last executing test programs: 344.807025ms ago: executing program 0 (id=1): mkdirat(0xffffffffffffff9c, &(0x7f0000004140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000004180)='./file0\x00', &(0x7f00000041c0)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000004200)='./file0\x00', &(0x7f0000004240), 0x1000804, &(0x7f0000004280)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) chdir(&(0x7f00000042c0)='./file0\x00') stat(&(0x7f0000004300)='./bus\x00', 0x0) 295.71034ms ago: executing program 2 (id=3): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_GET(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000200)={0x6c, r2, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x13}, 0xf8}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}]}]}, 0x6c}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x54, r4, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @loopback}}, {0x14, 0x2, @in={0x2, 0x0, @multicast2}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}]}, 0x54}}, 0x0) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000180)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000000100000000000000014100000018001700000021000000006574683a64756d6d7930"], 0x34}}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="0100000000000000000003000000400001802c0004001400010002000000ac14140f00000000000000001400020002000000ffffffff00000000000000000d0001007564703a73797a3200"], 0x54}}, 0x0) 246.549045ms ago: executing program 0 (id=5): ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x100}) (async) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x100}) syz_usb_connect$uac3(0x5, 0x97, &(0x7f0000000400)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0x8ae, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x85, 0x3, 0x1, 0x1, 0xc0, 0x10, {0x8, 0xb, 0x0, 0x2, 0x1, 0x1, 0x30, 0x7}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x7}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@as_header={0x17, 0x24, 0x1, 0xc4, 0x800, 0x400, 0x1002, 0x0, 0xbc, 0x81, 0x6}]}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x40, 0xd4, 0x84, {0xa, 0x25, 0x25, 0x0, 0x1, 0x2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x210, 0xfa, 0xa, 0x81, {0xa, 0x25, 0x25, 0x80000000, 0x5, 0x9}}}}}}}}]}}, 0x0) (async) syz_usb_connect$uac3(0x5, 0x97, &(0x7f0000000400)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0x8ae, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x85, 0x3, 0x1, 0x1, 0xc0, 0x10, {0x8, 0xb, 0x0, 0x2, 0x1, 0x1, 0x30, 0x7}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x7}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@as_header={0x17, 0x24, 0x1, 0xc4, 0x800, 0x400, 0x1002, 0x0, 0xbc, 0x81, 0x6}]}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x40, 0xd4, 0x84, {0xa, 0x25, 0x25, 0x0, 0x1, 0x2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x210, 0xfa, 0xa, 0x81, {0xa, 0x25, 0x25, 0x80000000, 0x5, 0x9}}}}}}}}]}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x3d5) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x8b}, 0x0) syz_usb_connect$uac1(0x2, 0x91, &(0x7f00000004c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x8, 0x582, 0x2f, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x7f, 0x3, 0x1, 0x7, 0x30, 0x8, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x5, 0x12}, [@selector_unit={0x8, 0x24, 0x5, 0x5, 0x4, "5c3bf3"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0xe, 0x9, 0x2, {0x7, 0x25, 0x1, 0x0, 0x50, 0x8}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x40, 0x10, 0x1002}, @as_header={0x7, 0x24, 0x1, 0x6, 0x53}, @format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x8ba8, 0x1, 0xc9}]}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x15, 0x1, 0x8c, {0x7, 0x25, 0x1, 0xc, 0xc5, 0x8}}}}}}}}]}}, &(0x7f0000000880)={0xa, &(0x7f0000000580)={0xa, 0x6, 0x200, 0xe, 0x10, 0x9c, 0x268065dac054431b, 0x1}, 0x46, &(0x7f00000005c0)={0x5, 0xf, 0x46, 0x4, [@ssp_cap={0x24, 0x10, 0xa, 0x8, 0x6, 0x5, 0xf0f, 0xff00, [0x3f00, 0x30, 0xff006f, 0x3f00, 0x0, 0xff0030]}, @wireless={0xb, 0x10, 0x1, 0xc, 0x6, 0x9f, 0x23, 0x8000, 0x7}, @ext_cap={0x7, 0x10, 0x2, 0x8, 0x9, 0x1, 0x9}, @wireless={0xb, 0x10, 0x1, 0x8, 0x1a, 0xde, 0x88, 0xfffc, 0x6}]}, 0x5, [{0x4, &(0x7f0000000640)=@lang_id={0x4, 0x3, 0x44c}}, {0xdd, &(0x7f0000000680)=@string={0xdd, 