last executing test programs: 3.379447494s ago: executing program 3 (id=4): sigaltstack(&(0x7f0000000000)={&(0x7f00000000c0)=""/4096, 0x80000001, 0x1000}, 0x0) sigaltstack(0x0, &(0x7f00000010c0)={0x0}) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000001100), 0x40000) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000001180)={0x0, 0x8bb8, 0x2000, 0x1, 0x348}, &(0x7f0000001200)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1737, 0x8, 0x0, 0x188}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8432, 0x400, 0x3, 0x3d4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8869, 0x2000, 0x0, 0x1c4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xef7f, 0x400, 0x3, 0x1fc}, 0xffffffffffffffff}], 0x4, &(0x7f0000002480)={0x2e, 0x18, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x3}, 0x0, 0x0, '\x00', {0x3, 0x8bf, 0x0, &(0x7f0000001480)=@buf_1k="ade9e019ed357c8303d45031b91168e072528153ee181369d1252afc87b2c87cba798321d3da26c260a39f188b0300730d6bc383ca5402b18d128f7b5b451dc5349d0e131cd298dcfc430d3a789d668b26a3382dcc219cb16212b9056c2b0c6e9bc7621b7aceed7b9393d0fb138df56e109b1e58e9ebdb5378624cf2d6c62c308d13283882b9fb728eb8bb995eafe5afe536d8d2a4292e6fd5618311af51f3904ba5114de23bf857d72dceadc05a764c39999d78428a85b281c1a7331c725b36e9a3a27cc0c9ae586710c39ae6e98af1a161f96c7f33ea7ecf2b8dbe62c96aa12d2e1b1b063697288c17d4eea40fd08aa59fdd86c68f51ef407f6f22d2b2d5b8445de31896fd0360b246147422cd9fde7e1976d2ee6a3d7dca70d9cc1a4b8cfbae46cdc8cbc2d0c3d2a65681a9fa3e01b1e4cb405b911e23df7475728d69c3a07c45f07ac73714484069ecf6aaf758684f4336f770b34ebd8476648e362223d95c467381d8dcb0b0cf2b9b5c0946e2f722efcadf0b3d19ae77a4aaba8cdee9cb295984c8379f0f6a80d6b54e146799fdd285c24048d722c98ea2ecc461d767c8f0f763be7e50317ca62ad55cd85d2cd3460edc2982ee689614fed9cf4fc9813472f9f8ffbb9e99fd33deb629c13176ba3dde146de3ee29b359d4d6270221f106fbb465c597b7d63cb4904d33539e3cf09f59da159c44236c3bb973e7d14bcc9329f8e2461cd1a10e57447ac6abe28a4a7212ae4196ad0267d22e9b6f0c8213a1f2e9f94d99877199e166eb5c47752fd16dd08e251e5e981867a2b64b502317c35dc2421f43079ab1de75e11875632180c5d6b3e4eac315f1501ba8e1115efb0652305c232ded375192d4a81d9f9e03962bde9a629aeb4582d5fa27220fd1c39d71a5119db932ff7a5216bc35be8c51f637ecdc4e1c39519d7c10521194322ccd9ae098de13e1b41f0d9cdd6562c8628e6b28242fe01b02948e5f304188e5cbc89ba82957f86f6afb2ae4f9ed5d453891d09152e2eb97f2126080d08df0ee6104cd65179627df60b86b146e35d6e8d0d73cd3860aeec626ac9d38a1fd84462f8796b1a6bc51949bfa9a096734414897052cc77025d0a18422cfff789638071873ed158e6f0b4405697795c981599773b503ec557880840640c46f254d25b1165c0088ec955cb68724303b915a5b21adbc633a4809ae94f6db304d98b3cb4b1b65dda8ef49e1ee24c8386490caaeb03d7a20c9024a8e6a6b02c26ba1c2692c99b1ddf8a666256baf18282c7bd01d4dd374823de66c2fd755dfefc7894a9e822ccd3c2767a485318291066806fc08ec9b7c11d0d80992619f3995722a138785a1bfd5dfaafc0b90cbd2bf2abc3a886addeeb765873594121ee19fd49f86cb461161eb54598981fb0173e815cfe5f58aeb348990a6606e4aa9ee5a58d9d00c3eb0c1"}}, &(0x7f0000002500)) clock_adjtime(0xa, &(0x7f0000002540)={0x9, 0x2, 0x5, 0xffffffffffffffff, 0x100, 0x3, 0x9, 0x7, 0x8, 0x1, 0x83, 0x100000000, 0xdf9, 0x4, 0x4, 0x0, 0x6, 0x0, 0x5, 0x8, 0xb07, 0x4, 0x3ff, 0x80, 0x3, 0x5}) (async) mmap$IORING_OFF_SQ_RING(0x0, 0x80000000, 0x1000008, 0x50910, r1, 0x0) (async) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r0, 0x80585414, 0x0) (async) r2 = syz_create_resource$futex(&(0x7f0000000040)) futex(r2, 0x0, 0x0, 0x0, 0x0, 0x1) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1c0) (async) pipe2$9p(&(0x7f0000002640)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r5 = dup(r4) mount$9p_fd(0x0, &(0x7f0000002680)='./file0\x00', &(0x7f00000026c0), 0x0, &(0x7f0000002700)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r3, @ANYBLOB=',wfdno=', @ANYRESHEX=r5, @ANYBLOB=',access=', @ANYRESDEC]) syz_usb_connect$hid(0x7, 0x36, &(0x7f0000001140)=ANY=[@ANYRES16, @ANYRESHEX=r2], 0x0) 3.363481106s ago: executing program 0 (id=1): poll(0xfffffffffffffffd, 0x0, 0x8) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x28100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000002c0)={0x1, 0x0, [{0x4b564d00, 0x0, 0xfff}]}) r3 = syz_usb_connect$cdc_ecm(0x4, 0x5a, &(0x7f0000000300)=ANY=[@ANYBLOB="39604eab12ef9f1289ca2b04eefbd487e5e6c0941346d18208cf7ee72c1bb0b508d8675772964735dc2af8f4cd846eaa8a3d6bba222025cee9f1a00a257e9a7d7f5935baf77f4dcae11532c2eed7b059ea203f21b3e77af0dabf316e855ab755179ec10c2b1936bf504ffbabf912cc1d10ab4fcf95cb74c259b27ea2fd50dd1d6a744f07513e79288242037456f6c043f2f75e2ed788361aafda7b0da2a92a3d161af3d50349df68960c79ac09142b4ef176aafafe224d81c6d9e9ae34e96bcf12b7533774af30f7f6d9", @ANYRES32], 0x0) syz_usb_control_io$cdc_ecm(r3, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x40, 0x0, 0x31, {0x31, 0x0, "0b3e4fcc6b3552f913624043a2946d48f2949885f16a0a6d7c3ce02a543d4c9629d74d1453c637d917f5c33ac7bceb"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x20, 0x15, 0x79, "2935d81dd84cff8471ac08fb2c6afcfc79f1721ccde4b6b148f4e848f2de879b76b482c333710b6cddb3566d984e530a32b5e65f2b491e190297b3a7583291efbbff0cf44ff7fb4fc598e50128907c3399d49057afda402b41aeeb84b825ca2194bf837a047a6b52b429db858cada1d39073eb2bc3b59c58bf"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0xa}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0x5}}) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000440), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r4, &(0x7f0000000500)={0x2020}, 0x2020) syz_ublk_setup_io_uring(0x1d, &(0x7f00000046c0)={0x0, 0xe912, 0x0, 0x3, 0x158}, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000004740)={0x2, 0x4e20, @empty}, 0x10) connect$inet(r5, &(0x7f0000004780)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f00000047c0)={0x0, 0x0, &(0x7f0000004800)={&(0x7f0000004840)=ANY=[@ANYBLOB="020d0000100000000000000000000000080012000200020000000000000000001200326a03030000001b000000000000000010002b0001000000000000000000fc0200000000000000000000000000000300050000000000"], 0x80}}, 0x0) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000048c0)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000004900)={0x1, &(0x7f0000004940)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r7, 0xffffffffffffffff, 0x0) 3.353009537s ago: executing program 1 (id=2): sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x88, 0x1, 0x9, 0x0, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x1f}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x2}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0xa}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x2}, @NFCTH_TUPLE={0x30, 0x2, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x33}}, {0x14, 0x4, @private1}}}]}, @NFCTH_STATUS={0x8, 0x6, 0x1, 0x0, 0x1}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0xf}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x8}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0xf50}}]}, 0x88}, 0x1, 0x0, 0x0, 0x4800}, 0x4000040) r0 = socket$inet6(0xa, 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/kernel/watchdog\x00', 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f0000000240)="629a3e", 0x3}], 0x1) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r1, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x8c, 0x0, 0x8, 0x5, 0x0, 0x0, {0x3, 0x0, 0x6}, [@CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x1c}, @CTA_TIMEOUT_DATA={0x34, 0x4, 0x0, 0x1, @fccp=[@CTA_TIMEOUT_DCCP_PARTOPEN={0x8, 0x3, 0x1, 0x0, 0x6}, @CTA_TIMEOUT_DCCP_PARTOPEN={0x8, 0x3, 0x1, 0x0, 0x4}, @CTA_TIMEOUT_DCCP_PARTOPEN={0x8, 0x3, 0x1, 0x0, 0x7fffffff}, @CTA_TIMEOUT_DCCP_RESPOND={0x8, 0x2, 0x1, 0x0, 0x9}, @CTA_TIMEOUT_DCCP_TIMEWAIT={0x8, 0x7, 0x1, 0x0, 0x400}, @CTA_TIMEOUT_DCCP_OPEN={0x8, 0x4, 0x1, 0x0, 0x2}]}, @CTA_TIMEOUT_DATA={0x2c, 0x4, 0x0, 0x1, @udp=[@CTA_TIMEOUT_UDP_REPLIED={0x8}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0xffffff80}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x8}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8}, @CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0x4}]}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x7}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x2f}]}, 0x8c}, 0x1, 0x0, 0x0, 0x1}, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@loopback={0x0, 0x7ffffffff000}, 0x800, 0x0, 0x1, 0xb, 0x7, 0x8}, 0x20) 3.279071544s ago: executing program 1 (id=5): r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='mounts\x00') r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000003c0)={0xaa, 0x4}) (async) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000400)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f0000000440)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) (async) pread64(r0, &(0x7f0000000140)=""/237, 0xfdef, 0x4eb) (async) sendmsg$AUDIT_SIGNAL_INFO(r0, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000008}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x3f2, 0x800, 0x70bd26, 0x25dfdbfd, "", ["", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./config\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000580)='./config\x00', &(0x7f00000005c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1\x00', 0x1ff) (async) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000800)={{{@in=@rand_addr=0x64010100, @in6=@dev={0xfe, 0x80, '\x00', 0x39}, 0x4e24, 0xfb, 0x4e23, 0x0, 0x8, 0xa0, 0x20, 0x5e}, {0xc, 0x480000000000000, 0x8000000000000000, 0x3, 0x3, 0x8, 0x6, 0x8}, {0xffffffff8974b977, 0x21a2, 0x9, 0x6}, 0x0, 0x0, 0x3, 0x1, 0x2}, {{@in6=@dev={0xfe, 0x80, '\x00', 0x45}, 0x4ce, 0x2b}, 0xa, @in6=@mcast1, 0x0, 0x3, 0x0, 0xa, 0xfffffff8, 0x254e, 0x10}}, 0xe8) (async) openat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/usb_gadget/g1/webusb/landingPage\x00', 