last executing test programs: 5.214529196s ago: executing program 0 (id=83): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_PAUSE_GET(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000600)=ANY=[@ANYRES16=r0, @ANYBLOB="476174eb3eef0089da3b1d258b96c66c81d382abf2f3a10143e27109d0ea", @ANYRES64=r1], 0x2c}, 0x1, 0x0, 0x0, 0x2000844}, 0x880) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'team_slave_1\x00', 0x0}) (async, rerun: 32) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000380)=""/8, 0x21d000, 0x1000, 0x2}, 0x20) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000001c0)={'gre0\x00', 0x0}) (async, rerun: 64) setsockopt$XDP_UMEM_COMPLETION_RING(r3, 0x11b, 0x6, &(0x7f0000000180)=0x122, 0x4) (async, rerun: 64) setsockopt$XDP_TX_RING(r3, 0x11b, 0x3, &(0x7f0000000200)=0x10000, 0x4) (async) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4) bind$xdp(r3, &(0x7f0000000100)={0x2c, 0x0, r5, 0x2000000}, 0x10) sendmsg$ETHTOOL_MSG_PAUSE_SET(r0, &(0x7f0000000540)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00', @ANYRES16, @ANYBLOB="10002cbd7000ffdbdf25160000ec040003f8000000000500041c0900000005000400200000000c00018062000100", @ANYRES32=r5, @ANYRES8=0x0], 0x38}, 0x1, 0x0, 0x0, 0x40885}, 0x48001) (async) bind$xdp(r3, &(0x7f00000003c0)={0x2c, 0x8, r2, 0x14}, 0x10) (async) r6 = socket$inet6(0xa, 0x6, 0x2000006) socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 64) connect$inet6(r6, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x31}, 0x8}, 0x1c) (async, rerun: 64) connect$inet6(r6, &(0x7f0000000000)={0xa, 0x4e65, 0xfffffffc, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c) syz_open_procfs(0x0, &(0x7f0000001080)='net\x00') (async) r7 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r7, 0x8946, &(0x7f00000000c0)={'batadv_slave_1\x00', &(0x7f0000000240)=@ethtool_wolinfo={0x6, 0x416, 0x0, "aae939a34103"}}) (async) fsopen(&(0x7f0000000040)='fuseblk\x00', 0x0) (async) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x8, 0x4, 0x7, 0x7ffc0004}]}) (async) r9 = socket(0x1, 0x2, 0xfffffffc) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r10, r10) futimesat(r8, 0x0, &(0x7f0000000280)={{0x0, 0xea60}}) (async) r11 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000002c0), 0x200101, 0x0) fsconfig$FSCONFIG_SET_STRING(r11, 0x1, &(0x7f0000000480)='{R\v\f\ra&K\xc8\xael\xc9\x9eG\x9c:\'\xff\xc5\x00', 0xfffffffffffffffe, 0x0) (async) getdents64(r11, &(0x7f0000000340)=""/35, 0x23) 5.146795977s ago: executing program 0 (id=84): r0 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0xa, 0x1234, 0x0, @loopback={0x0, 0xac14140a}}, 0x1c) 5.146566767s ago: executing program 0 (id=85): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f00000029c0)={@ptr={0x77622a85, 0x1, 0x0, 0x0, 0x1, 0x3c}, @ptr={0x73622a85, 0x0, 0x0, 0x0, 0x4, 0xb}, @fda={0x66646185, 0x7, 0x2, 0x1b}}, &(0x7f0000000280)={0x0, 0x28, 0x50}}, 0x400}], 0xd, 0x0, 0x0}) 5.095152608s ago: executing program 0 (id=86): sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000540)=ANY=[@ANYRESDEC, @ANYRES8=0x0, @ANYRESHEX, @ANYRES64, @ANYRESHEX], 0x20}], 0x1}, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201500285d5c2086004040031960154030109021b000100031003090458080119662194090586d757b7"], 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000140)={0xcf47, 0x19, 0x7, 0x9dff, 0x7, "8003e3ffff072000"}) write$binfmt_aout(r0, &(0x7f0000000140)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x3, 0x7fff, 0x16, "b0bf2ebb48c849ac0000000003000018bfff40"}) r1 = syz_open_pts(r0, 0x200) r2 = dup3(r1, r0, 0x0) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000000)=0xff) socket$inet6_udp(0xa, 0x2, 0x0) recvfrom$inet(0xffffffffffffffff, 0x0, 0x0, 0x720, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0) write(r5, &(0x7f0000000400)='dummy_udc.0', 0xb) r6 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0) write(r6, &(0x7f0000000400)='dummy_udc.0', 0xb) r7 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) ioctl$KVM_SET_VCPU_EVENTS(r7, 0x4040aea0, &(0x7f0000000140)=@x86={0x6, 0x0, 0x8, 0x0, 0x4, 0x8, 0x6, 0xb, 0x83, 0xe, 0x5, 0xa, 0x0, 0x101, 0x27, 0x1, 0x0, 0x0, 0x0, '\x00', 0xff, 0x100000d}) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup(r8) syz_ublk_setup_io_uring(0x742, &(0x7f0000000040)={0x0, 0x81a4, 0x80, 0x2, 0x4c}, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f00000001c0)) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x60001, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) write$tun(r10, &(0x7f0000000380)=ANY=[@ANYBLOB="080086dd0001280004000003a60c6eec00be00442ffffe800000000088fc70738daf7b3200aaff020000000000000000000000000001042086dda46e"], 0xfdef) 3.282032465s ago: executing program 1 (id=92): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000003280)={0x73622a85, 0x100b, 0x4}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@acquire], 0xffffffffffffff47, 0x0, 0x0}) dup3(r1, r0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000540)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0xfffffffffffffffd}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0xffffffffffffff67, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000940)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x200000000000000, 0x0, 0x10, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000400)={@ptr={0x66642a85, 0x0, 0x0, 0x0, 0x80000001, 0x3e}, @ptr={0x70742a85, 0x20000000, &(0x7f0000000580)=""/226, 0xe2, 0x1, 0x26}, @fda={0x66646185, 0x9, 0x1, 0xb4}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1040}], 0x0, 0x0, 0x0}) 3.273121256s ago: executing program 1 (id=93): r0 = syz_usb_connect$midi(0x5, 0x31, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200eaff1f8205010103900409040000010103200309058d0320027ffaf804250100000000000000000000930000"], 0x0) syz_usb_control_io(r0, &(0x7f0000000280)={0x2c, &(0x7f0000000000)={0x40, 0x2, 0xe4, {0xe4, 0x11, "a0884719cd50869758478b731cb3d1cef843920727c127aa633d7dfe1d44b7f6fe22c2c6147bf2816cb70a39e9d63e3b159c4a6a2d1e23cfbbf485d08cea2b88ae41303dcd52b9df315a108a0e058099371e60eb55b893b5bb0816f414f48221b14ff9bf039351e87a49ba76d689d91c985c82b0a897c5f2d5e99b53eb18ba9e61ca01d1e859899f1720a0f65fe02953a2f88dedf97cb57b4e9cd93091645c79c97efbe455e4146953140d2a80020e0847c8fb3ca99d556664e48bb5a510b5d57f566c18ed55e0e04ca7c4cc2874faf4a22b28cb239c79bca1c04e8484188258ea1e"}}, &(0x7f0000000100)={0x0, 0x3, 0xae, @string={0xae, 0x3, "2bcc63ac377810419a5087f86313ebc0ffc6ab05883f657f115ea0e4eb3a7d3479664c48394e3f779167efd2b803928933bfefe6406f2cfdba93fff6923d89921062e3af7b2aa7294e661f19434c2f13dde833adb6e945c19b075fb3f0a30abceae11aa96947d766fa917ff254a7ac1eef0ef59f11183307461d58e1e6484893c5af288bd3fd2740f58dd9efe0bfb801be49d2df34535eb311b6afa9bec7a839652f791330723fd3a8adccb0"}}, &(0x7f00000001c0)={0x0, 0xf, 0xc, {0x5, 0xf, 0xc, 0x1, [@ext_cap={0x7, 0x10, 0x2, 0x8, 0x1, 0x6, 0x8}]}}, &(0x7f0000000200)={0x20, 0x29, 0xf, {0xf, 0x29, 0x4, 0x2, 0x5, 0xf7, "e862b28a", "4d31dd70"}}, &(0x7f0000000240)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x9, 0x18, 0xf, 0x71, 0x7}}}, &(0x7f00000007c0)={0x84, &(0x7f0000000340)={0x20, 0x5b8bf603ea07ef55, 0xa0, "4d6e1f3d860fbd44c68ace452a4c20e2bf09c21862ecca859c10de13c01267f0561f6ae88f7f8109dedac463945e605deed53d63aa9e598bec3a2ad18cfe7736e84e3e2624be8d2bf14ec9ebd68c3df416de41b86d606584813db62d28138ce8d399f7706bf6b612baaa0682d999c0a52e4476379969bbc5ea01ff8aaf6009a770f2f7032c27a817b41e3e1850a0045cb2396e75530cc90a9299c9ad0019d7dc"}, &(0x7f0000000400)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000440)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x1}}, &(0x7f00000004c0)={0x20, 0x0, 0x8, {0x8, 0x0, [0x0]}}, &(0x7f0000000500)={0x40, 0x7, 0x2, 0xa251}, &(0x7f0000000540)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "0cee"}, &(0x7f00000005c0)={0x40, 0xf, 0x2, 0xb}, &(0x7f0000000600)={0x40, 0x13, 0x6, @remote}, &(0x7f0000000640)={0x40, 0x17, 0x6}, &(0x7f0000000680)={0x40, 0x19, 0x2, '\tJ'}, &(0x7f00000006c0)={0x40, 0x1a, 0x2, 0x5}, &(0x7f0000000700)={0x40, 0x1c, 0x1, 0x81}, &(0x7f0000000740)={0x40, 0x1e, 0x1, 0xd}, &(0x7f0000000780)={0x40, 0x21, 0x1}}) syz_usb_connect$midi(0x5, 0x31, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200eaff1f8205010103900409040000010103200309058d0320027ffaf804250100000000000000000000930000"], 0x0) (async) syz_usb_control_io(r0, &(0x7f0000000280)={0x2c, &(0x7f0000000000)={0x40, 0x2, 0xe4, {0xe4, 0x11, "a0884719cd50869758478b731cb3d1cef843920727c127aa633d7dfe1d44b7f6fe22c2c6147bf2816cb70a39e9d63e3b159c4a6a2d1e23cfbbf485d08cea2b88ae41303dcd52b9df315a108a0e058099371e60eb55b893b5bb0816f414f48221b14ff9bf039351e87a49ba76d689d91c985c82b0a897c5f2d5e99b53eb18ba9e61ca01d1e859899f1720a0f65fe02953a2f88dedf97cb57b4e9cd93091645c79c97efbe455e4146953140d2a80020e0847c8fb3ca99d556664e48bb5a510b5d57f566c18ed55e0e04ca7c4cc2874faf4a22b28cb239c79bca1c04e8484188258ea1e"}}, &(0x7f0000000100)={0x0, 0x3, 0xae, @string={0xae, 0x3, "2bcc63ac377810419a5087f86313ebc0ffc6ab05883f657f115ea0e4eb3a7d3479664c48394e3f779167efd2b803928933bfefe6406f2cfdba93fff6923d89921062e3af7b2aa7294e661f19434c2f13dde833adb6e945c19b075fb3f0a30abceae11aa96947d766fa917ff254a7ac1eef0ef59f11183307461d58e1e6484893c5af288bd3fd2740f58dd9efe0bfb801be49d2df34535eb311b6afa9bec7a839652f791330723fd3a8adccb0"}}, &(0x7f00000001c0)={0x0, 0xf, 0xc, {0x5, 0xf, 0xc, 0x1, [@ext_cap={0x7, 0x10, 0x2, 0x8, 0x1, 0x6, 