntl$addseals(r1, 0x409, 0x7) r2 = ioctl$UDMABUF_CREATE(r0, 0x40187542, &(0x7f00000001c0)={r1, 0x0, 0x0, 0x1000000}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) close(r2) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1\x00', 0x0) r3 = syz_open_dev$usbfs(&(0x7f00000000c0), 0xe, 0x1010c2) ioctl$USBDEVFS_GETDRIVER(r3, 0x41045508, &(0x7f0000000340)={0x2, "cbdd1ef521a80f92c6feb3ac52a98df988dcb13d4d9228c540a905ab6e1888c8e20cb4f9171dcfbe4e4e0ced31f3e73921f922d684610939f698073bfc65fa342eb155870be48981e03b2717e1d4aa2ab19a1f3f54ec9e0cbde7b7b2a8f3df9c735b4ae939776e846f45f1543cc658ae1c8d5e71b2520a179cc6271d215a55fc6a148a8cffb7b36b499c1a151a42084100e0ae7ce65c3ee3dda4ca5f7f68e70ec5fbebb554cfda393ef355aea6a0628620e3cdf1fa05645112b3b2723e22784cf5a630f939c0f2d288385310e379ced45938bf19e6a7c97c0041066eb7fd9bcda56ae7863e79cbec93e64ab41985b0753cfa8b5cadddd51ec013c48473dfe496"}) openat2(0xffffffffffffff9c, &(0x7f0000000040)='./config/usb_gadget/g1\x00', &(0x7f0000000080)={0x0, 0x0, 0x20}, 0x18) rmdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00') kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.165' (ED25519) to the list of known hosts. [ 30.145912][ T36] audit: type=1400 audit(1788070234.350:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 30.150633][ T286] cgroup: Unknown subsys name 'net' [ 30.168808][ T36] audit: type=1400 audit(1788070234.350:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 30.196358][ T286] cgroup: Unknown subsys name 'devices' [ 30.196919][ T36] audit: type=1400 audit(1788070234.380:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 30.316385][ T286] cgroup: Unknown subsys name 'hugetlb' [ 30.322033][ T286] cgroup: Unknown subsys name 'rlimit' [ 30.427258][ T36] audit: type=1400 audit(1788070234.630:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 30.450637][ T36] audit: type=1400 audit(1788070234.630:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 30.475476][ T36] audit: type=1400 audit(1788070234.630:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 30.500610][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 30.509430][ T36] audit: type=1400 audit(1788070234.710:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.534950][ T36] audit: type=1400 audit(1788070234.710:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.570016][ T36] audit: type=1400 audit(1788070234.770:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.595760][ T36] audit: type=1400 audit(1788070234.770:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.596371][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 31.357008][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.365253][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.372371][ T293] bridge_slave_0: entered allmulticast mode [ 31.378785][ T293] bridge_slave_0: entered promiscuous mode [ 31.385414][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.392476][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.399638][ T293] bridge_slave_1: entered allmulticast mode [ 31.405949][ T293] bridge_slave_1: entered promiscuous mode [ 31.549831][ T299] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.557037][ T299] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.564164][ T299] bridge_slave_0: entered allmulticast mode [ 31.570461][ T299] bridge_slave_0: entered promiscuous mode [ 31.578753][ T299] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.585861][ T299] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.592931][ T299] bridge_slave_1: entered allmulticast mode [ 31.599350][ T299] bridge_slave_1: entered promiscuous mode [ 31.611254][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.618489][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.625596][ T296] bridge_slave_0: entered allmulticast mode [ 31.631867][ T296] bridge_slave_0: entered promiscuous mode [ 31.648793][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.655907][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.662967][ T296] bridge_slave_1: entered allmulticast mode [ 31.669347][ T296] bridge_slave_1: entered promiscuous mode [ 31.683078][ T298] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.690309][ T298] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.697406][ T298] bridge_slave_0: entered allmulticast mode [ 31.703640][ T298] bridge_slave_0: entered promiscuous mode [ 31.713072][ T298] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.720195][ T298] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.727346][ T298] bridge_slave_1: entered allmulticast mode [ 31.733680][ T298] bridge_slave_1: entered promiscuous mode [ 31.778493][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.785602][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.792934][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.800023][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.894425][ T299] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.901746][ T299] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.909073][ T299] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.916124][ T299] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.927311][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.934405][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.941674][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.948743][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.970278][ T298] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.977383][ T298] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.984722][ T298] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.991769][ T298] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.013326][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.020665][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.028993][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.036505][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.043946][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.051258][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.058815][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.066193][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.086774][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.093866][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.101570][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.108666][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.134501][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.141591][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.150805][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.157891][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.168973][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.176061][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.185828][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.192888][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.218282][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.225463][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.248176][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.255287][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.270979][ T299] veth0_vlan: entered promiscuous mode [ 32.304432][ T293] veth0_vlan: entered promiscuous mode [ 32.313264][ T299] veth1_macvtap: entered promiscuous mode [ 32.320887][ T298] veth0_vlan: entered promiscuous mode [ 32.352718][ T293] veth1_macvtap: entered promiscuous mode [ 32.359896][ T296] veth0_vlan: entered promiscuous mode [ 32.370961][ T298] veth1_macvtap: entered promiscuous mode [ 32.402989][ T299] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 32.424608][ T296] veth1_macvtap: entered promiscuous mode [ 32.487620][ T317] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 32.520718][ T317] usb usb8: usbfs: process 317 (syz.3.4) did not claim interface 0 before use [ 32.530522][ T317] ======================================================= [ 32.530522][ T317] WARNING: The mand mount option has been deprecated and [ 32.530522][ T317] and is ignored by this kernel. Remove the mand [ 32.530522][ T317] option from the mount to silence this warning. [ 32.530522][ T317] ======================================================= [ 32.571647][ T321] zero sized request [ 32.577463][ T329] netlink: 'syz.0.1': attribute type 5 has an invalid length. [ 32.585728][ T329] netlink: 3657 bytes leftover after parsing attributes in process `syz.0.1'. [ 32.595825][ T317] overlay: ./file0 is not a directory [ 32.661796][ T340] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 32.785978][ T359] netlink: 76 bytes leftover after parsing attributes in process `syz.2.14'. [ 32.795082][ T359] netlink: 12 bytes leftover after parsing attributes in process `syz.2.14'. [ 32.804557][ T359] netlink: 16 bytes leftover after parsing attributes in process `syz.2.14'. [ 32.864327][ T10] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 32.884241][ T62] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 32.955818][ T31] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 33.014058][ T10] usb 4-1: device descriptor read/64, error -71 [ 33.020401][ T62] usb 1-1: device descriptor read/64, error -71 [ 33.115197][ T31] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 33.127114][ T31] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 33.139899][ T31] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 33.149429][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.157742][ T31] usb 2-1: Product: syz [ 33.162143][ T31] usb 2-1: Manufacturer: syz [ 33.167161][ T31] usb 2-1: SerialNumber: syz [ 33.263909][ T10] usb 4-1: device descriptor read/64, error -71 [ 33.273919][ T62] usb 1-1: device descriptor read/64, error -71 [ 33.378388][ T31] usb 2-1: 0:2 : does not exist [ 33.386524][ T31] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 33.403659][ T31] usb 2-1: USB disconnect, device number 2 [ 33.429612][ T313] udevd[313]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 33.503931][ T10] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 33.513995][ T62] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 33.644015][ T10] usb 4-1: device descriptor read/64, error -71 [ 33.653937][ T62] usb 1-1: device descriptor read/64, error -71 [ 33.893974][ T10] usb 4-1: device descriptor read/64, error -71 [ 33.900711][ T62] usb 1-1: device descriptor read/64, error -71 [ 34.003969][ T10] usb usb4-port1: attempt power cycle [ 34.014006][ T62] usb usb1-port1: attempt power cycle [ 34.234040][ T336] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 34.283940][ T31] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 34.343991][ T10] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 34.353940][ T62] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 34.365129][ T10] usb 4-1: device descriptor read/8, error -71 [ 34.375117][ T62] usb 1-1: device descriptor read/8, error -71 [ 34.384974][ T336] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 34.398138][ T336] usb 2-1: New USB device found, idVendor=0458, idProduct=5005, bcdDevice= 0.00 [ 34.407911][ T336] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.417270][ T336] usb 2-1: config 0 descriptor?? [ 34.443983][ T31] usb 3-1: Using ep0 maxpacket: 8 [ 34.450310][ T31] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 34.460532][ T31] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 34.469485][ T31] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 34.484069][ T31] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 34.494130][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.495436][ T10] usb 4-1: device descriptor read/8, error -71 [ 34.502163][ T31] usb 3-1: Product: syz [ 34.502183][ T31] usb 3-1: Manufacturer: syz [ 34.502201][ T31] usb 3-1: SerialNumber: syz [ 34.511731][ T62] usb 1-1: device descriptor read/8, error -71 [ 34.517240][ T31] cdc_ncm 3-1:1.0: skipping garbage [ 34.533273][ T31] cdc_ncm 3-1:1.0: CDC Union missing and no IAD found [ 34.540150][ T31] cdc_ncm 3-1:1.0: bind() failure [ 34.628662][ T336] input: HID 0458:5005 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0458:5005.0001/input/input4 [ 34.642026][ T336] input: HID 0458:5005 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0458:5005.0001/input/input5 [ 34.659600][ T336] kye 0003:0458:5005.0001: input,hiddev96,hidraw0: USB HID v7f.fd Device [HID 0458:5005] on usb-dummy_hcd.1-1/input0 [ 34.743955][ T10] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 34.763964][ T62] usb 1-1: new full-speed USB device number 5 using dummy_hcd [ 34.772781][ T10] usb 4-1: device descriptor read/8, error -71 [ 34.784973][ T62] usb 1-1: device descriptor read/8, error -71 [ 34.905080][ T10] usb 4-1: device descriptor read/8, error -71 [ 34.915038][ T62] usb 1-1: device descriptor read/8, error -71 [ 35.014083][ T10] usb usb4-port1: unable to enumerate USB device [ 35.023990][ T62] usb usb1-port1: unable to enumerate USB device [ 35.489266][ T36] kauditd_printk_skb: 84 callbacks suppressed [ 35.489286][ T36] audit: type=1400 audit(1788070239.690:158): avc: denied { unmount } for pid=298 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 35.575927][ T36] audit: type=1400 audit(1788070239.780:159): avc: denied { read } for pid=452 comm="syz.3.21" name="rtc0" dev="devtmpfs" ino=195 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 35.623901][ T36] audit: type=1400 audit(1788070239.780:160): avc: denied { open } for pid=452 comm="syz.3.21" path="/dev/rtc0" dev="devtmpfs" ino=195 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 35.653964][ T36] audit: type=1400 audit(1788070239.780:161): avc: denied { ioctl } for pid=452 comm="syz.3.21" path="/dev/rtc0" dev="devtmpfs" ino=195 ioctlcmd=0x7013 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 