0x1, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000700)='fd/3\x00') preadv(r3, &(0x7f0000000740)=[{&(0x7f0000000780)=""/85, 0x55}], 0x1, 0x5, 0x809) r4 = syz_usb_connect(0x3, 0xc7, &(0x7f0000000000)=ANY=[@ANYBLOB="12011002000000408680d20a0000010200010902b5000201008030080b00020e03000009040000010e0100000d2401000134000000000001011224020101020000000000000000030000000924030201010003000c24050301000002000000000705810310000609040100000e0200000e240101470082000200000001001b240401015955593200001000800000aa00389b711001000000001e24050100a000780000c0e00000c0e000009600001516050001"], &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched_retired(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)=@newtaction={0x18, 0x31, 0x80d, 0x70bd29, 0x25dfdbfb, {}, [{0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x8080}, 0x9080) (async) mprotect(&(0x7f00005fb000/0x2000)=nil, 0x2000, 0x2000002) (async) syz_usb_control_io(r4, 0x0, 0x0) (async) syz_usb_control_io$rtl8150(r4, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r4, 0x0, &(0x7f0000000600)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="2014480b9d8eb868aef5656d4d6933f7d79a205c26fb085e201f70691199e686d0ff7401ebf3fd9a59b00b8beca558bedd180d6b27732c7e94278ea53e80200b17b943e395129ae6cd041750448e85fab02fae12a50101000079139ecbf5c41bbf"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 2.73443172s ago: executing program 0 (id=9): r0 = mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = syz_ublk_setup_io_uring(0x477c, 0x0, &(0x7f0000000500)=0x0, 0x0, &(0x7f0000000580)=0x0) syz_ublk_add_dev(r1, r2, r0, r3, &(0x7f00000005c0)={0x2e, 0x40, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000680)) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="020a040007000000b6f1ffff0000854105001a"], 0x38}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020100090e000000030000000000000405000600000000000a000000000000"], 0x70}}, 0x0) r5 = syz_usb_connect(0x3, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="12010000b510f210950b2a7773820102030109022400010000000009042200028953950009050a02ff0300fa000905820250"], 0x0) syz_usb_control_io$printer(r5, 0x0, 0x0) syz_usb_control_io$lan78xx(r5, 0x0, &(0x7f0000000440)={0x34, &(0x7f0000000480)=ANY=[@ANYBLOB="001606"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r5, 0x0, &(0x7f00000004c0)={0x2c, &(0x7f0000000540)=ANY=[@ANYBLOB="400f02"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r5, 0x0, &(0x7f0000000640)={0x34, &(0x7f00000006c0)={0x20, 0x15, 0xb, "d3786d0793016dcf664c7d"}, 0x0, &(0x7f0000000700)={0x0, 0x8, 0x1, 0xa}, &(0x7f0000000740)={0xc0, 0xa1, 0x4, 0xffff}, 0x0, 0x0}) syz_usb_control_io$hid(r5, &(0x7f0000000780)={0x24, &(0x7f00000007c0)={0x0, 0x6, 0x60, {0x60, 0xd, "ba33cf53283c2f7f5b513169067f1b198134e2519ac85a36a873b5cfdee776fb38cfd06c4ea6a4cfe87cda34d92be8466665358a28faf15b88794d836fc38ee78358f4c1aaa14228d35cf27e0d5ded74ba9a4205be154c42ffa6300974c7"}}, &(0x7f0000000880)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x408}}, &(0x7f00000008c0)={0x0, 0x22, 0x11, {[@global=@item_012={0x1, 0x1, 0x2, ']'}, @local=@item_4={0x3, 0x2, 0x0, "b221d4c0"}, @main=@item_4={0x3, 0x0, 0xa, "a9d4cf01"}, @local=@item_012={0x0, 0x2, 0x1}, @global=@item_012={0x1, 0x1, 0x2, "7f"}, @local=@item_012={0x1, 0x2, 0xa, "e2"}]}}, &(0x7f0000000900)={0x0, 0x21, 0x9, {0x9, 0x21, 0x5, 0x3, 0x1, {0x22, 0x2d8}}}}, &(0x7f0000000940)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmmsg(r4, &(0x7f0000000200), 0x3ef, 0x0) r6 = openat$binderfs_ctrl(0xffffff9c, &(0x7f0000000840)='./binderfs/binder-control\x00', 0x0, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./sys\x00', &(0x7f00000002c0)='sysfs\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/devices/system/clockevents/clockevent0/current_device\x00', 0x0, 0x0) preadv(r8, &(0x7f0000000340)=[{&(0x7f0000000380)=""/106, 0x6a}], 0x1, 0x80000001, 0x0) r9 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000980)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000009c0)='./proc\x00', &(0x7f0000000a00)='proc\x00', 0x4000, 0x0) r10 = openat(0xffffffffffffff9c, &(0x7f0000000a40)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r10, &(0x7f0000000a80)='27', 0x2) syz_io_uring_setup(0x2, &(0x7f0000000ac0)={0x0, 0x289b, 0x10000, 0x1, 0xb1f, 0x0, r10}, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) r11 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r11, 0x4400ae8f, 0x0) ioctl$FS_IOC_FSSETXATTR(r6, 0xc1086201, 0x0) 2.207168004s ago: executing program 2 (id=11): ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000000)={0xffffffffffffffff, 0x8, 0x9}) sendmsg$SEG6_CMD_SETHMAC(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, 0x0, 0x20, 0x70bd25, 0x25dfdbfc, {}, [@SEG6_ATTR_DST={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, 0x28}, 0x1, 0x0, 0x0, 0x10}, 0xc000) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000140)=0x0) r2 = syz_genetlink_get_family_id$SEG6(&(0x7f00000001c0), r0) sendmsg$SEG6_CMD_SETHMAC(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x24, r2, 0x200, 0x70bd25, 0x25dfdbfc, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x1}, @SEG6_ATTR_SECRETLEN={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x20040000}, 0x4044080) close_range(r0, r0, 0x0) close_range(r0, r0, 0x2) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f0000000440)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400b000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x5c, r3, 0x100, 0x70bd2c, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r4}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x9}], @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x8001}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x4}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x18e}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xfff}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x11}], @NL80211_ATTR_DURATION={0x8, 0x57, 0x101}]}, 0x5c}}, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), r0) sendmsg$NL80211_CMD_ABORT_SCAN(r0, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x28, r5, 0x8, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x2, 0x6c}}}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x24040000}, 0x800) sendmsg$NL80211_CMD_START_P2P_DEVICE(r0, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x20, r3, 0x100, 0x70bd26, 0x9, {{}, {@void, @val={0xc, 0x99, {0x7, 0x70}}}}, ["", "", "", "", "", ""]}, 0x20}}, 0x2000800c) sendmsg$NL80211_CMD_SET_KEY(r0, &(0x7f0000000780)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x3c, r3, 0x800, 0xa, 0x25dfdbff, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "14e38769d9724932e3a36db7cc"}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040040}, 0x90) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x20, r3, 0x200, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x2, 0x74}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x45}, 0x40) ioctl$FAT_IOCTL_GET_VOLUME_ID(r0, 0x80047213, &(0x7f00000008c0)) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f00000009c0)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000980)={&(0x7f0000000940)={0x24, r5, 0x400, 0x70bd2a, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0xffff, 0x50}}}}, [@NL80211_ATTR_CSA_C_OFFSETS_TX={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004}, 0xc001) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_SURVEY(r6, &(0x7f0000000ac0)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x20, r5, 0x1, 0x70bd26, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0xffffff27, 0x7b}}}}, ["", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x48000}, 0x48c1) ioctl$NILFS_IOCTL_GET_SUINFO(0xffffffffffffffff, 0x80186e84, &(0x7f0000000b80)={&(0x7f0000000b00)=[{0xf3, 0x8, 0x1}, {0xffff, 0x5}, {0x2, 0x18d1, 0x2}, {0x8, 0x2, 0x2}, {0x8}, {0x3, 0x800, 0x2}, {0x2b, 0x5, 0x1}], 0x7, 0x10, 0x3, 0x3fb}) r7 = syz_pidfd_open(r1, 0x0) sendmsg$SEG6_CMD_SETHMAC(r6, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x48, r2, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [@SEG6_ATTR_SECRET={0x10, 0x4, [0x4, 0x4, 0x80]}, @SEG6_ATTR_DST={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x5}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x1}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000480}, 0x24044050) ioctl$F2FS_IOC_DECOMPRESS_FILE(r7, 0xf517, 0x0) sendmsg$NL80211_CMD_CONNECT(r6, &(0x7f0000000f00)={&(0x7f0000000d00)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000d40)={0x144, r5, 0x620, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x66, 0x29}}}}, [@NL80211_ATTR_IE={0x30, 0x2a, [@erp={0x2a, 0x1, {0x0, 0x1}}, @prep={0x83, 0x1f, {{}, 0xd, 0x80, @device_b, 0x2000000, @void, 0x81, 0x6, @device_b, 0x4}}, @ssid={0x0, 0x6, @default_ibss_ssid}]}, @NL80211_ATTR_IE={0x41, 0x2a, [@preq={0x82, 0x3b, {{0x1, 0x1, 0x1}, 0x96, 0x4, 0xa, @broadcast, 0x3, @void, 0x2, 0x8, 0x3, [{{0x0, 0x0, 0x1}, @device_b, 0x10001}, {{0x1, 0x0, 0x1}, @broadcast, 0x80000001}, {{}, @device_b}]}}]}, @NL80211_ATTR_BSS_SELECT={0x28, 0xe3, 0x0, 0x1, {0x24, 0x0, [@NL80211_BSS_SELECT_ATTR_BAND_PREF={0x8, 0x2, 0x4}, @NL80211_BSS_SELECT_ATTR_RSSI={0x4}, @NL80211_BSS_SELECT_ATTR_BAND_PREF={0x8, 0x2, 0x9}, @NL80211_BSS_SELECT_ATTR_BAND_PREF={0x8, 0x2, 0x5}, @NL80211_BSS_SELECT_ATTR_RSSI={0x4}]}}, @NL80211_ATTR_MAC_HINT={0xa}, @NL80211_ATTR_WANT_1X_4WAY_HS={0x4}, @NL80211_ATTR_MAC_HINT={0xa}, @NL80211_ATTR_KEYS={0x64, 0x51, 0x0, 0x1, [{0x60, 0x0, 0x0, 0x1, [@NL80211_KEY_CIPHER={0x8, 0x3, 0xfac01}, @NL80211_KEY_SEQ={0x6, 0x4, "6ee5"}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "0e1d05554c85c1ff048aed1b78"}, @NL80211_KEY_MODE={0x5}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac01}, @NL80211_KEY_TYPE={0x8, 