last executing test programs: 4.350074912s ago: executing program 2 (id=3): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000a00)=ANY=[@ANYBLOB="120100007856bb40da0b53813de20102030109021200010000000009040000000206"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) unshare(0x24020400) r1 = open(&(0x7f00000001c0)='.\x00', 0x200140, 0x1a8) getdents(r1, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000580)={0x2c, &(0x7f0000000280)={0x20, 0x12, 0x6, "65191d1c4768"}, 0x0, 0x0, 0x0, 0x0}) 4.323202263s ago: executing program 1 (id=2): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f0000000500)={0x2c}, 0x8) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r1, 0xffffffffffffffff, 0x0) ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE(r0, 0xf504, 0x0) 4.303212283s ago: executing program 1 (id=5): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000000)={@multicast2, @multicast2}, 0xc) getsockopt$inet_buf(r1, 0x0, 0x29, &(0x7f0000000000)=""/137, &(0x7f0000000200)=0x89) syz_genetlink_get_family_id$nl80211(&(0x7f0000002000), 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xb, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r2 = getpid() r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000000), 0x20000328) getsockopt$IP_VS_SO_GET_VERSION(r4, 0x0, 0x30, 0x0, &(0x7f0000000100)) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000140)={'veth1\x00', &(0x7f0000000040)=@ethtool_link_settings={0x4c, 0x4, 0xfa, 0x4, 0x2, 0xc, 0x59, 0x6, 0xb, 0x7, [0x1, 0x7fff, 0x3, 0xfffffff8, 0x7, 0x20000, 0x2, 0x4]}}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x300000f, 0x11, r4, 0xcfa3e000) write$vga_arbiter(r3, &(0x7f00000005c0)=ANY=[@ANYBLOB='trylock i'], 0xf) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) r5 = socket$inet6(0xa, 0x3, 0x38) setsockopt$inet6_int(r5, 0x29, 0x7, &(0x7f0000000040)=0xefbe, 0x4) connect$inet6(r5, &(0x7f0000000080)={0xa, 0x4e24, 0x3, @loopback, 0xb}, 0x1c) writev(r5, &(0x7f00000000c0)=[{&(0x7f0000000100)=',', 0xf338}], 0x1) syz_usb_connect$uac2(0x5, 0x7b, &(0x7f00000009c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x8, 0x2b73, 0x1b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x8, 0x30, 0x4, {0x8, 0xb, 0x1, 0x1, 0x1, 0x3, 0x20, 0x3}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x4, 0xa, 0x9, 0x2}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x2, 0x4, 0x7, {0x8, 0x25, 0x1, 0x81, 0xf, 0xf2, 0x9}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x80, 0x0, 0xb, {0x8, 0x25, 0x1, 0x81, 0x14, 0x7, 0x6}}}}}}}}]}}, &(0x7f0000000d80)={0x0, 0x0, 0x0, 0x0}) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000016c0)=@newsa={0x104, 0x10, 0x1, 0xfff7fffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x84}, {@in=@local, 0x4d4, 0x3c}, @in6=@rand_addr=' \x01\x00', {0x0, 0x192, 0x6, 0xffff, 0x82520, 0x2, 0xffbffffffffffff8, 0xe2e237c}, {0xffffffffffffffff, 0x0, 0x1f, 0xffffffffffffffde}, {0x1, 0xfffffffc, 0x40}, 0x70bd28, 0x3504, 0x2, 0x2}, [@coaddr={0x14, 0xe, @in=@dev={0xac, 0x14, 0x14, 0x25}}]}, 0x104}, 0x1, 0x0, 0x0, 0x8801}, 0x0) 4.071893255s ago: executing program 3 (id=9): exit(0xfffffffffffffff7) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x105042, 0x1ff) ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f00000008c0)={0xe8d, 0x6, 0x4, 0xffffffff, 0x7}) r3 = dup(r1) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @multicast}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) madvise(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x180) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000280)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@index_on}]}) rmdir(&(0x7f00000000c0)='./file0/file1\x00') write$tun(r0, &(0x7f00000003c0)={@void, @void, @eth={@multicast, @empty, @val={@val={0x88a8, 0x3, 0x1, 0x1}, {0x8100, 0x0, 0x0, 0x3}}, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x2, 0x3, 0xb0, 0x68, 0x4000, 0x7f, 0x1, 0x0, @empty=0x1c, @local}, @parameter_prob={0xc, 0x0, 0x0, 0x6, 0x3, 0x0, {0x25, 0x4, 0x2, 0x34, 0x7, 0x65, 0x8, 0x2, 0x2f, 0x1, @empty, @local, {[@cipso={0x86, 0x7d, 0x0, [{0x2, 0xa, "dc4138fccfac38a8"}, {0x5, 0xd, "8443e38f1343ebae44dbe4"}, {0x5, 0x12, "7dc58acf8649f4bf6ca63813c9d0b412"}, {0x5, 0xd, "447c309b7355c2d9f3bab6"}, {0x0, 0xd, "9738c017a183b3fcf51ddb"}, {0x0, 0xe, "00a0ab286f9432063326bb4b"}, {0x2, 0x11, "1901160181e736b70312411ced4699"}, {0x6, 0xf, "e41e1cd22e1afc519d643997ff"}, {0xb052f9521725037d, 0x6, "a550ba30"}]}]}}}}}}}}, 0xc6) 4.019235606s ago: executing program 0 (id=10): r0 = socket$key(0xf, 0x3, 0x2) accept$nfc_llcp(r0, 0x0, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = gettid() capset(&(0x7f0000000740)={0x20080522, r2}, &(0x7f0000000780)={0x8, 0xffff, 0xff, 0x4, 0x5, 0xcbf}) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r3, 0xa02000000000000, 0x60, &(0x7f0000000880)={'filter\x00', 0x1002, 0x4, 0x3f0, 0x1f8, 0x0, 0xe8, 0x308, 0x308, 0x308, 0x7fffffe, 0x0, {[{{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x3f0}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@broadcast, @mac, @initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0xf, 0xffffffff}}}, {{@arp={@loopback, @multicast1, 0xff000000, 0x0, 0x6, 0x0, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x22}, {[0x0, 0x0, 0x0, 0x0, 0xff, 0xff]}}, {@empty, {[0x0, 0xff, 0x0, 0xff, 0x0, 0xff]}}, 0x6, 0x81, 0x1, 0x1, 0xd13, 0xe106, 'pimreg1\x00', 'veth1_virt_wifi\x00', {0xff}, {0xff}, 0x0, 0x4}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@broadcast, @mac=@random="3330cb30ca8a", @private=0xa010102, @broadcast}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x440) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001100)=@newsa={0x1b0, 0x10, 0x1, 0x0, 0x0, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in=@multicast1, 0x0, 0xecdf, 0x0, 0xc, 0x0, 0x0, 0x0, 0x87}, {@in=@broadcast, 0x0, 0x32}, @in=@broadcast, {0xfffffffffffffffe}, {0xfffffffffffffffc, 0x800}, {}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x81}, [@algo_crypt={0x58, 0x2, {{'cbc(aes)\x00'}, 0x80, "e0fad3f10cd3a506627800000000074f"}}, @replay_esn_val={0x1c, 0x17, {0x0, 0x70bd2a, 