last executing test programs: 15.144176346s ago: executing program 1 (id=51): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x15) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./dev\x00', 0x1f3) mount(0x0, &(0x7f0000000680)='./dev\x00', &(0x7f0000001840)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001880)='./mnt\x00', 0x1ff) mount(&(0x7f00000018c0)=@filename='./dev/sda1\x00', &(0x7f0000001900)='./mnt\x00', &(0x7f0000001940)='ext4\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001a00)='./dev/sda1\x00', 0x748000, 0x100) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f00000019c0)={0x19, 0xffffffffffffffff, 0xc6bf, 0xff, 0x0, 0x3}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x80001) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='huge=always,huge=within_size,nr_blocks=5']) chdir(&(0x7f0000000140)='./file0\x00') r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpu.stat\x00', 0x275a, 0x0) ftruncate(r0, 0x8008976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, r2, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000001a40)=ANY=[@ANYBLOB="f000000010000100fdffffbffe000800e0000002000000000000000000000000ac14140b000000000000000000000000000307944e230020020020006c000000", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYBLOB="7f000001000000000000000000000000000004d66c00000000000000000000000000ffffac1414180400000000000000090000000000000000ffff0000000000001c25080000000000010000000000000083000000000000000000000000000000fcffffffffffffffff7f0000000000001f00000000000000ff010000000000000200000006000000090000002cbd700000000000020000fd2000"/168], 0xf0}, 0x1, 0x0, 0x0, 0xc801}, 0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000400)={0xaa, 0x715}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000240)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x4}) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000002c0), 0x2400, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f0000000300)={0x20000000000dff, 0xfffffff7}) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x57) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) pipe2$9p(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000004c0)='./file0\x00', &(0x7f0000001980), 0x1, &(0x7f0000001c00)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r7, @ANYRESDEC=r6, @ANYRESHEX=r5, @ANYBLOB="ac76657273696f6e3d39703230b5302e75"]) write$P9_RVERSION(r8, &(0x7f0000001bc0)=ANY=[@ANYBLOB="150000006bffff"], 0x15) openat$binderfs_log(0xffffffffffffff9c, &(0x7f0000000500)='./binderfs/binder_logs/transactions\x00', 0x0, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r4, 0xc0c89425, &(0x7f0000000540)={"3a6382272604095b34d6b4aec6907095", 0x0, 0x0, {0x2, 0x404}, {0x9, 0x8}, 0x1000, [0x5, 0x7, 0x7, 0x9, 0x9, 0x92, 0x3, 0x3f5c, 0x1, 0x4, 0x9, 0x6, 0x7, 0x4, 0xadea, 0x4]}) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f00000006c0)={{}, r9, 0x10, @inherit={0x58, &(0x7f00000016c0)=ANY=[@ANYBLOB="00000000000000000200000000000000050000000000000003000000000000000000000000000000ffffffffffffff7f0101000000000000ff7f00000000003500800000000000000400000000000000080000000000000028b1d2c56ef73085d76f91929432308eab9015172c539ee7bcf7ef8412080a3b939248acaf787857a4bb84dde230d7b9a614011242b909d0de870fdcf4aa9ce1381f986004e0f3e9f89422dcfb778545e9396fcd457a5365dfbd4b5dad9ad8af934ec8bfd7b16c05f7ce0a107c2376d58960f8198d092d3b5987ff23def7eba60e0574aa6f1ef097b72d4aced9078f022799fb6b766a0947835d1492b75c1fd108ab45459305c709c47d95c7616c601461546e01e5bbd727933074784c2d23726ab5b6ca10eb3891c29bd1fb1cb4d89ab779679958b64feed968fa40e6fbfd85a5037dbff95f691a1cf6ec4c8f25a4833e"]}, @subvolid=0x4}) r10 = socket$netlink(0x10, 0x3, 0x0) shutdown(r10, 0x0) 15.137720727s ago: executing program 1 (id=52): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x14, 0x3, 0x6, 0x3, 0x0, 0x0, {0x2, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x4000011}, 0x4800) r1 = syz_io_uring_setup(0x8d2, &(0x7f0000000000)={0x0, 0x0, 0x3010}, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100)) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x3482, 0x0) ioctl$TCSBRKP(r2, 0x5425, 0x6) poll(&(0x7f0000000240)=[{r1, 0xd010}], 0x1, 0x9) bind$netlink(r0, &(0x7f0000000440)={0x10, 0x0, 0x25dfdbfe, 0x1000000}, 0xc) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000280), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r3, 0x40345410, &(0x7f00000002c0)={{0x0, 0x0, 0x5, 0x3, 0xfea291d}}) unshare(0x40040000) 14.977580933s ago: executing program 1 (id=53): ioctl$KVM_SET_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee1, &(0x7f0000000140)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000100)=0x4}) r0 = openat$kvm(0xffffff9c, &(0x7f0000000540), 0x8000, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_TSS_ADDR(r1, 0xae47, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="0c0100000001010400000000000000000a0000003c0001802c00018014000300fe8000000000007fffffff00000000aa14000400fc0000000000000000000000000000000c00028005000100000000003c0002800c00028005000100000000002c000180140003000000000000000000000000000000000114000400fe8000000000000000000000000000aa08000740000000007800068014000500fc0200000000000000000000000000010c000380060001000000000014000400fc0200000000"], 0x10c}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000680)={0xac, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @empty}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @mcast1}]}]}, 0xac}}, 0x14) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)={0xac, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x400}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}]}, 0xac}}, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x3, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 14.968852324s ago: executing program 1 (id=54): mkdirat(0xffffffffffffff9c, &(0x7f0000002200)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1b6) mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/sda\x00', 0x4d802, 0x0) read$FUSE(r0, &(0x7f00000001c0)={0x2020}, 0xffffffca) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/trace\x00', 0x0, 0x0) r2 = add_key$fscrypt_v1(&(0x7f0000002240), &(0x7f0000002280)={'fscrypt:', @auto=[0x63, 0x62, 0x32, 0x30, 0x65, 0x32, 0x31, 0x35, 0x37, 0x37, 0x30, 0x61, 0x61, 0x38, 0x39, 0x36]}, &(0x7f0000002300)={0x0, "8527d2100090af54bfbca283be11c0de7af30e94937920fcba13ce0af61beaa44d66a6535daf1bc35fb3af1e9197d71d26589d077c88184095fb00", 0x14}, 0x48, 0xffffffffffffffff) keyctl$setperm(0x5, r2, 0x4) keyctl$set_timeout(0xf, r2, 0x9) read(r1, &(0x7f0000000180), 0x1000) readv(r1, &(0x7f0000002540)=[{&(0x7f00000022c0)=""/9, 0x9}], 0x1) 14.755867456s ago: executing program 1 (id=55): mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./proc\x00', 0x1aa) (async) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x4000, 0x0) (async) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='10', 0x2) (async) r1 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_setup_syzos_vm$x86(r2, &(0x7f0000c00000/0x400000)=nil) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000140)={0x2710, 0x0, 0xf0000000, 0x1000, &(0x7f0000200000/0x1000)=nil}) r4 = syz_kvm_add_vcpu$x86(r3, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_load_code={0x12e, 0x1e, {0x0, "66ba3412eef4"}}, @nested_vmlaunch={0x12f, 0x18}], 0x66}) ioctl$KVM_RUN(r4, 0xae80, 0x0) (async) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000240)={0x2710, 0x0, 0xf0000000}) (async) unshare(0x62020680) (async) ioctl$BTRFS_IOC_TREE_SEARCH(r0, 0xd0009411, &(0x7f0000000500)={{0x0, 0x6034, 0x0, 0x3ff, 0x7, 0x40a6, 0xf4f8, 0x6, 0xfffffff9, 0xcd, 0x93b, 0x7fffffffffffffff, 0x2, 0x3, 0x5}}) 14.586352943s ago: executing program 1 (id=56): r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x2100, 0x0) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r0, 0x89fa, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @broadcast, 0x13, 0x1e}}) readv(r0, &(0x7f00000015c0)=[{&(0x7f00000000c0)=""/162, 0xa2}, {&(0x7f0000000180)=""/221, 0xdd}, {&(0x7f0000000280)=""/117, 0x75}, {&(0x7f0000000300)=""/222, 0xde}, {&(0x7f0000000400)=""/182, 0xb6}, {&(0x7f00000004c0)=""/4096, 0x1000}, {&(0x7f00000014c0)=""/64, 0x40}, {&(0x7f0000001500)=""/33, 0x21}, {&(0x7f0000001540)=""/73, 0x49}], 0x9) r1 = socket$inet6(0xa, 0x3, 0x80000000) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000001740)={'batadv_slave_0\x00', &(0x7f0000001680)=@ethtool_flash={0x33, 0x5, './file0\x00'}}) ioctl$BTRFS_IOC_START_SYNC(r1, 0x80089418, &(0x7f0000001780)=0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r1, 0x50009417, &(0x7f0000001840)={{r1}, r2, 0x6, @inherit={0x50, &(0x7f00000017c0)={0x0, 0x1, 0x8, 0x1, {0x833c3dbac39f98b8, 0x8000000000000000, 0x3, 0x2, 0xbbeb}, [0x98]}}, @name="c7ccf1db341628db6cee0e251feff412eabdeb5243e98287e2de30a8ee9d89354dcfb6f599ca5c6a37d80c1042cf812796656cadaba6406bbe482a027dc890d23ae95eb8fa31243f69f69341da4b62b8dfa16174ba2eed1da99528ab783f5598ad65d7ebbbff6e597fb2c6e513b3bbcbc17f96996aca9a0a9c17b2b92aac481c72b57cfd68491b0568d293788f3a6ba6f66022c0493850088c1051a0edddf5dd3379ae9427880f863e492fb51dc36e4ba4be6aad51a535854a6dab51532fea62d8f1e82fd0eab2973e9b79e02218b8756c10fc20a51ea7d441215bc3336114dbf763df6cbd0103d921b3212a5d7b8d61d8d9317f3842d9a6cd17e9b85ce7261b7a4d601bbb76a7ebb0cf9390aed5a3a62600bf7ce79ff1999a7f5a2abfc6fdd2d6bbf9081294f31f28479259003acae98e8012ca71a3df86fad9f1d363e52023f88f1da6a8f7b51dbafd96ba110365f0e256682175388829430228a85077590fda6f5d67c9286b4faad35c80aa37d7a91cdb626dd1d8d115dc2e8529573e5dcc885c55b53d43b80d8d9ef20e905566b15c67ce0d2631aa0b76825320a004d8c9294e1f703b98162e08d05d444e15d52ef8599c904069239595b5e323b6a1173e02838b0ce061832f85c0fd9430967fa17e9cbfe2441025fdb8969ac20ec53ed8e0beb2ed1d5f2a75e6bd979f9db163b15cba07160b6bbb4ec0209114a579aee2a2dd7e251d8a0d5c88782af469e5fdd3deffe6724ce1a8e93d766cb5acbd0c25b02aedf194527a4722ac44bd3afdf8ef76502ee1d85cc5ea2d6a231314edbdd52fa98b73559736c6484d9e4b189d20b9f7edb2a326706f9f1cfd9bbee37b2c2dbcd3329c389e13f51851284897458a44ccc6c2a0504caf4d2dda7c4a1d336d2478d3d0fb382d4209ede93fc7f8d866f331f409015b7dae7756b8a170d62128a09aba20c83f4b70140109c32e6c03bdb76b8bc3da9e28b5bfc4307cd684a4ad8294d0445790aec3a3475c9bf7d6716dd8be991df5d77a6b1f46387a274078b2f156fb9a282b60168dd04b0e29fc7a6c3438037efc266d68b786375e847c938f962b0a4f2e9e1bf2f998f0d6aed814c452a10d8bd0ca521058c934c97e245448d5c5c62eb65dff78e684b7578fce64337936ad4a920f3c26bc687e70771e4fd8ef5356bcebe3db35e69d4e95808ea14f96ae6129c3b52f3d03dd3205fb333fb99b0757096d19ce5b206eb08e49938722532e7c50193c2937ad74727ce70e95186000c6ced534446bd895bf347d85e81dfba58a9d419f17b43de3dfbda2ac19fb5e824f9ab2f8119b6974ec72b3733c110af603dc9600c774b3172ab114a5c6129826c8f28c020977609320b0260d5b4dca5df63e163062c39fd1cc86f235343ef534144e5a398f88f8be39460a7da6290e592408c159d66b8c10246caf2dd54396835773b9943d9c7087e47cad9952c288efc89b8f98c2b088af7c138d50ef53c7d62c196b324d829518c6c8f914a3f5c77284a873c782fd307c1e7966550c3c1337e89b68f23ab20d7aff1d0e29810134aa5a6cc8579e29f6072f633bfa3c83f1742d86464dc38bc67b08276fe13013979aedc9564ec1b89997db653a07a0add27e1b6ee56bb7705a5ab82fb6e506848fb02ea8a631f92e9842b9d2486a42bd4ca531fdf3d9d6defc8b812ad63fcdd3f24b34f2c12268b0b86710aa562e9f6acede28a0143413bc8c053f72495a300adf5ee96843d8b257a53b0f6bce5a7b80c69d2ef27644736bb18911947eca9b276fe93e15a9d7e806deb060aa1d2ca546c4c87aed480cc9eb6d95d452d9b2eb8caf21463212e249fd60a004ba005147d55758341f2b3e5b65f7e44a73eafebdc71260f321f1e59d6dc9ce92ee0872c6954cc30dacd4d4de10cd7c8b4876e0c1407416b6e4c1d55af13844d88499a1b9182c3ff9880be44a98c2e7dedd3b4fbe8f24fefffe51995d1b55fa45874bc32905d85ec9a42655c6a83c51ee6b349e3a19e37fc9ae7d219273d9d8ca304e06bdf6d8e66d1a8b8267e0cce7d83a61e9b9d86cadcef4b32216d9bc2f917c5d16f968da4954a20b907e891f68f55a3edd50f3994b2e42dc3e6cc130fe812781de73900aa62dbe9d87448aed656f8df1b6777726503b70918ef8b14e9047b34098c6f9aabf84f00eba72517bcb23131d593eb03dc7a410ed0f807d029747e9f89fc583b37713d2351c5aaa9081512ac85c9f11324d964a508e02fb37c46a3da91e3cb3fb26ae4d5a816e962b03159d6bae9bd5ef70ccce05ab3f6a21f1e93b754b2457c3cc8a7078ff72ca791dc1851eec644108f4da8820cd94d2483efb6b2e2aa3866550186a309f1cf3331cc23e9cefb9f1785d073d6ca953f7245bca54c040db4e51cb1b31a1b8d39feed9f6d85ad007f2a03252357129ac5de8fb4a13359e6dab4c9a34154277aedc55c456005d8d299103c813aaf0cd481820fbce2f61de8b2371b5b913ae93afc61be92d380d88630240384ed3ef96b5ddcda738b8f73374c41c574e2e49676cf53cd0bb1df30d6bb845dfb14613766b2bb88b767a41bdc30c8e6667b94501cc0d83420a914428a9a5e29de056abe774ffe5a0ec208543dd65af60400d8ec3f9b4844858e9084446ac9c393b582542874c478bad32c911f5609d695d14dbcf96adfff644c3ee61d8d37809ff9c52c2fcd26b7dd7c1d766c1bb993d1406c77b338cb693b1e56aecf2b5e659720950ce0ce5c2c60acbb0638405b48509db114aba2074b0a341358281506508b0dc07fba90be4c75e907a13e8343199ba5e1abcc26e44c7d98663f42d91a94c9885afa09203d79a4ca2c4879302efcd6d3a00b77585690f6702ce9cf86ea23a6337354007899fe61a7c3eca7e3be8ae52d956567782c4a5e299a2b10ce071eb4c02515f412824cd4c1833ec7646029982bdd691008b94aee6b55892b05c58bda844f8b1c2fd0b046a8b6fb7b9b34b0f5b7dddef726264552dded7fdba03b6ebd1d19c87754845cbfc9982ce3ef16b212a4913989403186b9ecb8b07c1332842794b235b4d994447df3c63b3e48c4b8cdc34b9ac6c8c54bda8a01e7678f40830876494c9766b5021d05a04a79feddb95a7cd8abe6538e8d763757a4c38737681530f8751b4db125eeb198c59d9441def7828db79c62328a54d7c7cde54f0290c22db2cae8e0aac3f3208b1067a93e2c2b6c924cb94c61f9ad9e8917d780c60f60adae353af9ae134642743aaeb4a3abd6b05ef08e0f66295bf754c45bd1e6e3be4c40302b45f7e0fb917370f5c597ba5018e79ff3c97ed7bceaaa65d7e7a0e1544728b1faa208762dd4893e3b5221111d157d7a878dee7393d7713d3bafaec99e34a1493cd3f099d0e25114bc1d75b051a1a39097cb11800e9efa6ed8783d11d673dc07ec34d8f8fe5e0884f14509990fcbe4cf069d0db4ed823650d58c6292ce3881c2dac522d41dd2ee4fbdc2855483e16288e7dfbb3a90ad89f4b543c2716edcc0f120bacc496092d876fadd6ddd3952edf1dfeb4d15621d97a652c524e1c8bcbebd74c32a1006724e33d99ee2d3d13e9565f3b459d5e259df4a3bc61ec54cc069831b1568c2a658a4b16832d916ad21c249d74244b847599a9c4fa5052ea9a73009914c5bdc02539883479efb82899fe80c570f92658951c0b65a106a5132bb02e0c0313323a1e92313a606d477b4f442a00a41330ee65ace48c51585c75490698df3117c501b57b42910ea3a83e7339a18b1691e5ec36b0d61e2c33c3a7086b797b31a07f65191cdc1d33891c53da3ecfc00a57fb75443d7239ac6c0d42d4f5700fed74d545da47db1ec1a4d584a9c0788f8f11a85a1fb42b9fff9213261adb9e9dd6c2c7af428da6dd3cc05d52600165a41523176361953548a2d519561fb98a2db643fcb193858d5ff178df2b5145785864a0ef4aa1869b5b31a21fb5a2a8b3cdca8b676db92a44939197f7942157c4fd6a9a2df0a0dfd78489f9aee47a596ed9798782369e02f28309183fca1376edc7bd3d6b0a3da118dd25a2fbda03c5ad0fd01d395960472385f983c85cdd507cc3d323ae0b22af10aa46c06352553398da9b85489416a956d0d68c16c87a380e79d593ad847601c100b07cde8c02773b55eb94a19f036ec03378a7d9c436826bb6121f1c4d0fc07a5a97429f61c6665d79e191bad8bdd820275bbe7edf99ac9de8eed4ae13bdee1b9518ad3eb9cfbe5445cf99aeb68031ffec775a982d4054e41a4fefc3b09fe97a2e610dddc58f208028f1a4b3fd43eae449993c6515156ca9f3fe9292d4d5f992e6261aa4c2b36e7224aa91e2cc788582778386eb5dcccb3631c87e357146587599d0b9aee5603169cfaa2e30361d274f845a66cd431359766c8e4bdda41019671fd65834cb95ff4e39fa5f3dd32f20dfb2cb53e00fc45a25e8546e7b5ef654eadfe7e6d8946275822d19604d13966ec694d7d82a356f7ad10dfee60abd2ec06d51202976b03b7bd2223e9253d2beff363bef68a5788b823dab4f11ed37bc0fd3613a1dbb0475658e6eca44593ae041fbdac7dfbeefa5f066028d11802085a264727fb833c7e5328bce00b3d6648f007f2a38c1ebb1f271496bd6b485e567574f2c1f3a02a099bacf16bbce54dccd7b06aeb77e61b8035ee08a80ec1af73ab62390b6a77e3a0a857b9768d4d86c1cb017538bfc9f4e832bfd023653ec0181a425810a96ac06386a690df4902d77ffed36b2592e0b0ee6c6d57ff3c19191cc5370f25a73bdedfc9e872db08afc71299e785998b58386100d57b3dae9a9df59ca7b1055eb0983b77827f074bbdb34893be87c77de7afaeb2773ecc74650edf36df24f8d86bca48edd544a94811da8c0214377695ff38a2728438f5faa9d9074d6dc5cddeb43a93e38910dc9886b4d7ee095cde502799855f128629178507ceaf1eb419a2b3114223ecb0288d5a696c9db723bfe9680ae00f4ab6061ad374d66500030a7174eed282dc6350078548953278ac8d3f8ff38220470e235d71c649c47d59ef157df271e61d8c21c3bc5d7d05bde7f4f358618e6a76e696c16e7955a37463000c9b56e0cd770cc9ce50a6c3280909cdca3c4ec5a1c85b8fdb740cc60791b97c037f39a2f66efc624a6bed57cb09d092fc089d259a69186bf425fd16abc859e733c7737f483320244bcb62265db42ff974048d64eeda9f06fa92d228dfed4b93525c3db2b55f61d1bf77d6e1443f24db65bcad0fe0549e39571262ec1284119cf9e2a898976623eee9d7dccb15389a8afbefa08036320e67b44e661a169bf7cb3bd97dc0ed71e41c2de8be6ebb085c319c561a08ef34bc9e89293d556372d92647547bc2ad217eaf3b580f64c9c8bef984c8fd97065d91546edaf10982789c4e58efd759db1733a278f12fca598219d7daf468518856366d49c5b4a7a34cd5e3782fc6c4a71766e1d427a7695da617ff2ec7ba7df5643478122ca72c382adb0d6de435da72a33408752940d486728d21521eff7f910f06fb33e9ef98c9f4153b1adfa9458d43dfa5a97af7b82820f109a128afa63f185695531be37c68a5d4c9544478140b7fb9d809c212c0fc3b12ee74034a9a101d5eadfad8949c285354dc07448c76e8633f96d91e34fcd3a81d9cf53243b97e1293c27987dd6972d64de93b941b1802b5495a25779709d8ae5365a2db7830381c3e68813cc"}) recvmsg$unix(r0, &(0x7f00000029c0)={&(0x7f0000002840)=@abs, 