0x8}]}}, &(0x7f0000000200)={0x20, 0x29, 0xf, {0xf, 0x29, 0x4, 0x2, 0x5, 0xf7, "e862b28a", "4d31dd70"}}, &(0x7f0000000240)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x9, 0x18, 0xf, 0x71, 0x7}}}, &(0x7f00000007c0)={0x84, &(0x7f0000000340)={0x20, 0x5b8bf603ea07ef55, 0xa0, "4d6e1f3d860fbd44c68ace452a4c20e2bf09c21862ecca859c10de13c01267f0561f6ae88f7f8109dedac463945e605deed53d63aa9e598bec3a2ad18cfe7736e84e3e2624be8d2bf14ec9ebd68c3df416de41b86d606584813db62d28138ce8d399f7706bf6b612baaa0682d999c0a52e4476379969bbc5ea01ff8aaf6009a770f2f7032c27a817b41e3e1850a0045cb2396e75530cc90a9299c9ad0019d7dc"}, &(0x7f0000000400)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000440)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x1}}, &(0x7f00000004c0)={0x20, 0x0, 0x8, {0x8, 0x0, [0x0]}}, &(0x7f0000000500)={0x40, 0x7, 0x2, 0xa251}, &(0x7f0000000540)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "0cee"}, &(0x7f00000005c0)={0x40, 0xf, 0x2, 0xb}, &(0x7f0000000600)={0x40, 0x13, 0x6, @remote}, &(0x7f0000000640)={0x40, 0x17, 0x6}, &(0x7f0000000680)={0x40, 0x19, 0x2, '\tJ'}, &(0x7f00000006c0)={0x40, 0x1a, 0x2, 0x5}, &(0x7f0000000700)={0x40, 0x1c, 0x1, 0x81}, &(0x7f0000000740)={0x40, 0x1e, 0x1, 0xd}, &(0x7f0000000780)={0x40, 0x21, 0x1}}) (async) 1.829101423s ago: executing program 0 (id=109): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x48, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x110a, 0x1}, @flat=@weak_binder={0x77622a85, 0x1, 0x2}, @flat=@weak_binder={0x77622a85, 0x1001, 0x2}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 1.715680315s ago: executing program 0 (id=110): r0 = syz_usb_connect(0x5, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000092ecc620ac0500773aeb010203010902240001000020000904c40102fffd0180090502021002020000"], 0x0) syz_usb_control_io$uac1(r0, &(0x7f0000000000)={0x14, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0003060000000603"]}, 0x0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x0, {0x7, 0x1f, 0x0, 0x3481cc60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}}, 0x50) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x0, 0x0, {0x0, 0x1a}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x80101, 0x101) dup2(r1, 0xffffffffffffffff) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000340)={0x1c, &(0x7f0000000080)=ANY=[@ANYBLOB="196406"], 0x0, 0x0}) 818.315849ms ago: executing program 2 (id=125): openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) timer_create(0x2, &(0x7f00000002c0)={0x0, 0x2a, 0x4, @thr={&(0x7f00000000c0)="07897794fd010e845e53fcd5d5a432bda5d357440bc0bf164c379674305f2bd186fb34cf15a907e0ccfc180a8c2b8a786cce7fb1d46e51624655f9fb9ce2f0a38e7892d6085adfbc6911eeb1c1d69b159ff1f8fff165476fc8a88e8e1fc68abf60996fae16dca236b7a64f6869a5fd32b0c98583226fe959bcf0d98d6a233268d4beeade17bff01ca51f02437810aa639543a8517db0c4e4e55778d575234616333b6de577d367d65b88a8d951270f75a8f6dcaf560574d5e074e86115316a3490a69f9464722b487ea060f0195dfd605b081071ec6f94f20a312cd797ad3caee033", &(0x7f00000001c0)="d83a7bbe97f8b9bec357b999a16ac44bfbae9c7b8b83bc42935859c90380703b4ef4ce90e7ae582cac6e4d92b19854390f3346a9d1fae67d969ad6a7515208a05cc123953a05f3f6aa17db33f814f897e1f6e0319544916796497c7c6ee8a050340c38ac8df5b9e7474cbabe4ad52ce27499fec11f76e398f660c89b2ece9cef799b7439f310e006db0f04ed7a39171f113f17ebd550503a36c781bd8234068727f8a6d974bd02133b224f825a3898dc9dff8de79dd364456a03a631bc19c376315154daa75fe83e6d1b2baef4397b3f9682bd36e0d744c2"}}, &(0x7f0000000300)) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$XFS_IOC_GETBMAPX(r0, 0xc0205838, &(0x7f0000000000)={0x38f14cfb, 0xd657, 0x40, 0x2, 0x81, 0x8, 0x1}) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000600), 0xffffffffffffffff) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000003b00)=ANY=[@ANYBLOB="20100000180001000000000000000000020000000800000004000000040012"], 0x1020}}, 0x0) sendmsg$WG_CMD_GET_DEVICE(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)={0x14, r1, 0x301, 0x70bd2c, 0x25dfdbfd}, 0x14}}, 0x20040000) 793.0625ms ago: executing program 2 (id=126): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000200)={0x700, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="020d000014000000f0ffffff0000000005000600000000000a0080ff00000000fc0100000000000000ffffffff00000000000000000000000500050080ffffff0a00000000000000000000000000000000000000000008000000000000000000080012"], 0xa0}}, 0x20009800) 736.677581ms ago: executing program 2 (id=127): r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000000)={r0, 0x7fffffffffffffff, 0x7fffffff, 0x1}) sendmsg$netlink(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="b4000000110001000200fffef6dbdf256500000013", @ANYBLOB], 0xb4}], 0x1}, 0x0) 736.382321ms ago: executing program 2 (id=128): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mount$tmpfs(0x0, 0x0, &(0x7f0000000180), 0x88, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) getsockopt$inet_buf(r2, 0x0, 0x30, 0x0, &(0x7f0000000180)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x3938700}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = open(&(0x7f0000000000)='./bus\x00', 0x141b42, 0x8) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r6, 0x0, r5, 0x0, 0x8, 0x0) splice(r3, 0x0, r7, 0x0, 0x80, 0x8) mprotect(&(0x7f00000dc000/0x1000)=nil, 0x1000, 0x1000001) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) r8 = timerfd_create(0x8, 0x80000) capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000200)={0x200002, 0x200003, 0x801, 0x4, 0x7}) timerfd_settime(r8, 0x3, &(0x7f0000000040)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) write$tun(r4, &(0x7f00000033c0)=ANY=[], 0x107c) 576.279045ms ago: executing program 2 (id=132): mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c8) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100), 0x214001, &(0x7f0000000080)={[{@uuid_on}], [], 0x2c}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000140)={'sit0\x00', &(0x7f00000002c0)=@ethtool_pauseparam={0x13, 0x9, 0x7f, 0x1}}) syz_usb_connect$uac2(0x0, 0x98, &(0x7f0000000200)=ANY=[@ANYBLOB="12011059000000083512028040000102030109028600030180e007080b0101010a010120000924010200032600c511240806060000020002000200feff03000c2403fd0004a80206f9ff0a09040100000102200009040101010102200009050109400005040008250181090902000904020000cbe3da4ffc9114b9010102200009058209ff0305040208250183000a020000000000000000c2079436aba478279e2d4e5d2bf94b8f84eb147f4d12556d0c3b23fb92dddc35844fd529db9ad8d9cb0e01b873b63f817f18b17c48b1d23ab9f05507cd96a3258815eeee2b4df4649d342936de6103ce4e0b66e0e5a66b302050bb6af13bd8e1e6f0b2c1ae6ff7308c68324893eaf69a22a49108d7fb2eb943b6e2878682e1aae905b8fe44c475587e401cbd987506452f83016e30b5b09bfdd163faa9ff099400368e04d0cc5dfba596be112119206d7cf91708d673e77cdade2a45ecd4c02b2c9ac44f696652dca2adc757f73c1b342298fee4f9060c324cd4ce903a1123dba91c9df17a09ded786d1585f275a06155d6488ee061a50dbd5fc9e6883f6ef351be9c457"], 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x13e) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000001280)={&(0x7f0000001180)={0x20, r3, 0x1, 0x70bd27, 0x25dfdbfe, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x7}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x400c000}, 0x4000000) write$tun(r0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000fbfb633c429901e4210000000000000000000000ffff0a01010200000000000000000000000000000000030b000000000000c20400000001010900000000000020000007200000000306ff000004000000000000000800000000000000de0000000000000005020003000100071000000000020503000600000000000000c910fe88000000000000000000000000010100002b08000000000000c910fe880000000000000000000000000101c204fffffffd0401050718000000000407dc00f6ffffff26e4f28630667e86e72f6e7bb4a0ffffffff0300000000000000c20400000078010400000000000000000000002b0602010000000000000000000000000000000000000001ff020000000000000000000000000001fc0100000000000000000000000000012e05000000000000000100072000000002060b0f000800000000000000040000000000000000000000000000000502f801000000000000006c0d0000000000000104000000000401ffffffff040101c2040000005d0052ba13aaf39bd495b4e8ce3a13a9d9548f3b5ce2ecb76c19e8a3ed051d835fb7279ac45dbfcb7f12e5f9ee89c8a8598b303d2fc68d67d271cf0d9e887d62b8fd1dfdd624fbe76112cd6a621f874d6dad256570000000000000000004028b00000000fe800000000000000000000000000027fc0000000000000000000000000000004e234e200421907844aa9d49002472fa3b026b48fd03463c19fb8b5c41872771cc5ded1fb16e187cfb57712883aa97ffe6937fe7d824d78a7aeda5daea36f6ad8d0be2708ab75c0f6892e9a190ad7e8959f21fd7fcbed5aad6f0e301ff125e4e27937b81"], 0x210) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/configs/c1.1\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x737f0c77864bf3b9, 0x408) mkdirat(r0, &(0x7f0000000000)='./bus/file0\x00', 0x0) rename(&(0x7f0000000580)='./bus/file0\x00', &(0x7f0000000140)='./proc\x00') 573.023565ms ago: executing program 3 (id=133): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="7c0100001000130726bd70000000000000000000000004000000ffffe0000002ac1414130000000000000000000000004e22000100000003020000003a000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe8000000000000000000000000000bb0000000032000000fe8000000000000000000000000000aa0000000000000000000000000000000008000000000000000a000000000000000600000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000200000000000000f8ffffffffffffff0c000000000000000200000029bd70000000000002000100280000000000000068001200726663343534332867636d2861657329290000000000000000000a00000000000000000000000000000000000000000000000000000000000000000000000000e000000080"], 