last executing test programs: 17.160427377s ago: executing program 4 (id=41): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x100) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000600)={0x2, 0x0, @ioapic={0x8000000, 0xd, 0x10001, 0xfffffffe, 0x0, [{0x2, 0x2, 0x87, '\x00', 0x8}, {0xd, 0x8, 0x40, '\x00', 0xb}, {0xff, 0x7f, 0x9, '\x00', 0x67}, {0x0, 0x5, 0xd4, '\x00', 0x9}, {0x7, 0x9, 0xe, '\x00', 0xfb}, {0x0, 0x4, 0x54, '\x00', 0xff}, {0x2, 0xd5, 0xf4, '\x00', 0x7b}, {0x3, 0x4, 0xc}, {0x7c, 0xd, 0xb, '\x00', 0xb}, {0xd5, 0xd, 0x8, '\x00', 0x6}, {0x2, 0x28, 0x80, '\x00', 0x5}, {0xff, 0x5, 0xfe, '\x00', 0xff}, {0xfe, 0xa, 0x26, '\x00', 0x6}, {0xcf, 0xb, 0x1, '\x00', 0x6}, {0xf, 0x4, 0x7, '\x00', 0x3}, {0x39, 0x2, 0x7, '\x00', 0xb}, {0x10, 0x6, 0x2, '\x00', 0x7}, {0x5, 0x9, 0x0, '\x00', 0xc}, {0x3, 0xe1, 0x7, '\x00', 0xc2}, {0x0, 0x84, 0x10, '\x00', 0x1}, {0x1, 0xc, 0x80, '\x00', 0x7f}, {0x10, 0x6, 0x3, '\x00', 0x10}, {0x1, 0x23, 0xf3, '\x00', 0x4}, {0x7, 0x6, 0x4}]}}) ioctl$KVM_GET_MP_STATE(r2, 0x8004ae98, 0x0) 17.081645271s ago: executing program 4 (id=47): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x82f41, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r1, &(0x7f0000000000)='7', 0x1) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) 16.65349019s ago: executing program 4 (id=53): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000180)={0x42, 0x0, 0x2, 0xf5ff}, 0x10) sendmsg$tipc(r1, &(0x7f0000000540)={&(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x2, {0x41, 0x1, 0x3}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0) close(0x3) 16.569605254s ago: executing program 4 (id=57): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x2004de, &(0x7f0000000100), 0x3, 0x460, &(0x7f0000000380)="$eJzs3M9vFFUcAPDvzHaLBLAV8Qc/1CoaG3+0FFA5eFCjiQdMTPSgx6YtBFmooTURQhSMwZMxJt6NR/8FT3oxxpOJV70bEmK4AJ7WzO4M3d3uLrDsstD9fJJp35sffe+7b97Om3m7DWBkTWU/koitEfFXREzUs807TNV/Xb18duHa5bMLSVSr7/2b1Pa7cvnsQrFrcdyWPDOdRqRfJrG7Tbkrp88cn69Ulk7l+dnVEx/Prpw+8+KxE/NHl44undx/6NDBA3OvvLz/pb7EmdXpyq7PlvfsfPvDb985/HVT/C1x9MlUt43PVKt9Lm64tjWkk7EhVoRbUoqIrLnKtf4/EaVYa7yJeOuLoVYOGKhqtVrd0nnzuSqwgSXRnNflYVQUF/rs/rdYWgcBrw1u+DF0l16v3wBlcV/Nl/qWsUjzfcot97f9NBURH5z77/tsicE8hwAAaPJzNv55od34L42HG/a7P58bmoyIByJie0Q8GBE7IuKhiNq+j0TEo7dYfuskyfrxT3qxp8BuUjb+ezWf22oe/xWjv5gs5blttfjLyZFjlaV9+WsyHeVNWX6uSxm/vPnnN522NY7/siUrvxgL5vW4OLap+ZjF+dX524m50aXzEbvG2sWfXJ8JSCJiZ0Ts6rGMY8/9uKfTthvH30Uf5pmqP0Q8W2//c9ESfyHpPj85e19UlvbNFmfFer//ceHdTuXfVvx9cOl8FGfXuvbPTSaN87Urt17Ghb+/6nhP0+v5P568X0uP5+s+nV9dPTUXMZ4crle6cf3+tWOLfLF/dv5P723f/7fH2iuxOyKyk/ixiHg8Ip7I6/5kRDwVEXu7xP/bG09/1Hv8g5XFv9j2/a9T+68lxqN1TftE6fivPzUVOrku/mvd2/9gLTWdr7mZ97+bqVdvZzMAAADce9KI2BpJOnM9naYzM/XPy++ISCvLK6vPH1n+5ORi/TsCk1FOiyddEw3PQ+fy2/p6/nxE1D9aUGw/kD83/q60uZafWViuLA47eBhxWzr0/8w/pWHXDhg439eC0aX/w+jS/2F06f8wutr0/83DqAdw57W7/n8+hHoAd15L/zftByOj7P4fRljH/r+R//MPUNPD9T8ZRD2AO2plc9z4S/JdE8Vf6vHwDZuI8l1RjdtPVJO2jRvpsCt240Rxlbpb6nMvJYb3ngQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANBP/wcAAP//vQDabw==") mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) chdir(&(0x7f0000000300)='./file0\x00') r0 = open(&(0x7f00000000c0)='.\x00', 0x8000, 0x50) getdents(r0, 0x0, 0x0) 16.266880438s ago: executing program 4 (id=60): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r2, 0x4048ae9b, &(0x7f0000000080)={0xe0003, 0x0, {[0x8, 0x2, 0x404, 0xffffffffefffff14, 0x3, 0x100000000, 0x7, 0x4]}}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 16.030896609s ago: executing program 4 (id=66): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x8502, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r0, 0x400455c8, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r1, 0x400448e7, &(0x7f0000000100)="965a704e") 15.975719382s ago: executing program 32 (id=66): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x8502, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r0, 0x400455c8, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r1, 0x400448e7, &(0x7f0000000100)="965a704e") 14.861213053s ago: executing program 5 (id=85): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000100)=0x5000) 