35.988937][ T36] audit: type=1400 audit(1788070240.190:162): avc: denied { create } for pid=458 comm="syz.3.23" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 36.013110][ T459] netlink: 'syz.3.23': attribute type 5 has an invalid length. [ 36.013990][ T36] audit: type=1400 audit(1788070240.190:163): avc: denied { bind } for pid=458 comm="syz.3.23" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 36.040944][ T36] audit: type=1400 audit(1788070240.210:164): avc: denied { setopt } for pid=458 comm="syz.3.23" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 36.063921][ T10] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 36.193912][ T10] usb 1-1: device descriptor read/64, error -71 [ 36.443972][ T10] usb 1-1: device descriptor read/64, error -71 [ 36.539892][ T461] veth0_to_batadv: mtu greater than device maximum [ 36.620424][ T465] Zero length message leads to an empty skb [ 36.641696][ T36] audit: type=1400 audit(1788070240.840:165): avc: denied { mounton } for pid=466 comm="syz.3.27" path="/syzcgroup/unified/syz3" dev="cgroup2" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 36.641700][ T467] tmpfs: Unknown parameter 'nMnŻodes' [ 36.683934][ T10] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 36.696201][ T36] audit: type=1400 audit(1788070240.900:166): avc: denied { ioctl } for pid=468 comm="syz.3.28" path="socket:[4437]" dev="sockfs" ino=4437 ioctlcmd=0x89f3 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 36.720868][ T36] audit: type=1400 audit(1788070240.900:167): avc: denied { bind } for pid=468 comm="syz.3.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 36.813923][ T10] usb 1-1: device descriptor read/64, error -71 [ 37.011022][ T440] usb 2-1: USB disconnect, device number 3 [ 37.048480][ T336] usb 3-1: USB disconnect, device number 2 [ 37.056053][ T10] usb 1-1: device descriptor read/64, error -71 [ 37.068101][ T479] rust_binder: Write failure EFAULT in pid:29 [ 37.070538][ T477] rust_binder: Write failure EFAULT in pid:29 [ 37.174009][ T10] usb usb1-port1: attempt power cycle [ 37.524323][ T10] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 37.555193][ T10] usb 1-1: device descriptor read/8, error -71 [ 37.694970][ T10] usb 1-1: device descriptor read/8, error -71 [ 37.934039][ T10] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 37.942467][ T490] devpts: called with bogus options [ 37.965115][ T10] usb 1-1: device descriptor read/8, error -71 [ 38.111214][ T10] usb 1-1: device descriptor read/8, error -71 [ 38.131609][ T496] process 'syz.2.36' launched './file0' with NULL argv: empty string added [ 38.224013][ T10] usb usb1-port1: unable to enumerate USB device [ 38.433961][ T440] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 38.583973][ T440] usb 3-1: Using ep0 maxpacket: 32 [ 38.590233][ T440] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 38.598487][ T440] usb 3-1: config 0 has no interface number 0 [ 38.606168][ T440] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 38.615373][ T440] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.623400][ T440] usb 3-1: Product: syz [ 38.627687][ T440] usb 3-1: Manufacturer: syz [ 38.632313][ T440] usb 3-1: SerialNumber: syz [ 38.639509][ T440] usb 3-1: config 0 descriptor?? [ 38.646560][ T440] smsc95xx v2.0.0 [ 38.783934][ T10] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 38.853938][ T440] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 38.864897][ T440] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 38.904333][ T440] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 38.924142][ T440] smsc95xx 3-1:0.67: probe with driver smsc95xx failed with error -61 [ 38.951282][ T10] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 38.960324][ T10] usb 4-1: can't read configurations, error -71 [ 39.093927][ T336] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 39.104730][ T311] usb 3-1: USB disconnect, device number 3 [ 39.233918][ T336] usb 1-1: device descriptor read/64, error -71 [ 39.473889][ T336] usb 1-1: device descriptor read/64, error -71 [ 39.604046][ T443] af_packet: tpacket_rcv: packet too big, clamped from 80 to 4294967272. macoff=96 [ 39.713906][ T336] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 39.793949][ T10] usb 4-1: new full-speed USB device number 7 using dummy_hcd [ 39.863936][ T336] usb 1-1: device descriptor read/64, error -71 [ 39.963931][ T31] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 39.973825][ T10] usb 4-1: New USB device found, idVendor=0499, idProduct=104e, bcdDevice= 0.40 [ 39.982934][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.991041][ T10] usb 4-1: Product: syz [ 39.995302][ T10] usb 4-1: Manufacturer: syz [ 39.999944][ T10] usb 4-1: SerialNumber: syz [ 40.115606][ T31] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 40.126681][ T31] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 40.134107][ T336] usb 1-1: device descriptor read/64, error -71 [ 40.137254][ T31] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 40.155880][ T31] usb 3-1: New USB device found, idVendor=054c, idProduct=09cc, bcdDevice= 0.00 [ 40.165125][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 40.174333][ T31] usb 3-1: config 0 descriptor?? [ 40.209073][ T10] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 40.224139][ T10] usb 4-1: unit 4 not found! [ 40.228785][ T10] usb 4-1: unit 6 not found! [ 40.243996][ T336] usb usb1-port1: attempt power cycle [ 40.254159][ T10] usb 4-1: USB disconnect, device number 7 [ 40.272255][ T313] udevd[313]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 40.587332][ T31] playstation 0003:054C:09CC.0002: unknown main item tag 0x0 [ 40.594925][ T31] playstation 0003:054C:09CC.0002: unknown main item tag 0x0 [ 40.602427][ T31] playstation 0003:054C:09CC.0002: unknown main item tag 0x0 [ 40.604031][ T336] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 40.610991][ T31] playstation 0003:054C:09CC.0002: unknown main item tag 0x0 [ 40.625123][ T31] playstation 0003:054C:09CC.0002: unknown main item tag 0x0 [ 40.632569][ T31] playstation 0003:054C:09CC.0002: unknown main item tag 0x0 [ 40.646046][ T31] playstation 0003:054C:09CC.0002: hidraw0: USB HID vff.fd Device [HID 054c:09cc] on usb-dummy_hcd.2-1/input0 [ 40.657992][ T336] usb 1-1: device descriptor read/8, error -71 [ 40.747220][ T36] kauditd_printk_skb: 28 callbacks suppressed [ 40.747238][ T36] audit: type=1400 audit(1788070244.950:196): avc: denied { mount } for pid=525 comm="syz.3.46" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 40.784533][ T31] playstation 0003:054C:09CC.0002: Invalid byte count transferred, expected 16 got 0 [ 40.802895][ T31] playstation 0003:054C:09CC.0002: Failed to retrieve DualShock4 pairing info: -22 [ 40.812792][ T526] 9pnet_fd: Insufficient options for proto=fd [ 40.819752][ T31] playstation 0003:054C:09CC.0002: Failed to get MAC address from DualShock4 [ 40.829197][ T31] playstation 0003:054C:09CC.0002: Failed to create dualshock4. [ 40.829200][ T336] usb 1-1: device descriptor read/8, error -71 [ 40.863414][ T36] audit: type=1400 audit(1788070245.050:197): avc: denied { unmount } for pid=298 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 40.884046][ T31] playstation 0003:054C:09CC.0002: probe with driver playstation failed with error -22 [ 40.997933][ T36] audit: type=1400 audit(1788070245.200:198): avc: denied { map } for pid=522 comm="syz.2.45" path="/dev/binderfs/binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 41.063900][ T336] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 41.094889][ T336] usb 1-1: device descriptor read/8, error -71 [ 41.224939][ T336] usb 1-1: device descriptor read/8, error -71 [ 41.334390][ T336] usb usb1-port1: unable to enumerate USB device [ 41.505015][ T363] usb 3-1: USB disconnect, device number 4 [ 41.744507][ T36] audit: type=1400 audit(1788070245.940:199): avc: denied { execute } for pid=534 comm="syz.2.49" path="/selinux/policy" dev="selinuxfs" ino=20 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=file permissive=1 [ 41.827535][ T537] FAULT_INJECTION: forcing a failure. [ 41.827535][ T537] name failslab, interval 1, probability 0, space 0, times 1 [ 41.854059][ T537] CPU: 0 UID: 0 PID: 537 Comm: syz.0.50 Not tainted syzkaller #0 28bb5670a1b4a83370a1b0f1e6655e31af14d592 [ 41.854098][ T537] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 41.854122][ T537] Call Trace: [ 41.854130][ T537] [ 41.854140][ T537] __dump_stack+0x21/0x30 [ 41.854187][ T537] dump_stack_lvl+0x140/0x1c0 [ 41.854220][ T537] ? __cfi_dump_stack_lvl+0x10/0x10 [ 41.854255][ T537] dump_stack+0x19/0x20 [ 41.854296][ T537] should_fail_ex+0x3c2/0x510 [ 41.854325][ T537] should_failslab+0xac/0x100 [ 41.854355][ T537] kmem_cache_alloc_lru_noprof+0x44/0x410 [ 41.854382][ T537] ? __d_alloc+0x42/0x8c0 [ 41.854406][ T537] __d_alloc+0x42/0x8c0 [ 41.854429][ T537] d_alloc_anon+0x1b/0x30 [ 41.854450][ T537] path_from_stashed+0x39b/0x860 [ 41.854488][ T537] ? __cfi_path_from_stashed+0x10/0x10 [ 41.854522][ T537] ? _raw_spin_lock+0x92/0x120 [ 41.854556][ T537] ? __cfi__raw_spin_lock+0x10/0x10 [ 41.854588][ T537] ? do_futex+0x32a/0x510 [ 41.854623][ T537] pidfs_alloc_file+0x109/0x1e0 [ 41.854647][ T537] ? _raw_spin_unlock+0x45/0x60 [ 41.854681][ T537] ? __cfi_pidfs_alloc_file+0x10/0x10 [ 41.854707][ T537] pidfd_prepare+0x80/0x150 [ 41.854736][ T537] __se_sys_pidfd_open+0xd6/0x250 [ 41.854765][ T537] ? __x64_sys_pidfd_open+0x80/0x80 [ 41.854795][ T537] ? __kasan_check_write+0x18/0x20 [ 41.854820][ T537] __x64_sys_pidfd_open+0x5f/0x80 [ 41.854849][ T537] x64_sys_call+0x28c0/0x2ee0 [ 41.854870][ T537] do_syscall_64+0x57/0xf0 [ 41.854904][ T537] ? clear_bhb_loop+0x50/0xa0 [ 41.854931][ T537] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 41.854956][ T537] RIP: 0033:0x7fa97c19e159 [ 41.854980][ T537] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 41.854999][ T537] RSP: 002b:00007fa97d0f2018 EFLAGS: 00000246 ORIG_RAX: 00000000000001b2 [ 41.855029][ T537] RAX: ffffffffffffffda RBX: 00007fa97c425fa0 RCX: 00007fa97c19e159 [ 41.855048][ T537] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000f [ 41.855062][ T537] RBP: 00007fa97c235024 R08: 0000000000000000 R09: 0000000000000000 [ 41.855078][ T537] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 41.855092][ T537] R13: 00007fa97c426038 R14: 00007fa97c425fa0 R15: 00007fff616b8238 [ 41.855113][ T537] [ 41.950495][ T539] capability: warning: `syz.0.50' uses deprecated v2 capabilities in a way that may be insecure [ 42.084062][ T336] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 42.123883][ T36] audit: type=1400 audit(1788070246.330:200): avc: denied { map } for pid=536 comm="syz.0.50" path="socket:[5168]" dev="sockfs" ino=5168 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 42.263888][ T336] usb 3-1: device descriptor read/64, error -71 [ 42.503891][ T336] usb 3-1: device descriptor read/64, error -71 [ 42.657197][ T36] audit: type=1400 audit(1788070246.860:201): avc: denied { unmount } for pid=296 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 42.713868][ T36] audit: type=1400 audit(1788070246.910:202): avc: denied { getopt } for pid=540 comm="syz.0.51" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 42.754517][ T336] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 42.813914][ T36] audit: type=1400 audit(1788070247.010:203): avc: denied { mount } for pid=546 comm="syz.0.53" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 42.844137][ T547] device-mapper: ioctl: Invalid data size in the ioctl structure: 0 [ 42.853909][ T36] audit: type=1400 audit(1788070247.040:204): avc: denied { read write } for pid=546 comm="syz.0.53" name="control" dev="devtmpfs" ino=198 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 42.898034][ T336] usb 3-1: device descriptor read/64, error -71 [ 42.913908][ T36] audit: type=1400 audit(1788070247.040:205): avc: denied { open } for pid=546 comm="syz.0.53" path="/7/dev/mapper/control" dev="devtmpfs" ino=198 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 43.153900][ T336] usb 3-1: device descriptor read/64, error -71 [ 43.273932][ T336] usb usb3-port1: attempt power cycle [ 43.623888][ T336] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 43.667502][ T336] usb 3-1: device descriptor read/8, error -71 [ 43.805881][ T336] usb 3-1: device descriptor read/8, error -71 [ 44.053890][ T336] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 44.074922][ T336] usb 3-1: device descriptor read/8, error -71 [ 44.204990][ T336] usb 3-1: device descriptor read/8, error -71 [ 44.334014][ T336] usb usb3-port1: unable to enumerate USB device [ 45.113892][ T336] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 45.283957][ T336] usb 3-1: Using ep0 maxpacket: 16 [ 45.294665][ T336] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 45.321319][ T336] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 45.345294][ T336] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 45.363880][ T336] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 45.371973][ T336] usb 3-1: Product: syz [ 45.383923][ T336] usb 3-1: Manufacturer: syz [ 45.388582][ T336] usb 3-1: SerialNumber: syz [ 45.600179][ T336] usb 3-1: 0:2 : does not exist [ 45.616776][ T336] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 45.640333][ T336] usb 3-1: USB disconnect, device number 9 [ 45.805188][ T582] IPv6: NLM_F_CREATE should be specified when creating new route [ 45.813015][ T582] IPv6: NLM_F_REPLACE set, but no existing node found! [ 46.136411][ T363] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 46.280621][ T36] kauditd_printk_skb: 9 callbacks suppressed [ 46.280641][ T36] audit: type=1400 audit(1788070250.480:215): avc: denied { block_suspend } for pid=590 comm="syz.2.67" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 46.333893][ T363] usb 1-1: config index 0 descriptor too short (expected 4257, got 161) [ 46.342499][ T363] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x81 has invalid wMaxPacketSize 0 [ 46.363966][ T363] usb 1-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 46.373077][ T363] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 46.609481][ T363] usb 1-1: string descriptor 0 read error: -71 [ 46.615455][ T336] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 46.639105][ T363] uvcvideo 1-1:1.1: Unknown video format 32595559-0008-0010-8000-00aa00389b71 [ 46.648236][ T363] usb 1-1: Found UVC 1.00 device (046d:0825) [ 46.655466][ T363] uvcvideo 1-1:1.1: No supported video formats found. [ 46.662303][ T363] uvcvideo 1-1:1.1: Failed to initialize the device (-22). [ 46.675351][ T363] usb 1-1: USB disconnect, device number 14 [ 46.773941][ T336] usb 3-1: Using ep0 maxpacket: 16 [ 46.790348][ T336] usb 3-1: config 0 has an invalid interface number: 34 but max is 0 [ 46.803877][ T336] usb 3-1: config 0 has no interface number 0 [ 46.820183][ T336] usb 3-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 46.840457][ T336] usb 3-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 46.862028][ T336] usb 3-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 46.873882][ T336] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 46.892108][ T336] usb 3-1: Product: syz [ 46.902208][ T336] usb 3-1: Manufacturer: syz [ 46.906953][ T336] usb 3-1: SerialNumber: syz [ 46.922646][ T336] usb 3-1: config 0 descriptor?? [ 46.928007][ T593] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 46.935309][ T593] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 47.154352][ T593] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 47.162334][ T593] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 47.187721][ T36] audit: type=1400 audit(1788070251.390:216): avc: denied { ioctl } for pid=594 comm="syz.0.69" path="socket:[5444]" dev="sockfs" ino=5444 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 47.236079][ T36] audit: type=1400 audit(1788070251.440:217): avc: denied { connect } for pid=594 comm="syz.0.69" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 47.384401][ T336] asix 3-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 47.985181][ T336] asix 3-1:0.34 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 47.995802][ T336] asix 3-1:0.34 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x0080: ffffffb9 [ 48.033932][ T336] asix 3-1:0.34: probe with driver asix failed with error -71 [ 48.056347][ T336] usb 3-1: USB disconnect, device number 10 [ 48.535880][ T36] audit: type=1400 audit(1788070252.740:218): avc: denied { connect } for pid=605 comm="syz.2.71" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 48.590051][ T36] audit: type=1400 audit(1788070252.790:219): avc: denied { wake_alarm } for pid=607 comm="syz.0.72" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 48.650405][ T36] audit: type=1400 audit(1788070252.850:220): avc: denied { write } for pid=607 comm="syz.0.72" name="tcp6" dev="proc" ino=4026532511 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 48.813890][ T336] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 48.973881][ T336] usb 3-1: Using ep0 maxpacket: 8 [ 48.985301][ T336] usb 3-1: unable to get BOS descriptor or descriptor too short [ 48.995976][ T336] usb 3-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 49.032529][ T336] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 7 [ 49.055358][ T336] usb 3-1: New USB device found, idVendor=086a, idProduct=0003, bcdDevice= 0.40 [ 49.073872][ T336] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 49.092067][ T336] usb 3-1: Product: syz [ 49.096347][ T336] usb 3-1: Manufacturer: syz [ 49.100976][ T336] usb 3-1: SerialNumber: syz [ 49.328185][ T336] usb 3-1: USB disconnect, device number 11 [ 49.683890][ T311] usb 1-1: new full-speed USB device number 15 using dummy_hcd [ 49.864999][ T311] usb 1-1: config 0 has an invalid interface number: 41 but max is 0 [ 49.873276][ T311] usb 1-1: config 0 has no interface number 0 [ 49.893889][ T311] usb 1-1: config 0 interface 41 has no altsetting 0 [ 49.902059][ T311] usb 1-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 49.913870][ T311] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 49.921910][ T311] usb 1-1: Product: syz [ 49.943872][ T311] usb 1-1: Manufacturer: syz [ 49.948555][ T311] usb 1-1: SerialNumber: syz [ 49.964168][ T311] usb 1-1: config 0 descriptor?? [ 50.565226][ T36] audit: type=1400 audit(1788070254.770:221): avc: denied { setopt } for pid=630 comm="syz.2.76" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 50.598014][ T631] overlayfs: upper fs does not support file handles, falling back to index=off. [ 50.604168][ T36] audit: type=1400 audit(1788070254.800:222): avc: denied { unlink } for pid=630 comm="syz.2.76" name="#3" dev="tmpfs" ino=192 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 50.633989][ T631] overlayfs: NFS export requires "index=on", falling back to nfs_export=off. [ 50.673292][ T36] audit: type=1400 audit(1788070254.850:223): avc: denied { mount } for pid=630 comm="syz.2.76" name="/" dev="overlay" ino=186 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 50.741757][ T36] audit: type=1400 audit(1788070254.940:224): avc: denied { unmount } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 50.812422][ T634] netlink: 96 bytes leftover after parsing attributes in process `syz.2.77'. [ 50.988378][ T616] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 51.017612][ T616] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 51.195791][ T440] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 51.353882][ T440] usb 3-1: Using ep0 maxpacket: 32 [ 51.365641][ T440] usb 3-1: config 87 has an invalid interface number: 229 but max is 1 [ 51.374086][ T440] usb 3-1: config 87 has no interface number 1 [ 51.386875][ T440] usb 3-1: config 87 interface 229 has no altsetting 0 [ 51.401749][ T440] usb 3-1: New USB device found, idVendor=0421, idProduct=042f, bcdDevice=1a.7c [ 51.410989][ T440] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 51.423915][ T440] usb 3-1: Product: syz [ 51.428179][ T440] usb 3-1: Manufacturer: syz [ 51.432851][ T440] usb 3-1: SerialNumber: syz [ 51.641134][ T639] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 51.654142][ T639] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 51.673520][ T639] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 51.691827][ T639] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 51.711014][ T440] usb 3-1: bad CDC descriptors [ 51.721594][ T440] usb 3-1: USB disconnect, device number 12 [ 51.855166][ T311] CoreChips 1-1:0.41 (unnamed net_device) (uninitialized): Failed to send software