0x6e, &(0x7f0000002900)=[{&(0x7f00000028c0)=""/59, 0x3b}], 0x1, &(0x7f0000002940)=[@rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x70}, 0x20) faccessat2(r7, &(0x7f0000002a00)='./file0\x00', 0x8, 0x1200) quotactl$Q_SETQUOTA(0xffffffff80000802, &(0x7f0000002a40)=@nbd={'/dev/nbd', 0x0}, r14, &(0x7f0000002a80)={0x7fffffff, 0x7, 0x4, 0x36, 0x9, 0x3, 0x1, 0x4, 0x7}) r15 = syz_genetlink_get_family_id$ethtool(&(0x7f0000002b40), r9) getsockopt$inet_mreqn(r4, 0x0, 0x23, &(0x7f0000002b80)={@multicast1, @local, 0x0}, &(0x7f0000002bc0)=0xc) ioctl$ifreq_SIOCGIFINDEX_wireguard(r8, 0x8933, &(0x7f0000002c00)={'wg1\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r8, 0x89f1, &(0x7f0000002d00)={'gre0\x00', &(0x7f0000002c40)={'syztnl2\x00', 0x0, 0x10, 0x7800, 0xfffffe00, 0x101, {{0x20, 0x4, 0x1, 0x6, 0x80, 0x65, 0x0, 0x4, 0x4, 0x0, @loopback, @private=0xa010102, {[@ra={0x94, 0x4, 0x1}, @ssrr={0x89, 0xb, 0xf5, [@loopback, @loopback]}, @cipso={0x86, 0x3e, 0x2, [{0x6, 0x4, 'E#'}, {0x5, 0x4, "d451"}, {0x6, 0x10, "bc83c970796194bd38a6aa06c28f"}, {0x5, 0xa, "1151b2355bec8bb9"}, {0x5, 0x9, "f661ed151c3f44"}, {0x6, 0x3, "18"}, {0x6, 0xa, "4ae9cfb2e8cffd70"}]}, @rr={0x7, 0x1f, 0x86, [@empty, @broadcast, @local, @multicast2, @rand_addr=0x64010100, @multicast2, @multicast2]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r10, 0x89f1, &(0x7f0000002dc0)={'ip6gre0\x00', &(0x7f0000002d40)={'syztnl1\x00', 0x0, 0x2f, 0xf9, 0xce, 0x4, 0x6, @dev={0xfe, 0x80, '\x00', 0xc}, @dev={0xfe, 0x80, '\x00', 0x1b}, 0x40, 0x7800, 0x2, 0x7}}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r12, 0x8933, &(0x7f0000002e00)={'batadv_slave_0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000002ec0)={'ip6tnl0\x00', &(0x7f0000002e40)={'syztnl1\x00', 0x0, 0x4, 0xc0, 0x38, 0x1, 0x10, @local, @dev={0xfe, 0x80, '\x00', 0x27}, 0x7, 0x7, 0x3, 0x6}}) getsockopt$inet_mreqn(r11, 0x0, 0x0, &(0x7f0000002f00)={@initdev, @local, 0x0}, &(0x7f0000002f40)=0xc) getsockname$packet(r3, &(0x7f0000002f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000002fc0)=0x14) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r4, 0x89f0, &(0x7f0000003080)={'syztnl0\x00', &(0x7f0000003000)={'syztnl0\x00', 0x0, 0x2f, 0x5, 0x4, 0x4, 0x2, @ipv4={'\x00', '\xff\xff', @empty}, @local, 0x700, 0x7, 0x7, 0x2}}) ioctl$ifreq_SIOCGIFINDEX_wireguard(r10, 0x8933, &(0x7f00000030c0)={'wg2\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r4, 0x89f2, &(0x7f0000003180)={'syztnl1\x00', &(0x7f0000003100)={'syztnl1\x00', 0x0, 0x29, 0x9, 0x5, 0xffffffff, 0xa, @local, @mcast2, 0x10, 0x7800, 0x3, 0x9}}) sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(r3, &(0x7f0000003380)={&(0x7f0000002b00)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000003340)={&(0x7f00000031c0)={0x14c, r15, 0x0, 0x70bd26, 0x25dfdbfe, {}, [@HEADER={0x68, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r16}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r17}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r18}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nr0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg1\x00'}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r19}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r20}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, @HEADER={0x5c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r21}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r22}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r23}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r24}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_virt_wifi\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r25}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r26}]}]}, 0x14c}, 0x1, 0x0, 0x0, 0x8080}, 0x44004) syz_ublk_add_dev(r6, 0x0, 0x0, 0x0, &(0x7f0000003400)={0x2e, 0x4, 0x0, r5, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0xfdf0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000033c0)=@new_dev={0x1, 0xfc0, 0x0, 0x0, 0x1000, 0xffffffff, r13, 0x0, 0xe0}}}, &(0x7f0000003480)=0x0) r28 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000003540), 0x0, 0x0) syz_ublk_setup_queues(r7, r27, &(0x7f00000034c0)={0x0, 0x304, 0x4, 0x2, 0x172}, &(0x7f0000003580)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9e81, 0x4, 0x3, 0x0, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1de, 0x800, 0x2, 0xe0, 0x0, r28}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf074, 0x400, 0x1, 0x2a9, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc500, 0x10, 0x3, 0x17b, 0x0, r9}}], 0x4, &(0x7f0000004800)={0x2e, 0x29, 0x0, r3, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {0xba4}, 0x0, 0x0, '\x00', {0x0, 0x202, 0x0, &(0x7f0000003800)=@buf_512="989fda486cddbc17edb6b25aa1d70b218cfeb8e70d0516d24f670ecc10eb847795d879bc3c03863c03edda290f73d740b8ef949c9e97d10983addcf23454ca34cbfa159489b46dd9b75552fb3f85ff70224ceb4c6e948bf9feccdb04575401a5966bf4a7337868f1106fb0e93b26b339339bfd82f03aa6842fb7aa2045da3416d4c8b1a2fb3e7b4c47e1b9828d7d32026659440b3bdac532e9b56a521eb2213489a5ab869f8f77be2fbc322a3f87312117426752359d8b06f3f749bb77271e5d3b14414415ef805d88a9c6be78b9e2af6ed2a72c7304519ea3e6287702c5303d6bc8a9689f99d3b1e7cdc7e85483f059c087adf1c8ef868505c6516c7f258d7a387ba462a59c033789fafcc253979e90321d0b3789565ed1774d48f06c5fce34910cc8d7b501ede87b0789a94c3d3d56d6729ebe77747350878abbedcd4fe5f4c3cd81e9aa34746f63d7a7dd1e599aec272950035547b750ad7f8325073f0f8463bed0a6680a676346dbe66d69e938edde4474aff21398ba3fc8cb8be33ee6b9eee381e39e1d7d451d060a3dce8f6b62905910ceae591cc0a91bf7adc8117b530fab1b3e2b96bb5d2d5ca975817973be8c81fb1ec114d673bd84d2fd056b52f4e47053fc449cbbbb59decd7adc7b2cf3fd7b699676b3e5795f873b7de430a3df7cf2f04b29810d5b15e21920f8750e139315bdd38613980c1f3d177a2eeceec8"}}, &(0x7f0000004880)) r29 = syz_genetlink_get_family_id$nl80211(&(0x7f0000004900), r8) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r12, &(0x7f00000049c0)={&(0x7f00000048c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000004980)={&(0x7f0000004940)={0x28, r29, 0x200, 0x70bd25, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x3, 0x61}}}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x3}]}, 0x28}, 0x1, 0x0, 0x0, 0x4040011}, 0x40040) r30 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000004a00), 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r30, 0x89f0, &(0x7f0000004ac0)={'ip6tnl0\x00', &(0x7f0000004a40)={'syztnl0\x00', r22, 0x2f, 0x7f, 0x4, 0x80000000, 0x8, @dev={0xfe, 0x80, '\x00', 0xf}, @mcast2, 0x80, 0x1, 0xce, 0x1}}) 8.838840773s ago: executing program 2 (id=105): memfd_create(&(0x7f0000000340)='y\x105\xfc\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xa4\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01L\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x06\xb3\xf0wVq\xe9d\xac\xe9\xaa\x9dR\x00\x9b\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc2G\x1b+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2v\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x1e\x11X\f\x0f\xf0\xe2\xb5\xf8', 0xb) (async) memfd_create(&(0x7f0000000340)='y\x105\xfc\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xa4\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01L\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x06\xb3\xf0wVq\xe9d\xac\xe9\xaa\x9dR\x00\x9b\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc2G\x1b+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2v\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x1e\x11X\f\x0f\xf0\xe2\xb5\xf8', 0xb) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x3, 0x0) (async) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000600)={0x9, 0xffffffff, 0x4e, 0x567}, 0x13) sendmsg$nl_generic(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000900)=ANY=[@ANYBLOB="2c0000001600010b00000000fbdbdf25e70000001800ca80140006"], 0x2c}}, 0x40) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_int(r1, 0x29, 0x4c, &(0x7f00000005c0), 0x4) (async) setsockopt$inet6_int(r1, 0x29, 0x4c, &(0x7f00000005c0), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2400, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt\x00', 0x24) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt\x00', 0x24) r2 = syz_kvm_add_vcpu$x86(0x0, &(0x7f00000007c0)={0x0, &(0x7f00000006c0)=[@cpuid={0x64, 0x18, {0x4, 0x8001}}, @uexit={0x0, 0x18, 0x8}, @rdmsr={0x66, 0x18, {0xbbf}}, @nested_amd_stgi={0x17e, 0x10}, @nested_amd_stgi={0x17e, 0x10}, @nested_amd_clgi={0x17f, 0x10}, @out_dx={0x6a, 0x28, {0x95cb, 0x4, 0x4}}, @rdmsr={0x66, 0x18, {0x928}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x2, @control_area=0x2b, 0x20c, 0xffffffff, 0x5}}], 0xf0}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000800)={[0x2, 0xd, 0x7, 0x6, 0x3, 0x40, 0x1, 0xfc0, 0x1, 0x52ff, 0x7, 0x8001, 0x5, 0xffffffffffffff99, 0xffffffffffffffff, 0x9], 0x4, 0x41402}) (async) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000800)={[0x2, 0xd, 0x7, 0x6, 0x3, 0x40, 0x1, 0xfc0, 0x1, 0x52ff, 0x7, 0x8001, 0x5, 0xffffffffffffff99, 0xffffffffffffffff, 0x9], 0x4, 0x41402}) open$dir(&(0x7f0000000680)='./mnt\x00', 0x0, 0x2) (async) open$dir(&(0x7f0000000680)='./mnt\x00', 0x0, 0x2) socket$nl_generic(0x10, 0x3, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000080)=0x13, 0x4) sendmmsg$inet6(r3, &(0x7f00000000c0)=[{{&(0x7f0000000540)={0xa, 0x0, 0x0, @mcast2}, 0x1c, 0x0}}], 0x1, 0x800) (async) sendmmsg$inet6(r3, &(0x7f00000000c0)=[{{&(0x7f0000000540)={0xa, 0x0, 0x0, @mcast2}, 0x1c, 0x0}}], 0x1, 0x800) recvfrom(r3, 0x0, 0x1200, 0x12000, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000180)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) (async) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000180)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) write(0xffffffffffffffff, &(0x7f0000000140)='p', 0x1) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x8800) recvmsg$unix(r4, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xa0}, 0x80) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) syz_ublk_setup_io_uring(0x467c, &(0x7f0000000140)={0x0, 0xcfab, 0x8000, 0x0, 0x118}, &(0x7f0000000280), &(0x7f00000002c0), &(0x7f00000003c0)) socket$inet6_tcp(0xa, 0x1, 0x0) 7.444399346s ago: executing program 2 (id=127): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)="50000000320005f54500000000000000000000003c00010038000100090001006761637400000000280002801800020000000000002000000000002cae85560d4b5f536009c202cf0000000000000000", 0x50}], 0x1}, 0x0) 7.440920326s ago: executing program 2 (id=128): r0 = syz_create_resource$binfmt(&(0x7f0000000140)='./file1\x00') syz_usb_connect(0x3, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x43, 0x2, 0x5e, 0x20, 0x1a0a, 0x108, 0xf2cf, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x6, 0xa4, 0x20, 0x1, "", [{{0x9, 0x4, 0x4, 0x3, 0x0, 0x89, 0x1d, 0x7e, 0x4}}]}}]}}, 0x0) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0x0, 0x9eaf, 0x40000, 0x2, 0x2ca}, &(0x7f0000000180)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x479f, 0x8, 0x0, 0x99}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xdd18, 0x1000, 0x0, 0x1cd}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3ab9, 0x2000, 0x20000000, 0x13}, 0xffffffffffffffff}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf5f4, 0x20, 0x0, 0x2e3}}], 0x4, &(0x7f0000001800)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x5}, 0x0, 0x0, '\x00', {0x3, 0x773, 0x0, &(0x7f0000000800)=@buf_512="4e42feaa00052d4fb4fb13f61300912f84d737e7fded54bbfed3547f139ddea738b6138f7e9a38f9bbc7134c2e897affd72bf94aa83360a80d3185ee0520663b773bbe13dabc73d07bd43f8b9c3232c11eba5c9481e3d5370299950b7e8b36f74967325733504b3997bbf100b8c6d299321ff5eddc3c71ae7ff3b495a6ed26ce3eb812026b08ba402d6eb7423dbb1435d017aa5d7e3fef35682eafff69a8357abc2d6f140dedcda0a26e9e40f4dec3ff8c5bd11aa15c6a7a5a8246592df404481d477fe8303ef0a7087a7b3d6b931a9f474d76081ea9a7dd3903f6e9372129a9bc7b91e6190e9dce592482894fd7982867e99d5637624719fec445c2b81b5e1b6cc388b4664a9f1744ed0ddd0333e7cd053833bdebca2a070c80ef53fab6719c3fa11302ee2b1040c74520b5fb52fb2c3d08358dfb91a05dcc2f7f57ff15425e34fc8265fda85d67df8c26b0406b0a049d2eb53309565f313aa11b659659696d8694589493cbb30f84cc17aa39aa7b56e36001ad1a7395a2601fb7cf24d832870315db2123a9afe079a4572a25a26d497a0525a323a58adc0244887a0024698847776195a0e0232e769bf91fb8059e003f9f0133a4948844110d8fbe24226779f59eb717baeb85aa6511a24f26f0da4e859f107d59a4f3be1c6362f4bec79b4c1fb8244d943e04c70c082544d0fc0ea8e4b9f5d8e27ab28cf154d0118d4fddfe"}}, &(0x7f0000001880)) mmap$IORING_OFF_SQ_RING(0x0, 0x0, 0x1000000, 0x100010, r1, 0x0) r2 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff) close(r2) r3 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', &(0x7f0000000040)={0x105000, 0x10, 0x12}, 0x18) execveat$binfmt(r3, r0, &(0x7f00000007c0)={[], 0x1f}, 0x0, 0x0) 6.295824364s ago: executing program 2 (id=129): r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000a40)='.