0x17c}, 0x1, 0x0, 0x0, 0xc0}, 0x0) 527.992706ms ago: executing program 3 (id=134): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22, 0x0, @empty, 0x80002}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000180)=[{&(0x7f00000001c0)="580000001500add427323b472545b45602117fffffff81000e22d991000005000000a80013007b00090080007f000001e809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) 472.533778ms ago: executing program 3 (id=135): r0 = creat(&(0x7f00000000c0)='./file0\x00', 0xdafbe5d6891b6e4) write$binfmt_elf32(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="7f454c46800c040001000400010000000200030001000000dd00ffffffff000045030000080000000500200001"], 0x58) r1 = fsopen(&(0x7f0000000000)='cgroup\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000340)='name', &(0x7f00000000c0)='\xf6gr\xe7lo_', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000100)='name', &(0x7f0000000140)='ccnA\xf6gr\xe7lo_', 0x0) close(r0) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) dup(r0) 472.344188ms ago: executing program 3 (id=136): clock_adjtime(0x0, &(0x7f00000001c0)={0x8b8d, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffd, 0xe00, 0x0, 0x0, 0x6, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xffffffffffffff20}) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="7801000010000100ffffffff00000000fc000000000000000000000000000008fe8000000000000000000000000000bb000400004e2300000000000064000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac1e00010000000000000000000000000000000032000000fc01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000040000200000000000000000000000000000200000000000000000000000a000000cd000000000000006800020063626328616573290000000000000700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100007e0bf8043bbb4a68e95ad209fd45c9110ebc34057d6c7f90a4f09b78a855fd66200017"], 0x178}}, 0x800) 470.661738ms ago: executing program 3 (id=137): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="84010000100013070000000000000000ffffffff000000000000000400000000fe80000000000000000000a6109ce800000000bb00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb0000000032000000ac14140000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000004800020063626328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c001400636d61632861657329"], 0x184}}, 0x10) 454.647428ms ago: executing program 3 (id=138): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000780)=ANY=[@ANYBLOB="180000005f007dc52cbd70000000000008004100", @ANYRES32=0x0, @ANYBLOB], 0x18}], 0x1}, 0x0) dup(r0) r1 = syz_usb_connect$cdc_ncm(0x6, 0x7a, &(0x7f00000000c0)=ANY=[], 0x0) lsetxattr$security_selinux(&(0x7f0000000180)='.\x00', &(0x7f00000001c0), &(0x7f0000000200)='system_u:object_r:crond_var_run_t:s0\x00', 0x25, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000140)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x20, 0x80, 0x1c, {0x5, 0x0, 0x800, 0xfff6, 0x3ff, 0xfff8, 0x400, 0x4, 0x1, 0x5, 0x400, 0x9}}, 0x0, 0x0, 0x0, 0x0}) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) syz_usb_connect$uac2(0x2, 0x7b, &(0x7f00000000c0)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x20, 0x4b4, 0x931d, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x74, 0xa0, 0x9, {0x8, 0xb, 0x1, 0x2, 0x1, 0x6, 0x20, 0x6}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0xdef2, 0xa, 0x9, 0x5}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x6, 0xd7, 0x8, {0x8, 0x25, 0x1, 0x2, 0x6, 0x6, 0x1}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0xd7, 0xe, 0x4, {0x8, 0x25, 0x1, 0x81, 0x30, 0x6, 0x5}}}}}}}}]}}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x2, [{0x7c, 0x0}, {0xa4, &(0x7f0000000180)=@string={0xa4, 0x3, "2a9dfea2aa724c432975adf11eee963ac6a755449770d7a0d13b95a61d4187965dd17a2f384c27db1a3c87d7c5eb1a96357570b4b620d2d5e12d4cc17e5b2e7a45d9972ed727f5ef488ff4d526a160d0fd3d93ab8d12aa375e56100def3300ca4c88d6eca1888f14a76a1e94816fb1fbd1c347076edf6e4c19ad8b1b566c8b1001090e930737a0427124900e23aa5f886da09d60bee7887c648daf3d8ecd67658cd9"}}]}) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x2d, &(0x7f0000000440)={&(0x7f0000000080)={0x24, 0x2, 0x3, 0x101, 0x0, 0x0, {0xd, 0x0, 0x2}, [@NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x13}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x33}]}, 0x24}, 0x1, 0x0, 0x0, 0x4048880}, 0x24000080) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r2, &(0x7f0000002d80)={0x0, 0x0, &(0x7f0000002d40)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000000203010200000000000000000000000009000200000000470200000008000340000000000800010001"], 0x30}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2000000002030500000000000040000002000000090002"], 0x20}, 0x1, 0x0, 0x0, 0x40049d1}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) 254.918564ms ago: executing program 1 (id=139): r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f00000006c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000005ec0)=[{{&(0x7f0000000000)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x80, &(0x7f0000000400)=[{&(0x7f0000000080)=""/153, 0x99}, {&(0x7f0000000300)=""/119, 0x77}], 0x2, &(0x7f0000000700)=""/106, 0x6a}, 0x4}, {{&(0x7f0000000880)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, 0x80, &(0x7f0000000ec0)=[{0x0}, {&(0x7f0000000a00)=""/212, 0xd4}, {&(0x7f0000000d00)=""/205, 0xcd}, {&(0x7f0000000e00)=""/184, 0xb8}], 0x4, &(0x7f0000000f00)=""/122, 0x7a}, 0x2e}, {{&(0x7f0000001fc0)=@ieee802154={0x24, @long}, 0x80, &(0x7f0000002140)=[{&(0x7f0000002040)=""/56, 0x38}, {&(0x7f0000002080)=""/139, 0x8b}], 0x2, &(0x7f0000002180)=""/128, 0x80}, 0x1}, {{&(0x7f0000002200)=@ieee802154={0x24, @short}, 0x80, &(0x7f0000002380)=[{&(0x7f0000002280)=""/113, 0x71}, {&(0x7f0000002300)=""/82, 0x52}], 0x2, &(0x7f00000023c0)=""/176, 0xb0}, 0x3}, {{&(0x7f0000002480)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, 0x80, &(0x7f0000002900)=[{&(0x7f0000002500)=""/172, 0xac}, {&(0x7f00000025c0)=""/104, 0x68}, {&(0x7f0000002640)=""/13, 0xd}, {&(0x7f0000002680)=""/148, 0x94}, {&(0x7f0000002740)=""/24, 0x18}, {&(0x7f0000002780)=""/230, 0xe6}, {&(0x7f0000002880)=""/3, 0x3}, {&(0x7f00000028c0)=""/38, 0x26}], 0x8, &(0x7f0000002980)=""/151, 0x97}, 0xb}, {{&(0x7f0000002a40)=@l2, 0x80, &(0x7f0000002bc0)=[{&(0x7f0000002ac0)=""/144, 0x90}, {&(0x7f0000002b80)=""/6, 0x6}], 0x2, &(0x7f0000003800)=""/4096, 0x1000}}, {{&(0x7f0000004800)=@un=@abs, 0x80, &(0x7f00000049c0)=[{&(0x7f0000004880)=""/83, 0x53}, {&(0x7f0000004900)=""/190, 0xbe}], 0x2, &(0x7f0000004a00)=""/220, 0xdc}, 0x9}, {{0x0, 0x0, 0x0}, 0xb}], 0x8, 0x2, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) 238.534304ms ago: executing program 1 (id=140): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000002c00)={0x0, 0x0, &(0x7f0000002bc0)={&(0x7f0000002940)=@expire={0xf8, 0x1c, 0x57d766a7dbb1ddd3, 0x70bd2a, 0x25dfdbfc, {{{@in=@empty, @in=@remote, 0x4e23, 0xbc63, 0x4e24, 0x6, 0x2, 0x80, 0x30, 0x3a}, {@in6=@empty, 0x4d4, 0xff}, @in6=@ipv4={'\x00', '\xff\xff', @remote}, {0x4, 0x1, 0x8, 0x5, 0xffffffffffffff8a, 0xfffffffffffffffe}, {0x4, 0xff, 0x400000000000000, 0xffffffffffffffff}, {0x80000001, 0xfffffc00, 0xdcf}, 0x70bd2a, 0x3505, 0xa, 0x0, 0x0, 0x98}, 0x6}}, 0xf8}}, 0x0) 168.085296ms ago: executing program 1 (id=141): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000003280)={0x73622a85, 0x100b, 0x4}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@acquire], 0xffffffffffffff47, 0x0, 0x0}) dup3(r1, r0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000540)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0xfffffffffffffffd}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0xffffffffffffff67, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000940)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0xc810, 0x10, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000400)={@ptr={0x66642a85, 0x0, 0x0, 0x0, 0x80000001, 0x3e}, @ptr={0x70742a85, 0x20000000, 0x0, 0x0, 0x1, 0x26}, @fda={0x66646185, 0x9, 0x1, 0xb4}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1040}], 0x0, 0x0, 0x0}) 119.591597ms ago: executing program 1 (id=142): pipe2$9p(&(0x7f00000003c0)={0xffffffffffffffff}, 0x80000) close_range(r0, r0, 0x0) readv(r0, 0x0, 0x0) (async) syz_usb_connect$uac2(0x3, 0x98, &(0x7f00000000c0)=ANY=[@ANYBLOB="12011001000000101e041030400001020301090286000301081040080b00010102208109040000000101200009240106009a4969ae112408022100000300010002000100034317240305f7040702"], 0x0) 0s ago: executing program 2 (id=143): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2b00, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x9) syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000100)={[0x4, 0x80000000000000, 0x0, 0x4, 0x101000, 0x0, 0x1002, 0x5, 0x3, 0x21, 0x2, 0x6, 0x8bda, 0xfffebffffffffeee, 0x3fe, 0xffffffffffffffff], 0x25000, 0xc4a57}) prlimit64(0x0, 0x6, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) lsetxattr$system_posix_acl(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x2c, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r5, &(0x7f0000000080)=ANY=[@ANYBLOB="083c86dd0001e1fd04600000a60c6eec00be140006fffe8000000000000000120000000000aaff020000000000000000000000000001"], 0xfdef) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.179' (ED25519) to