last executing test programs: 2.46112536s ago: executing program 3 (id=4): mount$binderfs(0x0, &(0x7f0000000000)='./binderfs\x00', 0x0, 0x2010860, &(0x7f0000000040)=ANY=[@ANYBLOB="3d8879"]) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000018c0), 0x0, 0x0) setresuid(0x0, 0xee01, 0xffffffffffffffff) (async) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x6) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f0000001900)={0xbe, 0x0, 0x1}) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000001980)=[@text64={0x40, &(0x7f00000019c0)="48b8c3e60000000000000f23d00f21f8350000000f0f23f82e0f01cb0f072e46adb805000000b9060000000f01c166b8d0008ec064400f300f01c58fe97812c46436420f00d8", 0x46}], 0x1, 0x11, 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f0000000080)={0xa, 0x7, 0xa, 0x0, 0x0, [{{r0}, 0x3}, {{r1}, 0x9}, {{}, 0x5}, {{r1}, 0x9}, {{}, 0xfffffffffffffe00}, {{r2}, 0x7fffffff}, {{r1}, 0x3}, {{r0}, 0x2}, {{}, 0x7fff}, {{r1}, 0x8000000000000001}]}) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.4604603s ago: executing program 2 (id=3): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r1, 0x0) preadv(r1, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000002c0), 0x0, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r3, 0x6, 0x1, &(0x7f0000000300)={0x7, 0x8000, 0x1, 0x4, 0x3, 0xa7, 0x1000}, 0xc) read$msr(r2, &(0x7f0000001600)=""/102392, 0x18ff8) fcntl$getownex(r1, 0x10, &(0x7f0000000100)) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x4, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) setns(0xc9, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) close(0x3) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000004c0)={'ip6gre0\x00', &(0x7f0000000500)=@ethtool_test={0x1a, 0x8, 0x4, 0x1, [0xffffffffffffff01]}}) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$netlink(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000003c0)=ANY=[@ANYBLOB="2c00000013002108000000000000000002"], 0x2c}], 0x1}, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) memfd_create(&(0x7f0000000180)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xcda\x9b\x11X\x0e\xa1\xcf\x1a\x98S7\xc9\x00'/47, 0x2) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) setitimer(0x2, &(0x7f0000000200)={{}, {0x77359400}}, 0x0) r8 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_int(r8, 0x0, 0x13, 0x0, &(0x7f0000000280)) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000440)={0x1, &(0x7f0000000480)=[{0x6, 0x9, 0x8, 0x7ff00001}]}) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000581000/0x400000)=nil) ioctl$KVM_RUN(r5, 0xae80, 0x0) 2.352460512s ago: executing program 1 (id=2): mkdirat(0xffffffffffffff9c, &(0x7f0000002100)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002140), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002180)='./file0\x00', &(0x7f00000021c0), 0x0, &(0x7f0000002200)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) syz_fuse_handle_req(r0, &(0x7f0000002280)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00', 0x2000, &(0x7f0000004280)={&(0x7f0000004340)={0x50, 0x0, 0x0, {0x7, 0x29, 0x7, 0x22110039, 0x1000, 0x0, 0x7ff, 0x5c, 0x0, 0x0, 0x6, 0x8}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r0, &(0x7f0000004440)="d5c2280baf4e05cfa1d1112770cf43a123827586f0f2675b130041ff58ba6533ea7947f2f65b1d458fe88a96133ea3927f41fa6976fad8c967c88679769ee674b80debcd1ec6ce1eb490888bd66a52141fa82f51882b22a8e36ff462b51560307cd0048156800ad137f359719a9c5d6ad6a8c999984f22461c4ca6614ca4cbbd5e9103a3459228e3bd35e3c1cd5f2a83fbefafe7c5a39617ba1d856f37977da077ffcf4d52f5bb3feffa9e100b0279cb635a61ae9f5f4491bb1c9f04c041818a1ae9a25cbca38c4b4754a8be4f52db20ca464b3b4faf0ea8ff193b414e7b7a4ec8aec2e77adc43d09c62d37fc0aa6296a56a9445f264a245d41e77de43c2694cc5885ebd454a3b78b60172e3e6a2fd79efa8b5fbbe827512aa0656920858da51616244ad32e53ed039a270c042662bc966a8fa05e23a51c76585a6f753e57c63b5a1dd11c4ce8773702c5c759471b79ee9bed600d99853afda9b675f071bdf6ff4eb99cb1ae0128ac1f8132f9b7bef82221276395e59f1323c9f9f6bb937a9db0bc2088670ffc3e6233ba73d4e324df7bc866e84e82ab707ab8aadd593913dd3533cddb396e804a63155ad6911962bc49bad21faba90b5570b62d98eb5328214a7198b36ea6df9a72dc248311040e01539112e1d6bcb4ed9d7fb70d22768ec6603e4727b6ed2616eb9108524985ccd70f1361f68b1fb7088829acdd59ec5af9e84409737f0d852a3c55993cb7398b5640c458bc036115b86de7b8e68f1cff882ee5707040571c3e5c9602c773459cfecad4917d8ba2902bd64a676e2c6e507d06dbc806c13c0fd18175087440ce7d7300dfe745b8e98ac63b400e449a3f2518c6112c9864fde68f580ebc2d72e4bbd03f16a7289be813c258b02f76ce901afdafc69046c947c9e801ac635b2a95cca291c052c7f8149c92aaeaab41edb34a70604a7538c4bb6486b983416843fe6a65d7b828d66deb991e71526b7627e71c6a795a02e787bc561ec4b65d4742a129c59bc71b323850cb416f3d32494d6dbfe3ea73cb473b093ae0b0ebbbd3e3251ece756b3cc381f05ea1b8c3f7fbcbb16fc446fc084725e6c3a608221aad8d8179112f9e5ee3697346a0dc0645e530df523cf4daea14764c25da2da863adebaccefc2c83a9257b3131ac2fe04a27bf3aea8979b6f3091b4fef99e203725368d297bad3b020273d0b606d2368e2ecb0776349cb86bbcbaa5c910636527e3cbeca06b4135170d8808c5f113fcd77ecb2f099d1e663617a46ffc5275c8fcc339d315ca1583f66fe7a7e6430405c0be889826c07fcafa17f04e08bc39570a1f499092d390c5dba82d259f652307ff941e9f1f569a48144da846f14452df295553de6ef4e9ba0cd98dd16cf89d8bead08eacd4eea71cc5f8232349f2d8519b1172c724d3bbc415c19c9e679b5a96bc9051cf6f243f243366622023ab1b7039a89152e7db97f291bb3f0213c445c25caf5f0a5a2b382c841cd8a490dc97d008966e94ed0b5ce07bcc0c13b39c349e4b596147a633f3a73ab6012a1582d3d283293bd7c01f99cdbad8e18d24867c39ed0dc3fc3cc800edd23af24b225acb2cca5aa264bcda40e1432cf2cc0050efdff48fd49ae4225a983d1b12facbaaba73294eb225fff64a677d0ed2cd71bab61b3fde8a1fdae638d2036283a8a4ff5a548d05cb706f56ce7e3f55a688fa6c70393c53c33be11f34a38f61f80c8e94e50fc9d7c3695d234705bb9e0b2a8316cf54d7963f548d49f153bf796d0970ed1264c19d79eb77fd0aad4844796cec73a08206b9eca76f2ad76318a20d52e7d3338eac40d03775cca0c2b29a451cb10bc141289c2703198e7137200a360463000fab97d0da72a7b4e8aadfa8a2e559a7d06bf49d6d4a932cb29994ef7ca0c1beabf05b898bb2338e89a67373d50614300f13523fe451d4058e5a522d364ec884099ee3c6e6db8d4ec1e5dc08d127b6301a308a1d6798878c28ef828b91b529a22b7519d249a189a7eb942b94ce26148ea8bf16a44261cd9691ba980ec2d0c710dbee41756cb39b88213ad5763239ae7636e983580c41a40b0f3a3af9fa6f995ed1981d073f63a623554bb01869bdfda190bc8d9507cc067b897e1c5f0d087cf8dfcb171169541fa3cce7c3a620544c74f2d3234935a0acf6c804c43992812925cbaaa24f497e7a00efb20c45c7acb80adb3322cbe0f08d1015b40f5ae1366003ebea977b7b95f803487d10aedca3fd018cfa7b267dae604ed0ada202cbebd731f86b7c6764911d4ff0c75a318ee43b1b556781ac58fbd773b2bd0dd693f9b12fa149bbe392cb2d6bf72015912f4a120e47654d42d14107c67b4502b5ad62044d0022c7f8b255a3e46da4bb8f9e44515e4076ce7b1aefd57c4e264b2cbee4a9e8612ce8517b028067644c927a9ce7564449c8fb0471a87b9b76f374c7c2559379a3004326bdc91be5ec52672dc5fac0883ec527f2a1248601bb9267c3123568b815b90b40ba06c250e3068dee2d7fc232141eaaa130443a5775d049464ec454a7c980d9eebaa4f67a75075a6bc28ded9a5f07fe658a2b9eafa37f14055155409d1aa50be6343d13d515d0531b84644d2f58c280d6d008dee95607f67eb74c900f664d97f411f4ac6afc18f11b6fb75e78b3ff25680ed3bbf5b20969678475b86faa02a751e4cec87735645753f245047371c9e6e2e7ab5a9ea3182b4c96934a21b9df3628b478f5ef705aeda49a0609d4b8f5bf34424581557d029438306002fd4e9cff5a2d4e7d5e23c2992032d314b8fbb46ccda250070fc1b679c9c8646c5fe22d8fe2e0fff73d8153fc46ef7885aeaa2d1eabbe455544d46fdef8e3ef9debfe589870942bcc7196e62736e927c311782b5e4da2889d530a7c1550bff4909d2055941655cbcc5c924a477c80fc3b8a904cd9e62f5fb005b5b00154db5becbe327c0f3ec8314ef3fb53977ec24ff7d15aa83a13b23ab99c5332306023005d2dfb70d3ea2aefababd019ae16d304c083e38997cc94bdeb746fc151849c98dc2a23554e6fe789d3aba8bf4e31133c7f93a3cdcd884271dfdd2c45be398a5349ef5d08456178dfafa31cb4c607f09394d71b3405b3d615c7c59c125db88f72380140345d24c56094711dd833221d6b7c5864d049585605c1301c31982d19e403b601b797fe99d0bbfe30d647a913da72b4c5306f6123e7c572828308a9a8f4c686d07125d0006229c2e890ff7d3c354dde61ccd3b26069a81a98e112e61a930f253d607cda5023f002a09df6b1371638d9661c5a06bed166434f07120ad21476de8ad47296af4b449d581cddc74f9be42a84596fb0634f330a856216a9b32b080c8b66e9f51a758b9ca2e1215ddfe633714ca512032f6547217b1a60fcdb27ac8a04bc7851718b38607bc92c13118a323c3221bad99a8639762abcc4a08654da9938aeb301c55546f5ae7f61439dd883a1b2dede156a57c805ab12337d5381a2fb25b32916a8827fc4de8e2ecc70eeebeb01659d6bf88055477b863fb897d5db275a0c222d261e7df79474858b721e57747fe8997faaf36f5f175b23dd3c5efb2b93fb5824da18d635cd7027a3b0b1c87e7c90a5681682b8a7c47dc82fdd3f329c7b60270100dec8ccdd310245b92f4b0bd9a92e1f2a5733b1b91966be15a4761b06f6fe3b05b60ee7964b4d028257c2210ca88031db0590190d3714c1b6ec86e2821dca03db2fc0c9f0ad9800d1773c8037e9b38c7eb7c99618b731e0526f8453c7e1bb67cffcc2d96cc297e1f917b13dd7dda2a8b12191ed107c1e076ffd4965b9415f830be97935cac23a87f07e26354273c2663c7ef19a27dfe08543fa057e1285c909051602981f5929078214058684bc80bed493f6ef853012cb654d180e414fd484f5cb2cfd06c9b753f417697ff42794649e05fcaa3d53ad0fdfbb0db57dc549115e59978b14dd621370d136176098af2f39a2de72482a29b616e8b308b3d9b46ac9abf3d57ff89fe59b5a97966cc4b97d06c20ee4fd765e1c2abce54dc271a7c7efe656648800c27a9988583b4b76572222cb28916b9ff5f6f649de93923179809405c879a90cb450f604cbe8af55cf2a6d844a59ab0393b394e09c79e1b3c403af6eba69330f6969f78a49eb7022e77a39363f11e07fcc69f670f63c11497352f3f5bfea0aee446da35428cebe28f1c2d23ef3ff97e16ceeb2f88ab19b2b69dcdcc81b947b483cc06c776c52232489f86f4c377eb38056042e2e9e0943fc0ef1490df472b9b244235598894a2ffc296f0a2e4257baca6a3ea8cfb1a22ea8295ab9e5faaa2a9e964ae7625dbf945cdbb369265f429d475ab69413cc5bcb89af57b1b966bd0076f799a401d4b46e5045aceb1ef36e5bbfb037bb7681f2a38ef1df9b84baa3598201d13a813165355bf052bb5e456dc0abdefed995b4eb37a39b313af800f6029243a6a7bec75a23389a90034cac8df6713b919028a14649d756d0093550278aad494de2dfeb76220fd3ee5be31f73839ace7f0d6da650e26f5ded30471ed55d2e814fc1b89102e5917b4e58840ecc211eaffa5a2937abeb882ccdf29308e3ac30e23d66ee79c29b4fb7e793a55e344cac298e30f1ca3333df8b58f43126a3404a61501ce06b75e6e6a4bf13dbfb05efd7b9b4219efd428c8f7f345884640d19f5515abcce05f315f00e65d9aa8022890a23da45ede06f455d66e0c96bbf7e9cc74eddca999a51174b4784eba8a9ebed13415de6bd0f160443d43b78181cfa381313a54e25f6751a38f290e5972ff7f70692e18c4737af2a7f6d4eac52ea594a22be4fd00fac1484e6d2d4d3196b49212b49598f5bc77b34d8a3633cf7212c869557d6eb27bf0d0a02555d9318194e9de9c9730ac72daee7cad6c2d4b248a8744515670766a8f1c739917fb859d98974532477989f4c24345f120f5320fdb8d8d56fa6ff2511e701bab399513cecb3e740e3761d02685a765f5267554d0f9243b51620197adc3b561b59c58f334307220db357c1121d7dbf593898b5d2c505f333445c084a6cbc6a7e5252724c83fcee85e304534780a01e7ecceb2ef53ffb6bc6cb9051b1400493ce55d62c01e972fff3cc7d0b68a2dd4d263c9191df1b629e323797f570083f122db3df6abb6fd6c4a351bb7500c7241e4392ac76e04259968e517a43e907cb0b0533d6750b9587a1a5d852639c6b789d333e848e3ad66cbf19c5ee5a641036cb7a858f822f657dec36cc134d6c1a629cfce1f1e24dbb73d09fba04f53b2c6309d71d92211a1f08535244eefcbb52e095626bcc78b950db1cb8facc3660fa705dceef155b00aef3291367ffcea06b5abe588bbdcea2637761308dc65509798b6a494dae4a75c1922c1234248dbfcabfaab3088a0dad09a135a45d75105314020f3ba8901dc39ee624a32e9f863ff55844974b44e57b30302cd0c349f3cc091befd5665f918c298ba89454fb811ce573e41f27490853a52abd6144e85d77de88c3f2e5506c8de40a3957e65936f3b294ce92610b63cec888cb16fe0e8a7af3dd142da96b57f602cc64ba69966724584c2872e5fc42348a324ff082a3ecfded82c3e5b7292d3726c4800176acab6a7a1479a0b5fea79f299e90ffdb1b3843e2349b8f8dc7881145b3796380474c2ceb57e27726c9e50b746a2b12a214fea9cfd6c668363fe6e402710665118928fedb2f4900322b0c7d2c348881ea52