last executing test programs: 466.692243ms ago: executing program 2 (id=3): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./dev\x00', &(0x7f0000000200)='proc\x00', 0x80000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/ram0\x00', 0x2, 0x0) pwrite64(r1, 0x0, 0x0, 0x7) r2 = memfd_create(&(0x7f00000002c0)='+\x8b\x8a\xa9\x16\x11\x91J\xbc+ \x18\x17\xc2:}\xa3\x9bO\xdd\xdf\xdf\x92\xd5\xed\xb4\x17\xe5\xd6\x9a\xb2\xd8\x9ba\xde\xb2.F\xc0\x99}|\xaf\xd3\x1d\x84[*_\x9f\x9d\xb0rYP\x1b\x9f \xe0\x9cgq\x103\x89\x11\x87Rv\x169\xdf\xe3>B\x04\x00\x00\x00W\xd3\xec\xfb\xdf?\xa2\x90+\xa4!\xb2\xf2\xff\x90\a\xc3\x12\xc4;\xffh\xf1x=\xb9c\xce\x03h\xdap\x88U\x1788\x82\xd7\xfd\x83\x00Sx\x91%\x99_\xfe\xd4c\x83\x86\x0f\xa4a-\xaf\x9e\xd9\xef\xe0)]\x00F\xfa\x03\xbc4\xc4\x9a\v\x03\x8b\xa4\xf3\x8f\xf4\"\'\xd3\a9\x14H}j&~\xe9\x16\x83o\xbd\xab\xcd[\xbd\xcb\x04\xfc\xe7\xe3\x9e?\x12\xf0\xf4\x83M3\xd88\x92?@\v\xe6\xd1\xd2\xe4\xde\xdaUeJ\x9fR\xd1`\xfa\xc8\v\xed\xfd\x0e\xc8\x89W\x847\x88\x82\x94\x14\xe33\xb7H\xc8b\xd6@3F#\xb7\x04C\x8dm\t\x16a\x0fI\xf4\xfe\xf8\x06j\x96\xd0\aJ^4`\x97C\xf0\xb9\x8a\xdc\xe5`\x19Pz&\xb8\x0f\x98`W\xdb\xc6\"81A\xa4\x8bT\xf1\xcb\xab\xa3\t\xef\xdf&\x0e\xad\x03\x123.\xc2V\xaa\xd5\xf8\xde\x8aV\xa4p{\xcez\xa2\x92\xdb8*wLO\f\x97X\x05\x9a\xc2\xe8\x85\x9d\xcb\xc8\xf0\xc4\x01\x03\xe3?\x9f1\xf4\xfb\xa5y`KB\xdf\xae#\x94C\a\x04\xea\xccG\xf2\b\x8f\xf7\xb1\xe96\x90\xf5P\xa4\'\xce\xe3\xa24\x196\xc5Q\xa1K\x95\xd6\xfal\xe9\xd1\\\r&\xb2c\xb3\x8d\xa7\xb7\xa8\x03S\xbd\xdd\b{\xae\f\x10\xc2\xbb\xd0\xdd*\xa3\xb4\fJ\x00X\xab`N; LF\xa5D\xee\xdf\x7f\x80p\xf6o\x1c\xbdXR\xf2\xa0\x81a\xa1\xe1B\x93Xn\xaf\xfc\x05?\xab\xac\x91x\xa8#\xe1\xbeQ\xd1^\x9b\xb9)\xd3\n\xf7(3!\x18\b\xc0\xaampRl\xfdQ\x03\x8c\xd5\xe4\\\xed\x9a\xd1?\xd21\xc8\x90\x1dl|\xd1\x14\xbc3\xe0\x1e\x0e\xe6\x88Y\x99K\x93\x1c@_P\x8c\xc7\x9eZ\xb74KT:\x8a\xdbJ#w\x18\x14\x00\x93\x86\xa5wo\xf6M\xe7D\xf4*\xe3X\x1d\x19\x83\xa7w\xc7+7\x89s\xed\x8a\xd7O\xdd\rhh`\xc0\xa8$\x06pu\xa0\xd0L\x0ez@I\xb8\x83\xb2f\x93j\a0I\xc8l\xe5\x9b\x06\xb5\xac`d\xa3\xcf/\x14\x10\xab\xab\t\xec\xc1c\fA\xaf\x14\xef\xbap@*7\x86\xdf\',\x03Y\xb1$\xf0\xb5}\xf0\x82%)9`\x8f\x04\x85m\x80\xd2\xcf@\x06}\xea\xe7w`\xa5\x11\x9f\x9b\x9e\x8f\xb7cb\x1a\xe1\xcf\x87\x1c\\\xf5\xc21\xf7\x82C*\xd5;\x00\x00\x00\x00\x03\xba\xe3\xdc\x92\'\x8e\xd5\x7fG\xfd.\x91\x89T\x99t\xd4d,\xd5\x92O\xf1\xafT!Y\x8e\\\xac\xf7\x11R\x05p\x1a\"\r\xe9\xe5\x8b&\x0f\x8c\xfb\xef\xf8\xd5\x18\xde\xeb\xe5\x19\xdd\xebQ8\xc5iS+\x06D\x16\xfe\xf5.\xe5\v\x89\xb0\"\xa3M\xe9\x81\x11P\xdb\xc4\xc2y\x14\x04\x06\xf6\f\xb0\xecz\x8d`\xb5\x9b\xb43\xcc1\xa7\x9e\xa8\xb5\'\xc6MAe\x0f\xd1\xfcG\xc2/\xe8\xe9t\xcaQ\xf1\fI\x1chM\xc1\x92\xe3\xc3\x01M\xc8/\xefJ\xcb\xd0]\f\xff\xf5\x92\xce\x97Z\xea\xe8\x99\xfa\x96\xce\xa7\x02\xad\xa2\xce\x955\xeaNg\x02\xcd\xfd\x1a}.\xd3\"x\x89/8H\xc2\x93B\na)\x86\xa9U\xa0\xb7\x18\xfb\xe9\xd1\x97', 0x3) write$binfmt_misc(r2, &(0x7f0000000640)="cf", 0x1) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)=0x80000000) r3 = socket(0xa, 0x1, 0x0) ioctl(r3, 0x8901, &(0x7f0000000080)) sendfile(r0, r2, &(0x7f0000000680), 0xfffb) fcntl$addseals(r2, 0x409, 0x8) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000000, 0x11, r2, 0x19b80000) syz_usb_connect$uac2(0x5, 0x7b, &(0x7f00000000c0)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x20, 0x41e, 0x3f19, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x74, 0xa0, 0x9, {0x8, 0xb, 0x1, 0x2, 0x1, 0x6, 0x20, 0x6}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0xdef2, 0xa, 0x9, 0x5}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x6, 0xd7, 0x7, {0x8, 0x25, 0x1, 0x2, 0x6, 0x6, 0x1}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0xd7, 0xe, 0x4, {0x8, 0x25, 0x1, 0x81, 0x30, 0x6, 0x5}}}}}}}}]}}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0}) 442.257315ms ago: executing program 0 (id=1): r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000740)={0xa, 0x4e22, 0xd, @loopback, 0x6}, 0x1c) connect$inet6(r1, &(0x7f0000000780)={0xa, 0x4e22, 0x20, @loopback, 0x28}, 0x1c) setsockopt$inet6_int(r1, 0x29, 0xb, &(0x7f00000007c0)=0x80000002, 0x4) sendto$inet(r0, &(0x7f0000000800)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9025a01c95d4a068ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) recvfrom$inet(r0, &(0x7f00000009c0)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) timer_create(0x6, &(0x7f0000000bc0)={0x0, 0x11, 0x3, @tid=r2}, &(0x7f0000000c00)) timer_settime(0x0, 0x0, &(0x7f0000000d80)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) 406.258469ms ago: executing program 1 (id=2): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) syz_open_pts(0xffffffffffffffff, 0x200) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/mapper/control\x00', 0x80402, 0x68) ioctl(r0, 0xc138fd01, &(0x7f0000000140)="0400000000000000000000003801") syz_usb_connect$uac1(0x2, 0xa5, &(0x7f0000000000)=ANY=[@ANYRESDEC=0x0, @ANYRES16=0x0], 0x0) 344.317385ms ago: executing program 3 (id=5): r0 = syz_pidfd_open(0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_DEV_INFO(0xffffffffffffffff, 0xd000941e, &(0x7f0000000000)={0x0, "04e09943aea97c0c2378b907dfc6c856"}) ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000001000)={r1, 0x3, 0x1}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000001400), 0x600102, 0x0) fcntl$setown(r2, 0x8, 0x0) syz_ublk_add_dev(r2, 0x0, 0x0, 0x0, &(0x7f0000001480)={0x2e, 0x44, 0x0, r2, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000001440)=@any_dev={0x2, 0x5b0, 0x0, 0x0, 0x1000, 0x10001, 0x0, 0x0, 0xa9}}}, &(0x7f0000001500)=0x0) r4 = syz_io_uring_setup(0x1a89, &(0x7f0000001540)={0x0, 0xe84e, 0x800, 0x1, 0x159}, &(0x7f00000015c0), &(0x7f0000001600), &(0x7f0000001640)) syz_ublk_setup_queues(r2, r3, &(0x7f0000001680)={0x0, 0x7f81, 0x20000, 0x2, 0x19d, 0x0, r4}, &(0x7f0000001700)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc56d, 0x200, 0x2, 0x17e, 0x0, r2}, 0xffffffffffffffff}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe3c8, 0x200, 0x0, 0x13c}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x25b, 0x800, 0x0, 0x177, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x13ca, 0x800, 0x1, 0x17c}}], 