0x7, 0x2}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "fd39479dcc"}, @NL80211_KEY_TYPE={0x8, 0x7, 0x1}, @NL80211_KEY_SEQ={0x4}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac05}]}]}]}, 0x144}, 0x1, 0x0, 0x0, 0x24004000}, 0x800) r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000000f80), r6) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_SET(r0, &(0x7f00000011c0)={&(0x7f0000000f40)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000001180)={&(0x7f0000000fc0)={0x1a0, r8, 0x1, 0x70bd28, 0x25dfdbfc, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x3}, {0x6, 0x16, 0x56b}, {0x5, 0x12, 0x1}, {0x6, 0x11, 0x81}, {0x8, 0xb, 0x6d64d9e2}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0x8}, {0x6, 0x16, 0x7ff}, {0x5, 0x12, 0x1}, {0x6, 0x11, 0x400}, {0x8, 0xb, 0x7}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8}, {0x6, 0x16, 0x7ad7}, {0x5, 0x12, 0x1}, {0x6, 0x11, 0x10}, {0x8, 0xb, 0x7}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0xfff000}, {0x6, 0x16, 0x80}, {0x5, 0x12, 0x1}, {0x6, 0x11, 0x3a07}, {0x8, 0xb, 0x80}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0xe}, {0x6, 0x16, 0x7}, {0x5}, {0x6, 0x11, 0x9}, {0x8, 0xb, 0x2}}]}, 0x1a0}, 0x1, 0x0, 0x0, 0x4040040}, 0x2000) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000001240)={'batadv_slave_0\x00', &(0x7f0000001200)=@ethtool_sset_info={0x37, 0x9, 0x7f}}) ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r7, 0x4018f50b, &(0x7f0000001280)={0x0, 0x8, 0x61b}) r9 = syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) splice(r9, &(0x7f00000012c0)=0x100, r6, &(0x7f0000001300)=0xcfdb, 0x9, 0x1) 2.191994656s ago: executing program 2 (id=12): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_io_uring_setup(0xf00, &(0x7f0000000180)={0x0, 0x0, 0xc00, 0x0, 0x13}, &(0x7f0000000200)=0x0, &(0x7f0000000240)=0x0, &(0x7f0000000280)) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000380)={0x28, 0x2c, 0x1, 0x0, 0x0, "", [@typed={0x8, 0x0, 0x0, 0x0, @uid}, @nested={0xa, 0x0, 0x0, 0x1, [@generic="976b64086860"]}, @nested={0x4, 0x1}]}, 0x28}], 0x1}, 0x0) syz_io_uring_modify_offsets$generic(r2, r3, 0x54, 0x10000) r5 = syz_open_procfs(0x0, &(0x7f00000002c0)='fdinfo/3\x00') read$FUSE(r5, &(0x7f0000000700)={0x2020}, 0x2020) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect(0x5, 0x36, 0x0, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000000c0)={0x1, 0x1, 0x0, 0x0, 0x0}) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000100)=0x1) syz_usb_connect$uac1(0x0, 0x7b, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x20, 0x582, 0x12, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0xc, 0xd0, 0x4, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x5, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x8, 0xe, 0x5, 0x8, 0x23}]}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0x3, 0x5, 0xa, {0x7, 0x25, 0x1, 0x4, 0x7, 0xa004}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0xbf, 0x6, 0x8, {0x7, 0x25, 0x1, 0x0, 0xac, 0x4}}}}}}}}]}}, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0}) 2.091167057s ago: executing program 1 (id=13): syz_usb_connect(0x5, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000772904202404019957c2010203010902240001000010000904430002317d5500090502020002020000090582020002"], 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prctl$PR_SET_VMA(0x42, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0) unshare(0x400) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000100)={0x3000, 0x0, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000140)={0x2, 0x34000, 0x1}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING_WITH_BITMAP(r1, 0x4068aea3, &(0x7f0000000200)={0xe1, 0x0, 0x30000}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0xeeee8000, 0x102000, 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0) unshare(0x20000080) 963.564691ms ago: executing program 2 (id=14): r0 = socket(0x10, 0x803, 0x0) setns(0xc9, 0x0) r1 = socket$netlink(0x10, 0x3, 0xa) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000040)="290000002000190f00003fffffffda0602000000ffe80001dd0000040d001800ea11c21d0005000000", 0x29}], 0x1) fstatfs(r0, &(0x7f0000000080)=""/83) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000001100)={'veth0_to_team\x00', &(0x7f0000000100)=@ethtool_sset_info={0x50, 0xc, 0x3ff}}) 671.017811ms ago: executing program 2 (id=15): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='freezer.self_freezing\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000240)=ANY=[@ANYBLOB="1400000068001f"], 0x14}], 0x1, 0x0, 0x0, 0x4004000}, 0x0) ptrace(0x10, r1) ptrace$PTRACE_SETSIGMASK(0x420b, r1, 0x8, &(0x7f0000000080)={[0x8]}) r3 = landlock_create_ruleset(&(0x7f00000000c0)={0xc0d8, 0x1, 0x3}, 0x18, 0x0) landlock_restrict_self(r3, 0x0) r4 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r5, 0x29, 0x36, &(0x7f0000000280)={0x73}, 0x8) close_range(r5, 0xffffffffffffffff, 0x0) ioctl$int_in(r4, 0x5421, &(0x7f0000000140)=0x5) syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000eafa7240936901b0293df400100109021b000124a800800904000001030000000905", @ANYRES16], 0x0) wait4(r1, &(0x7f0000000180), 0x1, 0x0) 323.170387ms ago: executing program 3 (id=16): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PAUSE_GET(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000001e0000000c00018008000100", @ANYRES32=r3], 0x20}}, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x21, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000200)={0x0, 0x23ad697ddad057f0}) close_range(r0, 0xffffffffffffffff, 0x0) 263.051763ms ago: executing program 3 (id=17): r0 = socket(0x10, 0x3, 0x0) r1 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x205, 0x8401) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, &(0x7f0000000100)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000140)={0x2, 0x3, 0x0, 0x0, 0x7995}, 0xfcb5, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x3e) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f00000001c0)={0x1fe, 0x0, 0xa000, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r5, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x6a, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000280)='ns\x00') openat2(r6, &(0x7f00000002c0)='./cgroup/../file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x10}, 0x18) syz_kvm_setup_cpu$x86(r4, r6, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000240)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000340), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r7, 0xc004743e, &(0x7f0000000380)) pwritev(r7, &(0x7f00000003c0)=[{&(0x7f0000000400)='\x00!E\x00', 0x4}], 0x1, 0x0, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x3c, 0x19, 0x1, 0x0, 0x25dfdbfe, {0xa, 0xd601, 0x9}, [@nested={0x19, 0x12, 0x0, 0x1, [@generic="5f8eb0b2256dd895acccd34b30", @typed={0x8, 0x1e, 0x0, 0x0, @ipv4=@empty}]}, @nested={0xc, 0x9, 0x0, 0x1, [@nested={0x8, 0xce, 0x0, 0x1, [@nested={0x4, 0x13e}]}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x5}, 0x0) 137.151496ms ago: executing program 3 (id=18): mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./debug\x00', 0x1ff) mount$binderfs(0x0, &(0x7f0000000000)='./binderfs\x00', 0x0, 0x5c04c, 0x0) r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000140)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}}}) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$DM_TABLE_DEPS(r0, 0xc138fd0b, &(0x7f0000000280)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x81210, 0x0, 0x0, @by_dev={r1}}) accept4(r2, &(0x7f00000003c0)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @loopback}}}, &(0x7f0000000440)=0x80, 0x800) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./file1\x00', 0x0) write(r0, &(0x7f0000000880)="54ac37a436bb31bd69951d10b8c177a1969a67f5f2e568d5c8d3accc6ebe65fcb65a60592500f1e8316469a1afbbb245c9e897cc3f4f82e04eb6e255a81b70761befc6010182b9c587b7307fc0d60f35a528a8283d321035a3f06b609c6ef58630b80380766b728e84b6608a20c34e5cd9b6e78bf40c112eecb446934e15504155fbe7c5a1ef2cd3fb6a2b3dd81c0789b9250366ac3f76ac9d413f5aaee54b980b0832020ed0478cf1245f48a313cb8ae4b26852ca9007590d0f8b30c4ffec3ec5fc462a45aaf1370c746c870bcc692891aa4bd399240d11fb576008e1972f85a330d17f700590d78d500393e368a47097821e74bcc9274e77e3fb7b3215f1eca750065e9c47e51a2c53edecdc378bfbf4553f2f87b14c45f7882d83046bed797615132b7c220999b4223a080967339e0395fd32e3df9b4b231627c7b838dd58c8c9643d899fb66b8e30442b8287c671f21654b1ba2fbc0f61edd74c194ab95cdf1120452ca300f52f9239ac37ad02a3896251915eca2d9359f6002a87780081f1801e7704dc12cc1407f49b2a1268eb20ff34682e36f90aac2f0a96043b10f8cbf44979bdedd30f8776a8e9e10e3b4e9b8761773649b5a0a6e84d3e9128c7dda600f7a65850d07df321ca31a40fa77863135cbf8a8fc310539a737240a51347a8a6f54fc55c674e396e14374562292a7e10ab702bac9e4979228d5bc638905a815417c3af941438dbf6e46f866ca71df18cd55e7e108b5daebd3ed9cb9b94bb96578f938faef995688b0fc3dbc08e0a56d31b41cb5bd6b9ddde2c702b17b8ae1464d76f33bb90c3378d462b3dacfe6001e60cef24c632c73e89ae075980771b1d2aba8a6debed25a47efe8f0e90eb4ff74706132a9578c8c8db5ea76b9daab8fde9bc77914fb25ff7c298b0e53abeca69884c5ec787bc6083f75c9db69a8883dbe70035ebe7fc80c1dcafca6c1370b521741c86abce2377fff3d64457d6946c079f07d8e3a8d8395707736e01e085a0938e8becb36a7ebd3139b41846f551fc744ad8fdafb662bf7a7ed74c8f472fcc6dac0ca18f3b09058f78c8c31d90fa3433b013ba407338906dd96b316f92c3740ceaa7e153b6ee21486726a96f72aa6d1938b61a09704897d11b444aa535c32665e22a29b89dbff4ecc994f15a0a45313a27528c465b336309e1720fd9d0874f3032d893395b0a07a6320879402e98a5b00845a9360ae05f1a2b768b3fe57c6c705c59423cba31e4aed20203fafb0a62650a728335342e2deb03e4680f9f3bae4efa1b9f562d9bd6751e8950e8c2928693cec6d6fd7df24b91c823df247d0b7b992f98ba65a7f65d6e9829c815257050c741ba492aacc3520a399f0ef