278dae765c14b51fd5e8f000602aa3978d83b76056410c2260931e35d841793c8a36b191f93c33c0e4e6367ef45a1cf5145d774861224afbb11a7b77bb94492ec49827f713f8309d80d22e17701046e04c5b277f7b423cbbada01e6d40beb56e755e583b8f3de4b67c4b5ac83771b805fa7af49de2fc8b9a223293d83e7eb4eea3a3af1d1221e5d458e7cab60eaf1b51550a1b125ce018d76096f16d922f4aba48a728ec1b7d4812fe2ca789261b6d8e0c8edb3ba9007649084899c4f6b7986c1cb4a98d412c801fb91675ee42e2bb511bff6700772d3c03a7cb6adb41cbddc33053f8f65c164e9bd47b931510046506b169216d0a04edc479bc51c28acc536ced3834a7a9ce8fb55b72fa186a559437bf41f04b733e05986c915bc19f1b2f99d3bae6c13873d32e3c809b71881c3075f8dd1746f36409ac7934c25236ee2752560fcdd5175037a6fc5f0da58a229418ce30f3e64f9eb6ff3fe4498f47fdd69ceac5e792c8c9f087316f334b7f75e3432d3f1d03ee97c8f16485ec906c94e6c9580f7d03d98a8da85ec118b77c6c1d3b2e99fbf4b45e66cb4f8817f786d1f90e1e5e250be8c240a9648a219a02e62acbd72d1b0c0b42c75065a35664ea6a03cb05ea179f2e8e50e3d7ed53d31cdc10cf5fce48781fa338e3ee819f410540f045cb0edd7b2d219993faaa97cf95aa6144e889a02069421291d05eade30693a751039fece452c22d1afba081d1c40178fed7684cae475fcc365484118a184670cd7aa2758bdb01058ea9b244d5241f627bc5be11c9395e3cb839b0eac7842a312e1fc8b4ddae2aa4ef907ca5c9b847785051323e16d5497c4424289496277475bba67da750fa05bd8be730e4aabaeb94641fa2263dd3d4eb511b4fa40b8cf8b16d7aded1163f2258add79b04e1eb888afa27d057de2523863fc2da38d44cc69ae2d455900eede5fce69d7e9f8707cdb2456a45dda14d257eee4982f86259b855a0293068aa4aeff9439bc06c8ed5a370fe46fa88fa9bb92872166ac69152d1cbb4720eec5b9a057890cbb838aef12091454fe721395b46f9fa29ec1829fedf65aaec1176bb9eb15511bd77e7d4fe7321b3e0dfda95e5c90c3663956477885d6d94b280f58edbc77e864dca73536cd4988bcde2a3edb91704ad59148d85a001e393cebdb56ee088fa1033cdc6fbcbea30e2974035bfe29cee1eace13e30950bb4658886dae7e565ffd7b71e41feecbcac35fd97c81a8fff9d2a1d43f183c6e984671e06645eb0a60228d1b6c12c28bc6eaa4b9125c57b48ced2e199ed3acf12dbe10af4a56f2f5dca829fd07fc3f7e0de6913c73be0ada3e43bcbe70de784de699d0b51d7a56a3eacaf5d7dcd77d73cfb82e04633574213e05dc98850d822bc6dc90dc3fd6184296287342e2243fe6f0cf94e6d02a1b900d0c718e2afbe7fea2fafa375f209fb9cef5d844b861a1029aa3dd7081e81fe6501bbb413dcd23e013f279ef87e082335ade324b7688054992ccc63fbf9153213ab6d07ed0b79945d19639aaa5dd10e53aafe57f1e323300246cb1d6ede1eb1f319ca6fe1b0cc8e733b34818425888110b6eabe2db302310d0a8bcdd5342146b29c535cc9a95a455c8926d77323a31b948d47dc611815a329654a252fd09dbcec5f3cd8bc7e465759eb8e72ff6fd4ef1f375e4e8762a58148622d14480b7bb9aca2eeab3367a7376c9c85e6ba1735e56a2fcc6baf92c8d21942883f318eab7a568fc7ff01885a7089aa7661b15d73799bc0b8f8ce6a3b61adb6949965a223850b6825616c036e099952e04fde7cf086b5e76d45b86ab78b322f9af580173f2e798a39df7cade0d365c9d46d3fb36970f8a99d7b20a1b275afff852126f21ac24ca8c34deb49ba511f4d9edb4f56941aaaa477253f9bfc9a25a2694bbbe3b917074dd4eb6f1be20395ac33dd932a7ccf0604d64257b5af3faf271c145c190a528e471a7f23a53b5f9ea1bd0cc36410e9c538e91dd01d162edde856087b60dcba2042e65b6ae7b81787bd3308db9eb025b6fd930a9eb74a30883b83cfa8be5270dd3ee3408db7f7b136adebb3ee30f0e0b8835a0ded325363e4a2991cafd4a73483954c0f5d3358b25780608fa48f3f527c7e617ec12eb017df33f5088676d8bc476da251e608394e3d8fc0883fd4d1804f8e07f5e12ffa4ee80365a88abf29936bf1b255539fef95f5cf3bebcd26817edb28e7b6adf4851dcfe8aa1aa097f67c51557326ccf9c46ee2780d491e87774324d4dcf26f2e472a5e199b0cdef01094ea72bd5ad5fe1be6c9d545df3dc5de550665d220718a2c0baed2833cfb1428e2d1c2b9ea1e29f4b07fd6c51492643d4000716cd1e8a4f9d58b6b04b805d8962495323fd62949b17348418201664c6f2f651f99d73f8d17bb5e52dba2e6f94fa33f816d74bb6a45bd6cbdbd07f530406227c8fd11f390e805bbc17bc0e81076a27c0be023b64777afec0a7a0c3f53f03bc2ca72ae2873d68217a1a6905f414c2cb1b9561dfd07850a026da5f5775a66f8f3a6bc29b48c8a81b06ba30994ba8e7e233e3a3a5d886767ea6de91fbfc0a594c2375d62e71c7209d87d0f6c7a79a0d80da328e93f08650ec745495c771410913d094e4190075b7225761172eb420c82ab493548f6de38e17d3e687a89ce77c67c58b875c48c8a4d1664cbc6f67df357e040444fcd515d92d5823fc3ef6485208b6f3eda8cd09ea3b004f7eb06ac268ae8c3bf571aa3f619222a47540f9af340c80c587f7226e3d715b18c3ee41f64777d3a0a09f32190ad67922f6ecc63c956a715c3c42a6aaaf5e588d119210083ceaa414820b62fef87a678cd3f24f8fa3cdb6629b041cd7555974313f56d1b0e117ea925dc95e18b5d3f4ba9812f1067022945c3f5d547370d45853c4db3c9ca4436d7e649e1ac3ec02f9c1e9139849b46027d4b276cb0eb4b09848999f466f528290e47ba9540ceca89390db3fcbacb1d566e22e917f01f4442bd4dd0d350d057ffdf5b3549ca559901e6ff5147bdc25c11b23f1678f02c20e4e2e6f339b262e2b82eae0b15b4227f1d514f99ec78fbcf80c8f6f243536f2d7a809de05ae5e1d676fe950ad3513f801bbe4d16737def4b5ec4b62f8562cd5432bd372645202edeb286662d7e8d0dadac5b91c903c2756bdc4f5a7c931f2c3f7feace2b83f5459a196000e2ed1e1b2accaa9d637d5e408340161331c4b0047bf2ab31d317bb1c8f6e1b3d52f9f240bd971a447942dd4b73301781656aad9ce9b01aed907b7eb3a78397b97e601b04a4cb028d327ef32cf20c34e8dad9c9b1f981ab5c06a2b0271852e2a1016ee460d8568391c9ece5a2b8f29cbc6f2d6cc2e66c30c96df548e67dd6ad8c1ff09dfa22b2e8b2c52a3948c4febb09e3c2d34c0604a5ef930cd53be69a4bed9c9ee057178ece02a6b4df4624191590952888bdfafd2dbeca128d500872a8b236fba9623672c4dc15f56a761ee0c54026112fc464f72d3039587f009b94930dac0dbe444a939b38c0f5bce7aa366bfc2bb909db231178228846f71a56ab219e28cef1b102c1bfadbe8f0916d10a573b8cb38cc2cc2ec496a410a4e82847006d2ed4bac927a63a00416d0bfce59cc69aaf78ddc9566f23582999a655c8ad3b217486fb5a037ce089baf344d55bbd475be4e90b10e92c9c1bae3202c2d63355549f0ac95058724fea81ff9cec027e7b93e2cee43af81c6978fee5faf6216118785251b8ca023115b2f87d5d4b10c29aa3616628ab40a8ef36668ef57d7f9be505eabc01947ca222362818a71b3d63e5725a4d8a2c619b1867f70daa07703360d026d6f65247330be1ba84ddaaa7779591ca261beda4f4c094af65c5c276fe3bfb89f067c8c54af67e78f61bdc114ed4aa869c3adf282d7a8e7272579e9fd9e47611e0dc89f97561110e0141c69b1fa114e27b3d1e2c825ea008a370e08cd0a0610edef20cdd8a7cda0922fff046edfd2ff391a10ffce5dd6045619ce9af6b03f4193d858a76b201ed5beb0f11321707b7b593b23adaee4a0c0caf39dfeebcbd2948030435dc94ca00990c728502ec4686194f0f454304a422023c1b2c5b1ebbcd8cd50fa2d11361e3bbdc306e2739e27de300eda27b1c1ea62d773104cea77c18037c6bcc76423621b45abbe789b384bfdfb46efa1627ff29d9d840bf6e1f05e7e13fae6383e42ce153dcb062fa0cefd0fe9298ddbe77fd78d7036b5a815504b48267203da08ca685bfe8ae89c031074bbe5d3d6dcc6a3a8a8a4d3102765c3b714867f4516df62f214351b97bb8b5697a9f9a9dd78627342b239c524a3943d1d70f8cdd7391f05e7395731a8fc05210c6733ea256040bbbb53389229b84dafaaa3db1d5eca2971d9e550149461f1a672eae2319a99beed48934520666bc54b63085a744b5fc9a9b089b16c50ae945f74adcd4c5d064a12a6e103ef59bcc035a755ad31836eb7d04e5900d3800c822b96b466a9f6611f46b8a7d6131f91c625a5604de5bf01e5ca5d99a714c8dc1160260010f8d55f9125ee453b61c911bdf0824caa804c76d6512802875c5433de9b2e8b6c579a67fec5d2bc64ed3d1c313854221b75c9a0ed42af6f5354e7b1d1bf8661baa1261e68fc20d14b5652d25a536f208bff2b90fefa163a232696e655bcf95bed39355ec865e272fed582aae18858f5096ece40b9108efb00147f9c2ced59bfe2a79826851850ed95b35908dfb4d9ab7da0668a1fa8933ac4f6534e9598481477791fd1a1c269011ac9fe81f0491790e8aac121ffc00e38a7619a1855e6899abc2c670375a3ba4ac0cf652da89a70628cee1a35ae17b3490102e3c88ca324d06fce2151bc9de49472cf6e76ccb16d2a9cbf4161812e2c7758d73631024190fe9b71935de6968b289d3503b497f3f4b6306446ae9c312f8f1c63c1f7e62652173d9ed48cb128815bd44a12061f9b73fbdc6674ab9e0d01807f7bcfa0aa59168420e5ad8b72d7b576e273a1d229934fce2867689a41cb17767cf9defe1a96515a677ba08e10e187a3ce2f1d78e6b43b0d46c36163a1967b203df4f53379ee98422e973ab5c090adff21b5cc84fc78358021f681a0f0fd744f687e4f6c295470bf8f548d2d3dc841481dd51db9124cacde83bc9fef44a3e69e1cb28579d897f3013ac6133395328247fdcc152e5563678258936576196ced017c79bb6a4ea501a44cb25e5af1697afbdb3abb316837470ffdbe985ac3967334a90731602d3fac4f5c2758f04ec9c161a7cf330b7c7549fb62e6c15d07a7203c94edd3a8141c91b2029d6a90b14322337e6610822d9d7bff58c10d9c6cff71822f6456a421a65fdaa5d2c793f256a4e7a39f0d85d65fb95479eff79345c0615c9bbb4fb3324f9360b70dc709b0200042e8461b8cee9ce30beab3e276df48f41f001262fc14153f9764e13b50397442e00d7b11266bde10a3b7f83818086ff0015409679e4472d9e0215804fa9d21cebfa5cb5099cf88750cbeaaf58c2743f2746ea4cb73760ba88a07b91b68553716d563af5d7702219d0c600916dc54242d825c6d68320baf234a39f0b9ea9e6a4a72c4d5829b2f28508f54b33c7e0394a43fe23e7940d9b04bbe790d903a2d2c979e0ea79931b934d094fa2d5948c05cf278c341d788f2061ff617c9fa4700b1e1f0fbfa1b8c42848f2ea01cd318a8748c3336622ead25527ddbcd8a12ba3a5183f4419deb13558ed0ec99e73448c21ede0dbee9c01fc7675e54c60d4dee29c0f8fe81af6fe7b726f5d3c50dac634aefbf1ca6aa4df1b340a4109acf30939f6094c8591218729788111bfde98cd96d4b04b25bcd1bcb7f826241995573bae", 0x2000, &(0x7f0000006440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006500)={0x78, 0x0, 0x100000000, {0x20000, 0xcbfb, 0x0, {0x5, 0x0, 0x48b, 0xa, 0x400000000000007, 0xd, 0xfff7ffff, 0x6, 0x101, 0x4000, 0xffff1854, 0xffffffffffffffff, 0x0, 0x3, 0x1}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000040)="580000001400192340834b80040d8c560a320000000000000000000000ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000200040810000e0c9e35161b4e352d753079380800014004000000", 0x58}], 0x1) fchownat(0xffffffffffffff9c, &(0x7f00000065c0)='./file0\x00', 0x0, 0x0, 0x1000) fsetxattr$trusted_overlay_redirect(r1, &(0x7f00000000c0), &(0x7f0000000100)='./file0\x00', 0x8, 0x2) 2.236006455s ago: executing program 1 (id=6): socket$nl_sock_diag(0x10, 0x3, 0x4) (async) r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) getsockopt$netlink(r0, 0x10e, 0xb, &(0x7f0000000200)=""/22, &(0x7f00000002c0)=0x16) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000140)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000000140)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) clock_nanosleep(0x2, 0x0, &(0x7f0000000000)={0x77359400}, 0x0) (async) clock_nanosleep(0x2, 0x0, &(0x7f0000000000)={0x77359400}, 0x0) timer_create(0x0, &(0x7f0000000040)={0x0, 0x12, 0x1, @thr={0x0, 0x0}}, &(0x7f00000000c0)) (async) timer_create(0x0, &(0x7f0000000040)={0x0, 0x12, 0x1, @thr={0x0, 0x0}}, &(0x7f00000000c0)=0x0) timer_settime(r1, 0x0, &(0x7f0000000100)={{0x0, 0x3938700}, {0x0, 0x3938700}}, 0x0) timer_create(0x7, &(0x7f00000001c0)={0x0, 0x13, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000240)) r2 = socket$inet(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000300)={0x2, 0x115c, @loopback}, 0x10) socket$pppl2tp(0x18, 0x1, 0x1) (async) r3 = socket$pppl2tp(0x18, 0x1, 0x1) chroot(&(0x7f0000000480)='./proc\x00') connect$pppl2tp(r3, &(0x7f0000000340)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x115c, @loopback}, 0x1, 0x1, 0x1, 0x1}}, 0x22) openat$kvm(0xffffffffffffff9c, &(0x7f0000000500), 0x101000, 0x0) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000500), 0x101000, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000540)={0x0, 0x1, 0x3000, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000540)={0x0, 0x1, 0x3000, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r5, 0x8208ae63, &(0x7f0000000580)={0x0, 0x0, @pic={0x3, 0x7, 0xe1, 0x81, 0x9, 0xf9, 0x40, 0x42, 0xfb, 0x0, 0xc, 0x0, 0x7f, 0x4, 0xfc, 0x38}}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000007c0)={[0x6e, 0x3, 0x7ff, 0x20, 0x3, 0x2, 0x80000000106c, 0x100, 0x3, 0x80000004000080, 0x1c00000, 0x8, 0x0, 0x2000000000fff, 0x0, 0x8003], 0x1, 0x3c4210}) ioctl$KVM_RUN(r6, 0xae80, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000003c0)='./proc\x00', &(0x7f0000000400)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000440)='./proc/net/pppol2tp\x00', 0x0, 0x0) (async) r7 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./proc/net/pppol2tp\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) (async) r8 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$SIOCGSTAMP(r8, 0x8906, 0x0) setsockopt$SO_TIMESTAMPING(r8, 0x1, 0x40, &(0x7f00000004c0)=0x3d, 0x4) lseek(r7, 0x1, 0x0) (async) lseek(r7, 0x1, 0x0) read(r7, &(0x7f00000004c0), 0x1000) 2.180592937s ago: executing program 3 (id=7): newfstatat(0xffffffffffffff9c, &(0x7f00000001c0)='.