last executing test programs: 4.43536366s ago: executing program 2 (id=7): socket$key(0xf, 0x3, 0x2) (async) r0 = socket$key(0xf, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) (async) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) (async) sched_setaffinity(0x0, 0x0, 0x0) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, 0x0, 0x40001) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000100), 0x12) epoll_pwait(0xffffffffffffffff, &(0x7f0000000300), 0x0, 0x7fffffff, 0x0, 0x0) (async) epoll_pwait(0xffffffffffffffff, &(0x7f0000000300), 0x0, 0x7fffffff, 0x0, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x2, 0xd, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @private1}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @empty}}, @sadb_x_policy={0x2, 0x12, 0x2, 0x2, 0x0, 0x0, 0x0, {0x6, 0x32, 0x0, 0x0, 0x0, 0x0, 0x0, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1}}, @sadb_lifetime={0x4, 0x4}]}, 0xc0}}, 0x0) sendmsg$key(r0, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) (async) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f00000003c0)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x6}, {}, 0x0, 0x0, 0x1}, {{@in=@rand_addr=0x64010102, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x0, 0x3, 0x0, 0x0, 0x400000}}, 0xe8) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c) 4.244922614s ago: executing program 2 (id=9): syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000086d0415c20000000000010902240001000000ef09040000090300030009210b0010002229000905810308"], 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="3800000003010104000000000000000002000000240001801400018008000100e0ede80108000200e00000010c0002800400010000000000"], 0x38}}, 0x0) 3.892336342s ago: executing program 3 (id=13): capset(&(0x7f00000000c0)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x1, 0x0, 0x2}) pipe2(&(0x7f0000000480)={0xffffffffffffffff}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x7, 0x7ff}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) ioctl$UBLK_U_CMD_END_USER_RECOVERY(r0, 0xc0207511, &(0x7f0000000100)={0x0, 0xffff, 0x0, 0x0, 0x0}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x41, &(0x7f0000000100)=0x2008, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r3, &(0x7f00000001c0)="40c3", 0x2, 0x20c1, 0x0, 0x0) ioprio_set$pid(0x1, r2, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYRES64=r1], 0x28}, 0x1, 0x0, 0x0, 0x4880}, 0x4810) r5 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) ioctl$TUNATTACHFILTER(r6, 0x401054d5, &(0x7f0000000080)={0x2, &(0x7f0000000180)=[{0x24}, {0x6}]}) shutdown(r5, 0x0) r7 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r7, 0x10e, 0xc, &(0x7f0000000000)={0x4800}, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000c40)=ANY=[@ANYBLOB="1c0000001600010a10000040000000000207"], 0x1c}}, 0x0) write(r5, 0x0, 0x0) connect$bt_rfcomm(r5, &(0x7f0000005dc0)={0x1f, @any, 0x10}, 0xa) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000280), 0xdf6407dc0dc2d23f, 0x0) ioctl$sock_SIOCINQ(r7, 0x541b, &(0x7f00000002c0)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r8, 0x6, 0x13, &(0x7f0000000040)=0x21, 0x4) connect$inet6(r8, &(0x7f0000000080)={0xa, 0x0, 0xfffffffe, @loopback, 0x4}, 0x1c) 3.891789502s ago: executing program 3 (id=14): syz_usb_connect(0x0, 0x0, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) r3 = socket$inet6(0xa, 0x3, 0x3) bind$inet6(r3, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @random="bd948687618d"}) write$tun(r0, &(0x7f0000000480)={@val={0xa, 0x88a8}, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @random="cd1008a2dc58", @void, {@ipv6={0x86dd, @generic={0x1, 0x6, "fdeb4a", 0xd0, 0x0, 0x59653e1b0257ddd0, @local, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {[@hopopts={0x32, 0x19, '\x00', [@calipso={0x7, 0x8, {0x1, 0x0, 0x7}}, @pad1, @generic={0x9b, 0xb9, "4975b229d9a80cb67bed82f9616fb69326dc3750164c441935f18fe9da0af78388dc2921a8a2818c89c489d0dfd2b714b82bc3ac199f7d40bad4e2010ea22d418a7ebec95b883700a3427cead0a50207b44996f885193a51794082ce88d7c0120c63220d9c499ac7ec9216d948d3733f8f197fa2d1675f3d8241b6de9fc5007859e7fb345f22b88a948ae2c5e28abe46d9a77ca9a64029b9970b4326d8464adb8e0a517c972f9b23576cb723edc8eadbe160268d2919e4672f"}]}]}}}}}}, 0x10a) 3.335381885s ago: executing program 3 (id=15): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000000600)="6459df536e39c72401df00e39f31561fde3bb80bac686827534cf60be8fdefc76c65806bb8f09878182b793929e034a5d78a57a18afda3cde2fb36d45d4b1c694bd33c71c03a84cfaa054b08ac9b4f99e2b4f30bcc790e5bd6bfba9ce11e0c2241efba8011007d326dcaf100b6f5ae6c7b9c955ea7cc53d43ac1f963551de75d47", 0x81, 0x24000045, &(0x7f00000001c0)={0xa, 0x2, 0xdfff, @loopback}, 0x1c) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) writev(r1, &(0x7f0000000100)=[{&(0x7f0000000a40)="2e9b3d0007e03dd651930100c575963f886411", 0x13}, {&(0x7f0000000140)='\x00\x00\x00\x00\x00\x00W', 0x7}], 0x2) r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) r3 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup(r8) syz_ublk_setup_queues(r9, r7, &(0x7f0000000180)={0x0, 0x1, 0x1f00, 0x1, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7fffde, 0x200, 0x2, 0x15e, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x80, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90f, 0x200, 0x3, 0x0, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0x1e9}}], 0x1, &(0x7f0000000340)={0x2e, 0x2, 0x0, r9, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x8004, 0x0, 0x0}}, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000340)={{0x2, 0x3, 0xf3b, 0x2, 0x13fffffc}}) sendmsg$TCPDIAG_GETSOCK(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="4c0000001200010003950000000000000a09007f0000000000000000000000000000ffff"], 0x4c}}, 0x80) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000180)='reno', 0x4) shutdown(r0, 0x1) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) r11 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f00000004c0)={'syz_tun\x00', 0x0}) r13 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r13, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={0x30, r10, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@ETHTOOL_A_LINKMODES_OURS={0x10, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}, @ETHTOOL_A_BITSET_MASK={0x7, 0x5, "8b4e9f"}]}, @ETHTOOL_A_LINKMODES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x20004000}, 0x4044094) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES16=r0, @ANYRES16], 0x0) 3.068421761s ago: executing program 2 (id=16): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x0) mount$fuseblk(&(0x7f0000000340), &(0x7f0000000380)='./file0\x00', &(0x7f0000000440), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="66c2077b6753a9f67b4223643d", @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000010000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',default_permissions,allow_other,\x00']) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.numa_stat\x00', 0x275a, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_SET_CPUID(r6, 0x4008ae8a, &(0x7f00000000c0)={0x1, 0x0, [{0xd, 0xfffffff4, 0x4, 0x5, 0x2}]}) r7 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r8 = getpid() r9 = syz_pidfd_open(r8, 0x0) setns(r9, 0x20000) ioctl$HIDIOCGREPORT(r1, 0x400c4807, &(0x7f00000000c0)={0x3, 0x100, 0x4}) write$selinux_load(r7, &(0x7f0000000280)=ANY=[@ANYBLOB="8cff7cf908"], 0x65) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r3, &(0x7f0000000180)={0x0, 