25a791ece593065a2113b312f5731fae701617620b20690c8c53793c425d5de2aafe171fba8b30733a8c10eef8514db879f3ffbc0b625ca8f634a907b3761a9d259df96bb95284904f513df78bb17fc59366f6974049000322433e1431298cbb917eb0e8076f841a9cd819b31458e84efb87d6ccc5a32ef861febf9620101d9538435c342e6977e38e5a4ad86973d3948692a08a348f688284e93e6fd8ba28ee5e84c8a328567c4b9c1678f1c59044127d3a013c300f0e9f1354f9a6fbe95ddc389056036814c3edf0bed0c0b1773107fc74d5012256a4f5be6f1d263bc49c6fce622946da0bdeb9d2f4530d440cf7d609c9828a554ba06a552cc9bdb6c28375901756797ce55e5dea3758b2d68e00aab9c1277078ad0c2b4557033f4c7081634a6cccaff6d10cd178526ba8b21c28c79b332bc58fcde9eee2f2982eb9e4f81eff855606fdd3dd198b2da4a83527cb98067c6e635c26d0bf1dc2f6ae6eb2a18dcded703f800f1446ab1e1651bf82adfc00a145f595973a7f70c8cfc1a09911dcb1f84ea18d9fcc12b8f247b722bc41e694eb8697455a1d7f171751286f1c8accb0bdd37f24b29493e1670db4d24341201905566c2e9a07034015939aa60a3aa77ebfa05f5ee29a987b0293b6303aff0e808bb4087880d9399136ff7ed7e274ce006167e82ebb9a3aa65ed97056c358af5958cd39cb349f4f57d8f605c4bcc0e62dc090985ff96f6c0d7367b6dde6f23326363db720a528a190cd0608e12d1f0a9e64a6172232a26f0502be6517d18f0d9c62c5f98c5440e4a0ad0b782ae01e70a852ecbecf1b64345e58c971b146765a75f481da22a26677d5b05e58323616e13fa85944066270f1d2d0d5ec218e6111a3e55f8b5fe90ba0aa144a68bf0d6558ea17b10080c60a650b81b7c812ee518bd0b1a45a03da48b24751fa0b3d3d5967848e474fe9c9fa5cd0551edce9eee22e33a75523c834b5b6e72f8b3eee6efee2aec9ed6dcbb2a4a3db59c8b7e38e59363f458c66027ddafc873aa8c3c64dd02741dccfd261f0745783ec0f58f2ab76fb50b0fbac67873e2f13e4ceb23a8fb1b724120bf59037703b65d0dabba618df3e202efcd0a76e9882c0f71a63903bb33ad38c4995cbe4832960718db77022250b8f7365d86dc73850de1228fa39b4414d7fc5b9a0056b0e13e903ba5f8522b6184a2add420a7f75c9512806804444bc1661dc7e0ebf70f050af2e7324e642d0c0b26718d1f1029dc658d600226ca2f1ab8e6085466c6cba83f305bcfc74e7d5009c05ed40ce6ab4fd6793b061bd0b0d411126b8923de0f3c3effc0a3f32f8d55fe3e2f1a366ca89082fc7038d9f8b7cb00bb3e6d532dc8b50d50d713ab18c5b0f83e4cf82f4f632256cab1b6941055b1b2e8df70a05de9093eedee1cb7018346502d874153c8f7f8b6ed5047e757d7837b93430205f0c2b2f8621a9a1058bbfdabc8a7e2a8f974ab040f97b70c5e0c04dedc08e5bb331f7038564ad4aae8f4a33c68794c226951e24505ff065a9e4e0357ce76b94940801debfb7928fcd8263aaa63cff74d4a4aa65fcdf098f0c4608d3d8dac33d4b79db733cc8dee4674687e24c9f839eb3e822912db5276451f54d7f25687e4b049371a2d9174b27f3fbb08e1e546a119aad516b20fe8dd7dc83687d5388c4ac5c22af0346311571b83365834592f0eb34a458c9843e443c7549ea14f83d370815e7bc5be905b3250c00ad10956b3f46be3e7d25751f66304826e5351734f540490f6b3da724632e5792912bdcd2e80ae44e80e7e5e8ea1f08c98fb8f35a185def26ec4fe07db1ee5d579babdf0e67f86514c3125f01508800046e5e94a9e839ed344b161a19a16f0f2f16ff936a3680d99e3e8e3e3e2873987ea68c10966a06b29aec92005fb8e30110e040e67893d32bc22725c38e79dd0f8f3997bca2229fbc54d00046c78aaf97db7438f2d5bb6aabd3fc9c6a573c6f201a715b7e86355f8347018302bb7ca7867700cce29b30ec123cf45fc4f20174ec45392053c7f46f7ca8b13a7eeb4e02fa929ba2a830cacf2bc1fbf03b5cb159b67449c75fb3a1b06c34f507f7f7632a8f560aac8c110f280ab3be0531e9282fd7fdbc2b812aa19ba378b2703b221beb181d27714b0475b3aafdfcc2d16786203964e3a252956515ebe81270d3f0282d17de2963abf50d7f18683f0c16e40b4179ca07a75fc5e39ac4e075981fc04c02145b03e243542ced301f59a7b12582f2645a3a458d8a744c6f6a222d6d2ff9a88bcce3b95484ab968622265b6714ce2e608948a97516a8f2df56f1bd476d2f7f58cf59f6123adcb226f7052109b23850806829620971317eac92e781f11791daee6a5e37d303485be4916b51e2f311169c76ac7db45e2fc4e4141bb4075781df074fefef6d534cd914270eae09786a5a590366748d7b6e0648f73528c90a3118904e568666e34255988ec612bd1f6bb52fccc530050a5c13cb8c56871c8d112c1b988bca7ffb3c4c3904e3e36ec909f86e708a7afa1fb0c1e64a014303e6d94e539ee829455370a9ba44a196af283c9d6701f31190d2fd2366d4c42801ca19075226ea9d029f0c91c94215eab78600843909902b27489475fc9b4d00cc2453ea94f58607186585689af0521816474ef2720b85d7137ce28acd627206d919032b85fc3527b7dd1f0e07a26940cea7f52f73c72dfea00a74b9e6620d2f4abb21477fa767bcdc30020b1cdb1125b0298b3a4994f66ece4d0a0af6d1337bb19be622277cb792f658215b971b49ef327134915e40d7ac819fe2f92de437557594180235dd4c595a38d609ea3593af7ff57961331199c51c9c32c5ac9a01d8ce29c6e22c2099b7db45e66e50cfdc1b892df1fd7154c8ef92746ab8f4fa3f52debccc048b0a1332abc4eedc93e24a3c9fb5409fb29d6647ece713dceeaf4c999e0252bbf371ae8f32affb07d714ea060139f9e1050e427bb7b42ab01a8bb2411cc3611891508adb2facfc4f73f96e2e6852449d5f7897e89c8d7b7140ad6126083e6456d09b6f31cc10ec0af30c7e98fad46a8ce58da384ed9b67e3fe7d4a89110aba197a77a96142dcf7a4c93019ce54cdad8591a9ece547507c61754f088e45a9d217072d4e5af379d3903d1d3caa908fca46ab70262cb99f5b00a288c8915c61f08d50b846f9d75e5219f033154117bde4a86a5f3f45da8bb782acc1b784c711d067cb91497cd864f8276707fbe4dbef405358d8ae5e05fb1ada826c73e3730b0cf93d51342632df4d7ee0039848cb39072517e18ea0ae19db27c3d90b1346d0dde0de0923cd3b3f4cac5ba4c209b909c77288b8b1a3898ec3c6843dac06831256058990d8c266f3f053b4fe6f210a16bbdf892bdb74ead07ee289753c621541a0a82c47a1dd4c1d3725b5f244004e34dbdb58d3bd0004c93452dfc724705303ebbca3d02aa623ea3d31260467f20f118ee3131a92d0b9e752e4301630e5f2a8b8428b27b1055accc91751c7571ec584ac44229d0461c7d5f4a102bf2405c3a3ab4042d0a7de09c89d52a30bd98739418164447ea6e6f44c18387c0d525ffc38f5544fc20c1b85ec96c46dcde767be525c29fcb20017b9e27feef8aa83ad70b20167c0106b94b63756a1e5cc4bb654a79c6b3a150db5c625d87b6317591ddce33b3cf2544ae8e98423b55d57888b18c03210f277de40597e04e9466d8d90337febe3a322708ce96fed148650492534851fc75a42806b46c1bcf55de4513dddd62b46e9ac5e7749c9ad02c4d3b1dc2755e15335829f9ec45fea15d4f29be212a0f0cf5cf752efb00fc11b77c9cd35aa5cf4f0cae64be25a4eaa47bce85574c5702a20339df5c27db626c6ddae34a948473607cb23105d92c63e09b4b2fd6f5d39eb8cef81ced072b3d0f7bd71481eea3e2090dde665957971ac9bdfed94ea81e35b0bebfdeff9c3ebf0d17895cba71da9ce970e3cb7536c024e1c03664c3d11806953574b1cf3819d72acfc2545142d4b08bce7f63d15240137f93aae5d98184534fd13710ee514183fc8be785860cbb19ba58c31aa25749106c08704ec4face9280da24bf4b6a551956bf14242597f73c344bc41708687f44a7f810a33cc30317e5d288e78b34a94309cf8e62d2c76e50b3328685cfc9114f170dbdfe708bd0546bf6c695fcace010c45ca970c44ebda1379880eaadc7e73c6454913d0505800527e8193b8b2e65aa25f462c096f8b714fb34c0f12d092ec98b04c1a1049fae8ef624f7d005c6ac9fbf40c08c34ba429153450ac91c399b706b0bed1f1ab12d5fac460f89c898fa6a2d2a037df93fc10c67e167ede99d116d030f7b97bce5fd5ec49bebf3202102519afe36a7511c1bdd48be05bacd4c9864e855c103b18b7d88b4b9d8fd446edc153d", 0x1000) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file1/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000640)='./bus\x00', &(0x7f00000006c0), 0x40, &(0x7f0000000700)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) r3 = landlock_create_ruleset(&(0x7f0000000080)={0x20}, 0x18, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r3, 0x1, &(0x7f00000000c0)={0x20}, 0x0) mount(0x0, &(0x7f0000000540)='./debug\x00', &(0x7f0000000580)='debugfs\x00', 0x0, 0x0) personality(0x8001a0ffffffff) ioctl$DM_DEV_REMOVE(r0, 0xc138fd04, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x1011, 0x0, 0x0, @by_uuid={0x0, '\x00', {'CRP-syz', 0x0, '3\x00'}}}) prctl$PR_CAP_AMBIENT(0x2f, 0x2, 0x17) prctl$PR_CAP_AMBIENT(0x2f, 0x1, 0x26) r4 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./debug/split_huge_pages\x00', 0x1, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000680)={0x1, &(0x7f0000000040)=[{0x3d74, 0x2, 0x2, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000001880), r4) 26.912917ms ago: executing program 3 (id=19): syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f0000000000)=[@nested_amd_vmsave={0x183, 0x18, 0x3}, @nested_create_vm={0x12d, 0x18}, @nested_load_code={0x12e, 0x5d, {0x0, "48b8008000000000000066ba6100b8555ad4abef2fad21e6e60c0020000f23f86592927716b9800000c00f3235000800000f30d035000100000f006080000f47dff2b00f30"}}], 0x8d}) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000000)={[{0x80000004, 0x5, 0xcb, 0x8, 0x7c, 0x2, 0x80, 0xe3, 0x3, 0x80, 0x8, 0x2, 0xe}, {0xe, 0xfffd, 0x3, 0x0, 0x9, 0x3, 0x8, 0x4, 0xd, 0x13, 0x3, 0xc8, 0x1}, {0x1ff, 0x5, 0xc, 0x0, 0x26, 0x4, 0x81, 0xfb, 0x4, 0x4, 0x0, 0xfe}], 0x9}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x48}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000000)={0x0, &(0x7f00000001c0)=[@nested_amd_invlpga={0x17d, 0x20, {0x1, 0xa0d1}}], 0x20}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000340)={[0x1, 0x749, 0x8001, 0x1, 0x3, 0x34, 0x2, 0x7c73af4, 0x8b, 0x5, 0x4, 0x3, 0x3f89, 0x39, 0x4, 0x100000000], 0x58000, 0x301}) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, &(0x7f0000000180)={0x2, 0x0, 0x1}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000200)={{0x0, 0xffffffff, 0x8, 0xb, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}, {0x0, 0xffffffff, 0x10, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x0, 0xffffffff, 0x10, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1}, {0xeeef0000, 0xffffffff, 0x10, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x0, 0xffffffff, 0x10, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x0, 0xffffffff, 0x10, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x0, 0xffff, 0x18, 0xb, 0x1}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {}, {}, 0x80050033, 0x0, 0x2000, 0x20, 0x0, 0x500, 0xfee00900}) ioctl$KVM_SET_GUEST_DEBUG_x86(r3, 0x4048ae9b, &(0x7f0000000240)={0xe0003, 0x0, {[0x8, 0x7, 0x4, 0x8, 0x3, 0x8, 0x4, 0x4]}}) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f0000000000)=[@nested_amd_vmsave={0x183, 0x18, 0x3}, @nested_create_vm={0x12d, 0x18}, @nested_load_code={0x12e, 0x5d, {0x0, "48b8008000000000000066ba6100b8555ad4abef2fad21e6e60c0020000f23f86592927716b9800000c00f3235000800000f30d035000100000f006080000f47dff2b00f30"}}], 0x8d}) (async) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000000)={[{0x80000004, 0x5, 0xcb, 0x8, 0x7c, 0x2, 0x80, 0xe3, 0x3, 0x80, 0x8, 0x2, 0xe}, {0xe, 