last executing test programs: 6.746976323s ago: executing program 1 (id=2): r0 = syz_usb_connect$uac2(0x5, 0x83, &(0x7f0000000540)=ANY=[@ANYBLOB="120100020000002082052500400001020301090271000301f81005080b020001052008090400000001012000092401fdff0a11004708248c93f3d77f00090401efff01022000090401010101022000090501"], 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r1, &(0x7f0000002a80)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)={0x38, 0x13, 0x1, 0x70bd2b, 0x25dfdbfb, "", [@nested={0x4, 0x4f}, @nested={0x4, 0x71}, @nested={0x20, 0xbc, 0x0, 0x1, [@nested={0x4, 0xc3}, @nested={0x18, 0x2e, 0x0, 0x1, [@typed={0x14, 0x10b, 0x0, 0x0, @ipv6=@local}]}]}]}, 0x38}], 0x1, 0x0, 0x0, 0x8800}, 0x4048884) syz_usb_control_io(r0, &(0x7f0000000b40)={0x2c, 0x0, &(0x7f00000003c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x843}}, 0x0, 0x0, &(0x7f0000000a40)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x7, 0x1, 0x6, 0x2, 0xa, 0xfe01, 0xd}}}, 0x0) mount$cgroup(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000640), 0x2008000, &(0x7f0000000000)={[{@favordynmods}]}) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, 0x0, 0x0, &(0x7f00000002c0)={0x0, 0xf, 0x5, {0x5, 0xf, 0x5}}, 0x0, 0x0}, &(0x7f0000000a80)={0x84, &(0x7f0000000440)={0x20, 0xe, 0x53, "ef86a6cf0104772aeb2e57066ff840a91b4bb846516ff212bd336714fb8993b57e1fd34bcb79d06572e04adff670ec0600773ffe48a23a5287ada06770768b335860baf120334970c83442516f346e4ab261ce"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x42042, 0x180) sendfile(r2, r2, 0x0, 0x1200000000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0xcc) r4 = syz_io_uring_setup(0x574b, &(0x7f00000004c0)={0x0, 0x3b40, 0x13080, 0xffffffff, 0x2b7, 0x0, r3}, &(0x7f0000000080), &(0x7f0000000180), &(0x7f0000000000)) r5 = userfaultfd(0x801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) syz_io_uring_setup(0x5793, &(0x7f0000000340)={0x0, 0xca23, 0x10000, 0xfffffff7, 0x212}, &(0x7f0000000100), &(0x7f0000ff4000), 0x0) ioctl$UFFDIO_WRITEPROTECT(r5, 0xc018aa06, &(0x7f0000000280)={{&(0x7f0000ff0000/0xd000)=nil, 0xd000}}) mount$9p_fd(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f0000000480), 0x84, &(0x7f0000000300)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r3, @ANYBLOB=',wfdno=', @ANYRESHEX=r4]) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r6 = fsopen(&(0x7f0000000080)='omfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x8, 0x0, 0x0, 0x0) syz_usb_connect$printer(0x3, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x6, 0x10, 0x5, "", [{{0x9, 0x4, 0x0, 0x9, 0x1, 0x7, 0x1, 0x2, 0x57, "", {{{0x9, 0x5, 0x1, 0x2, 0x200, 0x6, 0x9, 0x2}}}}}]}}]}}, &(0x7f0000000340)={0xa, &(0x7f0000000140)={0xa, 0x6, 0x300, 0xb, 0xe1, 0x7, 0xff, 0xf8}, 0x58, &(0x7f0000000680)=ANY=[@ANYBLOB="050f5800060a100302050006060001071002043905001410040e068c6234e2cad7d86fffb32e83e2521107100200967002ee0f020adf090020100ace05400000000001009000ff00300000000000ff00000000000f0000002490e809da3ca5e0b8c36dc5690a420f234b227166d41e41911b6e2049f7ddf2a4ce9e7d2fc8a3a802040485ce99810c9662caa3c1be9ac88fe81ec6a0539a5f13541c5950e1c65b12d9bf2297a367757b59314943628e9a04d14fc36447debd278c732b0677536447fba8f6ef01400800000059951c4c278863c3c4a5357f451f8a3232097d2f53a6e867a6753b00020000000000009b9993686516113cd05cff9ad28b01d32516de363ac6b1cdc7e2a157dea9"], 0x3, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x44f}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x2009}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x860}}]}) timer_create(0x0, 0x0, 0x0) 3.682603748s ago: executing program 1 (id=17): r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0xb, &(0x7f0000000000)=0x1e, 0x4) (async) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0) (async) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0xa, &(0x7f00000004c0)=0x5, 0x4) (async) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) (async) r3 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) sendmsg$IPSET_CMD_ADD(r3, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x94, 0x9, 0x6, 0x201, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_LINENO={0x8}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_DATA={0x58, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP_TO={0x18, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}}, @IPSET_ATTR_NAMEREF={0x9, 0x13, 'syz1\x00'}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e21}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x16}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x5}, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x5}, 0x4000000) (async, rerun: 32) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) (async, rerun: 32) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)={0x1c, r1, 0x3141e0b2751b0f9b, 0x70bd2b, 0x25dfdbff, {}, [@ETHTOOL_A_STRSET_STRINGSETS={0x8, 0x2, 0x0, 0x1, [{0x4}]}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4000) (async) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=@newsa={0x170, 0x10, 0x713, 0x70bd2d, 0x25dfdbfc, {{@in6=@remote, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e20, 0x0, 0x4e21, 0x602, 0x0, 0x20, 0x0, 0x33, 0x0, 0xee00}, {@in=@loopback, 0xfc, 0x32}, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, {0x0, 0x3, 0xc, 0x8, 0x0, 0x0, 0x0, 0x743}, {0x2a8, 0x7fffffffffffffff}, {0x0, 0xaf4}, 0x70bd28, 0x3500, 0xa, 0x0, 0x0, 0x50}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x40, "217d66c7cb7a00"/20}}, @replay_esn_val={0x20, 0x17, {0x1, 0x70bd2a, 0x70bd2b, 0x70bd2c, 0x70bd2a, 0x5, [0x2]}}]}, 0x170}}, 0x0) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x4040100) 3.515889422s ago: executing program 1 (id=19): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2e2003, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYRES16=r1], 0x76) 3.515748842s ago: executing program 1 (id=20): r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.cpu/cpuset.cpus\x00', 0x2, 0x85) write$tcp_mem(r0, &(0x7f0000000300), 0x48) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000000)={0xa84, 0xcfb, 0x3, 0x6, 0xfffffc01}, 0x14) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r1, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) recvfrom$inet(r1, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) syz_usb_connect(0x2, 0x43, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000a3233910daa658744d2d0102030109023100010800100009"], 0x0) 3.266700199s ago: executing program 3 (id=25): r0 = syz_usb_connect$uac2(0x5, 0x83, &(0x7f0000000540)=ANY=[@ANYBLOB="120100020000002082052500400001020301090271000301f81005080b020001052008090400000001012000092401fdff0a11004708248c93f3d77f00090401efff01022000090401010101022000090501"], 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r1, &(0x7f0000002a80)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)={0x38, 0x13, 0x1, 0x70bd2b, 0x25dfdbfb, "", [@nested={0x4, 0x4f}, @nested={0x4, 0x71}, @nested={0x20, 0xbc, 0x0, 0x1, [@nested={0x4, 0xc3}, @nested={0x18, 0x2e, 0x0, 0x1, [@typed={0x14, 0x10b, 0x0, 0x0, @ipv6=@local}]}]}]}, 0x38}], 0x1, 0x0, 0x0, 0x8800}, 0x4048884) syz_usb_control_io(r0, &(0x7f0000000b40)={0x2c, 0x0, &(0x7f00000003c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x843}}, 0x0, 0x0, &(0x7f0000000a40)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x7, 0x1, 0x6, 0x2, 0xa, 0xfe01, 0xd}}}, 0x0) mount$cgroup(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000640), 0x2008000, &(0x7f0000000000)={[{@favordynmods}]}) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, 