last executing test programs: 1.740909599s ago: executing program 1 (id=2): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(r1, 0x4068aea3, &(0x7f0000000000)={0xa8, 0x0, 0x3}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x200000, &(0x7f0000200000/0x200000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r2, 0xc040aed5, &(0x7f0000000200)={0x0, 0x200000}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x1, 0x0, 0x200000, &(0x7f0000200000/0x200000)=nil}) ioctl$KVM_CLEAR_DIRTY_LOG(r1, 0xc018aec0, &(0x7f00000001c0)={0x0, 0x200, 0x0, &(0x7f0000000400)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x8000, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x6, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffdfffffffff, 0xffffffffffffffff, 0x4, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x2, 0xffffffffffffffff, 0xffffffffffffffff, 0xfffffffffffffffb, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xfffffffffffffffb, 0xffffffffffffffff, 0x2, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa5b, 0xffffffdffffffffe, 0xffffffffffffffff, 0xffffffffffffffff, 0xffbfffffffffffff, 0xffffffffefffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xfffffffffffffff3, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xfffffffffffffffc, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0x2, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}) 1.72668863s ago: executing program 3 (id=4): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) pwrite64(r0, &(0x7f0000000100)="0000010042", 0x5, 0x1be) pwrite64(r0, &(0x7f0000000100)="55aa", 0x2, 0x1fe) pwrite64(r0, &(0x7f0000000100)='PRIVHEAD', 0x8, 0xc00) pwrite64(r0, &(0x7f0000000100)="0002000b", 0x4, 0xc0c) pwrite64(r0, &(0x7f0000000100)='12345678-1234-1234-12', 0x15, 0xc30) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\a', 0x7, 0xd23) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\b', 0x7, 0xd2b) pwrite64(r0, &(0x7f0000000100)='co', 0x2, 0x100224) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) 1.440787006s ago: executing program 3 (id=6): request_key(&(0x7f0000000000)='user\x00', &(0x7f0000001ffb)={'syz', 0x1, 0xc}, &(0x7f0000001fee)='R\x10rust\xe3c*sgrVdx:Di', 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/keys\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000005c40)={0x2020}, 0x2020) 1.416754297s ago: executing program 3 (id=7): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) pwrite64(r0, &(0x7f0000000100)="0000010042", 0x5, 0x1be) pwrite64(r0, &(0x7f0000000100)="55aa", 0x2, 0x1fe) pwrite64(r0, &(0x7f0000000100)='PRIVHEAD', 0x8, 0xc00) pwrite64(r0, &(0x7f0000000100)="0002000b", 0x4, 0xc0c) pwrite64(r0, 0x0, 0x0, 0xd2b) pwrite64(r0, &(0x7f0000000100)='\x00\x00', 0x2, 0x1e8133) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) 1.408781327s ago: executing program 1 (id=9): syz_ublk_setup_queues(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000900)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) write$binfmt_aout(r0, &(0x7f0000000180)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000140)={0x0, 0x0, 0xfffffff9, 0x7fff, 0x16, "0062ba7d82000000000000000000f7ffffff00"}) r1 = syz_open_pts(r0, 0xc0000) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000100)=0x12) 1.205384232s ago: executing program 3 (id=15): r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300034700bb65e1c3c6ffff01000000010000005600000025000000190004000400000047fd17e5ffff0800040000000000000000", 0x39}], 0x1) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=@updpolicy={0xfc, 0x19, 0xfd3649826d894c67, 0x0, 0x0, {{@in6=@mcast1, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x4, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x0, 0x33}, 0x0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}}]}]}, 0xfc}}, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCADDRT(r2, 0x890b, &(0x7f0000000140)={0x0, {0x2, 0x3, @multicast1}, {0x2, 0x0, @local}, {0x2, 0x0, @multicast2}, 0xa4, 0x0, 0x0, 0x0, 0x5, 0x0, 0xe41}) r3 = socket$igmp(0x2, 0x3, 0x2) sendmsg$inet(r3, &(0x7f00000000c0)={&(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10, 0x0}, 0x0) 1.167856793s ago: executing program 0 (id=16): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) pwrite64(r0, &(0x7f0000000100)="0000010042", 