0xfffd, 0x3, 0x0, 0x9, 0x3, 0x8, 0x4, 0xd, 0x13, 0x3, 0xc8, 0x1}, {0x1ff, 0x5, 0xc, 0x0, 0x26, 0x4, 0x81, 0xfb, 0x4, 0x4, 0x0, 0xfe}], 0x9}) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) (async) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x48}]}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000000)={0x0, &(0x7f00000001c0)=[@nested_amd_invlpga={0x17d, 0x20, {0x1, 0xa0d1}}], 0x20}) (async) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000340)={[0x1, 0x749, 0x8001, 0x1, 0x3, 0x34, 0x2, 0x7c73af4, 0x8b, 0x5, 0x4, 0x3, 0x3f89, 0x39, 0x4, 0x100000000], 0x58000, 0x301}) (async) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, &(0x7f0000000180)={0x2, 0x0, 0x1}) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000200)={{0x0, 0xffffffff, 0x8, 0xb, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}, {0x0, 0xffffffff, 0x10, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x0, 0xffffffff, 0x10, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1}, {0xeeef0000, 0xffffffff, 0x10, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x0, 0xffffffff, 0x10, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x0, 0xffffffff, 0x10, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x0, 0xffff, 0x18, 0xb, 0x1}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {}, {}, 0x80050033, 0x0, 0x2000, 0x20, 0x0, 0x500, 0xfee00900}) (async) ioctl$KVM_SET_GUEST_DEBUG_x86(r3, 0x4048ae9b, &(0x7f0000000240)={0xe0003, 0x0, {[0x8, 0x7, 0x4, 0x8, 0x3, 0x8, 0x4, 0x4]}}) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) 26.254048ms ago: executing program 2 (id=20): r0 = mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x42, 0x1ff) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="7f454c4607fc3c4f010001000000000002003e000700000094020000000000004000000000000000dd0100000000000033000000000038000100000033030000030000000000000004000000070000000000000001000000c801000000000000e8"], 0xec) close(r1) syz_ublk_add_dev(0xffffffffffffffff, 0x0, r0, 0x0, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x5, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000140)=@any_dev={0x1, 0xdbb, 0x0, 0x0, 0x1000, 0x7, 0xffffffffffffffff, 0x0, 0x81}}}, &(0x7f0000000200)=0x0) r3 = openat2(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)={0x28000, 0x1a, 0xa}, 0x18) r4 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x20842, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2d, 0x10012, r4, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(0xffffffffffffffff, 0x4058587a, &(0x7f0000000540)={{0xffffffffffffffff, &(0x7f0000000380)='\x00', 0x21e101, &(0x7f00000003c0)={@align=0x7, {0x5, 0xc, 0x37, 0x5}}, 0xfffffff9, &(0x7f0000000400)={@_ha_fsid}, &(0x7f0000000440)=0x3}, {[0x6, 0x0, 0xc39, 0x3]}, 0x7, 0x91, &(0x7f0000000480)=""/145}) syz_ublk_setup_queues(r1, r2, &(0x7f0000000240)={0x0, 0xfe27, 0x80, 0x6, 0xf4}, &(0x7f00000005c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x10b6, 0x40, 0x3, 0x231, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xbd7c, 0x2, 0x3, 0x3c2, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xbb6, 0x400, 0x0, 0x15}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x203, 0x800, 0x1, 0x28f, 0x0, r5}}], 0x4, &(0x7f0000001840)={0x2e, 0x21, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x3}, 0x0, 0x0, '\x00', {0x3, 0x8c7, 0x0, &(0x7f0000000840)=@buf_4k="7f42e9a82e20a9220a0bf23d9a152029e04c090dfbdcff364c8c4f1ee62f6980c2a438592e2fa9d86ba548ef5668b4da34a6de8815216e77042116744fcf5a0920f90ae99cbc9505732244ddf2bab1761ef3e16d37131a8d5285f104b8edb4bce96c69a2c0559f62da6de70d826e43a5775ec68426d9ffef9b57bed6561724f94801f4fcb3339797c2fee0e7e42f85871e72be7249dba964f300d6327d1530312a182bbd348667375f0759e0f41eef8b0799dd0792cd95f467f1163728383676dba8948e9b458fe94f98c41452fe1fcd74e7c5ca7fa6b8277025a12e5ad10a85f07d4cb94c435b998cc133099738ada9e43abc47902925b31fe95ba17e9cb2187adcd0822ca13b7e33be562fcff90dd2ca8b357ecc9227b2cbbd227c174c24432b798372b8042812d43a850dab82b6ca7a5dddc7868e56c3d01eaf903ebead8036b50c31e33e5d457f805a5ea790537945faf384ff6d6082d7266dc0b609a9ad365f6d5b8b0e43a355fe1353f7474564774c79a342ef1652f96003ce4e62346ac72a0423ed2dbe2ec7137cbe58ccd5cc5e3d632594100816a24f36636cf3ade14544cd8ac85b4fbdbce96cc366767e181e21e7b23a90c67d9db1386ee2705d68bde12b7568f8259dca615224ec00a306ca8581bce103ac3a67d7b48c339ac0474d0246bbfda7fb62e922b59828a2e69b3a5ee6c25519665fff3515898c801ed34c653407d9db78a99b7d02ae1a0368c2f12afeb5019d977b86d7e903a2680547468cf8e7a85c23747e12638dc79ffa2e583a11ab7322c55a7fa67182d9de0b9550a9ec232bcd4b4f91f31f7f7f2bc1697f5b2d9412c8ec91e72a462413facfd2bc2ea322a4a8906b8dc96408d6d63289fa3f6d68378b448f30a41cfa8260c70708afa6a7d2ecc782f741505937033c6811a5b21a455ba4c24fde88cb8eb2d5f6c5692700e12a157c39e62d291e1d6accd427b2049ee2e8a142aeed24b11b33678587c4a708d9f2a0ea85bfbbdd2616d5c78465524e67e7c0f48838a93b10f9eb08be8134ef789a6e3947be99bcb821deb90c759097a60cef63c05433ad58d410b4661b1a48bc50c56758150aa77b0c256d296cc6d56ed0e09bb1b52ae75179436b86b999fb9187e7134aec3c01c1357a2f0c56788e6183939a1f40bd5fd225ebaba5f35eeecebb511cb2af08ba8687efd00df07d4c51806b39ec949d1b32433c4650dd59364e4720503e59161e20cc9a5ef2ad6fb4cc5a5c28b0467b54fa195e037eb2266d609d19cab5b1c77c392a4165e5772c3629b098a0a7d28e18e484731d1dd79659a2a02442a93d2f5ce12c1bf0b9ed276e42aceca3a7a6e332c7cba02b41823d12e1863e9f5601e46cf67faab4ff2a06961f2beb01ee540e1d1190ddffcca7527f0c96afd47047907511dd58296ce41544f88e3cbe6fab2b8d6999662286963debe663c8d8d083bba92b71f2329b1855aa0e39ee77a0c7f77b05e4ca06999ed4befa0c9a41edd6a12b8a5744c9ec429a9ca8cceebec8d71fd6c108837c76c7531f8ac46db650b76960456d5f4991674877552eba87323c3b89d85ad4550415ca58c5fa1be93b9baea183f534664405dff6cec9cdf73a41fb7e2368132656d956cbd840d96e8c3e0e1b4f2871981429254832bb1dbf3b378aa587ce7bea5108a2fa8279428bbf2651b9d94e04ce4ab2ea5f4634884e89ce502a2cb4e84993db92d0fead3ab607af7db96550c5e098aab9c85771b6e2bb50844533fe87595aa7fdf35ea1232d51478c115a79a183b2e7edae24cfe58e5c3cd5434a07a2c1516cc6405a75c823eb99c948f7356e8dd58b3520d487a576c6f534d6dc93f77af642212f9daf2474375ba51e91daab4e6cebed3ca6bb0022799611b1247660024a203212371606367d6293d8f7a0c28ff1065ff92c79282d0a8365c2355522c665abaf05c81a95139c3ce4b795fec7fec1cbea3928a595cd9e6682ff1ac760ba1fde00707eb5dd17e37642bdb49d981f7dce68b84e6cdbf9ae499de0403bd4178c7217f40384d7d06f44f2102d779f89dbce55f37aedb32e1f5d4184fc159554aca4e938a66685c6a89fed71f6c612daf702905e2a5ad6ebfd830477d3c4534393be171a66703b6b9383ccbd7075636dd087dd26a3f642caffe0607096ce97bf5a49408f4f49118fcb8c99b66f65f75caf79da08ec46186fcacfcb90139861af0f129e17a61227fb78aa612b568647f6a4fdd9405b89b112c84579b6ae6eda77f6bf6bfad25590716a0a0b238e7da0cce760652ba174d576e1a8effd715dc349262ff1455df551f8b1c62c91342788bddebb56be3fb69235db94b7e99b5f05609d9689e545c3e782a43f910d575f904dfdba7aa83d6c74a6ee034c04c5371a0ee7d1eef27cbb222bb118aae24ea084657ed5e96c22be0c090cabcdcb6b01cca39ea5271aed96d7efcacefec579317cda598b9bb701745dbf08a31d10da09ed69b44ece699f04c962290b9e53a0455c686cb9074ad5833077a31d29548ceb60b57573815fa0e68201f0519939bf9a9ce27144a887c4d7989a5e1cb6c56b58af8b384149d9b526fd1f1e478931e1d979fa59c9dbf5885cf4e24cfcf0952adde0a29da2f138e27eb6025a5456d33050f18c5ee36d90c9b8e3ecad3f4d562a313ff138ada0bfa06997c10faaf1e733e0eb98d45b4fc5cd026b17ede69c09242ba27f0000eaf46e632ac99080b249c447ae714c8ad22fa145e66119b5f0b683b861db6d30ccb2bf43a2f10882db43a488c60c1446cb1a6ba4e92dae16dadf387066ea112edab187b8d1a946f16263c932008e6e89de50c0836475554cce198cd9ec9bb95afc196ddf8b41364a61d1ae72296a371d061cd67afd78acc6ebde8e745ce9db84ad0bcfad549fbb962e56cb2b743b84cb66fc4d5314a25f32d5964f55ee48875a7d4fed4a9e403a4b8ead8c7e33a78dc9a074338b11faa322be5cf5351d0cb871e44266c4c8886618ba600b8d4bb1297bc9952f2449b6e2bac5eda1c80f4cd69f73bdd9db48af7946f6bdbb228dee6a13b58c06b9d96190db3b047f948ffaaa7272f6d8f4fee3c24f12f38f6c22467cda41467d1f75f30e093661b79ebfa430b785a58531b7506b24d97f332484493bd35b6e2694b9839af87f4da168d1ed3b068b280fbd9d9af4dba70f06c12e45a568ec19681aedac3dfedafec2cf939d24f86e2313a70608b5e65926781d26ea5533033985e1857a44824f2709c980103b260f82d8f9a5ae9056a93a7f13dadbbec4f0d0c9dbb6604a8961995898cf13e1abe554922442de705ef74ec8cb3048d422127fc34b09a6e4585c68b679e7e8f55c323f78fdee3a0541765fa2529d8ac5c0bbb9c5963b6ba68f6d464c6b42c024aada697bb2263a077cf385873eab81917f2637957175a6cb2f0c62156baec630b4ec6bb303d9f7a81a0c1cdef98ee9c48668fb52ccd74ae0b2e53cd1700fc0e96d1323c53422d04865dd67b1a92b1e879d474e5d681e6590b87a04b07315bdf6dc92fcd8bd56c92e8bdfb22d8c00a6498bcc582a7bd58a8190e4cc3ba9402e45905d5b7c93e47e2df0479f467040df27f7281069fa091fbea69ddddedaf8941a22e6c27d28d38dfc1fc6f4afcfd5955706417b27c12654c56b35e2aae5feec09987678889b84fd52adec2bcc58263e9cc0fca6d8f79a972b3f778428b567e9a2d03b7f5e4f8c40f1452a0bdae0e41f05fb7808ba76759a01f12005d3fe3b780e73cb8a661a36f701d4e53972c1a7c78c8ba627bc8f54856ddc1343da768732dc0ece148133b1b0f259dc98e049123c8fd02820f7c5fd7c1a67770152fc05475aa8c8cebf1a553d639a13f0ca1c21383bb20242470eea048a0e527f2fc1f601befa5b2029a61797ac867536273e6180d0ac6998b5b11fe7a46a905f46bc87ab18bb81a44d295f97da938474385defbc0986d7da7af286f2886452ff3e05157096ad9cae42214a74449825d1016323346776910c5737ac6d857c6c675c81bd119ce32f5139c45c1a2f6c7a3ca3d82ba455f6b2df927648c2fb2cacaffa60f64a360be4104ede004f7e8465f0a24e9fbd1da609c161e3cad1c3406c33d45bf02045157e51015f2505f0ab2ba019aedaf93dff4495661d7a8180636e3ed141d4887372df394cff6ec5e3652bdb0e0bbf5b54ee8d925f8bd995084fc19312c7310798c110a01de50003be91c61954ef86cb0716628e64fb86fbccd0e15f5c0cdd45e3161b7df46e49f2817e93dabdda428880e432f0919f4de3c7b8e88ba1d5049235bd171c9b8ea9c801b0876e58d5a64b3181b7d47124743f4abfcf55e4471ed92a1caa9c0f9dc2cf5865cb03a96a249c0edefbfa176086da2dbe9cd54417201a10fa7369caad00daf8652e99f45c27069d683b59cc0e4fddab1438b5e5e3077034b2512e7276f575b343ccf2203a401e425f1