last executing test programs: 6.123725129s ago: executing program 2 (id=3): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000459bb2405804035000000000000109021b000111000000090400000195699b000905", @ANYRES32], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000180)={0x0, 0x0, 0x3, 'Yf\''}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000001e40)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000001dc0)={0x20, 0x1, 0x34, "712bab"}, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000001300)={0x84, &(0x7f0000000e40)={0x0, 0x0, 0x3, "0b3b81"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000800)={0x44, &(0x7f0000000540)={0x40, 0x12, 0x3, "64d99b"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20004184, 0x0, 0x0) syz_usb_control_io$uac1(r0, &(0x7f0000000140)={0x14, &(0x7f0000000000)={0x40, 0x22, 0xb8, {0xb8, 0x23, "b39ae8530e11f563eca8a2b3e97ac14e969ae969d4537ca9a09d02bc09eaaaa5343c2cc4f38994e0253690603ac0a8b129da04df8f4e720a6998156836124ce4309d570f9720e75e887dee548233a0d5a25a407c211b0e33cf580ea3ae4962116e053ee078d883e171a487fcc35073fdc1c39a89bb170000ae5979fcb7cb0eeb9e617035755d68aa8cb45310d712a813dfd8ea01432fb454bf151fe5c2d1ab8c6268ac6e1298f72cc84eea09d78ceb7a70b8f5e64c7e"}}, &(0x7f0000000100)={0x0, 0x3, 0x30, @string={0x30, 0x3, "a5b8c2b2fe169f431b19ba7159d6ae79c92156f6b85448427a81e0ca2e32f989a35ed5800d544aa8ee6284596116"}}}, &(0x7f00000004c0)={0x44, &(0x7f00000001c0)={0x20, 0x11, 0x40, "24b6d1048248829bf4e48794539d58de7a925d61b2b6914f92bfed966111159cea93e02a2949a15e451848b2b9dc0275e37c32ff9bc26d569351e1177d3fe7ec"}, &(0x7f0000000240)={0x0, 0xa, 0x1, 0xec}, &(0x7f0000000280)={0x0, 0x8, 0x1, 0x7}, &(0x7f00000002c0)={0x20, 0x81, 0x2, "e0b7"}, &(0x7f0000000300)={0x20, 0x82, 0x3, "91ba64"}, &(0x7f0000000340)={0x20, 0x83, 0x1, '\n'}, &(0x7f0000000380)={0x20, 0x84, 0x1, "91"}, &(0x7f00000003c0)={0x20, 0x85, 0x3, "24995e"}}) 6.051001071s ago: executing program 3 (id=4): mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x3, &(0x7f0000000440)=[{0x3d, 0x0, 0x1, 0xfffffffc}, {0x4, 0x2}, {0x6, 0xfc, 0x0, 0x6}]}) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x1, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x2}, 0x1c) r1 = socket$packet(0x11, 0x2, 0x300) syz_usb_connect(0x3, 0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="92010002508bf5088205cae60bd30102030109023400010301600209042d0202ff6229010a24010c000302010209050101000203ff0609050a030800030101072501"], 0x0) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'bridge0\x00', 0x0}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CAP_X86_BUS_LOCK_EXIT(r5, 0x4068aea3, &(0x7f0000000300)={0xc1, 0x0, 0xea287a22f2b33d7a}) sendto$packet(r2, &(0x7f00000000c0)='G', 0x1, 0xc190, &(0x7f0000000200)={0x11, 0x8100, r3, 0x1, 0x6, 0x6, @multicast}, 0x14) 3.488304796s ago: executing program 0 (id=14): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x40, 0x0) mmap(&(0x7f00001f9000/0x3000)=nil, 0x3000, 0x2000007, 0x12, r0, 0x9f25e000) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="280000004300010000000000000000000a004000140001"], 0x28}}, 0x0) (async) ioctl$XFS_IOC_FSCOUNTS(0xffffffffffffffff, 0x80205871, &(0x7f0000000040)) 3.430615697s ago: executing program 0 (id=15): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010025bd7000fedbdf2501000000000000000b000000000c0014"], 0x28}, 0x1, 0x0, 0x0, 0x4000006}, 0x40) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_sys\x00', 0x275a, 0x0) fcntl$lock(r2, 0x6, &(0x7f0000000000)={0x0, 0x0, 0x8}) fcntl$lock(r2, 0x24, &(0x7f0000000040)={0x0, 0x2, 0x14, 0x7}) syz_usb_connect$cdc_ncm(0x5, 0x98, &(0x7f0000000000)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x86, 0x2, 0x1, 0xdf, 0x40, 0x1, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0x24}, {0x60, 0x24, 0xf, 0x1, 0xfffffffc, 0xba, 0xb4, 0x9}, {0x6, 0x24, 0x1a, 0xf8bc, 0x6}, [@mdlm={0x15, 0x24, 0x12, 0xff}, @mdlm={0x15, 0x24, 0x12, 0x1}]}, {{0x9, 0x5, 0x81, 0x3, 0x10, 0xdd, 0x5, 0x3}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x18, 0x9, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x8, 0x2, 0x6, 0xb}}}}}}}]}}, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0}) 2.845714049s ago: executing program 3 (id=17): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x141a82, 0x0) copy_file_range(r0, 0x0, r0, 0x0, 0x3, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f00000001c0), 0x10) setsockopt$CAN_RAW_RECV_OWN_MSGS(r1, 0x65, 0x4, &(0x7f0000000040)=0x1, 0x4) sendmsg$can_raw(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=@can={{0x3}, 0x3, 0x2, 0x0, 0x0, "ee0d702fac00008a"}, 0x10}, 0x1, 0x0, 0x0, 0x801}, 0xd209f6d83486bb56) recvmmsg(r1, &(0x7f0000002480)=[{{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000300)=""/31, 0x1f}, {0x0}, {&(0x7f0000000580)=""/194, 0xc2}, {&(0x7f0000000680)=""/195, 0xc3}], 0x4}, 0x2fa}], 0x2, 0x2, 0x0) ioctl$BTRFS_IOC_DEFRAG(r0, 0x50009402, 0x0) 2.138228745s ago: executing program 2 (id=20): unshare(0x64000400) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'gre0\x00', 0x0}) bind$packet(r1, &(0x7f0000000300)={0x11, 0x1b, r2, 0x1, 0x6, 0x6, @local}, 0x14) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c0000001000810000000000008000000000ffff", @ANYRES32=0x0, @ANYBLOB="1f043cbf", @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) 2.131577274s ago: executing program 2 (id=21): r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="4001000010001307fefffffffcdbdf2564010101000000000010000000fb00002001000000000000000f000000000000000000034e2000020a0000006c000000507f4629bc5cb632ea9e0e5cf9fb640f553bd4275d3b54b6ac5614c3535fe29c32efe91b0c180e7c1b4035cb1adaf41c35cfca8c3120a579e126c9681973610b47c8c236e65176aadcbd6516baddcbb73ee7408c", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="fc010000000000000000000000000000000000fe3200000020010000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000043050000000000000400000000000000ffffffffffffff7f000000000000000000000000000000000200000000000000000000002cbd70000035000002000400500000000000000050001200726663343130362867636d28616573292900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000060000000210466d3"], 0x140}, 0x1, 0x0, 0x0, 0x880}, 0x0) (async) r2 = openat$cgroup_procs(r0, &(0x7f0000000000)='tasks\x00', 0x2, 0x0) pread64(r2, &(0x7f0000001240)=""/102382, 0x18fee, 0xfffff7f75) 2.062048286s ago: executing program 2 (id=23): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) unshare(0x60000600) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000440)={'tunl0\x00', &(0x7f0000000480)={'syztnl0\x00', 0x0, 0x700, 0x8, 0x4000006, 