last executing test programs: 3.04493472s ago: executing program 0 (id=1): r0 = open$dir(&(0x7f0000000000)='./proc\x00', 0x40000, 0x103) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='ns\x00') statx(r1, &(0x7f00000002c0)='./cgroup\x00', 0x1000, 0x4, 0x0) openat(r0, &(0x7f0000000040)='./proc\x00', 0x100, 0x92) 3.018909493s ago: executing program 0 (id=7): munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000000)={0x0, &(0x7f0000000040)}) r0 = socket$inet(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @empty}, 0x10) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r4, &(0x7f0000000140)=[{{&(0x7f0000000180)={0x2, 0x4e20, @multicast1}, 0x10, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='p'], 0x70}}], 0x1, 0x2000c044) write$binfmt_misc(r2, &(0x7f0000000200), 0xfffffecc) readv(r0, &(0x7f0000000240)=[{&(0x7f0000000480)=""/4104, 0x1008}], 0x1) splice(r1, 0x0, r3, 0x0, 0x7151, 0x0) syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000440)=ANY=[@ANYBLOB="120101020000004035120c8040000102030109026e0003017f5016080b0002012230230904000000010130000a2401100a00090000000904010000010330"], &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0}) 2.037666843s ago: executing program 2 (id=30): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_CHILD_SUBREAPER(0x24, 0x1) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_CHILD_SUBREAPER(0x24, 0x1) ioctl$SIOCSIFHWADDR(r0, 0x8992, &(0x7f0000000180)={'batadv_slave_0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4a9c1, 0x6) mount$bpf(0x0, 0x0, 0x0, 0x60150e2, &(0x7f0000000080)={[{@gid={'gid', 0x3d, 0xffffffffffffffff}}]}) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='devpts\x00', 0x0, &(0x7f0000000140)) r1 = socket$inet(0x2, 0x80001, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x61, 0x0, 0x48) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0xfffffffffffffffa}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000240)=0x9) syz_clone(0x840c0200, 0x0, 0x0, 0x0, 0x0, 0x0) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000280)='hugetlb.1GB.failcnt\x00', 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x3a8bc000) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TIOCPKT(r3, 0x5420, 0x0) r4 = open(&(0x7f00000002c0)='./file0\x00', 0x149442, 0x40) fcntl$setlease(r4, 0x400, 0x0) fcntl$setlease(r4, 0x400, 0x2) syz_open_pts(r3, 0x381002) 1.299146848s ago: executing program 2 (id=32): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340), 0x41, 0x0) write$binfmt_aout(r0, &(0x7f0000000380)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000003c0)={0x0, 0x0, 0x3, 0x7fff, 0x16, "b0bf2ebb48c849ac0000000003000018bfff40"}) r1 = syz_open_pts(r0, 0x200) r2 = dup3(r1, r0, 0x80000) ioctl$KDGETKEYCODE(r0, 0x4b4c, &(0x7f0000000000)={0x0, 0x3}) timer_create(0x0, &(0x7f0000000040)={0x0, 0x21, 0x2}, &(0x7f0000000080)) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f00000000c0)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000015000/0x3000)=nil, 0x3000, 0x2000002) write(r0, &(0x7f0000000500)="9e033d919295652a8ff0e2ec37a5e20543bfabb16e4bd6fed7e98f9d5e777186eff4413615c5abadb4d286ca4a483460d6cf307febc980fd7d6bc455d76d30ce8044cb11c1f7d8ffa32ff97052830cc7bc1e020deac6d088537bd806c6e99de345f2a6", 0x63) timer_settime(0x0, 0x1, &(0x7f0000000100)={{0x0, 0x3938700}}, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r3 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write$UHID_CREATE(r3, &(0x7f0000000180)={0x0, {'syz0\x00', 'syz0\x00', 'syz0\x00', &(0x7f00000002c0)=""/2, 0x2, 0x0, 0x8}}, 0x120) readv(r3, &(0x7f0000000300)=[{&(0x7f0000000440)=""/155, 0x9b}, {0x0, 0x4}], 0x2) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000400)=0x11) 1.298785018s ago: executing program 3 (id=33): mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./trace\x00', 0x2af) mount(0x0, &(0x7f0000000200)='./trace\x00', &(0x7f0000000240)='tracefs\x00', 0x0, 0x0) (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./trace/events/sched/sched_switch/trigger\x00', 0x302, 0x0) write(r0, &(0x7f0000000540)="686973743a6b6579733d635da709a8b7b562dc7f657374616d702e753bd2301ad6bb3ab30c05d9f58ad0c59701d592da90f73d3e0dac14923b8bd0f272539e2bb663592e34436d58ac2c9251", 0x4c) (async) symlinkat(&(0x7f0000000000)='./trace\x00', r0, &(0x7f0000000040)='./trace\x00') 1.210157587s ago: executing program 3 (id=34): r0 = syz_io_uring_setup(0xd3a, &(0x7f0000000300)={0x0, 0x8000002, 0x3a10, 0x3, 0x3}, &(0x7f0000000240)=0x0, &(0x7f00000003c0)=0x0, &(0x7f0000000400)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000040)={0x2e, 0x2, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0xff7f0000, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000000)=@new_dev={0x4, 0x3af, 0x0, 0x0, 0x1000, 0xffffffff, 0xffffffffffffffff, 0x0, 0x40}}}, &(0x7f00000000c0)) 1.209886067s ago: executing program 3 (id=35): r0 = socket$inet6(0xa, 0x1, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (rerun: 32) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x89f1, &(0x7f0000000040)={'tunl0\x00', &(0x7f0000000080)=@ethtool_cmd={0x41, 0x5, 0x0, 0x4, 0x7, 0x2, 0x5, 0x1, 0x57, 0x8, 0xfffffffd, 0x2, 0x8, 0xff, 0x9a, 0x45, [0x3]}}) (async) mount$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_EXTERNAL_AUTH(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240), 