last executing test programs: 2.550614634s ago: executing program 2 (id=3): r0 = socket$vsock_stream(0x28, 0x1, 0x0) close(0x3) socket(0x28, 0x801, 0x0) bind$vsock_stream(r0, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r0, 0x0) accept4(r0, 0x0, 0x0, 0x80000) 2.504369376s ago: executing program 2 (id=6): ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000ffc000/0x3000)=nil, 0x3000}, 0x1}) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x10008, &(0x7f0000000080)={[{@debug}, {@resuid={'resuid', 0x3d, 0xee01}}]}, 0xff, 0x49e, &(0x7f0000000f40)="$eJzs3M9vFFUcAPDvbH/Qyo9WRBQEraCR+KOlBZWDBzSaeNDERA94rG1BZKGG1gRIo8UYPBoS78ajiX+BNy9GPRgTr5p4NCREe6F4qpmdGbpsd0u3tF3pfj7Jdt/bmd33vjPv7b6Z15kA2tZA+ieJ2BYRv0dEX5a9fYWB7Gl+bmbs5tzMWBILC2//nVTWuzE3M1asWrxva545VIoofZbE8WRpuVMXL50ZLZcnzuf5oemzHw5NXbz03Omzo6cmTk2cGzl27OiR4RdfGHl+TeJM47qx9+PJfXtef/fqm2Mnrr7307dptXbvz5ZXx3FHN+sEVMdAutX+WaioXfZkE3W/F2yvSiedLawITemIiHR3dVX6f190xOLO64vXPm1p5YB1lf42bWm8eHYB2MSSaHUNgNYofujT49/isUFDj/+F6y9HdOfp+bmZsflb8XdGKX+9ax3LH4iIE7P/fpU+otnzEAAAq1AZ2zxbb/xXit2V52yuY0c+h9IfEfdHxM6IeCAidkXEgxGVdR+KiIezNy/0rbD8gZr80vFP6VrdOq+RdPz3UtXYb74q/vypvyPPba/E35WcPF2eOJxvk0PRtSXNDy9Txvev/vZFo2XV47/0kZZfjAXzClzrrDlBNz46PbpWG+H65Yi9nfXiT27NBKQtYE9E7G3uo3cUidNPf7Ov0Up3jn8ZazDPtPB1xFPZ/p+NmvgLyfLzk0M9UZ44PFS0iqV+/vXKW43Kv6v418D1A49kicX9X7NGVUMrlyfOTzVfxpU/Pm94TLPa9t+dvFOZs/7l/ey1C6PT0+eHI7qTNyr54piu8vrI4nsvjE73pvli/bT9HzpYv//vzN+T7v90K6WNeH9EPBoRj+V1fzwiDkTEwWXi//GVJz5YJv4kkmjd/r8cMV73++9W++9PqufrV5HoOPPDd41mzFe2/4/GbOW7NlP5/ruDlVbwLjcfAAAA3BNKEbEtktJglh7YFqXS4GD2P/y74r5SeXJq+pmTkx+dG8+uEeiPrlJxpquv6nzocDKbf2KWH8nPFRfLj+Tnjb/s6K3kB8cmy+Mtjh3a3dbb+38U/T/1V0erawesO9drQfuq7f+lFtUD2Hgr+f13LACb0+39vyf909uqugAby/E/tK96/f+TmrzxP2xOS/v/n3VuWQdsRsb/0L70f2hf+j+0pWYu54/jjRb1REQztwUoLhZY/V0FelZ8hX+7JIo7XqxnWb1x6Ux3/kqUWhRpR5ONbVMk0h6zsYUu3kMFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgXvZfAAAA//8hId5P") mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$setregset(0x4205, r0, 0x2, &(0x7f0000000040)={0x0}) 2.41835597s ago: executing program 0 (id=9): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="540000001400b59540"], 0x54}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x4, 0x370, 0xffffffff, 0x0, 0xd0, 0x1a0, 0xffffffff, 0xffffffff, 0x0, 0xd0, 0x2a0, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x11, 0x0, 0x1}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@inet=@l2tp={{0x30}, {0x0, 0x0, 0x3, 0x0, 0xf}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3d0) r1 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4ea3, 0x8, @loopback, 0x3}, 0x1c) sendmsg(r1, &(0x7f00000000c0)={0x0, 0x9511, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0xff8a}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 2.346151764s ago: executing program 0 (id=11): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r1, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfff8}, 0xe) close_range(r0, 0xffffffffffffffff, 0x2) 2.331993844s ago: executing program 0 (id=12): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000000)={@remote, 0x8}, 0x1f) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f00000000c0)={@remote={0xfe, 0x80, '\x00', 0xffffffffffffffff}}, 0x20) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00') preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000180)=""/88, 0x58}], 0x1, 0x78, 0x0) 2.313045875s ago: executing program 0 (id=13): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x20080, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0xeffffffd, 0x801) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000000)={0x200, 0x4000, 0x4, r2, 0x1}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000001340)={0x3, 0x0, 0x1, r2, 0x3}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x3, 0x0, 0x1, r2, 0xb}) 2.240398239s ago: executing program 3 (id=14): r0 = fsopen(&(0x7f0000000180)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x1) fchdir(r1) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) lseek(r2, 0xfffffffffffffffd, 0x1) 2.191670752s ago: executing program 4 (id=15): unshare(0x22020600) r0 = inotify_init1(0x80000) r1 = io_uring_setup(0x4a86, &(0x7f0000000300)={0x0, 0x4178, 0x40, 0x8001002, 0x3d7}) close_range(r1, 0xffffffffffffffff, 0x0) r2 = dup(r0) read$FUSE(r2, 0x0, 0x0) 2.181736612s ago: executing program 2 (id=16): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) wait4(r0, 0x0, 0x40000000, 0x0) ptrace$poke(0x5, r0, &(0x7f0000000040), 0x6) 2.157804363s ago: executing program 3 (id=17): r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000027c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x2d, 0x20040040) connect$unix(r1, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) 2.147563834s ago: executing program 3 (id=18): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x4) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2d, 0x0, {{@in6=@loopback, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0xe, 0x100000001, 0x0, 0x0, 0x3d, 0xffffffffffffffff, 0x200000000000}, {0xcdab, 0x2f, 0x5, 0x800000000000002}, 0x1, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in=@broadcast, 0x0, 0x3c}, 0x2, @in6=@dev={0xfe, 0x80, '\x00', 0x3a}, 0x6, 0x4, 0x1}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x20}, 0x4048050) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x1c) 2.137740064s ago: executing program 3 (id=19): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x51) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x81899, 0x0) chdir(&(0x7f0000000200)='./file0/file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0/../file0\x00', &(0x7f0000000000)='sysfs\x00', 0x0, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000040)='./file0/../file0\x00', &(0x7f0000000100), 0x0, 0x0, 0x0) 2.128418555s ago: executing program 3 (id=20): bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000750000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000e00000095"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x5, &(0x7f0000000440)=ANY=[@ANYBLOB="1809000000ffffff00000000000000008510000002000000850000000f0000009500000000000000"], 0x0, 0xfffffdff, 0x0, 0x0, 0x727c45cd4283345, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r0}, 0xc) 2.060073108s ago: executing program 2 (id=21): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000100)={[0x8, 0x0, 0x34a30b42, 0x5, 0x1000, 0x8000, 0x1002, 0xfffffffffffffffb, 0x8, 0x6, 0x2, 0x2372, 0x1, 0xfffffffffffffefe, 0x401, 0x20], 0x26000, 0x201c00}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.059988888s ago: executing program 32 (id=21): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000100)={[0x8, 0x0, 0x34a30b42, 0x5, 0x1000, 0x8000, 0x1002, 0xfffffffffffffffb, 0x8, 0x6, 0x2, 0x2372, 0x1, 0xfffffffffffffefe, 0x401, 0x20], 0x26000, 0x201c00}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.059910778s ago: executing program 3 (id=23): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x2a, &(0x7f0000000000)=0xb6, 0x4) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) recvfrom(r0, 0x0, 0x0, 0x32, 0x0, 0x0) syz_emit_ethernet(0x2e, &(0x7f0000000380)={@multicast, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x40, 0x100, @void}}}}}}}, 0x0) syz_emit_ethernet(0x2e, &(0x7f0000000380)={@multicast, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x40, 0x100, @void}}}}}}}, 0x0) 2.054797008s ago: executing program 0 (id=24): r0 = socket$inet(0x2, 0x801, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @empty}, 0x10) sendto$inet(r0, &(0x7f0000000140)="ee", 0x1, 0x20044011, 0x0, 0x0) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) splice(r0, 0x0, r1, 0x0, 0x7ffff000, 0x3) 1.983974612s ago: executing program 33 (id=23): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x2a, &(0x7f0000000000)=0xb6, 0x4) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) recvfrom(r0, 0x0, 0x0, 0x32, 0x0, 0x0) syz_emit_ethernet(0x2e, &(0x7f0000000380)={@multicast, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x40, 0x100, @void}}}}}}}, 0x0) syz_emit_ethernet(0x2e, &(0x7f0000000380)={@multicast, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x40, 0x100, @void}}}}}}}, 0x0) 1.981490812s ago: executing program 0 (id=26): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000240)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x6a3, 0xcd0, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xa0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0xcc28163f40625b84, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000b40)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000a00)={0x20, 0x1, 0x1, "9e"}, 0x0}) r1 = syz_open_dev$hiddev(&(0x7f0000000080), 