0x8, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x67, 0x0, 0x9, 0x4, 0x0, @multicast1, @empty}}}}) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f0000000cc0)=[{{0x0, 0x0, 0x0}, 0xdb}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000001180)=""/4051, 0xfd3}, {&(0x7f0000000ac0)=""/200, 0xc8}, {&(0x7f0000000980)=""/265, 0x109}, {&(0x7f0000000780)=""/160, 0xa0}, {&(0x7f0000000880)=""/212, 0xd4}, {&(0x7f0000000000)=""/108, 0x6c}, {&(0x7f00000002c0)=""/229, 0xe5}, {&(0x7f0000000240)=""/109, 0x6d}, {&(0x7f0000000100)=""/94, 0x5e}, {&(0x7f00000001c0)=""/32, 0x20}], 0xa}, 0x120a}], 0x3, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0369e269b9, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) futex(&(0x7f0000000000)=0x2, 0xb, 0x2, 0x0, &(0x7f00000000c0)=0x2, 0x2) futex(&(0x7f000000cffc), 0x5, 0x4, 0x0, &(0x7f0000000000)=0x1, 0x4ffffff) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) 2.017354857s ago: executing program 3 (id=25): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000000000404c05f20dafd60000000109022400010000000009040000010300010009210101000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000e40)={0x84, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080)={0x1}) 2.001006907s ago: executing program 0 (id=26): r0 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x1e7d, 0x2d50, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x5, 0xc, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x0, 0xb, 0xfe}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000180)={0x24, &(0x7f0000000040)={0x40, 0xc, 0x16, {0x16, 0x10, "5a2b5d0880577c22683e39bff23da4f481cfbd02"}}, &(0x7f00000000c0)={0x0, 0x3, 0x38, @string={0x38, 0x3, "58e632d89699b3635fd7b8242c3b83aeb0a0b14827a108324e362ab92618b5c5df260a2191bc8c216b12614a8b38306a5b2692538209"}}, &(0x7f0000000100)={0x0, 0x22, 0x24, {[@global=@item_4={0x3, 0x1, 0xa, "0d4ef14f"}, @main=@item_012={0x0, 0x0, 0x8}, @main=@item_012={0x1, 0x0, 0xc, "d2"}, @global=@item_012={0x2, 0x1, 0x5, "bba6"}, @global=@item_4={0x3, 0x1, 0x0, "d8773006"}, @main=@item_012={0x1, 0x0, 0x0, '8'}, @main=@item_4={0x3, 0x0, 0x9, "5cfbf626"}, @local=@item_4={0x3, 0x2, 0x0, "f6f81f33"}, @local=@item_4={0x3, 0x2, 0x4, "47886e53"}, @local=@item_012={0x2, 0x2, 0x9, "b66f"}]}}, &(0x7f0000000140)={0x0, 0x21, 0x9, {0x9, 0x21, 0x400, 0x7, 0x1, {0x22, 0xbf2}}}}, &(0x7f0000000400)={0x2c, &(0x7f00000001c0)={0x20, 0x6, 0x6f, "1a837454abaf0fd969021a486fccddee73823e21045a2e1186d6f3a031d9f4364bf9131a4d934accb6036f747dac52e07d367b2a52bb1992c0b0b073b13f2a7138d8296e516ce61fd09af4cefc46e8348ffb4a8ba40f186b6927293671612f7303c497fe5b74c5d015ba9f61e3e35b"}, &(0x7f0000000240)={0x0, 0xa, 0x1, 0x7}, &(0x7f0000000280)={0x0, 0x8, 0x1, 0x99}, &(0x7f00000002c0)={0x20, 0x1, 0xc7, "d6b7610802aef5ac5200290615c809d4ea20a7557226f2804238f04f229c591ff11a920ec3bd6844293f623116b0022d8ad03c32f91c5f4763b8342a1507306f7968421f00ed3c12e01eb9282c4032b45318945107828d4e9865a029318ace4dfb1b5c78319bf172dcebf021be9350ba9dae50f5c523f77e383d0dfeeef349d06674431f0ca6ee9255d6fa0c0c66c20bb7d40ddc59527efd980f2766c769a95bca791f7d42d2aaa5d6c3b2731fb4c8321021c7d1c26be5a8cb60101e0a490bca7f3207d4a96c17"}, &(0x7f00000003c0)={0x20, 0x3, 0x1, 0x8}}) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0}, 0x0) 1.941932149s ago: executing program 2 (id=27): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000040bd28420000000000000109022400010000000009040100020300000009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, &(0x7f0000000240)={0x2c, &(0x7f0000000800)=ANY=[@ANYBLOB="20088a00"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) pipe2(0x0, 0x80000) 743.041484ms ago: executing program 1 (id=28): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) pipe(&(0x7f0000000280)) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='wchan\x00') fchdir(r1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="f0000000100001e82cbd7000fcdbdf25ac141419000000000000000000000a00ac1e00010000000000000000000000004e2404774e21044502000080be0000009c8f177d56b00244cd62e714ffffffffe7d2965ad938ad47425dee005c9c88f209b3e0c54572971d413315f5db52094c229158af3afef93e62592cff32ff9d051b542acfa424e533baab9708009893ac8ee0f0d8cbfd8ef8c03c1ba8af49dc", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac1414bb000000000000000000000000000004d22b000000640101000000000000000000000000000700000000000000b109000000000000ffffffffffffffff08000000000000000200000000000000213800000000000008000000000000004e7e00000000000001000000010000000000000000000000ffff0000000000000700000000000000d5000000f8ffffff3a51aa6c2dbd700006350000020000011000000000000000"], 0xf0}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) 722.049344ms ago: executing program 1 (id=29): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)=@newsa={0x1b4, 0x10, 0x1, 0x0, 0x0, {{@in6=@remote, @in=@remote, 0x0, 0x0, 0xfffe}, {@in=@multicast1, 0x0, 0x32}, @in6=@private1, {0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x1000000000}, {0x0, 0x0, 0x0, 0x80000001}, {0xfffffffc, 0x0, 0x20000000}, 0x0, 0x0, 0x2, 0x0, 0x0, 0xcd}, [@algo_crypt={0x48, 0x2, {{'cbc(aes)\x00'}}}, @replay_esn_val={0x1c, 0x17, {0x0, 0x0, 0x0, 0x0, 0x70bf27}}, @algo_auth_trunc={0x5d, 0x14, {{'cmac(aes)\x00'}, 0x88, 0x0, "ba1d3a4407cee3bc5f0d7597dbee8ada33"}}]}, 0x1b4}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000010) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000100)=0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'erspan0\x00', 0x0}) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="300000001e0021002bbd7000000000000a000000000000000000000014000100"], 0x30}}, 0x0) setresuid(0xee00, 0xee00, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFDSTADDR(r5, 0x8918, &(0x7f0000000080)={@loopback={0x0, 0x3fc}, 0x0, r6}) sendto$packet(r2, &(0x7f00000002c0)="05031600d3fc140000004788031c09103328", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r3, 0x1, 0x0, 0x6, @multicast}, 0x14) 630.908297ms ago: executing program 1 (id=30): unshare(0x64000400) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'gre0\x00', 0x0}) bind$packet(r1, &(0x7f0000000300)={0x11, 0x1b, r2, 0x1, 0x6, 0x6, @local}, 0x14) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c0000001000810000000000008000000000ffff", @ANYRES32=0x0, @ANYBLOB="1f043cbf", @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) 624.329406ms ago: executing program 1 (id=31): ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000000)={0x0, 0x0}) r1 = syz_open_dev$hiddev(&(0x7f0000000080), 0x6, 0x480) r2 = signalfd(0xffffffffffffffff, &(0x7f00000000c0)={[0x5]}, 0x8) kcmp$KCMP_EPOLL_TFD(0xffffffffffffffff, r0, 