0x0, 0x0, &(0x7f00000002c0)={0x0, 0xf, 0x5, {0x5, 0xf, 0x5}}, 0x0, 0x0}, &(0x7f0000000a80)={0x84, &(0x7f0000000440)={0x20, 0xe, 0x53, "ef86a6cf0104772aeb2e57066ff840a91b4bb846516ff212bd336714fb8993b57e1fd34bcb79d06572e04adff670ec0600773ffe48a23a5287ada06770768b335860baf120334970c83442516f346e4ab261ce"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x42042, 0x180) sendfile(r2, r2, 0x0, 0x1200000000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0xcc) r4 = syz_io_uring_setup(0x574b, &(0x7f00000004c0)={0x0, 0x3b40, 0x13080, 0xffffffff, 0x2b7, 0x0, r3}, &(0x7f0000000080), &(0x7f0000000180), &(0x7f0000000000)) r5 = userfaultfd(0x801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) syz_io_uring_setup(0x5793, &(0x7f0000000340)={0x0, 0xca23, 0x10000, 0xfffffff7, 0x212}, &(0x7f0000000100), &(0x7f0000ff4000), 0x0) ioctl$UFFDIO_WRITEPROTECT(r5, 0xc018aa06, &(0x7f0000000280)={{&(0x7f0000ff0000/0xd000)=nil, 0xd000}}) mount$9p_fd(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f0000000480), 0x84, &(0x7f0000000300)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r3, @ANYBLOB=',wfdno=', @ANYRESHEX=r4]) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r6 = fsopen(&(0x7f0000000080)='omfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x8, 0x0, 0x0, 0x0) syz_usb_connect$printer(0x3, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x6, 0x10, 0x5, "", [{{0x9, 0x4, 0x0, 0x9, 0x1, 0x7, 0x1, 0x2, 0x57, "", {{{0x9, 0x5, 0x1, 0x2, 0x200, 0x6, 0x9, 0x2}}}}}]}}]}}, &(0x7f0000000340)={0xa, &(0x7f0000000140)={0xa, 0x6, 0x300, 0xb, 0xe1, 0x7, 0xff, 0xf8}, 0x58, &(0x7f0000000680)=ANY=[@ANYBLOB="050f5800060a100302050006060001071002043905001410040e068c6234e2cad7d86fffb32e83e2521107100200967002ee0f020adf090020100ace05400000000001009000ff00300000000000ff00000000000f0000002490e809da3ca5e0b8c36dc5690a420f234b227166d41e41911b6e2049f7ddf2a4ce9e7d2fc8a3a802040485ce99810c9662caa3c1be9ac88fe81ec6a0539a5f13541c5950e1c65b12d9bf2297a367757b59314943628e9a04d14fc36447debd278c732b0677536447fba8f6ef01400800000059951c4c278863c3c4a5357f451f8a3232097d2f53a6e867a6753b00020000000000009b9993686516113cd05cff9ad28b01d32516de363ac6b1cdc7e2a157dea9"], 0x3, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x44f}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x2009}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x860}}]}) timer_create(0x0, 0x0, 0x0) 1.407922236s ago: executing program 2 (id=39): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x80000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000240)={0x1, 0x0, [{0xc0010058, 0x0, 0xfff}]}) sendmsg$NFC_CMD_GET_TARGET(r0, &(0x7f0000000100)={0x0, 0x49, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4, 0x70bd2a}, 0x14}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e20, @rand_addr=0x64010102}, 0x3) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000040)={0x3, 0x2, 0x3000, 0x1000, &(0x7f0000feb000/0x1000)=nil}) syz_kvm_setup_cpu$x86(r6, r7, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000300)="48b801b89734000000004d9823c80f23f835080050000f23f8c744240004000000c744240200000000c7442406000000000f06670f2107c74424002a010000ff2c24b8010000000f01c10f23c00f21f835020002000f23f8260f01d1f341f4c4017d10e548b8c0770c90f03a5f344b0fc76f000f20e035004000000f22e035080000000f23f8", 0xfffffffffffffeec}], 0x1, 0x21, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r0) r8 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r0) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000000c0)={0x28, r8, 0x1, 0x0, 0x0, {0x1c}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x840}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000200)={'wpan0\x00', 0x0}) r11 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE_wg(r11, 0x1, 0x19, &(0x7f00000003c0)='wg1\x00', 0x4) ioctl$ifreq_SIOCGIFINDEX_wireguard(r11, 0x8933, 0x0) setsockopt$inet_mreqn(r11, 0x0, 0x20, &(0x7f00000001c0)={@empty, @loopback}, 0xc) sendmsg$NL802154_CMD_SET_CCA_MODE(r0, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="00022abd0000000800030000000000000000", @ANYRES32=r9, @ANYBLOB="08000300", @ANYRES32=r10, @ANYBLOB], 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x4004080) 1.21477135s ago: executing program 0 (id=40): r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x42, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f0000000280), 0x348, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_ublk_setup_queues(r0, r2, &(0x7f0000000180)={0x0, 0xcf6f, 0x40000, 0x0, 0x255, 0x0, r1}, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000340)={{0x2, 0x3, 0xf3b, 0x2, 0x13fffffc}}) sendmsg$OSF_MSG_ADD(r0, &(0x7f0000000a00)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000500)={0x4bc, 0x0, 0x5, 0x801, 0x0, 0x0, {0x5, 0x0, 0x6}, [{{0x254, 0x1, {{0x2, 0x681}, 0x3, 0x2, 0xcb, 0x1, 0x14, 'syz1\x00', "a97d332b0dd9524a6743837accd20579c2a3f564bab2e0e291120e7f12941023", "8b9f9578c14a30fb2338057ba42a273c9adea02f208142c13dcd71759b03477f", [{0x7f, 0x0, {0x3, 0x5}}, {0xc0, 0xb, {0x2, 0x40}}, {0x800, 0x7, {0x1, 0x6}}, {0x6, 0x0, {0x3, 0x80000001}}, {0x2, 0xfb, {0x0, 0xfff}}, {0xe2b, 0x7, {0x0, 0xfffff001}}, {0x6, 0x7, {0x0, 0x2}}, {0x3, 0x80, {0x1, 0x4}}, {0x3, 0x3, {0x1, 0x8001}}, {0x2, 0x1, {0x0, 0x2}}, {0x6, 0x7, {0x1, 0x2}}, {0x4c7, 0x4, {0x3, 0xca}}, {0x8, 0x9304, {0x2, 0x40}}, {0x595d, 0xa, {0x3, 0x7}}, {0x6cf, 0xab6, {0x3, 0xfffffff2}}, {0xaf39, 0x0, {0x3, 0x1}}, {0x0, 0x4, {0x3, 0x4}}, {0x852, 0xc, {0x2, 0x1}}, {0xf88a, 0x1, {0x1, 0xf}}, {0x1ff, 0x0, {0x3, 0x400}}, {0x7, 0x8, {0x0, 0x1dde}}, {0xff, 0x100, {0x1, 0x3}}, {0x4, 0x0, {0x3, 0xfffffff7}}, {0xe000, 0x4400, {0x3, 0x10000}}, {0x622, 0x6, {0x2, 0x2}}, {0x1, 0x4, {0x3, 0x4}}, {0x5, 0xf, {0x0, 0xfff}}, {0x1, 0x24, {0x0, 0x5}}, {0xf39, 0x1ff, {0x3, 0x9}}, {0x72, 0x8, {0x1, 0x3}}, {0x5, 0x6, {0x0, 0x2}}, {0x4806, 0xb260, {0xe7a2e2f8c23f0364, 0x2}}, {0x1, 0x5, {0x0, 0x3eec}}, {0x1c0, 0xbe9, {0x3, 0x1}}, {0x46ef, 0x1ff, {0x1, 0xffff2ec8}}, {0x5, 0x7, {0x0, 0x15}}, {0x401, 0x8, {0x1, 0xfffffff8}}, {0x6, 0x7, {0x2, 0x80}}, {0x4, 0x0, {0x2, 0x3}}, {0x1, 0x1, {0x3}}]}}}, {{0x254, 0x1, {{0x2, 0x1}, 0x7, 0x8, 0x10, 0x7, 0x7, 'syz1\x00', "353ad168ebb7f04121d9258f75e7ab764d3dc38a48d6dfcaecb69fe5e32f3460", "cf039a5ca708094ea8c5bf3603b91b3b01e763ae98e6445f1a4921cb95b78639", [{0x7f, 0x400, {0x0, 0x4}}, {0x1000, 0x0, {0x0, 0x1}}, {0x2, 0xfffb, {0x1, 0xa26}}, {0x7, 0x8, {0x0, 0x160}}, {0xfff7, 0xb, {0x1, 0xb}}, {0x4, 0xb, {0x1, 0xffff0001}}, {0x4, 0x4, {0x1, 0x8}}, {0x5, 0x4, {0x0, 0x3}}, {0x5e, 0x2, {0x3, 0x8}}, {0x401, 0x7ff, {0x1, 0xfffffffc}}, {0x80, 0x5, {0x1, 0x5}}, {0xfff8, 0x16ad, {0x2, 0x3}}, {0x3, 0x4, {0x0, 0x2}}, {0x10, 0xfff, {0x1, 0xffff}}, {0x0, 0x6c, {0x0, 0x3}}, {0x5, 0x0, {0x1, 0x8}}, {0xf3c0, 0x3, {0x0, 0x3}}, {0xed89, 0x7, {0x3, 0x8}}, {0x40, 0xfee3, {0x3, 0x7}}, {0x1, 0xa6e, {0x1, 0x300000}}, {0x2, 0x5, {0x3, 0xd43}}, {0x200, 0x1, {0x3, 0x1000}}, {0x5, 0x0, {0x0, 0x8c0000}}, {0x8, 0xd255, {0x3, 0x9}}, {0x7, 0x101, {0x0, 0x3}}, {0x0, 0x81, {0x1, 0x7ff}}, {0x0, 0x8, {0x2, 0x9}}, {0xfff, 0x8, {0x1, 0x1}}, {0xd, 0x4, {0x1, 0x5}}, {0x10, 0x9, {0x0, 0xfffffff8}}, {0x0, 0x33, {0x2, 0x3}}, {0xa, 0x557, {0x1, 0x6}}, {0x7fff, 0x4, {0x2, 0x8f7e}}, {0x1c, 0x209, {0x3, 0x1}}, {0x7, 0x81, {0x3, 0xfffffffd}}, {0x401, 0x4, {0x1, 0x800}}, {0x1e, 0xfffc, {0x0, 0x513}}, {0x5, 0xfff, {0x0, 0x3}}, {0x7, 0x503, {0x0, 0x2}}, {0x2, 0x0, {0x1, 0x400}}]}}}]}, 0x4bc}, 0x1, 0x0, 0x0, 0x50}, 0x800) 1.148333012s ago: executing