last executing test programs: 2.819579069s ago: executing program 2 (id=3): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000000), 0x10) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) (async) ptrace(0x10, r1) tkill(r1, 0x2f) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) ptrace(0x10, r1) (async) ptrace(0x10, r1) ptrace$peeksig(0x4209, r1, &(0x7f0000000140)={0x8000000003}, &(0x7f00000000c0)) sendmsg$can_bcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000005900)={0x5, 0x1, 0x0, {0x0, 0x2710}, {0x0, 0x2710}, {}, 0x2, @can={{}, 0x7, 0x1, 0x0, 0x0, "f01881a1debdfbff"}}, 0x48}, 0x300, 0x0, 0x0, 0x8800}, 0x0) (async) sendmsg$can_bcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000005900)={0x5, 0x1, 0x0, {0x0, 0x2710}, {0x0, 0x2710}, {}, 0x2, @can={{}, 0x7, 0x1, 0x0, 0x0, "f01881a1debdfbff"}}, 0x48}, 0x300, 0x0, 0x0, 0x8800}, 0x0) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r2, &(0x7f00000002c0)={0x24, &(0x7f0000000380)=ANY=[@ANYBLOB="c60009"], 0x0, 0x0, 0x0}, 0x0) (async) syz_usb_control_io$hid(r2, &(0x7f00000002c0)={0x24, &(0x7f0000000380)=ANY=[@ANYBLOB="c60009"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f0000001640)={0x24, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="002201"], 0x0}, 0x0) 2.811549649s ago: executing program 3 (id=4): r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'veth0_to_team\x00', 0x0}) connect$can_bcm(r0, &(0x7f0000000000)={0x1d, r2}, 0x10) close_range(r1, r0, 0x0) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) fcntl$F_SET_FILE_RW_HINT(r1, 0x40e, &(0x7f00000000c0)=0x1) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c0000005200010000000000000000000200000008000100", @ANYRES64=r7], 0x1c}}, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r6, 0x4010ae67, &(0x7f0000000140)={0x26000, 0xe000}) ioctl$KVM_REGISTER_COALESCED_MMIO(r6, 0x4010ae67, &(0x7f0000000040)={0x0, 0x10000, 0x1}) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r6, 0x4010ae68, &(0x7f0000000100)={0x0, 0x10000}) write(r4, &(0x7f0000000340), 0x11000) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500)}], 0x1, 0xc) 2.738841901s ago: executing program 1 (id=2): syz_usb_connect$uac1(0x3, 0x81, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x10, 0x763, 0x2003, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6f, 0x3, 0x1, 0x2, 0xa0, 0x0, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x8001, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x40, 0xe, 0x6, {0x7, 0x25, 0x1, 0xc, 0x8, 0x29}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x5, 0x2, 0xf1, 0x3}, @as_header={0x7, 0x24, 0x1, 0x1, 0x7, 0x1001}]}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x8, 0xf, 0x80, {0x7, 0x25, 0x1, 0xc, 0x0, 0x3}}}}}}}}]}}, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0}) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect(0x3, 0x0, 0x0, 0x0) mprotect(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2000008) munmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000) ioctl$SIOCGETSGCNT_IN6(0xffffffffffffffff, 0x89e1, 0x0) syz_genetlink_get_family_id$tipc2(0x0, r0) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) vmsplice(r1, &(0x7f0000e79000)=[{&(0x7f00003fb000)="f7", 0x7ffff000}], 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x50, &(0x7f00000000c0)=0x8, 0x4) 2.595308203s ago: executing program 3 (id=5): r0 = socket(0x1f, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000500)={'gre0\x00', &(0x7f0000000280)={'tunl0\x00', 0x0, 0x710, 0x1100, 0x1, 0x0, {{0x5, 0x4, 0x0, 0x1, 0x14, 0x0, 0x0, 0x5, 0x2f, 0x0, @empty, @private}}}}) 2.594711112s ago: executing program 3 (id=6): ioctl$F2FS_IOC_DEFRAGMENT(0xffffffffffffffff, 0xc010f508, &(0x7f0000000000)={0x401, 0x2}) (async) r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) sendmsg$NL80211_CMD_RELOAD_REGDB(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, 0x0, 0x10, 0x70bd27, 0x25dfdbff, {}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000801}, 0x400c800) getdents64(r0, &(0x7f0000000180)=""/41, 0x29) (async) fsopen(&(0x7f00000001c0)='jffs2\x00', 0x1) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r0) sendmsg$NL80211_CMD_GET_STATION(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x14, r1, 0x2, 0x70bd2a, 0x25dfdbfd, {{}, {@void, @void}}}, 0x14}, 0x1, 0x0, 0x0, 0xb7f7d33c23962915}, 0x14) (async) close_range(r0, r0, 0x2) ioctl$SIOCGIFHWADDR(r0, 0x8927, &(0x7f0000000340)={'veth1_macvtap\x00'}) (async) r2 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) (async) accept$unix(0xffffffffffffffff, &(0x7f0000000380)=@abs, &(0x7f0000000400)=0x6e) (async) r3 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_SIGNAL_INFO(r3, &(0x7f0000000500)={&(0x7f0000000440), 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x10, 0x3f2, 0x100, 0x70bd2b, 0x25dfdbfc, "", [""]}, 0x10}}, 0x4040004) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580), r0) sendmsg$IPVS_CMD_GET_SERVICE(r0, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x6c, r4, 0x4, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xfecc}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_to_team\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private1={0xfc, 0x1, '\x00', 0x1}}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x40}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x8}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'batadv_slave_1\x00'}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20048000}, 0x8004) (async) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r0, 0x800448d2, &(0x7f0000000940)={0x4, &(0x7f00000006c0)=[{}, {@fixed}, {@fixed}, {@none}]}) (async) sendmsg$DEVLINK_CMD_TRAP_SET(r0, &(0x7f0000000ac0)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000a80)={&(0x7f00000009c0)={0x94, 0x0, 0x400, 0x70bd27, 0x25dfdbfe, {}, [{@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5, 0x83, 0x1}}]}, 0x94}, 0x1, 0x0, 0x0, 0x40000}, 0x2004c8c1) r5 = accept(r2, &(0x7f0000000b00)=@qipcrtr, &(0x7f0000000b80)=0x80) (async) ioctl$FUSE_DEV_IOC_CLONE(r0, 0x8004e500, &(0x7f0000000bc0)=r0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000c40), r5) sendmsg$TIPC_NL_BEARER_ADD(r0, &(0x7f0000000e00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000dc0)={&(0x7f0000000c80)={0x120, r6, 0x20, 0x70bd29, 0x25dfdbff, {}, [@TIPC_NLA_PUBL={0x4c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7fffffff}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7}, @TIPC_NLA_PUBL_TYPE={0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x10000}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xf4}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x1000}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x6}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xfffffff8}]}, @TIPC_NLA_NET={0x50, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xffffffffffffffff}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x7fffffffffffffff}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x24}]}, @TIPC_NLA_LINK={0x70, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1ff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffe01}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4187}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xcdb}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x120}, 0x1, 0x0, 0x0, 0x1}, 0x8004) (async) ioctl$NILFS_IOCTL_SET_ALLOC_RANGE(r2, 0x40106e8c, &(0x7f0000000e40)=[0xfbf9, 0x6]) (async) ioctl$MON_IOCT_RING_SIZE(r0, 0x9204, 0xc106d) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r7, &(0x7f0000000f40)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x10008}, 0xc, &(0x7f0000000f00)={&(0x7f0000000ec0)={0x28, 0x0, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'rose0\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x1) lstat(&(0x7f0000000f80)='./file0\x00', &(0x7f0000000fc0)) (async) write$FUSE_NOTIFY_RESEND(r0, &(0x7f0000001040)={0x14}, 0x14) (async) sendmsg$TIPC_NL_BEARER_DISABLE(r5, &(0x7f0000001380)={&(0x7f0000001080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000010c0)={0x254, r6, 0x0, 