\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) setuid(r0) (async, rerun: 32) setreuid(0xffffffffffffffff, 0xee01) (async, rerun: 32) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) (async) r1 = socket(0x2, 0x3, 0x6) bind$inet(r1, 0x0, 0x0) r2 = syz_genetlink_get_family_id$gtp(&(0x7f00000002c0), r1) (async) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000700)={'syztnl0\x00', &(0x7f0000000640)={'erspan0\x00', 0x0, 0x40, 0x40, 0x101, 0x0, {{0x19, 0x4, 0x1, 0x23, 0x64, 0x65, 0x0, 0x6, 0x4, 0x0, @loopback, @empty, {[@cipso={0x86, 0x4a, 0x3, [{0x5, 0x11, "75312c46d46340c380dd04faa06fa0"}, {0x0, 0xb, "b1e58dd7ca1174f309"}, {0x6, 0x5, "060f49"}, {0x0, 0x10, "01321b6c2d972d43e806e4254f6b"}, {0x477405885fc651ee, 0x9, "42fe2f7d0531b0"}, {0x7, 0xa, "7682fef58de503c0"}]}, @ra={0x94, 0x4}]}}}}}) sendmsg$GTP_CMD_GETPDP(r1, &(0x7f0000000400)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x7c, r2, 0x300, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_LINK={0x8, 0x1, r3}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_FLOW={0x6, 0x6, 0x1}, @GTPA_TID={0xc, 0x3, 0x2}, @GTPA_MS_ADDR6={0x14, 0xc, @dev={0xfe, 0x80, '\x00', 0xf}}, @GTPA_MS_ADDR6={0x14, 0xc, @mcast2}, @GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_TID={0xc, 0x3, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x1}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20004001}, 0x44084) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000540)=0x6, 0x4) (async, rerun: 32) r4 = socket(0x10, 0x0, 0x6) (async, rerun: 32) setsockopt$sock_void(r1, 0x1, 0x1b, 0x0, 0x0) (async) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000080)={'macsec0\x00', 0x200}) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f00000000c0)={'macsec0\x00', 0x1}) sendto$inet(r1, 0x0, 0x0, 0x48800, 0x0, 0x0) (async) sendto$inet(r1, &(0x7f00000005c0), 0x0, 0x0, &(0x7f0000000600)={0x2, 0x0, @multicast2}, 0x10) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r8, 0x4008ae89, &(0x7f0000000180)={0x1, 0x0, [{0x10, 0x0, 0xdb57}]}) (async) syz_extract_tcp_res(0x0, 0x9, 0x108) (async) mount(0x0, &(0x7f0000000100)='./proc/thread-self/fail-nth\x00', &(0x7f0000000280)='hostfs\x00', 0x180402, 0x0) (async) r9 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r9, &(0x7f00000004c0)='100', 0x3) (async, rerun: 64) unshare(0x40000000) (rerun: 64) 2.171266637s ago: executing program 3 (id=8): openat$ttyS3(0xffffffffffffff9c, &(0x7f00000003c0), 0x2982, 0x0) (async, rerun: 32) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) (rerun: 32) ioctl$SIOCSIFHWADDR(r0, 0x8932, &(0x7f0000000080)={'veth0_to_bond\x00', @random='\x00\x00\x00\x00\x00 '}) (async) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) fsetxattr$security_selinux(r1, &(0x7f0000000040), &(0x7f0000000440)='system_u:object_r:su_exec_t:s0\x00', 0x1f, 0x1) 2.109565518s ago: executing program 3 (id=9): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1fe) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5) r3 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r3, &(0x7f00000001c0), 0x10) sendmsg$can_bcm(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x5, 0x800, 0x8ca, {0x0, 0x2710}, {0x0, 0xea60}, {0x0, 0x0, 0x1}, 0x1, @can={{0x3, 0x0, 0x0, 0x1}, 0x3, 0x2, 0x0, 0x0, "f887fb21349a2fdc"}}, 0x48}, 0x1, 0x0, 0x0, 0x3f9bbfad8c226d7a}, 0x20000040) sendmsg$can_bcm(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x5, 0xf52, 0x0, {0x77359400}, {0x77359400}, {0x0, 0x0, 0x1}, 0x1, @canfd={{}, 0x81, 0x0, 0x0, 0x0, "595b6028a0e4931133f6d9919fd4a457896811cd874f3c107bbfc1c8831026f4079ba2b35d0600e02216198977dc3d41ed0880c64c39e5ff0f00000000000012"}}, 0x80}, 0x1, 0x0, 0x0, 0x800}, 0x4000) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f00004aa000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x485, 0x0, 0x3}]}) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x80, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/net/bridge0/brif/bridge_slave_0/multicast_router\x00', 0x82041, 0x102) writev(r4, &(0x7f0000000780)=[{&(0x7f0000000500)="dc688596a1", 0x5}], 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1fe) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5) (async) socket$can_bcm(0x1d, 0x2, 0x2) (async) connect$can_bcm(r3, &(0x7f00000001c0), 0x10) (async) sendmsg$can_bcm(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x5, 0x800, 0x8ca, {0x0, 0x2710}, {0x0, 0xea60}, {0x0, 0x0, 0x1}, 0x1, @can={{0x3, 0x0, 0x0, 0x1}, 0x3, 0x2, 0x0, 0x0, "f887fb21349a2fdc"}}, 0x48}, 0x1, 0x0, 0x0, 0x3f9bbfad8c226d7a}, 0x20000040) (async) sendmsg$can_bcm(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x5, 0xf52, 0x0, {0x77359400}, {0x77359400}, {0x0, 0x0, 0x1}, 0x1, @canfd={{}, 0x81, 0x0, 0x0, 0x0, "595b6028a0e4931133f6d9919fd4a457896811cd874f3c107bbfc1c8831026f4079ba2b35d0600e02216198977dc3d41ed0880c64c39e5ff0f00000000000012"}}, 0x80}, 0x1, 0x0, 0x0, 0x800}, 0x4000) (async) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f00004aa000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) (async) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x485, 0x0, 0x3}]}) (async) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x80, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/net/bridge0/brif/bridge_slave_0/multicast_router\x00', 0x82041, 0x102) (async) writev(r4, &(0x7f0000000780)=[{&(0x7f0000000500)="dc688596a1", 0x5}], 0x1) (async) 2.108433288s ago: executing program 2 (id=11): r0 = gettid() ptrace(0x10, r0) r1 = add_key$keyring(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffb) add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, r1) 2.04395504s ago: executing program 2 (id=12): r0 = syz_open_procfs$userns(0x0, &(0x7f0000000000)) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000040)={0x0, 0x2, 0x4}) ioctl$BTRFS_IOC_DEV_REPLACE(r0, 0xca289435, &(0x7f0000000440)={0x1, 0xb, @start={r1, 0x1, "a9ba61c66417c3bd16b675a7641af0796b7ca4b26591f5404334c08d82d09b65a38746a8aa1eb323c5c493c8d7b2f485aec0437b382ee5657a6756a410c7cec83e8b2fb28ca608fb98599aede7e63c3e73f9f46e0c7d120ea94cc4402f47d71550d4e21bdb1a0b7341cd1e50607a6e47fe6f2ec07ca3181a8432591068565a287648802661715937b52570d8018858d87f3869093ca86715447d0bdaa1a54324c01bd297a68daef7bbb98fb7e45446b4b5ff6179f42573747912746c7acce0e9ff5a9244e11197f9d0990a54d0b0a1b9518a5d2d839f4a37bd0f5537006e69c0bc8dca031f41aff3fca52c1cedaf30ad04c88b906a7fc16ae568ad9a17c4da88e790903a46b1565ca5dedd5692a6cac96e8d6deb9a52223c86b4d0b62ea2c0f7d30ca343298d1123db9982d7872f0df72f77a02d46a94caa16ff25953ad0641fe8c396b5aaede6eb9bb2b4f81471b35063e133ee56c1d699a8ea748cba41959274362ceb03701355b1b64f91ae6dbb26db015562a08a4b5f6984d6aeab6dba2b206c581755422297e2f5feb0e013e3e16a3a5fd4ac481941a7a1753c7c62a3d761cda4e4d52d0da52c0f3e578d79c92f93e4ffeabadb934067e461f4bf86824d459d3ddac8cd5b1d146ed23bf9ed5c4afee3ffb1f48c0ae4f4ced7e4cd5d17c589a9aed1cbb690bb80fa5fef10aee08fcd688f3b786a55d9897652ce3eac9f079ff5a1188b31942b4a5f50df991b4943d58c6f181460ac15618f518ebaca4e131589eb6c06f098ee319319790bdea59cffbdc8e9b6de82bb09ced8946d08764d1259b308d0568aa46e52472cfb2010d8c3f62ee6a9d45c8ab7d19b69b5789a5d0ac4a79806197fec4f1e92d9a7abbb010e19e8917df9b1578a7244d2614ad25ead22a9ff8054ae1024fd4cae60a0f369ec63e791463aa89dff39990f77afdb226d99eceb7ab444b19b428e5d23b8a117d0563cb061e73cb6f1f14f6e9e648f1a047500da05c64fd50e8635c16e2ecd80bd735dba7de0e8e04f6d7f3a915316d2937e0a61234ec4c00964a6d96d263696fdf2b2ea7933ccd4398cd5019553d3a1ab9f0036c927611092192e372285605507016f953dfea50d3ebecccbac7a05499d67d05129ac597dae6ce3213e5c839f9e72b76e0c512755fd87ca19e8749e612acac0e72b65d27f6036eac5449eb57a159dea1e8791c1700c1ced5ef1d6a8f86954317498ff30016895272d107f4109ea78b042ea285605a020d4c07b67a28f0db15d121f8f1c8cf00d49cb016f4102d54d50f0a9cdffc40f4992877ec4c0db2d8319917e2c26444fb331ae802b003f03a08742ad504eec9c0fcf499fb84b154dfd423f21743ded6d4182fedb598a6b1b59d7a1655025b959e435e02f295aedec158bb3fd9f78cbd54e1e5f4e7535800df253b6a93c906b627fa1223b10fd9864", "1786d8f9e477e3627b5f836686aa8abb115d68c9f4f40deebea5d2a5f244dc3763991cba7c10fac5b908c4032d9d18c5dd33904d4c8650b17f56210c484c4383259c0ca7505d77dac8c9036bcab9063952803e5bf6b3042972e4a65570b7b6754f1cbd0bd05dfb877a3b197e84d96c45d445149290ba23e2f85e935792d5e5b73282168898b99adf9e2104a24cd69b13f1a14b265bc8a1b7d378bc535b8956214733716d1756758ea88f9d83d25b69c265dbb7de15ea1de6261b890b04ab388e5c2c3d9e0a2ee876f45bb9592e368ebf39d2ccc860b213e448aeb8378ec55958f6146149b6a693958022924651d3a6d1eea53c78046f5d960f2a97a219f9ddcd6beeed2baef0dcc4dbdc27cdeea152376f543dcaea34e582c70a7987db86858f81603276502ab57c1c8b258f1950ff5a184c796c27fb4a8c19cfda578137fe3c13a2f49ab1f260bed7b6ed1ffffa36bdb6f1714634265f0c2e9b6bae0acbefd060b391d17424ea27aed339ad56df4df474f52afbca9c29a7017f84b6e6542a95f12dc2c3fe74db623f7bfd31ca4944f20859d8140f62d383543d832e6d0dbec678c320ab5c468ee65589f3d2f146a7ddb308a37e8905b56764508706d803cf02c196dc20733d182e6668247484b4ed22b7b231ddbedeee64dd97eac70b8b48ad4f565fbcd5a97d155489b08d85deb50225f5d87192492d115a40febfc96b6525fe15ea8c2b361eddc10f699b43a13c8b1eb9da893b7d3a7c7d26f275ca30e073acad41ab0b6d32c1dc517694e1b327eae0a6198c5b850ae5a5777911a5a403fcfa90184fba465b99024e4fe74ad4eea878a40d561953159bced44f52c0d5824e448eea55bd1788da6bb201f1589586012dc87d85c58213a8cc81792cf13217b08e90afa60bc461e2afc682b154ff1908c9817b0f4a4f265bb86188467e0dcc698e14012872863d9b4c57a84de773461047b71f175e616f01cafbde6489a8bcf7fa711474db858c30a27ecf0bdf4448a347d6286dda971f108cfac0b649696b1fa5cd3aca9758be8d86e239379ea69f3a4f9b7cba857760518e10dd0c16db00fc359762f0c708d7d5a1f7c4d01a332dcb01b6f30077491c45f94b1a6d467b3099b75c57e5b824f42fd7378021ab59f019467875a25d1f527a70948904593a0b1dfe41f0cf32ee1a8b0737bdcbe54c76f2a237081cbf17dc6bc39af169e127a25a9666d0bc47f618f078f6a23ef3120df2a28159d589a39950e5e539dd77dd240861603fcdb07bfe3034f211927cf08c2ffd08fcd7a256507ab18a1d04e8523b2daabe1b2c01aa0efd12a5808741b5cb825b005a354fd1936b37b706b319d643a7c3d889943b48891ed403a83544d69d30ec246cde10042c8daf2634b5600ada39d00a9a27e2b6f95f8c8a2b8aff8e5b74787de24a2c6bdb12ca0910a6445c6d18fd"}, [0x5, 0x4, 0x6, 0xbda9, 0xf, 0x1, 0x100, 0x9, 0x10000, 0x0, 0x1, 0xb1, 0x9, 0x6, 0x1, 0x4, 0xff, 0x2000, 0x1, 0x10, 0xfffffffffffffffb, 0x0, 0x10000, 0xfff000000000, 0x2e8000000, 0x24, 0x1, 0x7, 0x0, 0x5, 0x9, 0x7, 0x1, 0xa, 0x0, 0x2, 0xff, 0xfff, 0x400, 0x80000001, 0x40, 0xffffffff80000000, 0x3, 0x6, 0x4, 0x400, 0x9, 0x848b, 0x0, 0x10000, 0x7, 0x6, 0xd47, 0x0, 0x1, 0x0, 0x6, 0x8, 0xfe0, 0xfffffffffffffff8, 0x3, 0x101, 0x8000000000000001, 0x8]}) ioctl$BTRFS_IOC_DEV_REPLACE(r0, 0xca289435, &(0x7f0000000e80)={0x1, 0x10000, @status={[0xdc3, 0x2, 0x8000000000000001, 0x7fffffffffffffff, 0x8, 0x4]}, [0x6, 0x80000001, 0x9, 0x80000001, 0x0, 0xf4, 0x8, 0x1, 0x10001, 0xffff, 0x5, 0xff, 0x1, 0x439, 0x120000, 0x2, 0x6, 0x5, 0x7fff, 0xffffffffffffffff, 0x114, 0x8, 0xfffffffffffffffd, 0x40, 0x4, 0x7d, 0x8, 0x7, 0x5, 0x5, 0x3, 0x2, 0xfffffffffffff000, 0x80000001, 0x8, 0x26ec0000000000, 0x400, 0x5, 0x3, 0x3, 0x2, 0x2, 0x4, 0x4, 0x70bc, 0xfffffffffffffffc, 0x0, 0x2, 0xc, 0xc4ac, 0x7fff, 0x8, 0x3, 0x3, 0xb, 0x3, 0x100, 0x0, 0x28000, 0x9, 0x0, 0x0, 