program 0 (id=41): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)={0x2, 0x6, 0x0, 0x7, 0x2}, 0x10}}, 0x0) recvmmsg(r0, &(0x7f0000006700)=[{{0x0, 0x0, 0x0}, 0x11}], 0x1, 0x10162, 0x0) 1.147991601s ago: executing program 0 (id=42): recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@rights={{0x10}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x30}, 0x80) r0 = openat$kvm(0xffffff9c, &(0x7f0000000540), 0x8000, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x7, 0xd, 0x5, '\x00', 0x6}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_GET_ONE_REG(0xffffffffffffffff, 0x4010aeab, &(0x7f00000002c0)=@riscv64_sbi_sta={0x803000000a000000, &(0x7f00000001c0)=0xfffffffffffffff9}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x75, 0x7f, 0x2, 0x3ff, 0x9, 0x8000000000000000, 0x5, 0x0, 0x4, 0xefffffffffffffff, 0x2000000000000000, 0x5, 0x8c], 0xeeee8000, 0x284a93}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.103052263s ago: executing program 0 (id=43): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000040)=@newsa={0x1ac, 0x10, 0x1, 0x0, 0x0, {{@in=@multicast2, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa0}, {@in=@broadcast, 0x0, 0x33}, @in=@local, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, {}, {0x0, 0x0, 0x1}, 0x0, 0x0, 0xa, 0x1}, [@replay_esn_val={0x1c, 0x17, {0x0, 0x0, 0x0, 0x0, 0x14, 0x4}}, @algo_crypt={0x95, 0x2, {{'ecb(des3_ede)\x00'}, 0x268, "301787d80d67b176945f4453441b436f94095439d00992ca6e2579e112d2094cc1fd935c94a840ad4b9fa2a49e1e849f0b60d5fab900f37ce8b5f76a813af0758f68f5cf65dafb03ee172f6e3c"}}, @sa_dir={0x5, 0x21, 0x1}]}, 0x1ac}}, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x80002, 0x0) write(r0, &(0x7f0000000240)="8f3cefea207cc29678239de705526f9adceb1038679aaa1fca26c82199ec844439309e26461ba7718eb7b09dc8639272f3ed16d051910e2682e313cbd8ad2fdeab3f3cb694459f74870a5cc1418de9f8f76243e13f8eeeacaeff2bbcd6d0ea08bfa8e6d2ee0f830f89f4f77dd6dfbcdea6e478cc629bb4ac71a3b67d6118dcc4", 0x80) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000200)={'\x00', 0x400}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000000)={'ip6gre0\x00', 0x0}) 1.069233354s ago: executing program 0 (id=44): madvise(&(0x7f000000f000/0x3000)=nil, 0x3000, 0x4) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}], 0x60}, 0x80) socket$key(0xf, 0x3, 0x2) clock_gettime(0xfffffffffffffffe, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r6 = dup(0xffffffffffffffff) syz_ublk_setup_queues(r6, r5, &(0x7f00000004c0)={0x0, 0x42cc, 0x10, 0xffffffff, 0x1d9}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe706, 0x80000, 0x1000002, 0x1b2, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x4, 0x3ab}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93e6, 0x2000, 0x4003bfff, 0x2b9, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x364, 0x800, 0x1, 0x230, 0x0, r3}}], 0x1, 0x0, 0x0) 988.424406ms ago: executing program 0 (id=45): r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040e60405000001010203010902200001010080320904000002080650000705810200020007050202"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x80040, 0x0) 498.193828ms ago: executing program 1 (id=46): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r0, 0xffffffffffffffff, 0x0) 479.496689ms ago: executing program 1 (id=47): ioprio_set$uid(0x3, 0x0, 0x0) (async) ioprio_set$uid(0x3, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x100000000009, 0xa, 0x0, 0x3}, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000080), 0x10b841, 0x0) (async) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080), 0x10b841, 0x0) pwritev2(r0, &(0x7f0000000600)=[{&(0x7f0000000580)="e5", 0x1}], 0x1, 0x1, 0xfffffffb, 0x1a) syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000000)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x2b73, 0x1b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x50, 0x16, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x2}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x85, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x3, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0}) syz_usb_connect$hid(0x5, 0x3f, &(0x7f00000000c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x8, 0x56a, 0x301, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0xd0, 0x7, "", [{{0x9, 0x4, 0x0, 0x2, 0x1, 0x3, 0x1, 0x3, 0x1, {0x9, 0x21, 0x1, 0x3, 0x1, {0x22, 0xb35}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x81, 0x6, 0x5f}}, [{{0x9, 0x5, 0x2, 0x3, 0x200, 0x1, 0xb, 0x8}}]}}}]}}]}}, &(0x7f0000000900)={0xa, &(0x7f0000000140)={0xa, 0x6, 0x310, 0x23, 0x94, 0xe, 0xff, 0x81}, 0x8, &(0x7f0000000180)={0x5, 0xf, 0x8, 0x1, [@ptm_cap={0x3}]}, 0xa, [{0xf4, &(0x7f00000001c0)=@string={0xf4, 0x3, "3cd774743d0eafac69070b93dd03f21d6fbb53da63df70de830a6cdb91e927f7dfd63b3171b0e686b67617c03804df07171fa441eb5866dadd255990a80488590de04e0365c528f4b658a1832a5e33568b91ca3eafc8c740e99b60900ba31089c61c7a9e998a9083218799ee4bcc98a6dd67e8b15105961976e7f776fcd65e04ba1cae50f3b253dc15a01c44dad1f2f19ff37e49e65bd7a264fa6b61d0397b35d430994b260c14fb967a34d999372291b245ccf53b2ad22268b31161aee683882afb84701cc02297d3bdc4c7c4f47d10db1d67a2e891b38e511360002ccd3255841135b56db9cf94977929f2c2a86de5f2f8"}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x446}}, {0x1d, &(0x7f0000000300)=@string={0x1d, 0x3, "eb5641303a60846862b0ab5c93c845509e7729e0975ffea1984079"}}, {0xee, &(0x7f0000000440)=@string={0xee, 0x3, "ffd906d495468c8cd88a99a4259e4d2171c1d83cd9a85407157b2e8735750d0438db8a3d1da24917dfba5da7db7d0a797f63897e29eea47c6a9e1793d9f517b716f8a35d6ee8f7dc386618124e7f2d2cba86c3a2746455ee4398e6b09c45532e6955f63142fd7ad7a69c781b7bfe85d5baf80e633096384e355b74e4c54053b95d54c74a778dd388c5da04a2f9fd6c28c893dbbcf856d35aaf6b15ed4f0ceb47d6594508d092122344a42f90d9e6911c778692f093f95d3644a18fd8094dc56d6e0dc720d848e0cfe3a9a893ff82c14ae684bc3838d4d8051ea964d5bb060d2802d0e5973a1084ea810bc25e"}}, {0xe8, &(0x7f0000000640)=@string={0xe8, 0x3, "2bfaa639ac3b3a6bcbc0c19584f7ae577cc2bb1b19bdf83b76cfe103c9f9053c94d913fd1ed278394fdabd2c903f56f5144d85a7467896ef7c43e059ad4628d1e4ed977a73999554193e5df06cedcea142a061f39e2bb22b16081f9f6dd31aaa33675fb0494bd74c17e9237f29101653b1659adda6d506d5ca4f5cc85c7d580d706d16d684e8d23e807a9d750ca78a5d1405efb233fbfd762911cc85486bb2edb4e05915b53d9b5006c49f0389090f39515af83796ef5dea328c9d873d57b8df7c36adf182e317ba5e1a178850e3687b7b40ae9fe3ec0f8a20b62ff44d27975f60acba9f222e"}}, {0xbb, &(0x7f0000000740)=@string={0xbb, 0x3, "fe6152fbc61b59edd184fae4191a3fdf0a94a0454a93822a642f4baebda474766f07e83d63fd56f52aa9c9fb5c029f7d865d49eb2b6857e022be024facc9c8e34204f6c7389219ea49b28b8b48cde754e71f52e8c4da0746aa5ed56795034cf5570387327f121527f8ffdbfb460075d22535bd8c45cb2237c0f140c3f2a5ba8e9cf518d3f3b107fda63dd52462e5bb0fc1cc4b81d82cee3e4332adeb81035184d2d561b63398ad8bb8209cc78d9b28561b7f8626eee7932edd"}}, {0x4, &(0x7f0000000800)=@lang_id={0x4, 0x3, 0x41f}}, {0x4, &(0x7f0000000840)=@lang_id={0x4, 0x3, 0x40b}}, {0x4, &(0x7f0000000880)=@lang_id={0x4, 0x3, 0xc01}}, {0x4, &(0x7f00000008c0)=@lang_id={0x4, 0x3, 0x40f}}]}) syz_usb_connect$uac2(0x2, 0xd4, &(0x7f00000009c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x582, 0x121, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xc2, 0x3, 0x1, 0x2d, 0x20, 0x9, {0x8, 0xb, 0x0, 0x2, 0x1, 0x6, 0x20, 0x6b}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0xc, 0x6, 0x11, 0x3}, [@extension_unit={0x8, 0x24, 0x9, 0x3, 0x7c4, 0x61, "ed"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x0, 0x2, 