last executing test programs: 1.457519743s ago: executing program 2 (id=3): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x90}, 0x4000000) socket$xdp(0x2c, 0x3, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 1.324101567s ago: executing program 3 (id=4): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000001040)={0x73622a85, 0x0, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000003c0)={0x73622a85, 0x10a, 0xfffffffffffffffc}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f00000005c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x1058, 0x0, 0x20, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000300)={@fd={0x66642a85, 0x0, r2}, @ptr={0x66646185, 0xffffffff, 0x0, 0x0, 0x2, 0x3f}, @fda={0x66646185, 0x2, 0x1, 0x8}}, &(0x7f0000000600)={0x0, 0x18, 0x40}}, 0x1000}], 0x0, 0x0, 0x0}) 1.239907999s ago: executing program 0 (id=1): r0 = syz_usb_connect$uac3(0x0, 0xa0, &(0x7f0000002440)=ANY=[@ANYBLOB="12011003000000403512100040000102030109028e000301002040080b0201012130c60904000000010130000a2401042a00ff0f0000132403050001020602028000000700100002000f24090202000000", @ANYRES16], &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f00000005c0)={0x44, &(0x7f0000000200)=ANY=[@ANYBLOB="200604000000e971ec7b"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000002240)={0x84, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000dc0)={0x44, &(0x7f0000000b40)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, 0x0) 1.20510503s ago: executing program 1 (id=2): pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f00000005c0)='fd', 0x0, r0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x2) fchdir(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x84) chdir(&(0x7f0000000080)='./file1\x00') r3 = syz_clone(0x2000, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r3, 0x0) setpgid(0x0, r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) 1.151507681s ago: executing program 3 (id=6): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_GET_DEVICE_ATTR_vm(r0, 0x4018aee2, 0x0) 1.151348541s ago: executing program 3 (id=7): sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002140)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000002280)="21ae1baf930b4569b9ddef9797ffd935c7d80e6466b3e4e62dd4603583f5d4b61fbc65b6ac744d7319535e75bf552062e4cfde1ba7ce29263322e18ea9740aa89f69c47a63133708cda00d2b1f4e799bd41e3f76258180fa91a42aaa8b1ebc4e0ea8fb12f2c71e6e5bc57a8e91f254005514721d93c13c5606ae1fea7f31f558d562bd5a8dfb0b9fed873efa221fccffa84fcd374c92e6cbb03e6a9de890ce323f000000abcc6c01326d588495b7c1a7db31ec4129e6336f26bb9e0b7552af3cd2d5dda1632799bbc98425c433384d8a8e4071ff39a36dfde5f05af35a4ddd340cfecd7ec935f4ce7d3e851583ba1cf53a90a7f7bce5703de57ce93ddef7849b30a01de0637e6d5e507b801d32e582e0c2d564539ebfc84c098a23e765552767b122885fb1629e9c180be47da7931bd125b80de1594b75e5371a81c2c32d0c4a028a5aab0c56a2edf2e0483b87f5ab299dc046076203dea10ccbfc631d5bf4a87ce67004519f248f086346ce6a8a9d181789a59f81d9b7f6781daac3e229914b8b8998c15c3b6302a519331cb05995bc60b7cb872dd3b5b43331c77c5d72e21f7bd2b1a915ff3204e3f20d3a20b22d6a58155b5a4ebf6d1d1cd90c656ecada531c07ff91deb3efa91762cdecfbcc43553750f22ac5c18cc5e8b6f790c2f4e6373af9f98d10e6df49ff8e5cbcbd68e11ed0b967add11410dc2e34f08dbfaf8eb95d4d1153b4c6093192a340eb30fcc71619888c6486746a049585d249efb96b9cace83320b8f96b40ebe3a9a788d05a053380d1026b9434df87a3a387549bcabe88684c4d0948a6e219b5769480e6d0a9bf0da9a5212f3dbc8d1dff240856691243b203d7edd4d3cc89a38a6c80fdb1229a01", 0x272}, {&(0x7f0000000dc0)="ab29d92826349952eb8f7a2a74f535bc9739c1df57144c51a3391625b8b5354134b06ef1355506aeae96e3f097503998f375a054cf3d7de4fe53ea51518955349cdbadca60e1c65cc18dbe99369be03e492fb55fc9067bb6f7f7c3ee1720000000054a63ac58225ed0502f5ac8999e0c74a5dbb320bd54ec813e8bee6bfa5cbfb0726ac1b6ad97d802d5fae186f0769421fb965c7396854e2a3ac844a3769f8449901ba5e2b2da1ff6119aeb26ac204cfc6b54be73b6f195491ae2c0cb26b0cba61dae7a17740e8112ff188919c6e2e31a2a074863edba4a0e58b61faec4a42c29d7f9e48a43b8cb7d3c5a1e5aa67f87538140f8d633a54bceb8b1dda2397ea147d3b26e903f608b6ab1844ea7cf630d828118bba0f0f85e2e6316ae1ed9a2a7d08a05c170cb76bf111930df0cf760f7768571afdefe82a95296cee7c010f748a97046efcc774e7d85edbd5058104fef4942fb4430da89f67d1fea33bf2acfb793a610b3738b393eed8633fc8e8f630932206960e9076c7d7fc99fce018701c50d39b811a7427a7a9fcb340c2755541f228462010ec40ba945a0febd460dad5d548f1be090f5dbaa8ae8835dc47ed2537681827f6129759272574cf58f2f33e47a0e", 0x1c2}], 0x2, 0x0, 0x0, 0x900}}], 0x1, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000000)=""/102, 0x365}, {&(0x7f0000000280)=""/76, 0x14c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/92, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x188}, {&(0x7f00000007c0)=""/154, 0x2c}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) 1.119623802s ago: executing program 1 (id=8): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x90}, 0x4000000) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={0x0}, 