\x00', 0x0, 0x121) r1 = add_key$keyring(&(0x7f0000000380), &(0x7f00000003c0)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key(&(0x7f0000000400)='asymmetric\x00', 0x0, &(0x7f0000000440)="30800201", 0xfffff, r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./trace\x00', &(0x7f0000000280)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./trace/events/sched/sched_switch/filter\x00', 0x2, 0x0) write$FUSE_BMAP(r2, 0x0, 0xff0f) fcntl$notify(r0, 0x402, 0x2) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000a80)='./file0\x00', 0x1000, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000ac0)='./file0\x00', 0x20842, 0x4) write$P9_RWALK(r3, &(0x7f00000001c0)=ANY=[@ANYBLOB="300000006f0900000000000000000000080000000000000002010000000700000000000000502e2a6acb3df4d2cb423f21fcbd5e3a7998ae1ff36f2f06a24b1669ac9e2f75e45bb3d4493a694d1f705354354ef37d49f0"], 0x30) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$sock_buf(r4, 0x1, 0x24, 0x0, &(0x7f0000000340)) syz_clone(0x200000, &(0x7f0000000000)="e3ae690252d9dc36ecec6e19f0a82c5459c91e7285925d930c447f42d91074ed07fe3ef44b82a8b4ff28c128c4cf1d0a646b6aecd05e7f5c646688341f28509ad4c3bb280a041f87024dbfd788d59daf6ec50fcb9bab8c6e59c022bd4fa84f36e353cd3e241c7a3d321fbd561bd24dbf835c912e2ad955b70e0cbdc89ff88a10dd778bf4a00c6518281aec253fd9792f1e914a49d8acd008107501f4d494338ba7a9878be9bd41ec84dba9f69aa37e8dcdfbca2d0a1a754c9082a5f48eaf0b7b30419df13cba1fa647e6", 0xca, &(0x7f0000000100), &(0x7f0000000140), 0xfffffffffffffffe) landlock_create_ruleset(&(0x7f0000000300)={0x484, 0x9, 0x2, 0xa420, 0x2, 0x2}, 0x30, 0x0) fcntl$setpipe(r2, 0x407, 0x10) write$P9_RVERSION(r3, 0x0, 0x15) 6.271837696s ago: executing program 2 (id=130): syz_usb_connect$uac3(0x3, 0x86, &(0x7f0000000240)=ANY=[@ANYBLOB="1201100300000010820582054000010203010902740003010f6003080b0002010130000904000000010130000a2401050a00e58a000009040100000102300009040101010102300006240201000709050109100090060f0a2525040000000a040009040200ffff023000090402010101023000090506"], &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0}) r0 = openat$kvm(0x0, &(0x7f0000000100), 0x8080, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000000000)=0x20800001, 0x4) setsockopt$inet6_int(r3, 0x29, 0x4e, &(0x7f0000000040)=0x1, 0x4) mount(&(0x7f0000000140)=@sr0, &(0x7f0000000940)='./file0\x00', &(0x7f0000000980)='squashfs\x00', 0x1000000, &(0x7f00000009c0)='\x00') connect$can_bcm(0xffffffffffffffff, &(0x7f00000000c0), 0x10) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x1, @rand_addr=' \x01\x00', 0x8000}, 0x1c) listen(r3, 0xa) r4 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@code={0xa, 0x6e, {"488d054900000048c7c30052020066890348c1e8106689430648c1e810894308b91b0000000f320d000c00000f30b90f08000031d2b8ff0100000f30b93008000031d2b8200000000f30fb90909090f4b90b08000031d231c00f3048cf"}}], 0x6e}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_SET_LAPIC(r4, 0x4400ae8f, &(0x7f0000000540)={"5063e49833b3edc63d1d1f63dca6a70fa8b612002326224ea884e212b6f165a29aed1f5b1935c87c5404356f768deefd8b3bbee679d681d10ec4d9d38d427ebf5aec16d0df1312bded7e3aa999d3a7a6bab6775a1d2c03f5032babd2de10404121605c17da90a004c79930c3fb28917b3b5c879661640093655c0c918d3a95880082d30069445448390a34f5245136ea1f5f1f4a9c3baae0dd9ff6d1bd967781e980871de660815f5d57b3e506397f893558293ec97aa196da08368c0c144e2dc00f90e79e4c6b8e25661b3308253ddc0195321a345c6bfbc09757d9cb351bd9f5e6df8aba7aaf3b2d43282bc1787e06af8d563ccbc8f6f66d336d8529fe540e298f2af3a6ef64b73989f7b0241b7e5e2538037f3195ed638ff003d8fd5845c708966d4d76afa4fd1e28812d3cc209b689303cb71978ce4b4714cf57616dc6018053d2702fb1da0af7f4bc8c1033f7c61fe74d57a013edaecaa5826e8e80dc328f8a09da0feee4778794ba84416764de8fbdd8cd261a75d7e2216753974b72d3aad0cdc6c5cc7ae21e9a69735b9e57a1beab257069ed6c15215aca04bb2fb9fece7219f16974ad64bc2ae03351e01111d53b2de4c3ea537d0520f4fe481775745eaf393ef56bfc818522aef895b9821e682b6a1430f5ed9c9d8809b8cbb731935d4c97df641e94fbe3b0d47266a70fbee8f1ba68a901f652247c4fdcbc085a6d273af1225476f2afcb3727d1d1296d4259bc2ea9cf3d59b20b7f2d96532d0aa0dd8716e06d2f22ef03dddb94217fadbaffdb40245f8c89a1981144b87eb6297e3e972c79f11d700142d9291563a32545831ab010f22ffd028ae4d9d941cc744829047f810b8dd92acce9095e14369085e9a28b2c00323d8cfc6aa77076a60affccae19f202ee97cadc1890dde18549fe0e68b7469d469e89a6f86df6b5da5db18ed57b04847baa5a945b0364d862d573b445cc361d6d6ab18f68fdbe43922133713152077564ef1b1735e4f027d993b1d1e6459aa3f6fe61de92b33b332a4183a13c2bd459843d27a7d27d2d0901a151f27c96341b0fff729bda829108dd29f83f700fa0c92b6154a9d76255163b928fc65079ba9cf50dccb801c333e61f572d51e9a4ccf53bcc7e1826b336bc910a0b360fa14b3dd92ae3865ab7a6ca3c58a3a0df66fb9f0fc7b6e4c03d0631fdbdd90c94d4f842e714de35b05f5314b8b24ed5ae0d570056e6368b8195fef4c02a99812d83b117f8f0681bcfc207b759fe981b56f001dca52f5cb47e98e3327f5c942f0866336bd139dedeac6ff24ba787c952e1d8e6f87751957e62847e2aada07d98dc2c1b17712974ff17ca92e5b59565fdbd20dc2501e4f24549ec3e26a871b0f14aff7821eb3bd13c7e897b3c99ac3d819ead0b661dd81dfc47060fd98bcc002ec6ad94c1c59a5e8172d7395dc20070"}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000300)={0x2, 0x0, @ioapic={0x80a0000, 0x5, 0x60, 0x7fffffff, 0x0, [{0x41, 0x9, 0x40, '\x00', 0xd7}, {0x51, 0xa, 0x5, '\x00', 0x9}, {0x72, 0xfb, 0x80, '\x00', 0x5}, {0x40, 0x0, 0xe9, '\x00', 0xd}, {0x1, 0x9c, 0x7f, '\x00', 0x30}, {0x7e, 0x4, 0x8, '\x00', 0x9}, {0xb, 0x58, 0x8, '\x00', 0x2}, {0x4, 0x2, 0x75}, {0x5, 0x0, 0x10, '\x00', 0x7f}, {0x8, 0x18, 0x3, '\x00', 0xb0}, {0x4, 0x7, 0x7, '\x00', 0x2}, {0x5, 0x3, 0x65, '\x00', 0xfe}, {0x10, 0x9, 0x1, '\x00', 0x4}, {0x80, 0xaa, 0x8}, {0x7f, 0x1, 0x8, '\x00', 0x8}, {0x8, 0x4, 0x5, '\x00', 0xfa}, {0x3, 0x5, 0x1, '\x00', 0x2}, {0xe8, 0x6, 0x80, '\x00', 0x5}, {0x8, 0xc, 0x4, '\x00', 0xb}, {0x8, 0x9, 0xa, '\x00', 0x7}, {0x9, 0xfe, 0x9}, {0x7, 0xc5, 0x7, '\x00', 0x40}, {0x10, 0xff, 0x4, '\x00', 0x6}, {0xd, 0xbc, 0x3, '\x00', 0x1}]}}) 5.990194865s ago: executing program 2 (id=136): nanosleep(0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000c80)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r1, 0x25, &(0x7f0000000cc0)={0x0, 0x0, 0x17f17e79, 0xfffffffffffc}) ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000000000)={0x0, 0x7, 0x2}) ioctl$BTRFS_IOC_RESIZE(r1, 0x50009403, &(0x7f0000000400)={{r0}, {@val={r2}, @actul_num={@val=0x2d, 0x9, 0x65}}}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000d00)='cpuset.effective_cpus\x00', 0x275a, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000d80)='cpuset.effective_cpus\x00', 0x275a, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) setresuid(0x0, 0xee00, 0x0) prlimit64(0x0, 0x8, &(0x7f0000000440)={0x4, 0x7}, 0x0) lsetxattr$trusted_overlay_origin(0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$sock_int(r5, 0x1, 0x3c, &(0x7f0000000480)=0x1, 0x4) sendmmsg$inet(r5, &(0x7f00000004c0)=[{{&(0x7f0000000500)={0x2, 0x4e22, @empty}, 0x10, 0x0}}], 0x1, 0x240080e4) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c0200001900010025bd700001000000fe8800000000000000000000000000010000000000000000000000000000000000000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000001000000000000000000000000000000900000000000000000000000000000005000000000000000000000000000000000000000000000000000000000000000000000000000000040800000000000000000000000000000002000000000000010001000000000084010500ac1414aa00000000000000000000000000000000330000000000000064010100000000000000000000000000ff340000000000000000000000000000402000007f000001000000000000000000000000000020003c00000002000000fe80000000000000000000000000000000000000000000000000000000000000000000007f000001000000000000000000000000000000006c00000000000000e00000010000000000000000000000000000000000000000000000000000000000000000ac1414430000000000000000000002000000000033"], 0x23c}, 0x1, 0x0, 0x0, 0x1}, 0x4000) fcntl$lock(r4, 0x26, 0x0) fcntl$lock(r3, 0x25, &(0x7f0000000e40)={0x0, 0x0, 0x9, 0x17}) close_range(r0, 0xffffffffffffffff, 0x0) 5.877852397s ago: executing program 32 (id=136): nanosleep(0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000c80)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r1, 0x25, &(0x7f0000000cc0)={0x0, 0x0, 0x17f17e79, 0xfffffffffffc}) ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000000000)={0x0, 0x7, 0x2}) ioctl$BTRFS_IOC_RESIZE(r1, 0x50009403, &(0x7f0000000400)={{r0}, {@val={r2}, @actul_num={@val=0x2d, 0x9, 0x65}}}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000d00)='cpuset.effective_cpus\x00', 0x275a, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000d80)='cpuset.effective_cpus\x00', 0x275a, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) setresuid(0x0, 0xee00, 0x0) prlimit64(0x0, 0x8, &(0x7f0000000440)={0x4, 0x7}, 0x0) lsetxattr$trusted_overlay_origin(0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$sock_int(r5, 0x1, 0x3c, &(0x7f0000000480)=0x1, 0x4) sendmmsg$inet(r5, &(0x7f00000004c0)=[{{&(0x7f0000000500)={0x2, 0x4e22, @empty}, 0x10, 0x0}}], 0x1, 0x240080e4) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c0200001900010025bd700001000000fe8800000000000000000000000000010000000000000000000000000000000000000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000001000000000000000000000000000000900000000000000000000000000000005000000000000000000000000000000000000000000000000000000000000000000000000000000040800000000000000000000000000000002000000000000010001000000000084010500ac1414aa00000000000000000000000000000000330000000000000064010100000000000000000000000000ff340000000000000000000000000000402000007f000001000000000000000000000000000020003c00000002000000fe80000000000000000000000000000000000000000000000000000000000000000000007f000001000000000000000000000000000000006c00000000000000e00000010000000000000000000000000000000000000000000000000000000000000000ac1414430000000000000000000002000000000033"], 0x23c}, 0x1, 0x0, 0x0, 0x1}, 0x4000) fcntl$lock(r4, 0x26, 0x0) fcntl$lock(r3, 0x25, &(0x7f0000000e40)={0x0, 0x0, 0x9, 0x17}) close_range(r0, 0xffffffffffffffff, 0x0) 3.622929818s ago: executing program 4 (id=175): r0 = syz_usb_connect$cdc_ncm(0x2, 0x7a, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902680002010040000904000001020e0000052406000105240000000d370f0100000000000000000006241a0000000c241b4800f3ff00050080050905810300020000000904010000020d00000904010102020d0000090582020004000000090503020002"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000002680)={0x5e, 0x0, 0x0, 0x0, &(0x7f0000002700)={0x20, 0x80, 0x1c, {0x538a, 0x4, 0x0, 0x6, 0x3, 0x3, 0x41, 0xdfe, 0x1, 0xeba7, 0x204, 0x80}}, 0x0, 0x0, 0x0, 0x0}) mount(&(0x7f0000000080)=@loop={'/dev/loop', 0x0}, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='smb3\x00', 0x2440, &(0x7f0000000140)='\x00') syz_usb_control_io(r0, 0x0, 0x0) 2.103968304s ago: executing program 3 (id=184): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000040)={0x1, 0x0, [{0x1, 0x3, 0x0, 0x0, 0x0, 0x20}]}) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000000140)=@vmx={0x0, 0x0, 0x2080, {0x1000, 0xffffffffffffffff}, {"0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ebffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100"}}) 2.103750354s ago: executing program 3 (id=185): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)="50000000320005f54500000000000000000000003c0001003800010009000100676163740000000028000280180002000000ffffffef00000000002cae85560d4b5f536009c202cf0000000000000000", 0x50}], 0x1}, 0x0) 2.098809255s ago: executing program 3 (id=186): openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x101800, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x41) write(r0, &(0x7f0000000040)='0', 0x1) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f00009b3000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000240)="f30f09b96a090000b80fb2be1abaae5d5b360f30f2a726f3420fbd05a0dab3b53e0f32400f070f350f01c8c4029538156b0b00000f011b", 0x37}], 0x1, 0x71, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28012, r3, 0x0) mount$binderfs(0x0, 0x0, &(0x7f00000000c0), 0x4800, 0x0) r4 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000009e602206d0414c340000000000109022400010400a000090400000103010100093700086ce82201000905815f"], 0x0) syz_usb_control_io(r4, &(0x7f0000000140)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0x13, 0xe1, 0x2, 0x3, '8\x00}4', "87bf00"}}, 0x0}, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.507902955s ago: executing program 3 (id=188): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000380)={0x1, &(0x7f0000000400)=[{0x6, 0x10, 0x0, 0x7fff7ffc}]}) close_range(r0, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', 0x1}) write$tun(r1, &(0x7f00000000c0)={@val={0x70}, @void, @eth={@broadcast, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0xb, 0x28, 0x64, 0x0, 0x9, 0x6, 0x0, @remote, @broadcast}, {{0x4e23, 0x4e21, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0x20, 0x0, 0x0, 0x2}}}}}}}, 0x3a) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000180)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) write(0xffffffffffffffff, &(0x7f0000000140)='p', 0x1) socket$nl_generic(0x10, 0x3, 0x10) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) pipe2$9p(0x0, 0x0) syz_io_uring_setup(0x0, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000100)=0x0) ptrace(0x4208, r3) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@any_dev={0x2, 0x465, 0x0, 0x0, 0x1000, 0x1c9e959d, 0x0, 0x0, 0x106}}}, &(0x7f0000000300)=0x0) syz_ublk_setup_io_uring(0x477c, &(0x7f0000000140)={0x0, 0x4fab, 0x20000, 0x0, 0x118}, &(0x7f0000000280), &(0x7f00000002c0), &(0x7f00000003c0)) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f00000004c0)={0x0, 0x42cc, 0x10, 0x40001, 0x80}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe706, 0x1000, 0x7, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9b45, 0x1000, 0x4, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93e9, 0x200, 0x4003bfff, 0x99, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x230}}], 0x1, 0x0, 0x0) 1.507418495s ago: executing program 4 (id=189): r0 = syz_usb_connect$hid(0x4, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201eabd89f4000000000001090224000500008024090400050203000200092100003e1500"/49], 0x0) r1 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x42002, 0x180) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_setup(0x606a, &(0x7f0000000300)={0x0, 0x4029, 0x4000, 0x3, 0xab}, 0x0, 0x0, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="020300091b0000000000000000000000040003000000000000000000000000000000000000000000000000000000000005000600000000000a00000000000000fe8000000000000000000000000000bb00000000000000000400040000000000000000000000000000000000000000000000000000000000020001000000000000000000000000ff05000500000000000a00000000000000fe8896380000000000000001000000010000000000000000030007000000000002004e24ac14141f0000000000000000020013"], 