0x7, r1, &(0x7f0000000100)={0xffffffffffffffff, r2, 0x80}) ioctl$EXT4_IOC_CLEAR_ES_CACHE(r1, 0x6628) (async) ioctl$EXT4_IOC_CLEAR_ES_CACHE(r1, 0x6628) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r2, 0x84009422, &(0x7f0000000140)={0x0, 0x0, {}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) r3 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_CTL(r2, 0x40049421, 0x0) r4 = dup3(0xffffffffffffffff, r1, 0x80000) accept4$unix(r2, &(0x7f0000000580), &(0x7f0000000600)=0x6e, 0x800) (async) r5 = accept4$unix(r2, &(0x7f0000000580), &(0x7f0000000600)=0x6e, 0x800) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ppoll(&(0x7f0000000640)=[{r4, 0x80}, {0xffffffffffffffff, 0x8000}, {r2, 0x8000}, {r5, 0x1522}, {r6}, {r3}, {r3, 0x4104}, {r3, 0x100}], 0x8, &(0x7f0000000680)={0x77359400}, &(0x7f00000006c0)={[0xf826]}, 0x8) (async) ppoll(&(0x7f0000000640)=[{r4, 0x80}, {0xffffffffffffffff, 0x8000}, {r2, 0x8000}, {r5, 0x1522}, {r6}, {r3}, {r3, 0x4104}, {r3, 0x100}], 0x8, &(0x7f0000000680)={0x77359400}, &(0x7f00000006c0)={[0xf826]}, 0x8) ioctl$F2FS_IOC_GET_COMPRESS_OPTION(r6, 0x8002f515, &(0x7f0000000700)) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000780)={'wpan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000780)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r7, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x34, 0x0, 0x100, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x0) ioctl$HIDIOCGREPORT(r1, 0x400c4807, &(0x7f0000000880)={0x1, 0x0, 0xffff}) (async) ioctl$HIDIOCGREPORT(r1, 0x400c4807, &(0x7f0000000880)={0x1, 0x0, 0xffff}) socket$nl_generic(0x10, 0x3, 0x10) (async) r9 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000900), r4) (async) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000900), r4) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000940)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_UPDATE_FT_IES(r9, &(0x7f0000000b40)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000980)={0x154, r10, 0x20, 0x70bd2d, 0xd, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_MDID={0x6, 0xb1, 0x4}, @NL80211_ATTR_IE={0x2d, 0x2a, [@prep={0x83, 0x1f, {{}, 0x25, 0x0, @broadcast, 0x8ba1, @void, 0x8, 0x80000000, @broadcast, 0x6}}, @mesh_chsw={0x76, 0x6, {0x8, 0x1, 0xe, 0x2}}]}, @NL80211_ATTR_MDID={0x6, 0xb1, 0x57}, @NL80211_ATTR_MDID={0x6, 0xb1, 0x2}, @NL80211_ATTR_IE={0xdf, 0x2a, [@perr={0x84, 0xc8, {0x1, 0xc, [{{0x0, 0x1}, @device_a, 0x4f9, @value, 0x15}, {{}, @broadcast, 0x6, @void, 0x38}, {{0x0, 0x1}, @device_a, 0x8, @value=@broadcast, 0x19}, {{}, @device_a, 0x5, @void, 0x19}, {{0x0, 0x1}, @device_a, 0xfffffffc, @value, 0x2e}, {{0x0, 0x1}, @device_b, 0x7, @value=@broadcast, 0x15}, {{0x0, 0x1}, @device_b, 0x80000001, @value=@device_b, 0x29}, {{0x0, 0x1}, @broadcast, 0x7, @value=@broadcast, 0x34}, {{0x0, 0x1}, @broadcast, 0x32}, {{}, @device_b, 0x3d, @void, 0x5}, {{}, @device_b, 0x30000000, @void, 0x32}, {{}, @device_a, 0x2, @void, 0x28}]}}, @cf={0x4, 0x6, {0x5, 0xc4, 0x8}}, @channel_switch={0x25, 0x3, {0x1, 0x7, 0x7}}, @ibss={0x6, 0x2, 0x2}]}, @NL80211_ATTR_MDID={0x6}, @NL80211_ATTR_MDID={0x6, 0xb1, 0x3b37}]}, 0x154}, 0x1, 0x0, 0x0, 0xb752ba42c6572c98}, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000b80)=[@mss={0x2, 0xb6}, @sack_perm], 0x2) r12 = socket(0x13, 0x800, 0x9) r13 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000c00), 0xffffffffffffffff) sendmsg$IEEE802154_LIST_IFACE(r7, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c40)={0x14, r13, 0x29, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x94}, 0xd4) (async) sendmsg$IEEE802154_LIST_IFACE(r7, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c40)={0x14, r13, 0x29, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x94}, 0xd4) ioctl$sock_SIOCSIFBR(r12, 0x8941, &(0x7f0000000d40)=@add_del={0x2, &(0x7f0000000d00)='nr0\x00'}) (async) ioctl$sock_SIOCSIFBR(r12, 0x8941, &(0x7f0000000d40)=@add_del={0x2, &(0x7f0000000d00)='nr0\x00'}) r14 = openat$cgroup_int(r3, &(0x7f0000000d80)='memory.max\x00', 0x2, 0x0) ioctl$FS_IOC_GETFSUUID(r14, 0x80111500, &(0x7f0000000dc0)) flock(r6, 0xc) syz_genetlink_get_family_id$ethtool(&(0x7f0000000e00), r3) 610.243417ms ago: executing program 3 (id=32): openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r0 = syz_usb_connect$uac1(0x0, 0xda, &(0x7f0000000000)=ANY=[@ANYBLOB="1201b0c63e0739086b1d01014000010203010902c800030100007309040000000101"], &(0x7f0000000bc0)={0x0, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x2042, 0x19d) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', r1, &(0x7f00000004c0)='./file1\x00', 0x5) unlinkat(r1, &(0x7f00000011c0)='./file0\x00', 0x0) creat(&(0x7f0000000080)='./file0\x00', 0x6a) syz_usb_control_io(r0, &(0x7f0000000640)={0x2c, &(0x7f0000000500)={0x20, 0xb, 0x7, {0x7, 0x23, "80b22a5e94"}}, &(0x7f00000002c0)={0x0, 0x3, 0x5a, @string={0x5a, 0x3, "6d540dbc2fd94a1b05be9e7d38822c4c642e4112ad5b6201ce793bf3f81500f0f7b1903121808c3a9421f593376aac1686c0120eb874e37cf76a8aaedc1177058906de9d5bee5bcf113307d41b03edb5c797b4d97403d1f9"}}, &(0x7f0000000580)={0x0, 0xf, 0x11, {0x5, 0xf, 0x11, 0x1, [@ssp_cap={0xc, 0x10, 0xa, 0xff, 0x0, 0xce, 0xf00, 0x8}]}}, &(0x7f00000005c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf7, 0xa, 0x9, 0x73, "ee3b7159", "87e26654"}}, 0x0}, &(0x7f0000000b00)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000880)={0x40, 0x9, 0x1, 0x8}, 0x0, &(0x7f0000000900)={0x40, 0xf, 0x2, 0x9}, 0x0, &(0x7f0000000980)={0x40, 0x17, 0x6}, 0x0, &(0x7f0000000a00)={0x40, 0x1a, 0x2, 0x1}, &(0x7f0000000a40)={0x40, 0x1c, 0x1, 0x5}, &(0x7f0000000a80)={0x40, 0x1e, 0x1, 0x4}, 0x0}) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001300)={0x1c, 0x19, 0x1, 0x0, 0x0, {0x1d, 0xd601, 0x9}, [@nested={0x8, 0x9, 0x0, 0x1, [@nested={0x4, 0x75}]}]}, 0x1c}, 0x1, 0x0, 0x0, 0x5}, 0x804) syz_usb_control_io$uac1(r0, &(0x7f00000001c0)={0x14, &(0x7f00000000c0)={0x0, 0x23, 0x2, {0x2, 0x1}}, &(0x7f0000000100)=ANY=[@ANYBLOB="0003360000003603edea18723a1979083544936c61416d1b98c885dca8506009f346394f903a70c2b602002e96138b06ea6d23e330a1d92571253bbe"]}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) futex(&(0x7f000000cffc), 0x9, 0x0, 0x0, 0x0, 0x80) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, &(0x7f0000048000)=0x1, 0x0) futex(&(0x7f000000cffc)=0x2, 0xa, 0x0, 0x0, 0x0, 0x1000000) mount$cgroup(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000100)={[{@subsystem='cpuset'}, {@subsystem='memory'}, {@subsystem='cpuacct'}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x1d0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x8, &(0x7f00000000c0)={[{@verity_require}, {@metacopy_on}], [], 0x2c}) 557.959688ms ago: executing program 1 (id=33): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xc, &(0x7f0000000340), 0x4) ioctl$XFS_IOC_PATH_TO_HANDLE(r0, 0xc0385869, &(0x7f0000000100)={r0, &(0x7f0000000000)='\xb3\x00', 0x2, &(0x7f0000000040)={@align=0xa, {0x3ff, 0x8, 0x5, 0x2}}, 0x1ff, &(0x7f0000000080), &(0x7f00000000c0)=0x7fffffff}) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r1, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000300)={&(0x7f00000001c0)={0x134, r2, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@TIPC_NLA_PUBL={0x54, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x6}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xab6}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7f}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x2}, @TIPC_NLA_PUBL_TYPE={0x8}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x3}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x3}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xfffffffe}]}, @TIPC_NLA_SOCK={0x84, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xfffff7d8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x7f}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x800}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x45a}]}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x10}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}]}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xd5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xf}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x1}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x2}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x80}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x3}]}, @TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x7}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x9c4}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1}]}]}, 0x134}, 0x1, 0x0, 0x0, 0x40005}, 0x20000000) 557.663278ms ago: executing program 1 (id=34): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r0, 0x0, 0x28, &(0x7f00000003c0)="d7696464f9b143dab4a32d119e31e11954bbfe386f211c741e5c74c67a6684986349170127e2dfc2481197ef79e8a2f374ae58b724aa23861201a1353e3fa815c275460b06481db1779ce1198411b893165d27201185ec311e7b3ab3222f1fd7a40d170169e5bfe7c7c7e0547d0f624443f4b0ac", 0x74) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000002c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000, 0x4}, 0x20) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, 0x0, 0x0) r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000240), 0x1a000, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00', 0x0}) bind$xdp(r1, &(0x7f00000000c0)={0x2c, 0x0, r4}, 0x10) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f00000001c0)={0x2, 0x0, @remote}, 0x10) connect$inet(r5, &(0x7f0000000480)={0x2, 0x4e23, @broadcast}, 0x10) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000002040)={{{@in6=@ipv4={""/10, ""/2, @private}, @in=@loopback}}, {{@in6=@initdev}, 0x0, @in6=@private0}}, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) r6 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r6, 0x29, 0x1000000000021, &(0x7f0000000040)=0x5, 0x4) close(r0) socket$nl_route(0x10, 0x3, 0x0) sendmmsg$inet6(r6, &(0x7f0000000480)=[{{&(0x7f0000000000)={0xa, 0x4c20, 0x0, @dev={0xfe, 0x80, '\x00', 0x22}, 0x10}, 0x1c, 0x0}}, {{&(0x7f0000000200)={0xa, 0x4e20, 0x4a, @mcast2, 0x81}, 0x1c, 0x0}}], 0x2, 0x6b38deb179a2b498) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, 0x10, 0x701, 0x0, 0xffffffff, {0xa}}, 0x14}}, 0x20008080) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), r8) faccessat2(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x84, 0x1100) 466.07076ms ago: executing program 2 (id=35): mount$cgroup(0x0, 0x0, 0x0, 0x242129, &(0x7f0000000340)) openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x6a542, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) lsetxattr$security_capability(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0), &(0x7f0000000480)=@v1={0x1000000, [{0x6, 0x4}]}, 0xc, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x1) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000000)) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f0000000100)={&(0x7f000085a000/0x2000)=nil, &(0x7f00003e1000/0x2000)=nil, 0x2000, 0x0, 0x2}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x4, 0x6, 0x0, 0x2000, &(0x7f00004ae000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, &(0x7f0000000380)="260f00d0650f01d1660f1adb0fc76d0bbad004b0e7eebaa100ecbaf80c66b81cc3488366efbafc0cb85600efd9ffba420066ed0f01c8", 0x36}], 0x1, 0x8, 0x0, 0x0) setsockopt$inet_group_source_req(0xffffffffffffffff, 0x0, 0x2c, &(0x7f00000004c0)={0x4, {{0x2, 0x2, @dev={0xac, 0x14, 0x14, 0x22}}}, {{0x2, 0x4e1e, @empty}}}, 0x108) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_XSAVE(r6, 0x5000aea5, 0x0) r7 = syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x80000) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x6, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) r9 = dup3(r3, r8, 0x80000) ioctl$BINDER_WRITE_READ(r9, 0xc03062fe, 0x0) syz_usb_disconnect(0xffffffffffffffff) ioctl$EVIOCRMFF(r7, 0x5509, &(0x7f00000000c0)=0x18) ioctl$EVIOCGBITSND(r7, 0x80404532, &(0x7f00000001c0)=""/163) r10 = socket$unix(0x1, 0x5, 0x0) accept4(r10, 0x0, 0x0, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r6, 0x4008ae93, &(0x7f0000000080)=0xffffffff) ioctl$KVM_CREATE_VM(r9, 0xae01, 0x20000006) 268.522814ms ago: executing program 0 (id=36): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = gettid() signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xfffffffffffffffb]}, 0x8, 0x0) (async) r2 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xfffffffffffffffb]}, 0x8, 0x0) readv(r2, &(0x7f0000000580)=[{&(0x7f0000000240)=""/246, 0xf6}], 0x1) rt_sigqueueinfo(r1, 0x21, &(0x7f0000000180)={0x33, 0x40000020, 0xfffffffb}) (async) rt_sigqueueinfo(r1, 0x21, &(0x7f0000000180)={0x33, 0x40000020, 0xfffffffb}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bond_slave_0\x00'}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="8c000000", @ANYRES16=r3, @ANYBLOB="a183ffffffff030000000500000008000300", @ANYRES64=r3], 0x8c}}, 0x4c044) (async) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="8c000000", @ANYRES16=r3, @ANYBLOB="a183ffffffff030000000500000008000300", @ANYRES64=r3], 0x8c}}, 0x4c044) ioctl$TUNGETFILTER(r2, 0x801054db, &(0x7f0000000340)=""/197) 125.883927ms ago: executing program 0 (id=37): capset(&(0x7f0000000000)={0x20080522}, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x81, 0xfffffdff, 0x5}) getgroups(0x2, &(0x7f0000000140)=[0x0, 0xee00]) r1 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000140)={0x10000, 0x1, 0x10000, 0x2000, &(0x7f0000007000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x2, 0x2, 0x0, 0x4002004c4, 0x1004, 0x8000000000000000, 0xc595, 0x0, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0xb3, 0x8d], 0xeeee8000, 0x2010d3}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$TIOCL_GETKMSGREDIRECT(0xffffffffffffffff, 0x541c, &(0x7f0000000040)) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) setregid(0x0, r0) capset(&(0x7f0000000000)={0x20080522}, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x81, 0xfffffdff, 0x5}) (async) getgroups(0x2, &(0x7f0000000140)=[0x0, 0xee00]) (async) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) (async) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) (async) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000140)={0x10000, 0x1, 0x10000, 0x2000, &(0x7f0000007000/0x2000)=nil}) (async) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x2, 0x2, 0x0, 0x4002004c4, 0x1004, 0x8000000000000000, 0xc595, 0x0, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0xb3, 0x8d], 0xeeee8000, 0x2010d3}) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) ioctl$TIOCL_GETKMSGREDIRECT(0xffffffffffffffff, 0x541c, &(0x7f0000000040)) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) setregid(0x0, r0) (async) 0s ago: executing program 0 (id=38): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) connect$unix(0xffffffffffffffff, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e23}, 0x6e) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000280)={0x1, 0x0, [{0x4b564d06}]}) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file0\x00', 0x50b840, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff002, 0x0, 0x2000000000032, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) fremovexattr(r3, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x42, 0x0) mount$incfs(&(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='./file1\x00', &(0x7f0000000140), 0x90, &(0x7f00000002c0)={[{@rlog_pages={'rlog_pages', 0x3d, 0xffffffffffff89d4}}]}) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000140), 0x0, 0x0) llistxattr(&(0x7f0000000440)='./file0/file0\x00', 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r5, r6, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, &(0x7f0000000440)="d8df0f23b3b9ce000000b807000000ba000000000f301b8154fea900600000c4e28ddc8dcd000000c182fd3f0000c8b950020000b801000000ba00000000b9c50d0000b800c80000b8010000000f01d90f300fc79d53bf0000c4e16dd3010f2202", 0x52}], 0x1, 0x4f, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r6, 0x4008ae90, &(0x7f00000000c0)={0x2, 0x0, [{0x80000008, 0x7, 0x0, 0x500000, 0x8001, 0x9, 0x1}, {0x1, 0x3, 0x6, 0x4, 0xa103, 0x5, 0x4}]}) ioctl$KVM_RUN(r6, 0xae80, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.208' (ED25519) to the list of known hosts. [ 29.156605][ T36] audit: type=1400 audit(1782910109.060:64): avc: denied { mounton } for pid=287 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 29.160143][ T287] cgroup: Unknown subsys name 'net' [ 29.179693][ T36] audit: type=1400 audit(1782910109.060:65): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.206766][ T36] audit: type=1400 audit(1782910109.090:66): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.207432][ T287] cgroup: Unknown subsys name 'devices' [ 29.327082][ T287] cgroup: Unknown subsys name 'hugetlb' [ 29.332772][ T287] cgroup: Unknown subsys name 'rlimit' [ 29.428089][ T36] audit: type=1400 audit(1782910109.330:67): avc: denied { setattr } for pid=287 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 29.451445][ T36] audit: type=1400 audit(1782910109.330:68): avc: denied { mounton } for pid=287 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 29.476223][ T36] audit: type=1400 audit(1782910109.330:69): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 29.533512][ T289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 29.542469][ T36] audit: type=1400 audit(1782910109.450:70): avc: denied { relabelto } for pid=289 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 29.568014][ T36] audit: type=1400 audit(1782910109.450:71): avc: denied { write } for pid=289 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.602658][ T36] audit: type=1400 audit(1782910109.500:72): avc: denied { read } for pid=287 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.628497][ T36] audit: type=1400 audit(1782910109.500:73): avc: denied { open } for pid=287 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.629176][ T287] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 30.405656][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.412815][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.431281][ T294] bridge_slave_0: entered allmulticast mode [ 30.438531][ T294] bridge_slave_0: entered promiscuous mode [ 30.445312][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.452391][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.459540][ T294] bridge_slave_1: entered allmulticast mode [ 30.466270][ T294] bridge_slave_1: entered promiscuous mode [ 30.609785][ T300] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.617160][ T300] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.624283][ T300] bridge_slave_0: entered allmulticast mode [ 30.630802][ T300] bridge_slave_0: entered promiscuous mode [ 30.639157][ T300] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.646311][ T300] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.653408][ T300] bridge_slave_1: entered allmulticast mode [ 30.659758][ T300] bridge_slave_1: entered promiscuous mode [ 30.681793][ T298] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.688917][ T298] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.696047][ T298] bridge_slave_0: entered allmulticast mode [ 30.702316][ T298] bridge_slave_0: entered promiscuous mode [ 30.711738][ T298] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.718881][ T298] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.726006][ T298] bridge_slave_1: entered allmulticast mode [ 30.732425][ T298] bridge_slave_1: entered promiscuous mode [ 30.781347][ T299] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.788486][ T299] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.795689][ T299] bridge_slave_0: entered allmulticast mode [ 30.801958][ T299] bridge_slave_0: entered promiscuous mode [ 30.811725][ T299] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.818920][ T299] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.826124][ T299] bridge_slave_1: entered allmulticast mode [ 30.832804][ T299] bridge_slave_1: entered promiscuous mode [ 30.839369][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.846725][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.854186][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.861293][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.969532][ T300] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.976646][ T300] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.983971][ T300] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.991052][ T300] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.003582][ T298] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.010687][ T298] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.018001][ T298] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.025066][ T298] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.046442][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.053785][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.061352][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.069333][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.121361][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.128453][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.136795][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.144051][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.167483][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.174583][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.182746][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.189858][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.204035][ T294] veth0_vlan: entered promiscuous mode [ 31.221909][ T294] veth1_macvtap: entered promiscuous mode [ 31.250215][ T300] veth0_vlan: entered promiscuous mode [ 31.279052][ T300] veth1_macvtap: entered promiscuous mode [ 31.301342][ T298] veth0_vlan: entered promiscuous mode [ 31.308894][ T294] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 31.338692][ T14] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.345825][ T14] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.365685][ T298] veth1_macvtap: entered promiscuous mode [ 31.386543][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.393637][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.449765][ T299] veth0_vlan: entered promiscuous mode [ 31.464588][ T299] veth1_macvtap: entered promiscuous mode [ 31.500708][ T323] overlayfs: failed to resolve './file0': -2 [ 31.509311][ T323] process 'syz.0.1' launched './file0' with NULL argv: empty string added [ 31.519392][ T323] Invalid argument reading file caps for ./file0 [ 31.684600][ T31] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 31.692440][ T310] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 31.784503][ T62] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 31.804524][ T9] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 31.846092][ T31] usb 3-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 31.857839][ T310] usb 2-1: config 0 interface 0 altsetting 6 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 31.868993][ T31] usb 3-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 31.880075][ T310] usb 2-1: config 0 interface 0 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 7 [ 31.892964][ T31] usb 3-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 31.904621][ T310] usb 2-1: config 0 interface 0 has no altsetting 0 [ 31.911271][ T310] usb 2-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.00 [ 31.920393][ T31] usb 3-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 31.929737][ T310] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.937820][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.945793][ T62] usb 4-1: Using ep0 maxpacket: 8 [ 31.947402][ T62] usb 4-1: config 3 has an invalid interface number: 45 but max is 0 [ 31.959205][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 31.963880][ T310] usb 2-1: config 0 descriptor?? [ 31.970419][ T315] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 31.979960][ T62] usb 4-1: config 3 contains an unexpected descriptor of type 0x1, skipping [ 31.989396][ T62] usb 4-1: config 3 has no interface number 0 [ 31.995896][ T62] usb 4-1: config 3 interface 45 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 32.008984][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 32.016936][ T62] usb 4-1: config 3 interface 45 has no altsetting 0 [ 32.024136][ T9] usb 1-1: config 5 has an invalid interface number: 34 but max is 0 [ 32.032344][ T9] usb 1-1: config 5 has no interface number 0 [ 32.039054][ T9] usb 1-1: config 5 interface 34 has no altsetting 0 [ 32.046023][ T62] usb 4-1: New USB device found, idVendor=0582, idProduct=e6ca, bcdDevice=d3.0b [ 32.055633][ T62] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.063683][ T62] usb 4-1: Product: syz [ 32.068309][ T62] usb 4-1: Manufacturer: syz [ 32.073051][ T62] usb 4-1: SerialNumber: syz [ 32.078272][ T9] usb 1-1: New USB device found, idVendor=04dd, idProduct=8006, bcdDevice=65.57 [ 32.087781][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.096171][ T9] usb 1-1: Product: syz [ 32.100424][ T9] usb 1-1: Manufacturer: syz [ 32.105678][ T9] usb 1-1: SerialNumber: syz [ 32.307001][ T324] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 32.330965][ T9] usb 1-1: bad CDC descriptors [ 32.338190][ T9] usb 1-1: USB disconnect, device number 2 [ 32.384188][ T310] hid-multitouch 0003:1FD2:6007.0001: invalid report_size -1559234810 [ 32.392756][ T310] hid-multitouch 0003:1FD2:6007.0001: item 0 4 1 7 parsing failed [ 32.400943][ T310] hid-multitouch 0003:1FD2:6007.0001: probe with driver hid-multitouch failed with error -22 [ 32.629392][ T316] bridge0: port 3(erspan0) entered blocking state [ 32.636059][ T316] bridge0: port 3(erspan0) entered disabled state [ 32.642624][ T316] erspan0: entered allmulticast mode [ 32.648596][ T316] erspan0: entered promiscuous mode [ 32.653975][ T316] bridge0: port 3(erspan0) entered blocking state [ 32.660550][ T316] bridge0: port 3(erspan0) entered forwarding state [ 32.670193][ T316] erspan0: left allmulticast mode [ 32.675343][ T316] erspan0: left promiscuous mode [ 32.680466][ T316] bridge0: port 3(erspan0) entered disabled state [ 33.213252][ T334] input: syz0 as /devices/virtual/input/input5 [ 33.336602][ T342] netlink: 20 bytes leftover