0xdeeb, 0x20, 0x1, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x10000, 0x3, 0x10000002, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x1, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x2000, 0x4000001, 0x0, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x100, 0x1, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x20, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB=')\x00'], 0x18}, 0x440e0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) futimesat(0xffffffffffffffff, 0x0, &(0x7f0000000440)={{0x77359400}, {0x0, 0xea60}}) ioctl$IOC_PR_REGISTER(r2, 0x401870c8, &(0x7f0000000040)={0xfe5, 0xffffffff, 0x1}) r12 = syz_open_procfs(0x0, &(0x7f0000000080)='mounts\x00') read$FUSE(r12, &(0x7f00000044c0)={0x2020}, 0x2020) 2.880406455s ago: executing program 2 (id=17): r0 = syz_open_procfs(0x0, &(0x7f0000000200)='net/vlan/config\x00') preadv(r0, &(0x7f0000000340)=[{&(0x7f0000003200)=""/4096, 0x1000}], 0x1, 0x2c2, 0xca) r1 = syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000080)=0x9, 0x4) connect$inet6(r2, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4001c00) ptrace$poke(0x4, r1, &(0x7f00000000c0), 0x80000001) r3 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) r4 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000080)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f0000000240)='asymmetric\x00', &(0x7f0000000180)=@keyring) close(r3) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r5 = userfaultfd(0x801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$UFFDIO_CONTINUE(r5, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) truncate(&(0x7f0000000000)='./file0\x00', 0x2) 2.845294986s ago: executing program 2 (id=18): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x101b00, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.current\x00', 0x275a, 0x0) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x158}, 0x0, 0x0, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x8010, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x44, 0x0, 0x0) keyctl$join(0x1, &(0x7f0000000100)={'syz', 0x2}) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_usb_connect(0x5, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000092ecc620ac0500773aeb010200010902240001000020000904c41f02fffd01"], 0x0) 1.946287386s ago: executing program 1 (id=23): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x300000a, 0x12, r4, 0x852ac000) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, 0x0) r5 = dup(r1) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f00000004c0)={@val={0x0, 0x891f}, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @multicast, @void, {@ipv4={0x800, @tipc={{0x5, 0x4, 0x2, 0x0, 0x14, 0x66, 0x0, 0x2, 0x6, 0x0, @private=0xa010100, @empty=0x4a}, @name_distributor={{0x28, 0x0, 0x0, 0x0, 0x0, 0xa, 0xb, 0x2, 0x4, 0x0, 0x1, 0x2f6f, 0x9, 0x2, 0x4e20, 0x4e20, 0x0, 0x3, 0x0, 0x0, 0x1}}}}}}}, 0x4e) 1.723000531s ago: executing program 1 (id=25): r0 = socket$can_bcm(0x1d, 0x2, 0x2) socket$can_bcm(0x1d, 0x2, 0x2) (async) r1 = socket$can_bcm(0x1d, 0x2, 0x2) r2 = userfaultfd(0x801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x380}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) (async) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000040)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00001b1000/0x4000)=nil, 0x400000, 0x3, 0x2}) (async) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000040)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00001b1000/0x4000)=nil, 0x400000, 0x3, 0x2}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r3 = syz_open_procfs$pagemap(0x0, &(0x7f0000000240)) ioctl$PAGEMAP_SCAN(r3, 0xc0606610, &(0x7f0000000100)={0x60, 0x0, &(0x7f00001c9000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) sendfile(r4, r4, 0x0, 0x3) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r1, 0x0, 0x0) connect$can_bcm(r0, &(0x7f0000000140)={0x1d, r5}, 0x10) sendmsg$can_bcm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="050000000109"], 0x80}}, 0x0) (async) sendmsg$can_bcm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="050000000109"], 0x80}}, 0x0) socket(0x10, 0x1, 0x2) (async) r6 = socket(0x10, 0x1, 0x2) write(r6, &(0x7f0000000000)="2400000011005f0414f9f4070009041f810000000e0000000000000008000f0001000000", 0x24) 1.613649734s ago: executing program 1 (id=26): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x101800, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000200)=0x5, 0x4) r2 = socket$netlink(0x10, 0x3, 0xf) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r2, 0x10e, 0x4, &(0x7f0000000080)=0x100, 0x4) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000000), 0x4) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r3, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="3c0000001100010000000000ffdbdf252c0000002500000072eaf496202493a840919fdc5a8d2527eff06892d1"], 0x3c}], 0x1, 0x0, 0x0, 0xc010}, 0x40080) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x6) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f00009b3000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000100)="0f01df0f3235004000000f30b9fa000000430f79a279a2300d76c4020a1bf7b805000000b90000c0fe0f3cae0a41d941d9000f32ba00e500000f30660fc775023a0fba600c9864660ffc76002f3166b85766baa00066ed00d0", 0x59}], 0x1, 0x1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1e2) r6 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000700)={0x0, &(0x7f0000000380)=[@set_irq_handler={0xc8, 0x20, {0xa0, 0x1}}, @nested_vmlaunch={0x12f, 0x18, 0x3}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x1, @guest64=0x2808, 0xffffffffffffffff, 0x5, 0x10000}}, @wrmsr={0x65, 0x20, {0xb92, 0x5}}, @uexit={0x0, 0x18, 0x100000001}, @uexit={0x0, 0x18, 0x9}, @enable_nested={0x12c, 0x18}, @nested_vmlaunch={0x12f, 0x18}, @wr_drn={0x68, 0x20, {0x1, 0x5}}, @nested_amd_inject_event={0x180, 0x38, {0x3, 0x2e, 0x4, 0xc7, 0x1}}, @wr_drn={0x68, 0x20, {0x5, 0x3}}, @nested_amd_stgi={0x17e, 0x10}, @nested_amd_stgi={0x17e, 0x10}, @in_dx={0x69, 0x20, {0x21bd, 0x1}}, @nested_load_code={0x12e, 0x6f, {0x1, "450f01f8b9800000c00f3235004000000f30440f01ca0f38057e0666410f01f82e470fc72fb805000000b9931400000f01d9c4218572e1c1c744240005000000c744240224210000c7442406000000000f0114240f79ca"}}, @nested_load_code={0x12e, 0x68, {0x2, "f30f1efd426b55003cc7442400140f0000c744240200100000c7442406000000000f011c24653ef042f61e45deb00300000066b862008ed0643e26470fae33c48176c2c89bb8010000000f01d90f01c3"}}, @cpuid={0x64, 0x18, {0xf}}, @in_dx={0x69, 0x20, {0x1002eea, 0x3}}, @nested_amd_stgi={0x17e, 0x10}, @nested_vmlaunch={0x12f, 0x18, 0x3}, @nested_vmresume={0x130, 0x18, 0x2}, @nested_amd_set_intercept={0x181, 0x30, {0x1, 0x7fffffff, 0x8, 0x1}}, @in_dx={0x69, 0x20, {0xef62, 0x1}}, @nested_amd_vmsave={0x183, 0x18, 0x1}, @wrmsr={0x65, 0x20, {0x911, 0x3}}], 0x37f}) ioctl$KVM_GET_MSRS_cpu(r6, 0xc008ae88, &(0x7f0000000740)={0xa, 0x0, [{0xbd3, 0x0, 0x3}, {0x2fc}, {0xa54, 0x0, 0x10}, {0x4b564d03, 0x0, 0x9}, {0x9bd, 0x0, 0xffffffffffffb797}, {0x2db, 0x0, 0x1ff}, {0xa95, 0x0, 0x4}, {0x858, 0x0, 0x4}, {0x774, 0x0, 0x7fffffffffffffff}, {0xcdf729d0a7ae03df}]}) capset(&(0x7f0000000080)={0x20080522}, &(0x7f00000000c0)={0x200004, 0x200004, 0x3}) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) r7 = ioctl$KVM_GET_STATS_FD_vm(r4, 0xaece) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANGE_NAN_CONFIG(r7, &(0x7f00000008c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x44, r8, 