the list of known hosts. [ 29.045572][ T36] audit: type=1400 audit(1786048932.410:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 29.050160][ T286] cgroup: Unknown subsys name 'net' [ 29.068728][ T36] audit: type=1400 audit(1786048932.420:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.096155][ T36] audit: type=1400 audit(1786048932.440:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.096743][ T286] cgroup: Unknown subsys name 'devices' [ 29.219363][ T286] cgroup: Unknown subsys name 'hugetlb' [ 29.225791][ T286] cgroup: Unknown subsys name 'rlimit' [ 29.322946][ T36] audit: type=1400 audit(1786048932.690:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 29.346912][ T36] audit: type=1400 audit(1786048932.690:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 29.372127][ T36] audit: type=1400 audit(1786048932.690:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 29.401243][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 29.410526][ T36] audit: type=1400 audit(1786048932.780:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.437013][ T36] audit: type=1400 audit(1786048932.780:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.474007][ T36] audit: type=1400 audit(1786048932.840:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.499908][ T36] audit: type=1400 audit(1786048932.840:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.500734][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 30.897367][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.904681][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.912240][ T293] bridge_slave_0: entered allmulticast mode [ 30.918680][ T293] bridge_slave_0: entered promiscuous mode [ 30.930580][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.938085][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.945308][ T293] bridge_slave_1: entered allmulticast mode [ 30.952076][ T293] bridge_slave_1: entered promiscuous mode [ 30.985143][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.992433][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.999934][ T294] bridge_slave_0: entered allmulticast mode [ 31.006868][ T294] bridge_slave_0: entered promiscuous mode [ 31.020390][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.027548][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.034902][ T294] bridge_slave_1: entered allmulticast mode [ 31.041400][ T294] bridge_slave_1: entered promiscuous mode [ 31.075350][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.082978][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.090390][ T295] bridge_slave_0: entered allmulticast mode [ 31.097012][ T295] bridge_slave_0: entered promiscuous mode [ 31.117922][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.125439][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.133733][ T295] bridge_slave_1: entered allmulticast mode [ 31.140609][ T295] bridge_slave_1: entered promiscuous mode [ 31.237548][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.245451][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.253593][ T296] bridge_slave_0: entered allmulticast mode [ 31.261876][ T296] bridge_slave_0: entered promiscuous mode [ 31.272367][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.281328][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.289450][ T296] bridge_slave_1: entered allmulticast mode [ 31.296221][ T296] bridge_slave_1: entered promiscuous mode [ 31.387776][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.395240][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.403380][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.410680][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.422990][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.430525][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.438127][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.445220][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.470787][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.477940][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.485655][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.493027][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.527957][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.535425][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.542921][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.550129][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.584404][ T44] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.592453][ T44] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.600934][ T44] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.608360][ T44] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.615736][ T44] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.623669][ T44] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.631867][ T44] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.639850][ T44] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.652919][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.660952][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.680679][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.688247][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.696261][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.703654][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.712837][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.720355][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.746648][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.753759][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.771824][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.778979][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.803504][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.810634][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.820580][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.828276][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.855360][ T293] veth0_vlan: entered promiscuous mode [ 31.885905][ T294] veth0_vlan: entered promiscuous mode [ 31.899564][ T295] veth0_vlan: entered promiscuous mode [ 31.914414][ T293] veth1_macvtap: entered promiscuous mode [ 31.933942][ T296] veth0_vlan: entered promiscuous mode [ 31.942332][ T294] veth1_macvtap: entered promiscuous mode [ 31.957420][ T295] veth1_macvtap: entered promiscuous mode [ 31.990583][ T296] veth1_macvtap: entered promiscuous mode [ 32.018491][ T294] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 32.083453][ T315] netlink: 228 bytes leftover after parsing attributes in process `syz.2.3'. [ 32.134040][ T316] rust_binder: 312:316 FDA parent offset not aligned correctly [ 32.164702][ T316] rust_binder: 312:316 error while translating object: EINVAL [ 32.180051][ T316] rust_binder: Failure in copy_transaction_data: EINVAL [ 32.180114][ T316] rust_binder: 312:316 transaction call to 312:0 failed EINVAL, code 0 size 112-24 [ 32.198626][ T316] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 32.198662][ T316] rust_binder: Read failure Err(EFAULT) in pid:2 [ 32.217751][ T330] sit0: entered promiscuous mode [ 32.230843][ T31] rust_binder: 312: undelivered TRANSACTION_ERROR: 29201 [ 32.237567][ T330] netlink: 'syz.3.8': attribute type 1 has an invalid length. [ 32.245889][ T330] netlink: 1 bytes leftover after parsing attributes in process `syz.3.8'. [ 32.258691][ T330] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=330 comm=syz.3.8 [ 32.284996][ T333] netlink: 148 bytes leftover after parsing attributes in process `syz.1.9'. [ 32.457076][ T66] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 32.470630][ T351] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 32.470665][ T351] rust_binder: Read failure Err(EFAULT) in pid:20 [ 32.477071][ T10] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 32.493396][ T351] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 32.493422][ T351] rust_binder: Read failure Err(EFAULT) in pid:20 [ 32.544625][ T358] netlink: 36 bytes leftover after parsing attributes in process `syz.3.20'. [ 32.608848][ T365] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 32.647116][ T66] usb 1-1: Using ep0 maxpacket: 32 [ 32.653609][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 32.660847][ T66] usb 1-1: config 0 has an invalid interface number: 196 but max is 0 [ 32.669817][ T10] usb 3-1: config 0 has an invalid interface number: 105 but max is 0 [ 32.678622][ T66] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 32.687720][ T365] capability: warning: `syz.3.21' uses 32-bit capabilities (legacy support in use) [ 32.689997][ T10] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 32.711311][ T66] usb 1-1: config 0 has no interface number 0 [ 32.718799][ T66] usb 1-1: config 0 interface 196 altsetting 1 endpoint 0x2 has invalid wMaxPacketSize 0 [ 32.733352][ T10] usb 3-1: config 0 has no interface number 0 [ 32.742035][ T66] usb 1-1: config 0 interface 196 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 32.758964][ T10] usb 3-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 32.770816][ T66] usb 1-1: config 0 interface 196 has no altsetting 0 [ 32.778161][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.786654][ T10] usb 3-1: Product: syz [ 32.790920][ T10] usb 3-1: Manufacturer: syz [ 32.795903][ T10] usb 3-1: SerialNumber: syz [ 32.804749][ T66] usb 1-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 32.814194][ T10] usb 3-1: config 0 descriptor?? [ 32.819253][ T66] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.828622][ T66] usb 1-1: Product: syz [ 32.832889][ T66] usb 1-1: Manufacturer: syz [ 32.838473][ T10] usb 3-1: Found UVC 0.00 device syz (046d:08f3) [ 32.844927][ T10] usb 3-1: No valid video chain found. [ 32.851411][ T66] usb 1-1: SerialNumber: syz [ 32.857774][ T66] usb 1-1: config 0 descriptor?? [ 33.065869][ T66] ipheth 1-1:0.196: Unable to find endpoints [ 33.099971][ T367] SELinux: truncated policydb string identifier [ 33.106920][ T367] SELinux: failed to load policy [ 33.400017][ T381] netlink: 228 bytes leftover after parsing attributes in process `syz.1.25'. [ 33.441631][ T385] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 33.441655][ T385] rust_binder: Read failure Err(EFAULT) in pid:20 [ 33.450981][ T385] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 33.457637][ T385] rust_binder: Read failure Err(EFAULT) in pid:20 [ 33.468553][ T385] rust_binder: validate_parent_fixup: new_min_offset=216, sg_entry.length=0 [ 33.475219][ T385] rust_binder: 384:385 error while translating object: EINVAL [ 33.492327][ T385] rust_binder: Failure in copy_transaction_data: EINVAL [ 33.492363][ T385] rust_binder: 384:385 transaction call to 384:0 failed EINVAL, code 28672 size 112-24 [ 33.510686][ T311] rust_binder: 384: undelivered TRANSACTION_ERROR: 29201 [ 33.623323][ T391] rust_binder: 390:391 error while translating object: ENOENT [ 33.631377][ T391] rust_binder: Failure in copy_transaction_data: ENOENT [ 33.631473][ T391] rust_binder: 390:391 transaction call to 390:0 failed ENOENT, code 0 size 104-24 [ 33.649440][ T66] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 33.658638][ T10] rust_binder: 390: undelivered TRANSACTION_ERROR: 29201 [ 33.722582][ T311] rust_binder: 397: undelivered TRANSACTION_COMPLETE [ 33.733880][ T10] rust_binder: 397: undelivered transaction 22, process died [ 33.758632][ T400] netlink: 37 bytes leftover after parsing attributes in process `syz.1.34'. [ 33.806670][ T66] usb 4-1: Using ep0 maxpacket: 16 [ 33.817696][ T66] usb 4-1: config 0 interface 0 altsetting 254 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 33.832644][ T66] usb 4-1: config 0 interface 0 has no altsetting 0 [ 33.839526][ T66] usb 4-1: New USB device found, idVendor=0f30, idProduct=0111, bcdDevice= 0.00 [ 33.848851][ T66] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.861601][ T66] usb 4-1: config 0 descriptor?? [ 34.076389][ T36] kauditd_printk_skb: 71 callbacks suppressed [ 34.076426][ T36] audit: type=1400 audit(1786048943.447:145): avc: denied { create } for pid=468 comm="syz.1.38" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 34.121620][ T36] audit: type=1400 audit(1786048943.457:146): avc: denied { connect } for pid=468 comm="syz.1.38" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 34.612879][ T36] audit: type=1400 audit(1786048943.987:147): avc: denied { create } for pid=470 comm="syz.1.39" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 34.615658][ T471] netlink: 4 bytes leftover after parsing attributes in process `syz.1.39'. [ 34.632511][ T36] audit: type=1400 audit(1786048943.987:148): avc: denied { bind } for pid=470 comm="syz.1.39" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 34.717132][ T473] netlink: 228 bytes leftover after parsing attributes in process `syz.1.40'. [ 34.758483][ T66] pantherlord 0003:0F30:0111.0001: unknown main item tag 0x6 [ 34.766124][ T66] pantherlord 0003:0F30:0111.0001: unknown main item tag 0x0 [ 34.776585][ T66] pantherlord 0003:0F30:0111.0001: unknown main item tag 0x0 [ 34.784021][ T66] pantherlord 0003:0F30:0111.0001: unknown main item tag 0x0 [ 34.791505][ T66] pantherlord 0003:0F30:0111.0001: unknown main item tag 0x0 [ 34.798995][ T66] pantherlord 0003:0F30:0111.0001: unknown main item tag 0x0 [ 34.806576][ T66] pantherlord 0003:0F30:0111.0001: unknown main item tag 0x0 [ 34.814293][ T66] pantherlord 0003:0F30:0111.0001: unknown main item tag 0x0 [ 34.821829][ T66] pantherlord 0003:0F30:0111.0001: unknown main item tag 0x0 [ 34.829712][ T66] pantherlord 0003:0F30:0111.0001: unknown main item tag 0x0 [ 34.837237][ T66] pantherlord 0003:0F30:0111.0001: unknown main item tag 0x0 [ 34.844799][ T66] pantherlord 0003:0F30:0111.0001: unknown main item tag 0x0 [ 34.852725][ T66] pantherlord 0003:0F30:0111.0001: unknown main item tag 0x0 [ 34.860222][ T66] pantherlord 0003:0F30:0111.0001: unknown main item tag 0x0 [ 34.867740][ T66] pantherlord 0003:0F30:0111.0001: unknown main item tag 0x0 [ 34.875395][ T66] pantherlord 0003:0F30:0111.0001: unknown main item tag 0x0 [ 34.882900][ T66] pantherlord 0003:0F30:0111.0001: unknown main item tag 0x0 [ 34.890533][ T66] pantherlord 0003:0F30:0111.0001: unknown main item tag 0x0 [ 34.898106][ T66] pantherlord 0003:0F30:0111.0001: unknown main item tag 0x0 [ 34.907058][ T66] pantherlord 0003:0F30:0111.0001: hidraw0: USB HID v0.07 Device [HID 0f30:0111] on usb-dummy_hcd.3-1/input0 [ 34.918896][ T66] pantherlord 0003:0F30:0111.0001: no output reports found [ 34.960895][ T66] usb 4-1: USB disconnect, device number 2 [ 35.182662][ T66] usb 1-1: USB disconnect, device number 2 [ 35.218969][ T31] usb 3-1: USB disconnect, device number 2 [ 35.288101][ T490] rust_binder: 489:490 FDA parent offset not aligned correctly [ 35.306565][ T490] rust_binder: 489:490 error while translating object: EINVAL [ 35.314871][ T490] rust_binder: Failure in copy_transaction_data: EINVAL [ 35.314912][ T490] rust_binder: 489:490 transaction call to 489:0 failed EINVAL, code 0 size 112-24 [ 35.343135][ T490] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 35.343171][ T490] rust_binder: Read failure Err(EFAULT) in pid:52 [ 35.357194][ T10] rust_binder: 489: undelivered TRANSACTION_ERROR: 29201 [ 35.395568][ T36] audit: type=1400 audit(1786048944.767:149): avc: denied { mounton } for pid=494 comm="syz.2.48" path="/syzcgroup/unified/syz2" dev="cgroup2" ino=85 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 35.448219][ T505] netlink: 148 bytes leftover after parsing attributes in process `syz.1.50'. [ 35.454264][ T36] audit: type=1400 audit(1786048944.807:150): avc: denied { setopt } for pid=487 comm="syz.0.45" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 35.581420][ T514] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 35.581453][ T514] rust_binder: Read failure Err(EFAULT) in pid:33 [ 35.600185][ T514] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 35.613300][ T514] rust_binder: Read failure Err(EFAULT) in pid:33 [ 35.690962][ T36] audit: type=1400 audit(1786048945.067:151): avc: denied { create } for pid=517 comm="syz.3.56" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmsvc_socket permissive=1 [ 35.736560][ T31] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 35.754070][ T525] netlink: 36 bytes leftover after parsing attributes in process `syz.3.58'. [ 35.779329][ T36] audit: type=1400 audit(1786048945.157:152): avc: denied { setopt } for pid=526 comm="syz.3.59" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 35.886838][ T31] usb 3-1: Using ep0 maxpacket: 32 [ 35.893529][ T31] usb 3-1: config 0 has an invalid interface number: 196 but max is 0 [ 35.902135][ T31] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 35.913247][ T31] usb 3-1: config 0 has no interface number 0 [ 35.919884][ T31] usb 3-1: config 0 interface 196 altsetting 1 endpoint 0x2 has invalid wMaxPacketSize 0 [ 35.930843][ T31] usb 3-1: config 0 interface 196 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 35.946419][ T31] usb 3-1: config 0 interface 196 has no altsetting 0 [ 35.954950][ T541] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 35.954982][ T541] rust_binder: Read failure Err(EFAULT) in pid:60 [ 35.955958][ T31] usb 3-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 35.966910][ T541] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 35.971060][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.979954][ T541] rust_binder: Read failure Err(EFAULT) in pid:60 [ 35.995900][ T31] usb 3-1: Product: syz [ 35.999735][ T541] rust_binder: validate_parent_fixup: new_min_offset=216, sg_entry.length=0 [ 36.003404][ T31] usb 3-1: Manufacturer: syz [ 36.007113][ T541] rust_binder: 540:541 error while translating object: EINVAL [ 36.016892][ T31] usb 3-1: SerialNumber: syz [ 36.021266][ T541] rust_binder: Failure in copy_transaction_data: EINVAL [ 36.034195][ T541] rust_binder: 540:541 transaction call to 540:0 failed EINVAL, code 30720 size 112-24 [ 36.034717][ T31] usb 3-1: config 0 descriptor?? [ 36.059696][ T9] rust_binder: 540: undelivered TRANSACTION_ERROR: 29201 [ 36.087268][ T36] audit: type=1400 audit(1786048951.451:153): avc: denied { read write } for pid=542 comm="syz.1.66" name="uhid" dev="devtmpfs" ino=199 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 36.112236][ T36] audit: type=1400 audit(1786048951.451:154): avc: denied { open } for pid=542 comm="syz.1.66" path="/dev/uhid" dev="devtmpfs" ino=199 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 36.140222][ T543] netlink: 'syz.1.66': attribute type 4 has an invalid length. [ 36.151128][ T543] netlink: 'syz.1.66': attribute type 4 has an invalid length. [ 36.161620][ T543] netlink: 'syz.1.66': attribute