last executing test programs: 2.473504784s ago: executing program 0 (id=70): r0 = openat$kvm(0x0, &(0x7f0000000d80), 0x20000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x185803) ioctl$SNDRV_TIMER_IOCTL_CREATE(r2, 0xc02054a5, &(0x7f0000000080)={0x4, r1, 'id1\x00'}) r4 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r5 = syz_kvm_add_vcpu$x86(r4, &(0x7f0000000dc0)={0x0, &(0x7f0000000e00)=[@enable_nested={0x12c, 0x18}], 0x18}) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r5, 0x4068aea3, &(0x7f0000000f00)={0xa3, 0x0, 0x0}) ioctl$int_in(r0, 0x5421, &(0x7f0000000000)=0x2) r6 = openat$kvm(0xffffff9c, &(0x7f0000000100), 0x80000, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000580)={0x1, 0x0, [{0xf88e470f, 0xed}]}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f00000001c0)={0xa, 0x4}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x290, 0x0, 0xde180000000000}]}) writev(r5, &(0x7f0000000480)=[{&(0x7f00000003c0)="b72948d21a55e2ecbd529609065ad72036a3aca5c28c295a175eed72ee5e37ccbe86c6da7c705b2896b3303a67e69fe589c29e4456189bcc1229f30b2cd0c403b00396f9780bce06f99f155693b747de20e00c26d4da643e59b3ece8dd3862a2e1697d49dee706e4702a8ca63224f71fce229383df283668058b5698670d4ebeaf35798d6b8de1280ad1b191406755b2d8fc06905a1099b87c1b9c61061b", 0x9e}], 0x1) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f00000005c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r8 = syz_kvm_setup_syzos_vm$x86(r3, &(0x7f0000c00000/0x400000)=nil) r9 = syz_kvm_add_vcpu$x86(r8, &(0x7f0000000600)={0x0, &(0x7f0000000640)=[@wrmsr={0x65, 0x20, {0x400000b4}}], 0x20}) ioctl$KVM_SET_CPUID2(r9, 0x4008ae90, &(0x7f0000000680)={0x1, 0x0, [{0x40000001, 0x4, 0x2, 0x31237649, 0x4, 0x2, 0x80}]}) ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(r9, 0x4068aea3, &(0x7f00000006c0)={0xc7, 0x0, 0x1}) ioctl$KVM_RUN(r9, 0xae80, 0x0) r10 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x1f) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000240)={0x0, 0x0}) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r10, 0x4020ae46, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_GET_MSR_INDEX_LIST(r6, 0xc004ae02, &(0x7f00000002c0)) ioctl$KVM_SET_REGS(r11, 0x4090ae82, &(0x7f0000000300)={[0x2, 0x9, 0xfffffffffffffffd, 0x77, 0x2, 0x2, 0x4002004c4, 0x1004, 0x8000000000000000, 0xc595, 0x2000, 0x1, 0xffffffffffffffff, 0x1ffffffffffffffc, 0x5, 0x90], 0xeeee8000, 0x2010d3}) ioctl$KVM_RUN(r11, 0xae80, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000500)='./sys\x00', &(0x7f0000000540)='sysfs\x00', 0x0, 0x0) 2.310306501s ago: executing program 0 (id=71): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000026c0)=ANY=[@ANYBLOB="04010000100007000000000000000000ac1e0101000000000000000000000000fe80000000000000000000000000001a4e200002000010000000000002000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff010000000000000000000000000001000004d33c000000ff01000000000000000000000000000100000000000000000000000000000000820000000000030000000000000000000000001000000000ffffffffffffffff00000000000000000000000000000000000000000000000000002000000000000700000000000000000000000000000000000400fdffffffe80a0000000000000000000002000000340000000000000014000e"], 0x104}}, 0x0) 2.240777418s ago: executing program 0 (id=72): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) listen(r1, 0x2) (async) listen(r1, 0x2) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000000), 0x3) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x138, 0x14, 0x1, 0x4, 0x25dfdbfe, {0xa}, [@typed={0x4}, @nested={0x10c, 0x8, 0x0, 0x1, [@nested={0x107, 0x142, 0x0, 0x1, [@typed={0xc, 0x29, 0x0, 0x0, @u64=0x3fd}, @nested={0xbf, 0x107, 0x0, 0x1, [@typed={0xc, 0xf2, 0x0, 0x0, @u64=0x3}, @generic="fbf19413fc8fee86ae44ec5484756cecca6dccd2786a99159b3ad9c0d273c8b3f1600ffddf1f75cddc1106e1d7db4565a612a8598649fc92ccaf786b18cc23c27098af5d3a3130167b581c84d542020d2604f670bf3d2f75f4e0f94cfce9fd133a1f4f82d3e07e60bfe5c8d6ea8100d5bfd082c877a5b2813883fd7d1ed01317aee009f1df94cf503b3f1fedf54f13b6749eb1a6ea30d8b116a2ffca9f14ba2b323f93690167ed02f9c321563c72db"]}, @generic="19636f7a4d7a8e5cc3f82d56982dcb2f9ba1e6833f2f1ad01d9bad8383bd6d713484453fbd3c6815506b22e59374ee7d56d562f4749ac3"]}]}, @nested={0x14, 0x2, 0x0, 0x1, [@typed={0xd, 0x5a, 0x0, 0x0, @binary="2926d650db77e5cb36"}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x20000804}, 0x4800) 2.240580449s ago: executing program 0 (id=73): syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r0 = add_key$keyring(&(0x7f0000000100), &(0x7f0000000480)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$set_timeout(0xf, r0, 0x2) clock_settime(0xfffffff4, &(0x7f0000000000)={0x0, 0x3938700}) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000200)=ANY=[@ANYBLOB="4c000000100001060000000000000000000000000000000000000000000000000b00033264756d6d793000000800200004022100180012000a00010064756d6d79"], 0x4c}], 0x1}, 0x0) setsockopt$inet_buf(r1, 0x0, 0x25, &(0x7f0000000140)="17000000020001000003d68c5ee17688a2003308020300ecff3f0200000300000a000000009afc5ad9485bbb6a880000d6c8db0000dba67e060180000a0000f10607bdff59100ac45761407a681f009cee4a5acb3da400001fb700674f19b44e09f9315033bf79ac2dff060115003901000000000000ea000000000000000009ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e000"/184, 0xb8) syz_usb_connect(0x4, 0x97, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_connect(0x5, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000d7dda4108911930800000102030109022400020000000009046802006e02c000090468"], 0x0) syz_usb_connect$midi(0x5, 0x121, &(0x7f0000000280)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0xff, 0x582, 0x8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x10f, 0x1, 0x1, 0x10, 0x40, 0xfc, "", {{{0x9, 0x4, 0x0, 0x0, 0x8, 0x1, 0x3, 0x20, 0x1, [@midi_in_jack={0x6, 0x24, 0x2, 0x3, 0x4, 0xd}, @midi_out_jack={0xd, 0x24, 0x3, 0x2, 0x5, 0x3, [{0x9}, {0x7, 0x6}, {0xd, 0x6}], 0x86}, @midi_in_jack={0x6, 0x24, 0x2, 0x3, 0x8, 0xd}, @midi_in_jack={0x6, 0x24, 0x2, 0x1, 0xad, 0x45}, @midi_in_jack={0x6, 0x24, 0x2, 0x2, 0xf3, 0xf}, @ms_header={0x7, 0x24, 0x1, 0x0, 0x7}, @midi_out_jack={0x11, 0x24, 0x3, 0x3, 0x55, 0x5, [{0x7, 0xca}, {0xb, 0x81}, {0x81, 0x4}, {0x4, 0x7f}, {0x6, 0x50}], 0x8}, @midi_out_jack={0xb, 0x24, 0x3, 0x2, 0x2, 0x2, [{0x7, 0x3}, {0xa, 0x4}], 0x9}, @midi_out_jack={0x11, 0x24, 0x3, 0x1, 0x3, 0x5, [{0x9, 0x5}, {0x7, 0x7f}, {0x0, 0x7}, {0xfe, 0x1}, {0x9, 0x2}], 0x9}], [{{0x9, 0x5, 0xc, 0x0, 0x20, 0x10, 0x8, 0x8, {0x9, 0x25, 0x1, 0x5, "7dc4b41153"}}}, {{0x9, 0x5, 0x3, 0x20, 0x8, 0x3, 0x6, 0x2, {0xe, 0x25, 0x1, 0xa, "84af3a712326556f08b5"}}}, {{0x9, 0x5, 0x6, 0x4, 0x40, 0x9, 0x6, 0x1, {0xc, 0x25, 0x1, 0x8, "1f0c0c8d00693473"}}}, {{0x9, 0x5, 0xf, 0x10, 0x400, 0xb8, 0x4, 0x6, {0x6, 0x25, 0x1, 0x2, "9884"}}}, {{0x9, 0x5, 0xf, 0x1, 0x40, 0x0, 0x10, 0xef, {0xb, 0x25, 0x1, 0x7, "b67a1b28355f4b"}}}, {{0x9, 0x5, 0xf, 0x10, 0x200, 0x4, 0x9, 0xff, {0x8, 0x25, 0x1, 0x4, "c6b73034"}}}, {{0x9, 0x5, 0x7, 0xc, 0x10, 0x3, 0x3, 0x2, {0xd, 0x25, 0x1, 0x9, "10b49f4a5094d1c1a6"}}}, {{0x9, 0x5, 0x4, 0x3, 0x200, 0x8, 0x5, 0x6, {0x13, 0x25, 0x1, 0xf, "9debd8394e53c89d40f92268258876"}}}]}}}}}]}}, &(0x7f00000005c0)={0xa, &(0x7f00000003c0)={0xa, 0x6, 0x250, 0xfa, 0x2, 0x7f, 0xff, 0x3}, 0x2a, &(0x7f0000000400)={0x5, 0xf, 0x2a, 0x4, [@ptm_cap={0x3}, @ptm_cap={0x3}, @ptm_cap={0x3}, @ssp_cap={0x1c, 0x10, 0xa, 0x1, 0x4, 0x6, 0xf000, 0x3, [0xff0000, 0x3f18, 0x3f00, 0xc0cf]}]}, 0x3, [{0x18, &(0x7f0000000440)=@string={0x18, 0x3, "ea73f60df8b8ee792db2a512c81074830e6a0b07f48c"}}, {0x8c, &(0x7f0000000600)=@string={0x8c, 0x3, "358beca6ef2427c95bbf49b90ac28e3fbd8a558a4675b98b46632e9bf64582b727c62d73a70114f5607cc1e37fcd48999654bbf29e970e794cddaef0d213d63edf39ea2bfc7310fd0bca9db0e17d927612b963315397da6295f06e703dbcbfda8d40b5b79177e09c50c8d2ce1c69ec9ca5d83957e47a8b76d54a50f9e8b721f7998d80703dc8596392ae"}}, {0x4c, &(0x7f0000000540)=@string={0x4c, 0x3, "a79a91b1560a8f40403032731d1284a5a14047d0531f76de140e594aaacbddab970aa7004cf45bdab7a1169d222a5906c7d5a9e83273b9145306410a65c1990bcb3f6f7d7e624519fffa"}}]}) 1.608076274s ago: executing program 2 (id=76): write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f0000000100)={0x30, 0x5, 0x0, {0x0, 0x2000a, 0xd, 0x2}}, 0x30) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x10) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f00000000c0)='devtmpfs\x00', 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./mnt\x00', 0x1ff) mount(&(0x7f00000003c0)=@filename='./dev/sda1\x00', &(0x7f0000000400)='./mnt\x00', &(0x7f0000000440)='ext4\x00', 0x8410, 0x0) chdir(&(0x7f0000000480)='./mnt\x00') r2 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./mnt\x00', 0x0, 0x21) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r2, 0x800c6613, &(0x7f0000000500)=@v2={0x2, @aes256, 0x3, '\x00', @auto="5b6470438f31fdddeac2337f8fb6fab6"}) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000540)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x4ee59ce4, 0xfffffffffffffffd, 0xfffffffc}, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000580)={0x2e, 0x60, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000600)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000640)=0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup(r4) syz_ublk_setup_queues(r5, r3, &(0x7f0000000680)={0x0, 0x42cc, 0x10, 0x1, 0x7f}, &(0x7f0000000700)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe706, 0x1000, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x4, 0x3ae}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93e5, 0x2000, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x230, 0x0, r2}}], 0x1, 0x0, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000140)={0x1, 0x0, @ioapic={0xffe, 0xd69e, 0x800, 0x8, 0x0, [{0x0, 0x6, 0x6, '\x00', 0x8}, {0x0, 0x4, 0x3, '\x00', 0x2}, {0x86, 0x7, 0x2b, '\x00', 0x1}, {0xb1, 0x18, 0x8}, {0x3, 0x79, 0x7, '\x00', 0x8}, {0xe5, 0x0, 0x1, '\x00', 