last executing test programs: 6.274888459s ago: executing program 1 (id=63): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @local}, 0x47) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000180)=0x100000001, 0x4) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000240)=[@window={0x3, 0x8, 0x3}, @sack_perm, @timestamp, @timestamp, @sack_perm, @timestamp, @mss={0x2, 0xfffffffd}, @sack_perm], 0x8) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000002c0), 0x4) sendto$inet(r0, &(0x7f0000000300)='<', 0xffffffffffffffef, 0x4805, 0x0, 0xfe8d) getpeername$inet(r0, 0x0, &(0x7f0000000380)) 5.383415852s ago: executing program 1 (id=74): r0 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$x86(r2, &(0x7f0000000100)={0x0, &(0x7f0000000140)=[@wrmsr={0x65, 0x20, {0xa64, 0x1ff}}, @rdmsr={0x66, 0x18}, @nested_amd_vmload={0x182, 0x18}, @out_dx={0x6a, 0x28, {0xdebd, 0x0, 0x9}}, @nested_vmlaunch={0x12f, 0x18, 0x2}, @wr_drn={0x68, 0x20, {0x5}}, @nested_vmresume={0x130, 0x18, 0x2}, @nested_amd_clgi={0x17f, 0x10}, @nested_set_state_pages={0x140, 0x28, {0x3, 0x32, @gpa=0xa000}}, @enable_nested={0x12c, 0x18}, @nested_amd_vmload={0x182, 0x18}, @nested_amd_invlpga={0x17d, 0x20, {0xfec00000, 0x85c7}}, @in_dx={0x69, 0x20, {0xc180, 0x6}}, @nested_amd_invlpga={0x17d, 0x20, {0xdddd0000, 0xf52c}}, @set_irq_handler={0xc8, 0x20, {0xd0, 0x2}}, @nested_amd_invlpga={0x17d, 0x20, {0xc000, 0x910e}}, @nested_load_code={0x12e, 0x54, {0x2, "f3420f2b420e0fc7b24fb2000026f3440f019df8ffffff66b8de000f00d82ef20f350f01df363664f30fbdcd460f01d166b83a008ec866b895008ed0"}}], 0x224}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r3 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) fchdir(r4) r5 = open(0x0, 0x143142, 0x80) r6 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0xc0940, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./bus\x00', 0x1c1002, 0x0) write(r7, &(0x7f0000000680)='t', 0x1) sendfile(r7, r6, 0x0, 0x7fffffff) ftruncate(r5, 0x2007ffb) sendfile(r5, r7, 0x0, 0x1000000201005) 4.72356578s ago: executing program 0 (id=77): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x11, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x1}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000001ac0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r3, &(0x7f0000001b00)=ANY=[@ANYBLOB="1500000065ffff018000000800395032303030"], 0x15) r4 = dup(r3) write$FUSE_BMAP(r4, &(0x7f0000001b40)={0x18, 0x0, 0x0, {0x8}}, 0x18) write$FUSE_DIRENTPLUS(r4, &(0x7f0000001b80)=ANY=[@ANYBLOB="3801"], 0x138) mount$9p_fd(0x0, &(0x7f0000001bc0)='./file0\x00', &(0x7f0000001c00), 0x0, &(0x7f0000001c40)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r3}}) 4.557150497s ago: executing program 0 (id=78): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x3, 0x0) r0 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000180)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) write(0xffffffffffffffff, &(0x7f0000000140)='p', 0x1) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet6(0xa, 0x2, 0x3a) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) syz_ublk_setup_io_uring(0x467c, &(0x7f0000000140)={0x0, 0xcfab, 0x8000, 0x0, 0x118}, &(0x7f0000000280), &(0x7f00000002c0), &(0x7f00000003c0)) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup(r4) syz_ublk_setup_queues(r5, r3, 0x0, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe706, 0x1000, 0x3, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b40, 0x2, 0x4, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93f9, 0x8000, 0x4003bfff, 0x2b8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x3, 0x8}}], 0x1, 0x0, 0x0) 4.430903681s ago: executing program 2 (id=80): r0 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000480)={0xa, 0x4e20, 0x400, @loopback, 0x7}, 0x1c) listen(r0, 0xb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f00000005c0)={0xa, 0x4e20, 0x9, @loopback, 0x106}, 0x1c) r2 = fcntl$dupfd(r1, 0x406, r1) setsockopt$inet6_buf(r1, 0x29, 0x39, &(0x7f0000000640)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) write$binfmt_elf64(r2, &(0x7f0000000680)=ANY=[], 0xfffffdcf) close(0x3) r3 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) r4 = openat(0xffffffffffffff9c, 0x0, 0x22801, 0x0) write$FUSE_ENTRY(r4, 0x0, 0x0) syz_fuse_handle_req(r3, 0x0, 0x0, 0x0) syz_fuse_handle_req(r3, 0x0, 0x0, 0x0) 4.388490575s ago: executing program 1 (id=82): r0 = socket$inet6(0xa, 0x1, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e1f, 0x6, @loopback, 0x2}, 0x1c) bind$inet6(r0, &(0x7f0000000c00)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x20000808, &(0x7f0000000c40)={0xa, 0x4e20, 0x8, @loopback, 0xdbb}, 0x1c) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000002c0)=0x8) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000300)={0x0, 0x989680}, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="14000000420005"], 0x14}, 0x1, 0x0, 0x0, 0x68840}, 0x4) recvmmsg(r2, &(0x7f00000001c0)=[{{0x0, 0x0, 0x0}, 0x2}], 0x1, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000cc0), r0) 4.34186273s ago: executing program 1 (id=86): mkdir(&(0x7f0000000100)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) chdir(&(0x7f0000000240)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file1\x00', 0x101042, 0x1db) ioctl$FS_IOC_RESVSP(r0, 0xc0189436, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0xffffff6a) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) writev(r0, &(0x7f0000001480)=[{&(0x7f0000000440)="f5", 0x1}], 0x1) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x40010003, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, 0x0, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x45, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) 4.34148949s ago: executing program 2 (id=87): r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040), 0xa8402, 0x0) write$vga_arbiter(r0, &(0x7f0000000080)=ANY=[], 0xb) r1 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_RESET_OWNER(r1, 0xaf02, 0x0) exit(0x3) read$FUSE(0xffffffffffffffff, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x54, r4, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @local}}, {0x14, 0x2, @in={0x2, 0x0, @multicast2}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)={0x58, r4, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "e3de3d7b4cd07ec3ee777de774fc7987cca41989"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4}, 0x4000004) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)={0x54, r6, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x40, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "e3de3d7b4cd07ec3ee777de774fc7987cca41989"}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x4}, 0x4000004) syz_genetlink_get_family_id$tipc2(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r3, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x0) 4.289210715s ago: executing program 1 (id=88): r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) fchdir(r0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) open_tree(0xffffffffffffff9c, 0x0, 0x89901) r1 = getpid() openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000440), 0x0) r2 = syz_pidfd_open(r1, 0x0) setns(r2, 0x24020000) r3 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) llistxattr(0x0, 0x0, 0x0) r4 = syz_pidfd_open(r3, 0x0) setns(r4, 0x24020000) mount(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='binfmt_misc\x00', 0x800, 0x0) 4.178347447s ago: executing program 1 (id=89): openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8982, 0x0) r0 = openat$selinux_load(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$selinux_load(r0, 0x0, 0x65) unshare(0x60000600) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x42, 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x5, 0x12, r1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000480)='./tracefs\x00', &(0x7f00000004c0)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./tracefs/uprobe_events\x00', 0x1, 0x0) write(r2, &(0x7f0000000580)='p:p1 ./file0:0', 0xe) r3 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./tracefs/events/uprobes/p1/enable\x00', 0x1, 0x0) write(r3, &(0x7f0000000600)='1', 0x1) 4.153034449s ago: executing program 32 (id=89): openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8982, 0x0) r0 = openat$selinux_load(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$selinux_load(r0, 0x0, 0x65) unshare(0x60000600) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x42, 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x5, 0x12, r1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000480)='./tracefs\x00', &(0x7f00000004c0)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./tracefs/uprobe_events\x00', 0x1, 0x0) write(r2, &(0x7f0000000580)='p:p1 ./file0:0', 0xe) r3 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./tracefs/events/uprobes/p1/enable\x00', 0x1, 0x0) write(r3, &(0x7f0000000600)='1', 0x1) 3.453167252s ago: executing program 2 (id=91): socket$inet6(0xa, 0x3, 0x3) syz_usb_connect$hid(0x0, 0x9f21d88eb2fac37f, 0x0, 