last executing test programs: 355.774411ms ago: executing program 3 (id=4): socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x20000}}, {{0xa, 0x0, 0x40000, @dev={0xfe, 0x80, '\x00', 0x26}}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @loopback}}}, 0x108) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000400)=[@timestamp, @mss={0x2, 0x9}, @window={0x3, 0x7f78, 0x6653}], 0x3) close(r0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x59679518a3865ee3) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000000340)={'syz_tun\x00', 0x101}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = syz_ublk_setup_io_uring(0x2fc0, &(0x7f0000000240)={0x0, 0x49d1, 0x4, 0x0, 0x11b, 0x0, r2}, &(0x7f00000002c0), &(0x7f0000000300), &(0x7f0000000340)) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x20010, r3, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000, 0x0, &(0x7f0000ffc000/0x1000)=nil) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000006480)={0x28, 0x13, 0x1, 0x2, 0x25dfdbf6, "", [@typed={0x7, 0x0, 0x0, 0x0, @str='\x13\x00\x00'}, @typed={0x8, 0x3fff, 0x0, 0x0, @fd}, @nested={0x8, 0x1a, 0x0, 0x1, [@nested={0x4}]}]}, 0x28}], 0x1}, 0x0) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x200a7a) r5 = syz_io_uring_setup(0x7b5e, &(0x7f0000000440)={0x0, 0xc1c6, 0x8148, 0x1, 0x203}, &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(0x0, 0x101, 0x1, 0x11, r5, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x6, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r6 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) write$binfmt_register(r6, &(0x7f0000000380)={0x3a, 'syz3', 0x3a, 'M', 0x3a, 0x1, 0x3a, '\\srjquota=', 0x3a, '\x00\x03!\f\xee\x998r~\b\x13\x89\xae\xf1\x06hz\xcc\xd6\xbb\xb8\x19\x90\x9e\xdb\xa2F\xfa_F(\x05\b\x13\x82\x12\xad\x0f^\xff\a\xb5', 0x3a, './file2', 0x3a, [0x50]}, 0x5c) setns(0xc9, 0x0) r7 = socket(0x10, 0x803, 0x0) sendto(r7, &(0x7f0000000080)="120000001200e7ef00341618a585107b462e", 0x12, 0x10, 0x0, 0x0) r8 = syz_open_procfs$userns(0x0, &(0x7f0000000080)) mount_setattr(0xffffffffffffffff, 0x0, 0x900, &(0x7f0000000140)={0x100000, 0x76, 0x80000, {r8}}, 0x20) recvmmsg(r7, &(0x7f0000008780)=[{{0x0, 0x0, &(0x7f0000001980)=[{&(0x7f00000001c0)=""/69, 0x45}, {&(0x7f00000004c0)=""/179, 0xb3}, {&(0x7f0000000980)=""/4096, 0x1000}], 0x3}, 0xc8cd}], 0x1, 0x2020, 0x0) 331.369351ms ago: executing program 1 (id=2): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000280)={0x4000}, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14, 0x1e, 0xa01, 0x2, 0x0, {0x7}}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000300)={0xe4, 0x2, 0x1, 0x401, 0x0, 0x0, {0xa, 0x0, 0xa}, [@CTA_ID={0x8}, @CTA_FILTER={0x1c, 0x19, 0x0, 0x1, [@CTA_FILTER_REPLY_FLAGS={0x8}, @CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x80}, @CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x400}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x76d}, @CTA_SEQ_ADJ_ORIG={0x3c, 0xf, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x3}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x5}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x9}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0xa6a}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x1}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x100}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x7cc}]}, @CTA_ID={0x8}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x2}, @CTA_MARK_MASK={0x8, 0x15, 0x1, 0x0, 0x3}, @CTA_TUPLE_MASTER={0x10, 0xe, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}]}, @CTA_TUPLE_REPLY={0xc, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}, @CTA_FILTER={0x34, 0x19, 0x0, 0x1, [@CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x800}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x9a}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0xb00}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x1}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x10}, @CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x10}]}]}, 0xe4}}, 0x20040004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000440)=[{0x6, 0x0, 0x9}]}, 0x10) r3 = openat$tun(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000002280)={'pim6reg0\x00', 0x2102}) ioctl$TUNSETQUEUE(r3, 