14.70058912s ago: executing program 5 (id=91): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001080), 0x40, 0x0) ioctl$KVM_GET_API_VERSION(r0, 0xae00, 0x0) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/kernel/mm/lru_gen/enabled\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='7\n', 0x2) 14.679073011s ago: executing program 5 (id=92): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x9, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r0, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r1, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 14.636884083s ago: executing program 5 (id=94): syz_mount_image$exfat(&(0x7f0000002bc0), &(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x1c040, &(0x7f00000004c0)={[{@namecase}, {@fmask={'fmask', 0x3d, 0x2}}, {@time_offset={'time_offset', 0x3d, 0x400}}, {@dmask={'dmask', 0x3d, 0x8}}, {@sys_tz}, {@umask={'umask', 0x3d, 0x400}}, {@iocharset={'iocharset', 0x3d, 'cp865'}}, {@namecase}, {@keep_last_dots}, {@iocharset={'iocharset', 0x3d, 'macgreek'}}]}, 0x1, 0x1533, &(0x7f0000006800)="$eJzs3AucTtX6OPDnWWvtMSS9TXIZ1lrP5k0uiyTJJUkuSZIkSW4JSZIjCYkht6QhCcllSC5DSC4Tk8b9fr8kJEmTJCG5Jev/mZi/OnX+55xfnfz+Z57v5/N+Zj2z3mftZ88z73733vPyTZehNRrVrNqAiOAPwYtfEgAgFgAGAsA1ABAAQNm4snEZ89klJvyxjbA/10PJV7oCdiVx/7M27n/Wxv3P2rj/WRv3P2vj/mdt3P+sjfvPWFa2eXr+a/mRdR98/z8r4/f//yLpJcd+sbbk9V0BYv7VFO7////wD+Ry//9rBf/Kk7j/WRv3P6uKvdIFsP8F+PWfFWT7hzPc/6yN+89YVvbLe8GxcOXvR//VD4j8J/8G4ntd/Clf+f38h/vPGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4z9Bc74yxQAZI6vdF2MMcYYY4wxxhj78/hsV7oCxhhjjDHGGGOM/echCJCgIIAYyAaxkB1ygACIyZy/FuLgOsgN10MeyAv5ID/EQwEoCBoMWCAIoRAUhijcAEXgRigKxaA4lAAHJaEU3ASl4WYoA7dAWbgVysFtUB4qQEWoBLdDZbgDqsCdUBXugmpQHWpATbgbasE9UBvuhTpwH9SF+6EePAD14UFoAA9BQ3gYGsEj0BgehSbQFJpBc2jxP8p/AXrAi9ATekEC9IY+8BL0hX7QHwbAQHgZBsErMBhehUQYAkPhNRgGr8NweANGwEgYBW/CaHgLxsBYGAfjIQkmwER4GybBOzAZpsBUmAbJMB1mwLswE2bBbHgP5sD7MBfmwXxYACnwASyERZAKH8Ji+AjSYAkshWWwHFbASlgFq2ENrIV1sB42wEbYBJthC2yFbbAddsBO+Bh2wSewG/bAXvgU9sFn/2b+6b/L74qAgAIFKlQYgzEYi7GYA3NgTsyJuTAXRjCCcRiHuTE35sE8mA/zYTzGY0EsiAYNEhIWwkIYxSgWwSJYFIticSyODh2WwlJYGm/GMlgGy2JZLIflsDxWwApYCSthZayMVbAKVsWqWA2rYQ2sgXfj3dgba2NtrIN1sC7Wzbw9hQ2wATbEhtgIG2FjbIxNsAk2w2bYAltgS2yJrbAVtsE22BbbYjtsh+2xPXbADtgRO2In7ISdsTN2wS7YFbtht/QXsgG+iC9iL6wmemMf7IN9MTFbfxyAA/BlHISv4Cv4KibiEByKr+Fr+DoOx1M44sJIHIWjsLJ4C8fgWCQxHpMwCSfiRJyEk3AyTsEpOA2TcTrOwBk4E2fhLHwP5+D7+D7Ow3m4AFMwBRfiIkzFVFyMpzENl+BSXIbLcQUux1W4GlfhWlyHa3EDbsBNuAm34BbchttwB+7Aj1EB4Ce4B/dgIu7Dfbgf9+MBPIAH8SCmYzoewkN4GA/jETyCR/EoHsPjeAKP40k8iafwNJ7BM3gOz+F5fC7+q4YfF1uTCCKDEkrEiBgRK2JFDpFD5BQ5RS6RS0RERMSJOJFb5BZ5RB6RT+QT8SJeFBQFhRFGkAgzjhQiKqKiiCgiioqiorgoLpxwopQoJUqL0qKMKCPKiltFOXGbKC8qiNaukqgkKos2roq4U1QVVUU1UV3UEDVFTVFL1BK1RW1RR9QRdUVdUU88IOqL3tgfHxIZnWkkhmBjMRSbiKZCXjpCtRTDsZVoLdqIJ8RIHIHtREvXXjwtOogx2FH8TYzFZ0VnMR67iOdFV9FNdBcviB6ilespeonJ2Fv0EdOwr+gn+osBYiZWF+/hnOw1xKsiUQwRQ8VrYgG+LoaLN8QIMVKMEm+K0eItMUaMFePEeJEkJoiJ4m0xSbwjJospYqqYJpLFdDFDvCtmillitnhPzBHvi7linpgvFogU8YFYKBaJVPGhWCw+EmliiVgqlonlYoVYKVaJ1WKNWCvWifVig9goNonNYovYKraJ7WKH2Ck+FrvEJ2K32CP2ik/FPvGZ2C8+FwfEF+Kg+FKki6/EIfG1OCy+EUfEt+Ko+E4cE8fFCfG9OCl+EKfEaXFGnBXnxI/ivPhJXBBegEQppJRKBjJGZpOxMrvMIa+SOWWQefyXcfI6mVteL/PIvDKfzC/jZQFZUGpppJUkQ1lIFpZReYMsIm+URWUxWVyWkE6WlKXkTbK0vFmWkbfIsvJWWU7eJsvLCrKirCRvl5XlHRIiF7dRTVaXNWRNebdMgHtkbXmvrCPvk3Xl/bKefEDWlw/KBvIh2VA+LBvJR2Rj+ahsIpvKZrK5bCEfky3l47KVbC3byCdkW/mkbCefku3l07KD9Jd+RZ6VneVzsot8XnaV3WR3+ZO8IL3sKXtJ6A2yj3xJ9pX9ZH85QA6UL8tB8hU5WL4qE+UQOVS+JofJ1+Vw+YYcIUfKUfJNOVq+JcfIsXKcHC+T5AQ5Ub4tJ8l35GQ5RU6V02SynC77X1pptpT/NP/t38kf/PPWN8nNcovcKrfJ7XKH3Ck/lrvkLrlb7pZ75V65T+6T++V+eUAekAflQZku0+UheUgeloflEXlEHpVH5TF5XJ6V38uT8gd5Sp6Wp+VZeU6ek+cv/QxAoRJKKqUCFaOyqViVXeVQV6mc6mqVS12jIupaFaeuU7nV9SqPyqvyqfwqXhVQBZVWRllFKlSFVGEVVTfgpV8YVVyVUE6VVKXUTf9OviqiblRFVbFf5WfWl/AP6muhWqiWqqVqpVqpNqqNaqvaqnaqnWqv2qsOqoPqqDqqTqqT6qw6qy6qi+qquqruqrvqoXqonqqnSlAJqo96SfVV/VR/NUANVC+LjH0YrAarRJWohqqhapgapoar4WqEGqFGqVFqtBqtxqgxapwap5JUkpqoJqpJapKarCarqWqqSlbJaoaaoWaqmWq2mq3mqDlqrpqr5qv5KkWlqIVqoUpVqWqxWqzS1BK1RC1Ty9QKtUKtUqvUGrVGrVPr1Aa1QaWpzWqz2qq2qu1qu9qpdqpdapfarXarvWqv2qf2qf1qvzqgDqiD6qBKV+nqkDqkDqvD6og6oo6qo+qYOqZOqBPqpDqpTqlT6ow6o86pc+q8Oq8uqAsZp32BCESgAhXEBDFBbBAb5AhyBDmDnEGuIFcQCSJBXBAX5A6uD/IEeYN8Qf4gPigQFAx0YAIbiEtNjwY3BEWCG4OiQbGgeFAicEHJoFRwU1A6uDkoE9wSlA1uDcoFtwXlgwpBxaBScHtQObgjqBLcGVQN7gqqBdWDGkHN4O6gVnBPUDu4N6gT3BfUDe4P6gUPBPWDB4MGwUNBw+DhoFHwSNA4eDRoEjQNmgXNgxZ/6vren8r7uOupe+kE3Vv30S/pvrqf7q8H6IH6ZT1Iv6IH61d1oh6ih+rX9DD9uh6u39Aj9Eg9Sr+pR+u39Bg9Vo/T43WSnqAn6rf1JP2Onqyn6Kl6mk7W0/UM/a6eqWfp2fo9PUe/r+fqeXq+XqBT9Ad6oV6kU/WHerH+SKfpJXqpXqaX6xV6pV6lV+s1eq1ep9frDXqj3qQ36y16q96mt+sdeqf+WO/Sn+jdeo/eqz/V+/Rner/+XB/QX+iD+kudrr/Sh/TX+rD+Rh/R3+qj+jt9TB/XZfT3+qT+QZ/Sp/UZfVaf0z/q8/onfUH7jJP7jLd3o4wyMSbGxJpYk8PkMDlNTpPL5DIREzFxJs7kNrlNHpPH5DP5TLyJNwVNQZOBDJlCppCJmqgpYoqYoqaoKW6KG2ecKWVKmdKmtCljypiypqwpZ8qZ8qa8qWgqmtvN7eYOc4e509xp7jJ3meqmuqlpappappapbWqbOqaOqWvqmnqmnqlv6psGpoFpaBqaRqaRaWwamyamiWlmmpkWpoVpaVqaVqaVaWPamLamrWln2pn2pr3pYDqYjqaj6WQ6mc6ms+liupiupqvpbrqbHqaH6Wl6mgSTYPqYPqav6Wv6m/5moBloBplBZrAZbBJNohlqhpphZpgZboabEWakGZVxomreMmPMWDPOjDdJJslMNBPNJDPJTDaTzVQz1SSbZDPDzDAzzUwz28w2c8wcM9fMNfPNfJNiUsxCs9CkmlSz2Cw2aSbNLDVLzXKz3Kw0K81qs9qsNWvNelhvNpqNZrPZbLaarWa72W52mp1ml9lldpvdZq/Za/aZfWa/2W8OmAPmoDlo0k26OWQOmcPmsDlijpij5qg5Zo6ZE+aEOWlOmlPmlDljzphzJu+l90tvYm12m8NeZXPaq20ue439+zifzW/jbQFb0Gqbx+b9VWystUVtMVvclrDOlrSl7E2/icvbCrairWRvt5XtHbbKb+Ja9h5b295r69j7bE1796/iuvZ+W88+YusjAtimtqFtbhvZR2xj+6htYpvaZra5bWuftO3sU7a9fdp2sM/8Jl5oF9nVdo1da9fZ3XaPPWPP2sP2G3vO/mh72l52oH3ZDrKv2MH2VZtoh/wmHmXftKPtW3aMHWvH2fG/iafaaTbZTrcz7Lt2pp31mzjFfmDn2FQ7186z8+2Cn+OMmlLth3ax/cim2QCW2mV2uV1hV9pV/7fWZXaD3Wg32V32E7vVbrPb7Q67M/NE2O6xe+2ndp/9zB6yX9sD9gt70B6x6farn+OM/Ttiv7VH7Xf2mD1uT9jv7Un7g8rMztj37+1P9oL1FggJSJKigGIoG8VSdspBV1FOuppy0TUUoWspjq6j3HQ95aG8lI/yUzwVoIKkyZAlopAKUWGK0g2UWV5xKkGOSlIpuolK081Uhm6hsnQrlaPbqDxVoIpUiW6nynQHVaE7qSrdRdWoOtWgmnQ31aJ7qDbdS3XoPqpL91M9eoDq04PUgB6ihvQwNaJHqDE9Sk2oKTWj5tSCHqOW9Di1otbUhp6gtvQktaOnqD09TR3oGepIf6NO9Cx1pueoCz1PXakbdacXqAe9SD2pFyVQb+pDL1Ff6kf9aQANpJdpEL1Cg+lVSqQhNJReo2H0Og2nN2gEjaRR9CaNprdoDI2lcTSekmgCTaS3aRK9Q5NpCk2laZRM02kGvUszaRbNpvdoDr1Pc2kezacFlEIf0EJaRKn0IS2mjyiNltBSWkbLaQWtpFW0mtbQWlpH62kDbaRNtJm20FbaRttpB+2kj2kXfUK7aQ/tpU9pH31G++lzOkBf0EH6ktLpKzpEX9Nh+oaO0Le+F31Hx+g4naDv6ST9QKfoNJ2hs3SOfqTz9BNdIE8QYihCGaowCGPCbGFsmD3MEV4V5gyvDnOF14SR8NowLrwuzB1eH+YJ84b5wvxhfFggLBjq0IQ2pDAMC4WFw2h4Q1gkvDEsGhYLi4clQheWDEuFN4Wlw5vDMuEtYdnw1rBceFtYPqwQPnJfpfD2sHJ4R1glvDOsGt4VVgurhzXCmuHdYa3wnrB2eG9YJ7wvLBPeH9YLHwjrhw+GDcKHwobhw2Gj8JGwcfho2CRsGjYLm4ctwsfCluHjYauwddgmvCpsGz4ZtgufCtuHT4cdwmd+nr9/Ueb8E7+ZTwh7h33Cl8KXQu/vlfOjC6Ip0Q+iC6OLoqnRD6OLox9F06JLokujy6LLoyuiK6Oroquja6Jro+ui66Mbohujm6Le18wGDp1w0ikXuBiXzcW67C6Hu8rldFe7XO4aF3HXujh3ncvtrnd5XF6Xz+V38a6AK+i0M846cqEr5Aq7qLvBFXE3uqKumCvuSjjnSrpSrrlr4Vq4lu5x18q1dm3cE+4J96R70j3lnnJPuw7uGdfR/c11cs+6zu4595x73nV13Vx394Lr4SbkuviaTHB9XB/X1/V1/V1/N9ANdIPcIDfYDXaJLtENdUPdMDfMDXfD3Qg3wo1yo9xoN9qNcWPcODfOJbkkN9FNdJPcJDfZTXZT3VSX7JLdDDfDzXQzXeVZF7cy18118918l+JS3EKXcc6Y6ha7xS7Npbmlbqlb7pa7lW6lW+1Wu7VurVvv1ruNbqPb7Da7rW6r2+62u51up9vldrnd/pqLi7p9br/b7w64A+6g+9Klu6/cIfe1O+y+cUfct+6o+84dc8fdCfe9O+l+cKfcaXfGnXXn3I/uvPvJXXDeJUUmRCZG3o5MirwTmRyZEpkamRZJjkyPzIi8G5kZmRWZHXkvMifyfmRuZF5kfmRBJCXyQWRhZFEkNfJhZHHko0haZElkaWRZZHlkRcT7AltDX8gX9lF/gy/ib/RFfTFf3Jfwzpf0pfxNvvTFutO8v9WX87f58r6Cr+gf9U18U9/MN/ct/GO+pX/ct/KtfRv/hG/rn/Tt/FO+vX/ad/DP+I7+b76Tf9Z39s/5Lv5539V38939C76Hf9H39L18gu/t+/iXfF/fz/f3A/xA/7If5F/xg/2rPtEP8UP9a36Yf90P92/4EX6kHxXzph+deYkM432Sn+An+rf9JP+On+yn+Kl+mk/20/0M/66f6Wf52f49P8e/7+f6eX6+X+BT/Ad+oV/kU/2HfrH/yKf5JZk3jf1Kv8qv9mv8Wr/Or/cb/Ea/yW/2W/xWv81v9zv8Tv+x3+U/8bv9Hr/Xf+r3+c/8fv+5P+C/8Af9lz7df+UP+a/9Yf+NP+K/9Uf9d/6YP+5P+O/9Sf+DP+VP+zP+rD/nf/Tn/U/+Av+bNcYYY4yxf8mEy0Px65mLt/N7/06O+MWT+wDA1dvyp/9yPuOMcn2ei+N+Ij424+vTvbo8lPmoVi0hIeHSc9MkBIXnAWT+JSjDzx89uBQvgTbwJLSH1lD6d+vvJ7qdo3+yfvRWgBy/yMkoKDO+vP7nAJjwO+s/9sSoheXCM3H/j/XnARQtfDknO1yOl0Cbn++vtIYy/6D+vC3/Sf3Zv0gCaPWLnJxwOb5cfyl4HJ6B9r96JmOMMcYYY4wxdlE/UbFT5vVn5ic+f+/6PF5dzskGl+N/dn3OGGOMMcYYY4yxK+/Zbt2feqx9+9ad/v1Blf9R1r88aAz/qZV58LsD7wEyv6MA4A8uCJAxkH/lXmz5S7aVeOml8/dTy8/6AP53tPLPGFzhAxNjjDHGGGPsT3f5pP/X31dXqiDGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYYywL+iv+O7ErvY+MMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcbYlfZ/AgAA//+1tfsI") mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000440)='./proc\x00', &(0x7f0000000480)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x24200, 