0x0) setsockopt$IP_VS_SO_SET_ZERO(0xffffffffffffffff, 0x0, 0x48f, &(0x7f0000000340)={0x84, @empty, 0x4e20, 0x0, 'rr\x00', 0x30, 0x9, 0x3a}, 0x2c) bind$inet(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000940)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000980)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f00000009c0)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000a00)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000a40), 0x4) sendto$inet(r0, &(0x7f0000000a80), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000ac0)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 3.249162553s ago: executing program 0 (id=92): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000140)={{0xffff1000, 0xeeee8000, 0x4, 0xf6, 0x2, 0xf3, 0xd7, 0x8, 0x7, 0x1, 0x9, 0x5}, {0x50000, 0xc0a0c0f0f5000ded, 0xd, 0x5, 0x3, 0x8, 0x5, 0x0, 0x80, 0xfc, 0xfc, 0x4}, {0x200000, 0x4000, 0xb, 0x6, 0xff, 0x3, 0x0, 0x5, 0xef, 0x27, 0xd5, 0x2}, {0x4000, 0x6000, 0x9, 0x9, 0x8f, 0x4, 0x83, 0xfc, 0xb, 0x1, 0x9, 0x3}, {0xffffffff, 0x0, 0x3, 0x2, 0x6, 0x1, 0x9, 0x2, 0x3, 0x3, 0x0, 0xe4}, {0x200000, 0xffff1000, 0xf, 0x0, 0x3, 0x0, 0xde, 0x9, 0x3, 0x0, 0x4, 0x30}, {0xdddd0000, 0x9000, 0xc, 0x1, 0x8, 0x3, 0x2, 0x6, 0x91, 0x8, 0x9, 0x88}, {0x8000000, 0xeeee0000, 0x10, 0x6, 0xc2, 0x8, 0x6, 0x10, 0x7, 0x3, 0x80, 0x87}, {0x6000, 0x8000}, {0xe9eb89d253be8b8b, 0x9}, 0x50000, 0x0, 0x0, 0x400408, 0x6, 0x8000, 0xeeef0000, [0x6, 0x5, 0x5, 0xe]}) add_key$fscrypt_v1(0x0, &(0x7f0000000180)={'fscrypt:', @desc3}, 0x0, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f00000000c0)=@x86={0x60, 0x4, 0xc, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x1, 0x0, 0x0, 0x8, 0x0, 0xff, 0xff, 0x0, '\x00', 0x0, 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000380)={0x2, 0x0, @ioapic={0x8000000, 0x9, 0x10001, 0xfffffffd, 0x0, [{0x2, 0x2, 0x87, '\x00', 0x8}, {0x9, 0x8, 0x2, '\x00', 0xa}, {0xff, 0x7f, 0xd3, '\x00', 0x67}, {0x0, 0x2, 0xf5, '\x00', 0xf}, {0x9, 0x89, 0xc, '\x00', 0xfb}, {0x0, 0x4, 0x54, '\x00', 0xff}, {0x71, 0xd5, 0xf1, '\x00', 0x7f}, {0x3, 0x4, 0x1, '\x00', 0x8}, {0x7f, 0x5, 0xb, '\x00', 0x8}, {0xd7, 0xd, 0x8, '\x00', 0xa}, {0x0, 0x28, 0x7, '\x00', 0xdc}, {0x40, 0x1, 0x5, '\x00', 0x2}, {0xfe, 0x3, 0x26}, {0xcf, 0xfa, 0xb, '\x00', 0x5}, {0xf, 0x6, 0x5, '\x00', 0x10}, {0x39, 0x2, 0x6, '\x00', 0x8}, {0x9, 0x6, 0x2, '\x00', 0x8}, {0x5, 0x7, 0x5, '\x00', 0xc}, {0x7, 0x1, 0x7}, {0x0, 0x80, 0x1, '\x00', 0x81}, {0x1, 0xc, 0x80, '\x00', 0x7f}, {0x10, 0x3, 0x3, '\x00', 0x10}, {0x1, 0x23, 0xf3, '\x00', 0x4}, {0x7, 0x6, 0x4, '\x00', 0x8}]}}) ioctl$KVM_RUN(r2, 0xae80, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x1, &(0x7f0000000740)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r3, 0xffffffffffffffff, 0x0) 3.150142623s ago: executing program 3 (id=93): socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_udp(0x2, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000380)='.\x00', 0x0, 0x6) socket$inet6_tcp(0xa, 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', 0x103a42, 0x32) socket$inet6_tcp(0xa, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_tcp(0xa, 0x1, 0x0) fsopen(&(0x7f0000000400)='erofs\x00', 0x1) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) syz_usb_connect(0x2, 0xb3, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a1000201008032080b00020e03000009040000000e0100000d240100012700006cdc020101112402010102000000000000000002000009240302010100010009040100000e0200000e240101470881000200000001001b24", @ANYRES8=r0], &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0}) 3.068354102s ago: executing program 0 (id=94): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ppoll(&(0x7f0000000100)=[{r0, 0xc2}], 0x1, 0x0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000001c0)={0x205, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x4, 0x7, 0xe1, 0x81, 0x9, 0xd9, 0x40, 0x41, 0xfb, 0x1, 0xc, 0x2, 0x2, 0x41, 0x1, 0xf0}}) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000180)={0x42, 0x0, 0x2}, 0x10) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x14, 0x3, 0x2, 0x401, 0x0, 0x0, {0x2, 0x0, 0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x10) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x5, 0x20, 0x3, 0x2, 0x106c, 0x100, 0x8000000000000001, 0x80000004000080, 0x380000, 0x2000008, 0x8, 0x4, 0x0, 0x8000], 0x1, 0x3c4210}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r4, &(0x7f0000000200)=ANY=[@ANYBLOB="0a000010ffff"], 0x62) ioctl$KVM_RUN(r3, 0xae80, 0x0) 3.003630229s ago: executing program 0 (id=95): openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x400, 0x0) openat$khugepaged_scan(0xffffffffffffff9c, &(0x7f0000000140), 0x1, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='fd/3\x00') read$ptp(r0, &(0x7f0000000200)=""/231, 0xe7) r1 = dup(0xffffffffffffffff) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x4000000000000000) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r3) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100), 0x80082, 0x0) write$vga_arbiter(r5, 0x0, 0x0) sendmsg$IEEE802154_SET_MACPARAMS(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x14, r4, 0x1, 0x70bd2c, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x4008008) ioctl$OCFS2_IOC_UNRESVSP(r0, 0x40305829, &(0x7f0000000300)={0x0, 0x0, 0x5, 0x3, 0xb946, 0x2}) syz_kvm_setup_cpu$x86(r1, r1, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000440)=[@textreal={0x8, 0x0}], 0x1, 0x42, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000580)=[@text64={0x40, &(0x7f00000008c0)="b9800000c00f3235000400000f30440f20c03508000000440f22c036646665f36526f20f22a5430f01c566ba4000edc4a39979250b00000008b9800000c00f3235010000000f30f245ab48b800000000000000800f23c00f21f83500000b000f23f8c481e57dcd", 0x67}], 0x1, 0x10, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.98760017s ago: executing program 0 (id=96): socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_icmp(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_usb_connect(0x2, 0x68, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000a1121710950b2a17f4f701020301090224"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, 0x0) socket$inet(0x2, 0x2, 0x1) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) clock_gettime(0xfffffffffffffffe, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000040)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000100)=0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) syz_ublk_setup_queues(r3, r1, &(0x7f0000000140)={0x0, 0x42cc, 0x10, 0x1, 0x7f}, &(0x7f0000000400)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe706, 0x1000, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x4, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93e9, 0x2000, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x230}}], 0x1, 0x0, 0x0) 1.92767454s ago: executing program 3 (id=100): syz_ublk_setup_queues(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_usb_connect(0x0, 0x62, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000500)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000540)={0xa, 0x0, 0x6, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000580), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000600)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b07caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000640)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) recvfrom(r0, &(0x7f0000002e80)=""/4071, 0xfffffffffffffdab, 0x17, 0x0, 0x0) writev(r0, &(0x7f0000003e80)=[{&(0x7f0000003ec0)='c', 0x1}], 0x1) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000003f40)=0x2, 0x4) writev(r0, 0x0, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x1, &(0x7f0000000740)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r1, 0xffffffffffffffff, 0x0) 1.410685903s ago: executing program 3 (id=101): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x3, 0x0) r0 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000180)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) write(0xffffffffffffffff, &(0x7f0000000140)='p', 0x1) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet6(0xa, 0x2, 0x3a) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r1, 0x0, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) syz_ublk_setup_io_uring(0x467c, &(0x7f0000000140)={0x0, 0xcfab, 0x8000, 0x0, 0x118}, &(0x7f0000000280), &(0x7f00000002c0), &(0x7f00000003c0)) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup(r4) syz_ublk_setup_queues(r5, r3, 0x0, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe706, 0x1000, 0x3, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b40, 0x2, 0x4, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93f9, 0x8000, 0x4003bfff, 0x2b8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x3, 0x8}}], 0x1, 0x0, 0x0) 912.119285ms ago: executing program 4 (id=105): r0 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$x86(r2, &(0x7f0000000100)={0x0, &(0x7f0000000140)=[@wrmsr={0x65, 0x20, {0xa64, 0x1ff}}, @rdmsr={0x66, 0x18}, @nested_amd_vmload={0x182, 0x18}, @out_dx={0x6a, 0x28, {0xdebd, 0x0, 0x9}}, @nested_vmlaunch={0x12f, 