0x6}, {0xf7, 0x8, 0x6, '\x00', 0x6}, {0x0, 0x3, 0x9, '\x00', 0x6}, {0x0, 0x6, 0x8, '\x00', 0x2}, {0x91, 0xf4, 0x8, '\x00', 0x2a}, {0x2, 0x0, 0x2, '\x00', 0xd}, {0x80, 0x8, 0x60, '\x00', 0x4}, {0x40, 0x1, 0x1, '\x00', 0x7}, {0xb4, 0x5, 0x8, '\x00', 0x1}, {0x4, 0x0, 0x7, '\x00', 0x5}, {0xe, 0x7, 0xff, '\x00', 0x6}, {0x6e, 0x8, 0x9}, {0x4, 0xe4, 0x0, '\x00', 0x2}, {0xd8, 0x5, 0x53, '\x00', 0x81}, {0x4, 0x7, 0x9, '\x00', 0x68}, {0x9, 0x28, 0x7, '\x00', 0x6}, {0x7, 0x97, 0x0, '\x00', 0x6}, {0x2, 0x7, 0x3, '\x00', 0x80}, {0x0, 0x79, 0xa, '\x00', 0x6}]}}) mkdirat(0xffffffffffffff9c, 0x0, 0x1bf) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$FIBMAP(r6, 0x5393, &(0x7f0000000100)=0x3) 1.607150104s ago: executing program 2 (id=77): getdents(0xffffffffffffffff, 0x0, 0x0) close(0x3) r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, 0x0, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x0, 0x1000, 0x240002, 0x1e8}, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)) ioctl$INCFS_IOC_GET_FILLED_BLOCKS(r1, 0x80286722, &(0x7f0000000400)={&(0x7f0000000340)=""/134, 0x86, 0x7f, 0x4}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x200000e, 0x401d031, 0xffffffffffffffff, 0x0) r2 = syz_create_resource$futex(&(0x7f00000002c0)=0x1) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x28100, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000480)=0x2) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = openat$kvm(0xffffff9c, &(0x7f0000000540), 0x800, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000001000/0x1000)=nil}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000001640)={[0xfffffffffffffff9, 0xe34, 0x1, 0xfffffffffffffffc, 0xa, 0x1, 0x1000, 0x401000000000008, 0x7d, 0x0, 0x100000000000, 0xc, 0x3, 0x1, 0x1fffffffffffe, 0xfffffffffffffffb], 0x50000, 0x1c61c6}) ioctl$KVM_RUN(r7, 0xae80, 0x0) setsockopt$SO_TIMESTAMP(r4, 0x1, 0x23, &(0x7f0000000500)=0x7, 0x4) ioctl$TIOCSETD(r3, 0x5423, &(0x7f00000004c0)=0x11) ioctl$TIOCVHANGUP(r3, 0x5437, 0x0) futex(r2, 0xc, 0x1, 0x0, 0x0, 0x1) 1.593979355s ago: executing program 2 (id=78): unshare(0x6a060000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x149040, 0x0) truncate(&(0x7f0000000040)='./file0\x00', 0x4) r1 = mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x200000000000000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x7) ioprio_set$uid(0x3, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='comm\x00') socket$netlink(0x10, 0x3, 0x0) syz_ublk_setup_io_uring(0x20, &(0x7f0000000280)={0x0, 0x0, 0x1000, 0x40002, 0x1e5}, &(0x7f0000000300), &(0x7f0000000340), &(0x7f0000000380)=0x0) syz_ublk_add_dev(r0, 0x0, r1, r3, &(0x7f00000003c0)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x104, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x3, 0x462, 0x0, 0x0, 0x1000, 0x7, 0x0, 0x0, 0x13}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, 0x0, &(0x7f00000004c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x80000, 0x1000000, 0x33d, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffffff, 0x20, 0x3, 0x121}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7d70, 0x2000, 0x0, 0xc2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0x40, 0x0, 0xffffffff}}], 0x1, 0x0, 0x0) 1.340681121s ago: executing program 2 (id=82): r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2b, &(0x7f0000000280)={0x7f, {{0xa, 0x4e23, 0x80000003, @mcast2, 0x7}}, {{0xa, 0x4e23, 0x403, @empty, 0x81}}}, 0x108) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201e10000000040050be0170000000000010902"], 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) syz_usb_connect(0x5, 0x8ac, &(0x7f0000000100)=ANY=[@ANYBLOB="120110019f1a1010d1121e1400000102030109029a08044c04400c09047d700d4b01"], 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fda000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, &(0x7f00000003c0)="46b80100000000fa0000000f01d9660f78c4020a3ef32e650f09f23e650f080fae41d901000000b87f8b7f26ba000000000f30660fc775022e0fba600c980f320f3566b857000f20c035000000800f22c0", 0x51}], 0x1, 0x12, 0x0, 0xfffffffffffffffd) ioctl$KVM_PPC_ALLOCATE_HTAB(r2, 0xc004aea7, &(0x7f00000000c0)=0xfffffffe) ioctl$KVM_CAP_X86_USER_SPACE_MSR(r2, 0x4068aea3, &(0x7f0000000040)={0xbc, 0x0, 0x5}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1.340486221s ago: executing program 1 (id=83): mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x3b) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) openat$selinux_relabel(0xffffffffffffff9c, 0x0, 0x2, 0x0) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x40, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x3, &(0x7f00000001c0)=[{0x45, 0x0, 0x1, 0xfffffffc}, {}, {0x6}]}) mkdirat(r2, &(0x7f0000000080)='./sys/class/scsi_host/host0/scan\x00', 0x1ff) mount(0x0, &(0x7f0000000440)='./sys\x00', &(0x7f00000008c0)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r3, &(0x7f0000000480)="7e98931eeacfa026b4826510823c64f781a124f84657a7959db1e83900261ca62c58c39dcf00b3d39b665f3d502ae28a7bb7f00026b33621592fd8af6cf6b98fd2c0639849", 0x45) r4 = openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0) ioctl$F2FS_IOC_START_VOLATILE_WRITE(r4, 0xf503, 0x0) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x400202, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000140)={0x2, &(0x7f0000000100)=[{0x9, 0xfa, 0x3, 0x84}, {0x0, 0x2, 0x88, 0xc8}]}) 1.035536943s ago: executing program 0 (id=84): r0 = socket(0x10, 0x3, 0x0) r1 = fsopen(&(0x7f0000000000)='devpts\x00', 0x0) fsconfig$FSCONFIG_SET_FLAG(r1, 0x0, &(0x7f0000000400)='posixacl\x00', 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000440)={0x1, &(0x7f00000006c0)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r2, 0xffffffffffffffff, 0x0) write(r0, &(0x7f0000000240)="2000000012005f0214f9f4070000fbe40a0000000000", 0x41d) openat$zero(0xffffffffffffff9c, &(0x7f0000000200), 0xa0043, 0x0) r3 = userfaultfd(0x80801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x145}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f00000001c0)={{&(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0x1}) sendfile(r3, r3, 0x0, 0x200000c) recvmmsg(r0, &(0x7f0000000280)=[{{0x0, 0xfffffffffffffc48, &(0x7f0000000100)=[{&(0x7f0000000480)=""/255, 0xff}, {&(0x7f0000000580)=""/118, 0x76}, {&(0x7f0000000600)=""/132, 0x84}, {&(0x7f0000001780)=""/4110, 0x100e}, {&(0x7f0000000040)=""/7}, {&(0x7f0000000080)=""/65}], 0x4}}, {{0x0, 0x0, 0x0}, 0x4}, {{0x0, 0x0, 0x0}, 0x6}, {{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, 0x0}, 0xae}, {{0x0, 0x0, 0x0}, 0x80}], 0x6, 0x40000020, 0x0) 1.024275604s ago: executing program 0 (id=85): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f0000000280)={0x79, 0x0, 0x78b}) (async) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000000)={0x4000}, 0x10) (async) sendmsg$nl_generic(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001e00010a020000000000000007000000a78643f4d8ab5365f17044c2d853c09d7c13f8c18bc607a5a53697720849496f7adc1d7564e370bcaa19dfca7fd99d2bf2cf0faa011d72d5eeb9d78df40c31dafcd4e3d9816ce624b0f86aa719b66bdb8a7e2cadcd0d6eaa933137dc451533d643c993314178b2218375c77e945bd47bc514e356f20ef5"], 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) (async) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) signalfd4(0xffffffffffffffff, &(0x7f0000000100)={[0x100000000]}, 0x8, 0x180000) (async) ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000300)=0x3) (async) ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000001b40)={"43d064455ca79c3698dcca60005c1ba163b1d8f04d69d873792c0cbfc95dacc7cd39a49df12a052d0d8f1bd04b722b4f262437efc030d0000000e618763f4600660b41f320706e06860fe29f1bb455ef5071560200000000000000aad99f74b3e592254eede14eb1b64af356cfaa8ff002c4deed28995dc5e6ee13c4a1b39ba72979c5f3ed91ff89e73e09f7f88fe58bcb505f0500764c95c8bed7499213d10200000000000000b094843295ac02f06dc46485bb56f2eb2eb3c5ef1e50a2431a2082b54c4b0ee08322fb5f922f6d9fa3226faf7aeb9630aabe81617fe2849d8ab92fb80f07dfa9d831f4f7ef48923e28553f0c31cf1343d4c0d4dee937e639670fc2ceab9e5048d5bcd9f52a9c90ddd1fee1fda90a114fdf7298b7607c5294efdea04743a0045e96aae496fcb06636a8620f6e007ee5f5c24ab0d0f85cfb3a7820dbe2241b017e917eafb27d13feba7de3a28dd4c29c7959ae5c07a4c848f896fcc32fa6bbf869030a1b61fb0d20a5631dcea68ffa7d456869c4e7a96033f38fa88ccd53dc1feb5381c01dd71ec0446e3633ea88000000000000e1f44e3fd0d96c724499e1ec2cff23a3d5b979526c0a44dd967491dc45d4df48ad83027df0be02e35ca4c107bdf957f4c7a831dff89f998a2e1302445dc0ab5fc38f7c8a6260723e535062319cb68cb309e91b88c55014bb436c5d9f6bf35cbe24605821baf9ea6aaa31cb2dd74e29863a0c71e3367846cffe17c4a29a76eb635e95c6d7f4d846f3369aedbfb70b3716c1c0234a0deb9abfac12686d45ba97952e8a50480c5f44e038b1a4d5cd9301d02b942afacfaa30b6ef315d72eaf41dddda4983608dc2f5d5e92392a141b0f2f8d34042d1a6cd45d9f9df4c83b8c8b55959d58843ab3564d3f49d81d82ccd42bb8ad9c8e4b92c2df872c9383c88f4b1bbaf116fff233f55d99b43677eb29ad63e00e24eee69c72a604b2cdd7641d9c682d1d4ea865bd0de857ac1a55b2d6374a4a18af8f27887ffb4b2168e764a5aa9b303a35873d2177de8c5a00be39726baa6d320f29f6b8ec6743454b4542f3fb3ca678a0ecca17ba7c2655931f38ed26219fde45ab846ff07a156953b09000000000000008bd9f9f0861e7aeb8195013444d2d326cad53718e40be06aea644573a9ef22b13692a17ed8c257063e00007e4c3301a1bff37d72efc14d34ddabbb286f53264e0c8122f215de4f2e06f6e0472774c2476a61ad2c309abfed7e3367bc7373876507764e60b193e8c5ab4dd25c9098dfba8272f7361d0000000000000000000000000000000000000000000000000000e000008000"}) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000200)=[{0x6, 0x7, 0xff, 0x7fff7ffc}]}) (async) r5 = syz_open_dev$usbfs(&(0x7f0000000340), 0x1ff, 0xa401) ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, &(0x7f0000000380)={0x0, 