last executing test programs: 5.508275177s ago: executing program 0 (id=9): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000100)={0x209d, 0x3, 0x0, 0x7ffffff9}, 0x10) write(r0, &(0x7f00000000c0)="1800000016005f0214fffffffffffff80700400001000000", 0x18) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0x541b, &(0x7f0000000040)={0xffffffffffffffff, 0x1}) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1002}) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000900)={'syzkaller0\x00', 0x41}) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r3) sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000010000000000000001410000001c0017fffffffd000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) write(r2, &(0x7f0000000500)="ffffffffffff00000000000188ca4f400028100000000000000001000001010000010100000200000000000000030000000000000000", 0x36) 5.305017662s ago: executing program 0 (id=12): r0 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000040), 0x82284, 0x0) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) write$UHID_INPUT(r3, &(0x7f0000010140)={0x8, {"7f9654d636ab18b7938a2804505c72e9994ca22404fc203334cc21ed3d6a776fd12d13f9602b2980f983c31a5d1e431db778099ce3af3fb20e1ee1f4fdb77cbb36154982a93c19825d6fd273ab1eb5bcd47adad50de8a6791486e482e29ecc94284921f33b941cfc1000c9781d9a828c5ec7a2c77b4e624a5aa0e9e39782bad733eda81ba47e1c6116e4170e6587dd6210a57abe91f1f80c4e31139d8b73fe35ac1f99ea82dd6aa9c9aa67de88ae3e141020e1a876bbc449d2d843aa7e6d90b948b7e28770e6ac71010c63f17e90fd20806a9f8d9f418ee3af74aac64b04a27c4f5e3626ca2da546c79d24acadd11e8d272a22fc54078fd5e64475993668980a9f95aff964ded28f79c862e674356af492b8377a759d8ccf1accb9a18ef7ad16f438dde69cd020d71552b0810688c882a26a22b23f4b35471b08b379193db1cd7934a4049ff1b00d9795cda6e73951641d5e2365c24facd5afd09ed1d096d758b4fef66fe1aa22395d67b7e1db623d4a60a7dc93893d6c4a91df79535a855868c5dc0033d5c428cd25b85c5deb6e81068553bc84cead4d1eba8aa57e2b354a6899e44acbd3834491219b3e231cd55d82f161774a689efe197cc193ac0124c67738a0a1d5f16a6768c2c2ba7386c8c95ca08c55117f344f5a2bca0d09e79ea3fc49491f2c7adc513c2779c1bf62b1a8643d23e9e8b2ae41d4a59f1b82b82e092b36eb851b8456da871b4057aec325a9d4cccafde61f2abc85e3cabeabb856f6ffbfe23d69219ec8fae6beb54abe7870dbae823d49806a967a1c7f252999804f106745f20490bb3347b59321dc69765567abcbd89de04d89622170005df5871ed0fb72345a11da074060d7d4ee2e437f71a45723fb6b02de56067e54f54c52d10f7874a13cbfb3bd65ce54f9d6719ea210e0cf79e4e2157736ec07ac5915682ab81bced665c1e72fab8d8cfe509de0f21fe374b957b379fd5918061e21c2e96985cc1354b2de859b0f1a463ab04683b1253eda671c2353b5c208aca652f5419ffc4949a7fa909b95653f42d97390c400b4a1c308b11e73e9a06d3b164d3361e75584d70e6bc61d570a7e0c7da330f643194c1893fcd6489fac605eead61b53dff18caf526ecccc9bbd9146bc3c3bb67677695e6fddaab081786e9084014e60f5c03ae5a9087726b05e17402cd2fbb80d773b8a41470b1f901a8c2b2d57450181f4fc5bc53c7cb3dc032b84567492607cb08832eca9f79da9210d197863e5db5a74a9823dc0cc8bd9f3a9b6ff5a7d15d4747a9b26e088f4fad96d81cd1214226b1c4585d418d593220fcbb9ad949266cc48163e3498b46ebcdf7b2b5ecfe67539a61ed9e39b02d5b35ac0d0e7fa830034ca2da8a7ddf04bcf2cee939994369feb77023e0e3de04b21db7a640a92c17748245005cd75a7deba4ff0e4c104a9db2d9a98ec8edb3562050a3bac5f322290e3d8b6fb21770ac436d4cb12b97fc8f76d7bb9eeed85663eb0626f1ad1719ee4b07f7de2c1d1a31c27c6879f4fa3dbdfb2bfc0898beabafbeca9f13050e6b2f6c432e423cd5cb6b8fa56fe32c3e50104e44462c0a5c69de6a7ac5ae3d9f07ceed64dbffa42e4663838bfcde92f0fcb895f3b93c59b0e48c09890dfc36436db56b708f6e7cbbd2a6305f573cee099dbcd263cb96d9fb69cbc3cb06d8f5e3789698a17e71d22b4665ff5447fcc17a31bb136c8bb4b984573bcaf1cb650198c1266e6ddfd42d44f9de02cb9d915c5334c550fac3fcee56790aeb09d81e7690a32d8b0cc477b23f15257820de227be1ffaec2f63f3266b8f5dd78947dcee355fe59bfb100e5244425532bb1d115acd211b8c16b0ec0aae00fca5d4511a05c3ff027a1cac56210a10d81c01b90e156cc7b33de0fac825dc516d398166096013e068db935483c93ba95da39b5ae4087d84479a4c4809f28f93790dc279637bd6f3dc441d315cf6bd7b0e3d92070a45baf4445ce063fd12690eb002f5ca068a256bc54100c99a02a346beca39072163c4b297d117f1ed9fef42e3dbc11d36a0a0db52e84461c6fbb4aad62cd6c8dc9ae6a3390a5e8773ac599e67436220c8d541a9039762bffaa7f490e31dddbc362fb4ff686cda905f3b02a1db76d4d570d970434921ca8a4765af6d5c8b881e1f4ffa7e2d9ef5f5511b94f88474674ec790bb5186c73446a227bf1ffd19b605733abd1bd41e421aeaf2ed4617088c7ceef85451225056435993e89e4bccd2c2e4b39af99feef11fea645eeb5cf9f77b1e19a72d3efb613100969b84302789714bca65bcbc96762b4012a5700c62aed706433b9f142b7302442b6a9958b0e28e8b1cfa9eeb4ac0d71f497b23babf9f0221dcb658d9f4db5d45bee30d2ad7c97d6a562e014a7701c15325ec5d42ab732b37714a77a95c03fb15bbfba6fade32bf50f985a1df362ca7216cc152907dd931acb58a63920f581e82b590c0d6a0033009f8e50c3263d3f58596b63d507cadbc809a6690561f74d0772bf92d04e06c47a350724b106f5e83f7e71c4b2a983bf5ad7d8684e7b8b5dc1273d0fa5879b8e61bde33d602bc8ff0913b6d32dcac366d568dc7cf82bbfc405cbe418a2644c26592b32ca1a632fc95123efb784cfb6953a94ebeccd24fba389a0e56b043df07d9a2dd38a1196e5e55576b25f85cb96f6560802a4a58b7a6857e8454faa2c880bf32d464562b2bdc5f0df22b663f2c01fc944f1cfd1908f617f8295a5440bb79ae178ea46a95baeea48322105146ac3ed2de7d3796ddddcc848a8ecf4a00dd055733b4f59211f5a40deea44e74b3bc57953b26ed61e6fd67889edfe8d0902385e37666aacec072735630ecc441c3cc6b09bb2f63aa4e332c6df728dc74078a83ce20454dfd616d116270666ddc09c5fea2e8442bc43455d0257fac92f3780061178f9420bf8e463f29896c12383dbb9a81bc5c87376e647c8a9786cb514fb9696d9c0a8d303c5c4b5b7c5f601c01fa19323e02f675c371bc44fbc1ac5704d41a89a2a4ccec6ac8440c532f07da25aa2dce6a5d2ebe694eb4017d178b221213bfe2a01d9cfe689bd190776bca6c032f446eb8862587a7826e35f3f691763212eee6af2e49bbeb0a27e07c5714b74e373798c7bebce265f7ebef3a1ea64078cf1e8a9d433af32c53090c972ffedbadafb50b9a6e540abd84f8e938583ea725954be3b236c5d8aca7d486d21902a2902f25a7c02dbe83c39bd0b81513f9ef198c49d560e930ae224ff47f92e4851e1f7ab5bb406abcf6596569261e6b0c67bb3b854e9c6de60bfb60fcf29241ff237151310ecd19f8b2cfe764c1df1a2de9d840eca47aa169ba9a415901204ec31ccdfd76e908029ae34fb12dc286758c64fd6d42bc82b14e07e421f4b42b180cd6ef40cac8062928b4a420a4577f24295f54de9048ac9d34307bf93e463cea4967cf4880166f68ed1eb965db2e4fb9f5f0b1c695d621e427ccb9a3188073ee6fde729c6698346efa1c0ba643c1efd20858965511da750060d551c44c435a5f1603fae7357e0bc78e92aad3d88790ec2aa1a42d6fe7e0ffc57f3599e406db63be7dd32692df32ce33dee0a2becdb02d6e435e09de3d356497543db23f53da25643f9c585e275297800d8beed47f0e622f86fc25d2e87036fdceebfe7257cb6de0c02412d1c0758acfcd0862e99ad17a118f46f635a87477e8b825423d94ada35bf0b5444aa7d3de4bb7eec7ae5129fcc2cba651cc972f5500fc5161149d29f452962afb102a01ae76825cb4477460be0b85d75058595c27e9b7fae3492ec3925c671bee5f4ca534d5a294f783d6cc073c992139b61d21fd98297b04c0578dafd5f7ebcaf8d4d9185aea3d76e813421f4573b38c25093c015a65e44fb297f0f6ac2d02c4237b37a3bfca2406c5c95ae5812816bacad59ba7c6f72d7c644ff25b592ed1e89b276e05866c01a4ced7fc6dd9f190c20d420d7c8a1fe908833a24c5e5bd7a95a2a6fbf147fc4b29a179718166dd0fbae2fc6b8c8aac6194fa6baf0d3edc36b2316c56c441ba53e3e7aaaf0a1405566ff584f73a637b74dde9bcb4d41da2be6c9df5d533fbac54f5fb52a8a793757cfe19aa90048c6d07e3474136ae1be2455b0d0d02eb4b5961ba883209355c0dd2af4aad98e7b971e358a7d9b55fe17cd6095f257355d9b99e5ea52848f17b35a80792d9ed0fef6fe3eef9a324902409969823be20bbe0e8dba9c747cd1a14d3642d877b86271f3f0c322a142c4ff635b37d542c3265b5fe8589a732bb1a55010b930dd0196cd43ac3634c01b4a44c517197d03a3d89c67f5c09aab409e84c0af466bfbd0c96d240101a2542c66b4b4b8ef65b41b0079995c52cc9720d2c1d7c128c6f17a65cc798c1986cfbd8888460c54438edc4f91f3580391c8b57d9aee209a59a116c1c44775437e9c30e6d87e82ce84e28532b19441e32ab9aea22177bac9daad25a6c88395e9348d6780de630cddb266c411011175bdb6255a36535180818447d43ffba3758d311539fe9f6811fa470bf3767b4c2d4cdf37854c7ee28730bb1d39d5c0dfffcdbf353cca3e13079f3ae66b839c7dd36914022a0e75bca5b622f521420b73249ef47f03c1fb03ecf7557882afcaa7cf454a68ad237d4ce860bd6b1531c