last executing test programs: 5.03090501s ago: executing program 2 (id=199): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000ec0), 0x0, 0x0) r1 = socket$inet(0x2, 0x6, 0x7) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x19}}, 0x10) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000f00)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x800000) ioctl$SNDRV_TIMER_IOCTL_GINFO(r4, 0xc0f85403, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000f40)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x41) write(r5, &(0x7f00000000c0)='0', 0x1) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4400ae8f, &(0x7f0000000f80)=@x86={0x60, 0x4, 0x9, 0x0, 0x0, 0x0, 0x10, 0x4, 0x0, 0x7f, 0x9, 0x1, 0x0, 0x0, 0x8, 0x0, 0xff, 0xff, 0x0, '\x00', 0x0, 0x3}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000fc0)={0x2, 0x0, @ioapic={0x30000, 0x3, 0x10004, 0xfffffffe, 0x0, [{0x2, 0x1, 0x87, '\x00', 0x8}, {0x9, 0x8, 0x40, '\x00', 0xb}, {0xff, 0x7f, 0xd3, '\x00', 0x67}, {0xb5, 0x9, 0xf5, '\x00', 0xf}, {0x7, 0x5, 0x7}, {0x0, 0x4, 0x54, '\x00', 0xff}, {0x61, 0xd5, 0xf1, '\x00', 0x7b}, {0x3, 0x4, 0xc}, {0x7f, 0x5, 0xb, '\x00', 0x7}, {0xbc, 0xd, 0xa, '\x00', 0x6}, {0x0, 0xa8, 0x7c, '\x00', 0xdc}, {0xff, 0x1, 0xfe, '\x00', 0x1}, {0xfe, 0x7, 0x26}, {0xcf, 0x3, 0x1, '\x00', 0xa}, {0xf, 0xed, 0x7, '\x00', 0x3}, {0x39, 0x2, 0x16, '\x00', 0xb}, {0x9, 0x6, 0x4, '\x00', 0x8}, {0x9, 0xc, 0x4, '\x00', 0xc}, {0x7, 0xe1, 0x7, '\x00', 0xc2}, {0x0, 0x5, 0xe, '\x00', 0x7f}, {0x1, 0xc, 0x80, '\x00', 0x7f}, {0x10, 0x0, 0x3, '\x00', 0x10}, {0xd, 0x23, 0xf3, '\x00', 0x4}, {0xfd, 0x6, 0x4}]}}) 4.858837358s ago: executing program 2 (id=201): setns(0xc9, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x4, @multicast2}, 0x10) openat(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x121000, 0x106) syz_usb_connect(0x2, 0xb3, &(0x7f0000000180)=ANY=[], &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r2, 0x4008ae48, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_int(r3, &(0x7f0000000040)='cpuset.mems\x00', 0x2, 0x0) write$cgroup_subtree(r4, &(0x7f0000000140)=ANY=[@ANYBLOB='N'], 0x5a) 4.703621994s ago: executing program 1 (id=203): clock_gettime(0x0, &(0x7f0000001a80)={0x0, 0x0}) utimensat(0xffffffffffffffff, &(0x7f0000001a40)='./file0\x00', &(0x7f0000001ac0)={{0x77359400}, {r0, r1/1000+60000}}, 0x100) (async) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x8, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x3000) madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x13) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x10000, 0x0) r3 = userfaultfd(0x801) r4 = socket(0x2, 0x3, 0xff) (async) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000001c0)={'veth0_to_bond\x00', 0x0}) sendmmsg$inet(r4, &(0x7f0000000200)=[{{&(0x7f0000000240)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f00000002c0)=[{&(0x7f0000000300)="89165aed46537f28ce0fe840cf8fafa3e7676a6cb920fb38ca4506ecc1ac5f744c95f43bbdbbf97661edffae541f5fc259363dbc7d50f7cb3f0cebad8282e6b9a973dbea8edfdc8fbd47d442108e46d975480eadf51bd070f1503a1b905cf573d6dafe30b5622e916d5dceee7db428351dc8bd6c7369ddca952b0efc22c04388b21704dd8dbee80b336e94ce2e6f5990fb621e57ce821d511ad595f19f4034e45ace1b2537285024e66dd335a473f9f7f8cb1fb8a3b36b908a9a35056959ff5e5b4399f8c5b10df6ae99", 0xca}, {&(0x7f0000001480)="ef04591ee82cf20491b318710ecf2f2a8da5ecc7810d71912a2dd84f3a13909e64e881debb9b5ef37fa67c90b79c3b347e614ba32825ab1a8d967d153b92e1da6a58aa3e9c553f5c7ba7e2a692b82bc3545117d1386144d8bdcedefe18eebc161a5e26d8da61262299efbb8893aa2e43bf1e15e3ec01c2228dac1c7fa117fc9c35d8a149c495e3e698aaf5452ff15290d13e014b08950b726d84a61de8e9db07a0014a68941ceeda6949b6202619007f8260fac34e738deb53e62dd11e56503e3f7eeed6e4a8a12398dcca7b8195b67d262e38c205e845bae39609375ed61866eb86d7e39d07ac6c5f1022da824b0021fcf35e130e3c292a2b616b2b06ef14985600c29b192689173188690b8cd1ff12eef075a9c7f53eed7288a8dc03688ebeb8a171cf2ce16773b15ec6d7430ebacfa9b6b8613465f5185caee8b9317169b64ad9de8826e43c138cc29773ca6d2eedbcec06cbf4b75d1bff8bcbecabf3ed7cbaaf04718e735e6bbd33f2bd417a78deb61c68d1b5dc14fc3dd66f2c09bd73fff09a3b87007b1e88b421a8e579235d99390061b7a4b2dc3765c178052e70c0e13f752568b5754e2b6ea54eec24d5ab8867154ee05dcfdaaad3dfaba31fd56e20de45ba31000bf1dde31f263abdcbd8d325f92862b2cf37800027991150c4a545c3ffa380d0b2de618b548759727966755c5f5db1e2cdbd0e9af07d80a971c8b44a311026d17aaf9207f5f7973a0312d4dcdeb3daa0f6b447003cbbd79f5a006f6b7eebd8c81fc3c10bc4a27d71f408cef39cfb3fea51188fc3d64534ab79b22dc9a0ae8381ec08a883ed3883ef36dbc2b5a83522211faaed21837030b4e62a1ef1150beff8e7bbeece17fcd9bbda1d7a21a776857eff04899895822cd0d219dcc738fb236c13cf94a3b96626c945f1f1613b3e64acab96ab1e3237e3775afec7f2e43efd0de40f58de48670abd5a34153357465ecafa4d0cfa4ca367dae0ebc5e68ded284183f274998f683f4e4d182d3ff428a632c32d7f89009fc751b9680eabc643ecf896b6d02af66dc803a3547683c54aac16db244be6317270424d810777a7c7f1ced1a726585010a499aaf04b1444f45f9a5e66027935c715ed8a415253cbb5978341194c24cab83d6d56d8279da340f1c00dd9a75714fc00548a5bf455ca80984797be78a0e6b1c87fab9bae2027b4bcbfaa17340aef183f7203cf31c378444e48aa37db758a8efd02b3f8180f67bed2e436d42e7676f400424a98d51b9376a266e573b6e75f6dc63a8aa2c2927f9a3089612b2c428c73989832fb3bca40c46448e9bf236eb6a50251a647bab3f9af33b56aff0ee3a93412feabd7eec537c8d5d229650a3fec09e5e252bfa2e24e5ea205567f2f4a09bc72fcc14d08c87a7b2922504ce2a032e618ebae53a10e0d7ee79fd5cd1c91a3fb9b39c48594eba92d0021640792f0351d9645eed5e81cc58724c1a97b7b0603f4307a08cbcf91cf75f56a8c3b4a229f6f84e1c65e674b7b2d6867bbc21a73bddc0901129b9b26412411a39e6f65fbdf6d6e79baffb753b37c636604a658681d665a39485fe5df314e85376f3c1f2a0186524285d8ab107652e444fdf2371731622e5703226497fb3f86f1a8f8dff318f465f44a198b7217d361f47f75368c2c931840edb76c6341021b1d910aae197a0f62cf74f5b1e4ff62e684f2d6e1a6dee759e87cc539cfbee8a81a7059cd26e083f0ed1c26f9963bbd47d4d6b2fea0c219dab8fb2e87dbde72cab5d5ea23e8b13085b7eeb2af4406df28d5b9fc6b14d7165e72e97645864c0b8ccbae2dab64f9aeb9f66dd9b8ec3208", 0x513}], 0x2, &(0x7f00000019c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @dev={0xac, 0x14, 0x14, 0x39}, @private=0xa010102}}}], 0x20}}], 0x1, 0x14) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000400)={0xaa, 0x108}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000440)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCGETNODEID(r7, 0x89e1, &(0x7f0000000180)={0x2}) (async) r8 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000001a00)={0xaa, 0x602}) (async) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) (async) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r8, r9, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) (async) r10 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/keys\x00', 0x0, 0x0) preadv(r10, &(0x7f00000000c0)=[{&(0x7f0000000480)=""/4096, 0x1000}], 0x1, 0x0, 0x0) (async) ioctl$UFFDIO_MOVE(r3, 0xc028aa05, &(0x7f0000000000)={&(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2}) ioctl$KVM_SET_VAPIC_ADDR(r9, 0x4008ae93, &(0x7f0000000040)=0x1000) ioctl$KVM_RUN(r9, 0xae80, 0x0) 4.689463226s ago: executing program 1 (id=204): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x20001, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_GET_MSRS_cpu(r2, 0xc008ae88, &(0x7f00000002c0)={0x1, 0x0, [{0x40000002, 0x0, 0x100}]}) r3 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r3, &(0x7f0000000440)={0x10, 0x0, 0x25dfdbfe, 0x1000000}, 0xc) add_key(&(0x7f0000000040)='.dead\x00', 0x0, &(0x7f0000000080)="3082a8eebdcece81cdfd0a7ecfab9901d43082017ba00302010202142eea648d7f17e62e9e5869c887c69e1bd0f86fde30f805082a8648ce3d040302303a31383036060355acd23cb2ca6fa329340c2f43657274696669636174652076657269666963612ed17f93bce20e874c41ce803d36eb74696f6e4357c82e3f2045434453412073656c662d74657374696e67206b65793020170d3234303431333232313632365a180f3231323430333230323230366361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793059301306072a8648ce3d020106082a8648ce3d0301070342000407e56b51affc19412c88926b775771039ee2fe6e6a714ec7299f90e177189fc2e70a82d08ae181a9717c5a73fb25b95b1e248c739ff838f848b4ad1619c022c6a35d305b301d0603551d0e041604142900bcea1deb7bc8479a84a23d758efdfdd2b2d3301f0603551d230418301680142900bcea1deb7bc8479a84a23d758efdfdd2b2d330800603551d130101ff04023000300b0603551d0f040403020780300a06082a8648ce3d040302034700304402200000437ec7666ea5007c121db409760c99568c265de9705cb4022073b7c77a5a2925f24fc810149d79691c7ad75d0000000000000000000000000000000000000000000000007ff20000000000", 0x1f4, 0xffffffffffffffff) bind$netlink(r3, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfe, 0x800000}, 0xc) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r5, r6, &(0x7f0000fe2000/0x18000)=nil, &(0x7f0000000340)=[@text64={0x40, 0x0}], 0x1, 0x4b, &(0x7f0000000380)=[@efer={0x2, 0x900}], 0x1) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_X86_SET_MCE(r6, 0x4040ae9e, &(0x7f00000003c0)={0x1000000000000000, 0xdddd1000, 0x0, 0x6, 0x11}) 4.526832312s ago: executing program 1 (id=205): madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0x65) mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000fff000/0x1000)=nil) madvise(&(0x7f0000f0f000/0x2000)=nil, 0x2000, 0x15) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000140)={0x3}) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000180)={[{0x1, 0xc, 0x6, 0x3, 0x6, 0x2, 0x42, 0x9, 0x1, 0x4, 0x2, 0x3, 0x3}, {0x1, 0x7, 0x7, 0x0, 0x8, 0x7, 0x49, 0xff, 0x2, 0x1, 0x9, 0xf, 0x20000000006}, {0x2, 0x5, 0x5, 0x84, 0x8, 0x7, 0xfd, 0x40, 0x5, 0x3, 0x4, 0x3, 0x80000000000}], 0xf87}) ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, &(0x7f0000000200)={0x3552, 0xffffffffffffffff, 'id0\x00'}) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000c43000/0x18000)=nil, &(0x7f0000000300)=[@text64={0x40, &(0x7f0000000280)="0f79a311f5000066baa100b81c1e0000efc4e35d0698c1f1aef400360f380a5f0f2e0f017500650fc73966ba6100b038ee3e6766440f3881620566baf80cb8d006e48eef66bafc0cedc441e37d01", 0x4e}], 0x1, 0x36, &(0x7f0000000340)=[@cr4={0x1, 0x40180}, @flags={0x3, 0x80}], 0x2) mlock2(&(0x7f0000c1d000/0x4000)=nil, 0x4000, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./debug/split_huge_pages\x00', 0x1, 0x0) write(r3, &(0x7f0000000040)='\\,', 0x2) ioctl$UFFDIO_ZEROPAGE(r3, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ca1000/0x3000)=nil, 0x3000}, 0x1}) 4.465182319s ago: executing program 1 (id=206): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x9, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffff9, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0x2, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x2, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0xff, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x5, 0xfff, 0x1, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000086f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x3, 0x200b398, 0x8001, 0x1, 0x6, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff4, 0x4, 0x46, 0x5, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x200, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x1000, 0x31, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x69, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x8, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xfff, 0x4, 0x7f, 0x9, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x27, 0xf7cc, 0xd502, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x6, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0x10dab, 0x5, 0x8, 0x13fff, 0xffff, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./trace\x00', &(0x7f0000000140)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(&(0x7f00000001c0)='.\x00', &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) umount2(&(0x7f0000000280)='./file0\x00', 0xc) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 3.568760171s ago: executing program 1 (id=211): r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) ioctl$UDMABUF_CREATE(r0, 0x40187542, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x8ba66fe65b9ba25a, 0x1000}) mmap$IORING_OFF_SQ_RING(0xfffff000, 0x2000, 0x2000001, 0x8132, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x4) socket$tipc(0x1e, 0x2, 0x0) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, 0x0, 0x0) sendmsg$tipc(r2, 0x0, 0x4010) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000240)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/power/disk\x00', 0x1, 0x0) write(r3, &(0x7f00000002c0)='reboot\n\x00', 0x7) close(r3) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r4 = openat(0xffffffffffffff9c, 0x0, 0x1c5e02, 0x140) r5 = syz_usb_connect$uac2(0xd408d8d715334451, 0x0, 0x0, 0x0) syz_usb_ep_read(r5, 0xa, 0x0, 0x0) write$P9_RUNLINKAT(r4, 0x0, 0x0) write(r1, &(0x7f0000000100)='0', 0x1) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r8, 0x4018aee1, &(0x7f0000000180)=@attr_arm64={0x0, 0x0, 0x0, 0x0}) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) 3.496658759s ago: executing program 1 (id=215): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x161) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x4000, 0x0) r0 = memfd_create(&(0x7f0000000240)='\xf3e\t\x9f\x918\xc0y\x01c\x1fnux\x00sV\ad\xb0l \xfd\xd7\x8e\x7f\x89\xb8\xc5;~\x04\x03~K\xfbP\x84=\xfa\x81\f\x1et\x10\x0e\xcf^9\xbe\\', 0x0) pwrite64(r0, &(0x7f0000000280)='/', 0x1, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x3a) sendto$inet6(r1, &(0x7f00000002c0)="800037bbfa9ba1ce", 0x8, 0x4000, &(0x7f0000000300)={0xa, 0x0, 0x0, @remote, 0x3}, 0x1c) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x5) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000440)=0x11) ioctl$TIOCVHANGUP(r4, 0x5437, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r2, 0xc400941d, &(0x7f0000000480)={0x0, 0x7, 0x6}) ioctl$BTRFS_IOC_GET_DEV_STATS(r1, 0xc4089434, &(0x7f0000000880)={0x0, 0x6, 0x1, [0x4, 0x1ff, 0x4, 0x40, 0x1f6], [0x10001, 0x595, 0x1, 0x0, 0x29, 0x1, 0x6, 0x2, 0xfffffffffffff001, 0x7, 0xcae, 0x4, 0x2, 0xe426, 0xae65, 0x1, 0x3, 0x9, 0x4, 0x0, 0xfffffffeffffffff, 0x5, 0x8, 0x8000000000000000, 0x1, 0x100, 0x10001, 0xffffffffffffffff, 0x0, 0x7, 0xb, 0x2, 0x0, 0x84d8, 0x7f, 0x2, 0x527, 0x6f94b55f, 0x4, 0xef, 0xfffffffffffffeff, 0x7, 0x3, 0x7, 0xa7, 0x0, 0xd, 0x5, 0x4, 0x3, 0x1, 0xd52, 0x8, 0x4d, 0x5, 0xc, 0xd6, 0x401, 0xfffffffffffffff8, 0x34310236, 0x8, 0x25ce, 0x8, 0x0, 0x6, 0x80000001, 0xfffffffffffffffe, 0x2, 0x7f, 0x6, 0x3, 0x7f, 0x1, 0x2, 0x8, 0x8, 0x62, 0xfffffffffffffff9, 0x1ff, 0xffffffffffff8000, 0xffffffffffff9659, 0x4, 0x200, 0xea, 0x200, 0x2, 0x8001, 0xc2, 0x8001, 0x4, 0x0, 0xff, 0xfffffffffffffff4, 0xa, 0x6, 0x0, 0xc, 0xa, 0x6, 0x2, 0x1, 0xa0000000000, 0x2, 0xfbda, 0x7, 0x2, 0x7f, 0x4, 0xffffffff, 0x1, 0x7, 0x1, 0x85, 0x5, 0x5e, 0x98cc, 0x2, 0x6e22, 0x6, 0x5, 0x3df9]}) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000cc0)={0x0, 0x1, 0x1, [0x7, 0x15, 0x8, 0x10, 0x3], [0x1, 0x3, 0x7, 0xd4, 0xfffffffffffffc01, 0x9, 0x800, 0x2, 0x2, 0x0, 0xfffffffffffffffa, 0x8, 0x5, 0x3, 0x1, 0x3, 0x8, 0x6ef97dd4, 0xe7, 0x7fffffffffffffff, 0xffffffff, 0x0, 0x1000000000000, 0x9567, 0x0, 0x3, 0xb29, 0x5, 0x1, 0x5, 0x4, 0xc, 0x1, 0x1, 0x368, 0xa3, 0x1, 0x6, 0x8, 0x5, 0x9b0, 0xe, 0x2, 0x2, 0x6, 0x0, 0x2, 0xde, 0x1, 0x80fe, 0x9, 0x3, 0x3ff, 0x8, 0x5, 0xd08b, 0xe3, 0x5, 0x3, 0xfffffffffffffffb, 0x3ff, 0x3bb1, 0x101, 0xa8, 0xffff, 0xd, 0x7, 0x5, 0xeed9, 0x5, 0x80, 0x0, 0x1, 0x8, 0xf0, 0x400, 0x5, 0x7f, 0x7, 0x9, 0x5, 0x5, 0x4, 0x4, 0x7, 0x7fffffff, 0x7, 0x6, 0x10, 0x38d, 0x7f, 0xbd7, 0x8000000000000000, 0xba5a, 0x3, 0x9, 0x89, 0xa, 0x7fffffff, 0x8922, 0x8000000000000000, 0x7, 0x5, 0x5, 0xffffffff, 0x7, 0x81, 0x3b, 0x4, 0x2, 0x8, 0xbb3f, 0xfffffffffffffffc, 0x6cc6, 0x2, 0x2, 0x17, 0x55b, 0xfffffffffffff001, 0x8, 0x4]}) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000001100)={0x0, 0x4, {0x1, @usage=0x5, r5, 0x8, 0x9, 0xe60, 0x4398, 0x2, 0x11, @usage=0x5, 0x5, 0x6, [0x3f76, 0x6, 0x7, 0x101, 0x9, 0x2]}, {0x7, @usage=0x4, r6, 0x3, 0x2, 0x1ff, 0x1c76, 0xffffffffffffff34, 0xa, @struct={0x6, 0x3}, 0x5, 0x6, [0x7, 0x7fffffffffffffff, 0xf, 0x4, 0x99f, 0x3]}, {0x3, @struct={0x3, 0x3}, r7, 0x2, 0x1, 0x0, 0x8, 0x3, 0x98, @struct={0x1, 0x4}, 0x3, 0xff, [0x8, 0x9, 0x6a9c218c, 0x7f, 0x9, 0x1]}, {0x5, 0x3, 0x7}}) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r3) socket$unix(0x1, 0x5, 0x0) sendmsg$NL80211_CMD_GET_WIPHY(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="510328bd70000000000001000000a40001000a00000048000300", @ANYRES32, @ANYBLOB="0c0099000208000004000000"], 0x30}}, 0x44) write(r2, &(0x7f0000000100)='100', 0x3) r9 = userfaultfd(0x801) ioctl$UFFDIO_API(r9, 0xc018aa3f, &(0x7f0000001500)={0xaa, 0x80}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) ioctl$UFFDIO_COPY(r9, 0xc028aa05, &(0x7f0000001540)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00003ab000/0x2000)=nil, 0x400000, 0x2, 0x2}) r10 = openat$ttynull(0xffffffffffffff9c, 0x0, 0x82084, 0x0) ioctl$TCSETSF2(r10, 0x402c542d, 0x0) ioctl$TIOCSTI(r10, 0x5412, 0x0) socket(0x10, 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) 3.462965873s ago: executing program 32 (id=215): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x161) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x4000, 0x0) r0 = memfd_create(&(0x7f0000000240)='\xf3e\t\x9f\x918\xc0y\x01c\x1fnux\x00sV\ad\xb0l \xfd\xd7\x8e\x7f\x89\xb8\xc5;~\x04\x03~K\xfbP\x84=\xfa\x81\f\x1et\x10\x0e\xcf^9\xbe\\', 0x0) pwrite64(r0, &(0x7f0000000280)='/', 0x1, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x3a) sendto$inet6(r1, &(0x7f00000002c0)="800037bbfa9ba1ce", 0x8, 0x4000, &(0x7f0000000300)={0xa, 0x0, 0x0, @remote, 0x3}, 0x1c) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x5) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000440)=0x11) ioctl$TIOCVHANGUP(r4, 0x5437, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r2, 0xc400941d, &(0x7f0000000480)={0x0, 0x7, 0x6}) ioctl$BTRFS_IOC_GET_DEV_STATS(r1, 0xc4089434, &(0x7f0000000880)={0x0, 0x6, 0x1, [0x4, 0x1ff, 0x4, 0x40, 0x1f6], [0x10001, 0x595, 0x1, 0x0, 0x29, 0x1, 0x6, 0x2, 0xfffffffffffff001, 0x7, 0xcae, 0x4, 0x2, 0xe426, 0xae65, 0x1, 0x3, 0x9, 0x4, 0x0, 0xfffffffeffffffff, 0x5, 0x8, 0x8000000000000000, 0x1, 0x100, 0x10001, 0xffffffffffffffff, 0x0, 0x7, 0xb, 0x2, 0x0, 0x84d8, 0x7f, 0x2, 0x527, 0x6f94b55f, 0x4, 0xef, 0xfffffffffffffeff, 0x7, 0x3, 0x7, 0xa7, 0x0, 0xd, 0x5, 0x4, 0x3, 0x1, 0xd52, 0x8, 0x4d, 0x5, 0xc, 0xd6, 0x401, 0xfffffffffffffff8, 0x34310236, 0x8, 0x25ce, 0x8, 0x0, 0x6, 0x80000001, 0xfffffffffffffffe, 0x2, 0x7f, 0x6, 0x3, 0x7f, 0x1, 0x2, 0x8, 0x8, 0x62, 0xfffffffffffffff9, 0x1ff, 0xffffffffffff8000, 0xffffffffffff9659, 0x4, 0x200, 0xea, 0x200, 0x2, 0x8001, 0xc2, 0x8001, 0x4, 0x0, 0xff, 0xfffffffffffffff4, 0xa, 0x6, 0x0, 0xc, 0xa, 0x6, 0x2, 0x1, 0xa0000000000, 0x2, 0xfbda, 0x7, 0x2, 0x7f, 0x4, 0xffffffff, 0x1, 0x7, 0x1, 0x85, 0x5, 0x5e, 0x98cc, 0x2, 0x6e22, 0x6, 0x5, 0x3df9]}) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000cc0)={0x0, 0x1, 0x1, [0x7, 0x15, 0x8, 0x10, 0x3], [0x1, 0x3, 0x7, 0xd4, 0xfffffffffffffc01, 0x9, 0x800, 0x2, 0x2, 0x0, 0xfffffffffffffffa, 0x8, 0x5, 0x3, 0x1, 0x3, 0x8, 0x6ef97dd4, 0xe7, 0x7fffffffffffffff, 0xffffffff, 0x0, 0x1000000000000, 0x9567, 0x0, 0x3, 0xb29, 0x5, 0x1, 0x5, 0x4, 0xc, 0x1, 0x1, 0x368, 0xa3, 0x1, 0x6, 0x8, 0x5, 0x9b0, 0xe, 0x2, 0x2, 0x6, 0x0, 0x2, 0xde, 0x1, 0x80fe, 0x9, 0x3, 0x3ff, 0x8, 0x5, 0xd08b, 0xe3, 0x5, 0x3, 0xfffffffffffffffb, 0x3ff, 0x3bb1, 0x101, 0xa8, 0xffff, 0xd, 0x7, 0x5, 0xeed9, 0x5, 0x80, 0x0, 0x1, 0x8, 0xf0, 0x400, 0x5, 0x7f, 0x7, 0x9, 0x5, 0x5, 0x4, 0x4, 0x7, 0x7fffffff, 0x7, 0x6, 0x10, 0x38d, 0x7f, 0xbd7, 0x8000000000000000, 0xba5a, 0x3, 0x9, 0x89, 0xa, 0x7fffffff, 0x8922, 0x8000000000000000, 0x7, 0x5, 0x5, 0xffffffff, 0x7, 0x81, 0x3b, 0x4, 0x2, 0x8, 0xbb3f, 0xfffffffffffffffc, 0x6cc6, 0x2, 0x2, 0x17, 0x55b, 0xfffffffffffff001, 0x8, 0x4]}) ioctl$BTRFS_IOC_BALANCE_V2(r4, 0xc4009420, &(0x7f0000001100)={0x0, 0x4, {0x1, @usage=0x5, r5, 0x8, 0x9, 0xe60, 0x4398, 0x2, 0x11, @usage=0x5, 0x5, 0x6, [0x3f76, 0x6, 0x7, 0x101, 0x9, 0x2]}, {0x7, @usage=0x4, r6, 0x3, 0x2, 0x1ff, 0x1c76, 0xffffffffffffff34, 0xa, @struct={0x6, 0x3}, 0x5, 0x6, [0x7, 0x7fffffffffffffff, 0xf, 0x4, 0x99f, 0x3]}, {0x3, @struct={0x3, 0x3}, r7, 0x2, 0x1, 0x0, 0x8, 0x3, 0x98, @struct={0x1, 0x4}, 0x3, 0xff, [0x8, 0x9, 0x6a9c218c, 0x7f, 0x9, 0x1]}, {0x5, 0x3, 0x7}}) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r3) socket$unix(0x1, 0x5, 0x0) sendmsg$NL80211_CMD_GET_WIPHY(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="510328bd70000000000001000000a40001000a00000048000300", @ANYRES32, @ANYBLOB="0c0099000208000004000000"], 0x30}}, 0x44) write(r2, &(0x7f0000000100)='100', 0x3) r9 = userfaultfd(0x801) ioctl$UFFDIO_API(r9, 0xc018aa3f, &(0x7f0000001500)={0xaa, 0x80}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) ioctl$UFFDIO_COPY(r9, 0xc028aa05, &(0x7f0000001540)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00003ab000/0x2000)=nil, 0x400000, 0x2, 0x2}) r10 = openat$ttynull(0xffffffffffffff9c, 0x0, 0x82084, 0x0) ioctl$TCSETSF2(r10, 0x402c542d, 0x0) ioctl$TIOCSTI(r10, 0x5412, 0x0) socket(0x10, 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) 1.806776944s ago: executing program 2 (id=237): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000140)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback, 0x8}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000001c0), 0x3c) (async) setsockopt$inet6_tcp_int(r0, 0x11a, 0x3, &(0x7f0000000200)=0x304, 0x4) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_RTHDR(r1, 0x29, 0x39, &(0x7f0000000240)={0x33, 0x4, 0x0, 0xa7, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1={0xfc, 0x1, '\x00', 0x1}]}, 0x28) (async) r2 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) (async) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x4800, 0x0) ioctl$KVM_GET_API_VERSION(r3, 0xae00, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, &(0x7f0000000000)={0x7, {{0xa, 0x4e21, 0x2, @mcast2, 0x400}}}, 0x88) (async) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f0000000500)=ANY=[@ANYBLOB="01000000000000000a004e2000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000"], 0x90) 1.801040605s ago: executing program 2 (id=238): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x103a42, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) getrandom(&(0x7f00000012c0)=""/286, 0xffffff9a, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) bind$inet(0xffffffffffffffff, &(0x7f0000001400)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x32}}, 0x10) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) prctl$PR_CAP_AMBIENT(0x2f, 0x2, 0x2800) fallocate(r0, 0x1, 0x5, 0x6) write(r0, &(0x7f0000000100)="96b34879", 0x1001) ioctl$HIDIOCGUSAGES(r0, 0xd01c4813, &(0x7f0000000280)={{0x3, 0xffffffff, 0x3, 0x1, 0x40, 0x78400000}, 0x268, [0xfffff001, 0xff, 0xec3, 0xb6, 0x40, 0x9, 0x4, 0x5, 0x2, 0x401, 0xfffffffd, 0x0, 0x6, 0x101, 0x9, 0x800, 0x0, 0x10, 0xfff, 0x6bc, 0x3, 0x4, 0x2d, 0x274e1a59, 0x3ff, 0x0, 0x1, 0x10001, 0x8, 0xffff, 0x6, 0x4, 0xfffffff9, 0x9, 0x3, 0x0, 0xe00000, 0x3996, 0xfff, 0xa, 0x9000, 0x9, 0xe0000, 0x7, 0xfffffffb, 0x471, 0x4, 0x7, 0x10001, 0x8, 0x7, 0x2, 0x7, 0x8, 0x7, 0xff, 0x2, 0x7ff, 0x5, 0x4, 0x62d8, 0x81, 0x2, 0xc74, 0x9, 0x9000, 0x8, 0x40, 0x8001, 0x83dd, 0x4, 0x2, 0x8001, 0x6, 0x0, 0xfffffff7, 0x401, 0x5, 0x7, 0x4, 0xc, 0x2, 0x4, 0x9, 0x9, 0x3ff, 0x8, 0x4, 0x2, 0xf, 0xe1, 0x9, 0x0, 0x8, 0x3, 0x2e, 0x7, 0xea39, 0x80000000, 0x1, 0x1, 0xe, 0x4, 0x8b, 0x1, 0x1, 0xffff, 0xf0, 0x3, 0x1, 0xffff69a5, 0x80, 0x0, 0xdca, 0x81, 0x2, 0x1000, 0x585e, 0x5, 0x35, 0x7fff, 0x10001, 0x8, 0x1ff, 0x101, 0x401, 0x7fff, 0xe6a, 0xb, 0x3, 0x8000, 0xf, 0x2, 0x2e8d, 0x3, 0x1, 0x5, 0x7ff, 0x5, 0x5, 0x2, 0x7f, 0x2000000, 0x7, 0x9, 0x7, 0x7, 0x0, 0x1, 0x8, 0x1, 0x7c, 0x3, 0x5, 0x5, 0x7fff, 0x7f, 0x3, 0xfffffff8, 0x6, 0x8, 0x7fffffff, 0x7, 0xfd5, 0x6b, 0x3, 0x7, 0x4, 0x4, 0x401, 0x9, 0x4000, 0x1, 0x8000, 0x0, 0x3, 0x7, 0x400, 0x2, 0x80000000, 0xe6a8, 0x3, 0xffffffff, 0x5, 0xaff3, 0x0, 0xfffffff7, 0x2, 0x7ff, 0x3, 0xf41, 0x3, 0x6, 0x0, 0x9, 0x8, 0x7fff, 0x35, 0x1, 0x1d0044bb, 0xbd, 0xfffffffa, 0xfffffff9, 0xc, 0x11113ca9, 0x0, 0x5, 0x8, 0x2, 0xff, 0x8, 0x2, 0x401, 0x1, 0x100, 0x7ff, 0xfffffff9, 0xff, 0x6, 0x7, 0x1fc8, 0x1, 0x8, 0xa, 0xffffffff, 0x10001, 0x700, 0xffffffff, 0x4b1d6707, 0x6, 0x7, 0x7ff, 0x3, 0x7, 0x5, 0x1, 0x6, 0x4ba, 0x6fb, 0x0, 0x3ff, 0x8c, 0x8001, 0x5, 0x1, 0x4, 0x6, 0x7, 0xc, 0x6, 0x8, 0x10, 0x1ff, 0x74fc, 0x2, 0x4, 0x200, 0xffffd508, 0x9, 0x3, 0x2, 0x6, 0x7fff, 0x6, 0xfffff800, 0x6, 0xe0000, 0x8, 0x8, 0x400, 0x8, 0x4, 0x0, 0x5fc, 0x10000, 0x3, 0xfffffffa, 0xaf, 0x3, 0x100, 0x3, 0x2920b4b5, 0x8, 0x2, 0x10, 0x1a1, 0xa, 0x50, 0x5, 0x9, 0x7ff, 0xe, 0x1, 0x80000000, 0x6, 0x4, 0x101, 0x800, 0x2, 0x5, 0xe27, 0x1, 0x9, 0x7, 0xee24, 0x4, 0xb9e, 0xafd, 0x4, 0x7fffffff, 0x7, 0x37, 0x2, 0x1, 0x81, 0x1, 0x6, 0x2, 0x4, 0x6, 0x4434, 0xc, 0x10, 0x7fffffff, 0x7, 0x6, 0x9, 0x5, 0x21, 0x2, 0x10001, 0x7fffffff, 0xc, 0xb, 0xfffffff9, 0x0, 0x8ce, 0x53, 0x9, 0x0, 0x9, 0x8, 0xd8100, 0xfffffff7, 0x3, 0x2, 0x5, 0x9, 0x1, 0x3, 0x9, 0x7, 0x2, 0x2, 0xa8a, 0xfffffc0c, 0x0, 0x6, 0xfffffffa, 0xa, 0xd, 0x10, 0x30, 0x234, 0xb5, 0x8, 0x1, 0x100, 0x2b, 0xfffffffa, 0x7, 0xfffff779, 0x3, 0x9, 0x4, 0xd, 0xfffffff8, 0x4, 0x2, 0x2, 0x6, 0x2, 0x5, 0x0, 0xb, 0xd4e, 0xfffffff2, 0x5b, 0x6, 0x9, 0x0, 0x10000, 0x10000, 0xfffff800, 0x202ee930, 0xe, 0x6, 0x5, 0x2, 0x0, 0xf1, 0x9d, 0x401, 0x1, 0x2, 0x4, 0x1, 0x8, 0x200, 0x4, 0xfffffff7, 0x9, 0x10, 0x1, 0x40, 0xa, 0x7, 0x200, 0x6, 0x8, 0x4, 0xfffff481, 0x46, 0x7, 0xe90, 0x8001, 0x6, 0x8, 0x7, 0x7, 0x6, 0x7, 0x8001, 0x80000000, 0x1ff, 0x0, 0x9, 0xb, 0xb06f, 0xff, 0x3, 0x0, 0xe, 0x6, 0x7, 0x9, 0xffffffff, 0x400, 0x2, 0x0, 0xffffff99, 0x101, 0x9c80dd6, 0xe, 0x3, 0x6, 0xfffffffe, 0x4, 0x7f, 0x1, 0x0, 0x3, 0x3, 0x5, 0x7, 0x1, 0xf86, 0xf785, 0x1, 0x81, 0x5, 0x0, 0xa756, 0xf4, 0x67, 0x78fa, 0x8, 0x4, 0x3, 0x0, 0x6, 0x44c, 0x4, 0x6, 0x2, 0xffff7fff, 0x7, 0xe8ac, 0x6, 0x8, 0x8, 0x5, 0x0, 0x80, 0x8, 0x5, 0x9, 0x1, 0x9, 0x4, 0xffffffff, 0x8, 0x81, 0x7, 0x5, 0x9, 0x40, 0x21, 0x8, 0x6622, 0x3, 0x8, 0x0, 0xb, 0x97, 0x8, 0xf97, 0x35a, 0x0, 0xfffffffb, 0x78b4, 0x8000, 0x7, 0x7f, 0x5, 0x8, 0x7, 0x9, 0x492c, 0x0, 0x3, 0x0, 0x5, 0x9, 0x100, 0x9fcb, 0xfd, 0x81, 0x400, 0x7a01, 0x2, 0x6, 0xfffff3dc, 0x9, 0x5, 0xfffffffc, 0x7, 0x3, 0x8, 0x5a, 0x101, 0x7, 0x2, 0x4, 0x195b, 0x1, 0x4, 0x9, 0x7f, 0x5, 0xb1c9, 0x57d, 0xd, 0xd, 0x8, 0xfffffffd, 0x8, 0x7fff, 0xfffffff9, 0x7, 0xfffffffe, 0x4, 0x5, 0xba8, 0xfffff613, 0x5, 0x5, 0x1219d187, 0x0, 0xffffffa9, 0x80, 0x8, 0x17, 0x4, 0x5, 0x80000001, 0x7fff, 0xfffffff9, 0x3, 0x9, 0x2, 0xdeb4, 0xe8b, 0x4, 0x6, 0x95, 0xa, 0x73, 0xfffffff0, 0x93cf, 0x2, 0x7fffffff, 0x2, 0x96e, 0x5, 0x1, 0x7, 0xe, 0x0, 0x81, 0x1, 0xa, 0x5, 0x8, 0x80000000, 0x2, 0x400, 0x7, 0x8774, 0x2, 0x3, 0x1f, 0x9, 0x356705d4, 0x2, 0x7, 0x8, 0x1, 0x2, 0x6, 0x7fffffff, 0x800, 0xd, 0x2, 0x4, 0x1000, 0x7, 0x6, 0x9, 0xfed, 0x6, 0x8, 0x4, 0x4, 0x3, 0x30c5d063, 0x3, 0x9, 0xffff9105, 0x1, 0xfc, 0x10000, 0x8001, 0x2, 0xce0, 0x2, 0xfff, 0x8, 0x4, 0xb8503621, 0x2, 0x0, 0x7, 0xbb61, 0x0, 0x6, 0x73, 0x9, 0x10000, 0xa, 0x6, 0x7, 0x10, 0x7, 0x7, 0x7fffffff, 0x5, 0x9, 0x1, 0x8, 0x3, 0x8bd, 0x200, 0x6aed, 0x6, 0x1, 0xb880, 0x4, 0x8, 0x3, 0x4bb7541d, 0x81, 0x6, 0xa, 0x10000, 0x8, 0xfffffffc, 0x8, 0x6, 0x200, 0x8, 0x5, 0x10000, 0x5, 0x2, 0x7, 0xfffffffe, 0xb, 0x9, 0xff, 0x4, 0xff, 0x0, 0x8, 0xfffff326, 0x3, 0x662f9573, 0x8, 0x80, 0x0, 0x8, 0x0, 0x4, 0x5, 0x5, 0x7, 0x200, 0xce3, 0x5f63, 0x7, 0x1, 0x1, 0xc443, 0x5, 0x2be, 0x40, 0xb3ee, 0x100, 0x7, 0x52, 0x8, 0x8, 0x2e23f20a, 0xa4, 0x4db4, 0xd5b, 0x5, 0x5, 0x968, 0x7, 0x6, 0x6, 0x5c, 0x40, 0x8, 0x400, 0x800, 0x5, 0x2, 0xd, 0x1, 0x7, 0x2, 0x8, 0x1a000000, 0x9, 0xb16, 0xe71, 0x3, 0x1, 0x3ff, 0x2255, 0x0, 0xfffffffb, 0x97, 0x9, 0x5, 0x7fffffff, 0x6, 0x2, 0x1000, 0x718a, 0xfd1, 0x3, 0x1e71, 0x1, 0x4, 0x7, 0x2, 0xfffffff8, 0x1, 0x0, 0x7, 0x6, 0x5aaa, 0x78, 0x1000, 0x6, 0x9, 0xe2, 0x4, 0xfffffff9, 0x6, 0x3000, 0x3, 0x8, 0x8, 0x7, 0xf4, 0x1, 0x7, 0x5, 0x0, 0x3, 0xffff, 0x3, 0x2, 0x8, 0x3, 0x8, 0x7, 0xd, 0x5, 0xca, 0x6, 0x40000000, 0x4, 0x284c, 0xa, 0x3, 0x5, 0xc5, 0x7fff, 0x7, 0xfffffff8, 0x5, 0x80000, 0x800, 0x8, 0x5, 0x9a6f, 0x347, 0x1, 0x6, 0x3, 0x5, 0x5, 0x7, 0x400, 0x5, 0x6, 0x100, 0x0, 0x9, 0xd, 0x2, 0x39, 0x10001, 0x4, 0x2, 0x5, 0xff, 0x8, 0xf, 0x9, 0x80, 0x4, 0xff800000, 0xfffffffb, 0x10001, 0x1, 0x43a42a2b, 0x0, 0x800, 0x3, 0x2, 0x100, 0xe0, 0xff, 0xb9, 0x101, 0x7, 0x7, 0x9d2f, 0xffffffd9, 0x3, 0x7, 0x2, 0x1, 0x8, 0xfd48, 0x2, 0x1, 0x3, 0x755, 0x67cc2958, 0x5af, 0x80000001, 0x8, 0x8, 0x3, 0xffffffff, 0x940e, 0x7ff, 0x80, 0x4, 0x2, 0x5c1e, 0xeac, 0x4, 0x3, 0xfffffc01, 0x100, 0x7, 0x6, 0x3, 0x6, 0x7fff, 0x50000, 0x8000, 0x1, 0x9, 0x41be, 0x1, 0x10001, 0x1, 0x7, 0x5b0, 0x1, 0x4, 0x8, 0x22f, 0xb763, 0x1000, 0xffffffff, 0x1, 0x6c, 0x3, 0xffff7fff, 0xffffffff, 0x4, 0x1, 0x400, 0x3, 0x6, 0xe, 0x3, 0xf957, 0x5, 0x7, 0x1, 0x8, 0x0, 0x80000001, 0x7, 0x9, 0x1, 0xd110, 0x1000, 0x6, 0x0, 0x6, 0x7, 0x81, 0x8, 0x0, 0x8, 0x8001, 0x6, 0x0, 0x1, 0xb, 0x3, 0x9, 0x4, 0x0, 0x9, 0x512, 0x6, 0x7, 0x80000001, 0x7, 0x3, 0xfffffff8, 0x9, 0x1, 0x6, 0x8, 0x8, 0x5, 0x3, 0x6, 0x10, 0x200, 0x0, 0x8, 0x4, 0x8, 0x8, 0x5, 0x4, 0xafa9, 0x401, 0x2, 0xf, 0x0, 0x2, 0x7f, 0x1060, 0xfffffffc, 0x2, 0x12, 0x2, 0x0, 0x3, 0x1, 0xd4, 0x400, 0x4, 0xd3, 0x9, 0x7fffffff, 0x6, 0x250d]}) r1 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) fchdir(r1) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f00000000c0)='proc\x00', 0x2800005, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000240)='cmdline\x00') openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0xc8) lseek(r2, 0x6, 0x0) 1.412143674s ago: executing program 4 (id=247): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'veth1_to_bridge\x00'}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x2, &(0x7f0000000080)=[{0x84}, {0x6}]}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x3e) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000740)={0x6, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000780)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f00000007c0)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.246773922s ago: executing program 3 (id=248): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000940)=@newsa={0x150, 0x10, 0x1, 0x70bc2c, 0x0, {{@in=@multicast2, @in=@rand_addr=0x64010100, 0x4e21, 0xecdf, 0x0, 0x0, 0xa, 0x80}, {@in6=@local, 0x0, 0x32}, @in6=@private1, {0xfffffffffffffffe, 0xfffffffffffffffe, 0x3, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x8000000000000000}, {0x1, 0x400800, 0x6, 0x292}, {0x1000}, 0x0, 0x7507, 0xa, 0x4, 0x0, 0x2c}, [@algo_crypt={0x60, 0x2, {{'cbc(des3_ede)\x00'}, 0xc0, "6e000bfff000002000ff8000000000000000000100001800"}}]}, 0x150}, 0x1, 0x0, 0x0, 0xc881}, 0x4044050) r1 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0xc882, 0x28) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'nr0\x00', 0x0}) sendmsg$MPTCP_PM_CMD_GET_ADDR(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x68, r2, 0x10, 0x70bd25, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x7ff}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x10000}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x2c, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @private=0xa010100}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r3}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xf8}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x1}]}, 0x68}, 0x1, 0x0, 0x0, 0x814}, 0x40) 1.246407232s ago: executing program 3 (id=249): mkdir(&(0x7f0000000300)='./bus\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x143142, 0x120) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x8, &(0x7f0000000080)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@metacopy_on}, {@verity_on}]}) setxattr$incfs_size(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, 0x0, 0x3) linkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file2\x00', 0x1000) 1.246126682s ago: executing program 3 (id=250): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f00002d8000/0x1000)=nil, 0x1000, 0x3) (async) r0 = open(&(0x7f00009e1000)='./file0\x00', 0x48141, 0x0) fcntl$setlease(r0, 0x400, 0x1) (async) ioctl$EVIOCREVOKE(r0, 0x40044591, &(0x7f0000000000)=0x10000) (async) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x55) (async) fcntl$getflags(r0, 0x401) 1.244232172s ago: executing program 2 (id=251): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x5, &(0x7f0000000000)=0x1, 0x4) (async) sendto$inet(r0, 0x0, 0x0, 0x4008084, &(0x7f0000000040)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x10) (async) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @local}, 0x47) (async) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0)=0x40, 0x4) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f0000000100)=0x100000001, 0x4) (async) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) (async) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) (async) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f00000001c0)=[@mss, @timestamp, @window={0x3, 0x62f3, 0x1}, @mss, @sack_perm, @mss={0x2, 0x6}, @timestamp, @sack_perm], 0x8) sendmsg(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000280)="29966a", 0x3}], 0x1}, 0x4000800) (async) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000002c0), 0x4) sendto$inet(r1, &(0x7f0000000300)='<', 0xfdef, 0x805, 0x0, 0x0) socketpair(0x25, 0x5, 0x80, &(0x7f0000000b80)) 1.228434283s ago: executing program 2 (id=252): r0 = socket$nl_audit(0x10, 0x3, 0x9) r1 = socket$inet6(0xa, 0x1, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='status\x00') r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x149a01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000180)={'syzkaller1\x00', 0xc201}) ioctl$TUNGETFILTER(r3, 0x801054db, 0x0) ioctl$FICLONE(r1, 0x40049409, r2) sendmsg$AUDIT_USER_TTY(r0, &(0x7f0000000440)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000400)={&(0x7f0000000300)={0xec, 0x464, 0x300, 0x70bd22, 0x25dfdbfc, "7aa91e256d79b99310bace02fb39e6a47255dd65b2fa161c7fdac9410a093dfc3b35a7269fb7405b9f77508803b228358da7624b6093ded2484b6635f30b47014445a22b6ec853d4c5252343ac15d9ccd5c6f896f121b4b0b799955908e29a1af9598842606524d04203722723f61d10520c64b7fa61a777390811fd0adeb730da1c06ecc9a82f7f3ca33ae569192d75c8e36841a52b4ddabef2badaf287fff06c650a9560a9aad958dd25fbdec3d8dedcf89db039a0a7e801d12b6a5ec97f89c780547e7a67559f7cdef8df16040bda792c3e6fc71b9cfdc179", ["", ""]}, 0xec}, 0x1, 0x0, 0x0, 0x800}, 0x1) r4 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000080), 0x883, 0x0) ioctl$DM_DEV_CREATE(r4, 0xc138fd03, &(0x7f0000000480)={0x4, 0x0, 0x0, 0x138, 0xffffffffffffff65, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}, @uuid={'LVM-syz', 0x0, '2\x00'}}}) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r6, 0x0, 0x60, 0x0, 0x0) ioctl$DM_TABLE_LOAD(r4, 0xc138fd09, &(0x7f00000005c0)={0x4, 0x0, 0x0, 0x1d0, 0x138, 0x1, 0x0, 0xd010, 0x0, 0x0, @by_dev={r5}, [@crypt={0x0, 0x1488, 0x0, 0x98, 'crypt\x00', {'aes-ecb', 0x20, @hex16=[0x37, 0x33, 0x32, 0x31, 0x30, 0x61, 0x62, 0x66, 0x33, 0x62, 0x62, 0x36, 0x65, 0x63, 0x61, 0x61, 0x35, 0x36, 0x61, 0x34, 0x33, 0x38, 0x65, 0x31, 0x37, 0x65, 0x65, 0x64, 0x66, 0x30, 0x33, 0x64], 0x20, '128', 0x20, {@ram_num={'1:', 0x1}, 0x20, '1'}, ' 2 sector_size:4096 iv_large_sectors'}}]}) syz_usb_connect$uac1(0x0, 0x72, &(0x7f00000000c0)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x41e, 0x3048, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x60, 0x3, 0x1, 0x7, 0x40, 0x1, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xfffa, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x18, 0xf8, 0x6, 0x7, {0x7, 0x25, 0x1, 0xc, 0xfe, 0x1454}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x6, 0x9, 0x3, {0x7, 0x25, 0x1, 0x0, 0x7, 0x400}}}}}}}}]}}, &(0x7f00000002c0)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x201, 0xa, 0x3, 0x1f, 0x8, 0xf7}, 0x0, 0x0}) 946.799233ms ago: executing program 0 (id=257): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x181) (async) mount$bind(&(0x7f0000000080)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x1141099, 0x0) (async, rerun: 64) chroot(&(0x7f0000000140)='./file0/../file0\x00') (async, rerun: 64) mount$bind(&(0x7f0000000280)='.