0x4, &(0x7f0000002980)={0x2e, 0x3, 0x0, r2, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {0x401}, 0x0, 0x0, '\x00', {0x4, 0xc1f, 0x0, &(0x7f0000001980)=@buf_4k="487f7f02c050c3814054548fb087a2b805dcb482c8f68b31d67eec5111feca7a772eadf60a8afc49cfa92913bd01fcc1bf5a23d3ac73f652b304f80ee3fc39a8a9cfddb213cee857a123649c96fac205c02c70df739c0c00bdf5a9905149597f3cd005c3886f66e8a8a3dca97bb49e9396ea68566e7959d0657996203f598d17c50a0cd481a62ac8d5d1df7536759cccaab7e139a4a810ead3dcd361b2c2323f6adec93004e22ebb3e5c708c17c9f1d93b73c9d5855acfbe13760fd22984b3a70c26d22f25e077ffa0cb373d3cec1004b48271fb8b67ddb2ac91a07951edb922c7c5c5034c772335d16becd172d2399440ea18c4adca826bf3778407a87b7fdc425014514aa15eb9bf4a2ad2e1e1e1f14fb61abef839b29c0fbc57e81a172e4a9439647d439a1072ad418eaedc02ff59b672bb9653456779ced262b2e850d5952e0ce23d7cf8698d67abe81534a517c4928151dfef05569171c4c6bb013872059cf35739878052d47f794150fc200674896599a2fafffd5135be4865ef3b8d71edf946182899859dd0bd1605ba0c92abef4909afe8c2c66b43c4b96dda9bd69af6e0ebe189a89fc78fa87feaab3d74c76d2c0f2b3e32218be597ccb6aca699d144dedea2ae0ba666b0cd0db3aa0b04d98a58b87d97041db47bc66e68fc7093e74ca9786f906a1741cb06649be2392ec1bf2d6bb307c744c557a4b14a19d032cf8d048ecd7c9e2e1263be1736932f4e4d6a872a4d844eb8557d345cc0eab56170a7c8d9fc8d4234b3a969e33d30656564618ed0ec7dc03db572e3a886387791043e937d0dbedef6d2b01936f8c0b798f3c60710dc01a08b9fc9f1bf1e7e48465f4312831130b38697e5c6547742a4f077e15175202f13b229536ccb524fc79a7da2365ca42df749cdfa5ed10566ecfc4ccb10cdf38b1feb38a2c9ccfa01f4b53c7accfc1d7dd11a688fa7604f679ca097c666bf5f7e95a95cbc3839d03405bcb19872f0989ba41bc92ec141476a4a3a30bcad354d1c08db0be047ee4d0d3822c9e3972d3924c2ccf2855b3ca4dd993c3d9f2ee21c17a055ea1d9f67165d157898a0895d709635828321c831c8140baa6d4256d914284b5d4189739141ba47d65b733db6502dfb4e5921b57199acfbba15f318c364636bf4e14549e2342aea882c2a26921c64a1f50f215eb41a58710cd2ef57572ad8414aea493521de734094db43da585b7e605a4be9f4c3a0ff5f3996165ed07b4be35096533cae6e8e71ef85b146ceb9ba40865f6ae11ba8544e2150ef5ecdafe9947117a05d10b9563b822a58ae4e4aebf5ac53e48ade019f19b847beccacec23d4628c2c56636288daa13d8a1d9f47dfd06a29d6fd8936f03a7946173114ea9899f6508876263183f7bc272a03c55de7a1a5abc9f74ca959a0e31113ed4615fcea2e0fb73fc9163fb433331d8a0f6bc4b768e4939c891253d2dce6c5afb49ba3b7c1681bee7ede6eadddee4c21f9881fceb20e0f96263b4cbe2060b32cba4e544aafca1f901d6e093fe307be6b8853cf7aacc0e8a9e5c56e58ab485996da99e4a9664db4d2a9ceeb8a4199d67d25d4c80653ada8616bb40dc28dfe626e27dcaa36b6d87f46b4ae5661d0e15eef5a5ebd8096f900377adfd3f3d6501381334c79f8f5f84213675320e65360e36d6c8c8ddf662231d655d171ee2e4831698b4feb77947644a3a85d49e678fb5a42dddc9fa96c485280cda5077951838e003dcf5a91f9bd95a150d8fe8bb71c7c73d642e2e166f1af5a7b8c1d7f448738f8f6517cd3d9477496f14e9d0fdd5ede100bc3e71652beb7188f31b2e04cf99adde98e016e14241ccc6dbd1710837458b5485040be81ef295c35e928a9dd999c816f1590fad99355fde334746f8804f7e166df11203d35265b35fb07467d8235a088a0f42465c95f4fc042dbe7f14bd1b60670cf672d8815e59abdd995f883f0b0924d1f2548dd2139a225fbe41d013b19be55d8f88fd88df1df61aa1076c3f92254bec9b261dc43e36ca5c95c1f0077a59e98ed6e071657f72ec0c42cb842b73b9744cdd7cab05752b5c91106ca722289c509b045c27e6a0844a8bc827d8f5a2abe28bfef40c08501ef5c16f6fe03ca5cb9f80fe0f1649fb14aa4271fdca77b4a22bfd653f9074ec014d1c89faa9d368642e2462926bdd25397906756579b2a8bfc2e9849a27f141b7b170b541dd6173a24c85e6c97ea22a6025ef791569aa66da0e0e9360f0a66508db8e1e5d0079c61df56b636a6a38aa1a73dd458819cf13ef762c94030f574ef7174af3a7a9b0c450c4d575c08f866e8621415b7ceb7fb8652a92890cf487693c3096bb68445a5e938b11bd23357734875efe41c45d12df66813a087c3af68aa5fe9a18d17342f8276243976724a8528a9dbfd74a47997513f834154bcbbe900c5194b05c58fc0dd105f4a21857311c207c28b9f052ce14a666f40661d41c41eb69a098d63dc7fb5897ca856e941f7ffe0c24fec471184fea932f105d9347707046a8a7a80bf14e7d6b09f3c752adea49286c0f7e7db07c1d62d59db9f6b617ab0e077e051b1dd08679cd80492f500e2c182905dd8acd6550a7f5a58292c8c727e00e9aeaed30d7caf83c15027bf64e2ddaa38256d09ff93b35c2a907e1b397bf0444cb1b65facfd01de791cfee80e03202455fb331478f5d30ebb6b8125c5d3a57a24982c266d43d69368aa80f9a4ac7decb2485020c615fec9abf5658855577cea5e6d203cb293d67933debde90a9da5662f1e0f4cd5b8226a489f3fd199466b84c3efc075309dc10eea6edcd1a183be9eae4389b53f522a2f8592fea6adb4e803a6a9a04146a09f3e68d03eaa33a47f60aa80515dfed473532e0a322d2463a4aa1e6fedbeb7239697a1f91c312ba5c7c99643bc37fbab2ba38769edcc7d936ea48c8a690a65cccb86731b590974a6236d63f470abdc9b31278b19c417f6ef3ed7798f60a208904e1a604cbdc9ded617a620c556291d303c86d6ba58767f79b3a54ae2c3a3904275f985514e506ed00c589aa44ce1eaa92b99281c9c1203891b2c7873d24b4e9dbe327a5256a3cbc7319d0c7b33d3940d23c0ca77b4e64a32645ed18350ed82a66cb5ff5298f02afc945042df0a127aa9f69fb964d331d87c1255a1a9b91b92e2057ac75098a5b9fc5a803c91a6bcfc8247ea9fbab65365648d295532882f9f77034602b8ea72ee22a3cc1fec7bce38aeb33fc62b7fa655928d20eec1b581e075f8adc9a054b855ce3ea21fc3e8840ff6a6d8ec5db40532f1bf12cf5bd27d140b0b76c50dddfe8f8556f94391b74b55cb3c0bec905d1e282a402dfac7d0ef606517d97e755abb16d7b18ec4c0a0e5a1b2c33f1f3a8035d0e241a220a0856a10f4e0dbc24ce5361a12ff749c32bdca646670ced525bcafcb1fb18339ec552ae95245049eba129cf5c40cab89501fa9a0591d188ba47fe2164ac81b4bba4f41504490e411f23619c827dd9d843e8d5080350396457d6dd16c1b41e102f83fb60f7c886fbcb74ce135f9a06751d4bd321165f0c0e648765d795f777f1969b713ffd316af941fb45bffe2503f71a5534f449d41af3b684140c96b0d023a40292d610e27e71d83148a44faf9bc3ffd0e8a3903df404d0971eefec0520191df391822d1059146c92f5589f08f6d56591112cf3f3b9008c3b38ab27788fda3e4d3feecf40aa5dc2a3a90c2a78bebad4c25cfc3d4b845e4b0a27e1fbb81d0fdb27e5708374964383c6bacdb98acd7e5ddd881163b976745af1863ca88b68cff063c23972fede3ea2f2f3156ee8d1478a99831c61a7ad11d62d1088b339c853aeaf32839ef737d64496d5db92ef0e8e0a2e36d718cca679f6968b6937ccd277f47e11d93f52f88e793cddca27874db854fda2a603b16b08c58ca506a502619db23200cd0cf986a133cec4125abfc83fa4c3c4c212393e1274905ff8e644122c2c292d5f6b0524001d4586c3c5ebb4fe24453a3d758ade14cf1b5ed0756509a66f919a06c3e7da791e5af2aeb59418f93389b359b69bca44cfd1c95ba1619e5a0de88b089d3853e49f336a2ad5644a8e91eb20bac9f34d0d05cd18f2250c87aad62cd0544bc8282e53969f84c5e5ea094e6368e4eae0f36c2ed419d9d9aab7c33b85aec8d22b25d7522aea8e82182f91eb75191eed43bda