0x0) pread64(r0, 0x0, 0x0, 0x3ff) syz_mount_image$vfat(&(0x7f0000005880), &(0x7f00000001c0)='./bus\x00', 0x0, 0x0, 0x5, 0x0, &(0x7f0000000240)) 14.519299629s ago: executing program 5 (id=101): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file2\x00', 0x404, &(0x7f0000000580)={[{@max_batch_time={'max_batch_time', 0x3d, 0x4}}, {@max_batch_time}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x6a}}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}, {@errors_remount}, {@nombcache}]}, 0x1, 0x437, &(0x7f0000000900)="$eJzs289PHFUcAPDv7EKR/hBs6o/Sqmg1En9AobX24EWjiQdNTPRQjwi0wW6LKZjYhigaU4+miXfj0cS/wJNejHoy8ap306QxXFo9rZndGdhddrdAF7a6n08y8N7MW9777szbfW8eE0DPGk1/JBH7I+L3iBiqZusLjFZ/3Vpdnvl7dXkmiXL5rb+SSrmbq8szedH8dfvyTF9E4bMkjjSpd/HylfPTpdLcpSw/sXTh/YnFy1eem78wfW7u3NzFqdOnT56YfOHU1PMdiTON6+bIRwtHD7/2zrU3Zs5ce/fnb5M8/oY4OmS03cEny+UOV9ddB2rSSV8XG8KWFKvdNPor/X8oirF+8obi1U+72jhgR5XL5fIDrQ+vlIH/sSS63QKgO/Iv+nT+m2+7NPS4K9x4qToBSuO+lW3VI31RyMr0N8xvO2k0Is6s/PNVusXO3IcAAKjzfTr+ebbZ+K8QtfeF7s3WUIYj4r6IOBgRpyLiUETcH1Ep+2BEPNSskqR1/Y2LJBvHP4Xr2w5uE9Lx34vZ2lb9+C8f/cVwMcsdqMTfn5ydL80dz96TsegfSPOTber44ZXfvmh1rHb8l25p/flYMGvH9b6B+tfMTi9N30nMtW58EjHS1yz+ZG0lID19hyNiZJt1zD/9zdFWx24ffxsdWGcqfx3xVPX8r0RD/Lmk/frkxD1Rmjs+kV8VG/3y69U3W9V/R/F3QHr+9za9/tfiH05q12sXt17H1T8+bzmn2e71vyd5u27fh9NLS5cmI/Ykr1cbXbt/qqHc1Hr5NP6xY837/8FYfyeORER6ET8cEY9ExKNZ2x+LiMcj4lib+H96+Yn3thf/QJu/2hlp/LNbOv/riT3RuKd5onj+x+/qKh3ebPyRnf+TldRYtmczn3+badf2rmYAAAD47ylExP5ICuNr6UJhfLz6P/yHYm+htLC49MzZhQ8uzlafERiO/kJ+p2uo5n7oZDatz/NTDfkT2X3jL4uDlfz4zEJpttvBQ4/b16L/p/4sdrt1wI7zvBb0Lv0fepf+D71L/4fe1aT/D3ajHcDua/b9/3EX2gHsvob+b9kPeoj5P/Qu/R96l/4PPWlxMG7/kLyExIZEFO6KZkjsUKLbn0wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACd8W8AAAD//zpS5t0=") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[], 0x10448) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x510, 0xd0, 0xd0, 0x428, 0xd0, 0xd0, 0x5a0, 0x5a0, 0x5a0, 0x5a0, 0x5a0, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x5}}}, {{@ipv6={@mcast1, @local, [], [], 'macvtap0\x00', 'ip6tnl0\x00', {}, {}, 0x6, 0x0, 0x0, 0x4a}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@broadcast}}}, {{@ipv6={@mcast2, @loopback, [], [], 'veth0_to_team\x00', 'syzkaller0\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}, {{@uncond, 0x0, 0xa8, 0xd0}, @inet=@DSCP={0x28}}, {{@uncond, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@dev}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x570) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x183042, 0x15) pwrite64(r1, &(0x7f0000000140)='2', 0xfdef, 0xe7c) 14.416021744s ago: executing program 5 (id=104): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000001c0), 0x12) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000dd0a0000000000006b01a400000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xb5}, 0x48) 14.390974145s ago: executing program 33 (id=104): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000001c0), 0x12) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000dd0a0000000000006b01a400000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xb5}, 0x48) 5.364113642s ago: executing program 6 (id=235): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x2d}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000100)=0xb329, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) sendto$inet(r0, &(0x7f0000000900)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9025a01c95d4a068ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 5.155716921s ago: executing program 1 (id=241): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2281, 0x0) syz_usb_connect$cdc_ncm(0x5, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) unshare(0x20000400) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r4, 0x1, 0x45, &(0x7f0000000000), 0x4) ioctl$TCFLSH(0xffffffffffffffff, 0x400455c8, 0x4) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2f) 