0x70bd27}}, @algo_auth_trunc={0x4c, 0x14, {{'sha224\x00'}, 0x0, 0x80}}]}, 0x1b0}}, 0x4050) 3.964201467s ago: executing program 0 (id=11): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000000)=ANY=[], 0x8) connect$inet6(r0, &(0x7f00000003c0)={0xa, 0xfffe, 0x3080008, @mcast2, 0x6}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='bridge0\x00', 0x10) write(r0, &(0x7f00000000c0)="8f000000000000008004000e058055d47c5963e286a5cefe", 0x18) syz_usb_connect(0x6, 0x24, &(0x7f0000000000)=ANY=[@ANYRES16], 0x0) 3.489876242s ago: executing program 0 (id=12): timerfd_gettime(0xffffffffffffffff, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x60303, 0x0) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) (async) rt_sigqueueinfo(0xffffffffffffffff, 0x3b, &(0x7f00000000c0)={0x5, 0x9, 0xfffffff8}) (async) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, 0x0) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20000, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x2, 0x2, 0x0, 0x4002004c4, 0x1004, 0x8000000000000000, 0xc595, 0x0, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0xb6, 0x8d], 0xeeee8000, 0x2010d3}) ioctl$KVM_RUN(r4, 0xae80, 0x0) (async) ioctl$KVM_RUN(r4, 0xae80, 0x0) (async) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_usb_connect$uac2(0x3, 0x7b, &(0x7f00000040c0)=ANY=[@ANYBLOB="1201500200000040532b2400400001020301090269000301053009080b000101072000090400000001012000092401ff3f04090007090401000001022000090401010101022000090501"], &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}) 3.181475685s ago: executing program 3 (id=13): r0 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000086d043fc5000000000001090224000100000000090400f64103000100092108000c01222800190581030004000bfe"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r1, 0x800448d2, &(0x7f0000000040)) syz_usb_control_io(r0, &(0x7f0000000040)={0x2c, &(0x7f00000000c0)={0x0, 0x8, 0x9a, {0x9a, 0x31, "f70ba381030000000000000000cb4fdca0bf6fc93f0808251f5500000000000000000000000000c74c1077050000000000001d43399f5e7d18f6b6afa7a67670605f134aaa3ccfebc44c26f644a7c29f055d6dc29fb1efbdb197c143d35e50dd38999a398be5bccca2d0165da8a2636865901276e2cf3a9b5fdf4fc4a939e575635b26bb52e169fc5e66e904405b67863ade0eb732651ac6"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 2.876157219s ago: executing program 2 (id=14): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000940)=ANY=[@ANYBLOB="1201000083ef0840e07d6e67db77000000480902120001000000000904000000ef01"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000280)={0x3, 0x100, 0x0, 0x8, 0x80000, 0x5}) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000280)={0x2, 0x4e1f, @broadcast}, 0x10, 0x0, 0x0, 0x0, 0x28}, 0x4000810) 2.859917329s ago: executing program 1 (id=15): connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x3, 0x2, 0x4}}, 0x26) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040), 0x2a42, 0x0) write$binfmt_register(r3, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.75166884s ago: executing program 1 (id=16): socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000140)='bridge0\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x800, &(0x7f0000000100)={0x2, 0x4e23, @multicast1=0xe000000d}, 0x10) socket(0x31, 0x5, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0x1, 0x7, 0x7fffffff}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0xff, 0x7, 0x7fc00002}]}) r1 = syz_usb_connect(0x2, 0x5e, &(0x7f0000000140)=ANY=[@ANYBLOB="120100006b36a2207b06a1279bb00102030109024c0001000010000904e7000229feac000b2402010302057ff49bfd052406000105240002000d240f0105000000090007000806241a7f000109050602ff030000000905820208"], 0x0) syz_usb_control_io$rtl8150(r1, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x9) syz_open_procfs(0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0x2, 0x7, 0x7fffffff}]}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup(r4) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r3, &(0x7f0000000340)={@void, @void, @eth={@broadcast, @remote, @val={@val={0x88a8, 0x7, 0x0, 0x2}, {0x8100, 0x0, 0x0, 0x1}}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x2, 0x15, 0xb0, 0x65, 0x0, 0x82, 0x11, 0x0, @rand_addr=0x65010102, @remote}, {0x4e22, 0x4e23, 0x9c, 0x0, @wg=@initiation={0x1, 0x1, "0b5ca6205f985c1414e634290090845158db14d524f7e17816000e932a2e41ff", "df68c5d1b101900425e0b2d26f7dd136fb0bad72357e0c4956a2bd50db8f72b5859ac7e9dc4cdb1744be43107ad9abdc", "42acc3b16cfaf1e3009f03620c1cf87cceb460cd9c078962c42a5241", {"9e892c5900", "d12f33bf330000000900"}}}}}}}}, 0xc6) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) ioctl$BINDER_GET_FROZEN_INFO(r2, 0xc00c620f, 0x0) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, 0x0, &(0x7f0000000040)) sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24000005}, 0x4004) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[], 0x6c}}, 0x4048081) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x101100, 0x0) r6 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000), 0x80701, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000180)={'batadv0\x00', 0x112}) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000440)=ANY=[@ANYBLOB="a400000054000100000000000000800007"], 0xa4}], 0x1, 0x0, 0x0, 0x4000001}, 0x0) 2.128138947s ago: executing program 0 (id=17): getpriority(0x0, 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da070000000000010902240001000000000904000009030000000921000000012222000905810308"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = add_key$user(&(0x7f0000000080), &(0x7f0000000140)={'syz', 0x0}, &(0x7f0000000180)='5', 0x1, 0xfffffffffffffffd) keyctl$update(0x2, r1, &(0x7f00000000c0)="b1", 0x1) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="300000001d00210000000000000000000700000005000000000000000a00020077a9c6f76f000000060005"], 0x30}}, 0x0) (async) sendmsg$nl_generic(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="300000001d00210000000000000000000700000005000000000000000a00020077a9c6f76f000000060005"], 0x30}}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="00222200000096231306e53f070c00c4df85e63ed5d1af108100002a9000070900be0083"], 0x0}, 