last executing test programs: 5.733140246s ago: executing program 2 (id=68): r0 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x81) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000000)={0x3, 0x8, 0x0, 0x1, 0x4, "da4c898dc77eb6ce3b9b8a993cc6a4a5c9f5a3"}) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCCONS(r1, 0x541d) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, &(0x7f0000000080)=[0x2, 0x8]) r3 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f00000000c0)) ioctl$FS_IOC_GETFSLABEL(r3, 0x81009431, &(0x7f0000000100)) r4 = memfd_secret(0x80000) ioctl$UI_END_FF_ERASE(r4, 0x400c55cb, &(0x7f0000000200)={0x6, 0x0, 0x1}) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) pipe2$watch_queue(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) connect$can_bcm(r6, &(0x7f0000000280), 0x10) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x38a}) syz_ublk_add_dev(r4, 0x0, 0x0, 0x0, &(0x7f0000000340)={0x2e, 0xc, 0x0, r6, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0xbe8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000300)=@any_dev={0x1, 0x729, 0x0, 0x0, 0x1000, 0xce, 0x0, 0x0, 0x748050871d5ecec8}}}, &(0x7f00000003c0)) ioctl$BTRFS_IOC_DEFRAG_RANGE(r7, 0x40309410, 0x0) r8 = getegid() getresgid(&(0x7f0000000400), &(0x7f0000000440)=0x0, &(0x7f0000000480)) setresgid(r8, r9, 0xee00) r10 = add_key$fscrypt_provisioning(&(0x7f00000004c0), &(0x7f0000000500)={'syz', 0x3}, &(0x7f0000000540)={0x2, 0x0, @b}, 0x48, 0xfffffffffffffffb) keyctl$invalidate(0x15, r10) ioctl$XFS_IOC_GETPARENTS(r3, 0xc028583e, &(0x7f0000000680)={{[0x6, 0x0, 0x6, 0x9]}, 0x0, 0x2, 0x4, 0x0, &(0x7f00000005c0)=[{{@_ha_fsid={[0x6, 0x4]}, {0x3, 0x1, 0x80000000, 0x3}}, 0x3f1, 0x0, '/dev/snd/timer\x00'}, {{@_ha_fsid={[0x5, 0x6]}, {0x7f, 0x2, 0x2, 0x5}}, 0x30b2, 0x0, ')\\$\x00'}, {{@_ha_fsid={[0x2, 0xa76]}, {0x8, 0xa3f, 0x7, 0x2}}, 0x1, 0x0, 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa11111111111111111111111111111111'}]}) ioctl$TIOCL_SETSEL(r4, 0x541c, &(0x7f00000006c0)={0x2, {0x2, 0xfff9, 0x400, 0x0, 0x7, 0x10}}) getsockopt$inet6_IPV6_IPSEC_POLICY(r5, 0x29, 0x22, &(0x7f0000000700)={{{@in6=@mcast2, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@multicast2}}, &(0x7f0000000800)=0xe8) fremovexattr(r4, &(0x7f0000000840)=@random={'btrfs.', 'syz'}) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000008c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(r6, &(0x7f0000000980)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x28, 0x0, 0x208, 0x70bd2a, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r12}, @val={0xc, 0x99, {0x5, 0x7e}}}}, ["", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x8040}, 0x4) r13 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r13, 0x89f0, &(0x7f0000000a40)={'syztnl2\x00', &(0x7f00000009c0)={'ip6tnl0\x00', r11, 0x2f, 0x8, 0xa, 0x3ff, 0x9, @mcast1, @private2, 0x700, 0x700, 0x4c, 0xaf}}) ioctl$KDGKBLED(0xffffffffffffffff, 0x4b64, &(0x7f0000000a80)) 5.722926787s ago: executing program 2 (id=69): memfd_create(&(0x7f0000000340)='y\x105\xfc\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xa4\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01L\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x06\xb3\xf0wVq\xe9d\xac\xe9\xaa\x9dR\x00\x9b\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc2G\x1b+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2v\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x1e\x11X\f\x0f\xf0\xe2\xb5\xf8', 0xb) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt\x00', 0x24) socket$nl_generic(0x10, 0x3, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000180)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) write(0xffffffffffffffff, &(0x7f0000000140)='p', 0x1) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = syz_ublk_setup_io_uring(0x467c, &(0x7f0000000140)={0x0, 0xcfab, 0x8000, 0x0, 0x118}, &(0x7f0000000280), &(0x7f00000002c0), &(0x7f00000003c0)) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup(r4) syz_ublk_setup_queues(r5, r2, &(0x7f00000004c0)={0x0, 0xd17, 0x10, 0x1, 0x80, 0x0, r3}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe702, 0x1000, 0x3, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x542b, 0x2, 0x4, 0x1bf}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93f9, 0x8000, 0x4003bffc, 0x2b8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x3, 0x8}}], 0x1, 0x0, 0x0) 5.111798141s ago: executing program 2 (id=72): syz_usb_connect$cdc_ncm(0x1, 0x6e, &(0x7f0000000200)=ANY=[@ANYBLOB="12011003020000082505a1a440000102030109025c0002010890020904000001020d00000024060001002400000000240f0100000000000000000000241a0000000905810300000000000904010000020d00000904010102020d000009058202000000000009050302000000000089f751112c751234f79b8942013f1af6f63ba07fc38bce9018ec5861b1c4f4a56da32b5bd288f265bac324c0d3"], &(0x7f0000000140)={0x0, 0x0, 0x12, &(0x7f0000000180)=ANY=[@ANYBLOB="0500"/18], 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f00000006c0)) ioctl$PPPIOCSMAXCID(r2, 0x40047451, &(0x7f0000000700)=0x8) ioctl$PPPIOCSFLAGS1(r2, 0x40047459, &(0x7f0000000740)=0x120008c) pwritev(r2, &(0x7f0000000780)=[{&(0x7f00000007c0)="002145001f2c00000000400600000a0000010a000002005000500000000100000001601003e80000000001010101", 0x2e}], 0x1, 0xf, 0x8001) pwritev(r2, &(0x7f0000000800)=[{&(0x7f0000000840)="002145000b2c000b0000400600000a0000010a000002005000500000000100000001601003e80000000001010101", 0x2e}], 0x1, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, r1, 0x0, &(0x7f00000002c0)={0x2e, 0x6, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0xb, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000340)=@any_dev={0x2, 0x48f, 0x0, 0x0, 0x1000, 0x1, 0x0, 0x0, 0xa1}}}, &(0x7f0000000380)=0x0) r4 = dup(0xffffffffffffffff) syz_ublk_setup_queues(r4, r3, &(0x7f00000003c0)={0x0, 0xfffffffe, 0x700, 0x4, 0x1f3}, &(0x7f0000000440)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x20, 0x0, 0x6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x8000, 0x3, 0xbab}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8684, 0x0, 0x40040005, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xec4b, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) gettid() r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) connect$bt_sco(r6, &(0x7f0000000940)={0x1f, @none}, 0x8) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000040)={0x0, 0x1, 0x0, 0x100000, &(0x7f0000000000/0x100000)=nil}) syz_usb_connect(0x0, 0x5d, &(0x7f00000001c0)=ANY=[@ANYRESHEX=0x0, @ANYRES64=r5], 0x0) 5.11163017s ago: executing program 3 (id=73): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000a, 0x28011, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xa, 0x204031, 0xffffffffffffffff, 0xc9751000) cachestat(r0, &(0x7f0000000080), &(0x7f0000000200), 0x0) syz_usb_connect$uac3(0x1, 0x87, &(0x7f00000000c0)=ANY=[@ANYBLOB="12011001000000083512048240000102030109029700030109200c080b0001010130f70904000000010130000a2401012a0003100000132403038f9daefd9961f9cc00080004000a000d240906010000000000000000090001000001023000090401010101023000092402027f000000df09050109b0020805f80a252502000000070c000904020000010230000904020101010230000905820900040602210a2525040000000200008585c7da00613eebc2c9107b98b783500a5d0ab75db15ddddd8452e26a983df90e5cd523618ce92b69962b118d1224101b4d1e5c9ebc6969d566858d1fdf1a6e4efdc58c2001dc3e7a8cbdc077c765a15ba2da99fd8747689f233f56952cff4df963fd3419f4e8c4b66ac39e54e42a3c0e8a17b7f0fce2f27758fd159067555219473225bb71537b49be"], 0x0) 4.254442149s ago: executing program 1 (id=82): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x1ff) close(r0) (async) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) (async) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) (async, rerun: 32) syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), r0) (async, rerun: 32) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000200)={0x0, 0x30b5, 0x0, 0x1, 0x40000156}, 0x0, 0x0, 0x0) close(0x3) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async) r2 = socket$igmp(0x2, 0x3, 0x2) (async, rerun: 32) r3 = socket$tipc(0x1e, 0x2, 0x0) (rerun: 32) sendmsg$tipc(r3, &(0x7f0000000300)={&(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x0, {0x15a0cdf3b1e64a13, 0x2}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x81}, 0x0) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f0000000380)={0x1, 0x1, 0x2, 0x102, @vifc_lcl_addr=@empty, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) (async) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$igmp(0x2, 0x3, 0x2) (async) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r6, 0x6, 0x21, &(0x7f00000003c0)="0e9dd6f7f1c5a41afd7e46fed6e7bf3b", 0x10) (async) bind$inet(r5, &(0x7f0000000400)={0x2, 0x4e22, @private=0xa010100}, 0x10) r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) recvmsg(r7, 0x0, 0x0) (async) connect$inet6(r4, &(0x7f0000000480)={0xa, 0x4e24}, 0x1c) (async, rerun: 64) r8 = fcntl$dupfd(r4, 0x0, r4) (rerun: 64) connect$unix(r8, &(0x7f0000000680)=@abs={0x0, 0x0, 0x4e20}, 0x6e) (async, rerun: 64) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./sys\x00', 0x155) (async, rerun: 64) mount(0x0, &(0x7f0000000740)='./sys\x00', &(0x7f0000000780)='sysfs\x00', 0x0, 0x0) r9 = openat(0xffffffffffffff9c, &(0x7f00000007c0)='./sys/module/kvm/parameters/nx_huge_pages\x00', 0x2, 0x0) write(r9, &(0x7f0000000800)='force', 0x5) (async) syz_create_resource$futex(&(0x7f0000000280)=0x1) 4.129990672s ago: executing program 1 (id=83): r0 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x1, 0x0) fchdir(r1) r2 = open(&(0x7f0000002a40)='./file1\x00', 0x80242, 0x8) sched_setattr(0x0, &(0x7f0000002b40)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb47, 0x9, 0x8, 0x80000001, 0x3}, 0x0) ioprio_set$pid(0x3, 0x0, 0x0) sendfile(r2, r2, &(0x7f0000002b80), 0x4d9b6eaf) 4.076272198s ago: executing program 1 (id=84): r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) inotify_init1(0x800) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) write(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r3, 