0x230, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x76}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x8}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x9}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x1}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0xd4}]}, 0x44}, 0x1, 0x0, 0x0, 0x20008041}, 0x1) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000300), 0x401, &(0x7f00000001c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) chdir(&(0x7f0000000140)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', 0x0, 0x28010b3, 0x0) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x2) 1.237693072s ago: executing program 0 (id=27): r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000002ec0)='./binderfs/binder-control\x00', 0x2, 0x0) (async) r1 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000002d00)) (async) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000037c0)) (async) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$BINDER_CTL_ADD(r0, 0xc1086201, &(0x7f0000002f00)={'binder1\x00'}) (async, rerun: 64) ioctl$BTRFS_IOC_QUOTA_RESCAN(r0, 0x4040942c, &(0x7f0000000000)={0x0, 0xb, [0xe34, 0x7ff, 0x4, 0x8, 0x10001, 0x4]}) (rerun: 64) 1.164414294s ago: executing program 1 (id=28): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000008000000000a200000"], 0xd8}}, 0x20050800) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r1, &(0x7f0000002a80)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000300)={0x40, 0x13, 0x1, 0x70bd2b, 0x25dfdbf8, "", [@nested={0x4, 0x4f}, @typed={0x8, 0x33, 0x0, 0x0, @uid}, @nested={0x24, 0x125, 0x0, 0x1, [@nested={0xc, 0x2e, 0x0, 0x1, [@typed={0x8, 0x92, 0x0, 0x0, @u32=0x8000}]}, @typed={0x14, 0x1c, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}]}, 0x40}], 0x1, 0x0, 0x0, 0x8000}, 0x8880) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.io_wait_time_recursive\x00', 0x26e1, 0x0) r2 = socket$netlink(0x10, 0x3, 0x10) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(r3, 0x112, 0xa, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(r5, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8905, &(0x7f0000000340)={'pim6reg0\x00', @remote}) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e00000000000000000005000600010000000800090001000000050002"], 0x44}}, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.162644004s ago: executing program 0 (id=29): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f0000000200)={@val={0x70, 0x88fb}, @void, @eth={@broadcast, @multicast, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x12, 0x18, 0x65, 0x0, 0x10, 0x6, 0x0, @loopback, @broadcast}, "391d96ed"}}}}}, 0x2a) (async) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000400), 0x101000, 0x0) ioctl$RTC_IRQP_READ(r5, 0x8008700b, &(0x7f0000000440)) r6 = dup(r4) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) (async, rerun: 64) syz_kvm_setup_cpu$x86(r6, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0x4b, 0x0, 0x0) (rerun: 64) r7 = socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = syz_genetlink_get_family_id$batadv(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(r7, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20a}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r8, 0x300, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0xfffffffe}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0xfe}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}]}, 0x58}, 0x1, 0x0, 0x0, 0x44840}, 0x4000) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r6, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x30, r8, 0x10, 0x70bd25, 0x25dfdbfb, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0xfffffffb}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x30}, 0x1, 0x0, 0x0, 0x40090}, 0x40) (async, rerun: 32) mount$cgroup2(0x0, &(0x7f0000000240)='./cgroup\x00', &(0x7f0000000300), 0x4006, &(0x7f0000000480)={[{@memory_recursiveprot}]}) (rerun: 32) 1.080570286s ago: executing program 1 (id=30): r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x2, 0x158}, &(0x7f0000000100), &(0x7f0000000280), &(0x7f0000000140)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, 0x0, &(0x7f0000000180)={0x0, 0xcd5e, 0x1, 0x1, 0x257, 0x0, r2}, &(0x7f0000000980)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xddfb, 0x8, 0x1, 0x10000006}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffc, 0x40, 0x0, 0x143, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f6e, 0x0, 0x5, 0x1000037b, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8000, 0x5, 0x49}}], 0x1, &(0x7f0000000340)={0x2e, 0x40, 0x0, r0, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0xfff9, 0x5, 0x0, 0x0}}, 0x0) 1.053913076s ago: executing program 1 (id=31): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x1, 0x0, 0x0, 0x0, 0x20, 0x5543, 0x64, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x38, 0x9, "", [{{0x9, 0x4, 0x0, 0xfa, 0x1, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x2, 0x0, 0x1, {0x22, 0x6}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x0, 0xf, 0x3}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = socket$nl_audit(0x10, 0x3, 0x9) bind$netlink(r1, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfe, 0x8000}, 0xc) setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000000040)={0x0, 0x4}, 0x8) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f0000000340)={0x0, 0x23, 0x6, {0x6, 0x21, "7e00a674"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 960.456899ms ago: executing program 2 (id=32): r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r1 = getuid() quotactl_fd$Q_SETQUOTA(r0, 0xffffffff80000800, r1, &(0x7f00000000c0)={0x6, 0xff, 0x2de, 0x9, 0x5, 0x5, 0x5, 0x2, 0x3}) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (async) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_ro(r2, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) (async) r3 = openat$cgroup_ro(r2, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r3, &(0x7f0000000200)=0x1, 0x12) syz_usb_connect(0x2, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="1201100154181e10d8160660b4120102030109021b00024005000909470600004de60b0509049b0d000202ff"], 0x0) 960.137088ms ago: executing program 0 (id=33): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cgroup.stat\x00', 0x275a, 0x0) socket$inet_udp(0x2, 0x2, 0x0) syz_usb_connect$uac3(0x0, 0xbd, &(0x7f0000000140)={{0x12, 0x1, 0x311, 0x0, 0x0, 0x0, 0x10, 0x499, 0x2002, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xab, 0x3, 0x1, 0x0, 0x40, 0x66, {0x8, 0xb, 0x0, 0x1, 0x1, 0x0, 0x30, 0x4}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x6, 0x47, 0xfff}, [@feature_unit={0x9, 0x24, 0x7, 0x5, 0x5, [0x6]}, @multiply_unit={0xb, 0x24, 0xd, 0x2, 0xff, 0x8, 0xf}, @multiply_unit={0xb, 0x24, 0xd, 0x4, 0xe, 0x800, 0x400}, @feature_unit={0x15, 0x24, 0x7, 0x5, 0x4, [0xeb, 0xc, 0x3e92dd003c6df779, 0x3]}, @selector_unit={0x9, 0x24, 0xc, 0x1, 0x4, "2cda8ed8"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x9, 0x40, 0x1, {0xa, 0x25, 0x25, 0x3, 0x2, 0x3}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x5, 0x0, 0x0, {0xa, 0x25, 0x25, 0xd, 0x10, 0x1}}}}}}}}]}}, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100), 0x100000005, 0x0) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000001280)={r0, 0x0, {0x2a12, 0x80010000, 0x0, 0x0, 0x4, 0x0, 0x0, 0x13, 0xc, "0500000000000000d1f8a0e91ddaaca79603dda1af1ea80000000000edffffff0000deff00ffffffffffffffe300000014a2648f00", "2809e8dbe108038948224ad54afac11d875397bdb22d0000b420a1a93c7540f4767f9e01177d3dd40600000061ac00", "90be8b1c55f96400", [0x800]}}) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000040)=0x2) ioctl$PPPIOCSACTIVE(r2, 