0x400454d9, &(0x7f0000000080)={'nicvf0\x00', 0x400}) ioctl$TUNSETTXFILTER(r3, 0x401054d5, &(0x7f0000000000)=ANY=[]) r4 = openat$tun(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000002280)={'pim6reg0\x00', 0x2102}) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000000104010200000000000900000a0000050a000200000000ff05000000050001000100000008000340"], 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x4044844) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f0000000340)=[@window={0x3, 0x15a, 0x9}, @window={0x3, 0x6, 0x17}, @mss={0x2, 0x7}, @timestamp], 0x4) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r6, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="3000000011000100"], 0x30}], 0x1}, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0x2, &(0x7f00000001c0)=0x1c, 0x4) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0369e269b9, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) r7 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSARP(r7, 0x8955, &(0x7f00000007c0)={{0x2, 0x4e23, @rand_addr=0x64010101}, {0x306, @broadcast}, 0x0, {0x2, 0x4e21, @private=0xa010102}, 'veth1_to_hsr\x00'}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r8 = syz_open_procfs(0x0, &(0x7f0000004600)='map_files\x00') fchdir(r8) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000002d80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x408d4}}, {{&(0x7f0000000080)=@abs={0x1, 0x30, 0x30}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x4004}}], 0x2, 0x40000004) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f0000005480)={&(0x7f0000005380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000005440)={&(0x7f00000053c0)={0x54, 0x0, 0x2, 0x301, 0x0, 0x0, {0x2, 0x0, 0x1}, [@CTA_EXPECT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x1}, @CTA_EXPECT_FN={0x13, 0xb, 'callforwarding\x00'}, @CTA_EXPECT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x3}, @CTA_EXPECT_ID={0x8, 0x5, 0x1, 0x0, 0x5}, @CTA_EXPECT_HELP_NAME={0x9, 0x6, 'snmp\x00'}, @CTA_EXPECT_ID={0x8, 0x5, 0x1, 0x0, 0x5}]}, 0x54}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 319.394652ms ago: executing program 0 (id=1): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80002, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000100)="d8df0f23b3b9ce000000b807000000ba000000000f301b8154fea900c1210680320000c4e28dda8dcd000000c182fd3f0000c8b9500200004d01000400b9a6080000b80000010066b87a000f00d80f300f300fc79d53bf0000c4b9e16dc3010022", 0x61}], 0x1, 0x14, 0x0, 0x0) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000000)={0x19, 0x4, 0x8}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x4000}}) ioctl$FUSE_DEV_IOC_BACKING_OPEN(r4, 0x4010e501, &(0x7f0000000040)) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r3) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000240), 0x800, &(0x7f0000000140)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@xino_on}]}) mount$incfs(&(0x7f0000000240)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000140), 0x0, 0x0) 299.163842ms ago: executing program 2 (id=3): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x1, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) write(0xffffffffffffffff, &(0x7f00000000c0)="8f2a0a65bd8c002b0304000e0580a7b6070d63e286a5cefe", 0x5ac) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x1000000000, 0x5, 0x41, 0x2000000, 0x0, 0x2004cb, 0x0, 0xa1d, 0x2000000068ff, 0x5, 0x0, 0x3, 0x2], 0x10000, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) keyctl$clear(0x7, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000100)={{0xd000, 0x0, 0x4, 0x0, 0x8, 0x0, 0x0, 0x3, 0x0, 0x8, 0x6, 0x40}, {0xffffffff, 0x10000, 0xa, 0x40, 0x2, 0x0, 0x0, 0x0, 0x7, 0xff}, {0xe6ee2000, 0x3000, 0xb, 0x0, 0x8, 0xc4, 0x0, 0x0, 0x48, 0x3, 0x0, 0xfc}, {0xeeef0000, 0xeee96000, 0xa, 0x0, 0x1, 0xa6, 0x9, 0x85, 0x8, 0x6, 0x7, 0x4}, {0xf000, 0x3ff8, 0xe, 0x0, 0x0, 0x4, 0x0, 0xfd, 0x0, 0x3c}, {0x8000000, 0xdddd0000, 0xb, 0x78, 0x5, 0x83, 0x0, 0x0, 0x3, 0xff, 0x1}, {0x1ffe, 0xeeee0000, 0xa, 0x4, 0x0, 0x5, 0xa1, 0x9, 0x0, 0x0, 0xb}, {0xffffffff, 0x6000, 0x8, 0x6, 0x0, 0x5, 0x8, 0x40, 0x26, 0x0, 0x0, 0x2}, {0x41000, 0x8cc}, {0x58000}, 0x2, 0x0, 0x0, 0x134, 0xf, 0x0, 0x0, [0x80000005, 0x8, 0x1]}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r4, 0x0, 