0x70bd26, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x114, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1000}]}, @TIPC_NLA_MEDIA_PROP={0x4}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x27}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf15}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x44134e3b}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x4}, @TIPC_NLA_MEDIA_PROP={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xab1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xf0000000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xd}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x54a1800}]}]}, @TIPC_NLA_MEDIA={0x7c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xd3c}]}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6b56}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfff}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_NODE={0x58, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_NODE_KEY={0x3e, 0x4, {'gcm(aes)\x00', 0x16, "b7cc83345242c167120239b0aa3aef5566fd0dc09431"}}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}, @TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x7ff, @local, 0xffff76fc}}, {0x14, 0x2, @in={0x2, 0x4e24, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4b}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}]}]}, 0x254}, 0x1, 0x0, 0x0, 0x20040885}, 0x4800) (async) r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000001400), r5) sendmsg$DEVLINK_CMD_TRAP_SET(r7, &(0x7f0000001700)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000016c0)={&(0x7f0000001440)={0x264, r8, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x1c}, {0x5, 0x83, 0x1}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5, 0x83, 0x1}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5, 0x83, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5, 0x83, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5, 0x83, 0x1}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5, 0x83, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5, 0x83, 0x1}}]}, 0x264}, 0x1, 0x0, 0x0, 0x44000}, 0x4) 2.594549523s ago: executing program 3 (id=7): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x20000, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000240)=0x6, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'gre0\x00', 0x0}) sendto$packet(r1, &(0x7f0000000180)="0b032200eb1025120212475400f6a13bb1000000080086dd4803", 0x10300, 0x0, &(0x7f0000000140)={0x11, 0x0, r2}, 0x14) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d01, 0x0, 0x1}]}) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r6 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r6, &(0x7f0000001500), 0x10) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$can_bcm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="05000000470700000800000000000000", @ANYRES64=0x0, @ANYRES64=r7, @ANYRES64=0x0, @ANYRES64, @ANYBLOB="0000004001"], 0x48}, 0x1, 0x0, 0x0, 0x15}, 0x60040090) close_range(r5, 0xffffffffffffffff, 0x0) r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='mountinfo\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='huge=always,huge=within_size,nr_blocks=5']) read$FUSE(r8, &(0x7f0000002140)={0x2020}, 0x2020) 2.528829563s ago: executing program 3 (id=8): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_connect$midi(0x6, 0x8c, &(0x7f00000003c0)=ANY=[@ANYBLOB="120101020000004030144b4740000102030109027a00010109f0010904000001198cbaa55b1592fe87c89185f15502010330021524030240070a000203043701937f0488450c0701112403020305060703090904ff0f000103132403010c06014005f8730708002c0705080215240301080700a40509fd0109ffe003190714040509050e0400027f1f0204250100090501102000e00603042501006a0e09fd09f99265e1a7bf613499ac4791309650361ef192cfab8da91891a751686ac18bf9a7f750490032191e6d676ebb526b630b8a2b86ebb9bd86a8ace8f26f41b963489d88afdf180015be4c8450a1edb5b9d2ae41e253c5ac0d64c30442e25a3fda16f8467ee59a12aec00672edd67d7439517852fb8e21451598580f37e51f1f32f374"], 0x0) syz_usb_disconnect(r0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000012c0)=[{&(0x7f0000000480)=ANY=[@ANYBLOB="2c0000001000010002000000fedbdf250c0000000700000000000000040011800c00100004"], 0x2c}], 0x1}, 0x0) r2 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000380)={'team_slave_0\x00', &(0x7f0000000080)=@ethtool_sset_info={0x3f, 0x0, 0x101, [0x101, 0x8, 0x8d, 0x4, 0x8, 0x70ae000, 0x0, 0x1000, 0x8ec, 0x5]}}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_TRIGGER_SCAN(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x30, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}]}, 0x30}}, 0x0) r5 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) r6 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$VHOST_VDPA_GET_CONFIG(r6, 0x8008af73, &(0x7f0000000500)={0x0, 0xfd, ""/253}) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000") 1.647111746s ago: executing program 0 (id=13): openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x382, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x597183, 0x0) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = socket$packet(0x11, 0x3, 0x300) poll(&(0x7f0000000180)=[{r2, 0x80}], 0x1, 0x1ff) (async) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@set_irq_handler={0xc8, 0x20, {0x80, 0x2}}], 0x20}) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) (async) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0xca341, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000040)={0x1ff, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000016000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000180)=[@cr4={0x1, 0x40002}], 0x1) (async) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f000000b000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, &(0x7f0000000240)="0f0d51f40f01d10fc75800f30fc73600102ed5c01dc0000000008ec0640f017400aa66b9e408000066b81f6269e766ba000000000f3036db45ef0c0cb8d09bbc8966efbafc0cedba4300ba210066ed3626f00fc70d", 0x55}], 0x1, 0x2, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000440)=0x2, 0x4) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000003180)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x801, 0xf84, 0x3}, 0x1c) (async) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r7, 0x29, 0x1a, &(0x7f0000000080)=0x2, 0x4) (async) bind$inet6(r7, &(0x7f0000000540)={0xa, 0x4e22, 0x7, @empty, 0x1fc}, 0x1c) (async) write$tun(0xffffffffffffffff, 0x0, 0x107c) (async) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r8, &(0x7f0000000280)={0xa, 0x4e22, 0x9, @loopback, 0x6}, 0x1c) (async) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x2, 0x2, 0x0, 0x4002004c4, 0x1004, 0x8000000000000000, 0xc595, 0x0, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0xb3, 0x8d], 0xeeee8000, 0x2010d3}) ioctl$KVM_RUN(r6, 0xae80, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) ioctl$KVM_RUN(r6, 0xae80, 0x0) 1.626010807s ago: executing program 0 (id=14): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) setxattr$incfs_metadata(&(0x7f0000000000)='./cgroup.cpu/cpuset.cpus\x00', 0x0, 0x0, 0x0, 0x2) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x2a, &(0x7f0000000040)=ANY=[@ANYBLOB="020000000000000002000000e0"], 0x190) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x2a, &(0x7f0000000000)=ANY=[@ANYBLOB="020000000000000002000000e0"], 0x190) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000080)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) ioctl$sock_SIOCETHTOOL(r0, 0x89f6, &(0x7f0000000080)={'bridge0\x00', &(0x7f00000000c0)=@ethtool_regs={0x4, 0x0, 0x1d, "2a161d2d71db37f20a8f1597f02515fcead4e1f5cad54790db5c4e09db"}}) 1.582521857s ago: executing program 0 (id=15): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder-control\x00', 0x800, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000b00)="1b080b7a30aec939ce8e26e0cbbe37fc064ceef965fd5e3b6739c966492dbdf71c04423d8a403e56dfd224e4e55918a5e31e683fec5cc9460882a0d1628d02d51a8da9", 0x43}], 0x1}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$BINDER_CTL_ADD(r1, 0xc1086201, &(0x7f0000000b40)={'binder0\x00'}) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r2, 0x10e, 0x1, &(0x7f0000000a80)=0x1, 0x4) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000980)={{{@in6=@empty, @in=@broadcast, 0x421f, 0x0, 0x0, 0x5, 0x2}, {0x8001, 0x200000004, 0x40000000007, 0x6811221d, 0x100000000, 0x4, 0x200000003, 0x9}, {0x5, 0xfffffffffffffffd, 0x7}, 0x1, 0x0, 0x1, 0x0, 0x6}, {{@in=@remote, 0x0, 0x6c}, 0x2, @in=@empty, 0x3502, 0x1, 0x0, 0x0, 0x9, 0x2}}, 0xe8) r3 = landlock_create_ruleset(&(0x7f0000000140)={0x4000}, 0x18, 0x0) landlock_restrict_self(r3, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='.