reset:ffffffb9 [ 51.873909][ T311] CoreChips 1-1:0.41 (unnamed net_device) (uninitialized): Failed to reset PHY: -71 [ 51.887037][ T311] CoreChips 1-1:0.41: probe with driver CoreChips failed with error -71 [ 51.897986][ T311] usb 1-1: USB disconnect, device number 15 [ 52.268810][ T647] netlink: 132 bytes leftover after parsing attributes in process `syz.2.80'. [ 52.428053][ T36] audit: type=1400 audit(1788070256.630:225): avc: denied { mounton } for pid=656 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 52.466072][ T36] audit: type=1400 audit(1788070256.660:226): avc: denied { bind } for pid=654 comm="syz.2.84" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 52.482030][ T655] netlink: 32 bytes leftover after parsing attributes in process `syz.2.84'. [ 52.506383][ T36] audit: type=1400 audit(1788070256.660:227): avc: denied { setopt } for pid=654 comm="syz.2.84" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 52.535022][ T392] bridge_slave_1: left allmulticast mode [ 52.540744][ T392] bridge_slave_1: left promiscuous mode [ 52.547473][ T392] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.555493][ T392] bridge_slave_0: left allmulticast mode [ 52.561179][ T392] bridge_slave_0: left promiscuous mode [ 52.567381][ T392] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.657311][ T656] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.664589][ T656] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.671818][ T656] bridge_slave_0: entered allmulticast mode [ 52.678941][ T656] bridge_slave_0: entered promiscuous mode [ 52.688896][ T656] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.696425][ T656] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.703609][ T656] bridge_slave_1: entered allmulticast mode [ 52.710440][ T656] bridge_slave_1: entered promiscuous mode [ 52.717625][ T392] veth1_macvtap: left promiscuous mode [ 52.723365][ T392] veth0_vlan: left promiscuous mode [ 52.879410][ T656] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.886548][ T656] bridge0: port 2(bridge_slave_1) entered forwarding state [ 52.893949][ T656] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.901018][ T656] bridge0: port 1(bridge_slave_0) entered forwarding state [ 52.929568][ T381] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.937379][ T381] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.971907][ T381] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.979041][ T381] bridge0: port 1(bridge_slave_0) entered forwarding state [ 52.989221][ T36] audit: type=1400 audit(1788070257.180:228): avc: denied { create } for pid=666 comm="syz.0.85" name="file5" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 53.011020][ T381] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.018116][ T381] bridge0: port 2(bridge_slave_1) entered forwarding state [ 53.038077][ T656] veth0_vlan: entered promiscuous mode [ 53.048868][ T36] audit: type=1400 audit(1788070257.250:229): avc: denied { unlink } for pid=296 comm="syz-executor" name="file5" dev="tmpfs" ino=148 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 53.089110][ T656] veth1_macvtap: entered promiscuous mode [ 53.172968][ T672] loop7: detected capacity change from 0 to 1 [ 53.192796][ T677] can: request_module (can-proto-0) failed. [ 53.218769][ T675] loop7: detected capacity change from 1 to 0 [ 53.410356][ T36] audit: type=1400 audit(1788070257.610:230): avc: denied { write } for pid=680 comm="syz.0.89" name=".pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 53.461356][ T36] audit: type=1400 audit(1788070257.610:231): avc: denied { open } for pid=680 comm="syz.0.89" path="/27/file0/.pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 53.489073][ T36] audit: type=1400 audit(1788070257.650:232): avc: denied { ioctl } for pid=680 comm="syz.0.89" path="/27/file0/.pending_reads" dev="incremental-fs" ino=2 ioctlcmd=0x6726 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 53.517166][ T36] audit: type=1400 audit(1788070257.670:233): avc: denied { unmount } for pid=296 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 53.543948][ T45] usb 3-1: new full-speed USB device number 13 using dummy_hcd [ 53.698358][ T45] usb 3-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 53.709630][ T45] usb 3-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 53.722835][ T45] usb 3-1: config 0 interface 0 has no altsetting 0 [ 53.729730][ T45] usb 3-1: New USB device found, idVendor=28bd, idProduct=0042, bcdDevice= 0.00 [ 53.740673][ T45] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 53.754714][ T45] usb 3-1: config 0 descriptor?? [ 53.814100][ T36] audit: type=1400 audit(1788070258.010:234): avc: denied { bind } for pid=690 comm="syz.4.93" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 54.224922][ T45] uclogic 0003:28BD:0042.0003: interface is invalid, ignoring [ 54.413914][ T443] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 54.425899][ T679] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 54.435214][ T679] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 54.443696][ T440] usb 3-1: USB disconnect, device number 13 [ 54.564945][ T443] usb 1-1: config 0 has an invalid interface number: 0 but max is -1 [ 54.573304][ T443] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 54.583018][ T443] usb 1-1: New USB device found, idVendor=07fd, idProduct=0004, bcdDevice=86.34 [ 54.601073][ T443] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 54.610773][ T443] usb 1-1: config 0 descriptor?? [ 54.627647][ T443] usb 1-1: Waiting for MOTU Microbook II to boot up... [ 54.636424][ T443] usb 1-1: failed setting the sample rate for Motu MicroBook II: -22 [ 54.644856][ T443] snd-usb-audio 1-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 54.826710][ T311] usb 1-1: USB disconnect, device number 16 [ 55.021926][ T45] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 55.188781][ T45] usb 5-1: config 0 has an invalid interface number: 0 but max is -1 [ 55.204123][ T45] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 55.220710][ T45] usb 5-1: New USB device found, idVendor=07fd, idProduct=0004, bcdDevice=86.34 [ 55.232219][ T45] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 55.242517][ T45] usb 5-1: config 0 descriptor?? [ 55.249620][ T45] usb 5-1: Waiting for MOTU Microbook II to boot up... [ 55.257222][ T45] usb 5-1: failed setting the sample rate for Motu MicroBook II: -22 [ 55.266226][ T45] snd-usb-audio 5-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 55.315211][ T728] mmap: syz.2.106 (728) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 55.438457][ T738] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 55.452523][ T715] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 55.471343][ T715] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 55.490674][ T715] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 