0x0) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000000)='BB') syz_usb_connect(0x0, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) (async) syz_usb_connect(0x0, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_int(r3, 0x29, 0x4c, 0x0, &(0x7f0000000140)) (async) getsockopt$inet6_int(r3, 0x29, 0x4c, 0x0, &(0x7f0000000140)) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000100)={'ip6gre0\x00', &(0x7f0000000080)={'syztnl1\x00', 0x0, 0x2f, 0xff, 0x3, 0x7ff, 0x0, @mcast2, @empty, 0x8000, 0x7800, 0x92, 0xfffff5f0}}) syz_usb_connect$rtl8150(0x2, 0x3f, &(0x7f0000000440)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) socket(0x10, 0x803, 0x0) (async) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_xfrm(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c0000001e00010026bd706e6e24139e07"], 0x40}}, 0x90) (async) sendmsg$nl_xfrm(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c0000001e00010026bd706e6e24139e07"], 0x40}}, 0x90) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r5, &(0x7f0000000400)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000003c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="5c010000010100000001000000000000010000074c001980080002001000000008000100980900000800020048000000080001000001000008000200010100000800020080000000080002000002000008000100010000000800020010080000f4000e800c000280050001000100000014000180080001000a010100080002006401010f000000801400030000000000000000000000000000ff0f0000000000008000000000000000000000000000bb0c00028005000100210000002c000180140003ffffffffff14000400fe80000000000000000000000000000c2c00018014000300fc0100000000000000000000005b000014000400000000000000000000000000000000002c00010000000300fe88000000000000000000000000010114000400ff0100000000000000000000000000010c000280050001003a0000000600034000000000080008400000000600"/348], 0x15c}, 0x1, 0x0, 0x0, 0x400c0}, 0x4820) 561.721544ms ago: executing program 0 (id=18): socket$key(0xf, 0x3, 0x2) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000001040)=ANY=[@ANYBLOB="94010000100013070000000000000000ffffffff000000000000de4b5aa8d4d779d10000000000000000000000800001000017004e230080000000001d000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac1414bb0000000000000000000000000000000032000000ff01000000000000000000000000000100000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000048000200656362286369706865725f6e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005c001400636d616328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080"], 0x194}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)=0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000940)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r6, 0x0, r7, 0x0, 0xf3a, 0x0) write$binfmt_misc(r7, &(0x7f0000000980), 0xfdef) splice(r5, 0x0, r7, 0x0, 0x1, 0xf) timer_settime(r4, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r8 = creat(&(0x7f00000002c0)='./file0\x00', 0x40) writev(r8, &(0x7f0000000600)=[{0x0}, {0x0}, {&(0x7f0000000500)="9092", 0x2}], 0x3) setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000000)=0x5, 0x4) getsockopt$bt_l2cap_L2CAP_LM(0xffffffffffffffff, 0x6, 0x3, &(0x7f0000000000), &(0x7f00000000c0)=0x4) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000180)={0xffffff}, 0x10) write(r1, &(0x7f0000000380)="240000001a005f1414f9f407000904000a00000000000008000f0001000000181fa198b0", 0x24) socket$key(0xf, 0x3, 0x2) (async) socket$nl_xfrm(0x10, 0x3, 0x6) (async) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000001040)=ANY=[@ANYBLOB="94010000100013070000000000000000ffffffff000000000000de4b5aa8d4d779d10000000000000000000000800001000017004e230080000000001d000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac1414bb0000000000000000000000000000000032000000ff01000000000000000000000000000100000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000048000200656362286369706865725f6e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005c001400636d616328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080"], 0x194}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) (async) socket(0x10, 0x3, 0x0) (async) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) (async) gettid() (async) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000940)) (async) pipe(&(0x7f0000000080)) (async) splice(r6, 0x0, r7, 0x0, 0xf3a, 0x0) (async) write$binfmt_misc(r7, &(0x7f0000000980), 0xfdef) (async) splice(r5, 0x0, r7, 0x0, 0x1, 0xf) (async) timer_settime(r4, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) (async) creat(&(0x7f00000002c0)='./file0\x00', 0x40) (async) writev(r8, &(0x7f0000000600)=[{0x0}, {0x0}, {&(0x7f0000000500)="9092", 0x2}], 0x3) (async) setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000000)=0x5, 0x4) (async) getsockopt$bt_l2cap_L2CAP_LM(0xffffffffffffffff, 0x6, 0x3, &(0x7f0000000000), &(0x7f00000000c0)=0x4) (async) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000180)={0xffffff}, 0x10) (async) write(r1, &(0x7f0000000380)="240000001a005f1414f9f407000904000a00000000000008000f0001000000181fa198b0", 0x24) (async) 395.778496ms ago: executing program 0 (id=19): r0 = syz_usb_connect$uac2(0x0, 0x7b, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xc010, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x6, 0x0, 0x7, {0x8, 0xb, 0x0, 0x1, 0x1, 0x6, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x1, 0x3, 0x9, 0x8}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0xfd, 0x5, 0x5, {0x8, 0x25, 0x1, 0x3, 0x30, 0x0, 0xad}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x8e, 0x2, 0x3, {0x8, 0x25, 0x1, 0x36daf7a1e4f31d8b, 0x3c, 0x2, 0x6}}}}}}}}]}}, 0x0) syz_usb_control_io$uac2(r0, &(0x7f00000010c0)={0x14, 0x0, &(0x7f0000001080)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_connect$midi(0x1, 0xd5, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x0, 0x582, 0x156, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xc3, 0x1, 0x1, 0x3, 0xd0, 0x9b, "", {{{0x9, 0x4, 0x0, 0x0, 0x7, 0x1, 0x3, 0x20, 0x3, [@midi_in_jack={0x6, 0x24, 0x2, 0x0, 0x0, 0x10}, @midi_in_jack={0x6, 0x24, 0x2, 0x1, 0x5, 0x4}, @midi_in_jack={0x6, 0x24, 0x2, 0x2, 0xc9, 