\x00', 0x0, 0x0) ioctl$KVM_CAP_MEMORY_FAULT_INFO(r4, 0x4068aea3, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) 1.519282678s ago: executing program 0 (id=16): syz_usb_connect(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000c9d1c40899040a50b7e70102030109024400020000000009049700010dd5ce0008240201000000000905000000000000000705a3f6d2fb5b09040000014106cf0008240201000000000905c926", @ANYRESDEC=0x0], 0x0) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_RUN(r0, 0xae80, 0x0) 1.481740939s ago: executing program 1 (id=17): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) madvise(&(0x7f00009b8000/0x1000)=nil, 0x1000, 0x1) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x16) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x80}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x104880) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x5) r3 = eventfd2(0x0, 0x0) io_setup(0x4, &(0x7f0000000080)=0x0) io_submit(r4, 0x2, &(0x7f00000000c0)=[&(0x7f0000000000)={0x1802, 0x0, 0x0, 0x5, 0xfffe, r2, 0x0, 0x0, 0x0, 0x0, 0x3, r3}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x5, 0x0, r2, 0x0}]) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x1) syz_kvm_setup_cpu$x86(r6, r7, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000340)="660fc7b10080ffffad0f019fd8000000366467660f388135ea020000004600c4c225a70c353e00000066bad104ed3e0f01cf66b8a8000f00d8f20f5eb60000c0fe", 0x41}], 0x1, 0x59, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r7, 0x4080aebf, &(0x7f00000005c0)=@vmx={0x0, 0x0, 0x2080, {0x7000, 0x26000, {}, 0x1, 0xc}, {"7d141eb7ad66d8daf4e38835d6e70d9d55296eb2c36e50d54f0d34613be4614ba1281c117b33fcb43767503fcaabbf284170937241093fa9cfbb624be8ec7b4e06bc4a4bfde3123549c3f753eada1e7c249e717905909988e09ac81179028ba71d10bbbd641f85bc53cf28086eb2df7f88ef2e2cbf50ed37810b684fdd2ee73e5f99688aa2a75681fa84c18240caa51200246c929bbd0b59e1d49135eb7e6c8b6546c6e8bc1eb9bed258f66c8def90f4244b8a9e91a5a4638265086e80d18e0cbd929d9b1628376e9809871af94bc9a293ef9d27abf84952b5452a3aad4d2516912489dee29d77815eba3bbeac3de7d8117601fd310c8d3da265f86f17fdba756856988d813fa47e9703eae6ab3e9a7f3869d2b3a3a7f2d039d4bd4d319d77fe3657d2ab04c8ef359d398357d5845d729b9e9d16ad74327050b8891503e8468a4f079babaebf007aa9cc25de29706e9a6c1bf3ab53afa10bef99a360dd6715e64d56d8c4e2063df16b3680fe56b3ae027d44d9cfad653981044d704e8c92121baf89c4cf76440e6089e486c1fbed86765f07938013da044ee260bf8fce020e049cec5e10332a2ffa81dc9c6c1b6bc56a9224649ecd591bdc8acd75e1b3b20129e2d6fab9e795ee6f2010ac8f242807a21d9631ce750c92cafac8c0a68d98dcee27982958463d89c10a20fec48eb2974cc022c7de74d39e2eed822f7e6668bb921a8db21f78e16cdd8e71e5757e063e1aaea6e1cea467cd3c2217a9ae20f721da27b1dd45c4a8471e837ec8c2ee2f763df2ea59d94c5b6be5f49ec640f6068b772e9fa5dfe4a02bc2fecbfa85a24375b2769268fdf756ababa469272ffc0969ecae8bd3a1122b8996ee77cf7947eb056b10bc099c3233db8dff9f97bbe3b8ff4f2a99555402a91971e8558c3af94bbb538c42fc05d8b5eedd1ceb306eae773b8d33a953906325104d11d9b4aa69ec7f32a30d6664a1cdb310944aee156ea713e37b4de2c8bd53156eabb3d6e494923289181102ba09d5cd707b895f89be0b66673b8520d475cc8e8d4fbb4b017033abdd13932bc41551966b959c55e943fa3efd92870a83fc2d917186e3eebc6ef75ddfdea52b44c51c45ef4297e065470d13fcad4c42f8f7dbd66545aa31a3f9e999b5cac5d8893d0dfafc63adb97610134507617bc93c77c4dcc9a0305c727eddde9ced309cd7ec72ddcd27f73b11835cb9de090f1fe93c9bd442af8f50d26e9789a255813e774804fcc36bacc50117bfea3cc2e2670d65226978c683f76d40412a9aedc8b002c835196929716b90233fd60b5a27eeabc5d93097a941ca5adf1c11a7a92755a73f0530ffe6b53a92127fd3cd897cd1496adebe1f46154845c91ca99027541d8f2df7d41abb1b016276a6aee113dde179fe18365655014a5b764482c56ece0533ae791a70ee0f4a19047e3847c971a45eef444b1748320970550965d021f626d8dd17091c3efcc5a26f702040b5d85e13dab48b66ffee27048d4eaf3092df1bb70489a6d02e0650bf3cd6d8c04df31d1ec6c7ce051c61724829a860062a28593e1016f2c94bcfafc2db3970f92aa04f15b8594f6c3f0c6cba18c1776785eaddc3510ad8f75a583d71c99072b15333c6031f90237f41336fb4318dfcdc271cbcb369d0085d178cc3ed73cbb8593993a894a2f4f7183524f70dd499f14d9dc225e5017085d501d170c7644909c0327cc867d2c99b1f77b62f827d17eae3899218047c456cbebfded12cfdc86cd42a7da91f394668bc6f4855faae32fa3b2410e2ba2fecf55242866ff8d2b2d1b66fc25f6958bec72c4aa2bab40683b1dc552fd5462ca255e0613648781768ece01e03bee42bf386b5cf14e05935a1fa3951b89267e9a72406ef5f78e510f3b5ebb6b2b390839316f58c7907c0f2e7b4eb5478b833705d3264a1724bb64267a5f28e35ac556ba28779ad3a8c1dba38194e9e56e41532fe4892041f71b3c72bbd25b4c7e2d49f27701ea18cfb375b63453c762bbc0411198d862dfba97fc876955e57f05834784699a88e73ff41cb5268a689d66a950780c11e0f70357a6a8e77fa5cbcac6281d6b3346452a4df5eedeb5e4171f3116bcf8c06cc3db746416754adc6f1a07d27e5be3241b64b116e27635a9cda80725452b0922edad97939853d546212bba8935f849f930ce04f15e45a7addc4699f6e89beaee18434cc34d9513a5827783f24eac29bf6aa7b1195c1f914343b93ecdb000d42d0d0775700e3830d16323191801ffd7a083abaef2a92b924babbe5610a9e040505d7930b3f2a2f7d5df9d7a778bc757b96abe3a0c0a837c7e9b40d896d75bec67672ddfb8dda78cf27fc69bec9bd6448812b23ff02775c4f04cf7ee65e46f89e24f24b380e33239230944a83cce01faae8a043d227287dbf87b12f684a6b10e5783d36da7b3b4b9246d9ec22ee56ed002a7c2b4e3be2f6fce43a7ffd6c59cd0d8da1c36d6fd09e3e92087513a18f4fce3a3bf1e8d33e437bc982a5094e2f43d5be04a3bfdd26809ded456f22664b6be5b625e7ae122bd2da1788f8bc181934857104d345981ea48cf7a52b3c680aa836641006b1e41fbddbcc712cf58490a98179c7d778da01952391de5bcc3344bd7d8b26cb268afa1ea81ef9ed607d76713f0078338ca1fb4829e619253e20d2ca4ea7bf8b998ff00685ad333f034acd9cd7b1de23fa08ac8856caa898397df32a8eda57cc129d8713ca87ba645265eec454a7f91134f3b7631202b860027a753c84182cb23e1fc21e780be8c7bbe0fe44c01c3357863acd1b0bf433079a0ad2e5bd20055bf013948aeae92bee1e2136e9f11f9c30f27af907aac4c70e1f25dd786f9988d91ed1b50d156a4e0d862c2e157dcae4bbba5f689c9b6c22b71d4fe8d8d248be466e1146cd0a7457da77a3276a7b56ec9f523c8a262f96c4ea7992cb4d98d715e33232837de6feebb6970bf51174731c56481938cc83cc6def53db43c3ea37c4d845a03e5b32fe1150b01fe4d6eb57649f05abc74e81bbdaa180bf0215054ce1c74870fb7626ed50b894c7de80acd3db8bc073e02a5fad267264ee0c6892822cf0b8bc01c0bd925e95733a8a35fb5e52afccf5219529fdb94be4726368cd8f61e93bc6acdb1ecee71a6ba07e7a415bab37f2684f407c71e38f3f775579db6cffd4172e729405c002bd7410c8985b30fd01e8ca8b63b1e652e9b7dc857e6a1d439b326ad6480c7942ae6d661d7b9c61e5c0e852f5473da9b5d2d9664cd9fe1d0db7e2e2dd28244c9b8a028860cd510f7e98c1aa5dd913e3607ac8ce912894f8813adb3433860b6916c157d360d9da3a9b835303d1c10fef73fe58265bc44cb065052a875cb4960671763d821f1882eeda84b66c21db49776e34b7fc8ac98d113f13b2307ea16609b396b999f487860920265f6715886ecb198c219e7015e4bcda8d70df30bbf7d1d91cf7f5978de25959a5cbb95125519bed2ac8b7f707c0222a7839c614cab422ea19c95ae3a36945c2ed8a370fd6c237f3263a3d6bcc2100e745c6e26fd4edafb0e6d90d132d2bba8ffadcc4b6c85fad583b3a683b5773b3fc0f9e70dd56eb6b4aa54fa5a0da26642e778eeacee84bc4d94528e2a2a193c81423e0aa706d53257170b2d8ab0cf5327594f2b0fee91c57533694d46d1eee566a6eac553447c23ed27e9bffb78248302874b4d43cdd4bd27836e6344bd0736313b9540810e62c5efcfa2b863cd88e306b1f649324f820b8bd8fc6265bf16040344996fc392b4fa151e6d7de66052079b191503c56ad382af42c2985e78c5f9ced5359e3e5fb875982b19817b0e589001323a7a9acb38864c12cf73ab881c4a7329e450915842463ec9e49ac8ee35f25c22f23001596858ec46bd9cb70e9ef4a0c0b5e85ae35c312f088ed19bd17a0fd8ca8b8a60dcf81142214d5e575a6af58aa47b6de84745bbd42cc75c59d36b5c562c805c0060753a4b72f18b20e6e69874d693e3bc6ecb733de44e5a65de3fd3f00068c30ebeddf36b4b1e808528679f5068cc2644403a91e15c7465d6dc94eec57533938b9e52e1428895a217e21a08bcc5bdf8b1d48568d80e59c03b0e8315824fc0b49504d90e130d66177603af59ce84e0242bb4844bb42bf1826f3ac00dfd9f6f3f3d54d0eb01c1ab46907fbfda2b48dc683c361164fec4bff8a5ec2c6fa1f40562aa5f5ebfb58dad7f3dbfc95ee053daa045d42b9f9dbffaf16533a709e2be90b67e45ffb9397a39ad4761bf49e39745fa1a27b9f39257d05cd53f7f210716c72730e1c01dd9f12265e2ea1d37a8bfd87e86205a15b3019096c72580008fe75010804d60f49e70b846dcd5e59e03d9b8f1a8bba2a3ebe808afc5577b32b75d7a14d118824ab59198151737fe4e485c6e9fc04f79c8f1d8ebefc357