0x1, 0x0, 0x0, 0x4}, 0x80) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={0x0, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 1.097772453s ago: executing program 3 (id=9): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)={0x60, 0x0, 0x2, 0x301, 0x0, 0x0, {0x2, 0x0, 0x10}, [@CTA_EXPECT_NAT={0x4}, @CTA_EXPECT_NAT={0x48, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x44, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010101}, {0x8, 0x2, @local}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x2a}}}}]}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x40810}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x49, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000004, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x5, 0x5, 0xd500, 0x8, 0x79, 0x7, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0x9b54, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a00000709"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000183, 0x2, 0x7, 0xf2, 0x0, 0x7fffffffffffe, 0x7, 0x5, 0x8000b, 0x7, 0xfffffffffffffff8, 0x9, 0x4], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 1.050489374s ago: executing program 4 (id=5): sendmsg$TIPC_NL_NAME_TABLE_GET(0xffffffffffffffff, 0x0, 0xd7983ab608da75d7) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x49, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000004, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x5, 0x5, 0xd500, 0x8, 0x79, 0x7, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0x9b54, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYRESHEX=r1], 0x7c}, 0x1, 0x0, 0x0, 0x4004880}, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000183, 0x2, 0x7, 0xf2, 0x0, 0x7fffffffffffe, 0x7, 0x5, 0x8000b, 0x7, 0xfffffffffffffff8, 0x9, 0x4], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 895.233178ms ago: executing program 3 (id=10): inotify_init1(0x800) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x100) mkdir(&(0x7f0000000000)='./file0\x00', 0x4) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x84242, 0x1df2a23c5997fad6) write$FUSE_CREATE_OPEN(r3, &(0x7f0000000180)={0xa0, 0x0, 0x0, {{0x4, 0x0, 0x5, 0x7, 0x3, 0xfffffffd, {0x400000080001, 0xfd, 0x20ff, 0x8, 0xe, 0xd615, 0x9, 0x3, 0xfffffffc, 0x6000, 0x0, 0x0, 0x0, 0x5, 0x7}}, {0x0, 0x13}}}, 0xa0) sendfile(r3, r3, &(0x7f0000000080), 0x7f03) 847.419509ms ago: executing program 1 (id=11): syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x418000) syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090000082502000000000000000109025c00020100f92a0904000001020900000524060001053408fa6e0d240f0100000000000d000a0006471a010000190581"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(0xffffffffffffffff) write$char_usb(r0, 0x0, 0x0) write$char_usb(r0, 0x0, 0x0) syz_usb_control_io$uac2(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x1c0000000000) 412.29807ms ago: executing program 2 (id=12): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060"], 0xb8}}, 0x20040014) sendmsg$TIPC_NL_NAME_TABLE_GET(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40400c0}, 0xd7983ab608da75d7) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x49, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000004, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x5, 0x5, 0xd500, 0x8, 0x79, 0x7, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0x9b54, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000183, 0x2, 0x7, 0xf2, 0x0, 0x7fffffffffffe, 0x7, 0x5, 0x8000b, 0x7, 0xfffffffffffffff8, 0x9, 0x4], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 0s ago: executing program 4 (id=13): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7001}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x104, 0xe}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000980)=@newtfilter={0x84, 0x2c, 0xd2f, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x8, 0x40, 0x7, 0x7, 0x80}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x24008084}, 0x20000000) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.9' (ED25519) to the list of known hosts. [ 22.252506][ T30] audit: type=1400 audit(1789087826.197:64): avc: denied { mounton } for pid=277 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.256745][ T277] cgroup: Unknown subsys name 'net' [ 22.275355][ T30] audit: type=1400 audit(1789087826.197:65): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.302806][ T30] audit: type=1400 audit(1789087826.227:66): avc: denied { unmount } for pid=277 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.303340][ T277] cgroup: Unknown subsys name 'devices' [ 22.444576][ T277] cgroup: Unknown subsys name 'hugetlb' [ 22.450413][ T277] cgroup: Unknown subsys name 'rlimit' [ 22.593542][ T30] audit: type=1400 audit(1789087826.537:67): avc: denied { setattr } for pid=277 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.617124][ T30] audit: type=1400 audit(1789087826.537:68): avc: denied { mounton } for pid=277 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.642218][ T30] audit: type=1400 audit(1789087826.537:69): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.661538][ T279] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 22.674583][ T30] audit: type=1400 audit(1789087826.617:70): avc: denied { relabelto } for pid=279 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.700251][ T30] audit: type=1400 audit(1789087826.617:71): avc: denied { write } for pid=279 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.713404][ T277] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.727565][ T30] audit: type=1400 audit(1789087826.647:72): avc: denied { read } for pid=277 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.761084][ T30] audit: type=1400 audit(1789087826.647:73): avc: denied { open } for pid=277 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.393866][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.400981][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.408818][ T285] device bridge_slave_0 entered promiscuous mode [ 23.417997][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.425569][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.433329][ T285] device bridge_slave_1 entered promiscuous mode [ 23.439867][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.447133][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.454910][ T287] device bridge_slave_0 entered promiscuous mode [ 23.462152][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.470205][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.477840][ T287] device bridge_slave_1 entered promiscuous mode [ 23.530056][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.537164][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.544857][ T289] device bridge_slave_0 entered promiscuous mode [ 23.566981][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.574911][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.582551][ T289] device bridge_slave_1 entered promiscuous mode [ 23.589174][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.596286][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.603966][ T286] device bridge_slave_0 entered promiscuous mode [ 23.611007][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.618222][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.626207][ T286] device bridge_slave_1 entered promiscuous mode [ 23.673977][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.681108][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.688846][ T288] device bridge_slave_0 entered promiscuous mode [ 23.715523][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.722735][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.730339][ T288] device bridge_slave_1 entered promiscuous mode [ 23.870955][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.878174][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.885554][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.892636][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.908573][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.915824][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.923244][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.930286][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.942989][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.950174][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.957546][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.964625][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.006810][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.013929][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.021244][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.028345][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.046760][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.053864][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.061169][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.068354][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.093030][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.100600][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.108205][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.116524][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.124053][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.131736][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.140494][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.148146][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.156190][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.164946][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.172370][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.194365][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.203004][