\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2a05004, 0x0) (async) mount(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='f2fs\x00', 0xa20020, 0x0) (async) stat(&(0x7f0000000400)='./file0/../file0\x00', 0x0) (async) readlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0/../file0/../file0\x00', &(0x7f0000000100)=""/62, 0x3e) 890.754699ms ago: executing program 0 (id=258): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000000200)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f69643df52e27c5c3a75488dadc83d036e194b18bfa9c7b214aa5218279ef32ba175e57571e31a71e34468ec6305c28137bb323f632d22cabffe2e92a8ee0f5f714fd9d7c0b60c632249ef1280e", @ANYRESDEC=0x0, @ANYBLOB=',\x00']) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000080)={0x50, 0x0, r1, {0x7, 0x29, 0x9, 0xffffffff9080edc4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x2}}, 0x50) openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x2c) syz_init_net_socket$802154_raw(0x24, 0x4, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracing\x00', 0x1ff) creat(&(0x7f0000000400)='./tracing/uprobe_events\x00', 0x120) socket(0x10, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='.\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r2, 0xc0189436, &(0x7f0000000000)=ANY=[@ANYBLOB="00000000000000000000078f5af816d0a65eb037dbab56106cc100"/39]) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$nl_audit(0x10, 0x3, 0x9) socket$netlink(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet(0x2, 0x2, 0x1) add_key$keyring(&(0x7f0000000540), &(0x7f0000000580)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) pipe(0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_ublk_setup_io_uring(0x3, &(0x7f00000005c0)={0x0, 0x4}, &(0x7f0000000740), 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000780)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000800)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000840)) socket$inet6_tcp(0xa, 0x1, 0x0) 890.262369ms ago: executing program 0 (id=259): r0 = syz_open_procfs(0x0, &(0x7f0000000080)='setgroups\x00') close_range(r0, r0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1a1740, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_setup_syzos_vm$x86(r2, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$x86(r3, &(0x7f0000000040)={0x0, 0x0}) ioctl$KVM_SET_CPUID2(r4, 0x4008ae90, &(0x7f00000002c0)={0x1, 0x0, [{0x80000000, 0x1, 0x9, 0x80000008, 0x3, 0x344, 0x2}]}) 889.909439ms ago: executing program 0 (id=260): r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) (async) r1 = syz_create_resource$futex(&(0x7f0000000680)=0x1) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000700)={0xaa, 0x79}) (async) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000740)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async) madvise(&(0x7f000084a000/0x1000)=nil, 0x1000, 0x18) (async) munmap(&(0x7f0000800000/0x800000)=nil, 0x800000) (async) read(r2, &(0x7f0000000780)=""/153, 0x99) r3 = syz_create_resource$futex(&(0x7f00000006c0)) futex(r1, 0xb, 0x1, 0x0, r3, 0x0) futex(r1, 0x3, 0x1, 0x0, r3, 0x1) r4 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2) ftruncate(r4, 0x1000006) (async) fcntl$addseals(r4, 0x409, 0x7) (async) ioctl$UDMABUF_CREATE(r0, 0x40187542, &(0x7f0000000000)={r4, 0x0, 0x0, 0x1000000}) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f00000001c0), 0x100, 0x0) ioctl$RTC_AIE_ON(r5, 0x7001) (async) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000640)=ANY=[@ANYBLOB="20000000110001000000000001fff1001d0000000c00e3801800228004002b80"], 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x14000000) r7 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./mnt\x00', 0x149000, 0x19a) ioctl$EXT4_IOC_GROUP_ADD(r7, 0x40286608, &(0x7f0000000100)={0x8, 0xffffffffffffffff, 0x3, 0x7ffb, 0xfeb, 0x2}) (async) ioctl$PIO_FONTX(r7, 0x4b6c, &(0x7f0000000600)={0x183, 0x9, &(0x7f0000000200)="2335826397cbd8fbc21885c23f861786a6b254fcbdd6c987372497b7e1fbac2d21bf108d11a70717275fab95d08556cd2ca8f83ee7b305724c4af5f9de11c9d9b2ba42da61a052b4b6ce59ab88782da13eb833f3480be5f93ec6923a9d7819afeecfdf0387002f337caf8574eb9cce2b2b77822e5a7df397efd2458d8851a4e0ccbda116192ae7dc1d77cbb94aee39e40c42c900c39699f3694660a4d499384192f5071d63c4cc29a46a325151773a6340ddc6e412eb426a11aa6cb8199ff17a24f315203532890181affbb6e820026ca766ea42a975c9b428b6e19216cdc3f49fb2a3d412aacacc80e3c28666d93412ef45b8e005033825e58af199a86b94abb143ff89309c2f349ea7c82bcf51fc2d97c052cae1925c185d868c8cdf213afd58c726b476b438910ea17a80a86812ae471e69dbd15eb9a7f3976e075a81c93c9c31369efd756e68a8a617964fbe4b5019edc23e1019b26739c4200cf9e6268a66dd5e79c0f18802d891cf216ea6032da9242c7c91032685abc09a6e0edd47b6dd7d2f0e4b6702f324da6939d95dd8ce3259a05ed88a44d4fd7b13928646cfd6438d7e11a4f7876d2bc6c5b4a5899b5938ac1d0472a3907f79f847281e709de5bc3a8987fb983b34eb8eb7fa4fb481357c0b30158b322a6cd2f8815fc841c5f35bb863307f7d374960f7054a236bd57b38a3d328b095e8d89f899ca1f1acbee9740a03db21a13aa2d6c991a7b70916a26db83c48bbe582dfa37f44f429414b3bb9586a57f5c25cb8575bfb592a7de05b109dbaa066f151d9e2ce8a276ce0ddc604b28dde4ffb0bedf8f891fca0d411bea93f829d7989cec5f6f820bf507e566e869c50590ae9147480bf865f92106ccc3cbad91b508a78c0277048b01d1ad424edbab13e23991b4de456566bf364ab735ed6bc16c150da4e3d19d3484aa3368b89753301ff2b3efba356269b0bb3e70d8e7781c71c89f1c634bd01632dbf39892917b0a505a2d60d2efe6c33c5ed9cc85c3e68e404ef302b07311c404cf4954ef21d224a3f720f48e49db1cc4e0126d23524b926c61870a190c19cd9e35cac67713fc037ed7dbf8c42d1daed182c0fffc63bef15c7640b4b4c4382aa46a9833b9682d9717a45e6038e9f362c152badf2a2a39b14cdbe77846f38ed1226ed71800eb471cc4b31bed1bda554f000a1f2cc0bbc9292e28820f177ea923a67357fc302a9c8b239a9bd6c6cbe24f0104cabed2fd86632ec670172fb0d4b6580cd0ec493636e50d0881b8761a1f0f1192fc91b425695829cdd400ee4525db0ecbca047a49475b98c2fb882f555b0230695f350794bb3441ab19378c0c3632081313e4eebecf041b8a58cc95803df6f0930ece2ad569441a92b2781cdc96c7a100da37a468c4cb44c06e35405716af69d24c2c7a8927bfad483470cc3f72f38121dd76a"}) 551.206763ms ago: executing program 4 (id=261): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) keyctl$negate(0xd, 0x0, 0x5, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000040)=0x80000000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee059853", 0xfffffffffffffcc1, 0x840, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x13, r1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000180)={&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfe3d, 0x0, 0x0}, &(0x7f00000001c0)=0x40) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async) keyctl$negate(0xd, 0x0, 0x5, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) (async) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000040)=0x80000000001, 0x4) (async) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) (async) sendto$inet6(r0, &(0x7f00000000c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee059853", 0xfffffffffffffcc1, 0x840, 0x0, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x13, r1, 0x0) (async) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000180)={&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfe3d, 0x0, 0x0}, &(0x7f00000001c0)=0x40) (async) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) (async) 490.2153ms ago: executing program 4 (id=262): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='100', 0x3) openat$fuse(0xffffffffffffff9c, &(0x7f0000000b00), 0x2, 0x0) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/resume', 0x8080, 0x40) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000b80)={0x54, 0x2, 0x6, 0x3, 0x0, 0x0, {0x7, 0x0, 0x2}, [@IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x5}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x6}, @IPSET_ATTR_SIZE={0x8, 0x17, 0x1, 0x0, 0x1ff}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e21}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e24}]}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r3, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)={0x54, r4, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @loopback}}, {0x14, 0x2, @in={0x2, 0x0, @multicast2}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="8b463c34", @ANYRES16=r4, @ANYBLOB="0100000000000000000017000000400006803c00040067636d286165732900000000000000000000000000000000000000000000000014000000e3de3d7b4cd07ec3ee777de774fc7987cca41989"], 0x54}, 0x1, 0x0, 0x0, 0x4}, 0x4000004) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000880), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r3, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000940)={0x6c, r5, 0x1, 0x0, 0x25dfdbfe, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @loopback}}, {0x20, 0x2, @in6={0xa, 0x0, 0x1, @remote}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}]}]}, 0x6c}}, 0x0) quotactl_fd$Q_QUOTAON(r1, 0xffffffff80000201, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) socket$tipc(0x1e, 0x5, 0x0) set_tid_address(0x0) r7 = openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) write$uinput_user_dev(r7, &(0x7f0000000200)={'syz0\x00', {0x0, 0x4, 0x0, 0x1}, 0x1c, [0x101, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x4000, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x4, 0xac, 0xff, 0xeb93], [0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x7, 0x0, 0x8, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0xfd], [0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x1, 0xfffffffe, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1], [0x0, 0x0, 0x0, 0x9, 0xffffffff, 0xa, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf3, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0xff, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0xb5, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x45c) getsockopt$sock_cred(r6, 0x1, 0x11, 0x0, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r8, 0x107, 0xf, &(0x7f00000009c0)=0x46c, 0x4) r9 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000a00)={'bridge_slave_1\x00', 0x0}) sendto$packet(r8, &(0x7f0000000a40)="330312001200140000007ee82f555f2a0c09000000fd810000f786ddbbaa4b1f0f852b4632f47042195e0b8ca9767e06b5ee37a16737de6213570256ecac7ede41272a2fd20f80d4adea8f0e50", 0x4d, 0x3674842c2925b8c7, &(0x7f0000000ac0)={0x11, 0x0, r10, 0x1, 0x62, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x14) socket$inet_udp(0x2, 0x2, 0x0) ioctl$UI_DEV_CREATE(r7, 0x5501) 165.469254ms ago: executing program 3 (id=263): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000500)={0x0, &(0x7f0000000580)=[@wrmsr={0x65, 0x20, {0x400000f1, 0x1}}], 0x20}) (async) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='setgroups\x00') socket$unix(0x1, 0x1, 0x0) writev(r4, &(0x7f0000000040)=[{&(0x7f0000000080)="64656e7986", 0x5}], 0x1) getegid() ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000640)={0x1, 0x0, [{0x40000001, 0x0, 0xe, 0x31237648, 0x0, 0x0, 0x20000}]}) (async) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r4, 0x4018aee1, &(0x7f0000000100)=@attr_pmu_irq={0x0, 0x1, 0x1, &(0x7f00000000c0)=0x2}) (async, rerun: 32) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async, rerun: 32) socket(0x15, 0x3, 0x9) 163.280984ms ago: executing program 3 (id=264): madvise(&(0x7f0000a53000/0x1000)=nil, 0x1000, 0xe) mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000) mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000c40000/0x4000)=nil) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000140)='reno', 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000180)=0xce, 0x4) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$inet(r0, &(0x7f0000000200)={0x0, 0x14, &(0x7f0000000240)=[{&(0x7f0000000280)=' ', 0x100120}], 0x1}, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) request_key(&(0x7f0000000000)='.request_key_auth\x00', 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x2000000000031, 0xffffffffffffffff, 0x0) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/pm_freeze_timeout', 0x1a1081, 0x18) write$khugepaged_scan(r1, &(0x7f0000000080), 0x8) setsockopt$inet6_int(r1, 0x29, 0x1f, &(0x7f00000000c0)=0xfff, 0x4) 163.045884ms ago: executing program 3 (id=265): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x158) (async) capset(&(0x7f0000000200)={0x20071026}, &(0x7f0000000240)={0x0, 0x2}) chdir(&(0x7f0000000280)='./file0\x00') symlink(&(0x7f00000002c0)='.\x00', &(0x7f0000000300)='./file0\x00') (async) seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0) (async) setns(0xc9, 0x0) (async) setns(0xc9, 0x0) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="14000002", @ANYRES16=r3, @ANYBLOB="b3af00000000ffffffff33000000"], 0x32}}, 0x10800) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) (async) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f000000a000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, &(0x7f00000000c0)="b91b0000000f3225ff0f00000d000010000f30b878563412bb000310008903", 0xfffffcad}], 0x1, 0x0, 0x0, 0x0) (async) ioctl$KVM_RUN(r4, 0xae80, 0x0) 143.231976ms ago: executing program 4 (id=266): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000005c0), r0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) r4 = dup3(r3, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, 0x0) ioctl$OCFS2_IOC_MOVE_EXT(r4, 0x40406f06, &(0x7f00000000c0)={0x3, 0x2, 0xeeda, 0x2, 0x3}) r5 = ioctl$KVM_GET_STATS_FD_cpu(r4, 0xaece) ioctl$EXT4_IOC_SETFSUUID(r5, 0x4008662c, &(0x7f0000000080)={0x0, 0x0, "7119c70879ca4eb42a68478b5e52a00c"}) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000840)={0x20, r1, 0x1, 0x70bd25, 0x25dfdbfc, {}, [@ETHTOOL_A_LINKMODES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x2000c041}, 0x4044094) 128.367717ms ago: executing program 4 (id=267): lstat(0x0, 0x0) (async) r0 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) r1 = add_key(&(0x7f0000000080)='asymmetric\x00', 0x0, &(0x7f0000000440)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r0) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x80102, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) (async) r4 = eventfd2(0xe5c, 0x80000) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000100)={r4, 0x7, 0x2, r4}) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r1, 0x0, &(0x7f0000000180)=@chain={'key_or_keyring:', r0}) (async) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000140)={r4, 0x6, 0x2, r4}) keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f00000009c0)={r1}, &(0x7f0000000a00)=ANY=[@ANYBLOB='enc=pkcs1 hash=sha3(('], 0x0, 0x0) 10.88541ms ago: executing program 0 (id=268): unshare(0x60000600) r0 = socket(0x10, 0x3, 0x0) socket$tipc(0x1e, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00001, 0x3000007, 0x401d031, 0xffffffffffffffff, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, &(0x7f0000000080)='mem\x00\xffEev\xf2r\xf1\x18\x1d\xb9\x00y_hug$\bo-\x03Q`]o\x8cr\x9d_etl\xf9\xdd\a\xad\\H\xe94\b,H\xbf', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)) write$tcp_mem(r1, &(0x7f0000000100)={0x8, 0x20, 0x8001, 0x20, 0x1}, 0x48) sendto$inet6(r0, &(0x7f0000000000)="c10e000018001f06b9409b0dffff110d0207be040205060506100a044300040018000000fac8388827a685a168d9a44604094565360c648dcaaf6c26c291214549932fde4a460c89b6ec0cff3959547f509058ba86c902fc3a10004a320c0400160012000a00004000000000000000080756ede4ccbe5880", 