0x9, 0x8}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x0, 0x3, 0xd4, 0x8, 0xe0}]}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0x8, 0x81, 0x4, {0x8, 0x25, 0x1, 0x0, 0x39, 0x2, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x2}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x3, 0x10}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x2, 0x1, 0x3, 0x3, 0x3d}, @as_header={0x10, 0x24, 0x1, 0x2, 0x5, 0x3e6b42342a0c7bf5, 0x4, 0xd3, 0xfffffffb, 0x3}, @as_header={0x10, 0x24, 0x1, 0x2d, 0x3, 0x1, 0x3, 0x9, 0x5, 0x10}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x200, 0x100, 0x5, 0x2}]}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x40, 0x4, 0x0, {0x8, 0x25, 0x1, 0x1, 0x33, 0x0, 0x5}}}}}}}}]}}, &(0x7f0000000f00)={0xa, &(0x7f0000000ac0)={0xa, 0x6, 0x201, 0x0, 0x8, 0x3, 0x40, 0x7}, 0xdd, &(0x7f0000000b00)={0x5, 0xf, 0xdd, 0x6, [@generic={0xaa, 0x10, 0x3, "a6c9c34e5d33e781b70db8a704fddc5b918a07f2e9e71b9e6c5cf45a235ea0b4ba3cadb94b7d45b0482827d94cfcf1569e1e4e819693f28cc608780dcdfb8137334a527069ab5cbc1097006eb247c548fb4d6487b11e356439da04221d145d4fc90081e6176812dd06a4a49a5bcb333385eb6f28e3876a469557e754a7713608678e27c65da6874c1bc3cd6cfa106312ed695c456e10c061b7f79b6c67f89ac003b06b3902bb90"}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x2, 0x7, 0x9, 0x5}, @ssp_cap={0x10, 0x10, 0xa, 0x0, 0x1, 0x8, 0x0, 0x7f, [0xc007]}, @ext_cap={0x7, 0x10, 0x2, 0x1c, 0xd, 0xf, 0x1}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x8, 0xf, 0x3, 0x400}, @ptm_cap={0x3}]}, 0x6, [{0x95, &(0x7f0000000c00)=@string={0x95, 0x3, "fe1c5c60201404b261f43a31969e9b79cb1786638807bd08f68be04dc5d17820c22b10b67d268468309a4f87c74844e7fabf97cdbf85d942f9fb1a8019b289420604f55a8a3c972d4c49f5bd504d15b2cc6260f0302416e466be25df7112b8780fb352b24b87fdefaa2999a34fe40b57332c2a2ec6653dc96c88119fb333377c264d7b36c737710f57a6d665479130a24b192b"}}, {0x9d, &(0x7f0000000cc0)=@string={0x9d, 0x3, "bc966913f2b29cd483a37ba9f845312bc09c444176417753dfdd59437f3f30cd5cd1ba51ce65ae60136432dad01f9cf6eed36b3abc51b4e2726b390242d7219ef30543785f6ea6b02fe268ecc0a4cae3fdf4c5cc28234d094da92f344117ae372d36e8b9e031dc656351646842ac7d85d29f00d7d8ae5e66e1f6b98cf6697a8afbca93434114ff8322c86b53f9cd0a64d1b9da3e81ad52302e7ad3"}}, {0x3a, &(0x7f0000000d80)=@string={0x3a, 0x3, "f3378d386ee3e6b043ee19ba2b5f39937ea6b565fe5f62d26b2ddd42577b93364b9aca8b5043d9dcbb456f2debb15b492eb82e8e8acecfc8"}}, {0x4, &(0x7f0000000dc0)=@lang_id={0x4, 0x3, 0x827}}, {0x4, &(0x7f0000000e00)=@lang_id={0x4, 0x3, 0x429}}, {0x9d, &(0x7f0000000e40)=@string={0x9d, 0x3, "374e484324b407c9ed6f2807c5113d20cae7d702fb6bf7fbc6ceb9ecb2d7c5f9326ed3aadd50e6c4e35dc7b979feb797510f75b95c581e941de2b35136a32e4a7a49c13b19ff347ec80abd0c5e07fd480b945e1c0f87a00fbb984a04e50b29cdd66a3504ac09f22c0b02bc47b1316fa6cadfb442a039d77dc4a7995ae1f3432f8e5f928842e4b2afd04a5a9202b66bf7af14969835deb2b0a4bc77"}}]}) 372.268431ms ago: executing program 2 (id=48): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40004}, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = dup(r0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r3 = openat$cgroup_int(r2, &(0x7f0000000080)='cpuset.memory_spread_page\x00', 0x2, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = dup(r5) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r5, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, &(0x7f0000000080)="0f2124660fc734650f01d566b9a601000066b80f03000066ba000000000f30b8ff068ed8baa000ed8904f20f3066b9800000c00f326635001000000f30baf80c66b85ce2ce8366efbafc0c66ed", 0x4d}], 0x1, 0x3f, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) write$cgroup_int(r3, &(0x7f00000000c0)=0xd, 0x12) mkdirat$cgroup(r2, &(0x7f00000001c0)='syz1\x00', 0x1ff) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0xffffffff, 0x1000, &(0x7f0000003000/0x1000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r1, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0x4b, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f00000002c0)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000040)={0x8080000, 0x10e000}) ioctl$KVM_RUN(r8, 0xae80, 0x0) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) futex(0x0, 0x10d, 0x0, 0x0, 0x0, 0x0) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) ioctl$PAGEMAP_SCAN(r6, 0xc0606610, &(0x7f0000000200)={0x60, 0x3, &(0x7f0000280000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, 0x1, &(0x7f0000000140)=[{0x80000001, 0x8, 0x5}, {0x5, 0xc9d, 0x4}], 0x2, 0x1, 0x1, 0x27, 0x10, 0x20}) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000180)={@loopback, 0x800, 0x0, 0x3, 0x1, 0x80}, 0x20) setuid(0xee00) 260.142284ms ago: executing program 2 (id=49): add_key$fscrypt_v1(0x0, &(0x7f0000000040)={'fscrypt:', @desc1}, &(0x7f0000000080)={0x0, "4d0916cb7a186d2a2e55ba48ad3f796547502777ff87f76b395c692150689bb4a628a9f3aa873e97ebd2a2089456afed727eaa0e6eaaad8669a20c12ac48c3fc", 0x2f}, 0x48, 0xffffffffffffffff) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x1, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x1000000000, 0x5, 0x41, 0x2000000, 0x0, 0x2004cb, 0x0, 0xa1d, 0x2000000068ff, 0x5, 0x0, 0x3, 0x2], 0x10000, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000100)={{0xd000, 0x0, 0x4, 0x0, 0x8, 0x0, 0x0, 0x3, 0x0, 0x8, 0x6, 0x40}, {0xffffffff, 0x10000, 0xa, 0x3, 0x2, 0x0, 0x0, 0x0, 0x7, 0xff}, {0xe6ee2000, 0x3000, 0xc, 0x0, 0x8, 0xc4, 0x0, 0x0, 0x48, 0x3, 0x0, 0xfc}, {0xeeef0000, 0xeee96000, 0xa, 0x0, 0x1, 0xa6, 0x9, 0x0, 0x8, 0xfe, 0x7, 0x4}, {0xf000, 0xffff1000, 0xe, 0x0, 0x0, 0x4, 0x0, 0xfd, 0x0, 0x3c}, {0x8000000, 0x0, 0xb, 0x78, 0x5, 0x83, 0x0, 0x0, 0x3, 0xff, 0x1}, {0x0, 0xeeee0000, 0xa, 0x4, 0x0, 0x0, 0xa1, 0x20, 0x0, 0x0, 0x8}, {0x81a0002, 0x6000, 0xf, 0x0, 0x0, 0x5, 0x8, 0x40, 0x26, 0x0, 0x0, 0x2}, {0x41000, 0x8cc}, {0xdddd1000}, 0xddf8ffdb, 0x0, 0x0, 0x114, 0xd, 0x0, 0x0, [0x80000005, 0x8, 0x1]}) ioctl$KVM_RUN(r2, 0xae80, 0x300) 229.762835ms ago: executing program 3 (id=50): r0 = socket$inet6(0xa, 0x80002, 0xffff) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) (async) r1 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x20000, 0x80, 0x25}, 0x18) openat(r1, &(0x7f0000000080)='./file0\x00', 0xa041, 0x1d0) (async) connect$inet6(r0, &(0x7f0000002140)={0xa, 0x4e28, 0x9, @mcast1, 0x5}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000002b80)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000740)={0xa, 0x4e21, 0x5, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x28}}, 0xffffffff}, 0x1c, 0x0}}, {{0x0, 0x0, 0x0}}], 0x3, 0x4001c00) 164.295306ms ago: executing program 3 (id=51): recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@rights={{0x10}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x30}, 0x80) r0 = openat$kvm(0xffffff9c, &(0x7f0000000540), 0x8000, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x7, 0xd, 0x5, '\x00', 0x6}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_GET_ONE_REG(0xffffffffffffffff, 0x4010aeab, &(0x7f00000002c0)=@riscv64_sbi_sta={0x803000000a000000, &(0x7f00000001c0)=0xfffffffffffffff9}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x75, 0x7f, 0x2, 0x3ff, 0x9, 0x8000000000000000, 0x5, 0x0, 0x4, 0xefffffffffffffff, 0x2000000000000000, 0x5, 0x8c], 0xeeee8000, 0x284a93}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 164.066036ms ago: executing program 2 (id=52): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000300)={0x0, 0x0, 0xffe00000, 0x200000, &(0x7f0000200000/0x200000)=nil}) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/tty/ldiscs\x00', 