0x3, "dca7f232b3021aa596cf2d18fd43c787955ee807bcf6d762a8e519d4bc1bada720b76da61bdd893e47f5bb77be6710bad843fe0e53fd8c5802ea4dc964cfb6f2cea359c01c16765cf4a697c449e8394bd3f82ca4353fbdd42b28980acd00248398ebd514c89d8d874121bdb356e181d1032936a81e7f48ed3a3f380ecbe4c99a51a9a97eb82c927d338929153cd483d6418c947e987e2200ea6c20493468c397b67ecaa603bdc52d3cea5a3cb22ecd00e482379818e06ad050d2d87b71c21047060467ab004215d8abe71aac3989aeebaa1ec7478b92b37b30e938"}}, {0x77, &(0x7f0000000780)=@string={0x77, 0x3, "a0c7eb9600178f6ff4a34d9bfcb75b89fe8d4d5177410aeecab9d19995bc65cc513bed6612b57f93eeae36cc14fa3acd8738a8ee967815c83abf8b0f17d695489f4d686ecf3543bc226040329faa84167e284568dda32891c3bc5c5e42040829feefb492edadba4a18a516e21b221078ab0e356259"}}, {0x4, &(0x7f0000000800)=@lang_id={0x4, 0x3, 0x41c}}, {0x4, &(0x7f0000000840)=@lang_id={0x4, 0x3, 0x43e}}]}) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) getpid() (async) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000200), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) (async) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) mount(0x0, &(0x7f0000000280)='./debug\x00', &(0x7f00000002c0)='debugfs\x00', 0x0, 0x0) pread64(0xffffffffffffffff, &(0x7f0000000200)=""/3, 0x31, 0x4) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000340)='./cgroup/syz0\x00', 0x200000, 0x0) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000340)='./cgroup/syz0\x00', 0x200000, 0x0) socket$inet_udp(0x2, 0x2, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000300)) add_key$fscrypt_v1(&(0x7f00000003c0), 0x0, 0x0, 0x0, 0xfffffffffffffffe) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ptrace$getregset(0x4204, 0x0, 0x200, 0x0) write$UHID_SET_REPORT_REPLY(r3, &(0x7f0000000400)=ANY=[], 0xc) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x0, 0x0}) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x0, 0x0}) 246.255535ms ago: executing program 1 (id=2): r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) r1 = syz_io_uring_complete(0x0, 0x0) close_range(r0, r1, 0x2) capset(&(0x7f00000000c0)={0x20080522}, &(0x7f0000000100)={0x200000, 0x200000, 0x7}) r2 = socket(0x1, 0x2, 0x1) r3 = socket(0x10, 0x3, 0x0) bind$pptp(r3, &(0x7f0000000180)={0x18, 0x2, {0x2, @private=0xa010101}}, 0x1e) ioctl$SIOCGETLINKNAME(r2, 0x89e0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x4880, 0x0) r4 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r4, &(0x7f0000000000), 0x10) sendmsg$can_bcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x22008824) socket(0x26, 0x2, 0x3) 231.756797ms ago: executing program 1 (id=6): r0 = syz_open_procfs(0x0, &(0x7f0000000000)='pagemap\x00') (async) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) socket$nl_route(0x10, 0x3, 0x0) socket$nl_audit(0x10, 0x3, 0x9) (async) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) (async) socket$tipc(0x1e, 0x2, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_open_dev$loop(&(0x7f00000000c0), 0x5, 0x801) syz_open_dev$loop(&(0x7f0000000100), 0xa811, 0x10b000) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) socket$key(0xf, 0x3, 0x2) (async) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000003c0)) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) syz_usb_connect(0x2, 0xb3, &(0x7f0000000280)=ANY=[@ANYBLOB="12010002ef0201405a22d4e1ada7f5c200010902a1000201008032080b00020e03000009040000000e0100000d240100012700006cdc02010111240301010200000000000000000200000924030201010001"], &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0}) (async) r2 = fsopen(&(0x7f0000000180)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) (async) fsmount(r2, 0x0, 0x8) (async) r3 = open(&(0x7f0000000340)='./file0\x00', 0x48141, 0x0) fcntl$setlease(r3, 0x400, 0x1) fsetxattr$system_posix_acl(r3, &(0x7f0000000380)='system.posix_acl_access\x00', 0x0, 0x0, 0x0) (async) syz_open_procfs(0x0, &(0x7f00000001c0)='net/vlan/config\x00') socket$netlink(0x10, 0x3, 0x6) (async) r4 = socket$key(0xf, 0x3, 0x2) syz_usb_connect$uac1(0x3, 0xdc, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c240208000103000000ff000924060506020100000924030003030005490c240206", @ANYRES8=r4, @ANYBLOB='\a'], 0x0) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000080)=[{0x6, 0xdf, 0x7, 0x7fffffff}]}) futex(0x0, 0x85, 0x2, 0x0, 0x0, 0x95000002) (async) pread64(r0, &(0x7f0000001240)=""/102400, 0x19000, 0x80000000000000) 156.811314ms ago: executing program 3 (id=4): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) close_range(r0, 0xffffffffffffffff, 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x11d) mkdir(&(0x7f0000000080)='./dev\x00', 0x1fc) mount(0x0, &(0x7f0000000140)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x2, 0x0) socket(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f00000001c0)={0x2, {{0xa, 0x1, 0x9, @mcast2}}, {{0xa, 0x4e20, 0x2, @local}}}, 0x108) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x210) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000340)=0x2) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./mnt\x00', 0x1ff) mount(&(0x7f00000003c0)=@filename='./dev/sda1\x00', &(0x7f0000000640)='./mnt\x00', &(0x7f0000000680)='ext4\x00', 0x8410, 0x0) chdir(&(0x7f00000006c0)='./mnt\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/sda\x00', 0x1c5e42, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000740)={0xfffffffffffffecb, 0x4d, 0x1}, 0xffffffd7) mkdirat(0xffffffffffffff9c, &(0x7f0000000780)='./file0\x00', 0x1a2) mount$overlay(0x0, &(0x7f00000007c0)='./file0\x00', &(0x7f0000000800), 0x0, &(0x7f0000000840)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@volatile}]}) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000880)='./file0\x00', 0x0, 0x0) fsync(r2) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000008c0), 0x2, 0x0) fsopen(&(0x7f0000000900)='fuse\x00', 0x0) r3 = syz_ublk_setup_io_uring(0x3833, &(0x7f0000000940)={0x0, 0x2, 0x10, 0x8000003, 0x1e8}, &(0x7f00000009c0)=0x0, &(0x7f0000000a00)=0x0, &(0x7f0000000a40)=0x0) syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000a80)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000b00)=@new_dev={0x3, 0x879, 0x0, 0x0, 0x1000, 0xffffffff, 0xffffffffffffffff, 0x0, 0x160}}}, &(0x7f0000000b40)) 83.616492ms ago: executing program 2 (id=7): r0 = socket(0x10, 0xa, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000280)={0x3, 0x400}, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000009740)=ANY=[@ANYBLOB="280000001200170a26bd7000000000000700000014"], 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x0) 83.360952ms ago: executing program 2 (id=8): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./tracing\x00', &(0x7f0000000180)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x420800, 0x90) mmap(&(0x7f0000000000/0x1000)=nil, 0x1020, 0x1, 0x11, r0, 0x2000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) truncate(&(0x7f0000000000)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x10000) 11.569219ms ago: executing program 2 (id=9): setresuid(0x0, 0xee00, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="180000007600010072a9709e960000000000005f"], 0x18}], 0x1}, 0x40814) capset(&(0x7f0000000680)={0x20080522}, &(0x7f00000006c0)={0x200002, 0x200003, 0x803, 0x4, 0x7}) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x4) mount(0x0, &(0x7f0000000500)='./file0\x00', &(0x7f0000000540)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000580)='./file0\x00', &(0x7f00000005c0), 0x0, &(0x7f0000000600)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x0, 0x0) accept$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @private2}, &(0x7f0000000140)=0x1c) openat(0xffffffffffffff9c, &(0x7f0000000640)='./file0\x00', 0x4, 0x80) 0s ago: executing program 2 (id=10): ioprio_set$uid(0x0, 0x0, 0x4007) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x4c, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{}]}, 0x10) sendmmsg$unix(r0, &(0x7f00000001c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8050}}, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000001}}], 0x2, 0x4000000) r1 = openat$selinux_policy(0xffffff9c, &(0x7f0000000140), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000240)='./binderfs/custom1\x00', 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x18d042, 0x15) pwrite64(r2, &(0x7f00000002c0)="ff", 0x58222, 0xfb2200) r3 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r4 = openat$selinux_policy(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r4, 0x0) openat$kvm(0xffffff9c, &(0x7f0000000180), 0x648900, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000480)={[0x6, 0x0, 0xbe, 0x200, 0x1, 0xfffffffffffffff9, 0x1d1, 0x7, 0x4, 0x7, 0x9, 0x6, 0x270, 0x100000001, 0x4, 0x401], 0xe000, 0x800}) write$selinux_load(r3, &(0x7f0000000000)=ANY=[], 0x1b000) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.10.3' (ED25519) to