d4008f0e250792da3b1025a502f81b4e07c4bfcf5c4178ea45179ba782ffbfca485ce035a45ad74690d2fd3a8c83ea544b0467c05a77cb7a4730152e3af0c84556d6b30dafe002bd7a097f2d7948644e2026b4e854b273b978ce02eb8196beb4f2c2616696102600e348e85d2804b5ad225dab473496711d154e8f5836114cb692d000e6ad0cffc7dfa7789a2250a07b37ba5e8c1e5459234004d796f8201d99695a53089b0b64fdba693654e02ec5ab293df63ca4f586e9575838e3829d743b7a2e79d32a6349cea6a62872754c2ee36ff33a7447e178c2939fbe731b712502c841b0f619ca4b01049eea9984cfbe545c2c036d35d4f83d59b153347323e68137d718c3d6df6cc86edbea4f37333a2e4d6eb50a7c1d5ed8860f3ced015cdb86aa5de1401b6ca1ee24908a8d22a3e69652bd23842960b992b9cec74b94e2622a283b14c0835926996db28b23aec0193fd4b73f8f33e4303d5f6b55f3835014f93ce59bf87bd050d6aacb56a89d9978d8bdbf882f5f47f4bb79cb47422d630338c2b4ad7bfbd9ab5a1b285be56fac14fc105154e11ad8b1740393d37a1c919b70893549bdbb5bb92a1e51c682dd889fcd7394933f60c7318652a92df65d961ae21adb220b9f5f44d5990cd5e662b04d3d8a6a8254836037656e44561373ea8fd5fd52b1cb2ab637688bdd19f82052d2d44cbbd906e033e1f50496e6cae65a0f2d755332da9466c6b85b33a275aa560e03c8e086f1426cffb6de21dd8ae60e58ca2edd46052afc5acfdd148ff523ee32c124ae37aa31c41854920078832ce80b61d91a0aad990a894bdd7f505f50ac2a50787097735053a6b0625f8b67036217fd3063c56496c6ce6b4d751068fbaeae1ccdeca4f839e4ca95ee3672d9a84d63b125adf53c8a369e859e66f5d3d617c74e4d2a74f7e3c743e28a304686d637f17bc2c36f04d11d863b7d72b15cb280dfbb974e1d9e703f1521e8113d48199c4d928fe4fb394f96d814cf4b0655fb13333d4fb61266a2106c6a2418651bf7af76e00d9b413f517328171cd6de78742465c7805beec01f83d9877d636402183dec4c3eafb4640255219c5e4afbd6f9ac05286b6b9fe7c01b501e10841725131e81783232c3b1548c2ba65d069452d704e1c8bd69418df693cefe6f9b979b6648e0fb02d5a441647cc52ce38c99fd52eb3c678ddc7740728137e2fd20a3d383472d522791446e52cd1c159c4caeb29a4d80655be56e3171e5af447a8a5221c5c735587abf2cc064dbd2ef2668c3958d8ee3b67e59221e9d43c9485455a28ab63841ef8951fb08510a60a1a50563f546ff67c632f25292e9015ae5a6d37644bcc77a1c913336897ec105bffd3", "192650b4208045a71444241d0169d23b90e4c05e1fd221e304d6a8792700dc4c81c9b9741628c6c0812f73baaf040fb0a0f94fefcca199a2bc8ade7d933e6419ab80b6fd0c1df253b43db84458c31596d149e10039d773f3714f0f92af66a89e5504c1bd2b48747119bf189eab32a184d56eaef2b6f247c343e0c5acb7983b7ee492d3da6dbdc94854661c9c3ca5770575218b1bac0a71ba749498316afa64e29814af632be8286db5283fa3769c794b0f307bf3291fa893ddca57c68fa7f860ff8885a06a2595e847d3074efaefbf08d88f0bcc088f6cb19168fa6b7a4b50326e098ba5010d55b5bf7cac301206c77576eeca829f856e969b77ca85ab73c61e35ad44809462b606e3966e3f66018721845439aa947348e911fd9e0b8d5ea733b704c993066e515d5743fe4b7d8f6e40cb9886e6aa0675d899e5e64be6c4cf37be9b889d930fa9609168c0fedd84a8b44dbfb2ecc1368aacf4bd23c6ca051edd61604194f938f1511801262395c3059a723e3e8ca49a30e60c93b9e3ca31e6b3b0a3f33f00dc579be3f7babe5da955bed6b4feee9a6e2c004cf91412c5c8a741d5ab8773707576a173dc4b95cbb098d28f66fd71306f8d0f0dbccaea9a2cbc518842ff12d0ccb0507f085e5cef0e39b3faaf3bdcb59aa13f179ac4edbc9e07e8947c9794c50f97cc76b78484a5432c05b948f3828781d571fafe306c4d7c4489d9839d8cf08fbe722bce8f23928a35ef72606804c41189d4cba0596010c0bc1f3db55d1c25a582e466b50a0bb8d6fd5eb2b6f46104615d4fa2bce4dd3648fbb50bd33506ed473f54824a0f9caf6065c6f6383d75adef0f7d4c2e16d9242d39c9359367c730e6548b16c7f8b3ab8a643daf8343456aa1b11951f54da7ed4e381cc238ffc0bb1755e0ea1c4459dc1920b2544a45b0cadf5aebda4810653f13a762dcc807b22c52b284c46190e55ba7c8e119489ef9c37f0825081b7ba19a8c6dc31b04d81730490e3941ae409f58491e7343d00543f2957968e9bb8642efc2e9a670c3f79043d236dee48f9f390e47bab4f306370b295e4102c7da9a1c9954a757ede2b5a8aac6244c0d734a3f9dc9706da881167a5748564d1a232e8fab172b9f150849b0d7cb5f84c38aa931ef1b8cc4afa967ee851f11fd2fb6e87814437cfe6c086cb3ddb091705669325bcc00cb9a3b7969d07db8cdebc848694549f4e0fa29ad3f200c1b2e767ed4509b2e5ed8cd3d7e7c78c5cff1e1e9bdfbb0b8741d6aac01e09b8969ed2fa9bf35193f7335e223381098a5a2623ba5ba5302f590ddf059dde7d9c0743feb539a46eeeae7c8f5228fb4c9e9b6ffa741e8285aea7a842a415adc9831b4d020262f3e1165a027e00259907db1612f1accfb910bd03efccf173710061f49315c5fa47ae3ec4580bf5a6fb292ff70d382d8f9a16501b6898f5f7b79a7819f00b4df127065cc312737beeb53e61838d53108d75de56c591bf8b0a893e7470899d65578801e9de5ca254f51e5fe4a790a771e877765d0f7042141463e2cfe1cec88b5b43b8ebb414936465f8af335b3218c6f87d57fd71089a51dd8065a603b2af9b9586bfbd07fe3535a91b1033295f0f916d834605bea7d15829a9aa21e47b35797f3c8b386b5d3d021a062e5fde6b98fec8d9d6c623b2840b5593efedfe5f7e585b55603625b56d429965395c8cff28c1a69736b1c23b1fe898a56e5af3d41156e3a9cd3e44eb734ad859f463ae2ce221674d62b609dbdea1901194c9406411a3610556e25f1f1511a5ce8dbe579340ca57009b9f793a85d886222dee4b1f597e468dffd0cca97a2d8fe743c2689c408cf5ab30bf23af4423b9602842f267117df4977b52e8acd5ec9b5eb867dc0708291dcbb70e0868b3be946e229d08057ef06bec185ac8babf7277852678b3f1fb3624fd0d4e363983718fc0834ba59ff2f00bac77349487e322734525da2b788451de8e71712fb1ef95ba34289ce9219b483c009237ce8af2cbfea891fc23044e30e806bddf702b43fd88d5440958f560ff91ee8696d2ed664b91f29bbb6add0bf2eeefaa0f743557f8169b75fb1f64670606b05a2caf4f1ee7c06021bb5a01f2bd369eb554802b963358e2028b0281277e24b8d169e957fe0222a99bfeef741e6d58a134afe02e24a2f0136a84f256587a6eb5ff4a0c089caec3d2c0b94e45937800cc2ca7791f5d9fcb497a6f1f7aaeb370d6b18ab191bf79bcc13b4e55f413d12715447f42b5ae496d9bb0bcfaf1dd0260bc0a8b56146e6aa9bd8e19aa3032fe8a723c33b351b0b72a11fd4078bf3fec6d3b59d050a9a57226ce2206d8f8b07075d9f33cc64412edbba1c9a663b8ddebd9d0784fcdd216e4a41a28c03d909383bfa25da1a8009f073fd16883cafb8fa97490e271e4038fa9f638189f3b71bc696cf9ec079f7d3f43cbf798af7e1a68a1799e9cb1fdb96b011336ceaf5a1f05c4995cc608c470a748817a8216368f8b61f9b1c720a1bd2da0398731e0f69b7fe057fb8f052c7d53439612879a4e5ddc79c2b8e76a655d60be18297fe7841b17ff11a577b1851be12544322db49d6f9c7711ce0a6192ec5a25f9cfad189bf19c05f0e39cbb5690434f8b518a8bb277a784e67df7939e57d74417eb4a18404bbc34130c4b83c5dbece49cd79bd938f3be797c8a4308dd3d8f309e7dd465ecc93c3587adea7d8fa4cd5ed25f11147dea66b507e13cebd9ac30ae3c640995bd6be1eba790ee70b88180ab52c6a720d5ac90ff6fd80d266c6783168c665a1c85b631b49681df18ab77751f6a7983be2f2e61b805d42e708f829fa298f1d24417f26c473feb1fcc73ed4f15454bd3b7c0e55731c52b848483b73ca5e12366a52a84b07368b791374be5bab6757d809ad6678b11ceee9251e282b8f54631ddf2774a50bb696cc85b9fcd5577498e248f5beb212eaf6bc217009403b18575fd87c6802cd305d7128a8d291fa317fc5aaf99b37fc0ced25d8613549275e927407a0fd0e4f0361b2dd7b1b30ac76772704c6ea8c62afa0256578c528aa0b75d80ea1ecc6bbf45a921bc282acd4a8a18dcf3d08b7cbd1c4938ac1f3f1e8a201dad771891cb9dca4c608f9187f5ae49fd2104879a7e4297b21c349516ec3a68e0e0416118ab2b61ac0bc0782d2ead3889b6c2cbc5929eeff0623fc240f9abed8c805ca6dfaee791f910f4c4a2605b545298356ce5ee4617a83aed9e8ac1f32f6e0c0158546916e422dd3c8522be7c8759a731a0aa2e35045b29853adb9fb0fe9e0ccc0c82c0f80baaf631cf11c684fcded14c0ceffbca59f62eb614face68be183d7eae61bfba7b65749697b7dc852c179c240751f22684dcf7c447bad9592a59dd414b1993c7cc4dd77a0366a8388860c18ed7dc4aa7b91d858325126112f0d769f45786a7e7d061c3db637d77cee2e5021e59bb338d7d400ab4a87250c71a372178e57c917da0a9048f3c627ea9dbbaa95feec016a20bb1effed778cc0d898415615033ce815ed335d21071fb890204ba19451f8227a5b4b4e8fe076dcd2b0cef938c07fb2a3cca7de1d48fafcc0afea0fe471d84a6d8dee4fa90f540acbf6de845a14ed195e6f628f36f2f3624c9d69ee1bde953d8fee14949a408494ad2d1662cf7d25ec4b6e363d50cbffafa2a724c3bea7e4ac6dc2a1b85b46ec45f76de82f94e79273bb569c292a3641013a481dffe64059384e60ff9f85dc45dcda892ccb6b8c7c56ade260443aa02614ed6bae4b3b8d62b52b65eafb9fccc6bee6a666348d93887a414717915507a99baa11566c5ef88a557539288d47f772f0d44d06cd8ae868e49549fda97edc82578b364d6cb2c654d604ffe3f17e3ced857d12c34a920d3b05ccd299991b1d230238009d0841a166eb893a52ab2349b22b2d692eed8d5b0dec7c0d770dd13cb41e7d607f0c02f08c5076365769d20f319dfe9a865c98002ab5ef3395e767286938aa9d0626fe01f916948033abe0a5b699f05aa280ffa5914c574faa1c176c2b571c489a431e29a614eb519133625f65bd886aadef31b9965eccfed1ed02814ba18a20f13ffef2ccf4ed3f057612d75674f81b0832842dd2c87a7c33c8f1b0c40e5175fc46d50d6fcd9b607bb4f1f49b35fece376f13679ce370dac906edbc34158bd4ba27028c4f2d1aa33379e102ee347c2de8405279f4320bcc839109c4bfc5b14d0f4642a90ad13165c541252b7115fc290b621e4c02d09ae2778328e8c0750c892ab1c757b7b797a42bcceb412e5210afa0e380ab1fe3f2a67809e3fac6a0597e8b14894194e4c17db8c194f74825c1ef770e64cb07675b067f4a2ffaf9cf58a83085489a6b4b710e33835ff3e942d1ebf41b2a3aea0f04c7dd54b3005d47b93bfc36d1f8c80