0x1800, 0x0) preadv2(r3, &(0x7f0000000480)=[{&(0x7f0000000380)=""/46, 0x2e}], 0x1, 0x1, 0x9, 0x2) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0xffe00000, 0x200000, &(0x7f0000200000/0x200000)=nil}) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:05.0/remove\x00', 0x1, 0x0) write(r4, &(0x7f00000002c0)='9', 0x1) 140.338917ms ago: executing program 3 (id=53): madvise(&(0x7f000000f000/0x3000)=nil, 0x3000, 0x4) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}], 0x60}, 0x80) socket$key(0xf, 0x3, 0x2) clock_gettime(0xfffffffffffffffe, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, 0x0, &(0x7f00000004c0)={0x0, 0x42cc, 0x10, 0xffffffff, 0x1d9}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe706, 0x80000, 0x1000002, 0x1b2, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x4, 0x3ab}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93e6, 0x2000, 0x4003bfff, 0x2b9, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x364, 0x800, 0x1, 0x230, 0x0, r3}}], 0x1, 0x0, 0x0) 104.770968ms ago: executing program 3 (id=54): sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) shutdown(r0, 0x1) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x22}}, 0x10}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x7fff, @ipv4={'\x00', '\xff\xff', @local}, 0x80000106}, 0x1c) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000580)="580000001400192340834b80040d8c560a067fbc45ff810500004000070058000b480400945f640094272d7061d328b92d0000000000008000f0fffeffe809000000fff5dd00000010000100050808004149004001040800", 0x58}], 0x1) ptrace(0x10, r1) ptrace$getregs(0xe, r1, 0x7fffffff, &(0x7f0000000300)=""/138) socket$inet6_tcp(0xa, 0x1, 0x0) openat$rtc(0xffffff9c, &(0x7f0000000040), 0xc2440, 0x0) 60.883239ms ago: executing program 2 (id=55): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r0, 0xffffffffffffffff, 0x0) 55.997059ms ago: executing program 3 (id=56): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x0) sendto(r0, &(0x7f0000000180)="32532e4526bd4f5c59fddc7d0a348d22f1c6ba022649ed1c0ea7115aff4401751c9e80e7231b7013b5bcc2d80b7c1ac99028756a0dc87544617ba4c783d58f7f4db81d12c1c2da31e67b0ee6a1e949c7d3d71736aeaa7729c98a7822801dd6e8a9b427154c5dc9a2676460b0fc8f7a7521fb138942a715", 0x77, 0x1, &(0x7f0000000280)=@pppol2tpv3in6={0x18, 0x1, {0x0, r1, 0x0, 0x1, 0x0, 0x2, {0xa, 0x4e22, 0xb, @local, 0xb}}}, 0x80) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) (fail_nth: 8) 0s ago: executing program 2 (id=57): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40004}, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = dup(r0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_int(r2, 0x0, 0x2, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = dup(r5) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r5, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, &(0x7f0000000080)="0f2124660fc734650f01d566b9a601000066b80f03000066ba000000000f30b8ff068ed8baa000ed8904f20f3066b9800000c00f326635001000000f30baf80c66b85ce2ce8366efbafc0c66ed", 0x4d}], 0x1, 0x3f, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) write$cgroup_int(r3, &(0x7f00000000c0)=0xd, 0x12) mkdirat$cgroup(r2, &(0x7f00000001c0)='syz1\x00', 0x1ff) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0xffffffff, 0x1000, &(0x7f0000003000/0x1000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r1, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0x4b, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f00000002c0)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000040)={0x8080000, 0x10e000}) ioctl$KVM_RUN(r8, 0xae80, 0x0) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) futex(0x0, 0x10d, 0x0, 0x0, 0x0, 0x0) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) ioctl$PAGEMAP_SCAN(r6, 0xc0606610, &(0x7f0000000200)={0x60, 0x3, &(0x7f0000280000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, 0x1, &(0x7f0000000140)=[{0x80000001, 0x8, 0x5}, {0x5, 0xc9d, 0x4}], 0x2, 0x1, 0x1, 0x27, 0x10, 0x20}) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000180)={@loopback, 0x800, 0x0, 0x3, 0x1, 0x80}, 0x20) setuid(0xee00) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.167' (ED25519) to the list of known hosts. [ 24.150115][ T36] audit: type=1400 audit(1788313215.340:64): avc: denied { mounton } for pid=287 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 24.153791][ T287] cgroup: Unknown subsys name 'net' [ 24.173008][ T36] audit: type=1400 audit(1788313215.340:65): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.200247][ T36] audit: type=1400 audit(1788313215.370:66): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.200776][ T287] cgroup: Unknown subsys name 'devices' [ 24.326024][ T287] cgroup: Unknown subsys name 'hugetlb' [ 24.331649][ T287] cgroup: Unknown subsys name 'rlimit' [ 24.427875][ T36] audit: type=1400 audit(1788313215.620:67): avc: denied { setattr } for pid=287 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 24.451068][ T36] audit: type=1400 audit(1788313215.620:68): avc: denied { mounton } for pid=287 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 24.475946][ T36] audit: type=1400 audit(1788313215.620:69): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 24.494320][ T289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 24.507913][ T36] audit: type=1400 audit(1788313215.700:70): avc: denied { relabelto } for pid=289 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.533327][ T36] audit: type=1400 audit(1788313215.700:71): avc: denied { write } for pid=289 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.541166][ T287] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 24.559684][ T36] audit: type=1400 audit(1788313215.730:72): avc: denied { read } for pid=287 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.593210][ T36] audit: type=1400 audit(1788313215.730:73): avc: denied { open } for pid=287 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.502336][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.509480][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.516669][ T294] bridge_slave_0: entered allmulticast mode [ 25.523020][ T294] bridge_slave_0: entered promiscuous mode [ 25.529626][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.536732][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.543871][ T294] bridge_slave_1: entered allmulticast mode [ 25.550132][ T294] bridge_slave_1: entered promiscuous mode [ 25.578469][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.585645][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.592745][ T297] bridge_slave_0: entered allmulticast mode [ 25.599087][ T297] bridge_slave_0: entered promiscuous mode [ 25.608472][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.615578][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.622660][ T297] bridge_slave_1: entered allmulticast mode [ 25.629014][ T297] bridge_slave_1: entered promiscuous mode [ 25.677441][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.684567][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.691763][ T295] bridge_slave_0: entered allmulticast mode [ 25.698117][ T295] bridge_slave_0: entered promiscuous mode [ 25.707255][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.714338][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.721400][ T295] bridge_slave_1: entered allmulticast mode [ 25.727726][ T295] bridge_slave_1: entered promiscuous mode [ 