1cafe2cfb76bc4188271ef6bdfb304ee0e6932463a1909f03d6e8a27b5f137d6b342841d613863dfdf37d5ec3a98d667810fb6f82d67620bdefed8b3ff98420a6c7ee577c3ba68b95a20403608a7ba6526ec9e8662c6e15ab09b1a9019d4958af04cb2e4890ee6b1077fcaa5cc0817f388461b230fe631e75f18ab392a5ca5de4a024ca16dd05fcfdf92114e43a5c4a169d462ff0dba57deeaf5eaafd892f8ccbd72ac56471162e1416bca39859b4184ba0d1b3f7ec05db4ef4cf0142867fa9be328a0be8aa74c716aad9411008607980861f4f72e9bfa60195e2f939d3f6a44a6cec07dd376d1bccaa126686f313d5f7918ecd1215026982c82ed1922ef70e36e8ed59b2d5ceab3b4aad7e53049062dd5ba0e87f7005c3f4d2b788245cdc2f35ef2572bea5ea92dfad406ade6d5ad18be8eeb4c652e5277b244645c68c0c0f5a68d42e00d59b75941917b2cdf31fdf809f2078ca97fd5beba65b34e0621138ea0e94feb87166b2dac2232ebca575e5c0a4d565d9992f733bbfbe68a63d99ee93398604065d5517c33ed0e067bdb643e73102f16137afd7d4bf21e8065ea028c392a6dcefbe642dc3fb03a239d9c8b17023eacc8e19fea11c34a10644af1b786fc0f4504038c2ee59c1b353f3d7b9313df025b4b5874ca63ec164a3fe35bf390d266f53dcda6a8e190e63a56ffdf4f7c5c02aa22d376db06d4d2b96be5b331f897d1ecfd25c13a1c194c265dd95a5724a6435bc8138224d9db28b689b9cea5132cd19601dbc4a43e70c71e27e8fd0689d09484974e8a4605f8553735fffaf5654a087e323ca14e02b681b9bbe592bd6b719ae2e86bdf918b27c79d52dd334d1aa7ebc1bff76e97572faad092010a1022f7d33089049107a89c364ae7dd022d119e8f6ab795fd71d76a90e8202339401ff9e9918ea8c8e12f7b0ba10d9ebde5d1bc5988f2d07b34579d8c282628204f2978d8b0cf95dc41f3775a4053f833267c64b42336d7c850f2918ef0dd6d62e43fcc173254eb34748efd4754609ce25ade162ba3c91bb844aaf6fd648ee5a8fc5c64346603f8258592d67b9613e8f7ac0def0958f13436581d729e0b3e062738eb06b2116abe837529690a614fc5d3f53b4d4602e57060", 0x1000}}, 0x1006) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r3, 0x0) (async) ioctl$KVM_SET_CLOCK(r2, 0x4030ae7b, &(0x7f0000000080)={0x2, 0xc, 0x3, 0x2, 0x4}) ioctl$TCSETSF2(r0, 0x402c542d, &(0x7f0000000000)={0xf8c8, 0x8001ff, 0x4, 0x8003, 0x7, "ea710000000000f9000000024200000200", 0x4000000, 0x400}) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000180)=0x2) 5.198591884s ago: executing program 0 (id=14): mount$tmpfs(0x0, &(0x7f0000000200)='.\x00', &(0x7f0000000240), 0x204080, &(0x7f0000000300)=ANY=[@ANYBLOB='size=G']) r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x2000000000d, 0x8e2b40) writev(0xffffffffffffffff, &(0x7f0000000300)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560aff820fffff5bab00070000002058000b4824ca945f6400940f6a0325010ebc000000000000008000f0fffeffe8090053", 0x41}], 0x1) r1 = socket$netlink(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e00000000000000000005000600010000000800090001000000050002"], 0x44}, 0x1, 0x0, 0x0, 0x42000}, 0x6000c880) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x140) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x10018, &(0x7f0000000140)={[{@upperdir={'upperdir', 0x3d, './bus'}}, {@redirect_dir_follow}, {@verity_on}]}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x2, 0x2, 0x0, 0x4002004c4, 0x1004, 0x8000000000000000, 0xc595, 0x0, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0xb3, 0x8d], 0xeeee8000, 0x2010d3}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) ioctl$EVIOCGREP(r0, 0x80084503, 0x0) 5.121560066s ago: executing program 0 (id=16): sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x20, 0x0, 0x800, 0x70bd2b, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x53a, 0x19}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4000000}, 0x40800) r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000090000102505a1a4400000000101090244000101000000090400001202060000052406000005240000000d240f010000000000000000000905810340000000000905820260000000000905030208"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000500)={0x0, 0x3, 0x1a, {0xfffffffffffffea4}}}, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) 3.092852345s ago: executing program 1 (id=26): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000000c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000f0000001c0007800c000400002e00000000005f0c0003"], 0x30}, 0x1, 0x0, 0x0, 0xc091}, 0x4004014) 3.066517396s ago: executing program 1 (id=27): r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) getsockopt$IP_SET_OP_GET_BYINDEX(r0, 0x1, 0x53, &(0x7f0000000000)={0x7, 0x7, 0x2}, &(0x7f0000000040)=0x28) recvmmsg(r0, &(0x7f0000000b00)=[{{0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000780)=""/227, 0xe3}, {&(0x7f0000001a40)=""/217, 0xd9}, {&(0x7f0000001e40)=""/4103, 0x1005}, {&(0x7f0000000380)=""/162, 0xa2}, {&(0x7f0000000280)=""/134, 0x86}, {&(0x7f0000000a00)=""/132, 0x84}, {&(0x7f0000000880)=""/139, 0x8b}, {&(0x7f0000000580)=""/272, 0x110}, {&(0x7f00000004c0)=""/95, 0x5f}], 0x9}, 0xe}, {{0x0, 0x0, 0x0}, 0x7f}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, 0x0}, 0xfffffffe}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0xfffffffd}], 0x7, 0x140, 0x0) 3.047244636s ago: executing program 1 (id=28): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000000004026093333400000000001090224"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x6, 0x36, &(0x7f00000000c0)=ANY=[], 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000080)="66b9800000c00f326635000800000f300f01d1660fc7b5095066b8010000000f23c00f21f86635000009000f23f8660f73d1f5decfcb9a000026010f300f01ca", 0x40}], 0x1, 0x32, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 3.037526617s ago: executing program 0 (id=30): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) dup2(r2, r1) connect$inet(r1, &(0x7f0000001600)={0x27, 0x4e20, @remote}, 0x10) sendmsg$inet6(r0, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=ANY=[], 0x98}, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) 2.950787509s ago: executing program 0 (id=31): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x201, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @loopback}, 0x5}, 0x1c) connect$inet6(r4, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) r5 = fcntl$dupfd(r4, 0x0, r4) sendmsg$ETHTOOL_MSG_FEATURES_SET(r5, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000011c0)={&(0x7f0000000580)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x400c000}, 0x1) fspick(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r5) r6 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r7, r8, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f0000000100)="3e0f794c32e5b8010000000f01d9266736260f01c2360f009e00200000b805000000b9009000000f01c166baf80cb89b2d628aef66bafc0cb0d8ee66baf80cb844441180ef66bafc0cecb9860a0000b86a4b3a16ba025809000f30b996080000b800000000ba000000000f30f30f1be3", 0x70}], 0x1, 0x16, 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) setsockopt$sock_int(r4, 0x1, 0xa, &(0x7f0000000280)=0x1, 0x4) sendmsg$NL80211_CMD_GET_KEY(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000100)=ANY=[@ANYBLOB], 0x30}, 0x1, 0x0, 0x0, 0x20000090}, 0x41) ioctl$KVM_CAP_HYPERV_SYNIC2(r3, 0x4068aea3, &(0x7f0000000140)) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)={0x2, 0x0, [{0x400000b0, 0x0, 0x7fff}, {0x400000b1, 0x0, 0x8}]}) r9 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) syz_usb_disconnect(r9) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1fe) mount(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='tracefs\x00', 0x139d090, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r10 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x101400, 0x0) fsync(r10) syz_usb_connect$rtl8150(0x0, 0x2e, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) 2.622451677s ago: executing program 2 (id=36): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x34200, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae03, 0xe) 2.622247746s ago: executing program 2 (id=37): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) (async) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x3, 0xc41, 0x0, 0x0, 0x1000, 0x7, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) r3 = syz_io_uring_setup(0x5b17, &(0x7f0000000000)={0x0, 0xc995, 0x4000, 0x0, 0x2de, 0x0, r2}, &(0x7f0000000080), &(0x7f0000000100), &(0x7f00000001c0)) syz_ublk_setup_queues(r2, r0, &(0x7f0000000380)={0x0, 0x2, 0x1000, 0xfffffffe, 0x238, 0x0, r3}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x704, 0x100, 0x1000000, 0x2033f, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffffff, 0x4000, 0x0, 0xdd}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9b59, 0x400}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0x4000, 0x1, 0xdfffffff, 0x0, r3}}], 0x1, 0x0, 0x0) (async) ioctl$MON_IOCG_STATS(r2, 0x80089203, &(0x7f0000000040)) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r4, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0) write(r5, &(0x7f0000000400)='dummy_hcd.0', 0xb) 2.499931049s ago: executing program 2 (id=38): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x22, &(0x7f0000000000)=0x1, 0x4) sendmmsg$inet(r1, &(0x7f0000000900)=[{{&(0x7f0000000300)={0x2, 0x4e23, @remote}, 0x10, &(0x7f0000000240)=[{&(0x7f0000000080)='o', 0x1}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x2400c040) sendmsg$netlink(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000006c40)=[{&(0x7f0000000140)=ANY=[], 0x1c}], 0x1, 0x0, 0x0, 0x40000}, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fda000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$BTRFS_IOC_RM_DEV_V2(0xffffffffffffffff, 0x5000943a, &(0x7f0000000580)={{r2}, 0x0, 0x6, @inherit={0x0, 0x0}, @devid}) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x201, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040845}, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) dup2(r6, r5) ioctl$KVM_SET_IRQCHIP(r6, 0x8208ae63, &(0x7f00000004c0)={0x0, 0x0, @pic={0x83, 0x7, 0xe1, 0x81, 0x9, 0xf9, 0x40, 0x42, 0xfb, 0x8, 0xc, 0x4, 0xe9, 0x4, 0xfc, 0x38}}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x100000000005, 0x20, 0x3, 0x2, 0x80000000106c, 0x100, 0x8000000000000, 0x80000004000080, 0x1c00000, 0x8, 0x0, 0x4, 0x0, 0x8000], 0x6000, 0x3c4210}) r8 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000380), 0x42, 0x0) syz_fuse_handle_req(r8, 0x0, 0x0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0xffffffffffffffda}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r9 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r9, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendto$packet(r9, &(0x7f00000002c0)="05031600d3fc140000004788031c09102c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r10, 0x1, 0x0, 0x6, @multicast}, 0x14) socket$nl_netfilter(0x10, 0x3, 0xc) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_SET_CPUID2(r7, 0x4008ae90, &(0x7f0000000280)={0x5, 0x0, [{0xc0000001, 0x3ff, 0x0, 0x81, 0x4, 0x2ac79ac0, 0x8001}, {0xc0000000, 0x7, 0x3, 0xfffffffb, 0x3, 0x3, 0x9}, {0x80000001, 0x7fff, 0x1, 0x4355ee70, 0x7f, 0x7, 0x2}, {0x80000019, 0x9, 0x3, 0x4, 0x80, 0xffffffc0, 0x5}, {0x80000001, 0x6, 0x2, 0x9, 0x82, 0x8, 0x5}]}) 2.375935832s ago: executing program 2 (id=39): madvise(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x1, &(0x7f0000000000)=[{0x6, 0xfd, 0xd, 0x43}]}, 0x10) listen(r0, 0x5) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20040014, &(0x7f0000000280)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) r2 = fcntl$dupfd(r1, 0x0, r0) writev(r1, &(0x7f0000000580)=[{&(0x7f0000001240)="4fb6b3c65f18ee12bc9643b50723670ed775fd626fd07522a419a1bf640fbb", 0x1f}, {&(0x7f0000000680)}], 0x2) landlock_create_ruleset(&(0x7f0000000080)={0x8000}, 0x30, 0x0) sendmsg$ETHTOOL_MSG_WOL_GET(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=ANY=[], 0x2c}, 0x1, 0x0, 0x0, 0x840}, 0x81) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000080)=ANY=[], 0xff2e) sendmsg$key(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000200)=ANY=[@ANYBLOB="020df9ffffffffffffff7000fbdbdf2561c0a7f6224c84b5c5aac33655bc486da3e0e1cedac3e802fc91048d98a2c31738d635e1196e2c2d23b10f1490a6d426bafe5ed13ce8f181c19accfcdc23551724019b2058708c0e6e43aa41460d9090e40bab53a9bd77ffffdb0476cd3edb"], 0x10}}, 0x40008841) 1.529179203s ago: executing program 2 (id=40): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fda000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, &(0x7f0000000200)="b805000000b9fa0000000f01d9660f78c4020a3ef32e650f09b805000000b90000c0fe0fae41d901000000b87f8b7f26ba000000000f30660fc775022e0fba600c980f320f3566b857000f20c035000000800f22c0", 0x55}], 0xaaaaaaaaaaaaaf6, 0x10, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fd6000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x4, 0x0, 0x0) ioctl$KVM_CAP_DISABLE_QUIRKS(r1, 0x4068aea3, &(0x7f0000000040)={0x74, 0x0, 0x54}) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f00000000c0)={0x28}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x1) fchdir(r4) rename(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file1\x00') 1.422964035s ago: executing program 1 (id=41): openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x1, 0x2, 0x0, 0x9, 0xffffffffffffffff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ff9}]}) r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x24020000) r2 = socket$tipc(0x1e, 0x2, 0x0) r3 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) r4 = socket$tipc(0x1e, 0x5, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x8) fallocate(r5, 0x66, 0x3, 0x6) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) sendmsg$tipc(r2, &(0x7f0000000280)={&(0x7f0000000040), 0x10, 0x0}, 0x0) sendmsg$tipc(r4, &(0x7f00000000c0)={&(0x7f0000000000)=@name={0x1e, 0x2, 0x0, {{0x0, 0x1}, 0x2}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x48001}, 0x20044095) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x400, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SMI(r8, 0xaeb7) r9 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x46900, 0x0) readv(r9, &(0x7f00000005c0)=[{&(0x7f0000004200)=""/4088, 0xff8}], 0x1) r10 = socket(0x10, 0x2, 0x0) sendmsg$nl_generic(r10, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000740)=ANY=[@ANYBLOB="12000000180001002bbd7000fbdbdf251d"], 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x4044800) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, 0xffffffffffffffff) ioctl$KVM_RUN(r8, 0xae80, 0x0) 1.422713895s ago: executing program 1 (id=42): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000900)={'syzkaller0\x00', 0x41}) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r1) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01000000000000000000010000000000000001410000001c0017fffffffd000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) write(r0, &(0x7f0000000500)="ffffffffffff00000000000188ca4f400028100000000000000001000001010000010100000200000000000000030000000000000000", 0x36) 1.402584046s ago: executing program 1 (id=43): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) mknod(0x0, 0x836fac3ed7542db, 0x2) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/78, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001680)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000240)={0x0, 0x0, 0x0, &(0x7f0000001d00)=""/176, 0x0, 0xffff1000}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x1}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socket(0x29, 0xa, 0x1) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$KVM_IRQ_LINE(r2, 0x4008ae61, &(0x7f0000000080)={0x80000000, 0x7}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180), 0x100, 0x0) r5 = dup(r4) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r3, &(0x7f0000000100)={@val={0xa, 