73474d575b961c88dc4999f997ddf4f846771ee8e03dc16145dbcf94dafc2f93b8e57e3e40fad01088660df36151688db384a083c893f069593d12468404c404aea44398fb53fcadc8db79c37ca540b46b9ef4bf1477fcb06afaccc165ede8240e931e028bedc6483d4a8d8d90b207a5d35e63ce266b01c5614f13130af94797be6ea6c4877e40bd4822fb632060c76a9898d2eae7a7bda16f242b2b065dff63ef0743288a62d85af84b4c9b08b21951c300591b770b558b8af32ecd4ecb82c0a68b33000dba597ee9124c1419d3875253e5e7158a1c0c0877bced060924fdcf8b562868b99f60ef80cdff595f534056fff243ca8d2d0801d545ca292bc8b2bb2028ac611f711e26def1b53d86f9791705aed710ffe782cad402185dce5023d8a9e9f63ea4620ebf13c333d8cc246167cf239259d7edd2b6ed61e7232ff9b9ae3dcce76a0c7e1ff0709660a97671e7ae34ddd5998789687557600c3fdef6775d173da780f2b1fc369a5d2205b0d96b4d6d7cf1d7307bd6a7ea20b7fe195a19a70e3c14f74af493800d436da7083a812e2b8c4a483dfb5ac60c224c5b9f371054c263e93d3b0ec198c48f31fcfb9fc7139fdc4868d386e5d3a635976dbe9c93419ac900e77fb92d184d1dc8247da10c8494fff7705fc9093cc23cb6246cc7b5d34309d3ee6bdbb67301915c5a4586cb8eb53a8113c1fa2ff3281c039ac21bf88c541b87fde0a712a8e05df554fdb106fcae56cb5ab8631a084490fc61ddbac94a73d63efa60c761302da2085d1950d2081212e1439d0203a2a54a518186dc5a235511c12ff38269056e484d7445e1562ed0eb74d08c8f783ea7c1284f7db14c5bf682343130a41145bef059a31dd2eebed5362588beb41241126af2fd02df6c2333ebba32d2018c5f0df714185082e7cd2bafc0dc8a3b5decbe1f89f1abcd3f30d26e25469b3aa922a186e6c901dfec7cf2b722fdb437be2b93915197e9e3c3d6a6bedfd4569ace221d34c22820c641669ffe982652807f8e686130d31dc438caf33ac37fee9f87525ebea0d78434314e6c16f3bb96297c26972cbd63b744e9bb95f8630c759954283e74b70c4cdc6dbc8dad36ff0936329d9c0e2a431f8071ad88e257d81411e2041a91a51635650d1d305becc9176dcfd9ec1aa8118216205e5f3a7a9ae3fdf28470a4a3b1d5c733591698db4f5dfc833e4a3872793df89d77577d4c9442aab5562f5dffae48f7c9510ace923319b26ee647d74e27f340ab97a7cc75caeacc7326054542bf2263473b46c545911fa4b77ac0f51b441109302499131acd5ba92bce831ec9ff63937c730da807adcf04af0082aec5c4bf783d04b99a3815aeb06d5888b69701705431315298960f502c41b943d432dc82396d50a3b3f5e21be5018cd2d508390e9ff364573e83017a49669474ab193f0e9588f4b155542ec957c241b5c828b8027e588997de6137925b6cfb5dd6e276a8e01d07858d94b6b8364f80bb6533a8e42b0406ac8052b6a11e4ea441d1b511ddea395026044957a4cde0d16b4975ed974ea5d598e14e3b9412f11aa0733f66cdcd5387749d96bcf670a5649c408d6f"}}, &(0x7f0000002a00)=0x0) fcntl$F_GET_RW_HINT(r7, 0x40b, &(0x7f0000002a40)) syz_ublk_setup_io_uring(0x3f72, &(0x7f0000002a80)={0x0, 0xe411, 0x400, 0x3, 0x336, 0x0, r6}, &(0x7f0000002b00), &(0x7f0000002b40), &(0x7f0000002b80)) r10 = openat$incfs(r2, &(0x7f0000002bc0)='.pending_reads\x00', 0x88000, 0x19) bind$bt_rfcomm(r10, &(0x7f0000002c00)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xfc}, 0xa) ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f0000002c40)={0x4, 0xffffffffffffffff, 0x1}) ioctl$FICLONERANGE(r2, 0x4020940d, &(0x7f0000002c80)={{r11}, 0x7, 0x0, 0xef63}) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f0000002d00), r10) sendmsg$NL80211_CMD_GET_KEY(r10, &(0x7f0000002e00)={&(0x7f0000002cc0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000002dc0)={&(0x7f0000002d40)={0x78, r12, 0x10, 0x70bd2a, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "8c42f443772f72981412e061cb"}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0xc, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "c3df8f7e5d"}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x28, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x880}, 0x4) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000002e40)={0x1, 0x0, [{0x1904, 0x0, 0x10000}]}) ioctl$STOP_ARRAY_RO(r10, 0x933, 0x0) ioctl$KVM_SET_SREGS2(r10, 0x4140aecd, &(0x7f0000002e80)={{0x9000, 0x4, 0x3, 0xa6, 0x10, 0xfc, 0x3e, 0x8, 0xf7, 0x0, 0x6, 0x5}, {0x10000, 0x6000, 0x3, 0x2, 0xa6, 0x40, 0x7f, 0x48, 0x87, 0x2, 0x8, 0x61}, {0x100000, 0xb000, 0xd, 0x3, 0x0, 0x7, 0x5c, 0x8, 0x7, 0xff, 0x6d, 0x80}, {0x1, 0x3000, 0x4, 0x3, 0xa, 0xa, 0x1, 0x0, 0x1, 0x8d, 0x6, 0x4}, {0x9000, 0xc000, 0x8, 0x5, 0x3, 0x3, 0x1, 0x20, 0x6, 0x9, 0x80, 0x5}, {0x6000, 0x848b8ddfbcc4f700, 0x0, 0x4, 0xd, 0x3, 0x6, 0x8, 0x80, 0x4, 0x9, 0x3}, {0x1, 0x1ff8, 0x0, 0x4, 0x8, 0x8, 0x5, 0x1, 0x8, 0x7, 0x62, 0x7}, {0xe000, 0x8000000, 0xb, 0x7, 0x26, 0xfd, 0xd, 0x4, 0x5, 0x7, 0x1d, 0xe}, {0x6000, 0x8}, {0x3ff8, 0xfc3}, 0x0, 0x0, 0xc000, 0x400128, 0xd, 0x4000, 0x5000, 0x0, [0x3, 0x4, 0x3]}) r13 = getpid() tkill(r13, 0x2b) fcntl$F_GET_FILE_RW_HINT(r5, 0x40d, &(0x7f0000002fc0)) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000003000)='hybla', 0x5) r14 = openat$full(0xffffffffffffff9c, &(0x7f0000003040), 0x248000, 0x0) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r14, &(0x7f0000003180)={&(0x7f0000003080), 0xc, &(0x7f0000003140)={&(0x7f00000030c0)={0x78, r12, 0x300, 0x70bd2b, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x5, 0x49}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x5}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x2}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x11b}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x1f1}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x5}], @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x5}]]}, 0x78}, 0x1, 0x0, 0x0, 0x4000}, 0x804) rmdir(&(0x7f00000031c0)='./file0\x00') syz_ublk_process_io(r9, 0x0, 0x1, &(0x7f0000004200)=@ublk_io_fetch_sqe={0x2e, 0x6e, 0x0, r14, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xffff}, 0x0, r8, '\x00', {0x0, 0x73, 0x0, &(0x7f0000003200)=@buf_512="3bd9766d7898f2b148abbfa71849ace6260577ea3698a83f8a05886c35314ce102c6b6cd99d189e41fa5d2c6b1a9d86022e6489bf41f865ec5718e43c82c97466b64abd21e4b26618a68f1309c1e7effade25e7149d2d53f13aad5b683e9e151fcb39ba3f8aa4ffffa878d19e63d25ae95e1d2ce5625a2e4394bdd4b521839ac4573902f7ed0620d0d9f5ad5aade1152c0cdf13c0dfda5b9e01ed8f7afcec997ecf821642fc4ca00eed8ecde6c7b66b5c8159daa775ef9b71142fa8adcee95c7d9282b13fd39218164d75d7c6cbf2bedc075730eb70c9c9457ac860869181e0bd827701048c2fdfb5c46cce1614386c109109d1d28c9f2b8b35d98800b41cecc94285a33b1baa0d50ddd701c7a5feac81e88d43838ec9ccf35fa252b941173246cfe3d5024318dc8938f37dec5617267ff9c89cb69bb4312d69c709074fcf7b653aa5822d89ce2b56215dcc0ecd4c5b621ef18eb73578372e5780930a7e105520e2d466e5a7867173c88089c29ee1c8b989d93d4988dec2795ef8cf379d27a3a5d924e0fa379f220233fbe1e065bc002459552aa2eca2ab50528b09781741ee29cc3bf99b2a6e72c9309835108b68fd2e63f0f762ba877ff7e0a6c70f37a271d3b2f0fc04fd3bb155d1dffd8c94d340bb9b3d7ad8f121d188d502df6efcbd454c554c0dab25c281c11d909097fa0cb5b87a3a0e86a5c34f1f5e6335ba2af7ca5"}}, 0x1) syz_pidfd_open(r13, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(r10, 0x0, 0x83, &(0x7f0000004380)={'filter\x00', 0x0, 0x4, 0x8f, [0xb, 0x29425b7f, 0x4, 0x3907, 0x100, 0x6], 0x4, &(0x7f0000004280)=[{}, {}, {}, {}], &(0x7f00000042c0)=""/143}, &(0x7f0000004400)=0x78) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) 343.758375ms ago: executing program 3 (id=6): symlink(&(0x7f0000000000)='.