0x7, 0x81]}) (async) lsetxattr$trusted_overlay_nlink(&(0x7f00000018c0)='./file0\x00', &(0x7f0000001900), &(0x7f0000001940)={'L+', 0x1}, 0x16, 0x3) (async) r3 = getpgrp(0xffffffffffffffff) sendmsg$AUDIT_SET(0xffffffffffffffff, &(0x7f0000001a40)={&(0x7f0000001980)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001a00)={&(0x7f00000019c0)={0x3c, 0x3e9, 0x4, 0x70bd2d, 0x25dfdbfd, {0x40, 0x1, 0x2, r3, 0x0, 0xffffffff, 0x0, 0x1, 0x0, 0x9, 0x1}, ["", "", "", "", "", "", "", ""]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000}, 0x20000000) (async) r4 = open$dir(&(0x7f0000001a80)='./file0\x00', 0x1a1003, 0x90) (async) r5 = syz_open_procfs$userns(r3, &(0x7f0000001b00)) mount_setattr(r4, &(0x7f0000001ac0)='./file0\x00', 0x1000, &(0x7f0000001b40)={0x1, 0x82, 0xc0000, {r5}}, 0x20) (async) r6 = openat$make_it_fail(0xffffffffffffff9c, &(0x7f0000001b80)='/proc/thread-self/make-it-fail\x00', 0x1, 0x0) ppoll(&(0x7f0000001bc0)=[{r5}, {r0, 0x200}, {r5, 0x441}, {r6, 0x8008}, {r0, 0x606}], 0x5, &(0x7f0000001c00), &(0x7f0000001c40)={[0xac67]}, 0x8) (async) r7 = openat2(r4, &(0x7f0000001c80)='./file0\x00', &(0x7f0000001cc0)={0xfbecc822fdcefd42, 0x4b, 0x32}, 0x18) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r7, 0x6, 0x14, &(0x7f0000001d00), 0x4) (async, rerun: 32) r8 = syz_open_dev$rtc(&(0x7f0000001e40), 0x0, 0x20000) (rerun: 32) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001e80)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000fed000/0x13000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000001d40)="3ee29cc48ecba75dc9bdfc5075a7216aa88211f5b8d3efde9a69c33950d4758672e6eabd2aad384dedd52d02b233760197e008f2c8dbee5f74100b19c0c8e5b00e300aef9430911359114c6ab117655e5bb023026679fd6be1e81724bb1251990520b850565f7d9facc80f6ec6cb9ab2d5be58bf732f34faaf89e295c49914b9db3fbf52a5bd3768124e0f95619ddfc49e96b9d8ae492f34f7c85ceaff333e7c96d67411bbadd4692cf1332d3bf41bedae1115225340d64816664e7c796cef29e36913fadc4007f031f1a009d036c12393e08d04ce630add157bd18bd357bccaa2efaf91554f5ba4292d2f9097c3ddff92", 0xf1, r8}, 0x68) write$selinux_create(r7, &(0x7f0000001f00)=@objname={'system_u:object_r:devicekit_disk_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x0, 0x20, './file0\x00'}, 0x5f) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r5, 0xc400941d, &(0x7f0000001f80)={r2, 0x3, 0x3, 0x1}) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r7, 0x4018aee1, &(0x7f0000002380)=@attr_pmu_init) (async) r9 = openat$rnullb(0xffffffffffffff9c, &(0x7f00000023c0)={'/dev/syzrnull', 0x0}, 0x400000, 0x0) openat2$dir(0xffffffffffffff9c, &(0x7f0000002400)='./file0\x00', &(0x7f0000002440)={0x541800, 0x21, 0x4}, 0x18) mount(&(0x7f0000002480)=@loop={'/dev/loop', 0x0}, &(0x7f00000024c0)='./file0\x00', &(0x7f0000002500)='hostfs\x00', 0x3005444, 0x0) sendfile(r9, r6, &(0x7f0000002540)=0x3, 0x8) epoll_ctl$EPOLL_CTL_MOD(r7, 0x3, r6, &(0x7f0000002580)={0x8}) (async) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000002600)={0x0, 0x0, 0x0}, &(0x7f0000002640)=0xc) quotactl$Q_GETNEXTQUOTA(0xffffffff80000902, &(0x7f00000025c0)=@filename='./file0\x00', r10, &(0x7f0000002680)) (async, rerun: 64) setsockopt$inet6_buf(r7, 0x29, 0x2c, &(0x7f0000002700)="17b3539a8c3c2f0723b65a1fb944bd294a05166c03552c04a28d2fc104096431aca64a1bd860a1f7661249e02e085951c647e40befac12f94060892eb0d44dff00799f1b8d8689f66f5f53268bd31bd11c14f5426247073f0fa33a992a5efb822c671dd52647e150b3f0bc581e74fcad1e39f18f6c3d267cb79b3729bc7c7a03875f44fe012b9e75ccde0341eb06f75dd5f43f7941594bb082ea64264ab5b270a2148dbffc3994c23ce532e9de8d3149b91cfd9fcb5ef83391bf234f98dee923be82073c7be9095860449587c2274305741cb2c1016c7f04b9927d88c5c3b6b62fb345520012de9a561cc1ee6032b7a7f5", 0xf1) (rerun: 64) r12 = syz_open_dev$char_usb(0xc, 0xb4, 0x9) fchown(r12, r10, r11) syz_genetlink_get_family_id$devlink(&(0x7f0000002800), r7) 2.04192848s ago: executing program 2 (id=13): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./bus\x00', 0x0) (async) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240), 0x8, &(0x7f0000000280)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@uuid_on}]}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) (async) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000380)={0x9}) (async) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f00000003c0)={[{0x5, 0xc000, 0x4, 0x5, 0xff, 0x9, 0x3, 0x8, 0xb9, 0x3, 0x8e, 0x5, 0xc50}, {0x804, 0x1, 0x1, 0x45, 0xff, 0x6, 0x2, 0xff, 0x0, 0x4, 0x6, 0x7f, 0x20c}, {0xf1c2, 0x3, 0x38, 0xf, 0x84, 0x7, 0x3, 0x50, 0x0, 0x5, 0x4, 0x5, 0x3a}], 0xffffffff}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e22, 0x2, @empty, 0x8}, 0x1c) (async) openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) (async) listen(r3, 0x204) (async) r4 = socket$netlink(0x10, 0x3, 0x4) writev(r4, &(0x7f0000000080)=[{&(0x7f00000000c0)="580000001400add427323b470c45b4560a067fffffff81004e22030d00ff0028925aa8002000eaa57b00090080020efffeffe809020000ff0004f03a09000000ffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1) (async) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000480)={[0x60000000000, 0xd4, 0x0, 0x61, 0x200002000001, 0x0, 0x2004c8, 0x0, 0x0, 0x36ae, 0x4, 0x7fff, 0x3, 0x400000000], 0x80a0000}) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.996942111s ago: executing program 3 (id=14): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) (async) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_clone(0x22000211, 0x0, 0x0, 0x0, 0x0, 0x0) (async) syz_clone(0x22000211, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0xa0402, 0x0) io_setup(0x3, &(0x7f0000000180)=0x0) io_submit(r3, 0x2, &(0x7f00000001c0)=[&(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x2, r2, &(0x7f0000000240)=' ', 0x1, 0xe3}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x6, 0x3, r2, 0x0}]) (async) io_submit(r3, 0x2, &(0x7f00000001c0)=[&(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x2, r2, &(0x7f0000000240)=' ', 0x1, 0xe3}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x6, 0x3, r2, 0x0}]) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r4 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x110, 0xffffffffffffffff, 0xd2ddb000) timerfd_settime(r4, 0x3, &(0x7f0000000080)={{}, {0x0, 0x989680}}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x1, 0xa7, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002020000202505a1a440000102030109029500020102a0050904000001020d0000092406000110a713e605240000040d240f01080000003f0509340706241a0500000424020800241309a571f5de2fab78aea1434f876617d1965e2e4f0f8586f593bb3de73622bd8124c0e23c977695ba32ad571d0e4e5a0433e8c13af0fd6f5f7d423b8eff74bce470b7eb8a4febb853a9ad6b5a712e35e1615b52d3eabc4b877c1e2638e3aa8294c199f5199f185cbb35b725b1674e5d55f045f7caacfaf5bcbcbb66af6e33193b8032ea2accb720380d706678e740cc95b6d93be9713e7d22abdb5d3246bd0bbab9d091f17c24120200a317a88b045e4f01a607c0ffcb7e392a1524121c00a317a88b045e4f01a607c0ffcb7e392a090581030004fe06f20904010003020d00000904010102020d0000090582020800f1080b090042fe7fc0a6a6239ba3bf65791e24a07fd6d84a27e5e85665d4b2ee9d5da0c4f7871221a33ce1ad"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) (async) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000") 1.940887223s ago: executing program 2 (id=15): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000000), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="05000000800d"], 0x80}}, 0x8000) syz_usb_connect(0x1, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000009a65d0860040800dee20102030109021b0500000000000904"], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) 1.777468887s ago: executing program 0 (id=17): setxattr$system_posix_acl(&(0x7f0000000bc0)='./bus\x00', &(0x7f0000000000)='system.posix_acl_default\x00', &(0x7f0000000200)=ANY=[@ANYBLOB="0200000001000000000032000400000086bd000e000000000000002000000000000000002000"], 0x24, 0x3) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x620002, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000b80)=ANY=[@ANYBLOB="300000000301010100000000000000000a000006100001800c000280050001003a0000000c001980080001000808"], 0x30}, 0x1, 0x0, 0x0, 0x8080}, 0x14) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x152) mount(0x0, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/usb/devices/usb1/bConfigurationValue\x00', 0x2, 0x0) recvmsg$inet_nvme(r2, &(0x7f00000009c0)={&(0x7f0000000240)=@isdn, 0x80, &(0x7f0000000940)=[{&(0x7f0000000500)=""/210, 0xd2}, {&(0x7f0000000600)=""/71, 0x47}, {&(0x7f0000000680)=""/230, 0xe6}, {&(0x7f0000000780)=""/33, 0x21}, {&(0x7f00000007c0)=""/118, 0x76}, {&(0x7f0000000840)=""/162, 0xa2}, {&(0x7f0000000900)=""/32, 0x20}], 0x7}, 0x3) write(r2, &(0x7f00000001c0)="313690", 0x3) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(r0, 0x3312, 0x10) socket$netlink(0x10, 0x3, 0x10) r3 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x5b, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000002c0)='./sys\x00', &(0x7f0000000a00)='sysfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000a40)='./sys/devices/system/memory/memory35/state\x00', 0x2, 0x0) write(r5, &(0x7f0000000a80)='offline', 0x7) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x7, 0x0, 0x0) ioctl$KVM_SET_REGS(r6, 0x4090ae82, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x20004010, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x42, 0x0) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000400), 0x8, &(0x7f0000000440)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) linkat(0xffffffffffffff9c, &(0x7f0000000480)='./file0/file1\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0/file2\x00', 0x1000) openat$incfs(r8, &(0x7f0000000ac0)='.pending_reads\x00', 0x50340, 0x3) 1.528848502s ago: executing program 0 (id=18): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/notes', 0x800, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) rmdir(&(0x7f0000000100)='./file0/../file0/file0\x00') r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB], 0x150}, 0x1, 0x0, 0x0, 0x8801}, 0x80) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$sock(r3, 0x0, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x1, &(0x7f0000000240)=ANY=[@ANYRESHEX=r1, @ANYBLOB="c5a748c3b5eca210e44e6ca6fcbc0000f862f4bfbbedb43455bbe031ff3c44fec7d7db061ad1734ff81e4386fa5d2a18e79506bfea591697bf97645de463e51e4da1e28aa47026e80084d6a05f6e544e9a9006be"]) getuid() ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r2, 0x8983, &(0x7f00000002c0)={0x2, 'vlan1\x00', {0x6}, 0x600}) r4 = socket(0x2, 0x2, 0x0) socket$inet6(0xa, 0x6, 0xd3e) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r4, 0x8983, &(0x7f0000000300)={0x1, 'vlan1\x00', {}, 0x5832}) io_setup(0x3, &(0x7f0000000400)=0x0) io_submit(r5, 0x1, &(0x7f0000000500)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0xe11, r0, 0x0, 0x0, 0x4, 0x0, 0x0, r0}]) 1.387932406s ago: executing program 1 (id=19): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x4080, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'tunl0\x00', 0x4000}) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x46000, 0x0) ioctl$TIOCSPTLCK(r1, 0x40045431, &(0x7f00000000c0)) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000100)={'ipvlan0\x00', 0x600}) ioctl$TCSETSF2(r1, 0x402c542d, &(0x7f0000000140)={0x7, 0x3, 0x387, 0x4, 0x5, "5c58c24832d4680e260a51fdfa9029c1578b55", 0x194, 0x6}) ioctl$TIOCSBRK(r1, 0x5427) fallocate(r0, 0x4, 0x0, 0x10) r2 = accept4$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, &(0x7f0000000200)=0x6e, 0x80400) getsockopt$sock_buf(r2, 0x1, 0x1c, &(0x7f0000000240)=""/254, &(0x7f0000000340)=0xfe) ioctl$TUNGETIFF(r0, 0x800454d2, &(0x7f0000000380)={'pim6reg1\x00'}) ioctl$TUNSETQUEUE(r2, 0x400454d9, &(0x7f00000003c0)={'macvlan0\x00', 0x400}) r3 = ioctl$TIOCGPTPEER(r1, 0x5441, 0x5e35) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000400)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x20, 0x4d9, 0xa070, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x1, 0x30, 0x7, "", [{{0x9, 0x4, 0x0, 0xf7, 0x2, 0x3, 0x1, 0x0, 0x1, {0x9, 0x21, 0x9, 0x3, 0x1, {0x22, 0x910}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x7, 0xfb, 0x9}}}}}]}}]}}, &(0x7f0000000540)={0xa, &(0x7f0000000440)={0xa, 0x6, 0x310, 0x22, 0xff, 0x7, 0x8, 0xb9}, 0x23, &(0x7f0000000480)={0x5, 0xf, 0x23, 0x2, [@ss_container_id={0x14, 0x10, 0x4, 0x3, "259e69518c29e0980ac589dedf1f87e6"}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x20c0967a0c834874, 0x7, 0x7}]}, 0x2, [{0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x2c0a}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x82c}}]}) r4 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000580), 0x705640, 0x0) ioctl$TCGETA(r4, 0x5405, &(0x7f00000005c0)) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000600), 0x90004, 0x0) ioctl$KVM_CHECK_EXTENSION(r5, 0xae03, 0x101) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000680), 0xffffffffffffffff) r8 = ioctl$TUNGETDEVNETNS(r0, 0x54e3, 0x0) r9 = syz_open_procfs$userns(0x0, &(0x7f00000006c0)) r10 = syz_clone(0x24030180, &(0x7f0000000700)="89cb78a36b3e3205ae0879c2ed146d19d8e6cd57288c881da054fbedd6eb0d89036944663d874ef4e9b2e0f04e638175173b89b138b15abbf56ebfdad04ca7678631795b12a23368a23a2ffd4bd32557a854949ef93f683635042e85d633c031a24fcff2f9b848e09ad9d4de8764e4676928340c71a7438f8e028b39c192af33ea319a7e33ccc758033138128b80aa8c697a092e80befc1ec1", 0x99, &(0x7f00000007c0), &(0x7f0000000800), &(0x7f0000000840)="28565097e740b8fdacc6bd53219169a0f63e550021a6ce9262db1fd022aa1fde271ac5bfd522885959e8ba9c8e352f3039745f545c04147ca1a6c1e88455ad3f28b8af2366a599e3b46382680027f7ae9b91872a6078932849e5baa01e6fd2f95ffe97efd67e682d8b10fb2b7bf64deef58e0b88") ioctl$TIOCGPGRP(r4, 0x540f, &(0x7f00000008c0)=0x0) sendmsg$DEVLINK_CMD_RELOAD(r6, &(0x7f0000000a40)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000a00)={&(0x7f0000000900)={0xd0, r7, 0x0, 0x70bd25, 0x25dfdbfe, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, 0xffffffffffffffff}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r8}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r9}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r10}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r11}}]}, 0xd0}, 0x1, 0x0, 0x0, 0x26c379fb7280d3b6}, 0x5) syz_genetlink_get_family_id$ipvs(&(0x7f0000000a80), 0xffffffffffffffff) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000b00), r3) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000000bc0)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000b80)={&(0x7f0000000b40)={0x1c, r12, 0x2, 0x70bd2b, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_DONT_WAIT_FOR_ACK={0x4}, @NL80211_ATTR_OFFCHANNEL_TX_OK={0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x41}, 0x40000) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000c40)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r6, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x1c, r12, 0x300, 0x70bd26, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r13}, @void}}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x14}, 0x24000000) 1.370362786s ago: executing program 0 (id=20): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000600), 0x200000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x2e) syz_kvm_setup_syzos_vm$x86(r2, &(0x7f0000c00000/0x400000)=nil) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000140)={0x18, 0x56, 0x601, 0x0, 0x0, "", [@typed={0x7, 0x0, 0x0, 0x0, @str='\x00\x00\x00'}]}, 0x18}], 0x1, 0x0, 0x0, 0x4000001}, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000000)={0x1fa, 0x1, 0x0, 0x2000, &(0x7f0000fe5000/0x2000)=nil}) readv(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc\x00', 0x1ff) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000240), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r6, 0x40345410, &(0x7f0000000280)={{0x0, 0x1, 0x4, 0x1}}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r6, 0x54a2) mount(0x0, &(0x7f00000002c0)='./proc\x00', &(0x7f0000000300)='proc\x00', 0x4000, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r7, &(0x7f0000000380)='27', 0x2) r8 = openat$udambuf(0xffffffffffffff9c, &(0x7f00000003c0), 0x2) r9 = memfd_create(&(0x7f0000000400)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\xdenJ\xeb\x87\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\x008\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38\x14\xcb\xfa\xb3j\x92\f\xe0\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xd9w\\\xf0\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xd9\xbd\xd9\xaf\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x2) ioctl$UDMABUF_CREATE(r8, 0x40187542, &(0x7f0000000540)={r9, 0x0, 0x0, 0x4000}) r10 = openat(0xffffff9c, &(0x7f0000000580)='./proc/sys/net/ipv6/conf/all/force_mld_version\x00', 0x1, 0x5) write$cgroup_int(r10, &(0x7f00000005c0)=0x1, 0x12) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect(0x3, 0x63, &(0x7f0000000640)=ANY=[@ANYBLOB="12010002000000404c17aa5500010102030109025100010100c0320904000002080200000705010200020007058202"], 0x0) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x261, 0x0, 0x1}]}) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f0000fce000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000680)="9a00004e0065670fc719440f20c066350c000000440f22c0f2260f8f0b000fae0b3e0f01370f20c06635000000800f22c00f01d1650bf5674c"}], 0x1, 0x0, 0x0, 0x5f) r11 = socket(0x2, 0x3, 0x6) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) bind$inet(r11, &(0x7f0000000180)={0x2, 0x4e22, @local}, 0x10) ioctl$KVM_RUN(r5, 0xae80, 0x0) 586.914846ms ago: executing program 2 (id=21): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f00000000c0)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000100)=@ccm_128={{0x303}, "ffffffffffffffff", "e071e70aed0a5ef79f52ae34f3a61cf7", "88318644", "a915950f158d5a6b"}, 0x28) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) write$tun(r1, &(0x7f00000001c0)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) recvfrom(r0, &(0x7f0000000240)=""/4071, 0xfffffffffffffdab, 0x17, 0x0, 0x0) writev(r0, &(0x7f0000001240)=[{&(0x7f0000001280)='X', 0x1}], 0x1) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f00000012c0)=0xffff1884, 0x4) syz_usb_connect(0x3, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f0104000000090583"], 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x8000, 0x0) ioctl$BTRFS_IOC_SET_FEATURES(r2, 0x40309439, &(0x7f0000001440)={0x2, 0x0, 0x1e}) openat$sysfs(0xffffffffffffff9c, 0x0, 0x28681, 0xd0) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, 0x0) r3 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="12011001000000409412241300000000000109022400010000e020090400180203000600092101100b012206000905810310"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) openat2$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000001480)={0x24, 0x0, 0x0, &(0x7f00000014c0)=ANY=[@ANYBLOB="0022060000000b05f8ffffffffffffc3"], 0x0}, 0x0) syz_clone(0x2002c00, &(0x7f0000001300)="fa8e78664a2d0da42ea4416d47365c1824f8a7e422de9bc77d8a74dd070b92cd35762b3bebfa1240d1acaa7bcfecbc0e46a14c5f89cf0667bee57ff7f02c4c5a9e43365a0314628b8f2a3dc246a903f2", 0x50, &(0x7f0000001380), &(0x7f00000013c0), &(0x7f0000001400)="3b1985367b7f2e1dff3d3665e0f7f73a90cd5cd9f15487f74b591291fb2b1970d7ce7e64143876a5e584270536db2061b494c8631f13aaba36b7") 12.07101ms ago: executing program 0 (id=22): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x40) ioctl$KVM_CAP_DIRTY_LOG_RING(r1, 0x4068aea3, &(0x7f0000000280)={0xc0, 0x0, 0x2000}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x1ff, 0x1, 0x0, 0x1000, &(0x7f0000001000/0x1000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000040)=0x4) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000440)={"db4c1421593cb4d3f8fe6094dc821bbbe06520701fc6de7b0349f34b0f8c556a9e9aff1355aab8d6da26d74608530f150f127f9e3f0a2f1fff0be9774c95d6c007c91903f78616596487bf50017c56b15385ab264cba5b168c62d971e67e6f3e73d60b5a8adbaaf2af8610c6a91c0a116f619adce4aa91d5a68faf8ee98693d32d8d8244381b5720ef596600e39491d216c22d0725904bab7d90fa8afb8fa04b707410aa300ef098609b4fa6dd77b1b7c321b1fc6356564ce3f90826be3a9a5be186ffc48eb13824e9dae77ed212a0f802074ff4f1725c4ad88cf5bbd36e3406bc59d96e82047631d8be9462ee7e54e5b2897c3fff38eabf67e1e160c2b5e18be06457844d89c9a606b7d25fbde713f4759da0bee1fabe3f71dcca63540f113a2b5edc4b327d1f9610377b97265d4aa875b4bc3c44bf8110d5df1beb1fe54794a0aa52dfc80df1caf7d812b4f1cdba1a6836b45ea2180d08439d411ce8e0755868cc839eaeac73e5d28f9f1990584038cf5fa6bee0c4095a27cc8c7b59519bf2a9bf1fedf54cc2dc6aea6c42c32de40c291e5f422f5c7792a08926af160fb379576dd81bac746232fb246817fc3248097914b75e83cc5eb518ce8fb643b34ca69c3b61f0d94e7db62dd480198d41e0862f1ec4429ab637569884a5ba446a0b09edfd986a2b3e15ee35bbd18610dad6271681ed240b0ffab9199b541013c0aadc36484da57511896c14776a41602aa1426edfbb828897d9c218b7936a0572840ebbc796e888a439b24e640324b511deb6ed0b2ce2f7567447826944b4f34101e492e8d20a2deda950e96e78f86d6d4c976f0c99041c94944309e6ce08d84a7c96677d570d9a57ec0506a4321d9e049b55be883ca3648c27772fc5dbaea5e6c2ded2ce72fb68989ae381fe1394cf6966ab04285d5ff8256bc2e85462b8d89aeeebd5432157c945b5dc1960d9282c6cc007fe029325d6078aef94d4954f956c71bcdf846f41392ebe0d3b289438d24ec4bc073617459a6b232445dd636a9f21140e14b162fd5ef1d626b0ff84884fd63d22cc1b05befb77ea937f3045cc15b125479b262c1e32fca75a5468423288c5776efee744b1fccb5e6d661d9d287cfa8582c96ea34a33c1bbc29c0035657da66a87150bbb885be5ee123e431fd793ea179a0fc77aaee66d874c0616cb32324826b36d0e27d14217ad1131cace3bae4ef82dfbc790e78de53a9bfbdb468bf0eb3ff134073b380858965de2d108862daf3fc6b49ad46f20832238aeaa5d010cf08e37938f0bb7bbeaa970c39ce9327a16fe07565708266ce9ef639bfa08538693b456228aa1c370d64ef9795b7cc208a2c528d381a042d149ed5c7f34ed26a7d5a4401b86434f054389e5dac7a4ee896e406d7b27240d925d478e0eb2202797832d3e2c74f4925ad58377b0d6ae9b97034f94"}) r3 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) r4 = getpid() write$cgroup_pid(r3, &(0x7f0000000080)=r4, 0x12) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, 0x0}], 0x1, 0x67, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 11.77587ms ago: executing program 0 (id=23): mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000040)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x80, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8c) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl2\x00', &(0x7f0000000280)={'ip_vti0\x00', 0x0, 0x80, 0x8, 0x2, 0x0, {{0x5, 0x4, 0x2, 0x7, 0x14, 0x67, 0x0, 0x2, 0x29, 0x0, @remote, @empty}}}}) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'gre0\x00', 0x0}) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000300)=0x8, 0x4) sendto$packet(r1, &(0x7f0000000340)="05030006e8fe091c6202a0ffffffff006003000000007f141434e3177f43055762cb80948864113b022543424aa608", 0xfef2, 0x0, &(0x7f0000000380)={0x11, 