0x89b0, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x2f, 0x5, 0x4, 0x8, 0x4a, @mcast1, @empty, 0x20, 0x1, 0xdfb, 0x7}}) ioctl$TCFLSH(r2, 0x400455c8, 0x0) ioctl$sock_bt_hci(r1, 0x400448cc, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="01000000000000000000030000005800018044000400200001000a00000000005b582d"], 0x6c}, 0x1, 0x0, 0x0, 0x1}, 0x4000) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)=ANY=[@ANYBLOB="a400000054000100000000000000800007"], 0xa4}], 0x1, 0x0, 0x0, 0x4000001}, 0x0) listen(r0, 0xfffffc01) getsockopt$IP_SET_OP_GET_BYNAME(r3, 0x1, 0x53, &(0x7f0000000340)={0x6, 0x7, 'syz1\x00'}, &(0x7f0000000380)=0x28) ppoll(&(0x7f0000000440)=[{r0, 0x4400}], 0x1, &(0x7f0000000700)={0x0, 0x989680}, 0x0, 0x0) 3.362906482s ago: executing program 2 (id=85): prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000140)=0x8) r0 = socket$inet(0x2, 0x802, 0x1) connect$inet(r0, &(0x7f00000003c0)={0x2, 0x0, @local}, 0x10) write(r0, &(0x7f0000000400)="08008edf773c8000", 0xfd) setsockopt$inet_int(r0, 0x0, 0xd, &(0x7f0000000540)=0x80000003, 0x4) recvmmsg(r0, &(0x7f0000000580)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x46}}], 0x1, 0x0, 0x0) r1 = socket(0x10, 0x803, 0x0) bind$netlink(r1, 0x0, 0x0) r2 = syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x1, r2, 0x0, 0x1000009, 0x0) sched_setaffinity(r2, 0x6, &(0x7f0000000280)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000340)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000003c0), 0x318, 0x0) recvmmsg(r3, &(0x7f0000000400), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000440)=0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x1a, &(0x7f00000004c0)={0x3, &(0x7f0000000500)=[{0x20, 0x0, 0xb, 0xfffff038}, {0x20, 0x81, 0x0, 0xfffff024}, {0x6, 0x0, 0x0, 0x2000000}]}, 0x10) sendmmsg(r5, &(0x7f0000000540), 0x400000000000159, 0x40840) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000680)=@newsa={0xf0, 0x10, 0x401, 0xfffffffd, 0x0, {{@in6=@mcast2, @in6=@loopback, 0x1234, 0x9a, 0x0, 0xfffd, 0xa}, {@in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x4d2, 0x33}, @in6=@local, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x5b57, 0xffffffffffffffff}, {}, {}, 0x70bd2b, 0x0, 0xa}}, 0xf0}}, 0x4000800) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000740)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x10000, {{@in=@multicast2, @in=@empty, 0x0, 0x10, 0x4e24, 0x0, 0xa, 0x20, 0x0, 0x62}, {0x7, 0x10, 0x100000002, 0x0, 0xfff, 0xffffffffffffb473, 0xffffffffffffffff}, {0x1000000000, 0x2000000000000003, 0x2, 0xffffffffffffffff}, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0xb8}}, 0x4004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) sendmsg$nl_xfrm(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000800)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0xfffffffffffffff7, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000}, 0x3a, 0x6e6bc0}}, 0xb8}}, 0x2c000010) sendmsg$nl_xfrm(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x800, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x800, 0x1000, 0x0, 0xa, 0x20}, {}, {0x1, 0x6, 0x0, 0xfffffffffffffffe}, 0x0, 0x6e6bbc}}, 0xb8}, 0x1, 0x0, 0x0, 0x404c830}, 0x0) 3.095118959s ago: executing program 2 (id=88): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = socket$packet(0x11, 0xa, 0x300) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000600)=0xffffffe9, 0x4) recvmsg(r0, &(0x7f0000000640)={0x0, 0x0, 0x0}, 0x2) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='ramfs\x00', 0x2800000, 0x0) chdir(&(0x7f00000000c0)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f0000000140)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/midi.usb0/out_ports\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='d', 0x1) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) mkdir(&(0x7f0000000440)='./bus\x00', 0x13e) mount$incfs(&(0x7f0000000480)='.\x00', &(0x7f00000004c0)='./bus\x00', &(0x7f0000000500), 0xc002, 0x0) chdir(&(0x7f0000000540)='./bus\x00') mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000580)='./cgroup.cpu/syz1\x00', 0x1ff) write$P9_RSETATTR(r1, &(0x7f00000005c0)={0x7, 0x1b, 0x2}, 0x7) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000003c0)=ANY=[], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000280)={0x9, &(0x7f0000000300)=ANY=[@ANYRESOCT], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r2, &(0x7f0000000340)={0x24, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0003020000000203"], 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) 2.164090486s ago: executing program 0 (id=91): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000408405080042010102000109021200010100c03209040000000806"], 0x0) syz_usb_connect(0x4, 0x6c, &(0x7f0000000040)={{0x12, 0x1, 0x201, 0x1c, 0x8f, 0xc7, 0x0, 0x12d1, 0x1424, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5a, 0x1, 0x9, 0x0, 0x10, 0x7, "", [{{0x9, 0x4, 0x58, 0x3, 0x2, 0x17, 0x4c, 0x44, 0x3, [@hid_hid={0x9, 0x21, 0x81, 0x8, 0x1, {0x22, 0x17c}}, @cdc_ecm={{0xa, 0x24, 0x6, 0x0, 0x0, "b4b75f0beb"}, {0x5, 0x24, 0x0, 0x10}, {0xd, 0x24, 0xf, 0x1, 0x9, 0x8, 0xfffc, 0x2d}, [@mbim={0xc, 0x24, 0x1b, 0x6, 0xae, 0x6, 0x10, 0xdd, 0x3}, @obex={0x5, 0x24, 0x15, 0xe}]}], [{{0x9, 0x5, 0x2, 0xc, 0x10, 0x8, 0x2, 0xd}}, {{0x9, 0x5, 0x4, 0x3, 0x400, 0x4, 0x6b, 0x4}}]}}]}}]}}, &(0x7f0000000500)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x250, 0x1, 0x9, 0x3, 0x60, 0x5}, 0x194, &(0x7f0000000100)={0x5, 0xf, 0x194, 0x5, [@generic={0xe3, 0x10, 0xa, "e95c6d7663505a7fb3afed20cbb0fc00f11478aa9a8285dec3e11cb378a8139460ab500fe2e62cc7a9171a77bac85668b646d45a1dbea468b8210bed42ce7f89cbe1fd19e348135fb82f430dead5e967396b8ee71019078de6368cf646a1c35517e006c90f9a655ec0b7bfc8d4a0a5983793527cf5de92b8b310e463d4d7340c6e8de0fd076bc2e647150f81255afe5ea45b29747f159fa1874dd99a3442b4191497cf2ab5e6d7d2cbd2c3a6cb8e56f154c21e513c7a606f5fe3f4d95216a8de222ff5f703ebf14b7452e8f9d0f6cbae5039e327b2c72396ad91736fa2e95171"}, @ss_container_id={0x14, 0x10, 0x4, 0x5, "d1aa182975a57e2ae4395bf96087990a"}, @generic={0x7c, 0x10, 0x1, "70dec6c8cf4d1866cbce215930181b7b95b1e1fa54dd70ff8a9db5545f36fbea0df9980dcb7d15550656945ac3975d0677bee00025292dc957f53154d690edf8a8bbbed23ebd6e37d1191e8f1cbf36be8b4a1be34d52b5770fbf934d1227b49ebe73006bb273aa5bebf58c753c1e49d0485b64f3fffbb38804"}, @generic={0x8, 0x10, 0xa, "fa5724e3ef"}, @ss_container_id={0x14, 0x10, 0x4, 0xca, "a800f24bf617ebd7bb7dc0af8f1fae74"}]}, 0x6, [{0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x426}}, {0x24, &(0x7f0000000300)=@string={0x24, 0x3, "dde766aaa571ee593942241cad18ec81380d411c262aec5787987664d6c110e3642d"}}, {0xf2, &(0x7f0000000340)=@string={0xf2, 0x3, "1ab0602263ce3720f5afbd943d1d7caff29fc1fe1ffcf48640a984aae05b3c4a0687ef55a47b7f93ffefffab2800a47fbb7f22d153e05701f8f339b4e0f66fab16a10c145e3d40518dc220642d948badb0908d8f52b40298b783a82e95f713011cb42e4650de241a6bb6c8fc671e4585e4a9209bf69d0c2c7f04a3d809c8784070ed67b0cdacf7a9061ca434ee9b76630101a397db6f8f4d033c2d4858f585497655c60e649d9f099dc99ae02a4190bba812cd00be5bde76a8c05890d3b8fb8d9c100748c7451fdda5ced259bd69bc5faa7a3a25d5ada5e5fa1b1d06be8d30c35ae019e8da329240a779e4b175450bd0"}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x100a}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x81a}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x280a}}]}) 2.116086291s ago: executing program 3 (id=92): ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x8528c000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000480)='./dev\x00', &(0x7f00000004c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/ram0\x00', 0x2, 0x0) write$P9_RGETATTR(r0, &(0x7f0000005400)={0xa0, 0x19, 0x1, {0x2, {0x40, 0x4, 0x8}, 0x89, 0x0, 0x0, 0x100000001, 0x0, 0x7, 0x4, 0x8, 0x9, 0x5a, 0x4, 0xa8a8, 0x2, 0x6, 0x200, 0x4, 0x4, 0x180000000000000}}, 0xa0) pwritev(r0, &(0x7f0000000540)=[{&(0x7f00000005c0)}], 0x1, 0x5, 0x1) 2.091778143s ago: executing program 3 (id=93): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x28011, r0, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={0x0}) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000080)=0x10, 0x4) mmap$xdp(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x180000000) ioctl$FS_IOC_MEASURE_VERITY(r0, 0xc0046686, &(0x7f0000000680)={0x2, 0xce, "0bff6d2f1ae1c37b02141af9567d8cc35e51438d3b3f826ab76a5ed29456b91f083755f38258648a94f76c2e472d972972a1079c6ad90b917470be6b3053e4662bb6690c32df5ed036ad6b7b17a78e9acb8e4e836d6452c704d632d0eca50e30c913b6a1b82f36a7487505e0d8164c03f05d9184c89f11fd3c410931fda74d10a7379a344d9d0c84b872fcfdd84cddbc2ce6356cf44a3f3602a386d8989fc41a2d52353422a7dd62378196d5d3b89f8e06715f329b04d8f8688a935dca88fd6692c64d268086fccd1f64049cd3a9"}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000005c0)={'wlan1\x00', 0x0}) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BLKRAGET(r0, 0x1263, &(0x7f0000000200)) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000600)={{0x0, @loopback, 0x4e22, 0x2, 'sh\x00', 0xb, 0x2, 0x3a}, {@dev={0xac, 0x14, 0x14, 0x35}, 0x4e20, 0x3, 0x3, 0x10001, 0x1}}, 0x44) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000280)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010029bd7000fddbdf2502000000080096000300000005003e004c"], 0x24}, 0x1, 0x0, 0x0, 0x44840}, 0x24000040) sendmsg$NL80211_CMD_SET_COALESCE(r7, &(0x7f0000000380)={0x0, 0xffffffffffffff8c, &(0x7f00000003c0)={&(0x7f0000000400)={0x28, r8, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r9}, @void}}}, 0x28}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000440)={'wlan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000007c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_MPATH(r0, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x58, r2, 0x400, 0x70bd2a, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000095}, 0x0) sendmsg$NL80211_CMD_SET_MESH_CONFIG(r0, &(0x7f0000000580)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000540)={&(0x7f0000000480)={0x84, r2, 0x2, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_WIPHY={0x8, 0x1, 