\x00', &(0x7f0000000100)='./file0\x00') r0 = fsopen(&(0x7f0000000040)='fuseblk\x00', 0x0) socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000003c0)='proc\x00', 0x4000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000240)='27', 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000500)='wchan\x00') pread64(r2, &(0x7f0000000540)=""/5, 0x5, 0x7fffffff) ioctl$XFS_IOC_DIOINFO(r1, 0x800c581e, 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x2, &(0x7f0000000280)='\x00\xe5\xff\xff\xff\xff\xff\xff\xff2', &(0x7f00000002c0)="f1", 0x1) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000300)='\x1c@\\X', &(0x7f0000000340)='R\x8d\xe9\x1a\xe0\x04\x00\x00\x00\x00\x00\x00\x00s\x03l\x8c\x11kS\x03\x03\x14 \'_\v/\xe0\xb0A\rx\x19\xe8\xf6sU\xfe<\xef\xc9\x12\xc25\xf8A\t\xdb\xb7\x88\xeeT\x80\x00\x00\x00Q\x00\x90\x04\'J\xf8\xdfs\xad\xe6dS\x98\xeb\x89p\xd6)\xe8\x94d\x9d-8\xae\xb4![!\xd2\xbc\x888', 0x0) openat$zero(0xffffffffffffff9c, &(0x7f00000004c0), 0x200, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x20846, 0x2) write(r3, &(0x7f0000000440)='.I', 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r3, 0x0) r4 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) ioctl$EXT4_IOC_GET_ES_CACHE(r2, 0xc020662a, &(0x7f0000000580)={0x7, 0x7fffffffffffffff, 0x0, 0x7, 0x8, 0x0, [{0x1, 0x1, 0x6, '\x00', 0x3612}, {0x8, 0xbde, 0x4, '\x00', 0x2c07}, {0x7, 0xc, 0x0, '\x00', 0x408}, {0xffffffff80000001, 0x5, 0x8, '\x00', 0x2400}, {0x4, 0x4, 0x1f05deae, '\x00', 0x2984}, {0x0, 0xd4aa, 0x38000000000, '\x00', 0x108a}, {0x6f2, 0x4, 0x36fe, '\x00', 0x3106}, {0x281, 0xfff, 0x7afaef82, '\x00', 0x4}]}) setsockopt$WPAN_SECURITY(r4, 0x0, 0x1, &(0x7f0000000480)=0x1, 0x4) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000780)={0x1, &(0x7f00000007c0)=[{0x6, 0x4, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r6, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000880)={0x14, 0x56, 0x1, 0x0, 0x0, {0x7}}, 0x14}, 0x1, 0x0, 0x0, 0x84}, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) timerfd_create(0x0, 0x80000) syz_ublk_setup_io_uring(0x20, &(0x7f00000008c0)={0x0, 0xd40c, 0x1000, 0x40002, 0x1e5}, &(0x7f0000000940), &(0x7f0000000980), &(0x7f00000009c0)=0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, r7, &(0x7f0000000a00)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x104, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000a80)=@any_dev={0x2, 0xc25, 0x0, 0x0, 0x1000, 0x6, 0x0, 0x0, 0x4}}}, &(0x7f0000000ac0)) socket$inet6_tcp(0xa, 0x1, 0x0) 62.641173ms ago: executing program 3 (id=7): setns(0xc9, 0x0) ioctl$XFS_IOC_GETPARENTS(0xffffffffffffffff, 0xc028583e, &(0x7f00000194c0)={{[0xffff8000, 0x0, 0x3d0c3d8e, 0x6]}, 0x0, 0x1, 0x5, 0x0, 0x0}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) capset(&(0x7f0000000300)={0x20080522}, &(0x7f0000000340)={0x1000, 0x10ffff, 0xfffffffd}) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) (async) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) syz_kvm_setup_cpu$x86(r0, r1, &(0x7f0000591000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, &(0x7f00000000c0)="26660f10316626f20f44880d0066b9800000c00f326635004000000f3066b95906000066b882c3000066ba000000000f30f2aa36f32e2e663edcea66b9860b00000f32e0f9f3df6200660f38310b", 0x4e}], 0x1, 0x14, &(0x7f0000000180)=[@cr0={0x0, 0x60000039}, @efer={0x2, 0x401}], 0x2) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000), 0x80200, 0x0) ioctl$PPPIOCDISCONN(r2, 0x7439) r3 = syz_open_procfs(0x0, &(0x7f0000000380)='pagemap\x00') pread64(r3, &(0x7f00000003c0)=""/102400, 0x19000, 0x1000000000) (async) pread64(r3, &(0x7f00000003c0)=""/102400, 0x19000, 0x1000000000) 54.813634ms ago: executing program 3 (id=8): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x1d1) mount$tmpfs(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000400), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='nr_inodes=1']) chdir(&(0x7f00000004c0)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x158) 868.65µs ago: executing program 3 (id=9): openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x740, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$IPSET_CMD_HEADER(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x14, 0xc, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x8008010}, 0x4000) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r1, 0x29, 0x3b, &(0x7f0000000080), 0x8) mkdir(&(0x7f0000000dc0)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000e00)='.\x00', &(0x7f0000000e40)='./bus\x00', &(0x7f0000000e80), 0xc002, 0x0) chdir(&(0x7f0000000ec0)='./bus\x00') r2 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') prctl$PR_SET_THP_DISABLE(0x41, 0xffffffff) openat$binfmt(0xffffffffffffff9c, r2, 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x740, 0x0) (async) socket$netlink(0x10, 0x3, 0x4) (async) sendmsg$IPSET_CMD_HEADER(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x14, 0xc, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x8008010}, 0x4000) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) setsockopt$inet6_IPV6_DSTOPTS(r1, 0x29, 0x3b, &(0x7f0000000080), 0x8) (async) mkdir(&(0x7f0000000dc0)='./bus\x00', 0x0) (async) mount$incfs(&(0x7f0000000e00)='.