0x78, 0x0, 0x0, 0x0) 7.61667ms ago: executing program 4 (id=269): seccomp$SECCOMP_GET_NOTIF_SIZES(0x3, 0x0, &(0x7f0000000400)) r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$OCFS2_IOC_GROUP_ADD64(r0, 0x40186f03, &(0x7f0000000100)={0xffffffff, 0x2, 0xaa}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_setup_syzos_vm$x86(r2, &(0x7f0000c00000/0x400000)=nil) connect$inet(0xffffffffffffffff, &(0x7f0000000300)={0x2, 0x4e21, @loopback}, 0x10) (async, rerun: 64) r4 = syz_kvm_add_vcpu$x86(r3, &(0x7f0000000180)={0x0, 0x0}) (rerun: 64) ioctl$KVM_SET_SREGS2(r4, 0x4140aecd, &(0x7f00000001c0)={{0xffffffff, 0x4, 0xa, 0x8, 0x8, 0x3, 0x9, 0xa, 0x2, 0x0, 0x7, 0x80}, {0xffff1000, 0x26000, 0xd, 0x6, 0x7, 0x4, 0x2, 0xc, 0x4, 0x8, 0x8, 0x3}, {0x0, 0x5000, 0x0, 0xff, 0x2, 0x1, 0xa3, 0xfa, 0x7, 0x80, 0x9, 0x2}, {0x7000, 0xeee80000, 0x0, 0x7, 0xaf, 0x8, 0x3, 0x2, 0xb, 0x3, 0x3, 0xf6}, {0x800dffe, 0xdddd1000, 0xd, 0x3, 0x7, 0x4, 0xd0, 0x48, 0x7, 0x5, 0xb, 0x54}, {0x60000, 0x80a0000, 0x10, 0x1, 0xd8, 0xf, 0x7, 0x5, 0x2, 0x7, 0x55, 0x1}, {0xeeee0000, 0x66f7ae013f5d15c1, 0xa, 0x1, 0xa, 0xfc, 0x80, 0x6a, 0x6, 0x0, 0x7, 0x2}, {0xc000, 0x3e12b17e264e20d1, 0x8, 0x1, 0x6, 0x0, 0x0, 0x4, 0x2, 0x1, 0x45, 0x20}, {0x7000, 0x5}, {0x4000, 0x10}, 0xc0a8bf25a8f76288, 0x0, 0xeeee0000, 0x6185, 0x3, 0x2900, 0x4000, 0x0, [0x81, 0x7, 0x8, 0x6]}) r5 = openat$selinux_policy(0xffffff9c, &(0x7f00000000c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r5, 0x0) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) prctl$PR_SET_MM(0x23, 0x6, &(0x7f0000555000/0x1000)=nil) prctl$PR_SET_MM(0x23, 0x7, &(0x7f0000ffd000/0x3000)=nil) (async) brk(0x200000555000) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/custom1\x00', 0x2, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) (async, rerun: 64) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x3) (rerun: 64) ioctl$KVM_SET_VCPU_EVENTS(r8, 0x4400ae8f, 0x0) (async) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x2e, 0x54, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x10) (async) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f00000004c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r9, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e00000000000000000005000600010000000800090001000000050002"], 0x44}}, 0x0) sendmmsg(r9, &(0x7f00000005c0), 0x40000000000009f, 0x0) syz_clone3(&(0x7f0000000380)={0x200, 0x0, 0x0, 0x0, {0x1f}, 0x0, 0x0, 0x0, 0x0, 0x0, {r5}}, 0x58) write$selinux_load(r0, &(0x7f0000000000)=ANY=[], 0x190ec) (async) ioctl$F2FS_IOC_RESERVE_COMPRESS_BLOCKS(r0, 0x8008f513, &(0x7f0000000040)) 0s ago: executing program 0 (id=270): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYRES16], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f0000000300)=ANY=[@ANYBLOB="00dc6b"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000380)={0x24, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0003060000000203"], 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0003020000000203"], 0x0, 0x0}, 0x0) syz_usb_ep_write(r0, 0xf, 0x2d, &(0x7f0000000080)="f4527af037c40f2d18206255e6fb9d9d8a3fd3d2eb436cdb8e9a672e450eab6dd7817399891a8a782c53ee958a") syz_usb_control_io(r0, &(0x7f0000000040)={0x2c, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x4b, @lang_id={0x0, 0x3, 0x5817}}, 0x0, 0x0, 0x0}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.212' (ED25519) to the list of known hosts. [ 23.891203][ T36] audit: type=1400 audit(1793352813.820:64): avc: denied { mounton } for pid=287 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.894769][ T287] cgroup: Unknown subsys name 'net' [ 23.913913][ T36] audit: type=1400 audit(1793352813.820:65): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.941402][ T36] audit: type=1400 audit(1793352813.860:66): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.941828][ T287] cgroup: Unknown subsys name 'devices' [ 24.050301][ T287] cgroup: Unknown subsys name 'hugetlb' [ 24.055947][ T287] cgroup: Unknown subsys name 'rlimit' [ 24.152445][ T36] audit: type=1400 audit(1793352814.080:67): avc: denied { setattr } for pid=287 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 24.175742][ T36] audit: type=1400 audit(1793352814.080:68): avc: denied { mounton } for pid=287 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 24.200512][ T36] audit: type=1400 audit(1793352814.080:69): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 24.266242][ T289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 24.275248][ T36] audit: type=1400 audit(1793352814.210:70): avc: denied { relabelto } for pid=289 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 24.300790][ T36] audit: type=1400 audit(1793352814.210:71): avc: denied { write } for pid=289 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.337575][ T36] audit: type=1400 audit(1793352814.260:72): avc: denied { read } for pid=287 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.363232][ T36] audit: type=1400 audit(1793352814.260:73): avc: denied { open } for pid=287 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.363926][ T287] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 25.972672][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.979883][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.987015][ T294] bridge_slave_0: entered allmulticast mode [ 25.993785][ T294] bridge_slave_0: entered promiscuous mode [ 26.001700][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.008814][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.015913][ T294] bridge_slave_1: entered allmulticast mode [ 26.022353][ T294] bridge_slave_1: entered promiscuous mode [ 26.050591][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.057683][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.065001][ T295] bridge_slave_0: entered allmulticast mode [ 26.071368][ T295] bridge_slave_0: entered promiscuous mode [ 26.087450][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.094565][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.101713][ T295] bridge_slave_1: entered allmulticast mode [ 26.108126][ T295] bridge_slave_1: entered promiscuous mode [ 26.132123][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.139239][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.146329][ T296] bridge_slave_0: entered allmulticast mode [ 26.152785][ T296] bridge_slave_0: entered promiscuous mode [ 26.160753][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.167813][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.175018][ T296] bridge_slave_1: entered allmulticast mode [ 26.181317][ T296] bridge_slave_1: entered promiscuous mode [ 26.245041][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.252215][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.259547][ T297] bridge_slave_0: entered allmulticast mode [ 26.265817][ T297] bridge_slave_0: entered promiscuous mode [ 26.272451][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.279554][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.286680][ T297] bridge_slave_1: entered allmulticast mode [ 26.293100][ T297] bridge_slave_1: entered promiscuous mode [ 26.420255][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.427352][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.434701][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.441869][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.457471][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.464585][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.471917][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.478989][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.489218][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.496295][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.503621][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.510688][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.519574][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.526665][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.534025][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.541104][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.601509][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.609713][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.617020][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.624446][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.633012][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.640382][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.647969][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.655284][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.670936][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.678035][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.685670][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.692767][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.700595][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.707655][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.720198][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.727280][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.735600][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.742695][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.753106][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.760213][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.769048][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.776122][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.789789][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.796860][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.851989][ T297] veth0_vlan: entered promiscuous mode [ 26.859431][ T295] veth0_vlan: entered promiscuous mode [ 26.883689][ T296] veth0_vlan: entered promiscuous mode [ 26.898712][ T295] veth1_macvtap: entered promiscuous mode [ 26.908259][ T294] veth0_vlan: entered promiscuous mode [ 26.923699][ T297] veth1_macvtap: entered promiscuous mode [ 26.937220][ T296] veth1_macvtap: entered promiscuous mode [ 26.952962][ T294] veth1_macvtap: entered promiscuous mode [ 26.986278][ T297] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 27.033282][ T316] netlink: 'syz.1.2': attribute type 10 has an invalid length. [ 27.041655][ T316] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2'. [ 27.050655][ T316] veth1: entered promiscuous mode [ 27.079317][ T319] FAULT_INJECTION: forcing a failure. [ 27.079317][ T319] name failslab, interval 1, probability 0, space 0, times 1 [ 27.096837][ T318] FAULT_INJECTION: forcing a failure. [ 27.096837][ T318] name failslab, interval 1, probability 0, space 0, times 1 [ 27.112894][ T319] CPU: 1 UID: 0 PID: 319 Comm: syz.3.4 Not tainted syzkaller #0 b5d0aad997485fc03b0f686c9bc4e10dbcf7cbf9 [ 27.112930][ T319] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 27.112955][ T319] Call Trace: [ 27.112964][ T319] [ 27.112972][ T319] __dump_stack+0x21/0x30 [ 27.113014][ T319] dump_stack_lvl+0x140/0x1c0 [ 27.113047][ T319] ? __cfi_dump_stack_lvl+0x10/0x10 [ 27.113082][ T319] ? string+0x283/0x2b0 [ 27.113104][ T319] dump_stack+0x19/0x20 [ 27.113135][ T319] should_fail_ex+0x3c2/0x510 [ 27.113157][ T319] ? context_struct_to_string+0x45c/0xa10 [ 27.113189][ T319] should_failslab+0xac/0x100 [ 27.113213][ T319] __kmalloc_noprof+0x69/0x510 [ 27.113245][ T319] ? context_struct_to_string+0x45c/0xa10 [ 27.113275][ T319] context_struct_to_string+0x45c/0xa10 [ 27.113304][ T319] ? string_to_context_struct+0x680/0x680 [ 27.113332][ T319] ? sidtab_sid2str_get+0x1d7/0x360 [ 27.113362][ T319] security_sid_to_context_core+0x340/0x5d0 [ 27.113389][ T319] security_sid_to_context+0x2e/0x50 [ 27.113415][ T319] avc_audit_post_callback+0x1a8/0x790 [ 27.113438][ T319] ? __cfi_avc_audit_post_callback+0x10/0x10 [ 27.113460][ T319] ? __cfi_audit_log_format+0x10/0x10 [ 27.113490][ T319] ? audit_log_untrustedstring+0xea/0x100 [ 27.113518][ T319] ? __cfi_avc_audit_post_callback+0x10/0x10 [ 27.113551][ T319] common_lsm_audit+0x14b9/0x18b0 [ 27.113572][ T319] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 27.113597][ T319] ? __cfi_avc_audit_post_callback+0x10/0x10 [ 27.113620][ T319] ? __cfi_common_lsm_audit+0x10/0x10 [ 27.113641][ T319] ? avc_denied+0x113/0x180 [ 27.113666][ T319] slow_avc_audit+0x19f/0x220 [ 27.113688][ T319] ? __cfi_slow_avc_audit+0x10/0x10 [ 27.113709][ T319] ? __cfi__raw_spin_lock+0x10/0x10 [ 27.113731][ T319] ? iput+0x2c1/0x910 [ 27.113753][ T319] ? avc_has_perm_noaudit+0x21f/0x360 [ 27.113775][ T319] avc_has_perm+0x1ec/0x240 [ 27.113797][ T319] ? __cfi_avc_has_perm+0x10/0x10 [ 27.113821][ T319] selinux_sb_kern_mount+0x173/0x200 [ 27.113853][ T319] ? __cfi_selinux_sb_kern_mount+0x10/0x10 [ 27.113881][ T319] ? __kasan_check_read+0x15/0x20 [ 27.113910][ T319] ? static_key_count+0x45/0x70 [ 27.113933][ T319] ? security_sb_set_mnt_opts+0x272/0x290 [ 27.113957][ T319] security_sb_kern_mount+0x47/0xe0 [ 27.113980][ T319] vfs_cmd_create+0x138/0x220 [ 27.114009][ T319] ? vfs_fsconfig_locked+0x6c/0x350 [ 27.114036][ T319] vfs_fsconfig_locked+0x76/0x350 [ 27.114064][ T319] __se_sys_fsconfig+0x72d/0x870 [ 27.114090][ T319] ? __x64_sys_fsconfig+0xf0/0xf0 [ 27.114118][ T319] ? __kasan_check_write+0x18/0x20 [ 27.114146][ T319] ? fpregs_restore_userregs+0x11c/0x260 [ 27.114175][ T319] __x64_sys_fsconfig+0xc3/0xf0 [ 27.114202][ T319] x64_sys_call+0x11bb/0x2ee0 [ 27.114225][ T319] do_syscall_64+0x57/0xf0 [ 27.114247][ T319] ? clear_bhb_loop+0x50/0xa0 [ 27.114279][ T319] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 27.114310][ T319] RIP: 0033:0x7f826999f559 [ 27.114339][ T319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 27.114358][ T319] RSP: 002b:00007f826a904028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 27.114386][ T319] RAX: ffffffffffffffda RBX: 00007f8269c26090 RCX: 00007f826999f559 [ 27.114403][ T319] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000008 [ 27.114417][ T319] RBP: 00007f8269a36b20 R08: 0000000000000000 R09: 0000000000000000 [ 27.114431][ T319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 27.114444][ T319] R13: 00007f8269c26128 R14: 00007f8269c26090 R15: 00007fff80840af8 [ 27.114463][ T319] [ 27.116279][ T318] CPU: 1 UID: 0 PID: 318 Comm: syz.0.1 Not tainted syzkaller #0 b5d0aad997485fc03b0f686c9bc4e10dbcf7cbf9 [ 27.116313][ T318] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 27.116329][ T318] Call Trace: [ 27.116337][ T318] [ 27.116346][ T318] __dump_stack+0x21/0x30 [ 27.116385][ T318] dump_stack_lvl+0x140/0x1c0 [ 27.116419][ T318] ? __cfi_dump_stack_lvl+0x10/0x10 [ 27.116453][ T318] ? __kasan_check_write+0x18/0x20 [ 27.116485][ T318] dump_stack+0x19/0x20 [ 27.116517][ T318] should_fail_ex+0x3c2/0x510 [ 27.116551][ T318] should_failslab+0xac/0x100 [ 27.116573][ T318] kmem_cache_alloc_noprof+0x42/0x410 [ 27.116606][ T318] ? __kernfs_new_node+0xf1/0x740 [ 27.116631][ T318] ? __kasan_check_write+0x18/0x20 [ 27.116661][ T318] ? down_write+0xee/0x2b0 [ 27.116693][ T318] __kernfs_new_node+0xf1/0x740 [ 27.116716][ T318] ? __kasan_check_write+0x18/0x20 [ 27.116746][ T318] ? kernfs_new_node+0x280/0x280 [ 27.116774][ T318] ? kernfs_add_one+0x301/0x400 [ 27.116798][ T318] ? __kernfs_create_file+0x203/0x280 [ 27.116826][ T318] kernfs_new_node+0x154/0x280 [ 27.116848][ T318] kernfs_create_link+0xa8/0x200 [ 27.116875][ T318] sysfs_do_create_link_sd+0x8a/0x120 [ 27.116908][ T318] sysfs_create_link+0x6c/0x90 [ 27.116940][ T318] device_add_class_symlinks+0xbe/0x260 [ 27.116970][ T318] device_add+0x4b8/0xbf0 [ 27.116998][ T318] input_register_device+0x9af/0x1080 [ 27.117035][ T318] uinput_create_device+0x416/0x670 [ 27.117070][ T318] uinput_ioctl_handler+0x3ea/0x1360 [ 27.117103][ T318] ? uinput_release+0x70/0x70 [ 27.117137][ T318] ? __fget_files+0x2bc/0x330 [ 27.117159][ T318] uinput_ioctl+0x2c/0x40 [ 27.117191][ T318] ? __cfi_uinput_ioctl+0x10/0x10 [ 27.117222][ T318] __se_sys_ioctl+0x123/0x1b0 [ 27.117245][ T318] __x64_sys_ioctl+0x7f/0xa0 [ 27.117266][ T318] x64_sys_call+0x1878/0x2ee0 [ 27.117288][ T318] do_syscall_64+0x57/0xf0 [ 27.117312][ T318] ? clear_bhb_loop+0x50/0xa0 [ 27.117345][ T318] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 27.117375][ T318] RIP: 0033:0x7fbdd1d9f559 [ 27.117394][ T318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 27.117413][ T318] RSP: 002b:00007fbdd2c06028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 27.117437][ T318] RAX: ffffffffffffffda RBX: 00007fbdd2025fa0 RCX: 00007fbdd1d9f559 [ 27.117454][ T318] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000006 [ 27.117468][ T318] RBP: 00007fbdd1e36b20 R08: 0000000000000000 R09: 0000000000000000 [ 27.117481][ T318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 27.117494][ T318] R13: 00007fbdd2026038 R14: 00007fbdd2025fa0 R15: 00007fff7e862f18 [ 27.117513][ T318] [ 27.368223][ T10] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 27.763682][ T63] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 27.863652][ T332] capability: warning: `syz.3.7' uses deprecated v2 capabilities in a way that may be insecure [ 27.927982][ T63] usb 2-1: Using ep0 maxpacket: 