the list of known hosts. [ 20.935281][ T36] audit: type=1400 audit(1793737982.610:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 20.958259][ T36] audit: type=1400 audit(1793737982.640:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.959133][ T286] cgroup: Unknown subsys name 'net' [ 20.986136][ T36] audit: type=1400 audit(1793737982.660:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.986255][ T286] cgroup: Unknown subsys name 'devices' [ 21.088854][ T286] cgroup: Unknown subsys name 'hugetlb' [ 21.094471][ T286] cgroup: Unknown subsys name 'rlimit' [ 21.247759][ T36] audit: type=1400 audit(1793737982.930:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.267371][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 21.271084][ T36] audit: type=1400 audit(1793737982.930:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 21.304485][ T36] audit: type=1400 audit(1793737982.930:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.318257][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.327640][ T36] audit: type=1400 audit(1793737982.960:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.361783][ T36] audit: type=1400 audit(1793737982.960:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.387470][ T36] audit: type=1400 audit(1793737983.000:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.413247][ T36] audit: type=1400 audit(1793737983.000:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.795346][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.802501][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.809874][ T293] bridge_slave_0: entered allmulticast mode [ 22.816102][ T293] bridge_slave_0: entered promiscuous mode [ 22.824364][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.831471][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.838587][ T293] bridge_slave_1: entered allmulticast mode [ 22.844763][ T293] bridge_slave_1: entered promiscuous mode [ 22.889565][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.896631][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.903854][ T296] bridge_slave_0: entered allmulticast mode [ 22.910236][ T296] bridge_slave_0: entered promiscuous mode [ 22.924525][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.931592][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.938665][ T296] bridge_slave_1: entered allmulticast mode [ 22.944839][ T296] bridge_slave_1: entered promiscuous mode [ 22.956021][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.963100][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.970195][ T294] bridge_slave_0: entered allmulticast mode [ 22.976364][ T294] bridge_slave_0: entered promiscuous mode [ 22.993655][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.000733][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.007831][ T294] bridge_slave_1: entered allmulticast mode [ 23.013982][ T294] bridge_slave_1: entered promiscuous mode [ 23.052814][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.059916][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.067000][ T295] bridge_slave_0: entered allmulticast mode [ 23.073187][ T295] bridge_slave_0: entered promiscuous mode [ 23.082885][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.090137][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.097210][ T295] bridge_slave_1: entered allmulticast mode [ 23.103373][ T295] bridge_slave_1: entered promiscuous mode [ 23.201890][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.208999][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.216281][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.223328][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.263738][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.270826][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.278269][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.285318][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.297470][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.304700][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.312002][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.319057][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.347657][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.354725][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.362047][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