0x81}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r5}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r6}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r9}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x70}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x37}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r10}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x2, 0xb}}, @NL80211_ATTR_MESH_CONFIG={0x1c, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_CONNECTED_TO_GATE={0x5}, @NL80211_MESHCONF_AUTO_OPEN_PLINKS={0x5, 0x7, 0x68}, @NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES={0x19, 0x8, 0xb}]}]}, 0x84}, 0x1, 0x0, 0x0, 0x44804}, 0x3404c414) 2.032131849s ago: executing program 3 (id=94): mkdirat(0xffffffffffffff9c, &(0x7f0000002680)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000026c0)='./dev\x00', &(0x7f0000002700)='devtmpfs\x00', 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002740)='./mnt\x00', 0x1ff) mount(&(0x7f0000002780)=@filename='./dev/sda1\x00', &(0x7f00000027c0)='./mnt\x00', &(0x7f0000002800)='ext4\x00', 0x2000c10, 0x0) chdir(&(0x7f0000002840)='./mnt\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0) fallocate(r0, 0x3, 0xa9, 0x8000c5f) r1 = accept$unix(r0, &(0x7f0000000000)=@abs, &(0x7f0000000080)=0x6e) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x400, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r5 = dup(r4) ioctl$KVM_SET_VAPIC_ADDR(r5, 0x4008ae93, &(0x7f0000000140)=0xffff) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) write$uinput_user_dev(r6, &(0x7f0000000240)={'syz0\x00', {}, 0x0, [0x80000000, 0x3, 0x3ff, 0x8, 0xfffffffd, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x4, 0x0, 0x0, 0x0, 0x0, 0xf5b1, 0xffffffff, 0x10000000, 0x99, 0x20000000, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe, 0x0, 0xc, 0x0, 0x0, 0x0, 0xe758, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0xfffffffe, 0x0, 0x4, 0x1], [0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xedc0, 0x0, 0x5f1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa0000000, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0xfffffff8, 0x2, 0x0, 0x2000079, 0x400, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xc0800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x4771], [0x0, 0x7f, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xcd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x6, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0xf, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0xfffffffc, 0x4], [0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, 0x0, 0x0, 0x3, 0x3, 0xfffffffc, 0x4, 0x800, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x51, 0x2, 0x0, 0x0, 0x0, 0x3, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5, 0xfffffffd, 0x0, 0x0, 0x0, 0x8001, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8ec5, 0x0, 0x8000000, 0x4, 0x0, 0x0, 0x0, 0xffffe]}, 0x45c) ioctl$UI_SET_EVBIT(r6, 0x40045564, 0x5) ioctl$UI_SET_SWBIT(r6, 0x4004556d, 0x3) ioctl$UI_DEV_CREATE(r6, 0x5501) write$uinput_user_dev(r6, &(0x7f00000006c0)={'syz1\x00', {0xb710, 0xe, 0x3}, 0x34, [0xe, 0x1ff, 0x8, 0x3, 0x2, 0x8, 0x69, 0x2, 0x0, 0x874, 0x9, 0xd4a1, 0x3, 0x3, 0x7, 0x5b8, 0x2, 0x6, 0xc, 0x7, 0x51, 0xbe4, 0x100, 0x1, 0xa, 0x8, 0xfff, 0x8, 0xb, 0x80, 0x9ad, 0x26, 0x1, 0x5, 0x1, 0x6, 0x905e, 0xf87, 0xe2ee, 0x0, 0x6, 0x5, 0x1, 0x80000000, 0x1000, 0x1d7, 0x2, 0x6, 0x0, 0x8001, 0x10, 0x7, 0xc7bb, 0x1, 0x1, 0x5, 0x1, 0x4, 0x2, 0x339, 0xbbf, 0xfffff000, 0x100800, 0x8], [0x2, 0x100, 0x7af, 0x6, 0x5, 0x85a, 0x5, 0x7fffc, 0x2, 0x6, 0xa, 0x10000, 0x2, 0x17, 0x20, 0x2, 0x5, 0x5, 0xa, 0x65, 0x9, 0x9, 0x8, 0x4, 0x7fff, 0x3ff, 0xffffff01, 0x8, 0x3, 0x9, 0xb6, 0x7cb4cb2c, 0x0, 0x2, 0x7d, 0xffff, 0x7, 0xc5d3, 0xa, 0xc2e, 0x7, 0x9, 0x9, 0x8, 0x2, 0xfffffffe, 0x7c, 0x9, 0x5, 0x5, 0xa, 0x5, 0xc98, 0x9, 0xffffcbb6, 0xd0, 0x1, 0x5, 0x6, 0x1, 0x7, 0x5, 0x1, 0x6], [0x404, 0x5, 0xffffffff, 0x200, 0x5e4, 0xfffffff6, 0x6, 0x3, 0x1ff, 0x6, 0x9, 0x3, 0x0, 0x10000, 0x9, 0x3, 0x2, 0x89a, 0x100, 0x5, 0x2, 0x1, 0x3, 0xfffffffb, 0x7, 0x6, 0x20000007, 0x9, 0x4, 0x0, 0x3, 0x9, 0x0, 0x2, 0x6, 0x0, 0xfffffff8, 0x7, 0x0, 0x3, 0x6, 0x0, 0x5, 0x3, 0x9bb, 0xa, 0x0, 0x4, 0x7, 0x3ff, 0x0, 0xe5c, 0x1, 0x5, 0x9, 0x7, 0x80000000, 0x8, 0x1, 0xffff613a, 0x42c0, 0x76, 0xe339], [0xd54, 0x1, 0x4, 0xb, 0x2, 0x7f, 0x6, 0x4, 0x0, 0x7ff, 0x2, 0x10000, 0x8, 0x8001, 0x80, 0xfb, 0xe68f, 0xdaba, 0xfffffffe, 0x52b, 0x8010, 0x9, 0xfd, 0x80000000, 0x8, 0x8, 0x2, 0x5, 0xfffffffb, 0x5, 0x7, 0x7, 0xd2c7, 0x8001, 0x94, 0x80000000, 0x8, 0x0, 0x5, 0x0, 0x8, 0x6, 0x3, 0x7, 0x0, 0x7, 0x961a, 0x1, 0x7, 0x49, 0x7, 0x255d, 0x1, 0x0, 0x9, 0x5, 0x10, 0x7, 0x0, 0xff, 0x66, 0x90000000, 0x7, 0x81]}, 0x45c) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r5, 0x8916, &(0x7f00000001c0)={@empty, 0x6e, r7}) 2.0231484s ago: executing program 1 (id=95): r0 = syz_create_resource$futex(&(0x7f0000000080)=0x1) futex(r0, 0xd, 0x2, 0x0, 0x0, 0x2) r1 = syz_create_resource$futex(&(0x7f0000000000)) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r5 = pidfd_getfd(0xffffffffffffffff, r4, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) r7 = socket$packet(0x11, 0x3, 0x300) r8 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_int(r8, 0x0, 0x31, &(0x7f0000000240)=0x1, 0x4) setsockopt$packet_int(r7, 0x107, 0xf, &(0x7f0000000340)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000380)={'bridge0\x00', 0x0}) sendto$packet(r7, &(0x7f00000003c0)="0b032200e0ff25000200", 0xa, 0x0, &(0x7f0000000400)={0x11, 0x0, r9}, 0x14) r10 = geteuid() sendmsg$nl_xfrm(r5, &(0x7f00000005c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000580)={&(0x7f0000000440)=@newpolicy={0x13c, 0x13, 0x100, 0x70bd2d, 0x25dfdbff, {{@in6=@empty, @in6=@mcast2, 0x4e24, 0xff3a, 0x4e22, 0x6, 0xa, 0xa0, 0x100, 0x2b, r9, r10}, {0x8, 0x8000000000000001, 0x1, 0x1, 0x80, 0x4, 0x2}, {0x2, 0x1, 0x3, 0x2}, 0x1, 0x6e6bb1, 0x2, 0x0, 0x3}, [@algo_aead={0x83, 0x12, {{'echainiv(gcm_base(fpu(pcbc(aes)),poly1305-arm))\x00'}, 0x1b8, 0x60, "99626122e8bf2c1f61cbd35c3e8b12aaf6056cffef79880aafe51238f513e29e41c93c74418696c92d17f58d2cbd34c219f845dc9abb0d"}}]}, 0x13c}, 0x1, 0x0, 0x0, 0x4000800}, 0x20000880) r11 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r12 = ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r12, 0x4008ae89, &(0x7f00000002c0)={0x1, 0x0, [{0x400000b3, 0x0, 0x1}]}) futex$unlock_wake_list32(r0, 0x68a, 0x3, &(0x7f0000000200)={r2, r3+60000000}, &(0x7f0000000600)=0x7, 0x5) r13 = syz_create_resource$futex(&(0x7f0000000100)=0x2) futex$unlock_wake_list32(r13, 0x601, 0xba9, &(0x7f0000000140)={0x77359400}, &(0x7f0000000180)=0x80, 0xa) nanosleep(&(0x7f0000000040)={0x77359400}, &(0x7f00000000c0)) futex(r1, 0x5, 0x0, 0x0, r0, 0x1000083) 1.945743669s ago: executing program 3 (id=96): r0 = socket$inet6(0xa, 0x2, 0x0) (async, rerun: 32) r1 = add_key$keyring(&(0x7f0000000200), &(0x7f0000000240)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) (async, rerun: 32) syz_clone(0x82020000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) (async) ioprio_set$pid(0x2, 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000001600)={0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x6, r1, r2, 0x40) (async) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x7ffffff, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000018c0), 0x82f41, 0x0) (rerun: 64) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000001900)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async, rerun: 64) r4 = socket$inet_udp(0x2, 0x2, 0x0) (rerun: 64) fcntl$lock(0xffffffffffffffff, 0x25, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000001940)={'syzkaller1\x00', 0x1}) (async, rerun: 32) write$tun(r3, &(0x7f0000001980)=ANY=[@ANYBLOB="0a0092000180c2000003bbbbbbbbbbbb86dd694fd2cd00083afffe8000000000000000000000000000bbff0210000000000000000000000000018f0090783c030000"], 0x42) (async, rerun: 32) rename(&(0x7f0000001640)='./file0\x00', &(0x7f0000001680)='.\x00') (async, rerun: 32) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) (async, rerun: 32) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000100)={0x1, &(0x7f0000000140)=[{0x6, 0xf5, 0xe, 0x7ffffffe}]}) ppoll(&(0x7f0000000280)=[{r5, 0x1}, {r5, 0x800d}, {r5, 0x492}, {r0}, {r5}, {r5, 0x1114}], 0x6, &(0x7f00000001c0)={0x0, 0x3938700}, 0x0, 0x0) (async) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000180), 0xc0802, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r6, 0x81f8943c, &(0x7f0000000400)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, &(0x7f0000000600)={{r6}, r7, 0xc, @unused=[0x2, 0x77, 0x7, 