0x10}, @void, @eth={@broadcast, @remote, @void, {@ipv6={0x86dd, @generic={0x9, 0x6, "17007e", 0x0, 0x2b, 0xff, @local, @mcast2}}}}}, 0x3a) r6 = socket$vsock_stream(0x28, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) connect$vsock_stream(r6, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x1}, 0x10) 1.336568148s ago: executing program 2 (id=44): r0 = syz_usb_connect$cdc_ncm(0x0, 0x7a, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902680002010040000904000001020e0000052406000105240000000d370f0100000000000000000006241a0000000c241b4800f3ff00050080050905810300020000000904010000020d00000904010102020d0000090582020004000000090503020002"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000000)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000080)={0x20, 0x80, 0x1c, {0x5, 0x28, 0x800, 0xfff9, 0x3ff, 0x1, 0x8000, 0x4, 0x1, 0x22, 0x4, 0x9}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_connect(0x2, 0x8f, &(0x7f0000000100)=ANY=[@ANYBLOB="12011001892563086e050450d1db0102030109027d0002a200000009044f040334e95f5b0a24010a00060201030c2408050600070d0a329ce20905860c0004f40804072501832f08000905000040008103ff0905091b08000c07800904b70104ff63200309050900ff03030004090502020002f7810609050303ff030840040705a6c6415a9f09058503"], 0x0) 994.934385ms ago: executing program 3 (id=45): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = gettid() timer_create(0x1, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r2, 0x0, r4, 0x0, 0x25a5, 0x4) vmsplice(r3, &(0x7f0000000600)=[{&(0x7f00000000c0)='*', 0x1}], 0x1, 0xd) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r6, r7, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000100)="d8df0f23b3b9ce000000b807000000ba000000000f301b8154fea900c1210680320000c4e28ddc8dcd000000c182fd3f0000c8b950020000b801000400b9a6080000b80000010066b87a000f00d80f300f300fc79d53bf0000c4b9e16dc30101220f01c3", 0x64}], 0x1, 0x14, 0x0, 0x0) r8 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r8, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r8, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r8, 0x1, 0x1a, &(0x7f0000000340)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe0}]}, 0x10) sendmmsg$inet(r8, &(0x7f0000003400)=[{{0x0, 0x0, &(0x7f00000005c0)}}, {{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000022c0)="3a23e634120d22900e74df6e1249d3810cde78ce99b22cb02db102f88979b655278efea504c8c1bdda465f83605eb33cb1b9e9169a7b7d58219872c333ed3c9fa3fad5f8ed4707d9ddcf77597495f43b8154980574d7eec5716e255816b5239eca8c76aa070c78aab315049a6279137d1cc1bbd03af9c2a37753c6735a0d703e48034157b70f5ddda289f166c96c845cb18b69349e59d486c5d1364822f37adacc36c236bb4fb9c59620ee4d41e5b54180098fdf7e776177c95fede734065d4127c61784d5710cf81480767620d7100276e419c668043c396e205d010d20db1b47e404d35657a70e797e214b77401fbbe3f218ad4555d05564de4816707fea0c3e42e082d5d694bde0d15896b7df1ff51b8c4e815191a83ed68ecce61fb4067157b6d448990716695bf445ecf0b68cc39164d15a389cfbe78e16756cfd987c4ba6dfe2a6c2f03c19ed9a6dcb6618b8c1e65de05b3dab737ce229421389a3469a02e8b22d1710bc8ff4d24b99c7351050a410853b2056f44f5c0253ae5215abc01146a86eb520c82cad6b97defb08b6e60d8f619d25000d3f88856a0a5cb118c705c2efe4451f324096241dda64d70c593ad97f538453e6fe8cf8d81a7c02647b18b0c624bfebecd5d84af086cc3c931a2248a57ed5076854bdf1c901dadd0681679e3b1abe2793399faa6bbbdc07f3137b591e8aad208f9f3e226f90b64ac71220612459b5e4278590ddf9e7800e55c02de45b4b72e7e806d300a6ad9216c72e5227878f22bb9a97f097797b71a853f8675a36b2457c187273bd7bc85c0246faf501e9ebf5de8b0b511a9fb92fd3163dcf08496a0307e3521b6874a22b0dc7f2e4cc91f3695f3b81f0c298555c5c2552797ab74cdf44c0ea40f7cbd4127e8a37dfa2", 0x282}], 0x1}}], 0x2, 0x4000000) r9 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x142, 0x14) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x2400, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) close(r11) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) write(r9, &(0x7f0000000080)='4', 0x1) ioctl$KVM_SET_LAPIC(r7, 0x4400ae8f, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, 0x0) fcntl$F_SET_RW_HINT(r8, 0x40c, &(0x7f0000000680)=0x5) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f0000000180)={"e5e46478b699322107ff4bdf36eb18b1", 0x0, 0x0, {0x2bf, 0x3f800}, {0x0, 0x5}, 0x6, [0x2, 0x7, 0x355d6b24, 0x0, 0x7, 0x7, 0x8, 0x2, 0x400, 0xffffffffffffffff, 0x4, 0x3ff, 0x52dd, 0x3, 0x0, 0x56]}) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3, 0x2}, 0x4) 765.792082ms ago: executing program 3 (id=46): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='oom_score_adj\x00') unshare(0x400) unshare(0x64000600) syz_open_dev$loop(&(0x7f0000000080), 0x7, 0x20800) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000005100), 0x600, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/uevent_helper', 0x82802, 0xf) r1 = syz_create_resource$binfmt(&(0x7f0000000000)='./file1\x00') socket$inet6_udplite(0xa, 0x2, 0x88) openat$binfmt(0xffffffffffffff9c, r1, 0x42, 0x1ff) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x50}, 0x2080) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r4 = mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) syz_ublk_setup_io_uring(0x5be0, &(0x7f00000004c0)={0x0, 0x2956, 0x20, 0x0, 0x381, 0x0, r0}, &(0x7f0000000540), &(0x7f0000000580), &(0x7f00000005c0)) syz_ublk_add_dev(0xffffffffffffffff, 0x0, r4, 0x0, &(0x7f0000000140)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x3, 0xc41, 0x0, 0x0, 0x1000, 0x800007, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) r8 = syz_io_uring_setup(0x5b17, &(0x7f0000000000)={0x0, 0xc995, 0x4000, 0x0, 0x2de, 0x0, r7}, &(0x7f0000000080), &(0x7f0000000100), &(0x7f00000001c0)) syz_ublk_setup_queues(r7, r5, &(0x7f0000000380)={0x0, 0x2, 0x1000, 0xfffffffe, 0x23c}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x704, 0x100, 0x1000000, 0x2033f, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffffff, 0x80, 0x0, 0xdd}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9b59, 0x10, 0x0, 0x8000000}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0x4000, 0x1, 0xdfffffff, 0x0, r8}}], 0x1, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000480)="2df32a", 0x3}], 0x1) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) symlinkat(0x0, 0xffffffffffffff9c, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/uac2.usb0\x00', 0x0) 665.105574ms ago: executing program 3 (id=47): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = syz_open_dev$evdev(&(0x7f0000000000), 0x2, 0x0) ioctl$EVIOCGABS3F(r2, 0x8018457f, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r3, 0x4080aebf, &(0x7f0000003680)=@vmx={0x0, 0x0, 0x2080, {0x0, 0x0, {}, 0x0, 0x2}}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000240)=[@textreal={0x8, &(0x7f0000000000)="360f01300fc5c2070f78a2c4cfbaf80c66b824cb008c66efbafc0ced0f20a20fc73afb0fc7aa7dcb6ff080ad600006", 0x2f}], 0x1, 0x2, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 539.851727ms ago: executing program 3 (id=48): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x10, 0x0, &(0x7f0000000940)=[@acquire={0x40086315}, @acquire={0x40046305, 0x1}], 0x0, 0x0, 0x0}) (fail_nth: 8) 33.690199ms ago: executing program 3 (id=49): unshare(0x24020400) r0 = open(&(0x7f00000001c0)='.\x00', 0x200140, 0x1a8) getdents(r0, 0x0, 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000180)="92c766cf6191603116fbb6e996c455ad71ba38f350d245749534ea1c2e2cb1eb6f46", 0x22) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r2 = open(&(0x7f0000000040)='./file0\x00', 0x400, 0x43) mknodat$loop(r2, &(0x7f0000000200)='./file1\x00', 0x800, 0x1) chdir(&(0x7f0000000140)='./bus\x00') creat(&(0x7f0000000100)='./file1\x00', 0x30) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', &(0x7f0000000240), 0x0, 0x0, 0x0) llistxattr(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) r3 = open(&(0x7f0000000040)='.