after parsing attributes in process `syz.0.9'. [ 33.373990][ T344] netlink: 'syz.0.10': attribute type 16 has an invalid length. [ 33.382016][ T344] netlink: 64138 bytes leftover after parsing attributes in process `syz.0.10'. [ 33.961912][ T353] capability: warning: `syz.0.13' uses deprecated v2 capabilities in a way that may be insecure [ 34.324508][ T9] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 34.421826][ T319] usb 2-1: USB disconnect, device number 2 [ 34.439269][ T36] kauditd_printk_skb: 56 callbacks suppressed [ 34.439289][ T36] audit: type=1400 audit(1782910114.340:130): avc: denied { create } for pid=362 comm="syz.1.16" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 34.474503][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 34.487861][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 34.494874][ T36] audit: type=1400 audit(1782910114.340:131): avc: denied { write } for pid=362 comm="syz.1.16" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 34.508347][ T9] usb 1-1: config 1 descriptor has 1 excess byte, ignoring [ 34.516737][ T36] audit: type=1400 audit(1782910114.340:132): avc: denied { ioctl } for pid=362 comm="syz.1.16" path="user:[4026531837]" dev="nsfs" ino=4026531837 ioctlcmd=0xf50c scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 34.540988][ T9] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 34.574487][ T9] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 34.602998][ T62] usb 4-1: USB disconnect, device number 2 [ 34.616642][ T9] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 34.636359][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.641734][ T36] audit: type=1400 audit(1782910114.540:133): avc: denied { create } for pid=364 comm="syz.3.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 34.651901][ T9] usb 1-1: Product: syz [ 34.667806][ T36] audit: type=1400 audit(1782910114.570:134): avc: denied { bind } for pid=364 comm="syz.3.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 34.684697][ T9] usb 1-1: Manufacturer: syz [ 34.689814][ T36] audit: type=1400 audit(1782910114.570:135): avc: denied { setopt } for pid=364 comm="syz.3.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 34.695113][ T325] udevd[325]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:3.45/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 34.711432][ T36] audit: type=1400 audit(1782910114.570:136): avc: denied { write } for pid=364 comm="syz.3.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 34.730753][ T9] usb 1-1: SerialNumber: syz [ 34.751021][ T36] audit: type=1400 audit(1782910114.570:137): avc: denied { read } for pid=364 comm="syz.3.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 34.772168][ T36] audit: type=1400 audit(1782910114.670:138): avc: denied { ioctl } for pid=362 comm="syz.1.16" path="socket:[3569]" dev="sockfs" ino=3569 ioctlcmd=0x8946 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 34.800343][ T36] audit: type=1400 audit(1782910114.670:139): avc: denied { write } for pid=362 comm="syz.1.16" name="event2" dev="devtmpfs" ino=208 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 34.974592][ T9] cdc_ncm 1-1:1.0: skipping garbage [ 34.979961][ T9] cdc_ncm 1-1:1.0: CDC Union missing and no IAD found [ 34.986837][ T9] cdc_ncm 1-1:1.0: bind() failure [ 34.993324][ T9] usb 1-1: USB disconnect, device number 3 [ 35.015235][ T31] aiptek 3-1:17.0: Aiptek using 400 ms programming speed [ 35.023929][ T31] input: Aiptek as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:17.0/input/input4 [ 35.036264][ T31] usb 3-1: USB disconnect, device number 2 [ 35.036340][ C0] aiptek 3-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 35.332984][ T374] netlink: 'syz.2.20': attribute type 27 has an invalid length. [ 35.342559][ T374] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 35.371902][ T376] netlink: 80 bytes leftover after parsing attributes in process `syz.2.21'. [ 35.684737][ T62] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 35.734523][ T319] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 35.744513][ T9] usb 1-1: new low-speed USB device number 4 using dummy_hcd [ 35.764517][ T361] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 35.846192][ T62] usb 2-1: unable to get BOS descriptor or descriptor too short [ 35.854941][ T62] usb 2-1: not running at top speed; connect to a high speed hub [ 35.863673][ T62] usb 2-1: config 4 has an invalid interface number: 147 but max is 0 [ 35.871967][ T62] usb 2-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 35.882242][ T62] usb 2-1: config 4 has no interface number 0 [ 35.889947][ T62] usb 2-1: Dual-Role OTG device on HNP port [ 35.896138][ T319] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 35.896277][ T62] usb 2-1: New USB device found, idVendor=04f2, idProduct=b746, bcdDevice=8e.6e [ 35.908902][ T319] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 35.916543][ T62] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=38 [ 35.927095][ T319] usb 4-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 35.934938][ T62] usb 2-1: Product: syz [ 35.944322][ T319] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 35.947880][ T62] usb 2-1: Manufacturer: syz [ 35.960176][ T319] usb 4-1: config 0 descriptor?? [ 35.965235][ T9] usb 1-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 35.976372][ T9] usb 1-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid maxpacket 32, setting to 8 [ 35.987142][ T62] usb 2-1: SerialNumber: syz [ 35.992422][ T9] usb 1-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 36.005373][ T361] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 36.013420][ T361] usb 3-1: config 0 has no interface number 0 [ 36.019978][ T361] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 36.030976][ T361] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 36.040940][ T9] usb 1-1: config 0 interface 0 has no altsetting 0 [ 36.047656][ T9] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2d50, bcdDevice= 0.00 [ 36.057083][ T361] usb 3-1: config 0 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 36.070162][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.078300][ T361] usb 3-1: New USB device found, idVendor=28bd, idProduct=0042, bcdDevice= 0.00 [ 36.088042][ T361] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.096429][ T9] usb 1-1: config 0 descriptor?? [ 36.101729][ T387] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 36.109509][ T361] usb 3-1: config 0 descriptor?? [ 36.246038][ T62] uvcvideo 2-1:4.147: Found Unit with invalid