0x6], @name="a59e287d49058bcc516968cc527b04d8760931a94955270c2a14916eb7d56064190c7e20f27be13148ba60af6721551b6acd1e3ab0ea734d8c21ddc36ea355a2c27caf34b64a720a31fb5dabc325a7c6fa848d24a916f3b145f6b08d752d0584bd5e8090972b76685fd9a631678bcb6307ca022dec943cb01ced934612f1d7608e12a595ac570b05b3aebf584809f2bb674a35679104cff2532ae15a863b522e714a0831679558ca1eb36528c27505648c2fce10925acadcfd461d403c90d693e483936c46e3f87fe9ef56b5235fc998a5c55b648131152a22a6ccb36e5ac9610e896ce89dc953293c6e72c748928a57fca4c429a78d5d272de84d2629fedc38520898590b6fcf93168f9b104505141560c970baea64450e6c53f47f2789a4377d13e9a08b95c3c0169e43a5d18daa2b2728a996cd1c15ead52a3927668d3335c586680255dfc7c95d42fad32f3f28abc85c84fc7f5f5eac5319bc1b99844d796d32014954f6908ca1f28792003787696cbac265706953864e039c934d3dbfa12922568429b369f679c48b15734fe99eb1885c02a31dcdbb406d66fe3a8828cf79d7b29de7969fefbccce406537833669eac150158b0a96c57aaa917f2f25b925f46e378c6188133505de7c0dc9ce931fc46da499c40ddf560cad028d551b5bad231b17a000802ca839608096597f6d76fbf33ec63aaa7dd218758a6111f03ee562079ae115ac09729070432bc48ebef07b950e8d424bfdb162b4e00e264cb5aa38e150fdb471ba998b04940a922c0b65318655e4a0e8dc2ae80a8fd1e19d434c64d433801b8a792eabd1dedca10edd442ed3f6a58ab86fbf535bd01e4abcece4af1dace010b2baf16bce50f979d5dc4839edc4b9e7b02baa133613e68619ba175eadab4e0519a9b41afb303b5a259296e485d066f9d01f6185687fab8c8f2ac1b61bc124d1527ffb79d192a23e14f225307fb5bb3da48e5e66c59593358fcf1c41e3dac2cce180945fddc11a2bd56635d6173d00d02c89e21e3a3f9b2b3fd7844a1dc87a1a74691a320221831c80c1d040899427fd0fb55f565f18e45b7c5672177f09b81bb75c59086b01a1c17838f1d25300c08dc37bede464840c293dbcf729b2597cccca4a8ca6de07260acfc711ffef39741f0713d4f6463b89b7383cf3fbf0003279d37c9312147f190a871d1d88b77eac65ee0d57b37e446eba64940dddb464ad9283e9d8b90450307f8c02f97baabc532471998030b3b0d983bd4dbd76c3f67e0613b1859e4d933cc138dc3c91e81a8d1f63c70c67ad61991e8d71fb0d64ab2e536665e39122ab639e174bb099f5d3c71acc27a1874b9b2af715bbc5555504f514466ead86eff5991bbc169ac8684ad168055670de291294e625e7f86b3e69d8476f94262acf916499c51af00a0a47fa46f6386fe0a1e5da05a9786f4b7a580d91fc0b721d96b4406791e64143779494b2b28cc703a9ea20d77a9e2d6019df6248a10871bc50724ddabc4d8164de4c1d7aac104739b95b6c31567cfa3d179f39f43bbf5d4576ec850914af38f73ac64adcf7a595189c759119396c8f15239894587f609dd7f69a08fd79550fa2ec31b6f990355c8d9912867d35264bdadc9870c4ef0b2484d4ce52f59f228f33cca89766d24ea9902e2f74da14753110d5782607888262de468a12a7fbd1a0cef41a25d6c325c93f6140e6208afbeace46d5f479d5bd837fe83504f0d35de5b31a1efcb54ff071e39ad68bb2d5c3754873b64feb11b9616c0e547cba88bccc8e3b9553a856d1198eaa7b2df3c486c11bdb3f195cb6e1a241834413eef7ceb8df012585b2104a6247b339e9d036be28351e3a61864346dca4c4b406063da064449d1abf9ed28316bbfbfb9d7da240979f2d486691d3b642596b3c77ed0336cd73c14f8c39b99b15ac6e6b38015f96c6b800e2d2023950be002a4e3709523b3ed215e42657c45d45025c02c336ba608ec1fc590e71342cec2a94bf1d564447263b0440b777e8b4017ac05e758b32832e8f33ff226ad37550be1f4729fbf7220df88f81ee1414e035e112a534873bf9bf5533a1acb9c09bdedd9fa1c072337477858a9a0a661365fe4720b1b8b24e80d4a9a998151066d58ecf76d797b48f02656d52f0c5a3b21e211edd9762fa3c83ca312959f8ba1e4a724c2a0e09353f7520b6ffa259d5846878eddcae3b39aacd241de40649dc10bdd1523d4c4595f6d176907fefa266ecc414f5c759aa2bee360b92ae65622f22f8bde65d60955298a24aa1e7278f5cda4396f43f35421155728237cbded188452ba8ac50aed2c9f790da3e4c95a5948f005467ea4b15a1a78f9b58b1883cc76046199574a9dd8f843bd55d1e19d3aa918b56958600f073c33e743dca4e44e3373609885755578a3a6b7a59457edc1a10789dfd23a05053687637219113da5d74a2b83c8b2ba2bdec4b9c9b96fa9b4cef2d2967e0261ef5a87f5f541e0b6ee97147eac30583a747d4cdb4915230fef75f1065aceeeba1bc29c0233ad579085e3614fc6798f04f5edbed42be4b5f30cbefd779e38d103e94311a43679ce41c3f9307d85112d1af1e9780704e2cd0bb99cc92a17c28b90f1b596c19ea46bfdab4205e20135a341432e8bab43737f21db8f03c8758517b5459e969be15d0f074364e7c852a38532449e01e51936d5180f1d2b7635be63a8f19781fc5e878ae2bf8db5ba5292be04143521bc4386361270f5a7702159102278fc01bcaf29574bbb750e3d4b1d1fdee03aa80a2458d5687fe7e4cd267e39f56b720f1137b4c2771056ade78b83b6ab9a29ea7485d05b77b9ebab9a5143f4e525d1e7b0d98e4a56bdf69cb47ce26fd8c533cdeaa6394d57347ad72b2ab217b1ee9daf34cf89074abd27cbfce84e408e798de27b8a2bcc38d1d3e7c061f1cdd877b588b42866ff8090167bea519854d927208a89fde01975a3f95915f0912db93fd9f6c3a29d641e1226f5b521843b06d8e2dcec97ceb0c638cc2416d0dbacd3e50b6a2fbed9130bc2bf36278a1666aa093df0a20adb83ad5f8aeb76a51c8738ccf17142c3599b72da1bfa409a0a83bd085eafea045d81b1518bcf0517c72c61c3f895dbe72adc5804a08086d5f762664b0220abdb22a24d185faf7d813f7140f43763cc86e146edecd2a26f92316b6695e580b2f6010f1bbf005cf365303410c613229fff9e5327edbe4d45f29be1cddd688f3c81bb2b8400d6ac060cdcf27614f81a10c74a1e9b8ba7da6fb1a0089055945555c92676c9ebc4b0aacf235446c401f154949c6972101bff6a8913abf8b63c6f516e9710b34f82e8126954f94334af1680cbdd96070db778054549cba2368bb540d9c5ad5394032d50840f3f57c975e40f9aee5e35a99a1bea9060e0a2c0a3df961373cd1fc9c037d4605c1a4fee1ae2271bd91d46a690077187d337782144f875249065540fa4451102259b75739e1f4d8f6f5a2cf3566ed13bba096f8f4ea3d94e674bb8e70868f60becada705e19e0209ea2ae6b1ff2701210671b6dff51c7c025cfa550a1748d82df6da5dfe16e2de3981e4cea975bbae8524354946e7d0662636b0c41c952e6f9e03bd5ac9df253e66d906e6fa0e14f8232cbad2b1bd033e699cb39e836f7401eeeb96730364a68c0a8c9e871f98ab3c2d85cfef70ae757725ef13235ebbb650ae7ef8d0ca9ded48e0b8eeceaaec3765f4d82cbf770199bcba1835ca81e4e3a2b85dfaba3fe6c084c9e00f6a7b5f00159fc59db9e5abf06f3b67272f09915b7cdc5e385857495708fc13f45d3545ab886db536417079a4df07354fc13fffa6f702b58c765218089a1388af777b045a66963e2c73574f8bb71c3f3693f9176d3fade88eee7afa7e62b261730d771e30f30d7297b6e5f684a8dd8c9789709d75cd1ea83e3ea75038e0d59ecfd5710458e2e3b0b3e2bbad01e63cbb32355a787bd375b285f841dbc2b890038eb5649d1b03660069095dea8b006109261e46a98b9537956daf0a148a8a20af89a07026df07325a512b5983179c8e19a85e887b8c116c61969502934e7516791701e1ab00a9ec904bd63959da6e040c3ceea456f24341e64f41b891126107d8b4c0725c549443c0ee504e943c8aab40aafb2f2c09d039f30c61bad600850ca4d9384b08fce4908756ee94c79bc69f0dc743df1e5714dc66f96af086f96fbc9e3c5c78b705eb41ce57c3020858e160c0dc437ba855de76d595f5e83c5e26a67a74e02d1502fd9f8d8a4f925a9092d57f813dceaff3914f27c185d1c71d9f81fbd23e1a770efda155216083a0c55d713af2de79b7165a087e262681dbfb905696e8258bc849b78d7f211447e5b4111fdbbb76becc9427f014a86feafbec94eb8befd81e6eabad9ba94b4ca527918de61a0494b8b9fe0cfe0cb750413b61501d72e851d444291135a1abdc7cd3f974abc63d34960f1a9eaca9eb14b65e9841470af336fdb94e1570fcb901ffbbd07bfdba773830e75d437fd933f1b4f52146164ac7ca94da68365608e37c10304e25751fc737f30259aa628858218c81107b7e8edb712f16834ced0926706b8a42b388f169be415c5abd493c8896aac28c21c2702b58a37bbef4a4138e7aa1d9ac9a8ecda97d718892de5cd7e5e298ea638da5caddb68279376047866831fe75a625d4d0bc123ec06f10b22dcc74788b3ad9e620b26ee3d31ead9835f27d760d9217cf8c2ae13df908f69f1b6e9c0ec547677393e93395efbfa19988cb8d656fa3c92183155f75943bc956dae7f39cdd07662bb5ef7699109ce2bdb1ee72fd43229d0c4fa842c94f179fc4ba9aecb83f8b89773a7ca2d2b213819e16b248fe415ff94a6e2939e0894e86abddabc3168945f02a865be75e0fef909dd1048d74cc91af60bea8504620ecd598ec9de6105ea6649f8c21a8e3f4ab453bad5f917a67f01488bb7c80c8215ac5323c4ade027eeb498c3db2db1b96f09d7d378cd62be64d38626c6b5a84ac4bf7e7b0754951a25eb83e6706f5866d6d2266b2c67aa933b0039a6d0dbcd4d98e14c740f058b8f8e563c3112d35c943acb0de0af0ce7cd16d9b9ac3642d1638b194822e2adbbad4333892446d57f73ff6a784296a00f79f571de7f4d0b7e288800fc85b0e9c55830e25c5f3c12fd78392dc1f773b6b93623a78a11e94682daf6aa560e3d86f4ef9d37834f475340b1306a51fe5cfe1d26d51aa6433b03b6f66d9049647859d43ead54a84394648a78b36ea30f62951eaa7162c0b2f1b13a15d1ced9c552145c8d61caf22480f7c947032227643c91ab909d3512bdcc1b8b8fe9257ee26c115ef13a9381f7bf179391737cbc1ec3e499ad2f9e8040375e2c378d97076b12840cc4c2d63832936ff35ede3a1ffcb2d86799fc7d4d8069ff9f7df18cfabbed452fbb9af2e9176df3cd358257b1eedb15ce3faab6e552cd06e912401f5ec66a09b9109f32f0bc61b07a8d52c56a811a8ccb4666fc1063bc2dfe0891e527f690c03ea5a2cfde7c4ab52311ae9c795318d0d12fca8e3f6810600f04694440aebecb4f6ce3c2199548c773c4b5c03da52614e7de011a3055ed5b22d130aa6c08d82dea71ad5c43e4e67452a2e08738d62d4ea0ce7b4f6cd9999bbdce3558cc418e9c62ef20e42e1fba5b4233d3fd99e8bc81f89eb7429ffcb8ad9ccab0ff6dd1030825a44924b8ba87f936acc8031"}) (async) ioctl$PPPIOCNEWUNIT(r6, 0xc004743e, &(0x7f00000002c0)) (async) syz_clone(0x102311, 0x0, 0x0, 0x0, 0x0, 0x0) (async) select(0x0, 0x0, 0x0, 0x0, 0x0) (async) ioctl$PPPIOCSMAXCID(r6, 0x40047451, &(0x7f0000000300)=0x8) ioctl$PPPIOCSFLAGS1(r6, 0x40047459, &(0x7f0000000340)=0xc) pwritev(r2, &(0x7f0000000380)=[{&(0x7f00000003c0)="00214500002800000002400600000a0000010a0000020050", 0x18}], 0x1, 0x0, 0x0) flistxattr(r0, &(0x7f0000000000)=""/222, 0xde) r8 = add_key$keyring(&(0x7f00000016c0), &(0x7f0000001700)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) add_key(&(0x7f0000001740)='asymmetric\x00', 0x0, &(0x7f0000001780)="3082010c3081baa003020102020101300a06082a85030701010302300c310a30080603550403130141301e170d32303031303130303030303058170d3330303130313030303030305a300c310a300806035504031301413068302106082a85030701010101301506092a850307010a01010106082a84fb0701010202034300044001010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101300a06082a8503070101030203410002020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202", 0x110, r8) 1.141182412s ago: executing program 1 (id=97): mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffefffff6, 0x20031, 0xffffffffffffffff, 0x0) (async) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x541}) (async) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x4}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f00000001c0)={&(0x7f00006c6000/0x400000)=nil, &(0x7f0000685000/0x4000)=nil, 0x400000, 0x0, 0x18100}) (async) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000080), 0x181000) ioctl$SNDRV_TIMER_IOCTL_STATUS64(r1, 0x80605414, &(0x7f0000000140)) (async) syz_usb_connect$midi(0x5, 0x53, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x582, 0x2b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x41, 0x1, 0x1, 0xf, 0xf0, 0x14, "", {{{0x9, 0x4, 0x0, 0x0, 0x3, 0x1, 0x3, 0x20, 0x44, [], [{{0x9, 0x5, 0x6, 0x2, 0x200, 0x4, 0x6, 0x1, {0x7, 0x25, 0x1, 0x3, "5ecea7"}}}, {{0x9, 0x5, 0x1, 0x3, 0x200, 0x6, 0x2, 0x8, {0x8, 0x25, 0x1, 0x4, "d7e26abe"}}}, {{0x9, 0x5, 0xe, 0x12, 0x8, 0x8, 0x2, 0xc0, {0x5, 0x25, 0x1, 0x1, "ec"}}}]}}}}}]}}, 0x0) 1.028215083s ago: executing program 0 (id=98): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000280)=0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x20040, 0x1ff) socket(0x1e, 0x4, 0x0) syz_ublk_setup_queues(r1, r0, &(0x7f00000002c0)={0x0, 0x3a98, 0x1000, 0xffffffff, 0x2f6}, &(0x7f00000005c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x0, 0xffffff, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb66c, 0x20000, 0x3, 0x20c, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x52ef, 0x2000, 0x1, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x4000, 0x5, 0xffffbff7, 0x0, r1}}], 0x1, 0x0, 0x0) 1.027933063s ago: executing program 0 (id=99): r0 = gettid() timer_create(0x0, &(0x7f00000003c0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f00000009c0)) timer_create(0x1, &(0x7f0000000000)={0x0, 0x2f, 0x1, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) syz_io_uring_setup(0x3bad, &(0x7f0000000100)={0x0, 0x3fb0, 0x10, 0x0, 0x14f}, 0xfffffffffffffffc, 0x0, &(0x7f0000000180)) timer_gettime(r1, &(0x7f0000000080)) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="440000001400010000000000000000000218000004000000140004000000000600000000000000000000000115000280", @ANYBLOB="e0"], 