0xa, 0x62080) ioctl$HIDIOCGUSAGE(r1, 0xc018480b, 0x0) 1.344915723s ago: executing program 4 (id=30): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x18, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000002000000000000000000000085000000870000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000a00000009500"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x3, 0xd, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006100000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000009800000095"], &(0x7f0000000680)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={r2, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000100)="d28a08d988a88d8bf2f08c828807", 0x0, 0xd5b4, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.289637856s ago: executing program 4 (id=31): mkdir(&(0x7f0000000140)='./control\x00', 0x111) r0 = inotify_init1(0x800) r1 = inotify_init1(0x80000) inotify_add_watch(r1, &(0x7f0000000040)='./control\x00', 0x20000004) inotify_add_watch(r0, &(0x7f0000000180)='./control\x00', 0xa4000960) rmdir(&(0x7f0000000100)='./control\x00') 1.262157837s ago: executing program 4 (id=33): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x140) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x82c1, 0x0) unlink(&(0x7f0000000100)='./file0\x00') 1.245429618s ago: executing program 4 (id=34): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) close(r0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1200000009000000040000000200000000000000"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{r1, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000140)=r0}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000440)={{r2}, &(0x7f00000004c0), &(0x7f0000000400)=r0}, 0x20) 1.21185315s ago: executing program 4 (id=35): r0 = syz_usb_connect$cdc_ncm(0x2, 0x8f, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109027d0002010080000904000001020d0000052406000105240000000d240f0103050000fd0000000406241aff072908241c0101090000142413099f33760bf14377323063f9c8a04d113905241510000905810300020800040904010000020d00000904010102020d0000090582020002e1ad00090503020002"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000a00)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000c00)={0x20, 0x80, 0x1c, {0xc9f8, 0x5, 0x800, 0x5, 0x6, 0x4, 0xd, 0x8000006f, 0x8, 0x9c8, 0xfffe, 0xc}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) 797.7907ms ago: executing program 6 (id=44): ioctl$BLKFRASET(0xffffffffffffffff, 0x1264, 0x0) close(0x3) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000006c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000fef7ff7a0af0fff80000ff79a4f0ff00000000b7060000efffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00ba23008500000098000000b70000000000000095000000000000006f88300eaa171100756695acf0af839ec5300a584fe44c80de0b061417e9ade22cecede5d5be6ab3d7828ee094518a5800000082c81ddfe3960a29ea15fa7e26f0f3e51416b698f6da6fe8af496d22585ffab3af24974fae00d824313ffef788c6983945dd3663f79f67e78a48b24a4bcdc33b38c5f86e96111199f0f0af9f42099a0f54041889b971cf394bd43473a5ac2acab9768cbc52ff7f000000000000711727c4a32a6b7ecdae05d2b3fed4572eb0d88976d2adda68000010000000c47b18cf93996a43e2e080f57fadf535d8b3078ebe16b10160fad64474a7b558f7a56f41022feec18e013abd8fda2b96779e534d0675fbcc13ba9f9eb96319fd5b49521d5cb2ced401d7b6fce658f203a9c2da91116d986730da1be85b0000829512099df32814820fbf7be91cd13b77f4e4e599f8bbca388247856073472312a9ff4273b9cd08000000000000616e888cda842c661577818c2069cb41a73b4b7fc28882cad315db3fffc5183deca7a32838ec0ad70d4f55382c1879b71ec504d2f3e3883428ee350123a5cad346f6d517f6fcea5b6bc4fcffffffffffff03f419a6e45fd98e77da4a8202ebbdafe6b2e38c9d7e506f5da2958cf7f0d9b31ca3275e64e29d39d158cebe43308cf8760588001172e19685e9a334aec76530861b772a1da96f0a227514bd0bc26df2b50a45e4eceae1ddfe88d58879d12afdb295ce2edecb253e0471714fa124211203000000000000001f502b6c760655ffb20ae13a1a94f7ae229fbf5da7cae4f994ee82fc98c864c3e352ad16f98208cf1469dd6c1212582a3687f7dbdf708929643f3f0f4e947c40742452685ec044fc71eaca9abc92145677e14054331801b1412b39049ed782742f9a1b6aca9123b243c1a68c047f2db79701b62c8cc0d2f608c7f62d107ebc68df9f8d296721c9d465dad604bc0dc500000000000000000000000000000000000000000568a4997dd54fa83aacd2d209f66de2e26dc2fd862a0b8ee149c148197176745fc8ff1dd5bd6611daa882298a37b041b34668d4662ea8fbe2e787dfc4c8bef2124f0439b2d18ec83361da5cc732f365b0a528db31b90bc1405b6d5301c34319ccae29b1d6034b665c79baeeeac5e71d24e2e3b6ffc5bc2dcb600e645c0048b45e286a49e888d21abfc817085d9c00e08525207e33505226fdda16e6da6dd31f7a1736029b87e8d6a05bcb356298d7dccd7de2af0885bd4939ff96ab74da3871b077e4058c8752ba4994eafed8b239d781638fa339fa0f7dd135af3f80e40f4b885770cf27d205a45d4702f97b8b7c57b180c50b2b370dfb35dc895e8f05d6e71829f36150b2cde31469c4aea0c64850eb3f3e0dc35f8cdd76bdde2018366c3201307c370433762676f72e68c962430a0000000000000000000000000000e737dc2e1a3fdebbb510c663d24f72b954965201f775b3739c14dd4832647c028be09f2809fd396fa26532a30a37737e95f0f41dd024b7bf8a6bf807c9fd9b8c7a39717729339dc3054117cb95693bdd61edcc2860b66545e194a961bdc5457d76ae1a87050e12ead896f3337d5a000000000000000000400000602bfd2f1ace65f2e74dc99cb73a37f40362b7904e8a0ea8d2d9805c924f9985d22972031a1223afa1288af3f48c93fcdb11963d0b748287448f722dc180e87637b662b11effabf45beda2e3a7e1adf8f94b619fa152b33440f2358a745848caf7000eb305c936d26964a2a85e133d01368b8d228d02f96064de261cf02c9632a0eb4ab259e8f4dd63d8b6d2d6b2a0c29fbab7d04d73a381c296af344655b64e12f216fbc646cc6bd60ca773d187f2fd317f6cb2309d1a13526a44b7d9b2bf93947dc3ac3340a7a114051d33d152310574f0d784910dc1a8f5bbf3610c544437626236458f285196161496389b02ba46a72da0149b4ddfdd4ef7862a07395752a37cb0244e94e1310e0c0a148a9a48b149bf2f345f3f89813c9eb05160f63f0b363deee5cb77ea6e951857e1942e5c56d72d724af7aa24a8aadb512f3302972c53b0eb7a693e0b0c775b21aed72995cfe9e9347a07d43ce3db9f22d461e86416ffff6f2e4e36306630052a2b03ee36ec52af0d684fabd5f38adffaa6c5a7a8100d1aefaf8576b363690b76e2eb96b07ab790cf63cfc334b7469b5b5b397c622f7c3ee064f9272443bcb928b6f7a2450cd33550a42843b0b5ac9e37134c81bd56b72e1030b05a5b3ac47b5af22a9dff0700004adacc71db2b15b4ffd98e30224763382ade45d164be76b2e9a674448f3ee2cd29707484df87ea6e8e6333b5fcb1b8b43a7c005ea800000000000000000000010000000000387592adc78ccfe479549e6f4efc14c4a5cfe845e6157d6fe70b278147edf0e25065ec6b17f8022493d105c9c31121e7957aeec5f7f2af0446d128778c8bf15b87a0eec6f4c75966b5f0e06744bda63134223416102aea1254d57c390e1f84ec7d5c3a758ce59c9e2c4ce1f28b6783661e272bf1cb5c8ac177aa9c6ccbead9a96b22394afb840247e5d69473b836f070dc0bf9302e33b03d4e07395c82e33667726b51ff24b0bbea730702835159e3517ffb3da0d01833589fec3bdab629b21e5d9e87c3c58d962ff5e75c81f583c64b7d5a643674801e18b06ca98b49d9e28d004c7ebccf076c64ef71421f672b0948b18ab5af448ca9446e71ba6dd4bd15a12553066de7cb767a121d56d9d26ce27fdbe6721191f2ed1cc3f9c5e3d5cba447c4793165b3cbf51c7d0cf9edf823641e1bc7db7803b60dc8b21e49a33a73ac00337067dfd3ecaf4e6dceee1048f300000000000000000000000000000000000000000000007958a50896df65337581398793d0a9abe75251908c07d2957ca70ad7ac31aae536294d6a944cd35f46cb554d8aecae5a72cb24596d896ff9ad83473567b6cb9d032c395a1459399cea31ebafc1e77649b55af527ca0f1ac972ee72a78391473c1b9e0000000000000000004076eac7e605f8de6f0ce5702af52c5d78bac0097d92f078a3a98229ebf281c3c876d2614109b69967871fea621fb2a29a77a1516b51d9b1c3c5ef1436f50fad4a1cd92a211fec61d37c8b410a20fbdeb642228d6cfeb8cda8eea3a7f343fcaa0459b9d916abb668d4799534307084ee7d854dd0850000000000000000000000002f40c3e24f9c0a56edf543425058c35febda26a43bdab770212186b84421d8b841cf9181d47c08cb392e414c1efba9978a97769e65ae443644dbdb32a50cdc717a34d1aa9ced37820a6d1cd0920a9a07e36a85e967bfa7f2caf1c9b52c06f4d178fbb91a169e9533e401819e57cab814761819b0fc517239a6777dbb92a7462538dbd8a4b82f87df7982b44b160a598c75bafa5a9b388a44303dbebc83ac2ad2da3ae80c851bc2fdb8d444597fdac4538aa33bb9204ffe534b15a1878be30157d0815d38fc2effeb7b87d6bd15e21c7b7c7d1ad7b3fd69b4bd06716a203e82f4c0413719eae0967fc70f03570375c2d0986b0200897e505afb87b878f3e13187001bba6a401bd56f3f8eb5384e33"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x304, 0x10, &(0x7f0000000000), 0xfffffea2}, 0x48) close(0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x6, 0xa, &(0x7f0000000300)=ANY=[@ANYBLOB="b70200000a0000007b2ac0ff00000000632ac8ff00000000b70200000001010abfa200000000000007020000c0ffffffb703000040000000b704000000000000850000004500000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r0, 0x0, 0xe, 0x20, &(0x7f0000000040)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0xcfac, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 700.828835ms ago: executing program 6 (id=47): r0 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x154}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000300)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe27, 0x0, 0x0, 0x1000, 