25.733748][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.740793][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.747907][ T296] bridge_slave_0: entered allmulticast mode [ 25.754203][ T296] bridge_slave_0: entered promiscuous mode [ 25.763368][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.770448][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.777549][ T296] bridge_slave_1: entered allmulticast mode [ 25.783886][ T296] bridge_slave_1: entered promiscuous mode [ 25.934392][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.941466][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.948787][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.955861][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.965716][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.972770][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.980088][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.987138][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.000499][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.007603][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.014935][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.021977][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.031304][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.038375][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.045718][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.052760][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.108558][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.116110][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.123290][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.130710][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.138409][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.145739][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.152970][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.189443][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.196555][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.204459][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.211520][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.221222][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.228333][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.236671][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.243746][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.251502][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.258581][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.270716][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.277806][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.294952][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.302006][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.329602][ T294] veth0_vlan: entered promiscuous mode [ 26.343214][ T296] veth0_vlan: entered promiscuous mode [ 26.364275][ T294] veth1_macvtap: entered promiscuous mode [ 26.390070][ T295] veth0_vlan: entered promiscuous mode [ 26.396987][ T297] veth0_vlan: entered promiscuous mode [ 26.406035][ T296] veth1_macvtap: entered promiscuous mode [ 26.433386][ T297] veth1_macvtap: entered promiscuous mode [ 26.443200][ T294] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 26.466319][ T295] veth1_macvtap: entered promiscuous mode [ 26.502291][ T314] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 26.549193][ T314] FAULT_INJECTION: forcing a failure. [ 26.549193][ T314] name failslab, interval 1, probability 0, space 0, times 1 [ 26.572198][ T314] CPU: 0 UID: 0 PID: 314 Comm: syz.3.4 Not tainted syzkaller #0 018ff8b15f97deb4d6c6217ad3b2c61971603935 [ 26.572232][ T314] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.572256][ T314] Call Trace: [ 26.572264][ T314] [ 26.572272][ T314] __dump_stack+0x21/0x30 [ 26.572318][ T314] dump_stack_lvl+0x140/0x1c0 [ 26.572351][ T314] ? __cfi_dump_stack_lvl+0x10/0x10 [ 26.572383][ T314] ? futex_wait+0x2b8/0x7c0 [ 26.572406][ T314] ? __cfi_futex_wait+0x10/0x10 [ 26.572429][ T314] dump_stack+0x19/0x20 [ 26.572471][ T314] should_fail_ex+0x3c2/0x510 [ 26.572500][ T314] should_failslab+0xac/0x100 [ 26.572548][ T314] kmem_cache_alloc_noprof+0x42/0x410 [ 26.572573][ T314] ? do_futex+0x32a/0x510 [ 26.572605][ T314] ? getname_flags+0xcc/0x6b0 [ 26.572632][ T314] getname_flags+0xcc/0x6b0 [ 26.572659][ T314] getname+0x1b/0x30 [ 26.572683][ T314] do_sys_openat2+0xda/0x1d0 [ 26.572716][ T314] ? fput+0x1a4/0x230 [ 26.572755][ T314] ? do_sys_open+0x100/0x100 [ 26.572790][ T314] __x64_sys_openat+0x13a/0x170 [ 26.572826][ T314] x64_sys_call+0xe69/0x2ee0 [ 26.572844][ T314] do_syscall_64+0x57/0xf0 [ 26.572872][ T314] ? clear_bhb_loop+0x50/0xa0 [ 26.572894][ T314] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 26.572915][ T314] RIP: 0033:0x7f78cfb9e159 [ 26.572935][ T314] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 26.572951][ T314] RSP: 002b:00007f78d0a5c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 26.572979][ T314] RAX: ffffffffffffffda RBX: 00007f78cfe25fa0 RCX: 00007f78cfb9e159 [ 26.572994][ T314] RDX: 00000000000a2f01 RSI: 00002000000001c0 RDI: ffffffffffffff9c [ 26.573008][ T314] RBP: 00007f78cfc35024 R08: 0000000000000000 R09: 0000000000000000 [ 26.573020][ T314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 26.573032][ T314] R13: 00007f78cfe26038 R14: 00007f78cfe25fa0 R15: 00007ffc1d469548 [ 26.573048][ T314] [ 26.924534][ T46] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 27.103661][ T31] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 27.193615][ T46] usb 2-1: Using ep0 maxpacket: 32 [ 27.210636][ T46] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 27.225256][ T46] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 27.241002][ T46] usb 2-1: too many endpoints for config 1 interface 1 altsetting 239: 255, using maximum allowed: 30 [ 27.263266][ T31] usb 1-1: unable to get BOS descriptor or descriptor too short [ 27.271186][ T46] usb 2-1: config 1 interface 1 altsetting 239 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 27.285714][ T31] usb 1-1: not running at top speed; connect to a high speed hub [ 27.297905][ T46] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 27.307923][ T31] usb 1-1: config index 0 descriptor too short (expected 26403, got 35) [ 27.321286][ T31] usb 1-1: config 169 has too many interfaces: 60, using maximum allowed: 32 [ 27.330256][ T46] usb 2-1: config 1 interface 1 has no altsetting 0 [ 27.339791][ T31] usb 1-1: config 169 has an invalid interface number: 81 but max is 59 [ 27.348603][ T31] usb 1-1: config 169 has 1 interface, different from the descriptor's value: 60 [ 27.359145][ T31] usb 1-1: config 169 has no interface number 0 [ 27.365658][ T31] usb 1-1: config 169 interface 81 altsetting 215 endpoint 0x7 has invalid maxpacket 14848, setting to 64 [ 27.377226][ T46] usb 2-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 27.387335][ T46] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.395521][ T31] usb 1-1: config 169 interface 81 has no altsetting 0 [ 27.402514][ T46] usb 2-1: Product: syz [ 27.406919][ T46] usb 2-1: Manufacturer: syz [ 27.411615][ T46] usb 2-1: SerialNumber: syz [ 27.417551][ T31] usb 1-1: New USB device found, idVendor=0499, idProduct=7862, bcdDevice=3b.d1 [ 27.430985][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.439333][ T31] usb 1-1: Product: syz [ 27.443689][ T31] usb 1-1: Manufacturer: syz [ 27.448319][ T31] usb 1-1: SerialNumber: syz [ 27.459112][ T320] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 27.642570][ T318] netlink: 'syz.1.2': attribute type 46 has an invalid length. [ 27.652366][ T46] usb 2-1: selecting invalid altsetting 0 [ 27.703426][ T313] udevd[313]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:169.81/sound/card1/controlC1/../uevent} for writing: No such file or directory [ 27.719833][ T31] usb 1-1: USB disconnect, device number 2 [ 27.813968][ T9] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 27.879460][ T343] ======================================================= [ 27.879460][ T343] WARNING: The mand mount option has been deprecated and [ 27.879460][ T343] and is ignored by this kernel. Remove the mand [ 27.879460][ T343] option from the mount to silence this warning. [ 27.879460][ T343] ======================================================= [ 27.916768][ T343] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 28.024595][ T9] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 28.034464][ T9] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 28.055311][ T9] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 28.064554][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 28.072745][ T9] usb 4-1: Product: syz [ 28.077193][ T9] usb 4-1: Manufacturer: syz [ 28.081827][ T9] usb 4-1: SerialNumber: syz [ 28.289981][ T350] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 28.303796][ T350] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 28.305351][ T334] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 28.346687][ T334] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 28.482127][ T9] usblp 4-1:1.0: usblp0: USB Unidirectional printer dev 2 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 28.758662][ T46] usb 4-1: USB disconnect, device number 2 [ 28.769238][ T46] usblp0: removed [ 28.803671][ T31] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 28.954725][ T31] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 248, using maximum allowed: 30 [ 28.965624][ T31] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 248 [ 28.978845][ T31] usb 1-1: New USB device found, idVendor=056a, idProduct=003f, bcdDevice= 0.00 [ 28.987979][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.996764][ T31] usb 1-1: config 0 descriptor?? [ 29.320999][ T36] kauditd_printk_skb: 70 callbacks suppressed [ 29.321018][ T36] audit: type=1400 audit(1788313220.510:144): avc: denied { write } for pid=364 comm="syz.3.14" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 29.321311][ T365] netlink: 80 bytes leftover after parsing attributes in process `syz.3.14'. [ 29.333692][ T36] audit: type=1400 audit(1788313220.510:145): avc: denied { nlmsg_write } for pid=364 comm="syz.3.14" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 29.413480][ T31] wacom 0003:056A:003F.0001: item fetching failed at offset 6/40 [ 29.425475][ T31] wacom 0003:056A:003F.0001: parse failed [ 29.431385][ T31] wacom 0003:056A:003F.0001: probe with driver wacom failed with error -22 [ 29.588771][ T36] audit: type=1400 audit(1788313220.780:146): avc: denied { unmount } for pid=297 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 29.608855][ T31] usb 2-1: USB disconnect, device number 2 [ 29.638606][ T46] usb 1-1: USB disconnect, device number 3 [ 29.653675][ T36] audit: type=1400 audit(1788313220.840:147): avc: denied { setopt } for pid=372 comm="syz.1.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 29.703433][ T36] audit: type=1400 audit(1788313220.840:148): avc: denied { read } for pid=372 comm="syz.1.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 29.794971][ T36] audit: type=1400 audit(1788313220.990:149): avc: denied { append } for pid=389 comm="syz.3.21" name="001" dev="devtmpfs" ino=114 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 29.849449][ T36] audit: type=1400 audit(1788313221.040:150): avc: denied { read write } for pid=394 comm="syz.2.23" name="vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 29.882638][ T36] audit: type=1400 audit(1788313221.040:151): avc: denied { open } for pid=394 comm="syz.2.23" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 29.907145][ T36] audit: type=1400 audit(1788313221.070:152): avc: denied { read write } for pid=394 comm="syz.2.23" name="fuse" dev="devtmpfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 29.930582][ T36] audit: type=1400 audit(1788313221.070:153): avc: denied { open } for pid=394 comm="syz.2.23" path="/dev/fuse" dev="devtmpfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 30.083663][ T9] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 30.234664][ T9] usb 2-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 30.244920][ T9] usb 2-1: config 8 has 0 interfaces, different from the descriptor's value: 1 [ 30.262905][ T9] usb 2-1: New USB device found, idVendor=a6da, idProduct=7458, bcdDevice=2d.4d [ 30.272097][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.280238][ T10] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 30.287940][ T9] usb 2-1: Product: syz [ 30.292136][ T9] usb 2-1: Manufacturer: syz [ 30.298237][ T9] usb 2-1: SerialNumber: syz [ 30.443650][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 30.450208][ T10] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 30.460588][ T10] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 30.469674][ T10] usb 4-1: too many endpoints for config 1 interface 1 altsetting 239: 255, using maximum allowed: 30 [ 30.480878][ T10] usb 4-1: config 1 interface 1 altsetting 239 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 30.494328][ T10] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 30.504061][ T10] usb 4-1: config 1 interface 1 has no altsetting 0 [ 30.519372][ T10] usb 4-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 30.528971][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.537084][ T10] usb 4-1: Product: syz [ 30.541511][ T10] usb 4-1: Manufacturer: syz [ 30.546217][ T10] usb 4-1: SerialNumber: syz [ 30.638127][ T421] SELinux: Context system_u:object_r:auditd_initrc_exec_t:s0 is not valid (left unmapped). [ 30.754926][ T402] netlink: 'syz.3.25': attribute type 46 has an invalid length. [ 30.764167][ T10] usb 4-1: selecting invalid altsetting 0 [ 30.933670][ T46] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 31.094692][ T46] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 31.105622][ T46] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x8 has invalid wMaxPacketSize 0 [ 31.116789][ T46] usb 3-1: New USB device found, idVendor=2a39, idProduct=3fd2, bcdDevice= 0.40 [ 31.125886][ T46] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 31.133969][ T46] usb 3-1: Product: syz [ 31.138154][ T46] usb 3-1: Manufacturer: syz [ 31.142779][ T46] usb 3-1: SerialNumber: syz [ 31.353524][ T423] overlayfs: conflicting options: metacopy=on,redirect_dir=follow [ 31.355498][ T46] usb 3-1: MIDIStreaming interface descriptor not found [ 31.371916][ T46] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -12 [ 31.383219][ T46] usb 3-1: USB disconnect, device number 2 [ 31.392476][ T425] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 31.401096][ T425] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 31.414675][ T319] udevd[319]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card1/controlC1/../uevent} for writing: No such file or directory [ 31.897780][ T442] kvm: kvm [441]: vcpu2, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010058) = 