0x5, 0x1be) pwrite64(r0, &(0x7f0000000100)="55aa", 0x2, 0x1fe) pwrite64(r0, &(0x7f0000000100)='PRIVHEAD', 0x8, 0xc00) pwrite64(r0, &(0x7f0000000100)="0002000b", 0x4, 0xc0c) pwrite64(r0, &(0x7f0000000100)='12345678-1234-1234-1234-123456789612', 0x24, 0xc30) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\a', 0x7, 0xd23) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\b', 0x7, 0xd2b) pwrite64(r0, &(0x7f0000000100)='\x00\x00', 0x2, 0x1e8133) pwrite64(r0, &(0x7f0000000100)='TOCBLOCK', 0x8, 0x100200) pwrite64(r0, &(0x7f0000000100)='config', 0x6, 0x100224) pwrite64(r0, &(0x7f0000000100)='log', 0x3, 0x100246) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) 1.159795513s ago: executing program 2 (id=17): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./sys/bus/pci/devices/0000:00:07.0/remove\x00', 0x1, 0x0) write(r0, &(0x7f00000004c0)='1', 0x1) syz_clone(0x2008400, 0x0, 0x0, 0x0, 0x0, 0x0) 1.090997525s ago: executing program 1 (id=18): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x4, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f00000001c0)=@attr_riscv64=@attr_aplic={0x0, 0x1, @any=0x1, 0x0}) 1.075807845s ago: executing program 3 (id=19): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0xdddd1000, 0x200000, &(0x7f0000200000/0x200000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r2, 0xc040aed5, &(0x7f0000000200)={0x0, 0x200000}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x1, 0x0, 0x200000, &(0x7f0000200000/0x200000)=nil}) ioctl$KVM_PRE_FAULT_MEMORY(r2, 0xc040aed5, &(0x7f00000000c0)={0x3000, 0x100000}) 1.031277196s ago: executing program 0 (id=20): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000200)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x24, 0x3, 0x46d, 0xc082, 0x0, 0x0, "0600ff0901a10185107508950609018102090191028511750895130901810209019102c0"}}, 0x13c) write$UHID_INPUT2(r0, &(0x7f0000000380), 0x6) 1.020887486s ago: executing program 2 (id=21): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) listen(r0, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff) mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=2.1,nodfs\x00') r1 = accept(r0, 0x0, 0x0) recvfrom(r1, &(0x7f0000001000)=""/4096, 0x1000, 0x0, 0x0, 0x0) sendto$inet(r1, &(0x7f0000002000)="00000080fe534d4240000100000000000000010001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000041000100100200000000000000000000000000000000000000000000000010000000100000001000000000000000000000000000000000000000800000000000", 0x84, 0x0, 0x0, 0x0) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) sendto$inet(r1, &(0x7f0000002100)="00000078fe534d4240000100160000c00100010001000000000000000100000000000000000000000000000001000000000000000000000000000000000000000000000009000000480030004e544c4d535350000200000000000000000000000002082000"/124, 0x7c, 0x0, 0x0, 0x0) close(r1) faccessat2(0xffffffffffffff9c, 0x0, 0x0, 0x0) 994.363577ms ago: executing program 0 (id=22): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x40, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008000}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x14) 991.558057ms ago: executing program 1 (id=23): mkdir(&(0x7f0000000100)='mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='mnt\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x2, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040a00e58684000010203010902270001010080320904000003ff00000007058102400000070502024000000705830308"], &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f0000000400)='mnt/ttyUSB0\x00', 0x2, 0x0) rt_sigtimedwait(0x0, 0x0, 0x0, 0x0) unshare(0x44040000) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r0, 0xffffffffffffffff, 0x0) 750.295963ms ago: executing program 0 (id=24): r0 = openat$sysfs(0xffffff9c, &(0x7f0000000140)='/sys/kernel/fscaps', 0xa8440, 0xa) preadv(r0, &(0x7f00000004c0)=[{&(0x7f00000003c0)=""/207, 0xcf}], 0x1, 0x0, 0x0) 750.141673ms ago: executing program 0 (id=25): r0 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x8) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x6) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r1, 0x0) landlock_restrict_self(r1, 0x0) landlock_restrict_self(r1, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r3 = landlock_create_ruleset(&(0x7f00000002c0)={0x7f6e}, 0x18, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r3, 0x1, &(0x7f0000000000)={0x210a, r2}, 0x0) landlock_restrict_self(r3, 0x0) open(&(0x7f00000000c0)='.