b4e0a57fdbff61c6244cb9be3bae0036887e93471c7f189341c03aaf048278791a51228b4ea71268dd685179ae392b478cd30ea1acd2e6c8e3b97f87f71496f18b831e69799045bea539075f4622b906eece2eccccadb325a9b73f7e7360310caca17927f01f5df979a188f68953fd3a1c9a89af288d0b209532103d469d1893dd80d49f4b6cf94c16e51440d1e974ff8b423434f3f3ca351c9d5b31193625ddd0fe1990bc32f78b2d96b5e1c01f4fa4f77eec661d8da5daf99710680598b2d5ff2abfaa24dddabe4fbc49f6ce29769fe24a02ef83261a2f5c314a698f1c67992291be995a44588c575567b0840c21f0d88832ca6297130887113d5a011f70c8dcc21f9697dd905420af835abd6cbde0d5e6f55cb41571bed63a7eed04b31710fbfbe95a1f7435ef1919dc0bc8d2b56d8ca6a6f43e357ec6231afb0bcefd944940b4379ac16f9db1c899b8d43b67d2d8066963136161e6a4b8ca2303311083551cfcfacbe8f0b48652ff764182d4c8162cc2a3c9870ad217fb049f289a695836807e6231b73eb3ef1db94f58c47dbb1c389d87c0ed71bfa70cf7910a0610c25e25840fdd9588efe37649006bba95572fefbf4e29dc955f69206c8f12924175688b47274c22ea8bbbd0ba64e4b6370a7aa5460f4ec23cb7086a2d60728edc6ca5990c4ed12bfeb4a2e96981838cdafde962eb7c4b19655ccf71d4afcc63ac179f37fadf76cf0e841856db932aecb2ea2a89c69e4c8c2e3a508eb751cd2b9b5c6d824bef530f900f4f1327ac709e045a4dbd96dbf709a5c72f8e5eec4c659f667b0a5d8b94ceff890a14815b721f0a12b73068139ee5f59c6cd3cc4dbab8515997b8abd94f02c3280ae172885eb131570bd3b034173af18406469dae8ac3fb4dd2774f5de2709963bf704c8e3d51b5a0d5099f201f04ae07a7a88d31467d5b6f369f4706f161233054e00456e72cbf17a11c4440cc8b48ae99aaa5b783dbfba1f3d158d74e492a8ec91aa95318769f7b91f304e65fc92e0b20ede0f7bb71dedad80b89d54aabbb78cdfd7e7e325bf3cbf7e7dd3132d4f633c13034aaaab9a2a8ded78c7c388e10f07a5637c67fdbb3410f0e1460ecf464e98daf673398c3af88d9453960b31a56ec8a0cd8be1fe6923b3eb7953b728929cf5b705d812b9d05ad7cdf6c20264b52322e74e60f604887803f034d17fe3be1f8101b51db5c819fd2ef894ffebb6c8659cd1c5716fb2766322f7eae089d5484820e45505f8d11c8524307bd1a438b70d0ad101299675d7968da791e438c27ef5f96ca6b584d3af5fee1894129f18ea25fc04151617ca"}}, &(0x7f00000018c0)) syz_ublk_setup_io_uring(0x201d, &(0x7f00000000c0)={0x0, 0x80000000, 0x4000, 0x0, 0x320}, 0x0, 0x0, 0x0) 17.299168ms ago: executing program 2 (id=21): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)={0x184, 0x19, 0x1, 0x0, 0x0, {0x1d, 0xd601, 0x9}, [@nested={0x4d, 0x12, 0x0, 0x1, [@generic="d09178d2da3477ec73a38ffffcd82caf103bc848f7ff22290bd6c0375f437b167f431ad24706d7263978db87dbaa159b0fdec8e129e835688cf370555aa8c6dffe261622b114299d6f"]}, @nested={0x11e, 0x6, 0x0, 0x1, [@typed={0x109, 0x0, 0x0, 0x0, @binary="7ec7ba67da011673ff1ab09e525585242784f25a94b9c1a68abdaf9f8add1006a67b4d693c1288f571c5170a818b005fdb1329cbfdf218310f40d1f304d996dc626d41898d87422f8bbb41206c39321b335fc70c9286ebdbb773955fe26f7c912cd9171c6d320a539fa594287d65bcb8b52f24e49a1ba39633cd52f1c1bf2930116650533617839f03127338b37b0d07242de37293ea67a40f2a4cd4cc5063766dac6d2766fe27e39a9154f81b08f957567d5997ae2ac9132fb043e493299254b85d88c6c24bbbd025319996e97994723530e334584477d2eb82c28b60bf2ff5b963ee93a2d8b0c02aeb1ab1e8f02d332611e22b66a6e906836600"/261}, @generic="d83bea4ae74b4d194feb3f8d8b6d"]}]}, 0x184}}, 0x0) r1 = openat$dm_control(0xffffffffffffff9c, &(0x7f00000013c0), 0x2, 0x0) ioctl$DM_DEV_CREATE(r1, 0xc138fd03, &(0x7f0000001400)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f00000001c0)={0x3, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="0203e302040000002cbd04d30e08030100000000"], 0x20}, 0x1, 0x7}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$SO_TIMESTAMP(r3, 0x1, 0x40, 0x0, &(0x7f0000000280)) ioctl$DM_TABLE_LOAD(r1, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x198, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0xc88, 0x0, 0x60, 'snapshot-merge\x00', {@ram_num={'1:', 0x1}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'p', 0x20, '0'}}]}) 0s ago: executing program 0 (id=22): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000406c256d0000000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000040)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="000005"], 0x0, 0x0, 0x0, 0x0}, 0x0) (async) syz_usb_control_io(r0, &(0x7f0000000040)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="000005"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_usb_connect(0x5, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000772904202404019957c2010203010902240001000010000904430002317d5500090502020002020000090582020002", @ANYRES32=r0, @ANYRES16=0x0, @ANYRES16=r0], 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.156' (ED25519) to the list of known hosts. [ 21.762976][ T36] audit: type=1400 audit(1793534404.930:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.765928][ T286] cgroup: Unknown subsys name 'net' [ 21.785655][ T36] audit: type=1400 audit(1793534404.930:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.812925][ T36] audit: type=1400 audit(1793534404.960:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.813319][ T286] cgroup: Unknown subsys name 'devices' [ 21.937580][ T286] cgroup: Unknown subsys name 'hugetlb' [ 21.943175][ T286] cgroup: Unknown subsys name 'rlimit' [ 22.037281][ T36] audit: type=1400 audit(1793534405.210:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.060464][ T36] audit: type=1400 audit(1793534405.210:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.085158][ T36] audit: type=1400 audit(1793534405.210:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.114469][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 22.123262][ T36] audit: type=1400 audit(1793534405.290:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.148740][ T36] audit: type=1400 audit(1793534405.290:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.177877][ T36] audit: type=1400 audit(1793534405.350:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.203405][ T36] audit: type=1400 audit(1793534405.350:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.203981][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.415025][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.425088][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.433427][ T293] bridge_slave_0: entered allmulticast mode [ 23.440225][ T293] bridge_slave_0: entered promiscuous mode [ 23.456847][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.463898][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.471010][ T293] bridge_slave_1: entered allmulticast mode [ 23.477205][ T293] bridge_slave_1: entered promiscuous mode [ 23.548797][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.555963][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.563017][ T297] bridge_slave_0: entered allmulticast mode [ 23.569703][ T297] bridge_slave_0: entered promiscuous mode [ 23.579875][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.586929][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.593987][ T297] bridge_slave_1: entered allmulticast mode [ 23.600277][ T297] bridge_slave_1: entered promiscuous mode [ 23.667996][ T299] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.675042][ T299] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.682150][ T299] bridge_slave_0: entered allmulticast mode [ 23.688368][ T299] bridge_slave_0: entered promiscuous mode [ 23.697729][ T298] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.704777][ T298] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.711899][ T298] bridge_slave_0: entered allmulticast mode [ 23.718131][ T298] bridge_slave_0: entered promiscuous mode [ 23.724247][ T299] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.731400][ T299] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.738579][ T299] bridge_slave_1: entered allmulticast mode [ 23.744768][ T299] bridge_slave_1: entered promiscuous mode [ 23.755011][ T298] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.762109][ T298] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.769221][ T298] bridge_slave_1: entered allmulticast mode [ 23.775397][ T298] bridge_slave_1: entered promiscuous mode [ 23.845684][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.852747][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.860080][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.867129][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.901739][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.908796][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.916080][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.923154][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.942583][ T298] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.949635][ T298] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.956912][ T298] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.963941][ T298] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.000022][ T299] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.007093][ T299] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.014352][ T299] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.021408][ T299] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.034939][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.042443][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.050312][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.057831][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.065081][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.072531][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.079684][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.087033][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.101774][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.108836][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.116607][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.123655][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.139443][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.146515][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.155654][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.162692][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.173729][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.180808][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.189494][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.196549][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.221036][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.228117][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.236366][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.243411][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.280089][ T293] veth0_vlan: entered promiscuous mode [ 24.299623][ T297] veth0_vlan: entered promiscuous mode [ 24.310236][ T298] veth0_vlan: entered promiscuous mode [ 24.322277][ T293] veth1_macvtap: entered promiscuous mode [ 24.337166][ T297] veth1_macvtap: entered promiscuous mode [ 24.343921][ T299] veth0_vlan: entered promiscuous mode [ 24.354823][ T298] veth1_macvtap: entered promiscuous mode [ 24.375609][ T299] veth1_macvtap: entered promiscuous mode [ 24.406129][ T293] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 24.439322][ T315] 9p: Unknown access argument 18446744073709551615: -34 [ 24.468076][ T318] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 24.755835][ T65] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 24.907276][ T65] usb 2-1: unable to get BOS descriptor or descriptor too short [ 24.915940][ T65] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 24.927725][ T65] usb 2-1: New USB device found, idVendor=8086, idProduct=0ad2, bcdDevice= 0.00 [ 24.936862][ T65] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 24.944858][ T65] usb 2-1: Product: syz [ 24.949065][ T65] usb 2-1: Manufacturer: syz [ 24.955904][ T65] usb 2-1: Found UVC 1.00 device syz (8086:0ad2) [ 25.156843][ T65] usb 2-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 25.166438][ T65] uvcvideo 2-1:1.1: Failed to query (129) UVC probe control : -71 (exp. 26). [ 25.175238][ T65] uvcvideo 2-1:1.1: Failed to initialize the device (-71). [ 25.184248][ T65] usb 2-1: USB disconnect, device number 2 [ 25.325813][ T311] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 25.475849][ T311] usb 1-1: Using ep0 maxpacket: 16 [ 25.482084][ T311] usb 1-1: config 0 has an invalid interface number: 34 but max is 0 [ 25.490403][ T311] usb 1-1: config 0 has no interface number 0 [ 25.496722][ T311] usb 1-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 25.506986][ T311] usb 1-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 25.522453][ T311] usb 1-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 25.532030][ T311] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.542921][ T311] usb 1-1: Product: syz [ 25.547368][ T311] usb 1-1: Manufacturer: syz [ 25.552005][ T311] usb 1-1: SerialNumber: syz [ 25.557666][ T311] usb 1-1: config 0 descriptor?? [ 25.563082][ T344] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 25.570575][ T344] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 25.779579][ T344] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 25.787057][ T344] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 25.865819][ T345] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 25.935833][ T312] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 25.995906][ T311] asix 1-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 26.025809][ T345] usb 3-1: Using ep0 maxpacket: 32 [ 26.032214][ T345] usb 3-1: unable to get BOS descriptor or descriptor too short [ 26.040613][ T345] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 191, changing to 7 [ 26.053228][ T345] usb 3-1: New USB device found, idVendor=0582, idProduct=0012, bcdDevice= 0.40 [ 26.062562][ T345] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.070654][ T345] usb 3-1: Product: syz [ 26.074913][ T345] usb 3-1: Manufacturer: syz [ 26.079548][ T345] usb 3-1: SerialNumber: syz [ 26.085959][ T312] usb 2-1: Using ep0 maxpacket: 32 [ 26.092191][ T312] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 26.100312][ T312] usb 2-1: config 0 has no interface number 0 [ 26.108023][ T312] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 26.117096][ T312] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.125129][ T312] usb 2-1: Product: syz [ 26.129342][ T312] usb 2-1: Manufacturer: syz [ 26.133951][ T312] usb 2-1: SerialNumber: syz [ 26.139482][ T312] usb 2-1: config 0 descriptor?? [ 26.145303][ T312] smsc95xx v2.0.0 [ 26.286999][ T345] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 26.299932][ T345] usb 3-1: USB disconnect, device number 2 [ 26.807441][ T36] kauditd_printk_skb: 59 callbacks suppressed [ 26.807458][ T36] audit: type=1400 audit(1793534409.980:133): avc: denied { read } for pid=343 comm="syz.0.9" name="binder-control" dev="binder" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 26.852724][ T36] audit: type=1400 audit(1793534409.980:134): avc: denied { open } for pid=343 comm="syz.0.9" path="/dev/binderfs/binder-control" dev="binder" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 26.877273][ T36] audit: type=1400 audit(1793534410.010:135): avc: denied { mount } for pid=343 comm="syz.0.9" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 26.880905][ T344] FAULT_INJECTION: forcing a failure. [ 26.880905][ T344] name failslab, interval 1, probability 0, space 0, times 1 [ 26.899674][ T36] audit: type=1400 audit(1793534410.050:136): avc: denied { create } for pid=361 comm="syz.2.14" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 26.931381][ T344] CPU: 0 UID: 0 PID: 344 Comm: syz.0.9 Not tainted syzkaller #0 1736d3b6ee88961c9d73e511fbf4428dbce80e3d [ 26.931463][ T344] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 26.931515][ T344] Call Trace: [ 26.931534][ T344] [ 26.931553][ T344] __dump_stack+0x21/0x30 [ 26.931615][ T344] dump_stack_lvl+0x140/0x1c0 [ 26.931669][ T344] ? __cfi_dump_stack_lvl+0x10/0x10 [ 26.931715][ T344] dump_stack+0x19/0x20 [ 26.931759][ T344] should_fail_ex+0x3c2/0x510 [ 26.931842][ T344] should_failslab+0xac/0x100 [ 26.931863][ T344] kmem_cache_alloc_noprof+0x42/0x410 [ 26.931942][ T344] ? security_file_alloc+0x49/0x220 [ 26.932033][ T344] ? kasan_save_alloc_info+0x3a/0x50 [ 26.932101][ T344] security_file_alloc+0x49/0x220 [ 26.932165][ T344] init_file+0x9e/0x210 [ 26.932220][ T344] alloc_empty_file+0xd9/0x270 [ 26.932282][ T344] ? _raw_spin_unlock+0x45/0x60 [ 26.932327][ T344] alloc_file_pseudo+0x142/0x1f0 [ 26.932371][ T344] ? security_inode_init_security_anon+0x3e/0x110 [ 26.932433][ T344] ? __cfi_alloc_file_pseudo+0x10/0x10 [ 26.932489][ T344] ? anon_inode_make_secure_inode+0xf5/0x150 [ 26.932544][ T344] ? __cfi_anon_inode_make_secure_inode+0x10/0x10 [ 26.932607][ T344] ? __kasan_kmalloc+0x96/0xb0 [ 26.932654][ T344] __anon_inode_getfile+0x12e/0x200 [ 26.932718][ T344] anon_inode_create_getfile+0x3f/0x50 [ 26.932780][ T344] io_uring_create+0xc61/0x13f0 [ 26.932842][ T344] __se_sys_io_uring_setup+0x2a4/0x2b0 [ 26.932944][ T344] ? __se_sys_futex+0x13c/0x320 [ 26.933000][ T344] ? __x64_sys_io_uring_setup+0x80/0x80 [ 26.933052][ T344] ? __kasan_check_write+0x18/0x20 [ 26.933117][ T344] __x64_sys_io_uring_setup+0x5f/0x80 [ 26.933188][ T344] x64_sys_call+0x22c0/0x2ee0 [ 26.933237][ T344] do_syscall_64+0x57/0xf0 [ 26.933297][ T344] ? clear_bhb_loop+0x50/0xa0 [ 26.933393][ T344] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 26.933468][ T344] RIP: 0033:0x7fa55079f559 [ 26.933513][ T344] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 26.933558][ T344] RSP: 002b:00007fa551682fb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 26.933620][ T344] RAX: ffffffffffffffda RBX: 0000200000000ac0 RCX: 00007fa55079f559 [ 26.933658][ T344] RDX: 0000000000000000 RSI: 0000200000000ac0 RDI: 0000000000000002 [ 26.933695][ T344] RBP: 00007fa550836b50 R08: 0000000000000000 R09: 0000000000000008 [ 26.933724][ T344] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 26.933753][ T344] R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffe3cd74bc8 [ 26.933791][ T344] [ 27.197406][ T36] audit: type=1400 audit(1793534410.080:137): avc: denied { write } for pid=361 comm="syz.2.14" path="socket:[3482]" dev="sockfs" ino=3482 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 27.221625][ T36] audit: type=1400 audit(1793534410.240:138): avc: denied { ioctl } for pid=343 comm="syz.0.9" path="/dev/binderfs/binder-control" dev="binder" ino=2 ioctlcmd=0x6201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 27.266542][ T311] asix 1-1:0.34 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 27.279562][ T311] asix 1-1:0.34: probe with driver asix failed with error -71 [ 27.288468][ T311] usb 1-1: USB disconnect, device number 2 [ 27.554388][ T36] audit: type=1400 audit(1793534410.720:139): avc: denied { append } for pid=368 comm="syz.3.17" name="001" dev="devtmpfs" ino=114 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 27.581571][ T369] netlink: 32 bytes leftover after parsing attributes in process `syz.3.17'. [ 27.590879][ T36] audit: type=1400 audit(1793534410.750:140): avc: denied { read write } for pid=368 comm="syz.3.17" name="ppp" dev="devtmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 27.615645][ T36] audit: type=1400 audit(1793534410.750:141): avc: denied { open } for pid=368 comm="syz.3.17" path="/dev/ppp" dev="devtmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 27.638484][ T36] audit: type=1400 audit(1793534410.750:142): avc: denied { ioctl } for pid=368 comm="syz.3.17" path="/dev/ppp" dev="devtmpfs" ino=86 