0x40047459, &(0x7f0000000080)={0xfffffffffffffe43, 0x0}) read(r2, 0x0, 0x0) write$ppp(r2, &(0x7f0000000200)="bc72", 0x2) write$binfmt_misc(r0, &(0x7f00000013c0)="fb64380aa72b09bb4f3aeaa382495e0a1f862a6e026de6e7ac372c5268189646c8f34c00c46fe6f48372d3e6f0b7cef3aa5b478a4957323136722d67a1533b7fb2baf8de579c2e236df8aaaa6a88b7658e23", 0x52) 334.738922ms ago: executing program 0 (id=34): capset(&(0x7f00000000c0)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x1, 0x0, 0x2}) pipe2(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) prlimit64(0x0, 0xa, &(0x7f0000000240)={0x5, 0x7fe}, 0x0) prlimit64(0x0, 0xc, &(0x7f0000000600)={0xff, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) ioctl$UBLK_U_CMD_END_USER_RECOVERY(r0, 0xc0207511, &(0x7f0000000100)={0x0, 0xffff, 0x0, 0x0, 0x0}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x41, &(0x7f0000000100)=0x2008, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r3, &(0x7f00000001c0)="40c3", 0x2, 0x20c1, 0x0, 0x0) ioprio_set$pid(0x1, r2, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="28000000140001e903000000fedbdc250a0000000400"], 0x28}, 0x1, 0x0, 0x0, 0x20000804}, 0x4800) r5 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) shutdown(r5, 0x0) write(r5, 0x0, 0x0) connect$bt_rfcomm(r5, &(0x7f0000005dc0)={0x1f, @any, 0xc}, 0xa) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000280), 0xdf6407dc0dc2d23f, 0x0) ioctl$sock_SIOCINQ(r1, 0x541b, &(0x7f0000000180)) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x13, &(0x7f0000000040)=0x21, 0x4) connect$inet6(r7, &(0x7f0000000080)={0xa, 0x0, 0xfffffffe, @loopback, 0x4}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r7, 0x11a, 0x2, &(0x7f0000000140)=@ccm_128={{0x304, 0x39}, "4526000000927650", '\x00', "c5f54bb1"}, 0x28) ioctl$TIOCSETD(r6, 0x5423, &(0x7f00000000c0)=0x3ff) setuid(0xee01) 309.349273ms ago: executing program 0 (id=35): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="3800000003010104000000000000000002000000240001801400018008000100e0ede80108000200e00000010c0002800400010000000000"], 0x38}}, 0x0) 285.995054ms ago: executing program 0 (id=36): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000d00), r1) sendmsg$IEEE802154_LLSEC_ADD_KEY(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000040)={0x14, r2, 0x1, 0x70bd29, 0x5dfdbfb}, 0x14}}, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x103, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r5, 0x4040aea0, &(0x7f0000000100)=@x86={0xe, 0x3, 0x10, 0x0, 0xfffffffe, 0xfc, 0x5, 0x4, 0x9, 0x3, 0x1, 0x0, 0x0, 0x6, 0x5, 0x1, 0x5, 0x9, 0x6, '\x00', 0x64, 0x21}) ioctl$KVM_GET_VCPU_EVENTS(r5, 0x8040ae9f, &(0x7f00000001c0)) sendmsg$NFC_CMD_GET_TARGET(r1, &(0x7f00000000c0)={0x0, 0x14, &(0x7f0000000080)={&(0x7f0000000100)={0x14, 0x0, 0x4, 0x0, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x1c4}, 0x24040844) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = socket(0x10, 0x3, 0x0) sendto$inet6(r6, &(0x7f0000000100)="c10e000018001f06b9409b0dffff110d0207be040205060506100a044300040018000000fac8388827a685a168d9a44604094565360c648dcaaf6c26c291214549932fde4a460c89b6ec0cff3959547f509058ba86c902fc3a10004a320c0400160016000a00000000000000000000080756ede4ccbe5880", 0xec1, 0x0, 0x0, 0x9e5e111c47e3504f) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r0) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000380)=ANY=[@ANYBLOB="1c000021", @ANYRES16=r7, @ANYBLOB="010000000000000000001c0000000800010001000000"], 0x1c}}, 0x0) syz_usb_connect(0x0, 0x164, &(0x7f0000000100)=ANY=[@ANYBLOB="120100007af28810d30b69055b000000000109025201012000000009044000000e010000082406", @ANYBLOB="0563ca964ed0cfb20000d366"], 0x0) 232.078875ms ago: executing program 3 (id=37): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101100, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) (async) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) (async) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x34, r4, 0x7, 0x70bd25, 0x25dfdbfd, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_SPEED={0x8, 0x5, 0x2710}]}, 0x34}, 0x1, 0x0, 0x0, 0x200000c0}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000016000/0x18000)=nil, &(0x7f0000000300)=[@text32={0x20, 0x0}], 0x1, 0x4e, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x0, 0xd000}) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f00000000c0)={[{0x6, 0x8, 0x7f, 0xb, 0x4e, 0x9, 0x4, 0x0, 0x40, 0x6, 0x94, 0x2f, 0x9}, {0x7ff, 0x8, 0x8f, 0x4, 0x4, 0x4e, 0x1, 0x7d, 0x6, 0x7, 0x5, 0x7, 0x2}, {0x8723, 0xfff, 0x7f, 0x5, 0xa, 0x6, 0x0, 0x2, 0xf7, 0x80, 0x81, 0x8, 0x4}], 0x4}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 103.361088ms ago: executing program 3 (id=38): r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0) (async) r1 = openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x12, r1, 0x0) io_setup(0x1, &(0x7f00000000c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000100)=[&(0x7f0000000040)={0x1802, 0x0, 0x0, 0x5, 0xfffe, r0, 0x0}]) prctl$PR_TASK_PERF_EVENTS_DISABLE(0x1f) write$selinux_load(r0, &(0x7f0000000000)=ANY=[], 0x2000) (async) write$selinux_load(r0, &(0x7f0000000000)=ANY=[], 0x2000) 0s ago: executing program 3 (id=39): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) (async) mprotect(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x4000006) (async) ioctl$VFAT_IOCTL_READDIR_SHORT(r0, 0x82307202, &(0x7f0000000200)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) (async) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x109240, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, r1, 0xc144f000) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f00005a3000/0x400000)=nil) (async) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'bridge0\x00', 0x0}) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000000)=0x8, 0x4) (async) sendto$packet(r2, &(0x7f00000000c0)="3f031c000302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r3, 0x1, 0x0, 0x6, @multicast}, 0x14) (async) fadvise64(r0, 0x7, 0x4, 0x2) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async) setsockopt$inet_tcp_int(r0, 0x6, 0x10, &(0x7f0000000000)=0xfffffff8, 0x4) (async) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.250' (ED25519) to the list of known hosts. [ 20.595689][ T36] audit: type=1400 audit(1784009389.440:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 20.596921][ T286] cgroup: Unknown subsys name 'net' [ 20.618612][ T36] audit: type=1400 audit(1784009389.440:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.646371][ T36] audit: type=1400 audit(1784009389.470:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.646611][ T286] cgroup: Unknown subsys name 'devices' [ 20.774342][ T286] cgroup: Unknown subsys name 'hugetlb' [ 20.780096][ T286] cgroup: Unknown subsys name 'rlimit' [ 20.872170][ T36] audit: type=1400 audit(1784009389.710:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 20.895541][ T36] audit: type=1400 audit(1784009389.720:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 20.920600][ T36] audit: type=1400 audit(1784009389.720:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 20.936258][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 20.953657][ T36] audit: type=1400 audit(1784009389.800:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.979856][ T36] audit: type=1400 