0xd8}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r3 = socket$unix(0x1, 0x2, 0x0) bind$unix(r3, &(0x7f0000000500)=@abs={0x1, 0x0, 0x4e24}, 0x48) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) syz_clone3(&(0x7f0000000280)={0x148000000, &(0x7f0000000080), &(0x7f00000000c0)=0x0, &(0x7f0000000100), {0x31}, &(0x7f0000000180)=""/2, 0x2, &(0x7f00000001c0)=""/112, &(0x7f0000000240)=[0x0], 0x1}, 0x58) r5 = fsopen(&(0x7f0000000580)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0x1) fchdir(r6) r7 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r7, 0x40086602, &(0x7f0000000600)=0x40430a) ioctl$KVM_SET_VCPU_EVENTS(r1, 0x4040aea0, &(0x7f0000000640)=@arm64={0x9, 0x1, 0x1, '\x00', 0x1}) ptrace(0x4207, r4) 1.36404951s ago: executing program 0 (id=191): fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xffffff7b) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000380)='net/psched\x00') preadv(r0, &(0x7f00000001c0)=[{&(0x7f0000000200)=""/200, 0xc8}], 0x1, 0x3, 0x0) pread64$ublk_ch(r0, &(0x7f0000000c00)=@buf_1k, 0x1000, 0x7f) openat$fuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@random={'security.', 'upperdir'}) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) lsetxattr$system_posix_acl(&(0x7f0000000800)='./file0\x00', &(0x7f0000000bc0)='system.posix_acl_access\x00', 0x0, 0x0, 0x2) 1.300352037s ago: executing program 0 (id=192): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = fsopen(&(0x7f0000000000)='fuse\x00', 0x0) fchown(r1, 0xffffffffffffffff, 0xffffffffffffffff) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x10001, &(0x7f0000004780)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRES64=r0, @ANYBLOB]) ioctl$FUSE_DEV_IOC_BACKING_OPEN(r0, 0x4010e501, &(0x7f00000000c0)={r0}) 1.295373267s ago: executing program 0 (id=193): syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, 0xfffffffffffffffd, 0x0, 0x29, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdir(0x0, 0xe7) capset(&(0x7f0000000000)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x0, 0x8000000}) mkdirat(0xffffffffffffff9c, 0x0, 0x1d0) socket$netlink(0x10, 0x3, 0xf) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e4, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000003000000400001802c0004001400010002004e22ac1414aa00000000000000001400020022000000e000000200000000000000000d0001007564703a73"], 0x54}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, 0xfffffffffffffffd, 0x0, 0x29, 0x0, 0x0) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) (async) mkdir(0x0, 0xe7) (async) capset(&(0x7f0000000000)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x0, 0x8000000}) (async) mkdirat(0xffffffffffffff9c, 0x0, 0x1d0) (async) socket$netlink(0x10, 0x3, 0xf) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$sock_bt_hci(r0, 0x400448e4, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$tipc2(&(0x7f00000003c0), 0xffffffffffffffff) (async) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000003000000400001802c0004001400010002004e22ac1414aa00000000000000001400020022000000e000000200000000000000000d0001007564703a73"], 0x54}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) (async) 1.259429571s ago: executing program 0 (id=194): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000040)={0x1, 0x0, [{0x1, 0x3, 0x0, 0x0, 0x0, 0x20}]}) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000000140)=@vmx={0x0, 0x0, 0x2080, {0x1000, 0xffffffffffffffff}, {"0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200", "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ebffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100"}}) 1.120309965s ago: executing program 0 (id=195): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000ac0), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000b00)=0xcde, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000b40), r0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r1, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000c40)=ANY=[@ANYBLOB="4c000000100001060000000000000a00000000000000000000000000000000010b00033264756d6d7930000008001f0004000000180012000a00010064756d6d79"], 0x4c}], 0x1, 0x0, 0x0, 0x4040001}, 0x0) 1.113337265s ago: executing program 0 (id=196): ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae03, 0x26) r0 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$selinux_access(r0, 0x0, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000080)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./dev_mnt\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000000000407d1e5a2d00000000000109022400010000000009040000010301020009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f00000003c0)={0x24, 0x0, 0x0, &(0x7f0000000400)={0x0, 0x22, 0x22, {[@global=@item_012={0x2, 0x1, 0x9, "2313"}, @global=@item_012={0x2, 0x1, 0x0, "e53f"}, @global=@item_4={0x3, 0x1, 0x0, '\f\x00'}, @local=@item_012={0x2, 0x2, 0x2, "9000"}, @global=@item_4={0x3, 0x1, 0x0, "0900be00"}, @main=@item_4={0x3, 0x0, 0x8}, @local=@item_4={0x3, 0x2, 0x0, "09007a15"}, @local=@item_4={0x3, 0x2, 0x0, "5d8c3dda"}]}}, 0x0}, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r3, &(0x7f00000045c0)={0x0, 0x0, &(0x7f00000046c0)={&(0x7f0000004700)={0x18, 0x19, 0x1, 0x0, 0x25dfdbfb, {0x1d, 0xd601, 0x9}, [@nested={0x4, 0x6}]}, 0x18}, 0x1, 0x0, 0x0, 0x5}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) move_mount(r6, &(0x7f00000002c0)='./file0/file0\x00', r6, &(0x7f0000000300)='./file0/file0\x00', 0x247) getsockopt$IP_SET_OP_GET_BYNAME(r6, 0x1, 0x53, &(0x7f0000000340)={0x6, 0x7, 'syz0\x00'}, &(0x7f00000024c0)=0x28) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000001c0)={'syzkaller1\x00', 0x5001}) r7 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) write$tun(r4, &(0x7f0000000240)={@void, @val={0x0, 0x0, 0x5, 0xde6, 0x9, 0x401}, @ipv4=@generic={{0x5, 0x4, 0x1, 0x33, 0x3c, 0x67, 0x0, 0xbd, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "414dc1c90728557ded5995abd8c2dd746ed1b8e7b953b5e72002e546652f979f45a699fe21e64016"}}, 0x46) r8 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./dev_mnt/roccatsavu0\x00', 0x2, 0x0) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f0000002540)='/proc/crypto\x00', 0x0, 0x0) read$FUSE(r9, &(0x7f0000002580)={0x2020}, 0x2020) mount(&(0x7f00000045c0), &(0x7f0000004600)='.\x00', &(0x7f0000004640)='tmpfs\x00', 0xa145c7, 0x0) r10 = syz_open_procfs(0x0, &(0x7f0000004680)='mounts\x00') lseek(r10, 0xfff, 0x0) ioctl$INCFS_IOC_PERMIT_FILL(r7, 0x40046721, &(0x7f0000002500)={r1}) read$FUSE(r8, &(0x7f0000000480)={0x2020}, 0x2020) close_range(r1, 0xffffffffffffffff, 0x0) 1.004988727s ago: executing program 3 (id=197): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d6) r0 = syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r1 = syz_kvm_add_vcpu$x86(r0, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24008005}, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x34a300, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x4) ioctl$KVM_GET_MSRS_cpu(r5, 0xc008ae88, &(0x7f0000000140)={0x1, 0x0, [{0x400000f1, 0x0, 0x1ff}]}) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f0000002580), 0x2000, 0x0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000100)=[{0x6, 0x75, 0x0, 0x7fff0000}]}) mkdirat(0xffffffffffffff9c, &(0x7f00000048c0)='./file0\x00', 0x92) socket$nl_netfilter(0x10, 0x3, 0xc) mount(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x3b94441, 0x0) mount$overlay(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000200)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r7 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r7, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000004800)=[@text64={0x40, &(0x7f0000004840)="6766672e0f23a4b8010000000f01c448b800000000008000000f23d80f21f835c0000040c4e2ad472866baf80cb8ba9ad088ef66bafc0c66b80080c40197519f5095b9ec0f380beac7442400aa150000c74424020d000000c7442406000000000f01142436440f01c9263233450f01c3", 0x70}], 0x1, 0x7e, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x4, 0x80) r8 = socket(0x1e, 0x1, 0x0) connect$tipc(r8, &(0x7f0000000380)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10) write$binfmt_misc(r8, &(0x7f00000003c0), 0x2000011a) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$tipc(&(0x7f00000047c0), 0xffffffffffffffff) ioctl$KVM_RUN(r1, 0xae80, 0x0) sendmsg$TIPC_CMD_SET_NODE_ADDR(r9, &(0x7f0000004a00)={0x0, 0xa1, &(0x7f0000004a40)={&(0x7f0000004a80)={0x24, r10, 0x201, 0x400000, 0x0, {{}, {}, {0x8, 0x11, 0x4}}}, 0x24}}, 0x0) close_range(r6, 0xffffffffffffffff, 0x0) 912.439226ms ago: executing program 4 (id=198): r0 = openat$kvm(0xffffff9c, 0x0, 0x8000, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="0c0100000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000fffffffd0000aa14000400fc0000000000000000000000000000000c00028005000100000000003c0002800c00028005000100000000002c000180140003000000000000000000000000000000000114000400fe8000000000000000000000000000aa08000740000000007800068014000500fc0200000000000000000000000000010c000380060001"], 0x10c}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 895.452128ms ago: executing program 4 (id=199): mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0xecf86c37d53049cc) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/devices/system/cpu/cpu1/hotplug/target\x00', 0x1, 0x0) write$P9_RGETLOCK(r1, &(0x7f0000000200)={0x33, 0x37, 0x2, {0x1, 0xffffffffffffffff, 0x655c, 0x0, 0x15, '/--}(\xd6\x83[vf\x97\x8a|&\xad#\x00?i^\xbd'}}, 0x33) wait4(r0, 0x0, 0x1, &(0x7f00000000c0)) 865.901581ms ago: executing program 4 (id=200): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f00000000c0)={0x0, 0x0, 0x10001, 0x5}) r1 = syz_create_resource$futex(&(0x7f0000000100)=0x1) r2 = syz_create_resource$futex(&(0x7f0000000140)=0x1) futex(r2, 0xb, 0x1, 0x0, r1, 0x403) futex(r1, 0x6, 0x0, 0x0, r1, 0x1) futex(r2, 0xc, 0x1, 0x0, r1, 0x1) futex_waitv(&(0x7f0000001240)=[{0x5, &(0x7f0000000e00)=0x8, 0x2}, {0x9, &(0x7f0000000e40)=0x9, 0x2}, {0x693, &(0x7f0000000e80)=0x80, 0x82}, {0x4, &(0x7f0000000ec0)=0x5, 0x82}, {0x2, &(0x7f0000000f00)=0x490b, 0x80}, {0x8, &(0x7f0000000f40), 0x82}, {0xffff, &(0x7f0000000f80)=0x8, 0x82}, {0x5, &(0x7f0000000fc0)=0x8, 0x2}, {0x0, &(0x7f0000001000)=0x3, 0x82}, {0x0, &(0x7f0000001040)=0x9, 0x2}, {0x8, &(0x7f0000001080)=0x4, 0x2}, {0xfffffffffffffff3, &(0x7f00000010c0)=0x9, 0x82}, {0xffff, &(0x7f0000001100)=0x400, 0x2}, {0x2, &(0x7f0000001140)=0x7f, 0x82}, {0x6, &(0x7f0000001180)=0x8000000000000000, 0x82}, {0x4, &(0x7f00000011c0)=0x7fffffff, 0x2}, {0x1, &(0x7f0000001200)=0xffffffffffffffc0, 0x2}], 0x11, 0x0, &(0x7f0000001400), 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)="2d2930202faa66d28f74c153359fb7", 0xf) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440), 0xffffffffffffffff) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r5, 0x107, 0xa, &(0x7f0000000480)=0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000004c0)={'batadv_slave_0\x00', 0x0}) bind$packet(r5, &(0x7f0000000500)={0x11, 0x0, r6, 0x1, 0xf7, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000580)=0x14) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r8 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r8, 0x0, 0x2e, &(0x7f0000001440)={0x4, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @local}}}, 0x108) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000640)={'syztnl1\x00', &(0x7f00000005c0)={'syztnl0\x00', 0x0, 0x0, 0x6, 0xf1, 0x0, 0x20, @empty, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x8, 0x10, 0x1, 0x7}}) sendmsg$ETHTOOL_MSG_EEE_SET(r3, &(0x7f0000000dc0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000d80)={&(0x7f0000000680)=ANY=[@ANYBLOB="dc0600", @ANYRES16=r4, @ANYBLOB="000129bd7000ffdbdf2518000000f402028058000380240001800400030007000200245d000009000200636f6d6d00000000080001000300000030000180040003000400030008000100ffff000008000100050000000e0002004e4c424c5f4d474d540000000400030068000380080001800400030008000180040003002000018008000100b16b0000080001007bfdffff060002007d000000040003001c0001800400030004000300070002002b400000040003000400030008000180040003001000018005000200000000000400030028000380240001800800010005000000080001007bd7000008000100010000000800010006000000d6000500f3d04f45c975b939af0bb291b268cba10486ff8fac5f4ee7399ad09c9dbb3edf074a3b25b886bd2fe80c7d566515f76fb2b65c2e0aa678c93959842daf46561181c53792401d28a40a929a57da60915d453ad95ec470b598fb20e4fc641ab4f05f8c7308862a5a54ee299b7f9cec86ca2bbd40c02a62e93d33c99cae6d3fb8ca0dd23f4f74b54a28fa7f847b9ba227b00a3327c8e7631e45cba4ebf5d945059a396f8bed9bce8a7e952d2e63fc88a841054562d87a3db09a4b3c28c4504c774d45864696c79d04b19a37b5712fc03d3ea8ca000020010380040001802c0001800e0002004e4c424c5f4d474d540000000f0002002624265d2d2521272c2300000800010081ffffff2c0001800400030008000100080000000800010081000000080001000400000009000200636f6d6d00000000100001800400030008000100090000005400018008000100090000000400030005000200000000000400030008000100040000000e0002005b2d7b26242ced7d4000000008000200272a2a0008000100050000000d0002005b5c2b2153293a26000000001c000180080001000000000008000100ffffffff08000100010100000c00018008000100020000003400018008000100020000000800010005000000040003000900020066642f330000000008000100edd80000060002005c00000008000200e6000000040001000400010058030280e9000400b6213eb7c3de8d10bdd41f074eef709e507647a4dff2a4e0fcab78b80f6624619f87430240ad7963c0d626bfab5f460bce92c407835f8d7fe908fb2f799267149119af506e781772025ce567a6dd5b70d9da75a60755be6668d66e70ee613f4c4cd7c747456c1eba0cf7a3c8a62f70f56ce2e67b2e85ed747d86c907a0fe13107263e80934cf3ea989f39376d7de86e4fd4a208f34e11598cc94cae9cf280ec08d6c72ef992bf0330b390349a0130460d26cc4e82a346cc99ec6217d6db2bf842d972588e0ded1ca0f4a9d6dd1a7aa6490d7770551eca21458abe5db33264e178398eb66f9000000b9000500cd466f62bd12f585861fd0ce031c8692491f9e0786d4b945b37599136ccda307de63a65cdbdf70848e01ded76403507c61b25f16082b31a26c9129a162e1fbc3ed1d14e6063be22c3378928d25f3f382bf1f516e51506353b0d91b6ceec3094244c23c4a691377e9bd8e396c77d8d0fcc926b27b68ecdcb6e24b58a40a9038ac3ac4b3630b516e102a8483746f249bbaf6925b99edc304b48fac7f644ff7e4c703ea87e0e669b1509aea14917d664c8ede36efdc0000000004000100cc0003800c0001800400030004000300100001800400030008000100040000005000018008000100feffffff09000200636f6d6d00000000080001000700000004000300080001000600000004000300080001000700000008000100020000000e0002004e4c424c5f4d474d5400000008000180040003003400018004000300080001000300000009000200636f6d6d000000000500020000000000040003000400030008000100000000002000018008000100f9ffffff060002002d00000009000200636f6d6d000000000400010054000500d8fde635454b5b6655d966687f870c38ee39ff4e57f3144195529b72ff1802bf13028793da4bb434bc9260b6da3eed149033a3ed50c014756c846c5da39a2b97beb706bdb51f48963a8f0b4fdda7fe9d770004006fd55407df2a469c76f2f2c5e37b02a7d4fedaf61e079d7eff360609ba9e668ae77e930ebe68e1f7c691d2bb72b826dbd704ada8a318b39da344a7fdd8931e957e16baa063a9e85898347b1073f10aa3f7ab1f7ebb974b8dac6b910a1a7039be5d18d7f9fccc06ed128610f2d6a460d0ce91c7000b0004000a9cc87479a8850064000180080003000200000008000100", @ANYRES32=r6, @ANYBLOB="140002006970766c616e3100000000000000000008000100", @ANYRES32=r7, @ANYBLOB="080003000100000008000300010000001400020076657468305f746d5f626f6e64000000080003000300000008000100", @ANYRES32=r9, @ANYBLOB="080007000080000005000500000000000500060001000000"], 