0x0, "ec9fe44d4dbe56a60274fcffffffffffffff14e315eeb406bfdd73835e57efa94b1a0275781c647aa7e3470c6028643b17832b10b386a6f73791011c26a9aa141f406e312295ee620a9a46577b9249b738fe7750bec83bf6ed5b67213fa7d6c0823fd154ed29ede1ff379742c3f0b46caa357d70ee438f901d7645c3f87e4b21482b76f2ad8eaac090272081f98fd2e3e5a63e008104df635e731a5bfcd942f4529517454618de595cd179445b4bdbf698b9986356f0ebf7d25a57774ef474f86a3ad24ae9f0bf94b99e6b87de5f79d383d05bb32701daed400785a49788f08caecc9e0c48a3740bbe6e1c1fd4f6cfdfe756bc00d08e36655c00"}) (async) ioctl$USBDEVFS_ALLOW_SUSPEND(r5, 0x5522) (async) close_range(r4, 0xffffffffffffffff, 0x200000000000000) syz_usb_connect$hid(0x5, 0x3f, &(0x7f00000004c0)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x7c, 0x56a, 0x60, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x8, 0x40, 0x5, "", [{{0x9, 0x4, 0x0, 0x2, 0x1, 0x3, 0x1, 0x3, 0x7f, {0x9, 0x21, 0x9, 0x80, 0x1, {0x22, 0x8d2}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x8, 0x2, 0x3}}, [{{0x9, 0x5, 0x2, 0x3, 0x40, 0x7, 0xe7, 0xff}}]}}}]}}]}}, &(0x7f0000000640)={0xa, &(0x7f0000000500)={0xa, 0x6, 0x711, 0xf7, 0xb8, 0x2, 0x8, 0x9c}, 0x2d, &(0x7f0000000540)={0x5, 0xf, 0x2d, 0x4, [@ss_container_id={0x14, 0x10, 0x4, 0x4, "58ef58b37a56e79bdcd23a86be6b3822"}, @ptm_cap={0x3}, @ext_cap={0x7, 0x10, 0x2, 0x10, 0x1, 0xd, 0x6}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x4, 0xcb, 0x8, 0x1}]}, 0x2, [{0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x44f}}, {0x79, &(0x7f00000005c0)=@string={0x79, 0x3, "bb0d0be3447f26c4205275dc2fe11ffc1edcf6f5b295818761880028e777670f6535da64c4a4d9ae5f11093b17ca2cb4d2ee2a69bd4fdffe4f0c1ffea2ba059046383c7716a78f0e9fc1c1737baa8802665ae6766501adebbc9d1543e617df51b0d3ed796f19e5d23b3635b6bc1a66b7095360e3a39ff2"}}]}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) socket$xdp(0x2c, 0x3, 0x0) 496.829769ms ago: executing program 3 (id=89): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000c13000/0x2000)=nil, 0x2000, &(0x7f0000000040)='\x00') r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) setsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000000180)=0x4c, 0x4) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x8, 0x70bd28, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r2}, @void}}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x24000004}, 0x8000) 496.646459ms ago: executing program 1 (id=90): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000026c0)=ANY=[@ANYBLOB="04010000100007000000000000000000ac1e0101000000000000000000000000fe80000000000000000000000000001a4e200002000010000000000002000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff010000000000000000000000000001000004d33c000000ff01000000000000000000000000000100000000000000000000000000000000820000000000000000000300000000000000001000000000ffffffffffffffff00000000000000000000000000000000000000000000000000002000000000000700000000000000000000000000000000000400fdffffffe80a0000000000000000000002000000340000000000000014000e"], 0x104}}, 0x0) 493.846749ms ago: executing program 1 (id=91): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000240)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) r2 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$selinux_load(r2, &(0x7f0000000100)=ANY=[@ANYBLOB="8cff7cf9080000005345204c696e757813"], 0x65) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="7bedcb5d07081196f37538e486dd6372ce22667f2b00dbf6e97158cf474fec87891f6d76745b686158bbcfe8875afdef00010000000029"], 0x66) 419.490897ms ago: executing program 1 (id=92): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/wakeup_count', 0x28201, 0xeb) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000540)={0x3b, @multicast2, 0x4e23, 0x0, 'lc\x00', 0x20, 0x1000, 0x51}, 0x2c) io_setup(0x9, &(0x7f00000000c0)=0x0) io_submit(r1, 0x1, &(0x7f0000000100)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x40, r0, &(0x7f0000000180)='8', 0x1, 0x80, 0x0, 0x3}]) r2 = socket$inet6(0xa, 0x1, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000200)={'team_slave_0\x00', &(0x7f0000000240)=@ethtool_ringparam={0x10, 0x9, 0x100, 0x8003, 0x6, 0x200, 0x1, 0x800, 0x4}}) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000000)=0x80000004, 0x4) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x33, &(0x7f0000000040)={0x1, &(0x7f00000001c0)=[{0x6, 0x0, 0x9, 0x2}]}, 0x10) listen(r2, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000440), 0x42, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000006c0), 0x2002, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r6, r7, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000700)=[@text64={0x40, &(0x7f0000000740)="67400f070f01c4b9800000c00f3235010200000f300f2040a366460f38804000440f20c03588001d00445b66baf80cb88cf4b684ef66bafc0ced460f01c966ba4cf0ff07ef87f345a57a43e1685b", 0x4e}], 0xaaaacab, 0x7c, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r7, 0x4138ae84, &(0x7f00000007c0)={{0x0, 0xdddd1000, 0x4, 0xd, 0x5, 0xe2, 0x40, 0x7, 0x0, 0x2b, 0x16}, {0x30000, 0x3000, 0x3, 0x4, 0x40, 0x5, 0x7d, 0x6, 0xff, 0x3, 0x3, 0xfd}, {0xeeef0000, 0xeeef0000, 0xe, 0x5, 0x3, 0x7, 0x0, 0x9, 0x1, 0xa8, 0x4, 0x4}, {0x25000, 0xeeee0000, 0x9, 0x6, 0x4, 0x42, 0xb, 0xff, 0x8, 0x3, 0xe}, {0x10000, 0xffffffff, 0x2, 0x3, 0x3, 0x6, 0xed, 0x80, 0x7, 0x2, 0xdb}, {0x60000, 0x100000, 0x10, 0x7, 0xb1, 0x4, 0x21, 0x81, 0x9, 0x2, 0x1}, {0xdddd0000, 0x8000000, 0x4, 0x5, 0x2, 0x5, 0x7, 0x3, 0x5, 0x7f, 0x1, 0x70}, {0x70000, 0x1000, 0x10, 0x5, 0xf, 0x27, 0xc, 0x34, 0x2, 0xc, 0xb0, 0x9}, {0x10000, 0x1000}, {0x5000, 0x7ff}, 0x80000031, 0x0, 0x8000000, 0x2024, 0x3, 0x500, 0x3000, [0xf90000000000, 0x100000000, 0x80, 0xfff]}) close_range(r4, 0xffffffffffffffff, 0x0) 402.610338ms ago: executing program 3 (id=93): timer_create(0x3, 0x0, &(0x7f0000000340)) timer_create(0x3, 0x0, &(0x7f0000000000)=0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='1', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='1', 0x1) timer_delete(r0) 332.604286ms ago: executing program 3 (id=94): syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x80, 0x5, 0x7fff0003}]}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101901, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) flistxattr(r2, &(0x7f0000000300)=""/36, 0x24) r3 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00') r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x28100, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000400)={@multicast1, @local}, 0xc) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000440)={@rand_addr, @initdev}, &(0x7f0000000480)=0xc) syz_open_procfs(0xffffffffffffffff, &(0x7f00000004c0)='fdinfo/3\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r6, 0xae9a) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000540)={[0x0, 0x100000000, 0x0, 0x7f, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x8, 0x2, 0xffffffffffffffff], 0x0, 0x200}) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000600)={[0x101, 0xaec4, 0x3, 0x4000, 0x2, 0x808, 0xfffffffffffffffa, 0x40000000000000, 0x0, 0x3, 0x20000, 0x1c, 0x0, 0x802, 0x1, 0x3e], 0x200000, 0x41981}) r7 = inotify_init() inotify_add_watch(r3, &(0x7f0000000340)='./file0/file0\x00', 0x0) symlinkat(&(0x7f0000000700)='.\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./file1\x00') inotify_add_watch(r7, &(0x7f0000000780)='./file1\x00', 0x1000420) ioctl$KVM_RUN(r6, 0xae80, 0x0) pread64(r3, 0x0, 0x0, 0x76) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(r3, 0x4068aea3, &(0x7f0000000280)={0xa8, 0x0, 0x1}) unshare(0x40020000) r8 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r8, 0x4068aea3, &(0x7f0000000180)={0x79, 0x0, 0x602}) ioctl$KVM_SET_GSI_ROUTING(r8, 0x4008ae6a, &(0x7f0000000200)={0x1, 0x0, [{0x2, 0x2, 0x15bd07bf87c14d67, 0x0, @sint={0xffffffff, 0x4}}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, 0x0) openat2$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x294101, 0x11, 0x18}, 0x18) 223.005487ms ago: executing program 1 (id=95): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1, 0x0) r1 = fsopen(&(0x7f0000000000)='configfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x5) fchdir(r2) r3 = open(&(0x7f0000000040)='.\x00', 0x0, 0x100) lseek(r3, 0x1, 0x1) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) getdents64(r2, &(0x7f0000000d80)=""/247, 0xf7) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f0000fda000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, &(0x7f0000000280)="b9800000c00f3235010000000f3065f30fc735570000003ef23ef33e2e3e0f35f30f097700440f20c0350a000000440f22c026430f22440f3acc4efbd126d1a3fdffffff0f07", 0x46}], 0x1, 0x1c, 0x0, 0x0) ioctl$KVM_NMI(r5, 0xae9a) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioprio_get$pid(0x0, 0x0) ioctl$KVM_X86_SET_MSR_FILTER(r4, 0x4188aec6, &(0x7f0000000b00)={0xa1f992f8892f4f87, [{0x0, 0x250, 0x5, &(0x7f0000000080)="cae1e15e9e3988e0dbabf7b367e309ddfeaa184485f6a6c4a5abd600c1208b08412b6b616b93753dc07c1dedbd135851f2633bf89d2e226035aa5235e71263b83543215962abb32fe524"}, {0x0, 0x10, 0xe, &(0x7f0000000100)="25bc"}, {0x1, 0x0, 0xea6, &(0x7f0000000180)}, {0x3, 0x770, 0x1, &(0x7f0000000300)="a7d435e47911ed1166d7a846b8ff69a776a497a79f359201a1a8c90a6314e946fc0d87125b536b33a617203259af7234233e80984aae1c4b61793c165292e22cb48adb25e923dacf47f919e1cfd422e5a7618e56cba6364aeca18fc3f82c84d05724d4e0922f27a956f5bda60c34c2db89bae679382f350577728ed2ef443ca7545613271e06ebc487fa2180d2c0a38ac91f4f18a4eff1ffb7b51e3696f92087b5f524a4463c3ff5e85785942efcd57c32737a265ed71f298d5804e19f30790f3e98a96ec75c724c6b15bad4d48cb3aefa87cac9b5417c841cab7f06d415766a5056f64e2e0a0813e2be39be1769"}, {0x2, 0x630, 0x0, &(0x7f0000000400)="6dc489865317a9e062a493a1052b6c2845870a4695139d18e05a9426f714b69961c25018cf00eb17dc744b11005beb4e725e3ace2e7542b3e38f2b248408d13de3e0037533998264f2cabe73c18424e8824224c87261d1c5a032d0f02ebc4d9f0181352d70fe598a319546117abbfde36b53d0c37ad03f4e10e33096e65be560f358c77e8a7818a03b135595ca34ce8f508141c69c92418402da6e0947e6b3c4dc777d3127470fd0e332857005cbd20ec4b4b77468d944ec6b5143e78e99b52f9910e41ca69e"}, {0x3, 0x660, 