0x18, 0x2}, @wr_drn={0x68, 0x20, {0x5}}, @nested_vmresume={0x130, 0x18, 0x2}, @nested_amd_clgi={0x17f, 0x10}, @nested_set_state_pages={0x140, 0x28, {0x3, 0x32, @gpa=0xa000}}, @enable_nested={0x12c, 0x18}, @nested_amd_vmload={0x182, 0x18}, @nested_amd_invlpga={0x17d, 0x20, {0xfec00000, 0x85c7}}, @in_dx={0x69, 0x20, {0xc180, 0x6}}, @nested_amd_invlpga={0x17d, 0x20, {0xdddd0000, 0xf52c}}, @set_irq_handler={0xc8, 0x20, {0xd0, 0x2}}, @nested_amd_invlpga={0x17d, 0x20, {0xc000, 0x910e}}, @nested_load_code={0x12e, 0x54, {0x2, "f3420f2b420e0fc7b24fb2000026f3440f019df8ffffff66b8de000f00d82ef20f350f01df363664f30fbdcd460f01d166b83a008ec866b895008ed0"}}], 0x224}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r3 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) fchdir(r4) r5 = open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80) r6 = openat(0xffffffffffffff9c, 0x0, 0xc0940, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./bus\x00', 0x1c1002, 0x0) write(r7, &(0x7f0000000680)='t', 0x1) sendfile(r7, r6, 0x0, 0x7fffffff) ftruncate(r5, 0x2007ffb) sendfile(r5, r7, 0x0, 0x1000000201005) 896.910657ms ago: executing program 3 (id=106): socket$inet_udp(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6(0xa, 0x800000000000002, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) recvmsg$unix(r0, 0x0, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) syz_ublk_setup_queues(r3, r1, &(0x7f00000004c0)={0x0, 0x42cc, 0x10, 0x1, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe706, 0x800, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x4000, 0x4, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93e9, 0x1000, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x20, 0x1, 0x230}}], 0x1, 0x0, 0x0) 626.330425ms ago: executing program 4 (id=107): socket$igmp6(0xa, 0x3, 0x2) mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_kvm_add_vcpu$x86(0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) mount$binderfs(0x0, &(0x7f0000000100)='./binderfs\x00', 0x0, 0x2000, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) eventfd2(0x1, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x20702, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0xca58c30f81b6079f}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) close(r2) socket(0x10, 0x803, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000480)={'syzkaller0\x00', @multicast}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000004c0)={'veth1_to_hsr\x00', 0x400}) pwritev(r1, &(0x7f0000000500)=[{&(0x7f0000000540)="cceea7c2", 0x4}], 0x1, 0x8, 0x7) close(0x4) 429.268075ms ago: executing program 2 (id=108): connect$inet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x300) recvmmsg(0xffffffffffffffff, &(0x7f000000bd00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=""/19, 0x13}, 0x8819520}], 0x1, 0x45833af92e4a38bf, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r2 = gettid() timer_create(0x2, &(0x7f0000000280)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f00000002c0)) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000004740)={[0x100, 0x0, 0x30a30b42, 0x6, 0x1000, 0x2, 0x208000000001002, 0xfffffffffffffffc, 0x4, 0x80, 0x9, 0x2372, 0x8bd6, 0x4, 0x7f, 0x20], 0x26000, 0x216146}) ioctl$KVM_RUN(r3, 0xae80, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x0) 428.970145ms ago: executing program 4 (id=109): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) timer_create(0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000240)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/kmsg\x00', 0x60000, 0x0) lseek(r0, 0x0, 0x2) read(r0, 0x0, 0x7e) creat(&(0x7f0000000000)='./file0\x00', 0xd931d3864d39dcdb) setxattr$system_posix_acl(&(0x7f0000000040)='./file0\x00', 0x0, &(0x7f00000000c0)={{}, {0x1, 0x8}, [], {0x4, 0x4}, [], {0x10, 0x5}}, 0x24, 0x1) r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x10b) r2 = openat$incfs(0xffffffffffffffff, 0x0, 0x22000, 0x1b4) ioctl$FS_IOC_GETVERSION(r2, 0x80087601, 0x0) getsockopt$WPAN_SECURITY_LEVEL(r2, 0x0, 0x2, &(0x7f0000000380), &(0x7f00000003c0)=0x4) write(0xffffffffffffffff, 0x0, 0x0) ioctl$NILFS_IOCTL_GET_CPINFO(r1, 0x80186e82, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) 396.358899ms ago: executing program 2 (id=110): socket$inet_udp(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6(0xa, 0x800000000000002, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x3c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x10}}, @cred={{0x1c}}], 0xb0}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup(r4) syz_ublk_setup_queues(r5, r3, &(0x7f00000004c0)={0x0, 0x42cc, 0x10, 0x1, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe706, 0x800, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x4000, 0x4, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93e9, 0x1000, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x20, 0x1, 0x230, 0x0, r2}}], 0x1, 0x0, 0x0) 373.724601ms ago: executing program 2 (id=111): r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040), 0xa8402, 0x0) write$vga_arbiter(r0, &(0x7f0000000080)=ANY=[], 0xb) r1 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_RESET_OWNER(r1, 0xaf02, 0x0) exit(0x3) read$FUSE(0xffffffffffffffff, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x54, r4, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @local}}, {0x14, 0x2, @in={0x2, 0x0, @multicast2}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)={0x58, r4, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "e3de3d7b4cd07ec3ee777de774fc7987cca41989"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4}, 0x4000004) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)={0x54, r6, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x40, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "e3de3d7b4cd07ec3ee777de774fc7987cca41989"}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x4}, 0x4000004) syz_genetlink_get_family_id$tipc2(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={0x0}}, 0x0) 295.590169ms ago: executing program 4 (id=112): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f0000000180)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x1008c10, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000001c0)={0x0, 0x1, 0x0, &(0x7f0000000200)=""/66, 0x0, 0x200000}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x0, 0x0, &(0x7f00000002c0)=""/82, 0x0, 0x10000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000340)) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000380)=0xfffffffe) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af04, &(0x7f00000003c0)={0x1}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xa, 0x204031, 0xffffffffffffffff, 0xc9751000) mount$tmpfs(0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)=ANY=[]) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x18d042, 0x15) pwrite64(r1, &(0x7f0000000000)="ff", 0x58200, 0xfb2200) 211.280278ms ago: executing program 4 (id=113): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f0000000180)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x1008c10, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xa, 0x204031, 0xffffffffffffffff, 0xc9751000) timer_create(0xfffffffffffffffd, 0x0, 0x0) timer_create(0xfffffffffffffffd, 0x0, &(0x7f0000000200)=0x0) timer_settime(r0, 0x1, &(0x7f0000000240)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x2c0040, 0x0) write$tun(r1, &(0x7f0000002480)={@val={0x0, 0x88e7}, @val={0x0, 0x43, 0x4, 0xff00, 0x6, 0x2}, @ipv6=@dccp_packet={0x3, 0x6, "645414", 0xfc8, 0x21, 0xff, @dev={0xfe, 0x80, '\x00', 0x3b}, @remote, {[@dstopts={0x33, 0xa, '\x00', [@calipso={0x7, 0x50, {0x3, 0x12, 0x8, 0x9, [0x1, 0x8, 0xffffffff, 0xc86e, 0x9, 0x7fffffff, 0x3, 0x5, 0x4]}}]}, @dstopts={0x29, 0x9, '\x00', [@hao={0xc9, 0x10, @private0={0xfc, 0x0, '\x00', 0x1}}, @hao={0xc9, 0x10, @mcast2}, @generic={0x88, 0x25, "368202410a56f6471364274d835dd23ecb740ea6f964bd74f361bfe9ba91c2bf2faab875f2"}]}, @fragment={0x0, 0x0, 0xb, 0x0, 0x0, 0x1, 0x68}, @dstopts={0x3a, 0x5, '\x00', [@hao={0xc9, 0x10, @private2}, @pad1, @pad1, @hao={0xc9, 0x10, @private2}]}, @routing={0x2c, 0x4, 0x2, 0x3, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @dev={0xfe, 0x80, '\x00', 0x23}]}, @fragment={0x88, 0x0, 0x3, 0x1, 0x0, 0x1e, 0x66}], {{0x4e23, 0x4e22, 0x4, 0x1, 0x9, 0x0, 0x0, 0x2, 0x3, "bddd5b", 