ba7a29e3afc8e48fd07ea42d3049ddb4ae1922faf7c5d5c266d737a91610a0403ecba4d7bfd578c179769a54b54eb0c2a6450ce3b690539a211620a2311196a61b68f11ce087645713b68d7cbc3fbfaba3cd29dcb7ff1a33ddd2291f617f8140aa51292244dd9022b8274034f0e94000b84b7cc5eaf2303297d9a2cce81acb242920b6c086e4fa19a4edd187bd2bfffb7b492a900e24b405e80ab7446ef81012e3685dd174feea6a61c73bdb74450d1f8ffae3680d495ddd864671cfedb0b00941d1a33bf0156eb9aee5f4b15fdf1262a2dbe27379d164ed45c0f5c29d4b8a20c663ef8fe871c8076e11cf2c292849f381d0ba84ea082f622426ff436bd9025744a5773009e662b8ab0e8298a92dfe544181eaf6f76b1acc55d87f744c391ee528138fb02beadfa5ac0f3cf12928bbff43681a2b5a3679036b59e8fa34d4e01a0ab97fbafe01f9e29fdb4e20ac9a265c1b061ab283a34cd61bad6abf5f46a10e50bcd05002ae5af2ca88b12c2afad57e00977ff95a6987a8d4c73b40142db89ed4b892dde350597fb4585ccb1fb53742cbfc6d35eb9325df20f4a24ee89418c9b182f469af47d813e2db71b88ae8b647208ff8ccbd38304327bd69ac044947dec9c33271882c3ca5a064ca76f78cf3d0c61a0ac3d84c11b9ce8fea68dbf07c3578ff3004c620e2c4bfe67717a75d7893ceeddc220e647928c000bcdba19493b36dd49d79390cfd507d1e25274e1dc73181ac26156fb640684083cfdb2cb26c4a7c2d1df4466bfd76eb5d4965b10cbf84a5901832afcb77c5303f07917adfed630026a0401a98daa6222a9babadd385d066888ecafaf3e675865f9ebb40291ad0d634e9ca8b68332d54cfca9b093d0b5f2783b7c815d870b1c9f221d73ccb3b0439b57f2fdec32b012f6f1bf09ec4e06ed3d19c596e46fa8a95d4fa8deca65b42bbbd094dcd4fea4995ae716e7ea83fcc86db6fac68c98bb5f61beae3381c2960a849b23d9a4d6af86a77e26a855449f02a36991d73b86ed47f4321a291b2a12d017cda81a8c255b697a0179794dbfbf77ea38f3e397a36dacf773ad60fb7705c0c2ccf4110e8deeaeffbec3110aeb423be513caac296ea8396eeee12d80e17191324e8162ade6fff4e45452faa4f150f265e9087d5bb593337e11fe6b14b2d75e8951ff0a477c2e5d6ff6b30b9b4d37f43baab9a5849fafecd116df774b03aca75edb898b15dbc918418f837d93e8d6c62b13be12596348905c44416c418222362a733d3b2f58e2cc106e35affe8ba7e7c53d0c96647d6865b086950d57eeeeb18539c8a6b68399a55d405972803027648d67f9cf10a1605f6f06dd0a51fb68079672b625ac3bc464ea73805de0d8a39f818431ca00"}}) ioctl$KVM_RUN(r7, 0xae80, 0x0) io_getevents(r4, 0x2, 0x2, &(0x7f0000000c80)=[{}, {}], 0x0) shutdown(r2, 0x0) mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x400000000000000) ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000180)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00003ab000/0x2000)=nil, 0x400000, 0x2, 0x2}) 1.34825713s ago: executing program 1 (id=18): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20940, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) (async, rerun: 64) r3 = socket$unix(0x1, 0x1, 0x0) (rerun: 64) bind$unix(r3, &(0x7f0000003000), 0x6e) (async, rerun: 64) connect$unix(r2, &(0x7f0000000640)=@file={0x1}, 0x6e) (rerun: 64) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async, rerun: 32) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) (rerun: 32) write$uinput_user_dev(r5, &(0x7f00000006c0)={'syz0\x00', {0x0, 0x0, 0xb830, 0x5}, 0x48, [0x7, 0x4, 0xc, 0x1, 0x9, 0x5, 0x10, 0x9, 0x4, 0xc2, 0x1, 0x5, 0x4, 0x0, 0x0, 0x200, 0xe2, 0x10, 0x19, 0xa, 0x51, 0x7, 0x4, 0x2, 0x0, 0x0, 0x6, 0xf, 0x6, 0x58628377, 0x7, 0x5, 0x6, 0x8001, 0x7ff, 0x1ff, 0x0, 0xfffffffa, 0x2, 0x6, 0x60, 0x8, 0x3, 0x363, 0x0, 0xe, 0x5, 0x0, 0x7, 0x4, 0x7, 0x5, 0x4, 0x6, 0x8, 0x100, 0x101, 0x4e, 0x200, 0x7, 0x9, 0x6, 0x1, 0x1000], [0xffffffc0, 0x4, 0x1, 0x1, 0xff, 0x3, 0xa7, 0x3, 0x6000000, 0x0, 0x10001, 0x80000001, 0x9, 0x84e, 0x6, 0x1, 0x2, 0x3, 0x3, 0x10000, 0x5, 0xbfb, 0x5, 0x6, 0x1, 0x4, 0x4e2b, 0xe, 0xa, 0x2, 0x9, 0x7ff, 0x0, 0xa18, 0x9, 0x1, 0xd6, 0x1, 0x800, 0xa, 0x8, 0x7, 0xf3, 0x6c6, 0x8000, 0x0, 0x6, 0x4d6, 0x3, 0x2, 0x1, 0x21daa2fe, 0x7fff, 0x9, 0x2, 0x7, 0x7f, 0x0, 0x9, 0x10000, 0x4, 0x1, 0xfffeffff, 0xe2a], [0x3, 0x8, 0xd0c, 0x9, 0x80000001, 0x1, 0x6, 0x8, 0xffff, 0x200, 0xf, 0x80000001, 0xf, 0x6, 0xd, 0x8, 0xffffeca2, 0x200, 0x1ff, 0x7, 0xfff, 0x5, 0x3, 0x5, 0x713, 0x7ff, 0x10001, 0x9, 0x0, 0x18, 0x9, 0x3, 0x6, 0x3, 0x422, 0x4, 0x1, 0x3, 0x8379, 0xfffffffc, 0x6, 0x1, 0xb, 0x2, 0x2, 0x279d, 0x8, 0x1, 0x6, 0x8, 0x2, 0x9, 0xa, 0x3, 0x0, 0x5, 0xff, 0x4, 0x1471d911, 0x1e12, 0x9, 0x3, 0x6, 0x7ff], [0x3, 0x1, 0x2, 0x800, 0x3, 0x101, 0x800, 0x1a96cebd, 0x4, 0x27c3a3b4, 0x0, 0xb, 0xb, 0x3f2, 0xfffff801, 0x8, 0x101, 0x3, 0x2, 0x9, 0x7, 0x6, 0x10000, 0x0, 0x7, 0x3, 0x3, 0xb, 0x7c, 0x0, 0x2, 0x3ff, 0xffffffed, 0x4, 0x400, 0x6, 0x2, 0x7f, 0x6, 0x46f, 0x200, 0x6, 0xff, 0x100, 0xb4, 0xbd, 0x1, 0x9, 0x5, 0x8, 0x5637, 0x2, 0xa80, 0x8, 0x3, 0x4, 0x7, 0x1, 0xffffffff, 0x5, 0x1, 0x7b3, 0x8, 0xffff05de]}, 0x45c) write$binfmt_script(r5, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000b, 0x28011, r5, 0x0) preadv(r5, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) (async) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) (async, rerun: 64) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) (async, rerun: 64) openat$random(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) setrlimit(0xf, &(0x7f0000000000)={0x1, 0x5}) 1.094982054s ago: executing program 1 (id=19): unshare(0x20000000) syz_clone(0xc101480, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone3(&(0x7f0000000400)={0x6200, 0x0, 0x0, 0x0, {0xa}, 0x0, 0x0, 0x0, 0x0}, 0x58) wait4(0x0, 0x0, 0x80000003, 0x0) syz_usb_connect$uac1(0x2, 0xaa, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902980003010000000904000000010100000a2401000000020102132406040006030000000000000000000000000924030000010000ff0924050000f8431cfd0924030604030204001b240404020904", @ANYBLOB="0abb603600ff0700006300000000000012"], 0x0) 265.693176ms ago: executing program 0 (id=20): socket$unix(0x1, 0x5, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000480)='.\x00', 0x10000, 0x0) r0 = socket$netlink(0x10, 0x3, 0x12) capset(&(0x7f0000000140)={0x20071026, 0xffffffffffffffff}, &(0x7f0000000100)={0x3, 0x3, 0x6, 0x80, 0x3, 0xfffffffd}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$KVM_CAP_DISABLE_QUIRKS2(r2, 0x4068aea3, &(0x7f00000000c0)={0xd5, 0x0, 0x2}) r3 = userfaultfd(0x1) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x1a5}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) socket$xdp(0x2c, 0x3, 0x0) ioctl$UFFDIO_COPY(r3, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000400)='ramfs\x00', 0x2800000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000280)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000000)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') open(&(0x7f0000000000)='./cgroup.cpu/cpuset.cpus\x00', 0x1a1342, 0x162) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fbc45ff810500000000000058000b480400945f6400947e570028925a01000000000000008000f0fffeffe809000000fff5dd000000100001000a081000418e00000004fcff", 0x58}], 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) 0s ago: executing program 0 (id=21): r0 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x6, 0x0, &(0x7f0000000140)) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$XFS_IOC_COMMIT_RANGE(r0, 0x40585883, &(0x7f0000000080)={r1, 0x0, 0x3ff, 0x4, 0x8000, 0xf, [0x7, 0x3, 0x400, 0x101, 0x5, 0x2]}) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000040)={0x14, 0x14, 0x9, 0x3, 0x25dfdbff, {0x5}}, 0x14}, 0x1, 0x0, 0x0, 0xca1de99cf558760b}, 0x20004000) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.177' (ED25519) to the list of known hosts. [ 22.910018][ T36] audit: type=1400 audit(1782565423.070:64): avc: denied { mounton } for pid=287 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.913603][ T287] cgroup: Unknown subsys name 'net' [ 22.932703][ T36] audit: type=1400 audit(1782565423.080:65): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.960023][ T36] audit: type=1400 audit(1782565423.100:66): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.960670][ T287] cgroup: Unknown subsys name 'devices' [ 23.062751][ T287] cgroup: Unknown subsys name 'hugetlb' [ 23.068414][ T287] cgroup: Unknown subsys name 'rlimit' [ 23.183914][ T36] audit: type=1400 audit(1782565423.350:67): avc: denied { setattr } for pid=287 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.207116][ T36] audit: type=1400 audit(1782565423.350:68): avc: denied { mounton } for pid=287 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 23.231896][ T36] audit: type=1400 audit(1782565423.350:69): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.262944][ T289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 23.271843][ T36] audit: type=1400 audit(1782565423.440:70): avc: denied { relabelto } for pid=289 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.292709][ T287] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.297483][ T36] audit: type=1400 audit(1782565423.440:71): avc: denied { write } for pid=289 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.331866][ T36] audit: type=1400 audit(1782565423.450:72): avc: denied { read } for pid=287 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.357779][ T36] audit: type=1400 audit(1782565423.450:73): avc: denied { open } for pid=287 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.228036][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.235227][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.242440][ T294] bridge_slave_0: entered allmulticast mode [ 24.248749][ T294] bridge_slave_0: entered promiscuous mode [ 24.255511][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.262605][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.269687][ T294] bridge_slave_1: entered allmulticast mode [ 24.276112][ T294] bridge_slave_1: entered promiscuous mode [ 24.322457][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.329608][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.336738][ T296] bridge_slave_0: entered allmulticast mode [ 24.343062][ T296] bridge_slave_0: entered promiscuous mode [ 24.352866][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.360374][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.367542][ T296] bridge_slave_1: entered allmulticast mode [ 24.373908][ T296] bridge_slave_1: entered promiscuous mode [ 24.395327][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.402511][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.409587][ T297] bridge_slave_0: entered allmulticast mode [ 24.415983][ T297] bridge_slave_0: entered promiscuous mode [ 24.425442][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.432539][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.439609][ T297] bridge_slave_1: entered allmulticast mode [ 24.445995][ T297] bridge_slave_1: entered promiscuous mode [ 24.466607][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.473715][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.480831][ T295] bridge_slave_0: entered allmulticast mode [ 24.487159][ T295] bridge_slave_0: entered promiscuous mode [ 24.496493][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.503581][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.510828][ T295] bridge_slave_1: entered allmulticast mode [ 24.517128][ T295] bridge_slave_1: entered promiscuous mode [ 24.662831][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.669935][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.677295][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.684362][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.696870][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.703979][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.711303][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.718347][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.757951][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.765050][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.772397][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.779436][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.794852][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.801935][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.809226][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.816318][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.827728][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.835076][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.842941][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.850210][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.857486][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.864901][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.872449][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.879715][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.902651][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.909886][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.917587][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.924680][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.933129][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.940171][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.955562][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.962671][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.012236][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.019401][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.028225][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.035314][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.044536][ T297] veth0_vlan: entered promiscuous mode [ 25.068169][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.075313][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.094073][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.101179][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.109258][ T294] veth0_vlan: entered promiscuous mode [ 25.115535][ T297] veth1_macvtap: entered promiscuous mode [ 25.149721][ T294] veth1_macvtap: entered promiscuous mode [ 25.162738][ T296] veth0_vlan: entered promiscuous mode [ 25.185139][ T295] veth0_vlan: entered promiscuous mode [ 25.205810][ T297] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 25.214290][ T295] veth1_macvtap: entered promiscuous mode [ 25.232616][ T296] veth1_macvtap: entered promiscuous mode [ 25.289594][ T316] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.600742][ T314] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 25.610487][ T9] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 25.750512][ T314] usb 2-1: Using ep0 maxpacket: 16 [ 25.757221][ T314] usb 2-1: unable to get BOS descriptor or descriptor too short [ 25.764987][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 25.770936][ T314] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 64, changing to 7 [ 25.783315][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 25.794545][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 25.800712][ T46] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 25.805124][ T9] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 25.821502][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.829647][ T314] usb 2-1: New USB device found, idVendor=0763, idProduct=2003, bcdDevice= 0.40 [ 25.839155][ T314] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.847541][ T9] usb 3-1: config 0 descriptor?? [ 25.852835][ T314] usb 2-1: Product: syz [ 25.858225][ T9] hub 3-1:0.0: USB hub found [ 25.863003][ T314] usb 2-1: Manufacturer: syz [ 25.867629][ T314] usb 2-1: SerialNumber: syz [ 25.971637][ T46] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 25.982638][ T46] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 25.991739][ T46] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.000624][ T46] usb 4-1: config 0 descriptor?? [ 26.057802][ T9] hub 3-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 26.081659][ T314] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 26.088875][ T314] usb 2-1: 2:1: invalid format type 0x1001 is detected, processed as PCM [ 26.100085][ T314] usb 2-1: 2:1 : sample bitwidth 241 in over sample bytes 2 [ 26.107488][ T314] usb 2-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 26.119029][ T314] usb 2-1: USB disconnect, device number 2 [ 26.137789][ T342] udevd[342]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 26.211985][ T46] usbhid 4-1:0.0: can't add hid device: -71 [ 26.221799][ T46] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 26.230832][ T46] usb 4-1: USB disconnect, device number 2 [ 26.413263][ T341] netlink: 'syz.3.8': attribute type 16 has an invalid length. [ 26.450666][ T361] bridge0: port 3(veth0_to_team) entered blocking state [ 26.457682][ T361] bridge0: port 3(veth0_to_team) entered disabled