type 4 has an invalid length. [ 36.173287][ T9] logitech-hidpp-device 0005:046D:B012.0002: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz1 [ 36.213859][ T546] fido_id[546]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 36.232976][ T549] rust_binder: 547:549 error while translating object: ENOENT [ 36.240759][ T549] rust_binder: Failure in copy_transaction_data: ENOENT [ 36.240797][ T549] rust_binder: 547:549 transaction call to 547:0 failed ENOENT, code 0 size 104-24 [ 36.258356][ T10] rust_binder: 547: undelivered TRANSACTION_ERROR: 29201 [ 36.346198][ T31] ipheth 3-1:0.196: Unable to find endpoints [ 36.372631][ T31] rust_binder: 555: undelivered TRANSACTION_COMPLETE [ 36.385554][ T31] rust_binder: 555: undelivered transaction 49, process died [ 36.476574][ T480] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 36.637781][ T480] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 36.649053][ T480] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 36.660378][ T480] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 36.673641][ T480] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 36.683012][ T480] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.692376][ T480] usb 2-1: Product: syz [ 36.700581][ T480] usb 2-1: Manufacturer: syz [ 36.705642][ T480] usb 2-1: SerialNumber: syz [ 36.712453][ T550] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 36.922217][ T550] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 37.228296][ T572] __nla_validate_parse: 1 callbacks suppressed [ 37.228315][ T572] netlink: 4 bytes leftover after parsing attributes in process `syz.3.77'. [ 37.303554][ T574] netlink: 228 bytes leftover after parsing attributes in process `syz.3.78'. [ 37.331418][ T550] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 37.340506][ T550] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 37.391964][ T550] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 37.407467][ T550] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 37.427248][ T480] cdc_ncm 2-1:1.0: failed GET_NTB_PARAMETERS [ 37.434368][ T480] cdc_ncm 2-1:1.0: bind() failure [ 37.441520][ T480] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 37.449008][ T480] cdc_ncm 2-1:1.1: bind() failure [ 37.465219][ T480] usb 2-1: USB disconnect, device number 2 [ 37.545341][ T592] rust_binder: 591:592 FDA parent offset not aligned correctly [ 37.553753][ T592] rust_binder: 591:592 error while translating object: EINVAL [ 37.561385][ T592] rust_binder: Failure in copy_transaction_data: EINVAL [ 37.561419][ T592] rust_binder: 591:592 transaction call to 591:0 failed EINVAL, code 40 size 112-24 [ 37.579330][ T31] usb 4-1: new low-speed USB device number 3 using dummy_hcd [ 37.579561][ T592] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 37.590423][ T592] rust_binder: Read failure Err(EFAULT) in pid:42 [ 37.600453][ T9] rust_binder: 591: undelivered TRANSACTION_ERROR: 29201 [ 37.716593][ T31] usb 4-1: device descriptor read/64, error -71 [ 37.766610][ T480] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 37.876570][ T9] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 37.906606][ T480] usb 2-1: device descriptor read/64, error -71 [ 37.966748][ T31] usb 4-1: device descriptor read/64, error -71 [ 38.095610][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 38.116366][ T9] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 38.125036][ T9] usb 1-1: can't read configurations, error -71 [ 38.166675][ T480] usb 2-1: device descriptor read/64, error -71 [ 38.216561][ T31] usb 4-1: new low-speed USB device number 4 using dummy_hcd [ 38.346770][ T31] usb 4-1: device descriptor read/64, error -71 [ 38.406586][ T480] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 38.466601][ T9] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 38.508745][ T597] usb 3-1: USB disconnect, device number 3 [ 38.526993][ T601] netlink: 148 bytes leftover after parsing attributes in process `syz.2.88'. [ 38.537636][ T480] usb 2-1: device descriptor read/64, error -71 [ 38.586613][ T31] usb 4-1: device descriptor read/64, error -71 [ 38.596571][ T9] usb 1-1: device descriptor read/64, error -32 [ 38.696626][ T31] usb usb4-port1: attempt power cycle [ 38.776545][ T480] usb 2-1: device descriptor read/64, error -71 [ 38.846561][ T9] usb 1-1: device descriptor read/64, error -32 [ 38.886696][ T480] usb usb2-port1: attempt power cycle [ 38.926573][ T597] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 38.956741][ T9] usb usb1-port1: attempt power cycle [ 39.036565][ T31] usb 4-1: new low-speed USB device number 5 using dummy_hcd [ 39.057800][ T31] usb 4-1: device descriptor read/8, error -71 [ 39.076609][ T597] usb 3-1: Using ep0 maxpacket: 32 [ 39.083166][ T597] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 39.093488][ T597] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 39.103304][ T597] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.112769][ T597] usb 3-1: config 0 descriptor?? [ 39.119309][ T597] hub 3-1:0.0: bad descriptor, ignoring hub [ 39.125670][ T597] hub 3-1:0.0: probe with driver hub failed with error -5 [ 39.188107][ T31] usb 4-1: device descriptor read/8, error -71 [ 39.226878][ T480] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 39.237036][ T9] raw-gadget.5 gadget.0: failed to queue resume event [ 39.247249][ T480] usb 2-1: device descriptor read/8, error -71 [ 39.306563][ T9] usb 1-1: new full-speed USB device number 5 using dummy_hcd [ 39.328568][ C0] raw-gadget.5 gadget.0: ignoring, device is not running [ 39.336034][ C0] raw-gadget.5 gadget.0: ignoring, device is not running [ 39.343688][ C0] raw-gadget.5 gadget.0: ignoring, device is not running [ 39.351015][ T9] usb 1-1: device descriptor read/8, error -32 [ 39.382371][ T480] usb 2-1: device descriptor read/8, error -71 [ 39.398427][ T611] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 39.398449][ T611] rust_binder: Read failure Err(EFAULT) in pid:69 [ 39.408028][ T611] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 39.414927][ T611] rust_binder: Read failure Err(EFAULT) in pid:69 [ 39.426536][ T31] usb 4-1: new low-speed USB device number 6 using dummy_hcd [ 39.465645][ T31] usb 4-1: device descriptor read/8, error -71 [ 39.496762][ C0] raw-gadget.5 gadget.0: ignoring, device is not running [ 39.504261][ C0] raw-gadget.5 gadget.0: ignoring, device is not running [ 39.511618][ C0] raw-gadget.5 gadget.0: ignoring, device is not running [ 39.519044][ T9] usb 1-1: device descriptor read/8, error -32 [ 39.597982][ T31] usb 4-1: device descriptor read/8, error -71 [ 39.636614][ T9] raw-gadget.5 gadget.0: failed to queue suspend event [ 39.643836][ T9] raw-gadget.5 gadget.0: failed to queue reset event [ 39.707338][ T31] usb usb4-port1: unable to enumerate USB device [ 39.716567][ T9] raw-gadget.5 gadget.0: failed to queue resume event [ 39.776637][ T9] usb 1-1: new full-speed USB device number 6 using dummy_hcd [ 39.796739][ C0] raw-gadget.5 gadget.0: ignoring, device is not running [ 39.805203][ C0] raw-gadget.5 gadget.0: ignoring, device is not running [ 39.812989][ C0] raw-gadget.5 gadget.0: ignoring, device is not running [ 39.820285][ T9] usb 1-1: device descriptor read/8, error -32 [ 39.836598][ T480] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 39.870705][ T480] usb 2-1: device descriptor read/8, error -71 [ 39.879229][ T615] netlink: 36 bytes leftover after parsing attributes in process `syz.2.94'. [ 39.924400][ T619] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 39.936246][ T619] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 39.976817][ C0] raw-gadget.5 gadget.0: ignoring, device is not running [ 39.985071][ C0] raw-gadget.5 gadget.0: ignoring, device is not running [ 39.993150][ C0] raw-gadget.5 gadget.0: ignoring, device is not running [ 40.001068][ T9] usb 1-1: device descriptor read/8, error -32 [ 40.008513][ T480] usb 2-1: device descriptor read/8, error -71 [ 40.116597][ T9] raw-gadget.5 gadget.0: failed to queue suspend event [ 40.123984][ T9] usb usb1-port1: unable to enumerate USB device [ 40.127172][ T480] usb usb2-port1: unable to enumerate USB device [ 40.351141][ T36] kauditd_printk_skb: 17 callbacks suppressed [ 40.351162][ T36] audit: type=1400 audit(1786048955.721:172): avc: denied { write } for pid=620 comm="syz.3.97" lport=4 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 40.475847][ T632] netlink: 228 bytes leftover after parsing attributes in process `syz.2.102'. [ 40.517471][ T635] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 40.517508][ T635] rust_binder: Read failure Err(EFAULT) in pid:38 [ 40.532021][ T635] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 40.541128][ T635] rust_binder: Read failure Err(EFAULT) in pid:38 [ 40.552632][ T635] rust_binder: validate_parent_fixup: new_min_offset=216, sg_entry.length=0 [ 40.560332][ T635] rust_binder: 634:635 error while translating object: EINVAL [ 40.582458][ T635] rust_binder: Failure in copy_transaction_data: EINVAL [ 40.582503][ T635] rust_binder: 634:635 transaction call to 634:0 failed EINVAL, code 46080 size 112-24 [ 40.602673][ T9] rust_binder: 634: undelivered TRANSACTION_ERROR: 29201 [ 40.638622][ T36] audit: type=1400 audit(1786048962.001:173): avc: denied { mounton } for pid=636 comm="syz.2.104" path="/15/file0" dev="tmpfs" ino=95 