audit(1784009389.800:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.981249][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.006295][ T36] audit: type=1400 audit(1784009389.820:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.040751][ T36] audit: type=1400 audit(1784009389.820:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.828501][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.835821][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.843075][ T293] bridge_slave_0: entered allmulticast mode [ 21.849294][ T293] bridge_slave_0: entered promiscuous mode [ 21.863051][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.870111][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.877603][ T293] bridge_slave_1: entered allmulticast mode [ 21.883896][ T293] bridge_slave_1: entered promiscuous mode [ 21.904203][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.911370][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.918646][ T294] bridge_slave_0: entered allmulticast mode [ 21.924942][ T294] bridge_slave_0: entered promiscuous mode [ 21.932910][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.939961][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.947149][ T294] bridge_slave_1: entered allmulticast mode [ 21.953975][ T294] bridge_slave_1: entered promiscuous mode [ 21.983885][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.991213][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.998551][ T295] bridge_slave_0: entered allmulticast mode [ 22.004907][ T295] bridge_slave_0: entered promiscuous mode [ 22.011421][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.019398][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.026912][ T295] bridge_slave_1: entered allmulticast mode [ 22.033393][ T295] bridge_slave_1: entered promiscuous mode [ 22.083733][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.091145][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.098784][ T296] bridge_slave_0: entered allmulticast mode [ 22.105322][ T296] bridge_slave_0: entered promiscuous mode [ 22.111731][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.119000][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.126209][ T296] bridge_slave_1: entered allmulticast mode [ 22.132730][ T296] bridge_slave_1: entered promiscuous mode [ 22.210555][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.217637][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.225428][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.232809][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.293735][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.301165][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.308751][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.316234][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.335715][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.342802][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.350165][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.357400][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.370144][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.377227][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.384610][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.391817][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.401356][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.409279][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.417529][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.425337][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.432953][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.440435][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.448199][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.456032][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.468503][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.476035][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.493590][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.500652][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.544370][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.551433][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.560097][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.568408][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.577399][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.584466][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.596295][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.603365][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.620339][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.627880][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.635758][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.642841][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.665594][ T294] veth0_vlan: entered promiscuous mode [ 22.696144][ T293] veth0_vlan: entered promiscuous mode [ 22.703114][ T295] veth0_vlan: entered promiscuous mode [ 22.722813][ T295] veth1_macvtap: entered promiscuous mode [ 22.729898][ T294] veth1_macvtap: entered promiscuous mode [ 22.741211][ T293] veth1_macvtap: entered promiscuous mode [ 22.775545][ T296] veth0_vlan: entered promiscuous mode [ 22.803064][ T294] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 22.808878][ T296] veth1_macvtap: entered promiscuous mode [ 22.859322][ T313] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2'. [ 22.863489][ T316] capability: warning: `syz.2.3' uses deprecated v2 capabilities in a way that may be insecure [ 22.873665][ T31] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 22.899682][ T314] batadv_slave_1: entered promiscuous mode [ 22.919956][ T31] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 22.930378][ T314] SELinux: Context system_u:object_r:system_cron_spool_t:s0 is not valid (left unmapped). [ 22.972477][ T315] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 23.056924][ T313] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=313 comm=syz.1.2 [ 23.074701][ T315] batadv_slave_1: left promiscuous mode [ 23.182479][ T66] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 23.245136][ T351] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=io+mem:owns=io+mem [ 23.344399][ T66] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 23.355781][ T66] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 23.365384][ T66] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 23.375299][ T66] usb 1-1: config 0 descriptor?? [ 23.377786][ T355] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12'. [ 23.462505][ T324] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 23.543470][ T45] usb 2-1: new low-speed USB device number 2 using dummy_hcd [ 23.622333][ T324] usb 3-1: Using ep0 maxpacket: 8 [ 23.628613][ T324] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 23.639732][ T324] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 23.653087][ T324] usb 3-1: New USB device found, idVendor=046d, idProduct=c215, bcdDevice= 0.00 [ 23.662367][ T324] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 23.671447][ T324] usb 3-1: config 0 descriptor?? [ 23.677946][ T324] usbhid 3-1:0.0: fixing wrong optional hid class descriptors count [ 23.707690][ T45] usb 2-1: config 85 has an invalid interface number: 198 but max is 2 [ 23.716299][ T45] usb 2-1: config 85 has an invalid interface number: 75 but max is 2 [ 23.724649][ T45] usb 2-1: config 85 has an invalid interface number: 94 but max is 2 [ 23.733811][ T45] usb 2-1: config 85 contains an unexpected