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x3c, r2, 0x200, 0x70bd2a, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x17}, @NL80211_ATTR_BSSID={0xa, 0xf5, @random="5984b415bcf4"}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x4b}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) (async) unshare(0x60000600) (async) setns(0xc9, 0x0) (async, rerun: 64) r3 = socket$netlink(0x10, 0x3, 0x0) (rerun: 64) sendmsg$netlink(r3, 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x8880, 0x85) socket$inet_udp(0x2, 0x2, 0x0) (async) r4 = socket(0x10, 0x3, 0x0) write(r4, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) 1.106644428s ago: executing program 3 (id=37): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) symlinkat(&(0x7f00000001c0)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00') ioctl$INCFS_IOC_CREATE_FILE(0xffffffffffffffff, 0xc058671e, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./bus\x00', 0x0) syz_open_dev$mouse(0x0, 0x790, 0x2f0040) mount$overlay(0x0, &(0x7f00000002c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@verity_off}]}) 1.048651814s ago: executing program 3 (id=39): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000040)={@mcast1, 0x800, 0x0, 0x103, 0x1}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000080)=0x5, 0x4) sendmsg$inet6(r0, &(0x7f00000000c0)={&(0x7f0000000100)={0xa, 0x4e1f, 0x83000, @dev={0xfe, 0x80, '\x00', 0x9}, 0x9}, 0x1c, 0x0}, 0x440e0) 805.770958ms ago: executing program 3 (id=41): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) (async) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000800)='./cgroup/syz0\x00', 0x200002, 0x0) fcntl$lock(r1, 0x24, &(0x7f00000007c0)={0x0, 0x2, 0x2, 0x5}) (async) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000100)={0x1, &(0x7f00000002c0)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000400)={0x2, 0x4e21, @broadcast}, 0x10) setsockopt$inet_tcp_int(r4, 0x6, 0x2, &(0x7f0000000440)=0x8a4, 0x4) (async) connect$inet(r4, &(0x7f0000000480)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x19}}, 0x10) (async, rerun: 64) r5 = socket(0xa, 0x3, 0x3a) (rerun: 64) getsockopt$MRT6(r5, 0x29, 0xce, 0x0, &(0x7f00000004c0)) (async) sendto$inet(r4, &(0x7f0000000500), 0xffffffffffffff94, 0x34, 0x0, 0x0) (async) getsockopt$inet_int(r2, 0x0, 0x7, &(0x7f0000000500), &(0x7f0000000600)=0x4) (async) ioctl$NILFS_IOCTL_GET_BDESCS(r5, 0xc0186e87, &(0x7f0000000780)={&(0x7f0000000640)=[{0x16, 0x78f, 0x39, 0x797d91d7, 0x8}, {0x2, 0x1fe00000, 0x9, 0x6, 0x4}, {0x401, 0x9, 0x5, 0x7, 0x5}, {0x2, 0x3, 0x56, 0xffffffffffffffff, 0x7f}, {0x800, 0x9, 0x3, 0x9680, 0x2a6}, {0x9, 0x1, 0x7, 0x4, 0x4}, {0x8, 0xff, 0x9, 0x4, 0x8}], 0x7, 0x28, 0x200, 0xffffffffc218ee0a}) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000540)={0x1, &(0x7f0000000580)=[{0x6, 0x7, 0x0, 0x8001}]}, 0x10) recvfrom$inet(r4, &(0x7f00000005c0)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000000300)) (async) ioctl$SNDRV_TIMER_IOCTL_CREATE(r2, 0xc02054a5, &(0x7f0000000380)={0xa, r3, 'id1\x00'}) (async, rerun: 64) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) (async, rerun: 64) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000840)='pipefs\x00', 0x83c30, 0x0) (async) memfd_secret(0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) (async, rerun: 64) ioprio_get$pid(0x2, 0x0) (rerun: 64) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000180)={0x1, &(0x7f00000001c0)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) r6 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) clock_nanosleep(0x4, 0x0, &(0x7f0000000240), 0x0) (async) write(r6, &(0x7f0000000280)='3', 0x4e) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) (async, rerun: 64) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) (rerun: 64) 575.253691ms ago: executing program 1 (id=42): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000200)={'ip_vti0\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @loopback, @multicast1}}}}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r1, 0x89f4, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000000)={@remote, 0x0, 0x0, 0x80, 0x0, [{@multicast2}, {@local}, {}, {@multicast1}, {@private}, {@broadcast}, {@empty}, {@loopback}]}}) 500.755779ms ago: executing program 1 (id=43): ioprio_set$pid(0x1, 0x0, 0x0) mknod$loop(&(0x7f0000001380)='./file0\x00', 0xfff, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000013c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000001400)='./file0\x00', &(0x7f0000001440), 0x80, &(0x7f0000001480)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000001500)={0x2020}, 0x2020) write$FUSE_INIT(r0, 0x0, 0x0) utime(0x0, &(0x7f0000003600)={0x8}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = fsopen(&(0x7f0000003640)='fuseblk\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000003680)='j\x95\'\x8aC\x16\xca\\', &(0x7f00000036c0)='\xe6usek\v\xf6u%\x9b\x00\x00\xad\xeb\x00\x00\x00\x00\x01\x80\x00\x00\xcf\x9b\x9f\b\xb6\xfe\xc8\xda~-\x83w\xf9Z\xd2\xcb\xcdF\xd0#N7\x17\xfc\x1e\xf1\x97\xffxi\xe0KE}]\x8e\xca\xe3+\xc8\x98\x03\x91\x88(\bn\x7f\x0e\x85\xa5\xb4\n?^\xc9\xef\xe0Q\x01\xb6\xa5\x81t\x06\xda\x95\x935\xf1\x18\xac\x00\xf0\xff\xff\x80\x1a\xa1\x06\xfd\x01\x00\x00\x00\x0f\xf8\xe3\x8a\x1f\x9c\xf3\xc5\x1f\xf9\xbf?