0x2c, &(0x7f00000001c0)={0x3, {{0x2, 0x4e24, @multicast2}}, {{0x2, 0x4e21, @private=0xa010100}}}, 0x108) r5 = openat$cgroup_procs(r3, &(0x7f00000000c0)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r5, &(0x7f0000000640), 0x15) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_freezer_state(r6, &(0x7f0000000140), 0x2, 0x0) sendfile(r7, r7, 0x0, 0x9) ioctl$KVM_RUN(r2, 0xae80, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r8 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r8, &(0x7f0000000380)='\x00\x00', 0x2) r9 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r9, &(0x7f0000000200)='1', 0x1) r10 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r10, &(0x7f0000000280)='0', 0x1) io_setup(0x3ff, &(0x7f0000000500)) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x1f) ioctl$KVM_SET_TSS_ADDR(r11, 0xae47, 0x0) 263.866223ms ago: executing program 3 (id=5): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$cgroup_freezer_state(r1, &(0x7f0000000080)='FROZEN\x00', 0x7) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x2800, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x22003, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000140), 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$TUNSETOWNER(r0, 0x400454cc, 0xffffffffffffffff) 67.959668ms ago: executing program 1 (id=6): openat$kvm(0xffffffffffffff9c, 0x0, 0xac101, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_NOTIFY_DELETE(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="2f000000060000000000000000000000010000000000000002009f1594f24d36f25c"], 0x2f) ioctl$HIDIOCSFLAG(r0, 0x4004480f, &(0x7f0000000040)=0x3) 16.380579ms ago: executing program 1 (id=7): mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x4c) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000001440), 0x40102, 0x0) ioctl$RTC_ALM_SET(r0, 0x40247007, 0x0) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r3 = dup(r2) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x10800, &(0x7f0000000240)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@afid={'afid', 0x3d, 0x3}}]}}) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x4c) (async) openat$rtc(0xffffffffffffff9c, &(0x7f0000001440), 0x40102, 0x0) (async) ioctl$RTC_ALM_SET(r0, 0x40247007, 0x0) (async) pipe2$9p(&(0x7f0000000080), 0x800) (async) dup(r2) (async) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x10800, &(0x7f0000000240)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@afid={'afid', 0x3d, 0x3}}]}}) (async) 15.510039ms ago: executing program 0 (id=8): socket$inet6_tcp(0xa, 0x1, 0x0) (async) r0 = creat(&(0x7f0000000000)='./file0\x00', 0x6a) write$binfmt_elf32(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="7f454c46000000000000000000000000030006000000000000000000380000000000000000191bda0000200001000000000280000000000003"], 0x69) (async) close(r0) (async) setsockopt(r0, 0x1, 0x8, 0x0, 0x0) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCDIFADDR(r1, 0x8936, &(0x7f00000000c0)={@dev={0xfe, 0x80, '\x00', 0x3c}, 0x12}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ef) (async) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./tracing/dynamic_events\x00', 0x1, 0x0) write(r2, &(0x7f0000000100)="65486d795fe26d032d6239a78e2246d9efdeed7dda726561645f74b9ff9be377865f2e760c69", 0x26) (async) socket(0x10, 0x803, 0x0) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r4, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000640)={0x14, 0x0, 0x4, 0x70bd28, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x84) (async, rerun: 32) syz_genetlink_get_family_id$nfc(&(0x7f0000000ec0), r4) (rerun: 32) r5 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000001180), r4) (async, rerun: 32) r6 = syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00') (rerun: 32) renameat2(r6, &(0x7f00000006c0)='./cgroup\x00', r6, &(0x7f00000002c0)='./mnt\x00', 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) sendmsg$NLBL_CIPSOV4_C_LISTALL(r3, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)={0x14, r5, 0xa5ba51ab665b64ff, 0x70bd29, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x0) mount$incfs(&(0x7f0000000080)='./cgroup\x00', &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000100), 