last executing test programs: 3.587293492s ago: executing program 1 (id=10): capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000080)={0x0, 0x1, 0x0, 0x0, 0x3a2c, 0x4}) ptrace$getenv(0x4201, 0xffffffffffffffff, 0x10000, &(0x7f0000000100)) r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) readv(r0, &(0x7f00000003c0)=[{&(0x7f0000000040)=""/72, 0x48}, {0x0}], 0x2) r1 = gettid() tkill(r1, 0x14) capset(&(0x7f0000000000)={0x20071026, r1}, &(0x7f00000000c0)={0x9, 0x6, 0x5, 0x6, 0xd, 0x4}) 3.549390275s ago: executing program 1 (id=11): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x4}) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) getsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x2, &(0x7f0000000180)=""/60, &(0x7f00000001c0)=0x3c) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000040)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000100)={@flat=@binder={0x73622a85, 0x10a, 0x3}, @flat=@binder={0x73622a85, 0x1, 0x3}, @flat=@handle={0x73682a85, 0xa, 0x2}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 3.49750135s ago: executing program 1 (id=12): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFCONF(r1, 0x8912, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000004340)='/proc/keys\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d031, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs$pagemap(0x0, &(0x7f0000000000)) ioctl$PAGEMAP_SCAN(r2, 0xc0606610, &(0x7f0000000200)={0x60, 0x0, &(0x7f0000245000/0x2000)=nil, &(0x7f00004c7000/0x1000)=nil, 0x0, &(0x7f0000000180)=[{}], 0x1, 0x1bb, 0x0, 0x0, 0x0, 0x55}) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB='fdH', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) lgetxattr(&(0x7f0000000200)='./file0\x00', &(0x7f0000000140)=@known='trusted.overlay.opaque\x00', 0x0, 0x0) syz_fuse_handle_req(r3, &(0x7f00000021c0), 0x2000, &(0x7f00000041c0)={&(0x7f0000004280)={0x50, 0x0, 0x0, {0x7, 0x2b, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x80, 0xfffffffc}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) read$FUSE(r3, &(0x7f0000006400)={0x2020}, 0x2020) write$FUSE_DIRENTPLUS(r3, &(0x7f00000001c0)=ANY=[@ANYBLOB="10000000daffffff", @ANYRES64=r3], 0x10) lsetxattr$trusted_overlay_opaque(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080), 0x0, 0x0, 0x1) mount$binderfs(0x0, &(0x7f0000000100)='./binderfs\x00', &(0x7f0000000140), 0x4800, &(0x7f0000000180)=ANY=[@ANYBLOB='defcontext']) 3.49609986s ago: executing program 1 (id=14): setrlimit(0x7, &(0x7f0000000000)={0x9, 0x40000000006}) r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r0, 0x800448d3, &(0x7f0000000100)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x0, 0x0, 0x81, 0x0, 0x7, "efe85f29f70f8d08af9c13473173db993697c8208719ce918f71c246a59e27b294e05b64c41bdeee9d96f24c7283181aa45a223058935a159dbd009d085d63737038682cbac965019766ba481061cd2f12a2ba5127231d99d0f6be5406eb6cdbb0c793e01e64912878c33269109bf933032731d53fe862196977b4b6b193ab6b"}) r1 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000240)=ANY=[@ANYRESHEX=r0], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000340)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\a\a'], 0x0, 0x0, 0x0, 0x0}, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x1002, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x141800, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={0x14, r5, 0x1, 0x0, 0x0, {0x3}}, 0x14}}, 0x0) r6 = socket$inet(0x2, 0x1, 0x0) bind$inet(r6, &(0x7f0000deb000)={0x2, 0x4e23, @local}, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r6, 0x1, 0x2f, &(0x7f0000000100), 0x4) ioctl$KVM_GET_API_VERSION(r3, 0xae00, 0x0) connect$inet(r6, &(0x7f0000000340)={0x2, 0x4e23, @local}, 0x10) r7 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) mount$tmpfs(0x0, &(0x7f0000000080)='./cgroup\x00', &(0x7f00000000c0), 0x10, &(0x7f0000000480)=ANY=[@ANYBLOB='mode=0000']) ioctl$KVM_CAP_SPLIT_IRQCHIP(r7, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0x5}) r8 = eventfd2(0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r10, 0x1, 0x1a, &(0x7f0000001600)={0x3, &(0x7f0000000040)=[{0x50, 0x0, 0xfa, 0x5}, {0x28, 0x0, 0x0, 0x7fff}, {0x6, 0xfc}]}, 0x10) write$binfmt_aout(r9, &(0x7f0000000000)=ANY=[], 0xfdef) ioctl$KVM_IRQFD(r7, 0x4020ae76, &(0x7f0000000000)={r8}) fsopen(&(0x7f0000000080)='msdos\x00', 0x1) close_range(r2, 0xffffffffffffffff, 0x0) 1.988547471s ago: executing program 0 (id=39): r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000b40)={0x57, 0x0, 0x8, {0x80c, 0x1}, {0x45, 0x400}, @rumble={0xdd, 0x5}}) write$char_usb(r0, &(0x7f0000000040)="e2", 0x2250) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) r2 = accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x80000) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000080)={@fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x0, 0x2e}, @flat=@binder={0x73622a85, 0xb, 0x3}}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}, 0x1000}], 0x0, 0x0, 0x0}) 1.87042785s ago: executing program 0 (id=41): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='net\x00') exit(0xfe) getdents64(r0, 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mountinfo\x00') mkdir(&(0x7f0000000040)='./file0\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x1000000, &(0x7f0000000140)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@default_permissions}]}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_TSC_KHZ_vm(r3, 0xaea2, 0x0) read$FUSE(r1, &(0x7f00000005c0)={0x2020}, 0x2020) 1.738995971s ago: executing program 2 (id=42): openat$random(0xffffffffffffff9c, &(0x7f0000000940), 0x800, 0x0) syz_open_dev$usbfs(0x0, 0x206, 0x8401) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_int(r1, 0x0, 0x6, 0x0, &(0x7f0000000240)) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') r3 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000005c0), 0x2, 0x0) r4 = openat$selinux_policy(0xffffff9c, &(0x7f0000000300), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r4, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="18000000", @ANYRES16, @ANYBLOB="09030000000000fdff072000adce040002"], 0x18}, 0x1, 0xf000000}, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='memory.swap.current\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r5, 0x0) preadv(r5, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r6, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000013c0)=ANY=[@ANYBLOB='(\x00\x00\x00C\x00'], 0x28}], 0x1}, 0x0) r7 = userfaultfd(0x0) ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f00000000c0)) write$selinux_load(r3, &(0x7f0000000000)=ANY=[], 0xffaf) openat$cgroup_ro(r2, &(0x7f0000000080)='blkio.bfq.io_serviced\x00', 0x0, 0x0) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_MEDIA_GET(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)={0x18, r8, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x24040084}, 0x84) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), 0xffffffffffffffff) mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r0]) 1.009836679s ago: executing program 0 (id=43): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x1}) ioctl$TUNSETLINK(r1, 0x400454cd, 0x339) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000100)={'pim6reg1\x00', @broadcast}) close_range(r0, 0xffffffffffffffff, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r3, 0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x440}) 907.862967ms ago: executing program 0 (id=44): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r2) r3 = memfd_create(&(0x7f00000000c0)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\x01\x00\x00\x00;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xff\xfe\xff\xff\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x9a\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00\x81Ks\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x14\xb1`\x87#X\\W`;\'_4\xc5\xc9\x921<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\x02\x00\x00\x00\x8aeh;F[\xe2\x1c\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\x948P\xe4\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\x9a{C|S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ', 0x9) ioctl$FS_IOC_RESVSP(r3, 0x40305828, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8010002}) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x2000003, 0x97052, r3, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x486602, 0x80) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000600)) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'netdevsim0\x00', @link_local}) close_range(r0, 0xffffffffffffffff, 0x0) ioctl$KVM_CAP_STEAL_TIME(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000100)) 826.302754ms ago: executing program 2 (id=46): r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$KVM_GET_MP_STATE(r0, 0x8004ae98, &(0x7f0000000000)) (async, rerun: 32) r1 = syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) (rerun: 32) ioctl$BTRFS_IOC_SYNC(r1, 0x9408, 0x0) getsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000040)=0x8, &(0x7f0000000080)=0x2) (async) faccessat2(r0, &(0x7f00000000c0)='./file0\x00', 0x40, 0x280) (async) openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000100), 0x2, 0x0) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r0, 0x40089413, &(0x7f0000000140)=0x3) (async, rerun: 32) getsockopt$packet_int(r0, 0x107, 0x9, &(0x7f0000000180), &(0x7f00000001c0)=0x4) (async, rerun: 32) io_setup(0x90000, &(0x7f0000000200)=0x0) io_submit(r2, 0x1, &(0x7f0000000340)=[&(0x7f0000000300)={0x0, 0x0, 0x0, 0x8, 0x5, r1, &(0x7f0000000240)="65eb7c655286752a33eaa280f96311091b3dd25537b1b9f6cd31aa40910ca60bea2a7b04c0901093dd759e3281f16a7f515e2a49502abc23c61ee37653200706f6ca74a65a02332427507ab680014fd046f5e91ffbe87dcb0caf60f5b0ceedd4d213d27c98b5755fef972cbeb2ddf05214642a3ebfca1d5966fb6143263be0cce95be9a39278fa87ee2e323709562c5ef0ee4e4ad6ae9af77f175ce1db18ee3528a74d2a05434d600da05f60450f805eb94809a42e833e06fd", 0xb9, 0x1ff, 0x0, 0x2, r0}]) r3 = syz_clone(0x40000100, &(0x7f0000000380)="00fdfceeebd58aa0b1b4272215d61f8977778ef10d6524979a4bce4dd364a3e3b2d13a8227fd917c9628fa28bf4ca4c1b9c34863c2b03f9558b45e26f4ddad194b30b1420afa13500ed8ef9fd97609e560c555a217b45d0abd6296124ffc3aec79a60bf92066fba1ec95f68633c7745d8e9d656a795a7530746453c48a877a1554a8aac22a7a0c966b0f9ee0c731e42aac5b94cc76f6a4353f5913dd55f4b238c530c282bc280f16375c36de351db7f43937b16cacea6f9d82a41e87af88eb284ceeddd210582cf14d2a6d4e4a8194533454eb5a291e76ce2281fedaf339bac3dd9255f90860b7b3ffc150d82623087cfa5b755281e4fed4ec9cd54c08efdaffde7e6a3a7f4a038f95b20def15db93ba09b46f15bbe07dd54c7edb128bab3d187824a594f7712e0f7ac641f1f9f41dcbc57e6c8bc5c4fea0d5bc00029b669393be5b47cea42f189d212704e8b63b5d1866d0273ede82ea14ffd10da73431f30dd37956e8b1168878c9e0048780f2edeb7f0f4e7809a837b7ba05ade285360820d20695b52e32c061add9b7da39b4ba65b8d5a20dd334964968c1474f9abdff15d4eceda17282e1cfb14319a4eee9d227d7f8b2b3ed3b7a6d4180ad619b58e4d6d8b08ad273b3e13a1129fe20bbd3af3ca3026ede21e19f21da6c2555cc158d44b32905ba47fdf089a09e19b350532851f09b4432e95a751cdd3e801bf67f8903de3d82b1324dce5abe902e4d4790de08321587c167de3af2dedf89bc8a0c5bab17ea8f8803f109242376831f5fecb8dd78d96ab514562b77191ff4c42f00f1284333b30e81987513f01f623b6efc61620c87985896c55eed71e316d63adab65d1562be131368229bc826f3227d53ba6b85626b644dd6ad22c3982ed8eb24d59fbdba9176769b24cee0b52d6c2f2af8c2e31a6a57656dc718150b00acb8e6cd06956a18ac07e784a422586021c6a4a360db2a8f0455cf8d9e31475669a029d54ccee3f1d219e8dd66033807e0280fb673743d1a042ce8e3559f65ed88a836e904e54dc599592d770a30794cec87b03f3aa048f57bb1ec3330e3b37c6ea8028cee81b21e015bf871ac78141cb639ad74c33b8faa2e9ca2ea50fedc18ded633b92bf70fe7981a93cf871c4b2ed33d1f5f8fff0345b8a77abf2ba62151775819b09570cdd27216cc092a386af71ae7377ceb84b98534f37f6c61afc56c6b2b49fc3fe076c117a29a55f3a07fd22cb1cd95bf11857779f3903d6f19a3387fcdba6c33902af663d67be628e8048927cc08ef9b1d2945573b753cf98ae0b8c9d3c2bdb61e2be90e877d0be83f19f4b7e815fe34d6bda8f62ff1fb837530ff9552b9b177d93212411add48577e35cfd75c8e14555b1d5cfb7a519f976cb11a8c16312f887909f34836ec4a912e563f273d639ba2da875a99cdef77e0cb78c8e7aa86c614278ee968fe92bbe474fc586b577b2963e633660b3dd566b22d2675b70f1e844c74c6621de17dddfc79fcfdd4b286705c2e66ee0979b9b5aaf342a1fbe8cb6413b804bd8cb598035fcabfd5a2ca816ba031b400bbcd8be8e669b985ed9a713b5a29066bb881c1d92af2de13b3fb0a512e55683828f5dd8c34d3293c5c380d78adaaa00e7b6afcb561e69dc2986b8698e40cfadf0bb901f2ff47ddc9b927be3133ced138c7efb0882c18ed1c26c63424c93db6847fd4e56b7ccc56f02e919f72149795d0bb5f528cc3aa69537de90c2536d945966017c8000cefad0dbafb322dd10fed93d2979f207f4d991d4ab60ff413a3e46158b6fe045f9d2e03f70d0b6a310cf2346280529499382c998e8b4de7a13fb6923e388b30ed2ccb66f8942dc7f847d7067ff41a3c69eb34069dc6c591f88a8eca8e06c5d27c616785a60a9c8b55a9f3004737f0c3e623402f28ab2805045bad806e78e8c8e713472e7da4566fec5250b65bb43f3861fa866fbe9b0e3577ead335075a6c12d8070abce9e7b436493e3d0052bcc564a97f02fc797c989c78b0f058b5f529285c8237141bb21c1c08b2df6df6d7c22c2b693ff8b1f0a4aab5ec53052c465c1238f184584870c2740540ffce271929d90cfc9e82a2fc275f839a0f0ec44c9cc1a667e2e920385540b561cfa86ddbfdf0e81178d5dac3ebcd4bfb5544ce48d399aa600563f00c74c5123e8cf3e8d6c1e7447991e5eb0c0c4041eeb5e963547cd50aca38c2eb483cc4c1d351f7ad1c80e2af23fba2c286a8822215a3d381d193b2a81b05c11dcef64e0a027dd7017b505700d3a18ec30aa63f65dd048dce37aed08f5eec27d9af723c2d9245167e0134cd3de36bb286f8ceba5520b85cf3311af26687703d7edc1f5ba93d4cf1178438688bd405de6e70581164b02c467a0b717058eb20fde545e0ab547d6d7c0e4df989f21b58dade9c1dbc4ebdb29b3b82c0a995e4ee2c92232cfed4bc570b87ee2087041604385453c2f1c96d7827c404a65dac3538fbbaaf74d40a24a98a79c102fea7442a7b54a7d13a4daf41db616ecefc37c6db31fd99f41e9c1c331c347fd000b2977c2c2925313d03c9c30cc7cd413db39a69c0778a7e21d7d6bf7048b6e1407f741db5abf86e739e066ab20f761c8dd15d30b69df4b47a9210a8766a21f113ff42384f782dc309f1ef63d68dff80b0f42fd6989cce74d74b5811660e20cc4809bcf77bb32796137ce325844e0a3222f908496447b3c0c6012d2638500d6e84dd9a8e0d04446e18e63807dbf7dc56b4caf35aace90bfbadba58b0737d6acf5793991a49a90e4be50702fedcf5f716e09c3a4ad57e350b0a0f9f740e4f7abb21a41b53adc8a158a3e9a7f25f66f300f88f0ed3ee2009890b2f066dcbe3896950ddaf32b277534bed84fa7d5e80a3e95e80df58462d70c3daed2c1c37b3249bf96676be8c22a143aa0bef226063919108f137f0c59ceb99367e0297ea26f1a74e3a521c0cbc9fe902bce6e483bce57787a7625d3eee013923d46dafd78e0c66059e4a320b7989c20075e75477be3dba9c7405a5295cecf2d5487de24bad4fe6c4298615c1a5a80eb5c6014175bb8af6d612427ee3c4efec57e7cedbd3a1ceece245f4aa0cebf036e2dba400a80ae4c0179fe35cacdcfb92781a64100856483457876b811db6904a608bbee67eab2c3b5eb580c1f4f81b4a78784d187cdd2ac453c408ecd0ce4cef612ac8fb6740696c21a91459d28ae7fc02e0359909e39e5c8ccd95ed425e781aeebb5b4ce8d655fac13cfeac17f758ffa06bf2768bac792cdc79d8b937e34a2d11979fc858b973ce30de55a351b04fa0186763fbaa4e8319951ff67044185edd62a3f62a5ceecc4f5483724dd7bb3173f32665715d44bee31fccd2ddb1e5bf3c86d2164910465c099ecc797c2fa46ea75e1ca90489f78f3d6c33f132ce4f8e2af69f0b8aaa19ef8d995e93468c4c24cae68c85718a2b9cca754a30f72adc32638a5e5180ea49bd5cbe3f76aa48009f6ac8f3841b6ac9fbf8bf5ad832d4d99f0584687d3a9e07d6f828865e041dec2a6896b99d25f49e7775451badfb741b8e2fc65b9ed16787104cbd5b0d6c34848e13f08e51014c75aeee49bc37225e17f8ffe23ae81190e63a53267f2741d64d5926d5476bcfca53a5ac8d5b57485525423d06a269ce6c82c259c916c3ae386cee553cb00cae17d27595734c31036bf209f289c05ac2629d4e7ca8a4f2e5904ea16a0c6811c20ee6581c2d03b525c52a061ff8eda3c4f1002e1d64fe24190b22a99929b3ef4dfc35e15670148a069ed1e819b34e3f09671b88982fa424b6cebae8c4a8f937f6b09cc13dc7eb7b9f032c362687cc70082e6fa32472d8a76ee62b155538f80d290ef7b0c3fa08728124d1c29fe0b048fcd9a783976dc5ff018fc1cc754d024bc9e7edee9b22ae9b20a9c6fae02e97fb13e07e944e88879a90c06408e616943771723574f291b2051a5724ba71ef958ef90b3136c68d2c18e4ff59a9711a464bf167d91a91da920145f86797bab2932dea7bf68e04610e1d4b407170bab654bbe6ac9646161dd103947d845b507f05ac74ee813e963e88a5048e53ef0bd3bf5964a501fadb493e9135430968902668b5f99863e019592cafcd1c1e29a68aea642f706b2d0a963db85bfc5650bb31c87b470770041134c5b8dcb7ed7101811749e958eb341db7261469ce2d974a689f2493e57ceb15c03939535a35a0294dec3ece4ded52c2f045b65953a5679c284e411e6f6b004e8f7484a126927920bc89b4d1f468e5f0cb5ef7ce511debc314598cf5e3d77a88fab6f5286cce91e06cb409853e7d490a98b87fc46cf3c79244681521bb30923231085c4e1af78f836474b0f8c3062af620655fedbd9e5f2eda9881e9f93ed2431739971e3123cf2e744fb92189f26cd41f0e0a9167cfa037165425226dbce204712b3e38180b984cded006f9ea9d6f885275ab041b8753d246bcd0e94bdf54205a718068829d303dd79138804c3e106e75b07405f35f5b3049f4b9d0b133c4f6215aebf0c8ebab8d6c3d76931a7c05785e66c824cfc0e0fbc1dbd9ac87a767dcc2aa0ca4b77098a4b37a6132793d991918765fff7d61549817f1b130cf7b0ab7c1155ec17cfc3e904f189c3d5450c170631a7b23730fac2d6efc931bec7c001594ef14c68939e293bc4b503c91a41441737556f954a2f418adddbc37f4e1a1bbe3402665f08248008a519123186bf38c3ba389811fdd966f33ac718aa0479d97bb2067efae8a14ad30256169d6e7d9f4f2b35941e52b04fdc56f629aa01e40f45bb99fcaf56fb5b7cc4dc69858e2af74b67745965cd27d88e16dca112b2063fcb56b59aa5ec5f96d1991ad38c366712fb35bb678cf1a58e2d1047cb377db42727c92fbb476641a118505db6667f849e2c825ee6875243b2a9218b1651459134300046a5677beccb4bb1a407fad8182b11b53df50ae2000be0c6974f9965957f245c8447b1da708df837c20219bfd86a1f479715a17ccb77059cb5fa4ae5862f6361bf63211e5102d44b8e6ec06209ab83ca859e2f421844b32e0df35b97dbad47badc9b12ef4cc4205ecac0a2547a492019999790b571e714ecc6f018e19b98301c045b01399fe53f9e87e65f2863769f5b3efb80d994d2906bc1b4540506fd4abe7dbc50f770c71b1cef4a117ea29d9acdb7e0bbdbd01fa20e16f81c8ea14e07c13c5608dec56e1fc91668d185516846214581749bdf3d3059a7aa67795a989684a7ae79c9e48cc318a2605a6e3af628086236384179c3166aa2849234afdbb0e075d06740d701afb99129b0283e165b9ab0886ddcb9012708c048b5f02a2dc229bbc62edde5ed75045e9c037a7c7cca3b9cd37db78d851d43d4dd25560f4a8fce0693945c25a23add05e7921b3d0c05dff3fc6f2f2e1d1081d656d936efd5c62484d10528cc538c5931358725396d24bdaac4612838de433b61c7c8630fe65a75f5a16764ae86e89eb0ac351508a1c9d7ce4b9c0bfc66d4f8d046be1f39ccc590a7979f2ef2d0a7457f8acea5492e34a01e13068048fba4e6e06e882b8a60c19d2406e8e06be8c4cb10588edbc7750840694e53d245c898e6d1b06d4b6edd2a4c90407a25d6a23f86704518d51899b3cc18b6013a09c0d3b9325c723e7d70b1c205119d239ce697f2c43812bd2bfb433549dbad9f1955187c5aa3dbc657f96d11356664bd638a9a41dc4c7f1d0325638d9138b7c46c02fdcccf8609c7a19445e9f6e449cf68a5d57afa3b4cb9f42bccdea49df5d81edec3c5f3672d334f6d1c4c755b784bfa69ceb48", 0x1000, &(0x7f0000001380), &(0x7f00000013c0), &(0x7f0000001400)="18b04298fc31534ad2a1398daab2ca45db9a8f56c9ee1a62106154d8b77a0c") write$P9_RREADDIR(0xffffffffffffffff, &(0x7f0000001440)={0x49, 0x29, 0x2, {0x8, [{{0x20, 0x2, 0x5}, 0x1000, 0xc5, 0x7, './file0'}, {{0x40, 0x1, 0x4}, 0x7c73, 0x4, 0x7, './file0'}]}}, 0x49) (async) ioctl$EVIOCGVERSION(r0, 0x80044501, &(0x7f00000014c0)=""/239) (async) r4 = geteuid() (async) newfstatat(0xffffffffffffff9c, &(0x7f0000001680)='./file0\x00', &(0x7f00000016c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400) mount$9p_virtio(&(0x7f00000015c0), &(0x7f0000001600)='./file0\x00', &(0x7f0000001640), 0x24008, &(0x7f0000001740)={'trans=virtio,', {[{@access_uid={'access', 0x3d, r4}}, {@cachetag={'cachetag', 0x3d, 'net_prio.ifpriomap\x00'}}, {@cache_loose}, {@access_client}, {@cache_fscache}, {@nodevmap}, {@cache_loose}, {@cache_readahead}, {@directio}], [{@obj_user={'obj_user', 0x3d, '[%:{\x00'}}, {@subj_type={'subj_type', 0x3d, 'net_prio.ifpriomap\x00'}}, {@obj_type={'obj_type', 0x3d, '$,\\\\['}}, {@uid_gt={'uid>', r5}}, {@pcr={'pcr', 0x3d, 0x15}}]}}) (async) ptrace$ARCH_SHSTK_DISABLE(0x1e, r3, 0x2, 0x5002) newfstatat(0xffffffffffffff9c, &(0x7f0000001880)='./file0\x00', &(0x7f00000018c0)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x2000) quotactl_fd$Q_QUOTAOFF(r0, 0xffffffff80000300, r7, 0x0) (async) write$P9_RREADDIR(r0, &(0x7f0000001940)={0x2a, 0x29, 0x2, {0x7, [{{0x1, 0x1, 0x7}, 0x6, 0x7, 0x7, './file0'}]}}, 0x2a) (async) read$FUSE(r0, &(0x7f0000001980)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_ATTR(r0, &(0x7f00000039c0)={0x78, 0x2f, r8, {0x1, 0xb9, 0x0, {0x5, 0x2, 0x3, 0x6, 0x0, 0xffffffffffffffff, 0x5b6b, 0x6, 0x3, 0x1000, 0x5, r4, r6, 0x0, 0x80}}}, 0x78) (async) clock_gettime(0x0, &(0x7f0000003a40)={0x0, 0x0}) nanosleep(&(0x7f0000003a80)={r9, r10+10000000}, &(0x7f0000003ac0)) (async) mknodat$loop(r0, &(0x7f0000003b00)='./file0\x00', 0x800, 0x0) lsetxattr$trusted_overlay_opaque(&(0x7f0000003b40)='./file0/file0\x00', &(0x7f0000003b80), &(0x7f0000003bc0), 0x2, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000003c00)='9p\x00', &(0x7f0000003c40)='./file0/file0\x00', r0) r11 = syz_clone(0x8000000, &(0x7f0000003c80)="babff49244314f3981a85fc94b9c12043f0549e0f5c37ace237bf20b2f206b0ac071adf250f155eb881a9cb82cedfb73a4eb2248554fcffb5d820531ae034e2bd96da7eb3b2ee44f558beb3cc3427082e9", 0x51, &(0x7f0000003d00), &(0x7f0000003d40), &(0x7f0000003d80)="25e6fc815c350f48df40fefe8ea373cf678da2b93c53e41841095ca103f9045c2ec6582c6fd30e823499622a232ec1d1bd83ff42b7538e134eb31bbaaee4c8eaf46114af7eba1b7c4247a03e94e62a74a96018ec95cb586c634efa4487598c8dfb8315031001f31f8a8858f795ed") tkill(r11, 0x35) 719.705082ms ago: executing program 2 (id=48): r0 = getpid() (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) open(&(0x7f00000002c0)='./file0/file0\x00', 0x141840, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0xa) (async) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f00000004c0), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_GET(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="bc000000", @ANYRES16=r5, @ANYBLOB="93132cbd7000fcdbdf2512"], 0xbc}, 0x1, 0x0, 0x0, 0x20000010}, 0x40804) (async) setreuid(0x0, 0x0) (async, rerun: 32) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) (rerun: 32) ptrace(0x10, r6) (async, rerun: 64) request_key(&(0x7f00000003c0)='asymmetric\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0xfffffffffffffffe) (async, rerun: 64) ptrace(0x11, r6) (async) writev(r3, &(0x7f00000003c0)=[{&(0x7f0000000240)="390000001300034700bb65e1c3e4ffff0100000001000000560000002500000019001c000400000007fd17e5ffff8800040000000000000000", 0x39}], 0x1) (async) r7 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r8 = dup(r7) ioctl$KVM_SET_MSRS(r8, 0x4008ae89, 0x0) (async) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000240)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0xb0e, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x30, 0xc, [{{0x9, 0x4, 0x0, 0x6, 0x1, 0x3, 0x0, 0x2, 0x4, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x8}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x0, 0xfe, 0x9}}}}}]}}]}}, 0x0) (async) mount$incfs(&(0x7f0000000340)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f000001f980)) (async) r9 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r9, &(0x7f00000000c0), 0x10) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYRES16=r9], 0x448}}, 0x0) (async, rerun: 64) sendmsg$can_bcm(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="050000000808"], 0x80}}, 0x0) (rerun: 64) sendmmsg$inet(r9, &(0x7f0000001b00)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000080)="050000007402b8f4191db62b", 0xc}, {&(0x7f0000000440)="9f336d70bf41f19e47e98b4015e3b0384d86a1ceb4e530554ebc8154bf392bcf9ce0b09f879bd7aaf9d086e3", 0x2c}], 0x2}}, {{0x0, 0x0, &(0x7f0000000100), 0x2}}], 0x40000000000003a, 0x0) (async) chmod(&(0x7f0000000080)='./file0\x00', 0x40) (async) syz_pidfd_open(r0, 0x0) (async) openat$null(0xffffffffffffff9c, &(0x7f0000000180), 0x200, 0x0) 616.158111ms ago: executing program 0 (id=50): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x167342, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000080)=0xc) sendmsg$netlink(r1, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f00000031c0)=ANY=[@ANYBLOB=',\x00\x00\x00,\x00'/20, @ANYRES32=r3, @ANYBLOB="0b000280976b640868603000080001800400ea80"], 0x2c}], 0x1}, 0xcc000) r4 = memfd_secret(0x0) ioctl$KVM_GET_CPUID2(r4, 0xc008ae91, &(0x7f0000000180)) fcntl$lock(r4, 0x24, &(0x7f0000000200)={0x2, 0x4, 0x3, 0x3, r2}) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCGIFPFLAGS(r5, 0x8935, &(0x7f0000000100)={'rose0\x00'}) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240), r1) sendmsg$IPVS_CMD_DEL_SERVICE(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x6404a00}, 0xc, &(0x7f0000000380)={&(0x7f0000000280)={0xc4, r6, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x2c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sed\x00'}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x33}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_SERVICE={0x74, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@mcast2}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@dev={0xac, 0x14, 0x14, 0x10}}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x32}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast1}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x6}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x26, 0xa}}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x77}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x35}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}]}, 0xc4}, 0x1, 0x0, 0x0, 0x4008001}, 0x80) readv(r0, &(0x7f0000000140)=[{&(0x7f0000001400)=""/4096, 0x1000}, {0x0, 0xfffffe28}], 0x2) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x167342, 0x0) (async) socket$netlink(0x10, 0x3, 0x0) (async) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0), &(0x7f0000000080)=0xc) (async) sendmsg$netlink(r1, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f00000031c0)=ANY=[@ANYBLOB=',\x00\x00\x00,\x00'/20, @ANYRES32=r3, @ANYBLOB="0b000280976b640868603000080001800400ea80"], 0x2c}], 0x1}, 0xcc000) (async) memfd_secret(0x0) (async) ioctl$KVM_GET_CPUID2(r4, 0xc008ae91, &(0x7f0000000180)) (async) fcntl$lock(r4, 0x24, &(0x7f0000000200)={0x2, 0x4, 0x3, 0x3, r2}) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) ioctl$sock_inet_SIOCGIFPFLAGS(r5, 0x8935, &(0x7f0000000100)={'rose0\x00'}) (async) syz_genetlink_get_family_id$ipvs(&(0x7f0000000240), r1) (async) sendmsg$IPVS_CMD_DEL_SERVICE(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x6404a00}, 0xc, &(0x7f0000000380)={&(0x7f0000000280)={0xc4, r6, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x2c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sed\x00'}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x33}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_SERVICE={0x74, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@mcast2}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@dev={0xac, 0x14, 0x14, 0x10}}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x32}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast1}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x6}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x26, 0xa}}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x77}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x35}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}]}, 0xc4}, 0x1, 0x0, 0x0, 0x4008001}, 0x80) (async) readv(r0, &(0x7f0000000140)=[{&(0x7f0000001400)=""/4096, 0x1000}, {0x0, 0xfffffe28}], 0x2) (async) 569.353185ms ago: executing program 2 (id=52): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x167342, 0x0) unshare(0x24020400) r1 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x1840, 0x124, 0x8}, 0x18) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0}) setreuid(0x0, r2) cachestat(r1, &(0x7f0000003a80)={0x80000001, 0x5e43}, 0x0, 0x0) readv(r0, &(0x7f0000000140)=[{&(0x7f0000001400)=""/4096, 0x1000}, {0x0, 0xfffffe28}], 0x2) 568.947064ms ago: executing program 0 (id=53): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x60a00, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r1, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1, 0x0, 0x300}, 0x1f00) sendmsg$tipc(r2, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) sendmsg$tipc(r2, &(0x7f0000000340)={&(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x41, 0x0, 0x3}}, 0x10, &(0x7f00000001c0)=[{0x0}, {&(0x7f0000000640)="69710c3e7b90", 0x5dc}], 0x2, 0x0, 0x0, 0xc0090}, 0x4000000) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2041, 0x0) ioctl$TCSETAF(r3, 0x5408, &(0x7f0000000080)={0x49de, 0x0, 0xfffc, 0x67b, 0x19, "ec28a144f13d7607"}) write$binfmt_aout(r3, &(0x7f0000000280)=ANY=[@ANYBLOB], 0xff2e) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x12, "0062ba5d8200"}) r4 = syz_open_pts(r3, 0x20800) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x66}], 0x1, 0x74, 0x0, 0x0) sendmsg$IPVS_CMD_ZERO(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000480)={0x14, 0x0, 0x400, 0x70bd28, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4008001}, 0x8000) ioctl$KVM_RUN(r7, 0xae80, 0x0) dup3(r4, r3, 0x0) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000000)=0x44) ioctl$KVM_X86_SET_MSR_FILTER(0xffffffffffffffff, 0x4188aec6, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0x57789000) connect$can_bcm(0xffffffffffffffff, &(0x7f00000000c0), 0x10) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r8 = socket$unix(0x1, 0x1, 0x0) sendmsg$unix(r8, &(0x7f0000001040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000040}, 0x8000) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 568.736305ms ago: executing program 2 (id=54): r0 = mmap$IORING_OFF_SQ_RING(&(0x7f00006fd000/0x2000)=nil, 0x2000, 0x9, 0x1010, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x11c, &(0x7f00000000c0)=0x800, 0x0, 0x4) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x20002, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x11, r1, 0x45809000) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r3, &(0x7f0000000000)={0x28, 0x0, 0x0, @local}, 0x10) close_range(r2, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x40001e, 0x15) socket$inet6(0xa, 0x2, 0x0) r4 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x1cbd81, 0x0) fadvise64(r4, 0x6b, 0x4000000000f7c, 0x4) mmap$IORING_OFF_SQ_RING(&(0x7f00006fd000/0x2000)=nil, 0x2000, 0x9, 0x1010, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x11c, &(0x7f00000000c0)=0x800, 0x0, 0x4) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x20002, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x11, r1, 0x45809000) (async) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) (async) socket$vsock_stream(0x28, 0x1, 0x0) (async) socket$vsock_stream(0x28, 0x1, 0x0) (async) connect$vsock_stream(r3, &(0x7f0000000000)={0x28, 0x0, 0x0, @local}, 0x10) (async) close_range(r2, 0xffffffffffffffff, 0x0) (async) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) (async) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) (async) madvise(&(0x7f0000000000/0x400000)=nil, 0x40001e, 0x15) (async) socket$inet6(0xa, 0x2, 0x0) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x1cbd81, 0x0) (async) fadvise64(r4, 0x6b, 0x4000000000f7c, 0x4) (async) 419.691016ms ago: executing program 1 (id=55): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4) (async) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000100)=0xfffffff7, 0x4) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x7cab6ced6415608, 0x3}) (async) ioctl$BLKROSET(r1, 0x125d, &(0x7f0000000340)=0x3) (async) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r2, 0x29, 0x36, &(0x7f0000000240)={0x73}, 0x8) (async) setsockopt$inet6_opts(r2, 0x29, 0x39, 0x0, 0x0) (async) prctl$PR_SET_KEEPCAPS(0x8, 0x0) (async) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000000)={'bridge0\x00', @random="0100"}) (async) prctl$PR_SET_KEEPCAPS(0x8, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$SO_TIMESTAMPING(r3, 0x1, 0x64, &(0x7f0000000180), &(0x7f0000000300)=0x4) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)="dd", 0x1}], 0x1, &(0x7f00000001c0)=[@rights={{0x14, 0x1, 0x1, [r5]}}], 0x18}, 0x1011) (async) close_range(r4, 0xffffffffffffffff, 0x0) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) (async) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0xffffffffffffff2f, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xfffffffffffffffa, 0x0, 0x0, 0x0}}, @register_looper], 0x25, 0x0, 0x0}) 384.791939ms ago: executing program 1 (id=57): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = socket(0x10, 0x3, 0x0) write(r3, &(0x7f0000000100)="240000001e005f1814fffffffffffff807000000b800000000000000080007000d000000", 0x24) r4 = socket$unix(0x1, 0x5, 0x0) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x80040, 0x1b) close_range(r4, r5, 0x2) socket$inet6(0xa, 0x80002, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r6, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6, 0xfffffffd}, 0x67) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) write$cgroup_subtree(r7, &(0x7f0000000000)=ANY=[], 0x66) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$UHID_INPUT(r8, &(0x7f0000000940)={0x8, {"85f080a4933d55266e07e799aa0cc421388242df2a3c6b631b65b1c061edd2aa108c3528fe9b0bb3a53ab1200f5d01a68a4acdec8fee09648222f908c1fedc3000342e6139de28366c13509306d00ebcc67497181ac916db98af9d366b76e427d9ab5bb68095f0fb246df32b8af0783653136f8a04c03690312125b2ded6a24fda8685340c575ead69519e3583f89d467ec232d6a1ffd0463ba4ea3cbae5dae6654b5547b5458f02ac307729e57b09e134f68be44f88d72517b230b066f6315b5fb80206397bbff8cbc2a36e01c2e7b3aadb03bd3dd5288a69a991d9c674717e3abba7167280b2db3b1b8502afa4f3f296c532510c9d2dd79bb5eeb25adb5edddbdd069c09d14d15c2e7e1e2bb22e97d6992236d2273c8bb95536f7118d007965008b125c7daac2814e6bbe1adbfa3572ad0b7ad5c26c8014118d8374ca9f285779dfee7715a403908146a74de61b3853914c89f444c12e7a38bdd46c4ed36eb806ea598f44d1dec9eff9e2476f43802211f0762b66673b45d236b2391ce322e30fb9c69fe0d514dc1f8b6e3979c1205fd5224b07d18a44fec4f6f1a6f65158bb6adcc295bf2dd7dea107f59d7e03c2e45968956b931bdc4d6445ff1631e0b98e4b4448774dd4b9cd53a45896fdb3f03702778741ae2b45a25bf9a23fc02fb97a630f132bf9def6c6d4a7baeb62972f1a814f6f2377bcfc78e2e86368c138510a04cedf7175af8c2033aae7413e3ace8c71ab9a0af1ca7042011a6ed028e205648535dabf3b2f85196ae18d36b839e3cd54ae4933ad529888fdac7bb8a70c72bc0fc81ba06506f2d5bc7686e219bbe5283959cbef9950e071cb6d9f341fc624a5110341f26cebd7100599a06e61f66fae120c7fc2b34c6221200eba75bd1277114671a3fa8f058b27fd897b052f4a52afcea814df526181c75c4497210a2b85b7b26601561e78735387cf123654b0295d1d60556956b36d96dd038866c4b4db31ebdcddd6929bbc2850cd4901389e6ea6e86041e0efa1111c2fb0e6df6364cb95659f506d5c7e63fb67c8116577d15e4a4b1fc4c27de2e52586cb1f52be9c3601f5066549de8bdc3ec07d1a84caf1961323ec2487a37b751aeabafcd647ce2dae5d9499c0f969467e6cabad198669ac96bd1488954eff0854ee0c83d7b596d273625bdb16270782321071fda5d980ded78ffa9dc2b56037d7cbf942547f48a5131f1991f6c17ae1ed5120ca6878f98e68e7997a9a2b70be640a70a34adb80de286c669bb5f092e4e3a15a83217e03d02a4054f34af3a65ff6b36f395b76a0579cffafd5d3bb0e704c935caecf3a7ab756c23fd60c9fe3f4fb2be7504f5bae22b116ff1588dcf02b327d31bf0488dba8af5b33ccf2d7d87f43bbc48fcd4f191ad6af9313ad38b8b2967cbfabd6651bc1f6ce5abb4a2f1413194f96b26d7d6edc4e013fba549075c97eef508af5ca7873664b058b7bcf455a8a04b591d29fab6366c844bb75576bac2d52323e747303d00a5736c9812922b0e17bcec9135550736b54cf6407d61e22e62d7bb75f62935b665acf33e75f688c36ef416f1b890d0f0c8ad1df00e02ec45967834d5649c8e7143978622fa3704672970b7993a87e97d3d926a14265647bc8b8c9e6f83e29572608d24b42c2635ef4abbd0af83860e99c90d7471cf6e8ce99507f5ec2bc572212fa9ee3f5a9dfa3815fe55f0bbb119acce062ae37f2ff921707abba139bcddf42bfd174d29b540161b4113c4e1a13f3a628c638ec4d3a884dfbc093e23ec0d0671b46b41dc8b42d950c8615ba5ee87f49b5d0910ffa4871207995001920db05a95199967f097ba7b55bbd271d818690c4238406b40a3dfc42fa56a67173b53a96b543326c56738b6d043195934018696f5ab49347e5148a78f2d1369a71afab8330273d46ecfba4ee05802a5385649851db949dbfb39e290941641c50b1ac20fb3102754a760b097f464ddb0b83f8168badfa71db6621dcf22fb081e3403f3bac5c7e65905aca52885c807f8ddab18bb2f12ef952c50483c0e251968bc70ff0d42a638ca744dea4c7ebb4fea777cf663bb4f1505ed79730c45bc86e488a13f924377a8e2ee6670a02ca52874ae1c42a35d55b9765757047b2cc3742aa51fa3e43fb2c113c92ad213bad252c1a82966dd016f12a7f1c3900c0f1ab455035163f31899bdd30f3ff43ad17d9e45bb7438c1c986712736f24be14f71ab1bfe92a25ec07f086ee8c7971b8077a13e58a8e8bea39c8e06b251909f02cb0080abf020f27ca160eb26c082dda1fa54ea4094dfdbcb2fa7bddccb67a844e8075f4cc08dad35757006d051e183dced336bc0c2502f93ffc87dca622286ba174c24e1f53f27dc2777baafe170348b0e8d3e743b3aa906bc0764bbe7da08ff403efe2212627d6748c2ce5bb513b7312517d1f88c61c7ba5f9647cd619281c5b390b48606ee39fb4171103df2e09d7cfd56c06c721f7c24ad8cce383623fc2dcb73f7b1b3b86df1b42490815513681aafbf7e871b4b9686efae6c45ecfca60a640a6f071dfd31f9437c3d03086164b48c1ed802986864bfe0d49bdd7709662262368dbc3ecc05eb240ecc41904c76d78ab5c52b66af5a720fdd6a92f52be0676427a56e32e5bc5085b25f90add28a76f2fce6f8f0ef74f4658098549646bd63175adf77b5cdcf102946554ba6136cbc83c6268ee40318f3c9d4718025688b35d2265bf60bf889ff629f7834586ef46eab7a9176337536bb6001e676546b987f36b1fe4baea02fa76fb4830aebbb9c14d8e2b43ea77ef887e5a26448f4086fa819a25e27725ac10298851c8bc45f2ce4430b07917ade5ea8c434c3f2576effbeb521173736e5c9557450643068b0c0fb132a7e99de6ca292246a9937fa7d7e06e59cf59ce5b9f8426a9049931146af40a8a1256ba373a88d09dc00cdf4453cc6ba78572bf3e1f2352a978cdbad60220cb8ac37d7f614a306492a4b5eee9244b0ca84b6cf2e23013bfb1cb92bf6d126fe550e58c19f84e7a4081437b75b31b2b9fb658dcd8ba077962e0f3359721a148d4fefe5c97941ca9688cb85adf38fd10f5811cdd8e074a21abfc9541c71465b08d7321281b68ed52bfab789b9c83849c09d52376d419b1e7ba367603236e119cdf4a7b7cf9d81f2229601deace53cea2f14a05f7fa0ca04b39e31c6453e332f4bd0915c0e09e28f4d1125c390c6ff0833a04b6fc37855e65de90333e505b9eb66e0068607000000fb7b8b215dbdc9787b5baa724cfa71ee6745b41e203de8b7794757ac328ec5567540b951b50530c3d4ee34705ea1c66fd6591e88561083e86d48c45ef3b83a3029319d8f3d8e65ce14c1dc3cb92d0a7dbeb609a8d2793928caa079f0fbbb2bc90b9fb4000000f4032041d14c5bca00e99b3027ec3a50c4957199cf016a4594069af8659df0973f20ffb15dbc265ac5b8a2203e90b114a3e9441e357c60ce0b550a7fe66fc34f5702ac8e8992a22e89194c1df69e81a9b7ad3d2634ea8c0388588192fd47d8e803b10044d558617fb2921b69eb4d85c051f86ef63a2f4382b9becd870fb2ecadca6902712b88680792e2f2ec89591cfebb6db3ad31c2a339af10465fcf7988519d382218df52261234f26a6f66ad0d1859de505d0fe819caf2f8d30aa9fd1228ac91d11ca67f1f8d50c8eefa5c441514321507dff6c6ea3cff6f340a1c11e0c40f419e8e60fc94d8828fa47a96cdf7ee4f61e23f40751b25cf9ca1295041a350f83f0e679515d6b4b46e2c9ce8999e07f835abc1663cefcf728df37831f4e17f8c8a4feaf1fbf44c38c9313284404a50ba4cd8abe835b33bfecb02cd6c9d7f435853b4c8d505ab83cf46512739116694765658bae64b3127152d216055aef9b25c70a8a3b302752d7b1e8791c657b9f3fc9001ef299fd1a349491ae6ee9940149160507fc4130fb825d47d97dc2c243209d2403583ac3ef6ddbedcaa76432255487c0a06e59e043e572ab3aec002afea6b6a2dc9cfaeefa70557886c4d12924a0388f2f1bc8e89e4cfa69705d1ef3c4658f8616278b588011d9dd914beec0b151d65b6524fba3e3f235d58373e021699b07622a51504eade747e0b2f9cf38bc167cabc8cb18c708d1337e25648707e8c0872876514c7a49c0b2aaee5ed9e9ecfcbcc23e032c4deb63e48e7120188056468fad31448e4b46e7d62fbcfc1c2cfb01fcf0db5e8a162bdb9bd820c763f17b96c23f32db9d1c1d74ddbe657b4f9595a9796982a0742153111b15e484d8ffebe47ce0a78a41e470a341616ec2eb6eef813fb415fab50fa965bec6a5977a0ade4fed67f86fc24e11b0e2f5364079f7c7c35b560cac726dbc80f29dbd248f7ecda0286a23ef172a28c96d9bdb1f598eab31c6baf0321312da23920c074b9d2d2e442717f2c21001142a39c2da6b8bd9d06b05a6a8deae1bd1be4108a636ddbebc682d113e715f2f3ee506abc28b1c654b3d2d28e02f73b171ed0deed71dda90ce4a0b728cc75cb576385e7418b545b992b1dd98e2ee53355f464f9250a2a03b3d1e4d2ac1aa71d01de2573530324e14d15a507883411ddbd37be21dc929db9b11f11010e4d2a04c7325a5ae6d24d19900ff97a8a89438f8676457a78cff05201528f4358fe67f61288bf042a8f3c2e0f8b4997b8fb74996b80d465489b2d7807a945eba72a945e8cf8625dbad6f6f6e30537b29e558ca8a8b0625f578c766d34f2d28d704715f94df1f6318a308042aa494baa295640679f1eab1e6a8308af8ce6441d5ad8a2f3d477eb5307af0dfae66444a8f1434030b8361621340ad3dcefa6d8f090ed3929d89ad9c0ba01a6903033428dd8f98619304b1803187d2a6130bf1e009b5eb0e7e21c75594b3b8470f3106c92a9e55bfeb026091ced127a90a1f1247f3c07e36d3572923e0de3f73518d0369a25fcd4e65d243b7eab91063a7bfd8bc8ac9e39fbbb32b5c9517886287a18eacd8dbfda9b91db693cb12e42cba5988280e09e51e72b91a0f360656d8f21cc1eb3248ac345ad51d1a6172b18419277851dab01e028c7e8e2cf34095efd28267852a08fccf61c45b5e46930160daf50282be058274e7ff58c48b60b86d0c8cc886ab8778a2a2b5fa2557ad7bf7f01f2175523ce758871d334c20a9839f7a89fe2867c06289c8a2f6456ac7e4fbadee53ac41aee68214bc76669853baa4f58255b39ba581414f2e8c4b49303f8936a33bae5cbc96b29a5c724d5b50e1614144c2acd03bd90de891c3d36ce040d57543682ecbfcae66c4153c337c3a5d01896524c8e0c27e9a08919821ca27bbfe3fc9ba24a823aeec8d4ad8ef8a65c585bee4dcf1acaa3da501a8c11a23b2e22920c1ad0129a038b31fe16c2abc80589dbf7c37211afc5d1a6db908bc5fe8a692060069fcbcdcba7c523d3c424aa3b0c6556387e0e51bcde9e5f850abf62d2c2101c3a2786a0cb94932877a09cb6b64aa61da8cab3b423e7adc4c4700418a65e87225710e1691f6d9cb2eb63cce5b605ce0a4a89cf519767e00845397c5e381141a0ed8a89b01064b495ec8d1e2da37433bf1597d919a69610d2ad26bdf6fca8de422bb2cb80d0516206e8194ee51445a3dcb5dee33c0c310b4751e68e58bebda2fb586985a5a5b06456756f44e6dbfef4bb99ca732f00fb9ea35775f7419681bfbe6f43dc7c4650c13b63d93c1d490bf0173f287a4309531f13ecb1a775d0bd881a00", 0x1000}}, 0x1006) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x13, r8, 0x0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000040)=0x48, 0x4) r9 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r9, 0xc0306201, &(0x7f00000003c0)={0x6, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) 247.724571ms ago: executing program 3 (id=58): r0 = socket(0x25, 0x80000, 0x1) (async) openat(0xffffffffffffffff, &(0x7f0000000300)='.\x00', 0x0, 0xa4) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380), 0x147180, 0x0) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000140)=0x20000000) r2 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) write$tcp_congestion(r2, &(0x7f0000000400)='illinois\x00', 0x8) (async) r3 = openat(0xffffffffffffff9c, 0x0, 0x290c40, 0x1a) (async) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) (async) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x3}, 0x1c) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000000)=0x3, 0x4) (async) sendto$packet(r4, &(0x7f00000000c0)="3f031c00eee8140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c153cfdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)='./file0\x00') (async) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="640000001900010000000000fbdbdf251d"], 0x64}, 0x1, 0x0, 0x0, 0x5}, 0x0) (async, rerun: 32) close(r1) (rerun: 32) pipe(&(0x7f00000001c0)) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) (async) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) (async) readv(r1, &(0x7f0000000140), 0x0) (async, rerun: 32) mlockall(0x4) (async, rerun: 32) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='smaps_rollup\x00') getsockopt$IP6T_SO_GET_INFO(r3, 0x29, 0x40, &(0x7f0000000200)={'raw\x00', 0x0, [0x9, 0x539c, 0x2705, 0x348b, 0x9d]}, &(0x7f00000002c0)=0x54) (async) fchdir(r6) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x11, 0xffffffffffffffff, 0x45809000) (async, rerun: 32) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x1cbd81, 0x0) (async, rerun: 32) ioctl$sock_TIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000180)) sync_file_range(r4, 0x8000000000000001, 0x4, 0x0) 159.642168ms ago: executing program 3 (id=59): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f0000000240)={0x1f, 0x8000, @none, 0x0, 0x1}, 0xe) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x7cab6ced6415608, 0x3}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) mkdir(&(0x7f00000020c0)='./file0\x00', 0x82) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id']) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67726f00a6a98d618e15ff3db747e275705f69643d", @ANYRESDEC=0x0, @ANYBLOB=',\x00']) rt_sigaction(0x40000022, &(0x7f0000000080)={0x0, 0x80000000, 0x0, {[0x400fff]}}, 0x0, 0x8, &(0x7f0000000180)) r3 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)=ANY=[@ANYBLOB="140000001e000101000000000000000007"], 0x14}], 0x1}, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x1, 0x0, 0x0, 0x3, 0xc}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1, 0xc}, @flat=@handle={0x73682a85, 0x101, 0x7}}, &(0x7f0000000000)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 144.452229ms ago: executing program 3 (id=60): r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x4044000, &(0x7f00000001c0)={0x11, 0x88fb, 0x0, 0x1, 0x5, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2f}}, 0x14) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'xfrm0\x00', 0x0}) sendto$packet(r0, &(0x7f00000001c0)=' ', 0x5dc, 0x20000840, &(0x7f00000002c0)={0x11, 0x88a8, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r3 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r3, &(0x7f0000000180), 0x10) sendmsg$can_bcm(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)={0x6, 0x0, 0x5, {0x77359400}, {}, {0x0, 0x0, 0x0, 0x1}, 0x1, @canfd={{0x1, 0x0, 0x1}, 0x2b, 0x3, 0x0, 0x0, "0d1f3c27117034f6d5e271f08beb50ceb064553cbe8c093cb242232010bb3874140162e7fed6908644a259ab5b0a532218639b476d0dfee7aee09c5ecf80dd69"}}, 0x80}, 0x1, 0x0, 0x0, 0x4000054}, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) 104.207222ms ago: executing program 3 (id=61): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1100, 0x2}) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000000)={0x1}) 23.692439ms ago: executing program 3 (id=62): r0 = syz_open_dev$ptys(0xc, 0x3, 0x0) ioctl$KDSETLED(r0, 0x4b32, 0xbc) ioctl$AUTOFS_IOC_EXPIRE_MULTI(r0, 0x40049366, &(0x7f0000000000)=0x2) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDFONTOP_COPY(r1, 0x4b72, &(0x7f0000000440)={0x3, 0x0, 0x6, 0x16, 0x19c, &(0x7f0000000040)}) ioctl$RTC_IRQP_READ(0xffffffffffffffff, 0x8008700b, &(0x7f0000000480)) r2 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f00000004c0)=0xff, 0x4) r3 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$TIOCSIG(r3, 0x40045436, 0x9) read$hidraw(r2, &(0x7f0000000500)=""/4096, 0x1000) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r3) clock_gettime(0x0, &(0x7f0000003500)={0x0, 0x0}) recvmmsg(r4, &(0x7f0000003400)=[{{&(0x7f0000001500)=@in6={0xa, 0x0, 0x0, @private1}, 0x80, &(0x7f0000001b40)=[{&(0x7f0000001580)=""/194, 0xc2}, {&(0x7f0000001680)=""/43, 0x2b}, {&(0x7f00000016c0)=""/212, 0xd4}, {&(0x7f00000017c0)=""/20, 0x14}, {&(0x7f0000001800)=""/217, 0xd9}, {&(0x7f0000001900)=""/221, 0xdd}, {&(0x7f0000001a00)=""/250, 0xfa}, {&(0x7f0000001b00)=""/16, 0x10}], 0x8, &(0x7f0000001bc0)=""/189, 0xbd}, 0xb}, {{&(0x7f0000001c80)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, 0x80, &(0x7f0000001e40)=[{&(0x7f0000001d00)=""/164, 0xa4}, {&(0x7f0000001dc0)=""/114, 0x72}], 0x2}, 0x9}, {{&(0x7f0000001e80)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, 0x80, &(0x7f0000003300)=[{&(0x7f0000001f00)=""/244, 0xf4}, {&(0x7f0000002000)=""/153, 0x99}, {&(0x7f00000020c0)=""/68, 0x44}, {&(0x7f0000002140)=""/248, 0xf8}, {&(0x7f0000002240)=""/156, 0x9c}, {&(0x7f0000002300)=""/4096, 0x1000}], 0x6}, 0x80000000}, {{0x0, 0x0, &(0x7f00000033c0)=[{&(0x7f0000003380)=""/40, 0x28}], 0x1}, 0xfffffffa}], 0x4, 0x2100, &(0x7f0000003540)={r5, r6+10000000}) getsockopt(r4, 0xb, 0x7, &(0x7f0000003580)=""/206, &(0x7f0000003680)=0xce) ioctl$TIOCSRS485(r3, 0x542f, &(0x7f00000036c0)={0x72, 0x0, 0x22}) ioctl$BTRFS_IOC_QUOTA_RESCAN_WAIT(r3, 0x942e, 0x0) r9 = socket$inet(0x2, 0xa, 0x2) getsockopt$SO_TIMESTAMPING(r9, 0x1, 0x25, &(0x7f0000003700), &(0x7f0000003740)=0x4) connect$inet6(r2, &(0x7f0000003780)={0xa, 0x4e20, 0x5, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x6}, 0x1c) socket$nl_generic(0x10, 0x3, 0x10) getsockopt$IP_VS_SO_GET_SERVICE(r8, 0x0, 0x483, &(0x7f00000037c0), &(0x7f0000003840)=0x68) r10 = syz_open_dev$hidraw(&(0x7f0000003880), 0xe, 0x200000) fcntl$dupfd(r10, 0x406, r2) socket$netlink(0x10, 0x3, 0x76dbeae9ce2706ce) ioctl$F2FS_IOC_MOVE_RANGE(r7, 0xc020f509, &(0x7f00000038c0)={r8, 0x6, 0xc9b, 0xd}) r12 = geteuid() sendmsg$nl_netfilter(r11, &(0x7f00000039c0)={&(0x7f0000003900)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000003980)={&(0x7f0000003940)={0x24, 0x10, 0x2, 0x201, 0x70bd25, 0x25dfdbfd, {0x5, 0x0, 0x9}, [@typed={0x8, 0xe, 0x0, 0x0, @uid=r12}, @typed={0x8, 0xe1, 0x0, 0x0, @ipv4=@rand_addr=0x64010101}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000003}, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0xc) 20.881589ms ago: executing program 3 (id=63): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder1\x00', 0x1802, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socket(0x10, 0x3, 0x0) (async) r3 = socket(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x9, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) ppoll(0x0, 0x0, &(0x7f0000000340)={0x0, 0xff}, 0x0, 0x0) r4 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x0, 0x0) fchdir(r5) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x714}}, 0x2000c004) r6 = creat(&(0x7f0000000000)='./file0\x00', 0x6a) write$binfmt_elf32(r6, &(0x7f0000000040)=ANY=[@ANYBLOB="7f454c46000000000000000000000000030006000000000000000000380000000000000000191bda0000200001000000000280000000000003"], 0x69) close(r6) execve(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) (async) execve(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000003200010a25bd7000feffffff2f000000"], 0x14}}, 0x0) (async) sendmsg$nl_generic(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000003200010a25bd7000feffffff2f000000"], 0x14}}, 0x0) sendmsg$NFQNL_MSG_VERDICT(r3, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000300)={&(0x7f0000000440)=ANY=[@ANYBLOB="dc02000001030101000000000000000003000001a4000f800e000600736e6d705f747261700000000600074000010000100003800c0002800500010006000000680003800600034000000000060003400002000014000180080001007f00000108000200ac14140b1400018008000100e000000208000200e00000012c00018014000300fe80000000000000000000000000002c14000400fc020000000000000000000000000000080009400000000b060007400002000000020f800600074000040000540001800c000280050001002f000000060003400000000006000340000400002c000180140003000000000000000000000000000000000014000400fe8000000000000000000000000000bb060003400001000008000840000000021c000180060003400003000006000340000100000600034000030000080004400000000074010a800800014000000001180002800c0002800500010011000000060003400004000008000140000000000800014000000001b400028006000340000400000c000280050001003a0000002c000180140003002001000000000000000000000000000014000400ff0200000000000000000000000000010c00028005000100840000001400018008000100ac1414aa08000200ac1414aa0c00028005000100060000002c00018014000300fc00000000000000000000000000000114000400fe8800000000000000000000000000010c00028005000100840000000c000280050001002f0000008c0002801400018008000100ffffffff08000200e00000010c000280050001002100000006000340000000000c000280050001003a0000000c000280050001000600000006000340000000000c00028005000100210000001400018008000100ac1e010108000200000000000c00028005000100840000001400018008000100ac1414bb08000214ffffffff24000f801800038006000340000400000c000280050001003a00000008000b0073697000"], 0x2dc}, 0x1, 0x0, 0x0, 0x8050}, 0x10) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) (async) r7 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_GET_STATS_FD_cpu(r7, 0xaece) (async) r8 = ioctl$KVM_GET_STATS_FD_cpu(r7, 0xaece) close_range(r0, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r8) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) r9 = creat(&(0x7f00000000c0)='./file0\x00', 0x43) syz_open_dev$usbfs(&(0x7f0000000380), 0x80000001, 0x400) (async) r10 = syz_open_dev$usbfs(&(0x7f0000000380), 0x80000001, 0x400) ioctl$USBDEVFS_IOCTL(r10, 0xc0105512, &(0x7f00000008c0)=@usbdevfs_driver={0xffffffff, 0xfffffff7, &(0x7f00000007c0)="24c3307f46661ee64ed20f250019e17959fabea63084cfcc4b076e031906a31dad64d3b60ca95cd0f7dbdc2e97d031dc266a1ea2c481dfc09fc594d97b768a20d3524c4ad92d1a8c5ac2a36b46246950678e905ce268cca25d7e344ad1efc364c887565b300e38e9f4d6a597c35ecd95f221af3c0a97aee972d559ba72213712c152c65a95c3d9c219e46eced5636467907edb8255aaec7ba007faf985c9cf2ac9ea2d1424e4b9faa34fc68263cb9eec10781f3ace74455674611f3d45ae28a9aa685ca1dd7d679c"}) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r11, &(0x7f0000000100)={0xa, 0x4e22, 0x5ccc6e75, @rand_addr, 0x3}, 0x1c) (async) bind$inet6(r11, &(0x7f0000000100)={0xa, 0x4e22, 0x5ccc6e75, @rand_addr, 0x3}, 0x1c) listen(r11, 0x3) ioctl$KVM_CAP_X86_BUS_LOCK_EXIT(r9, 0x4068aea3, &(0x7f0000000740)={0xc1, 0x0, 0x3}) (async) ioctl$KVM_CAP_X86_BUS_LOCK_EXIT(r9, 0x4068aea3, &(0x7f0000000740)={0xc1, 0x0, 0x3}) 0s ago: executing program 2 (id=64): socket$inet6_icmp(0xa, 0x2, 0x3a) (async) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) (async) r1 = inotify_init1(0x80800) inotify_add_watch(r1, &(0x7f0000000040)='.\x00', 0xc0000484) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000d40)='./file0\x00', 0x0) (async) r2 = openat$dir(0xffffffffffffff9c, &(0x7f00000026c0)='./file0\x00', 0x12100, 0x0) preadv2(r2, 0x0, 0x0, 0x0, 0x0, 0x0) (async) r3 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet6(r3, &(0x7f0000001480)=[{{&(0x7f0000000080)={0xa, 0x4e20, 0x5, @ipv4={'\x00', '\xff\xff', @empty}, 0x4}, 0x1c, 0x0}}], 0x1, 0x40044) (async) recvmmsg(r0, &(0x7f00000002c0)=[{{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000140)=""/216, 0xd8}], 0x1}, 0x9}], 0x2, 0x2, 0x0) syz_clone3(0x0, 0x0) (async) r4 = openat$udambuf(0xffffffffffffff9c, &(0x7f00000001c0), 0x2) r5 = memfd_create(&(0x7f0000000580)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\xea7\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\x0f<\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xd9w\\\xf8\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xcd\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00\xd5\xf3\\\x00\xbe]Et\xad*\xecj\x02\xc8\xc4\f\x04\x99\xf6\xfc', 0x3) ftruncate(r5, 0xfffb) (async) fcntl$addseals(r5, 0x409, 0x7) r6 = ioctl$UDMABUF_CREATE(r4, 0x40187542, &(0x7f00000002c0)={r5, 0x0, 0x0, 0x8000}) lseek(r6, 0x3, 0x3) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x167342, 0x0) (async) r7 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000005c0), 0x2, 0x0) r8 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001400e8e50401a5aa16e4df2528010000631443eec4af1b06cdd12e262a707385482b8522af21cedf8337c537a34cc9d060998bb20b3fd2b58d32f2c33e3589fc7a2c8ad0e2db0619d5b9251703a1281e92c24f07612ccbef7f013999d10bb542f97e572250570633c1310c62f053aee3cbf145fedd153862d0fb3996fb910ac693ac11b43af4614f3b4049e8245ad6ca24d022a0ffe7be2c9a71084b7b0c01382082e0826d2ea9d0d2fee2e9387c96106c406bc9d2eb76a8e76270a464270eae10"], 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x20040000) (async) r9 = openat$selinux_policy(0xffffff9c, &(0x7f0000000300), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r9, 0x0) (async) r10 = userfaultfd(0x0) (async) r11 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') pread64(r11, &(0x7f00000001c0)=""/210, 0xd2, 0x60a2d3b9) (async) ioctl$UFFDIO_API(r10, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x540}) (async) write$selinux_load(r7, &(0x7f0000000000)=ANY=[], 0xffaf) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.241' (ED25519) to the list of known hosts. [ 22.922897][ T36] audit: type=1400 audit(1756063658.060:64): avc: denied { mounton } for pid=281 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.924268][ T281] cgroup: Unknown subsys name 'net' [ 22.945615][ T36] audit: type=1400 audit(1756063658.060:65): avc: denied { mount } for pid=281 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.972982][ T36] audit: type=1400 audit(1756063658.090:66): avc: denied { unmount } for pid=281 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.973255][ T281] cgroup: Unknown subsys name 'devices' [ 23.160070][ T281] cgroup: Unknown subsys name 'hugetlb' [ 23.165708][ T281] cgroup: Unknown subsys name 'rlimit' [ 23.321828][ T36] audit: type=1400 audit(1756063658.460:67): avc: denied { setattr } for pid=281 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.345142][ T36] audit: type=1400 audit(1756063658.460:68): avc: denied { mounton } for pid=281 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.369997][ T36] audit: type=1400 