\x00', &(0x7f0000000e40)='./bus\x00', &(0x7f0000000e80), 0xc002, 0x0) (async) chdir(&(0x7f0000000ec0)='./bus\x00') (async) syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') (async) prctl$PR_SET_THP_DISABLE(0x41, 0xffffffff) (async) openat$binfmt(0xffffffffffffff9c, r2, 0x42, 0x1ff) (async) 0s ago: executing program 3 (id=10): r0 = socket(0x10, 0x803, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) (async) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r2, 0x29, 0xb, 0x0, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) (async) r4 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000002300)=ANY=[@ANYBLOB="1201000000000010ef17476000000000000109022400010000a00209040005020300840009210000400122180009058103"], 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) (async) syz_usb_control_io$hid(r4, &(0x7f0000002340)={0x24, 0x0, 0x0, &(0x7f0000002380)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) (async) r5 = syz_open_dev$hiddev(&(0x7f00000023c0), 0xa, 0x62080) ioctl$HIDIOCGUSAGE(r5, 0xc018480b, &(0x7f0000002400)={0x2, 0x200, 0x30cd, 0x5, 0x3fdc, 0x2}) bind$inet(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000002, 0x204031, 0xffffffffffffffff, 0xe60d3000) (async) r6 = mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000001a40)={0x1, &(0x7f0000001a80)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) (async) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001ac0), 0x129600, 0x0) r8 = add_key$keyring(&(0x7f0000002000), &(0x7f0000002040)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r8, 0x0, &(0x7f0000002080)=@chain) (async) r9 = syz_ublk_setup_io_uring(0x20, &(0x7f0000001b00)={0x0, 0x0, 0x1000, 0x40002, 0x1e5}, &(0x7f0000001b80)=0x0, &(0x7f0000001bc0)=0x0, &(0x7f0000001c00)=0x0) r13 = syz_genetlink_get_family_id$mptcp(&(0x7f0000002100), r0) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000021c0)={'ip6gre0\x00', &(0x7f0000002140)={'syztnl2\x00', 0x0, 0x4, 0x9, 0xa9, 0x9, 0x40, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @mcast1, 0x8000, 0x700, 0x7a, 0x1}}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r0, &(0x7f00000022c0)={&(0x7f00000020c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000002280)={&(0x7f0000002200)={0x5c, r13, 0x1, 0x70bd29, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xfff}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x40, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r14}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x1e}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x4000000) syz_ublk_add_dev(r9, r10, r11, r12, &(0x7f0000001c40)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x104, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000001cc0)=@any_dev={0x1, 0x68, 0x0, 0x0, 0x1000, 0xd, 0x0, 0x0, 0x120}}}, &(0x7f0000001d00)=0x0) (async) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) (async) r16 = socket$inet6_tcp(0xa, 0x1, 0x0) r17 = dup(r16) (async) ioctl$TIOCVHANGUP(r7, 0x5437, 0x0) syz_ublk_add_dev(r17, 0x0, r6, r12, 0x0, &(0x7f0000001d40)) syz_ublk_setup_queues(r17, r15, 0x0, &(0x7f0000001d80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x1, 0x1000001, 0xb6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xa803, 0x40, 0x0, 0x146, 0x0, r9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xa4b3, 0x2000, 0x3, 0xbfffffff}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2a37, 0x8, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) (async) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r0, &(0x7f0000001a00)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000019c0)={&(0x7f0000000100)={0x4c, r1, 0x4, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x4, 0x51}}}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4001}, 0x8001) sendto(r0, &(0x7f0000000180)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.81' (ED25519) to the list of known hosts. [ 22.057499][ T36] audit: type=1400 audit(1794186375.509:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.080388][ T36] audit: type=1400 audit(1794186375.539:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.081200][ T286] cgroup: Unknown subsys name 'net' [ 22.108005][ T36] audit: type=1400 audit(1794186375.559:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.108125][ T286] cgroup: Unknown subsys name 'devices' [ 22.209982][ T286] cgroup: Unknown subsys name 'hugetlb' [ 22.215561][ T286] cgroup: Unknown subsys name 'rlimit' [ 22.308107][ T36] audit: type=1400 audit(1794186375.759:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.331269][ T36] audit: type=1400 audit(1794186375.759:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 22.335999][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.356209][ T36] audit: type=1400 audit(1794186375.759:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.376191][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.387617][ T36] audit: type=1400 audit(1794186375.819:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.421632][ T36] audit: type=1400 audit(1794186375.819:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.447202][ T36] audit: type=1400 audit(1794186375.829:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.472655][ T36] audit: type=1400 audit(1794186375.829:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.833647][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.840749][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.847802][ T296] bridge_slave_0: entered allmulticast mode [ 23.854180][ T296] bridge_slave_0: entered promiscuous mode [ 23.865318][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.872381][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.879450][ T295] bridge_slave_0: entered allmulticast mode [ 23.885558][ T295] bridge_slave_0: entered promiscuous mode [ 23.891773][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.898841][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.905872][ T296] bridge_slave_1: entered allmulticast mode [ 23.912066][ T296] bridge_slave_1: entered promiscuous mode [ 23.920891][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.927915][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.934985][ T293] bridge_slave_0: entered allmulticast mode [ 23.941100][ T293] bridge_slave_0: entered promiscuous mode [ 23.948881][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.955903][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.963020][ T295] bridge_slave_1: entered allmulticast mode [ 23.969251][ T295] bridge_slave_1: entered promiscuous mode [ 23.980823][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.987845][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.994909][ T293] bridge_slave_1: entered allmulticast mode [ 24.001110][ T293] bridge_slave_1: entered promiscuous mode [ 24.095613][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.102686][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.109808][ T294] bridge_slave_0: entered allmulticast mode [ 24.115994][ T294] bridge_slave_0: entered promiscuous mode [ 24.124982][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.132028][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.139112][ T294] bridge_slave_1: entered allmulticast mode [ 24.145217][ T294] bridge_slave_1: entered promiscuous mode [ 24.206202][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.213268][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.220568][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.227591][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.268998][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.276039][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.283315][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.290344][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.300854][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.307887][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.315172][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.322205][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.334611][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.341665][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.348933][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.355951][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.385593][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.393095][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.400676][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.407775][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.415449][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.422700][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.465508][ T296] veth0_vlan: entered promiscuous mode [ 24.473633][ T61] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.480669][ T61] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.489191][ T61] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.496213][ T61] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.510131][ T61] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.517158][ T61] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.524679][ T61] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.531698][ T61] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.552394][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.559436][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.570442][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.577473][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.595223][ T296] veth1_macvtap: entered promiscuous mode [ 24.614781][ T293] veth0_vlan: entered promiscuous mode [ 24.633367][ T294] veth0_vlan: entered promiscuous mode [ 24.644068][ T293] veth1_macvtap: entered promiscuous mode [ 24.664693][ T296] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 24.684707][ T295] veth0_vlan: entered promiscuous mode [ 24.702589][ T294] veth1_macvtap: entered promiscuous mode [ 24.713723][ T295] veth1_macvtap: entered promiscuous mode [ 24.800257][ T327] FAULT_INJECTION: forcing a failure. [ 24.800257][ T327] name fail_futex, interval 1, probability 0, space 0, times 1 [ 24.813172][ T327] CPU: 0 UID: 0 PID: 327 Comm: syz.3.6 Not tainted syzkaller #0 ff996278633adec6fd25d1632b496761701c4fe9 [ 24.813198][ T327] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 24.813218][ T327] Call Trace: [ 24.813224][ T327] [ 24.813231][ T327] __dump_stack+0x21/0x30 [ 24.813253][ T327] dump_stack_lvl+0x140/0x1c0 [ 24.813270][ T327] ? __cfi_dump_stack_lvl+0x10/0x10 [ 24.813288][ T327] ? __kasan_check_write+0x18/0x20 [ 24.813312][ T327] ? mutex_unlock+0x90/0x240 [ 24.813335][ T327] dump_stack+0x19/0x20 [ 24.813350][ T327] should_fail_ex+0x3c2/0x510 [ 24.813368][ T327] should_fail+0xf/0x20 [ 24.813384][ T327] get_futex_key+0x178/0x940 [ 24.813403][ T327] ? __cfi_get_futex_key+0x10/0x10 [ 24.813422][ T327] futex_wake+0x150/0x950 [ 24.813445][ T327] ? futex_wait+0x2b8/0x7c0 [ 24.813465][ T327] ? __cfi_futex_wake+0x10/0x10 [ 24.813488][ T327] ? bpf_lsm_file_permission+0xd/0x20 [ 24.813508][ T327] ? vfs_read+0x72a/0xc70 [ 24.813532][ T327] do_futex+0x37d/0x510 [ 24.813550][ T327] ? __cfi_do_futex+0x10/0x10 [ 24.813569][ T327] __se_sys_futex+0x13c/0x320 [ 24.813588][ T327] ? fput+0x1a4/0x230 [ 24.813607][ T327] ? __x64_sys_futex+0x110/0x110 [ 24.813626][ T327] ? __cfi_ksys_pread64+0x10/0x10 [ 24.813644][ T327] __x64_sys_futex+0xe9/0x110 [ 24.813663][ T327] x64_sys_call+0x227f/0x2ee0 [ 24.813682][ T327] do_syscall_64+0x57/0xf0 [ 24.813700][ T327] ? clear_bhb_loop+0x50/0xa0 [ 24.813731][ T327] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 24.813755][ T327] RIP: 0033:0x7f948559fb19 [ 24.813775][ T327] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 24.813790][ T327] RSP: 002b:00007f94863b60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 24.813815][ T327] RAX: ffffffffffffffda RBX: 00007f9485825fa8 RCX: 00007f948559fb19 [ 24.813830][ T327] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f9485825fac [ 24.813843][ T327] RBP: 00007f9485825fa0 R08: 4000000000000000 R09: 0000000000000000 [ 24.813857][ T327] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 24.813868][ T327] R13: 00007f9485826038 R14: 00007ffc4ca7e590 R15: 00007ffc4ca7e678 [ 24.813884][ T327] [ 25.008629][ T31] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 25.112683][ T335] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=1548 