4.268654382s ago: executing program 6 (id=246): io_uring_setup(0x4822, &(0x7f0000000100)={0x0, 0x0, 0x400, 0x3, 0xfc}) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) close(0x3) 4.152420828s ago: executing program 0 (id=248): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000140)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c) 4.053847932s ago: executing program 0 (id=249): ptrace$getregset(0x4205, 0x0, 0x202, 0x0) r0 = inotify_init1(0x80800) syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000080)='./file1\x00', 0x1a04447, &(0x7f0000000640)=ANY=[], 0x8, 0x1e6, &(0x7f0000000400)="$eJzsmD+LE0EYxp+Z3UvuThFsLGwUPPCEu83uRsXGIn4CIfFfZzBriG4SSbZIAiLBxsaP4VewCAgWdnZptVBBsDCllcXITGazYzYbEkxQ8P1BZp7JzLzvzLvLUywIgvhv+fL5x6eXN65VjgCcxAHy+v9vVrKGG+s/7mrx4dW71qmno/l4bM38NoC3JQuRHgshhDl/oPsK+EzfAsclre+AwdH6Pjhuax2A4Z7Wjwzd3tMiDJwH7bD2sBEGrmw82fiyKc6fbzJkqAGQVxfW7+fv9gePq2EYdObFjojzpKaWiDdYsMvMl0vXz56UOK4b9ZPP6+6L50M5diCeyd416ueBw9O6CIZyXBPk4ThOUhLj/mftJL61yv1XFOMTwB9szxAMSpw+Xrb4aHmcnxs8zxoifsB/J/u/KuLXbSMBmfHPnhTMjHxmMnqf3vV1mxc8v90aQnt2amq8v8V3NfFPaS8XDX+yYc/8oxA1nxS6/cFxo1mtB/Wg5fvFq+5l173iF5QRTVtkYWNX+dO+EX8nY22O5dCrRlHH6wFRx5uN/WlrOG75dfu72sOV/3EcXpjGYLEH5xfnYPrHVS/VoZV5eIIgCIIgCIIgCIIgCIIgiLU4B6a+ggohmP4gugj/plr9KwAA//8epVZj") inotify_add_watch(r0, &(0x7f0000000040)='./file0\x00', 0x430002d7) r1 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0, 0x0) getdents64(r1, 0x0, 0x0) 4.021431194s ago: executing program 0 (id=250): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x10) sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) connect$tipc(r0, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x70da97db27eb4fb9, {0x2, 0x3, 0x3}}, 0x10) 3.407652802s ago: executing program 2 (id=254): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x1ffffc, 0xb66, &(0x7f0000006680)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) r3 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), r3) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl1\x00', r4, 0x4, 0x0, 0x0, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @private1={0xfc, 0x1, '\x00', 0x1}, 0x80, 0x0, 0x1, 0x1}}) r6 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r7 = syz_open_dev$loop(&(0x7f0000000100), 0x6, 0x2300) ioctl$IOC_PR_RESERVE(r7, 0x401070c9, 0x0) r8 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r6) mmap$IORING_OFF_SQ_RING(0x0, 0x8000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000940)={r8, 0x9f}, 0x0, &(0x7f0000000b80)="cb44032c2a3a518de9000000c11a536275a146d65e2988ef1a4992f9a2675b2853d82c107d0fd00990b531004a27f0395fdb7d3b545b60ff5be75bcb1d85878c1cbdb120730ded7b4d10b0612763631dd3db62ddf7f799a4257d4bf67e86244beee88b1e3e5bac3ad4dea44fc08db9f741b76996bf785368bc3b20816471f5254e6e9e7a9ccd90d32ebcf5ea2c79482fb0e0cfb8bf19da1095e6b47db929f5", 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000180)={'ip6tnl0\x00', r5, 0x0, 0x0, 0x0, 0x4, 0x8, @remote, @dev={0xfe, 0x80, '\x00', 0xe}, 0x0, 0x1, 0xfffffffe, 0x1}}) r9 = socket$inet(0xa, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r9, 0x0, 0x40, &(0x7f00000002c0)=@mangle={'mangle\x00', 0x44, 0x6, 0x410, 0x138, 0x98, 0x138, 0x0, 0x0, 0x378, 0x378, 0x378, 0x378, 0x378, 0x6, 0x0, {[{{@ip={@loopback, @multicast1=0xe0007600, 0x0, 0x0, 'gre0\x00', 'ip6gre0\x00', {}, {}, 0x0, 0x0, 0x11}, 0x7a00, 0x70, 0x98}, @inet=@DSCP={0x28, 'DSCP\x00', 0x0, {0x3}}}, {{@ip={@multicast1, @local, 0x0, 0x0, 'wg1\x00', 'nicvf0\x00', {}, {}, 0x11}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0xb8, 0x100, 0x0, {}, [@common=@unspec=@limit={{0x48}, {0x0, 0x28, 0x9, 0x0, 0x0, 0x1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private2, 'veth0_virt_wifi\x00', {0x7}}}}, {{@ip={@rand_addr, @private, 0xffffffff, 0xff, 'syzkaller0\x00', 'veth1_to_team\x00', {}, {0xff}}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @empty}}}, {{@ip={@empty, @empty, 0xff000000, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x1fb, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x470) r10 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r10, 