\xc1\rv\xd3j\r6\x7f\x00'/141, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000003780)='\x00\xe5\xff\xff\xff\xff\xff\xff\xff2', &(0x7f00000037c0)='\x1d*.\x005\x98\xc7\x05\xf4\x99D\x97*\x10\xce\xdb_\xa2\xc0w\n\x9f\xbbpN\xab,\xd9\x90D\x8a\x04\xe9\x84#\x14\xf8\x95\xd5\x1a\xeaO|\x1c\xa2\\LB\x93W\x86y\x14\xa1\x01\xa2#jN{\x05\x1bdVL8\xbauD\xde\xc1P\x00'/86, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000003840)='\x00', &(0x7f0000003880)='(!\xef(.(\\-]\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r1, 0x2, &(0x7f00000038c0)='\xe6\xdf\xf4\x89\b,\xcd\x9dP\x9e\xd7\xe3/\xd2=#\xc8\xb7\x98\f\x87\xcf\x00\x00\x00\x00\x00\x00\x00\x9a\x8e\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000003900), 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_BINARY(r1, 0x2, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, 0x0, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) r2 = syz_open_procfs(0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$KVM_GET_NESTED_STATE(r2, 0xc080aebe, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc0686611, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x5e3f8b2d08cbb781) mount(0x0, &(0x7f0000000040)='./trace\x00', 0x0, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./trace/events/sched/sched_switch/trigger\x00', 0x2, 0x0) write(r3, &(0x7f0000000100)='traceon', 0x7) 489.93068ms ago: executing program 1 (id=44): r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_SET(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x3c, 0x3e9, 0x400, 0x70bd29, 0x25dfdbfc, {0x18, 0x1, 0x2, 0x0, 0x3f1, 0x7fffffff, 0xfffffffb, 0x2, 0x0, 0x5f5, 0x8}}, 0x3c}, 0x1, 0xf0ffffff, 0x0, 0x4000000}, 0x80) 416.366538ms ago: executing program 1 (id=45): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000540)) syz_clone(0x4040411, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000580)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$UFFDIO_WRITEPROTECT(r0, 0xc018aa06, &(0x7f00000005c0)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) r1 = getpid() process_vm_readv(r1, &(0x7f0000000600)=[{&(0x7f0000000640)=""/54, 0x7ffff000}, {&(0x7f0000000680)=""/152, 0x98}], 0x2, &(0x7f0000000740)=[{&(0x7f0000000880)=""/95, 0x7ffff000}], 0x286, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0xf4, 0x4a, 0x1, 0x0, 0x0, {0xa, 0x0, 0x6e80}, [@nested={0xde, 0xd7, 0x0, 0x1, [@generic="fbf62c76672e35dcf37a940a4d51b84d8d05412370e04db6ecee57c4282d925e46a598b18962bcef5bb500284d734f55079b90b8d2604e06a475b726781a988a668d40836e203b91be84cb5d14d73038c9edb3952f1e2f8f554acba852ceb12e922e05ef6b7ba3c7db22a95c6a1a8d6adee76894fd638217c84661ab2037e1df1462202a88b9e1c507bca519a10228aec9472703550b2839efbf10ef24dcc2acc2e711c9d7dcb4776fd9c0295859ea1fa06c1103a4b80c74917015ade12c645ca7bce63b34ec41b00cb193febb5fd6bf8f338e2ebc935b15e32e"]}]}, 0xf4}}, 0x4008000) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000140)={0x1, 0x0, [{0xf88e470f, 0xed}]}) r3 = openat$kvm(0xffffff9c, &(0x7f0000000180), 0x800, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e23, 0x2, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xa}}, 0x8000}, 0x1c) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x11, &(0x7f0000000380)=0x8, 0x4) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000400)={[0xc45, 0x9, 0xfffffffffffffffd, 0x10000000, 0x10000, 0x3, 0x4002004c2, 0x803, 0x9, 0x0, 0x400, 0x80, 0x89, 0xfffffffffffffffd, 0x8, 0x8d], 0x100000, 0x240046}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000006000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000080)="f00fba760004f3ab0f3036deb9800066b9800000c00f326635000400000f300fbf81c5b0e600f20f017e0064f364f30f20160f01cf", 0x35}], 0x1, 0x1, 0x0, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) shutdown(r7, 0x2) close(r7) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x34) pidfd_getfd(0xffffffffffffffff, r2, 0x0) 146.110765ms ago: executing program 2 (id=46): unshare(0x60000600) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="f00000001000132428bd700000000000e00000010000000000000000000000ac1e010100000000000000000000000003"], 0xf0}}, 0x804) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="44000000140001b66fb1b313ba36db000a0000000400000014000100"], 0x44}, 0x1, 0x0, 0x0, 0x4018}, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000280)="390000001300090468fe0700000000001000ff3f04000000480100100000000004002b000a00010014a4ee1ee438d2fd000000000000007208", 0x39}], 0x1) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000380)="3900008713000318680907070000000f0000ff3f04000000170a001700000000040037000f00030001332564aaee7b1d58b9a64411f6bbf44d", 0x39}], 0x1) 119.800148ms ago: executing program 2 (id=47): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000100)={0x10000, 0x2, 0x51002, 0x1000, &(0x7f0000ffe000/0x1000)=nil}) ioctl$KVM_RUN(r2, 0xae80, 0x1100000000000000) 81.580112ms ago: executing program 1 (id=48): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) symlinkat(&(0x7f00000001c0)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00') ioctl$INCFS_IOC_CREATE_FILE(0xffffffffffffffff, 0xc058671e, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./bus\x00', 0x0) syz_open_dev$mouse(0x0, 0x790, 0x2f0040) mount$overlay(0x0, 0x0, &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@verity_off}]}) 62.762714ms ago: executing program 1 (id=49): r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000140)={0x1fff}, 