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 40.667994][ T36] audit: type=1400 audit(1786048962.011:174): avc: denied { bind } for pid=636 comm="syz.2.104" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 40.689582][ T36] audit: type=1400 audit(1786048962.011:175): avc: denied { create } for pid=636 comm="syz.2.104" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 40.802132][ T641] rust_binder: 640:641 error while translating object: ENOENT [ 40.813467][ T641] rust_binder: Failure in copy_transaction_data: ENOENT [ 40.813515][ T641] rust_binder: 640:641 transaction call to 640:0 failed ENOENT, code 0 size 104-24 [ 40.843781][ T31] rust_binder: 640: undelivered TRANSACTION_ERROR: 29201 [ 40.862866][ T643] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 40.877065][ T596] raw-gadget.5 gadget.0: failed to queue disconnect event [ 40.886783][ T643] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 40.893489][ T36] audit: type=1400 audit(1786048962.251:176): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 40.933536][ T31] rust_binder: 646: undelivered TRANSACTION_COMPLETE [ 40.951445][ T328] rust_binder: 646: undelivered transaction 76, process died [ 41.188595][ T36] audit: type=1400 audit(1786048962.561:177): avc: denied { create } for pid=658 comm="syz.3.115" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 41.226551][ T328] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 41.246712][ T36] audit: type=1400 audit(1786048962.611:178): avc: denied { read } for pid=658 comm="syz.3.115" dev="nsfs" ino=4026532553 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 41.250362][ T660] syz.3.115 uses obsolete (PF_INET,SOCK_PACKET) [ 41.275775][ T36] audit: type=1400 audit(1786048962.621:179): avc: denied { open } for pid=658 comm="syz.3.115" path="net:[4026532553]" dev="nsfs" ino=4026532553 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 41.317039][ T36] audit: type=1400 audit(1786048962.661:180): avc: denied { getopt } for pid=658 comm="syz.3.115" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 41.396639][ T328] usb 1-1: Using ep0 maxpacket: 32 [ 41.407362][ T328] usb 1-1: config 0 has an invalid interface number: 196 but max is 0 [ 41.417676][ T328] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 41.433411][ T328] usb 1-1: config 0 has no interface number 0 [ 41.440824][ T328] usb 1-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 41.451719][ T328] usb 1-1: config 0 interface 196 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 41.465752][ T328] usb 1-1: config 0 interface 196 has no altsetting 0 [ 41.474205][ T328] usb 1-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 41.483739][ T328] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 41.491920][ T328] usb 1-1: Product: syz [ 41.496236][ T328] usb 1-1: Manufacturer: syz [ 41.500937][ T328] usb 1-1: SerialNumber: syz [ 41.507117][ T328] usb 1-1: config 0 descriptor?? [ 41.512736][ T651] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 41.538671][ T662] netlink: 4 bytes leftover after parsing attributes in process `syz.2.116'. [ 41.608003][ T664] netlink: 228 bytes leftover after parsing attributes in process `syz.2.117'. [ 41.724758][ T328] ipheth 1-1:0.196: Unable to find endpoints [ 41.756775][ T36] audit: type=1400 audit(1786048963.131:181): avc: denied { bind } for pid=674 comm="syz.2.122" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 41.785403][ T676] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=20 sclass=netlink_audit_socket pid=676 comm=syz.2.122 [ 41.838598][ T681] rust_binder: 680:681 FDA parent offset not aligned correctly [ 41.846538][ T681] rust_binder: 680:681 error while translating object: EINVAL [ 41.854526][ T681] rust_binder: Failure in copy_transaction_data: EINVAL [ 41.854571][ T681] rust_binder: 680:681 transaction call to 680:0 failed EINVAL, code 112 size 112-24 [ 41.871525][ T681] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 41.871560][ T681] rust_binder: Read failure Err(EFAULT) in pid:65 [ 41.880901][ T328] rust_binder: 680: undelivered TRANSACTION_ERROR: 29201 [ 41.905873][ T683] netlink: 4096 bytes leftover after parsing attributes in process `syz.2.125'. [ 41.945290][ T687] netlink: 148 bytes leftover after parsing attributes in process `syz.2.127'. [ 42.083912][ T697] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 42.083947][ T697] rust_binder: Read failure Err(EFAULT) in pid:108 [ 42.100933][ T697] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 42.108323][ T697] rust_binder: Read failure Err(EFAULT) in pid:108 [ 42.124927][ T699] overlayfs: option "uuid=on" requires an upper fs, falling back to uuid=null. [ 42.147251][ T699] overlayfs: missing 'lowerdir' [ 42.154749][ T701] netlink: 36 bytes leftover after parsing attributes in process `syz.3.133'. [ 42.158099][ T699] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 42.175505][ T699] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 42.215415][ T705] process 'syz.3.135' launched './file0' with NULL argv: empty string added [ 42.269439][ T711] SELinux: Context system_u:object_r:crond_var_run_t:s0 is not valid (left unmapped). [ 42.483991][ T715] netlink: 228 bytes leftover after parsing attributes in process `syz.1.140'. [ 42.507173][ T717] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 42.507244][ T717] rust_binder: Read failure Err(EFAULT) in pid:77 [ 42.516665][ T595] usb 4-1: new full-speed USB device number 7 using dummy_hcd [ 42.527277][ T717] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 42.531165][ T717] rust_binder: Read failure Err(EFAULT) in pid:77 [ 42.540291][ T717] rust_binder: validate_parent_fixup: new_min_offset=216, sg_entry.length=0 [ 42.547158][ T717] rust_binder: 716:717 error while translating object: EINVAL [ 42.563929][ T717] rust_binder: Failure in copy_transaction_data: EINVAL [ 42.563972][ T717] rust_binder: 716:717 transaction call to 716:0 failed EINVAL, code 51216 size 112-24 [ 42.582151][ T9] rust_binder: 716: undelivered TRANSACTION_ERROR: 29201 [ 42.677991][ T595] usb 4-1: unable to get BOS descriptor or descriptor too short [ 42.686290][ T595] usb 4-1: not running at top speed; connect to a high speed hub [ 42.695248][ T595] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 215, changing to 4 [ 42.709039][ T595] usb 4-1: language id specifier not provided by device, defaulting to English [ 42.719571][ T595] usb 4-1: New USB device found, idVendor=04b4, idProduct=931d, bcdDevice= 0.40 [ 42.729065][ T595] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 42.739363][ T595] usb 4-1: Product: syz [ 42.746720][ T595] usb 4-1: Manufacturer: 鴪ꋾ犪䍌甩㪖Ᶎ䑕炗ꃗ㯑ꚕ䄝隇텝⽺䰸㰚힇阚电둰₶헒ⷡ셌孾種⺗⟗轈헴ꄦ큠㷽ꮓኍ㞪噞ഐ㏯쨀行袡ᒏ檧鐞澁ﮱ쏑݇䱮괙ᮋ汖ႋँ錎㜇䊠⑱ຐꨣ衟ꁭ悝粈赤㶯춎敧 [ 42.773272][ T595] usb 4-1: SerialNumber: syz [ 42.823956][ T606] ------------[ cut here ]------------ [ 42.829743][ T606] WARNING: CPU: 0 PID: 606 at fs/inode.c:340 drop_nlink+0xce/0x110 [ 42.837785][ T606] Modules linked in: [ 42.841753][ T606] CPU: 0 UID: 0 PID: 606 Comm: syz.2.89 Not tainted syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 42.853134][ T606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 42.863289][ T606] RIP: 0010:drop_nlink+0xce/0x110 [ 42.868596][ T606] Code: 04 00 00 be 08 00 00 00 e8 5f 13 ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 d2 4b 95 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c [ 42.888494][ T606] RSP: 0018:ffffc9000ce0f8c8 EFLAGS: 00010293 [ 42.894711][ T606] RAX: ffffffff81f225ee RBX: ffff88811d2e5a78 RCX: ffff88811b4a9300 [ 42.902968][ T606] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 42.911187][ T606] RBP: ffffc9000ce0f8f0 R08: 0000000000000003 R09: 0000000000000004 [ 42.919270][ T606] R10: dffffc0000000000 R11: fffff520019c1f08 R12: dffffc0000000000 [ 42.927331][ T606] R13: 1ffff11023a5cb58 R14: ffff88811d2e5ac0 R15: 0000000000000000 [ 42.935419][ T606] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 42.937141][ T31] usb 3-1: USB disconnect, device number 4 [ 42.944672][ T606] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 42.957258][ T606] CR2: 00007fdb44f87240 CR3: 000000011b32c000 CR4: 00000000003526b0 [ 42.965535][ T606] Call Trace: [ 42.968945][ T606] [ 42.971947][ T606] shmem_rmdir+0x5f/0x90 [ 42.976287][ T606] vfs_rmdir+0x3de/0x560 [ 42.980700][ T606] incfs_kill_sb+0x102/0x220 [ 42.985594][ T606] deactivate_locked_super+0xd5/0x270 [ 42.991148][ T606] deactivate_super+0xb8/0xe0 [ 42.996097][ T606] cleanup_mnt+0x438/0x4d0 [ 43.000689][ T606] __cleanup_mnt+0x1d/0x40 [ 43.005516][ T606] task_work_run+0x1e8/0x260 [ 43.010461][ T606] ? __cfi_task_work_run+0x10/0x10 [ 43.015810][ T606] ? free_nsproxy+0x223/0x290 [ 43.020607][ T606] do_exit+0xa46/0x2850 [ 43.025158][ T606] ? __cfi_do_exit+0x10/0x10 [ 43.029838][ T606] ? __kasan_check_write+0x18/0x20 [ 43.035323][ T606] ? _raw_spin_lock_irq+0x93/0x120 [ 43.040795][ T606] ? __kasan_check_read+0x15/0x20 [ 43.045991][ T606] do_group_exit+0x21f/0x2f0 [ 43.051029][ T606] ? cgroup_leave_frozen+0x16a/0x2a0 [ 43.056684][ T606] get_signal+0x134c/0x1490 [ 43.061555][ T606] arch_do_signal_or_restart+0xbc/0x700 [ 43.067343][ T606] ? common_nsleep+0x93/0xb0 [ 43.072040][ T606] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 43.078499][ T606] ? __se_sys_clock_nanosleep+0x321/0x3b0 [ 43.084546][ T606] ? __kasan_check_read+0x15/0x20 [ 43.089957][ T606] ? fpregs_assert_state_consistent+0xb6/0xe0 [ 43.096348][ T606] syscall_exit_to_user_mode+0x57/0xb0 [ 43.102141][ T606] do_syscall_64+0x63/0xf0 [ 43.106806][ T606] ? clear_bhb_loop+0x50/0xa0 [ 43.111717][ T606] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 43.117692][ T606] RIP: 0033:0x7f3446d5e90e [ 43.122153][ T606] Code: Unable to access opcode bytes at 0x7f3446d5e8e4. [ 43.129616][ T606] RSP: 002b:00007f3447c4cf58 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 [ 43.138120][ T606] RAX: fffffffffffffdfc RBX: 00007f3447c4d6c0 RCX: 00007f3446d5e90e [ 43.146491][ T606] RDX: 00007f3447c4cfb0 RSI: 0000000000000000 RDI: 0000000000000000 [ 43.154562][ T606] RBP: 00007f3446e35024 R08: 0000000000000000 R09: 0000000000000000 [ 43.163081][ T606] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 43.171381][ T606] R13: 00007f3447026038 R14: 00007f3447025fa0 R15: 00007ffc5ac76568 [ 43.179524][ T606] [ 43.182662][ T606] ---[ end trace 0000000000000000 ]--- [ 43.188289][ T9] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 43.188316][ T606] ================================================================== [ 43.188345][ T606] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 [ 43.202101][ T595] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 43.204063][ T606] Write of size 4 at addr 0000000000000168 by task syz.2.89/606 [ 43.204099][ T606] [ 43.204126][ T606] CPU: 1 UID: 0 PID: 606 Comm: syz.2.89 Tainted: G W syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 43.204320][ T606] Tainted: [W]=WARN [ 43.204336][ T606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 43.204390][ T606] Call Trace: [ 43.204435][ T606] [ 43.204459][ T606] __dump_stack+0x21/0x30 [ 43.204561][ T606] dump_stack_lvl+0x140/0x1c0 [ 43.204635][ T606] ? __cfi_dump_stack_lvl+0x10/0x10 [ 43.204716][ T606] print_report+0x3d/0x70 [ 43.204794][ T606] kasan_report+0x162/0x1a0 [ 43.204866][ T606] ? ihold+0x24/0x70 [ 43.204942][ T606] ? ihold+0x24/0x70 [ 43.205010][ T606] kasan_check_range+0x25a/0x2b0 [ 43.205081][ T606] __kasan_check_write+0x18/0x20 [ 43.205148][ T606] ihold+0x24/0x70 [ 43.205214][ T606] vfs_rmdir+0x25c/0x560 [ 43.205294][ T606] incfs_kill_sb+0x102/0x220 [ 43.205362][ T606] deactivate_locked_super+0xd5/0x270 [ 43.205444][ T606] deactivate_super+0xb8/0xe0 [ 43.205525][ T606] cleanup_mnt+0x438/0x4d0 [ 43.205606][ T606] __cleanup_mnt+0x1d/0x40 [ 43.205697][ T606] task_work_run+0x1e8/0x260 [ 43.205782][ T606] ? __cfi_task_work_run+0x10/0x10 [ 43.205860][ T606] ? free_nsproxy+0x223/0x290 [ 43.205948][ T606] do_exit+0xa46/0x2850 [ 43.206027][ T606] ? __cfi_do_exit+0x10/0x10 [ 43.206134][ T606] ? __kasan_check_write+0x18/0x20 [ 43.206218][ T606] ? _raw_spin_lock_irq+0x93/0x120 [ 43.206286][ T606] ? __kasan_check_read+0x15/0x20 [ 43.206342][ T606] do_group_exit+0x21f/0x2f0 [ 43.206418][ T606] ? cgroup_leave_frozen+0x16a/0x2a0 [ 43.206504][ T606] get_signal+0x134c/0x1490 [ 43.206585][ T606] arch_do_signal_or_restart+0xbc/0x700 [ 43.206635][ T606] ? common_nsleep+0x93/0xb0 [ 43.206704][ T606] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 43.206778][ T606] ? __se_sys_clock_nanosleep+0x321/0x3b0 [ 43.206889][ T606] ? __kasan_check_read+0x15/0x20 [ 43.206956][ T606] ? fpregs_assert_state_consistent+0xb6/0xe0 [ 43.207045][ T606] syscall_exit_to_user_mode+0x57/0xb0 [ 43.207144][ T606] do_syscall_64+0x63/0xf0 [ 43.207235][ T606] ? clear_bhb_loop+0x50/0xa0 [ 43.207316][ T606] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 43.207394][ T606] RIP: 0033:0x7f3446d5e90e [ 43.207450][ T606] Code: Unable to access opcode bytes at 0x7f3446d5e8e4. [ 43.207482][ T606] RSP: 002b:00007f3447c4cf58 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 [ 43.207541][ T606] RAX: fffffffffffffdfc RBX: 00007f3447c4d6c0 RCX: 00007f3446d5e90e [ 43.207585][ T606] RDX: 00007f3447c4cfb0 RSI: 0000000000000000 RDI: 0000000000000000 [ 43.207620][ T606] RBP: 00007f3446e35024 R08: 0000000000000000 R09: 0000000000000000 [ 43.207655][ T606] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 43.207689][ T606] R13: 00007f3447026038 R14: 00007f3447025fa0 R15: 00007ffc5ac76568 [ 43.207735][ T606] [ 43.207764][ T606] ================================================================== [ 43.211507][ T595] usb 4-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 43.218451][ T421] bridge_slave_1: left allmulticast mode [ 43.230410][ T606] Disabling lock debugging due to kernel taint [ 43.242311][ T421] bridge_slave_1: left promiscuous mode [ 43.242822][ T421] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.265011][ T606] BUG: kernel NULL pointer dereference, address: 0000000000000168 [ 43.559112][ T606] #PF: supervisor write access in kernel mode [ 43.565379][ T606] #PF: error_code(0x0002) - not-present page [ 43.571361][ T606] PGD 0 P4D 0 [ 43.574754][ T606] Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI [ 43.580994][ T606] CPU: 0 UID: 0 PID: 606 Comm: syz.2.89 Tainted: G B W syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 43.593970][ T606] Tainted: [B]=BAD_PAGE, [W]=WARN [ 43.599362][ T606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 43.609444][ T606] RIP: 0010:ihold+0x2a/0x70 [ 43.614033][ T606] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 bd 42 95 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 1c 0a ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 cd [ 43.633652][ T606] RSP: 0018:ffffc9000ce0f908 EFLAGS: 00010246 [ 43.639828][ T606] RAX: ffff88811b4a9300 RBX: 0000000000000000 RCX: ffff88811b4a9300 [ 43.647856][ T606] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 43.655959][ T606] RBP: ffffc9000ce0f918 R08: ffffffff88bb6947 R09: 1ffffffff1176d28 [ 43.663966][ T606] R10: dffffc0000000000 R11: fffffbfff1176d29 R12: 0000000000000000 [ 43.671972][ T606] R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 [ 43.680048][ T606] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 43.689240][ T606] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 43.696040][ T606] CR2: 0000000000000168 CR3: 0000000122390000 CR4: 00000000003526b0 [ 43.704216][ T606] Call Trace: [ 43.707528][ T606] [ 43.710489][ T606] vfs_rmdir+0x25c/0x560 [ 43.714853][ T606] incfs_kill_sb+0x102/0x220 [ 43.719527][ T606] deactivate_locked_super+0xd5/0x270 [ 43.724926][ T606] deactivate_super+0xb8/0xe0 [ 43.729714][ T606] cleanup_mnt+0x438/0x4d0 [ 43.734151][ T606] __cleanup_mnt+0x1d/0x40 [ 43.738721][ T606] task_work_run+0x1e8/0x260 [ 43.743400][ T606] ? __cfi_task_work_run+0x10/0x10 [ 43.748555][ T606] ? free_nsproxy+0x223/0x290 [ 43.753386][ T606] do_exit+0xa46/0x2850 [ 43.757963][ T606] ? __cfi_do_exit+0x10/0x10 [ 43.762611][ T606] ? __kasan_check_write+0x18/0x20 [ 43.767750][ T606] ? _raw_spin_lock_irq+0x93/0x120 [ 43.772922][ T606] ? __kasan_check_read+0x15/0x20 [ 43.778066][ T606] do_group_exit+0x21f/0x2f0 [ 43.782684][ T606] ? cgroup_leave_frozen+0x16a/0x2a0 [ 43.788007][ T606] get_signal+0x134c/0x1490 [ 43.792568][ T606] arch_do_signal_or_restart+0xbc/0x700 [ 43.798181][ T606] ? common_nsleep+0x93/0xb0 [ 43.802804][ T606] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 43.809072][ T606] ? __se_sys_clock_nanosleep+0x321/0x3b0 [ 43.814840][ T606] ? __kasan_check_read+0x15/0x20 [ 43.819936][ T606] ? fpregs_assert_state_consistent+0xb6/0xe0 [ 43.826125][ T606] syscall_exit_to_user_mode+0x57/0xb0 [ 43.831631][ T606] do_syscall_64+0x63/0xf0 [ 43.836197][ T606] ? clear_bhb_loop+0x50/0xa0 [ 43.840905][ T606] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 43.846921][ T606] RIP: 0033:0x7f3446d5e90e [ 43.851797][ T606] Code: Unable to access opcode bytes at 0x7f3446d5e8e4. [ 43.858930][ T606] RSP: 002b:00007f3447c4cf58 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 [ 43.867573][ T606] RAX: fffffffffffffdfc RBX: 00007f3447c4d6c0 RCX: 00007f3446d5e90e [ 43.875598][ T606] RDX: 00007f3447c4cfb0 RSI: 0000000000000000 RDI: 0000000000000000 [ 43.883608][ T606] RBP: 00007f3446e35024 R08: 0000000000000000 R09: 0000000000000000 [ 43.891651][ T606] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 43.899898][ T606] R13: 00007f3447026038 R14: 00007f3447025fa0 R15: 00007ffc5ac76568 [ 43.907899][ T606] [ 43.911077][ T606] Modules linked in: [ 43.915081][ T606] CR2: 0000000000000168 [ 43.919382][ T606] ---[ end trace 0000000000000000 ]--- [ 43.924972][ T606] RIP: 0010:ihold+0x2a/0x70 [ 43.929521][ T606] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 bd 42 95 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 1c 0a ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 cd [ 43.949409][ T606] RSP: 0018:ffffc9000ce0f908 EFLAGS: 00010246 [ 43.955499][ T606] RAX: ffff88811b4a9300 RBX: 0000000000000000 RCX: ffff88811b4a9300 [ 43.963812][ T606] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 43.971913][ T606] RBP: ffffc9000ce0f918 R08: ffffffff88bb6947 R09: 1ffffffff1176d28 [ 43.979983][ T606] R10: dffffc0000000000 R11: fffffbfff1176d29 R12: 0000000000000000 [ 43.988156][ T606] R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 [ 43.996324][ T606] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 44.005364][ T606] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 44.012319][ T606] CR2: 0000000000000168 CR3: 0000000122390000 CR4: 00000000003526b0 [ 44.020316][ T606] Kernel panic - not syncing: Fatal exception [ 44.027071][ T606] Kernel Offset: disabled [ 44.031440][ T606] Rebooting in 86400 seconds..