ID 0 [ 36.252740][ T62] usb 2-1: Found UVC 0.02 device syz (04f2:b746) [ 36.259303][ T62] usb 2-1: Failed to create links for entity 65535 [ 36.265897][ T62] usb 2-1: Failed to register entities (-22). [ 36.274062][ T62] usb 2-1: USB disconnect, device number 3 [ 36.370059][ T319] usbhid 4-1:0.0: can't add hid device: -71 [ 36.376459][ T319] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 36.385593][ T319] usb 4-1: USB disconnect, device number 3 [ 36.521957][ T361] input: HID 28bd:0042 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.1/0003:28BD:0042.0002/input/input6 [ 36.536372][ T361] uclogic 0003:28BD:0042.0002: input,hidraw0: USB HID v0.00 Keypad [HID 28bd:0042] on usb-dummy_hcd.2-1/input1 [ 36.552787][ T361] usb 3-1: USB disconnect, device number 3 [ 36.586194][ T392] fido_id[392]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/3-1/report_descriptor': No such file or directory [ 36.717856][ T9] usbhid 1-1:0.0: can't add hid device: -71 [ 36.723866][ T9] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 36.732658][ T9] usb 1-1: USB disconnect, device number 4 [ 36.762471][ T394] Zero length message leads to an empty skb [ 36.839372][ T403] netlink: 'syz.1.30': attribute type 27 has an invalid length. [ 36.849003][ T403] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 36.986479][ T414] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 37.144492][ T361] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 37.286445][ T421] netlink: 112 bytes leftover after parsing attributes in process `syz.0.36'. [ 37.295545][ T420] netlink: 112 bytes leftover after parsing attributes in process `syz.0.36'. [ 37.304518][ T361] usb 4-1: Using ep0 maxpacket: 8 [ 37.317190][ T361] usb 4-1: unable to get BOS descriptor or descriptor too short [ 37.328864][ T361] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 37.339657][ T361] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 37.350396][ T361] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 37.361136][ T361] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.374599][ T361] usb 4-1: Product: syz [ 37.378832][ T361] usb 4-1: Manufacturer: syz [ 37.383714][ T361] usb 4-1: SerialNumber: syz [ 37.519910][ T430] ------------[ cut here ]------------ [ 37.525548][ T430] WARNING: CPU: 0 PID: 430 at mm/page_alloc.c:5285 __alloc_pages_noprof+0x109/0x7e0 [ 37.535113][ T430] Modules linked in: [ 37.539278][ T430] CPU: 0 UID: 0 PID: 430 Comm: syz.0.38 Not tainted syzkaller #0 3aaf08658a080e6b88ffed1aa00ccc3c40537342 [ 37.550651][ T430] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 37.560797][ T430] RIP: 0010:__alloc_pages_noprof+0x109/0x7e0 [ 37.566871][ T430] Code: 00 0f 1f 44 00 00 83 fb 0b 72 28 b8 00 20 00 00 23 44 24 40 75 1d 80 3d 62 dc 0b 06 00 0f 85 c2 00 00 00 c6 05 55 dc 0b 06 01 <0f> 0b 31 c0 e9 b4 00 00 00 83 fb 0a 0f 87 a9 00 00 00 44 8b 64 24 [ 37.586743][ T430] RSP: 0018:ffffc9000dd3f880 EFLAGS: 00010246 [ 37.592975][ T430] RAX: 0000000000000000 RBX: 0000000000000020 RCX: 0000000000000000 [ 37.601046][ T430] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000dd3f938 [ 37.609165][ T430] RBP: ffffc9000dd3f9a8 R08: ffffc9000dd3f937 R09: 0000000000000000 [ 37.617275][ T430] R10: ffffc9000dd3f920 R11: fffff52001ba7f27 R12: ffffc9000dd3f8c0 [ 37.625330][ T430] R13: dffffc0000000000 R14: 1ffff92001ba7f14 R15: 0000000000000000 [ 37.633335][ T430] FS: 00007ff604bf76c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 37.642399][ T430] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.649123][ T430] CR2: 0000200000001000 CR3: 0000000117722000 CR4: 00000000003526b0 [ 37.657182][ T430] Call Trace: [ 37.660494][ T430] [ 37.663448][ T430] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 37.669597][ T430] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 37.675399][ T430] ? incfs_realloc_mount_info+0xa7/0x4c0 [ 37.681057][ T430] ___kmalloc_large_node+0x81/0x220 [ 37.686339][ T430] ? incfs_realloc_mount_info+0xa7/0x4c0 [ 37.692026][ T430] __kmalloc_large_node_noprof+0x1e/0xd0 [ 37.697756][ T430] ? incfs_realloc_mount_info+0xa7/0x4c0 [ 37.703452][ T430] __kmalloc_noprof+0x326/0x510 [ 37.708422][ T430] ? __cfi_lockref_get+0x10/0x10 [ 37.713464][ T430] incfs_realloc_mount_info+0xa7/0x4c0 [ 37.719000][ T430] ? incfs_add_sysfs_node+0x118/0x230 [ 37.724480][ T430] ? __kasan_check_write+0x18/0x20 [ 37.729647][ T430] incfs_alloc_mount_info+0x478/0x5f0 [ 37.735121][ T430] incfs_mount_fs+0x3ca/0x970 [ 37.739872][ T430] ? __cfi_incfs_mount_fs+0x10/0x10 [ 37.745195][ T430] ? asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 37.751399][ T430] ? __cfi_incfs_mount_fs+0x10/0x10 [ 37.756687][ T430] legacy_get_tree+0x103/0x1b0 [ 37.761499][ T430] ? __cfi_incfs_mount_fs+0x10/0x10 [ 37.766852][ T430] vfs_get_tree+0x9e/0x290 [ 37.771321][ T430] do_new_mount+0x251/0xb40 [ 37.775924][ T430] ? security_capable+0x44/0x130 [ 37.780918][ T430] path_mount+0x66a/0xff0 [ 37.785360][ T430] ? putname+0x113/0x150 [ 37.789654][ T430] __se_sys_mount+0x2bf/0x480 [ 37.794377][ T430] ? __x64_sys_mount+0xf0/0xf0 [ 37.799235][ T430] ? __kasan_check_write+0x18/0x20 [ 37.804390][ T430] ? fpregs_restore_userregs+0x11c/0x260 [ 37.810399][ T430] __x64_sys_mount+0xc3/0xf0 [ 37.815134][ T430] x64_sys_call+0x2021/0x2ee0 [ 37.819868][ T430] do_syscall_64+0x57/0xf0 [ 37.824339][ T430] ? clear_bhb_loop+0x50/0xa0 [ 37.829142][ T430] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 37.835129][ T430] RIP: 0033:0x7ff603d9de59 [ 37.839604][ T430] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 37.859330][ T430] RSP: 002b:00007ff604bf7028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 37.867807][ T430] RAX: ffffffffffffffda RBX: 00007ff604025fa0 RCX: 00007ff603d9de59 [ 37.875837][ T430] RDX: 0000200000000140 RSI: 0000200000000100 RDI: 0000200000000000 [ 37.883842][ T430] RBP: 00007ff603e33e6f R08: 00002000000002c0 R09: 0000000000000000 [ 37.891987][ T430] R10: 0000000000000090 R11: 0000000000000246 R12: 0000000000000000 [ 37.900206][ T430] R13: 00007ff604026038 R14: 00007ff604025fa0 R15: 00007ffd83b91198 [ 37.908260][ T430] [ 37.911326][ T430] ---[ end trace 0000000000000000 ]--- [ 37.916925][ T430] incfs: Error allocating mount info. -12 [ 37.923190][ T361] usb 4-1: cannot find UAC_HEADER [ 37.929486][ T430] incfs: mount failed -12 [ 37.930972][ T361] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 37.957507][ T325] udevd[325]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 38.227504][ T435] overlayfs: missing 'lowerdir' [ 39.905073][ T31] usb 4-1: USB disconnect, device number 4