0x10000}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x20fb89, 0x800, 0x1, 0x122}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x3, 0x15a, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7d, 0x8000, 0x10000000, 0x8000146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4cc2, 0x8, 0x3, 0xffffffff}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffd, 0x2000, 0x3, 0x400bd}}], 0x1, &(0x7f0000000340)={0x2e, 0x54, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x2b3, 0x0, 0x0}}, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000340)=[@window={0x3, 0x3, 0x1}, @timestamp, @window={0x3, 0x218, 0x5}], 0x3) 628.858648ms ago: executing program 5 (id=50): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x40, &(0x7f0000000100)=0xfffffffa, 0x4) bind$inet(r0, &(0x7f0000000400)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x28040041, &(0x7f0000000000)={0x2, 0x24e23, @loopback}, 0x10) sendmsg$inet(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000280)="17", 0x1d}], 0x1}, 0x8c0) recvmmsg(r0, &(0x7f0000001140)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=""/28, 0x1c}, 0x2009}], 0x4000000000001f7, 0x100, 0x0) 593.60998ms ago: executing program 5 (id=51): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaabb88a827008100100008060001080006040001"], 0x32) 541.718583ms ago: executing program 1 (id=52): r0 = socket$inet6(0xa, 0x3, 0x1) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x560, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x490, 0xffffffff, 0xffffffff, 0x490, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'vxcan1\x00', {0x8}}}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xfd}}, [], [0x0, 0xffffffff], 'pim6reg\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x3a0, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_virt_wifi\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x5}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'bridge_slave_0\x00', {0x53}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5c0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x8923, &(0x7f00000000c0)={'bond_slave_1\x00', @random="0163014030d9"}) 541.344123ms ago: executing program 6 (id=53): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0x2, 0x4e21, 0x0, @private2}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x8000000004) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e2a, 0x2c, @mcast2, 0x40008e}, 0x1c) writev(r1, &(0x7f0000000000)=[{&(0x7f00000001c0)="580000001500add427323b472545b45602117fffffff81000e224e217f000001925aa80020007b00090080007f000001e809000000ff0000f03ac7108e004000ffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1) 503.929215ms ago: executing program 6 (id=54): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x8040, 0x0, 0x2f) recvfrom$inet(r0, &(0x7f0000000000)=""/8, 0x9d1ef9b1eb79a62f, 0x40010522, 0x0, 0xfffffffffffffd25) shutdown(r0, 0x0) 488.408056ms ago: executing program 5 (id=55): syz_mount_image$exfat(&(0x7f0000000280), &(0x7f00000006c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x10080, &(0x7f00000018c0)=ANY=[], 0xfd, 0x1510, &(0x7f0000002e00)="$eJzs3Au4TtXWOPAx5pyLbefyJrmvMcfiTS6TJAkl5JIkSUjuCUmSJElik1sSkpDrTnIPuaedtvv9knvSzpEkSUhIMv/P7vL3nU7n6zvn63zO9+3xe571mMNaY64x93jevS7Ps9+vug2v0bhm1QbMDP8M/esAf/4nCQASAGAQAOQAgAAAyuYsmzN9fxaNSf/UScS/SMOZV7oCcSVJ/zM26X/GJv3P2KT/GZv0P2OT/mds0v+MTfovRIY2O9/VsmXcTd7//y+n/jvJcv3PEPDv7ZD+/1+j/6Gjpf8Zm/Q/Y5P+Z2zS/4wsuNIFiP9hnX7Tcvn8Z2zSfyEytD/9nfLG81f6nbZs/8AmhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEL8DzjvLzMA8Ov4StclhBBCCCGEEEKIP49/50pXIIQQQgghhBBCiH89BAUaDASQCTJDAmSBRLgKskI2yA45IAZXQ064BnLBtZAb8kBeyAf5oQAUhBAILDBEUAgKQxyugyJwPRSFYlAcSoCDklAKboDScCOUgZugLNwM5eAWKA8VfjpnutuhMlSBqnAHVIPqUANqwp1QC+6C2nA31IF7oC7cC/XgPqgP90MDaAiN4AFoDA9CE2gKzaA5tICW0OoP8pNz/F7+c9ATnode0BuSoA/0hRegH/SHATAQBsGLMBhegiHwMgyFYTAcXoER8CqMhNdgFIyGMfA6jIVxMB4mwESYBMnwBkyGN2EKvPVgNpgG02EGzIRZMBvehjkwF+bBOzAfFsBCSM6yGJbAUngXlsF7kALvw3L4AFJhBayEVbAa1sBaWAfrYQNshE2wGbbAVtgG2+FD2AE7YRfshj2wF/bBR7AfPoYD8Amk4af/YP65v86H7ggIqFChQYOZMBMmYAImYiJmxayYHbNjDGOYE3NiLsyFuTE35sW8mIT5sSAWREJCRsZCWAjjGMciWASLYlEsjsXRocNSWApL441YBstgWSyL5bAclscKWAFvxVuxElbCylgZq2JVrIbVsAbWwDvxTrwLa2NtrIN1sC7WxXpYD+tjfWyADbARNsLG2BibYBNshs2wBbbAVtgKW2NrbINtsB22w/bYHjtgB+yIHbETdsLO2Bm7YBfsil2xG3bD7vgsPovP4XP4PD6PvbGa6oN9sS/2w344AAfiQHwRB+NL+BK+jENxGA7HV/AVfBVH4lkchaNxDI7BSmocjscJyGoSJmMyZobJOAWn4FSchtNwBs7EWTgbZ+McnItz8R2cjwtwAS7CRbgEl+JSXIbvYQqm4HI8h6m4AlfiKlyNa3A1rsP1uA434ibciFtwC27Dbfghfog7cSfuxt24F/fiR/gRfowf41BMwzQ8iAfxEB7Cw3gYj+ARPIpH8Rgew+N4HE/gCTyJp/A0nsIzeAbP4jk8DwAX8AJexIt4CS+lf/hVOqOMyqQyqQSVoBJVosqqsqrsKruKqZjKqXKqXCqXyq1yq7wqr8qv8quCqqAiRYpVpAqpQiqu4qqIKqKKqqKquCqunHKqlCqlSqvSqowqo8qqm1U5dYsqryqotu5WdauqpNq5yqqKqqqqqmqquqqhaqqaqpaqpWqr2qqOqqPqqrqqnrpP1Vd9cAA2VOmdaayGYRM1HJup5qqFaqlexYdUazUS26i2qp16RI3GUdhBtXYd1eOqkxqPndWTagI+pbqqSdhNPaO6q2dVD/Wc6qnauF6qt5qKfVRfNQP7qf5qgBqo5mB1ld6xGupl9VzmYWq4ekUtwVfVSPWaGqVGqzHqdTVWjVPj1QQ1UU1SyeoNNVm9qaaot9RUNU1NVzPUTDVLzVZvqzlqrpqn3lHz1QK1UC1Si9UStVS9q5ap91SKel8tVx+oVLVCrVSr1Gq1Rq1V69R6tUFtVJvUZrVFbVXb1Hb1odqhdqpdarfao/aqfeojtV99rA6oT1Sa+lQdVH9Rh9Rn6rD6XB1RX6ij6kt1TH2ljquv1Qn1jTqpTqnT6lt1Rn2nzqpz6rz6Xl1QP6iL6kd1SXkFGrXSWhsd6Ew6s07QWXSivkpn1dl0dp1Dx/TVOqe+RufS1+rcOo/Oa/Lp/LqALqhDTdpq1pEupAvruL5OF9HX66K6mC6uS2inS+pS+gZdWt+oy+ibdFl9sy6nb9HldQVd0YO+TVfSt+vKuoququ/Q1XR1XUPX1HfqWvouXVvfrevoe3Rdfa+up+/T9fX9uoFuqBvpB3Rj/aBuopvqZrq5bqFb6lb6Id1aP6zb6La6nX5Et9eP6g76Md1RP6476Sd0Z/2k7qKf0l3107qbfkZ318/qHvpHfUl73Uv31km6j+6rX9D9dH89QA/Ug/SLerB+SQ/RL+uhepgerl/RI/SreqR+TY/So/UY/boeq8fp8XqCnqgn6WT9hp6s39RT9Ft6qp6mp+sZeqaepQf8MtO8/0L+m7+TP+Sns2/T2/WHeofeqXfp3XqP3qv36X16v96vD+gDOk2n6YP6oD6kD+nD+rA+oo/oo/qoPqaP6eP6uD6hT+iT+pT+Xn+rz+jv9Fl9Tp/T3+sL+oK++MvPAAwaZbQxJjCZTGaTYLKYRHOVyWqymewmh4mZq01Oc43JZa41uU0ek9fkM/lNAVPQhIaMNWwiU8gUNnFznSlirjdFTTFT3JQwzpQ0pcwN/+38P6qvlWllWpvWpo1pY9qZdqa9aW86mA6mo+loOplOprPpbLqYLqar6Wq6mW6mu+luepgepqfpaXqZXibJJJm+5gXTz/Q3A8xAM8i8aAabwWaIGWKGmqFmuBluRpgRZqQZaUaZUWaMGWPGmrFmvBlvJpqJJtnnMJPNZDPFTDFTzVQzfVAOM9PMNLPNbDPHzDHzzDwz38w3C81Cs9gsNkvNUrPMLDMpJsUsN8tNqllhVphVZpVZY9aYdWad2WA2mE1mk9litphUs91sNzvMDrPL7DJ7zB6zz+wz+81+c8AcMGkmzRw0B80hc8gcNofNEXPEHDVHzTFzzBw3x80Jc8KcNCfNaXPanDFnzFlz1pw3580Fc8FcNBfNJXMp/bYvUIEKTGCCTEGmICFICBKDxCBrkDXIHmQPYkEsyBnkDHIF1wa5gzxB3iBfkD8oEBQMwoACG3AQBYWCwkE8uC4oElwfFA2KBcWDEoELSgalghuC0sGNQZngpqBscHNQLrglKB9UCCoGtwa3BZWC24PKQZWganBHUC2oHtQIagZ3BrWCu4Lawd1BneCeoG5wb1AvuC+oH9wfNAgaBo2CB4LGwYNBk6Bp0CxoHrQIWgat/tT5vT+b52HXK+wdJoV9wr7hC2G/sH84IBwYDgpfDAeHL4VDwpfDoeGwcHj4SjgifDUcGb4WjgpHh2PC18Ox4bhwfDghnBhOCpPDN8LJ4ZvhlPCtcGo4LZwezAhnhrPC2eHb4ZxwbjgvfCecHy4IF4aLwsXhkhB/viWGlPD9cHn4QZgarghXhqvC1eGacG24Llwfbgg3hpvCzeGWsoN/PjTcEe4Md4W7wz3h3nBf+FG4P/w4PBB+EqaFn4YHw7+Eh8LPwsPh5+GR8IvwaPhleCz8Kjwefh2eCL8JT4anwtPht+GZ8LvwbHguPB9+H14Ifwgvhj+Gl0KffnOffnknQ4YyUSZKoARKpETKSlkpO2WnGMUoJ+WkXJSLclNuykt5KT/lp4JUkNIxMRWiQhSnOBWhIlSUilJxKk6OHJWiUlSaSlMZKkNlqSyVo3JUnspTRapIt9FtdDvdTlWoCt1Bd1B1qk41qSbVolpUm2pTHapDdaku1aN6VJ/qUwNqQI2oETWmxtSEmlAzakYtqAW1olbUmlpTG2pD7agdtaf21IE6UEfqSJ2oE3WmztSFulBX6krdqBt1p+7Ug3pQT+pJvagXJVES9aW+1I/60QAaQINoEA2mwTSEhtBQGkrDaTiNoBE0kkbSKBpNY+h1GkvjaDxNoIk0iZIpmSbTZJpCU2gqTaXpNJ1m0kyaTbNpDs2heTSP5tN8WkgLaTEtpqW0lJbRMkqhFFpOyymVUmklraTVtJrW0lpaT+tpI22kzbSZttJW2k7baQftoF20i/bQHtpH+2g/7acDdIDSKI0O0kE6RIfoMB2mI3SEjtJROkbH6DgdpxN0gk7SSTpNp+kMnaGzdJbO03m6QD/QRfqRLpGnBJvFJtqrbFabzWa3Oexv47w2n81vC9iCNrS5bZ6/islaW9QWs8VtCetsSVvK3vA3cXlbwVa0t9rbbCV7u61sy9ss8B/jWvYuW9vebevYe2xNe+dfxXXtvbaefdDWt01tA9vcNrItbWP7oG1im9pmtrltYVva9vZR28E+Zjvax20n+8TfxMvse3a93WA32k12v/3Ynrff22P2K3vB/mB72d52kH3RDrYv2SFQxQ61wy7H9mU7FMCOsa/bsXacHW8n2Il20t/E0+0MO9POsrPt23aOnfs38VL7rp1vU+xCu8gutkt+itNrSrHv2+X2A5tqV9iVdpVdbdfYtXbd/691ld1it9ptdp/9yO6wO+0uu9vusXt/itPXccB+YtPsp/ao/dIesp/Zw/a4PWK/+ClOX99x+7U9Yb+xJ+0pe9p+a8/Y7+xZe+6n9aev/Vv7o71kvQVGVqzZcMCZODMncBZO5Ks4K2fj7JyDY3w15+RrOBdfy7k5D+flfJyfC3BBDpnYMnPEhbgwx/k6LsLXc1EuxsW5BDsuyaX4Bi7NN3IZvonL8s1cjm/h8lyBK/KtfBtX4tu5MlfhqnwHV+PqXINr8p1ci+/i2nw31+F7uC7fy/X4Pq7P93MDbsiN+AFuzA9yE27Kzbg5t+CW3Iof4tb8MLfhttyOH+H2/Ch34Me4Iz/OnfgJ7sxPchd+irvy09yNn+Hu/Cz34Oe4Jz/Pvbg3J3Ef7ssvcD/uzwN4IA/iF3kwv8RD+GUeysN4OL/CI/hVHsmv8SgezWP4dR7L43g8T+CJPImT+Q2ezG/yFH6Lp/I0ns4zeCbP4tn8Ns/huTyP3+H5vIAX8iJezEt4Kb/Ly/g9TuH3eTl/wKm8glfyKl7Na3gtr+P1vIE38ibezFt4K2/j7fwh7+CdvIt38x7ey/v4I97PH/MB/oTT+FM+yH/hQ/wZH+bP+Qh/wUf5Sz7GX/Fx/ppP8Dd8kk/xaf6Wz/B3fJbP8Xn+ni/wD3yRf+RL7BkijFSkIxMFUaYoc5QQZYkSo6uirFG2KHuUI4pFV0c5o2uiXNG1Ue4oT5Q3yhfljwpEBaMwoshGHEVRoahwFI+ui4pE10dFo2JR8ahE5KKSUanohqh0dGNUJropKhvdHJWLbonKRxWiitGt0W1Rpej2qHJUJaoa3RFVi6pHNaKa0Z1RreiuqHZ0d1QnuicqE90b1Yvui+pH90cNooZRo+iBqHH0YNQkaho1i5pHLaKWUavooah19HDUJmobtYseidpHj0YdoseijtHjUafoicv7iwU/X01/sz8p6hPpX96Q3a0Xx5fEl8bfjS+LvxdPib8fXx7/IJ4aXxFfGV8VXx1fE18bXxdfH98Q3xjfFN8c3xLfGt8W975mZnCY/iAMxgUuk8vsElwWl+iuclldNpfd5XAxd7XL6a5xudy1LrfL4/K6fC6/K+AKutCRs45d5Aq5wi7urnNF3PWuqCvmirsSzrmSrpRr6Vq5Vq61e9i1cW1dO/eIe8Q96h51jyX8Urjr7J50XdxTrqt72j3tnnHd3bOuh3vO9XTPu16ut0tySa6v6+v6uX5ugBvgBrlBbrAb7Ia4IW6oG+qGu+FuhBvhRrqRbpQb5ca4MW6sG+vGu/Fuopvokl2ym+wmuyluipvqprrpbrqb6Wa62W62m+PmuHlunpvv5ruFbqFb7Ba7pW6pW+aWuRSX4pa75S7VpbqVbqVb7Va7tW6tW+/Wu41uo9vsNrutbqvb7ra7HW6H2+V2uT1uj9vn9rn9br874A64NJfmDrqDmQ+5Q+6w+9wdcV+4o+5Ld8x95Y67r90J94076U65087rM+47d9adc+fd9+6C+8FddD+6S8675NgbscmxN2NTYm/FpsamxabHZsRmxmbFZsfejs2JzY3Ni70Tmx9bEFsYWxRbHFsSWxp7N7Ys9l4sJfZ+bHnsg1hqbEVsZWxVbHVsTcz7AjsiX8gX9nF/nS/ir/dFfTFf3Jfwzpf0pfwNvrS/0ZfxN/my/mZfzt/iy/sKvqJv6pv55r6Fb+lb+Yd8a/+wb+Pb+nb+Ed/eP+o7+Md8R/+47+Sf8J39k76Lf8p39U/7bv6ZBb902ff0z/tevrdP8n18X/+C7+f7+wF+oB/kX/SD/Ut+iH/ZD/XD/HD/ih/hX/Uj/Wt+lB/tx/jX/Vg/zo/3E/xEP8kn+zf8ZP+mn+Lf8lP9ND/dz/Az/Sw/27/t5/i5fp5/x8/3C/xCv8gv9kv8Uv+uX+bf8yn+fb/cf+BT/Qq/0q/yq/0av9av8+v9Br/Rb/Kb/Ra/1W/z2/2Hfoff6Xf53X6P3+v3+Y/8fv+xP+A/8Wn+U3/Q/8Uf8p/5w/5zf8R/4Y/6L/0x/5U/7r/2J/w3/qQ/5U/7b/0Z/50/68/58/57f8H/4C/6H/2l3/mbtcz/4jfnQgghhBD/G+k/2N/nd/5P/bKl6wsA2XbmO/LbOTfn/nncX+3vFAOAx3t3a/jr1rBhUlLSL8emaggKLwKA2OX8n75/4Jd4BbSDR6EjtIXSv1tff1Xxp/u+/2z++M0AiQBZfs1JfzxKhN/Of+Pfmb/pu/xH8y8CKFr4ck76iX6NL89f5u/Mv7f9H8yf5bNkgDb/IScrXI4vz18KHoYnoONfHSmEEEIIIYQQQvysv7rQ/Y+eb9Ofz/ObyzmZ4XL8R8/nf6Dyn7EGIYQQQgghhBBC/OeeerbHYw917Ni2y//lQeZ/jzL+DQYIAP8GZcjg339wpX8zCSGEEEIIIf5sl2/6r3QlQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCFExvXPf0OY+i8ffKXXKIQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQlxp/y8AAP///hRVvA==") r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) r1 = open(&(0x7f0000000340)='./file1\x00', 0x86442, 0x10) dup3(r1, r0, 0x0) io_setup(0x91, &(0x7f0000000400)=0x0) io_submit(r2, 0x3f0a, &(0x7f0000000540)=[&(0x7f00000000c0)={0xf04aef, 0x3d8, 0x4, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 425.686899ms ago: executing program 6 (id=56): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x801, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x8}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000081c0)=@deltfilter={0x24, 0x2d, 0x1, 0x70bd2b, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x1, 0x4}, {0x6, 0x2}, {0x0, 0x9}}}, 0x24}, 0x1, 0x0, 0x0, 0x24048001}, 0x0) 289.084526ms ago: executing program 6 (id=57): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000006c0)=ANY=[@ANYBLOB="1201000000000040c41090ea80000000000109022400010000000009040000010300000009210000000122070009058103"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='\x00\"\v'], 0x0}, 0x0) 197.11734ms ago: executing program 1 (id=58): syz_ublk_setup_io_uring(0x187, &(0x7f0000000000)={0x0, 0x1a1c, 0x400, 0x1, 0x3ca}, &(0x7f0000000080)=0x0, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0) syz_ublk_add_dev(0xffffffffffffffff, r0, r1, r2, &(0x7f00000001c0)={0x2e, 0x40, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000180)=@any_dev={0x1, 0x977, 0x0, 0x0, 0x1000, 0xbc, 0x0, 0x0, 0xc0}}}, &(0x7f0000000240)) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="980000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000000010c0002"], 0x98}}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x4000) 105.679804ms ago: executing program 1 (id=59): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000009, 0x12, r0, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) getsockopt$XDP_MMAP_OFFSETS(r1, 0x11b, 0x1, 0x0, &(0x7f0000000080)) 97.683575ms ago: executing program 5 (id=60): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) write$FUSE_INIT(r0, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$int_in(r1, 0x5452, &(0x7f0000000000)=0xfff) 74.384376ms ago: executing program 1 (id=61): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x80) r1 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000200)={@cgroup=r2, r0, 0x12, 0x6}, 0x10) 56.124197ms ago: executing program 1 (id=62): unshare(0x22020600) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) 47.146217ms ago: executing program 5 (id=63): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0) 9.906349ms ago: executing program 5 (id=64): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0xb, &(0x7f0000000040)=0x3, 0x4) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x21}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x1, &(0x7f0000000600)=0x0) io_submit(r2, 0x4a, &(0x7f00000008c0)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x7fff, r1, &(0x7f0000000140)="bf", 0xfd62, 0x0, 0x0, 0x2}]) 0s ago: executing program 1 (id=65): r0 = syz_usb_connect$uac3(0x2, 0x80, &(0x7f0000001840)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x4b4, 0x931f, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x9, 0x10, 0xf9, {0x8, 0xb, 0x2, 0x2, 0x1, 0x25}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xa, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x3, 0x8, 0x28, {0xa, 0x25, 0x25, 0x1, 0x5, 0x2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x30, 0x40, 0xe, 0xb7, {0xa, 0x25, 0x25, 0xffffffff, 0xfc, 0x8}}}}}}}}]}}, &(0x7f0000001b80)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, &(0x7f0000001d00)={0x14, &(0x7f0000001bc0)={0x40, 0xe, 0xaf, {0xaf, 0x11, "f8e8b959a3f7b86636b72005af5e203139564e847dfc2c3043b49a63ff2622a17ebd4f22874e1f8151ae548f944ff691c553bd2ba98b4653291cf87f7337c49c68fd5ee4265d550661bfb648767346dc1fb207b58d325fbc99af433bc63ac826b10c83d5874f49b1db786aa0d0d1c76715aa8332629314e47253072891b905f250ffc508686907b37382fe2dc36115072e72fdfefc92fa6d7b9f5668ddb5102f050a3b43342b6800eefe734337"}}, &(0x7f0000001cc0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c09}}}, 0x0) syz_usb_control_io$uac3(r0, &(0x7f0000002140)={0x14, 0x0, &(0x7f0000002100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x3009}}}, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, &(0x7f0000002800)={'nat\x00', 0x0, 0x0, 0x0, [0x7ff, 0x4, 0x4, 0xffffffffffffffff, 0x9, 0x1]}, &(0x7f0000002880)=0x78) syz_usb_control_io$uac3(r0, &(0x7f0000002bc0)={0x14, 0x0, &(0x7f0000002b00)={0x0, 0x3, 0x36, @string={0x36, 0x3, "cb2bacfaa2c69907fe2487f5e509c28071621f41d138723e1792dc1d915f51cf530af2646ecbaf459635e67a386da631a79f3a70"}}}, 0x0) ioctl$EVIOCGID(0xffffffffffffffff, 0x80084502, 0x0) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 15.215773][ T28] audit: type=1400 audit(1790011187.381:59): avc: denied { transition } for pid=225 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.218991][ T28] audit: type=1400 audit(1790011187.381:60): avc: denied { noatsecure } for pid=225 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.221588][ T28] audit: type=1400 audit(1790011187.381:61): avc: denied { write } for pid=225 comm="sh" path="pipe:[14999]" dev="pipefs" ino=14999 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 15.224510][ T28] audit: type=1400 audit(1790011187.381:62): avc: denied { rlimitinh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.226953][ T28] audit: type=1400 audit(1790011187.381:63): avc: denied { siginh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.233290][ T222] sshd-session (222) used greatest stack depth: 22216 bytes left Warning: Permanently added '10.128.1.102' (ED25519) to the list of known hosts. [ 22.140501][ T28] audit: type=1400 audit(1790011194.311:64): avc: denied { mounton } for pid=279 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.141993][ T279] cgroup: Unknown subsys name 'net' [ 22.163192][ T28] audit: type=1400 audit(1790011194.311:65): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.190435][ T28] audit: type=1400 audit(1790011194.341:66): avc: denied { unmount } for pid=279 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.190578][ T279] cgroup: Unknown subsys name 'devices' [ 22.330425][ T279] cgroup: Unknown subsys name 'hugetlb' [ 22.336022][ T279] cgroup: Unknown subsys name 'rlimit' [ 22.438940][ T28] audit: type=1400 audit(1790011194.611:67): avc: denied { setattr } for pid=279 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.462123][ T28] audit: type=1400 audit(1790011194.611:68): avc: denied { mounton } for pid=279 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.486832][ T28] audit: type=1400 audit(1790011194.611:69): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.505667][ T281] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 22.519367][ T28] audit: type=1400 audit(1790011194.681:70): avc: denied { relabelto } for pid=281 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.544767][ T28] audit: type=1400 audit(1790011194.691:71): avc: denied { write } for pid=281 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.572239][ T28] audit: type=1400 audit(1790011194.741:72): avc: denied { read } for pid=279 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.572631][ T279] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.597739][ T28] audit: type=1400 audit(1790011194.741:73): avc: denied { open } for pid=279 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.314227][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.321321][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.328595][ T287] device bridge_slave_0 entered promiscuous mode [ 23.336792][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.343960][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.351341][ T287] device bridge_slave_1 entered promiscuous mode [ 23.420708][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.427756][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.435118][ T289] device bridge_slave_0 entered promiscuous mode [ 23.454273][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.461405][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.468781][ T291] device bridge_slave_0 entered promiscuous mode [ 23.475462][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.482511][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.489809][ T289] device bridge_slave_1 entered promiscuous mode [ 23.507650][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.514800][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.522198][ T291] device bridge_slave_1 entered promiscuous mode [ 23.539354][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.546482][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.553827][ T290] device bridge_slave_0 entered promiscuous mode [ 23.563341][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.570406][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.577784][ T290] device bridge_slave_1 entered promiscuous mode [ 23.600034][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.607075][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.614426][ T288] device bridge_slave_0 entered promiscuous mode [ 23.623900][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.630963][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.638352][ T288] device bridge_slave_1 entered promiscuous mode [ 23.795363][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.802446][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.812232][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.819281][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.826526][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.833550][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.842138][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.849185][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.856425][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.863447][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.872537][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.879584][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.886828][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.893856][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.935622][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.942685][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.949953][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.956969][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.978431][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.985714][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.993026][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.000232][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.007385][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.014846][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.022113][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.029349][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.036740][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.045020][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.052420][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.071093][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.100138][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.109668][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.117767][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.124802][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.132644][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.140872][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.147905][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.155275][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.163481][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.170507][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.177796][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.186120][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.193142][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.200541][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.208607][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.217033][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.225231][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.232254][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.239689][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.247819][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.254848][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.262209][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.269730][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.277817][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.284843][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.292179][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.300727][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.307752][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.320071][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.328127][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.357073][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.365265][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.373350][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.381580][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.389953][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.397915][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.405885][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.413343][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.420763][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.428700][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.436748][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.445117][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.453366][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.460393][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.467857][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.476146][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.484269][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.491312][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.498716][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.506899][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.514907][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.522923][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.530906][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.538937][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.546906][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.555092][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.573589][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.581942][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.598081][ T288] device veth0_vlan entered promiscuous mode [ 24.604429][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.612712][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.620279][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.627633][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.635952][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.644242][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.652532][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.663899][ T290] device veth0_vlan entered promiscuous mode [ 