16 [ 27.933491][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 27.940123][ T10] usb 3-1: config 14 has an invalid interface number: 199 but max is 0 [ 27.948821][ T10] usb 3-1: config 14 has no interface number 0 [ 27.956469][ T63] usb 2-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 27.965653][ T63] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.974053][ T63] usb 2-1: Product: syz [ 27.978308][ T63] usb 2-1: Manufacturer: syz [ 27.983012][ T10] usb 3-1: New USB device found, idVendor=5bfe, idProduct=a243, bcdDevice=3a.07 [ 27.992355][ T63] usb 2-1: SerialNumber: syz [ 27.997491][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.005818][ T63] usb 2-1: config 0 descriptor?? [ 28.011035][ T10] usb 3-1: Product: syz [ 28.015258][ T10] usb 3-1: Manufacturer: syz [ 28.020049][ T10] usb 3-1: SerialNumber: syz [ 28.025675][ T63] ftdi_sio 2-1:0.0: FTDI USB Serial Device converter detected [ 28.033274][ T327] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 28.042070][ T63] usb 2-1: Detected FT-X [ 28.199103][ T327] usb 1-1: config 0 has no interfaces? [ 28.204687][ T327] usb 1-1: New USB device found, idVendor=0b05, idProduct=17e0, bcdDevice= 0.00 [ 28.213815][ T327] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.222712][ T327] usb 1-1: config 0 descriptor?? [ 28.231153][ T63] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 28.240465][ T63] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 28.248063][ T63] ftdi_sio 2-1:0.0: GPIO initialisation failed: -71 [ 28.255612][ T10] cdc_acm 3-1:14.199: invalid descriptor buffer length [ 28.264318][ T63] usb 2-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 28.273445][ T10] usb 3-1: USB disconnect, device number 2 [ 28.281999][ T63] usb 2-1: USB disconnect, device number 2 [ 28.300275][ T63] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 28.312192][ T63] ftdi_sio 2-1:0.0: device disconnected [ 28.446514][ T329] process 'syz.0.6' launched '/dev/fd/8' with NULL argv: empty string added [ 28.747564][ T349] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 28.937545][ T36] kauditd_printk_skb: 89 callbacks suppressed [ 28.937564][ T36] audit: type=1400 audit(1793352818.860:163): avc: denied { setopt } for pid=354 comm="syz.2.14" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 28.958342][ T312] usb 1-1: USB disconnect, device number 2 [ 28.971403][ T36] audit: type=1400 audit(1793352818.890:164): avc: denied { connect } for pid=354 comm="syz.2.14" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 29.038415][ T63] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 29.198038][ T63] usb 2-1: Using ep0 maxpacket: 16 [ 29.204558][ T63] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 29.214758][ T63] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 29.225118][ T63] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 29.234223][ T63] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.242309][ T63] usb 2-1: Product: syz [ 29.246488][ T63] usb 2-1: Manufacturer: syz [ 29.251138][ T63] usb 2-1: SerialNumber: syz [ 29.352434][ T36] audit: type=1400 audit(1793352819.280:165): avc: denied { read } for pid=362 comm="syz.0.23" name="usbmon0" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 29.360301][ T365] fuse: Bad value for 'user_id' [ 29.380323][ T364] FAULT_INJECTION: forcing a failure. [ 29.380323][ T364] name failslab, interval 1, probability 0, space 0, times 0 [ 29.380356][ T364] CPU: 1 UID: 0 PID: 364 Comm: syz.3.15 Not tainted syzkaller #0 b5d0aad997485fc03b0f686c9bc4e10dbcf7cbf9 [ 29.380433][ T364] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 29.380482][ T364] Call Trace: [ 29.380513][ T364] [ 29.380543][ T364] __dump_stack+0x21/0x30 [ 29.380654][ T364] dump_stack_lvl+0x140/0x1c0 [ 29.380748][ T364] ? __cfi_dump_stack_lvl+0x10/0x10 [ 29.380852][ T364] dump_stack+0x19/0x20 [ 29.380943][ T364] should_fail_ex+0x3c2/0x510 [ 29.381005][ T364] should_failslab+0xac/0x100 [ 29.381068][ T364] kmem_cache_alloc_noprof+0x42/0x410 [ 29.381145][ T364] ? __kasan_check_write+0x18/0x20 [ 29.381232][ T364] ? __kernfs_new_node+0xf1/0x740 [ 29.381301][ T364] __kernfs_new_node+0xf1/0x740 [ 29.381386][ T364] ? __kasan_check_write+0x18/0x20 [ 29.381467][ T364] ? kernfs_new_node+0x280/0x280 [ 29.381529][ T364] ? kernfs_activate+0x1ee/0x200 [ 29.381586][ T364] ? __kasan_check_write+0x18/0x20 [ 29.381668][ T364] ? rwsem_read_trylock+0x275/0x5a0 [ 29.381743][ T364] ? downgrade_write+0x470/0x470 [ 29.381818][ T364] kernfs_new_node+0x154/0x280 [ 29.381914][ T364] __kernfs_create_file+0x52/0x280 [ 29.382002][ T364] sysfs_add_file_mode_ns+0x1d2/0x280 [ 29.382112][ T364] sysfs_merge_group+0x184/0x330 [ 29.382207][ T364] ? __cfi_sysfs_merge_group+0x10/0x10 [ 29.382288][ T364] dpm_sysfs_add+0xe4/0x280 [ 29.382355][ T364] device_add+0x521/0xbf0 [ 29.382428][ T364] input_register_device+0x9af/0x1080 [ 29.382531][ T364] uinput_create_device+0x416/0x670 [ 29.382617][ T364] uinput_ioctl_handler+0x3ea/0x1360 [ 29.382706][ T364] ? uinput_release+0x70/0x70 [ 29.382811][ T364] ? __fget_files+0x2bc/0x330 [ 29.382875][ T364] uinput_ioctl+0x2c/0x40 [ 29.382960][ T364] ? __cfi_uinput_ioctl+0x10/0x10 [ 29.383050][ T364] __se_sys_ioctl+0x123/0x1b0 [ 29.383113][ T364] __x64_sys_ioctl+0x7f/0xa0 [ 29.383169][ T364] x64_sys_call+0x1878/0x2ee0 [ 29.383248][ T364] do_syscall_64+0x57/0xf0 [ 29.383322][ T364] ? clear_bhb_loop+0x50/0xa0 [ 29.383412][ T364] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 29.383494][ T364] RIP: 0033:0x7f826999f559 [ 29.383540][ T364] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 29.383593][ T364] RSP: 002b:00007f826a925028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 29.383663][ T364] RAX: ffffffffffffffda RBX: 00007f8269c25fa0 RCX: 00007f826999f559 [ 29.383706][ T364] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000006 [ 29.383749][ T364] RBP: 00007f8269a36b20 R08: 0000000000000000 R09: 0000000000000000 [ 29.383792][ T364] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 29.383826][ T364] R13: 00007f8269c26038 R14: 00007f8269c25fa0 R15: 00007fff80840af8 [ 29.383879][ T364] [ 29.405847][ T36] audit: type=1400 audit(1793352819.280:166): avc: denied { open } for pid=362 comm="syz.0.23" path="/dev/usbmon0" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 29.419910][ T365] fuse: Bad value for 'user_id' [ 29.436729][ T36] audit: type=1400 audit(1793352819.350:167): avc: denied { ioctl } for pid=362 comm="syz.0.23" path="/dev/usbmon0" dev="devtmpfs" ino=87 ioctlcmd=0x9207 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 29.467688][ T63] usb 2-1: 0:2 : does not exist [ 29.644513][ T36] audit: type=1400 audit(1793352819.580:168): avc: denied { create } for pid=367 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 29.684290][ T63] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 29.699347][ T36] audit: type=1400 audit(1793352819.600:169): avc: denied { read } for pid=369 comm="syz.3.16" dev="nsfs" ino=4026532547 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 29.704892][ T368] netlink: 160 bytes leftover after parsing attributes in process `syz.2.17'. [ 29.728877][ T36] audit: type=1400 audit(1793352819.600:170): avc: denied { open } for pid=369 comm="syz.3.16" path="net:[4026532547]" dev="nsfs" ino=4026532547 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 29.792660][ T63] usb 2-1: USB disconnect, device number 3 [ 29.843805][ T36] audit: type=1400 audit(1793352819.630:171): avc: denied { getopt } for pid=367 comm="syz.2.17" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 29.845379][ T372] SELinux: Context system_u: is not valid (left unmapped). [ 29.864225][ T36] audit: type=1400 audit(1793352819.630:172): avc: denied { write } for pid=367 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 30.177961][ T10] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 30.339007][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 30.350093][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 30.359925][ T10] usb 4-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 30.369029][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.377874][ T10] usb 4-1: config 0 descriptor?? [ 30.648013][ T63] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 30.789403][ T10] cp2112 0003:10C4:EA90.0001: item fetching failed at offset 0/7 [ 30.797316][ T10] cp2112 0003:10C4:EA90.0001: parse failed [ 30.803616][ T10] cp2112 0003:10C4:EA90.0001: probe with driver cp2112 failed with error -22 [ 30.819398][ T63] usb 2-1: unable to get BOS descriptor or descriptor too short [ 30.834131][ T63] usb 2-1: not running at top speed; connect to a high speed hub [ 30.845646][ T63] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 18, changing to 4 [ 30.872201][ T63] usb 2-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 30.881556][ T63] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.889811][ T63] usb 2-1: Product: syz [ 30.894051][ T63] usb 2-1: Manufacturer: syz [ 30.898849][ T63] usb 2-1: SerialNumber: syz [ 30.995108][ T312] usb 4-1: USB disconnect, device number 2 [ 31.110218][ T63] usb 2-1: Audio class v2/v3 interfaces need an interface association [ 31.134504][ T63] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 31.153989][ T325] udevd[325]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 31.259496][ T438] overlayfs: failed to clone lowerpath [ 31.260362][ T439] overlayfs: failed to clone upperpath [ 31.748320][ T312] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 31.801382][ T450] incfs: Options parsing error. -22 [ 31.806726][ T450] incfs: mount failed -22 [ 31.837308][ T459] ======================================================= [ 31.837308][ T459] WARNING: The mand mount option has been deprecated and [ 31.837308][ T459] and is ignored by this kernel. Remove the mand [ 31.837308][ T459] option from the mount to silence this warning. [ 31.837308][ T459] ======================================================= [ 31.874679][ T459] overlayfs: failed to clone lowerpath [ 31.880270][ T312] usb 4-1: device descriptor read/64, error -71 [ 32.128000][ T312] usb 4-1: device descriptor read/64, error -71 [ 32.347967][ T49] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 32.367962][ T312] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 32.442236][ T478] netlink: 12 bytes leftover after parsing attributes in process `syz.0.44'. [ 32.464273][ T480] overlayfs: failed to clone upperpath [ 32.471729][ T480] tipc: Started in network mode [ 32.476641][ T480] tipc: Node identity ac14140f, cluster identity 4711 [ 32.483569][ T480] tipc: New replicast peer: 255.255.255.255 [ 32.489940][ T480] tipc: Enabled bearer , priority 10 [ 32.508410][ T312] usb 4-1: device descriptor read/64, error -71 [ 32.516143][ T49] usb 3-1: config 15 has an invalid interface number: 10 but max is 0 [ 32.524663][ T49] usb 3-1: config 15 has no interface number 0 [ 32.531266][ T49] usb 3-1: config 15 interface 10 has no altsetting 0 [ 32.539917][ T49] usb 3-1: New USB device found, idVendor=05ac, idProduct=8501, bcdDevice=dd.83 [ 32.549326][ T49] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.557355][ T49] usb 3-1: Product: syz [ 32.561572][ T49] usb 3-1: Manufacturer: syz [ 32.566190][ T49] usb 3-1: SerialNumber: syz [ 32.767997][ T312] usb 4-1: device descriptor read/64, error -71 [ 32.777496][ T49] usb 3-1: Found UVC 0.00 device syz (05ac:8501) [ 32.784010][ T49] usb 3-1: No valid video chain found. [ 32.790868][ T49] usb 3-1: USB disconnect, device number 3 [ 32.878063][ T312] usb usb4-port1: attempt power cycle [ 33.218026][ T312] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 33.239255][ T312] usb 4-1: device descriptor read/8, error -71 [ 33.370213][ T312] usb 4-1: device descriptor read/8, error -71 [ 33.414742][ T63] usb 2-1: USB disconnect, device number 4 [ 33.607990][ T312] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 33.618144][ T10] tipc: Node number set to 2886997007 [ 33.629116][ T312] usb 4-1: device descriptor read/8, error -71 [ 33.708033][ T327] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 33.759127][ T312] usb 4-1: device descriptor read/8, error -71 [ 33.778016][ T63] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 33.859217][ T327] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 33.870231][ T327] usb 3-1: New USB device found, idVendor=056a, idProduct=033b, bcdDevice= 0.00 [ 33.878505][ T312] usb usb4-port1: unable to enumerate USB device [ 33.879873][ T327] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.929476][ T63] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 33.937165][ T63] usb 2-1: can't read configurations, error -61 [ 34.068498][ T63] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 34.118189][ T509] netlink: 'syz.0.55': attribute type 4 has an invalid length. [ 34.126015][ T509] netlink: 17 bytes leftover after parsing attributes in process `syz.0.55'. [ 34.219260][ T63] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 34.226950][ T63] usb 2-1: can't read configurations, error -61 [ 34.233756][ T63] usb usb2-port1: attempt power cycle [ 34.298629][ T36] kauditd_printk_skb: 39 callbacks suppressed [ 34.298647][ T36] audit: type=1400 audit(1793352824.230:212): avc: denied { read } for pid=497 comm="syz.2.52" name="binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 34.328594][ T36] audit: type=1400 audit(1793352824.230:213): avc: denied { open } for pid=497 comm="syz.2.52" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 34.352556][ T36] audit: type=1400 audit(1793352824.230:214): avc: denied { ioctl } for pid=497 comm="syz.2.52" path="/dev/binderfs/binder0" dev="binder" ino=13 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 34.378034][ T36] audit: type=1400 audit(1793352824.230:215): avc: denied { set_context_mgr } for pid=497 comm="syz.2.52" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 34.397854][ T36] audit: type=1400 audit(1793352824.230:216): avc: denied { read } for pid=497 comm="syz.2.52" name="state_hashed" dev="binder" ino=1048630 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 34.420966][ T36] audit: type=1400 audit(1793352824.230:217): avc: denied { open } for pid=497 comm="syz.2.52" path="/dev/binderfs/binder_logs/state_hashed" dev="binder" ino=1048630 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 34.512480][ T327] usbhid 3-1:1.0: can't add hid device: -71 [ 34.518618][ T327] usbhid 3-1:1.0: probe with driver usbhid failed with error -71 [ 34.527837][ T327] usb 3-1: USB disconnect, device number 4 [ 34.587995][ T63] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 34.609666][ T63] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 34.617300][ T63] usb 2-1: can't read configurations, error -61 [ 34.693454][ T36] audit: type=1400 audit(1793352824.620:218): avc: denied { write } for pid=523 comm="syz.0.58" name="ram0" dev="devtmpfs" ino=32 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 34.716742][ T36] audit: type=1400 audit(1793352824.620:219): avc: denied { map } for pid=523 comm="syz.0.58" path="/23/dev/ram0" dev="devtmpfs" ino=32 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 34.747998][ T63] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 34.779968][ T63] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 34.787634][ T63] usb 2-1: can't read configurations, error -61 [ 34.794097][ T63] usb usb2-port1: unable to enumerate USB device [ 35.342814][ T36] audit: type=1400 audit(1793352825.270:220): avc: denied { bind } for pid=542 comm="syz.0.63" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 35.405490][ T36] audit: type=1400 audit(1793352825.330:221): avc: denied { mount } for pid=546 comm="syz.3.65" name="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 35.439865][ T547] veth1: entered allmulticast mode [ 35.446913][ T546] veth1: left allmulticast mode [ 35.594098][ T567] Zero length message leads to an empty skb [ 35.624411][ T567] rust_binder: 566:567 got reply transaction with no transaction stack [ 35.632925][ T567] rust_binder: 566:567 transaction reply to 0:0 failed EINVAL, code 1 size 0-0 line thread.rs:1560 [ 35.704218][ T327] rust_binder: 566: undelivered TRANSACTION_ERROR: 29201 [ 35.716326][ T577] FAULT_INJECTION: forcing a failure. [ 35.716326][ T577] name failslab, interval 1, probability 0, space 0, times 0 [ 35.729170][ T577] CPU: 1 UID: 0 PID: 577 Comm: syz.3.73 Not tainted syzkaller #0 b5d0aad997485fc03b0f686c9bc4e10dbcf7cbf9 [ 35.729212][ T577] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 35.729224][ T577] Call Trace: [ 35.729230][ T577] [ 35.729236][ T577] __dump_stack+0x21/0x30 [ 35.729264][ T577] dump_stack_lvl+0x140/0x1c0 [ 35.729288][ T577] ? __cfi_dump_stack_lvl+0x10/0x10 [ 35.729311][ T577] ? futex_wait+0x2b8/0x7c0 [ 35.729331][ T577] ? __cfi_futex_wait+0x10/0x10 [ 35.729349][ T577] ? iov_iter_advance+0x9b/0x1e0 [ 35.729368][ T577] dump_stack+0x19/0x20 [ 35.729390][ T577] should_fail_ex+0x3c2/0x510 [ 35.729406][ T577] should_failslab+0xac/0x100 [ 35.729421][ T577] kmem_cache_alloc_noprof+0x42/0x410 [ 35.729442][ T577] ? do_futex+0x32a/0x510 [ 35.729457][ T577] ? getname_flags+0xcc/0x6b0 [ 35.729481][ T577] getname_flags+0xcc/0x6b0 [ 35.729504][ T577] getname+0x1b/0x30 [ 35.729526][ T577] do_sys_openat2+0xda/0x1d0 [ 35.729544][ T577] ? do_sys_open+0x100/0x100 [ 35.729562][ T577] ? __x64_sys_pwritev+0x1dd/0x2c0 [ 35.729577][ T577] __x64_sys_openat+0x13a/0x170 [ 35.729596][ T577] x64_sys_call+0xe69/0x2ee0 [ 35.729611][ T577] do_syscall_64+0x57/0xf0 [ 35.729628][ T577] ? clear_bhb_loop+0x50/0xa0 [ 35.729652][ T577] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 35.729675][ T577] RIP: 0033:0x7f826999f559 [ 35.729688][ T577] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.729701][ T577] RSP: 002b:00007f826a925028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 35.729717][ T577] RAX: ffffffffffffffda RBX: 00007f8269c25fa0 RCX: 00007f826999f559 [ 35.729729][ T577] RDX: 0000000000000000 RSI: 0000200000000200 RDI: ffffffffffffff9c [ 35.729740][ T577] RBP: 00007f8269a36b20 R08: 0000000000000000 R09: 0000000000000000 [ 35.729749][ T577] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 35.729759][ T577] R13: 00007f8269c26038 R14: 00007f8269c25fa0 R15: 00007fff80840af8 [ 35.729772][ T577] [ 35.969731][ T577] FAULT_INJECTION: forcing a failure. [ 35.969731][ T577] name fail_futex, interval 1, probability 0, space 0, times 1 [ 35.982688][ T577] CPU: 1 UID: 0 PID: 577 Comm: syz.3.73 Not tainted syzkaller #0 b5d0aad997485fc03b0f686c9bc4e10dbcf7cbf9 [ 35.982723][ T577] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 35.982738][ T577] Call Trace: [ 35.982745][ T577] [ 35.982753][ T577] __dump_stack+0x21/0x30 [ 35.982791][ T577] dump_stack_lvl+0x140/0x1c0 [ 35.982821][ T577] ? __cfi_dump_stack_lvl+0x10/0x10 [ 35.982856][ T577] dump_stack+0x19/0x20 [ 35.982886][ T577] should_fail_ex+0x3c2/0x510 [ 35.982909][ T577] should_fail+0xf/0x20 [ 35.982928][ T577] get_futex_key+0x178/0x940 [ 35.982950][ T577] ? __cfi_get_futex_key+0x10/0x10 [ 35.982969][ T577] ? call_rcu+0x14/0x20 [ 35.982998][ T577] futex_wake+0x150/0x950 [ 35.983024][ T577] ? __kasan_check_write+0x18/0x20 [ 35.983053][ T577] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 35.983075][ T577] ? __cfi_futex_wake+0x10/0x10 [ 35.983100][ T577] ? perf_lock_task_context+0x398/0x450 [ 35.983162][ T577] ? __perf_event_period+0x490/0x490 [ 35.983194][ T577] ? mutex_unlock+0x90/0x240 [ 35.983223][ T577] do_futex+0x37d/0x510 [ 35.983243][ T577] ? __kasan_check_read+0x15/0x20 [ 35.983271][ T577] ? __cfi_do_futex+0x10/0x10 [ 35.983293][ T577] ? __kasan_check_write+0x18/0x20 [ 35.983328][ T577] mm_release+0x15f/0x300 [ 35.983355][ T577] ? exit_mm_release+0x50/0x50 [ 35.983381][ T577] ? futex_exit_release+0x11d/0x1f0 [ 35.983402][ T577] exit_mm_release+0x29/0x50 [ 35.983426][ T577] do_exit+0x832/0x2850 [ 35.983454][ T577] ? __kasan_check_read+0x15/0x20 [ 35.983480][ T577] ? futex_wake+0x627/0x950 [ 35.983504][ T577] ? __cfi_do_exit+0x10/0x10 [ 35.983530][ T577] ? futex_wait+0x2b8/0x7c0 [ 35.983554][ T577] ? __cfi_futex_wait+0x10/0x10 [ 35.983578][ T577] ? __kasan_check_write+0x18/0x20 [ 35.983603][ T577] ? _raw_spin_lock_irq+0x93/0x120 [ 35.983625][ T577] do_group_exit+0x21f/0x2f0 [ 35.983654][ T577] ? __kasan_check_write+0x18/0x20 [ 35.983680][ T577] ? recalc_sigpending+0x16c/0x1d0 [ 35.983705][ T577] get_signal+0x134c/0x1490 [ 35.983737][ T577] arch_do_signal_or_restart+0xbc/0x700 [ 35.983759][ T577] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 35.983785][ T577] syscall_exit_to_user_mode+0x57/0xb0 [ 35.983813][ T577] do_syscall_64+0x63/0xf0 [ 35.983833][ T577] ? clear_bhb_loop+0x50/0xa0 [ 35.983862][ T577] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 35.983888][ T577] RIP: 0033:0x7f826999f559 [ 35.983906][ T577] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.983923][ T577] RSP: 002b:00007f826a9250e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 35.983945][ T577] RAX: fffffffffffffe00 RBX: 00007f8269c25fa8 RCX: 00007f826999f559 [ 35.983959][ T577] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f8269c25fa8 [ 35.983972][ T577] RBP: 00007f8269c25fa0 R08: 0000000000000000 R09: 0000000000000000 [ 35.983985][ T577] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 35.983998][ T577] R13: 00007f8269c26038 R14: 00007fff80840a10 R15: 00007fff80840af8 [ 35.984015][ T577] [ 36.031046][ T589] netlink: 25 bytes leftover after parsing attributes in process `syz.2.75'. [ 36.474430][ T607] netlink: 28 bytes leftover after parsing attributes in process `syz.1.80'. [ 36.657979][ T63] usb 4-1: new full-speed USB device number 7 using dummy_hcd [ 36.808789][ T63] usb 4-1: not running at top speed; connect to a high speed hub [ 36.817355][ T63] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 36.829178][ T63] usb 4-1: New USB device found, idVendor=225a, idProduct=e1d4, bcdDevice=a7.ad [ 36.838441][ T63] usb 4-1: New USB device strings: Mfr=245, Product=210, SerialNumber=0 [ 36.846885][ T63] usb 4-1: Product: syz [ 36.851169][ T63] usb 4-1: Manufacturer: syz [ 36.858908][ T63] usb 4-1: Found UVC 1.00 device syz (225a:e1d4) [ 36.919366][ T51] bridge_slave_1: left allmulticast mode [ 36.925676][ T51] bridge_slave_1: left promiscuous mode [ 36.931469][ T51] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.940266][ T51] bridge_slave_0: left allmulticast mode [ 36.946059][ T51] bridge_slave_0: left promiscuous mode [ 36.951885][ T51] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.065276][ T63] usb 4-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 37.089187][ T51] veth1_macvtap: left promiscuous mode [ 37.089432][ T63] uvcvideo 4-1:1.1: Failed to query (129) UVC probe control : -71 (exp. 26). [ 37.100550][ T51] veth0_vlan: left promiscuous mode [ 37.120768][ T63] uvcvideo 4-1:1.1: Failed to initialize the device (-71). [ 37.145775][ T63] usb 4-1: USB disconnect, device number 7 [ 37.275171][ T623] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.282559][ T623] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.289729][ T623] bridge_slave_0: entered allmulticast mode [ 37.296161][ T623] bridge_slave_0: entered promiscuous mode [ 37.303312][ T623] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.310408][ T623] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.317504][ T623] bridge_slave_1: entered allmulticast mode [ 37.324197][ T623] bridge_slave_1: entered promiscuous mode [ 37.410397][ T311] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.417540][ T311] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.440754][ T311] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.447860][ T311] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.464631][ T623] veth0_vlan: entered promiscuous mode [ 37.486639][ T623] veth1_macvtap: entered promiscuous mode [ 37.720263][ T641] netlink: 12 bytes leftover after parsing attributes in process `syz.0.91'. [ 37.729918][ T641] netlink: 1 bytes leftover after parsing attributes in process `syz.0.91'. [ 37.858083][ T63] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 37.891286][ T658] futex_wake_op: syz.0.95 tries to shift op by 144; fix this program [ 37.899639][ T658] futex_wake_op: syz.0.95 tries to shift op by 144; fix this program [ 38.007961][ T63] usb 4-1: Using ep0 maxpacket: 8 [ 38.014780][ T63] usb 4-1: config 1 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 85, changing to 10 [ 38.025952][ T63] usb 4-1: config 1 interface 0 altsetting 8 bulk endpoint 0x82 has invalid maxpacket 64 [ 38.035921][ T63] usb 4-1: config 1 interface 0 altsetting 8 bulk endpoint 0x3 has invalid maxpacket 16 [ 38.045781][ T63] usb 4-1: config 1 interface 0 has no altsetting 0 [ 38.056369][ T63] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 38.065576][ T63] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.073612][ T63] usb 4-1: Product: Й [ 38.077776][ T63] usb 4-1: Manufacturer: А [ 38.082387][ T63] usb 4-1: SerialNumber: 뺞⶘祑릮⧮봸瘑귡鮻ꦦᔾ탚昭풿垆溱梕ψ㿭酚뼪﯒╂샏祕镬蝧 [ 38.098388][ T639] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 38.105797][ T639] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 38.478229][ T12] Bluetooth: hci0: Frame reassembly failed (-84) [ 38.517737][ T63] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -71 [ 38.527819][ T63] usb 4-1: USB disconnect, device number 8 [ 39.085925][ T673] SELinux: security_context_str_to_sid (syt|v\{) failed with errno=-22 [ 39.112448][ T675] netlink: 16 bytes leftover after parsing attributes in process `syz.3.100'. [ 39.122590][ T676] netlink: 16 bytes leftover after parsing attributes in process `syz.3.100'. [ 39.388010][ T63] usb 4-1: new full-speed USB device number 9 using dummy_hcd [ 39.539108][ T63] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 39.550260][ T63] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 39.560146][ T63] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 39.573092][ T63] usb 4-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 39.582213][ T63] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.590982][ T63] usb 4-1: config 0 descriptor?? [ 39.637952][ T473] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 39.787955][ T473] usb 2-1: Using ep0 maxpacket: 16 [ 39.794379][ T473] usb 2-1: config 0 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 39.805601][ T473] usb 2-1: config 0 interface 0 altsetting 1 endpoint 0x81 has invalid wMaxPacketSize 0 [ 39.815582][ T473] usb 2-1: config 0 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 39.828470][ T473] usb 2-1: config 0 interface 0 has no altsetting 0 [ 39.835157][ T473] usb 2-1: New USB device found, idVendor=046d, idProduct=c215, bcdDevice= 0.00 [ 39.844299][ T473] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.853304][ T473] usb 2-1: config 0 descriptor?? [ 40.011901][ T36] kauditd_printk_skb: 32 callbacks suppressed [ 40.011919][ T36] audit: type=1400 audit(1793352829.940:254): avc: denied { unmount } for pid=679 comm="syz.3.102" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 40.045913][ T36] audit: type=1400 audit(1793352829.970:255): avc: denied { associate } for pid=696 comm="syz.3.102" name="core" scontext=root:object_r:etc_runtime_t tcontext=system_u:object_r:root_t tclass=filesystem permissive=1 [ 40.271806][ T473] input: HID 046d:c215 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:046D:C215.0002/input/input6 [ 40.297343][ T36] audit: type=1400 audit(1793352830.220:256): avc: denied { read } for pid=96 comm="acpid" name="event3" dev="devtmpfs" ino=468 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 40.321036][ T473] logitech 0003:046D:C215.0002: input,hiddev96,hidraw0: USB HID v0.00 Device [HID 046d:c215] on usb-dummy_hcd.1-1/input0 [ 40.345562][ T36] audit: type=1400 audit(1793352830.220:257): avc: denied { open } for pid=96 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=468 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 40.371516][ T36] audit: type=1400 audit(1793352830.300:258): avc: denied { ioctl } for pid=96 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=468 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 40.549356][ T669] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 40.549848][ T670] Bluetooth: hci0: command 0x1003 tx timeout [ 40.693196][ T63] usbhid 4-1:0.0: can't add hid device: -71 [ 40.700504][ T63] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 40.710423][ T63] usb 4-1: USB disconnect, device number 9 [ 40.917960][ T473] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 41.067962][ T473] usb 3-1: Using ep0 maxpacket: 16 [ 41.074540][ T473] usb 3-1: too many endpoints for config 1 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 41.085757][ T473] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 41.097031][ T473] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 41.107662][ T473] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 34118, setting to 1024 [ 41.119242][ T473] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 1024 [ 41.129602][ T473] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 255 [ 41.143978][ T473] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 41.153565][ T473] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 41.161863][ T473] usb 3-1: SerialNumber: syz [ 41.169374][ T702] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 41.177041][ T702] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 41.391308][ T473] cdc_acm 3-1:1.0: ttyACM0: USB ACM device [ 41.413092][ T473] usb 3-1: USB disconnect, device number 5 [ 41.458204][ T49] usb 2-1: reset high-speed USB device number 9 using dummy_hcd [ 41.501619][ T710] netlink: 44 bytes leftover after parsing attributes in process `syz.3.110'. [ 41.524623][ T710] netlink: 43 bytes leftover after parsing attributes in process `syz.3.110'. [ 41.541363][ T710] netlink: 'syz.3.110': attribute type 6 has an invalid length. [ 41.551024][ T710] netlink: 'syz.3.110': attribute type 5 has an invalid length. [ 41.561499][ T714] overlayfs: failed to clone upperpath [ 41.567086][ T710] netlink: 43 bytes leftover after parsing attributes in process `syz.3.110'. [ 41.577985][ T711] netlink: 44 bytes leftover after parsing attributes in process `syz.3.110'. [ 41.587066][ T711] netlink: 43 bytes leftover after parsing attributes in process `syz.3.110'. [ 41.597702][ T711] netlink: 'syz.3.110': attribute type 6 has an invalid length. [ 41.606006][ T711] netlink: 'syz.3.110': attribute type 5 has an invalid length. [ 41.613979][ T711] netlink: 43 bytes leftover after parsing attributes in process `syz.3.110'. [ 41.667726][ T36] audit: type=1400 audit(1793352831.590:259): avc: denied { setattr } for pid=717 comm="syz.3.113" name="secretmem" dev="secretmem" ino=6900 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 42.185324][ T734] overlayfs: missing 'workdir' [ 42.190188][ T36] audit: type=1400 audit(1793352832.110:260): avc: denied { watch_reads } for pid=732 comm="syz.0.118" path="/45/bus" dev="tmpfs" ino=273 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 42.238006][ T712] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 42.269776][ T739] fuse: Bad value for 'fd' [ 42.417969][ T712] usb 3-1: Using ep0 maxpacket: 16 [ 42.424351][ T712] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 42.433282][ T712] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 42.443475][ T712] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 42.454581][ T712] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 42.463884][ T712] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 42.472069][ T712] usb 3-1: Product: syz [ 42.476311][ T712] usb 3-1: Manufacturer: syz [ 42.481003][ T712] usb 3-1: SerialNumber: syz [ 42.525860][ T742] netlink: 'syz.1.121': attribute type 10 has an invalid length. [ 42.593308][ T36] audit: type=1400 audit(1793352832.520:261): avc: denied { create } for pid=743 comm="syz.1.122" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 42.612646][ T36] audit: type=1400 audit(1793352832.520:262): avc: denied { create } for pid=743 comm="syz.1.122" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 42.633502][ T36] audit: type=1400 audit(1793352832.520:263): avc: denied { ioctl } for pid=743 comm="syz.1.122" path="socket:[6946]" dev="sockfs" ino=6946 ioctlcmd=0x8946 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 42.711115][ T729] loop6: detected capacity change from 0 to 8 [ 42.738162][ T729] loop6: detected capacity change from 8 to 6 [ 42.746185][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 42.756763][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 42.765976][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 42.767680][ T729] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 42.775733][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 42.786822][ T729] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 42.791481][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 42.812378][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 42.821649][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 42.831606][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 42.840814][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 42.850051][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 42.851514][ T754] 9pnet_fd: Insufficient options for proto=fd [ 42.859242][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 42.892176][ T760] FAULT_INJECTION: forcing a failure. [ 42.892176][ T760] name failslab, interval 1, probability 0, space 0, times 0 [ 42.904962][ T760] CPU: 0 UID: 0 PID: 760 Comm: syz.1.126 Not tainted syzkaller #0 b5d0aad997485fc03b0f686c9bc4e10dbcf7cbf9 [ 42.905001][ T760] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 42.905016][ T760] Call Trace: [ 42.905024][ T760] [ 42.905033][ T760] __dump_stack+0x21/0x30 [ 42.905074][ T760] dump_stack_lvl+0x140/0x1c0 [ 42.905109][ T760] ? __cfi_dump_stack_lvl+0x10/0x10 [ 42.905145][ T760] ? selinux_kernfs_init_security+0x14b/0x4b0 [ 42.905179][ T760] dump_stack+0x19/0x20 [ 42.905210][ T760] should_fail_ex+0x3c2/0x510 [ 42.905243][ T760] should_failslab+0xac/0x100 [ 42.905268][ T760] kmem_cache_alloc_noprof+0x42/0x410 [ 42.905300][ T760] ? __kernfs_new_node+0xf1/0x740 [ 42.905324][ T760] ? bpf_lsm_kernfs_init_security+0xd/0x20 [ 42.905349][ T760] __kernfs_new_node+0xf1/0x740 [ 42.905371][ T760] ? __kasan_check_write+0x18/0x20 [ 42.905404][ T760] ? kernfs_new_node+0x280/0x280 [ 42.905426][ T760] ? down_write+0xee/0x2b0 [ 42.905459][ T760] ? __cfi_down_write+0x10/0x10 [ 42.905491][ T760] ? __kasan_check_write+0x18/0x20 [ 42.905522][ T760] ? up_write+0x66/0x280 [ 42.905548][ T760] ? kernfs_activate+0x1ee/0x200 [ 42.905572][ T760] kernfs_new_node+0x154/0x280 [ 42.905595][ T760] __kernfs_create_file+0x52/0x280 [ 42.905623][ T760] sysfs_add_file_mode_ns+0x1d2/0x280 [ 42.905653][ T760] internal_create_group+0x66c/0xe70 [ 42.905688][ T760] ? __kasan_check_write+0x18/0x20 [ 42.905720][ T760] ? sysfs_create_group+0x40/0x40 [ 42.905752][ T760] ? kernfs_activate+0x1ee/0x200 [ 42.905777][ T760] sysfs_create_groups+0x5c/0x130 [ 42.905811][ T760] device_add_attrs+0x12d/0x850 [ 42.905839][ T760] ? device_add_class_symlinks+0x260/0x260 [ 42.905870][ T760] ? __kasan_check_write+0x18/0x20 [ 42.905900][ T760] ? kobject_put+0x1cc/0x2a0 [ 42.905924][ T760] ? device_add_class_symlinks+0x22e/0x260 [ 42.905957][ T760] device_add+0x4db/0xbf0 [ 42.905985][ T760] input_register_device+0x9af/0x1080 [ 42.906022][ T760] uinput_create_device+0x416/0x670 [ 42.906058][ T760] uinput_ioctl_handler+0x3ea/0x1360 [ 42.906093][ T760] ? uinput_release+0x70/0x70 [ 42.906129][ T760] ? __fget_files+0x2bc/0x330 [ 42.906151][ T760] uinput_ioctl+0x2c/0x40 [ 42.906183][ T760] ? __cfi_uinput_ioctl+0x10/0x10 [ 42.906216][ T760] __se_sys_ioctl+0x123/0x1b0 [ 42.906249][ T760] __x64_sys_ioctl+0x7f/0xa0 [ 42.906271][ T760] x64_sys_call+0x1878/0x2ee0 [ 42.906295][ T760] do_syscall_64+0x57/0xf0 [ 42.906318][ T760] ? clear_bhb_loop+0x50/0xa0 [ 42.906349][ T760] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 42.906380][ T760] RIP: 0033:0x7f301319f559 [ 42.906400][ T760] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 42.906419][ T760] RSP: 002b:00007f3014074028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 42.906442][ T760] RAX: ffffffffffffffda RBX: 00007f3013425fa0 RCX: 00007f301319f559 [ 42.906459][ T760] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000007 [ 42.906473][ T760] RBP: 00007f3013236b20 R08: 0000000000000000 R09: 0000000000000000 [ 42.906488][ T760] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 42.906502][ T760] R13: 00007f3013426038 R14: 00007f3013425fa0 R15: 00007fff2737ff08 [ 42.906537][ T760] [ 43.149659][ T312] usb 2-1: USB disconnect, device number 9 [ 43.253392][ T712] usb 3-1: 0:2 : does not exist [ 43.265182][ T712] usb 3-1: USB disconnect, device number 6 [ 43.283131][ T325] udevd[325]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 43.597979][ T312] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 43.749448][ T312] usb 2-1: config index 0 descriptor too short (expected 64575, got 68) [ 43.758006][ T312] usb 2-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 43.768234][ T312] usb 2-1: config 1 interface 0 altsetting 0 has 5 endpoint descriptors, different from the interface descriptor's value: 6 [ 43.796871][ T312] usb 2-1: config index 1 descriptor too short (expected 64575, got 68) [ 43.806721][ T312] usb 2-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 43.817056][ T312] usb 2-1: config 1 interface 0 altsetting 0 has 5 endpoint descriptors, different from the interface descriptor's value: 6 [ 43.831841][ T765] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 43.841598][ T765] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 44.050688][ T312] usb 2-1: string descriptor 0 read error: -71 [ 44.057079][ T312] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 44.066332][ T312] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 44.078015][ T312] usb 2-1: can't set config #1, error -71 [ 44.084750][ T312] usb 2-1: USB disconnect, device number 10 [ 44.130365][ T780] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 44.662015][ T801] netlink: 'syz.1.139': attribute type 4 has an invalid length. [ 44.669781][ T801] netlink: 17 bytes leftover after parsing attributes in process `syz.1.139'. [ 44.885110][ T817] fuse: Bad value for 'fd' [ 44.891527][ T817] ./dev/sda1: Can't lookup blockdev [ 44.967981][ T312] usb 3-1: new full-speed USB device number 7 using dummy_hcd [ 44.987966][ T63] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 45.063260][ T36] kauditd_printk_skb: 17 callbacks suppressed [ 45.063279][ T36] audit: type=1400 audit(1793352834.990:281): avc: denied { ioctl } for pid=820 comm="syz.3.146" path="socket:[8206]" dev="sockfs" ino=8206 ioctlcmd=0xf504 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 45.107998][ T312] usb 3-1: device descriptor read/64, error -71 [ 45.137962][ T63] usb 2-1: Using ep0 maxpacket: 32 [ 45.145442][ T63] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 129, changing to 7 [ 45.158334][ T63] usb 2-1: New USB device found, idVendor=0dba, idProduct=3000, bcdDevice= 0.40 [ 45.167537][ T63] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 45.175757][ T63] usb 2-1: Product: syz [ 45.180209][ T63] usb 2-1: Manufacturer: syz [ 45.184839][ T63] usb 2-1: SerialNumber: syz [ 45.191143][ T832] 9pnet: Could not find request transport: xen [ 45.348237][ T312] usb 3-1: device descriptor read/64, error -71 [ 45.405057][ T63] usb 2-1: Invalid firmware size=105. [ 45.411244][ T63] usb 2-1: Invalid firmware size=105. [ 45.417270][ T63] usb 2-1: Invalid firmware size=105. [ 45.426949][ T63] usb 2-1: USB disconnect, device number 11 [ 45.471867][ T839] fuse: Bad value for 'fd' [ 45.587996][ T312] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 45.717971][ T312] usb 3-1: device descriptor read/64, error -71 [ 45.826489][ T36] audit: type=1400 audit(1793352835.750:282): avc: denied { name_bind } for pid=854 comm="syz.3.162" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 45.854533][ T36] audit: type=1400 audit(1793352835.780:283): avc: denied { connect } for pid=857 comm="syz.3.163" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 45.873992][ T36] audit: type=1400 audit(1793352835.780:284): avc: denied { shutdown } for pid=857 comm="syz.3.163" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 45.898723][ T860] netlink: 'syz.0.164': attribute type 27 has an invalid length. [ 45.935258][ T36] audit: type=1400 audit(1793352835.860:285): avc: denied { mount } for pid=864 comm="syz.0.166" name="/" dev="configfs" ino=1836 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 45.969449][ T36] audit: type=1400 audit(1793352835.890:286): avc: denied { search } for pid=864 comm="syz.0.166" name="/" dev="configfs" ino=1836 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 45.992088][ T36] audit: type=1400 audit(1793352835.890:287): avc: denied { write } for pid=864 comm="syz.0.166" name="usb_gadget" dev="configfs" ino=1837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 45.998829][ T312] usb 3-1: device descriptor read/64, error -71 [ 46.025298][ T36] audit: type=1400 audit(1793352835.890:288): avc: denied { add_name } for pid=864 comm="syz.0.166" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 46.052563][ T36] audit: type=1400 audit(1793352835.890:289): avc: denied { create } for pid=864 comm="syz.0.166" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 46.073107][ T36] audit: type=1400 audit(1793352835.900:290): avc: denied { unmount } for pid=294 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 46.090102][ T870] overlayfs: failed to clone upperpath [ 46.148018][ T312] usb usb3-port1: attempt power cycle [ 46.398430][ T473] usb 2-1: new full-speed USB device number 12 using dummy_hcd [ 46.421233][ T882] ./dev/sda1: Can't lookup blockdev [ 46.497962][ T312] usb 3-1: new full-speed USB device number 9 using dummy_hcd [ 46.529280][ T312] usb 3-1: device descriptor read/8, error -71 [ 46.530155][ T882] Invalid ELF header type: 3 != 1 [ 46.559288][ T473] usb 2-1: unable to get BOS descriptor or descriptor too short [ 46.567571][ T473] usb 2-1: not running at top speed; connect to a high speed hub [ 46.576460][ T473] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 46.586995][ T473] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 46.597620][ T473] usb 2-1: New USB device found, idVendor=200c, idProduct=1018, bcdDevice= 0.40 [ 46.606874][ T473] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 46.625176][ T473] usb 2-1: Product: syz [ 46.632176][ T473] usb 2-1: Manufacturer: syz [ 46.637316][ T473] usb 2-1: SerialNumber: syz [ 46.660563][ T312] usb 3-1: device descriptor read/8, error -71 [ 46.851231][ T473] usb 2-1: 3:0: failed to get current value for ch 0 (-71) [ 46.861104][ T473] usb 2-1: 3:0: failed to get current value for ch 0 (-71) [ 46.871000][ T473] usb 2-1: 3:0: failed to get current value for ch 0 (-71) [ 46.881017][ T473] usb 2-1: 3:0: cannot get min/max values for control 12 (id 3) [ 46.889829][ T473] usb 2-1: 3:0: failed to get current value for ch 0 (-71) [ 46.899900][ T473] usb 2-1: USB disconnect, device number 12 [ 46.908182][ T312] usb 3-1: new full-speed USB device number 10 using dummy_hcd [ 46.920977][ T325] udevd[325]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 46.920986][ T900] 9pnet_fd: p9_fd_create_unix (900): problem connecting socket: ./proc/thread-self/fail-nth: -2 [ 46.948364][ T312] usb 3-1: device descriptor read/8, error -71 [ 47.079110][ T312] usb 3-1: device descriptor read/8, error -71 [ 47.188105][ T312] usb usb3-port1: unable to enumerate USB device [ 47.212723][ T904] FAULT_INJECTION: forcing a failure. [ 47.212723][ T904] name fail_futex, interval 1, probability 0, space 0, times 0 [ 47.225681][ T904] CPU: 0 UID: 0 PID: 904 Comm: syz.0.178 Not tainted syzkaller #0 b5d0aad997485fc03b0f686c9bc4e10dbcf7cbf9 [ 47.225722][ T904] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 47.225734][ T904] Call Trace: [ 47.225739][ T904] [ 47.225746][ T904] __dump_stack+0x21/0x30 [ 47.225775][ T904] dump_stack_lvl+0x140/0x1c0 [ 47.225810][ T904] ? __cfi_dump_stack_lvl+0x10/0x10 [ 47.225836][ T904] dump_stack+0x19/0x20 [ 47.225858][ T904] should_fail_ex+0x3c2/0x510 [ 47.225875][ T904] should_fail+0xf/0x20 [ 47.225889][ T904] get_futex_key+0x178/0x940 [ 47.225903][ T904] ? __cfi___futex_wait+0x10/0x10 [ 47.225922][ T904] ? __cfi_get_futex_key+0x10/0x10 [ 47.225936][ T904] ? __cfi_futex_wake_mark+0x10/0x10 [ 47.225956][ T904] futex_wake+0x150/0x950 [ 47.225975][ T904] ? futex_wait+0x2b8/0x7c0 [ 47.225993][ T904] ? __cfi_futex_wake+0x10/0x10 [ 47.226013][ T904] ? __kasan_check_read+0x15/0x20 [ 47.226034][ T904] ? __seccomp_filter+0x48a/0x1b70 [ 47.226049][ T904] do_futex+0x37d/0x510 [ 47.226065][ T904] ? __cfi_do_futex+0x10/0x10 [ 47.226081][ T904] __se_sys_futex+0x13c/0x320 [ 47.226098][ T904] ? __x64_sys_futex+0x110/0x110 [ 47.226114][ T904] ? __cfi_ksys_write+0x10/0x10 [ 47.226137][ T904] __x64_sys_futex+0xe9/0x110 [ 47.226153][ T904] x64_sys_call+0x227f/0x2ee0 [ 47.226169][ T904] do_syscall_64+0x57/0xf0 [ 47.226185][ T904] ? clear_bhb_loop+0x50/0xa0 [ 47.226207][ T904] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 47.226228][ T904] RIP: 0033:0x7fbdd1d9f559 [ 47.226242][ T904] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 47.226255][ T904] RSP: 002b:00007fbdd2c060e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 47.226272][ T904] RAX: ffffffffffffffda RBX: 00007fbdd2025fa8 RCX: 00007fbdd1d9f559 [ 47.226284][ T904] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fbdd2025fac [ 47.226297][ T904] RBP: 00007fbdd2025fa0 R08: 4000000000000000 R09: 0000000000000000 [ 47.226309][ T904] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 47.226320][ T904] R13: 00007fbdd2026038 R14: 00007fff7e862e30 R15: 00007fff7e862f18 [ 47.226334][ T904] [ 47.478908][ T916] netlink: 20 bytes leftover after parsing attributes in process `syz.0.181'. [ 47.495702][ T916] netlink: 20 bytes leftover after parsing attributes in process `syz.0.181'. [ 47.504747][ T916] netlink: 20 bytes leftover after parsing attributes in process `syz.0.181'. [ 47.521486][ T916] netlink: 20 bytes leftover after parsing attributes in process `syz.0.181'. [ 47.530510][ T916] netlink: 20 bytes leftover after parsing attributes in process `syz.0.181'. [ 47.547086][ T916] netlink: 20 bytes leftover after parsing attributes in process `syz.0.181'. [ 47.757076][ T932] FAULT_INJECTION: forcing a failure. [ 47.757076][ T932] name failslab, interval 1, probability 0, space 0, times 0 [ 47.769941][ T932] CPU: 1 UID: 0 PID: 932 Comm: syz.2.184 Not tainted syzkaller #0 b5d0aad997485fc03b0f686c9bc4e10dbcf7cbf9 [ 47.769978][ T932] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 47.769993][ T932] Call Trace: [ 47.770002][ T932] [ 47.770011][ T932] __dump_stack+0x21/0x30 [ 47.770053][ T932] dump_stack_lvl+0x140/0x1c0 [ 47.770086][ T932] ? __cfi_dump_stack_lvl+0x10/0x10 [ 47.770120][ T932] ? selinux_kernfs_init_security+0x14b/0x4b0 [ 47.770154][ T932] dump_stack+0x19/0x20 [ 47.770185][ T932] should_fail_ex+0x3c2/0x510 [ 47.770208][ T932] should_failslab+0xac/0x100 [ 47.770240][ T932] kmem_cache_alloc_noprof+0x42/0x410 [ 47.770272][ T932] ? __kernfs_new_node+0xf1/0x740 [ 47.770295][ T932] ? bpf_lsm_kernfs_init_security+0xd/0x20 [ 47.770320][ T932] __kernfs_new_node+0xf1/0x740 [ 47.770343][ T932] ? __kasan_check_write+0x18/0x20 [ 47.770373][ T932] ? kernfs_new_node+0x280/0x280 [ 47.770394][ T932] ? down_write+0xee/0x2b0 [ 47.770425][ T932] ? __cfi_down_write+0x10/0x10 [ 47.770456][ T932] ? __kasan_check_write+0x18/0x20 [ 47.770485][ T932] ? up_write+0x66/0x280 [ 47.770509][ T932] ? kernfs_activate+0x1ee/0x200 [ 47.770532][ T932] kernfs_new_node+0x154/0x280 [ 47.770556][ T932] __kernfs_create_file+0x52/0x280 [ 47.770583][ T932] sysfs_add_file_mode_ns+0x1d2/0x280 [ 47.770612][ T932] internal_create_group+0x66c/0xe70 [ 47.770645][ T932] ? __kasan_check_write+0x18/0x20 [ 47.770689][ T932] ? sysfs_create_group+0x40/0x40 [ 47.770734][ T932] ? kernfs_activate+0x1ee/0x200 [ 47.770764][ T932] sysfs_create_groups+0x5c/0x130 [ 47.770797][ T932] device_add_attrs+0x12d/0x850 [ 47.770826][ T932] ? device_add_class_symlinks+0x260/0x260 [ 47.770854][ T932] ? __kasan_check_write+0x18/0x20 [ 47.770883][ T932] ? kobject_put+0x1cc/0x2a0 [ 47.770906][ T932] ? device_add_class_symlinks+0x22e/0x260 [ 47.770935][ T932] device_add+0x4db/0xbf0 [ 47.770962][ T932] input_register_device+0x9af/0x1080 [ 47.770998][ T932] uinput_create_device+0x416/0x670 [ 47.771033][ T932] uinput_ioctl_handler+0x3ea/0x1360 [ 47.771066][ T932] ? uinput_release+0x70/0x70 [ 47.771100][ T932] ? __fget_files+0x2bc/0x330 [ 47.771123][ T932] uinput_ioctl+0x2c/0x40 [ 47.771154][ T932] ? __cfi_uinput_ioctl+0x10/0x10 [ 47.771185][ T932] __se_sys_ioctl+0x123/0x1b0 [ 47.771207][ T932] __x64_sys_ioctl+0x7f/0xa0 [ 47.771236][ T932] x64_sys_call+0x1878/0x2ee0 [ 47.771258][ T932] do_syscall_64+0x57/0xf0 [ 47.771281][ T932] ? clear_bhb_loop+0x50/0xa0 [ 47.771314][ T932] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 47.771342][ T932] RIP: 0033:0x7fe3e859f559 [ 47.771362][ T932] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 47.771380][ T932] RSP: 002b:00007fe3e94ab028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 47.771404][ T932] RAX: ffffffffffffffda RBX: 00007fe3e8825fa0 RCX: 00007fe3e859f559 [ 47.771421][ T932] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000007 [ 47.771434][ T932] RBP: 00007fe3e8636b20 R08: 0000000000000000 R09: 0000000000000000 [ 47.771448][ T932] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 47.771461][ T932] R13: 00007fe3e8826038 R14: 00007fe3e8825fa0 R15: 00007ffdfe8a8188 [ 47.771479][ T932] [ 48.112914][ T935] fuse: Bad value for 'fd' [ 48.120296][ T935] fuse: Bad value for 'fd' [ 48.132704][ T942] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=3344 sclass=netlink_xfrm_socket pid=942 comm=syz.3.186 [ 48.156216][ T942] netlink: 8 bytes leftover after parsing attributes in process `syz.3.186'. [ 48.181793][ T952] netlink: 5 bytes leftover after parsing attributes in process `syz.1.189'. [ 48.192904][ T952] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 48.232811][ T957] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 48.242088][ T957] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 48.468132][ T312] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 48.619665][ T312] usb 3-1: unable to get BOS descriptor or descriptor too short [ 48.628139][ T312] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 48.638327][ T312] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 48.647415][ T312] usb 3-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30 [ 48.658427][ T312] usb 3-1: config 1 interface 1 altsetting 76 has 0 endpoint descriptors, different from the interface descriptor's value: 188 [ 48.671643][ T312] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 48.682478][ T312] usb 3-1: config 1 interface 1 has no altsetting 0 [ 48.691335][ T312] usb 