sclass=netlink_tcpdiag_socket pid=335 comm=syz.3.9 [ 25.127144][ T335] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=1548 sclass=netlink_tcpdiag_socket pid=335 comm=syz.3.9 [ 25.199661][ T294] ------------[ cut here ]------------ [ 25.205154][ T294] WARNING: CPU: 1 PID: 294 at fs/inode.c:340 drop_nlink+0xce/0x110 [ 25.208444][ T9] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 25.213089][ T294] Modules linked in: [ 25.224428][ T294] CPU: 1 UID: 0 PID: 294 Comm: syz-executor Not tainted syzkaller #0 ff996278633adec6fd25d1632b496761701c4fe9 [ 25.236076][ T294] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 25.246180][ T294] RIP: 0010:drop_nlink+0xce/0x110 [ 25.251242][ T294] Code: 04 00 00 be 08 00 00 00 e8 3f 07 ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d e9 98 14 b8 03 cc e8 42 47 94 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c [ 25.270884][ T294] RSP: 0018:ffffc9000b68fae8 EFLAGS: 00010293 [ 25.276951][ T294] RAX: ffffffff81f5228e RBX: ffff88810fbdda78 RCX: ffff8881047413c0 [ 25.285012][ T294] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 25.293004][ T294] RBP: ffffc9000b68fb10 R08: 0000000000000003 R09: 0000000000000004 [ 25.300995][ T294] R10: dffffc0000000000 R11: fffff520016d1f4c R12: dffffc0000000000 [ 25.308990][ T294] R13: 1ffff11021f7bb58 R14: ffff88810fbddac0 R15: 0000000000000000 [ 25.316956][ T294] FS: 0000000000000000(0000) GS:ffff8881f6d00000(0000) knlGS:0000000000000000 [ 25.325902][ T294] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.332566][ T294] CR2: 00007ffc4ca7bfc8 CR3: 000000010bb36000 CR4: 00000000003526b0 [ 25.340564][ T294] Call Trace: [ 25.343835][ T294] [ 25.346748][ T294] shmem_rmdir+0x5f/0x90 [ 25.348458][ T9] usb 2-1: device descriptor read/64, error -71 [ 25.351042][ T294] vfs_rmdir+0x3db/0x560 [ 25.361453][ T294] incfs_kill_sb+0x102/0x220 [ 25.366027][ T294] deactivate_locked_super+0xd5/0x270 [ 25.371414][ T294] deactivate_super+0xb8/0xe0 [ 25.376105][ T294] cleanup_mnt+0x438/0x4d0 [ 25.380523][ T294] __cleanup_mnt+0x1d/0x40 [ 25.384935][ T294] task_work_run+0x1e8/0x260 [ 25.389528][ T294] ? __cfi_task_work_run+0x10/0x10 [ 25.394639][ T294] ? free_nsproxy+0x223/0x290 [ 25.399318][ T294] do_exit+0xa46/0x2850 [ 25.403495][ T294] ? __cfi_do_exit+0x10/0x10 [ 25.408069][ T294] ? __kasan_check_write+0x18/0x20 [ 25.413229][ T294] ? _raw_spin_lock_irq+0x93/0x120 [ 25.418342][ T294] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 25.423896][ T294] ? __cfi_ksys_write+0x10/0x10 [ 25.428758][ T294] ? zap_other_threads+0x32e/0x3a0 [ 25.433855][ T294] do_group_exit+0x21f/0x2f0 [ 25.438457][ T294] __x64_sys_exit_group+0x43/0x50 [ 25.443476][ T294] x64_sys_call+0x2ed2/0x2ee0 [ 25.448134][ T294] do_syscall_64+0x57/0xf0 [ 25.452550][ T294] ? clear_bhb_loop+0x50/0xa0 [ 25.457233][ T294] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 25.463129][ T294] RIP: 0033:0x7f948559fb19 [ 25.467539][ T294] Code: Unable to access opcode bytes at 0x7f948559faef. [ 25.474562][ T294] RSP: 002b:00007ffc4ca7c6e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 25.482994][ T294] RAX: ffffffffffffffda RBX: 00007f9485637013 RCX: 00007f948559fb19 [ 25.491012][ T294] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 [ 25.498991][ T294] RBP: 0000000000000009 R08: 0000000000000000 R09: 00007f9485636fb3 [ 25.506943][ T294] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc4ca7d9a0 [ 25.515173][ T294] R13: 00007f9485636fb3 R14: 0000555574d414e8 R15: 00007ffc4ca7ea70 [ 25.523152][ T294] [ 25.526152][ T294] ---[ end trace 0000000000000000 ]--- [ 25.531821][ T294] ================================================================== [ 25.539888][ T294] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 [ 25.546112][ T294] Write of size 4 at addr 0000000000000168 by task syz-executor/294 [ 25.554058][ T294] [ 25.556365][ T294] CPU: 0 UID: 0 PID: 294 Comm: syz-executor Tainted: G W syzkaller #0 ff996278633adec6fd25d1632b496761701c4fe9 [ 25.556381][ T294] Tainted: [W]=WARN [ 25.556385][ T294] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 25.556392][ T294] Call Trace: [ 25.556395][ T294] [ 25.556400][ T294] __dump_stack+0x21/0x30 [ 25.556411][ T294] dump_stack_lvl+0x140/0x1c0 [ 25.556420][ T294] ? __cfi_dump_stack_lvl+0x10/0x10 [ 25.556430][ T294] print_report+0x3d/0x70 [ 25.556440][ T294] kasan_report+0x162/0x1a0 [ 25.556452][ T294] ? ihold+0x24/0x70 [ 25.556462][ T294] ? ihold+0x24/0x70 [ 25.556471][ T294] kasan_check_range+0x25a/0x2b0 [ 25.556483][ T294] __kasan_check_write+0x18/0x20 [ 25.556496][ T294] ihold+0x24/0x70 [ 25.556506][ T294] vfs_rmdir+0x25c/0x560 [ 25.556519][ T294] incfs_kill_sb+0x102/0x220 [ 25.556528][ T294] deactivate_locked_super+0xd5/0x270 [ 25.556541][ T294] deactivate_super+0xb8/0xe0 [ 25.556553][ T294] cleanup_mnt+0x438/0x4d0 [ 25.556564][ T294] __cleanup_mnt+0x1d/0x40 [ 25.556574][ T294] task_work_run+0x1e8/0x260 [ 25.556589][ T294] ? __cfi_task_work_run+0x10/0x10 [ 25.556602][ T294] ? free_nsproxy+0x223/0x290 [ 25.556613][ T294] do_exit+0xa46/0x2850 [ 25.556627][ T294] ? __cfi_do_exit+0x10/0x10 [ 25.556640][ T294] ? __kasan_check_write+0x18/0x20 [ 25.556653][ T294] ? _raw_spin_lock_irq+0x93/0x120 [ 25.556664][ T294] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 25.556674][ T294] ? __cfi_ksys_write+0x10/0x10 [ 25.556683][ T294] ? zap_other_threads+0x32e/0x3a0 [ 25.556697][ T294] do_group_exit+0x21f/0x2f0 [ 25.556711][ T294] __x64_sys_exit_group+0x43/0x50 [ 25.556720][ T294] x64_sys_call+0x2ed2/0x2ee0 [ 25.556731][ T294] do_syscall_64+0x57/0xf0 [ 25.556741][ T294] ? clear_bhb_loop+0x50/0xa0 [ 25.556755][ T294] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 25.556767][ T294] RIP: 0033:0x7f948559fb19 [ 25.556776][ T294] Code: Unable to access opcode bytes at 0x7f948559faef. [ 25.556781][ T294] RSP: 002b:00007ffc4ca7c6e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 25.556793][ T294] RAX: ffffffffffffffda RBX: 00007f9485637013 RCX: 00007f948559fb19 [ 25.556800][ T294] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 [ 25.556807][ T294] RBP: 