descriptor of type 0x2, skipping [ 23.743124][ T45] usb 2-1: config 85 has no interface number 0 [ 23.749488][ T45] usb 2-1: config 85 has no interface number 1 [ 23.755880][ T45] usb 2-1: config 85 has no interface number 2 [ 23.762705][ T45] usb 2-1: config 85 interface 198 altsetting 6 endpoint 0xC has invalid maxpacket 64, setting to 8 [ 23.774050][ T45] usb 2-1: config 85 interface 198 altsetting 6 endpoint 0x4 is Bulk; changing to Interrupt [ 23.784796][ T45] usb 2-1: config 85 interface 198 altsetting 6 endpoint 0x4 has invalid wMaxPacketSize 0 [ 23.786983][ T322] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 23.795979][ T45] usb 2-1: config 85 interface 198 altsetting 6 endpoint 0xB has invalid maxpacket 1023, setting to 8 [ 23.805831][ T322] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 23.816446][ T45] usb 2-1: config 85 interface 198 altsetting 6 endpoint 0x3 has invalid maxpacket 1560, setting to 8 [ 23.834597][ T45] usb 2-1: config 85 interface 198 altsetting 6 has a duplicate endpoint with address 0x4, skipping [ 23.845833][ T45] usb 2-1: config 85 interface 198 altsetting 6 has an invalid descriptor for endpoint zero, skipping [ 23.856884][ T45] usb 2-1: config 85 interface 198 altsetting 6 endpoint 0x1 has invalid maxpacket 1023, setting to 8 [ 23.869363][ T45] usb 2-1: config 85 interface 198 altsetting 6 endpoint 0xE has invalid maxpacket 1024, setting to 8 [ 23.883821][ T45] usb 2-1: config 85 interface 198 altsetting 6 has an endpoint descriptor with address 0xCD, changing to 0x8D [ 23.896738][ T324] usbhid 3-1:0.0: can't add hid device: -71 [ 23.903240][ T324] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 23.912381][ T45] usb 2-1: config 85 interface 198 altsetting 6 has a duplicate endpoint with address 0xB, skipping [ 23.923664][ T66] keytouch 0003:0926:3333.0002: fixing up Keytouch IEC report descriptor [ 23.933485][ T66] input: HID 0926:3333 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0926:3333.0002/input/input5 [ 23.945988][ T324] usb 3-1: USB disconnect, device number 2 [ 23.952826][ T45] usb 2-1: config 85 interface 198 altsetting 6 has a duplicate endpoint with address 0x3, skipping [ 23.965228][ T45] usb 2-1: config 85 interface 198 altsetting 6 has an invalid descriptor for endpoint zero, skipping [ 23.976871][ T45] usb 2-1: config 85 interface 75 altsetting 4 has a duplicate endpoint with address 0xB, skipping [ 23.988072][ T45] usb 2-1: config 85 interface 75 altsetting 4 has a duplicate endpoint with address 0xC, skipping [ 23.999563][ T45] usb 2-1: config 85 interface 75 altsetting 4 has a duplicate endpoint with address 0xD, skipping [ 24.011048][ T45] usb 2-1: config 85 interface 75 altsetting 4 has a duplicate endpoint with address 0xC, skipping [ 24.023718][ T45] usb 2-1: config 85 interface 75 altsetting 4 has a duplicate endpoint with address 0x1, skipping [ 24.035936][ T45] usb 2-1: config 85 interface 75 altsetting 4 endpoint 0x6 has invalid maxpacket 1024, setting to 8 [ 24.047790][ T45] usb 2-1: config 85 interface 75 altsetting 4 endpoint 0x5 has invalid maxpacket 1568, setting to 0 [ 24.059565][ T45] usb 2-1: config 85 interface 75 altsetting 4 endpoint 0xF has invalid maxpacket 32, setting to 8 [ 24.059607][ T66] keytouch 0003:0926:3333.0002: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.0-1/input0 [ 24.083639][ T45] usb 2-1: config 85 interface 94 altsetting 8 has a duplicate endpoint with address 0xC, skipping [ 24.096321][ T45] usb 2-1: config 85 interface 94 altsetting 8 has a duplicate endpoint with address 0x4, skipping [ 24.107333][ T45] usb 2-1: config 85 interface 94 altsetting 8 endpoint 0x9 has invalid maxpacket 512, setting to 8 [ 24.119637][ T45] usb 2-1: config 85 interface 94 altsetting 8 has an endpoint descriptor with address 0x1C, changing to 0xC [ 24.133289][ T45] usb 2-1: config 85 interface 94 altsetting 8 has a duplicate endpoint with address 0xC, skipping [ 24.148635][ T45] usb 2-1: config 85 interface 94 altsetting 8 has a duplicate endpoint with address 0xE, skipping [ 24.162633][ T45] usb 2-1: config 85 interface 94 altsetting 8 has a duplicate endpoint with address 0x9, skipping [ 24.173661][ T45] usb 2-1: config 85 interface 94 altsetting 8 has a duplicate endpoint with address 0xD, skipping [ 24.186377][ T45] usb 2-1: config 85 interface 94 altsetting 8 has a duplicate endpoint with address 0x5, skipping [ 24.198171][ T45] usb 2-1: config 85 interface 94 altsetting 8 has a duplicate endpoint with address 0xB, skipping [ 24.214924][ T45] usb 2-1: config 85 interface 94 altsetting 8 has an invalid descriptor for endpoint zero, skipping [ 24.226303][ T45] usb 2-1: config 85 interface 198 has no altsetting 0 [ 24.233514][ T45] usb 2-1: config 85 interface 75 has no altsetting 0 [ 24.240601][ T45] usb 2-1: config 85 interface 94 has no altsetting 0 [ 24.250223][ T45] usb 2-1: Dual-Role OTG device on HNP port [ 24.256871][ T45] usb 2-1: New USB device found, idVendor=1342, idProduct=0204, bcdDevice=2f.38 [ 24.273112][ T45] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 24.285485][ T45] usb 2-1: Product: 鬊敥党븷ꐼ尳嚐䴰꼕娭䶚菤㻽䉱ፋ詐꫾㛙폂䃥ۻŧ徐졐喦솧⑺馭◸鞚⡖᣺ᛋஷ῏濶띨끲做偧㊫棻뵒蔺盲勡㸛钃맥殩ↈؚﯿ搣퓾釥脨칔삥싃삸꾳ꝥ쎛曹뒃뿶앶뙼뽻柸鹼㩣ꓟퟴ꺪믚皟ⴝﯧ赍惴慲븺⼌㨌㮜疽屫謹ጎ竚픜叇≹ₔ킩葃롺龱쐜㫝–䆟첩袬᪏䁐 [ 24.320935][ T45] usb 2-1: SerialNumber: Ў [ 24.332637][ T350] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 24.340105][ T350] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 24.348211][ T350] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 24.356009][ T350] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 24.368728][ T350] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 24.410657][ T375] fuseblk: Unknown parameter 'f{gS{B#d' [ 24.428904][ T375] SELinux: policydb string length -156675320 does not match expected length 8 [ 24.442260][ T375] SELinux: failed to load policy [ 24.452076][ T10] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 24.564331][ T378] process 'syz.2.17' launched './file0' with NULL argv: empty string added [ 24.602186][ T10] usb 4-1: device descriptor read/64, error -71 [ 24.798063][ T45] usb 2-1: USB disconnect, device number 2 Stopping sshd: stopped /usr/sbin/sshd (pid 201) OK [ 24.854766][ T10] usb 4-1: device descriptor read/64, error -71 Stopping crond: stopped /usr/sbin/crond (pid 194) OK Stopping dhcpcd... [ 25.102252][ T10] usb 4-1: new high-speed USB device number 3 using dummy_hcd stopped /sbin/dhcpcd (pid 148) [ 25.122232][ T371] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 25.184801][ T400] netlink: 16 bytes leftover after parsing attributes in process `syz.0.19'. [ 25.197381][ T400] netlink: 393 bytes leftover after parsing attributes in process `syz.0.19'. Stopping network: [ 25.242243][ T10] usb 4-1: device descriptor read/64, error -71 [ 25.302209][ T371] usb 3-1: Using ep0 maxpacket: 32 [ 25.357022][ T371] usb 3-1: config 0 has an invalid interface number: 196 but max is 0 [ 25.392206][ T371] usb 3-1: config 0 has an invalid descriptor of length 72, skipping remainder of the config [ 25.415903][ T371] usb 3-1: config 0 has no interface number 0 [ 25.449180][ T371] usb 3-1: config 0 interface 196 altsetting 31 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 25.473184][ T371] usb 3-1: config 0 interface 196 has no altsetting 0 [ 25.476058][ T417] netlink: 104 bytes leftover after parsing attributes in process `syz.1.22'. [ 25.495077][ T371] usb 3-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 25.521740][ T371] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 