state [ 26.465021][ T361] veth0_to_team: entered allmulticast mode [ 26.471696][ T361] veth0_to_team: entered promiscuous mode [ 26.663248][ T314] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 26.750523][ T343] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 26.820839][ T314] usb 4-1: too many configurations: 18, using maximum allowed: 8 [ 26.829608][ T314] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 26.837620][ T314] usb 4-1: can't read configurations, error -61 [ 26.910503][ T343] usb 1-1: Using ep0 maxpacket: 8 [ 26.916967][ T343] usb 1-1: config 0 has an invalid interface number: 151 but max is 1 [ 26.925903][ T343] usb 1-1: config 0 has no interface number 1 [ 26.932734][ T343] usb 1-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 26.943731][ T343] usb 1-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 26.955563][ T343] usb 1-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 1024 [ 26.967231][ T343] usb 1-1: config 0 interface 151 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 26.978192][ T343] usb 1-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 26.991664][ T314] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 26.999282][ T343] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC9, changing to 0x89 [ 27.011230][ T343] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid maxpacket 12336, setting to 1024 [ 27.022506][ T343] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 1024 [ 27.037010][ T343] usb 1-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 27.046202][ T343] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.055071][ T343] usb 1-1: Product: syz [ 27.059328][ T343] usb 1-1: Manufacturer: syz [ 27.064018][ T343] usb 1-1: SerialNumber: syz [ 27.069648][ T343] usb 1-1: config 0 descriptor?? [ 27.075299][ T365] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 27.160848][ T314] usb 4-1: too many configurations: 18, using maximum allowed: 8 [ 27.169932][ T314] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 27.177629][ T314] usb 4-1: can't read configurations, error -61 [ 27.184736][ T314] usb usb4-port1: attempt power cycle [ 27.298705][ T46] usb 1-1: USB disconnect, device number 2 [ 27.340501][ T343] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 27.501577][ T343] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 27.511896][ T343] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 27.522311][ T343] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 27.531662][ T343] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.539821][ T314] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 27.547395][ T343] usb 2-1: Product: syz [ 27.551716][ T343] usb 2-1: Manufacturer: syz [ 27.556348][ T343] usb 2-1: SerialNumber: syz [ 27.571292][ T314] usb 4-1: too many configurations: 18, using maximum allowed: 8 [ 27.580114][ T314] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 27.587767][ T314] usb 4-1: can't read configurations, error -61 [ 27.720524][ T314] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 27.751246][ T314] usb 4-1: too many configurations: 18, using maximum allowed: 8 [ 27.760260][ T314] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 27.767920][ T314] usb 4-1: can't read configurations, error -61 [ 27.774546][ T314] usb usb4-port1: unable to enumerate USB device [ 27.781723][ T343] usb 2-1: 0:2 : does not exist [ 27.786697][ T343] usb 2-1: unit 9 not found! [ 27.793887][ T343] usb 2-1: 4:0: cannot get min/max values for control 1 (id 4) [ 27.809182][ T343] usb 2-1: 4:0: cannot get min/max values for control 2 (id 4) [ 27.819211][ T343] usb 2-1: 4:0: cannot get min/max values for control 3 (id 4) [ 27.822955][ T382] capability: warning: `syz.0.20' uses deprecated v2 capabilities in a way that may be insecure [ 27.831904][ T343] usb 2-1: 4:0: cannot get min/max values for control 5 (id 4) [ 27.847446][ T343] usb 2-1: 4:0: cannot get min/max values for control 10 (id 4) [ 27.859628][ T343] usb 2-1: USB disconnect, device number 3 [ 27.869194][ T378] udevd[378]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 27.889671][ T382] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 27.897023][ T382] overlayfs: failed to set xattr on upper [ 27.903022][ T382] overlayfs: ...falling back to redirect_dir=nofollow. [ 27.909972][ T382] overlayfs: ...falling back to uuid=null. [ 27.916226][ T36] kauditd_printk_skb: 64 callbacks suppressed [ 27.916242][ T36] audit: type=1400 audit(1782565428.080:138): avc: denied { mount } for pid=381 comm="syz.0.20" name="/" dev="overlay" ino=4556 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 27.918631][ T382] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 27.958930][ T382] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 27.965943][ T382] overlayfs: failed to set xattr on upper [ 27.971750][ T382] overlayfs: ...falling back to redirect_dir=nofollow. [ 27.978978][ T382] overlayfs: ...falling back to uuid=null. [ 27.985241][ T36] audit: type=1400 audit(1782565428.150:139): avc: denied { create } for pid=381 comm="syz.0.20" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 28.067984][ T36] audit: type=1400 audit(1782565428.230:140): avc: denied { unmount } for pid=295 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 28.088303][ T36] audit: type=1400 audit(1782565428.250:141): avc: denied { unmount } for pid=295 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 28.088735][ T295] ------------[ cut here ]------------ [ 28.114038][ T295] WARNING: CPU: 1 PID: 295 at fs/inode.c:340 drop_nlink+0xce/0x110 [ 28.122011][ T295] Modules linked in: [ 28.125959][ T295] CPU: 1 UID: 0 PID: 295 Comm: syz-executor Not tainted syzkaller #0 e549a79720f8b9d2445064a5e8a439d230f1aa2c [ 28.137662][ T295] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 28.147787][ T295] RIP: 0010:drop_nlink+0xce/0x110 [ 28.152916][ T295] Code: 04 00 00 be 08 00 00 00 e8 4f 14 ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 d2 5d 95 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c [ 28.172727][ T295] RSP: 0018:ffffc9000b65fc68 EFLAGS: 00010293 [ 28.178834][ T295] RAX: ffffffff81f211fe RBX: ffff888111203a80 RCX: ffff888106a93900 [ 28.187105][ T295] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 28.195147][ T295] RBP: ffffc9000b65fc90 R08: 0000000000000003 R09: 0000000000000004 [ 28.203304][ T295] R10: dffffc0000000000 R11: fffff520016cbf84 R12: dffffc0000000000 [ 28.211431][ T295] R13: 1ffff11022240759 R14: ffff888111203ac8 R15: 0000000000000000 [ 28.219451][ T295] FS: 00005555888e4500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 28.228456][ T295] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 28.235210][ T295] CR2: 000055558890f998 CR3: 000000012a7c2000 CR4: 00000000003526b0 [ 28.243338][ T295] Call Trace: [ 28.246731][ T295] [ 28.249689][ T295] simple_rmdir+0x152/0x260 [ 28.254337][ T295] vfs_rmdir+0x3de/0x560 [ 28.258648][ T295] incfs_kill_sb+0x102/0x220 [ 28.263296][ T295] deactivate_locked_super+0xd5/0x270 [ 28.268715][ T295] deactivate_super+0xb8/0xe0 [ 28.273444][ T295] cleanup_mnt+0x438/0x4d0 [ 28.277902][ T295] __cleanup_mnt+0x1d/0x40 [ 28.282468][ T295] task_work_run+0x1e8/0x260 [ 28.287099][ T295] ? __cfi_task_work_run+0x10/0x10 [ 28.292295][ T295] ? __x64_sys_umount+0x12e/0x180 [ 28.297379][ T295] ? __cfi___x64_sys_umount+0x10/0x10 [ 28.302833][ T295] resume_user_mode_work+0x35/0x50 [ 28.307992][ T295] syscall_exit_to_user_mode+0x63/0xb0 [ 28.313625][ T295] do_syscall_64+0x63/0xf0 [ 28.318079][ T295] ? clear_bhb_loop+0x50/0xa0 [ 28.322833][ T295] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 28.328853][ T295] RIP: 0033:0x7fb45f99e097 [ 28.333444][ T295] Code: a2 c7 05 5c 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 28.353138][ T295] RSP: 002b:00007fffbb48d708 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6 [ 28.361641][ T295] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fb45f99e097 [ 28.369743][ T295] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffbb48d7c0 [ 28.377831][ T295] RBP: 00007fffbb48d7c0 R08: 00007fffbb48e7c0 R09: 00000000ffffffff [ 28.382561][ T9] usbhid 3-1:0.0: can't add hid device: -71 [ 28.385858][ T295] R10: 0000000000000000 R11: 0000000000000206 R12: 00007fffbb48e8b0 [ 28.399766][ T295] R13: 00007fb45fa322ca R14: 0000000000006d51 R15: 00007fffbb48f980 [ 28.400122][ T9] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 28.407827][ T295] [ 28.418939][ T295] ---[ end trace 0000000000000000 ]--- [ 28.428524][ T295] ================================================================== [ 28.436649][ T295] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 [ 28.442940][ T295] Write of size 4 at addr 0000000000000168 by task syz-executor/295 [ 28.450951][ T295] [ 28.453298][ T295] CPU: 0 UID: 0 PID: 295 Comm: syz-executor Tainted: G W syzkaller #0 e549a79720f8b9d2445064a5e8a439d230f1aa2c [ 28.453329][ T295] Tainted: [W]=WARN [ 28.453336][ T295] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 28.453348][ T295] Call Trace: [ 28.453355][ T295] [ 28.453363][ T295] __dump_stack+0x21/0x30 [ 28.453396][ T295] dump_stack_lvl+0x140/0x1c0 [ 28.453422][ T295] ? __cfi_dump_stack_lvl+0x10/0x10 [ 28.453451][ T295] print_report+0x3d/0x70 [ 28.453477][ T295] kasan_report+0x162/0x1a0 [ 28.453502][ T295] ? ihold+0x24/0x70 [ 28.453525][ T295] ? ihold+0x24/0x70 [ 28.453546][ T295] kasan_check_range+0x25a/0x2b0 [ 28.453571][ T295] __kasan_check_write+0x18/0x20 [ 28.453589][ T295] ihold+0x24/0x70 [ 28.453610][ T295] vfs_rmdir+0x25c/0x560 [ 28.453636][ T295] incfs_kill_sb+0x102/0x220 [ 28.453656][ T295] deactivate_locked_super+0xd5/0x270 [ 28.453684][ T295] deactivate_super+0xb8/0xe0 [ 28.453710][ T295] cleanup_mnt+0x438/0x4d0 [ 28.453732][ T295] __cleanup_mnt+0x1d/0x40 [ 28.453754][ T295] task_work_run+0x1e8/0x260 [ 28.453780][ T295] ? __cfi_task_work_run+0x10/0x10 [ 28.453803][ T295] ? __x64_sys_umount+0x12e/0x180 [ 28.453831][ T295] ? __cfi___x64_sys_umount+0x10/0x10 [ 28.453868][ T295] resume_user_mode_work+0x35/0x50 [ 28.453898][ T295] syscall_exit_to_user_mode+0x63/0xb0 [ 28.453926][ T295] do_syscall_64+0x63/0xf0 [ 28.453945][ T295] ? clear_bhb_loop+0x50/0xa0 [ 28.453969][ T295] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 28.453992][ T295] RIP: 0033:0x7fb45f99e097 [ 28.454008][ T295] Code: a2 c7 05 5c 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 28.454024][ T295] RSP: 002b:00007fffbb48d708 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6 [ 28.454044][ T295] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fb45f99e097 [ 28.454056][ T295] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffbb48d7c0 [ 28.454068][ T295] RBP: 00007fffbb48d7c0 R08: 00007fffbb48e7c0 R09: 00000000ffffffff [ 28.454081][ T295] R10: 0000000000000000 R11: 0000000000000206 R12: 00007fffbb48e8b0 [ 28.454093][ T295] R13: 00007fb45fa322ca R14: 0000000000006d51 R15: 00007fffbb48f980 [ 28.454109][ T295] [ 28.454116][ T295] ================================================================== [ 28.688711][ T295] Disabling lock debugging due to kernel taint [ 28.692198][ T9] usb 3-1: USB disconnect, device number 2 [ 28.702396][ T295] BUG: kernel NULL pointer dereference, address: 0000000000000168 [ 28.710244][ T295] #PF: supervisor write access in kernel mode [ 28.716342][ T295] #PF: error_code(0x0002) - not-present page [ 28.722350][ T295] PGD 800000010fb57067 P4D 800000010fb57067 PUD 0 [ 28.728909][ T295] Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI [ 28.735013][ T295] CPU: 1 UID: 0 PID: 295 Comm: syz-executor Tainted: G B W syzkaller #0 e549a79720f8b9d2445064a5e8a439d230f1aa2c [ 28.748280][ T295] Tainted: [B]=BAD_PAGE, [W]=WARN [ 28.753434][ T295] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 28.761687][ T36] audit: type=1400 audit(1782565428.930:142): avc: denied { read } for pid=93 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 28.763527][ T295] RIP: 0010:ihold+0x2a/0x70 [ 28.788643][ T36] audit: type=1400 audit(1782565428.950:143): avc: denied { search } for pid=93 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 28.789741][ T295] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 bd 54 95 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 0c 0b ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 cd [ 28.811912][ T36] audit: type=1400 audit(1782565428.950:144): avc: denied { write } for pid=93 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 28.830720][ T295] RSP: 0018:ffffc9000b65fcc8 EFLAGS: 00010246 [ 28.830744][ T295] RAX: ffff888106a93900 RBX: 0000000000000000 RCX: ffff888106a93900 [ 28.830759][ T295] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 28.830772][ T295] RBP: ffffc9000b65fcd8 R08: ffffffff88bb2947 R09: 1ffffffff1176528 [ 28.853954][ T36] audit: type=1400 audit(1782565428.950:145): avc: denied { add_name } for pid=93 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 28.858032][ T295] R10: dffffc0000000000 R11: fffffbfff1176529 R12: 0000000000000000 [ 28.866618][ T36] audit: type=1400 audit(1782565428.950:146): avc: denied { create } for pid=93 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 28.873999][ T295] R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 [ 28.874016][ T295] FS: 00005555888e4500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 28.874036][ T295] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 28.882718][ T36] audit: type=1400 audit(1782565428.950:147): avc: denied { append open } for pid=93 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 28.902494][ T295] CR2: 0000000000000168 CR3: 000000012a7c2000 CR4: 00000000003526b0 [ 28.902519][ T295] Call Trace: [ 28.902527][ T295] [ 28.902536][ T295] vfs_rmdir+0x25c/0x560 [ 28.902571][ T295] incfs_kill_sb+0x102/0x220 [ 28.902593][ T295] deactivate_locked_super+0xd5/0x270 [ 28.902623][ T295] deactivate_super+0xb8/0xe0 [ 28.902650][ T295] cleanup_mnt+0x438/0x4d0 [ 28.902675][ T295] __cleanup_mnt+0x1d/0x40 [ 29.019165][ T295] task_work_run+0x1e8/0x260 [ 29.023765][ T295] ? __cfi_task_work_run+0x10/0x10 [ 29.028903][ T295] ? __x64_sys_umount+0x12e/0x180 [ 29.034093][ T295] ? __cfi___x64_sys_umount+0x10/0x10 [ 29.039488][ T295] resume_user_mode_work+0x35/0x50 [ 29.044621][ T295] syscall_exit_to_user_mode+0x63/0xb0 [ 29.050100][ T295] do_syscall_64+0x63/0xf0 [ 29.054525][ T295] ? clear_bhb_loop+0x50/0xa0 [ 29.059216][ T295] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 29.065111][ T295] RIP: 0033:0x7fb45f99e097 [ 29.069539][ T295] Code: a2 c7 05 5c 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 29.089144][ T295] RSP: 002b:00007fffbb48d708 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6 [ 29.097558][ T295] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fb45f99e097 [ 29.105524][ T295] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffbb48d7c0 [ 29.113494][ T295] RBP: 00007fffbb48d7c0 R08: 00007fffbb48e7c0 R09: 00000000ffffffff [ 29.121476][ T295] R10: 0000000000000000 R11: 0000000000000206 R12: 00007fffbb48e8b0 [ 29.129451][ T295] R13: 00007fb45fa322ca R14: 0000000000006d51 R15: 00007fffbb48f980 [ 29.137450][ T295] [ 29.140477][ T295] Modules linked in: [ 29.144424][ T295] CR2: 0000000000000168 [ 29.148583][ T295] ---[ end trace 0000000000000000 ]--- [ 29.154035][ T295] RIP: 0010:ihold+0x2a/0x70 [ 29.158541][ T295] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 bd 54 95 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 0c 0b ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 cd [ 29.178166][ T295] RSP: 0018:ffffc9000b65fcc8 EFLAGS: 00010246 [ 29.184249][ T295] RAX: ffff888106a93900 RBX: 0000000000000000 RCX: ffff888106a93900 [ 29.192245][ T295] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 29.200230][ T295] RBP: ffffc9000b65fcd8 R08: ffffffff88bb2947 R09: 1ffffffff1176528 [ 29.208231][ T295] R10: dffffc0000000000 R11: fffffbfff1176529 R12: 0000000000000000 [ 29.216218][ T295] R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 [ 29.224364][ T295] FS: 00005555888e4500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 29.233318][ T295] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.239901][ T295] CR2: 0000000000000168 CR3: 000000012a7c2000 CR4: 00000000003526b0 [ 29.247877][ T295] Kernel panic - not syncing: Fatal exception [ 29.254678][ T295] Kernel Offset: disabled [ 29.259021][ T295] Rebooting in 86400 seconds..