24.675117][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.683397][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.691857][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.700055][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.707968][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.716102][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.724569][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.732081][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.739559][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.746888][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.759672][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.767977][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.778962][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.788608][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.797086][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.805404][ T289] device veth0_vlan entered promiscuous mode [ 24.813754][ T287] device veth0_vlan entered promiscuous mode [ 24.821144][ T288] device veth1_macvtap entered promiscuous mode [ 24.828056][ T290] device veth1_macvtap entered promiscuous mode [ 24.836269][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.843933][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.851893][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.863679][ T289] device veth1_macvtap entered promiscuous mode [ 24.879335][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.887180][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.894637][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.903130][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.911431][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.919662][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.927433][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.935440][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.943738][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.952215][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.960477][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.968718][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.976194][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.983726][ T291] device veth0_vlan entered promiscuous mode [ 25.000283][ T287] device veth1_macvtap entered promiscuous mode [ 25.016117][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.025162][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.033868][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.033979][ T289] request_module fs-gadgetfs succeeded, but still no fs? [ 25.042348][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.057833][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.066247][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.074603][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.082771][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.090998][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.098538][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.107072][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.125050][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.133336][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.165978][ T291] device veth1_macvtap entered promiscuous mode [ 25.182206][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.190981][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.199552][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.210916][ T319] loop2: detected capacity change from 0 to 512 [ 25.235567][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.246320][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.255305][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.264747][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.285393][ T319] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 25.289742][ T327] loop3: detected capacity change from 0 to 2048 [ 25.309370][ T319] System zones: 1-12 [ 25.330072][ T339] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 25.337889][ T327] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 25.349902][ T319] EXT4-fs error (device loop2): ext4_xattr_inode_iget:401: inode #12: comm syz.2.6: missing EA_INODE flag [ 25.401595][ T319] EXT4-fs error (device loop2): ext4_xattr_inode_iget:406: comm syz.2.6: error while reading EA inode 12 err=-117 [ 25.404741][ T327] ext4 filesystem being mounted at /1/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 25.421806][ T347] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.447452][ T319] EXT4-fs (loop2): 1 orphan inode deleted [ 25.454002][ T288] EXT4-fs (loop3): unmounting filesystem. [ 25.458851][ T319] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 25.581457][ T350] EXT4-fs (loop2): unmounting filesystem. [ 25.737022][ T366] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.744349][ T366] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.752053][ T366] device bridge_slave_0 entered promiscuous mode [ 25.764080][ T366] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.771149][ T366] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.778647][ T366] device bridge_slave_1 entered promiscuous mode [ 25.865320][ T374] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.872464][ T374] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.879992][ T374] device bridge_slave_0 entered promiscuous mode [ 25.886953][ T374] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.894020][ T374] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.901783][ T374] device bridge_slave_1 entered promiscuous mode [ 25.917439][ T366] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.924489][ T366] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.931722][ T366] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.938749][ T366] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.987216][ T374] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.994324][ T374] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.001590][ T374] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.008611][ T374] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.008883][ T6] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 26.025828][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.033355][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.040943][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.048313][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.055686][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.071758][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.079971][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.086984][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.100838][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.109438][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.116481][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.126896][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.136928][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.149140][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.157256][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.164278][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.172319][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.180669][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.187718][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.197497][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.206241][ T6] usb 1-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 26.219624][ T6] usb 1-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 26.233135][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.233298][ T6] usb 1-1: config 0 interface 0 has no altsetting 0 [ 26.247942][ T6] usb 1-1: New USB device found, idVendor=06a3, idProduct=0cd0, bcdDevice= 0.00 [ 26.257200][ T6] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.265981][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.268495][ T6] usb 1-1: config 0 descriptor?? [ 26.274470][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.287368][ T383] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 26.297333][ T366] device veth0_vlan entered promiscuous mode [ 26.311036][ T374] device veth0_vlan entered promiscuous mode [ 26.317344][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.327859][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.335504][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.350367][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.359512][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.367569][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.375656][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.384997][ T351] device bridge_slave_1 left promiscuous mode [ 26.391286][ T351] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.399138][ T351] device bridge_slave_0 left promiscuous mode [ 26.410733][ T351] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.419148][ T351] device veth1_macvtap left promiscuous mode [ 26.425257][ T351] device veth0_vlan left promiscuous mode [ 26.435649][ T392] loop1: detected capacity change from 0 to 128 [ 26.447027][ T392] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 26.471541][ T392] ext4 filesystem being mounted at /6/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 26.507046][ T290] EXT4-fs (loop1): unmounting filesystem. [ 26.529026][ T403] loop1: detected capacity change from 0 to 256 [ 26.536842][ T403] FAT-fs (loop1): Directory bread(block 1285) failed [ 26.543836][ T403] FAT-fs (loop1): Directory bread(block 1286) failed [ 26.551244][ T403] FAT-fs (loop1): Directory bread(block 1287) failed [ 26.557960][ T403] FAT-fs (loop1): Directory bread(block 1288) failed [ 26.568300][ T403] FAT-fs (loop1): Directory bread(block 1285) failed [ 26.575342][ T403] FAT-fs (loop1): Directory bread(block 1286) failed [ 26.582234][ T403] FAT-fs (loop1): Directory bread(block 1287) failed [ 26.589024][ T403] FAT-fs (loop1): Directory bread(block 1288) failed [ 26.603563][ T403] FAT-fs (loop1): Directory bread(block 1285) failed [ 26.606973][ T374] device veth1_macvtap entered promiscuous mode [ 26.616889][ T403] FAT-fs (loop1): Directory bread(block 1286) failed [ 26.623816][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.636246][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.646538][ T366] device veth1_macvtap entered promiscuous mode [ 26.670059][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.681359][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.690179][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.698422][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.710387][ T6] input: HID 06a3:0cd0 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:06A3:0CD0.0001/input/input4 [ 26.732749][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.741114][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.749978][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.758170][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.766925][ T408] device pim6reg1 entered promiscuous mode [ 26.790992][ T6] saitek 0003:06A3:0CD0.0001: input,hiddev96,hidraw0: USB HID v0.00 Device [HID 06a3:0cd0] on usb-dummy_hcd.0-1/input0 [ 26.818933][ T292] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 26.877650][ T417] Illegal XDP return value 4294967274 on prog (id 4) dev syz_tun, expect packet loss! [ 27.033793][ T292] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 27.046074][ T292] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 27.057781][ T292] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 27.081732][ T292] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 27.097403][ T292] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.105553][ T292] usb 5-1: Product: syz [ 27.109779][ T292] usb 5-1: Manufacturer: syz [ 27.115765][ T292] usb 5-1: SerialNumber: syz [ 27.126521][ T400] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 27.150356][ T28] kauditd_printk_skb: 85 callbacks suppressed [ 27.150368][ T28] audit: type=1400 audit(1790011199.321:159): avc: denied { unmount } for pid=290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 27.188261][ T456] xt_hashlimit: size too large, truncated to 1048576 [ 27.234244][ T460] loop5: detected capacity change from 0 to 256 [ 27.251760][ T461] @0Ù: renamed from bond_slave_1 [ 27.285018][ T460] exFAT-fs (loop5): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x196362d4, utbl_chksum : 0xe619d30d) [ 27.317443][ T28] audit: type=1400 audit(1790011199.481:160): avc: denied { write } for pid=459 comm="syz.5.55" name="/" dev="loop5" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 27.340567][ T400] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 27.349605][ T400] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 27.365397][ T460] syz.5.55: attempt to access beyond end of device [ 27.365397][ T460] loop5: rw=0, sector=184, nr_sectors = 4101 limit=256 [ 27.378853][ T28] audit: type=1400 audit(1790011199.521:161): avc: denied { add_name } for pid=459 comm="syz.5.55" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 27.410311][ T28] audit: type=1400 audit(1790011199.521:162): avc: denied { create } for pid=459 comm="syz.5.55" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 27.430793][ T28] audit: type=1400 audit(1790011199.521:163): avc: denied { associate } for pid=459 comm="syz.5.55" name="bus" scontext=root:object_r:unlabeled_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 27.452940][ T28] audit: type=1400 audit(1790011199.521:164): avc: denied { write } for pid=459 comm="syz.5.55" path="/7/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/bus" dev="loop5" ino=1048608 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 27.470792][ T469] netlink: 12 bytes leftover after parsing attributes in process `syz.1.58'. [ 27.501795][ T28] audit: type=1400 audit(1790011199.531:165): avc: denied { append } for pid=459 comm="syz.5.55" name="file1" dev="loop5" ino=1048609 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 27.507351][ T469] netlink: 8 bytes leftover after parsing attributes in process `syz.1.58'. [ 27.529214][ T28] audit: type=1400 audit(1790011199.641:166): avc: denied { create } for pid=468 comm="syz.1.58" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 27.566553][ T28] audit: type=1400 audit(1790011199.641:167): avc: denied { write } for pid=468 comm="syz.1.58" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 27.584203][ T19] usb 1-1: USB disconnect, device number 2 [ 27.598598][ T28] audit: type=1400 audit(1790011199.761:168): avc: denied { create } for pid=470 comm="syz.1.59" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 27.630756][ T351] device bridge_slave_1 left promiscuous mode [ 27.638997][ T351] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.661567][ T351] device bridge_slave_0 left promiscuous mode [ 27.667783][ T351] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.677904][ T351] device veth1_macvtap left promiscuous mode [ 27.688710][ T351] device veth0_vlan left promiscuous mode [ 27.708836][ T39] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 27.813489][ T482] ================================================================== [ 27.821585][ T482] BUG: KASAN: use-after-free in rcu_segcblist_enqueue+0x9c/0xb0 [ 27.829237][ T482] Write of size 8 at addr ffff8881181b7d90 by task syz.5.63/482 [ 27.836851][ T482] [ 27.839184][ T482] CPU: 1 PID: 482 Comm: syz.5.63 Not tainted syzkaller #0 [ 27.846285][ T482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 27.856334][ T482] Call Trace: [ 27.859618][ T482] [ 27.862536][ T482] __dump_stack+0x21/0x24 [ 27.866865][ T482] dump_stack_lvl+0x110/0x170 [ 27.871531][ T482] ? __cfi_dump_stack_lvl+0x8/0x8 [ 27.876561][ T482] ? rcu_segcblist_enqueue+0x9c/0xb0 [ 27.881855][ T482] print_address_description+0x71/0x200 [ 27.887396][ T482] print_report+0x4a/0x60 [ 27.891725][ T482] kasan_report+0x122/0x150 [ 27.896221][ T482] ? rcu_segcblist_enqueue+0x9c/0xb0 [ 27.901496][ T482] __asan_report_store8_noabort+0x17/0x20 [ 27.907218][ T482] rcu_segcblist_enqueue+0x9c/0xb0 [ 27.912328][ T482] call_rcu+0x554/0xf50 [ 27.916505][ T482] ? __cfi_call_rcu+0x10/0x10 [ 27.921190][ T482] ? __kasan_check_write+0x14/0x20 [ 27.926300][ T482] ? selinux_inode_free_security+0x21f/0x230 [ 27.932266][ T482] security_inode_free+0xc5/0xe0 [ 27.937204][ T482] __destroy_inode+0x175/0x500 [ 27.941983][ T482] evict+0x777/0x8c0 [ 27.945882][ T482] ? asm_sysvec_reschedule_ipi+0x1b/0x20 [ 27.951499][ T482] ? proc_nr_inodes+0x2f0/0x2f0 [ 27.956336][ T482] ? _raw_spin_lock+0x94/0xf0 [ 27.961004][ T482] ? __cfi__raw_spin_lock+0x10/0x10 [ 27.966195][ T482] ? call_rcu+0xbed/0xf50 [ 27.968847][ T6] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 27.970518][ T482] ? __kasan_check_write+0x14/0x20 [ 27.983052][ T482] iput+0x633/0x690 [ 27.986850][ T482] dentry_unlink_inode+0x346/0x3f0 [ 27.991950][ T482] __dentry_kill+0x46c/0x680 [ 27.996539][ T482] dentry_kill+0xc0/0x2a0 [ 28.000852][ T482] dput+0x42/0x80 [ 28.004478][ T482] __fput+0x5c0/0x8f0 [ 28.008459][ T482] ____fput+0x15/0x20 [ 28.012443][ T482] task_work_run+0x1e1/0x250 [ 28.017033][ T482] ? __cfi_task_work_run+0x10/0x10 [ 28.022143][ T482] ? free_nsproxy+0x21f/0x270 [ 28.026821][ T482] do_exit+0xb0d/0x29f0 [ 28.030983][ T482] ? __cfi_do_exit+0x10/0x10 [ 28.035578][ T482] ? xfd_validate_state+0x70/0x150 [ 28.040677][ T482] ? __kasan_check_write+0x14/0x20 [ 28.045784][ T482] __x64_sys_exit+0x40/0x40 [ 28.050295][ T482] x64_sys_call+0x67/0x9a0 [ 28.054720][ T482] do_syscall_64+0x4c/0xa0 [ 28.059135][ T482] ? clear_bhb_loop+0x30/0x80 [ 28.063813][ T482] ? clear_bhb_loop+0x30/0x80 [ 28.068474][ T482] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 28.074362][ T482] RIP: 0033:0x7f7016d9e159 [ 28.078775][ T482] Code: Unable to access opcode bytes at 0x7f7016d9e12f. [ 28.085813][ T482] RSP: 002b:00007f7017c9fef8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 28.094226][ T482] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007f7016d9e159 [ 28.102195][ T482] RDX: 00007f7017ca09c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 28.110163][ T482] RBP: 00007f7016e3506b R08: 0000000000000000 R09: 0000000000000058 [ 28.118133][ T482] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 28.126092][ T482] R13: 00007f7017026038 R14: 00007f7017025fa0 R15: 00007ffcc0e25bd8 [ 28.134063][ T482] [ 28.137076][ T482] [ 28.139410][ T482] Allocated by task 478: [ 28.143638][ T482] kasan_set_track+0x4b/0x70 [ 28.148210][ T482] kasan_save_alloc_info+0x1f/0x30 [ 28.149947][ T6] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 4 [ 28.153302][ T482] __kasan_kmalloc+0x95/0xb0 [ 28.153326][ T482] __kmalloc+0xb4/0x1e0 [ 28.165806][ T6] usb 2-1: New USB device found, idVendor=04b4, idProduct=931f, bcdDevice= 0.40 [ 28.168826][ T482] l2tp_session_create+0x38/0xbd0 [ 28.168848][ T482] pppol2tp_connect+0xbf5/0x1640 [ 28.168865][ T482] __sys_connect+0x3da/0x460 [ 28.168882][ T482] __x64_sys_connect+0x7a/0x90 [ 28.174811][ T6] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.182015][ T482] x64_sys_call+0x88d/0x9a0 [ 28.182038][ T482] do_syscall_64+0x4c/0xa0 [ 28.182056][ T482] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 28.182073][ T482] [ 28.182077][ T482] Freed by task 320: [ 28.187483][ T6] usb 2-1: Product: syz [ 28.191988][ T482] kasan_set_track+0x4b/0x70 [ 28.192009][ T482] kasan_save_free_info+0x2b/0x40 [ 28.192022][ T482] ____kasan_slab_free+0x132/0x180 [ 28.192039][ T482] __kasan_slab_free+0x11/0x20 [ 28.196894][ T6] usb 2-1: Manufacturer: syz [ 28.201342][ T482] slab_free_freelist_hook+0xc2/0x190 [ 28.201360][ T482] __kmem_cache_free+0xb7/0x1b0 [ 28.201379][ T482] kfree+0x6f/0xf0 [ 28.201392][ T482] l2tp_session_put+0xaf/0x1a0 [ 28.209780][ T6] usb 2-1: SerialNumber: syz [ 28.213847][ T482] l2tp_session_delete+0x3df/0x4d0 [ 28.213870][ T482] l2tp_tunnel_del_work+0x199/0x410 [ 28.291760][ T482] process_one_work+0x717/0xc30 [ 28.296604][ T482] worker_thread+0xa4d/0x11d0 [ 28.301269][ T482] kthread+0x281/0x320 [ 28.305324][ T482] ret_from_fork+0x1f/0x30 [ 28.309724][ T482] [ 28.312028][ T482] Last potentially related work creation: [ 28.317717][ T482] kasan_save_stack+0x3a/0x60 [ 28.322378][ T482] __kasan_record_aux_stack+0xb6/0xc0 [ 28.327735][ T482] kasan_record_aux_stack_noalloc+0xb/0x10 [ 28.333522][ T482] call_rcu+0xcf/0xf50 [ 28.337575][ T482] pppol2tp_release+0x1e3/0x2b0 [ 28.342415][ T482] sock_close+0xc9/0x220 [ 28.346640][ T482] __fput+0x1fd/0x8f0 [ 28.350605][ T482] ____fput+0x15/0x20 [ 28.354570][ T482] task_work_run+0x1e1/0x250 [ 28.359150][ T482] do_exit+0xb0d/0x29f0 [ 28.363288][ T482] __cfi___ia32_sys_exit+0x0/0x10 [ 28.368294][ T482] x64_sys_call+0x67/0x9a0 [ 28.372692][ T482] do_syscall_64+0x4c/0xa0 [ 28.377095][ T482] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 28.382969][ T482] [ 28.385273][ T482] The buggy address belongs to the object at ffff8881181b7c00 [ 28.385273][ T482] which belongs to the cache kmalloc-512 of size 512 [ 28.399303][ T482] The buggy address is located 400 bytes inside of [ 28.399303][ T482] 512-byte region [ffff8881181b7c00, ffff8881181b7e00) [ 28.412556][ T482] [ 28.414865][ T482] The buggy address belongs to the physical page: [ 28.421251][ T482] page:ffffea0004606d00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1181b4 [ 28.431480][ T482] head:ffffea0004606d00 order:2 compound_mapcount:0 compound_pincount:0 [ 28.439779][ T482] flags: 0x4000000000010200(slab|head|zone=1) [ 28.445839][ T482] raw: 4000000000010200 0000000000000000 dead000000000001 ffff888100042f00 [ 28.454410][ T482] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 28.462966][ T482] page dumped because: kasan: bad access detected [ 28.469357][ T482] page_owner tracks the page as allocated [ 28.475045][ T482] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 109, tgid 109 (udevd), ts 5151215465, free_ts 0 [ 28.494643][ T482] post_alloc_hook+0x1f5/0x210 [ 28.499397][ T482] prep_new_page+0x1c/0x110 [ 28.503880][ T482] get_page_from_freelist+0x2ca9/0x2d20 [ 28.509406][ T482] __alloc_pages+0x1fa/0x610 [ 28.513980][ T482] alloc_slab_page+0x6e/0xf0 [ 28.518548][ T482] new_slab+0x98/0x3e0 [ 28.522599][ T482] ___slab_alloc+0x70f/0xb70 [ 28.527173][ T482] __slab_alloc+0x5e/0xa0 [ 28.531488][ T482] __kmem_cache_alloc_node+0x204/0x2d0 [ 28.536930][ T482] __kmalloc_node_track_caller+0xa1/0x1e0 [ 28.542628][ T482] __alloc_skb+0x226/0x4a0 [ 28.547114][ T482] alloc_skb_with_frags+0xa8/0x620 [ 28.552206][ T482] sock_alloc_send_pskb+0x87f/0x9a0 [ 28.557391][ T482] unix_dgram_sendmsg+0x5c1/0x1710 [ 28.562483][ T482] sock_write_iter+0x2ea/0x3f0 [ 28.567226][ T482] vfs_write+0x5ef/0xd00 [ 28.571452][ T482] page_owner free stack trace missing [ 28.576805][ T482] [ 28.579137][ T482] Memory state around the buggy address: [ 28.584745][ T482] ffff8881181b7c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.592781][ T482] ffff8881181b7d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.600820][ T482] >ffff8881181b7d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.608858][ T482] ^ [ 28.613425][ T482] ffff8881181b7e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.621464][ T482] ffff8881181b7e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.629498][ T482] ================================================================== [ 28.637533][ T482] Disabling lock debugging due to kernel taint [ 28.645726][ T490] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 28.658689][ T490] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 28.679904][ T39] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 28.691207][ T39] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 28.701082][ T39] usb 7-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 28.710156][ T39] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.719186][ T39] usb 7-1: config 0 descriptor?? [ 28.867570][ T292] cdc_ncm 5-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 28.874084][ T292] cdc_ncm 5-1:1.0: setting tx_max = 16384 [ 28.930313][ T39] usbhid 7-1:0.0: can't add hid device: -71 [ 28.936290][ T39] usbhid: probe of 7-1:0.0 failed with error -71 [ 28.943513][ T39] usb 7-1: USB disconnect, device number 2 [ 29.049884][ T6] usb 2-1: Audio class v2/v3 interfaces need an interface association [ 29.059509][ T6] snd-usb-audio: probe of 2-1:1.0 failed with error -22 [ 29.069780][ T292] cdc_ncm 5-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.4-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 29.086314][ T401] udevd[401]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 29.102734][ T292] usb 5-1: USB disconnect, device number 2 [ 29.108781][ T292] cdc_ncm 5-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.4-1, CDC NCM (NO ZLP) [ 29.280991][ T19] usb 2-1: USB disconnect, device number 2 [ 29.548862][ T39] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 29.729898][ T39] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 29.741101][ T39] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 29.750880][ T39] usb 7-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 29.759944][ T39] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.768487][ T39] usb 7-1: config 0 descriptor?? [ 30.175750][ T39] cp2112 0003:10C4:EA90.0002: unknown main item tag 0x0 [ 30.182821][ T39] cp2112 0003:10C4:EA90.0002: unknown main item tag 0x0 [ 30.189777][ T39] cp2112 0003:10C4:EA90.0002: unknown main item tag 0x0 [ 30.196711][ T39] cp2112 0003:10C4:EA90.0002: unknown main item tag 0x0 [ 30.203675][ T39] cp2112 0003:10C4:EA90.0002: unknown main item tag 0x0 [ 30.210656][ T39] cp2112 0003:10C4:EA90.0002: unknown main item tag 0x0 [ 30.217577][ T39] cp2112 0003:10C4:EA90.0002: unknown main item tag 0x0 [ 30.225327][ T39] cp2112 0003:10C4:EA90.0002: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.6-1/input0 [ 30.375645][ T39] cp2112 0003:10C4:EA90.0002: error requesting version [ 30.383505][ T39] cp2112: probe of 0003:10C4:EA90.0002 failed with error -71 [ 30.392134][ T39] usb 7-1: USB disconnect, device number 3 [ 30.405768][ T520] fido_id[520]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.6/usb7/7-1/report_descriptor': No such file or directory