0x6, "ff452a"}, "3ca14621396adc3bd5c769030637fe818713439f6602e7e9c3beef2d17e8c1d121f4b020eb4119a36fa4dcb626690cbed46c9aecaa9acf08c9800ad869ed895e68df3c19b16e5dd348e4cd6e91c68741a088c53b27dee69d73fa6b9d297e37a9c665c96fa52b81a3f05ccb52fd463074c1495a0a46d63f625f6d10b940d27288e45b659fcfdcde47c21407fd26b744b758e3274ff30805585677d48ef4a5b51b4103b7338b496fc4f57b187e01a152d08898c302a82cb049bf2a08fd22dd251f011879a9f65a793f7328f62478a8c1eb34b750a927a2f3749da7eacd2dc6d02caeed84636b01c97c494eb2772b610b11158a27e40fafe724f5ea652478614eaf937cad92a9831dbc2f25b47c49908ddae933afbe87f16c450b40d7f9141c48ed2f93e4fc99a2dc94e3782413a81087d86bcb7b7d0910779ca5b0ae33ad6d7d70e621f0f7bee965441670796f95dee0ea1d519acedc719e078bbed78999c3516435762a34cefaf0d37eef277287dd6ede3eb515638f3a114c938d2237b2589f3f4b3b6c3ebf38223344eeb6ddfb0e200e106b35dbdab098a1db3f0d0cfd816aa7bc0370ad97ac9d97118d30becf82d81a4bd8b04f3232b133edd9d194b655a12941f2aa0d1140335e4f6f0c4dc9456d03795f2623efac6caa1a9e433f350548211d46063e74af3f9dc00c658ec2cfb99d576e619da5b65534295260ec35af14d149895d40ad1f9b4d1c5c417f65bf29812ad91ef30bbdae1b172b77b0de68bb1f1e8929f17106caae47a7582f6c0338c9c0af2778bd29b052ea571fa775b56244159c4701e0a3aa14533f2f0ded51bd742dc47de299d42cbcf0d16fbe9913241d8c6473d339b9ac74cff5c1ddc09744d97779159136b6e4b4916e1c3f5b48ae8fd3eed601a4a9dd80f0704348a0bf1773abe52817d88e41ebb44ec61fca846c88ee4d85e74a3883e185a9ae9fd384c20b30823e978b7e4911927c2a593d072c9f801448557bb3d5a190b82bcedbe7c962729cfcf0e350a293cc60284c1f3bcd525edefff600cef32fbe229c6af67abda0054495f94679089515949a5a3378ebfba10ea1ede6157a4ab042d0618e887f9d690d8c056d5d685a78255a645c8bde2a9aa482154e84fd21440d50ef59a053efd76e335093657b6856327586f53d2fe7b64513937a86a5faa09dce4a0981c778cf3d8156b1c8c79fffb964a86e3c0151f0da572765b6905ce1a54eb94e27ed0d503c22fac5a5feb7b4a6eed6fa0885746d5c75af33124ac72cb681c550e2211a5a4e6ce0111b4582319fa3f0b61e2ffe959bdde7013ed2575b2dbe5cfdab6f8ad9891c6158e9400fa05c32476224e8f8815bb60d917c51c800baefb136abe56a559678d88f8dff692fb2efde277a26159edfdbbc280584e681823e245a3f4adebd94badaa79970ce6ecc2f99eb61227aa375f12da6e411192346536add0c9336d4515ed31f9749672381d687b72fb2c18f131a9e45a1bcb8ca847223a9c98e578ac0c872c1bb2f17c0874d85f5a1c27136ddada700d3023b74bbc03855afdb865518e2b949d0bbcf4c018a04fa1e5210022c7e2f754c16e4fc4038c96897bd2b2a0fce62e413d2a78858552d210a460c97792d94019054455f0cd55bd932d1452394d532d8e365351f4b5df77bb22736b7a1504d83bc3099c261ac914274925cc2137d77bb2dfac229cbec577022c8fbef4c5c551a055d0f056139f3dea7fe607197ecedc37531e3361cfa4bfae53ab9592b971c826d0ef0d972fa909d3eeed2fbc6f6b44b6af1383548a208a8c7c8392c437b04122b7bf5781d6b021eae6d52fce20c7dabf0f5a3964e9f907109ab144b1da7da86f539da204f50b26f8192245e8c03feeee8348818f3d1925f771ced368ab7c841b5eaee3a5df14400b242c7b5ccd7f421086818d00e16f3b040aa7c94f605c8cfc31a6b111d62198c7abbbc1d8e32eb8cdea78e0957a5945447c257d0ad251de7e13516b5d848aece75f91d7bcacac0f97cf8aa77d592cb990819888a362750b97dde06d3ee966678422bf67438f801164b5c2f53260a1acd43c583371a3ae32d4b8adc6778843b7e5e2f1937124722fb18bc11b5f33733fb641b6bbde7461fff0e3d5d99b7e24a2e1b009508c60ba938c7f03f907d63b1aecc3c846dd8adf7f31dc24d65f3a59fb41752a1c248a5d3ee533a1b52aa64ce2707a7eeadb3f09efafcb8f55e86ffd63b567401aac3f53767865e688c102e772d969631043a482c0472cfb60a56172cd1aa56d981f0655e61b18459ba69f6dda5232de63ca7f97dd832228c5e2479f3ff43767fcdf3ca2560182b3eece8a51a483e3c4bcf382c788c499672137b7a4f5ee39f4d18981fe7d817f9f59d025e3d5090e630fb2872cb93fcb86d66380ee77a748e6ea06cf07120744d2b075df29185cb522d23f2676e4e2c2f58708bf072b28a6fef92067c1ff6fff21235bda5a645c56ac69265a648b24f5e1c1e8b4f1166cda93f00931a1f0364445ca9f7ae5dfd5552b73758138f656861b2a13d0ea6254029ff98ea506825eee0eb18514b15c27c1241ee1e9dc0d84b623f7c8c9d4375256719859aa0b4132be0ef1258d2fabc7610ce2c42e078a4757638db87a1cbb61c6891f8faee9396f6ab05ffad5fbff49ae3821dfcf57889dda6fc76266b158b127629c84925a46dcdd5b9dafeb4eafdab57c19c74cd501a99f24c8e3d9b159bdb639bd7d3371b61c1d1af65e40ddac77ad0d5d7d060619cc20533528e465ef092579cfcd31c93d3fc15897c7c2cbe2825f02365a535bf343adf5e486a767f0c408770bc56def44cf6ba39b0152045ba74e23f9cb82364012c16a8ea7d6c731c3ee2e5915d25a0c5abfad6f2b156e8197f55347627e3d39ce16b184b3f5e279f284cc6f02f5a2adbc298b4d8ab58dbeaeac36119d2cd7db4afca48639d8cc973f1964a53354199d9955d1833b4c099a791902500ccb9a0c351897aa6f4a20015bc0c189438ec183f94b507b63f384f98f3a0d56aa6f1e1b1584310f9a44d13d7463ca6cac2cfe3cbc4f8f9a7dbf4921c330124ddb9e71fa126c23440dad4f04171ac028592ab34d779027f5cbcb5c8ab320d67d520003b8e3078dc067d11df841d5451c63d2ec212201bc09c496bec821d789444f551f4c5f68873adf5702c029ea4be162fca95d76079cc46ee84bfbd488b57a9e9ce6a3de368cdb42a647f2859c2fbd7bca0fb7bfb21b3aa48bbbc03026fde0d0328b89c7e18600f0099d15ca8edf6a166980348e90c72763dd1e3f3f25670b9579da9560b1a0840c91e0a665ada566896f2c47da7c1ff060944d18fddb829affa7ef3e837b27ca483c6266651d091b81aebbc0508ae327155519f5568744471a8c75281a1465644c4e55e90c2f238c0ba0f16cf92445c6244b90f90ea882ac56882a82f2d047485451e6ab7834c87be7d6dfb4b8215d48c12d491675140d945650a50aa4db2dd07fd876ce513c30562c4b4963139367789653d057968a0714ebbb5b89fb91d91e6085ef7fff84741dd699abfc29baf627162df6dd75a604132e37fe52fcaad0809e203209b21e3632ae005302c0f92ceb2c2052bfaf92f9acb381e3cbe812e7442f0a7ac4f5b9f6bb12a97fcb5b10795dd3bbfc1f74dcc539bd625cd3d284855dcedbcdd237a6312c6974cea9f1144cb1e600ed87f4999770f8bfbf4f0944fab7d727c611071c34a86d59a449ee20ea42dfa6ce0a5bc8646b89bee889d7020f972d07df0c8a22e6474ccd2a2141a551f019ca0cf4854240c0b8e38c3c69adba8f9ef0e2d002634dc6006015b3e8d46382945dec6fb48a84c53771e304dd4fcbcc82f12ea4e746ad411317e4ae45f55681c404d205f86e92eab54a666ef744a2f1cd678144cb60e6b341e9f817d97b2c46cdb9a7a2b001c24fac5893ce584cff03d465320df845de5d3de18575f314a09c4bfaaaf52a988b9842a1b9360a4ec984cc3a28a494e4bf5d7fafb305dd941cbbdaedd29cac8efe361021f5df33d25b58a4d67c1609c0be382666cfd2eb7f48f4360ad7a25afd20cfc95018acd08dff9f683e0373241447134af8777ef1247f9f4392e80647f50d04daf8e37c2b7431da4c7ccc98893b227ac519e3772a9e2963743b370e31e12e7bc117529ad2f2395e820a7062923ab8ca2fe53b66a879ae1b13ec19d0ab94fe4d6def9ea93f00aeabbef6b4518cbd961673e332339fb076e121acf6852c2b8db7dd98300eb2bb5992c019edde251bfa9e9ba6a75f833d1ac73d5e508fed4e0d3d3b6c6cfaf810c38098b4552fe7787daa267c1d5befb595c0211d8ba721f5ea24bdd2fc2a5110f51074c2b8fc215aeeb7d38c14dcd971c76fd89c81cf2e9c099b08db39bea7a6b28d41ba6dc211209cd4cfcc2e1f8a3a097176abb3e1cc1dd3ec7024b9bc7dbbffe714780499b0913fced01c52e9a60d791bbfbaeda3061db10aa52ec46f81e868aea9be57edb03eb01fbe5ac43e9ca4c20586389c31655e64efed11fdc5fbaffbe83f320d7eb4630d87f08fc153af2fa41f6f7f82650c39aba179df2434ab93318532e9fd10fcd03d5b9712297cca19438e527cf11029e1192fc56c6d19359f5793e900b970a81262ca8507b971a414bb736cdd1e632065dca37217d3110d4dbcb9b8202e62e33b040d9d512045df5b9367de852419ba7c3da52c0980fa9bbb8228c14fb262fdcf46fd4c9271322fa792c91556c8a15ab445a3f239fb0c217c6384c769e14d20154f4b7500e30329c3fd8046e96d1dd3e370493d638a765c893dddd6a8b9ac379a6b01ddf59aacd12e584bd1cf6d2f224c29727089426d386f823555d85f8297b56b30aa58249203ae94338c7c4b046cbe64c041a429f810e7fd76ebf25e960223868b46ace4d935349431f316d4686bd532c6e8193ca1e19ebf0c4d62e2b689535ce6a9f15e15692b3275182af03515f9e518547a8e54e10bf39ffb2f058a5b4c6bee49a8d387b76f02cbdf100eeb51c69e23e1d7929c63dd733d7ddd3fa0add9300c88ad8e8b8aab58d095d200da07d17871fd2c0a5f467e07525e92e6b0c75082b1986e4d20bb129ca3c5b7c4ee8e7b8714857c9133fd893a62e30324fdcd4552d14aa9998e493c43a0e327e9de9b2d428ab7e1fbdb23fd5486449c194486418d96c54abf6a3bf2595efb525feba211cf28e4ca2febcdc63edd0e9abb9e8a00f3fd0e85662bdeffcf6ad1e7978e1ea150740be416cc48c62bd5fdea4e6c24f9833"}}}}, 0xffe) timer_delete(0x0) utime(0x0, &(0x7f0000001480)={0x2, 0x9}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x18d042, 0x15) pwrite64(r2, &(0x7f0000000000)="ff", 0x58200, 0xfb2200) 210.707158ms ago: executing program 4 (id=114): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x3, 0x0) r0 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000180)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) write(0xffffffffffffffff, &(0x7f0000000140)='p', 0x1) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet6(0xa, 0x2, 0x3a) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r1, 0x0, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) syz_ublk_setup_io_uring(0x467c, &(0x7f0000000140)={0x0, 0xcfab, 0x8000, 0x0, 0x118}, &(0x7f0000000280), &(0x7f00000002c0), &(0x7f00000003c0)) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup(r4) syz_ublk_setup_queues(r5, r3, 0x0, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe706, 0x1000, 0x3, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b40, 0x2, 0x4, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93f9, 0x8000, 0x4003bfff, 0x2b8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x3, 0x8}}], 0x1, 0x0, 0x0) 528.42µs ago: executing program 3 (id=115): mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000400)='ramfs\x00', 0x2800000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./config\x00', &(0x7f00000002c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/midi.usb0/out_ports\x00', 0x1, 0x0) write(r0, &(0x7f0000000440)='d', 0x1) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) mkdir(&(0x7f0000000480)='./bus\x00', 0x13e) mount$incfs(&(0x7f00000004c0)='.