0x88a8, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) openat$incfs(r0, &(0x7f00000001c0)='.pending_reads\x00', 0x22400, 0x1b4) r3 = accept$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @multicast1}, &(0x7f0000000100)=0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000200)={'wg2\x00'}) openat$incfs(r0, &(0x7f0000000080)='.pending_reads\x00', 0x600400, 0x12) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) (async) mount$incfs(&(0x7f0000000040)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x80, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8c) (async) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl2\x00', &(0x7f0000000280)={'ip_vti0\x00', 0x0, 0x80, 0x8, 0x2, 0x0, {{0x5, 0x4, 0x2, 0x7, 0x14, 0x67, 0x0, 0x2, 0x29, 0x0, @remote, @empty}}}}) (async) socket$packet(0x11, 0x3, 0x300) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'gre0\x00'}) (async) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000300)=0x8, 0x4) (async) sendto$packet(r1, &(0x7f0000000340)="05030006e8fe091c6202a0ffffffff006003000000007f141434e3177f43055762cb80948864113b022543424aa608", 0xfef2, 0x0, &(0x7f0000000380)={0x11, 0x88a8, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) (async) openat$incfs(r0, &(0x7f00000001c0)='.pending_reads\x00', 0x22400, 0x1b4) (async) accept$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @multicast1}, &(0x7f0000000100)=0x10) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000200)={'wg2\x00'}) (async) openat$incfs(r0, &(0x7f0000000080)='.pending_reads\x00', 0x600400, 0x12) (async) 0s ago: executing program 0 (id=24): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) (async) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000003c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) (async) r3 = socket$inet(0x2, 0x3, 0x4) setsockopt$inet_opts(r3, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) (async) r4 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f00000009c0)={0x42, 0x0, 0x1}, 0x10) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000a00), 0xffffffffffffffff) (async) bind$tipc(r4, 0x0, 0x0) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r5, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f0000000ac0)={0x30, r6, 0x200, 0x0, 0x100000, {{}, {}, {0x14, 0x19, {0x2, 0x1, 0x0, 0x2000000}}}}, 0x30}, 0x1, 0x0, 0x0, 0x4080}, 0x1804) (async) r7 = userfaultfd(0x80801) ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f0000000300)) ioctl$UFFDIO_REGISTER(r7, 0xc020aa00, &(0x7f0000000340)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$UFFDIO_WRITEPROTECT(r7, 0xc018aa06, &(0x7f0000000840)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) (async) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040)='xfrm0\x00', 0x10) (async) sendmmsg$inet(r3, &(0x7f0000000080)=[{{&(0x7f00000000c0)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000100)=[{&(0x7f0000000140)="58c66954d6467a5b113b90e23ee71f0b57655f423b6f3ece877f3200054e5e44cae964ba4814a826e1ff68bb0f6ddf0d40a306c9bbca483b210c741893bd53dbcf6cbbfbe51c29373858079d8ce522f31d19a2c069e4fba0547064bfb1a94c107e58690262d5c589dd257f679bb1b082cae9d23bd36ef7c4f8ec153e97e1c47ca97fdd2ebe4ce80313727eea5b6f38b6f92f115ff43a8351ae4dfa098a311d763d4c173abfecc6f125ac9e2a93d896ecd64f2851ee1b305913aeaaccce741a7142f8100a1d215d42a8e840e1112e3f1d42109912aa45d1896122fa1e5a9471c97887753ff7da7da26ce52aea66ff1a5c58", 0xf1}, {&(0x7f0000000240)="0c5b04c83d552d50437b530ff67d07ffc5e8afe744f1c2c3e5b296efcb24d203b43e4a4eeca106f24036a7f899494a524704663cfd599cf888638ab7e29202935a36fbe9882181d39fc7afbd195e0bda1c20c84cf80d3700a54ac618c36fdf451fdbbf8f87b558ebd58523f2c4d2631772cdbc7ac0b1a0513a98b0702c7a29c274d26990efc63a192b513c8d9f8b22e2e828", 0x92}, {&(0x7f0000000400)="2fa7b5f6024d3fb7fc9818d3f20daa0e3e891c8ffd5b13ce714ae3a5160b639680542e352ebad39763c1d0668a85948d171c445a2ad76bea773d0e54891692d112752fd83efe6e9ab41fffc8ba8cfcf974ad76ae1f3617212a7f06fe9d229866da8a7420cecf8f340a7b10c25d21b7c3f36658afde39415261ada1ae03698417307b5b02ae0dcede5566aa9dfe3463019070b3b88cc8c94a723e2d14d7193ad9b32ccc703c2c6b903301f4439b20a85180d67faf748672c437112c99ab631064aa43ed62adae80b3d6a6551ab1c676433f8e415b0a3b1ede2dc3b58b9936d0ca179797d3f4907b5823159f86b09b43f9f2b2a59f98dc7b5a903572d71df94b8f58814a860b5e7c31a655ddac3064678aa8483a7349dd1dac73f77e35fc29450215db1601b1f1782c7131b4c8a0b65fd3fb3f06d8823f392c016523a62c1362ba0d7fb8f50aaca155bcb2107d4b4e0f7ee7510d109dbaa8ee78e2de4bb0be9f6e785f08e5e6d62f46328a734182efd0e660e314a53e450ddc4c453afd894e4763611dfa3145cb10917bb39cbcde5d7d33c2fd4ad01d1f50c7ef5f84cbfb40dd4b427281e2f7a90bdae484e972e5607a5dd4d18660e205a4f20572f9cec03d8d8d7b6b3d7fcad1de323ac91e879e74a06692fb8668b6bca5febbd56c3ec9990b67060274f4f1fa0643b13077f4d5e82372d109d7ce7aed2ac4a2755ca4eced989d95eb3b082a50bf0d5c2490a8d206816d112b211135c877db3d8071fe747d5c74c1a9ed843961a08c8cb81759f48cb0fa5a01b09b25a4b54b9088a481841a7711734c799e89f36bb455c3daf50fbc0329f426aa0931984c2c779e9b39c3c9823f259c470f5edc72a58691b5d0585acdddf895ee0640f9a4a191152f894ce585503b8e19435f12dc709d1dacc4821ddc5f80a6772408b1b588ce8a0726d3712e90a8f1d588ce8bba04e6ef273e58f83a52f8b820a1180fca3559ea8386957ec755e748f25530713aaf6d153556f0770180f4d41a1cb80b2440e0db7722f1228cd1e2edfd3576849bfa6465736a732d9b9bd7b9bb00bcba457882de454f0d10c1d69e9d7a14fae57d5dc697b9f8c4953e1974159aaf8f9d15f61e88bd3c0ce26b2cb1ff8ecec0b67b4e82929b22c4eac09b020304f8bf583fce4f4244b18fc557c892f1d4a52ca0fdd961300f541cc81469c419eb127b044dfceac89af8ee5b4c5baa3eadb668aec9f281544acc9d2a542a87600f90ed7c89e59d05c6b2fa9e5de2b90f97a0f8b92615d346ddd040acb8809041679c82993eddd6c0c3d8d8e5d8eade389c82d1aa06723bdf085374e2ef15e1b6027242777a32e7c43ad8fdf866b3b1019d06784856fdc0cc2b057665642739fced319a3d4d86f4a812bea537db639eee0660e8c99c9ff37d98567f6f554ece2cbe1a54c64b8b59e8316fab5178dd0e599cb3aac79529fd6b512ab0886d95a824fe5c199fd882d0bf6579355222ba84b19464816ecf4fc03d105bb1ac49fd273867448b65b43624eed165bcd0", 0x43e}], 0x3}}], 0x1, 0x24008000) (async) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000880)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) (async) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000940), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) (async) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000980)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, r11, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r10, 0x4048ae9b, 0x0) (async) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_CAP_HALT_POLL(r1, 0x4068aea3, &(0x7f00000008c0)) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000b00)={0x0, 0x0, @ioapic={0x8000000, 0x11, 0x10001, 0xfffffffe, 0x0, [{0x2, 0x4, 0x87, '\x00', 0x8}, {0x8, 0x8, 0x40, '\x00', 0xb}, {0xff, 0x7f, 0x9, '\x00', 0x67}, {0x0, 0x5, 0xd4, '\x00', 0xff}, {0x7, 0x9, 0xc, '\x00', 0xfb}, {0x0, 0x1, 0x54, '\x00', 0xff}, {0x2, 0xd5, 0xf1, '\x00', 0x7b}, {0x4, 0x4, 0xc}, {0x7f, 0xd, 0xb, '\x00', 0xb}, {0xd7, 0xd, 0x8, '\x00', 0x6}, {0x0, 0x28, 0x80, '\x00', 0x5}, {0xff, 0x1, 0xfe, '\x00', 0x1}, {0xfe, 0x7, 0x26}, {0xcf, 0x2, 0x1, '\x00', 0x6}, {0xf, 0xee, 0x9, '\x00', 0x3}, {0x39, 0x2, 0x7, '\x00', 0xb}, {0x9, 0x6, 0x2, '\x00', 0x8}, {0x5, 0x9, 0x8, '\x00', 0xc}, {0x7, 0xe1, 0x6, '\x00', 0xc4}, {0x0, 0x80, 0x11, '\x00', 0x7f}, {0x1, 0xc, 0xc4, '\x00', 0x7f}, {0x10, 0x2, 0x3, '\x00', 0x10}, {0x1, 0x23, 0xf3, '\x00', 0x4}, {0x0, 0x6, 0x4}]}}) kernel console output (not intermixed with test programs): cess permissive=1 [ 14.455127][ T36] audit: type=1400 audit(1792408859.579:63): avc: denied { siginh } for pid=232 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.123' (ED25519) to the list of known hosts. [ 21.959661][ T36] audit: type=1400 audit(1792408867.099:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.960772][ T286] cgroup: Unknown subsys name 'net' [ 21.982323][ T36] audit: type=1400 audit(1792408867.099:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.009611][ T36] audit: type=1400 audit(1792408867.129:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.009810][ T286] cgroup: Unknown subsys name 'devices' [ 22.125950][ T286] cgroup: Unknown subsys name 'hugetlb' [ 22.131551][ T286] cgroup: Unknown subsys name 'rlimit' [ 22.243960][ T36] audit: type=1400 audit(1792408867.379:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.267141][ T36] audit: type=1400 audit(1792408867.379:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.291843][ T36] audit: type=1400 audit(1792408867.379:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.320606][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 22.329381][ T36] audit: type=1400 audit(1792408867.469:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.354797][ T36] audit: type=1400 audit(1792408867.469:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.389527][ T36] audit: type=1400 audit(1792408867.529:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.415097][ T36] audit: type=1400 audit(1792408867.529:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.415359][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.241472][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.248694][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.255793][ T293] bridge_slave_0: entered allmulticast mode [ 23.261955][ T293] bridge_slave_0: entered promiscuous mode [ 23.271274][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.278347][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.285443][ T293] bridge_slave_1: entered allmulticast mode [ 23.291535][ T293] bridge_slave_1: entered promiscuous mode [ 23.333020][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.340120][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.347402][ T296] bridge_slave_0: entered allmulticast mode [ 23.353563][ T296] bridge_slave_0: entered promiscuous mode [ 23.362347][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.369419][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.376519][ T296] bridge_slave_1: entered allmulticast mode [ 23.382665][ T296] bridge_slave_1: entered promiscuous mode [ 23.388768][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.395842][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.402902][ T294] bridge_slave_0: entered allmulticast mode [ 23.409233][ T294] bridge_slave_0: entered promiscuous mode [ 23.415611][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.422635][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.429769][ T294] bridge_slave_1: entered allmulticast mode [ 23.435945][ T294] bridge_slave_1: entered promiscuous mode [ 23.441905][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.449052][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.456174][ T295] bridge_slave_0: entered allmulticast mode [ 23.462327][ T295] bridge_slave_0: entered promiscuous mode [ 23.471178][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.478241][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.485394][ T295] bridge_slave_1: entered allmulticast mode [ 23.491539][ T295] bridge_slave_1: entered promiscuous mode [ 