0xfff [ 31.969653][ T445] netlink: 'syz.2.39': attribute type 4 has an invalid length. [ 32.503662][ T46] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 32.655101][ T46] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 32.664998][ T46] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 32.676903][ T46] usb 1-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 32.686332][ T46] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.694574][ T46] usb 1-1: Product: syz [ 32.698927][ T46] usb 1-1: Manufacturer: syz [ 32.704076][ T46] usb 1-1: SerialNumber: syz [ 32.711775][ T46] ums-sddr09 1-1:1.0: USB Mass Storage device detected [ 32.728784][ T46] ums-sddr09 1-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 32.728784][ T46] Please send a copy of this message to and [ 32.781258][ T9] usb 2-1: USB disconnect, device number 3 [ 33.044400][ T31] usb 4-1: USB disconnect, device number 3 [ 33.123663][ T9] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 33.155952][ T46] ums-sddr09 1-1:1.0: probe with driver ums-sddr09 failed with error -32 [ 33.173881][ T46] usb 1-1: USB disconnect, device number 4 [ 33.248308][ T490] FAULT_INJECTION: forcing a failure. [ 33.248308][ T490] name failslab, interval 1, probability 0, space 0, times 0 [ 33.261066][ T490] CPU: 0 UID: 0 PID: 490 Comm: syz.3.56 Not tainted syzkaller #0 018ff8b15f97deb4d6c6217ad3b2c61971603935 [ 33.261097][ T490] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 33.261108][ T490] Call Trace: [ 33.261114][ T490] [ 33.261121][ T490] __dump_stack+0x21/0x30 [ 33.261152][ T490] dump_stack_lvl+0x140/0x1c0 [ 33.261177][ T490] ? __cfi_dump_stack_lvl+0x10/0x10 [ 33.261202][ T490] ? __kasan_check_write+0x18/0x20 [ 33.261221][ T490] ? down_write+0xee/0x2b0 [ 33.261244][ T490] dump_stack+0x19/0x20 [ 33.261267][ T490] should_fail_ex+0x3c2/0x510 [ 33.261289][ T490] should_failslab+0xac/0x100 [ 33.261312][ T490] __kmalloc_cache_noprof+0x41/0x470 [ 33.261331][ T490] ? cgroup_mkdir+0xbe2/0x1600 [ 33.261355][ T490] cgroup_mkdir+0xbe2/0x1600 [ 33.261378][ T490] ? __cfi_cgroup_mkdir+0x10/0x10 [ 33.261399][ T490] kernfs_iop_mkdir+0x1bb/0x2d0 [ 33.261425][ T490] vfs_mkdir+0x591/0x810 [ 33.261451][ T490] do_mkdirat+0x240/0x530 [ 33.261476][ T490] ? __cfi_do_mkdirat+0x10/0x10 [ 33.261501][ T490] ? __kasan_check_write+0x18/0x20 [ 33.261526][ T490] ? getname_flags+0x203/0x6b0 [ 33.261557][ T490] ? __kasan_check_read+0x15/0x20 [ 33.261575][ T490] __x64_sys_mkdirat+0x8b/0xa0 [ 33.261599][ T490] x64_sys_call+0x2ba8/0x2ee0 [ 33.261615][ T490] do_syscall_64+0x57/0xf0 [ 33.261640][ T490] ? clear_bhb_loop+0x50/0xa0 [ 33.261664][ T490] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 33.261683][ T490] RIP: 0033:0x7f78cfb9e159 [ 33.261698][ T490] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 33.261712][ T490] RSP: 002b:00007f78d0a5c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 33.261732][ T490] RAX: ffffffffffffffda RBX: 00007f78cfe25fa0 RCX: 00007f78cfb9e159 [ 33.261745][ T490] RDX: 0000000000000777 RSI: 0000200000000000 RDI: ffffffffffffff9c [ 33.261757][ T490] RBP: 00007f78d0a5c090 R08: 0000000000000000 R09: 0000000000000000 [ 33.261768][ T490] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 33.261779][ T490] R13: 00007f78cfe26038 R14: 00007f78cfe25fa0 R15: 00007ffc1d469548 [ 33.261794][ T490] [ 33.261887][ T490] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000021: 0000 [#1] PREEMPT SMP KASAN PTI [ 33.491844][ T490] KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f] [ 33.500273][ T490] CPU: 0 UID: 0 PID: 490 Comm: syz.3.56 Not tainted syzkaller #0 018ff8b15f97deb4d6c6217ad3b2c61971603935 [ 33.511575][ T490] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 33.521912][ T490] RIP: 0010:cgroup_mkdir+0x122a/0x1600 [ 33.527502][ T490] Code: eb 05 e8 79 4d 08 00 48 89 df e8 11 9e 00 00 48 81 fb 01 f0 ff ff 0f 83 9a fb ff ff 4c 8d b3 08 01 00 00 4d 89 f4 49 c1 ec 03 <43> 80 3c 2c 00 74 08 4c 89 f7 e8 b7 27 61 00 48 8b bb 08 01 00 00 [ 33.547125][ T490] RSP: 0018:ffffc9000d887c88 EFLAGS: 00010206 [ 33.553208][ T490] RAX: e56d21bb7819b500 RBX: 0000000000000000 RCX: ffff8881f6e3acc0 [ 33.561196][ T490] RDX: ffff8881134a5980 RSI: ffff88811ab8f000 RDI: ffff888100042000 [ 33.569185][ T490] RBP: ffffc9000d887d38 R08: ffffffff81dc02b8 R09: ffffffff81e01f9f [ 33.577177][ T490] R10: ffffffff81e04a84 R11: ffffffff81e01abe R12: 0000000000000021 [ 33.585177][ T490] R13: dffffc0000000000 R14: 0000000000000108 R15: ffff88811ab8f010 [ 33.593162][ T490] FS: 00007f78d0a5c6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 33.602105][ T490] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 33.608704][ T490] CR2: 00007f78cfa70050 CR3: 0000000119b4c000 CR4: 00000000003526b0 [ 33.616692][ T490] Call Trace: [ 33.619995][ T490] [ 33.622952][ T490] ? __cfi_cgroup_mkdir+0x10/0x10 [ 33.628000][ T490] kernfs_iop_mkdir+0x1bb/0x2d0 [ 33.632880][ T490] vfs_mkdir+0x591/0x810 [ 33.637150][ T490] do_mkdirat+0x240/0x530 [ 33.641508][ T490] ? __cfi_do_mkdirat+0x10/0x10 [ 33.646379][ T490] ? __kasan_check_write+0x18/0x20 [ 33.651506][ T490] ? getname_flags+0x203/0x6b0 [ 33.656286][ T490] ? __kasan_check_read+0x15/0x20 [ 33.661326][ T490] __x64_sys_mkdirat+0x8b/0xa0 [ 33.666138][ T490] x64_sys_call+0x2ba8/0x2ee0 [ 33.670828][ T490] do_syscall_64+0x57/0xf0 [ 33.675269][ T490] ? clear_bhb_loop+0x50/0xa0 [ 33.679965][ T490] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 33.685890][ T490] RIP: 0033:0x7f78cfb9e159 [ 33.690341][ T490] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 33.709959][ T490] RSP: 002b:00007f78d0a5c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 33.718385][ T490] RAX: ffffffffffffffda RBX: 00007f78cfe25fa0 RCX: 00007f78cfb9e159 [ 33.726370][ T490] RDX: 0000000000000777 RSI: 0000200000000000 RDI: ffffffffffffff9c [ 33.734356][ T490] RBP: 00007f78d0a5c090 R08: 0000000000000000 R09: 0000000000000000 [ 33.742339][ T490] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 33.750321][ T490] R13: 00007f78cfe26038 R14: 00007f78cfe25fa0 R15: 00007ffc1d469548 [ 33.758327][ T490] [ 33.761363][ T490] Modules linked in: [ 33.765483][ T490] ---[ end trace 0000000000000000 ]--- [ 33.775219][ T490] RIP: 0010:cgroup_mkdir+0x122a/0x1600 [ 33.780778][ T490] Code: eb 05 e8 79 4d 08 00 48 89 df e8 11 9e 00 00 48 81 fb 01 f0 ff ff 0f 83 9a fb ff ff 4c 8d b3 08 01 00 00 4d 89 f4 49 c1 ec 03 <43> 80 3c 2c 00 74 08 4c 89 f7 e8 b7 27 61 00 48 8b bb 08 01 00 00 [ 33.800712][ T490] RSP: 0018:ffffc9000d887c88 EFLAGS: 00010206 [ 33.807039][ T490] RAX: e56d21bb7819b500 RBX: 0000000000000000 RCX: ffff8881f6e3acc0 [ 33.815190][ T490] RDX: ffff8881134a5980 RSI: ffff88811ab8f000 RDI: ffff888100042000 [ 33.827868][ T490] RBP: ffffc9000d887d38 R08: ffffffff81dc02b8 R09: ffffffff81e01f9f [ 33.836097][ T490] R10: ffffffff81e04a84 R11: ffffffff81e01abe R12: 0000000000000021 [ 33.836171][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 33.851985][ T490] R13: dffffc0000000000 R14: 0000000000000108 R15: ffff88811ab8f010 [ 33.860214][ T490] FS: 00007f78d0a5c6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 33.869376][ T490] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 33.876132][ T490] CR2: 00007f78cfa70050 CR3: 0000000119b4c000 CR4: 00000000003526b0 [ 33.884325][ T9] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 37, changing to 7 [ 33.893757][ T490] Kernel panic - not syncing: Fatal exception [ 33.895330][ T490] Kernel Offset: disabled