\x00', &(0x7f0000000500)='./bus\x00', &(0x7f0000000540), 0xc002, 0x0) chdir(&(0x7f0000000580)='./bus\x00') mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000005c0)='./cgroup.cpu/syz1\x00', 0x1ff) write$P9_RSETATTR(r0, &(0x7f0000000640)={0x7, 0x1b, 0x2}, 0x7) 0s ago: executing program 3 (id=116): r0 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$x86(r2, &(0x7f0000000100)={0x0, &(0x7f0000000140)=[@wrmsr={0x65, 0x20, {0xa64, 0x1ff}}, @rdmsr={0x66, 0x18}, @nested_amd_vmload={0x182, 0x18}, @out_dx={0x6a, 0x28, {0xdebd, 0x0, 0x9}}, @nested_vmlaunch={0x12f, 0x18, 0x2}, @wr_drn={0x68, 0x20, {0x5}}, @nested_vmresume={0x130, 0x18, 0x2}, @nested_amd_clgi={0x17f, 0x10}, @nested_set_state_pages={0x140, 0x28, {0x3, 0x32, @gpa=0xa000}}, @enable_nested={0x12c, 0x18}, @nested_amd_vmload={0x182, 0x18}, @nested_amd_invlpga={0x17d, 0x20, {0xfec00000, 0x85c7}}, @in_dx={0x69, 0x20, {0xc180, 0x6}}, @nested_amd_invlpga={0x17d, 0x20, {0xdddd0000, 0xf52c}}, @set_irq_handler={0xc8, 0x20, {0xd0, 0x2}}, @nested_amd_invlpga={0x17d, 0x20, {0xc000, 0x910e}}, @nested_load_code={0x12e, 0x54, {0x2, "f3420f2b420e0fc7b24fb2000026f3440f019df8ffffff66b8de000f00d82ef20f350f01df363664f30fbdcd460f01d166b83a008ec866b895008ed0"}}], 0x224}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r3 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) fchdir(r4) r5 = open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80) r6 = openat(0xffffffffffffff9c, 0x0, 0xc0940, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./bus\x00', 0x1c1002, 0x0) write(r7, &(0x7f0000000680)='t', 0x1) sendfile(r7, r6, 0x0, 0x7fffffff) ftruncate(r5, 0x2007ffb) sendfile(r5, r7, 0x0, 0x1000000201005) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.23' (ED25519) to the list of known hosts. [ 20.530841][ T36] audit: type=1400 audit(1793367879.580:64): avc: denied { mounton } for pid=285 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 20.532013][ T285] cgroup: Unknown subsys name 'net' [ 20.553615][ T36] audit: type=1400 audit(1793367879.580:65): avc: denied { mount } for pid=285 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.581014][ T36] audit: type=1400 audit(1793367879.620:66): avc: denied { unmount } for pid=285 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.581237][ T285] cgroup: Unknown subsys name 'devices' [ 20.707496][ T285] cgroup: Unknown subsys name 'hugetlb' [ 20.713136][ T285] cgroup: Unknown subsys name 'rlimit' [ 20.806141][ T36] audit: type=1400 audit(1793367879.860:67): avc: denied { setattr } for pid=285 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 20.830614][ T36] audit: type=1400 audit(1793367879.860:68): avc: denied { mounton } for pid=285 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 20.838914][ T287] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 20.855753][ T36] audit: type=1400 audit(1793367879.860:69): avc: denied { mount } for pid=285 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 20.888276][ T36] audit: type=1400 audit(1793367879.910:70): avc: denied { relabelto } for pid=287 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.914654][ T36] audit: type=1400 audit(1793367879.910:71): avc: denied { write } for pid=287 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.947468][ T36] audit: type=1400 audit(1793367880.000:72): avc: denied { read } for pid=285 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.975617][ T36] audit: type=1400 audit(1793367880.000:73): avc: denied { open } for pid=285 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.975896][ T285] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.284953][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.292166][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.299310][ T294] bridge_slave_0: entered allmulticast mode [ 22.305763][ T294] bridge_slave_0: entered promiscuous mode [ 22.313617][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.320807][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.327941][ T294] bridge_slave_1: entered allmulticast mode [ 22.334115][ T294] bridge_slave_1: entered promiscuous mode [ 22.356349][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.363401][ T292] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.370593][ T292] bridge_slave_0: entered allmulticast mode [ 22.376781][ T292] bridge_slave_0: entered promiscuous mode [ 22.391683][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.398757][ T292] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.405842][ T292] bridge_slave_1: entered allmulticast mode [ 22.412180][ T292] bridge_slave_1: entered promiscuous mode [ 22.456156][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.463425][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.470615][ T295] bridge_slave_0: entered allmulticast mode [ 22.476865][ T295] bridge_slave_0: entered promiscuous mode [ 22.483311][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.490756][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.497988][ T293] bridge_slave_0: entered allmulticast mode [ 22.504404][ T293] bridge_slave_0: entered promiscuous mode [ 22.513337][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.521243][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.528383][ T293] bridge_slave_1: entered allmulticast mode [ 22.534892][ T293] bridge_slave_1: entered promiscuous mode [ 22.541022][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.548070][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.555107][ T295] bridge_slave_1: entered allmulticast mode [ 22.561387][ T295] bridge_slave_1: entered promiscuous mode [ 22.664289][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.671575][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.678917][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.686042][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.724247][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.731361][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.738872][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.745935][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.764299][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.771393][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.778686][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.785787][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.795561][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.802610][ T292] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.809958][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.816999][ T292] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.837574][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.844874][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.852301][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.859684][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.867411][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.874842][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.882270][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.890304][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.917881][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.925250][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.933182][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.940279][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.949652][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.956720][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.971543][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.978706][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.997862][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.005097][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.012769][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.019932][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.047860][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.055093][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.066745][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.073807][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.090924][ T293] veth0_vlan: entered promiscuous mode [ 23.102970][ T294] veth0_vlan: entered promiscuous mode [ 23.128180][ T295] veth0_vlan: entered promiscuous mode [ 23.139572][ T294] veth1_macvtap: entered promiscuous mode [ 23.149330][ T293] veth1_macvtap: entered promiscuous mode [ 23.166352][ T295] veth1_macvtap: entered promiscuous mode [ 23.211715][ T292] veth0_vlan: entered promiscuous mode [ 23.224743][ T295] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 23.225123][ T292] veth1_macvtap: entered promiscuous mode [ 23.356520][ T322] syzkaller1: entered promiscuous mode [ 23.362159][ T322] syzkaller1: entered allmulticast mode [ 23.437337][ T330] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 24.025552][ T359] syzkaller1: entered promiscuous mode [ 24.031122][ T359] syzkaller1: entered allmulticast mode [ 24.425074][ T379] netlink: 8 bytes leftover after parsing attributes in process `syz.3.25'. [ 24.605558][ T312] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 24.775429][ T312] usb 2-1: Using ep0 maxpacket: 16 [ 24.782147][ T312] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 24.792690][ T312] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 24.803182][ T312] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 24.812490][ T312] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 24.821601][ T312] usb 2-1: Product: syz [ 24.834007][ T312] usb 2-1: Manufacturer: syz [ 24.849170][ T312] usb 2-1: SerialNumber: syz [ 24.873608][ T411] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1574906631 (3149813262 ns) > initial count (1841593562 