23.638987][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.646054][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.653317][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.660368][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.670157][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.677224][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.684486][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.691496][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.699580][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.706638][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.713864][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.720914][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.731049][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.738108][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.745345][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.752346][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.803472][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.811369][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.818838][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.826488][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.833724][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.841021][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.856988][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.864035][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.874543][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.881608][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.895116][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.902149][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.911126][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.918185][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.928464][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.935525][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.950197][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.957290][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.986371][ T293] veth0_vlan: entered promiscuous mode [ 24.017209][ T293] veth1_macvtap: entered promiscuous mode [ 24.023819][ T295] veth0_vlan: entered promiscuous mode [ 24.047327][ T296] veth0_vlan: entered promiscuous mode [ 24.055948][ T295] veth1_macvtap: entered promiscuous mode [ 24.073326][ T293] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 24.090769][ T294] veth0_vlan: entered promiscuous mode [ 24.100500][ T296] veth1_macvtap: entered promiscuous mode [ 24.137925][ T294] veth1_macvtap: entered promiscuous mode [ 24.157304][ T320] ======================================================= [ 24.157304][ T320] WARNING: The mand mount option has been deprecated and [ 24.157304][ T320] and is ignored by this kernel. Remove the mand [ 24.157304][ T320] option from the mount to silence this warning. [ 24.157304][ T320] ======================================================= [ 24.193528][ T320] binder: Binderfs stats mode cannot be changed during a remount [ 24.212842][ T317] netlink: 44 bytes leftover after parsing attributes in process `syz.0.5'. [ 24.213034][ T319] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 24.367430][ T321] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3'. [ 24.445732][ T346] SELinux: Context system_u:object_r:su_exec_t:s0 is not valid (left unmapped). [ 24.555892][ T367] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 24.817147][ T381] netlink: 8 bytes leftover after parsing attributes in process `syz.0.16'. [ 24.838381][ T384] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118000 [ 24.847412][ T384] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 24.855954][ T384] flags: 0x4000000000000040(head|zone=1) [ 24.861599][ T384] page_type: f5(slab) [ 24.865635][ T384] raw: 4000000000000040 ffff888101a41a00 dead000000000122 0000000000000000 [ 24.874497][ T63] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 24.874796][ T384] raw: 0000000000000000 0000000000130013 00000001f5000000 0000000000000000 [ 24.891074][ T384] head: 4000000000000040 ffff888101a41a00 dead000000000122 0000000000000000 [ 24.899906][ T384] head: 0000000000000000 0000000000130013 00000001f5000000 0000000000000000 [ 24.904255][ T310] usb 3-1: new low-speed USB device number 2 using dummy_hcd [ 24.908854][ T384] head: 4000000000000002 ffffea0004600001 ffffffffffffffff 0000000000000000 [ 24.924772][ T384] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000 [ 24.933456][ T384] page dumped because: unmovable page [ 24.938956][ T384] page_owner tracks the page as allocated [ 24.944828][ T384] page last allocated via order 2, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_RECLAIMABLE), pid 114, tgid 114 (udevd), ts 5396554722, free_ts 0 [ 24.966406][ T384] post_alloc_hook+0x37d/0x3b0 [ 24.971187][ T384] prep_new_page+0x2d/0x180 [ 24.975714][ T384] get_page_from_freelist+0x4aea/0x4ba0 [ 24.981306][ T384] __alloc_pages_noprof+0x35a/0x7e0 [ 24.986525][ T384] alloc_slab_page+0x6b/0x1e0 [ 24.991201][ T384] allocate_slab+0x69/0x430 [ 24.995717][ T384] ___slab_alloc+0x591/0x8c0 [ 25.000311][ T384] kmem_cache_alloc_lru_noprof+0x295/0x410 [ 25.006204][ T384] alloc_inode+0xa9/0x270 [ 25.010593][ T384] iget_locked+0x198/0x9a0 [ 25.015014][ T384] kernfs_get_inode+0x50/0x830 [ 25.019793][ T384] kernfs_iop_lookup+0x213/0x320 [ 25.024804][ T384] __lookup_slow+0x2e2/0x420 [ 25.029434][ T384] lookup_slow+0x57/0x80 [ 25.033766][ T384] walk_component+0x308/0x450 [ 25.038535][ T384] path_lookupat+0x155/0x440 [ 25.043213][ T384] page_owner free stack trace missing [ 25.048777][ T63] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 25.062608][ T63] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 25.065308][ T310] usb 3-1: config index 0 descriptor too short (expected 1307, got 27) [ 25.072010][ T63] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.080091][ T310] usb 3-1: config 0 has an invalid interface number: 0 but max is -1 [ 25.092456][ T63] usb 4-1: config 0 descriptor?? [ 25.096806][ T310] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 25.111741][ T310] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 25.128580][ T310] usb 3-1: string descriptor 0 read error: -22 [ 25.135674][ T310] usb 3-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 25.144750][ T310] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.153521][ T310] usb 3-1: config 0 descriptor?? [ 25.159324][ T310] hub 3-1:0.0: bad descriptor, ignoring hub [ 25.166546][ T310] hub 3-1:0.0: probe with driver hub failed with error -5 [ 25.249464][ T393] FAULT_INJECTION: forcing a failure. [ 25.249464][ T393] name fail_futex, interval 1, probability 0, space 0, times 1 [ 25.262425][ T393] CPU: 0 UID: 0 PID: 393 Comm: syz.0.20 Not tainted syzkaller #0 bcd0852b9269e5a174a9e289c8567167f3c3d1d7 [ 25.262460][ T393] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 25.262479][ T393] Call Trace: [ 25.262485][ T393] [ 25.262493][ T393] __dump_stack+0x21/0x30 [ 25.262528][ T393] dump_stack_lvl+0x140/0x1c0 [ 25.262552][ T393] ? __cfi_dump_stack_lvl+0x10/0x10 [ 25.262577][ T393] dump_stack+0x19/0x20 [ 25.262601][ T393] should_fail_ex+0x3c2/0x510 [ 25.262620][ T393] should_fail+0xf/0x20 [ 25.262636][ T393] get_futex_key+0x178/0x940 [ 25.262653][ T393] ? kvfree+0x39/0x50 [ 25.262674][ T393] ? kfree+0x158/0x440 [ 25.262699][ T393] ? __cfi_get_futex_key+0x10/0x10 [ 25.262719][ T393] futex_wake+0x150/0x950 [ 25.262741][ T393] ? __cfi_futex_wake+0x10/0x10 [ 25.262763][ T393] ? selinux_file_ioctl+0x732/0x1480 [ 25.262788][ T393] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 25.262813][ T393] do_futex+0x37d/0x510 [ 25.262831][ T393] ? __kasan_check_write+0x18/0x20 [ 25.262855][ T393] ? __cfi_do_futex+0x10/0x10 [ 25.262873][ T393] ? udmabuf_ioctl+0x1f4/0x310 [ 25.262897][ T393] __se_sys_futex+0x13c/0x320 [ 25.262916][ T393] ? __x64_sys_futex+0x110/0x110 [ 25.262934][ T393] ? __kasan_check_write+0x18/0x20 [ 25.262956][ T393] __x64_sys_futex+0xe9/0x110 [ 25.262975][ T393] x64_sys_call+0x227f/0x2ee0 [ 25.262994][ T393] do_syscall_64+0x57/0xf0 [ 25.263011][ T393] ? clear_bhb_loop+0x50/0xa0 [ 25.263034][ T393] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 25.263055][ T393] RIP: 0033:0x7f81d8d9e559 [ 25.263078][ T393] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 25.263094][ T393] RSP: 002b:00007f81d77e30e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 25.263124][ T393] RAX: ffffffffffffffda RBX: 00007f81d9025fa8 RCX: 00007f81d8d9e559 [ 25.263139][ T393] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f81d9025fac [ 25.263152][ T393] RBP: 00007f81d9025fa0 R08: 4000000000000000 R09: 0000000000000000 [ 25.263165][ T393] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 25.263178][ T393] R13: 00007f81d9026038 R14: 00007fff685684f0 R15: 00007fff685685d8 [ 25.263193][ T393] [ 25.492960][ T63] usbhid 4-1:0.0: can't add hid device: -71 [ 25.498965][ T63] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 25.504228][ T386] usb 2-1: new low-speed USB device number 2 using dummy_hcd [ 25.508238][ T63] usb 4-1: USB disconnect, device number 2 [ 25.574299][ T310] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 25.611427][ T45] usb 3-1: USB disconnect, device number 2 [ 25.674317][ T386] usb 2-1: Invalid ep0 maxpacket: 32 [ 25.735291][ T310] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 25.745622][ T310] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 25.755783][ T310] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 25.766936][ T310] usb 1-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 25.776030][ T310] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.784017][ T310] usb 1-1: Product: syz [ 25.788189][ T310] usb 1-1: Manufacturer: syz [ 25.792790][ T310] usb 1-1: SerialNumber: syz [ 25.799949][ T310] usb-storage 1-1:1.0: USB Mass Storage device detected [ 25.807809][ T310] usb-storage 1-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 25.815828][ T386] usb 2-1: new low-speed USB device number 3 using dummy_hcd [ 25.924291][ T397] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 25.964264][ T386] usb 2-1: Invalid ep0 maxpacket: 32 [ 25.969655][ T386] usb usb2-port1: attempt power cycle [ 26.006672][ T63] usb 1-1: USB disconnect, device number 2 [ 26.075372][ T397] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 26.086410][ T397] usb 4-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 26.095620][ T397] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.104317][ T397] usb 4-1: config 0 descriptor?? [ 26.324316][ T386] usb 2-1: new low-speed USB device number 4 using dummy_hcd [ 26.344636][ T386] usb 2-1: Invalid ep0 maxpacket: 32 [ 26.364239][ T310] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 26.468297][ T375] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 26.476740][ T386] usb 2-1: new low-speed USB device number 5 using dummy_hcd [ 26.477495][ T375] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 26.504709][ T386] usb 2-1: Invalid ep0 maxpacket: 32 [ 26.510126][ T386] usb usb2-port1: unable to enumerate USB device [ 26.516639][ T310] usb 3-1: Using ep0 maxpacket: 8 [ 26.522859][ T310] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 26.531156][ T310] usb 3-1: config 179 has no interface number 0 [ 26.537462][ T310] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 26.548501][ T310] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 26.559942][ T310] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 26.570029][ T310] usb 3-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 26.583270][ T310] usb 3-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 