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x8810) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) timer_settime(r1, 0x1, &(0x7f0000000a00)={{r3, r4+10000000}, {0x0, 0x989680}}, 0x0) ioprio_set$pid(0x3, 0x0, 0x0) r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000d80), 0x80002, 0x0) read$FUSE(r5, &(0x7f0000000dc0)={0x2020}, 0x2020) sendfile(r5, r5, 0x0, 0x2000009) 980.239518ms ago: executing program 0 (id=100): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000080)='veth0_virt_wifi\x00', 0x10) sendto$inet(r2, 0x0, 0x0, 0x804, &(0x7f0000000100)={0x2, 0x4ea2, @multicast1}, 0x10) (async) sendto$inet(r2, 0x0, 0x0, 0x804, &(0x7f0000000100)={0x2, 0x4ea2, @multicast1}, 0x10) setsockopt$inet_int(r2, 0x0, 0x14, &(0x7f0000000140)=0x1, 0x4) setsockopt$inet_int(r2, 0x0, 0x19, &(0x7f0000000180)=0x7, 0x4) recvmmsg(r2, &(0x7f00000001c0)=[{{0x0, 0x0, 0x0}, 0x9}], 0x1, 0x0, 0x0) (async) recvmmsg(r2, &(0x7f00000001c0)=[{{0x0, 0x0, 0x0}, 0x9}], 0x1, 0x0, 0x0) signalfd4(r1, &(0x7f0000000040)={[0xde04]}, 0x8, 0x80000) (async) signalfd4(r1, &(0x7f0000000040)={[0xde04]}, 0x8, 0x80000) fcntl$setsig(r0, 0xa, 0x2c) ioctl$SIOCSIFHWADDR(r0, 0x8937, &(0x7f0000000000)={'veth0_vlan\x00', @random="0100002010ff"}) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000001240)=ANY=[], 0x1118) 973.002929ms ago: executing program 0 (id=101): ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x8528c000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000480)='./dev\x00', &(0x7f00000004c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/ram0\x00', 0x2, 0x0) write$P9_RGETATTR(r0, &(0x7f0000005400)={0xa0, 0x19, 0x1, {0x2, {0x40, 0x4, 0x8}, 0x89, 0x0, 0x0, 0x100000001, 0x0, 0x7, 0x4, 0x8, 0x9, 0x5a, 0x4, 0xa8a8, 0x2, 0x6, 0x200, 0x4, 0x4, 0x180000000000000}}, 0xa0) pwritev(r0, &(0x7f0000000540)=[{&(0x7f00000005c0)="75a9a8139f532b0f97f3c1139de0a8282431997b7cc5409b54a8f79dcf3cd524fd6bccb0726169035652cfbfeb8d7cd4de62a3a9a5063a02f2e91d11d38215e7c54cb819cc6621d06ef05a74cbaa4d20e949f47b943070ced6d2acd31307a78ee3afae49283d7d84a1c4ae5b4bdd168bc4ac2285b152dd995882c1010d30fa76137a58c94a2b67f6495abdf6ec87d798c8dfab4dfe3b274c89668b2f92f73fb86bc6c2de940c7afb9c4fa6f62ae1f341bcbcac0ad129b713720996450a8d3b41abbc162895c3a0cd8a67406933439de27b52703dc2bdc490501639ce735bea7bb29a71f1589e6c3d680cd18bb0a3a4bd1a6188fd72ba6a9f782a4e301072bb5d5eda56922d2475d241e4d65f3269a8fe8ac1fbd4797e96c412170709566b0ee430f5189b8f9916c15c3d108319f39a79afe175d2f919d4d7ca705876926af36f2764a6b4b3d247693388d5a93275ba707069ad710389fa187753d82645b2044f0a784fe5a9af2cc67c44147ce437e90d9f8febae0052c4c85aaca24feb0bade0ae7a1b95e07825c4fff11159a1176f44bca47c785a42296e1762d6e7a6d5365a364f6a3857fd160b37d465cd887ec5bce8d33a5bf13a90183887cdaa76b76ee192b8a9b6e69a7e7240dc3b1ea0cc9cd7b541ef97790671c2540fcfd8ae568be22fcfa3c03b447479b758e2f2fefb178668e109d0c493fdb0bcfdffbc6e91112802289ba33de5700a9b45b3157febb235052f9991c71bbcebfa44202d330fe83ddda387c9128bc0e1677b43e13f38807a61e91292dfa8de3d0c6a59bbe887644eab94f1222f14a9b5f7b7620ce10c7af0d7521f9d67eb01a7525cbaf393afc22f19187c4cc52e98910b39667607eedb2981a3f4cbabea4b806f73e2e3b9b95be7786b405d1069561b1b296b8ddc68df8b435123c19c1b7b18ad1c03e5dbb7ff349175be49df7c12975f72d6a291f3f520a32bcbff68c8cbecdee4a878d5300ca86b961d62986fbe31dde6e218888c43338eb53e5b09c334d7f502dd484f9a43b0520e0b39c2e1fdbb1d1106bb5f85ef53c1da1ca2fb6291fde0438774e93db4824d2ac09ddc3e8f9a0062f42a9e62d2cde4af326dcdf5f8e214328bbda2ba2c5df21c582f5567e947533bad5370d1f1638f4ee04986d61b11f7a04ab63c2ab43314d2da6a314be5474addf50a5f8c447eb0349163dd9ab322df46e7737f9d69d8ca2ee54dc1ddbd438b29bbed5c3bad4df015edf6cb5cf2aba81342bce215d20c1e993e8465c2aba8be7ff7fbd654330bc8ed3d3a76e441208b73a0fef8cfd707f0e905d794e385aea183c5355a96286f9e3fe7c1d2d9948aeb38991c559643ff98f31074af958e4831f2618cb0be3dab3757441db55d3719dd8035ce23356cf1adaa4b1fd42e8833c9065b7f60bedfff55ce86657cec4f151df3f9ad9095df26a32c13749f116ec9d2451110f3aefa9c568786b2d76d57c721cd0d6be10d4464858e6618084c6839bf4f502b893f92e29ee1b3d135c7293d5722135caafbb32033330e1c8efa50d369da9249b253b01c151da39ffd2efca245499a649b70b447a64cd8cf484da44f68925c665f31d36f0864c0ac687ec9b887ac57effc45798bf178deff818c3d5927ebf482f5639034f5302b1e2c43ffb812183adf833aa2de9fb9106d4e209939d7ee80820a73bfaf5a0f866dc3968ad80b5b7658e41dc542871b8badef6a6a9fc451aea00b30bfc4a28dbfbc5efa16fdbc13d51b460ba5b61778b455870b785343490d113703c0af43d16ce73a4f473550cdeb37375ff37075131765e18f84ae87f4968ba085b683516e2b7c3c6bfe4cad7bbde640ff57663273ea1f21969e34ad04e695f72540d21ac4e96fdc3c245e3b9d98a0c6ccefe5f0a91b76b33382464f5dde73e29a", 0x54e}], 0x1, 0x5, 0x1) 959.9362ms ago: executing program 0 (id=102): syz_usb_connect$cdc_ncm(0x1, 0x6e, &(0x7f0000000200)=ANY=[@ANYBLOB="12011003020000082505a1a440000102030109025c0002010890020904000001020d00000024060001002400000000240f0100000000000000000000241a0000000905810300000000000904010000020d00000904010102020d000009058202000000000009050302000000000089f751112c751234f79b8942013f1af6f63ba07fc38bce9018ec5861b1c4f4a56da32b5bd288f265bac324c0d3"], &(0x7f0000000140)={0x0, 0x0, 0x12, &(0x7f0000000180)=ANY=[@ANYBLOB="0500"/18], 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f00000006c0)) ioctl$PPPIOCSMAXCID(r1, 0x40047451, &(0x7f0000000700)=0x8) ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f0000000740)=0x120008c) pwritev(r1, &(0x7f0000000780)=[{&(0x7f00000007c0)="002145001f2c00000000400600000a0000010a000002005000500000000100000001601003e80000000001010101", 0x2e}], 0x1, 0xf, 0x8001) pwritev(r1, &(0x7f0000000800)=[{&(0x7f0000000840)="002145000b2c000b0000400600000a0000010a000002005000500000000100000001601003e80000000001010101", 0x2e}], 0x1, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) syz_ublk_setup_queues(r3, 0x0, &(0x7f00000003c0)={0x0, 0xfffffffe, 0x700, 0x4, 0x1f3}, &(0x7f0000000440)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x20, 0x0, 0x6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x8000, 0x3, 0xbab}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8684, 0x0, 0x40040005, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xec4b, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) gettid() r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) connect$bt_sco(r5, &(0x7f0000000940)={0x1f, @none}, 0x8) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000040)={0x0, 0x1, 0x0, 0x100000, &(0x7f0000000000/0x100000)=nil}) syz_usb_connect(0x0, 0x5d, &(0x7f00000001c0)=ANY=[@ANYRESHEX=0x0, @ANYRES64=r4], 0x0) 441.457724ms ago: executing program 3 (id=103): ptrace$ARCH_MAP_VDSO_X32(0x1e, 0xffffffffffffffff, 0x738, 0x2001) (async) recvfrom(0xffffffffffffffff, 0x0, 0x0, 0x2000, 0x0, 0x0) ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {0x9, 0x1}, 0xb26fd3ae, 0x4, &(0x7f0000000040)={0x5, 0xf, 0x84b6, 0x9, 0x4}, 0x8, 0x7, 0x0, 0x0, 0x8001, 0x0, &(0x7f0000000080)}) (async) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x1c, 0xfffffffffffffffd, &(0x7f0000000100)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000540)={0xa, 0x4e22, 0x7, @loopback, 0x200}, 0x72) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) (async) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000780), 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r1, &(0x7f0000000880)={&(0x7f0000000940), 0xc, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x8810) (async) prlimit64(0x0, 0xe, 0x0, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000980)=0x8) (async) sched_setaffinity(0x0, 0x8, &(0x7f00000009c0)=0x2) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000a00)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000ac0), 0x318, 0x0) (async) recvmmsg(r2, &(0x7f0000000b00), 0x10106, 0x2, 0x0) (async) mkdir(&(0x7f0000000b40)='./file0\x00', 0x97) mkdir(&(0x7f0000000b80)='./file1\x00', 0x13b) (async) mkdir(&(0x7f0000000bc0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000c00)='./bus\x00', &(0x7f0000000c40), 0x0, &(0x7f0000000080)={[{@verity_off}, {@lowerdir={'lowerdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './file1'}}]}) (async) chdir(&(0x7f0000000cc0)='./bus\x00') (async) r4 = open(&(0x7f0000000d00)='./file1\x00', 0x2a4242, 0x1df2a23c5997fa5f) write$FUSE_CREATE_OPEN(r4, &(0x7f0000000d40)={0xa0, 0xffffffffffffffda, 0x0, {{0x4, 0x3, 0x5, 0x6, 0x3, 0x1, {0x0, 0x9, 0x20ff, 0x1, 0x89, 0xd615, 0x9, 0x7fffffff, 0x9, 0x8000, 0x0, 0x0, 0x0, 0x3ff, 0x1}}, {0x0, 0x13}}}, 0xa0) sendfile(r4, r4, &(0x7f0000000e00), 0x7f03) (async) r5 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) (async) r6 = socket(0x9, 0x803, 0x40) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f00000001c0)={'veth0_to_team\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xf, [0x102, 0x0, 0x82a4, 0x5, 0x7f, 0xff, 0x4, 0x7, 0x9, 0x6, 0x9, 0x40, 0x5ca, 0x8, 0x81, 0x1, 0x80000000, 0x1, 0xfffffff8, 0xc, 0x9, 0x9e, 0x6, 0xfffffffd, 0x0, 0x1, 0xd6, 0x401, 0x1ff, 0x180, 0xa, 0x2, 0xfffffffd, 0x0, 0xff4, 0x8, 0x9, 0x800, 0x3, 0x6, 0x5, 0x0, 0x10000, 0xa7, 0x6, 0x5, 0x0, 0x4, 0x7fff, 0x4, 0xffffff66, 0x201b, 0x1, 0x8000001, 0xffff1de7, 0x80000001, 0x3, 0xc0af, 0x4, 0x0, 0x81, 0xc74, 0x6, 0x1, 0x0, 0x4, 0x213, 0x9, 0xfffffffd, 0x40000004, 0x3, 0x8, 0x7, 0x0, 0x4, 0x9, 0x800, 0x1, 0x6, 0x4, 0x3638aa87, 0x3d7e, 0x7, 0x3, 0x6, 0x7, 0x0, 0x1, 0x5, 0x6, 0x40e5, 0x6, 0x0, 0x5, 0x3, 0x10000, 0xffffffff, 0x1, 0x1, 0xf78, 0x7, 0x2, 0x120, 0x10000, 0xcd, 0x5, 0x9, 0xffffff01, 0x3, 0x81, 0x9, 0x7, 0x9efc6186, 0x8823, 0x8000, 0x733, 0xa5d, 0x94, 0x1, 0x10, 0xda800000, 0x4, 0x354, 0x52, 0x0, 0x8, 0x8, 0x3]}}) write$selinux_load(r5, &(0x7f0000000180)=ANY=[@ANYBLOB="8cff7cf9080000005345204c696e757813"], 0x65) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) 84.091471ms ago: executing program 2 (id=104): socket(0x28, 0x5, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r0 = socket$pppl2tp(0x18, 0x1, 0x1) dup(r0) socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) r1 = mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x5) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x70, &(0x7f0000000400)=[@vmwrite={0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x81a000009}], 