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.211095][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.219502][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.228160][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.235316][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.242949][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.251201][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.258313][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.267427][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.278349][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.286176][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.308084][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.316896][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.325447][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.333927][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.341158][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.352969][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.361474][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.384300][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.393455][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.401659][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.408876][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.416955][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.425728][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.434363][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.441703][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.449495][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.457941][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.466325][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.473616][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.481239][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.490414][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.498780][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.507089][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.525571][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.534132][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.543070][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.551281][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.561229][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.569559][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.589702][ T286] device veth0_vlan entered promiscuous mode [ 24.597244][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.605020][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.613219][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.621336][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.630017][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.638496][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.647884][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.655757][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.668587][ T285] device veth0_vlan entered promiscuous mode [ 24.682155][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.689937][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.698129][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.707395][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.719034][ T286] device veth1_macvtap entered promiscuous mode [ 24.729975][ T289] device veth0_vlan entered promiscuous mode [ 24.744634][ T287] device veth0_vlan entered promiscuous mode [ 24.751807][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.760969][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.769735][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.778862][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.787717][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.796561][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.805261][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.812544][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.820281][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.829040][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.837559][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.846145][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.854510][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.862431][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.870607][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.878704][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.890732][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.899565][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.912867][ T289] device veth1_macvtap entered promiscuous mode [ 