0x29, 0x40, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0xa7ae6000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000700)={&(0x7f0000000900)=ANY=[@ANYBLOB="9feb0100181800000017fffff00400000002000000010000"], &(0x7f0000000640)=""/192, 0x34, 0xc0, 0x1}, 0x28) statx(0xffffffffffffffff, 0x0, 0x400, 0x404, 0x0) 3.407252732s ago: executing program 3 (id=255): r0 = syz_ublk_setup_io_uring(0x1a, &(0x7f0000000400)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2000, 0x10000004, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0x0, 0x30b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x0, 0x0, 0x1f0, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x967f, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0x1, 0x4, 0x0, 0x0}}, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000340)={0xa, 0x4e24, 0x8, @empty}, 0x1c) 3.390508803s ago: executing program 6 (id=256): r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x7, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ptrace(0x10, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000500)=ANY=[@ANYBLOB="d80000001b0001002dbd7000fadbdf2500000000000000000000000000000000ac1e00010000000000000000000000004e2200004e23fff90a"], 0xd8}, 0x1, 0x0, 0x0, 0xc040}, 0x8010) ptrace$pokeuser(0x6, 0x0, 0x388, 0x41d9fda7) setuid(0x0) r4 = syz_clone(0x800000, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r5) mount(0x0, &(0x7f00000010c0)='.\x00', &(0x7f0000000000)='proc\x00', 0x80, 0x0) syz_open_procfs(r4, &(0x7f0000000040)='ns\x00') 3.246760409s ago: executing program 3 (id=257): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='ns\x00') fchdir(r0) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x1400037e) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) getdents64(r2, 0x0, 0x0) 3.172003893s ago: executing program 3 (id=258): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0x8, &(0x7f0000000300)=@raw=[@generic={0xb7, 0x2, 0x0, 0x0, 0xfffffffe}, @generic={0x7b, 0xa, 0x2, 0xffc0}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xffffffc0}, @generic={0xb7, 0x3, 0x0, 0x0, 0x40}, @generic={0xb7, 0x4}, @generic={0x85, 0x0, 0x0, 0x0, 0x45}, @generic={0x95}], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r2, r1, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0xd81, &(0x7f0000000080)=ANY=[], 0x0) 3.171731143s ago: executing program 3 (id=259): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x6, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @map_fd={0x18, 0x1, 0x1, 0x0, r0}, @generic={0x15, 0x8, 0x0, 0x2, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r2}, 0xc) 3.171555713s ago: executing program 3 (id=260): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000000004026093333400000000001090224"], 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x54c, 0x268, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x1, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400}}}}}]}}]}}, 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)=ANY=[], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000040)={0xffe7, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) 3.135955745s ago: executing program 0 (id=261): sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sendmsg$inet6(0xffffffffffffffff, 0x0, 0xc000) syz_open_dev$loop(0x0, 0x6b, 0x901) futex(0x0, 0x85, 0x0, 0x0, 0x0, 0xb0090199) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', 0x0, 0x20, 0x7, 0x8, 0xe, {{0x5, 0x4, 0x3, 0x1b, 0x14, 0x65, 0x0, 0x8, 0x0, 0x0, @empty, @multicast2}}}}) keyctl$set_reqkey_keyring(0xe, 0x2) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r2, 0x89f3, &(0x7f0000000940)={'syztnl0\x00', 0x0}) 2.601515159s ago: executing program 2 (id=262): syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./bus\x00', 0x2000410, &(0x7f0000000380)=ANY=[], 0x1, 