\x00', 0x8000, 0x50) 746.297243ms ago: executing program 0 (id=26): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/bus/usb/devices/usb5/bConfigurationValue\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='0', 0x1) 135.738987ms ago: executing program 2 (id=27): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80102, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = eventfd2(0xe5c, 0x80000) r3 = eventfd2(0x42000006, 0x801) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000340)={r2, 0x7, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000002c0)={r3, 0x2, 0x1}) 29.801959ms ago: executing program 2 (id=28): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x8081, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000380)="0000004a0000000004000002000000020000000000000001000000007c") ioctl(r1, 0x40140921, &(0x7f0000000420)="0100000001") ioctl(r1, 0x400c0930, 0x0) 29.64091ms ago: executing program 2 (id=29): r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000000)=""/91, 0x5b}, {&(0x7f0000000c00)=""/76, 0x4c}, {&(0x7f0000001fc0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/92, 0x5c}, {&(0x7f0000000980)=""/61, 0x3d}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x9a}, {&(0x7f0000000100)=""/23, 0x17}, {&(0x7f0000003800)=""/4096, 0x1000}], 0x9}}], 0x1, 0x0, 0x0) 29.547719ms ago: executing program 2 (id=30): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config/usb_gadget/g1/functions/mass_storage.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./config/usb_gadget/g1/functions/mass_storage.usb0/num_buffers\x00', 0x1, 0x0) write$cgroup_pid(r0, &(0x7f0000000300), 0x12) 0s ago: executing program 3 (id=31): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x20, 0x2f, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0xc, 0xc, 0x0, 0x0, @u64}]}, 0x20}, 0x1, 0x0, 0x0, 0x42014}, 0x80000) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.57' (ED25519) to the list of known hosts. [ 22.694738][ T36] audit: type=1400 audit(1788870495.880:64): avc: denied { mounton } for pid=287 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.698538][ T287] cgroup: Unknown subsys name 'net' [ 22.717512][ T36] audit: type=1400 audit(1788870495.890:65): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.745197][ T36] audit: type=1400 audit(1788870495.910:66): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.745676][ T287] cgroup: Unknown subsys name 'devices' [ 22.867470][ T287] cgroup: Unknown subsys name 'hugetlb' [ 22.873125][ T287] cgroup: Unknown subsys name 'rlimit' [ 22.988912][ T36] audit: type=1400 audit(1788870496.180:67): avc: denied { setattr } for pid=287 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.012140][ T36] audit: type=1400 audit(1788870496.180:68): avc: denied { mounton } for pid=287 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.036911][ T36] audit: type=1400 audit(1788870496.180:69): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.067905][ T289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 23.076838][ T36] audit: type=1400 audit(1788870496.270:70): avc: denied { relabelto } for pid=289 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.102307][ T36] audit: type=1400 audit(1788870496.270:71): avc: denied { write } for pid=289 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.124483][ T287] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.127911][ T36] audit: type=1400 audit(1788870496.300:72): avc: denied { read } for pid=287 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.162152][ T36] audit: type=1400 audit(1788870496.300:73): avc: denied { open } for pid=287 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.047805][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.054913][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.062056][ T295] bridge_slave_0: entered allmulticast mode [ 24.068662][ T295] bridge_slave_0: entered promiscuous mode [ 24.076695][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.083777][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.090923][ T295] bridge_slave_1: entered allmulticast mode [ 24.097322][ T295] bridge_slave_1: entered promiscuous mode [ 24.139237][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.146340][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.153398][ T297] bridge_slave_0: entered allmulticast mode [ 24.159802][ T297] bridge_slave_0: entered promiscuous mode [ 24.169038][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.176316][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.183401][ T297] bridge_slave_1: entered allmulticast mode [ 24.189746][ T297] bridge_slave_1: entered promiscuous mode [ 24.230764][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.237900][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.244960][ T296] bridge_slave_0: entered allmulticast mode [ 24.251355][ T296] bridge_slave_0: entered promiscuous mode [ 24.260019][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.267180][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.274276][ T296] bridge_slave_1: entered allmulticast mode [ 24.280590][ T296] bridge_slave_1: entered promiscuous mode [ 24.311019][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.318176][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.325408][ T294] bridge_slave_0: entered allmulticast mode [ 24.331677][ T294] bridge_slave_0: entered promiscuous mode [ 24.338267][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.345453][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.352566][ T294] bridge_slave_1: entered allmulticast mode [ 24.358972][ T294] bridge_slave_1: entered promiscuous mode [ 24.457662][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.464766][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.472146][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.479225][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.521858][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.528975][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.536319][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.543375][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.562327][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.569429][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.576856][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.583918][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.599807][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.606930][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.614222][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.621341][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.652854][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.660824][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.668220][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.675592][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.682828][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.690203][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.697653][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.704948][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.734008][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.741126][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.750718][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.757984][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.772530][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.779643][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.787391][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.794455][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.811497][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.818616][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.826517][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.833585][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.849972][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.857091][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.864668][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.871771][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.923774][ T295] veth0_vlan: entered promiscuous mode [ 24.949937][ T297] veth0_vlan: entered promiscuous mode [ 24.962354][ T294] veth0_vlan: entered promiscuous mode [ 24.971196][ T296] veth0_vlan: entered promiscuous mode [ 24.983687][ T295] veth1_macvtap: entered promiscuous mode [ 24.994234][ T297] veth1_macvtap: entered promiscuous mode [ 25.007497][ T296] veth1_macvtap: entered promiscuous mode [ 25.033588][ T294] veth1_macvtap: entered promiscuous mode [ 25.073983][ T295] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 25.124900][ T317] FAULT_INJECTION: forcing a failure. [ 25.124900][ T317] name failslab, interval 1, probability 0, space 0, times 1 [ 25.140030][ T314] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.148028][ T320] loop0: detected capacity change from 0 to 2049 [ 25.163513][ T317] CPU: 1 UID: 0 PID: 317 Comm: syz.0.1 Not tainted syzkaller #0 6f2d7458894aba4127f3ede48a844fbc689668cc [ 25.163551][ T317] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 25.163576][ T317] Call Trace: [ 25.163584][ T317] [ 25.163594][ T317] __dump_stack+0x21/0x30 [ 25.163647][ T317] dump_stack_lvl+0x140/0x1c0 [ 25.163683][ T317] ? __cfi_dump_stack_lvl+0x10/0x10 [ 25.163718][ T317] ? __kasan_kmalloc+0x96/0xb0 [ 25.163750][ T317] ? __kmalloc_cache_noprof+0x23c/0x470 [ 25.163779][ T317] dump_stack+0x19/0x20 [ 25.163813][ T317] should_fail_ex+0x3c2/0x510 [ 25.163844][ T317] should_failslab+0xac/0x100 [ 25.163876][ T317] __kmalloc_cache_noprof+0x41/0x470 [ 25.163903][ T317] ? __se_sys_fsopen+0x14d/0x390 [ 25.163942][ T317] __se_sys_fsopen+0x14d/0x390 [ 25.163980][ T317] __x64_sys_fsopen+0x5f/0x80 [ 25.164017][ T317] x64_sys_call+0x2d40/0x2ee0 [ 25.164041][ T317] do_syscall_64+0x57/0xf0 [ 25.164078][ T317] ? clear_bhb_loop+0x50/0xa0 [ 25.164107][ T317] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 25.164135][ T317] RIP: 0033:0x7f2bfef9e159 [ 25.164160][ T317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 25.164180][ T317] RSP: 002b:00007f2bffe54028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 25.164214][ T317] RAX: ffffffffffffffda RBX: 00007f2bff225fa0 RCX: 00007f2bfef9e159 [ 25.164233][ T317] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000180 [ 25.164250][ T317] RBP: 00007f2bff035024 R08: 0000000000000000 R09: 0000000000000000 [ 25.164266][ T317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 25.164282][ T317] R13: 00007f2bff226038 R14: 00007f2bff225fa0 R15: 00007ffce5513188 [ 25.164304][ T317] [ 25.386057][ T320] loop0: [ 25.458723][ T333] tipc: Started in network mode [ 25.463780][ T333] tipc: Node identity f685b554de46, cluster identity 4711 [ 25.471304][ T333] tipc: Enabled bearer , priority 0 [ 25.482282][ T333] D: renamed from syzkaller0 [ 25.487540][ T336] loop0: detected capacity change from 0 to 3904 [ 25.499659][ T333] tipc: Disabling bearer [ 25.533465][ T9] logitech-hidpp-device 0005:046D:B012.0001: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz1 [ 25.557196][ T336] loop0: [ 25.625839][ T340] fido_id[340]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 25.662784][ T350] netlink: 'syz.3.15': attribute type 4 has an invalid length. [ 25.698193][ T352] loop0: detected capacity change from 0 to 3904 [ 25.778177][ T352] loop0: [ 26.007539][ T368] mmap: syz.0.22 (368) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 26.145110][ T9] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 26.316063][ T9] usb 2-1: not running at top speed; connect to a high speed hub [ 26.324722][ T9] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 26.338532][ T9] usb 2-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 26.365126][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.373186][ T9] usb 2-1: Product: syz [ 26.377471][ T311] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 26.395087][ T9] usb 2-1: Manufacturer: syz [ 26.399798][ T9] usb 2-1: SerialNumber: syz [ 26.555101][ T311] usb 1-1: Using ep0 maxpacket: 8 [ 26.565879][ T311] usb 1-1: config 0 has an invalid interface number: 143 but max is 0 [ 26.574092][ T311] usb 1-1: config 0 has no interface number 0 [ 26.595124][ T311] usb 1-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 26.604317][ T311] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.625908][ T311] usb 1-1: config 0 descriptor?? [ 26.662286][ T312] usb 2-1: USB disconnect, device number 2 [ 26.811272][ T385] Mass Storage Function, version: 2009/09/11 [ 26.817695][ T385] LUN: removable file: (no medium) [ 26.827069][ T385] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN PTI [ 26.839737][ T385] KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] [ 26.848190][ T385] CPU: 0 UID: 0 PID: 385 Comm: syz.2.30 Not tainted syzkaller #0 6f2d7458894aba4127f3ede48a844fbc689668cc [ 26.859096][ T312] usb 1-1: USB disconnect, device number 2 [ 26.859774][ T385] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.875706][ T385] RIP: 0010:fsg_common_set_num_buffers+0xa5/0x3b0 [ 26.882179][ T385] Code: 49 be 00 00 00 00 00 fc ff df 66 90 e8 c4 cd c9 fd bf 00 40 00 00 be c0 0c 00 00 e8 35 6b 1e fe 49 89 c7 4c 89 e0 48 c1 e8 03 <42> 80 3c 30 00 74 08 4c 89 e7 e8 2c a9 22 fe 4d 8d 75 f0 4d 89 3e [ 26.901805][ T385] RSP: 0018:ffffc9000c98fb20 EFLAGS: 00010202 [ 26.907919][ T385] RAX: 0000000000000002 RBX: 0000000000000001 RCX: 0000000000000002 [ 26.915952][ T385] RDX: 0000000000000003 RSI: ffffffff83bda9ab RDI: ffffed1026eb5800 [ 26.923953][ T385] RBP: ffffc9000c98fb70 R08: 0000000000004000 R09: 0000000000000000 [ 26.931945][ T385] R10: ffffed1026eb5800 R11: fffff940009bad4c R12: 0000000000000010 [ 26.939963][ T385] R13: 0000000000000020 R14: dffffc0000000000 R15: ffff8881375a8000 [ 26.947956][ T385] FS: 00007f16dcadf6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 26.956896][ T385] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 26.963489][ T385] CR2: 00007f7a8bdf8494 CR3: 00000001153ce000 CR4: 00000000003526b0 [ 26.971535][ T385] Call Trace: [ 26.974859][ T385] [ 26.977833][ T385] fsg_opts_num_buffers_store+0x13c/0x1c0 [ 26.983622][ T385] ? __cfi_fsg_opts_num_buffers_store+0x10/0x10 [ 26.989924][ T385] ? futex_wait+0x2b8/0x7c0 [ 26.994486][ T385] configfs_write_iter+0x32c/0x490 [ 26.999661][ T385] ? __cfi_fsg_opts_num_buffers_store+0x10/0x10 [ 27.005996][ T385] vfs_write+0x762/0xfd0 [ 27.010304][ T385] ? __cfi_vfs_write+0x10/0x10 [ 27.015129][ T385] ? __cfi_mutex_lock+0x10/0x10 [ 27.020040][ T385] ksys_write+0x145/0x260 [ 27.024381][ T385] ? xfd_validate_state+0x68/0x140 [ 27.029512][ T385] ? __cfi_ksys_write+0x10/0x10 [ 27.034378][ T385] ? __kasan_check_write+0x18/0x20 [ 27.039502][ T385] ? fpregs_restore_userregs+0x11c/0x260 [ 27.045165][ T385] __x64_sys_write+0x7f/0x90 [ 27.049792][ T385] x64_sys_call+0x271c/0x2ee0 [ 27.054473][ T385] do_syscall_64+0x57/0xf0 [ 27.058928][ T385] ? clear_bhb_loop+0x50/0xa0 [ 27.063627][ T385] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 27.069565][ T385] RIP: 0033:0x7f16dbb9e159 [ 27.074012][ T385] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 27.093627][ T385] RSP: 002b:00007f16dcadf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 27.102088][ T385] RAX: ffffffffffffffda RBX: 00007f16dbe25fa0 RCX: 00007f16dbb9e159 [ 27.110073][ T385] RDX: 0000000000000012 RSI: 0000200000000300 RDI: 0000000000000003 [ 27.118054][ T385] RBP: 00007f16dbc35024 R08: 0000000000000000 R09: 0000000000000000 [ 27.126038][ T385] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 27.134020][ T385] R13: 00007f16dbe26038 R14: 00007f16dbe25fa0 R15: 00007ffe24338f28 [ 27.142032][ T385] [ 27.145072][ T385] Modules linked in: [ 27.149237][ T385] ---[ end trace 0000000000000000 ]--- [ 27.155172][ T385] RIP: 0010:fsg_common_set_num_buffers+0xa5/0x3b0 [ 27.162415][ T385] Code: 49 be 00 00 00 00 00 fc ff df 66 90 e8 c4 cd c9 fd bf 00 40 00 00 be c0 0c 00 00 e8 35 6b 1e fe 49 89 c7 4c 89 e0 48 c1 e8 03 <42> 80 3c 30 00 74 08 4c 89 e7 e8 2c a9 22 fe 4d 8d 75 f0 4d 89 3e [ 27.182573][ T385] RSP: 0018:ffffc9000c98fb20 EFLAGS: 00010202 [ 27.188792][ T385] RAX: 0000000000000002 RBX: 0000000000000001 RCX: 0000000000000002 [ 27.197248][ T385] RDX: 0000000000000003 RSI: ffffffff83bda9ab RDI: ffffed1026eb5800 [ 27.205494][ T385] RBP: ffffc9000c98fb70 R08: 0000000000004000 R09: 0000000000000000 [ 27.213582][ T385] R10: ffffed1026eb5800 R11: fffff940009bad4c R12: 0000000000000010 [ 27.221634][ T385] R13: 0000000000000020 R14: dffffc0000000000 R15: ffff8881375a8000 [ 27.229741][ T385] FS: 00007f16dcadf6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 27.238754][ T385] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.245389][ T385] CR2: 00007f7a8bdf8494 CR3: 00000001153ce000 CR4: 00000000003526b0 [ 27.253376][ T385] Kernel panic - not syncing: Fatal exception [ 27.260027][ T385] Kernel Offset: disabled [ 27.264397][ T385] Rebooting in 86400 seconds..