0x30, 0x3) landlock_restrict_self(r1, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) bind$unix(r2, &(0x7f0000000280)=@file={0x1, './file0\x00'}, 0x6e) r3 = openat$selinux_policy(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r3, 0x0) futimesat(r0, &(0x7f0000002240)='./sys_mnt\x00', &(0x7f0000002280)={{}, {0x0, 0x2710}}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) (async) ioctl$KVM_CAP_DISABLE_QUIRKS(r5, 0x4068aea3, &(0x7f00000000c0)={0x74, 0x0, 0x54}) (async) fsetxattr$trusted_overlay_origin(r0, &(0x7f0000000180), &(0x7f0000000300), 0x2, 0x5) (async) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000340)={0x4, 0x0, [{0x40000001, 0x0, 0x5, 0x3fe, 0x3, 0x7fffffff}, {0xd, 0x1ded, 0x7, 0x4, 0x1, 0x8, 0x6}, {0xc0000000, 0x0, 0x1, 0x1, 0x7, 0x7, 0xfdb}, {0x6, 0x0, 0x3, 0x80000001, 0xffffffff, 0xd8cb, 0x3}]}) (async) stat(&(0x7f00000020c0)='./sys_mnt\x00', 0x0) (async) write$selinux_load(r0, &(0x7f0000000000)=ANY=[], 0x190ec) 232.87µs ago: executing program 2 (id=50): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000400)="68000000000905040000efffffffffff", 0x10}], 0x1}, 0x0) 0s ago: executing program 2 (id=51): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./trace\x00', 0x1ff) mount(0x0, 0x0, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000100)='./trace\x00', &(0x7f0000000180)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./trace/events/irq/irq_handler_entry/filter\x00', 0x2, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x2d}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x50, &(0x7f0000000240)=0xb329, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x4e21, @empty}, 0x10) r1 = openat$kvm(0x0, &(0x7f0000000900), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_VM_DISABLE_NX_HUGE_PAGES(r2, 0x4068aea3, &(0x7f0000000940)) getgroups(0x0, 0x0) keyctl$chown(0x4, 0x0, 0xee01, 0x0) keyctl$setperm(0x5, 0x0, 0x300127) keyctl$KEYCTL_MOVE(0x11, 0x0, 0x0, 0x0, 0x1) mount$bpf(0x0, &(0x7f0000000640)='.\x00', &(0x7f00000009c0), 0x201002f, &(0x7f0000000a00)={[{@mode={'mode', 0x3d, 0x1}}], [{@uid_gt}]}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.10.11' (ED25519) to the list of known hosts. [ 22.901653][ T36] audit: type=1400 audit(1793021823.750:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.905155][ T286] cgroup: Unknown subsys name 'net' [ 22.924357][ T36] audit: type=1400 audit(1793021823.750:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.951941][ T36] audit: type=1400 audit(1793021823.780:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.953893][ T286] cgroup: Unknown subsys name 'devices' [ 23.071396][ T286] cgroup: Unknown subsys name 'hugetlb' [ 23.077282][ T286] cgroup: Unknown subsys name 'rlimit' [ 23.192478][ T36] audit: type=1400 audit(1793021824.040:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.215705][ T36] audit: type=1400 audit(1793021824.040:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.240959][ T36] audit: type=1400 audit(1793021824.040:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.265051][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 23.273928][ T36] audit: type=1400 audit(1793021824.120:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.299586][ T36] audit: type=1400 audit(1793021824.120:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.329659][ T36] audit: type=1400 audit(1793021824.180:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.355278][ T36] audit: type=1400 audit(1793021824.180:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.355992][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 24.678476][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.685642][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.692779][ T293] bridge_slave_0: entered allmulticast mode [ 24.699224][ T293] bridge_slave_0: entered promiscuous mode [ 24.705940][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.713048][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.720153][ T293] bridge_slave_1: entered allmulticast mode [ 24.726564][ T293] bridge_slave_1: entered promiscuous mode [ 24.861648][ T298] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.868975][ T298] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.876200][ T298] bridge_slave_0: entered allmulticast mode [ 24.882523][ T298] bridge_slave_0: entered promiscuous mode [ 24.889027][ T298] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.896160][ T298] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.903290][ T298] bridge_slave_1: entered allmulticast mode [ 24.909643][ T298] bridge_slave_1: entered promiscuous mode [ 24.943708][ T299] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.950813][ T299] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.957877][ T299] bridge_slave_0: entered allmulticast mode [ 24.964336][ T299] bridge_slave_0: entered promiscuous mode [ 24.971633][ T299] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.978688][ T299] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.985830][ T299] bridge_slave_1: entered allmulticast mode [ 24.992115][ T299] bridge_slave_1: entered promiscuous mode [ 25.007224][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.014398][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.021582][ T297] bridge_slave_0: entered