.369180][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.402146][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.410214][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.418566][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.425736][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.462423][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.469690][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.477405][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.484452][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.511875][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.518952][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.537042][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.544086][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.556584][ T294] veth0_vlan: entered promiscuous mode [ 23.583650][ T293] veth0_vlan: entered promiscuous mode [ 23.592802][ T296] veth0_vlan: entered promiscuous mode [ 23.600602][ T294] veth1_macvtap: entered promiscuous mode [ 23.618480][ T293] veth1_macvtap: entered promiscuous mode [ 23.634343][ T296] veth1_macvtap: entered promiscuous mode [ 23.675032][ T294] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 23.700842][ T295] veth0_vlan: entered promiscuous mode [ 23.721191][ T314] ======================================================= [ 23.721191][ T314] WARNING: The mand mount option has been deprecated and [ 23.721191][ T314] and is ignored by this kernel. Remove the mand [ 23.721191][ T314] option from the mount to silence this warning. [ 23.721191][ T314] ======================================================= [ 23.726500][ T295] veth1_macvtap: entered promiscuous mode [ 23.779172][ T318] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 23.789924][ T316] tipc: Started in network mode [ 23.794825][ T316] tipc: Node identity fe800000000000000000000000000013, cluster identity 4711 [ 23.797277][ T318] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 23.807165][ T316] tipc: Enabled bearer , priority 10 [ 23.827362][ T316] tipc: Enabled bearer , priority 10 [ 23.837558][ T316] tipc: Bearer : already 2 bearers with priority 10 [ 23.845389][ T316] tipc: Bearer : trying with adjusted priority [ 23.852626][ T329] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 23.852758][ T329] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 23.866447][ T316] tipc: Enabled bearer , priority 9 [ 23.896276][ T316] tipc: Bearer : already 2 bearers with priority 10 [ 23.903853][ T316] tipc: Bearer : trying with adjusted priority [ 23.913272][ T316] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 23.923164][ T333] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 24.017014][ T10] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 24.030992][ T333] overlayfs: failed to resolve './bus': -2 [ 24.070567][ T343] ------------[ cut here ]------------ [ 24.076056][ T343] WARNING: CPU: 1 PID: 343 at mm/page_alloc.c:5286 __alloc_pages_noprof+0x109/0x7e0 [ 24.085758][ T343] Modules linked in: [ 24.089838][ T343] CPU: 1 UID: 0 PID: 343 Comm: syz.2.10 Not tainted syzkaller #0 696230b0126414627535663eb488b8b4d474df7d [ 24.101275][ T343] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 24.111576][ T343] RIP: 0010:__alloc_pages_noprof+0x109/0x7e0 [ 24.118034][ T343] Code: 00 0f 1f 44 00 00 83 fb 0b 72 28 b8 00 20 00 00 23 44 24 40 75 1d 80 3d 3b fd 89 06 00 0f 85 c2 00 00 00 c6 05 2e fd 89 06 01 <0f> 0b 31 c0 e9 b4 00 00 00 83 fb 0a 0f 87 a9 00 00 00 44 8b 64 24 [ 24.137763][ T343] RSP: 0018:ffffc9000b7af640 EFLAGS: 00010246 [ 24.143961][ T343] RAX: 0000000000000000 RBX: 0000000000000016 RCX: 0000000000000000 [ 24.152174][ T343] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000b7af6f8 [ 24.160264][ T343] RBP: ffffc9000b7af780 R08: ffffc9000b7af6f7 R09: 0000000000000000 [ 24.168020][ T10] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 64, changing to 7 [ 24.168302][ T343] R10: ffffc9000b7af6e0 R11: fffff520016f5edf R12: ffffc9000b7af680 [ 24.179591][ T10] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 250, changing to 7 [ 24.187209][ T343] R13: dffffc0000000000 R14: 1ffff920016f5ecc R15: 0000000000000000 [ 24.200735][ T10] usb 1-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice= 0.40 [ 24.206523][ T343] FS: 00007f28498c96c0(0000) GS:ffff8881f6d00000(0000) knlGS:0000000000000000 [ 24.206554][ T343] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 24.206570][ T343] CR2: 0000200000045000 CR3: 00000001313d2000 CR4: 00000000003526b0 [ 24.216178][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 24.224832][ T343] Call Trace: [ 24.231948][ T10] usb 1-1: Product: syz [ 24.239584][ T343] [ 24.249145][ T10] usb 1-1: Manufacturer: syz [ 24.251005][ T343] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 24.251044][ T343] ? __kasan_slab_alloc+0x73/0x90 [ 24.255252][ T10] usb 1-1: SerialNumber: syz [ 24.258203][ T343] ? kmem_cache_alloc_noprof+0x1e2/0x410 [ 24.283923][ T343] ? hashtab_init+0xd6/0x1f0 [ 24.288581][ T343] ___kmalloc_large_node+0x81/0x220 [ 24.293820][ T343] ? hashtab_init+0xd6/0x1f0 [ 24.298551][ T343] __kmalloc_large_node_noprof+0x1e/0xd0 [ 24.304305][ T343] ? hashtab_init+0xd6/0x1f0 [ 24.309130][ T343] __kmalloc_noprof+0x326/0x510 [ 24.314040][ T343] ? __cfi_ebitmap_read+0x10/0x10 [ 24.319303][ T343] hashtab_init+0xd6/0x1f0 [ 24.323764][ T343] ? policydb_read+0x865/0x2860 [ 24.328702][ T343] symtab_init+0x44/0x70 [ 24.333065][ T343] policydb_read+0x8e1/0x2860 [ 24.337978][ T343] ? __kasan_kmalloc+0x96/0xb0 [ 24.342786][ T343] ? __cfi_policydb_read+0x10/0x10 [ 24.347977][ T343] ? security_load_policy+0x130/0x12d0 [ 24.353458][ T343] security_load_policy+0x16a/0x12d0 [ 24.358826][ T343] ? _raw_spin_unlock+0x45/0x60 [ 24.363704][ T343] ? __kasan_check_write+0x18/0x20 [ 24.368871][ T343] ? mutex_lock+0x97/0x1d0 [ 24.373376][ T343] ? __cfi_security_load_policy+0x10/0x10 [ 24.379190][ T343] ? __kasan_check_write+0x18/0x20 [ 24.384332][ T343] sel_write_load+0x258/0x600 [ 24.389111][ T343] ? __cfi_sel_write_load+0x10/0x10 [ 24.394331][ T343] ? bpf_lsm_file_permission+0xd/0x20 [ 24.399947][ T343] ? __cfi_sel_write_load+0x10/0x10 [ 24.405255][ T343] vfs_write+0x3c1/0xfd0 [ 24.409570][ T343] ? __cfi_vfs_write+0x10/0x10 [ 24.414461][ T343] ? __kasan_check_write+0x18/0x20 [ 24.419631][ T343] ? mutex_lock+0x97/0x1d0 [ 24.424099][ T343] ? __cfi_mutex_lock+0x10/0x10 [ 24.429007][ T343] ksys_write+0x145/0x260 [ 24.433358][ T343] ? __cfi_ksys_write+0x10/0x10 [ 24.438253][ T343] ? __kasan_check_write+0x18/0x20 [ 24.443388][ T343] ? fpregs_restore_userregs+0x11c/0x260 [ 24.449082][ T343] __x64_sys_write+0x7f/0x90 [ 24.453692][ T343] x64_sys_call+0x271c/0x2ee0 [ 24.458469][ T343] do_syscall_64+0x57/0xf0 [ 24.462950][ T343] ? clear_bhb_loop+0x50/0xa0 [ 24.467681][ T343] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 24.470070][ T318] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 24.473596][ T343] RIP: 0033:0x7f284899fb19 [ 24.473622][ T343] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 24.484279][ T318] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 24.486498][ T343] RSP: 002b:00007f28498c9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 24.523034][ T343] RAX: ffffffffffffffda RBX: 00007f2848c25fa0 RCX: 00007f284899fb19 [ 24.531046][ T343] RDX: 000000000001b000 RSI: 0000200000000000 RDI: 0000000000000007 [ 24.539113][ T343] RBP: 00007f2848a37b70 R08: 0000000000000000 R09: 0000000000000000 [ 24.547128][ T343] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 24.555121][ T343] R13: 00007f2848c26038 R14: 00007f2848c25fa0 R15: 00007ffe104a56e8 [ 24.563271][ T343] [ 24.566317][ T343] ---[ end trace 0000000000000000 ]--- [ 24.571962][ T343] SELinux: failed to load policy [ 24.574298][ T310] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 24.606222][ T10] usb 1-1: USB disconnect, device number 2 [ 24.737552][ T310] usb 2-1: not running at top speed; connect to a high speed hub [ 24.746085][ T310] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 24.756457][ T310] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 24.766395][ T310] usb 2-1: New USB device found, idVendor=225a, idProduct=e1d4, bcdDevice=a7.ad [ 24.775471][ T310] usb 2-1: New USB device strings: Mfr=245, Product=194, SerialNumber=0 [ 24.783941][ T310] usb 2-1: Product: syz [ 24.788181][ T310] usb 2-1: Manufacturer: syz [ 24.795495][ T310] usb 2-1: Found UVC 1.00 device syz (225a:e1d4) [ 24.802075][ T310] usb 2-1: Failed to create links for entity 1 [ 24.808279][ T310] usb 2-1: Failed to register entities (-22). [ 24.916825][ T310] tipc: Node number set to 4269801491 [ 24.995305][ T10] usb 2-1: USB disconnect, device number 2