\x00', 0x101480, 0x24) getdents64(r3, &(0x7f0000000fc0)=""/224, 0xe0) 0s ago: executing program 3 (id=50): r0 = socket(0x80000000000000a, 0x2, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r0, 0x8982, &(0x7f0000000040)={0x8, 'vlan0\x00', {'sit0\x00'}, 0x4}) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f00000003c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000380)={&(0x7f0000000500)=ANY=[@ANYBLOB="2c000000ca0a6175ef7f74376b21b6044addcdb763636465b43201630495b69af1121fe3b3718f8671879f80ee5128490e7a5bea29", @ANYRES16=0x0, @ANYBLOB="01032cbd7000fddbdf2502000000080061000000000005003e00080000000800690034000000"], 0x2c}, 0x1, 0x0, 0x0, 0x48041}, 0x4008080) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x100, 0x70bd2c, 0x25dfdbfc}, 0x1c}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)={@multicast1, @local}, 0xc) r2 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)=ANY=[@ANYBLOB="2400000022000106"], 0x24}], 0x1}, 0x0) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$IPCTNL_MSG_EXP_GET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000006640)={&(0x7f0000000240)=ANY=[@ANYBLOB="580000000102"], 0x58}, 0x1, 0x0, 0x0, 0xc0}, 0x8d0) ioctl$KVM_NMI(r4, 0xae9a) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000440)={[0x0, 0x100000000, 0x0, 0x7f, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x0, 0x2, 0xffffffffffffffff], 0x0, 0x102280}) ioctl$KVM_RUN(r4, 0xae80, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r5 = userfaultfd(0x80001) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_COPY(r5, 0xc028aa05, &(0x7f0000000180)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00003ab000/0x2000)=nil, 0x400000, 0x2, 0x2}) socket$packet(0x11, 0x2, 0x300) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r6, &(0x7f0000000240)=ANY=[@ANYBLOB="0000891f0180c200000ebbbbbbbbbbbb08004500007800670000032f9078e000000164010101a00086d900649078829cdfd11383065d5d2105706cf3f4df30727999a87ec235255b9421d24b3b14295a4c21c9593e77db0989ce40cd9756db3151fefdc97e4f11a2c04ab2a70346ad4cb89b18a57fbccc6210a363064f"], 0x8a) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000002c0)={[0x100, 0x5, 0x6, 0x4002, 0x9, 0x5, 0xefffffffffffffff, 0x0, 0xffffffffffffffff, 0x2000001, 0x0, 0x40000000001c, 0x1, 0xffffffffffffffff, 0x100], 0x0, 0x41801}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.84' (ED25519) to the list of known hosts. [ 23.093671][ T36] audit: type=1400 audit(1785443042.470:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.096367][ T286] cgroup: Unknown subsys name 'net' [ 23.116500][ T36] audit: type=1400 audit(1785443042.470:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.143857][ T36] audit: type=1400 audit(1785443042.500:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.144151][ T286] cgroup: Unknown subsys name 'devices' [ 23.264213][ T286] cgroup: Unknown subsys name 'hugetlb' [ 23.269938][ T286] cgroup: Unknown subsys name 'rlimit' [ 23.384665][ T36] audit: type=1400 audit(1785443042.760:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.407838][ T36] audit: type=1400 audit(1785443042.760:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 23.430861][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 23.432992][ T36] audit: type=1400 audit(1785443042.760:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.464241][ T36] audit: type=1400 audit(1785443042.820:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.469188][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.490290][ T36] audit: type=1400 audit(1785443042.820:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.524063][ T36] audit: type=1400 audit(1785443042.840:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.549575][ T36] audit: type=1400 audit(1785443042.840:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.927840][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.935561][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.942675][ T293] bridge_slave_0: entered allmulticast mode [ 24.948942][ T293] bridge_slave_0: entered promiscuous mode [ 24.956950][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.964013][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.971068][ T295] bridge_slave_0: entered allmulticast mode [ 24.977369][ T295] bridge_slave_0: entered promiscuous mode [ 24.983672][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.990719][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.997799][ T293] bridge_slave_1: entered allmulticast mode [ 25.004006][ T293] bridge_slave_1: entered promiscuous mode [ 25.011699][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.018915][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.026043][ T295] bridge_slave_1: entered allmulticast mode [ 25.032343][ T295] bridge_slave_1: entered promiscuous mode [ 25.063953][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.070996][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.078181][ T296] bridge_slave_0: entered allmulticast mode [ 25.084442][ T296] bridge_slave_0: entered promiscuous mode [ 25.092766][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.099808][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.106909][ T296] bridge_slave_1: entered allmulticast mode [ 25.113126][ T296] bridge_slave_1: entered promiscuous mode [ 25.150694][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.157798][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.164898][ T294] bridge_slave_0: entered allmulticast mode [ 25.171093][ T294] bridge_slave_0: entered promiscuous mode [ 25.182207][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.189275][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.196379][ T294] bridge_slave_1: entered allmulticast mode [ 25.202757][ T294] bridge_slave_1: entered promiscuous mode [ 25.306762][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.313933][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.321216][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.328281][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.351295][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.358467][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.365759][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.372802][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.390966][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.398051][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.405350][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.412404][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.430253][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.437522][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.444831][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.451863][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.477825][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.485265][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.492618][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.499801][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.507498][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.514771][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.521947][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.534806][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.541846][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.568006][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.575105][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.584339][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.591397][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.604772][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.611828][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.619479][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.626523][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.654638][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.661786][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.684262][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.691303][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.716157][ T295] veth0_vlan: entered promiscuous mode [ 25.727854][ T293] veth0_vlan: entered promiscuous mode [ 25.750791][ T294] veth0_vlan: entered promiscuous mode [ 25.757307][ T295] veth1_macvtap: entered promiscuous mode [ 25.763771][ T296] veth0_vlan: entered promiscuous mode [ 25.774783][ T293] veth1_macvtap: entered promiscuous mode [ 25.799806][ T294] veth1_macvtap: entered promiscuous mode [ 25.816572][ T296] veth1_macvtap: entered promiscuous mode [ 25.824299][ T295] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 25.916260][ T319] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2'. [ 25.944144][ T322] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 26.000718][ T328] FAULT_INJECTION: forcing a failure. [ 26.000718][ T328] name failslab, interval 1, probability 0, space 0, times 1 [ 26.013801][ T328] CPU: 0 UID: 0 PID: 328 Comm: syz.0.7 Not tainted syzkaller #0 0b31bef96cff8e44f9e14c4f768eb06c85e3b290 [ 26.013831][ T328] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.013850][ T328] Call Trace: [ 26.013856][ T328] [ 26.013864][ T328] __dump_stack+0x21/0x30 [ 26.013911][ T328] dump_stack_lvl+0x140/0x1c0 [ 26.013938][ T328] ? __cfi_dump_stack_lvl+0x10/0x10 [ 26.013965][ T328] ? release_sock+0x171/0x1f0 [ 26.013991][ T328] dump_stack+0x19/0x20 [ 26.014016][ T328] should_fail_ex+0x3c2/0x510 [ 26.014039][ T328] should_failslab+0xac/0x100 [ 26.014062][ T328] kmem_cache_alloc_node_noprof+0x45/0x420 [ 26.014083][ T328] ? netlink_data_ready+0x20/0x20 [ 26.014112][ T328] ? __alloc_skb+0x10c/0x360 [ 26.014138][ T328] __alloc_skb+0x10c/0x360 [ 26.014164][ T328] netlink_alloc_large_skb+0xf7/0x1b0 [ 26.014192][ T328] netlink_sendmsg+0x576/0xad0 [ 26.014247][ T328] ? __cfi_netlink_sendmsg+0x10/0x10 [ 26.014281][ T328] ? bpf_lsm_socket_sendmsg+0xd/0x20 [ 26.014302][ T328] ? security_socket_sendmsg+0x3d/0x100 [ 26.014329][ T328] ____sys_sendmsg+0x99e/0xa00 [ 26.014349][ T328] ? __import_iovec+0x5b9/0x7d0 [ 26.014376][ T328] ? __sys_sendmsg_sock+0x50/0x50 [ 26.014397][ T328] ? import_iovec+0x80/0xb0 [ 26.014423][ T328] ___sys_sendmsg+0x2a6/0x370 [ 26.014443][ T328] ? __sys_sendmsg+0x2a0/0x2a0 [ 26.014462][ T328] ? proc_fail_nth_write+0x184/0x220 [ 26.014490][ T328] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 26.014522][ T328] ? __fget_files+0x2bc/0x330 [ 26.014546][ T328] __x64_sys_sendmsg+0x206/0x2e0 [ 26.014565][ T328] ? fput+0x1a4/0x230 [ 26.014589][ T328] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 26.014608][ T328] ? ksys_write+0x1f3/0x260 [ 26.014630][ T328] ? __kasan_check_read+0x15/0x20 [ 26.014649][ T328] x64_sys_call+0x2a4c/0x2ee0 [ 26.014666][ T328] do_syscall_64+0x57/0xf0 [ 26.014687][ T328] ? clear_bhb_loop+0x50/0xa0 [ 26.014712][ T328] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 26.014737][ T328] RIP: 0033:0x7fe52cd9e019 [ 26.014753][ T328] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 26.014769][ T328] RSP: 002b:00007fe52db92028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 26.014795][ T328] RAX: ffffffffffffffda RBX: 00007fe52d025fa0 RCX: 00007fe52cd9e019 [ 26.014809][ T328] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 0000000000000003 [ 26.014822][ T328] RBP: 00007fe52db92090 R08: 0000000000000000 R09: 0000000000000000 [ 26.014834][ T328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 26.014845][ T328] R13: 00007fe52d026038 R14: 00007fe52d025fa0 R15: 00007ffe606550a8 [ 26.014862][ T328] [ 26.179762][ T337] binder: Bad value for 'max' [ 26.305030][ T333] process 'syz.0.8' launched './file0' with NULL argv: empty string added [ 26.342461][ T10] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 26.404456][ T341] tipc: Started in network mode [ 26.409498][ T341] tipc: Node identity 8687fd99ca3, cluster identity 4711 [ 26.417471][ T341] tipc: Enabled bearer , priority 10 [ 26.429043][ T340] tipc: Resetting bearer [ 26.440913][ T340] tipc: Disabling bearer [ 26.494770][ T10] usb 3-1: New USB device found, idVendor=0403, idProduct=fa78, bcdDevice=ab.79 [ 26.504125][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.512360][ T10] usb 3-1: Product: syz [ 26.516619][ T10] usb 3-1: Manufacturer: syz [ 26.521235][ T10] usb 3-1: SerialNumber: syz [ 26.552920][ T10] ftdi_sio 3-1:4.0: FTDI USB Serial Device converter detected [ 26.575789][ T351] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer. [ 26.594550][ T10] ftdi_sio ttyUSB0: unknown device type: 0xab79 [ 26.650031][ T356] overlayfs: conflicting options: verity=on,redirect_dir=follow [ 26.972356][ T310] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 27.142725][ T310] usb 1-1: Using ep0 maxpacket: 16 [ 27.149138][ T310] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 27.160322][ T310] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 96 [ 27.170509][ T310] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 27.180678][ T310] usb 1-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 27.195297][ T310] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 27.204653][ T310] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 27.213762][ T310] usb 1-1: SerialNumber: syz [ 27.219764][ T362] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 27.227018][ T362] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 27.235759][ T310] hub 1-1:1.0: bad descriptor, ignoring hub [ 27.241730][ T310] hub 1-1:1.0: probe with driver hub failed with error -5 [ 27.437752][ T362] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 27.445195][ T362] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 27.481452][ T370] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=61457 sclass=netlink_route_socket pid=370 comm=syz.3.19 [ 27.805090][ T375] rust_binder: Write failure EINVAL in pid:17 [ 27.857619][ T310] cdc_ether 1-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.0-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 28.010970][ T399] Zero length message leads to an empty skb [ 28.082126][ T385] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 28.233763][ T382] netlink: 188 bytes leftover after parsing attributes in process `syz.1.24'. [ 28.248288][ T385] usb 2-1: unable to get BOS descriptor or descriptor too short [ 28.257182][ T385] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 28.264785][ T385] usb 2-1: can't read configurations, error -71 [ 28.278803][ T10] usb 1-1: USB disconnect, device number 2 [ 28.285597][ T10] cdc_ether 1-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.0-1, CDC Ethernet Device [ 28.760946][ T431] tipc: Started in network mode [ 28.765892][ T431] tipc: Node identity , cluster identity 4711 [ 28.824345][ T36] kauditd_printk_skb: 91 callbacks suppressed [ 28.824363][ T36] audit: type=1400 audit(1785443048.200:165): avc: denied { connect } for pid=438 comm="syz.0.30" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 28.855323][ T36] audit: type=1400 audit(1785443048.200:166): avc: denied { name_bind } for pid=438 comm="syz.0.30" src=3618 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 28.882020][ T10] usb 3-1: USB disconnect, device number 2 [ 28.888688][ T10] ftdi_sio 3-1:4.0: device disconnected [ 28.908292][ T36] audit: type=1400 