25.530109][ T10] usb 4-1: device descriptor read/64, error -71 [ 25.554268][ T371] usb 3-1: Product: syz [ 25.559084][ T371] usb 3-1: Manufacturer: syz [ 25.573143][ T371] usb 3-1: config 0 descriptor?? [ 25.591443][ T423] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 25.600666][ T371] ipheth 3-1:0.196: Unable to find alternate settings interface OK [ 25.630455][ T423] misc raw-gadget: fail, usb_gadget_register_driver returned -16 Stopping iptables: [ 25.661585][ T36] kauditd_printk_skb: 98 callbacks suppressed [ 25.661601][ T36] audit: type=1400 audit(1784009394.500:172): avc: denied { search } for pid=425 comm="iptables" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 25.672291][ T10] usb usb4-port1: attempt power cycle OK [ 25.722206][ T36] audit: type=1400 audit(1784009394.500:173): avc: denied { write } for pid=425 comm="iptables" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 25.762199][ T36] audit: type=1400 audit(1784009394.500:174): avc: denied { add_name } for pid=425 comm="iptables" name="xtables.lock" scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Stopping system message bus: [ 25.802217][ T36] audit: type=1400 audit(1784009394.500:175): avc: denied { create } for pid=425 comm="iptables" name="xtables.lock" scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 25.811364][ T371] usb 3-1: USB disconnect, device number 3 [ 25.875271][ T36] audit: type=1400 audit(1784009394.500:176): avc: denied { read open } for pid=425 comm="iptables" path="/run/xtables.lock" dev="tmpfs" ino=582 scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 25.896183][ T433] netlink: 28 bytes leftover after parsing attributes in process `syz.1.26'. done [ 25.925826][ T36] audit: type=1400 audit(1784009394.500:177): avc: denied { lock } for pid=425 comm="iptables" path="/run/xtables.lock" dev="tmpfs" ino=582 scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 25.985503][ T36] audit: type=1400 audit(1784009394.550:178): avc: denied { create } for pid=426 comm="syz.1.25" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 26.045321][ T36] audit: type=1400 audit(1784009394.680:179): avc: denied { ioctl } for pid=426 comm="syz.1.25" path="socket:[3693]" dev="sockfs" ino=3693 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 26.048844][ T433] overlayfs: workdir and upperdir must reside under the same mount [ 26.102519][ T10] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 26.129949][ T36] audit: type=1400 audit(1784009394.680:180): avc: denied { connect } for pid=426 comm="syz.1.25" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 26.154178][ T10] usb 4-1: device descriptor read/8, error -71 Stopping klogd: [ 26.192228][ T36] audit: type=1400 audit(1784009394.680:181): avc: denied { write } for pid=426 comm="syz.1.25" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 OK Stopping acpid: [ 26.292784][ T451] netlink: 'syz.1.28': attribute type 46 has an invalid length. [ 26.309526][ T10] usb 4-1: device descriptor read/8, error -71 [ 26.315035][ T451] netlink: 'syz.1.28': attribute type 28 has an invalid length. [ 26.513695][ T461] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 26.523854][ T461] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 26.572247][ T10] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 26.593213][ T10] usb 4-1: device descriptor read/8, error -71 [ 26.662188][ T371] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 26.723225][ T10] usb 4-1: device descriptor read/8, error -71 [ 26.772209][ T415] usb 3-1: new full-speed USB device number 4 using dummy_hcd [ 26.813315][ T371] usb 2-1: config 0 interface 0 altsetting 250 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 26.825996][ T371] usb 2-1: config 0 interface 0 has no altsetting 0 [ 26.834773][ T10] usb usb4-port1: unable to enumerate USB device [ 26.841604][ T371] usb 2-1: New USB device found, idVendor=5543, idProduct=0064, bcdDevice= 0.00 [ 26.852570][ T371] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.861417][ T371] usb 2-1: config 0 descriptor?? [ 26.943250][ T415] usb 3-1: config 64 has an invalid interface number: 155 but max is 1 [ 26.951637][ T415] usb 3-1: config 64 has 1 interface, different from the descriptor's value: 2 [ 26.972223][ T415] usb 3-1: config 64 has no interface number 0 [ 26.978538][ T415] usb 3-1: config 64 interface 155 has no altsetting 0 [ 26.987241][ T415] usb 3-1: New USB device found, idVendor=16d8, idProduct=6006, bcdDevice=12.b4 [ 26.996680][ T415] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.004712][ T415] usb 3-1: Product: syz [ 27.008894][ T415] usb 3-1: Manufacturer: syz [ 27.013542][ T415] usb 3-1: SerialNumber: syz [ 27.166982][ T502] netlink: 'syz.0.35': attribute type 1 has an invalid length. [ 27.200492][ T505] netlink: 'syz.0.36': attribute type 4 has an invalid length. [ 27.208748][ T505] netlink: 3657 bytes leftover after parsing attributes in process `syz.0.36'. [ 27.219277][ T505] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 27.227816][ T505] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 27.228442][ T415] rndis_host 3-1:64.155: skipping garbage [ 27.241761][ T415] usb 3-1: bad CDC descriptors [ 27.248750][ T415] usb 3-1: USB disconnect, device number 4 [ 27.270882][ T371] uclogic 0003:5543:0064.0003: unknown main item tag 0x0 [ 27.278322][ T371] uclogic 0003:5543:0064.0003: item fetching failed at offset 4/6 [ 27.286531][ T371] uclogic 0003:5543:0064.0003: parse failed [ 27.293177][ T371] uclogic 0003:5543:0064.0003: probe with driver uclogic failed with error -22 OK Stopping syslogd: stopped /sbin/syslogd (pid 92) OK [ 27.377974][ T515] SELinux: policydb magic number 0x0 does not match expected magic number 0xf97cff8c [ 27.388627][ T515] SELinux: failed to load policy [ 27.393774][ T514] SELinux: policydb magic number 0x0 does not match expected magic number 0xf97cff8c [ 27.403736][ T514] SELinux: failed to load policy umount: can't remount debugfs read-only [ 27.471735][ T66] usb 2-1: USB disconnect, device number 3 umount: sysfs busy - remounted read-only umount: devtmpfs busy - remounted read-only umount: can't remount /dev/root read-only The system is going down NOW! Connection to 10.128.0.250 closed by remote host. Sent SIGTERM to all processes [ 27.754133][ T498] bridge_slave_1: left allmulticast mode [ 27.759830][ T498] bridge_slave_1: left promiscuous mode [ 27.765921][ T498] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.773711][ T498] bridge_slave_0: left allmulticast mode [ 27.779462][ T498] bridge_slave_0: left promiscuous mode [ 27.785907][ T498] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.954823][ T498] veth1_macvtap: left promiscuous mode [ 27.960704][ T498] veth0_vlan: left promiscuous mode [ 27.994941][ T415] usb 1-1: USB disconnect, device number 2 [ 28.184074][ T498] bridge_slave_1: left allmulticast mode [ 28.189854][ T498] bridge_slave_1: left promiscuous mode [ 28.195907][ T498] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.203572][ T498] bridge_slave_0: left allmulticast mode [ 28.209291][ T498] bridge_slave_0: left promiscuous mode [ 28.215091][ T498] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.222772][ T498] bridge_slave_1: left allmulticast mode [ 28.228579][ T498] bridge_slave_1: left promiscuous mode [ 28.234216][ T498] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.241729][ T498] bridge_slave_0: left allmulticast mode [ 28.247856][ T498] bridge_slave_0: left promiscuous mode [ 28.253557][ T498] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.261236][ T498] bridge_slave_1: left allmulticast mode [ 28.267338][ T498] bridge_slave_1: left promiscuous mode [ 28.273612][ T498] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.281396][ T498] bridge_slave_0: left allmulticast mode [ 28.287202][ T498] bridge_slave_0: left promiscuous mode [ 28.292945][ T498] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.516838][ T498] veth1_macvtap: left promiscuous mode [ 28.522645][ T498] veth1_macvtap: left promiscuous mode [ 28.528413][ T498] veth0_vlan: left promiscuous mode [ 28.534030][ T498] veth1_macvtap: left promiscuous mode [ 28.539600][ T498] veth0_vlan: left promiscuous mode Sent SIGKILL to all processes Requesting system poweroff [ 28.944948][ T498] ------------[ cut here ]------------ [ 28.950691][ T498] WARNING: CPU: 1 PID: 498 at net/ipv6/xfrm6_tunnel.c:341 xfrm6_tunnel_net_exit+0xc4/0x140 [ 28.961709][ T498] Modules linked in: [ 28.965890][ T498] CPU: 1 UID: 0 PID: 498 Comm: kworker/u8:33 Not tainted syzkaller #0 a506770653dd131ce1f6b755c8f096a645f29717 [ 28.977762][ T498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 28.987970][ T498] Workqueue: netns cleanup_net [ 28.993067][ T498] RIP: 0010:xfrm6_tunnel_net_exit+0xc4/0x140 [ 28.999243][ T498] Code: e8 e1 11 d7 fc 4b 83 3c 3e 00 75 19 e8 75 5e 7e fc 49 81 ff f8 07 00 00 74 1b e8 67 5e 7e fc 49 83 c7 08 eb c9 e8 5c 5e 7e fc <0f> 0b 49 81 ff f8 07 00 00 75 e5 49 8d 9e 00 08 00 00 45 31 ff 4a [ 29.019882][ T498] RSP: 0018:ffffc9000d64fb90 EFLAGS: 00010293 [ 29.026257][ T498] RAX: ffffffff85091394 RBX: ffff8881291b3540 RCX: ffff88811a1a9300 [ 29.034452][ T498] RDX: 0000000000000000 RSI: 0000000000400000 RDI: ffff88810d2f00b8 [ 29.042557][ T498] RBP: ffffc9000d64fbb0 R08: ffffffff87d41ae7 R09: 1ffffffff0fa835c [ 29.050553][ T498] R10: dffffc0000000000 R11: fffffbfff0fa835d R12: dffffc0000000000 [ 29.058649][ T498] R13: dffffc0000000000 R14: ffff88810d2f0000 R15: 00000000000000b8 [ 29.066645][ T498] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 29.075618][ T498] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.082237][ T498] CR2: 00007f6616f92bd0 CR3: 000000010b32e000 CR4: 00000000003526b0 [ 29.090758][ T498] Call Trace: [ 29.094077][ T498] [ 29.097137][ T498] cleanup_net+0x6ba/0xc90 [ 29.101746][ T498] ? __cfi_cleanup_net+0x10/0x10 [ 29.106756][ T498] ? kick_pool+0xb9/0x540 [ 29.111103][ T498] process_scheduled_works+0x7f7/0x1060 [ 29.116672][ T498] worker_thread+0xc99/0x13f0 [ 29.121347][ T498] kthread+0x2c7/0x360 [ 29.125537][ T498] ? __cfi_worker_thread+0x10/0x10 [ 29.130741][ T498] ? __cfi_kthread+0x10/0x10 [ 29.135483][ T498] ret_from_fork+0x67/0xa0 [ 29.139917][ T498] ? __cfi_kthread+0x10/0x10 [ 29.144542][ T498] ret_from_fork_asm+0x1a/0x30 [ 29.149398][ T498] [ 29.152558][ T498] ---[ end trace 0000000000000000 ]--- [ 29.158419][ T498] ------------[ cut here ]------------ [ 29.164259][ T498] WARNING: CPU: 0 PID: 498 at net/ipv6/xfrm6_tunnel.c:344 xfrm6_tunnel_net_exit+0x119/0x140 [ 29.175009][ T498] Modules linked in: [ 29.178893][ T498] CPU: 0 UID: 0 PID: 498 Comm: kworker/u8:33 Tainted: G W syzkaller #0 a506770653dd131ce1f6b755c8f096a645f29717 [ 29.192183][ T498] Tainted: [W]=WARN [ 29.196412][ T498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 29.206781][ T498] Workqueue: netns cleanup_net [ 29.211562][ T498] RIP: 0010:xfrm6_tunnel_net_exit+0x119/0x140 [ 29.217821][ T498] Code: fc 4b 83 bc 3e 00 08 00 00 00 75 19 e8 20 5e 7e fc 49 81 ff f8 07 00 00 74 1b e8 12 5e 7e fc 49 83 c7 08 eb c5 e8 07 5e 7e fc <0f> 0b 49 81 ff f8 07 00 00 75 e5 e8 f7 5d 7e fc 5b 41 5c 41 5e 41 [ 29.238417][ T498] RSP: 0018:ffffc9000d64fb90 EFLAGS: 00010293 [ 29.244924][ T498] RAX: ffffffff850913e9 RBX: ffff88810d2f0800 RCX: ffff88811a1a9300 [ 29.253745][ T498] RDX: 0000000000000000 RSI: 0000000000400000 RDI: ffff88810d2f0808 [ 29.263513][ T498] RBP: ffffc9000d64fbb0 R08: ffffffff87d41ae7 R09: 1ffffffff0fa835c [ 29.272301][ T498] R10: dffffc0000000000 R11: fffffbfff0fa835d R12: dffffc0000000000 [ 29.280309][ T498] R13: dffffc0000000000 R14: ffff88810d2f0000 R15: 0000000000000008 [ 29.288683][ T498] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 29.298062][ T498] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.305155][ T498] CR2: 00007fff1aa1cc14 CR3: 00000000074aa000 CR4: 00000000003526b0 [ 29.313369][ T498] Call Trace: [ 29.316658][ T498] [ 29.319597][ T498] cleanup_net+0x6ba/0xc90 [ 29.324048][ T498] ? __cfi_cleanup_net+0x10/0x10 [ 29.329348][ T498] ? kick_pool+0xb9/0x540 [ 29.333728][ T498] process_scheduled_works+0x7f7/0x1060 [ 29.339465][ T498] worker_thread+0xc99/0x13f0 [ 29.344226][ T498] kthread+0x2c7/0x360 [ 29.348592][ T498] ? __cfi_worker_thread+0x10/0x10 [ 29.353841][ T498] ? __cfi_kthread+0x10/0x10 [ 29.358900][ T498] ret_from_fork+0x67/0xa0 [ 29.363395][ T498] ? __cfi_kthread+0x10/0x10 [ 29.368095][ T498] ret_from_fork_asm+0x1a/0x30 [ 29.372923][ T498] [ 29.376023][ T498] ---[ end trace 0000000000000000 ]--- [ 29.388625][ T498] ------------[ cut here ]------------ [ 29.394129][ T498] WARNING: CPU: 0 PID: 498 at net/xfrm/xfrm_state.c:3217 xfrm_state_fini+0x2be/0x310 [ 29.403993][ T498] Modules linked in: [ 29.407888][ T498] CPU: 0 UID: 0 PID: 498 Comm: kworker/u8:33 Tainted: G W syzkaller #0 a506770653dd131ce1f6b755c8f096a645f29717 [ 29.421207][ T498] Tainted: [W]=WARN [ 29.425053][ T498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 29.435173][ T498] Workqueue: netns cleanup_net [ 29.439978][ T498] RIP: 0010:xfrm_state_fini+0x2be/0x310 [ 29.445600][ T498] Code: 3c 20 00 74 08 48 89 df e8 cf d1 f1 fc 48 8b 3b e8 e7 c2 dc fc 5b 41 5c 41 5d 41 5e 41 5f 5d e9 48 7b b7 00 cc e8 52 1e 99 fc <0f> 0b e9 b0 fd ff ff e8 46 1e 99 fc 0f 0b e9 18 fe ff ff e8 3a 1e [ 29.465720][ T498] RSP: 0018:ffffc9000d64fb70 EFLAGS: 00010293 [ 29.471972][ T498] RAX: ffffffff84ee539e RBX: ffff8881291b3540 RCX: ffff88811a1a9300 [ 29.480167][ T498] RDX: 0000000000000000 RSI: 0000000000400000 RDI: ffff88811a1a9300 [ 29.488789][ T498] RBP: ffffc9000d64fb98 R08: ffffffff87d41ae7 R09: 1ffffffff0fa835c [ 29.497395][ T498] R10: dffffc0000000000 R11: fffffbfff0fa835d R12: 1ffffffff0fa80b0 [ 29.506015][ T498] R13: dffffc0000000000 R14: ffff8881291b4140 R15: dffffc0000000000 [ 29.514309][ T498] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 29.523384][ T498] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.530091][ T498] CR2: 00007fff1aa1cc14 CR3: 00000000074aa000 CR4: 00000000003526b0 [ 29.538289][ T498] Call Trace: [ 29.541655][ T498] [ 29.544798][ T498] xfrm_net_exit+0x31/0x80 [ 29.549312][ T498] cleanup_net+0x6ba/0xc90 [ 29.553754][ T498] ? __cfi_cleanup_net+0x10/0x10 [ 29.558872][ T498] ? kick_pool+0xb9/0x540 [ 29.563358][ T498] process_scheduled_works+0x7f7/0x1060 [ 29.569192][ T498] worker_thread+0xc99/0x13f0 [ 29.574391][ T498] kthread+0x2c7/0x360 [ 29.578563][ T498] ? __cfi_worker_thread+0x10/0x10 [ 29.583793][ T498] ? __cfi_kthread+0x10/0x10 [ 29.588824][ T498] ret_from_fork+0x67/0xa0 [ 29.593486][ T498] ? __cfi_kthread+0x10/0x10 [ 29.598235][ T498] ret_from_fork_asm+0x1a/0x30 [ 29.603144][ T498] [ 29.606177][ T498] ---[ end trace 0000000000000000 ]--- [ 29.724691][ T523] sd 0:0:1:0: [sda] Synchronizing SCSI cache [ 29.731629][ T523] ACPI: PM: Preparing to enter system sleep state S5 [ 29.738623][ T523] kvm: exiting hardware virtualization [ 29.744142][ T523] reboot: Power down serialport: VM disconnected.