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 27.686933][ T371] ======================================================= [ 27.686933][ T371] WARNING: The mand mount option has been deprecated and [ 27.686933][ T371] and is ignored by this kernel. Remove the mand [ 27.686933][ T371] option from the mount to silence this warning. [ 27.686933][ T371] ======================================================= [ 27.725612][ T371] overlayfs: overlapping lowerdir path [ 27.808936][ T379] ================================================================== [ 27.817042][ T379] BUG: KASAN: slab-use-after-free in snapshot_ctr+0x586/0x1350 [ 27.824638][ T379] Read of size 8 at addr ffff888112ce7d98 by task syz.2.21/379 [ 27.832199][ T379] [ 27.834531][ T379] CPU: 1 UID: 0 PID: 379 Comm: syz.2.21 Not tainted syzkaller #0 1736d3b6ee88961c9d73e511fbf4428dbce80e3d [ 27.834556][ T379] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 27.834575][ T379] Call Trace: [ 27.834582][ T379] [ 27.834590][ T379] __dump_stack+0x21/0x30 [ 27.834610][ T379] dump_stack_lvl+0x140/0x1c0 [ 27.834629][ T379] ? __cfi_dump_stack_lvl+0x10/0x10 [ 27.834646][ T379] ? __cfi__printk+0x10/0x10 [ 27.834674][ T379] print_address_description+0x71/0x210 [ 27.834705][ T379] print_report+0x4a/0x70 [ 27.834734][ T379] kasan_report+0x162/0x1a0 [ 27.834754][ T379] ? snapshot_ctr+0x586/0x1350 [ 27.834774][ T379] ? snapshot_ctr+0x586/0x1350 [ 27.834793][ T379] __asan_report_load8_noabort+0x18/0x20 [ 27.834819][ T379] snapshot_ctr+0x586/0x1350 [ 27.834838][ T379] ? dm_split_args+0xa1/0x740 [ 27.834865][ T379] ? __cfi_snapshot_ctr+0x10/0x10 [ 27.834884][ T379] ? dm_split_args+0x5d0/0x740 [ 27.834912][ T379] dm_table_add_target+0x59c/0xcb0 [ 27.834941][ T379] table_load+0x2eb/0x7d0 [ 27.834963][ T379] ? __check_object_size+0x99/0x870 [ 27.834991][ T379] ? __cfi_table_load+0x10/0x10 [ 27.835015][ T379] ? __kasan_check_write+0x18/0x20 [ 27.835040][ T379] ? __cfi_table_load+0x10/0x10 [ 27.835063][ T379] dm_ctl_ioctl+0x8f3/0xde0 [ 27.835088][ T379] ? __cfi_dm_ctl_ioctl+0x10/0x10 [ 27.835116][ T379] ? __fget_files+0x2bc/0x330 [ 27.835135][ T379] ? bpf_lsm_file_ioctl+0xd/0x20 [ 27.835155][ T379] ? security_file_ioctl+0x3e/0x110 [ 27.835180][ T379] ? __cfi_dm_ctl_ioctl+0x10/0x10 [ 27.835203][ T379] __se_sys_ioctl+0x126/0x1b0 [ 27.835229][ T379] __x64_sys_ioctl+0x7f/0xa0 [ 27.835248][ T379] x64_sys_call+0x1878/0x2ee0 [ 27.835268][ T379] do_syscall_64+0x57/0xf0 [ 27.835285][ T379] ? clear_bhb_loop+0x50/0xa0 [ 27.835309][ T379] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 27.835332][ T379] RIP: 0033:0x7fd41199f559 [ 27.835349][ T379] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 27.835366][ T379] RSP: 002b:00007fd41290d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 27.835386][ T379] RAX: ffffffffffffffda RBX: 00007fd411c25fa0 RCX: 00007fd41199f559 [ 27.835401][ T379] RDX: 0000200000000000 RSI: 00000000c138fd09 RDI: 0000000000000004 [ 27.835414][ T379] RBP: 00007fd411a36b50 R08: 0000000000000000 R09: 0000000000000000 [ 27.835427][ T379] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 27.835439][ T379] R13: 00007fd411c26038 R14: 00007fd411c25fa0 R15: 00007fff8b7b1378 [ 27.835456][ T379] [ 27.835463][ T379] [ 28.095925][ T379] Allocated by task 379: [ 28.100190][ T379] kasan_save_track+0x3e/0x80 [ 28.104916][ T379] kasan_save_alloc_info+0x3a/0x50 [ 28.110087][ T379] __kasan_kmalloc+0x96/0xb0 [ 28.114701][ T379] __kmalloc_cache_node_noprof+0x225/0x430 [ 28.120538][ T379] dm_get_table_device+0x1e3/0x6c0 [ 28.125676][ T379] dm_get_device+0x32b/0x7f0 [ 28.130321][ T379] snapshot_ctr+0x292/0x1350 [ 28.134936][ T379] dm_table_add_target+0x59c/0xcb0 [ 28.140098][ T379] table_load+0x2eb/0x7d0 [ 28.144458][ T379] dm_ctl_ioctl+0x8f3/0xde0 [ 28.148981][ T379] __se_sys_ioctl+0x126/0x1b0 [ 28.153676][ T379] __x64_sys_ioctl+0x7f/0xa0 [ 28.158287][ T379] x64_sys_call+0x1878/0x2ee0 [ 28.162992][ T379] do_syscall_64+0x57/0xf0 [ 28.167430][ T379] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 28.173377][ T379] [ 28.175721][ T379] Freed by task 379: [ 28.179638][ T379] kasan_save_track+0x3e/0x80 [ 28.184358][ T379] kasan_save_free_info+0x44/0x50 [ 28.189423][ T379] __kasan_slab_free+0x5f/0x80 [ 28.194213][ T379] kfree+0x158/0x440 [ 28.198142][ T379] dm_put_table_device+0x298/0x2e0 [ 28.203321][ T379] dm_get_device+0x571/0x7f0 [ 28.207977][ T379] snapshot_ctr+0x435/0x1350 [ 28.212619][ T379] dm_table_add_target+0x59c/0xcb0 [ 28.217772][ T379] table_load+0x2eb/0x7d0 [ 28.222136][ T379] dm_ctl_ioctl+0x8f3/0xde0 [ 28.226662][ T379] __se_sys_ioctl+0x126/0x1b0 [ 28.231373][ T379] __x64_sys_ioctl+0x7f/0xa0 [ 28.235977][ T379] x64_sys_call+0x1878/0x2ee0 [ 28.240689][ T379] do_syscall_64+0x57/0xf0 [ 28.245179][ T379] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 28.251099][ T379] [ 28.253448][ T379] The buggy address belongs to the object at ffff888112ce7d80 [ 28.253448][ T379] which belongs to the cache kmalloc-96 of size 96 [ 28.267354][ T379] The buggy address is located 24 bytes inside of [ 28.267354][ T379] freed 96-byte region [ffff888112ce7d80, ffff888112ce7de0) [ 28.280987][ T379] [ 28.283335][ T379] The buggy address belongs to the physical page: [ 28.289792][ T379] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112ce7 [ 28.298679][ T379] flags: 0x4000000000000000(zone=1) [ 28.303894][ T379] page_type: f5(slab) [ 28.307921][ T379] raw: 4000000000000000 ffff888100041280 dead000000000122 0000000000000000 [ 28.316523][ T379] raw: 0000000000000000 0000000080200020 00000001f5000000 0000000000000000 [ 28.325147][ T379] page dumped because: kasan: bad access detected [ 28.331593][ T379] page_owner tracks the page as allocated [ 28.337325][ T379] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x152cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 376, tgid 376 (syz-executor), ts 27778914839, free_ts 27776922367 [ 28.356355][ T379] post_alloc_hook+0x37d/0x3b0 [ 28.361142][ T379] prep_new_page+0x2d/0x180 [ 28.365691][ T379] get_page_from_freelist+0x4aea/0x4ba0 [ 28.371273][ T379] __alloc_pages_noprof+0x35a/0x7e0 [ 28.376499][ T379] alloc_slab_page+0x6b/0x1e0 [ 28.381199][ T379] allocate_slab+0x69/0x430 [ 28.385718][ T379] ___slab_alloc+0x591/0x8c0 [ 28.390323][ T379] __kmalloc_node_noprof+0x2e7/0x500 [ 28.395647][ T379] __kvmalloc_node_noprof+0x128/0x300 [ 28.401050][ T379] simple_xattr_alloc+0x67/0x140 [ 28.406031][ T379] shmem_initxattrs+0x24f/0x530 [ 28.410928][ T379] security_inode_init_security+0x434/0x600 [ 28.416860][ T379] shmem_symlink+0xe4/0x4e0 [ 28.421397][ T379] vfs_symlink+0x3f4/0x620 [ 28.425848][ T379] do_symlinkat+0x1ba/0x400 [ 28.430388][ T379] __x64_sys_symlinkat+0x99/0xb0 [ 28.435355][ T379] page last free pid 365 tgid 365 stack trace: [ 28.441525][ T379] free_unref_page+0xb99/0xf50 [ 28.446314][ T379] __free_pages+0x6b/0x3b0 [ 28.450763][ T379] free_pages+0x86/0x90 [ 28.454949][ T379] tlb_finish_mmu+0x117/0x1d0 [ 28.459644][ T379] exit_mmap+0x458/0xc20 [ 28.463922][ T379] __mmput+0x92/0x330 [ 28.467948][ T379] mmput+0x55/0x170 [ 28.471795][ T379] do_exit+0x9a5/0x2850 [ 28.475977][ T379] __x64_sys_exit+0x44/0x50 [ 28.480533][ T379] x64_sys_call+0x2eb9/0x2ee0 [ 28.485245][ T379] do_syscall_64+0x57/0xf0 [ 28.489711][ T379] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 28.495639][ T379] [ 28.497975][ T379] Memory state around the buggy address: [ 28.503612][ T379] ffff888112ce7c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.511699][ T379] ffff888112ce7d00: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 28.519788][ T379] >ffff888112ce7d80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 28.527862][ T379] ^ [ 28.532728][ T379] ffff888112ce7e00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 28.540820][ T379] ffff888112ce7e80: 00 00 00 00 00 00 00 00 03 fc fc fc fc fc fc fc [ 28.548887][ T379] ================================================================== [ 28.558432][ T379] Disabling lock debugging due to kernel taint [ 28.564679][ T379] device-mapper: table: 252:1: device 1:5 not in table devices list [ 28.572821][ T379] device-mapper: table: 252:1: snapshot-merge: COW device cannot be the same as origin device (-EINVAL) [ 28.584111][ T379] device-mapper: ioctl: error adding target to table [ 28.591400][ T379] device-mapper: table: 252:1: dm_table_destroy: dm_put_device call missing for 1:5 [ 28.684250][ T312] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -71 [ 28.695024][ T312] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -71 [ 28.710047][ T312] usb 2-1: USB disconnect, device number 3 [ 28.845821][ T31] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 28.996858][ T31] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 29.007863][ T31] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 29.017661][ T31] usb 1-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 29.026772][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.035317][ T31] usb 1-1: config 0 descriptor?? [ 29.643776][ T389] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 29.652368][ T389] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 29.661435][ T31] usb 1-1: string descriptor 0 read error: -71 [ 29.667972][ T31] uclogic 0003:256C:006D.0001: failed retrieving string descriptor #200: -71 [ 29.676995][ T31] uclogic 0003:256C:006D.0001: failed retrieving pen parameters: -71 [ 29.685079][ T31] uclogic 0003:256C:006D.0001: failed probing pen v2 parameters: -71 [ 29.693187][ T31] uclogic 0003:256C:006D.0001: failed probing parameters: -71 [ 29.700712][ T31] uclogic 0003:256C:006D.0001: probe with driver uclogic failed with error -71 [ 29.710670][ T31] usb 1-1: USB disconnect, device number 3