0x2c6, &(0x7f0000000640)="$eJzs3c9qY1UcB/DfTdKbjArpWga84CxcDdPZukmRGRC7UrJQFypOC9IEoYWCfzB25daNS59AENz5Em58A8Gt4M4KxSv35t4kTZO0gaZV5vNZzJyee77nnnM4adOWe/rh/eHhsywOTr/8LTqdJBq9uBdnSWxHI2pfxwW9bwMA+D87y/P4Mx9b3OKlhbVJRHQ2OzQAYEPmvv7/PbnQXBL46daGBgBsyDvvvvfW7t7ek7ezrBNPh9+c9Ivv7Iv/x9d3D+KTGMR+PIpunEfktfr3A3mej1pZlmV5N2I4OukXyeEHv1T97/4RUeZ3opvGJFK+2yj+ffrm3pOdbCweTPKjYhwvVPfvFfnH5Y8cpvGZ/OMF+ein8dqrM+N/GN349eP4NAbxrOxkmv9qJ8veyL/764v3i+6LfDI66bfLdlPtZe+IAAAAAAAAAAAAAAAAAAAAAABgbQ+rs3PakW3Hg2FRVZ2/0zwvPtiKrLZ98Xyecb5ddzR3PtAoj+/r83UeZVmWV6f3TPOteLkVrbuZNQAAAAAAAAAAAAAAAAAAAPy3HH/2+eFHg8H+0Y0Uqof8J4/1rxfvTsbTm7n0SqxOtaf3alTFFfeKZt0miShqkmWLUEzihpblqsK9ZWP+4cd1O+xc3WYryoXa5Lzq3VUs78I27ahrOvUm+Xm2TRrXvFe67NL9aghHx9eZabp4Q6499/TFsjBa0SZvrnpdvP77eNhVTTL/IkrLVV0Qz//Zqmpissfn98Za+/ny54rEaR0AAAAAAAAAAAAAAAAAALBR04d+L11qxenKaCNvb3BgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHCLpn//f3mhFREXakZVeGVqXEjj6PiOpwgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBz4N8AAAD//07qTw8=") fchdir(0xffffffffffffffff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) lseek(r0, 0x2, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000080)={0x12, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x5c1}, [@ldst={0x3, 0x2, 0x3, 0x1, 0x1, 0x20}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x1e}, 0x94) getdents64(r0, 0x0, 0x22) 2.579053381s ago: executing program 2 (id=263): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000000)={0x0, 0xdeeb, 0x0, 0x1, 0x330}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x10000, 0x2, 0x10000002, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x0, 0x10040000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x800, 0x1, 0x0, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x100, 0x1, 0x367, 0x0, r2}}], 0x1, &(0x7f0000000340)={0x2e, 0x54, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB=')'], 0x18}, 0x440e0) 2.283349084s ago: executing program 0 (id=264): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="01000000050000000100000007"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000640), &(0x7f0000000740), 0x20075, r0}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x57, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r1, 0x2000300, 0xe, 0x0, &(0x7f0000000000)="63eced8e46dc3f0adf3389f7b986", 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) 2.283113604s ago: executing program 2 (id=265): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28001, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000003c0)={"60ddfe05cf5ab44163f210bc961ad8d06825126d28a0dc6c6f8b4966456546e376981a00febc7c6e84f40ecc8426c26140af6064e773de180c55e2415a39c76082d6e0365d40970183aa59a45c23058e1a3bab96548e07eccc538d9cd92e94cf08e063d898eee5d6b9cb67827f2a690f89db08250cc8fbdae590d7196381607df366bd7343763dacf64432449df9ce150050aacd5cb1ddb1d50758eb44e171bc5a927c1c8f6e2e869cb8f25bd622182b2f531caf0c4b3bdcf8c6c6e4896ac9c83a7622f9606d319e7e8d8e3dea8b54a7872f11fab1190fa3b9aa1f68213b9cade6731b46657a288e4dafc236cb510841af38c3de8cee93483ead0829c2baee5a7d08b84028a53394d4c66b7110a20b06b4d039be18da617ade0091224a31c5791611f66d36e75d722d9fdfe30d2438cb5933f8c1d833c85e3cf4f12d60ec7425ee40611eb915c342fef4b532685ea878099950ef51cdeb555fb371716c34482517ee5877970c0e675a07d16987e27c0ec50b6f7ecd9e4fdaf09ea8c3e558675e92758104ebd05e8b3a01e037e32865668bedb183ef4c90f0d7ff7b24645520cccacd166a44f145426cf7d496b9ea19c2aec33650ceaee005ac2fd742820e21f62ba28fe96ed4111a0954740e12ddf113fbad49266ffc86cb45cbfba35b4298e61cff8cd209ed4efaecbae24c0ae5ebcd6edbdd5b96ed6817a37c9d6848e6d65b59013ae11fffda70e4197364b5ab7948ade0301a48997901c7b912e73d23e4ccaa33bb6528f967af7bfd4bf728d0a43cdf1db7797da7fdc479c9c07d76a0528e239c2b0d4877708f00baeaa2ff06cd1a0efd30cdfd871cd9db248ef7ef1a960955089e1f49060e4e477070078c4405b04b295b801773787ef3a36d16cfcec5f3a6e00c6e3a490dd4cfff6b2ce9a8baa70df2da6878c9e86ae01c423b71ab88e83c6c230ec4874d149b31a4d74769e43b0875636bf94bde1196f994adc44eb921a3119cce3fb48499d013b2566ceb1eabd234c79cb169aff7aae16ed890725be47ab8208c9daca87c0f7710999d2a579936c7cde984e69f230244a6272e7ca14660eaf76cc9c47405d096d7738b601206ae76b1472c5bdcd236aafefdce7f73b4bfcfda90887a38f88e55f6fd7392ca6cfbbb2d6d7f389d205a9a656c32c47e8bb0fa641df4a5354a733b008bcf7ee101c7e67ab8fcdbc0ae3c09e4ad5dee614a23c73d5873301cf0a046959f9afb214ad98fc6b6f9ab80ed4ed893ba3951be1cc14197926775e5a51dd3877b3a079a1f269fa1e4a203a849c8c12ccb195dcea9e86f10937e3c0ce65f954eab99192392818d5b75dcafdcadc70da2100c908ffb2a60edfa7807b3391968631b8f415d7f2d1390696d8e8e743879d697afd34ab0205339b36c10f4e9f88b195100f6d9e6d22b3c10d82d9d7f7c8b9b74eebdf622"}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000080)=@x86={0x40, 