55.505069][ T715] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 55.525226][ T311] usb 5-1: USB disconnect, device number 2 [ 55.563908][ T45] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 55.735061][ T45] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 55.745404][ T45] usb 3-1: config 1 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 55.760233][ T45] usb 3-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 55.769837][ T45] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 55.779337][ T45] usb 3-1: Product: syz [ 55.783679][ T45] usb 3-1: Manufacturer: syz [ 55.788501][ T45] usb 3-1: SerialNumber: syz [ 55.798034][ T45] usb-storage 3-1:1.0: USB Mass Storage device detected [ 55.807250][ T45] usb-storage 3-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 55.815772][ T45] scsi host1: usb-storage 3-1:1.0 [ 56.005602][ T728] syzkaller1: entered promiscuous mode [ 56.011290][ T728] syzkaller1: entered allmulticast mode [ 56.018846][ T45] usb 3-1: USB disconnect, device number 14 [ 56.187633][ T754] BUG: scheduling while atomic: syz.4.114/754/0x00000002 [ 56.194780][ T754] Modules linked in: [ 56.198714][ T754] CPU: 0 UID: 0 PID: 754 Comm: syz.4.114 Not tainted syzkaller #0 28bb5670a1b4a83370a1b0f1e6655e31af14d592 [ 56.198748][ T754] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 56.198763][ T754] Call Trace: [ 56.198772][ T754] [ 56.198781][ T754] __dump_stack+0x21/0x30 [ 56.198821][ T754] dump_stack_lvl+0x140/0x1c0 [ 56.198852][ T754] ? __cfi_dump_stack_lvl+0x10/0x10 [ 56.198885][ T754] ? is_bpf_text_address+0x17b/0x1a0 [ 56.198926][ T754] dump_stack+0x19/0x20 [ 56.198958][ T754] __schedule_bug+0x12b/0x200 [ 56.198985][ T754] ? find_proxy_task+0x2460/0x2460 [ 56.199014][ T754] __schedule+0xb85/0x20b0 [ 56.199038][ T754] ? __kasan_check_read+0x15/0x20 [ 56.199063][ T754] ? rwsem_spin_on_owner+0x14b/0x3b0 [ 56.199104][ T754] ? __sched_text_start+0x10/0x10 [ 56.199128][ T754] ? osq_unlock+0x25/0xd0 [ 56.199151][ T754] ? __kasan_check_write+0x18/0x20 [ 56.199175][ T754] ? _raw_spin_lock_irq+0x93/0x120 [ 56.199210][ T754] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 56.199246][ T754] schedule+0xc5/0x240 [ 56.199268][ T754] schedule_preempt_disabled+0x14/0x30 [ 56.199293][ T754] rwsem_down_read_slowpath+0x88c/0x14c0 [ 56.199326][ T754] ? down_write_killable+0x2d0/0x2d0 [ 56.199356][ T754] ? __kasan_check_write+0x18/0x20 [ 56.199380][ T754] ? rwsem_read_trylock+0x275/0x5a0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 56.199418][ T754] ? __kasan_check_write+0x18/0x20 [ 56.199443][ T754] ? downgrade_write+0x390/0x470 [ 56.199482][ T754] down_read+0x95/0xe0 [ 56.199523][ T754] ? __cfi_down_read+0x10/0x10 [ 56.199552][ T754] ? mutex_unlock+0x90/0x240 [ 56.199578][ T754] ? __cfi_mutex_unlock+0x10/0x10 [ 56.199606][ T754] ? sysfs_unmerge_group+0x120/0x130 [ 56.199637][ T754] kernfs_find_and_get_ns+0x76/0x130 [ 56.199671][ T754] sysfs_unmerge_group+0x66/0x130 [ 56.199701][ T754] dpm_sysfs_remove+0x7b/0xd0 [ 56.199734][ T754] device_del+0x241/0xcf0 [ 56.199770][ T754] ? __cfi_class_find_device+0x10/0x10 [ 56.199797][ T754] ? __cfi_device_del+0x10/0x10 [ 56.199832][ T754] ? __kasan_check_write+0x18/0x20 [ 56.199857][ T754] ? kobject_put+0x1cc/0x2a0 [ 56.199892][ T754] device_destroy+0xb0/0x100 [ 56.199914][ T754] ? __cfi_device_destroy+0x10/0x10 [ 56.199935][ T754] ? __kasan_check_write+0x18/0x20 [ 56.199961][ T754] android_device_destroy+0x118/0x180 [ 56.199997][ T754] gadgets_drop+0x1d/0x30 [ 56.200020][ T754] ? __cfi_gadgets_drop+0x10/0x10 [ 56.200044][ T754] configfs_rmdir+0x8b7/0x9b0 [ 56.200079][ T754] vfs_rmdir+0x3db/0x560 [ 56.200115][ T754] do_rmdir+0x29a/0x590 [ 56.200150][ T754] ? __cfi_do_rmdir+0x10/0x10 [ 56.200185][ T754] ? __kasan_check_write+0x18/0x20 [ 56.200211][ T754] __x64_sys_rmdir+0x4b/0x60 [ 56.200246][ T754] x64_sys_call+0xaf7/0x2ee0 [ 56.200268][ T754] do_syscall_64+0x57/0xf0 [ 56.200303][ T754] ? clear_bhb_loop+0x50/0xa0 [ 56.200332][ T754] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 56.200359][ T754] RIP: 0033:0x7f2ea619e159 [ 56.200380][ T754] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 56.200400][ T754] RSP: 002b:00007f2ea70f3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 56.200426][ T754] RAX: ffffffffffffffda RBX: 00007f2ea6426090 RCX: 00007f2ea619e159 [ 56.200444][ T754] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000600 [ 56.200461][ T754] RBP: 00007f2ea6235024 R08: 0000000000000000 R09: 0000000000000000 [ 56.200476][ T754] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 56.200491][ T754] R13: 00007f2ea6426128 R14: 00007f2ea6426090 R15: 00007fff538d7748 [ 56.200521][ T754] [ 56.201035][ T754] ------------[ cut here ]------------ [ 56.575333][ T754] WARNING: CPU: 0 PID: 754 at lib/stackdepot.c:635 stack_depot_save_flags+0x266/0x800 [ 56.585014][ T754] Modules linked in: [ 56.588947][ T754] CPU: 0 UID: 0 PID: 754 Comm: syz.4.114 Tainted: G W syzkaller #0 28bb5670a1b4a83370a1b0f1e6655e31af14d592 [ 56.601912][ T754] Tainted: [W]=WARN [ 56.605816][ T754] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 56.615941][ T754] RIP: 0010:stack_depot_save_flags+0x266/0x800 [ 56.622208][ T754] Code: 48 83 3d b4 f0 db 05 00 0f 84 00 04 00 00 48 c7 45 c0 00 00 00 00 48 89 d3 65 8b 05 cc 51 1e 7d 4d 89 d7 a9 00 00 f0 00 74 2d <0f> 0b 48 c7 45 c8 00 00 00 00 9c 8f 45 c8 4c 8b 6d c8 fa 48 c7 c7 [ 56.641920][ T754] RSP: 0018:ffffc9001109f980 EFLAGS: 00010206 [ 56.648056][ T754] RAX: 000000007fffffff RBX: ffff8881f5b990d0 RCX: 00000000009990d0 [ 56.656183][ T754] RDX: ffff8881f5b990d0 RSI: 0000000000000001 RDI: 000000003eed3649 [ 56.664316][ T754] RBP: ffffc9001109f9e0 R08: 00000000c14480d6 R09: 00000000d5c0b1a9 [ 56.672340][ T754] R10: 000000000000000d R11: ffffffff81759fc0 R12: 000000006d79990d [ 56.680378][ T754] R13: 0000000000000000 R14: ffffc9001109f9f0 R15: 000000000000000d [ 56.688411][ T754] FS: 00007f2ea70f36c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 56.697416][ T754] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 56.704060][ T754] CR2: 00007f2ea61872c0 CR3: 0000000116146000 CR4: 00000000003526b0 [ 56.712069][ T754] Call Trace: [ 56.715407][ T754] [ 56.718375][ T754] ? do_syscall_64+0x57/0xf0 [ 56.723016][ T754] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 56.729161][ T754] kasan_save_track+0x4f/0x80 [ 56.733895][ T754] ? kasan_save_track+0x3e/0x80 [ 56.738787][ T754] ? kasan_save_free_info+0x44/0x50 [ 56.744054][ T754] ? __kasan_slab_free+0x5f/0x80 [ 56.749061][ T754] ? kfree+0x158/0x440 [ 56.753138][ T754] ? gadget_info_attr_release+0xcb/0x130 [ 56.758953][ T754] ? config_item_put+0x178/0x240 [ 56.763968][ T754] ? configfs_rmdir+0x8e8/0x9b0 [ 56.768941][ T754] ? vfs_rmdir+0x3db/0x560 [ 56.773377][ T754] ? do_rmdir+0x29a/0x590 [ 56.777793][ T754] ? __x64_sys_rmdir+0x4b/0x60 [ 56.782602][ T754] ? x64_sys_call+0xaf7/0x2ee0 [ 56.787444][ T754] ? do_syscall_64+0x57/0xf0 [ 56.792096][ T754] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 56.798228][ T754] kasan_save_free_info+0x44/0x50 [ 56.803286][ T754] __kasan_slab_free+0x5f/0x80 [ 56.808126][ T754] kfree+0x158/0x440 [ 56.812139][ T754] ? gadget_info_attr_release+0xcb/0x130 [ 56.817830][ T754] ? __cfi_gadget_info_attr_release+0x10/0x10 [ 56.823992][ T754] gadget_info_attr_release+0xcb/0x130 [ 56.829477][ T754] config_item_put+0x178/0x240 [ 56.834303][ T754] ? __cfi_gadgets_drop+0x10/0x10 [ 56.839363][ T754] configfs_rmdir+0x8e8/0x9b0 [ 56.844130][ T754] vfs_rmdir+0x3db/0x560 [ 56.848421][ T754] do_rmdir+0x29a/0x590 [ 56.852687][ T754] ? __cfi_do_rmdir+0x10/0x10 [ 56.857441][ T754] ? __kasan_check_write+0x18/0x20 [ 56.862592][ T754] __x64_sys_rmdir+0x4b/0x60 [ 56.867256][ T754] x64_sys_call+0xaf7/0x2ee0 [ 56.871877][ T754] do_syscall_64+0x57/0xf0 [ 56.876445][ T754] ? clear_bhb_loop+0x50/0xa0 [ 56.881158][ T754] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 56.887447][ T754] RIP: 0033:0x7f2ea619e159 [ 56.892068][ T754] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 56.911877][ T754] RSP: 002b:00007f2ea70f3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 56.920390][ T754] RAX: ffffffffffffffda RBX: 00007f2ea6426090 RCX: 00007f2ea619e159 [ 56.928426][ T754] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000600 [ 56.936464][ T754] RBP: 00007f2ea6235024 R08: 0000000000000000 R09: 0000000000000000 [ 56.944520][ T754] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 56.952519][ T754] R13: 00007f2ea6426128 R14: 00007f2ea6426090 R15: 00007fff538d7748 [ 56.960645][ T754] [ 56.963688][ T754] ---[ end trace 0000000000000000 ]--- [ 56.982950][ T754] BUG: scheduling while atomic: syz.4.114/754/0x00000000 [ 57.014049][ T754] Modules linked in: [ 57.018016][ T754] CPU: 1 UID: 0 PID: 754 Comm: syz.4.114 Tainted: G W syzkaller #0 28bb5670a1b4a83370a1b0f1e6655e31af14d592 [ 57.018053][ T754] Tainted: [W]=WARN [ 57.018061][ T754] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 57.018074][ T754] Call Trace: [ 57.018081][ T754] [ 57.018090][ T754] __dump_stack+0x21/0x30 [ 57.018126][ T754] dump_stack_lvl+0x140/0x1c0 [ 57.018158][ T754] ? __cfi_dump_stack_lvl+0x10/0x10 [ 57.018192][ T754] dump_stack+0x19/0x20 [ 57.018222][ T754] __schedule_bug+0x12b/0x200 [ 57.018247][ T754] ? find_proxy_task+0x2460/0x2460 [ 57.018271][ T754] ? update_rq_clock+0x326/0x7e0 [ 57.018305][ T754] ? ttwu_do_activate+0x620/0x620 [ 57.018331][ T754] __schedule+0xb85/0x20b0 [ 57.018354][ T754] ? ttwu_do_activate+0x345/0x620 [ 57.018380][ T754] ? try_to_wake_up+0x111a/0x1fd0 [ 57.018407][ T754] ? __sched_text_start+0x10/0x10 [ 57.018429][ T754] ? __kasan_check_write+0x18/0x20 [ 57.018452][ T754] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 57.018491][ T754] ? __cfi__raw_spin_lock_irqsave+0x10/0x10 [ 57.018525][ T754] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 57.018559][ T754] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 57.018594][ T754] schedule+0xc5/0x240 [ 57.018615][ T754] synchronize_rcu_expedited+0x6e2/0x960 [ 57.018644][ T754] ? __cfi_synchronize_rcu_expedited+0x10/0x10 [ 57.018674][ T754] ? __cfi_wait_rcu_exp_gp+0x10/0x10 [ 57.018697][ T754] ? __cfi_autoremove_wake_function+0x10/0x10 [ 57.018723][ T754] ? kfree+0x158/0x440 [ 57.018744][ T754] ? __put_mountpoint+0x1c6/0x230 [ 57.018772][ T754] ? shrink_dentry_list+0x4d5/0x500 [ 57.018794][ T754] ? __kasan_check_write+0x18/0x20 [ 57.018818][ T754] namespace_unlock+0x248/0x450 [ 57.018839][ T754] ? umount_tree+0xf29/0xfa0 [ 57.018859][ T754] ? umount_tree+0xfa0/0xfa0 [ 57.018879][ T754] ? __detach_mounts+0x610/0x610 [ 57.018901][ T754] put_mnt_ns+0xad/0xf0 [ 57.018925][ T754] free_nsproxy+0x52/0x290 [ 57.018957][ T754] exit_task_namespaces+0x99/0xe0 [ 57.018990][ T754] do_exit+0xa41/0x2850 [ 57.019020][ T754] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 57.019047][ T754] ? __cfi_do_exit+0x10/0x10 [ 57.019077][ T754] ? __kasan_check_write+0x18/0x20 [ 57.019100][ T754] ? _raw_spin_lock_irq+0x93/0x120 [ 57.019133][ T754] do_group_exit+0x21f/0x2f0 [ 57.019162][ T754] ? __kasan_check_write+0x18/0x20 [ 57.019185][ T754] ? recalc_sigpending+0x184/0x1d0 [ 57.019210][ T754] get_signal+0x134c/0x1490 [ 57.019244][ T754] arch_do_signal_or_restart+0xbc/0x700 [ 57.019266][ T754] ? putname+0x113/0x150 [ 57.019291][ T754] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 57.019313][ T754] ? do_rmdir+0x528/0x590 [ 57.019347][ T754] ? __kasan_check_write+0x18/0x20 [ 57.019371][ T754] syscall_exit_to_user_mode+0x57/0xb0 [ 57.019400][ T754] do_syscall_64+0x63/0xf0 [ 57.019432][ T754] ? clear_bhb_loop+0x50/0xa0 [ 57.019457][ T754] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 57.019489][ T754] RIP: 0033:0x7f2ea619e159 [ 57.019508][ T754] Code: Unable to access opcode bytes at 0x7f2ea619e12f. [ 57.019519][ T754] RSP: 002b:00007f2ea70f3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 57.019542][ T754] RAX: 0000000000000000 RBX: 00007f2ea6426090 RCX: 00007f2ea619e159 [ 57.019558][ T754] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000600 [ 57.019573][ T754] RBP: 00007f2ea6235024 R08: 0000000000000000 R09: 0000000000000000 [ 57.019587][ T754] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 57.019601][ T754] R13: 00007f2ea6426128 R14: 00007f2ea6426090 R15: 00007fff538d7748 [ 57.019620][ T754] [ 57.575094][ T401] bridge_slave_1: left allmulticast mode [ 57.580759][ T401] bridge_slave_1: left promiscuous mode [ 57.586440][ T401] bridge0: port 2(bridge_slave_1) entered disabled state [ 57.594119][ T401] bridge_slave_0: left allmulticast mode [ 57.599759][ T401] bridge_slave_0: left promiscuous mode [ 57.606245][ T401] bridge0: port 1(bridge_slave_0) entered disabled state [ 57.706328][ T401] veth1_macvtap: left promiscuous mode [ 57.711868][ T401] veth0_vlan: left promiscuous mode [ 58.085166][ T401] bridge_slave_1: left allmulticast mode [ 58.090837][ T401] bridge_slave_1: left promiscuous mode [ 58.096517][ T401] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.104255][ T401] bridge_slave_0: left allmulticast mode [ 58.109907][ T401] bridge_slave_0: left promiscuous mode [ 58.115569][ T401] bridge0: port 1(bridge_slave_0) entered disabled state [ 58.206241][ T401] veth1_macvtap: left promiscuous mode [ 58.211788][ T401] veth0_vlan: left promiscuous mode [ 58.645884][ T401] bridge_slave_1: left allmulticast mode [ 58.651563][ T401] bridge_slave_1: left promiscuous mode [ 58.657267][ T401] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.664819][ T401] bridge_slave_0: left allmulticast mode [ 58.670477][ T401] bridge_slave_0: left promiscuous mode [ 58.676279][ T401] bridge0: port 1(bridge_slave_0) entered disabled state [ 58.776272][ T401] veth1_macvtap: left promiscuous mode [ 58.781897][ T401] veth0_vlan: left promiscuous mode