audit(1756063658.460:69): avc: denied { mount } for pid=281 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.382315][ T283] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 23.402001][ T36] audit: type=1400 audit(1756063658.540:70): avc: denied { relabelto } for pid=283 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.427535][ T36] audit: type=1400 audit(1756063658.540:71): avc: denied { write } for pid=283 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.457256][ T36] audit: type=1400 audit(1756063658.590:72): avc: denied { read } for pid=281 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.482973][ T36] audit: type=1400 audit(1756063658.590:73): avc: denied { open } for pid=281 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.483128][ T281] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 24.351978][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.359157][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.366247][ T289] bridge_slave_0: entered allmulticast mode [ 24.372774][ T289] bridge_slave_0: entered promiscuous mode [ 24.379085][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.386138][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.393445][ T288] bridge_slave_0: entered allmulticast mode [ 24.399885][ T288] bridge_slave_0: entered promiscuous mode [ 24.408873][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.415923][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.423288][ T289] bridge_slave_1: entered allmulticast mode [ 24.429654][ T289] bridge_slave_1: entered promiscuous mode [ 24.440179][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.447226][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.454327][ T288] bridge_slave_1: entered allmulticast mode [ 24.460624][ T288] bridge_slave_1: entered promiscuous mode [ 24.505668][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.512804][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.520034][ T290] bridge_slave_0: entered allmulticast mode [ 24.526266][ T290] bridge_slave_0: entered promiscuous mode [ 24.542552][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.549740][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.556822][ T290] bridge_slave_1: entered allmulticast mode [ 24.563353][ T290] bridge_slave_1: entered promiscuous mode [ 24.617854][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.624903][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.632271][ T291] bridge_slave_0: entered allmulticast mode [ 24.638627][ T291] bridge_slave_0: entered promiscuous mode [ 24.652007][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.659098][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.666167][ T291] bridge_slave_1: entered allmulticast mode [ 24.672507][ T291] bridge_slave_1: entered promiscuous mode [ 24.746433][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.753516][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.760827][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.767911][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.815914][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.822984][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.830292][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.837333][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.878816][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.885883][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.893185][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.900244][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.917469][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.924551][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.931864][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.938921][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.947275][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.954870][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.962142][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.970143][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.977323][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.984595][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.991901][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.999272][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.018627][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.025678][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.033428][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.040511][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.079329][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.086398][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.109564][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.116717][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.124713][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.131787][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.139558][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.146602][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.162288][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.169368][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.177031][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.184212][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.207245][ T289] veth0_vlan: entered promiscuous mode [ 25.235244][ T290] veth0_vlan: entered promiscuous mode [ 25.253213][ T289] veth1_macvtap: entered promiscuous mode [ 25.266956][ T290] veth1_macvtap: entered promiscuous mode [ 25.283492][ T291] veth0_vlan: entered promiscuous mode [ 25.298531][ T288] veth0_vlan: entered promiscuous mode [ 25.328920][ T291] veth1_macvtap: entered promiscuous mode [ 25.338965][ T290] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 25.354811][ T288] veth1_macvtap: entered promiscuous mode [ 25.406071][ T331] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.448072][ T335] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 25.448133][ T335] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:2 [ 25.462557][ T338] overlayfs: failed to resolve './file1': -2 [ 25.534554][ T344] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 3 [ 25.554762][ T344] rust_binder: 4: no such ref 3 [ 25.565260][ T344] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6'. [ 25.578199][ T344] rust_binder: pid 344 performed invalid decrement on ref [ 25.743164][ T353] rust_binder: Failed to allocate buffer. len:4120, is_oneway:true [ 25.743196][ T353] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 25.751346][ T353] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:4 [ 26.373777][ T359] capability: warning: `syz.1.10' uses deprecated v2 capabilities in a way that may be insecure [ 26.412536][ T361] rust_binder: Error while translating object. [ 26.412590][ T361] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 26.420002][ T361] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:10 [ 26.538975][ T385] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 26.727759][ T347] usb 2-1: new low-speed USB device number 2 using dummy_hcd [ 26.817203][ T413] mmap: syz.0.25 (413) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 26.817905][ T9] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 26.867869][ T347] usb 2-1: device descriptor read/64, error -71 [ 26.998850][ T9] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 27.007557][ T9] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 27.017828][ T9] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 27.026817][ T9] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 27.037956][ T9] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 27.049064][ T9] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 27.058298][ T9] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 27.066317][ T9] usb 3-1: Product: syz [ 27.070595][ T9] usb 3-1: Manufacturer: syz [ 27.077491][ T9] cdc_wdm 3-1:1.0: skipping garbage [ 27.082951][ T9] cdc_wdm 3-1:1.0: skipping garbage [ 27.088867][ T9] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 27.094858][ T9] cdc_wdm 3-1:1.0: Unknown control protocol [ 27.107741][ T347] usb 2-1: device descriptor read/64, error -71 [ 27.282944][ T9] usb 3-1: USB disconnect, device number 2 [ 27.316748][ T421] rust_binder: 21: no such ref 0 [ 27.322145][ T421] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 27.347737][ T347] usb 2-1: new low-speed USB device number 3 using dummy_hcd [ 27.435334][ T423] rust_binder: 21: no such ref 0 [ 27.455309][ T425] netlink: 8 bytes leftover after parsing attributes in process `syz.2.30'. [ 27.477798][ T347] usb 2-1: device descriptor read/64, error -71 [ 27.623295][ T9] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 27.636168][ T9] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 27.677398][ T435] fido_id[435]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 27.727733][ T347] usb 2-1: device descriptor read/64, error -71 [ 27.827750][ T329] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 27.842559][ T446] rust_binder: Write failure EFAULT in pid:33 [ 27.852611][ T347] usb usb2-port1: attempt power cycle [ 27.938206][ T451] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 27.945475][ T451] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:27 [ 27.945690][ T451] rust_binder: 27: no such ref 2 [ 27.975954][ T36] kauditd_printk_skb: 114 callbacks suppressed [ 27.975973][ T36] audit: type=1400 audit(1756063663.110:188): avc: denied { ioctl } for pid=453 comm="syz.0.39" path="/dev/input/event2" dev="devtmpfs" ino=208 ioctlcmd=0x4580 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 27.989653][ T329] usb 4-1: config 1 interface 0 has no altsetting 0 [ 28.008632][ T454] rust_binder: Error while translating object. [ 28.014072][ T454] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 28.015879][ T329] usb 4-1: New USB device found, idVendor=046d, idProduct=c262, bcdDevice= 0.40 [ 28.021395][ T454] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:30 [ 28.042790][ T36] audit: type=1400 audit(1756063663.180:189): avc: denied { execute } for pid=455 comm="syz.2.40" name=7EF3195201 dev="tmpfs" ino=81 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 28.042848][ T456] process 'syz.2.40' launched '~R' with NULL argv: empty string added [ 28.082503][ T329] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.091094][ T329] usb 4-1: Product: Ⰱ [ 28.095374][ T329] usb 4-1: Manufacturer:  [ 28.100020][ T329] usb 4-1: SerialNumber: syz [ 28.197740][ T347] usb 2-1: new low-speed USB device number 4 using dummy_hcd [ 28.218777][ T347] usb 2-1: device descriptor read/8, error -71 [ 28.228622][ T36] audit: type=1400 audit(1756063663.370:190): avc: denied { write } for pid=461 comm="syz.2.42" name="random" dev="devtmpfs" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:random_device_t tclass=chr_file permissive=1 [ 28.256572][ T36] audit: type=1400 audit(1756063663.390:191): avc: denied { load_policy } for pid=461 comm="syz.2.42" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 28.256725][ T462] SELinux: policydb magic number 0x13c0 does not match expected magic number 0xf97cff8c [ 28.286535][ T462] SELinux: failed to load policy [ 28.348795][ T347] usb 2-1: device descriptor read/8, error -71 [ 28.507380][ T429] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 28.516061][ T429] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 28.525845][ T429] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 28.534518][ T429] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 28.548522][ T329] usbhid 4-1:1.0: can't add hid device: -71 [ 28.554579][ T329] usbhid 4-1:1.0: probe with driver usbhid failed with error -71 [ 28.564152][ T329] usb 4-1: USB disconnect, device number 2 [ 28.597747][ T347] usb 2-1: new low-speed USB device number 5 using dummy_hcd [ 28.618954][ T347] usb 2-1: device descriptor read/8, error -71 [ 28.749054][ T347] usb 2-1: device descriptor read/8, error -71 [ 28.857818][ T347] usb usb2-port1: unable to enumerate USB device [ 28.953981][ T464] pim6reg1: entered promiscuous mode [ 28.959399][ T464] pim6reg1: entered allmulticast mode [ 29.069306][ T36] audit: type=1400 audit(1756063664.200:192): avc: denied { ioctl } for pid=467 comm="syz.3.45" path="socket:[4665]" dev="sockfs" ino=4665 ioctlcmd=0x9403 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 29.100141][ T36] audit: type=1400 audit(1756063664.200:193): avc: denied { getopt } for pid=467 comm="syz.3.45" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 29.130146][ T36] audit: type=1400 audit(1756063664.200:194): avc: denied { setopt } for pid=467 comm="syz.3.45" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 29.133312][ T473] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 29.149720][ T36] audit: type=1400 audit(1756063664.210:195): avc: denied { getopt } for pid=467 comm="syz.3.45" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 29.161379][ T473] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:41 [ 29.186588][ T36] audit: type=1400 audit(1756063664.290:196): avc: denied { ioctl } for pid=470 comm="syz.2.46" path="socket:[4684]" dev="sockfs" ino=4684 ioctlcmd=0x9408 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 29.254586][ T488] ======================================================= [ 29.254586][ T488] WARNING: The mand mount option has been deprecated and [ 29.254586][ T488] and is ignored by this kernel. Remove the mand [ 29.254586][ T488] option from the mount to silence this warning. [ 29.254586][ T488] ======================================================= [ 29.297292][ T36] audit: type=1400 audit(1756063664.430:197): avc: denied { mounton } for pid=487 comm="syz.3.49" path="/16/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 29.299704][ T480] netlink: 'syz.2.48': attribute type 28 has an invalid length. [ 29.780282][ T527] Zero length message leads to an empty skb [ 29.899592][ T533] syz.3.62 uses obsolete (PF_INET,SOCK_PACKET) [ 29.969786][ T542] ------------[ cut here ]------------ [ 29.975289][ T542] WARNING: CPU: 1 PID: 542 at mm/page_alloc.c:5225 __alloc_pages_noprof+0xe8/0x7b0 [ 29.984651][ T542] Modules linked in: [ 29.988630][ T542] CPU: 1 UID: 0 PID: 542 Comm: syz.2.64 Not tainted syzkaller #0 0043dfd2fbaf315da186ee57f2b2b1c8bfff300f [ 29.999947][ T542] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 30.010068][ T542] RIP: 0010:__alloc_pages_noprof+0xe8/0x7b0 [ 30.016056][ T542] Code: 00 0f 1f 44 00 00 83 fb 0b 72 28 b8 00 20 00 00 23 44 24 40 75 1d 80 3d 81 26 ee 05 00 0f 85 be 00 00 00 c6 05 74 26 ee 05 01 <0f> 0b 31 c0 e9 b0 00 00 00 83 fb 0a 0f 87 a5 00 00 00 44 8b 64 24 [ 30.035866][ T542] RSP: 0018:ffffc9000cd2f5a0 EFLAGS: 00010246 [ 30.042086][ T542] RAX: 0000000000000000 RBX: 0000000000000014 RCX: 0000000000000000 [ 30.050112][ T542] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000cd2f658 [ 30.058155][ T542] RBP: ffffc9000cd2f6c8 R08: ffffc9000cd2f657 R09: 0000000000000000 [ 30.066146][ T542] R10: ffffc9000cd2f640 R11: fffff520019a5ecb R12: ffffc9000cd2f5e0 [ 30.074155][ T542] R13: dffffc0000000000 R14: 1ffff920019a5eb8 R15: 0000000000000000 [ 30.082437][ T542] FS: 00007f8506e666c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 30.091509][ T542] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 30.098355][ T542] CR2: 000020000000f000 CR3: 0000000134798000 CR4: 00000000003526b0 [ 30.106341][ T542] Call Trace: [ 30.109748][ T542] [ 30.112697][ T542] ? do_syscall_64+0x58/0xf0 [ 30.117296][ T542] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 30.123413][ T542] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 30.129189][ T542] ? hashtab_init+0xdb/0x1f0 [ 30.133808][ T542] ___kmalloc_large_node+0x9c/0x1d0 [ 30.139052][ T542] ? hashtab_init+0xdb/0x1f0 [ 30.143662][ T542] __kmalloc_large_node_noprof+0x1e/0xe0 [ 30.149367][ T542] ? hashtab_init+0xdb/0x1f0 [ 30.153991][ T542] __kmalloc_noprof+0x26d/0x450 [ 30.158889][ T542] hashtab_init+0xdb/0x1f0 [ 30.163335][ T542] ? common_read+0x16d/0x480 [ 30.167971][ T542] symtab_init+0x44/0x70 [ 30.172235][ T542] common_read+0x1de/0x480 [ 30.176660][ T542] ? __cfi_common_read+0x10/0x10 [ 30.181864][ T542] ? hashtab_init+0x105/0x1f0 [ 30.186561][ T542] policydb_read+0xaa8/0x28c0 [ 30.191384][ T542] ? kasan_save_alloc_info+0x40/0x50 [ 30.196702][ T542] ? __cfi_policydb_read+0x10/0x10 [ 30.201873][ T542] ? security_load_policy+0x128/0x12f0 [ 30.207371][ T542] security_load_policy+0x162/0x12f0 [ 30.212706][ T542] ? irqentry_exit+0x4a/0x60 [ 30.217322][ T542] ? exc_page_fault+0x66/0xc0 [ 30.222072][ T542] ? asm_exc_page_fault+0x2b/0x30 [ 30.227130][ T542] ? __cfi_security_load_policy+0x10/0x10 [ 30.232933][ T542] ? rep_movs_alternative+0x4a/0xa0 [ 30.238180][ T542] sel_write_load+0x298/0x5e0 [ 30.242883][ T542] ? futex_wait+0x29a/0x7a0 [ 30.247396][ T542] ? __cfi_sel_write_load+0x10/0x10 [ 30.252652][ T542] ? __cfi_futex_wait+0x10/0x10 [ 30.257547][ T542] ? bpf_lsm_file_permission+0xd/0x20 [ 30.263396][ T542] ? __cfi_sel_write_load+0x10/0x10 [ 30.268816][ T542] vfs_write+0x3c3/0xe80 [ 30.273087][ T542] ? __cfi_vfs_write+0x10/0x10 [ 30.277899][ T542] ? __kasan_check_write+0x18/0x20 [ 30.283050][ T542] ? mutex_lock+0x92/0x1c0 [ 30.287503][ T542] ? __cfi_mutex_lock+0x10/0x10 [ 30.292406][ T542] ? __fget_files+0x2c5/0x340 [ 30.297112][ T542] ksys_write+0x141/0x250 [ 30.301480][ T542] ? xfd_validate_state+0x68/0x150 [ 30.306623][ T542] ? __cfi_ksys_write+0x10/0x10 [ 30.311525][ T542] ? __kasan_check_write+0x18/0x20 [ 30.316669][ T542] ? fpregs_restore_userregs+0x11d/0x260 [ 30.322347][ T542] __x64_sys_write+0x7f/0x90 [ 30.326963][ T542] x64_sys_call+0x271c/0x2ee0 [ 30.331693][ T542] do_syscall_64+0x58/0xf0 [ 30.336310][ T542] ? clear_bhb_loop+0x50/0xa0 [ 30.341251][ T542] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 30.347176][ T542] RIP: 0033:0x7f8505f8ebe9 [ 30.351884][ T542] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 30.371563][ T542] RSP: 002b:00007f8506e66038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 30.380046][ T542] RAX: ffffffffffffffda RBX: 00007f85061b5fa0 RCX: 00007f8505f8ebe9 [ 30.388092][ T542] RDX: 000000000000ffaf RSI: 0000200000000000 RDI: 000000000000000b [ 30.396093][ T542] RBP: 00007f8506011e19 R08: 0000000000000000 R09: 0000000000000000 [ 30.404126][ T542] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 30.412200][ T542] R13: 00007f85061b6038 R14: 00007f85061b5fa0 R15: 00007fff122ab6e8 [ 30.420656][ T542] [ 30.423701][ T542] ---[ end trace 0000000000000000 ]--- [ 30.430148][ T542] SELinux: failed to load policy