allmulticast mode [ 25.027840][ T297] bridge_slave_0: entered promiscuous mode [ 25.037353][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.044550][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.051709][ T297] bridge_slave_1: entered allmulticast mode [ 25.058010][ T297] bridge_slave_1: entered promiscuous mode [ 25.064628][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.071727][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.079108][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.086209][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.222842][ T299] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.229940][ T299] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.237249][ T299] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.244393][ T299] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.252649][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.259994][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.267823][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.275263][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.286904][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.293994][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.310530][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.317594][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.373289][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.380387][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.397703][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.404797][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.417892][ T293] veth0_vlan: entered promiscuous mode [ 25.431534][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.438604][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.458546][ T293] veth1_macvtap: entered promiscuous mode [ 25.466815][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.473891][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.485553][ T309] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.492641][ T309] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.515842][ T309] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.523004][ T309] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.538055][ T299] veth0_vlan: entered promiscuous mode [ 25.562964][ T299] veth1_macvtap: entered promiscuous mode [ 25.572021][ T297] veth0_vlan: entered promiscuous mode [ 25.595012][ T298] veth0_vlan: entered promiscuous mode [ 25.608923][ T297] veth1_macvtap: entered promiscuous mode [ 25.616142][ T293] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 25.648427][ T298] veth1_macvtap: entered promiscuous mode [ 25.697288][ T314] FAULT_INJECTION: forcing a failure. [ 25.697288][ T314] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 25.711048][ T314] CPU: 1 UID: 0 PID: 314 Comm: syz.1.5 Not tainted syzkaller #0 c7db6ca8d812f5bae3d5d94ae814da2ca1a33223 [ 25.711083][ T314] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 25.711107][ T314] Call Trace: [ 25.711114][ T314] [ 25.711122][ T314] __dump_stack+0x21/0x30 [ 25.711160][ T314] dump_stack_lvl+0x140/0x1c0 [ 25.711194][ T314] ? __cfi_dump_stack_lvl+0x10/0x10 [ 25.711227][ T314] ? check_stack_object+0x138/0x150 [ 25.711268][ T314] dump_stack+0x19/0x20 [ 25.711300][ T314] should_fail_ex+0x3c2/0x510 [ 25.711323][ T314] should_fail+0xf/0x20 [ 25.711343][ T314] should_fail_usercopy+0x1e/0x30 [ 25.711366][ T314] _copy_to_user+0x24/0xa0 [ 25.711393][ T314] simple_read_from_buffer+0xed/0x160 [ 25.711420][ T314] proc_fail_nth_read+0x1aa/0x220 [ 25.711448][ T314] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 25.711476][ T314] ? bpf_lsm_file_permission+0xd/0x20 [ 25.711499][ T314] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 25.711526][ T314] vfs_read+0x288/0xc70 [ 25.711558][ T314] ? __cfi_vfs_read+0x10/0x10 [ 25.711586][ T314] ? __kasan_check_write+0x18/0x20 [ 25.711616][ T314] ? mutex_lock+0x97/0x1d0 [ 25.711643][ T314] ? __cfi_mutex_lock+0x10/0x10 [ 25.711674][ T314] ksys_read+0x145/0x260 [ 25.711703][ T314] ? __cfi_ksys_read+0x10/0x10 [ 25.711732][ T314] ? __kasan_check_write+0x18/0x20 [ 25.711762][ T314] ? fput+0x1a4/0x230 [ 25.711786][ T314] ? __kasan_check_read+0x15/0x20 [ 25.711816][ T314] __x64_sys_read+0x7f/0x90 [ 25.711847][ T314] x64_sys_call+0x2638/0x2ee0 [ 25.711870][ T314] do_syscall_64+0x57/0xf0 [ 25.711893][ T314] ? clear_bhb_loop+0x50/0xa0 [ 25.711923][ T314] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 25.711952][ T314] RIP: 0033:0x7f86fd35fd8e [ 25.711977][ T314] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 25.711996][ T314] RSP: 002b:00007f86fe2c0fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 25.712030][ T314] RAX: ffffffffffffffda RBX: 00007f86fe2c16c0 RCX: 00007f86fd35fd8e [ 25.712047][ T314] RDX: 000000000000000f RSI: 00007f86fe2c10a0 RDI: 0000000000000004 [ 25.712062][ T314] RBP: 00007f86fe2c1090 R08: 0000000000000000 R09: 0000000000000000 [ 25.712076][ T314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 25.712089][ T314] R13: 00007f86fd626038 R14: 00007f86fd625fa0 R15: 00007ffee7d728b8 [ 25.712109][ T314] [ 26.042136][ T346] Invalid logical block size (4) [ 26.061608][ T348] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 26.184668][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.190295][ T360] ======================================================= [ 26.190295][ T360] WARNING: The mand mount option has been deprecated and [ 26.190295][ T360] and is ignored by this kernel. Remove the mand [ 26.190295][ T360] option from the mount to silence this warning. [ 26.190295][ T360] ======================================================= [ 26.225530][ T10] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 26.233717][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.240528][ T360] 9pnet_fd: Insufficient options for proto=fd [ 26.242107][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.252766][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.258294][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.263948][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.281865][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.288795][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.294377][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.299947][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.305476][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.311228][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.316750][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.324243][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.332025][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.338425][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.344197][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.349738][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.355219][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.361224][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.366714][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.372309][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.377863][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.383941][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.391043][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.397573][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.403586][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.409436][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.415036][ T10] usb 1-1: unable to get BOS descriptor or descriptor too short [ 26.428488][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.435166][ T10] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 26.445369][ T10] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 26.454874][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.460624][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.466165][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.471838][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.471916][ T10] usb 1-1: New USB device found, idVendor=1235, idProduct=800c, bcdDevice= 0.40 [ 26.486631][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.492110][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.500297][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.505812][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.511841][ T10] usb 1-1: Product: syz [ 26.516021][ T10] usb 1-1: Manufacturer: syz [ 26.520957][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.526545][ T10] usb 1-1: SerialNumber: syz [ 26.529991][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.537047][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.542612][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.548214][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.553823][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.560035][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.565544][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.571426][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.576924][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.582698][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.588190][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.594023][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.599522][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.605060][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.610622][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.616133][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.621663][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.627140][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.632624][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.638092][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.643592][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.649672][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.655309][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.666311][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.672209][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.677746][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.683358][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.688881][ T359] cgroup: Unknown subsys name 'rfdno' [ 26.706197][ T45] rust_binder: 320: undelivered TRANSACTION_COMPLETE [ 26.733281][ T45] rust_binder: 320: undelivered transaction 2, process died [ 26.828147][ T395] devpts: called with bogus options [ 27.515377][ T401] netlink: 44 bytes leftover after parsing attributes in process `syz.3.31'. [ 27.527061][ T401] netlink: 8 bytes leftover after