ns). Using initial count to start timer. [ 25.001395][ T416] kvm: Disabled LAPIC found during irq injection [ 25.058728][ T312] usb 2-1: 0:2 : does not exist [ 25.065680][ T312] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 25.077983][ T312] usb 2-1: USB disconnect, device number 2 [ 25.089788][ T325] udevd[325]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 25.586535][ T423] kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 25.599070][ T426] FAULT_INJECTION: forcing a failure. [ 25.599070][ T426] name failslab, interval 1, probability 0, space 0, times 1 [ 25.611781][ T426] CPU: 0 UID: 0 PID: 426 Comm: syz.0.47 Not tainted syzkaller #0 04b5f10b80d13b0533bf6aaa302b886c75cf6d37 [ 25.611815][ T426] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 25.611836][ T426] Call Trace: [ 25.611842][ T426] [ 25.611848][ T426] __dump_stack+0x21/0x30 [ 25.611871][ T426] dump_stack_lvl+0x140/0x1c0 [ 25.611894][ T426] ? __cfi_dump_stack_lvl+0x10/0x10 [ 25.611918][ T426] ? kasan_save_alloc_info+0x3a/0x50 [ 25.611939][ T426] dump_stack+0x19/0x20 [ 25.611952][ T426] should_fail_ex+0x3c2/0x510 [ 25.611962][ T426] ? sk_prot_alloc+0x104/0x3a0 [ 25.611975][ T426] should_failslab+0xac/0x100 [ 25.611985][ T426] __kmalloc_noprof+0x69/0x510 [ 25.611998][ T426] ? sk_prot_alloc+0x104/0x3a0 [ 25.612010][ T426] sk_prot_alloc+0x104/0x3a0 [ 25.612022][ T426] ? security_socket_post_create+0x48/0x140 [ 25.612036][ T426] sk_alloc+0x40/0x590 [ 25.612047][ T426] __netlink_kernel_create+0x173/0x8a0 [ 25.612062][ T426] ? __cfi___netlink_kernel_create+0x10/0x10 [ 25.612075][ T426] ? __asan_memcpy+0x5a/0x80 [ 25.612087][ T426] rtnetlink_net_init+0xb2/0x140 [ 25.612098][ T426] ? __cfi_rtnetlink_net_init+0x10/0x10 [ 25.612108][ T426] ? __cfi_rtnetlink_rcv+0x10/0x10 [ 25.612117][ T426] ? __cfi_rtnetlink_bind+0x10/0x10 [ 25.612127][ T426] ? __kasan_check_write+0x18/0x20 [ 25.612139][ T426] ? __mutex_init+0xa6/0x1a0 [ 25.612150][ T426] ops_init+0x2ff/0x5d0 [ 25.612160][ T426] ? __kasan_check_write+0x18/0x20 [ 25.612172][ T426] ? rwsem_read_trylock+0x275/0x5a0 [ 25.612182][ T426] setup_net+0x227/0x9b0 [ 25.612191][ T426] ? copy_net_ns+0xa20/0xa20 [ 25.612200][ T426] ? down_read_killable+0x7f/0x100 [ 25.612215][ T426] ? __cfi_down_read_killable+0x10/0x10 [ 25.612229][ T426] copy_net_ns+0x4fc/0xa20 [ 25.612237][ T426] create_new_namespaces+0x390/0x6f0 [ 25.612248][ T426] unshare_nsproxy_namespaces+0x124/0x180 [ 25.612257][ T426] ksys_unshare+0x4f9/0x920 [ 25.612271][ T426] ? __cfi_ksys_unshare+0x10/0x10 [ 25.612284][ T426] ? __kasan_check_write+0x18/0x20 [ 25.612297][ T426] __x64_sys_unshare+0x3c/0x50 [ 25.612310][ T426] x64_sys_call+0x2998/0x2ee0 [ 25.612319][ T426] do_syscall_64+0x57/0xf0 [ 25.612330][ T426] ? clear_bhb_loop+0x50/0xa0 [ 25.612344][ T426] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 25.612366][ T426] RIP: 0033:0x7f67e519f559 [ 25.612382][ T426] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 25.612391][ T426] RSP: 002b:00007f67e3bf7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 25.612405][ T426] RAX: ffffffffffffffda RBX: 00007f67e5425fa0 RCX: 00007f67e519f559 [ 25.612413][ T426] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 [ 25.612420][ T426] RBP: 00007f67e5236b20 R08: 0000000000000000 R09: 0000000000000000 [ 25.612426][ T426] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 25.612432][ T426] R13: 00007f67e5426038 R14: 00007f67e5425fa0 R15: 00007ffc21f69c78 [ 25.612441][ T426] [ 25.957302][ T36] kauditd_printk_skb: 60 callbacks suppressed [ 25.957318][ T36] audit: type=1400 audit(1793367885.010:134): avc: denied { create } for pid=432 comm="syz.1.43" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 25.984702][ T36] audit: type=1400 audit(1793367885.010:135): avc: denied { sys_admin } for pid=432 comm="syz.1.43" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 26.012346][ T36] audit: type=1400 audit(1793367885.010:136): avc: denied { remount } for pid=432 comm="syz.1.43" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 26.032953][ T36] audit: type=1400 audit(1793367885.060:137): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 26.078697][ T36] audit: type=1400 audit(1793367885.120:138): avc: denied { ioctl } for pid=437 comm="syz.0.44" path="socket:[4498]" dev="sockfs" ino=4498 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 26.103235][ T36] audit: type=1400 audit(1793367885.120:139): avc: denied { write } for pid=437 comm="syz.0.44" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 26.123926][ T36] audit: type=1400 audit(1793367885.120:140): avc: denied { read } for pid=437 comm="syz.0.44" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 26.263079][ T36] audit: type=1400 audit(1793367885.310:141): avc: denied { create } for pid=448 comm="syz.2.51" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 26.319843][ T36] audit: type=1400 audit(1793367885.340:142): avc: denied { write } for pid=448 comm="syz.2.51" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 26.342074][ T454] netlink: 44 bytes leftover after parsing attributes in process `syz.0.48'. [ 26.350975][ T454] netlink: 43 bytes leftover after parsing attributes in process `syz.0.48'. [ 26.360072][ T454] netlink: 'syz.0.48': attribute type 5 has an invalid length. [ 26.368706][ T454] netlink: 43 bytes leftover after parsing attributes in process `syz.0.48'. [ 27.132026][ T36] audit: type=1400 audit(1793367886.180:143): avc: denied { create } for pid=461 comm="syz.1.53" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 27.365509][ T9] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 27.525467][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 27.531782][ T9] usb 4-1: config 0 has an invalid interface number: 188 but max is 0 [ 27.539992][ T9] usb 4-1: config 0 has no interface number 0 [ 27.546181][ T9] usb 4-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 27.557666][ T9] usb 4-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 27.566864][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.574856][ T9] usb 4-1: Product: syz [ 27.579063][ T9] usb 4-1: Manufacturer: syz [ 27.583735][ T9] usb 4-1: SerialNumber: syz [ 27.589062][ T9] usb 4-1: config 0 descriptor?? [ 27.594333][ T464] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 27.803650][ T464] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 30.015438][ T9] asix 4-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 30.025727][ T9] asix 4-1:0.188 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 30.036205][ T9] asix 4-1:0.188: probe with driver asix failed with error -71 [ 30.044660][ T9] usb 4-1: USB disconnect, device number 2 [ 30.527684][ T477] overlay: ./file0 is not a directory [ 30.591577][ T485] tipc: Started in network mode [ 30.596772][ T485] tipc: Node identity ac1414aa, cluster identity 4711 [ 30.603789][ T485] tipc: Enabling of bearer rejected, failed to enable media [ 31.371319][ T36] kauditd_printk_skb: 14 callbacks suppressed [ 31.371335][ T36] audit: type=1400 audit(2000000000.830:158): avc: denied { unmount } for pid=292 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 31.407692][ T36] audit: type=1400 audit(2000000000.860:159): avc: denied { unmount } for pid=292 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 31.436357][ T36] audit: type=1400 audit(2000000000.900:160): avc: denied { create } for pid=494 comm="syz.2.64" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 31.455633][ T36] audit: type=1400 audit(2000000000.900:161): avc: denied { read write } for pid=494 comm="syz.2.64" name="control" dev="devtmpfs" ino=198 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 31.488002][ T36] audit: type=1400 audit(2000000000.900:162): avc: denied { open } for pid=494 comm="syz.2.64" path="/dev/mapper/control" dev="devtmpfs" ino=198 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 31.528263][ T36] audit: type=1400 audit(2000000000.900:163): avc: denied { ioctl } for pid=494 comm="syz.2.64" path="/dev/mapper/control" dev="devtmpfs" ino=198 ioctlcmd=0xfd03 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 31.555053][ T36] audit: type=1400 audit(2000000000.970:164): avc: denied { create } for pid=494 comm="syz.2.64" name="dm0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 31.575776][ T36] audit: type=1400 audit(2000000000.980:165): avc: denied { read write } for pid=494 comm="syz.2.64" name="dm0" dev="tmpfs" ino=83 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 31.598353][ T36] audit: type=1400 audit(2000000000.980:166): avc: denied { open } for pid=494 comm="syz.2.64" path="/13/dm0" dev="tmpfs" ino=83 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 31.620592][ T36] audit: type=1326 audit(2000000000.990:167): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=494 comm="syz.2.64" exe="/root/ci2-android-6-12-rust/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f763959f559 code=0x0 [ 31.776326][ T508] FAULT_INJECTION: forcing a failure. [ 31.776326][ T508] name failslab, interval 1, probability 0, space 0, times 0 [ 31.789179][ T508] CPU: 0 UID: 0 PID: 508 Comm: syz.3.67 Not tainted syzkaller #0 04b5f10b80d13b0533bf6aaa302b886c75cf6d37 [ 31.789200][ T508] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 31.789208][ T508] Call Trace: [ 31.789212][ T508] [ 31.789218][ T508] __dump_stack+0x21/0x30 [ 31.789238][ T508] dump_stack_lvl+0x140/0x1c0 [ 31.789253][ T508] ? __cfi_dump_stack_lvl+0x10/0x10 [ 31.789267][ T508] ? vms_clear_ptes+0x4eb/0x610 [ 31.789284][ T508] dump_stack+0x19/0x20 [ 31.789298][ T508] should_fail_ex+0x3c2/0x510 [ 31.789308][ T508] should_failslab+0xac/0x100 [ 31.789317][ T508] kmem_cache_alloc_noprof+0x42/0x410 [ 31.789330][ T508] ? vma_merge_new_range+0x71e/0x900 [ 31.789342][ T508] ? vm_area_alloc+0x3f/0x190 [ 31.789355][ T508] vm_area_alloc+0x3f/0x190 [ 31.789366][ T508] mmap_region+0xce2/0x1d10 [ 31.789380][ T508] ? __cfi_mmap_region+0x10/0x10 [ 31.789393][ T508] ? __cfi_arch_get_unmapped_area_topdown+0x10/0x10 [ 31.789406][ T508] ? __kasan_check_read+0x15/0x20 [ 31.789419][ T508] ? __get_unmapped_area+0x406/0x470 [ 31.789437][ T508] ? futex_wait+0x2b8/0x7c0 [ 31.789450][ T508] do_mmap+0xa47/0x1370 [ 31.789462][ T508] ? __cfi_selinux_mmap_file+0x10/0x10 [ 31.789480][ T508] ? __cfi_do_mmap+0x10/0x10 [ 31.789492][ T508] ? __kasan_check_write+0x18/0x20 [ 31.789505][ T508] ? down_write_killable+0xee/0x2d0 [ 31.789525][ T508] ? __cfi_down_write_killable+0x10/0x10 [ 31.789540][ T508] ? do_futex+0x32a/0x510 [ 31.789550][ T508] vm_mmap_pgoff+0x367/0x4b0 [ 31.789564][ T508] ? __cfi_vm_mmap_pgoff+0x10/0x10 [ 31.789577][ T508] ? __x64_sys_futex+0x110/0x110 [ 31.789588][ T508] ksys_mmap_pgoff+0xfa/0x1e0 [ 31.789602][ T508] ? __kasan_check_write+0x18/0x20 [ 31.789621][ T508] __x64_sys_mmap+0x121/0x140 [ 31.789637][ T508] x64_sys_call+0x13bf/0x2ee0 [ 31.789652][ T508] do_syscall_64+0x57/0xf0 [ 31.789669][ T508] ? clear_bhb_loop+0x50/0xa0 [ 31.789686][ T508] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 31.789700][ T508] RIP: 0033:0x7f0f4899f559 [ 31.789711][ T508] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 31.789720][ T508] RSP: 002b:00007f0f49868028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 31.789732][ T508] RAX: ffffffffffffffda RBX: 00007f0f48c25fa0 RCX: 00007f0f4899f559 [ 31.789740][ T508] RDX: 0000000000000003 RSI: 0000000000b36000 RDI: 0000200000000000 [ 31.789746][ T508] RBP: 00007f0f48a36b20 R08: ffffffffffffffff R09: 0000000000000000 [ 31.789756][ T508] R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000 [ 31.789763][ T508] R13: 00007f0f48c26038 R14: 00007f0f48c25fa0 R15: 00007fff42ffd9e8 [ 31.789771][ T508] [ 32.313568][ T553] tipc: Enabling of bearer rejected, failed to enable media [ 32.865009][ T559] kvm: MWAIT instruction emulated as NOP! [ 33.364661][ T588] tipc: Enabling of bearer rejected, failed to enable media [ 33.375525][ T12] bridge_slave_1: left allmulticast mode [ 33.381297][ T12] bridge_slave_1: left promiscuous mode [ 33.387948][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.395940][ T12] bridge_slave_0: left allmulticast mode [ 33.401743][ T12] bridge_slave_0: left promiscuous mode [ 33.408151][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.526199][ T12] veth1_macvtap: left promiscuous mode [ 33.531823][ T12] veth0_vlan: left promiscuous mode [ 33.537243][ T9] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 33.613093][ T591] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.620296][ T591] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.628256][ T591] bridge_slave_0: entered allmulticast mode [ 33.634823][ T591] bridge_slave_0: entered promiscuous mode [ 33.641385][ T591] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.648682][ T591] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.655777][ T591] bridge_slave_1: entered allmulticast mode [ 33.662090][ T591] bridge_slave_1: entered promiscuous mode [ 33.698168][ T591] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.705308][ T591] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.712657][ T591] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.719890][ T591] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.727245][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 33.736262][ T9] usb 4-1: config 0 interface 0 has no altsetting 0 [ 33.742899][ T9] usb 4-1: New USB device found, idVendor=056a, idProduct=0059, bcdDevice= 0.00 [ 33.752014][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.760249][ T308] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.762970][ T9] usb 4-1: config 0 descriptor?? [ 33.772535][ T308] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.783010][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.790109][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.806341][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.813398][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.829870][ T591] veth0_vlan: entered promiscuous mode [ 33.842585][ T591] veth1_macvtap: entered promiscuous mode [ 33.983148][ T9] usbhid 4-1:0.0: can't add hid device: -71 [ 33.995490][ T9] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 34.006311][ T9] usb 4-1: USB disconnect, device number 3 [ 34.571175][ T608] kvm: pic: level sensitive irq not supported [ 34.571565][ T608] kvm: pic: level sensitive irq not supported [ 34.578660][ T608] kvm: pic: single mode not supported [ 34.584848][ T608] kvm: pic: level sensitive irq not supported [ 34.755757][ T9] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 34.905461][ T312] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 34.926670][ T9] usb 4-1: not running at top speed; connect to a high speed hub [ 34.935272][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 34.945589][ T9] usb 4-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 34.954913][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.965217][ T9] usb 4-1: Found UVC 1.00 device (046d:0825) [ 34.972314][ T9] usb 4-1: No streaming interface found for terminal 2. [ 35.066623][ T312] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 35.076875][ T312] usb 1-1: config 0 has no interfaces? [ 35.084269][ T312] usb 1-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 35.093421][ T312] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.101456][ T312] usb 1-1: Product: syz [ 35.105660][ T312] usb 1-1: Manufacturer: syz [ 35.110361][ T312] usb 1-1: SerialNumber: syz [ 35.115658][ T312] usb 1-1: config 0 descriptor?? [ 35.165923][ T312] usb 4-1: USB disconnect, device number 4 [ 35.706719][ T624] tipc: Started in network mode [ 35.711637][ T624] tipc: Node identity ac1414aa, cluster identity 4711 [ 35.718848][ T624] tipc: Enabling of bearer rejected, failed to enable media [ 36.810836][ T36] kauditd_printk_skb: 29 callbacks suppressed [ 36.810863][ T36] audit: type=1400 audit(2000000006.270:197): avc: denied { accept } for pid=636 comm="syz.3.106" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 37.028537][ T36] audit: type=1400 audit(2000000006.490:198): avc: denied { mounton } for pid=641 comm="syz.4.107" path="/dev/binderfs" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 37.064818][ T642] syzkaller0: entered promiscuous mode [ 37.070402][ T642] syzkaller0: entered allmulticast mode [ 37.328823][ T653] tipc: Enabling of bearer rejected, failed to enable media [ 37.338777][ T653] Zero length message leads to an empty skb [ 37.601413][ T36] audit: type=1400 audit(2000000007.060:199): avc: denied { mounton } for pid=660 comm="syz.3.115" path="/30/file0/config" dev="ramfs" ino=11361 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=dir permissive=1 [ 37.625532][ T36] audit: type=1400 audit(2000000007.080:200): avc: denied { create } for pid=660 comm="syz.3.115" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 37.645686][ T294] ------------[ cut here ]------------ [ 37.645768][ T36] audit: type=1400 audit(2000000007.080:201): avc: denied { unmount } for pid=294 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 37.651231][ T294] WARNING: CPU: 0 PID: 294 at fs/inode.c:340 drop_nlink+0xce/0x110 [ 37.651263][ T294] Modules linked in: [ 37.651278][ T294] CPU: 0 UID: 0 PID: 294 Comm: syz-executor Not tainted syzkaller #0 04b5f10b80d13b0533bf6aaa302b886c75cf6d37 [ 37.651297][ T294] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 37.651307][ T294] RIP: 0010:drop_nlink+0xce/0x110 [ 37.651324][ T294] Code: 04 00 00 be 08 00 00 00 e8 8f 08 ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 a2 72 94 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c [ 37.651336][ T294] RSP: 0018:ffffc9000b6afc68 EFLAGS: 00010293 [ 37.651350][ T294] RAX: ffffffff81f4e32e RBX: ffff88812f5ed380 RCX: ffff8881047ca780 [ 37.651363][ T294] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 37.651372][ T294] RBP: ffffc9000b6afc90 R08: 0000000000000003 R09: 0000000000000004 [ 37.651383][ T294] R10: dffffc0000000000 R11: fffff520016d5f84 R12: dffffc0000000000 [ 37.651396][ T294] R13: 1ffff11025ebda79 R14: ffff88812f5ed3c8 R15: 0000000000000000 [ 37.651407][ T294] FS: 