0x3}, @midi_out_jack={0xd, 0x24, 0x3, 0x1, 0x4, 0x3, [{0x8, 0x7}, {0x3, 0x2}, {0x20, 0x2}], 0x2}, @midi_out_jack={0x15, 0x24, 0x3, 0x2, 0x8, 0x7, [{0x5, 0x1}, {0x10, 0x7}, {0x5, 0x9}, {0x7, 0x8}, {0x1}, {0x9, 0xfb}, {0x6, 0x9}], 0x9}], [{{0x9, 0x5, 0x5, 0xc, 0x10, 0x7, 0x9, 0x2, {0x4}}}, {{0x9, 0x5, 0x3, 0x10, 0x400, 0x40, 0x8, 0x8, {0xc, 0x25, 0x1, 0x8, "ed96875035a9eee4"}}}, {{0x9, 0x5, 0x5, 0x0, 0x400, 0x8, 0x3, 0x0, {0x5, 0x25, 0x1, 0x1, 'H'}}}, {{0x9, 0x5, 0x1, 0x0, 0x40, 0x0, 0x3, 0x9, {0x4}}}, {{0x9, 0x5, 0x7, 0x3, 0x20, 0x1, 0x2e, 0x1, {0xb, 0x25, 0x1, 0x7, "0557ed0bd68426"}}}, {{0x9, 0x5, 0xa, 0x0, 0x0, 0x3, 0x3, 0x7f, {0xe, 0x25, 0x1, 0xa, "293a66959e20859692c8"}}}, {{0x9, 0x5, 0x9, 0x8, 0x3ff, 0x5, 0x0, 0x9, {0xc, 0x25, 0x1, 0x8, "4966a5441a429ffd"}}}]}}}}}]}}, &(0x7f0000000280)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x310, 0x1, 0x6, 0x5, 0x8, 0x6}, 0x10, &(0x7f00000001c0)={0x5, 0xf, 0x10, 0x1, [@wireless={0xb, 0x10, 0x1, 0xc, 0x52, 0x3, 0x2e, 0x5b, 0x4}]}, 0x1, [{0x44, &(0x7f0000000200)=@string={0x44, 0x3, "818714d6093be499ba4787ce6099acf0b19289bab65094ec3a6f72105c7fe05306cca31c4666f439d9161b28e623a46ff6434d3ba7b2803bd4026f801c969ce6c07e"}}]}) 120.179609ms ago: executing program 3 (id=20): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x66960000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) r0 = socket(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r1, &(0x7f0000000400)={@val={0x8, 0x800}, @val={0x7, 0x3, 0x3, 0x2, 0x14}, @x25={0x0, 0x2, 0x1, "5d1131846429864fd168cd48a8f352411dd59da0"}}, 0x25) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r3, 0xae03, 0xb6) write(r0, &(0x7f0000000000)="2400000011005f0414f9f4070009041f810000000e0000000000000008000f0001000000", 0x24) socket$inet6_tcp(0xa, 0x1, 0x0) 119.926569ms ago: executing program 3 (id=21): r0 = socket(0x22, 0x3, 0x0) prlimit64(0x0, 0xd, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) keyctl$revoke(0x3, 0x0) gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={[0xffffffed]}, 0x0, 0x8) timer_create(0x3, &(0x7f0000000100)={0x0, 0x1f, 0x2, @thr={&(0x7f0000000280)="1e1cfe982985551f883352cd7fcc57fb46d5441849fff987bd7a2bdfac7e941b1086d14e2b1abade552277de3ebd1437c23195428c20f7eae8dfe92fcb30e160768c8c5e6af8bfd4de74ac6e088828beb9d7cf9b723e3b845b220526779e27130a", &(0x7f0000000380)="2eb7d15c88d8052ddb956404552afc26dad2a7718bfe32b67b0da715630baec91c921c3dba927d85c615bba838bb41b0af9ea87f73fb2ef6c3e56682bc7173743511089c0a6d625ccf100e24795b32c4c6b9ac353444ff036637a762f059855d3f5c77eef8aaa165effed20677f05246f308622158ab648986212f70bfcbfa77d7ec90d9098cce6352cf93d9ae0bb702a093a96e98fd9d63dd5a4fe09c69e4423720856e6365df1baba95db95f98421b75edd8b7e5087ca367f5bb869a8ea70d1685610e5c0725da09a1edc8a950accdc3a8f9be01ce1b"}}, &(0x7f00000004c0)=0x0) timer_settime(0x0, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_gettime(r1, 0x0) rt_sigprocmask(0x2, &(0x7f0000001140)={[0x800]}, 0x0, 0x8) r2 = syz_open_dev$usbfs(&(0x7f0000000480), 0x77, 0x41341) unshare(0x64000600) socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet6(r0, &(0x7f0000000300)=[{{&(0x7f0000000040)={0xa, 0x4e20, 0x401, @mcast2, 0x100}, 0x1c, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="24000000000000002900000032000000fe880000000000000000000000000001", @ANYRES8=r0, @ANYBLOB="00000004"], 0x28}}], 0x1, 0x0) ioctl$USBDEVFS_CLAIM_PORT(r2, 0x80045518, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x127040, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_TSINFO_GET(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r6, @ANYBLOB="25cf4b21ef3e3c080000000000006d190000000c0001c0080003"], 0x20}, 0x1, 0x0, 0x0, 0x24004041}, 0x4008000) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000007c0)=[@text32={0x20, 0x0}], 0x1, 0x9, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x9, 0xffffffff, 0x4e, 0x567}, 0x13) r8 = openat$full(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) r9 = openat$cgroup_ro(r8, &(0x7f0000000080)='memory.events.local\x00', 0x0, 0x0) fstat(r9, &(0x7f00000001c0)) 119.756789ms ago: executing program 2 (id=22): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x4e22, 0xfffffffe, @ipv4={'\x00', '\xff\xff', @loopback}, 0x2}, 0x1c) connect$pppl2tp(r3, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x8, 0x0, 0x0, 0x0, {0xa, 0x4e21, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) writev(r3, &(0x7f0000000180)=[{&(0x7f0000000200)="f4", 0x34000}], 0x1) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000140)="ba2100ec36ddc0baf80c66b88a3b5d8466efbafc0ced2eff290f019d0c00670f3acc4292000ff271002fea000077000ad0d00166b9800000c00f326635010000000f30", 0x43}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ptrace$PTRACE_GETSIGMASK(0x420a, 0xffffffffffffffff, 0x8, &(0x7f0000000000)) syz_pidfd_open(r0, 0x0) clock_nanosleep(0x6, 0x1, &(0x7f00000001c0)={0x77359400}, 0x0) 76.477259ms ago: executing program 3 (id=23): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) setrlimit(0x9, &(0x7f0000000280)={0x6, 0x7}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="0200000001000000000000000400000000000000100000000000000020"], 0x24, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x42, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000000)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@metacopy_on}]}) linkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file2\x00', 0x1000) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r2 = inotify_init1(0x800) inotify_add_watch(r2, &(0x7f0000000240)='./file0\x00', 0xc0) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8c) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) 0s ago: executing program 3 (id=24): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x68}) mremap(&(0x7f0000636000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f000074f000/0x2000)=nil) ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f00000002c0)={{&(0x7f000074f000/0x3000)=nil, 0x3000}, 0x1}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x2d75000) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002880)={&(0x7f0000000000)={[0x81]}, 