parsing attributes in process `syz.3.31'. [ 27.692923][ T408] netlink: 32 bytes leftover after parsing attributes in process `syz.3.35'. [ 27.775313][ T415] overlayfs: workdir and upperdir must be separate subtrees [ 27.783501][ T416] FAULT_INJECTION: forcing a failure. [ 27.783501][ T416] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 27.814090][ T416] CPU: 0 UID: 0 PID: 416 Comm: syz.1.38 Not tainted syzkaller #0 c7db6ca8d812f5bae3d5d94ae814da2ca1a33223 [ 27.814124][ T416] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 27.814138][ T416] Call Trace: [ 27.814146][ T416] [ 27.814154][ T416] __dump_stack+0x21/0x30 [ 27.814196][ T416] dump_stack_lvl+0x140/0x1c0 [ 27.814230][ T416] ? __cfi_dump_stack_lvl+0x10/0x10 [ 27.814265][ T416] ? check_stack_object+0x81/0x150 [ 27.814299][ T416] dump_stack+0x19/0x20 [ 27.814330][ T416] should_fail_ex+0x3c2/0x510 [ 27.814354][ T416] should_fail+0xf/0x20 [ 27.814374][ T416] should_fail_usercopy+0x1e/0x30 [ 27.814398][ T416] _copy_from_user+0x20/0xa0 [ 27.814425][ T416] xfrm_user_policy+0x237/0x6e0 [ 27.814449][ T416] ? bpf_lsm_capable+0xd/0x20 [ 27.814476][ T416] ? __cfi_xfrm_user_policy+0x10/0x10 [ 27.814499][ T416] ? ns_capable+0x90/0xf0 [ 27.814529][ T416] do_ipv6_setsockopt+0x175c/0x3350 [ 27.814565][ T416] ? __cfi_do_ipv6_setsockopt+0x10/0x10 [ 27.814597][ T416] ? avc_has_perm_noaudit+0x26b/0x360 [ 27.814621][ T416] ? __asan_memcpy+0x5a/0x80 [ 27.814652][ T416] ? avc_has_perm_noaudit+0x289/0x360 [ 27.814677][ T416] ? avc_has_perm+0x155/0x240 [ 27.814698][ T416] ? __cfi_avc_has_perm+0x10/0x10 [ 27.814722][ T416] ? selinux_socket_setsockopt+0x324/0x3d0 [ 27.814750][ T416] ? __cfi_selinux_socket_setsockopt+0x10/0x10 [ 27.814776][ T416] ? bpf_lsm_file_permission+0xd/0x20 [ 27.814800][ T416] ? vfs_write+0xbcf/0xfd0 [ 27.814831][ T416] ipv6_setsockopt+0x5d/0x170 [ 27.814863][ T416] udpv6_setsockopt+0xa3/0xc0 [ 27.814889][ T416] sock_common_setsockopt+0xb8/0xd0 [ 27.814911][ T416] ? __cfi_sock_common_setsockopt+0x10/0x10 [ 27.814935][ T416] do_sock_setsockopt+0x27c/0x410 [ 27.814967][ T416] ? __cfi_do_sock_setsockopt+0x10/0x10 [ 27.814997][ T416] ? __fget_files+0x2bc/0x330 [ 27.815021][ T416] __x64_sys_setsockopt+0x18c/0x220 [ 27.815052][ T416] x64_sys_call+0x2adc/0x2ee0 [ 27.815075][ T416] do_syscall_64+0x57/0xf0 [ 27.815098][ T416] ? clear_bhb_loop+0x50/0xa0 [ 27.815130][ T416] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 27.815160][ T416] RIP: 0033:0x7f86fd39f559 [ 27.815178][ T416] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 27.815197][ T416] RSP: 002b:00007f86fe2c1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 27.815221][ T416] RAX: ffffffffffffffda RBX: 00007f86fd625fa0 RCX: 00007f86fd39f559 [ 27.815238][ T416] RDX: 0000000000000023 RSI: 0000000000000029 RDI: 0000000000000003 [ 27.815253][ T416] RBP: 00007f86fe2c1090 R08: 00000000000000e8 R09: 0000000000000000 [ 27.815267][ T416] R10: 0000200000000280 R11: 0000000000000246 R12: 0000000000000001 [ 27.815282][ T416] R13: 00007f86fd626038 R14: 00007f86fd625fa0 R15: 00007ffee7d728b8 [ 27.815301][ T416] [ 27.886878][ T45] hid-generic 0000:0008:0000.0001: unknown main item tag 0x0 [ 28.036612][ T423] x_tables: duplicate underflow at hook 1 [ 28.060566][ T45] hid-generic 0000:0008:0000.0001: unknown main item tag 0x0 [ 28.129378][ T45] hid-generic 0000:0008:0000.0001: hidraw0: HID v0.00 Device [syz0] on syz0 [ 28.144456][ T36] kauditd_printk_skb: 86 callbacks suppressed [ 28.144476][ T36] audit: type=1400 audit(1793021828.990:160): avc: denied { getopt } for pid=427 comm="syz.3.41" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 28.214607][ T36] audit: type=1400 audit(1793021828.990:161): avc: denied { ioctl } for pid=427 comm="syz.3.41" path="socket:[4553]" dev="sockfs" ino=4553 ioctlcmd=0x6e87 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 28.310554][ T36] audit: type=1400 audit(1793021829.160:162): avc: denied { read write } for pid=456 comm="syz.1.43" name="fuse" dev="devtmpfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 28.334150][ T36] audit: type=1400 audit(1793021829.160:163): avc: denied { open } for pid=456 comm="syz.1.43" path="/dev/fuse" dev="devtmpfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 28.368245][ T36] audit: type=1400 audit(1793021829.210:164): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 28.397042][ T429] cgroup: fork rejected by pids controller in /syz3 [ 28.406668][ T36] audit: type=1400 audit(1793021829.260:165): avc: denied { nlmsg_write } for pid=464 comm="syz.1.44" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 28.452776][ T36] audit: type=1400 audit(1793021829.300:166): avc: denied { ioctl } for pid=466 comm="syz.1.45" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=3686 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 28.543736][ T467] netlink: 216 bytes leftover after parsing attributes in process `syz.1.45'. [ 28.603319][ T36] audit: type=1400 audit(1793021829.450:167): avc: denied { read } for pid=466 comm="syz.1.45" dev="nsfs" ino=4026532297 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 28.624844][ T36] audit: type=1400 audit(1793021829.450:168): avc: denied { open } for pid=466 comm="syz.1.45" path="net:[4026532297]" dev="nsfs" ino=4026532297 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 28.693180][ T479] netlink: 24 bytes leftover after parsing attributes in process `syz.2.46'. [ 28.702941][ T479] netlink: 9 bytes leftover after parsing attributes in process `syz.2.46'. [ 28.724260][ T479] gretap0: entered promiscuous mode [ 28.830661][ T36] audit: type=1400 audit(1793021829.680:169): avc: denied { load_policy } for pid=493 comm="syz.1.49" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 28.851161][ T494] ------------[ cut here ]------------ [ 28.856857][ T494] WARNING: CPU: 1 PID: 494 at mm/page_alloc.c:5286 __alloc_pages_noprof+0x109/0x7e0 [ 28.866488][ T494] Modules linked in: [ 28.870445][ T494] CPU: 1 UID: 0 PID: 494 Comm: syz.1.49 Not tainted syzkaller #0 c7db6ca8d812f5bae3d5d94ae814da2ca1a33223 [ 28.882015][ T494] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 28.892141][ T494] RIP: 0010:__alloc_pages_noprof+0x109/0x7e0 [ 28.898173][ T494] Code: 00 0f 1f 44 00 00 83 fb 0b 72 28 b8 00 20 00 00 23 44 24 40 75 1d 80 3d 0a 04 8a 06 00 0f 85 c2 00 00 00 c6 05 fd 03 8a 06 01 <0f> 0b 31 c0 e9 b4 00 00 00 83 fb 0a 0f 87 a9 00 00 00 44 8b 64 24 [ 28.917889][ T494] RSP: 0018:ffffc9000c4b7560 EFLAGS: 00010246 [ 28.924032][ T494] RAX: 0000000000000000 RBX: 0000000000000016 RCX: 0000000000000000 [ 28.932053][ T494] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000c4b7618 [ 28.940119][ T494] RBP: ffffc9000c4b76a0 R08: ffffc9000c4b7617 R09: 0000000000000000 [ 28.941065][ T10] usb 1-1: MIDIStreaming interface descriptor not found [ 28.948123][ T494] R10: ffffc9000c4b7600 R11: fffff52001896ec3 R12: ffffc9000c4b75a0 [ 28.963151][ T494] R13: dffffc0000000000 R14: 1ffff92001896eb0 R15: 0000000000000000 [ 28.971213][ T494] FS: 00007f86fe2c16c0(0000) GS:ffff8881f6d00000(0000) knlGS:0000000000000000 [ 28.974300][ T10] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 28.980201][ T494] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 28.980223][ T494] CR2: 0000200000019000 CR3: 000000011324a000 CR4: 00000000003526b0 [ 29.003886][ T494] Call Trace: [ 29.007194][ T494] [ 29.010193][ T494] ? vfs_write+0x3c1/0xfd0 [ 29.014659][ T494] ? ksys_write+0x145/0x260 [ 29.019318][ T494] ? x64_sys_call+0x271c/0x2ee0 [ 29.024218][ T494] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 29.025262][ T10] usb 1-1: USB disconnect, device number 2 [ 29.030023][ T494] ? hashtab_init+0xd6/0x1f0 [ 29.041035][ T494] ___kmalloc_large_node+0x81/0x220 [ 29.046303][ T494] ? hashtab_init+0xd6/0x1f0 [ 29.050976][ T494] __kmalloc_large_node_noprof+0x1e/0xd0 [ 29.056651][ T494] ? hashtab_init+0xd6/0x1f0 [ 29.061306][ T494] __kmalloc_noprof+0x326/0x510 [ 29.066215][ T494] ? kasan_save_alloc_info+0x3a/0x50 [ 29.071598][ T494] hashtab_init+0xd6/0x1f0 [ 29.076063][ T494] ? common_read+0x175/0x490 [ 29.080731][ T494] symtab_init+0x44/0x70 [ 29.085022][ T494] common_read+0x1e7/0x490 [ 29.089525][ T494] ? hashtab_init+0xd6/0x1f0 [ 29.094159][ T494] ? __cfi_common_read+0x10/0x10 [ 29.099191][ T494] ? hashtab_init+0x100/0x1f0 [ 29.103916][ T494] policydb_read+0xa83/0x2860 [ 29.108650][ T494] ? __kasan_kmalloc+0x96/0xb0 [ 29.113484][ T494] ? __cfi_policydb_read+0x10/0x10 [ 29.118655][ T494] ? security_load_policy+0x130/0x12d0 [ 29.124444][ T494] security_load_policy+0x16a/0x12d0 [ 29.129824][ T494] ? irqentry_exit+0x4a/0x60 [ 29.134461][ T494] ? __kasan_check_write+0x18/0x20 [ 29.139645][ T494] ? mutex_lock+0x97/0x1d0 [ 29.144100][ T494] ? __cfi_security_load_policy+0x10/0x10 [ 29.149915][ T494] ? rep_movs_alternative+0x4a/0xa0 [ 29.155181][ T494] sel_write_load+0x258/0x600 [ 29.159941][ T494] ? __cfi_sel_write_load+0x10/0x10 [ 29.165192][ T494] ? bpf_lsm_file_permission+0xd/0x20 [ 29.170663][ T494] ? __cfi_sel_write_load+0x10/0x10 [ 29.175920][ T494] vfs_write+0x3c1/0xfd0 [ 29.180251][ T494] ? __x64_sys_newstat+0x80/0x80 [ 29.185222][ T494] ? __cfi_vfs_write+0x10/0x10 [ 29.190065][ T494] ? __kasan_check_write+0x18/0x20 [ 29.195226][ T494] ? mutex_lock+0x97/0x1d0 [ 29.199833][ T494] ? __cfi_mutex_lock+0x10/0x10 [ 29.204731][ T494] ksys_write+0x145/0x260 [ 29.209113][ T494] ? xfd_validate_state+0x68/0x140 [ 29.214333][ T494] ? __cfi_ksys_write+0x10/0x10 [ 29.219253][ T494] ? __kasan_check_write+0x18/0x20 [ 29.224412][ T494] ? fpregs_restore_userregs+0x11c/0x260 [ 29.230121][ T494] __x64_sys_write+0x7f/0x90 [ 29.234757][ T494] x64_sys_call+0x271c/0x2ee0 [ 29.239560][ T494] do_syscall_64+0x57/0xf0 [ 29.244030][ T494] ? clear_bhb_loop+0x50/0xa0 [ 29.248754][ T494] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 29.254805][ T494] RIP: 0033:0x7f86fd39f559 [ 29.259265][ T494] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 29.278974][ T494] RSP: 002b:00007f86fe2c1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 29.287625][ T494] RAX: ffffffffffffffda RBX: 00007f86fd625fa0 RCX: 00007f86fd39f559 [ 29.295675][ T494] RDX: 00000000000190ec RSI: 0000200000000000 RDI: 0000000000000003 [ 29.303711][ T494] RBP: 00007f86fd436b20 R08: 0000000000000000 R09: 0000000000000000 [ 29.311740][ T494] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 29.319785][ T494] R13: 00007f86fd626038 R14: 00007f86fd625fa0 R15: 00007ffee7d728b8 [ 29.327775][ T494] [ 29.330894][ T494] ---[ end trace 0000000000000000 ]--- [ 29.336577][ T494] SELinux: failed to load policy [ 29.369640][ T424] udevd[424]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory