last executing test programs: 2m10.66635463s ago: executing program 1 (id=153): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000300)={0x7f, 0x200004d, 0x6}) r1 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000380)={0x200, 0x4f, 0x4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000140)={0x8, 0x404d, 0x2ba9}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000380)={0x200, 0x4f, 0x4, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000180)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r4}) r5 = syz_open_dev$dri(&(0x7f0000000180), 0xcaf8, 0x40000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, 0x0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, 0x0) close_range(r6, 0xffffffffffffffff, 0x0) 2m0.698074024s ago: executing program 0 (id=154): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1/file4\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000000180)='./file1/file4\x00', 0x0, 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000200)='./file1/file4/file5\x00', 0x81c0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file4/file6\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file1/file4/file7\x00', 0x1c0) r0 = landlock_create_ruleset(&(0x7f00000002c0)={0x2001}, 0x18, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x200000, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000340)={0x2000, r1}, 0x0) landlock_restrict_self(r0, 0x0) linkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1/file2\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file2\x00', 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file3\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./file0/file3\x00', 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1/file2\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x2) linkat(0xffffffffffffff9c, &(0x7f0000000500)='./file1/file4/file5\x00', 0xffffffffffffff9c, 0x0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000580)='./file1/file4/file6\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./file1/file4/file7/file6\x00', 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000600)='./file1/file4/file5\x00', 0xffffffffffffff9c, &(0x7f0000000640)='./file1/file4/file7/file6\x00', 0x2) 1m49.466262873s ago: executing program 1 (id=155): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000300)={0x7f, 0x200004d, 0x6}) r1 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000380)={0x200, 0x4f, 0x4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000140)={0x8, 0x404d, 0x2ba9}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000380)={0x200, 0x4f, 0x4, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000180)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r4}) r5 = syz_open_dev$dri(&(0x7f0000000180), 0xcaf8, 0x40000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, 0x0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, 0x0) close_range(r6, 0xffffffffffffffff, 0x0) 1m38.704283778s ago: executing program 0 (id=156): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, 0x0, 0x0) write(r0, &(0x7f0000000180)='1', 0x1) write(r0, &(0x7f0000000140)='0\n', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/sys/kernel/watchdog\x00', 0x2, 0x0) write(r1, &(0x7f0000000140)='0\n', 0x2) write(r1, 0x0, 0x0) write(r1, &(0x7f0000000140), 0x0) close(r1) r2 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r2, 0x0, 0x0) close(r2) mount(&(0x7f0000000340)=@filename='none\x00', &(0x7f0000000380)='./sys\x00', 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) 1m27.793142991s ago: executing program 1 (id=157): socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket(0xa, 0x3, 0x3a) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000845, &(0x7f0000b63fe4), 0x1c) getsockopt$inet6_buf(r0, 0x29, 0x3d, 0x0, &(0x7f00000000c0)=0x37) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x10}}], 0x80}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f00000004c0)={0x0, 0xbd, 0x10, 0x1, 0x7f}, &(0x7f0000001080)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8000e308, 0x42, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x69, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe7d, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) 1m17.712486067s ago: executing program 0 (id=158): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x1a, &(0x7f0000000100)=0x401, 0x4) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0xfffffffe, @empty, 0x5e}, 0x1c) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x3) bind$inet6(r1, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r4, 0xa7ba) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r5, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r6, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r7, 0x0) r8 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r8, &(0x7f00000000c0)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a0677bc45ff810500000000000058000b480400945f64009400050028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010002081000418e00000004fcff", 0x58}], 0x1) 1m3.898485216s ago: executing program 1 (id=159): accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000040)={0x28, 0x0, 0x0, @hyper}, 0x0, 0x80800) socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./proc\x00', 0x0, 0x4000, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x111, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000180)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000200), 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) r1 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f00000005c0)='2', 0x1) epoll_pwait(r1, &(0x7f0000000080)=[{}, {}, {}, {}], 0x4, 0x6, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, r1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000880)={'bridge_slave_1\x00'}) sendmsg$nl_route(r2, 0x0, 0x44) syz_emit_ethernet(0x56, 0x0, 0x0) setns(0xc9, 0x0) socket$nl_route(0x10, 0x3, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x41, &(0x7f0000000900)=ANY=[], 0x58) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000980)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4f8, 0x0, 0xd0, 0x1a0, 0x270, 0x428, 0x0, 0xd0, 0x1a0, 0x358, 0x428, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff]}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x558) 49.964027958s ago: executing program 0 (id=160): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1/file4\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000000180)='./file1/file4\x00', 0x0, 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000200)='./file1/file4/file5\x00', 0x81c0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file4/file6\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file1/file4/file7\x00', 0x1c0) r0 = landlock_create_ruleset(&(0x7f00000002c0)={0x2001}, 0x18, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x200000, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000340)={0x2000, r1}, 0x0) landlock_restrict_self(r0, 0x0) linkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1/file2\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file2\x00', 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file3\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./file0/file3\x00', 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1/file2\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x2) linkat(0xffffffffffffff9c, &(0x7f0000000500)='./file1/file4/file5\x00', 0xffffffffffffff9c, 0x0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000580)='./file1/file4/file6\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./file1/file4/file7/file6\x00', 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000600)='./file1/file4/file5\x00', 0xffffffffffffff9c, &(0x7f0000000640)='./file1/file4/file7/file6\x00', 0x2) 39.472068022s ago: executing program 1 (id=161): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000300)={0x7f, 0x200004d, 0x6}) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000140)={0x8, 0x404d, 0x2ba9}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000380)={0x200, 0x4f, 0x4, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000180)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r4}) r5 = syz_open_dev$dri(&(0x7f0000000180), 0xcaf8, 0x40000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, 0x0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, 0x0) close_range(r6, 0xffffffffffffffff, 0x0) 20.30642512s ago: executing program 0 (id=162): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, 0x0, 0x0) write(r0, &(0x7f0000000180)='1', 0x1) write(r0, &(0x7f0000000140)='0\n', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/sys/kernel/watchdog\x00', 0x2, 0x0) write(r1, &(0x7f0000000140)='0\n', 0x2) write(r1, 0x0, 0x0) write(r1, &(0x7f0000000140), 0x0) close(r1) r2 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r2, 0x0, 0x0) close(r2) mount(&(0x7f0000000340)=@filename='none\x00', &(0x7f0000000380)='./sys\x00', 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) 15.255098915s ago: executing program 1 (id=163): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/hid.usb0/no_out_endpoint\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='1\n', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/functions/hid.usb0/subclass\x00', 0x2, 0x0) write(r1, &(0x7f0000000280), 0x0) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0/protocol\x00', 0x2, 0x0) write(r2, &(0x7f0000000300)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0) write(r3, &(0x7f0000000380)='8\n', 0x2) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0) write(r4, &(0x7f0000000400)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100", 0x3e) close(r4) symlinkat(&(0x7f0000000440)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r5, &(0x7f0000000500)='dummy_udc.0\n', 0xc) close(r5) nanosleep(&(0x7f0000000540)={0x1}, 0x0) syz_open_dev$hidraw(&(0x7f0000000580), 0x0, 0x2) 0s ago: executing program 0 (id=164): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='configfs\x00', 0x0, &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mount(&(0x7f0000000400)=@filename='sysfs\x00', &(0x7f0000000300)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config/usb_gadget/g_uac2\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000200)='0x12', 0x4) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g_uac2/functions/uac2.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g_uac2/functions/uac2.usb0/c_chmask\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='0\n', 0x2) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000940)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@remote}}, &(0x7f0000000a40)=0xe4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g_uac2/functions/uac2.usb0/p_chmask\x00', 0x1, 0x0) write(r1, &(0x7f0000000900)='3\n', 0x2) pipe2(&(0x7f0000000040), 0x4000) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/usb_gadget/g_uac2/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000001300)='./config/usb_gadget/g_uac2/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000001400)='./config/usb_gadget/g_uac2/configs/c.1/uac2.usb0\x00') kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:65258' (ED25519) to the list of known hosts. syzkaller login: [ 695.210311][ T3244] cgroup: Unknown subsys name 'net' [ 696.222376][ T3244] cgroup: Unknown subsys name 'cpuset' [ 696.431953][ T3244] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 809.209714][ T3244] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 969.165605][ T3251] rxe_eth0 speed is unknown, defaulting to 1000 [ 969.352424][ T3251] rxe_eth0 speed is unknown, defaulting to 1000 [ 969.610396][ T3251] rxe_eth0 speed is unknown, defaulting to 1000 [ 974.115795][ T3253] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 989.260913][ T3251] infiniband rxe0: set active [ 989.263227][ T3251] infiniband rxe0: added rxe_eth0 [ 989.343806][ T3246] rxe_eth0 speed is unknown, defaulting to 1000 [ 993.357798][ T3251] RDS/IB: rxe0: added [ 993.520833][ T3251] smc: adding ib device rxe0 with port count 1 [ 993.567777][ T3251] smc: ib device rxe0 port 1 has no pnetid [ 993.723606][ T29] rxe_eth0 speed is unknown, defaulting to 1000 [ 993.971927][ T3251] rxe_eth0 speed is unknown, defaulting to 1000 [ 1003.118889][ T29] rxe_eth0 speed is unknown, defaulting to 1000 [ 1004.247670][ T867] rxe_eth0 speed is unknown, defaulting to 1000 [ 1019.388917][ T3251] rxe_eth0 speed is unknown, defaulting to 1000 [ 1038.302145][ T3253] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1038.973628][ T3253] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1051.779099][ T10] rxe_eth0 speed is unknown, defaulting to 1000 [ 1085.041914][ T3253] hsr_slave_0: entered promiscuous mode [ 1085.314385][ T3253] hsr_slave_1: entered promiscuous mode [ 1116.259985][ T3251] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1116.756965][ T3251] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1117.763032][ T3253] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1118.127689][ T3253] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1118.674960][ T3253] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1118.906929][ T3253] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1118.942411][ T3253] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1119.058600][ T3253] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1119.174222][ T3253] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1119.724856][ T3253] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1156.183800][ T3253] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1161.542588][ T3251] hsr_slave_0: entered promiscuous mode [ 1161.638182][ T3251] hsr_slave_1: entered promiscuous mode [ 1161.975073][ T3251] debugfs: 'hsr0' already exists in 'hsr' [ 1161.979722][ T3251] Cannot create hsr debugfs directory [ 1179.551081][ T3251] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1179.647168][ T3251] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1179.720476][ T3251] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1179.815552][ T3251] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1180.279508][ T3251] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1180.352966][ T3251] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1180.479788][ T3251] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1180.582035][ T3251] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1224.638528][ T3251] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1312.592036][ T3253] veth0_vlan: entered promiscuous mode [ 1314.305914][ T3253] veth1_vlan: entered promiscuous mode [ 1320.636829][ T3253] veth0_macvtap: entered promiscuous mode [ 1322.183947][ T3253] veth1_macvtap: entered promiscuous mode [ 1328.775441][ T1465] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1329.212482][ T3257] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1329.404957][ T1479] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1330.714209][ T3257] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1354.460035][ T3253] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 1398.350292][ T3251] veth0_vlan: entered promiscuous mode [ 1400.571148][ T3251] veth1_vlan: entered promiscuous mode [ 1406.361737][ T3251] veth0_macvtap: entered promiscuous mode [ 1408.018163][ T3251] veth1_macvtap: entered promiscuous mode [ 1413.971969][ T3655] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1414.160169][ T3670] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1414.432483][ T1465] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1414.882166][ T1465] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1572.442888][ T3946] faux_driver vgem: [drm] Unknown color mode 6; guessing buffer size. [ 1639.224019][ T3966] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1939.929042][ T4031] ALSA: mixer_oss: invalid OSS volume 'PHlâ6žžqÓ†ØÈÌONEOUT' [ 1939.935062][ T4031] ALSA: mixer_oss: invalid index 1374389 [ 1939.970203][ T4031] ALSA: mixer_oss: invalid OSS volume 'P' [ 1995.185690][ T4041] FAULT_INJECTION: forcing a failure. [ 1995.185690][ T4041] name failslab, interval 1, probability 0, space 0, times 1 [ 1995.233171][ T4041] CPU: 1 UID: 0 PID: 4041 Comm: syz.1.37 Not tainted syzkaller #0 PREEMPT [ 1995.234164][ T4041] Hardware name: riscv-virtio,qemu (DT) [ 1995.234872][ T4041] Call Trace: [ 1995.235466][ T4041] [] dump_backtrace+0x2e/0x3c [ 1995.237533][ T4041] [] show_stack+0x30/0x3c [ 1995.238128][ T4041] [] dump_stack_lvl+0x114/0x1aa [ 1995.238723][ T4041] [] dump_stack+0x1c/0x24 [ 1995.239410][ T4041] [] should_fail_ex+0x58a/0x594 [ 1995.240321][ T4041] [] should_failslab+0xb2/0xfa [ 1995.241038][ T4041] [] kmem_cache_alloc_noprof+0x342/0x6a4 [ 1995.242082][ T4041] [] vm_area_dup+0x2c/0x70e [ 1995.242707][ T4041] [] __split_vma+0x1b6/0x23e4 [ 1995.243398][ T4041] [] vms_gather_munmap_vmas+0x3b4/0x160a [ 1995.244142][ T4041] [] do_vmi_align_munmap+0x240/0x6d6 [ 1995.244963][ T4041] [] do_vmi_munmap+0x14a/0x2ec [ 1995.245730][ T4041] [] unmap_source_vma+0x2b2/0x742 [ 1995.246439][ T4041] [] move_vma+0x2f2/0x1032 [ 1995.247079][ T4041] [] mremap_to+0x22a/0x4ac [ 1995.247742][ T4041] [] __do_sys_mremap+0x9be/0x1416 [ 1995.248459][ T4041] [] __riscv_sys_mremap+0xa0/0x1c6 [ 1995.249146][ T4041] [] syscall_handler+0x92/0x114 [ 1995.249984][ T4041] [] do_trap_ecall_u+0x4ca/0x658 [ 1995.250665][ T4041] [] handle_exception+0x168/0x174 [ 2091.038067][ T4063] ALSA: mixer_oss: invalid OSS volume 'PHlâ6žžqÓ†ØÈÌONEOUT' [ 2091.038617][ T4063] ALSA: mixer_oss: invalid index 1374389 [ 2091.079490][ T4063] ALSA: mixer_oss: invalid OSS volume 'P' [ 2202.940183][ T4090] netlink: 'syz.0.51': attribute type 11 has an invalid length. [ 2289.313264][ T4116] netlink: 'syz.0.58': attribute type 11 has an invalid length. [ 2369.305836][ T4138] netlink: 'syz.0.64': attribute type 11 has an invalid length. [ 2424.472921][ T4152] netlink: 'syz.0.68': attribute type 11 has an invalid length. [ 2455.475126][ T4159] netlink: 'syz.0.70': attribute type 11 has an invalid length. [ 2558.754843][ T4184] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 2630.571799][ T4202] ALSA: mixer_oss: invalid OSS volume 'PHlâ6žžqÓ†ØÈÌONEOUT' [ 2630.597586][ T4202] ALSA: mixer_oss: invalid index 1374389 [ 2630.604898][ T4202] ALSA: mixer_oss: invalid OSS volume 'P' [ 2661.524308][ T4208] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 2753.593228][ T4236] process 'syz.1.93' launched '/dev/fd/5' with NULL argv: empty string added [ 2852.891351][ T4255] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 2874.865020][ T4265] ALSA: mixer_oss: invalid OSS volume 'PHlâ6žžqÓ†ØÈÌONEOUT' [ 2874.872918][ T4265] ALSA: mixer_oss: invalid index 1374389 [ 2874.880808][ T4265] ALSA: mixer_oss: invalid OSS volume 'P' [ 2980.507877][ T4292] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 3018.988525][ T4304] ALSA: mixer_oss: invalid OSS volume 'PHlâ6žžqÓ†ØÈÌONEOUT' [ 3019.002741][ T4304] ALSA: mixer_oss: invalid index 1374389 [ 3019.051495][ T4304] ALSA: mixer_oss: invalid OSS volume 'P' [ 3043.910384][ T4314] ALSA: mixer_oss: invalid OSS volume 'PHlâ6žžqÓ†ØÈÌONEOUT' [ 3043.931430][ T4314] ALSA: mixer_oss: invalid index 1374389 [ 3043.934948][ T4314] ALSA: mixer_oss: invalid OSS volume 'P' [ 3090.593658][ T4330] ALSA: mixer_oss: invalid OSS volume '' [ 3169.117971][ T4349] ALSA: mixer_oss: invalid OSS volume 'PHlâ6žžqÓ†ØÈÌONEOUT' [ 3169.132961][ T4349] ALSA: mixer_oss: invalid index 1374389 [ 3169.151123][ T4349] ALSA: mixer_oss: invalid OSS volume 'P' [ 3250.035246][ T4370] ALSA: mixer_oss: invalid OSS volume 'PHlâ6žžqÓ†ØÈÌONEOUT' [ 3250.048484][ T4370] ALSA: mixer_oss: invalid index 1374389 [ 3250.098076][ T4370] ALSA: mixer_oss: invalid OSS volume 'P' [ 3324.020807][ T4390] ALSA: mixer_oss: invalid OSS volume 'PHlâ6žžqÓ†ØÈÌONEOUT' [ 3324.024767][ T4390] ALSA: mixer_oss: invalid index 1374389 [ 3324.025358][ T4390] ALSA: mixer_oss: invalid OSS volume 'P' [ 3333.795245][ T4395] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 3365.437683][ T4403] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 3417.158879][ T4422] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 3417.664173][ T4420] netlink: 'syz.1.143': attribute type 11 has an invalid length. [ 3440.011952][ T4426] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 3487.822085][ T4439] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 3595.310994][ T4470] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 3649.683266][ T4399] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 3650.254547][ T4399] usb 1-1: New USB device found: idVendor=0000, idProduct=a4a7, bcdDevice=7.04 [ 3650.331971][ T4399] usb 1-1: config 1 interface 2 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 3650.335278][ T4399] usb 1-1: config 1 