000055557078f500(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 [ 37.651490][ T294] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.651504][ T294] CR2: 00005555707ba998 CR3: 0000000123a48000 CR4: 00000000003526b0 [ 37.651520][ T294] Call Trace: [ 37.651526][ T294] [ 37.651535][ T294] simple_rmdir+0x152/0x260 [ 37.671906][ T36] audit: type=1400 audit(2000000007.090:202): avc: denied { unmount } for pid=294 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 37.679284][ T294] vfs_rmdir+0x3de/0x560 [ 37.692195][ T312] usb 1-1: USB disconnect, device number 2 [ 37.694848][ T294] incfs_kill_sb+0x102/0x220 [ 37.845222][ T294] deactivate_locked_super+0xd5/0x270 [ 37.850633][ T294] deactivate_super+0xb8/0xe0 [ 37.855321][ T294] cleanup_mnt+0x438/0x4d0 [ 37.859793][ T294] __cleanup_mnt+0x1d/0x40 [ 37.864221][ T294] task_work_run+0x1e8/0x260 [ 37.868878][ T294] ? __cfi_task_work_run+0x10/0x10 [ 37.874011][ T294] ? __x64_sys_umount+0x12e/0x180 [ 37.879156][ T294] ? __cfi___x64_sys_umount+0x10/0x10 [ 37.884554][ T294] ? __kasan_check_read+0x15/0x20 [ 37.889621][ T294] resume_user_mode_work+0x35/0x50 [ 37.894754][ T294] syscall_exit_to_user_mode+0x63/0xb0 [ 37.900242][ T294] do_syscall_64+0x63/0xf0 [ 37.904689][ T294] ? clear_bhb_loop+0x50/0xa0 [ 37.909414][ T294] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 37.915334][ T294] RIP: 0033:0x7f0f489a0797 [ 37.919796][ T294] Code: a2 c7 05 5c 9f 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 37.939546][ T294] RSP: 002b:00007fff42ffbb68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 37.948057][ T294] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f0f489a0797 [ 37.956280][ T294] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff42ffbc20 [ 37.964280][ T294] RBP: 00007fff42ffbc20 R08: 00007fff42ffcc20 R09: 00000000ffffffff [ 37.972390][ T294] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff42ffcd10 [ 37.980394][ T294] R13: 00007f0f48a35f63 R14: 00000000000092e8 R15: 00007fff42ffdde0 [ 37.988429][ T294] [ 37.991460][ T294] ---[ end trace 0000000000000000 ]--- [ 37.997095][ T294] ================================================================== [ 38.005195][ T294] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 [ 38.011554][ T294] Write of size 4 at addr 0000000000000168 by task syz-executor/294 [ 38.019560][ T294] [ 38.021873][ T294] CPU: 1 UID: 0 PID: 294 Comm: syz-executor Tainted: G W syzkaller #0 04b5f10b80d13b0533bf6aaa302b886c75cf6d37 [ 38.021892][ T294] Tainted: [W]=WARN [ 38.021895][ T294] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 38.021903][ T294] Call Trace: [ 38.021907][ T294] [ 38.021913][ T294] __dump_stack+0x21/0x30 [ 38.021932][ T294] dump_stack_lvl+0x140/0x1c0 [ 38.021946][ T294] ? __cfi_dump_stack_lvl+0x10/0x10 [ 38.021961][ T294] print_report+0x3d/0x70 [ 38.021975][ T294] kasan_report+0x162/0x1a0 [ 38.021985][ T294] ? ihold+0x24/0x70 [ 38.021995][ T294] ? ihold+0x24/0x70 [ 38.022004][ T294] kasan_check_range+0x25a/0x2b0 [ 38.022014][ T294] __kasan_check_write+0x18/0x20 [ 38.022027][ T294] ihold+0x24/0x70 [ 38.022035][ T294] vfs_rmdir+0x25c/0x560 [ 38.022047][ T294] incfs_kill_sb+0x102/0x220 [ 38.022060][ T294] deactivate_locked_super+0xd5/0x270 [ 38.022072][ T294] deactivate_super+0xb8/0xe0 [ 38.022083][ T294] cleanup_mnt+0x438/0x4d0 [ 38.022092][ T294] __cleanup_mnt+0x1d/0x40 [ 38.022101][ T294] task_work_run+0x1e8/0x260 [ 38.022115][ T294] ? __cfi_task_work_run+0x10/0x10 [ 38.022127][ T294] ? __x64_sys_umount+0x12e/0x180 [ 38.022139][ T294] ? __cfi___x64_sys_umount+0x10/0x10 [ 38.022152][ T294] ? __kasan_check_read+0x15/0x20 [ 38.022164][ T294] resume_user_mode_work+0x35/0x50 [ 38.022176][ T294] syscall_exit_to_user_mode+0x63/0xb0 [ 38.022191][ T294] do_syscall_64+0x63/0xf0 [ 38.022202][ T294] ? clear_bhb_loop+0x50/0xa0 [ 38.022216][ T294] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 38.022228][ T294] RIP: 0033:0x7f0f489a0797 [ 38.022239][ T294] Code: a2 c7 05 5c 9f 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 38.022247][ T294] RSP: 002b:00007fff42ffbb68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 38.022259][ T294] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f0f489a0797 [ 38.022266][ T294] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff42ffbc20 [ 38.022272][ T294] RBP: 00007fff42ffbc20 R08: 00007fff42ffcc20 R09: 00000000ffffffff [ 38.022281][ T294] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff42ffcd10 [ 38.022291][ T294] R13: 00007f0f48a35f63 R14: 00000000000092e8 R15: 00007fff42ffdde0 [ 38.022305][ T294] [ 38.022309][ T294] ================================================================== [ 38.264253][ T294] Disabling lock debugging due to kernel taint [ 38.270747][ T294] BUG: kernel NULL pointer dereference, address: 0000000000000168 [ 38.278561][ T294] #PF: supervisor write access in kernel mode [ 38.284610][ T294] #PF: error_code(0x0002) - not-present page [ 38.290571][ T294] PGD 800000013065e067 P4D 800000013065e067 PUD 0 [ 38.297152][ T294] Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI [ 38.303210][ T294] CPU: 0 UID: 0 PID: 294 Comm: syz-executor Tainted: G B W syzkaller #0 04b5f10b80d13b0533bf6aaa302b886c75cf6d37 [ 38.316312][ T294] Tainted: [B]=BAD_PAGE, [W]=WARN [ 38.321311][ T294] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 38.331440][ T294] RIP: 0010:ihold+0x2a/0x70 [ 38.335949][ T294] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 8d 69 94 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 4c ff ed ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 9d [ 38.355627][ T294] RSP: 0018:ffffc9000b6afcc8 EFLAGS: 00010246 [ 38.361783][ T294] RAX: ffff8881047ca700 RBX: 0000000000000000 RCX: ffff8881047ca780 [ 38.369781][ T294] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 38.377776][ T294] RBP: ffffc9000b6afcd8 R08: ffffffff893cf947 R09: 1ffffffff1279f28 [ 38.385746][ T294] R10: dffffc0000000000 R11: fffffbfff1279f29 R12: 0000000000000000 [ 38.393711][ T294] R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 [ 38.401938][ T294] FS: 000055557078f500(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 [ 38.411038][ T294] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 38.417625][ T294] CR2: 0000000000000168 CR3: 0000000123a48000 CR4: 00000000003526b0 [ 38.425592][ T294] Call Trace: [ 38.428865][ T294] [ 38.431805][ T294] vfs_rmdir+0x25c/0x560 [ 38.436043][ T294] incfs_kill_sb+0x102/0x220 [ 38.440656][ T294] deactivate_locked_super+0xd5/0x270 [ 38.446056][ T294] deactivate_super+0xb8/0xe0 [ 38.450722][ T294] cleanup_mnt+0x438/0x4d0 [ 38.455121][ T294] __cleanup_mnt+0x1d/0x40 [ 38.459517][ T294] task_work_run+0x1e8/0x260 [ 38.464098][ T294] ? __cfi_task_work_run+0x10/0x10 [ 38.469195][ T294] ? __x64_sys_umount+0x12e/0x180 [ 38.474226][ T294] ? __cfi___x64_sys_umount+0x10/0x10 [ 38.479586][ T294] ? __kasan_check_read+0x15/0x20 [ 38.484621][ T294] resume_user_mode_work+0x35/0x50 [ 38.489728][ T294] syscall_exit_to_user_mode+0x63/0xb0 [ 38.495187][ T294] do_syscall_64+0x63/0xf0 [ 38.499593][ T294] ? clear_bhb_loop+0x50/0xa0 [ 38.504280][ T294] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 38.510161][ T294] RIP: 0033:0x7f0f489a0797 [ 38.514583][ T294] Code: a2 c7 05 5c 9f 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 38.534369][ T294] RSP: 002b:00007fff42ffbb68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 38.543063][ T294] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f0f489a0797 [ 38.551025][ T294] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff42ffbc20 [ 38.558986][ T294] RBP: 00007fff42ffbc20 R08: 00007fff42ffcc20 R09: 00000000ffffffff [ 38.566952][ T294] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff42ffcd10 [ 38.575007][ T294] R13: 00007f0f48a35f63 R14: 00000000000092e8 R15: 00007fff42ffdde0 [ 38.582973][ T294] [ 38.585980][ T294] Modules linked in: [ 38.590513][ T294] CR2: 0000000000000168 [ 38.594672][ T294] ---[ end trace 0000000000000000 ]--- [ 38.600122][ T294] RIP: 0010:ihold+0x2a/0x70 [ 38.604622][ T294] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 8d 69 94 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 4c ff ed ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 9d [ 38.624224][ T294] RSP: 0018:ffffc9000b6afcc8 EFLAGS: 00010246 [ 38.630376][ T294] RAX: ffff8881047ca700 RBX: 0000000000000000 RCX: ffff8881047ca780 [ 38.638453][ T294] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 38.646529][ T294] RBP: ffffc9000b6afcd8 R08: ffffffff893cf947 R09: 1ffffffff1279f28 [ 38.654611][ T294] R10: dffffc0000000000 R11: fffffbfff1279f29 R12: 0000000000000000 [ 38.662666][ T294] R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 [ 38.670741][ T294] FS: 000055557078f500(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 [ 38.679765][ T294] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 38.686349][ T294] CR2: 0000000000000168 CR3: 0000000123a48000 CR4: 00000000003526b0 [ 38.694324][ T294] Kernel panic - not syncing: Fatal exception [ 38.700728][ T294] Kernel Offset: disabled [ 38.705053][ T294] Rebooting in 86400 seconds..