0x6dc}, 0x1, 0x0, 0x0, 0x10}, 0x20008010) timer_settime(r0, 0x1, &(0x7f0000000180)={{}, {0x0, 0x989680}}, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='comm\x00') exit(0x1ff) setns(0xc9, 0x0) r10 = socket$netlink(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(r10, &(0x7f0000001580)={0x0, 0x0, &(0x7f00000015c0)={&(0x7f0000001600)=ANY=[@ANYBLOB="140000001000010300000ae6f72087a003"], 0x3c}}, 0x80) recvmmsg(r10, &(0x7f0000001640)=[{{0x0, 0x0, &(0x7f0000001680)=[{&(0x7f00000016c0)=""/4112, 0x1041}, {&(0x7f0000002700)=""/194, 0xc2}], 0x2}, 0xb}], 0x1, 0x140, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') 804.187808ms ago: executing program 3 (id=201): timer_create(0xb, 0x0, &(0x7f00000002c0)) r0 = syz_usb_connect(0x2, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000001018610f4205ae06d6c011703010902240001010000000904690202ff5aa30009050402100000fa000905820240"], 0x0) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000000140)={0xffffffffffffffff, &(0x7f0000000040)=')]\x00', 0x105001, &(0x7f0000000080)={@_ha_fsid={[0x1, 0x1000]}, {0x401, 0x2, 0x1, 0x3}}, 0x1, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000100)=0x3}) r2 = gettid() r3 = socket$inet6(0xa, 0x2, 0x0) sendmsg$inet6(r3, &(0x7f0000000300)={&(0x7f0000000340)={0xa, 0x4e21, 0x80000, @dev={0xfe, 0x80, '\x00', 0x19}, 0xfffffffd}, 0x1c, 0x0, 0x0, &(0x7f0000000380)=[@rthdrdstopts={{0x18, 0x29, 0x37, {0x33, 0xd}}}, @dstopts_2292={{0x18, 0x29, 0x4, {0x89}}}, @dstopts_2292={{0x0, 0x29, 0x4, {0x2f, 0x0, '\x00', [@ra, @hao={0xc9, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @pad1, @hao={0xc9, 0x0, @loopback}, @hao={0xc9, 0x0, @dev={0xfe, 0x80, '\x00', 0xc}}, @jumbo={0xc2, 0x4, 0x6}, @jumbo={0xc2, 0x4, 0x5}, @jumbo={0xc2, 0x4, 0x200}, @enc_lim={0x4, 0x1, 0x7}, @hao={0xc9, 0x0, @loopback}]}}}, @hopopts={{0x0, 0x29, 0x36, {0x1d, 0x0, '\x00', [@generic={0x6, 0x0, "1666b0fb31431769fe0c2f8da081945305aae934cb2ef0b640f275797285c00e67887e7f99d25146204069"}, @jumbo={0xc2, 0x4, 0x6948}, @calipso={0x7, 0x0, {0x0, 0x0, 0x8, 0x0, [0x5, 0x4967, 0x6, 0x1000]}}, @pad1, @ra={0x5, 0x2, 0x11}, @generic={0x7f, 0x0, "69be4ae89f26dc9318935e1019bf57bd51ecf46b2078a8deb2360be6f02425f8"}, @generic={0x6, 0x0, "507755d91d76ebfe43a60bf8df730bab39923907333e24e530a1020c7baa54178ab5b779ab5ff0ebcf7217698a1975eb838af4bb6442fd99633bb29e9dc04fa5d5de14079ef82fe03965688f5522ad9ceedc289ff28b6e1bca602b3d3834da6b904b011f18b0f89b06b035599ade052f695cf745020f09e2c88ee823860b0df0dbad470a1f0d848345e93b4abaccad8f156c8f6d763adfb15e6a4a803a6505d3a50c45ec42d37af672982346f9d4e8d309e45d969aea8918a7"}]}}}], 0x30}, 0xc4) timer_create(0x2, &(0x7f0000000200)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000000240)) exit(0x5) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000640)={'ip_vti0\x00', &(0x7f00000005c0)={'tunl0\x00', 0x0, 0x3, 0x700, 0x400, 0x0, {{0xc, 0x4, 0x3, 0x3e, 0x30, 0x68, 0x0, 0x1, 0x4, 0x0, @multicast1, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x7, 0x54, [@multicast2]}, @ra={0x94, 0x4, 0x1}, @generic={0xc3, 0xd, "b55d9e9ec240d53af7f432"}, @ra={0x94, 0x4}]}}}}}) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000680)={@mcast1, @mcast1, @mcast1, 0x100, 0x10, 0x2, 0x0, 0x2, 0x40000, r4}) timer_settime(0x0, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) connect$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e24, 0x8, @private1={0xfc, 0x1, '\x00', 0x1}, 0xfffffff8}, 0x1c) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, &(0x7f0000000ac0)={0x14, &(0x7f0000000180)={0x60, 0x4, 0x2, {0x2, 0xa}}, &(0x7f00000009c0)={0x0, 0x3, 0x2, @string={0x2}}}, &(0x7f0000000dc0)={0x44, &(0x7f0000000b00)={0x20, 0x15, 0x22, "d93ddf4262117c1942afc2419dfb499dd70de012c836608d56bf2bef8f6b5b1b2cba"}, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000d00)={0x20, 0x83, 0x2, "6cc9"}, &(0x7f0000000d40)={0x20, 0x84, 0x1, "ca"}, 0x0}) 0s ago: executing program 4 (id=202): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000000)=0x9, 0x4) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x1, 0x8000}, 0x4) r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x76, 0x101301) ioctl$USBDEVFS_CLEAR_HALT(r1, 0xc0105502, &(0x7f00000001c0)={0x1, 0x1}) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000005c0), 0x101082, 0x0) write$FUSE_STATX(r2, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'wg0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000100)="0b03feff4f12021202004788aa96a13bb1000011000088ca1a00", 0x1fffc, 0x0, &(0x7f0000000140)={0x11, 0x0, r3}, 0x14) r4 = socket$unix(0x1, 0x5, 0x0) socket$inet_udp(0x2, 0x2, 0x0) open(&(0x7f00000002c0)='./file0\x00', 0x108843, 0x98) openat(0xffffffffffffff9c, &(0x7f0000000340)='./cgroup.cpu/memory.force_empty\x00', 0x21283, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) socketpair(0x1e, 0x5, 0x0, 0x0) ioctl$NILFS_IOCTL_CHANGE_CPMODE(r1, 0x40106e80, &(0x7f0000000540)={0x9}) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x10, 0x80002, 0x0) fsopen(&(0x7f0000000400)='tracefs\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) r6 = socket$key(0xf, 0x3, 0x2) syz_usb_connect$uac1(0x3, 0xdc, &(0x7f00000004c0)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c240208000103000000ff000924060506020100000924030003030005490c240206", @ANYRES8=r6, @ANYBLOB='\a'], 0x0) setxattr$security_ima(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240), &(0x7f0000000280)=@ng={0x4, 0x15, "99f32b735ef0"}, 0x8, 0x1) io_submit(0x0, 0x1, &(0x7f0000000300)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x6, r4, 0x0, 0x0, 0x5, 0x0, 0x1}]) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="6c00000066001f03"], 0x6c}], 0x1, 0x0, 0x0, 0x84}, 0x0) kernel console output (not intermixed with test programs): cess permissive=1 [ 14.909258][ T36] audit: type=1400 audit(1793621193.760:63): avc: denied { siginh } for pid=233 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.211' (ED25519) to the list of known hosts. [ 22.782888][ T36] audit: type=1400 audit(1793621201.640:64): avc: denied { mounton } for pid=287 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.786615][ T287] cgroup: Unknown subsys name 'net' [ 22.805591][ T36] audit: type=1400 audit(1793621201.640:65): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.833091][ T36] audit: type=1400 audit(1793621201.670:66): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.833623][ T287] cgroup: Unknown subsys name 'devices' [ 22.959535][ T287] cgroup: Unknown subsys name 'hugetlb' [ 22.965214][ T287] cgroup: Unknown subsys name 'rlimit' [ 23.080666][ T36] audit: type=1400 audit(1793621201.940:67): avc: denied { setattr } for pid=287 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.103889][ T36] audit: type=1400 audit(1793621201.940:68): avc: denied { mounton } for pid=287 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.128764][ T36] audit: type=1400 audit(1793621201.940:69): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.153499][ T289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 23.162417][ T36] audit: type=1400 audit(1793621202.020:70): avc: denied { relabelto } for pid=289 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.188558][ T36] audit: type=1400 audit(1793621202.020:71): avc: denied { write } for pid=289 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.218585][ T36] audit: type=1400 audit(1793621202.080:72): avc: denied { read } for pid=287 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.244237][ T36] audit: type=1400 audit(1793621202.080:73): avc: denied { open } for pid=287 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.244929][ T287] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 24.533655][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.540836][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.547989][ T294] bridge_slave_0: entered allmulticast mode [ 24.554502][ T294] bridge_slave_0: entered promiscuous mode [ 24.577855][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.584951][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.592751][ T294] bridge_slave_1: entered allmulticast mode [ 24.599211][ T294] bridge_slave_1: entered promiscuous mode [ 24.689825][ T298] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.696916][ T298] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.704261][ T298] bridge_slave_0: entered allmulticast mode [ 24.710870][ T298] bridge_slave_0: entered promiscuous mode [ 24.721020][ T298] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.728205][ T298] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.735304][ T298] bridge_slave_1: entered allmulticast mode [ 24.741710][ T298] bridge_slave_1: entered promiscuous mode [ 24.784543][ T300] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.791681][ T300] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.798909][ T300] bridge_slave_0: entered allmulticast mode [ 24.805213][ T300] bridge_slave_0: entered promiscuous mode [ 24.812935][ T300] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.820214][ T300] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.827392][ T300] bridge_slave_1: entered allmulticast mode [ 24.833841][ T300] bridge_slave_1: entered promiscuous mode [ 24.885573][ T299] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.892925][ T299] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.900216][ T299] bridge_slave_0: entered allmulticast mode [ 24.906500][ T299] bridge_slave_0: entered promiscuous mode [ 24.913193][ T299] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.920322][ T299] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.927519][ T299] bridge_slave_1: entered allmulticast mode [ 24.933783][ T299] bridge_slave_1: entered promiscuous mode [ 24.993119][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.000234][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.007589][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.014637][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.085333][ T298] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.092447][ T298] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.099806][ T298] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.106855][ T298] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.128463][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.135923][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.143679][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.155164][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.162274][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.224438][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.231564][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.240299][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.247384][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.255164][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.262294][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.278767][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.285858][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.293514][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.300673][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.309002][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.316051][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.331621][ T294] veth0_vlan: entered promiscuous mode [ 25.372916][ T294] veth1_macvtap: entered promiscuous mode [ 25.391386][ T299] veth0_vlan: entered promiscuous mode [ 25.406088][ T298] veth0_vlan: entered promiscuous mode [ 25.423925][ T300] veth0_vlan: entered promiscuous mode [ 25.448099][ T298] veth1_macvtap: entered promiscuous mode [ 25.456113][ T299] veth1_macvtap: entered promiscuous mode [ 25.467780][ T294] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 25.491162][ T300] veth1_macvtap: entered promiscuous mode [ 25.516251][ T311] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.631238][ T325] syzkaller0: entered promiscuous mode [ 25.636858][ T325] syzkaller0: entered allmulticast mode [ 25.839847][ T344] ªªªªªª: renamed from vlan0 (while UP) [ 25.877343][ T45] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 25.899037][ T345] netlink: 80 bytes leftover after parsing attributes in process `syz.1.9'. [ 25.977299][ T312] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 26.007476][ T45] usb 1-1: device descriptor read/64, error -71 [ 26.128192][ T312] usb 4-1: not running at top speed; connect to a high speed hub [ 26.145796][ T312] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 26.156362][ T312] usb 4-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 26.166633][ T312] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.178196][ T312] usb 4-1: Found UVC 1.00 device (046d:0825) [ 26.185291][ T312] usb 4-1: No streaming interface found for terminal 2. [ 26.247332][ T45] usb 1-1: device descriptor read/64, error -71 [ 26.379067][ T312] usb 4-1: USB disconnect, device number 2 [ 26.487300][ T45] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 26.617349][ T45] usb 1-1: device descriptor read/64, error -71 [ 26.654231][ T365] netlink: 12 bytes leftover after parsing attributes in process `syz.1.15'. [ 26.680135][ T367] FAULT_INJECTION: forcing a failure. [ 26.680135][ T367] name failslab, interval 1, probability 0, space 0, times 1 [ 26.692946][ T367] CPU: 0 UID: 0 PID: 367 Comm: syz.1.16 Not tainted syzkaller #0 c6d530d213d6421e3ceaeda0202ca36fa97e3e13 [ 26.692982][ T367] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 26.693009][ T367] Call Trace: [ 26.693015][ T367] [ 26.693022][ T367] __dump_stack+0x21/0x30 [ 26.693042][ T367] dump_stack_lvl+0x140/0x1c0 [ 26.693056][ T367] ? __cfi_dump_stack_lvl+0x10/0x10 [ 26.693073][ T367] dump_stack+0x19/0x20 [ 26.693086][ T367] should_fail_ex+0x3c2/0x510 [ 26.693111][ T367] ? x509_get_sig_params+0x250/0x6a0 [ 26.693136][ T367] should_failslab+0xac/0x100 [ 26.693152][ T367] __kmalloc_noprof+0x69/0x510 [ 26.693176][ T367] ? x509_get_sig_params+0x250/0x6a0 [ 26.693200][ T367] x509_get_sig_params+0x250/0x6a0 [ 26.693224][ T367] x509_cert_parse+0x53e/0xbd0 [ 26.693253][ T367] x509_key_preparse+0x6a/0x880 [ 26.693277][ T367] ? __cfi_down_read+0x10/0x10 [ 26.693299][ T367] asymmetric_key_preparse+0xb3/0x100 [ 26.693319][ T367] __key_create_or_update+0x433/0xa90 [ 26.693341][ T367] ? security_key_permission+0x3d/0x100 [ 26.693365][ T367] ? key_create_or_update+0x70/0x70 [ 26.693387][ T367] ? __kasan_kmalloc+0x96/0xb0 [ 26.693405][ T367] ? __cfi_lookup_user_key_possessed+0x10/0x10 [ 26.693425][ T367] key_create_or_update+0x47/0x70 [ 26.693447][ T367] __se_sys_add_key+0x355/0x4b0 [ 26.693461][ T367] ? __x64_sys_add_key+0xf0/0xf0 [ 26.693476][ T367] ? __kasan_check_write+0x18/0x20 [ 26.693499][ T367] ? fpregs_restore_userregs+0x11c/0x260 [ 26.693522][ T367] __x64_sys_add_key+0xc3/0xf0 [ 26.693537][ T367] x64_sys_call+0x195f/0x2ee0 [ 26.693554][ T367] do_syscall_64+0x57/0xf0 [ 26.693569][ T367] ? clear_bhb_loop+0x50/0xa0 [ 26.693590][ T367] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 26.693610][ T367] RIP: 0033:0x7fcac359fb19 [ 26.693629][ T367] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 26.693642][ T367] RSP: 002b:00007fcac4519028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 26.693662][ T367] RAX: ffffffffffffffda RBX: 00007fcac3825fa0 RCX: 00007fcac359fb19 [ 26.693675][ T367] RDX: 00002000000006c0 RSI: 0000000000000000 RDI: 0000200000000400 [ 26.693686][ T367] RBP: 00007fcac3637af8 R08: ffffffffffffffff R09: 0000000000000000 [ 26.693697][ T367] R10: 0000000000000559 R11: 0000000000000246 R12: 0000000000000000 [ 26.693706][ T367] R13: 00007fcac3826038 R14: 00007fcac3825fa0 R15: 00007ffdb5383dc8 [ 26.693720][ T367] [ 26.749097][ T367] ./proc: Can't lookup blockdev [ 26.952229][ T370] netlink: 12 bytes leftover after parsing attributes in process `syz.3.17'. [ 27.007269][ T45] usb 1-1: device descriptor read/64, error -71 [ 27.117482][ T45] usb usb1-port1: attempt power cycle [ 27.237707][ T67] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 27.337299][ T363] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 27.388500][ T67] usb 4-1: New USB device found, idVendor=05c6, idProduct=1000, bcdDevice= 0.00 [ 27.397918][ T67] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.409308][ T67] usb-storage 4-1:1.0: USB Mass Storage device detected [ 27.457277][ T45] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 27.467463][ T363] usb 2-1: device descriptor read/64, error -71 [ 27.478519][ T45] usb 1-1: device descriptor read/8, error -71 [ 27.608433][ T45] usb 1-1: device descriptor read/8, error -71 [ 27.707279][ T363] usb 2-1: device descriptor read/64, error -71 [ 27.819422][ T67] scsi host1: usb-storage 4-1:1.0 [ 27.826991][ T67] usb 4-1: USB disconnect, device number 3 [ 27.847333][ T45] usb 1-1: new full-speed USB device number 5 using dummy_hcd [ 27.868494][ T45] usb 1-1: device descriptor read/8, error -71 [ 27.947274][ T363] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 27.998524][ T45] usb 1-1: device descriptor read/8, error -71 [ 28.077409][ T363] usb 2-1: device descriptor read/64, error -71 [ 28.107420][ T45] usb usb1-port1: unable to enumerate USB device [ 28.317282][ T363] usb 2-1: device descriptor read/64, error -71 [ 28.334433][ T387] netlink: 124 bytes leftover after parsing attributes in process `syz.3.21'. [ 28.427488][ T363] usb usb2-port1: attempt power cycle [ 28.767300][ T363] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 28.788431][ T363] usb 2-1: device descriptor read/8, error -71 [ 28.856219][ T36] kauditd_printk_skb: 132 callbacks suppressed [ 28.856238][ T36] audit: type=1400 audit(1793621207.710:206): avc: denied { create } for pid=390 comm="syz.3.23" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 28.883173][ T36] audit: type=1400 audit(1793621207.720:207): avc: denied { ioctl } for pid=390 comm="syz.3.23" path="socket:[3889]" dev="sockfs" ino=3889 ioctlcmd=0x8922 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 28.907757][ T36] audit: type=1400 audit(1793621207.720:208): avc: denied { read write } for pid=390 comm="syz.3.23" name="vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 28.931702][ T36] audit: type=1400 audit(1793621207.720:209): avc: denied { open } for pid=390 comm="syz.3.23" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 28.933134][ T363] usb 2-1: device descriptor read/8, error -71 [ 28.957094][ T36] audit: type=1400 audit(1793621207.740:210): avc: denied { setopt } for pid=390 comm="syz.3.23" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 28.982586][ T36] audit: type=1400 audit(1793621207.740:211): avc: denied { read } for pid=390 comm="syz.3.23" dev="nsfs" ino=4026532490 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 29.003889][ T36] audit: type=1400 audit(1793621207.740:212): avc: denied { open } for pid=390 comm="syz.3.23" path="net:[4026532490]" dev="nsfs" ino=4026532490 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 29.028704][ T36] audit: type=1400 audit(1793621207.740:213): avc: denied { read } for pid=390 comm="syz.3.23" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 29.057323][ T9] usb 1-1: new full-speed USB device number 6 using dummy_hcd [ 29.141079][ T396] ªªªªªª: renamed from vlan0 (while UP) [ 29.197315][ T363] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 29.202188][ T397] netlink: 80 bytes leftover after parsing attributes in process `syz.3.24'. [ 29.214892][ T9] usb 1-1: config 0 interface 0 altsetting 7 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 29.219134][ T363] usb 2-1: device descriptor read/8, error -71 [ 29.226593][ T9] usb 1-1: config 0 interface 0 has no altsetting 0 [ 29.239433][ T9] usb 1-1: New USB device found, idVendor=056a, idProduct=006b, bcdDevice= 0.00 [ 29.248568][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.257410][ T9] usb 1-1: config 0 descriptor?? [ 29.313779][ T36] audit: type=1326 audit(1793621208.170:214): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=355 comm="syz.2.14" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0cb599fb19 code=0x7fc00000 [ 29.352808][ T36] audit: type=1400 audit(1793621208.210:215): avc: denied { shutdown } for pid=398 comm="syz.2.25" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 29.373836][ T363] usb 2-1: device descriptor read/8, error -71 [ 29.487344][ T363] usb usb2-port1: unable to enumerate USB device [ 29.667770][ T9] wacom 0003:056A:006B.0001: unknown main item tag 0x4 [ 29.674729][ T9] wacom 0003:056A:006B.0001: unknown main item tag 0x5 [ 29.682304][ T9] wacom 0003:056A:006B.0001: Unknown device_type for 'HID 056a:006b'. Assuming pen. [ 29.697342][ T9] wacom 0003:056A:006B.0001: hidraw0: USB HID v0.00 Device [HID 056a:006b] on usb-dummy_hcd.0-1/input0 [ 29.716775][ T9] input: Wacom Bamboo1 5x8 Pen as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:056A:006B.0001/input/input4 [ 29.866575][ T9] usb 1-1: USB disconnect, device number 6 [ 30.007337][ T363] usb 3-1: new low-speed USB device number 2 using dummy_hcd [ 30.137271][ T363] usb 3-1: device descriptor read/64, error -71 [ 30.217893][ T432] netlink: 64 bytes leftover after parsing attributes in process `syz.1.33'. [ 30.237286][ T312] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 30.278722][ T435] netlink: 92 bytes leftover after parsing attributes in process `syz.1.34'. [ 30.377295][ T363] usb 3-1: device descriptor read/64, error -71 [ 30.388553][ T312] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 30.396205][ T312] usb 4-1: can't read configurations, error -61 [ 30.527301][ T312] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 30.567477][ T45] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 30.627253][ T363] usb 3-1: new low-speed USB device number 3 using dummy_hcd [ 30.634837][ T67] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 30.680660][ T312] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 30.688424][ T312] usb 4-1: can't read configurations, error -61 [ 30.694846][ T312] usb usb4-port1: attempt power cycle [ 30.697441][ T45] usb 2-1: device descriptor read/64, error -71 [ 30.767338][ T363] usb 3-1: device descriptor read/64, error -71 [ 30.788449][ T67] usb 1-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 30.798586][ T67] usb 1-1: config 1 interface 0 altsetting 127 bulk endpoint 0x2 has invalid maxpacket 32 [ 30.808612][ T67] usb 1-1: config 1 interface 0 has no altsetting 0 [ 30.817028][ T67] usb 1-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 30.826171][ T67] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.834256][ T67] usb 1-1: Product: syz [ 30.838580][ T67] usb 1-1: Manufacturer: syz [ 30.843208][ T67] usb 1-1: SerialNumber: syz [ 30.850294][ T445] raw-gadget.3 gadget.0: fail, usb_ep_enable returned -22 [ 30.857713][ T445] raw-gadget.3 gadget.0: fail, usb_ep_enable returned -22 [ 30.937385][ T45] usb 2-1: device descriptor read/64, error -71 [ 31.007248][ T363] usb 3-1: device descriptor read/64, error -71 [ 31.037302][ T312] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 31.059146][ T312] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 31.066792][ T312] usb 4-1: can't read configurations, error -61 [ 31.117475][ T363] usb usb3-port1: attempt power cycle [ 31.177293][ T45] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 31.207250][ T312] usb 4-1: new full-speed USB device number 7 using dummy_hcd [ 31.229118][ T312] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 31.236807][ T312] usb 4-1: can't read configurations, error -61 [ 31.243979][ T312] usb usb4-port1: unable to enumerate USB device [ 31.307247][ T45] usb 2-1: device descriptor read/64, error -71 [ 31.457274][ T363] usb 3-1: new low-speed USB device number 4 using dummy_hcd [ 31.478377][ T363] usb 3-1: device descriptor read/8, error -71 [ 31.547271][ T45] usb 2-1: device descriptor read/64, error -71 [ 31.608330][ T363] usb 3-1: device descriptor read/8, error -71 [ 31.657355][ T45] usb usb2-port1: attempt power cycle [ 31.847266][ T363] usb 3-1: new low-speed USB device number 5 using dummy_hcd [ 31.868188][ T363] usb 3-1: device descriptor read/8, error -71 [ 31.874824][ T67] (unnamed net_device) (uninitialized): Assigned a random MAC address: a6:bf:7a:51:5e:18 [ 31.887173][ T67] rtl8150 1-1:1.0: eth1: rtl8150 is detected [ 31.895178][ T67] usb 1-1: USB disconnect, device number 7 [ 31.997310][ T45] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 32.006025][ T363] usb 3-1: device descriptor read/8, error -71 [ 32.018384][ T45] usb 2-1: device descriptor read/8, error -71 [ 32.117387][ T363] usb usb3-port1: unable to enumerate USB device [ 32.148458][ T45] usb 2-1: device descriptor read/8, error -71 [ 32.387263][ T45] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 32.408518][ T45] usb 2-1: device descriptor read/8, error -71 [ 32.538468][ T45] usb 2-1: device descriptor read/8, error -71 [ 32.647371][ T45] usb usb2-port1: unable to enumerate USB device [ 32.657284][ T363] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 32.807241][ T363] usb 1-1: Using ep0 maxpacket: 32 [ 32.818056][ T363] usb 1-1: too many endpoints for config 0 interface 0 altsetting 5: 146, using maximum allowed: 30 [ 32.829088][ T363] usb 1-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 32.840557][ T363] usb 1-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 146 [ 32.855036][ T363] usb 1-1: config 0 interface 0 has no altsetting 0 [ 32.863033][ T363] usb 1-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.00 [ 32.872218][ T363] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.881487][ T363] usb 1-1: config 0 descriptor?? [ 32.987598][ T461] netlink: 64 bytes leftover after parsing attributes in process `syz.3.43'. [ 32.997496][ T462] netlink: 'syz.2.42': attribute type 16 has an invalid length. [ 33.005598][ T462] netlink: 'syz.2.42': attribute type 3 has an invalid length. [ 33.013581][ T462] netlink: 64066 bytes leftover after parsing attributes in process `syz.2.42'. [ 33.077109][ T472] rust_binder: 470:472 transaction async to 0:0 failed EINVAL, code 1 size 0-0 line process.rs:950 [ 33.089344][ T362] rust_binder: 470: undelivered TRANSACTION_ERROR: 29201 [ 33.109433][ T475] ======================================================= [ 33.109433][ T475] WARNING: The mand mount option has been deprecated and [ 33.109433][ T475] and is ignored by this kernel. Remove the mand [ 33.109433][ T475] option from the mount to silence this warning. [ 33.109433][ T475] ======================================================= [ 33.277251][ T312] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 33.290321][ T363] hid-multitouch 0003:1FD2:6007.0002: No inputs registered, leaving [ 33.303579][ T363] hid-multitouch 0003:1FD2:6007.0002: hiddev96,hidraw0: USB HID v0.00 Device [HID 1fd2:6007] on usb-dummy_hcd.0-1/input0 [ 33.348483][ T485] netlink: 'syz.3.49': attribute type 4 has an invalid length. [ 33.427276][ T312] usb 3-1: Using ep0 maxpacket: 16 [ 33.434010][ T312] usb 3-1: unable to get BOS descriptor or descriptor too short [ 33.443026][ T312] usb 3-1: config 1 interface 0 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 32 [ 33.452930][ T312] usb 3-1: config 1 interface 0 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 8 [ 33.462838][ T312] usb 3-1: config 1 interface 0 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 33.471774][ T491] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1539 sclass=netlink_route_socket pid=491 comm=syz.1.52 [ 33.477854][ T312] usb 3-1: config 1 interface 0 has no altsetting 0 [ 33.499233][ T312] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 33.508457][ T312] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.516508][ T312] usb 3-1: Product: syz [ 33.520750][ T312] usb 3-1: Manufacturer: syz [ 33.525395][ T312] usb 3-1: SerialNumber: syz [ 33.531165][ T466] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 33.538581][ T466] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 33.607679][ T494] netlink: 64 bytes leftover after parsing attributes in process `syz.1.53'. [ 33.628544][ T362] usb 4-1: new full-speed USB device number 8 using dummy_hcd [ 33.746650][ T466] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.760800][ T466] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.772635][ T466] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.782126][ T466] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.791429][ T362] usb 4-1: config 0 has no interfaces? [ 33.799456][ T466] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.811660][ T362] usb 4-1: New USB device found, idVendor=10d6, idProduct=2200, bcdDevice= 0.02 [ 33.820897][ T362] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 33.829073][ T466] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.837391][ T362] usb 4-1: SerialNumber: syz [ 33.843184][ T362] usb 4-1: config 0 descriptor?? [ 33.848935][ T466] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.859581][ T36] kauditd_printk_skb: 54 callbacks suppressed [ 33.859600][ T36] audit: type=1400 audit(1793621212.720:270): avc: denied { unmount } for pid=298 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 33.864532][ T466] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.897731][ T466] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.908867][ T466] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.931363][ T312] usb 3-1: bad CDC descriptors [ 33.967774][ T312] usb 3-1: USB disconnect, device number 6 [ 34.061703][ T362] usb 4-1: USB disconnect, device number 8 [ 34.445607][ T510] capability: warning: `syz.2.57' uses 32-bit capabilities (legacy support in use) [ 34.693014][ T36] audit: type=1326 audit(1793621213.550:271): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=518 comm="syz.3.61" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c21f9fb19 code=0x7ffc0000 [ 34.730881][ T36] audit: type=1326 audit(1793621213.580:272): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=518 comm="syz.3.61" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c21f9fb19 code=0x7ffc0000 [ 34.756203][ T363] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 34.763858][ T36] audit: type=1326 audit(1793621213.580:273): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=518 comm="syz.3.61" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=133 compat=0 ip=0x7f0c21f9fb19 code=0x7ffc0000 [ 34.797033][ T36] audit: type=1326 audit(1793621213.580:274): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=518 comm="syz.3.61" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c21f9fb19 code=0x7ffc0000 [ 34.822397][ T36] audit: type=1326 audit(1793621213.580:275): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=518 comm="syz.3.61" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c21f9fb19 code=0x7ffc0000 [ 34.852914][ T523] netlink: 64 bytes leftover after parsing attributes in process `syz.3.62'. [ 34.860161][ T36] audit: type=1326 audit(1793621213.580:276): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=518 comm="syz.3.61" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=133 compat=0 ip=0x7f0c21f9fb19 code=0x7ffc0000 [ 34.897316][ T36] audit: type=1326 audit(1793621213.580:277): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=518 comm="syz.3.61" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c21f9fb19 code=0x7ffc0000 [ 34.923042][ T36] audit: type=1326 audit(1793621213.580:278): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=518 comm="syz.3.61" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c21f9fb19 code=0x7ffc0000 [ 34.948275][ T36] audit: type=1326 audit(1793621213.580:279): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=518 comm="syz.3.61" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f0c21f9fb19 code=0x7ffc0000 [ 34.974093][ T363] usb 3-1: descriptor type invalid, skip [ 34.979861][ T363] usb 3-1: descriptor type invalid, skip [ 34.985532][ T363] usb 3-1: descriptor type invalid, skip [ 35.005472][ T363] usb 3-1: descriptor type invalid, skip [ 35.011342][ T363] usb 3-1: descriptor type invalid, skip [ 35.017012][ T363] usb 3-1: descriptor type invalid, skip [ 35.027291][ T363] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 64 [ 35.037096][ T363] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x6 has invalid wMaxPacketSize 0 [ 35.051767][ T363] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 35.063180][ T363] usb 3-1: New USB device found, idVendor=0e41, idProduct=5058, bcdDevice= 0.40 [ 35.087235][ T363] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.095294][ T363] usb 3-1: Product: syz [ 35.099732][ T363] usb 3-1: Manufacturer: syz [ 35.104400][ T363] usb 3-1: SerialNumber: syz [ 35.118034][ T515] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 35.297244][ T362] usb 4-1: new full-speed USB device number 9 using dummy_hcd [ 35.331984][ T363] usb 3-1: MIDIStreaming interface descriptor not found [ 35.350284][ T363] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -12 [ 35.367193][ T363] usb 3-1: USB disconnect, device number 7 [ 35.369048][ T338] udevd[338]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 35.468384][ T362] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 35.478912][ T362] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 26 [ 35.492835][ T362] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 35.502030][ T362] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 35.510344][ T362] usb 4-1: SerialNumber: syz [ 35.517870][ T362] cdc_acm 4-1:1.0: Control and data interfaces are not separated! [ 35.525799][ T362] cdc_acm 4-1:1.0: This needs exactly 3 endpoints [ 35.534719][ T362] cdc_acm 4-1:1.0: probe with driver cdc_acm failed with error -22 [ 35.719217][ T362] usb 4-1: USB disconnect, device number 9 [ 36.035441][ T539] process 'syz.2.68' launched './file0' with NULL argv: empty string added [ 36.207704][ T545] netlink: 64 bytes leftover after parsing attributes in process `syz.2.71'. [ 36.438329][ T554] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 36.657264][ T67] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 36.817243][ T67] usb 3-1: Using ep0 maxpacket: 16 [ 36.823776][ T67] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 36.834193][ T67] usb 3-1: config 0 has no interfaces? [ 36.840292][ T67] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 36.849598][ T67] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.862088][ T67] usb 3-1: config 0 descriptor?? [ 37.269985][ T574] ./dev/sda1: Can't lookup blockdev [ 37.386014][ T595] netlink: 64 bytes leftover after parsing attributes in process `syz.3.86'. [ 38.113514][ T617] tipc: Trying to set illegal importance in message [ 38.665024][ T623] netlink: 64 bytes leftover after parsing attributes in process `syz.3.95'. [ 39.346039][ T36] kauditd_printk_skb: 32 callbacks suppressed [ 39.346058][ T36] audit: type=1400 audit(1793621218.200:312): avc: denied { create } for pid=634 comm="syz.3.101" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 39.402919][ T362] usb 3-1: USB disconnect, device number 8 [ 39.457287][ T637] mmap: syz.2.102 (637) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 39.586620][ T643] rust_binder: 642:643 transaction async to 0:0 failed EINVAL, code 1 size 0-0 line process.rs:950 [ 39.605178][ T312] rust_binder: 642: undelivered TRANSACTION_ERROR: 29201 [ 39.677543][ T648] netlink: 64 bytes leftover after parsing attributes in process `syz.2.104'. [ 39.783097][ T36] audit: type=1400 audit(1793621218.640:313): avc: denied { append } for pid=650 comm="syz.2.105" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 39.807695][ T36] audit: type=1400 audit(1793621218.670:314): avc: denied { read } for pid=650 comm="syz.2.105" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 40.201760][ T662] futex_wake_op: syz.3.109 tries to shift op by 144; fix this program [ 40.210207][ T662] futex_wake_op: syz.3.109 tries to shift op by 144; fix this program [ 40.299551][ T675] netlink: 64 bytes leftover after parsing attributes in process `syz.3.113'. [ 40.353351][ T36] audit: type=1400 audit(1793621219.210:315): avc: denied { connect } for pid=680 comm="syz.3.116" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 40.707806][ T692] netlink: 'syz.3.121': attribute type 4 has an invalid length. [ 40.715570][ T36] audit: type=1400 audit(1793621219.560:316): avc: denied { bind } for pid=691 comm="syz.3.121" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 40.717957][ T692] netlink: 'syz.3.121': attribute type 4 has an invalid length. [ 40.764824][ T694] netlink: 64 bytes leftover after parsing attributes in process `syz.3.122'. [ 41.020859][ T36] audit: type=1400 audit(1793621219.880:317): avc: denied { create } for pid=701 comm="syz.3.126" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 41.023459][ T705] overlayfs: failed to clone upperpath [ 41.049243][ T705] capability: warning: `syz.3.126' uses deprecated v2 capabilities in a way that may be insecure [ 41.060371][ T36] audit: type=1400 audit(1793621219.920:318): avc: denied { ioctl } for pid=701 comm="syz.3.126" path="socket:[6207]" dev="sockfs" ino=6207 ioctlcmd=0x8927 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 41.387247][ T67] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 41.537238][ T67] usb 3-1: Using ep0 maxpacket: 32 [ 41.543714][ T67] usb 3-1: config 6 has an invalid interface number: 4 but max is 0 [ 41.552067][ T67] usb 3-1: config 6 has no interface number 0 [ 41.558477][ T67] usb 3-1: config 6 interface 4 has no altsetting 0 [ 41.566862][ T67] usb 3-1: New USB device found, idVendor=1a0a, idProduct=0108, bcdDevice=f2.cf [ 41.576319][ T67] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 41.584623][ T67] usb 3-1: Product: syz [ 41.589107][ T67] usb 3-1: Manufacturer: syz [ 41.593808][ T67] usb 3-1: SerialNumber: syz [ 41.806210][ T67] usb_ehset_test 3-1:6.4: probe with driver usb_ehset_test failed with error -32 [ 41.817652][ T67] usb 3-1: USB disconnect, device number 9 [ 42.344425][ T36] audit: type=1400 audit(1793621221.200:319): avc: denied { read } for pid=300 comm="syz-executor" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 42.381296][ T36] audit: type=1400 audit(1793621221.200:320): avc: denied { open } for pid=300 comm="syz-executor" path="/33/trace" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 42.421210][ T36] audit: type=1400 audit(1793621221.200:321): avc: denied { setattr } for pid=300 comm="syz-executor" path="/33/trace/instances" dev="tracefs" ino=1110 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 42.458833][ T714] netlink: 64 bytes leftover after parsing attributes in process `syz.3.131'. [ 42.602829][ T46] bridge_slave_1: left allmulticast mode [ 42.609408][ T722] fuse: Unknown parameter 'root-ode000000000000100000' [ 42.615080][ T46] bridge_slave_1: left promiscuous mode [ 42.627300][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.647758][ T46] bridge_slave_0: left allmulticast mode [ 42.653467][ T46] bridge_slave_0: left promiscuous mode [ 42.667478][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.808457][ T46] veth1_macvtap: left promiscuous mode [ 42.814063][ T46] veth0_vlan: left promiscuous mode [ 42.991641][ T727] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.998798][ T727] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.005902][ T727] bridge_slave_0: entered allmulticast mode [ 43.012719][ T727] bridge_slave_0: entered promiscuous mode [ 43.019741][ T727] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.026818][ T727] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.034166][ T727] bridge_slave_1: entered allmulticast mode [ 43.040799][ T727] bridge_slave_1: entered promiscuous mode [ 43.104749][ T727] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.111880][ T727] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.119242][ T727] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.126304][ T727] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.191548][ T727] veth0_vlan: entered promiscuous mode [ 43.206050][ T727] veth1_macvtap: entered promiscuous mode [ 43.317542][ T740] netlink: 64 bytes leftover after parsing attributes in process `syz.4.140'. [ 43.797304][ T448] hid-multitouch 0003:1FD2:6007.0002: timeout initializing reports [ 43.874720][ T10] usb 1-1: USB disconnect, device number 8 [ 44.020454][ T761] netlink: 64 bytes leftover after parsing attributes in process `syz.3.149'. [ 44.096965][ T775] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 44.223010][ T797] netlink: 64 bytes leftover after parsing attributes in process `syz.3.158'. [ 44.250621][ T795] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1088 (2176 ns) > initial count (1152 ns). Using initial count to start timer. [ 44.304019][ T804] incfs: Options parsing error. -22 [ 44.309736][ T804] incfs: mount failed -22 [ 44.349589][ T36] kauditd_printk_skb: 7 callbacks suppressed [ 44.349608][ T36] audit: type=1400 audit(1793621223.210:329): avc: denied { create } for pid=807 comm="syz.3.162" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 44.423076][ T820] netlink: 4 bytes leftover after parsing attributes in process `syz.0.165'. [ 44.432526][ T820] netlink: 4 bytes leftover after parsing attributes in process `syz.0.165'. [ 44.501482][ T36] audit: type=1400 audit(1793621223.360:330): avc: denied { read } for pid=823 comm="syz.4.167" name="state" dev="binder" ino=1048645 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 44.524980][ T36] audit: type=1400 audit(1793621223.360:331): avc: denied { open } for pid=823 comm="syz.4.167" path="/dev/binderfs/binder_logs/state" dev="binder" ino=1048645 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 44.563727][ T36] audit: type=1400 audit(1793621223.360:332): avc: denied { ioctl } for pid=823 comm="syz.4.167" path="/dev/binderfs/binder_logs/state" dev="binder" ino=1048645 ioctlcmd=0xae60 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 44.627686][ T830] netlink: 64 bytes leftover after parsing attributes in process `syz.4.169'. [ 44.717274][ T45] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 44.877256][ T45] usb 1-1: Using ep0 maxpacket: 32 [ 44.886877][ T45] usb 1-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 44.917255][ T45] usb 1-1: config 0 interface 0 has no altsetting 0 [ 44.923989][ T45] usb 1-1: New USB device found, idVendor=1241, idProduct=5015, bcdDevice= 0.00 [ 44.945643][ T45] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 44.967477][ T45] usb 1-1: config 0 descriptor?? [ 45.177510][ T849] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 45.186500][ T45] holtek 0003:1241:5015.0003: invalid report_size 47643 [ 45.193536][ T45] holtek 0003:1241:5015.0003: item 0 2 1 7 parsing failed [ 45.201475][ T849] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 45.216107][ T45] holtek 0003:1241:5015.0003: parse failed [ 45.222213][ T45] holtek 0003:1241:5015.0003: probe with driver holtek failed with error -22 [ 45.231234][ T67] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 45.398626][ T67] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 45.410205][ T45] usb 1-1: USB disconnect, device number 9 [ 45.417287][ T67] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 45.433994][ T67] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 1024, setting to 64 [ 45.445684][ T67] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 45.459506][ T67] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 45.478819][ T67] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 45.490024][ T67] usb 5-1: Product: syz [ 45.494507][ T67] usb 5-1: Manufacturer: syz [ 45.501334][ T67] usb 5-1: SerialNumber: syz [ 45.507710][ T845] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 45.523953][ T67] cdc_mbim 5-1:1.0: skipping garbage [ 45.554588][ T857] netlink: 64 bytes leftover after parsing attributes in process `syz.3.178'. [ 45.724972][ T845] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 45.732558][ T845] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 46.343836][ T845] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 46.351466][ T845] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 46.359402][ T67] cdc_mbim 5-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048 [ 46.367261][ T67] cdc_mbim 5-1:1.0: setting rx_max = 2048 [ 46.569282][ T67] cdc_mbim 5-1:1.0: cdc-wdm0: USB WDM device [ 46.577538][ T67] wwan wwan0: port wwan0mbim0 attached [ 46.585653][ T67] cdc_mbim 5-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.4-1, CDC MBIM, 1e:ff:6e:6d:7f:0e [ 46.598462][ T67] usb 5-1: USB disconnect, device number 2 [ 46.604699][ T67] cdc_mbim 5-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.4-1, CDC MBIM [ 46.689431][ T67] wwan wwan0: port wwan0mbim0 disconnected [ 46.810065][ T36] audit: type=1400 audit(1793621225.670:333): avc: denied { unlink } for pid=882 comm="syz.0.187" name="#1" dev="tmpfs" ino=95 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 46.852692][ T36] audit: type=1400 audit(1793621225.690:334): avc: denied { remount } for pid=882 comm="syz.0.187" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 46.872205][ T36] audit: type=1400 audit(1793621225.710:335): avc: denied { connect } for pid=882 comm="syz.0.187" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 47.096053][ T36] audit: type=1400 audit(1793621225.950:336): avc: denied { write } for pid=889 comm="syz.4.189" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 47.177597][ T892] netlink: 64 bytes leftover after parsing attributes in process `syz.0.190'. [ 47.274442][ T897] fuse: Bad value for 'group_id' [ 47.279623][ T897] fuse: Bad value for 'group_id' [ 47.285050][ T36] audit: type=1400 audit(1793621226.140:337): avc: denied { ioctl } for pid=896 comm="syz.0.192" path="/dev/fuse" dev="devtmpfs" ino=23 ioctlcmd=0xe501 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 47.326040][ T899] tipc: Enabling of bearer rejected, failed to enable media [ 47.336253][ T902] tipc: Enabling of bearer rejected, failed to enable media [ 47.458018][ T36] audit: type=1400 audit(1793621226.320:338): avc: denied { bind } for pid=905 comm="syz.0.195" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 47.462455][ T906] netlink: 8 bytes leftover after parsing attributes in process `syz.0.195'. [ 47.616588][ T910] overlayfs: failed to clone lowerpath [ 47.672226][ T912] netlink: 84 bytes leftover after parsing attributes in process `syz.4.198'. [ 47.687567][ T913] tipc: Started in network mode [ 47.693070][ T913] tipc: Node identity 4, cluster identity 4711 [ 47.702722][ T913] tipc: Node number set to 4 [ 47.752235][ T312] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 47.908456][ T312] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 47.919759][ T312] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 47.931199][ T312] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 47.941543][ T312] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 47.955065][ T312] usb 1-1: config 0 descriptor?? [ 48.367208][ T312] savu 0003:1E7D:2D5A.0004: hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.0-1/input0 [ 48.580838][ T908] sit: Dst spoofed 172.30.0.1/ed59:95ab:d8c2:dd74:6ed1:b8e7:b953:b5e7 -> 255.255.255.255/2002:e546:652f:979f:45a6:99fe:21e6:4016 [ 48.632861][ T927] usb usb8: usbfs: process 927 (syz.4.202) did not claim interface 0 before use [ 48.709813][ T67] usb 1-1: USB disconnect, device number 10 [ 48.723221][ T67] ================================================================== [ 48.731364][ T67] BUG: KASAN: slab-use-after-free in roccat_disconnect+0x236/0x240 [ 48.739321][ T67] Read of size 4 at addr ffff88813173ac08 by task kworker/1:2/67 [ 48.747086][ T67] [ 48.749553][ T67] CPU: 1 UID: 0 PID: 67 Comm: kworker/1:2 Not tainted syzkaller #0 c6d530d213d6421e3ceaeda0202ca36fa97e3e13 [ 48.749589][ T67] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 48.749607][ T67] Workqueue: usb_hub_wq hub_event [ 48.749641][ T67] Call Trace: [ 48.749649][ T67] [ 48.749658][ T67] __dump_stack+0x21/0x30 [ 48.749684][ T67] dump_stack_lvl+0x140/0x1c0 [ 48.749706][ T67] ? __cfi_dump_stack_lvl+0x10/0x10 [ 48.749731][ T67] print_address_description+0x71/0x210 [ 48.749756][ T67] print_report+0x4a/0x70 [ 48.749776][ T67] kasan_report+0x162/0x1a0 [ 48.749802][ T67] ? roccat_disconnect+0x236/0x240 [ 48.749838][ T67] ? roccat_disconnect+0x236/0x240 [ 48.749872][ T67] __asan_report_load4_noabort+0x18/0x20 [ 48.749906][ T67] roccat_disconnect+0x236/0x240 [ 48.749940][ T67] savu_remove+0xf0/0x170 [ 48.749964][ T67] ? __cfi_savu_remove+0x10/0x10 [ 48.749988][ T67] hid_device_remove+0x293/0x400 [ 48.750022][ T67] ? __cfi_hid_device_remove+0x10/0x10 [ 48.750054][ T67] device_release_driver_internal+0x4ad/0x830 [ 48.750096][ T67] device_release_driver+0x1d/0x30 [ 48.750125][ T67] bus_remove_device+0x34f/0x370 [ 48.750164][ T67] device_del+0x583/0xcf0 [ 48.750190][ T67] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 48.750214][ T67] ? __pm_runtime_resume+0xa0/0xa0 [ 48.750251][ T67] ? __cfi_device_del+0x10/0x10 [ 48.750278][ T67] ? __kasan_check_write+0x18/0x20 [ 48.750311][ T67] ? _raw_spin_lock_irq+0x93/0x120 [ 48.750333][ T67] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 48.750357][ T67] hid_destroy_device+0x6e/0x110 [ 48.750390][ T67] usbhid_disconnect+0xa3/0xc0 [ 48.750419][ T67] usb_unbind_interface+0x2ad/0xa40 [ 48.750449][ T67] ? __cfi_usb_unbind_interface+0x10/0x10 [ 48.750475][ T67] device_release_driver_internal+0x525/0x830 [ 48.750506][ T67] device_release_driver+0x1d/0x30 [ 48.750533][ T67] bus_remove_device+0x34f/0x370 [ 48.750571][ T67] device_del+0x583/0xcf0 [ 48.750597][ T67] ? kfree_const+0x3d/0x50 [ 48.750628][ T67] ? __cfi_device_release+0x10/0x10 [ 48.750661][ T67] ? __cfi_device_del+0x10/0x10 [ 48.750688][ T67] ? kobject_put+0x238/0x2a0 [ 48.750710][ T67] ? device_unregister+0x2b/0x40 [ 48.750738][ T67] usb_disable_device+0x3af/0x770 [ 48.750764][ T67] usb_disconnect+0x331/0x950 [ 48.750787][ T67] hub_event+0x1ad5/0x4360 [ 48.750818][ T67] ? kthread_data+0x54/0xc0 [ 48.750855][ T67] ? __cfi_hub_event+0x10/0x10 [ 48.750881][ T67] ? kick_pool+0xb9/0x540 [ 48.750915][ T67] process_scheduled_works+0x7f7/0x1060 [ 48.750949][ T67] worker_thread+0xc99/0x13f0 [ 48.750980][ T67] ? __cfi_set_cpus_allowed_ptr+0x10/0x10 [ 48.751011][ T67] ? __kasan_check_read+0x15/0x20 [ 48.751045][ T67] kthread+0x2c7/0x360 [ 48.751076][ T67] ? __cfi_worker_thread+0x10/0x10 [ 48.751113][ T67] ? __cfi_kthread+0x10/0x10 [ 48.751144][ T67] ret_from_fork+0x64/0xa0 [ 48.751167][ T67] ? __cfi_kthread+0x10/0x10 [ 48.751208][ T67] ret_from_fork_asm+0x1a/0x30 [ 48.751237][ T67] [ 48.751246][ T67] [ 48.907319][ T312] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 48.910248][ T67] Allocated by task 312: [ 49.064228][ T67] kasan_save_track+0x3e/0x80 [ 49.068953][ T67] kasan_save_alloc_info+0x3a/0x50 [ 49.074120][ T67] __kasan_kmalloc+0x96/0xb0 [ 49.078151][ T312] usb 5-1: Using ep0 maxpacket: 16 [ 49.078753][ T67] __kmalloc_cache_noprof+0x23c/0x470 [ 49.085663][ T312] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 49.089260][ T67] roccat_connect+0x6a/0x540 [ 49.089299][ T67] savu_probe+0x1a7/0x3f0 [ 49.105675][ T312] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 49.108389][ T67] hid_device_probe+0x2ce/0x5f0 [ 49.108427][ T67] really_probe+0x2e1/0x8b0 [ 49.126705][ T67] __driver_probe_device+0x193/0x280 [ 49.129790][ T312] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 49.132037][ T67] driver_probe_device+0x54/0x3f0 [ 49.142232][ T312] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 49.146137][ T67] __device_attach_driver+0x2f1/0x4b0 [ 49.155074][ T312] usb 5-1: Product: syz [ 49.159562][ T67] bus_for_each_drv+0x264/0x300 [ 49.159602][ T67] __device_attach+0x2c4/0x3c0 [ 49.159627][ T67] device_initial_probe+0x1e/0x30 [ 49.159651][ T67] bus_probe_device+0x18b/0x270 [ 49.159681][ T67] device_add+0x7fd/0xbf0 [ 49.159703][ T67] hid_add_device+0x3c4/0x5a0 [ 49.159731][ T67] usbhid_probe+0xdca/0x1310 [ 49.159755][ T67] usb_probe_interface+0x6ab/0xbf0 [ 49.166730][ T312] usb 5-1: Manufacturer: syz [ 49.168794][ T67] really_probe+0x2e1/0x8b0 [ 49.168828][ T67] __driver_probe_device+0x193/0x280 [ 49.168854][ T67] driver_probe_device+0x54/0x3f0 [ 49.174951][ T312] usb 5-1: SerialNumber: syz [ 49.178690][ T67] __device_attach_driver+0x2f1/0x4b0 [ 49.178726][ T67] bus_for_each_drv+0x264/0x300 [ 49.236804][ T67] __device_attach+0x2c4/0x3c0 [ 49.241624][ T67] device_initial_probe+0x1e/0x30 [ 49.246703][ T67] bus_probe_device+0x18b/0x270 [ 49.251612][ T67] device_add+0x7fd/0xbf0 [ 49.255985][ T67] usb_set_configuration+0x1aad/0x2080 [ 49.261536][ T67] usb_generic_driver_probe+0x95/0x160 [ 49.267075][ T67] usb_probe_device+0x1ef/0x3b0 [ 49.272006][ T67] really_probe+0x2e1/0x8b0 [ 49.276559][ T67] __driver_probe_device+0x193/0x280 [ 49.281896][ T67] driver_probe_device+0x54/0x3f0 [ 49.286970][ T67] __device_attach_driver+0x2f1/0x4b0 [ 49.292396][ T67] bus_for_each_drv+0x264/0x300 [ 49.297306][ T67] __device_attach+0x2c4/0x3c0 [ 49.302120][ T67] device_initial_probe+0x1e/0x30 [ 49.307197][ T67] bus_probe_device+0x18b/0x270 [ 49.312104][ T67] device_add+0x7fd/0xbf0 [ 49.316473][ T67] usb_new_device+0x98d/0x1500 [ 49.321285][ T67] hub_event+0x2dbd/0x4360 [ 49.325748][ T67] process_scheduled_works+0x7f7/0x1060 [ 49.331347][ T67] worker_thread+0xc99/0x13f0 [ 49.336076][ T67] kthread+0x2c7/0x360 [ 49.340207][ T67] ret_from_fork+0x64/0xa0 [ 49.344666][ T67] ret_from_fork_asm+0x1a/0x30 [ 49.349478][ T67] [ 49.351840][ T67] Freed by task 907: [ 49.355788][ T67] kasan_save_track+0x3e/0x80 [ 49.360520][ T67] kasan_save_free_info+0x44/0x50 [ 49.365687][ T67] __kasan_slab_free+0x5f/0x80 [ 49.370502][ T67] kfree+0x158/0x440 [ 49.374458][ T67] roccat_release+0x2c3/0x390 [ 49.379195][ T67] __fput+0x20b/0xa30 [ 49.383235][ T67] ____fput+0x20/0x30 [ 49.387288][ T67] task_work_run+0x1e8/0x260 [ 49.391935][ T67] resume_user_mode_work+0x35/0x50 [ 49.397103][ T67] syscall_exit_to_user_mode+0x63/0xb0 [ 49.402620][ T67] do_syscall_64+0x63/0xf0 [ 49.403470][ T312] usb 5-1: 0:2 : does not exist [ 49.407076][ T67] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 49.415937][ T312] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 49.417921][ T67] [ 49.417929][ T67] The buggy address belongs to the object at ffff88813173ac00 [ 49.417929][ T67] which belongs to the cache kmalloc-512 of size 512 [ 49.417949][ T67] The buggy address is located 8 bytes inside of [ 49.417949][ T67] freed 512-byte region [ffff88813173ac00, ffff88813173ae00) [ 49.450398][ T312] usb 5-1: USB disconnect, device number 3 [ 49.455461][ T67] [ 49.455471][ T67] The buggy address belongs to the physical page: [ 49.455514][ T67] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x131738 [ 49.478967][ T67] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 49.487509][ T67] flags: 0x4000000000000040(head|zone=1) [ 49.493184][ T67] page_type: f5(slab) [ 49.497214][ T67] raw: 4000000000000040 ffff888100041c80 dead000000000100 dead000000000122 [ 49.505317][ T418] udevd[418]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 49.505837][ T67] raw: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000 [ 49.530113][ T67] head: 4000000000000040 ffff888100041c80 dead000000000100 dead000000000122 [ 49.538916][ T67] head: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000 [ 49.547634][ T67] head: 4000000000000002 ffffea0004c5ce01 ffffffffffffffff 0000000000000000 [ 49.556354][ T67] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000 [ 49.565496][ T67] page dumped because: kasan: bad access detected [ 49.571967][ T67] page_owner tracks the page as allocated [ 49.577806][ T67] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 313, tgid 313 (udevd), ts 25619475796, free_ts 0 [ 49.599139][ T67] post_alloc_hook+0x37d/0x3b0 [ 49.604054][ T67] prep_new_page+0x2d/0x180 [ 49.608615][ T67] get_page_from_freelist+0x4aea/0x4ba0 [ 49.614210][ T67] __alloc_pages_noprof+0x35a/0x7e0 [ 49.619502][ T67] alloc_slab_page+0x6b/0x1e0 [ 49.624230][ T67] allocate_slab+0x69/0x430 [ 49.628775][ T67] ___slab_alloc+0x591/0x8c0 [ 49.633408][ T67] __kmalloc_node_track_caller_noprof+0x2e3/0x4f0 [ 49.639881][ T67] kmalloc_reserve+0x144/0x4f0 [ 49.644688][ T67] __alloc_skb+0x13f/0x360 [ 49.649158][ T67] alloc_skb_with_frags+0xd0/0x8b0 [ 49.654315][ T67] sock_alloc_send_pskb+0x883/0x9a0 [ 49.659566][ T67] unix_dgram_sendmsg+0x63a/0x1a90 [ 49.664828][ T67] sock_write_iter+0x442/0x490 [ 49.669648][ T67] vfs_write+0x75f/0xfd0 [ 49.673950][ T67] ksys_write+0x145/0x260 [ 49.678347][ T67] page_owner free stack trace missing [ 49.683743][ T67] [ 49.686106][ T67] Memory state around the buggy address: [ 49.691769][ T67] ffff88813173ab00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 49.699876][ T67] ffff88813173ab80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 49.707977][ T67] >ffff88813173ac00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 49.716077][ T67] ^ [ 49.720533][ T67] ffff88813173ac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 49.728637][ T67] ffff88813173ad00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 49.736734][ T67] ================================================================== [ 49.746038][ T67] Disabling lock debugging due to kernel taint [ 49.751443][ T36] kauditd_printk_skb: 3 callbacks suppressed [ 49.751486][ T36] audit: type=1400 audit(1793621228.610:342): avc: denied { read } for pid=93 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 49.783719][ T36] audit: type=1400 audit(1793621228.610:343): avc: denied { search } for pid=93 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 49.805848][ T36] audit: type=1400 audit(1793621228.610:344): avc: denied { write } for pid=93 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 49.830987][ T36] audit: type=1400 audit(1793621228.620:345): avc: denied { add_name } for pid=93 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 49.851800][ T36] audit: type=1400 audit(1793621228.620:346): avc: denied { create } for pid=93 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 49.877896][ T36] audit: type=1400 audit(1793621228.620:347): avc: denied { append open } for pid=93 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 49.901049][ T36] audit: type=1400 audit(1793621228.620:348): avc: denied { getattr } for pid=93 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1