0x9, &(0x7f0000000500)="50bf5c062230f2ac4127601eb896bcb862e1a448c88f00abf7d270bb99529c390d4bfb60cdbb0dc8ad7f2841bc963802430e58c3872a27aaa0a91ae79ca3754c851d1b74291dd0b89af234dd760e44d094b4f7ca8edd2073d3dcddb4d2198a7f8fe6049e7410e43000e98bd58532442959cfeaa1784f4dca198934126f4697b63fb220e2570664945701ebdca314960129672847b323850746803c17c0885851a9634f633dfe7c18baa2cafba2c8f9b1eae930a1f64371e4e1e3636d7a266e666d25b53e5040ff9594b09a63"}, {0x0, 0x578, 0x1, &(0x7f0000000600)="a45e9943d260ffc0d1cbb94bcf9a0447154e9214c44819e39be15c6833d0a82b7140b15bbed74e29423b48e8d4adba60fe9e209930201594d9f3a7eced0cccc297e56b25ed25bfef67def938805440a7ca9f80a52e9de4fb7f2c5cc8e1236e3e02c799a091d59dd78db0699f2dcd0593ff9fbd0aad4c16df8a3d83cc151489a7588e7e155a08d751f58a6fdeec2f12a7ceed71f0cce477935224cfc9260d5f7710d3d818f60d9fc656a819bbdd8f2c"}, {0x0, 0x330, 0x6, &(0x7f00000006c0)="814e6b8c023b3be0d588d46c0f3b60f8bd17fd95252deb7ca95df1251b2bf32606acd5cf4cec0e993e15e4fa9ee00016c9dd0a61321307fbe39ce28c5b8ac7e8d8b4b2580bdbbd08af315f4824e44ab4044d5c38be02c0c3f9f46378a0ef5041139156de101e"}, {0x2, 0x418, 0x3, &(0x7f0000000740)="af43a18b5df6b0b62790e613ddfaafb0c1189a25b24286ae33e54fafa4be104e8a2377fb27d53f5996db08466d0c593d28a14b884e1addce9d916605b45d960d20f4f0befe5ecdbcd08381defeedce2135e9866875a3e7859aadf80db1faf81c1eb14d96f354ee4cd068d185d11dcc2b74253255b527b0f81af48e173d6c0b6c6c9b59"}, {0x2, 0x138, 0x7, &(0x7f0000000800)="6e3f0705c41244d4433621841682ca22e574fde450403c4983939d2fda4e86ba674ad54173e645"}, {0x5, 0x310, 0x81, &(0x7f0000000840)="d04725ef743bb05c852157136f5ec53c9eed7ffff0253170edaaf39aeba7e984d133a5800c7c4c778c2cd7c3a81bf90da1a6f57ceb0d85a93d16c6c60e5d8325ee0315817b3e6e3d19c02b2fc5328a428c7d777eb6b00fd31c5ac01811b9959bd911"}, {0x2, 0x4c0, 0x1ff, &(0x7f0000000cc0)="e65e0fc65781debd425cd4cd72a55333e9eb9de6dfacd62e13fc44741b21e5fdeab431a4841d01e2988874067fbc0a1dcce2175c1350e7693ec03d6010c3dd1e2aae7f609d1a72691f11a9255e5c8f106d1103b970fb5614ddd863496cb5de0ea30c2174db7c94ad023e190a565ccd6e7692de456d369e3c351cd4ed2351d59bae1e9eade871f39d271a6e6feef1814b03abf897df3a2581"}, {0x0, 0x5c8, 0x3, &(0x7f0000000900)="8c941fadc41946d5a3cff04a8406953c18a6af42d20059e7e628eb74e57b5f79dc7190573963ca554c80b4ccfcf536ccdf95fef00e439934ed90dbda5cac2fccd9d7d39d53ea2329b35ecfb55e60e479ed541ba39d81570f4b350dbedb59a0fbcf05bba235c6b8617fcd42811d732b5717b9b80638694d243f297cde13ff99d1177a892689e01bbd84104c6aaab2e94bceee7709c85296907c7776ec3d5aa92b7f7e9a25345b057c9515521ced9607e5c007d3ddabd7df7b50"}, {0x2, 0x8f0, 0x6, &(0x7f0000000e80)="8321de1e218da520b2a85369e84a0ec6b8c8d9861a2c45c9f18a78e917d5f690cad3b775b2d097164e2491b2a8e6ddeca37c3539f6340be62dbb281a23adcf1bfa94750e7f547d58af66e11c7a077dbb2ad309397c16fcc78d446ffdf65ee79010a7720aa0e79bbbbbb80f71419f58e451f9fdbe0762ddc24ea29f671cd31d4b31d6c57604c2885ddd1dec7228acae50ff0f0000000000004dc8b36f3b8ed03613a632c63b0a5275d39181657f1a8b30418c68d320d6e0e21440b86d8e3fceb5b203727f3a48ee5523faef95dc95daaf187e67e430cb05ad5e0622c4af3b56f16a3e020e24dac9b8dcd8345456614627cd31c88c1260727c00000000ee8d87cfb7e0a57991968b36b7aa4ad271c70304e39bead5840de5462f0cf1136f87"}, {0x2, 0x358, 0x1e1, &(0x7f0000000a40)="daa754e28099d8ba7aeb9d5d59b29c41b9445f9de4372a01486a139a4c2955987a742efd83a4b22f48eccc37d740735292e4d6a5ff9837442424710b48d044a475b990db82617440489c07de41c3df1466ac87a66f0d9119f1f1519201bbde0c88b71593f9410e23cfa710"}, {0x1, 0x198, 0xed76, &(0x7f0000000ac0)="ed185a06f1fb97b75b941ccaecafa61d7934fd26120420d6525efdc84b01ae64ccb89134b52c038ae39f4d9ddc60e83e25b5c3"}]}) ioctl$BTRFS_IOC_BALANCE_CTL(r2, 0x40049421, 0x3) ioctl$BLKRESETZONE(r2, 0x40101283, &(0x7f0000000180)={0x0, 0x7}) 126.686427ms ago: executing program 3 (id=96): write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f0000000100)={0x30, 0x5, 0x0, {0x0, 0x2000a, 0xd, 0x2}}, 0x30) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x10) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(&(0x7f00000003c0)=@filename='./dev/sda1\x00', &(0x7f0000000400)='./mnt\x00', &(0x7f0000000440)='ext4\x00', 0x8410, 0x0) chdir(&(0x7f0000000480)='./mnt\x00') r2 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./mnt\x00', 0x0, 0x21) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r2, 0x800c6613, &(0x7f0000000500)=@v2={0x2, @aes256, 0x3, '\x00', @auto="5b6470438f31fdddeac2337f8fb6fab6"}) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000540)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x4ee59ce4, 0xfffffffffffffffd, 0xfffffffc}, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000580)={0x2e, 0x60, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000600)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000640)=0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup(r4) syz_ublk_setup_queues(r5, r3, &(0x7f0000000680)={0x0, 0x42cc, 0x10, 0x1, 0x7f}, &(0x7f0000000700)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe706, 0x1000, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x4, 0x3ae}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93e5, 0x2000, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x230, 0x0, r2}}], 0x1, 0x0, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000140)={0x1, 0x0, @ioapic={0xffe, 0xd69e, 0x800, 0x8, 0x0, [{0x0, 0x6, 0x6, '\x00', 0x8}, {0x0, 0x4, 0x3, '\x00', 0x2}, {0x86, 0x7, 0x2b, '\x00', 0x1}, {0xb1, 0x18, 0x8}, {0x3, 0x79, 0x7, '\x00', 0x8}, {0xe5, 0x0, 0x1, '\x00', 0x6}, {0xf7, 0x8, 0x6, '\x00', 0x6}, {0x0, 0x3, 0x9, '\x00', 0x6}, {0x0, 0x6, 0x8, '\x00', 0x2}, {0x91, 0xf4, 0x8, '\x00', 0x2a}, {0x2, 0x0, 0x2, '\x00', 0xd}, {0x80, 0x8, 0x60, '\x00', 0x4}, {0x40, 0x1, 0x1, '\x00', 0x7}, {0xb4, 0x5, 0x8, '\x00', 0x1}, {0x4, 0x0, 0x7, '\x00', 0x5}, {0xe, 0x7, 0xff, '\x00', 0x6}, {0x6e, 0x8, 0x9}, {0x4, 0xe4, 0x0, '\x00', 0x2}, {0xd8, 0x5, 0x53, '\x00', 0x81}, {0x4, 0x7, 0x9, '\x00', 0x68}, {0x9, 0x28, 0x7, '\x00', 0x6}, {0x7, 0x97, 0x0, '\x00', 0x6}, {0x2, 0x7, 0x3, '\x00', 0x80}, {0x0, 0x79, 0xa, '\x00', 0x6}]}}) mkdirat(0xffffffffffffff9c, 0x0, 0x1bf) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$FIBMAP(r6, 0x5393, &(0x7f0000000100)=0x3) 93.79287ms ago: executing program 2 (id=97): getdents(0xffffffffffffffff, 0x0, 0x0) close(0x3) r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, 0x0, 0x0) r1 = syz_ublk_setup_io_uring(0x20, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000140)) ioctl$INCFS_IOC_GET_FILLED_BLOCKS(r1, 0x80286722, &(0x7f0000000400)={&(0x7f0000000340)=""/134, 0x86, 0x7f, 0x4}) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x200000e, 0x401d031, 0xffffffffffffffff, 0x0) r2 = syz_create_resource$futex(&(0x7f00000002c0)=0x1) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x28100, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000480)=0x2) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = openat$kvm(0xffffff9c, &(0x7f0000000540), 0x800, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000001000/0x1000)=nil}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000001640)={[0xfffffffffffffff9, 0xe34, 0x1, 0xfffffffffffffffc, 0xa, 0x1, 0x1000, 0x401000000000008, 0x7d, 0x0, 0x100000000000, 0xc, 0x3, 0x1, 0x1fffffffffffe, 0xfffffffffffffffb], 0x50000, 0x1c61c6}) ioctl$KVM_RUN(r7, 0xae80, 0x0) setsockopt$SO_TIMESTAMP(r4, 0x1, 0x23, &(0x7f0000000500)=0x7, 0x4) ioctl$TIOCSETD(r3, 0x5423, &(0x7f00000004c0)=0x11) ioctl$TIOCVHANGUP(r3, 0x5437, 0x0) futex(r2, 0xc, 0x1, 0x0, 0x0, 0x1) 93.0458ms ago: executing program 3 (id=98): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x4800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) (async) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000000)={'ip6tnl0\x00', &(0x7f0000000180)={'ip6tnl0\x00', 0x0, 0x2d, 0x0, 0x8f, 0xd, 0x5f, @empty, @remote, 0x1, 0x7800, 0x10, 0x81}}) (async) r4 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_set_state_pages={0x140, 0x28, {0x0, 0xa, @gpa=0xffff1000}}, @nested_vmlaunch={0x12f, 0x18}], 0x70}) (async) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='ramfs\x00', 0x2800000, 0x0) chdir(&(0x7f0000000280)='./file0\x00') (async) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x0) (async) mkdir(&(0x7f0000000300)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000380)='./config\x00', &(0x7f00000003c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./dev\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000700)='./dev\x00', &(0x7f0000000740)='devtmpfs\x00', 0x0, 0x0) (async) mount(&(0x7f0000000780)=@filename='./dev/sda1\x00', &(0x7f00000007c0)='./dev\x00', &(0x7f0000000800)='ext4\x00', 0x10001, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) (async) r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/functions/midi.usb0/out_ports\x00', 0x1, 0x0) write(r5, &(0x7f00000004c0)='d', 0x1) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) (async) mkdir(&(0x7f0000000500)='./bus\x00', 0x13e) (async) mount$incfs(&(0x7f0000000540)='.