24.930845][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.939396][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.948097][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.956647][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.965496][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.974890][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.983889][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.992429][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.000731][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.009296][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.018163][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.026645][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.033743][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.049896][ T285] device veth1_macvtap entered promiscuous mode [ 25.059131][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.075458][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.085043][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.097208][ T287] device veth1_macvtap entered promiscuous mode [ 25.104754][ T286] request_module fs-gadgetfs succeeded, but still no fs? [ 25.114632][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.123662][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.149564][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.162542][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.174173][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.179479][ T310] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.184538][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.208180][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.216797][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.225575][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.234302][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.243121][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.251603][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.288373][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.304943][ T316] binder: BINDER_SET_CONTEXT_MGR already set [ 25.307837][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.311007][ T316] binder: 314:316 ioctl 4018620d 2000000003c0 returned -16 [ 25.321241][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.334962][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.344072][ T288] device veth0_vlan entered promiscuous mode [ 25.383999][ T288] device veth1_macvtap entered promiscuous mode [ 25.409087][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.424624][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.433649][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.466081][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.510554][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.520012][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.529017][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.662012][ T39] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 26.042087][ T307] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 26.062164][ T39] usb 1-1: unable to get BOS descriptor or descriptor too short [ 26.152104][ T39] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 26.170181][ T39] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 26.302092][ T307] usb 2-1: Using ep0 maxpacket: 8 [ 26.362388][ T39] usb 1-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 26.377993][ T39] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.403792][ T39] usb 1-1: Product: syz [ 26.417331][ T39] usb 1-1: Manufacturer: syz [ 26.423019][ T307] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 26.442240][ T307] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 26.452814][ T39] usb 1-1: SerialNumber: syz [ 26.472481][ T307] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 100, changing to 10 [ 26.495864][ T307] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24936, setting to 1024 [ 26.512480][ T39] usb 1-1: selecting invalid altsetting 1 [ 26.521124][ T39] usb 1-1: unit 6 not found! [ 26.534639][ T307] usb 2-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 26.544659][ T307] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.602642][ T307] hub 2-1:1.0: bad descriptor, ignoring hub [ 26.618905][ T307] hub: probe of 2-1:1.0 failed with error -5 [ 26.625546][ T307] cdc_wdm 2-1:1.0: skipping garbage [ 26.635220][ T307] cdc_wdm 2-1:1.0: skipping garbage [ 26.651197][ T307] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 26.661633][ T355] ================================================================== [ 26.670119][ T355] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0x88e/0x3200 [ 26.678437][ T355] Read of size 8 at addr ffff88810fe2dcc0 by task syz.4.13/355 [ 26.686249][ T355] [ 26.688648][ T355] CPU: 1 PID: 355 Comm: syz.4.13 Not tainted syzkaller #0 [ 26.695905][ T355] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.706007][ T355] Call Trace: [ 26.709449][ T355] [ 26.712454][ T355] __dump_stack+0x21/0x30 [ 26.716844][ T355] dump_stack_lvl+0x110/0x170 [ 26.721578][ T355] ? show_regs_print_info+0x20/0x20 [ 26.726821][ T355] ? load_image+0x3f0/0x3f0 [ 26.731372][ T355] print_address_description+0x7f/0x2c0 [ 26.737547][ T355] ? tc_setup_flow_action+0x88e/0x3200 [ 26.743053][ T355] kasan_report+0x10f/0x150 [ 26.747624][ T355] ? tc_setup_flow_action+0x88e/0x3200 [ 26.753131][ T355] __asan_report_load8_noabort+0x14/0x20 [ 26.758903][ T355] tc_setup_flow_action+0x88e/0x3200 [ 26.764423][ T355] mall_replace_hw_filter+0x2db/0x8d0 [ 26.770035][ T355] ? pcpu_block_update_hint_alloc+0x8bc/0xc50 [ 26.776161][ T355] ? mall_set_parms+0x520/0x520 [ 26.781054][ T355] ? tcf_exts_destroy+0xb0/0xb0 [ 26.786084][ T355] ? pcpu_alloc+0x1118/0x16f0 [ 26.790810][ T355] ? mall_set_parms+0x1e4/0x520 [ 26.795699][ T355] mall_change+0x544/0x760 [ 26.800372][ T355] ? __kasan_check_write+0x14/0x20 [ 26.805720][ T355] ? mall_get+0xa0/0xa0 [ 26.809907][ T355] ? tcf_chain_tp_insert_unique+0x946/0xa70 [ 26.815841][ T355] ? mall_get+0xa0/0xa0 [ 26.820145][ T355] tc_new_tfilter+0x13df/0x1990 [ 26.825336][ T355] ? tcf_gate_entry_destructor+0x20/0x20 [ 26.831124][ T355] ? security_capable+0x87/0xb0 [ 26.836016][ T355] ? ns_capable+0x8c/0xf0 [ 26.840630][ T355] ? netlink_net_capable+0x125/0x160 [ 26.846216][ T355] ? tcf_gate_entry_destructor+0x20/0x20 [ 26.852056][ T355] rtnetlink_rcv_msg+0x83c/0xcb0 [ 26.857013][ T355] ? rtnetlink_bind+0x80/0x80 [ 26.861717][ T355] ? avc_has_perm_noaudit+0x390/0x490 [ 26.867133][ T355] ? memcpy+0x56/0x70 [ 26.871427][ T355] ? avc_has_perm_noaudit+0x30a/0x490 [ 26.876819][ T355] ? arch_stack_walk+0xee/0x140 [ 26.881787][ T355] ? avc_denied+0x1b0/0x1b0 [ 26.886505][ T355] ? stack_trace_save+0xa6/0xf0 [ 26.891407][ T355] ? avc_has_perm+0x163/0x250 [ 26.896243][ T355] ? avc_has_perm_noaudit+0x490/0x490 [ 26.901915][ T355] ? x64_sys_call+0x4b/0x9a0 [ 26.906800][ T355] ? selinux_nlmsg_lookup+0x39d/0x440 [ 26.912315][ T355] netlink_rcv_skb+0x1e9/0x430 [ 26.917140][ T355] ? rtnetlink_bind+0x80/0x80 [ 26.921934][ T355] ? netlink_ack+0xb10/0xb10 [ 26.926556][ T355] ? _copy_from_iter+0x4a4/0x10a0 [ 26.931636][ T355] ? __netlink_lookup+0x387/0x3b0 [ 26.936689][ T355] rtnetlink_rcv+0x1c/0x20 [ 26.941132][ T355] netlink_unicast+0x86c/0xa30 [ 26.945933][ T355] netlink_sendmsg+0x879/0xb80 [ 26.950723][ T355] ? netlink_getsockopt+0x530/0x530 [ 26.955961][ T355] ? security_socket_sendmsg+0x82/0xa0 [ 26.961525][ T355] ? netlink_getsockopt+0x530/0x530 [ 26.966775][ T355] ____sys_sendmsg+0x5be/0x8f0 [ 26.971564][ T355] ? __sys_sendmsg_sock+0x40/0x40 [ 26.976831][ T355] ? import_iovec+0x7c/0xb0 [ 26.981390][ T355] ___sys_sendmsg+0x236/0x2e0 [ 26.986123][ T355] ? __sys_sendmsg+0x280/0x280 [ 26.990923][ T355] ? sock_show_fdinfo+0xa0/0xa0 [ 26.995893][ T355] ? __fdget+0x1a1/0x230 [ 27.000153][ T355] __x64_sys_sendmsg+0x201/0x2d0 [ 27.005114][ T355] ? ___sys_sendmsg+0x2e0/0x2e0 [ 27.009984][ T355] ? __kasan_check_write+0x14/0x20 [ 27.015254][ T355] ? switch_fpu_return+0x15d/0x2c0 [ 27.020510][ T355] x64_sys_call+0x4b/0x9a0 [ 27.024961][ T355] do_syscall_64+0x4c/0xa0 [ 27.029525][ T355] ? clear_bhb_loop+0x50/0xa0 [ 27.034244][ T355] ? clear_bhb_loop+0x50/0xa0 [ 27.038966][ T355] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 27.045020][ T355] RIP: 0033:0x7f2ca47f8159 [ 27.049464][ T355] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 27.069092][ T355] RSP: 002b:00007f2ca3251028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 27.077620][ T355] RAX: ffffffffffffffda RBX: 00007f2ca4a7ffa0 RCX: 00007f2ca47f8159 [ 27.085622][ T355] RDX: 0000000020000000 RSI: 0000200000000480 RDI: 0000000000000004 [ 27.094058][ T355] RBP: 00007f2ca488f03b R08: 0000000000000000 R09: 0000000000000000 [ 27.102208][ T355] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 27.110292][ T355] R13: 00007f2ca4a80038 R14: 00007f2ca4a7ffa0 R15: 00007ffdd65ce778 [ 27.118306][ T355] [ 27.121366][ T355] [ 27.123720][ T355] Allocated by task 355: [ 27.127993][ T355] __kasan_kmalloc+0xd4/0x100 [ 27.132810][ T355] __kmalloc+0x13d/0x2c0 [ 27.137160][ T355] tcf_idr_create+0x5f/0x790 [ 27.141885][ T355] tcf_idr_create_from_flags+0x61/0x70 [ 27.147457][ T355] tcf_gact_init+0x342/0x570 [ 27.152082][ T355] tcf_action_init_1+0x3fd/0x6b0 [ 27.157075][ T355] tcf_action_init+0x233/0x7a0 [ 27.161881][ T355] tcf_exts_validate+0x24a/0x580 [ 27.167015][ T355] mall_set_parms+0x48/0x520 [ 27.171742][ T355] mall_change+0x478/0x760 [ 27.176395][ T355] tc_new_tfilter+0x13df/0x1990 [ 27.181303][ T355] rtnetlink_rcv_msg+0x83c/0xcb0 [ 27.186285][ T355] netlink_rcv_skb+0x1e9/0x430 [ 27.191163][ T355] rtnetlink_rcv+0x1c/0x20 [ 27.195647][ T355] netlink_unicast+0x86c/0xa30 [ 27.200717][ T355] netlink_sendmsg+0x879/0xb80 [ 27.205812][ T355] ____sys_sendmsg+0x5be/0x8f0 [ 27.210609][ T355] ___sys_sendmsg+0x236/0x2e0 [ 27.215649][ T355] __x64_sys_sendmsg+0x201/0x2d0 [ 27.220878][ T355] x64_sys_call+0x4b/0x9a0 [ 27.225318][ T355] do_syscall_64+0x4c/0xa0 [ 27.229929][ T355] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 27.236260][ T355] [ 27.238634][ T355] The buggy address belongs to the object at ffff88810fe2dc00 [ 27.238634][ T355] which belongs to the cache kmalloc-192 of size 192 [ 27.252964][ T355] The buggy address is located 0 bytes to the right of [ 27.252964][ T355] 192-byte region [ffff88810fe2dc00, ffff88810fe2dcc0) [ 27.266790][ T355] The buggy address belongs to the page: [ 27.272463][ T355] page:ffffea00043f8b40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10fe2d [ 27.282734][ T355] flags: 0x4000000000000200(slab|zone=1) [ 27.288404][ T355] raw: 4000000000000200 ffffea00043f8a00 0000000700000007 ffff888100042c00 [ 27.297003][ T355] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 27.305904][ T355] page dumped because: kasan: bad access detected [ 27.312442][ T355] page_owner tracks the page as allocated [ 27.318224][ T355] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 102, ts 6286927775, free_ts 6286904408 [ 27.334240][ T355] post_alloc_hook+0x192/0x1b0 [ 27.339041][ T355] prep_new_page+0x1c/0x110 [ 27.343680][ T355] get_page_from_freelist+0x2c3a/0x2cd0 [ 27.349775][ T355] __alloc_pages+0x1a2/0x460 [ 27.354387][ T355] new_slab+0xa0/0x4d0 [ 27.358474][ T355] ___slab_alloc+0x3ac/0x840 [ 27.363090][ T355] __slab_alloc+0x49/0x90 [ 27.367454][ T355] kmem_cache_alloc_trace+0x146/0x270 [ 27.372855][ T355] kernfs_fop_open+0x375/0xbb0 [ 27.377734][ T355] do_dentry_open+0x82a/0x1010 [ 27.382624][ T355] vfs_open+0x73/0x80 [ 27.386634][ T355] path_openat+0x26e6/0x2f80 [ 27.391258][ T355] do_filp_open+0x1df/0x400 [ 27.395786][ T355] do_sys_openat2+0x15e/0x7f0 [ 27.400494][ T355] __x64_sys_openat+0x136/0x160 [ 27.405368][ T355] x64_sys_call+0x219/0x9a0 [ 27.410337][ T355] page last free stack trace: [ 27.415381][ T355] free_unref_page_prepare+0x5fa/0x600 [ 27.420867][ T355] free_unref_page+0xae/0x540 [ 27.425567][ T355] __free_pages+0x6c/0x100 [ 27.430009][ T355] free_pages+0x82/0x90 [ 27.434418][ T355] selinux_genfs_get_sid+0x20b/0x250 [ 27.439745][ T355] inode_doinit_with_dentry+0x884/0xd90 [ 27.445338][ T355] selinux_d_instantiate+0x27/0x40 [ 27.450500][ T355] security_d_instantiate+0x9e/0xf0 [ 27.455719][ T355] d_splice_alias+0x6d/0x390 [ 27.460339][ T355] kernfs_iop_lookup+0x2c2/0x310 [ 27.465385][ T355] path_openat+0x1436/0x2f80 [ 27.469997][ T355] do_filp_open+0x1df/0x400 [ 27.474737][ T355] do_sys_openat2+0x15e/0x7f0 [ 27.479463][ T355] __x64_sys_openat+0x136/0x160 [ 27.484553][ T355] x64_sys_call+0x219/0x9a0 [ 27.489108][ T355] do_syscall_64+0x4c/0xa0 [ 27.493551][ T355] [ 27.495906][ T355] Memory state around the buggy address: [ 27.501550][ T355] ffff88810fe2db80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 27.509624][ T355] ffff88810fe2dc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.517921][ T355] >ffff88810fe2dc80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 27.526632][ T355] ^ [ 27.532980][ T355] ffff88810fe2dd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.541149][ T355] ffff88810fe2dd80: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.549219][ T355] ================================================================== [ 27.557294][ T355] Disabling lock debugging due to kernel taint [ 27.582127][ T30] kauditd_printk_skb: 40 callbacks suppressed [ 27.582146][ T30] audit: type=1400 audit(1789087831.517:114): avc: denied { read } for pid=83 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 27.611932][ T30] audit: type=1400 audit(1789087831.517:115): avc: denied { search } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 27.634981][ T30] audit: type=1400 audit(1789087831.517:116): avc: denied { write } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 27.657227][ T30] audit: type=1400 audit(1789087831.517:117): avc: denied { add_name } for pid=83 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 27.681301][ T30] audit: type=1400 audit(1789087831.517:118): avc: denied { create } for pid=83 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 27.706090][ T30] audit: type=1400 audit(1789087831.517:119): avc: denied { append open } for pid=83 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 27.729529][ T30] audit: type=1400 audit(1789087831.517:120): avc: denied { getattr } for pid=83 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 27.882172][ T307] usb 2-1: USB disconnect, device number 2 [ 28.092104][ T39] usb 1-1: cannot get ctl value: req = 0x84, wValue = 0x100, wIndex = 0x200, type = 3 [ 28.572130][ T39] usb 1-1: cannot get ctl value: req = 0x81, wValue = 0x100, wIndex = 0x200, type = 3 [ 28.792115][ T39] usb 1-1: cannot get ctl value: req = 0x81, wValue = 0x100, wIndex = 0x200, type = 3 [ 28.802259][ T39] snd-usb-audio: probe of 1-1:1.0 failed with error -22 [ 28.810209][ T39] usb 1-1: USB disconnect, device number 2