0x8}) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4400ae8f, &(0x7f00000000c0)=@x86={0x60, 0x4, 0xc, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x1, 0x0, 0x0, 0x8, 0x0, 0xff, 0xff, 0x0, '\x00', 0x0, 0x1}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000380)={0x2, 0x0, @ioapic={0x8000000, 0x9, 0x10001, 0xfffffffd, 0x0, [{0x2, 0x4, 0x87, '\x00', 0x8}, {0x9, 0x8, 0x2, '\x00', 0xb}, {0xff, 0x7f, 0xd3, '\x00', 0x67}, {0x0, 0x2, 0xf5, '\x00', 0xf}, {0x7, 0x9, 0xc, '\x00', 0xfb}, {0x0, 0x84, 0x54, '\x00', 0xff}, {0x71, 0xd5, 0xf1, '\x00', 0x7f}, {0x1, 0x4, 0xc}, {0x7f, 0x5, 0xb, '\x00', 0x8}, {0xd7, 0xd, 0x8, '\x00', 0x6}, {0x0, 0x28, 0x7, '\x00', 0xdc}, {0x40, 0x1, 0x5, '\x00', 0x2}, {0xfe, 0x3, 0x26}, {0xcf, 0x3, 0xb, '\x00', 0x5}, {0xf, 0xee, 0xa, '\x00', 0xf}, {0x39, 0x2, 0x6, '\x00', 0xb}, {0x9, 0x6, 0x2, '\x00', 0x8}, {0x5, 0xc, 0x5, '\x00', 0xc}, {0x7, 0x1, 0x7}, {0x0, 0x80, 0x1, '\x00', 0x7d}, {0x1, 0xc, 0x80, '\x00', 0x7f}, {0x10, 0x3, 0x3, '\x00', 0x10}, {0x1, 0x23, 0x9, '\x00', 0x4}, {0x7, 0x6, 0x4, '\x00', 0x8}]}}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) userfaultfd(0x80001) (async) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x68}) (async) mremap(&(0x7f0000636000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f000074f000/0x2000)=nil) (async) ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f00000002c0)={{&(0x7f000074f000/0x3000)=nil, 0x3000}, 0x1}) (async) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) (async) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) (async) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) (async) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x2d75000) (async) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002880)={&(0x7f0000000000)={[0x81]}, 0x8}) (async) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4400ae8f, &(0x7f00000000c0)=@x86={0x60, 0x4, 0xc, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x1, 0x0, 0x0, 0x8, 0x0, 0xff, 0xff, 0x0, '\x00', 0x0, 0x1}) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000380)={0x2, 0x0, @ioapic={0x8000000, 0x9, 0x10001, 0xfffffffd, 0x0, [{0x2, 0x4, 0x87, '\x00', 0x8}, {0x9, 0x8, 0x2, '\x00', 0xb}, {0xff, 0x7f, 0xd3, '\x00', 0x67}, {0x0, 0x2, 0xf5, '\x00', 0xf}, {0x7, 0x9, 0xc, '\x00', 0xfb}, {0x0, 0x84, 0x54, '\x00', 0xff}, {0x71, 0xd5, 0xf1, '\x00', 0x7f}, {0x1, 0x4, 0xc}, {0x7f, 0x5, 0xb, '\x00', 0x8}, {0xd7, 0xd, 0x8, '\x00', 0x6}, {0x0, 0x28, 0x7, '\x00', 0xdc}, {0x40, 0x1, 0x5, '\x00', 0x2}, {0xfe, 0x3, 0x26}, {0xcf, 0x3, 0xb, '\x00', 0x5}, {0xf, 0xee, 0xa, '\x00', 0xf}, {0x39, 0x2, 0x6, '\x00', 0xb}, {0x9, 0x6, 0x2, '\x00', 0x8}, {0x5, 0xc, 0x5, '\x00', 0xc}, {0x7, 0x1, 0x7}, {0x0, 0x80, 0x1, '\x00', 0x7d}, {0x1, 0xc, 0x80, '\x00', 0x7f}, {0x10, 0x3, 0x3, '\x00', 0x10}, {0x1, 0x23, 0x9, '\x00', 0x4}, {0x7, 0x6, 0x4, '\x00', 0x8}]}}) (async) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.109' (ED25519) to the list of known hosts. [ 23.559579][ T36] audit: type=1400 audit(1777995913.759:64): avc: denied { mounton } for pid=288 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.560740][ T288] cgroup: Unknown subsys name 'net' [ 23.582254][ T36] audit: type=1400 audit(1777995913.759:65): avc: denied { mount } for pid=288 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.609707][ T36] audit: type=1400 audit(1777995913.789:66): avc: denied { unmount } for pid=288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.609874][ T288] cgroup: Unknown subsys name 'devices' [ 23.775863][ T288] cgroup: Unknown subsys name 'hugetlb' [ 23.781482][ T288] cgroup: Unknown subsys name 'rlimit' [ 23.933359][ T36] audit: type=1400 audit(1777995914.129:67): avc: denied { setattr } for pid=288 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.956669][ T36] audit: type=1400 audit(1777995914.129:68): avc: denied { mounton } for pid=288 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.981397][ T36] audit: type=1400 audit(1777995914.129:69): avc: denied { mount } for pid=288 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.983293][ T290] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 24.013434][ T36] audit: type=1400 audit(1777995914.209:70): avc: denied { relabelto } for pid=290 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.038947][ T36] audit: type=1400 audit(1777995914.209:71): avc: denied { write } for pid=290 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.109077][ T36] audit: type=1400 audit(1777995914.309:72): avc: denied { read } for pid=288 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.109638][ T288] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 24.134659][ T36] audit: type=1400 audit(1777995914.309:73): avc: denied { open } for pid=288 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.939566][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.946849][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.954127][ T297] bridge_slave_0: entered allmulticast mode [ 24.960351][ T297] bridge_slave_0: entered promiscuous mode [ 24.967495][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.974609][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.981691][ T297] bridge_slave_1: entered allmulticast mode [ 24.988146][ T297] bridge_slave_1: entered promiscuous mode [ 25.013112][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.020259][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.027401][ T296] bridge_slave_0: entered allmulticast mode [ 25.033567][ T296] bridge_slave_0: entered promiscuous mode [ 25.041571][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.048660][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.055742][ T296] bridge_slave_1: entered allmulticast mode [ 25.061967][ T296] bridge_slave_1: entered promiscuous mode [ 25.067993][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.075086][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.082154][ T295] bridge_slave_0: entered allmulticast mode [ 25.088585][ T295] bridge_slave_0: entered promiscuous mode [ 25.095950][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.102987][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.110238][ T295] bridge_slave_1: entered allmulticast mode [ 25.116546][ T295] bridge_slave_1: entered promiscuous mode [ 25.168770][ T298] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.175845][ T298] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.182915][ T298] bridge_slave_0: entered allmulticast mode [ 25.189178][ T298] bridge_slave_0: entered promiscuous mode [ 25.198094][ T298] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.205171][ T298] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.212228][ T298] bridge_slave_1: entered allmulticast mode [ 25.218494][ T298] bridge_slave_1: entered promiscuous mode [ 25.311190][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.318471][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.325810][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.333295][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.362398][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.369518][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.376915][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.383969][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.409183][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.416339][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.423612][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.430843][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.467937][ T127] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.475838][ T127] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.483121][ T127] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.490626][ T127] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.498434][ T127] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.505653][ T127] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.520120][ T127] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.527201][ T127] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.546497][ T127] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.553541][ T127] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.561285][ T127] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.568330][ T127] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.585732][ T127] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.592780][ T127] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.603053][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.610136][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.624958][ T127] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.632040][ T127] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.660656][ T127] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.667741][ T127] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.675562][ T127] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.682621][ T127] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.691766][ T295] veth0_vlan: entered promiscuous mode [ 25.713215][ T295] veth1_macvtap: entered promiscuous mode [ 25.729551][ T296] veth0_vlan: entered promiscuous mode [ 25.752379][ T297] veth0_vlan: entered promiscuous mode [ 25.767146][ T298] veth0_vlan: entered promiscuous mode [ 25.777348][ T296] veth1_macvtap: entered promiscuous mode [ 25.789627][ T295] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 25.824743][ T298] veth1_macvtap: entered promiscuous mode [ 25.835049][ T297] veth1_macvtap: entered promiscuous mode [ 25.906556][ T324] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 25.971851][ T333] input: syz0 as /devices/virtual/input/input4 [ 26.032935][ T337] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 26.054116][ T331] fuse: Bad value for 'fd' [ 26.059862][ T331] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:6 [ 26.064004][ T10] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 26.246687][ T10] usb 3-1: New USB device found, idVendor=0bda, idProduct=8153, bcdDevice=e2.3d [ 26.256056][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.264286][ T10] usb 3-1: Product: syz [ 26.268477][ T10] usb 3-1: Manufacturer: syz [ 26.273067][ T10] usb 3-1: SerialNumber: syz [ 26.280698][ T10] r8152-cfgselector 3-1: Unknown version 0x0000 [ 26.287040][ T10] r8152-cfgselector 3-1: config 0 descriptor?? [ 26.333880][ T31] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 26.483815][ T31] usb 2-1: Using ep0 maxpacket: 8 [ 26.490403][ T31] usb 2-1: unable to get BOS descriptor or descriptor too short [ 26.499185][ T31] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 128, changing to 7 [ 26.501906][ T10] r8152-cfgselector 3-1: Needed 2 retries to read version [ 26.511960][ T31] usb 2-1: New USB device found, idVendor=2b73, idProduct=001b, bcdDevice= 0.40 [ 26.517748][ T10] r8152-cfgselector 3-1: Unknown version 0x1c10 [ 26.526750][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.533520][ T10] r8152-cfgselector 3-1: bad CDC descriptors [ 26.542979][ T31] usb 2-1: Product: syz [ 26.551573][ T31] usb 2-1: Manufacturer: syz [ 26.556243][ T31] usb 2-1: SerialNumber: syz [ 26.768951][ T31] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 26.778999][ T31] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 26.790602][ T31] usb 2-1: USB disconnect, device number 2 [ 26.806225][ T322] udevd[322]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 26.934493][ T10] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 27.085355][ T10] usb 1-1: unable to get BOS descriptor or descriptor too short [ 27.096831][ T10] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 27.107046][ T10] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 27.116025][ T10] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 27.127341][ T10] usb 1-1: New USB device found, idVendor=2b53, idProduct=0024, bcdDevice= 0.40 [ 27.136567][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.144758][ T10] usb 1-1: Product: syz [ 27.148925][ T10] usb 1-1: Manufacturer: syz [ 27.153500][ T10] usb 1-1: SerialNumber: syz [ 27.223848][ T31] usb 4-1: new low-speed USB device number 2 using dummy_hcd [ 27.248729][ T352] r8152-cfgselector 3-1: USB disconnect, device number 2 [ 27.366794][ T10] usb 1-1: USB disconnect, device number 2 [ 27.378287][ T312] udevd[312]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 27.396629][ T31] usb 4-1: config 0 has an invalid descriptor of length 25, skipping remainder of the config [ 27.407032][ T31] usb 4-1: too many endpoints for config 0 interface 0 altsetting 246: 65, using maximum allowed: 30 [ 27.421195][ T31] usb 4-1: config 0 interface 0 altsetting 246 has 0 endpoint descriptors, different from the interface descriptor's value: 65 [ 27.434569][ T31] usb 4-1: config 0 interface 0 has no altsetting 0 [ 27.441360][ T31] usb 4-1: New USB device found, idVendor=046d, idProduct=c53f, bcdDevice= 0.00 [ 27.450416][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.459711][ T31] usb 4-1: config 0 descriptor?? [ 27.466300][ T31] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 27.563898][ T352] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 27.715045][ T352] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 27.726050][ T352] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 27.736160][ T352] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 27.749238][ T352] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 27.758477][ T352] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.767225][ T352] usb 3-1: config 0 descriptor?? [ 28.174439][ T356] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 28.183260][ T356] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 28.192956][ T352] plantronics 0003:047F:FFFF.0001: No inputs registered, leaving [ 28.202068][ T352] plantronics 0003:047F:FFFF.0001: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 28.233871][ T10] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 28.383809][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 28.390220][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 28.401397][ T10] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 28.414630][ T10] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 28.424207][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.432688][ T10] usb 1-1: config 0 descriptor?? [ 28.642165][ T10] HID 045e:07da: Invalid code 65791 type 1 [ 28.651231][ T10] input: HID 045e:07da as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:045E:07DA.0002/input/input5 [ 28.667997][ T10] microsoft 0003:045E:07DA.0002: input,hidraw1: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.0-1/input0 [ 29.041313][ T363] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 29.049955][ T367] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 29.050682][ T363] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 29.058688][ T367] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 29.074774][ T363] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 29.083408][ T363] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 29.091882][ T36] kauditd_printk_skb: 63 callbacks suppressed [ 29.091911][ T36] audit: type=1400 audit(1777995919.289:137): avc: denied { create } for pid=362 comm="syz.0.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 29.092986][ T370] usb 1-1: USB disconnect, device number 3 [ 29.102137][ T36] audit: type=1400 audit(1777995919.289:138): avc: denied { write } for pid=362 comm="syz.0.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 29.993355][ T380] usb 4-1: USB disconnect, device number 2 [ 30.007579][ T31] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 30.017673][ T36] audit: type=1400 audit(1777995920.219:139): avc: denied { create } for pid=383 comm="syz.3.21" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 30.053720][ T36] audit: type=1400 audit(1777995920.249:140): avc: denied { create } for pid=385 comm="syz.2.22" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 30.081122][ T36] audit: type=1400 audit(1777995920.259:141): avc: denied { connect } for pid=385 comm="syz.2.22" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 30.106882][ T36] audit: type=1400 audit(1777995920.259:142): avc: denied { write } for pid=385 comm="syz.2.22" path="socket:[3851]" dev="sockfs" ino=3851 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 30.130020][ T36] audit: type=1400 audit(1777995920.299:143): avc: denied { unlink } for pid=388 comm="syz.3.23" name="#1" dev="tmpfs" ino=58 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 30.151889][ T36] audit: type=1400 audit(1777995920.299:144): avc: denied { mount } for pid=388 comm="syz.3.23" name="/" dev="overlay" ino=52 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 30.174297][ T298] ------------[ cut here ]------------ [ 30.174739][ T36] audit: type=1400 audit(1777995920.309:145): avc: denied { watch } for pid=388 comm="syz.3.23" path="/6/file0" dev="overlay" ino=52 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 30.179778][ T298] WARNING: CPU: 0 PID: 298 at fs/overlayfs/util.c:602 ovl_dir_modified+0x15a/0x190 [ 30.202283][ T36] audit: type=1400 audit(1777995920.309:146): avc: denied { read } for pid=388 comm="syz.3.23" name=".pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 30.210983][ T298] Modules linked in: [ 30.211020][ T298] CPU: 0 UID: 0 PID: 298 Comm: syz-executor Not tainted syzkaller #0 8e204e40c44961bd6596aa96fc7bf4ad6280e2fe [ 30.234944][ T31] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 253, changing to 7 [ 30.238092][ T298] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 30.254748][ T31] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 142, changing to 7 [ 30.260799][ T298] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 30.283049][ T31] usb 1-1: New USB device found, idVendor=047f, idProduct=c010, bcdDevice= 0.40 [ 30.287581][ T298] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 ee 5f 97 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d e9 bc c4 5b 03 cc e8 b6 ee 3e ff <0f> 0b e9 3e ff ff ff e8 aa ee 3e ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 30.297435][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.316439][ T298] RSP: 0018:ffffc9000b6efb48 EFLAGS: 00010293 [ 30.329141][ T31] usb 1-1: Product: syz [ 30.330663][ T298] RAX: ffffffff8248cdea RBX: 0000000000000000 RCX: ffff88812b331300 [ 30.330682][ T298] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 30.335143][ T31] usb 1-1: Manufacturer: syz [ 30.342825][ T298] RBP: ffffc9000b6efb70 R08: ffff888115e0445f R09: 1ffff11022bc088b [ 30.342842][ T298] R10: dffffc0000000000 R11: ffffed1022bc088c R12: 0000000000000000 [ 30.351206][ T31] usb 1-1: SerialNumber: syz [ 30.355526][ T298] R13: dffffc0000000000 R14: ffff888115e043c0 R15: ffff88813141d770 [ 30.355543][ T298] FS: 00005555696bb500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 30.355560][ T298] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 30.400322][ T298] CR2: 00005555696e6998 CR3: 0000000102ffc000 CR4: 00000000003526b0 [ 30.408383][ T298] Call Trace: [ 30.411667][ T298] [ 30.414641][ T298] ovl_do_remove+0x81b/0xda0 [ 30.419261][ T298] ? ovl_set_redirect+0x780/0x780 [ 30.424343][ T298] ? down_write+0xee/0x2b0 [ 30.428769][ T298] ? __cfi_down_write+0x10/0x10 [ 30.433644][ T298] ovl_rmdir+0x1e/0x30 [ 30.437767][ T298] vfs_rmdir+0x3e0/0x560 [ 30.442027][ T298] incfs_kill_sb+0x109/0x230 [ 30.446660][ T298] deactivate_locked_super+0xd8/0x2a0 [ 30.452090][ T298] deactivate_super+0xb8/0xe0 [ 30.457040][ T298] cleanup_mnt+0x406/0x4a0 [ 30.461561][ T298] __cleanup_mnt+0x1d/0x40 [ 30.466261][ T298] task_work_run+0x1e5/0x260 [ 30.470860][ T298] ? __cfi_task_work_run+0x10/0x10 [ 30.476036][ T298] ? __x64_sys_umount+0x12e/0x180 [ 30.481071][ T298] ? __cfi___x64_sys_umount+0x10/0x10 [ 30.486481][ T298] ? __kasan_check_read+0x15/0x20 [ 30.491527][ T298] resume_user_mode_work+0x35/0x50 [ 30.496673][ T298] syscall_exit_to_user_mode+0x63/0xb0 [ 30.502136][ T298] do_syscall_64+0x63/0xf0 [ 30.506632][ T298] ? clear_bhb_loop+0x50/0xa0 [ 30.511321][ T298] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 30.517273][ T298] RIP: 0033:0x7fbde979e017 [ 30.521702][ T298] Code: a2 c7 05 dc 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 30.541640][ T298] RSP: 002b:00007ffedfc06708 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 30.550391][ T298] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fbde979e017 [ 30.558431][ T298] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffedfc067c0 [ 30.566539][ T298] RBP: 00007ffedfc067c0 R08: 00007ffedfc077c0 R09: 00000000ffffffff [ 30.574568][ T298] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffedfc07850 [ 30.582577][ T298] R13: 00007fbde9832120 R14: 0000000000007584 R15: 00007ffedfc07890 [ 30.590642][ T298] [ 30.593685][ T298] ---[ end trace 0000000000000000 ]--- [ 30.599766][ T9] usb 3-1: USB disconnect, device number 3 [ 30.606784][ T298] ------------[ cut here ]------------ [ 30.612259][ T298] WARNING: CPU: 0 PID: 298 at fs/overlayfs/util.c:602 ovl_dir_modified+0x15a/0x190 [ 30.621772][ T298] Modules linked in: [ 30.625870][ T298] CPU: 0 UID: 0 PID: 298 Comm: syz-executor Tainted: G W syzkaller #0 8e204e40c44961bd6596aa96fc7bf4ad6280e2fe [ 30.639021][ T298] Tainted: [W]=WARN [ 30.642823][ T298] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 30.653045][ T298] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 30.658740][ T298] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 ee 5f 97 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d e9 bc c4 5b 03 cc e8 b6 ee 3e ff <0f> 0b e9 3e ff ff ff e8 aa ee 3e ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 30.678402][ T298] RSP: 0018:ffffc9000b6efb48 EFLAGS: 00010293 [ 30.684539][ T298] RAX: ffffffff8248cdea RBX: 0000000000000000 RCX: ffff88812b331300 [ 30.692528][ T298] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 30.701110][ T298] RBP: ffffc9000b6efb70 R08: ffff888115e0445f R09: 1ffff11022bc088b [ 30.709620][ T298] R10: dffffc0000000000 R11: ffffed1022bc088c R12: 0000000000000000 [ 30.717667][ T298] R13: dffffc0000000000 R14: ffff888115e043c0 R15: ffff88813141d770 [ 30.725722][ T298] FS: 00005555696bb500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 30.734733][ T298] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 30.741456][ T298] CR2: 00005555696e6998 CR3: 0000000102ffc000 CR4: 00000000003526b0 [ 30.749494][ T298] Call Trace: [ 30.752784][ T298] [ 30.755765][ T298] ovl_do_remove+0x81b/0xda0 [ 30.760384][ T298] ? ovl_set_redirect+0x780/0x780 [ 30.765480][ T298] ? down_write+0xee/0x2b0 [ 30.769917][ T298] ? __cfi_down_write+0x10/0x10 [ 30.775159][ T298] ovl_rmdir+0x1e/0x30 [ 30.779251][ T298] vfs_rmdir+0x3e0/0x560 [ 30.783536][ T298] incfs_kill_sb+0x1a0/0x230 [ 30.788654][ T298] deactivate_locked_super+0xd8/0x2a0 [ 30.794118][ T298] deactivate_super+0xb8/0xe0 [ 30.798820][ T298] cleanup_mnt+0x406/0x4a0 [ 30.803268][ T298] __cleanup_mnt+0x1d/0x40 [ 30.807736][ T298] task_work_run+0x1e5/0x260 [ 30.812343][ T298] ? __cfi_task_work_run+0x10/0x10 [ 30.817509][ T298] ? __x64_sys_umount+0x12e/0x180 [ 30.822556][ T298] ? __cfi___x64_sys_umount+0x10/0x10 [ 30.828053][ T298] ? __kasan_check_read+0x15/0x20 [ 30.833196][ T298] resume_user_mode_work+0x35/0x50 [ 30.838363][ T298] syscall_exit_to_user_mode+0x63/0xb0 [ 30.843870][ T298] do_syscall_64+0x63/0xf0 [ 30.848310][ T298] ? clear_bhb_loop+0x50/0xa0 [ 30.853006][ T298] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 30.859144][ T298] RIP: 0033:0x7fbde979e017 [ 30.863573][ T298] Code: a2 c7 05 dc 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 30.883815][ T298] RSP: 002b:00007ffedfc06708 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 30.892253][ T298] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fbde979e017 [ 30.900357][ T298] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffedfc067c0 [ 30.909925][ T298] RBP: 00007ffedfc067c0 R08: 00007ffedfc077c0 R09: 00000000ffffffff [ 30.919002][ T298] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffedfc07850 [ 30.927018][ T298] R13: 00007fbde9832120 R14: 0000000000007584 R15: 00007ffedfc07890 [ 30.935372][ T298] [ 30.938406][ T298] ---[ end trace 0000000000000000 ]--- [ 30.973671][ T379] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 30.982392][ T379] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 31.006925][ T31] usb 1-1: USB disconnect, device number 4