0x80, &(0x7f0000000580)={[{@no_bf_readahead}]}) (async) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f0000000340)={'ip6gre0\x00', &(0x7f0000000380)=@ethtool_per_queue_op={0x4b, 0xe, [0x2, 0x6, 0x0, 0x1, 0x100, 0x206, 0x0, 0x7, 0x4, 0x100, 0x5, 0x4, 0x8, 0xa8b, 0x1, 0x0, 0xffff0000, 0x9d, 0x9, 0x7fff, 0x8, 0x6, 0x0, 0x5, 0x5, 0x5, 0xe, 0x100, 0x0, 0xe, 0x3, 0x3, 0x0, 0x10000, 0x9, 0x5, 0x3ff, 0x47, 0x9, 0x1, 0x2a5ba946, 0x1, 0x6, 0x8, 0x5, 0xce, 0x3, 0x401, 0x3e2525ee, 0x40, 0x6, 0x5, 0x5, 0x5, 0x5, 0x401, 0x1000, 0xf, 0x200, 0x200, 0x1, 0x5, 0x43331893, 0xfffffff0, 0xd6, 0xc6, 0x6, 0x3f686615, 0x2f0, 0x1, 0x2000000, 0x4, 0x7, 0xffffffff, 0x3f8, 0x10000, 0x3, 0xfffffffa, 0x2, 0x9, 0x9, 0x7798, 0x5, 0xc8b, 0x10000, 0x80, 0x4, 0x0, 0x80000001, 0x0, 0xda, 0x5, 0x2, 0x0, 0x1000, 0x6, 0x7, 0xffffffff, 0xfffffffe, 0x101, 0x8, 0x5, 0x56ed, 0x6, 0x9, 0x3, 0x3, 0x9, 0x219, 0x1, 0x4, 0xfb, 0x8, 0x7, 0x60000000, 0x4171, 0x6, 0x649, 0x0, 0x7c, 0x1, 0x3, 0xffffff38, 0x92, 0x1, 0x8001, 0xf, 0x63]}}) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) (async) r8 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r8, 0x89f2, &(0x7f0000000340)={'tunl0\x00', 0x0}) (async, rerun: 32) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) (rerun: 32) r10 = dup(r9) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) 0s ago: executing program 3 (id=9): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') getdents64(r0, &(0x7f00000046c0)=""/4096, 0x1000) (async) mkdir(&(0x7f0000000000)='my_sys\x00', 0x1fd) (async) mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xff, 0x0, 0x12, r1, 0x0) setxattr$incfs_size(&(0x7f00000000c0)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', &(0x7f0000000100), &(0x7f0000000140)=0xfffffffffffffffc, 0x8, 0x1) (async, rerun: 32) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, &(0x7f0000000040)='mem\x00\xffEev\xf2r\xf1\x18\x1d\xb9\x00y_hug$\bo-\x03Q`]o\x8cr\x9d_etl\xf9\xdd\a\xad\\H\xe94\b,H\xbf', 0x0, 0x0) (async, rerun: 32) r2 = syz_open_procfs(0x0, &(0x7f0000000040)) (async, rerun: 64) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000004, 0x3b071, 0xffffffffffffffff, 0x0) (rerun: 64) read$FUSE(r2, &(0x7f00000034c0)={0x2020}, 0x2020) (async) ioctl$PTP_CLOCK_GETCAPS(r0, 0x80503d01, &(0x7f0000000000)) (async) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000000000040c215042200000000000109022400010000000009040000020304000009210000000122050009058103"], 0x0) (async) syz_usb_connect$uac1(0x2, 0x72, &(0x7f0000000480)=ANY=[@ANYBLOB="12015002000000086307012040000102030109026000030108c0040904000000010100000a2401bd000a000201020904010000010200000904010101010200000905019c5ccd23820908000580080725010ce5bebdecfb117d"], &(0x7f00000008c0)={0x0, 0x0, 0xc, &(0x7f0000000400)=ANY=[]}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.156' (ED25519) to the list of known hosts. [ 29.295180][ T36] audit: type=1400 audit(1791501308.030:64): avc: denied { mounton } for pid=287 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 29.298086][ T287] cgroup: Unknown subsys name 'net' [ 29.317939][ T36] audit: type=1400 audit(1791501308.030:65): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.345319][ T36] audit: type=1400 audit(1791501308.070:66): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.345805][ T287] cgroup: Unknown subsys name 'devices' [ 29.464080][ T287] cgroup: Unknown subsys name 'hugetlb' [ 29.469724][ T287] cgroup: Unknown subsys name 'rlimit' [ 29.585369][ T36] audit: type=1400 audit(1791501308.320:67): avc: denied { setattr } for pid=287 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 29.608563][ T36] audit: type=1400 audit(1791501308.320:68): avc: denied { mounton } for pid=287 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 29.633344][ T36] audit: type=1400 audit(1791501308.320:69): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 29.699968][ T289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 29.708977][ T36] audit: type=1400 audit(1791501308.450:70): avc: denied { relabelto } for pid=289 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 29.734574][ T36] audit: type=1400 audit(1791501308.450:71): avc: denied { write } for pid=289 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.792503][ T36] audit: type=1400 audit(1791501308.530:72): avc: denied { read } for pid=287 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.818215][ T36] audit: type=1400 audit(1791501308.530:73): avc: denied { open } for pid=287 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.818787][ T287] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 30.665842][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.673006][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.680099][ T294] bridge_slave_0: entered allmulticast mode [ 30.686462][ T294] bridge_slave_0: entered promiscuous mode [ 30.699200][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.706306][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.713490][ T294] bridge_slave_1: entered allmulticast mode [ 30.719721][ T294] bridge_slave_1: entered promiscuous mode [ 30.745659][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.752777][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.759947][ T296] bridge_slave_0: entered allmulticast mode [ 30.766303][ T296] bridge_slave_0: entered promiscuous mode [ 30.781608][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.788723][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.795996][ T296] bridge_slave_1: entered allmulticast mode [ 30.802345][ T296] bridge_slave_1: entered promiscuous mode [ 30.834639][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.841745][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.848800][ T295] bridge_slave_0: entered allmulticast mode [ 30.855529][ T295] bridge_slave_0: entered promiscuous mode [ 30.861793][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.868827][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.876067][ T297] bridge_slave_0: entered allmulticast mode [ 30.882503][ T297] bridge_slave_0: entered promiscuous mode [ 30.891970][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.899025][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.906222][ T295] bridge_slave_1: entered allmulticast mode [ 30.912530][ T295] bridge_slave_1: entered promiscuous mode [ 30.918597][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.925731][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.932872][ T297] bridge_slave_1: entered allmulticast mode [ 30.939048][ T297] bridge_slave_1: entered promiscuous mode [ 31.080623][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.087726][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.095060][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.102123][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.128484][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.135577][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.142916][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.149953][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.169558][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.176652][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.183969][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.191010][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.200999][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.208076][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.215455][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.222503][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.266477][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.273762][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.280982][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.288664][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.296046][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.303448][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.310704][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.317981][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.336204][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.343285][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.352184][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.359234][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.369052][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.376118][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.387467][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.394533][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.403091][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.410129][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.427380][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.434528][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.467442][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.474510][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.487721][ T53] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.494821][ T53] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.504312][ T296] veth0_vlan: entered promiscuous mode [ 31.518871][ T295] veth0_vlan: entered promiscuous mode [ 31.535979][ T296] veth1_macvtap: entered promiscuous mode [ 31.565008][ T294] veth0_vlan: entered promiscuous mode [ 31.577684][ T295] veth1_macvtap: entered promiscuous mode [ 31.602488][ T296] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 31.620436][ T294] veth1_macvtap: entered promiscuous mode [ 31.644008][ T297] veth0_vlan: entered promiscuous mode [ 31.668114][ T297] veth1_macvtap: entered promiscuous mode [ 31.714813][ T316] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 31.787696][ T318] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 31.803216][ T318] oom_control is deprecated and will be removed. Please report your usecase to linux-mm-@kvack.org if you depend on this functionality. [ 31.835392][ T316] kvm: kvm [315]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x9d00 [ 31.845651][ T314] Zero length message leads to an empty skb [ 31.854373][ T316] kvm: kvm [315]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x9d00 [ 31.885970][ T316] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 31.991235][ T294] ------------[ cut here ]------------ [ 31.996935][ T294] WARNING: CPU: 1 PID: 294 at fs/overlayfs/util.c:605 ovl_dir_modified+0x15a/0x190 [ 32.006531][ T294] Modules linked in: [ 32.010649][ T294] CPU: 1 UID: 0 PID: 294 Comm: syz-executor Not tainted syzkaller #0 ca35313610c8ed713bced2230d6c22219bd85c1d [ 32.022343][ T294] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 32.032488][ T294] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 32.038168][ T294] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 2e 5e 97 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 c6 e8 3d ff <0f> 0b e9 3e ff ff ff e8 ba e8 3d ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 32.057933][ T294] RSP: 0018:ffffc9000110fb88 EFLAGS: 00010293 [ 32.064066][ T294] RAX: ffffffff824b63fa RBX: 0000000000000000 RCX: ffff888128c9a780 [ 32.072117][ T294] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 32.080131][ T294] RBP: ffffc9000110fbb0 R08: ffff88811b67c0bf R09: 1ffff110236cf817 [ 32.088181][ T294] R10: dffffc0000000000 R11: ffffed10236cf818 R12: 0000000000000000 [ 32.096452][ T294] R13: dffffc0000000000 R14: ffff88811b67c020 R15: ffff888121085440 [ 32.104484][ T294] FS: 000055558d9d4500(0000) GS:ffff8881f6d00000(0000) knlGS:0000000000000000 [ 32.113501][ T294] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.120116][ T294] CR2: 000055558d9ef918 CR3: 0000000107ec2000 CR4: 00000000003526b0 [ 32.128238][ T294] Call Trace: [ 32.131538][ T294] [ 32.134579][ T294] ovl_do_remove+0x824/0xd10 [ 32.139209][ T294] ? ovl_set_redirect+0x780/0x780 [ 32.144308][ T294] ? __cfi_down_write+0x10/0x10 [ 32.149234][ T294] ovl_rmdir+0x1e/0x30 [ 32.153383][ T294] vfs_rmdir+0x3db/0x560 [ 32.157654][ T294] incfs_kill_sb+0x102/0x220 [ 32.162314][ T294] deactivate_locked_super+0xd2/0x270 [ 32.167724][ T294] deactivate_super+0xb8/0xe0 [ 32.172556][ T294] cleanup_mnt+0x438/0x4d0 [ 32.177020][ T294] __cleanup_mnt+0x1d/0x40 [ 32.181473][ T294] task_work_run+0x1e8/0x260 [ 32.186146][ T294] ? __cfi_task_work_run+0x10/0x10 [ 32.191301][ T294] ? __x64_sys_umount+0x12e/0x180 [ 32.196399][ T294] ? __cfi___x64_sys_umount+0x10/0x10 [ 32.201838][ T294] ? __kasan_check_read+0x15/0x20 [ 32.206899][ T294] resume_user_mode_work+0x35/0x50 [ 32.212072][ T294] syscall_exit_to_user_mode+0x63/0xb0 [ 32.217574][ T294] do_syscall_64+0x63/0xf0 [ 32.222071][ T294] ? clear_bhb_loop+0x50/0xa0 [ 32.226783][ T294] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 32.232745][ T294] RIP: 0033:0x7f596b19f417 [ 32.237214][ T294] Code: a2 c7 05 dc 62 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 32.256883][ T294] RSP: 002b:00007ffd4e31a748 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 32.265474][ T294] RAX: 0000000000000000 RBX: 00007f596b234ccb RCX: 00007f596b19f417 [ 32.273517][ T294] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd4e31a800 [ 32.281516][ T294] RBP: 00007ffd4e31a800 R08: 00007ffd4e31b800 R09: 00000000ffffffff [ 32.289665][ T294] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd4e31b890 [ 32.297703][ T294] R13: 00007f596b234ccb R14: 0000000000007c81 R15: 00007ffd4e31b8d0 [ 32.305888][ T294] [ 32.308927][ T294] ---[ end trace 0000000000000000 ]--- [ 32.316095][ T294] ------------[ cut here ]------------ [ 32.321582][ T294] WARNING: CPU: 1 PID: 294 at fs/overlayfs/util.c:605 ovl_dir_modified+0x15a/0x190 [ 32.331168][ T294] Modules linked in: [ 32.335125][ T294] CPU: 1 UID: 0 PID: 294 Comm: syz-executor Tainted: G W syzkaller #0 ca35313610c8ed713bced2230d6c22219bd85c1d [ 32.348288][ T294] Tainted: [W]=WARN [ 32.352172][ T294] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 32.362276][ T294] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 32.368048][ T294] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 2e 5e 97 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 c6 e8 3d ff <0f> 0b e9 3e ff ff ff e8 ba e8 3d ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 32.387717][ T294] RSP: 0018:ffffc9000110fb88 EFLAGS: 00010293 [ 32.393864][ T294] RAX: ffffffff824b63fa RBX: 0000000000000000 RCX: ffff888128c9a780 [ 32.401984][ T294] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 32.409982][ T294] RBP: ffffc9000110fbb0 R08: ffff88811b67c0bf R09: 1ffff110236cf817 [ 32.418039][ T294] R10: dffffc0000000000 R11: ffffed10236cf818 R12: 0000000000000000 [ 32.426083][ T294] R13: dffffc0000000000 R14: ffff88811b67c020 R15: ffff888121085440 [ 32.434120][ T294] FS: 000055558d9d4500(0000) GS:ffff8881f6d00000(0000) knlGS:0000000000000000 [ 32.443145][ T294] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.449752][ T294] CR2: 000055558d9ef918 CR3: 0000000107ec2000 CR4: 00000000003526b0 [ 32.457793][ T294] Call Trace: [ 32.461163][ T294] [ 32.464164][ T294] ovl_do_remove+0x824/0xd10 [ 32.468802][ T294] ? ovl_set_redirect+0x780/0x780 [ 32.473925][ T294] ? __cfi_down_write+0x10/0x10 [ 32.478809][ T294] ovl_rmdir+0x1e/0x30 [ 32.483082][ T294] vfs_rmdir+0x3db/0x560 [ 32.487361][ T294] incfs_kill_sb+0x197/0x220 [ 32.492012][ T294] deactivate_locked_super+0xd2/0x270 [ 32.497424][ T294] deactivate_super+0xb8/0xe0 [ 32.502166][ T294] cleanup_mnt+0x438/0x4d0 [ 32.506653][ T294] __cleanup_mnt+0x1d/0x40 [ 32.511099][ T294] task_work_run+0x1e8/0x260 [ 32.515756][ T294] ? __cfi_task_work_run+0x10/0x10 [ 32.520910][ T294] ? __x64_sys_umount+0x12e/0x180 [ 32.526025][ T294] ? __cfi___x64_sys_umount+0x10/0x10 [ 32.531432][ T294] ? __kasan_check_read+0x15/0x20 [ 32.536534][ T294] resume_user_mode_work+0x35/0x50 [ 32.541717][ T294] syscall_exit_to_user_mode+0x63/0xb0 [ 32.547215][ T294] do_syscall_64+0x63/0xf0 [ 32.551732][ T294] ? clear_bhb_loop+0x50/0xa0 [ 32.556457][ T294] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 32.562510][ T294] RIP: 0033:0x7f596b19f417 [ 32.566960][ T294] Code: a2 c7 05 dc 62 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 32.586633][ T294] RSP: 002b:00007ffd4e31a748 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 32.595128][ T294] RAX: 0000000000000000 RBX: 00007f596b234ccb RCX: 00007f596b19f417 [ 32.603147][ T294] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd4e31a800 [ 32.611139][ T294] RBP: 00007ffd4e31a800 R08: 00007ffd4e31b800 R09: 00000000ffffffff [ 32.619178][ T294] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd4e31b890 [ 32.627210][ T294] R13: 00007f596b234ccb R14: 0000000000007c81 R15: 00007ffd4e31b8d0 [ 32.635230][ T294] [ 32.638269][ T294] ---[ end trace 0000000000000000 ]--- [ 32.670169][ T340] incfs: Options parsing error. -22 [ 32.684808][ T340] incfs: mount failed -22 [ 34.467172][ T36] kauditd_printk_skb: 55 callbacks suppressed [ 34.467191][ T36] audit: type=1400 audit(1791501313.200:129): avc: denied { read } for pid=344 comm="poweroff" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 Stopping sshd: stopped /usr/sbin/sshd (pid 202) OK Stopping crond: stopped /usr/sbin/crond (pid 195) OK [ 35.077361][ T36] audit: type=1400 