3-1: string descriptor 0 read error: -22 [ 48.697713][ T312] usb 3-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 48.706889][ T312] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 48.722450][ T961] netlink: 25 bytes leftover after parsing attributes in process `syz.0.191'. [ 48.731671][ T961] gretap0: entered promiscuous mode [ 48.918563][ T312] usb 3-1: 2:0: failed to get current value for ch 0 (-71) [ 48.928115][ T312] usb 3-1: 2:0: cannot get min/max values for control 2 (id 2) [ 48.938197][ T312] usb 3-1: USB disconnect, device number 11 [ 48.946680][ T325] udevd[325]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 49.948007][ T312] usb 3-1: new full-speed USB device number 12 using dummy_hcd [ 50.087988][ T312] usb 3-1: device descriptor read/64, error -71 [ 50.327970][ T312] usb 3-1: device descriptor read/64, error -71 [ 50.577970][ T312] usb 3-1: new full-speed USB device number 13 using dummy_hcd [ 50.707964][ T312] usb 3-1: device descriptor read/64, error -71 [ 50.957969][ T312] usb 3-1: device descriptor read/64, error -71 [ 51.068014][ T312] usb usb3-port1: attempt power cycle [ 51.118991][ T1024] syz_tun: entered allmulticast mode [ 51.124984][ T36] kauditd_printk_skb: 10 callbacks suppressed [ 51.125001][ T36] audit: type=1400 audit(1793352842.056:301): avc: denied { bind } for pid=1023 comm="syz.0.217" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 51.170308][ T36] audit: type=1400 audit(1793352842.106:302): avc: denied { create } for pid=1027 comm="syz.0.219" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 51.175341][ T1029] FAULT_INJECTION: forcing a failure. [ 51.175341][ T1029] name failslab, interval 1, probability 0, space 0, times 0 [ 51.203479][ T1029] CPU: 1 UID: 0 PID: 1029 Comm: syz.0.219 Not tainted syzkaller #0 b5d0aad997485fc03b0f686c9bc4e10dbcf7cbf9 [ 51.203521][ T1029] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 51.203537][ T1029] Call Trace: [ 51.203546][ T1029] [ 51.203555][ T1029] __dump_stack+0x21/0x30 [ 51.203596][ T1029] dump_stack_lvl+0x140/0x1c0 [ 51.203631][ T1029] ? __cfi_dump_stack_lvl+0x10/0x10 [ 51.203666][ T1029] ? cred_has_capability+0x296/0x3a0 [ 51.203700][ T1029] dump_stack+0x19/0x20 [ 51.203733][ T1029] should_fail_ex+0x3c2/0x510 [ 51.203770][ T1029] should_failslab+0xac/0x100 [ 51.203793][ T1029] kmem_cache_alloc_noprof+0x42/0x410 [ 51.203827][ T1029] ? create_new_namespaces+0x48/0x6f0 [ 51.203851][ T1029] create_new_namespaces+0x48/0x6f0 [ 51.203878][ T1029] ? ns_capable+0x90/0xf0 [ 51.203900][ T1029] unshare_nsproxy_namespaces+0x124/0x180 [ 51.203922][ T1029] ksys_unshare+0x4f9/0x920 [ 51.203955][ T1029] ? fput+0x1a4/0x230 [ 51.203979][ T1029] ? __cfi_ksys_unshare+0x10/0x10 [ 51.204012][ T1029] ? __kasan_check_write+0x18/0x20 [ 51.204043][ T1029] __x64_sys_unshare+0x3c/0x50 [ 51.204075][ T1029] x64_sys_call+0x2998/0x2ee0 [ 51.204097][ T1029] do_syscall_64+0x57/0xf0 [ 51.204120][ T1029] ? clear_bhb_loop+0x50/0xa0 [ 51.204151][ T1029] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 51.204180][ T1029] RIP: 0033:0x7fbdd1d9f559 [ 51.204198][ T1029] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 51.204218][ T1029] RSP: 002b:00007fbdd2c06028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 51.204242][ T1029] RAX: ffffffffffffffda RBX: 00007fbdd2025fa0 RCX: 00007fbdd1d9f559 [ 51.204261][ T1029] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000002e000480 [ 51.204276][ T1029] RBP: 00007fbdd1e36b20 R08: 0000000000000000 R09: 0000000000000000 [ 51.204292][ T1029] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 51.204306][ T1029] R13: 00007fbdd2026038 R14: 00007fbdd2025fa0 R15: 00007fff7e862f18 [ 51.204326][ T1029] [ 51.207731][ T1029] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 51.208686][ T36] audit: type=1400 audit(1793352842.136:303): avc: denied { write } for pid=1027 comm="syz.0.219" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 51.219272][ T1029] IPv6: NLM_F_CREATE should be set when creating new route [ 51.219293][ T1029] IPv6: NLM_F_CREATE should be set when creating new route [ 51.380980][ T36] audit: type=1400 audit(1793352842.316:304): avc: denied { bind } for pid=1027 comm="syz.0.219" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 51.482532][ T312] usb 3-1: new full-speed USB device number 14 using dummy_hcd [ 51.500910][ T13] bridge_slave_1: left allmulticast mode [ 51.506616][ T13] bridge_slave_1: left promiscuous mode [ 51.512681][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.520567][ T13] bridge_slave_0: left allmulticast mode [ 51.521272][ T312] usb 3-1: device descriptor read/8, error -71 [ 51.526415][ T13] bridge_slave_0: left promiscuous mode [ 51.538230][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.630882][ T1031] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.638042][ T1031] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.645151][ T1031] bridge_slave_0: entered allmulticast mode [ 51.651768][ T1031] bridge_slave_0: entered promiscuous mode [ 51.658566][ T1031] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.665918][ T1031] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.673461][ T1031] bridge_slave_1: entered allmulticast mode [ 51.680263][ T312] usb 3-1: device descriptor read/8, error -71 [ 51.686659][ T1031] bridge_slave_1: entered promiscuous mode [ 51.693960][ T13] veth1_macvtap: left promiscuous mode [ 51.699724][ T13] veth0_vlan: left promiscuous mode [ 51.738827][ T1052] netlink: 104 bytes leftover after parsing attributes in process `syz.0.223'. [ 51.766412][ T36] audit: type=1400 audit(1793352842.696:305): avc: denied { ioctl } for pid=1051 comm="syz.0.223" path="socket:[8138]" dev="sockfs" ino=8138 ioctlcmd=0x9413 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 51.850093][ T1031] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.857256][ T1031] bridge0: port 2(bridge_slave_1) entered forwarding state [ 51.864612][ T1031] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.871726][ T1031] bridge0: port 1(bridge_slave_0) entered forwarding state [ 51.903310][ T51] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.913378][ T51] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.929316][ T51] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.936442][ T51] bridge0: port 1(bridge_slave_0) entered forwarding state [ 51.944164][ T312] usb 3-1: new full-speed USB device number 15 using dummy_hcd [ 51.947761][ T51] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.958938][ T51] bridge0: port 2(bridge_slave_1) entered forwarding state [ 51.973282][ T312] usb 3-1: device descriptor read/8, error -71 [ 51.991774][ T1031] veth0_vlan: entered promiscuous mode [ 52.005360][ T1031] veth1_macvtap: entered promiscuous mode [ 52.031204][ T36] audit: type=1400 audit(1793352842.966:306): avc: denied { mounton } for pid=1031 comm="syz-executor" path="/root/syzkaller.KwF6VO/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 52.069234][ T1060] netlink: 72 bytes leftover after parsing attributes in process `syz.4.216'. [ 52.109535][ T312] usb 3-1: device descriptor read/8, error -71 [ 52.130676][ T36] audit: type=1326 audit(1793352843.066:307): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1057 comm="syz.0.226" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbdd1d9f559 code=0x7fc00000 [ 52.155975][ T36] audit: type=1400 audit(1793352843.066:308): avc: denied { getopt } for pid=1057 comm="syz.0.226" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 52.175569][ T36] audit: type=1400 audit(1793352843.066:309): avc: denied { create } for pid=1057 comm="syz.0.226" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 52.219506][ T312] usb usb3-port1: unable to enumerate USB device [ 52.229323][ T36] audit: type=1326 audit(1793352843.166:310): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1065 comm="syz.4.228" exe="/root/ci2-android-6-12-rust/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f12af19f559 code=0x0 [ 52.493087][ T1087] ./dev/sda1: Can't lookup blockdev [ 53.107512][ T1111] overlayfs: missing 'workdir' [ 53.133179][ T1116] overlayfs: failed to clone lowerpath [ 53.141491][ T1116] ./dev/sda1: Can't lookup blockdev [ 53.309916][ T1128] overlayfs: failed to clone upperpath [ 53.553798][ T1150] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2571 sclass=netlink_route_socket pid=1150 comm=syz.0.255 [ 53.597961][ T63] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 53.648125][ T1162] fuse: Bad value for 'fd' [ 53.749657][ T63] usb 3-1: unable to get BOS descriptor or descriptor too short [ 53.758779][ T63] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 248, changing to 7 [ 53.771437][ T63] usb 3-1: New USB device found, idVendor=041e, idProduct=3048, bcdDevice= 0.40 [ 53.780692][ T63] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 53.788781][ T63] usb 3-1: Product: syz [ 53.792968][ T63] usb 3-1: Manufacturer: syz [ 53.797570][ T63] usb 3-1: SerialNumber: syz [ 54.007435][ T63] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 54.014958][ T63] usb 3-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 54.027201][ T63] usb 3-1: USB disconnect, device number 16 [ 54.043165][ T337] udevd[337]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 54.091541][ T1180] tipc: Started in network mode [ 54.096635][ T1180] tipc: Node identity 7f000001, cluster identity 4711 [ 54.103624][ T1180] tipc: Enabling of bearer rejected, failed to enable media [ 54.112715][ T1180] FAULT_INJECTION: forcing a failure. [ 54.112715][ T1180] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 54.125857][ T1180] CPU: 1 UID: 0 PID: 1180 Comm: syz.4.262 Not tainted syzkaller #0 b5d0aad997485fc03b0f686c9bc4e10dbcf7cbf9 [ 54.125891][ T1180] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 54.125906][ T1180] Call Trace: [ 54.125912][ T1180] [ 54.125921][ T1180] __dump_stack+0x21/0x30 [ 54.125958][ T1180] dump_stack_lvl+0x140/0x1c0 [ 54.125991][ T1180] ? __cfi_dump_stack_lvl+0x10/0x10 [ 54.126033][ T1180] ? stack_depot_save_flags+0x38/0x800 [ 54.126062][ T1180] dump_stack+0x19/0x20 [ 54.126102][ T1180] should_fail_ex+0x3c2/0x510 [ 54.126126][ T1180] should_fail+0xf/0x20 [ 54.126146][ T1180] should_fail_usercopy+0x1e/0x30 [ 54.126171][ T1180] _copy_to_iter+0x1a6/0x1520 [ 54.126196][ T1180] ? __kasan_check_write+0x18/0x20 [ 54.126227][ T1180] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 54.126254][ T1180] ? __cfi__copy_to_iter+0x10/0x10 [ 54.126279][ T1180] ? __check_object_size+0x54c/0x870 [ 54.126312][ T1180] ? __cfi___check_object_size+0x10/0x10 [ 54.126341][ T1180] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 54.126367][ T1180] ? __skb_try_recv_datagram+0x3e0/0x4e0 [ 54.126398][ T1180] __skb_datagram_iter+0x103/0x940 [ 54.126428][ T1180] ? __cfi_simple_copy_to_iter+0x10/0x10 [ 54.126459][ T1180] skb_copy_datagram_iter+0x44/0x160 [ 54.126488][ T1180] netlink_recvmsg+0x2d4/0xe60 [ 54.126521][ T1180] ? __cfi_netlink_recvmsg+0x10/0x10 [ 54.126574][ T1180] ? bpf_lsm_socket_recvmsg+0xd/0x20 [ 54.126609][ T1180] ? security_socket_recvmsg+0x44/0x130 [ 54.126639][ T1180] ? __cfi_netlink_recvmsg+0x10/0x10 [ 54.126670][ T1180] sock_recvmsg+0x188/0x1e0 [ 54.126695][ T1180] __sys_recvfrom+0x241/0x3b0 [ 54.126725][ T1180] ? __cfi___sys_recvfrom+0x10/0x10 [ 54.126757][ T1180] ? is_dma_buf_file+0x11/0x50 [ 54.126785][ T1180] ? fd_install+0x246/0x400 [ 54.126817][ T1180] ? __sys_socket+0x16d/0x1c0 [ 54.126841][ T1180] __x64_sys_recvfrom+0xe9/0x100 [ 54.126869][ T1180] x64_sys_call+0x18cf/0x2ee0 [ 54.126892][ T1180] do_syscall_64+0x57/0xf0 [ 54.126916][ T1180] ? clear_bhb_loop+0x50/0xa0 [ 54.126947][ T1180] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 54.126977][ T1180] RIP: 0033:0x7f12af15fd8e [ 54.126997][ T1180] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 54.127019][ T1180] RSP: 002b:00007f12affbde88 EFLAGS: 00000246 ORIG_RAX: 000000000000002d [ 54.127046][ T1180] RAX: ffffffffffffffda RBX: 00007f12affbf6c0 RCX: 00007f12af15fd8e [ 54.127064][ T1180] RDX: 0000000000001000 RSI: 00007f12affbe000 RDI: 0000000000000008 [ 54.127080][ T1180] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 54.127094][ T1180] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008 [ 54.127109][ T1180] R13: 00007f12affbdf58 R14: 00007f12affbe000 R15: 0000000000000000 [ 54.127129][ T1180] [ 54.412002][ T1180] input: syz0 as /devices/virtual/input/input9 [ 54.602983][ T1200] ------------[ cut here ]------------ [ 54.608552][ T1200] WARNING: CPU: 0 PID: 1200 at mm/page_alloc.c:5286 __alloc_pages_noprof+0x109/0x7e0 [ 54.618105][ T1200] Modules linked in: [ 54.622053][ T1200] CPU: 0 UID: 0 PID: 1200 Comm: syz.4.269 Not tainted syzkaller #0 b5d0aad997485fc03b0f686c9bc4e10dbcf7cbf9 [ 54.633989][ T1200] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 54.644138][ T1200] RIP: 0010:__alloc_pages_noprof+0x109/0x7e0 [ 54.650205][ T1200] Code: 00 0f 1f 44 00 00 83 fb 0b 72 28 b8 00 20 00 00 23 44 24 40 75 1d 80 3d fa 02 8a 06 00 0f 85 c2 00 00 00 c6 05 ed 02 8a 06 01 <0f> 0b 31 c0 e9 b4 00 00 00 83 fb 0a 0f 87 a9 00 00 00 44 8b 64 24 [ 54.669907][ T1200] RSP: 0018:ffffc9001073f560 EFLAGS: 00010246 [ 54.676011][ T1200] RAX: 0000000000000000 RBX: 0000000000000016 RCX: 0000000000000000 [ 54.684054][ T1200] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9001073f618 [ 54.692105][ T1200] RBP: ffffc9001073f6a0 R08: ffffc9001073f617 R09: 0000000000000000 [ 54.700164][ T1200] R10: ffffc9001073f600 R11: fffff520020e7ec3 R12: ffffc9001073f5a0 [ 54.708197][ T1200] R13: dffffc0000000000 R14: 1ffff920020e7eb0 R15: 0000000000000000 [ 54.716205][ T1200] FS: 00007f12affbf6c0(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 [ 54.725196][ T1200] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 54.731896][ T1200] CR2: 0000200000019000 CR3: 000000012fd28000 CR4: 00000000003526b0 [ 54.739948][ T1200] Call Trace: [ 54.743252][ T1200] [ 54.746220][ T1200] ? vfs_write+0x3c4/0xfd0 [ 54.750721][ T1200] ? ksys_write+0x145/0x260 [ 54.755261][ T1200] ? x64_sys_call+0x271c/0x2ee0 [ 54.760182][ T1200] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 54.765982][ T1200] ? hashtab_init+0xd6/0x1f0 [ 54.770635][ T1200] ___kmalloc_large_node+0x81/0x220 [ 54.775876][ T1200] ? hashtab_init+0xd6/0x1f0 [ 54.780533][ T1200] __kmalloc_large_node_noprof+0x1e/0xd0 [ 54.786235][ T1200] ? hashtab_init+0xd6/0x1f0 [ 54.790910][ T1200] __kmalloc_noprof+0x326/0x510 [ 54.795818][ T1200] ? kasan_save_alloc_info+0x3a/0x50 [ 54.801207][ T1200] hashtab_init+0xd6/0x1f0 [ 54.805665][ T1200] ? common_read+0x175/0x490 [ 54.810313][ T1200] symtab_init+0x44/0x70 [ 54.814597][ T1200] common_read+0x1e7/0x490 [ 54.819100][ T1200] ? hashtab_init+0xd6/0x1f0 [ 54.823730][ T1200] ? __cfi_common_read+0x10/0x10 [ 54.828724][ T1200] ? hashtab_init+0x100/0x1f0 [ 54.833472][ T1200] policydb_read+0xa86/0x2860 [ 54.838265][ T1200] ? __kasan_kmalloc+0x96/0xb0 [ 54.843080][ T1200] ? __cfi_policydb_read+0x10/0x10 [ 54.848284][ T1200] ? security_load_policy+0x130/0x12d0 [ 54.853802][ T1200] security_load_policy+0x16a/0x12d0 [ 54.859188][ T1200] ? irqentry_exit+0x4a/0x60 [ 54.863866][ T1200] ? __kasan_check_write+0x18/0x20 [ 54.869048][ T1200] ? mutex_lock+0x97/0x1d0 [ 54.873499][ T1200] ? __cfi_security_load_policy+0x10/0x10 [ 54.879287][ T1200] ? rep_movs_alternative+0x4a/0xa0 [ 54.884532][ T1200] sel_write_load+0x258/0x600 [ 54.889305][ T1200] ? __cfi_sel_write_load+0x10/0x10 [ 54.894543][ T1200] ? bpf_lsm_file_permission+0xd/0x20 [ 54.899985][ T1200] ? __cfi_sel_write_load+0x10/0x10 [ 54.905235][ T1200] vfs_write+0x3c4/0xfd0 [ 54.909562][ T1200] ? __cfi_vfs_write+0x10/0x10 [ 54.914364][ T1200] ? __kasan_check_write+0x18/0x20 [ 54.919538][ T1200] ? mutex_lock+0x97/0x1d0 [ 54.924003][ T1200] ? __cfi_mutex_lock+0x10/0x10 [ 54.928951][ T1200] ksys_write+0x145/0x260 [ 54.933322][ T1200] ? xfd_validate_state+0x68/0x140 [ 54.938499][ T1200] ? __cfi_ksys_write+0x10/0x10 [ 54.943393][ T1200] ? __kasan_check_write+0x18/0x20 [ 54.948583][ T1200] ? fpregs_restore_userregs+0x11c/0x260 [ 54.954254][ T1200] __x64_sys_write+0x7f/0x90 [ 54.958915][ T1200] x64_sys_call+0x271c/0x2ee0 [ 54.963624][ T1200] do_syscall_64+0x57/0xf0 [ 54.968124][ T1200] ? clear_bhb_loop+0x50/0xa0 [ 54.972846][ T1200] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 54.978798][ T1200] RIP: 0033:0x7f12af19f559 [ 54.983250][ T1200] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 55.002942][ T1200] RSP: 002b:00007f12affbf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 55.011443][ T1200] RAX: ffffffffffffffda RBX: 00007f12af425fa0 RCX: 00007f12af19f559 [ 55.019500][ T1200] RDX: 00000000000190ec RSI: 0000200000000000 RDI: 0000000000000003 [ 55.027499][ T1200] RBP: 00007f12af236b20 R08: 0000000000000000 R09: 0000000000000000 [ 55.035563][ T1200] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 55.043646][ T1200] R13: 00007f12af426038 R14: 00007f12af425fa0 R15: 00007fff9d2ccbc8 [ 55.051705][ T1200] [ 55.054753][ T1200] ---[ end trace 0000000000000000 ]--- [ 55.060853][ T1200] SELinux: failed to load policy