0x1) ioctl$KVM_RUN(r4, 0xae80, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, r1, 0x0, &(0x7f0000000180)={0x2e, 0x2, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000340)=@new_dev={0x1, 0x19f, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x1}}}, &(0x7f0000000380)=0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, 0x0, &(0x7f0000000600)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe706, 0x1000, 0x0, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9b45, 0x1, 0x1, 0x65}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93e9, 0x200, 0x4003bfff, 0x2b8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x891f, 0x80000, 0x1, 0x230}}], 0x1, 0x0, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r9 = openat$cgroup_procs(r8, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r10 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r11 = openat$cgroup_ro(r10, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r11, &(0x7f0000000200)=0x1, 0x12) write$cgroup_int(r11, &(0x7f00000000c0), 0x12) write$cgroup_pid(r9, &(0x7f00000005c0), 0x12) r12 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r12, &(0x7f0000000240)="6f4656ab0d1cf4cfa759ce7578b589d19f5179420b4a65a6b83a5c83894e5d3f84fa6ffdf637481d90a7c43c6857df8f9e4f84d0ea3a3c9d019598f311e3f105609d909f15b2ecc628d5f067a88c7eab64fe15932f29596efb86412f565da0b805a3b644c135997f3821789bb04351fc198d411594d93aa4b3a0aaf88245e90bbfc25b884683bae282ce7c294f4901b08350b44afafb94f02c1d3cf7dae256766b7890ed6c945254d1a8297eabedf10f9b95dc168707a615", 0xb8, 0x24008850, &(0x7f0000000300)={0x2, 0x4e24, @remote}, 0x10) 0s ago: executing program 1 (id=105): syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) futex(0x0, 0x9, 0x2, 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') r1 = memfd_create(&(0x7f00000001c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf#2\x99\x1e\xa1`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\f<\x8f\xc1\x99\x89r\xe1?\xbdu\x98\xc3\xf8\xd2Q#\xc6g\xa0\x85\xd6G\x85\x11X\x8d,\x02\xd45\xb8\xca\x97\x9d\xcb\x1e\x80\xd6\xd5>N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec\x8aog\x87BR\x9d\xad\xd4FcB\xda\x95\xc3\xdd\x9d\x8f\x1a\xce\x18\x80\"j\xe1\xba\x1e\x97uX\xccv\xd6\vcz\x92A^\xbc\xceF\xf7\xe5:\xaf\xc5~\xbcJ e\r\x88c\x9d\xb92\xb6i4zq\xb3c\x0f\xb2t\x93\xf2E6b\xfa\xcdJ5\xe3W]`4\xd8D\x05\v\xfc)\xca\xedQ\xd0]Ot\'\xc2tDF\xf9\xa7\xb5(\x83\xa5\x0f\x1d\x1d\x06Dg\x13>\x19\xe85#\aaT\x89=\x104\xd5\x85Q\x96\x91\xea\x172P\xb3:\xadZ\xbc\xbe\x00\xf0\x14\x96\xd9M\xd7\x88QZs\xb2\xe1+$jfQodH\x05/y`~Mx\x02\x00(v\xe6`\x026\xfcgC\xb5\xf0\x13.zb\xc5bj+@\x00\x00\x00\x00\x00\x00\x00.\xd4`=z\xd1n\x8d\x8f\xa5hS\x8e[\xb3\xa3\x87\xb9\xe2_Z\x11\xef\xc2]V\xf3\x03\x94\xb9\xe1\xa68\x8d\\\xe5\xef\xacpM\xf0\xa6\x04\x10\xb7\xc0t\x83\\\xf7\x12k\x9f\x10\xd5Z\x19\xc1\xc1\x80\\o\x97\xce=U\xdd\xaa\x1b\x05\x14\x13\xa6\xbd#\xde\x04\xe6$\xec$3\xf6\x97\xc6\xeaSL\xb7A72M\x88k@\xe5\xa3\n&\x1e\xc84\xa9\xe2\xccM\x906\x95xQ-2p\xd62\'\xec\x0f\x13;I\x95fE_\r\xe7\t!A\x05\xe4\x8f\x9e0\xf8/T\x18\xf7\xa1\x9f\xde1\xd5\x80<\xf5\b\xa9\xec\x85\xaeW\xb3\xd8#)bn \xfb\xf2\x88\xfaR\xff\xdd\x80\x96_\xec5\xf0\x1c\a\x8a\x80\x00@=\r8u+%f:\x1e\x82\xfap\xf6\x89\xea\xba\xe3\xbbM%F\xdb\\\xd1eJJ*\xc67\xca\x03\xa3\xf7(\xbb\xecN\xd4\xe7\xf2:u\x8a\b\xd5\v\xca\xfd\\\xd6\xe3\x05\xb3\x03\xd5\xe0\xd2\xf2{\'\x8b\xdf\xa1\xbe}\xb2\xe4y\xbb\xe6\x1f\x10c\xf5WQ\x82\x04\x01C\x83,\x90\x1a\xfa\x8e\x17\x89\xe2\xedX\x8d\rmq\t\xb5$\xb4\x9b\x92z\xd6/-\x13,\xb5%\x8eM/\x04\xa7\x7f\x1b\x85\xf1\xa4X\x17\xbb\x1cR14\xfb!\b\x10\xe8\xb2\xd41gK\xe4\xea\xe39d\bL\xe5\x1b\xbd[\x9bWD:\r&\xe9\vn^\xcc\x86\xe3\xce1>3{\xaa{\xbd0P\x9f\xa68\xf5\x82\xb8\x9aD\x9c{\xe6\xf8\xcbD\xb5aJ\xb0\x92\x89\xbc\x80\x1ch\x89\xe7\xdd]q,\xec\xc4\xa5\x93\xe5,\x0e,>/\xaf|\xf0\x01V\x7f\xc9?\xba\x16\xe4$+}5dy\xb1\xef\xf1m\xa5\x94d9\xaf\xcfq\x8b=\x026\xef\r\x91\x18\xc5\xb6\xb9fM\x8ayZ\xbcd\xa5\x8a\x88\x98\xc3\xfc`\xa6\xba\x1f\x17\v$\x88g\xb4\xad\b\xc1\xddW\xa6\xc1\xb7\xb0\xa3\x84Q\x13GoU\xe2\xb7\x03\x9c\xd5\x0f\xa8\x0ef\"\x15\x82\xe7\xbd\xf8\xca\x10f\xfe6h\xe9\xc3\xc2\xa0O:\xac~\x1a\xf7\xbeF\xbe\xe5\xf0\x81\xd6&\xc0N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec\x8aog\x87BR\x9d\xad\xd4FcB\xda\x95\xc3\xdd\x9d\x8f\x1a\xce\x18\x80\"j\xe1\xba\x1e\x97uX\xccv\xd6\vcz\x92A^\xbc\xceF\xf7\xe5:\xaf\xc5~\xbcJ e\r\x88c\x9d\xb92\xb6i4zq\xb3c\x0f\xb2t\x93\xf2E6b\xfa\xcdJ5\xe3W]`4\xd8D\x05\v\xfc)\xca\xedQ\xd0]Ot\'\xc2tDF\xf9\xa7\xb5(\x83\xa5\x0f\x1d\x1d\x06Dg\x13>\x19\xe85#\aaT\x89=\x104\xd5\x85Q\x96\x91\xea\x172P\xb3:\xadZ\xbc\xbe\x00\xf0\x14\x96\xd9M\xd7\x88QZs\xb2\xe1+$jfQodH\x05/y`~Mx\x02\x00(v\xe6`\x026\xfcgC\xb5\xf0\x13.zb\xc5bj+@\x00\x00\x00\x00\x00\x00\x00.\xd4`=z\xd1n\x8d\x8f\xa5hS\x8e[\xb3\xa3\x87\xb9\xe2_Z\x11\xef\xc2]V\xf3\x03\x94\xb9\xe1\xa68\x8d\\\xe5\xef\xacpM\xf0\xa6\x04\x10\xb7\xc0t\x83\\\xf7\x12k\x9f\x10\xd5Z\x19\xc1\xc1\x80\\o\x97\xce=U\xdd\xaa\x1b\x05\x14\x13\xa6\xbd#\xde\x04\xe6$\xec$3\xf6\x97\xc6\xeaSL\xb7A72M\x88k@\xe5\xa3\n&\x1e\xc84\xa9\xe2\xccM\x906\x95xQ-2p\xd62\'\xec\x0f\x13;I\x95fE_\r\xe7\t!A\x05\xe4\x8f\x9e0\xf8/T\x18\xf7\xa1\x9f\xde1\xd5\x80<\xf5\b\xa9\xec\x85\xaeW\xb3\xd8#)bn \xfb\xf2\x88\xfaR\xff\xdd\x80\x96_\xec5\xf0\x1c\a\x8a\x80\x00@=\r8u+%f:\x1e\x82\xfap\xf6\x89\xea\xba\xe3\xbbM%F\xdb\\\xd1eJJ*\xc67\xca\x03\xa3\xf7(\xbb\xecN\xd4\xe7\xf2:u\x8a\b\xd5\v\xca\xfd\\\xd6\xe3\x05\xb3\x03\xd5\xe0\xd2\xf2{\'\x8b\xdf\xa1\xbe}\xb2\xe4y\xbb\xe6\x1f\x10c\xf5WQ\x82\x04\x01C\x83,\x90\x1a\xfa\x8e\x17\x89\xe2\xedX\x8d\rmq\t\xb5$\xb4\x9b\x92z\xd6/-\x13,\xb5%\x8eM/\x04\xa7\x7f\x1b\x85\xf1\xa4X\x17\xbb\x1cR14\xfb!\b\x10\xe8\xb2\xd41gK\xe4\xea\xe39d\bL\xe5\x1b\xbd[\x9bWD:\r&\xe9\vn^\xcc\x86\xe3\xce1>3{\xaa{\xbd0P\x9f\xa68\xf5\x82\xb8\x9aD\x9c{\xe6\xf8\xcbD\xb5aJ\xb0\x92\x89\xbc\x80\x1ch\x89\xe7\xdd]q,\xec\xc4\xa5\x93\xe5,\x0e,>/\xaf|\xf0\x01V\x7f\xc9?\xba\x16\xe4$+}5dy\xb1\xef\xf1m\xa5\x94d9\xaf\xcfq\x8b=\x026\xef\r\x91\x18\xc5\xb6\xb9fM\x8ayZ\xbcd\xa5\x8a\x88\x98\xc3\xfc`\xa6\xba\x1f\x17\v$\x88g\xb4\xad\b\xc1\xddW\xa6\xc1\xb7\xb0\xa3\x84Q\x13GoU\xe2\xb7\x03\x9c\xd5\x0f\xa8\x0ef\"\x15\x82\xe7\xbd\xf8\xca\x10f\xfe6h\xe9\xc3\xc2\xa0O:\xac~\x1a\xf7\xbeF\xbe\xe5\xf0\x81\xd6&\xc0 (0000:0000) [ 32.315055][ T310] uvcvideo 1-1:1.1: No supported video formats found. [ 32.321847][ T310] uvcvideo 1-1:1.1: Failed to initialize the device (-22). [ 32.499861][ T31] usb 1-1: USB disconnect, device number 4 [ 32.997572][ T536] SELinux: Context system_u:object_r:inetd_var_run_t:s0 is not valid (left unmapped). [ 33.009072][ T36] kauditd_printk_skb: 43 callbacks suppressed [ 33.009087][ T36] audit: type=1400 audit(1793374411.450:212): avc: denied { relabelto } for pid=535 comm="syz.3.70" name="25" dev="tmpfs" ino=145 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:inetd_var_run_t:s0" [ 33.016799][ T536] netlink: 188 bytes leftover after parsing attributes in process `syz.3.70'. [ 33.049121][ T36] audit: type=1400 audit(1793374411.450:213): avc: denied { associate } for pid=535 comm="syz.3.70" name="25" dev="tmpfs" ino=145 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:inetd_var_run_t:s0" [ 33.087859][ T36] audit: type=1400 audit(1793374411.490:214): avc: denied { write } for pid=295 comm="syz-executor" name="25" dev="tmpfs" ino=145 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:inetd_var_run_t:s0" [ 33.114234][ T36] audit: type=1400 audit(1793374411.490:215): avc: denied { remove_name } for pid=295 comm="syz-executor" name="binderfs" dev="tmpfs" ino=149 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:inetd_var_run_t:s0" [ 33.141936][ T36] audit: type=1400 audit(1793374411.490:216): avc: denied { rmdir } for pid=295 comm="syz-executor" name="25" dev="tmpfs" ino=145 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:inetd_var_run_t:s0" [ 33.168608][ T36] audit: type=1400 audit(1793374411.580:217): avc: denied { mount } for pid=546 comm="syz.0.74" name="/" dev="ramfs" ino=5429 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 33.196413][ T36] audit: type=1400 audit(1793374411.630:218): avc: denied { read } for pid=549 comm="syz.0.75" name="ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 33.219286][ T36] audit: type=1400 audit(1793374411.630:219): avc: denied { open } for pid=549 comm="syz.0.75" path="/dev/ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 33.242352][ T36] audit: type=1400 audit(1793374411.660:220): avc: denied { ioctl } for pid=549 comm="syz.0.75" path="/dev/ptp0" dev="devtmpfs" ino=196 ioctlcmd=0x3d0f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 33.250173][ T552] FAULT_INJECTION: forcing a failure. [ 33.250173][ T552] name failslab, interval 1, probability 0, space 0, times 1 [ 33.279466][ T552] CPU: 1 UID: 0 PID: 552 Comm: syz.0.76 Not tainted syzkaller #0 04b5f10b80d13b0533bf6aaa302b886c75cf6d37 [ 33.279483][ T552] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 33.279496][ T552] Call Trace: [ 33.279500][ T552] [ 33.279504][ T552] __dump_stack+0x21/0x30 [ 33.279524][ T552] dump_stack_lvl+0x140/0x1c0 [ 33.279538][ T552] ? __cfi_dump_stack_lvl+0x10/0x10 [ 33.279552][ T552] dump_stack+0x19/0x20 [ 33.279565][ T552] should_fail_ex+0x3c2/0x510 [ 33.279576][ T552] should_failslab+0xac/0x100 [ 33.279586][ T552] kmem_cache_alloc_noprof+0x42/0x410 [ 33.279599][ T552] ? security_file_alloc+0x49/0x220 [ 33.279613][ T552] ? kasan_save_alloc_info+0x3a/0x50 [ 33.279626][ T552] security_file_alloc+0x49/0x220 [ 33.279638][ T552] init_file+0x9e/0x210 [ 33.279649][ T552] alloc_empty_file+0xd9/0x270 [ 33.279659][ T552] ? _raw_spin_unlock+0x45/0x60 [ 33.279670][ T552] alloc_file_pseudo+0x142/0x1f0 [ 33.279680][ T552] ? security_inode_init_security_anon+0x3e/0x110 [ 33.279692][ T552] ? __cfi_alloc_file_pseudo+0x10/0x10 [ 33.279702][ T552] ? anon_inode_make_secure_inode+0xf5/0x150 [ 33.279714][ T552] ? __cfi_anon_inode_make_secure_inode+0x10/0x10 [ 33.279726][ T552] __anon_inode_getfile+0x12e/0x200 [ 33.279737][ T552] anon_inode_create_getfile+0x3f/0x50 [ 33.279749][ T552] new_userfaultfd+0x1f6/0x410 [ 33.279764][ T552] __x64_sys_userfaultfd+0x89/0xb0 [ 33.279778][ T552] x64_sys_call+0x2950/0x2ee0 [ 33.279788][ T552] do_syscall_64+0x57/0xf0 [ 33.279798][ T552] ? clear_bhb_loop+0x50/0xa0 [ 33.279811][ T552] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 33.279824][ T552] RIP: 0033:0x7fd33cd9f559 [ 33.279837][ T552] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 33.279845][ T552] RSP: 002b:00007fd33dc63028 EFLAGS: 00000246 ORIG_RAX: 0000000000000143 [ 33.279861][ T552] RAX: ffffffffffffffda RBX: 00007fd33d025fa0 RCX: 00007fd33cd9f559 [ 33.279869][ T552] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000801 [ 33.279875][ T552] RBP: 00007fd33ce36b20 R08: 0000000000000000 R09: 0000000000000000 [ 33.279882][ T552] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 33.279888][ T552] R13: 00007fd33d026038 R14: 00007fd33d025fa0 R15: 00007ffcc7e04c28 [ 33.279896][ T552] [ 33.348979][ T310] usb 3-1: new low-speed USB device number 5 using dummy_hcd [ 33.530822][ T10] usb 4-1: new low-speed USB device number 6 using dummy_hcd [ 33.573779][ T36] audit: type=1400 audit(1793374412.010:221): avc: denied { unmount } for pid=294 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 33.594355][ T557] SELinux: Context system_u:object_r:netcontrol_device_t:s0 is not valid (left unmapped). [ 33.607235][ T557] EXT4-fs (sda1): resizing filesystem from 262144 to 262144 blocks [ 33.680235][ T10] usb 4-1: config index 0 descriptor too short (expected 151, got 117) [ 33.688579][ T310] usb 3-1: unable to get BOS descriptor or descriptor too short [ 33.696227][ T10] usb 4-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 33.706344][ T10] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 33.715337][ T10] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 688, setting to 0 [ 33.726023][ T10] usb 4-1: config 1 interface 1 has no altsetting 0 [ 33.732855][ T310] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 33.742992][ T310] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 33.751946][ T310] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 33.766769][ T310] usb 3-1: string descriptor 0 read error: -22 [ 33.773023][ T310] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 33.777016][ T564] FAULT_INJECTION: forcing a failure. [ 33.777016][ T564] name failslab, interval 1, probability 0, space 0, times 0 [ 33.782076][ T310] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.795078][ T564] CPU: 1 UID: 0 PID: 564 Comm: syz.0.81 Not tainted syzkaller #0 04b5f10b80d13b0533bf6aaa302b886c75cf6d37 [ 33.795105][ T564] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 33.795118][ T564] Call Trace: [ 33.795123][ T564] [ 33.795130][ T564] __dump_stack+0x21/0x30 [ 33.795160][ T564] dump_stack_lvl+0x140/0x1c0 [ 33.795186][ T564] ? __cfi_dump_stack_lvl+0x10/0x10 [ 33.795214][ T564] dump_stack+0x19/0x20 [ 33.795237][ T564] should_fail_ex+0x3c2/0x510 [ 33.795254][ T564] ? security_sk_alloc+0x65/0x260 [ 33.795275][ T564] should_failslab+0xac/0x100 [ 33.795292][ T564] __kmalloc_noprof+0x69/0x510 [ 33.795314][ T564] ? kasan_save_alloc_info+0x3a/0x50 [ 33.795334][ T564] ? security_sk_alloc+0x65/0x260 [ 33.795352][ T564] ? __kasan_slab_alloc+0x73/0x90 [ 33.795370][ T564] security_sk_alloc+0x65/0x260 [ 33.795389][ T564] sk_prot_alloc+0x123/0x3a0 [ 33.795410][ T564] ? security_inode_alloc+0xc2/0x230 [ 33.795429][ T564] sk_alloc+0x40/0x590 [ 33.795447][ T564] ? inode_init_always_gfp+0x76e/0x9e0 [ 33.795464][ T564] inet_create+0x5b7/0x1010 [ 33.795485][ T564] __sock_create+0x3a2/0x810 [ 33.795504][ T564] __sys_socket+0xe1/0x1c0 [ 33.795523][ T564] __x64_sys_socket+0x7e/0x90 [ 33.795541][ T564] x64_sys_call+0x2608/0x2ee0 [ 33.795559][ T564] do_syscall_64+0x57/0xf0 [ 33.795577][ T564] ? clear_bhb_loop+0x50/0xa0 [ 33.795600][ T564] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 33.795623][ T564] RIP: 0033:0x7fd33cd9f559 [ 33.795637][ T564] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 33.795651][ T564] RSP: 002b:00007fd33dc63028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 33.795670][ T564] RAX: ffffffffffffffda RBX: 00007fd33d025fa0 RCX: 00007fd33cd9f559 [ 33.795683][ T564] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000002 [ 33.795694][ T564] RBP: 00007fd33ce36b20 R08: 0000000000000000 R09: 0000000000000000 [ 33.795705][ T564] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 33.795715][ T564] R13: 00007fd33d026038 R14: 00007fd33d025fa0 R15: 00007ffcc7e04c28 [ 33.795731][ T564] [ 34.025303][ T310] cdc_ncm 3-1:1.0: CDC Union missing and no IAD found [ 34.032423][ T310] cdc_ncm 3-1:1.0: bind() failure [ 34.053116][ T322] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 34.077877][ T575] netlink: 140 bytes leftover after parsing attributes in process `syz.1.84'. [ 34.078030][ T13] Bluetooth: hci0: Frame reassembly failed (-84) [ 34.210028][ T322] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 34.220214][ T322] usb 1-1: config 1 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 34.233238][ T322] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 34.242442][ T322] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.253012][ T322] cdc_acm 1-1:1.0: probe with driver cdc_acm failed with error -22 [ 34.258682][ T545] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 34.270697][ T545] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 34.319445][ T322] usb 3-1: USB disconnect, device number 5 [ 34.954156][ T582] netlink: 104 bytes leftover after parsing attributes in process `syz.2.85'. [ 34.983242][ T322] usb 1-1: USB disconnect, device number 5 [ 35.389006][ T310] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 35.518997][ T310] usb 3-1: device descriptor read/64, error -71 [ 35.758998][ T310] usb 3-1: device descriptor read/64, error -71 [ 35.999047][ T310] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 36.074228][ T10] usb 4-1: New USB device found, idVendor=1235, idProduct=8204, bcdDevice= 0.40 [ 36.083901][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.095641][ T10] usb 4-1: can't set config #1, error -71 [ 36.104138][ T10] usb 4-1: USB disconnect, device number 6 [ 36.129000][ T310] usb 3-1: device descriptor read/64, error -71 [ 36.140259][ T607] input: syz0 as /devices/virtual/input/input5 [ 36.149006][ T577] Bluetooth: hci0: command 0x1003 tx timeout [ 36.151196][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 36.229004][ T322] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 36.368999][ T310] usb 3-1: device descriptor read/64, error -71 [ 36.380952][ T322] usb 1-1: New USB device found, idVendor=0584, idProduct=0008, bcdDevice= 1.42 [ 36.390051][ T322] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 36.398015][ T322] usb 1-1: Product: syz [ 36.402316][ T322] usb 1-1: Manufacturer: syz [ 36.408747][ T322] usb-storage 1-1:1.0: USB Mass Storage device detected [ 36.479134][ T310] usb usb3-port1: attempt power cycle [ 36.610705][ T10] usb 1-1: USB disconnect, device number 6 [ 36.819006][ T310] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 36.840025][ T310] usb 3-1: device descriptor read/8, error -71 [ 36.970021][ T310] usb 3-1: device descriptor read/8, error -71 [ 37.125628][ T630] netlink: 'syz.0.99': attribute type 4 has an invalid length. [ 37.133223][ T630] netlink: 'syz.0.99': attribute type 2 has an invalid length. [ 37.219256][ T310] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 37.250170][ T310] usb 3-1: device descriptor read/8, error -71 [ 37.259858][ T10] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 37.379985][ T310] usb 3-1: device descriptor read/8, error -71 [ 37.410013][ T10] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0xE has invalid maxpacket 8 [ 37.421003][ T10] usb 2-1: New USB device found, idVendor=0582, idProduct=002b, bcdDevice= 0.40 [ 37.430055][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.438038][ T10] usb 2-1: Product: syz [ 37.442200][ T10] usb 2-1: Manufacturer: syz [ 37.446780][ T10] usb 2-1: SerialNumber: syz [ 37.452249][ T626] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 37.468998][ T322] usb 1-1: new low-speed USB device number 7 using dummy_hcd [ 37.499046][ T310] usb usb3-port1: unable to enumerate USB device [ 37.623916][ T322] usb 1-1: unable to get BOS descriptor or descriptor too short [ 37.632349][ T322] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 37.642528][ T322] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 37.651413][ T322] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 37.661798][ T10] usb 2-1: MIDIStreaming interface descriptor not found [ 37.666754][ T322] usb 1-1: string descriptor 0 read error: -22 [ 37.672429][ T10] usb 2-1: too many endpoints [ 37.677740][ T322] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 37.686079][ T10] usb 2-1: USB disconnect, device number 3 [ 37.692649][ T322] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.708294][ T315] udevd[315]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 37.717641][ T641] overlayfs: option "workdir=./file1" is useless in a non-upper mount, ignore [ 37.733324][ T641] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 37.742027][ T322] cdc_ncm 1-1:1.0: CDC Union missing and no IAD found [ 37.743616][ T642] SELinux: policydb table sizes (0,0) do not match mine (8,7) [ 37.752434][ T322] cdc_ncm 1-1:1.0: bind() failure [ 37.761377][ T642] SELinux: failed to load policy [ 37.960031][ T637] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 37.968521][ T637] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 38.029355][ T10] usb 1-1: USB disconnect, device number 7 [ 38.104931][ T36] kauditd_printk_skb: 34 callbacks suppressed [ 38.104945][ T36] audit: type=1400 audit(1793374416.540:256): avc: denied { unmount } for pid=296 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 38.130861][ T36] audit: type=1400 audit(1793374416.540:257): avc: denied { unmount } for pid=296 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 38.130971][ T296] ------------[ cut here ]------------ [ 38.156390][ T296] WARNING: CPU: 1 PID: 296 at fs/inode.c:340 drop_nlink+0xce/0x110 [ 38.164395][ T296] Modules linked in: [ 38.168295][ T296] CPU: 1 UID: 0 PID: 296 Comm: syz-executor Not tainted syzkaller #0 04b5f10b80d13b0533bf6aaa302b886c75cf6d37 [ 38.179948][ T296] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 38.190246][ T296] RIP: 0010:drop_nlink+0xce/0x110 [ 38.193800][ T647] netlink: 'syz.1.105': attribute type 27 has an invalid length. [ 38.195457][ T296] Code: 04 00 00 be 08 00 00 00 e8 8f 08 ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 a2 72 94 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c [ 38.222706][ T296] RSP: 0018:ffffc9000b6dfc68 EFLAGS: 00010293 [ 38.228771][ T296] RAX: ffffffff81f4e32e RBX: ffff888124815a00 RCX: ffff888102f862c0 [ 38.236753][ T296] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 38.244737][ T296] RBP: ffffc9000b6dfc90 R08: 0000000000000003 R09: 0000000000000004 [ 38.252758][ T296] R10: dffffc0000000000 R11: fffff520016dbf84 R12: dffffc0000000000 [ 38.260743][ T296] R13: 1ffff11024902b49 R14: ffff888124815a48 R15: 0000000000000000 [ 38.268707][ T296] FS: 0000555555a5f500(0000) GS:ffff8881f6d00000(0000) knlGS:0000000000000000 [ 38.277640][ T296] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 38.284234][ T296] CR2: 0000555555a8a998 CR3: 00000001027c6000 CR4: 00000000003526b0 [ 38.292224][ T296] Call Trace: [ 38.295494][ T296] [ 38.298433][ T296] simple_rmdir+0x152/0x260 [ 38.302943][ T296] vfs_rmdir+0x3de/0x560 [ 38.307188][ T296] incfs_kill_sb+0x102/0x220 [ 38.311788][ T296] deactivate_locked_super+0xd5/0x270 [ 38.317162][ T296] deactivate_super+0xb8/0xe0 [ 38.321891][ T296] cleanup_mnt+0x438/0x4d0 [ 38.326303][ T296] __cleanup_mnt+0x1d/0x40 [ 38.330721][ T296] task_work_run+0x1e8/0x260 [ 38.335313][ T296] ? __cfi_task_work_run+0x10/0x10 [ 38.340453][ T296] ? __x64_sys_umount+0x12e/0x180 [ 38.345484][ T296] ? __cfi___x64_sys_umount+0x10/0x10 [ 38.350863][ T296] ? __kasan_check_read+0x15/0x20 [ 38.355890][ T296] resume_user_mode_work+0x35/0x50 [ 38.361008][ T296] syscall_exit_to_user_mode+0x63/0xb0 [ 38.366493][ T296] do_syscall_64+0x63/0xf0 [ 38.370918][ T296] ? clear_bhb_loop+0x50/0xa0 [ 38.375602][ T296] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 38.381549][ T296] RIP: 0033:0x7f4507fa0797 [ 38.385982][ T296] Code: a2 c7 05 5c 9f 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 38.405589][ T296] RSP: 002b:00007ffdbfae85c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 38.414023][ T296] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f4507fa0797 [ 38.422013][ T296] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdbfae8680 [ 38.430004][ T296] RBP: 00007ffdbfae8680 R08: 00007ffdbfae9680 R09: 00000000ffffffff [ 38.437966][ T296] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdbfae9770 [ 38.445943][ T296] R13: 00007f4508035f63 R14: 000000000000894a R15: 00007ffdbfaea840 [ 38.453931][ T296] [ 38.456962][ T296] ---[ end trace 0000000000000000 ]--- [ 38.462539][ T296] ================================================================== [ 38.470608][ T296] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 [ 38.476832][ T296] Write of size 4 at addr 0000000000000168 by task syz-executor/296 [ 38.484789][ T296] [ 38.487117][ T296] CPU: 0 UID: 0 PID: 296 Comm: syz-executor Tainted: G W syzkaller #0 04b5f10b80d13b0533bf6aaa302b886c75cf6d37 [ 38.487134][ T296] Tainted: [W]=WARN [ 38.487138][ T296] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 38.487145][ T296] Call Trace: [ 38.487148][ T296] [ 38.487152][ T296] __dump_stack+0x21/0x30 [ 38.487170][ T296] dump_stack_lvl+0x140/0x1c0 [ 38.487184][ T296] ? __cfi_dump_stack_lvl+0x10/0x10 [ 38.487201][ T296] print_report+0x3d/0x70 [ 38.487215][ T296] kasan_report+0x162/0x1a0 [ 38.487226][ T296] ? ihold+0x24/0x70 [ 38.487235][ T296] ? ihold+0x24/0x70 [ 38.487244][ T296] kasan_check_range+0x25a/0x2b0 [ 38.487254][ T296] __kasan_check_write+0x18/0x20 [ 38.487267][ T296] ihold+0x24/0x70 [ 38.487275][ T296] vfs_rmdir+0x25c/0x560 [ 38.487287][ T296] incfs_kill_sb+0x102/0x220 [ 38.487301][ T296] deactivate_locked_super+0xd5/0x270 [ 38.487313][ T296] deactivate_super+0xb8/0xe0 [ 38.487324][ T296] cleanup_mnt+0x438/0x4d0 [ 38.487333][ T296] __cleanup_mnt+0x1d/0x40 [ 38.487342][ T296] task_work_run+0x1e8/0x260 [ 38.487356][ T296] ? __cfi_task_work_run+0x10/0x10 [ 38.487391][ T296] ? __x64_sys_umount+0x12e/0x180 [ 38.487404][ T296] ? __cfi___x64_sys_umount+0x10/0x10 [ 38.487416][ T296] ? __kasan_check_read+0x15/0x20 [ 38.487428][ T296] resume_user_mode_work+0x35/0x50 [ 38.487441][ T296] syscall_exit_to_user_mode+0x63/0xb0 [ 38.487460][ T296] do_syscall_64+0x63/0xf0 [ 38.487477][ T296] ? clear_bhb_loop+0x50/0xa0 [ 38.487499][ T296] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 38.487517][ T296] RIP: 0033:0x7f4507fa0797 [ 38.487527][ T296] Code: a2 c7 05 5c 9f 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 38.487535][ T296] RSP: 002b:00007ffdbfae85c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 38.487547][ T296] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f4507fa0797 [ 38.487554][ T296] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdbfae8680 [ 38.487560][ T296] RBP: 00007ffdbfae8680 R08: 00007ffdbfae9680 R09: 00000000ffffffff [ 38.487567][ T296] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdbfae9770 [ 38.487573][ T296] R13: 00007f4508035f63 R14: 000000000000894a R15: 00007ffdbfaea840 [ 38.487581][ T296] [ 38.487585][ T296] ================================================================== [ 38.728580][ T296] Disabling lock debugging due to kernel taint [ 38.736535][ T296] BUG: kernel NULL pointer dereference, address: 0000000000000168 [ 38.744343][ T296] #PF: supervisor write access in kernel mode [ 38.750397][ T296] #PF: error_code(0x0002) - not-present page [ 38.756354][ T296] PGD 800000010fb19067 P4D 800000010fb19067 PUD 0 [ 38.762837][ T296] Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI [ 38.768880][ T296] CPU: 0 UID: 0 PID: 296 Comm: syz-executor Tainted: G B W syzkaller #0 04b5f10b80d13b0533bf6aaa302b886c75cf6d37 [ 38.781960][ T296] Tainted: [B]=BAD_PAGE, [W]=WARN [ 38.786951][ T296] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 38.796983][ T296] RIP: 0010:ihold+0x2a/0x70 [ 38.801469][ T296] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 8d 69 94 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 4c ff ed ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 9d [ 38.821068][ T296] RSP: 0018:ffffc9000b6dfcc8 EFLAGS: 00010246 [ 38.827116][ T296] RAX: ffff888102f86200 RBX: 0000000000000000 RCX: ffff888102f862c0 [ 38.835076][ T296] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 38.843025][ T296] RBP: ffffc9000b6dfcd8 R08: ffffffff893cf947 R09: 1ffffffff1279f28 [ 38.850977][ T296] R10: dffffc0000000000 R11: fffffbfff1279f29 R12: 0000000000000000 [ 38.858938][ T296] R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 [ 38.866900][ T296] FS: 0000555555a5f500(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 [ 38.875814][ T296] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 38.882375][ T296] CR2: 0000000000000168 CR3: 00000001027c6000 CR4: 00000000003526b0 [ 38.890334][ T296] Call Trace: [ 38.893591][ T296] [ 38.896503][ T296] vfs_rmdir+0x25c/0x560 [ 38.900742][ T296] incfs_kill_sb+0x102/0x220 [ 38.905321][ T296] deactivate_locked_super+0xd5/0x270 [ 38.910676][ T296] deactivate_super+0xb8/0xe0 [ 38.915330][ T296] cleanup_mnt+0x438/0x4d0 [ 38.919721][ T296] __cleanup_mnt+0x1d/0x40 [ 38.924113][ T296] task_work_run+0x1e8/0x260 [ 38.928685][ T296] ? __cfi_task_work_run+0x10/0x10 [ 38.933777][ T296] ? __x64_sys_umount+0x12e/0x180 [ 38.938788][ T296] ? __cfi___x64_sys_umount+0x10/0x10 [ 38.944149][ T296] ? __kasan_check_read+0x15/0x20 [ 38.949157][ T296] resume_user_mode_work+0x35/0x50 [ 38.954248][ T296] syscall_exit_to_user_mode+0x63/0xb0 [ 38.959687][ T296] do_syscall_64+0x63/0xf0 [ 38.964079][ T296] ? clear_bhb_loop+0x50/0xa0 [ 38.968740][ T296] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 38.974614][ T296] RIP: 0033:0x7f4507fa0797 [ 38.979006][ T296] Code: a2 c7 05 5c 9f 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 38.998587][ T296] RSP: 002b:00007ffdbfae85c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 39.006986][ T296] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f4507fa0797 [ 39.014938][ T296] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdbfae8680 [ 39.022887][ T296] RBP: 00007ffdbfae8680 R08: 00007ffdbfae9680 R09: 00000000ffffffff [ 39.030834][ T296] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdbfae9770 [ 39.038799][ T296] R13: 00007f4508035f63 R14: 000000000000894a R15: 00007ffdbfaea840 [ 39.046751][ T296] [ 39.049749][ T296] Modules linked in: [ 39.053638][ T296] CR2: 0000000000000168 [ 39.057769][ T296] ---[ end trace 0000000000000000 ]--- [ 39.063200][ T296] RIP: 0010:ihold+0x2a/0x70 [ 39.067685][ T296] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 8d 69 94 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 4c ff ed ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 9d [ 39.087268][ T296] RSP: 0018:ffffc9000b6dfcc8 EFLAGS: 00010246 [ 39.093313][ T296] RAX: ffff888102f86200 RBX: 0000000000000000 RCX: ffff888102f862c0 [ 39.101278][ T296] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 39.109233][ T296] RBP: ffffc9000b6dfcd8 R08: ffffffff893cf947 R09: 1ffffffff1279f28 [ 39.117194][ T296] R10: dffffc0000000000 R11: fffffbfff1279f29 R12: 0000000000000000 [ 39.125142][ T296] R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 [ 39.133090][ T296] FS: 0000555555a5f500(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 [ 39.141997][ T296] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 39.148573][ T296] CR2: 0000000000000168 CR3: 00000001027c6000 CR4: 00000000003526b0 [ 39.156528][ T296] Kernel panic - not syncing: Fatal exception [ 39.162830][ T296] Kernel Offset: disabled [ 39.167135][ T296] Rebooting in 86400 seconds..