audit(1791501313.810:130): avc: denied { unmount } for pid=296 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 Stopping dhcpcd... stopped /sbin/dhcpcd (pid 149) [ 35.125792][ T36] audit: type=1400 audit(1791501313.860:131): avc: denied { search } for pid=358 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Stopping network: [ 35.232499][ T36] audit: type=1400 audit(1791501313.960:132): avc: denied { write } for pid=150 comm="dhcpcd" name="dhcpcd" dev="tmpfs" ino=420 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 35.257181][ T36] audit: type=1400 audit(1791501313.960:133): avc: denied { remove_name } for pid=150 comm="dhcpcd" name="sock" dev="tmpfs" ino=422 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 35.284701][ T36] audit: type=1400 audit(1791501313.960:134): avc: denied { unlink } for pid=150 comm="dhcpcd" name="sock" dev="tmpfs" ino=422 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=sock_file permissive=1 [ 35.308390][ T36] audit: type=1400 audit(1791501313.970:135): avc: denied { unlink } for pid=150 comm="dhcpcd" name="pid" dev="tmpfs" ino=421 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 OK Stopping iptables: [ 35.367244][ T36] audit: type=1400 audit(1791501314.100:136): avc: denied { search } for pid=372 comm="iptables" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 OK[ 35.389049][ T36] audit: type=1400 audit(1791501314.100:137): avc: denied { write } for pid=372 comm="iptables" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 35.410968][ T36] audit: type=1400 audit(1791501314.100:138): avc: denied { add_name } for pid=372 comm="iptables" name="xtables.lock" scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Stopping system message bus: done Stopping klogd: OK Stopping acpid: OK Stopping syslogd: stopped /sbin/syslogd (pid 93) OK umount: can't remount debugfs read-only Connection to 10.128.1.156 closed by remote host. umount: sysfs busy - remounted read-only umount: devtmpfs busy - remounted read-only umount: can't remount /dev/root read-only The system is going down NOW! Sent SIGTERM to all processes [ 36.998686][ T46] bridge_slave_1: left allmulticast mode [ 37.004462][ T46] bridge_slave_1: left promiscuous mode [ 37.010117][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.017851][ T46] bridge_slave_0: left allmulticast mode [ 37.023585][ T46] bridge_slave_0: left promiscuous mode [ 37.029204][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.134146][ T46] veth1_macvtap: left promiscuous mode [ 37.139675][ T46] veth0_vlan: left promiscuous mode [ 37.414736][ T46] bridge_slave_1: left allmulticast mode [ 37.420498][ T46] bridge_slave_1: left promiscuous mode [ 37.426125][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.433629][ T46] bridge_slave_0: left allmulticast mode [ 37.439358][ T46] bridge_slave_0: left promiscuous mode [ 37.445149][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.452809][ T46] bridge_slave_1: left allmulticast mode [ 37.458446][ T46] bridge_slave_1: left promiscuous mode [ 37.464168][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.472020][ T46] bridge_slave_0: left allmulticast mode [ 37.477658][ T46] bridge_slave_0: left promiscuous mode [ 37.483291][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.490916][ T46] bridge_slave_1: left allmulticast mode [ 37.496610][ T46] bridge_slave_1: left promiscuous mode [ 37.502223][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.509661][ T46] bridge_slave_0: left allmulticast mode [ 37.515370][ T46] bridge_slave_0: left promiscuous mode [ 37.520960][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.747097][ T46] veth1_macvtap: left promiscuous mode [ 37.752720][ T46] veth0_vlan: left promiscuous mode [ 37.758252][ T46] veth1_macvtap: left promiscuous mode [ 37.763803][ T46] veth0_vlan: left promiscuous mode [ 37.769325][ T46] veth1_macvtap: left promiscuous mode [ 37.774835][ T46] veth0_vlan: left promiscuous mode Sent SIGKILL to all processes Requesting system poweroff [ 38.969998][ T394] sd 0:0:1:0: [sda] Synchronizing SCSI cache [ 38.976926][ T394] ACPI: PM: Preparing to enter system sleep state S5 [ 38.983844][ T394] kvm: exiting hardware virtualization [ 38.989353][ T394] reboot: Power down serialport: VM disconnected.