\x00', &(0x7f0000000580)='./bus\x00', &(0x7f00000005c0), 0xc002, 0x0) chdir(&(0x7f0000000600)='./bus\x00') (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000640)='./cgroup.cpu/syz1\x00', 0x1ff) (async) write$P9_RSETATTR(r5, &(0x7f0000000680)={0x7, 0x1b, 0x2}, 0x7) ioctl$KVM_RUN(r4, 0xae80, 0x0) 89.442001ms ago: executing program 2 (id=99): r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x3b) write(r0, &(0x7f00000000c0)="734942c9aa84d1f3731c50deca365206e2e66ecfd091874c3dfcd5ceb7d52cb397542e805b07fd4e425750ccc83e723c8243ebf442f066d5670c84b5b29ff17c77e075054b2c67c875c573c7ddccf1a0654a7127e1eafb16c91a661429d6e2bf2734ac04df716a1e9de925cdeb38c1c207fdec0b31412c630c2c47", 0x7b) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = syz_kvm_setup_syzos_vm$x86(r3, &(0x7f0000beb000/0x400000)=nil) r5 = syz_kvm_add_vcpu$x86(r4, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18, 0x2}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x2, @host16=0xc00, 0xb08, 0x2ffffe, 0x80000005}}, @nested_vmlaunch={0x12f, 0x18, 0x2}], 0x80}) ioctl$KVM_RUN(r5, 0xae80, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x100) openat$selinux_relabel(0xffffffffffffff9c, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x1c0) truncate(&(0x7f0000000380)='./file0\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./sys\x00', 0x1ff) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x54000, 0x0) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f00000008c0)='sysfs\x00', 0x404, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x6, &(0x7f0000000080), 0x4) write(r6, &(0x7f0000000480)="7e98931eeacfa026b4826510823c64f781a124f84657a7959db1e83900261ca62c58c39dcf00b3d39b665f3d502ae28a7bb7f00026b33621592fd8af6cf6b98fd2c0639849", 0x45) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r6, 0x6, 0x1d, &(0x7f0000000240), &(0x7f00000002c0)=0x14) 26.203907ms ago: executing program 1 (id=100): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000680)=ANY=[@ANYBLOB="1201000000000010bd28710000000000000109022400010000000009040100010300000009210200000122050009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000006c0)={0x24, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) syz_usb_control_io(r0, &(0x7f0000000900)={0x2c, 0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}, 0x0) 0s ago: executing program 3 (id=101): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000026c0)=ANY=[@ANYBLOB="04010000100007000000000000000000ac1e0101000000000000000000000000fe80000000000000000000000000001a4e200002000010000000000002000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff010000000000000000000000000001000004d33c000000ff01000000000000000000000000000100000000000000000000000000000000820000000003000000000000000000000000001000000000ffffffffffffffff00000000000000000000000000000000000000000000000000002000000000000700000000000000000000000000000000000400fdffffffe80a0000000000000000000002000000340000000000000014000e"], 0x104}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.30' (ED25519) to the list of known hosts. [ 29.785113][ T36] audit: type=1400 audit(1793410464.290:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 29.788159][ T286] cgroup: Unknown subsys name 'net' [ 29.807786][ T36] audit: type=1400 audit(1793410464.290:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.835110][ T36] audit: type=1400 audit(1793410464.320:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.835443][ T286] cgroup: Unknown subsys name 'devices' [ 29.960893][ T286] cgroup: Unknown subsys name 'hugetlb' [ 29.966505][ T286] cgroup: Unknown subsys name 'rlimit' [ 30.060700][ T36] audit: type=1400 audit(1793410464.570:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 30.083869][ T36] audit: type=1400 audit(1793410464.570:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 30.108664][ T36] audit: type=1400 audit(1793410464.570:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 30.130438][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 30.140604][ T36] audit: type=1400 audit(1793410464.650:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.166072][ T36] audit: type=1400 audit(1793410464.650:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.211149][ T36] audit: type=1400 audit(1793410464.720:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.236783][ T36] audit: type=1400 audit(1793410464.720:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.237359][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 30.971379][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.978902][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.992566][ T293] bridge_slave_0: entered allmulticast mode [ 30.999116][ T293] bridge_slave_0: entered promiscuous mode [ 31.005601][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.012667][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.019734][ T293] bridge_slave_1: entered allmulticast mode [ 31.026464][ T293] bridge_slave_1: entered promiscuous mode [ 31.130267][ T298] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.137336][ T298] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.144468][ T298] bridge_slave_0: entered allmulticast mode [ 31.150789][ T298] bridge_slave_0: entered promiscuous mode [ 31.157723][ T298] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.164818][ T298] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.172025][ T298] bridge_slave_1: entered allmulticast mode [ 31.178166][ T298] bridge_slave_1: entered promiscuous mode [ 31.238868][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.245965][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.253078][ T297] bridge_slave_0: entered allmulticast mode [ 31.259342][ T297] bridge_slave_0: entered promiscuous mode [ 31.265576][ T299] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.272658][ T299] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.279767][ T299] bridge_slave_0: entered allmulticast mode [ 31.285933][ T299] bridge_slave_0: entered promiscuous mode [ 31.294972][ T299] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.302077][ T299] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.309140][ T299] bridge_slave_1: entered allmulticast mode [ 31.315550][ T299] bridge_slave_1: entered promiscuous mode [ 31.321593][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.328636][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.335729][ T297] bridge_slave_1: entered allmulticast mode [ 31.341948][ T297] bridge_slave_1: entered promiscuous mode [ 31.407791][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.414866][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.422186][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.431402][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.484139][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.491215][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.498491][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.505556][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.529592][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.536913][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.544797][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.552154][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.568718][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.575813][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.585787][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.592890][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.626521][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.633576][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.650956][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.658020][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.665688][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.672738][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.701193][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.708323][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.741536][ T293] veth0_vlan: entered promiscuous mode [ 31.752286][ T297] veth0_vlan: entered promiscuous mode [ 31.773776][ T293] veth1_macvtap: entered promiscuous mode [ 31.782481][ T309] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.789556][ T309] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.799413][ T309] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.806466][ T309] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.821504][ T297] veth1_macvtap: entered promiscuous mode [ 31.829524][ T298] veth0_vlan: entered promiscuous mode [ 31.877662][ T298] veth1_macvtap: entered promiscuous mode [ 31.888353][ T293] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 31.924076][ T299] veth0_vlan: entered promiscuous mode [ 31.931931][ T313] capability: warning: `syz.2.3' uses deprecated v2 capabilities in a way that may be insecure [ 31.949854][ T313] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 31.963484][ T299] veth1_macvtap: entered promiscuous mode [ 31.986442][ T315] capability: warning: `syz.1.2' uses 32-bit capabilities (legacy support in use) [ 32.014906][ T317] loop4: detected capacity change from 0 to 7 [ 32.022486][ T320] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 32.030503][ T317] Buffer I/O error on dev loop4, logical block 0, async page read [ 32.050110][ T317] Buffer I/O error on dev loop4, logical block 0, async page read [ 32.057974][ T317] loop4: unable to read partition table [ 32.072716][ T323] Buffer I/O error on dev loop4, logical block 0, async page read [ 32.080795][ T317] loop_reread_partitions: partition scan of loop4 (Sj %`ր5) failed (rc=-5) [ 32.093254][ T323] Buffer I/O error on dev loop4, logical block 0, async page read [ 32.109664][ T323] Buffer I/O error on dev loop4, logical block 0, async page read [ 32.119453][ T323] Buffer I/O error on dev loop4, logical block 0, async page read [ 32.135306][ T323] Buffer I/O error on dev loop4, logical block 0, async page read [ 32.158447][ T323] Buffer I/O error on dev loop4, logical block 0, async page read [ 32.163331][ T332] kvm: kvm [318]: vcpu0, guest rIP: 0x9135 Unhandled WRMSR(0x11e) = 0x0 [ 32.178734][ T336] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8'. [ 32.187774][ T323] Buffer I/O error on dev loop4, logical block 0, async page read [ 32.196623][ T323] Buffer I/O error on dev loop4, logical block 0, async page read [ 32.205322][ T325] process 'syz.1.6' launched './file0' with NULL argv: empty string added [ 32.238197][ T338] overlayfs: lowerdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 32.262927][ T338] overlay: filesystem on ./bus not supported as upperdir [ 32.569133][ T31] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 32.588374][ T354] ======================================================= [ 32.588374][ T354] WARNING: The mand mount option has been deprecated and [ 32.588374][ T354] and is ignored by this kernel. Remove the mand [ 32.588374][ T354] option from the mount to silence this warning. [ 32.588374][ T354] ======================================================= [ 32.665008][ T356] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1775007430 (3550014860 ns) > initial count (824786394 ns). Using initial count to start timer. [ 32.685690][ T356] netlink: 12 bytes leftover after parsing attributes in process `syz.3.15'. [ 32.702446][ T358] loop7: detected capacity change from 0 to 7 [ 32.708907][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 32.718218][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 32.727485][ T358] loop7: unable to read partition table [ 32.733195][ T31] usb 1-1: Using ep0 maxpacket: 8 [ 32.733382][ T358] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 32.740039][ T31] usb 1-1: unable to get BOS descriptor or descriptor too short [ 32.757010][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 32.761572][ T31] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x88 has invalid maxpacket 2 [ 32.778596][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 32.789034][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 32.798446][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 32.807860][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 32.817189][ T31] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 32.826931][ T31] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xC has invalid maxpacket 65535, setting to 1024 [ 32.840737][ T31] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0xC has invalid maxpacket 1024 [ 32.850694][ T31] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 32.860693][ T31] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 32.872342][ T31] usb 1-1: New USB device found, idVendor=0763, idProduct=1002, bcdDevice=5f.84 [ 32.881683][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.892397][ T31] usb 1-1: Product: syz [ 32.896587][ T31] usb 1-1: Manufacturer: syz [ 32.901676][ T31] usb 1-1: SerialNumber: syz [ 32.913024][ T31] usb 1-1: config 0 descriptor?? [ 32.918296][ T347] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 32.926367][ T347] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 32.992173][ T323] udevd[323]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 33.152461][ T385] EXT4-fs warning (device sda1): verify_group_input:137: Cannot add at group 3 (only 8 groups) [ 33.171416][ T45] usb 1-1: USB disconnect, device number 2 [ 33.268993][ T31] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 33.422180][ T31] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 37, changing to 7 [ 33.433436][ T31] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 115, changing to 7 [ 33.446478][ T31] usb 2-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 33.455790][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.464117][ T31] usb 2-1: Product: syz [ 33.468500][ T31] usb 2-1: Manufacturer: syz [ 33.477056][ T31] usb 2-1: SerialNumber: syz [ 33.536480][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 33.545893][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 33.557673][ T110] loop7: unable to read partition table [ 33.658978][ T10] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 33.839000][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 33.845678][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 33.854311][ T10] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 129, changing to 7 [ 33.867230][ T10] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 33.876503][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.885272][ T10] usb 4-1: Product: syz [ 33.889614][ T10] usb 4-1: Manufacturer: syz [ 33.894235][ T10] usb 4-1: SerialNumber: syz [ 33.938963][ T9] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 34.040815][ T45] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 34.090028][ T9] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 34.098089][ T9] usb 3-1: config 0 has no interface number 0 [ 34.104450][ T9] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 34.115750][ T9] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 34.125598][ T9] usb 3-1: config 0 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 34.138621][ T9] usb 3-1: New USB device found, idVendor=28bd, idProduct=0042, bcdDevice= 0.00 [ 34.147805][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.156976][ T9] usb 3-1: config 0 descriptor?? [ 34.199000][ T45] usb 1-1: Using ep0 maxpacket: 32 [ 34.206121][ T45] usb 1-1: config 0 has an invalid descriptor of length 102, skipping remainder of the config [ 34.218123][ T45] usb 1-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 34.227408][ T45] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.235468][ T45] usb 1-1: Product: syz [ 34.239829][ T45] usb 1-1: Manufacturer: syz [ 34.244518][ T45] usb 1-1: SerialNumber: syz [ 34.253737][ T45] usb 1-1: config 0 descriptor?? [ 34.261685][ T45] usb 1-1: bad CDC descriptors [ 34.272539][ T45] usb 1-1: unsupported MDLM descriptors [ 34.345811][ T10] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 34.353466][ T10] usb 4-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 34.366553][ T10] usb 4-1: USB disconnect, device number 2 [ 34.394062][ T411] udevd[411]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 34.477659][ T403] usb 1-1: USB disconnect, device number 3 [ 34.567277][ T9] usbhid 3-1:0.1: can't add hid device: -71 [ 34.573426][ T9] usbhid 3-1:0.1: probe with driver usbhid failed with error -71 [ 34.582261][ T9] usb 3-1: USB disconnect, device number 2 [ 35.096865][ T36] kauditd_printk_skb: 587 callbacks suppressed [ 35.096890][ T36] audit: type=1400 audit(1793410469.600:661): avc: denied { ioctl } for pid=418 comm="syz.0.33" path="socket:[3761]" dev="sockfs" ino=3761 ioctlcmd=0x9426 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 35.127396][ T36] audit: type=1400 audit(1793410469.600:662): avc: denied { read write } for pid=418 comm="syz.0.33" name="vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 35.141277][ T423] netlink: 176 bytes leftover after parsing attributes in process `syz.2.32'. [ 35.152358][ T45] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 35.166983][ T36] audit: type=1400 audit(1793410469.600:663): avc: denied { open } for pid=418 comm="syz.0.33" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 35.198721][ T36] audit: type=1400 audit(1793410469.600:664): avc: denied { ioctl } for pid=418 comm="syz.0.33" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 ioctlcmd=0x586e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 35.224044][ T36] audit: type=1400 audit(1793410469.670:665): avc: denied { setopt } for pid=416 comm="syz.2.32" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 35.319926][ T45] usb 4-1: config 1 has an invalid descriptor of length 249, skipping remainder of the config [ 35.330382][ T45] usb 4-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 35.340840][ T45] usb 4-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 35.349927][ T45] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.357967][ T45] usb 4-1: Product: syz [ 35.362194][ T45] usb 4-1: Manufacturer: syz [ 35.366831][ T45] usb 4-1: SerialNumber: syz [ 35.775738][ T403] usb 4-1: USB disconnect, device number 3 [ 36.004731][ T31] usb 2-1: USB disconnect, device number 2 [ 36.019106][ T9] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 36.039470][ T467] udevd[467]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 36.060982][ T36] audit: type=1400 audit(1793410470.570:666): avc: denied { mount } for pid=469 comm="syz.1.40" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 36.089026][ T36] audit: type=1400 audit(1793410470.590:667): avc: denied { mounton } for pid=469 comm="syz.1.40" path="/6/sys" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 36.134760][ T36] audit: type=1400 audit(1793410470.640:668): avc: denied { setopt } for pid=474 comm="syz.2.42" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 36.200324][ T9] usb 1-1: config 0 has more interface descriptors, than it declares in bNumInterfaces, ignoring interface number: 0 [ 36.220654][ T9] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 36.236552][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 4 [ 36.285098][ T9] usb 1-1: New USB device found, idVendor=1908, idProduct=1315, bcdDevice= 0.00 [ 36.294208][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.302238][ T9] usb 1-1: Product: syz [ 36.306443][ T9] usb 1-1: Manufacturer: syz [ 36.311575][ T9] usb 1-1: SerialNumber: syz [ 36.320625][ T9] usb 1-1: config 0 descriptor?? [ 36.326500][ T9] usb-storage 1-1:0.0: USB Mass Storage device detected [ 36.338005][ T9] usb-storage 1-1:0.0: Quirks match for vid 1908 pid 1315: 20000 [ 36.528197][ T403] usb 1-1: USB disconnect, device number 4 [ 36.588979][ T413] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 36.678981][ T9] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 36.688427][ T36] audit: type=1400 audit(1793410471.190:669): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 36.719714][ T36] audit: type=1400 audit(1793410471.230:670): avc: denied { create } for pid=492 comm="syz.1.46" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 36.749131][ T413] usb 4-1: Using ep0 maxpacket: 32 [ 36.756088][ T413] usb 4-1: unable to get BOS descriptor or descriptor too short [ 36.768141][ T413] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 36.779436][ T413] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 36.789768][ T413] usb 4-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 36.802560][ T413] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.811551][ T413] usb 4-1: Product: syz [ 36.815762][ T413] usb 4-1: Manufacturer: syz [ 36.820580][ T413] usb 4-1: SerialNumber: syz [ 36.827714][ T413] usb 4-1: selecting invalid altsetting 1 [ 36.834907][ T9] usb 3-1: config index 0 descriptor too short (expected 65382, got 72) [ 36.845405][ T9] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 36.854520][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.863176][ T9] usb 3-1: Product: syz [ 36.867383][ T9] usb 3-1: Manufacturer: syz [ 36.872024][ T9] usb 3-1: SerialNumber: syz [ 37.227138][ T413] usb 4-1: 6:0: failed to get current value for ch 0 (-71) [ 37.236293][ T413] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 37.245930][ T403] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 37.254203][ T413] usb 4-1: USB disconnect, device number 4 [ 37.272561][ T326] udevd[326]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 37.408978][ T403] usb 2-1: Using ep0 maxpacket: 16 [ 37.415427][ T403] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 37.425649][ T403] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 37.436195][ T403] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 37.445357][ T403] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.453389][ T403] usb 2-1: Product: syz [ 37.457551][ T403] usb 2-1: Manufacturer: syz [ 37.462183][ T403] usb 2-1: SerialNumber: syz [ 37.595028][ T520] kvm_intel: kvm [519]: vcpu0, guest rIP: 0x0 Unhandled WRMSR(0x1d9) = 0x6b [ 37.604471][ T520] kvm_intel: kvm [519]: vcpu0, guest rIP: 0x0 Unhandled WRMSR(0x1d9) = 0x6b [ 37.613637][ T520] kvm_intel: kvm [519]: vcpu0, guest rIP: 0x0 Unhandled WRMSR(0x1d9) = 0x6b [ 37.622951][ T520] kvm_intel: kvm [519]: vcpu0, guest rIP: 0x0 Unhandled WRMSR(0x1d9) = 0x6b [ 37.632166][ T520] kvm_intel: kvm [519]: vcpu0, guest rIP: 0x0 Unhandled WRMSR(0x1d9) = 0x6b [ 37.641182][ T520] kvm_intel: kvm [519]: vcpu0, guest rIP: 0x0 Unhandled WRMSR(0x1d9) = 0x6b [ 37.650513][ T520] kvm_intel: kvm [519]: vcpu0, guest rIP: 0x0 Unhandled WRMSR(0x1d9) = 0x6b [ 37.659513][ T520] kvm_intel: kvm [519]: vcpu0, guest rIP: 0x0 Unhandled WRMSR(0x1d9) = 0x6b [ 37.668753][ T520] kvm_intel: kvm [519]: vcpu0, guest rIP: 0x0 Unhandled WRMSR(0x1d9) = 0x6b [ 37.677986][ T403] usb 2-1: 0:2 : does not exist [ 37.683062][ T520] kvm_intel: kvm [519]: vcpu0, guest rIP: 0x0 Unhandled WRMSR(0x1d9) = 0x6b [ 37.686118][ T403] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 37.706047][ T403] usb 2-1: USB disconnect, device number 3 [ 37.721107][ T326] udevd[326]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 37.833829][ T529] device-mapper: table: 252:0: verity: Hash device lookup failed (-ENOENT) [ 37.842643][ T529] device-mapper: ioctl: error adding target to table [ 38.108987][ T10] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 38.270035][ T10] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 38.298966][ T10] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 38.318995][ T10] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 38.338966][ T10] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 38.360085][ T10] usb 4-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 38.369165][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.377161][ T10] usb 4-1: Product: syz [ 38.398949][ T10] usb 4-1: Manufacturer: syz [ 38.403584][ T10] usb 4-1: SerialNumber: syz [ 38.409381][ T534] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 38.424674][ T534] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 38.432980][ T10] pl2303 4-1:1.0: pl2303 converter detected [ 38.439568][ T10] pl2303 4-1:1.0: unknown device type, please report to linux-usb@vger.kernel.org [ 38.632836][ T10] usb 4-1: USB disconnect, device number 5 [ 38.648997][ T387] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 38.799696][ T387] usb 2-1: not running at top speed; connect to a high speed hub [ 38.808323][ T387] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 38.819933][ T387] usb 2-1: New USB device found, idVendor=225a, idProduct=e1d4, bcdDevice=a7.ad [ 38.829041][ T387] usb 2-1: New USB device strings: Mfr=245, Product=210, SerialNumber=0 [ 38.837536][ T387] usb 2-1: Product: syz [ 38.841968][ T387] usb 2-1: Manufacturer: syz [ 38.850606][ T387] usb 2-1: Found UVC 1.00 device syz (225a:e1d4) [ 38.879327][ T572] netlink: 8 bytes leftover after parsing attributes in process `syz.0.73'. [ 39.049962][ T387] usb 2-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 39.059658][ T387] uvcvideo 2-1:1.1: Failed to query (129) UVC probe control : -71 (exp. 26). [ 39.068471][ T387] uvcvideo 2-1:1.1: Failed to initialize the device (-71). [ 39.077060][ T387] usb 2-1: USB disconnect, device number 4 [ 39.119018][ T31] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 39.268998][ T31] usb 1-1: Using ep0 maxpacket: 16 [ 39.275398][ T31] usb 1-1: config 0 has an invalid interface number: 104 but max is 1 [ 39.283637][ T31] usb 1-1: config 0 has an invalid interface number: 104 but max is 1 [ 39.291889][ T31] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 39.302007][ T31] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 39.310918][ T31] usb 1-1: config 0 has no interface number 0 [ 39.316999][ T31] usb 1-1: config 0 interface 104 has no altsetting 1 [ 39.325388][ T31] usb 1-1: New USB device found, idVendor=1189, idProduct=0893, bcdDevice= 0.00 [ 39.334460][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.342486][ T31] usb 1-1: Product: syz [ 39.346666][ T31] usb 1-1: Manufacturer: syz [ 39.351292][ T31] usb 1-1: SerialNumber: syz [ 39.356443][ T31] usb 1-1: config 0 descriptor?? [ 39.362534][ T31] asix 1-1:0.104: probe with driver asix failed with error -22 [ 39.438991][ T403] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 39.448423][ T10] usb 3-1: USB disconnect, device number 3 [ 39.567333][ T572] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 39.579605][ T572] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 39.588151][ T9] usb 1-1: USB disconnect, device number 5 [ 39.598962][ T403] usb 4-1: Using ep0 maxpacket: 8 [ 39.614686][ T403] usb 4-1: unable to get BOS descriptor or descriptor too short [ 39.625132][ T403] usb 4-1: config 4 has an invalid interface number: 147 but max is 0 [ 39.633541][ T403] usb 4-1: config 4 contains an unexpected descriptor of type 0x2, skipping [ 39.649023][ T403] usb 4-1: config 4 has no interface number 0 [ 39.665610][ T403] usb 4-1: New USB device found, idVendor=04f2, idProduct=b746, bcdDevice=8e.6e [ 39.679207][ T403] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.693820][ T403] usb 4-1: Product: 봷袥翃珅댃敘춇딾ʟ訃兘쾺퉜㬱ᓝᓔ坋鍿붂⏫䤲⭃轚맬ᗦ惈䜁੎찮噵첪䒠댉達 [ 39.706939][ T403] usb 4-1: Manufacturer: ⓢᢝ扁樝攅闷ㆨ끡纼䖿酼븎ꀫ绳♁㡆啥㶍⣺瑜鞲쥣먱馰ꌌ䡘섂쀴큎唯⃊蝎궣㇥̾⻧푞๓앤 [ 39.723128][ T403] usb 4-1: SerialNumber: syz [ 40.008986][ T9] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 40.021902][ T403] usb 4-1: Found UVC 0.02 device 봷袥翃珅댃敘춇딾ʟ訃兘쾺퉜㬱ᓝᓔ坋鍿붂⏫䤲⭃轚맬ᗦ惈䜁੎찮噵첪䒠댉達 (04f2:b746) [ 40.037286][ T403] usb 4-1: No valid video chain found. [ 40.044548][ T403] usb 4-1: USB disconnect, device number 6 [ 40.150796][ T36] kauditd_printk_skb: 33 callbacks suppressed [ 40.150812][ T36] audit: type=1400 audit(1793410474.660:704): avc: denied { append } for pid=600 comm="syz.0.85" name="001" dev="devtmpfs" ino=95 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 40.181273][ T9] usb 3-1: config 0 has no interfaces? [ 40.186764][ T9] usb 3-1: New USB device found, idVendor=0b05, idProduct=17e0, bcdDevice= 0.00 [ 40.195968][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 40.207303][ T9] usb 3-1: config 0 descriptor?? [ 40.414140][ T594] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 40.422721][ T594] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 40.480453][ T387] usb 3-1: USB disconnect, device number 4 [ 40.662125][ T36] audit: type=1400 audit(1793410475.170:705): avc: denied { load_policy } for pid=616 comm="syz.1.91" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 40.662164][ T617] SELinux: policydb table sizes (0,0) do not match mine (8,7) [ 40.689846][ T617] SELinux: failed to load policy [ 40.751551][ T622] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000 conventional PCI endpoint [ 40.788040][ T36] audit: type=1400 audit(1793410475.290:706): avc: denied { watch } for pid=623 comm="syz.3.94" path="/23" dev="tmpfs" ino=146 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 40.929588][ T36] audit: type=1400 audit(1793410475.440:707): avc: denied { mount } for pid=627 comm="syz.1.95" name="/" dev="configfs" ino=2256 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 40.952696][ T36] audit: type=1400 audit(1793410475.460:708): avc: denied { search } for pid=627 comm="syz.1.95" name="/" dev="configfs" ino=2256 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 40.976387][ T36] audit: type=1400 audit(1793410475.460:709): avc: denied { read } for pid=627 comm="syz.1.95" name="/" dev="configfs" ino=2256 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 40.998346][ T36] audit: type=1400 audit(1793410475.460:710): avc: denied { open } for pid=627 comm="syz.1.95" path="/" dev="configfs" ino=2256 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 41.070991][ T36] audit: type=1400 audit(1793410475.580:711): avc: denied { mount } for pid=634 comm="syz.3.98" name="/" dev="ramfs" ino=5724 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 41.079449][ T641] sda1: Can't mount, would change RO state [ 41.097671][ T36] audit: type=1400 audit(1793410475.580:712): avc: denied { mounton } for pid=634 comm="syz.3.98" path="/25/file0/config" dev="ramfs" ino=5727 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=dir permissive=1 [ 41.121617][ T36] audit: type=1400 audit(1793410475.580:713): avc: denied { mount } for pid=634 comm="syz.3.98" name="/" dev="configfs" ino=2256 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 41.148266][ T298] ------------[ cut here ]------------ [ 41.153822][ T298] WARNING: CPU: 1 PID: 298 at fs/inode.c:340 drop_nlink+0xce/0x110 [ 41.161774][ T298] Modules linked in: [ 41.165711][ T298] CPU: 1 UID: 0 PID: 298 Comm: syz-executor Not tainted syzkaller #0 04b5f10b80d13b0533bf6aaa302b886c75cf6d37 [ 41.177378][ T298] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 41.187476][ T298] RIP: 0010:drop_nlink+0xce/0x110 [ 41.192557][ T298] Code: 04 00 00 be 08 00 00 00 e8 8f 08 ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 a2 72 94 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c [ 41.212217][ T298] RSP: 0018:ffffc9000165fc68 EFLAGS: 00010293 [ 41.218301][ T298] RAX: ffffffff81f4e32e RBX: ffff8881113c89c0 RCX: ffff88812224a780 [ 41.226319][ T298] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 41.234387][ T298] RBP: ffffc9000165fc90 R08: 0000000000000003 R09: 0000000000000004 [ 41.242395][ T298] R10: dffffc0000000000 R11: fffff520002cbf84 R12: dffffc0000000000 [ 41.250408][ T298] R13: 1ffff11022279141 R14: ffff8881113c8a08 R15: 0000000000000000 [ 41.258406][ T298] FS: 000055557b5e1500(0000) GS:ffff8881f6d00000(0000) knlGS:0000000000000000 [ 41.267387][ T298] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.274027][ T298] CR2: 000055557b60c998 CR3: 000000012c55c000 CR4: 00000000003526b0 [ 41.282057][ T298] Call Trace: [ 41.285343][ T298] [ 41.288283][ T298] simple_rmdir+0x152/0x260 [ 41.292822][ T298] vfs_rmdir+0x3de/0x560 [ 41.297085][ T298] incfs_kill_sb+0x102/0x220 [ 41.301734][ T298] deactivate_locked_super+0xd5/0x270 [ 41.307139][ T298] deactivate_super+0xb8/0xe0 [ 41.311909][ T298] cleanup_mnt+0x438/0x4d0 [ 41.316354][ T298] __cleanup_mnt+0x1d/0x40 [ 41.320810][ T298] task_work_run+0x1e8/0x260 [ 41.321534][ T9] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 41.325460][ T298] ? __cfi_task_work_run+0x10/0x10 [ 41.338066][ T298] ? __x64_sys_umount+0x12e/0x180 [ 41.343148][ T298] ? __cfi___x64_sys_umount+0x10/0x10 [ 41.348560][ T298] ? __kasan_check_read+0x15/0x20 [ 41.353623][ T298] resume_user_mode_work+0x35/0x50 [ 41.358788][ T298] syscall_exit_to_user_mode+0x63/0xb0 [ 41.364293][ T298] do_syscall_64+0x63/0xf0 [ 41.368732][ T298] ? clear_bhb_loop+0x50/0xa0 [ 41.373466][ T298] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 41.379416][ T298] RIP: 0033:0x7f4a8d9a0797 [ 41.383875][ T298] Code: a2 c7 05 5c 9f 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 41.403550][ T298] RSP: 002b:00007ffdc579eed8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 41.412027][ T298] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f4a8d9a0797 [ 41.420057][ T298] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdc579ef90 [ 41.428058][ T298] RBP: 00007ffdc579ef90 R08: 00007ffdc579ff90 R09: 00000000ffffffff [ 41.436067][ T298] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdc57a0080 [ 41.444203][ T298] R13: 00007f4a8da35f63 R14: 000000000000a084 R15: 00007ffdc57a1150 [ 41.452260][ T298] [ 41.455300][ T298] ---[ end trace 0000000000000000 ]--- [ 41.462229][ T298] ================================================================== [ 41.470307][ T298] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 [ 41.476547][ T298] Write of size 4 at addr 0000000000000168 by task syz-executor/298 [ 41.484519][ T298] [ 41.486858][ T298] CPU: 0 UID: 0 PID: 298 Comm: syz-executor Tainted: G W syzkaller #0 04b5f10b80d13b0533bf6aaa302b886c75cf6d37 [ 41.486880][ T298] Tainted: [W]=WARN [ 41.486885][ T298] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 41.486894][ T298] Call Trace: [ 41.486899][ T298] [ 41.486905][ T298] __dump_stack+0x21/0x30 [ 41.486929][ T298] dump_stack_lvl+0x140/0x1c0 [ 41.486950][ T298] ? __cfi_dump_stack_lvl+0x10/0x10 [ 41.486973][ T298] print_report+0x3d/0x70 [ 41.486994][ T298] kasan_report+0x162/0x1a0 [ 41.487008][ T298] ? ihold+0x24/0x70 [ 41.487022][ T298] ? ihold+0x24/0x70 [ 41.487034][ T298] kasan_check_range+0x25a/0x2b0 [ 41.487049][ T298] __kasan_check_write+0x18/0x20 [ 41.487068][ T298] ihold+0x24/0x70 [ 41.487080][ T298] vfs_rmdir+0x25c/0x560 [ 41.487096][ T298] incfs_kill_sb+0x102/0x220 [ 41.487118][ T298] deactivate_locked_super+0xd5/0x270 [ 41.487135][ T298] deactivate_super+0xb8/0xe0 [ 41.487151][ T298] cleanup_mnt+0x438/0x4d0 [ 41.487165][ T298] __cleanup_mnt+0x1d/0x40 [ 41.487178][ T298] task_work_run+0x1e8/0x260 [ 41.487198][ T298] ? __cfi_task_work_run+0x10/0x10 [ 41.487217][ T298] ? __x64_sys_umount+0x12e/0x180 [ 41.487235][ T298] ? __cfi___x64_sys_umount+0x10/0x10 [ 41.487260][ T298] ? __kasan_check_read+0x15/0x20 [ 41.487279][ T298] resume_user_mode_work+0x35/0x50 [ 41.487296][ T298] syscall_exit_to_user_mode+0x63/0xb0 [ 41.487319][ T298] do_syscall_64+0x63/0xf0 [ 41.487333][ T298] ? clear_bhb_loop+0x50/0xa0 [ 41.487354][ T298] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 41.487374][ T298] RIP: 0033:0x7f4a8d9a0797 [ 41.487385][ T298] Code: a2 c7 05 5c 9f 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 41.487397][ T298] RSP: 002b:00007ffdc579eed8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 41.487412][ T298] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f4a8d9a0797 [ 41.487422][ T298] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdc579ef90 [ 41.487430][ T298] RBP: 00007ffdc579ef90 R08: 00007ffdc579ff90 R09: 00000000ffffffff [ 41.487441][ T298] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdc57a0080 [ 41.487450][ T298] R13: 00007f4a8da35f63 R14: 000000000000a084 R15: 00007ffdc57a1150 [ 41.487462][ T298] [ 41.487467][ T298] ================================================================== [ 41.726630][ T298] Disabling lock debugging due to kernel taint [ 41.732981][ T298] BUG: kernel NULL pointer dereference, address: 0000000000000168 [ 41.740795][ T298] #PF: supervisor write access in kernel mode [ 41.746863][ T298] #PF: error_code(0x0002) - not-present page [ 41.752845][ T298] PGD 8000000131b34067 P4D 8000000131b34067 PUD 0 [ 41.759347][ T298] Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI [ 41.765415][ T298] CPU: 0 UID: 0 PID: 298 Comm: syz-executor Tainted: G B W syzkaller #0 04b5f10b80d13b0533bf6aaa302b886c75cf6d37 [ 41.778521][ T298] Tainted: [B]=BAD_PAGE, [W]=WARN [ 41.783543][ T298] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 41.793600][ T298] RIP: 0010:ihold+0x2a/0x70 [ 41.798126][ T298] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 8d 69 94 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 4c ff ed ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 9d [ 41.817732][ T298] RSP: 0018:ffffc9000165fcc8 EFLAGS: 00010246 [ 41.823807][ T298] RAX: ffff88812224a700 RBX: 0000000000000000 RCX: ffff88812224a780 [ 41.831782][ T298] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 41.839757][ T298] RBP: ffffc9000165fcd8 R08: ffffffff893cf947 R09: 1ffffffff1279f28 [ 41.847747][ T298] R10: dffffc0000000000 R11: fffffbfff1279f29 R12: 0000000000000000 [ 41.855713][ T298] R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 [ 41.863683][ T298] FS: 000055557b5e1500(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 [ 41.872610][ T298] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.879191][ T298] CR2: 0000000000000168 CR3: 000000012c55c000 CR4: 00000000003526b0 [ 41.887170][ T298] Call Trace: [ 41.890447][ T298] [ 41.893395][ T298] vfs_rmdir+0x25c/0x560 [ 41.897679][ T298] incfs_kill_sb+0x102/0x220 [ 41.902273][ T298] deactivate_locked_super+0xd5/0x270 [ 41.907674][ T298] deactivate_super+0xb8/0xe0 [ 41.912352][ T298] cleanup_mnt+0x438/0x4d0 [ 41.916791][ T298] __cleanup_mnt+0x1d/0x40 [ 41.921213][ T298] task_work_run+0x1e8/0x260 [ 41.925825][ T298] ? __cfi_task_work_run+0x10/0x10 [ 41.930951][ T298] ? __x64_sys_umount+0x12e/0x180 [ 41.935995][ T298] ? __cfi___x64_sys_umount+0x10/0x10 [ 41.941411][ T298] ? __kasan_check_read+0x15/0x20 [ 41.946461][ T298] resume_user_mode_work+0x35/0x50 [ 41.951597][ T298] syscall_exit_to_user_mode+0x63/0xb0 [ 41.957081][ T298] do_syscall_64+0x63/0xf0 [ 41.961512][ T298] ? clear_bhb_loop+0x50/0xa0 [ 41.966207][ T298] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 41.972145][ T298] RIP: 0033:0x7f4a8d9a0797 [ 41.976570][ T298] Code: a2 c7 05 5c 9f 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 41.996181][ T298] RSP: 002b:00007ffdc579eed8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 42.004610][ T298] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f4a8d9a0797 [ 42.012593][ T298] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdc579ef90 [ 42.020570][ T298] RBP: 00007ffdc579ef90 R08: 00007ffdc579ff90 R09: 00000000ffffffff [ 42.028548][ T298] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdc57a0080 [ 42.036547][ T298] R13: 00007f4a8da35f63 R14: 000000000000a084 R15: 00007ffdc57a1150 [ 42.044535][ T298] [ 42.047570][ T298] Modules linked in: [ 42.051488][ T298] CR2: 0000000000000168 [ 42.055640][ T298] ---[ end trace 0000000000000000 ]--- [ 42.061110][ T298] RIP: 0010:ihold+0x2a/0x70 [ 42.065647][ T298] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 8d 69 94 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 4c ff ed ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 9d [ 42.085261][ T298] RSP: 0018:ffffc9000165fcc8 EFLAGS: 00010246 [ 42.091334][ T298] RAX: ffff88812224a700 RBX: 0000000000000000 RCX: ffff88812224a780 [ 42.099312][ T298] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 42.107289][ T298] RBP: ffffc9000165fcd8 R08: ffffffff893cf947 R09: 1ffffffff1279f28 [ 42.115270][ T298] R10: dffffc0000000000 R11: fffffbfff1279f29 R12: 0000000000000000 [ 42.123255][ T298] R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 [ 42.131239][ T298] FS: 000055557b5e1500(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 [ 42.140172][ T298] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 42.146760][ T298] CR2: 0000000000000168 CR3: 000000012c55c000 CR4: 00000000003526b0 [ 42.154742][ T298] Kernel panic - not syncing: Fatal exception [ 42.161324][ T298] Kernel Offset: disabled [ 42.165767][ T298] Rebooting in 86400 seconds..