audit(1785443048.280:167): avc: denied { read } for pid=440 comm="syz.0.31" name="event0" dev="devtmpfs" ino=192 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 28.940103][ T36] audit: type=1400 audit(1785443048.280:168): avc: denied { open } for pid=440 comm="syz.0.31" path="/dev/input/event0" dev="devtmpfs" ino=192 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 28.978405][ T446] tipc: Enabling of bearer rejected, failed to enable media [ 28.997932][ T448] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 29.011068][ T36] audit: type=1400 audit(1785443048.380:169): avc: denied { mmap_zero } for pid=447 comm="syz.2.34" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 29.030625][ T36] audit: type=1400 audit(1785443048.380:170): avc: denied { map } for pid=447 comm="syz.2.34" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=6059 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 29.055008][ T36] audit: type=1400 audit(1785443048.380:171): avc: denied { read write } for pid=447 comm="syz.2.34" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=6059 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 29.067488][ T448] netlink: 72 bytes leftover after parsing attributes in process `syz.2.34'. [ 29.079957][ T36] audit: type=1400 audit(1785443048.380:172): avc: denied { map } for pid=447 comm="syz.2.34" path="socket:[6058]" dev="sockfs" ino=6058 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 29.088564][ T31] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 29.113857][ T441] overlayfs: overlapping lowerdir path [ 29.120275][ T36] audit: type=1400 audit(1785443048.430:173): avc: denied { read write } for pid=447 comm="syz.2.34" name="fuse" dev="devtmpfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 29.124722][ T385] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 29.147264][ T36] audit: type=1400 audit(1785443048.430:174): avc: denied { open } for pid=447 comm="syz.2.34" path="/dev/fuse" dev="devtmpfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 29.214441][ T457] dummy_hcd dummy_hcd.0: remove, state 1 [ 29.282129][ T9] hub 1-0:1.0: activate --> -108 [ 29.287198][ T457] usb usb1: USB disconnect, device number 1 [ 29.295305][ T457] dummy_hcd dummy_hcd.0: stopped [ 29.300369][ T457] dummy_hcd dummy_hcd.0: USB bus 1 deregistered [ 29.307779][ T31] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid maxpacket 1015, setting to 64 [ 29.318869][ T31] usb 4-1: config 0 interface 0 has no altsetting 0 [ 29.325007][ T385] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 29.325578][ T31] usb 4-1: New USB device found, idVendor=05ac, idProduct=029a, bcdDevice= 0.00 [ 29.339623][ T385] usb 2-1: config 0 has no interfaces? [ 29.345926][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.362257][ T385] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 29.366746][ T31] usb 4-1: config 0 descriptor?? [ 29.371380][ T385] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.384562][ T385] usb 2-1: config 0 descriptor?? [ 29.403929][ T437] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 29.599365][ T385] usb 2-1: USB disconnect, device number 3 [ 29.813319][ T31] apple 0003:05AC:029A.0001: item 0 0 0 8 parsing failed [ 29.820633][ T31] apple 0003:05AC:029A.0001: parse failed [ 29.826470][ T31] apple 0003:05AC:029A.0001: probe with driver apple failed with error -22 [ 30.015567][ T437] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 30.024229][ T437] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 30.033225][ T310] usb 4-1: USB disconnect, device number 2 [ 30.362431][ T469] kvm: kvm [468]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0xc1) = 0xfffffc00 [ 30.371387][ T469] kvm: kvm [468]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0xc2) = 0xfffffc00 [ 30.383215][ T469] kvm: kvm [468]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0x11e) = 0xfffffc00 [ 30.395083][ T469] kvm: kvm [468]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0x186) = 0xfffffc00 [ 30.404268][ T469] kvm: kvm [468]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0x187) = 0xfffffc00 [ 30.428079][ T475] tipc: Enabling of bearer rejected, failed to enable media [ 30.752169][ T310] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 30.903248][ T310] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 30.914420][ T310] usb 3-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 30.926073][ T310] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 30.935257][ T310] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.943309][ T310] usb 3-1: Product: syz [ 30.947513][ T310] usb 3-1: Manufacturer: syz [ 30.952138][ T310] usb 3-1: SerialNumber: syz [ 30.958648][ T310] cdc_mbim 3-1:1.0: skipping garbage [ 30.981173][ T482] kvm: kvm [481]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x9d00 [ 31.159043][ T480] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 31.265593][ T491] FAULT_INJECTION: forcing a failure. [ 31.265593][ T491] name failslab, interval 1, probability 0, space 0, times 0 [ 31.278397][ T491] CPU: 1 UID: 0 PID: 491 Comm: syz.3.48 Not tainted syzkaller #0 0b31bef96cff8e44f9e14c4f768eb06c85e3b290 [ 31.278427][ T491] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 31.278440][ T491] Call Trace: [ 31.278447][ T491] [ 31.278455][ T491] __dump_stack+0x21/0x30 [ 31.278495][ T491] dump_stack_lvl+0x140/0x1c0 [ 31.278526][ T491] ? __cfi_dump_stack_lvl+0x10/0x10 [ 31.278560][ T491] dump_stack+0x19/0x20 [ 31.278590][ T491] should_fail_ex+0x3c2/0x510 [ 31.278616][ T491] should_failslab+0xac/0x100 [ 31.278644][ T491] __kmalloc_node_track_caller_noprof+0x65/0x4f0 [ 31.278671][ T491] ? _RNvMs_NtNtCswPamI0U300_11rust_binder7process6freezeNtB4_13FreezeMessage3new+0x53/0x1f0 [ 31.278715][ T491] krealloc_noprof+0x8d/0x130 [ 31.278740][ T491] _RNvMs_NtNtCswPamI0U300_11rust_binder7process6freezeNtB4_13FreezeMessage3new+0x53/0x1f0 [ 31.278780][ T491] ? __kasan_check_write+0x18/0x20 [ 31.278811][ T491] _RNvMs2_NtCswPamI0U300_11rust_binder6threadNtB5_6Thread5write+0x775/0x86d0 [ 31.278852][ T491] ? is_bpf_text_address+0x17b/0x1a0 [ 31.278886][ T491] ? kernel_text_address+0xa9/0xe0 [ 31.278918][ T491] ? __kernel_text_address+0x11/0x40 [ 31.278948][ T491] ? unwind_get_return_address+0x51/0x90 [ 31.278977][ T491] ? arch_stack_walk+0x10a/0x170 [ 31.279004][ T491] ? is_bpf_text_address+0x17b/0x1a0 [ 31.279038][ T491] ? __cfi__RNvMs2_NtCswPamI0U300_11rust_binder6threadNtB5_6Thread5write+0x10/0x10 [ 31.279074][ T491] ? kernel_text_address+0xa9/0xe0 [ 31.279104][ T491] ? __kernel_text_address+0x11/0x40 [ 31.279134][ T491] ? unwind_get_return_address+0x51/0x90 [ 31.279162][ T491] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 31.279190][ T491] ? arch_stack_walk+0x10a/0x170 [ 31.279215][ T491] ? stack_depot_save_flags+0x38/0x800 [ 31.279243][ T491] ? kasan_save_alloc_info+0x3a/0x50 [ 31.279277][ T491] ? kasan_save_track+0x4f/0x80 [ 31.279317][ T491] ? kasan_save_track+0x3e/0x80 [ 31.279341][ T491] ? kasan_save_alloc_info+0x3a/0x50 [ 31.279380][ T491] ? __kasan_kmalloc+0x96/0xb0 [ 31.279402][ T491] ? __kmalloc_node_track_caller_noprof+0x24e/0x4f0 [ 31.279425][ T491] ? _RNvMs4_NtCswPamI0U300_11rust_binder7processNtB5_7Process18get_current_thread+0x7d7/0x18e0 [ 31.279457][ T491] ? _RNvCswPamI0U300_11rust_binder17rust_binder_ioctl+0x379/0x3fe0 [ 31.279484][ T491] ? __se_sys_ioctl+0x132/0x1b0 [ 31.279507][ T491] ? __x64_sys_ioctl+0x7f/0xa0 [ 31.279529][ T491] ? x64_sys_call+0x1878/0x2ee0 [ 31.279546][ T491] ? do_syscall_64+0x57/0xf0 [ 31.279568][ T491] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 31.279599][ T491] ? __kasan_kmalloc+0x96/0xb0 [ 31.279622][ T491] ? kasan_save_alloc_info+0x3a/0x50 [ 31.279650][ T491] ? __kasan_kmalloc+0x96/0xb0 [ 31.279673][ T491] ? __kasan_check_write+0x18/0x20 [ 31.279692][ T491] ? _raw_spin_lock+0x92/0x120 [ 31.279713][ T491] ? __cfi__raw_spin_lock+0x10/0x10 [ 31.279735][ T491] ? _RNvMs4_NtCswPamI0U300_11rust_binder7processNtB5_7Process18get_current_thread+0xf30/0x18e0 [ 31.279770][ T491] ? __cfi__RNvMs4_NtCswPamI0U300_11rust_binder7processNtB5_7Process18get_current_thread+0x10/0x10 [ 31.279809][ T491] ? _RNvCswPamI0U300_11rust_binder17rust_binder_ioctl+0x1952/0x3fe0 [ 31.279836][ T491] ? __asan_memcpy+0x5a/0x80 [ 31.279855][ T491] _RNvCswPamI0U300_11rust_binder17rust_binder_ioctl+0x199a/0x3fe0 [ 31.279884][ T491] ? __asan_set_shadow_00+0x12/0x20 [ 31.279911][ T491] ? do_vfs_ioctl+0x182d/0x2010 [ 31.279933][ T491] ? arch_stack_walk+0x10a/0x170 [ 31.279952][ T491] ? __ia32_compat_sys_ioctl+0x920/0x920 [ 31.279976][ T491] ? __cfi__RNvCswPamI0U300_11rust_binder17rust_binder_ioctl+0x10/0x10 [ 31.280005][ T491] ? _parse_integer+0x2e/0x40 [ 31.280027][ T491] ? ioctl_has_perm+0x39a/0x500 [ 31.280046][ T491] ? has_cap_mac_admin+0xd0/0xd0 [ 31.280067][ T491] ? selinux_file_ioctl+0x732/0x1480 [ 31.280086][ T491] ? vfs_write+0xbcf/0xfd0 [ 31.280105][ T491] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 31.280124][ T491] ? __cfi_vfs_write+0x10/0x10 [ 31.280143][ T491] ? __kasan_check_write+0x18/0x20 [ 31.280161][ T491] ? mutex_unlock+0x90/0x240 [ 31.280184][ T491] ? __cfi_mutex_unlock+0x10/0x10 [ 31.280210][ T491] ? bpf_lsm_file_ioctl+0xd/0x20 [ 31.280232][ T491] ? security_file_ioctl+0x3e/0x110 [ 31.280260][ T491] ? __cfi__RNvCswPamI0U300_11rust_binder17rust_binder_ioctl+0x10/0x10 [ 31.280285][ T491] __se_sys_ioctl+0x132/0x1b0 [ 31.280308][ T491] __x64_sys_ioctl+0x7f/0xa0 [ 31.280328][ T491] x64_sys_call+0x1878/0x2ee0 [ 31.280345][ T491] do_syscall_64+0x57/0xf0 [ 31.280365][ T491] ? clear_bhb_loop+0x50/0xa0 [ 31.280389][ T491] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 31.280413][ T491] RIP: 0033:0x7f913a39e019 [ 31.280429][ T491] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 31.280445][ T491] RSP: 002b:00007f913b323028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 31.280465][ T491] RAX: ffffffffffffffda RBX: 00007f913a625fa0 RCX: 00007f913a39e019 [ 31.280480][ T491] RDX: 00002000000003c0 RSI: 00000000c0306201 RDI: 0000000000000003 [ 31.280492][ T491] RBP: 00007f913b323090 R08: 0000000000000000 R09: 0000000000000000 [ 31.280504][ T491] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 31.280516][ T491] R13: 00007f913a626038 R14: 00007f913a625fa0 R15: 00007fff58d03e88 [ 31.280532][ T491] [ 31.280565][ T491] rust_binder: Write failure ENOMEM in pid:37 [ 31.825062][ T493] overlayfs: failed to resolve './file0': -2 [ 31.885916][ T441] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI [ 31.898566][ T441] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 31.907015][ T441] CPU: 0 UID: 0 PID: 441 Comm: syz.0.31 Not tainted syzkaller #0 0b31bef96cff8e44f9e14c4f768eb06c85e3b290 [ 31.918311][ T441] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 31.928383][ T441] RIP: 0010:set_link_state+0x2a/0x1240 [ 31.933876][ T441] Code: 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 60 49 89 fd 48 bb 00 00 00 00 00 fc ff df e8 dd 01 ce fd 4c 89 e8 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 ef e8 b8 c4 26 fe 4d 8b 75 00 49 8d 95 93 [ 31.953495][ T441] RSP: 0018:ffffc9000b887718 EFLAGS: 00010046 [ 31.959580][ T441] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff8881166e9300 [ 31.967561][ T441] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 31.975540][ T441] RBP: ffffc9000b8877a0 R08: 0000000000000003 R09: 0000000000000004 [ 31.983524][ T441] R10: dffffc0000000000 R11: fffff52001710ee0 R12: 0000000000000000 [ 31.991502][ T441] R13: 0000000000000000 R14: 0000000000000000 R15: ffff888104b90000 [ 31.999479][ T441] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 32.008417][ T441] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.015016][ T441] CR2: 000000110c336edf CR3: 00000001185f6000 CR4: 00000000003526b0 [ 32.022995][ T441] Call Trace: [ 32.026290][ T441] [ 32.029235][ T441] ? __kasan_check_write+0x18/0x20 [ 32.034392][ T441] dummy_pullup+0xd1/0x130 [ 32.038834][ T441] ? __cfi_dummy_pullup+0x10/0x10 [ 32.043881][ T441] usb_gadget_disconnect_locked+0x151/0x400 [ 32.049795][ T441] gadget_unbind_driver+0xaf/0x3f0 [ 32.054919][ T441] ? __cfi_gadget_unbind_driver+0x10/0x10 [ 32.060682][ T441] device_release_driver_internal+0x4ad/0x830 [ 32.066773][ T441] driver_detach+0x1f5/0x2d0 [ 32.071378][ T441] bus_remove_driver+0x254/0x2b0 [ 32.076329][ T441] driver_unregister+0x79/0xb0 [ 32.081094][ T441] usb_gadget_unregister_driver+0x52/0x80 [ 32.086820][ T441] raw_release+0xdb/0x280 [ 32.091159][ T441] ? __cfi_raw_release+0x10/0x10 [ 32.096105][ T441] __fput+0x208/0xa30 [ 32.100199][ T441] ____fput+0x20/0x30 [ 32.104193][ T441] task_work_run+0x1e8/0x260 [ 32.108801][ T441] ? __cfi_task_work_run+0x10/0x10 [ 32.113933][ T441] ? __kasan_check_write+0x18/0x20 [ 32.119058][ T441] do_exit+0xa46/0x2850 [ 32.123271][ T441] ? preempt_schedule_irq+0xab/0x110 [ 32.128571][ T441] ? __cfi_do_exit+0x10/0x10 [ 32.133182][ T441] ? raw_irqentry_exit_cond_resched+0x32/0x40 [ 32.139251][ T441] ? irqentry_exit+0x4a/0x60 [ 32.143850][ T441] ? sysvec_reschedule_ipi+0x72/0x80 [ 32.149158][ T441] do_group_exit+0x21f/0x2f0 [ 32.153768][ T441] get_signal+0x134c/0x1490 [ 32.158294][ T441] arch_do_signal_or_restart+0xbc/0x700 [ 32.163850][ T441] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 32.170012][ T441] syscall_exit_to_user_mode+0x57/0xb0 [ 32.175505][ T441] do_syscall_64+0x63/0xf0 [ 32.179926][ T441] ? clear_bhb_loop+0x50/0xa0 [ 32.184615][ T441] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 32.190521][ T441] RIP: 0033:0x7fe52cd9e019 [ 32.194942][ T441] Code: Unable to access opcode bytes at 0x7fe52cd9dfef. [ 32.201959][ T441] RSP: 002b:00007fe52db920e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 32.210376][ T441] RAX: fffffffffffffe00 RBX: 00007fe52d025fa8 RCX: 00007fe52cd9e019 [ 32.218362][ T441] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fe52d025fa8 [ 32.226347][ T441] RBP: 00007fe52d025fa0 R08: 0000000000000000 R09: 0000000000000000 [ 32.234351][ T441] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 32.242335][ T441] R13: 00007fe52d026038 R14: 00007ffe60654fc0 R15: 00007ffe606550a8 [ 32.250315][ T441] [ 32.253340][ T441] Modules linked in: [ 32.257253][ T441] ---[ end trace 0000000000000000 ]--- [ 32.262714][ T441] RIP: 0010:set_link_state+0x2a/0x1240 [ 32.268220][ T441] Code: 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 60 49 89 fd 48 bb 00 00 00 00 00 fc ff df e8 dd 01 ce fd 4c 89 e8 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 ef e8 b8 c4 26 fe 4d 8b 75 00 49 8d 95 93 [ 32.287846][ T441] RSP: 0018:ffffc9000b887718 EFLAGS: 00010046 [ 32.293928][ T441] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff8881166e9300 [ 32.301999][ T441] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 32.310009][ T441] RBP: ffffc9000b8877a0 R08: 0000000000000003 R09: 0000000000000004 [ 32.318068][ T441] R10: dffffc0000000000 R11: fffff52001710ee0 R12: 0000000000000000 [ 32.326057][ T441] R13: 0000000000000000 R14: 0000000000000000 R15: ffff888104b90000 [ 32.334088][ T441] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 32.343031][ T441] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.349630][ T441] CR2: 000000110c336edf CR3: 00000001185f6000 CR4: 00000000003526b0 [ 32.357614][ T441] Kernel panic - not syncing: Fatal exception [ 32.364257][ T441] Kernel Offset: disabled [ 32.368597][ T441] Rebooting in 86400 seconds..