0000000000000009 R08: 0000000000000000 R09: 00007f9485636fb3 [ 25.556813][ T294] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc4ca7d9a0 [ 25.556820][ T294] R13: 00007f9485636fb3 R14: 0000555574d414e8 R15: 00007ffc4ca7ea70 [ 25.556828][ T294] [ 25.556832][ T294] ================================================================== [ 25.810685][ T9] usb 2-1: device descriptor read/64, error -71 [ 25.816982][ T294] Disabling lock debugging due to kernel taint [ 25.817334][ T309] bridge_slave_1: left allmulticast mode [ 25.828575][ T294] BUG: kernel NULL pointer dereference, address: 0000000000000168 [ 25.829667][ T31] usb 3-1: Using ep0 maxpacket: 32 [ 25.836759][ T294] #PF: supervisor write access in kernel mode [ 25.845574][ T309] bridge_slave_1: left promiscuous mode [ 25.847890][ T294] #PF: error_code(0x0002) - not-present page [ 25.847903][ T294] PGD 8000000130938067 P4D 8000000130938067 PUD 0 [ 25.847927][ T294] Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI [ 25.853877][ T309] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.859407][ T294] CPU: 0 UID: 0 PID: 294 Comm: syz-executor Tainted: G B W syzkaller #0 ff996278633adec6fd25d1632b496761701c4fe9 [ 25.866869][ T31] usb 3-1: unable to get BOS descriptor or descriptor too short [ 25.871939][ T294] Tainted: [B]=BAD_PAGE, [W]=WARN [ 25.871948][ T294] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 25.871958][ T294] RIP: 0010:ihold+0x2a/0x70 [ 25.885397][ T31] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 215, changing to 7 [ 25.892028][ T294] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 2d 3e 94 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 fc fd ed ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 3d [ 25.892044][ T294] RSP: 0018:ffffc9000b68fb28 EFLAGS: 00010246 [ 25.903272][ T31] usb 3-1: New USB device found, idVendor=041e, idProduct=3f19, bcdDevice= 0.40 [ 25.904656][ T294] RAX: ffff888104741300 RBX: 0000000000000000 RCX: ffff8881047413c0 [ 25.914864][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.919167][ T294] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 25.919181][ T294] RBP: ffffc9000b68fb38 R08: ffffffff893d8967 R09: 1ffffffff127b12c [ 25.919195][ T294] R10: dffffc0000000000 R11: fffffbfff127b12d R12: 0000000000000000 [ 25.930437][ T31] usb 3-1: Product: syz [ 25.949759][ T294] R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 [ 25.949773][ T294] FS: 0000000000000000(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 [ 25.956004][ T31] usb 3-1: Manufacturer: syz [ 25.964806][ T294] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.964821][ T294] CR2: 0000000000000168 CR3: 000000012538e000 CR4: 00000000003526b0 [ 25.964837][ T294] Call Trace: [ 25.972979][ T31] usb 3-1: SerialNumber: syz [ 25.980729][ T294] [ 25.980738][ T294] vfs_rmdir+0x25c/0x560 [ 26.059568][ T294] incfs_kill_sb+0x102/0x220 [ 26.064151][ T294] deactivate_locked_super+0xd5/0x270 [ 26.069510][ T294] deactivate_super+0xb8/0xe0 [ 26.074173][ T294] cleanup_mnt+0x438/0x4d0 [ 26.078587][ T294] __cleanup_mnt+0x1d/0x40 [ 26.082996][ T294] task_work_run+0x1e8/0x260 [ 26.087574][ T294] ? __cfi_task_work_run+0x10/0x10 [ 26.092670][ T294] ? free_nsproxy+0x223/0x290 [ 26.097344][ T294] do_exit+0xa46/0x2850 [ 26.101497][ T294] ? __cfi_do_exit+0x10/0x10 [ 26.106068][ T294] ? __kasan_check_write+0x18/0x20 [ 26.111170][ T294] ? _raw_spin_lock_irq+0x93/0x120 [ 26.116293][ T294] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 26.121841][ T294] ? __cfi_ksys_write+0x10/0x10 [ 26.126677][ T294] ? zap_other_threads+0x32e/0x3a0 [ 26.131792][ T294] do_group_exit+0x21f/0x2f0 [ 26.136380][ T294] __x64_sys_exit_group+0x43/0x50 [ 26.141391][ T294] x64_sys_call+0x2ed2/0x2ee0 [ 26.146068][ T294] do_syscall_64+0x57/0xf0 [ 26.150477][ T294] ? clear_bhb_loop+0x50/0xa0 [ 26.155151][ T294] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 26.161046][ T294] RIP: 0033:0x7f948559fb19 [ 26.165459][ T294] Code: Unable to access opcode bytes at 0x7f948559faef. [ 26.172458][ T294] RSP: 002b:00007ffc4ca7c6e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 26.180864][ T294] RAX: ffffffffffffffda RBX: 00007f9485637013 RCX: 00007f948559fb19 [ 26.188827][ T294] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 [ 26.196787][ T294] RBP: 0000000000000009 R08: 0000000000000000 R09: 00007f9485636fb3 [ 26.203675][ T31] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 26.204748][ T294] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc4ca7d9a0 [ 26.213463][ T31] usb 3-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 26.219360][ T294] R13: 00007f9485636fb3 R14: 0000555574d414e8 R15: 00007ffc4ca7ea70 [ 26.219380][ T294] [ 26.219387][ T294] Modules linked in: [ 26.234074][ T31] usb 3-1: USB disconnect, device number 2 [ 26.237001][ T294] CR2: 0000000000000168 [ 26.250765][ T294] ---[ end trace 0000000000000000 ]--- [ 26.256195][ T294] RIP: 0010:ihold+0x2a/0x70 [ 26.260679][ T294] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 2d 3e 94 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 fc fd ed ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 3d [ 26.273380][ T321] udevd[321]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 26.280261][ T294] RSP: 0018:ffffc9000b68fb28 EFLAGS: 00010246 [ 26.280280][ T294] RAX: ffff888104741300 RBX: 0000000000000000 RCX: ffff8881047413c0 [ 26.309860][ T294] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 26.317816][ T294] RBP: ffffc9000b68fb38 R08: ffffffff893d8967 R09: 1ffffffff127b12c [ 26.325785][ T294] R10: dffffc0000000000 R11: fffffbfff127b12d R12: 0000000000000000 [ 26.333756][ T294] R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 [ 26.341731][ T294] FS: 0000000000000000(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 [ 26.350660][ T294] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 26.357244][ T294] CR2: 0000000000000168 CR3: 000000012538e000 CR4: 00000000003526b0 [ 26.365199][ T294] Kernel panic - not syncing: Fatal exception [ 26.371504][ T294] Kernel Offset: disabled [ 26.375809][ T294] Rebooting in 86400 seconds..