interface 2 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 3650.423964][ T4399] usb 1-1: Dual-Role OTG device on HNP port [ 3650.445868][ T4399] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3650.451638][ T4399] usb 1-1: SerialNumber: 0123456789 [ 3650.688396][ C1] ------------[ cut here ]------------ [ 3650.688714][ C1] usb_ep_enable: ep134 (ep6in-bulk) has maxpacket 0 [ 3650.695483][ C1] WARNING: [] drivers/usb/gadget/udc/core.c:124 at usb_ep_enable+0x60c/0x78c, CPU#1: kworker/1:5/4399 [ 3650.704675][ C1] Modules linked in: [ 3650.706574][ C1] CPU: 1 UID: 0 PID: 4399 Comm: kworker/1:5 Not tainted syzkaller #0 PREEMPT [ 3650.708753][ C1] Hardware name: riscv-virtio,qemu (DT) [ 3650.710953][ C1] Workqueue: usb_hub_wq hub_event [ 3650.713705][ C1] epc : usb_ep_enable+0x60c/0x78c [ 3650.715985][ C1] ra : usb_ep_enable+0x60c/0x78c [ 3650.718759][ C1] epc : ffffffff83fe603e ra : ffffffff83fe603e sp : ffff8f80000176f0 [ 3650.722315][ C1] gp : ffffffff8b1494e0 tp : ffffaf801b8b5040 t0 : ffffffff89517f40 [ 3650.725035][ C1] t1 : fffffffef12a0899 t2 : 2d2d2d2d2d2d2d2d s0 : ffff8f8000017740 [ 3650.727610][ C1] s1 : ffffaf801be4c248 a0 : 0000000000000005 a1 : 0000000000000000 [ 3650.730230][ C1] a2 : 0000081800000000 a3 : ffffffff80155fa8 a4 : 0000000000000000 [ 3650.732943][ C1] a5 : 0000000000000000 a6 : 0000081800000000 a7 : ffffffff895044cb [ 3650.735518][ C1] s2 : 0000000000000086 s3 : ffffffff87793420 s4 : ffffffff8778f360 [ 3650.738070][ C1] s5 : 0000000000000005 s6 : ffffaf801ed74fba s7 : 1ffff5f003ba0d1a [ 3650.740507][ C1] s8 : ffffaf801dd06000 s9 : 0000000000000000 s10: ffffaf801ed74fa0 [ 3650.742976][ C1] s11: ffffaf801dd068b8 t3 : 0000000000000000 t4 : fffffffef12a0899 [ 3650.745471][ C1] t5 : fffffffef12a089a t6 : 0000000000008000 ssp : 0000000000000000 [ 3650.748006][ C1] status: 0000000200000100 badaddr: ffffffff83fe603e cause: 0000000000000003 [ 3650.750871][ C1] [] usb_ep_enable+0x60c/0x78c [ 3650.753455][ C1] [] hidg_set_alt+0x140/0xa40 [ 3650.755763][ C1] [] composite_setup+0x3e8e/0x7c9e [ 3650.758300][ C1] [] configfs_composite_setup+0xee/0x124 [ 3650.760734][ C1] [] dummy_timer+0x1e62/0x3530 [ 3650.763025][ C1] [] __hrtimer_run_queues+0x48e/0x1012 [ 3650.765533][ C1] [] hrtimer_run_softirq+0x18a/0x300 [ 3650.767987][ C1] [] handle_softirqs+0x4e0/0x14fa [ 3650.770331][ C1] [] __irq_exit_rcu+0x4b0/0x866 [ 3650.772656][ C1] [] irq_exit_rcu+0x10/0xf2 [ 3650.774835][ C1] [] handle_riscv_irq+0x40/0x4a [ 3650.777187][ C1] [] call_on_irq_stack+0x32/0x40 [ 3650.780413][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 3650.783152][ C1] CPU: 1 UID: 0 PID: 4399 Comm: kworker/1:5 Not tainted syzkaller #0 PREEMPT [ 3650.786070][ C1] Hardware name: riscv-virtio,qemu (DT) [ 3650.787929][ C1] Workqueue: usb_hub_wq hub_event [ 3650.790053][ C1] Call Trace: [ 3650.791253][ C1] [] dump_backtrace+0x2e/0x3c [ 3650.793467][ C1] [] show_stack+0x30/0x3c [ 3650.795434][ C1] [] dump_stack_lvl+0x114/0x1aa [ 3650.797592][ C1] [] dump_stack+0x1c/0x24 [ 3650.799620][ C1] [] vpanic+0x32e/0x76a [ 3650.801607][ C1] [] trace_suspend_resume+0x0/0x3f6 [ 3650.803803][ C1] [] check_panic_on_warn+0xc0/0xe4 [ 3650.806184][ C1] [] __warn+0x218/0x61a [ 3650.808266][ C1] [] __report_bug+0x166/0x302 [ 3650.810569][ C1] [] report_bug+0xd8/0x28c [ 3650.812733][ C1] [] handle_break+0x13a/0x30c [ 3650.815018][ C1] [] do_trap_break+0x22e/0x45c [ 3650.817153][ C1] [] handle_exception+0x168/0x174 [ 3650.819413][ C1] [] usb_ep_enable+0x60c/0x78c [ 3650.821727][ C1] [] hidg_set_alt+0x140/0xa40 [ 3650.823891][ C1] [] composite_setup+0x3e8e/0x7c9e [ 3650.826134][ C1] [] configfs_composite_setup+0xee/0x124 [ 3650.828378][ C1] [] dummy_timer+0x1e62/0x3530 [ 3650.830563][ C1] [] __hrtimer_run_queues+0x48e/0x1012 [ 3650.833025][ C1] [] hrtimer_run_softirq+0x18a/0x300 [ 3650.835416][ C1] [] handle_softirqs+0x4e0/0x14fa [ 3650.837664][ C1] [] __irq_exit_rcu+0x4b0/0x866 [ 3650.839108][ C1] [] irq_exit_rcu+0x10/0xf2 [ 3650.841249][ C1] [] handle_riscv_irq+0x40/0x4a [ 3650.842943][ C1] [] call_on_irq_stack+0x32/0x40 [ 3650.845246][ C1] SMP: stopping secondary CPUs [ 3650.849044][ C1] Rebooting in 86400 seconds..