26.592399][ T310] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.601463][ T406] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 26.811392][ T406] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 26.819935][ T406] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 26.904579][ T397] aiptek 4-1:0.0: Aiptek using 400 ms programming speed [ 26.912007][ T397] input: Aiptek as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input4 [ 27.200775][ C1] ------------[ cut here ]------------ [ 27.206243][ C1] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31 [ 27.214828][ C1] index 767 is out of range for type 'const int[34]' [ 27.221479][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 bcd0852b9269e5a174a9e289c8567167f3c3d1d7 [ 27.221497][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 27.221505][ C1] Call Trace: [ 27.221511][ C1] [ 27.221516][ C1] __dump_stack+0x21/0x30 [ 27.221539][ C1] dump_stack_lvl+0x140/0x1c0 [ 27.221556][ C1] ? __cfi_dump_stack_lvl+0x10/0x10 [ 27.221573][ C1] ? common_startup_64+0x13b/0x157 [ 27.221592][ C1] dump_stack+0x19/0x20 [ 27.221608][ C1] ubsan_epilogue+0xe/0x40 [ 27.221619][ C1] __ubsan_handle_out_of_bounds+0xe8/0xf0 [ 27.221634][ C1] aiptek_irq+0x208d/0x2a00 [ 27.221648][ C1] ? _raw_spin_unlock+0x45/0x60 [ 27.221659][ C1] ? kcov_remote_start+0x1d2/0x3c0 [ 27.221675][ C1] __usb_hcd_giveback_urb+0x36e/0x530 [ 27.221691][ C1] usb_hcd_giveback_urb+0x12b/0x400 [ 27.221706][ C1] dummy_timer+0xa3f/0x4900 [ 27.221727][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 27.221742][ C1] ? timerqueue_del+0xd7/0x130 [ 27.221757][ C1] ? __hrtimer_run_queues+0x2bd/0x8e0 [ 27.221771][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 27.221786][ C1] __hrtimer_run_queues+0x3ab/0x8e0 [ 27.221800][ C1] ? hrtimer_interrupt+0xf30/0xf30 [ 27.221812][ C1] ? read_tsc+0xd/0x20 [ 27.221827][ C1] ? ktime_get_update_offsets_now+0x3c0/0x3e0 [ 27.221844][ C1] hrtimer_run_softirq+0x159/0x560 [ 27.221858][ C1] ? irqtime_account_irq+0x51/0x1c0 [ 27.221875][ C1] handle_softirqs+0x1aa/0x5b0 [ 27.221889][ C1] __irq_exit_rcu+0x47/0xb0 [ 27.221900][ C1] irq_exit_rcu+0xd/0x30 [ 27.221911][ C1] sysvec_apic_timer_interrupt+0x82/0x90 [ 27.221926][ C1] [ 27.221929][ C1] [ 27.221933][ C1] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 27.221948][ C1] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 27.221964][ C1] Code: cc cc cc cc cc cc cc b8 07 9b 53 c6 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 83 09 3f 00 55 48 89 e5 fb f4 <5d> c3 cc cc cc cc cc cc cc cc cc cc cc b8 00 00 00 00 90 90 90 90 [ 27.221974][ C1] RSP: 0018:ffffc900001a7e00 EFLAGS: 000002c2 [ 27.221985][ C1] RAX: ffff8881f6d00000 RBX: ffff8881036693c0 RCX: ffffffff85a8553d [ 27.221994][ C1] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 000000000002e254 [ 27.222001][ C1] RBP: ffffc900001a7e00 R08: ffff8881f6d396fb R09: 1ffff1103eda72df [ 27.222010][ C1] R10: dffffc0000000000 R11: ffffed103eda72e0 R12: 0000000000000000 [ 27.222018][ C1] R13: 1ffff110206cd278 R14: dffffc0000000000 R15: ffffffff886da3e8 [ 27.222027][ C1] ? ct_kernel_exit+0x7d/0xb0 [ 27.222043][ C1] default_idle+0x17/0x30 [ 27.222057][ C1] arch_cpu_idle+0xd/0x20 [ 27.222072][ C1] default_idle_call+0x3e/0x80 [ 27.222087][ C1] do_idle+0x2fc/0x570 [ 27.222100][ C1] ? idle_inject_timer_fn+0x80/0x80 [ 27.222114][ C1] cpu_startup_entry+0x47/0x60 [ 27.222128][ C1] start_secondary+0x12e/0x140 [ 27.222144][ C1] common_startup_64+0x13b/0x157 [ 27.222169][ C1] [ 27.222174][ C1] ---[ end trace ]--- [ 27.513073][ C1] ================================================================== [ 27.521129][ C1] BUG: KASAN: global-out-of-bounds in aiptek_irq+0x20ab/0x2a00 [ 27.528694][ C1] Read of size 4 at addr ffffffff8670a71c by task swapper/1/0 [ 27.536127][ C1] [ 27.538458][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 bcd0852b9269e5a174a9e289c8567167f3c3d1d7 [ 27.538475][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 27.538483][ C1] Call Trace: [ 27.538488][ C1] [ 27.538493][ C1] __dump_stack+0x21/0x30 [ 27.538520][ C1] dump_stack_lvl+0x140/0x1c0 [ 27.538551][ C1] ? __cfi_dump_stack_lvl+0x10/0x10 [ 27.538575][ C1] ? __cfi__printk+0x10/0x10 [ 27.538591][ C1] print_address_description+0x71/0x210 [ 27.538611][ C1] print_report+0x4a/0x70 [ 27.538627][ C1] kasan_report+0x162/0x1a0 [ 27.538639][ C1] ? aiptek_irq+0x20ab/0x2a00 [ 27.538654][ C1] ? aiptek_irq+0x20ab/0x2a00 [ 27.538667][ C1] __asan_report_load4_noabort+0x18/0x20 [ 27.538682][ C1] aiptek_irq+0x20ab/0x2a00 [ 27.538695][ C1] ? _raw_spin_unlock+0x45/0x60 [ 27.538707][ C1] ? kcov_remote_start+0x1d2/0x3c0 [ 27.538724][ C1] __usb_hcd_giveback_urb+0x36e/0x530 [ 27.538741][ C1] usb_hcd_giveback_urb+0x12b/0x400 [ 27.538757][ C1] dummy_timer+0xa3f/0x4900 [ 27.538778][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 27.538794][ C1] ? timerqueue_del+0xd7/0x130 [ 27.538809][ C1] ? __hrtimer_run_queues+0x2bd/0x8e0 [ 27.538823][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 27.538839][ C1] __hrtimer_run_queues+0x3ab/0x8e0 [ 27.538853][ C1] ? hrtimer_interrupt+0xf30/0xf30 [ 27.538866][ C1] ? read_tsc+0xd/0x20 [ 27.538882][ C1] ? ktime_get_update_offsets_now+0x3c0/0x3e0 [ 27.538900][ C1] hrtimer_run_softirq+0x159/0x560 [ 27.538913][ C1] ? irqtime_account_irq+0x51/0x1c0 [ 27.538931][ C1] handle_softirqs+0x1aa/0x5b0 [ 27.538945][ C1] __irq_exit_rcu+0x47/0xb0 [ 27.538957][ C1] irq_exit_rcu+0xd/0x30 [ 27.538968][ C1] sysvec_apic_timer_interrupt+0x82/0x90 [ 27.538983][ C1] [ 27.538987][ C1] [ 27.538990][ C1] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 27.539005][ C1] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 27.539022][ C1] Code: cc cc cc cc cc cc cc b8 07 9b 53 c6 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 83 09 3f 00 55 48 89 e5 fb f4 <5d> c3 cc cc cc cc cc cc cc cc cc cc cc b8 00 00 00 00 90 90 90 90 [ 27.539031][ C1] RSP: 0018:ffffc900001a7e00 EFLAGS: 000002c2 [ 27.539042][ C1] RAX: ffff8881f6d00000 RBX: ffff8881036693c0 RCX: ffffffff85a8553d [ 27.539052][ C1] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 000000000002e254 [ 27.539059][ C1] RBP: ffffc900001a7e00 R08: ffff8881f6d396fb R09: 1ffff1103eda72df [ 27.539068][ C1] R10: dffffc0000000000 R11: ffffed103eda72e0 R12: 0000000000000000 [ 27.539076][ C1] R13: 1ffff110206cd278 R14: dffffc0000000000 R15: ffffffff886da3e8 [ 27.539086][ C1] ? ct_kernel_exit+0x7d/0xb0 [ 27.539125][ C1] default_idle+0x17/0x30 [ 27.539140][ C1] arch_cpu_idle+0xd/0x20 [ 27.539155][ C1] default_idle_call+0x3e/0x80 [ 27.539170][ C1] do_idle+0x2fc/0x570 [ 27.539184][ C1] ? idle_inject_timer_fn+0x80/0x80 [ 27.539199][ C1] cpu_startup_entry+0x47/0x60 [ 27.539212][ C1] start_secondary+0x12e/0x140 [ 27.539229][ C1] common_startup_64+0x13b/0x157 [ 27.539248][ C1] [ 27.539252][ C1] [ 27.842708][ C1] The buggy address belongs to the variable: [ 27.848679][ C1] .str.77+0x1c/0x20 [ 27.852577][ C1] [ 27.854881][ C1] The buggy address belongs to the physical page: [ 27.861265][ C1] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x670a [ 27.869917][ C1] flags: 0x4000(reserved|zone=0) [ 27.874857][ C1] raw: 0000000000004000 ffffea000019c288 ffffea000019c288 0000000000000000 [ 27.883439][ C1] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 27.892000][ C1] page dumped because: kasan: bad access detected [ 27.898403][ C1] page_owner info is not present (never set?) [ 27.904450][ C1] [ 27.906752][ C1] Memory state around the buggy address: [ 27.912360][ C1] ffffffff8670a600: f9 f9 f9 f9 00 00 00 00 f9 f9 f9 f9 00 01 f9 f9 [ 27.920400][ C1] ffffffff8670a680: 00 f9 f9 f9 00 03 f9 f9 00 06 f9 f9 06 f9 f9 f9 [ 27.928463][ C1] >ffffffff8670a700: 00 05 f9 f9 06 f9 f9 f9 06 f9 f9 f9 00 00 00 00 [ 27.936498][ C1] ^ [ 27.941338][ C1] ffffffff8670a780: 00 00 f9 f9 f9 f9 f9 f9 00 05 f9 f9 00 03 f9 f9 [ 27.949395][ C1] ffffffff8670a800: 05 f9 f9 f9 07 f9 f9 f9 06 f9 f9 f9 00 00 00 00 [ 27.957431][ C1] ================================================================== [ 27.965468][ C1] Disabling lock debugging due to kernel taint [ 27.971600][ C1] ------------[ cut here ]------------ [ 27.977049][ C1] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30 [ 27.985628][ C1] index 768 is out of range for type 'const int[34]' [ 27.992280][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G B syzkaller #0 bcd0852b9269e5a174a9e289c8567167f3c3d1d7 [ 27.992300][ C1] Tainted: [B]=BAD_PAGE [ 27.992304][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 27.992312][ C1] Call Trace: [ 27.992316][ C1] [ 27.992321][ C1] __dump_stack+0x21/0x30 [ 27.992343][ C1] dump_stack_lvl+0x140/0x1c0 [ 27.992359][ C1] ? __cfi_dump_stack_lvl+0x10/0x10 [ 27.992376][ C1] ? input_event_dispose+0x2f5/0x6d0 [ 27.992398][ C1] dump_stack+0x19/0x20 [ 27.992428][ C1] ubsan_epilogue+0xe/0x40 [ 27.992444][ C1] __ubsan_handle_out_of_bounds+0xe8/0xf0 [ 27.992459][ C1] aiptek_irq+0x1f3c/0x2a00 [ 27.992474][ C1] ? kcov_remote_start+0x1d2/0x3c0 [ 27.992489][ C1] __usb_hcd_giveback_urb+0x36e/0x530 [ 27.992506][ C1] usb_hcd_giveback_urb+0x12b/0x400 [ 27.992521][ C1] dummy_timer+0xa3f/0x4900 [ 27.992542][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 27.992563][ C1] ? timerqueue_del+0xd7/0x130 [ 27.992579][ C1] ? __hrtimer_run_queues+0x2bd/0x8e0 [ 27.992593][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 27.992608][ C1] __hrtimer_run_queues+0x3ab/0x8e0 [ 27.992623][ C1] ? hrtimer_interrupt+0xf30/0xf30 [ 27.992635][ C1] ? read_tsc+0xd/0x20 [ 27.992651][ C1] ? ktime_get_update_offsets_now+0x3c0/0x3e0 [ 27.992669][ C1] hrtimer_run_softirq+0x159/0x560 [ 27.992682][ C1] ? irqtime_account_irq+0x51/0x1c0 [ 27.992700][ C1] handle_softirqs+0x1aa/0x5b0 [ 27.992714][ C1] __irq_exit_rcu+0x47/0xb0 [ 27.992725][ C1] irq_exit_rcu+0xd/0x30 [ 27.992737][ C1] sysvec_apic_timer_interrupt+0x82/0x90 [ 27.992752][ C1] [ 27.992756][ C1] [ 27.992760][ C1] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 27.992775][ C1] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 27.992791][ C1] Code: cc cc cc cc cc cc cc b8 07 9b 53 c6 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 83 09 3f 00 55 48 89 e5 fb f4 <5d> c3 cc cc cc cc cc cc cc cc cc cc cc b8 00 00 00 00 90 90 90 90 [ 27.992801][ C1] RSP: 0018:ffffc900001a7e00 EFLAGS: 000002c2 [ 27.992812][ C1] RAX: ffff8881f6d00000 RBX: ffff8881036693c0 RCX: ffffffff85a8553d [ 27.992821][ C1] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 000000000002e254 [ 27.992828][ C1] RBP: ffffc900001a7e00 R08: ffff8881f6d396fb R09: 1ffff1103eda72df [ 27.992837][ C1] R10: dffffc0000000000 R11: ffffed103eda72e0 R12: 0000000000000000 [ 27.992844][ C1] R13: 1ffff110206cd278 R14: dffffc0000000000 R15: ffffffff886da3e8 [ 27.992854][ C1] ? ct_kernel_exit+0x7d/0xb0 [ 27.992869][ C1] default_idle+0x17/0x30 [ 27.992884][ C1] arch_cpu_idle+0xd/0x20 [ 27.992899][ C1] default_idle_call+0x3e/0x80 [ 27.992914][ C1] do_idle+0x2fc/0x570 [ 27.992927][ C1] ? idle_inject_timer_fn+0x80/0x80 [ 27.992942][ C1] cpu_startup_entry+0x47/0x60 [ 27.992955][ C1] start_secondary+0x12e/0x140 [ 27.992972][ C1] common_startup_64+0x13b/0x157 [ 27.992991][ C1] [ 27.992995][ C1] ---[ end trace ]--- [ 28.388508][ T63] usb 4-1: USB disconnect, device number 3 [ 28.388631][ C1] aiptek 4-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 29.034005][ T397] usb 3-1: USB disconnect, device number 3