0x1, 0xc, 0x0, 0xb07, 0x0, 0x10, 0x4, 0x7, 0x7, 0x1, 0x0, 0x0, 0x20000000, 0x928f, 0x2, 0xff, 0xff, 0x0, '\x00', 0x2}) 2.283007774s ago: executing program 6 (id=266): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x7fa962bfffff, 0x13012, r1, 0x0) madvise(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x4) 1.414055634s ago: executing program 6 (id=267): write$binfmt_register(0xffffffffffffffff, &(0x7f0000000300)={0x3a, 'syz2', 0x3a, 'M', 0x3a, 0x6, 0x3a, 'B\xd4GGI\x82\\4\xbb\xbb\xbb\xb3\xd4)\xed\x8f\xaa\xf4\xd2{\xc5\t\xa9\xed\xf8e\xaa\xb9\xf5\r\xe3T\x0e\x8a\xd6\x9a_?G\x05\x00\x00\x00\x00\x00\x00\x00\x1e\x9a\xce\xac&x3\x15\x14y\xbf\xc6)\xa8\b/\x01\x00\x00\f\x8e1\xc4\xa1\xb2]I\xa5\x13}9\x1b0x0}) sendto$packet(r0, &(0x7f00000002c0)="05031600d3fc140000004788031c09102c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) 1.374537236s ago: executing program 2 (id=268): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a80), 0x101200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, &(0x7f0000000080)="d8df0f23b3b9ce000000b807000000ba000000000f301b8154fea900c1210680320000c4e28ddc8dcd000000c182fd3f0000c8b950020000b801000400b9a6080000b800000100265d7aeabbc900bbc9000f30300f272d9d53bf0000c4b9e16dc30101220f01c3", 0xfffffffffffffdab}], 0x1, 0x14, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.299969979s ago: executing program 1 (id=269): mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x21c0, 0x103) syz_mount_image$fuse(0x0, &(0x7f0000000400)='./file0\x00', 0x3104019, 0x0, 0x11, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000000)='./bus\x00', 0x11, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000540)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x103a42, 0x32) 1.29268786s ago: executing program 1 (id=270): ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x4048aec9, &(0x7f0000000080)={[{0xfffffffc, 0x0, 0x0, 0x8, 0xfc, 0x81, 0x81, 0x7, 0x1, 0x0, 0x0, 0x8}, {0x0, 0x0, 0x0, 0x0, 0x8, 0x7, 0xfd, 0x0, 0xfe, 0x0, 0x47, 0x0, 0x20000}, {0x80000003, 0xa, 0x22, 0x8, 0x40, 0x3, 0x5f, 0x1, 0x2, 0x7, 0x0, 0x7f, 0xfffffffffffffffd}], 0x1ffffff}) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="020a040007000000b6f1ffff0000854105001a"], 0x38}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="020100090e000000030000000000000405000600000000000a0000000000000400000000000000000000002100000000000100000000000002000100010000000000010200fd000005000500000000000a"], 0x70}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x3ef, 0x0) 300.979986ms ago: executing program 6 (id=271): r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x20fb87, 0x800, 0x1, 0x32c}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x8000006, 0x15e, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7e, 0x8, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88e0, 0x1, 0x3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x82, 0xbd}}], 0x1, &(0x7f0000000340)={0x2e, 0x54, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000340)={0x27, {0x0, 0x0, 0x1, 0x4, 0x5}}) 273.052237ms ago: executing program 1 (id=272): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0) 272.377597ms ago: executing program 2 (id=273): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x1ffffc, 0xb66, &(0x7f0000006680)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) r3 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), r3) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl1\x00', r4, 0x4, 0x0, 0x0, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @private1={0xfc, 0x1, '\x00', 0x1}, 0x80, 0x0, 0x1, 0x1}}) r6 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r7 = syz_open_dev$loop(&(0x7f0000000100), 0x6, 0x2300) ioctl$IOC_PR_RESERVE(r7, 0x401070c9, 0x0) r8 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r6) mmap$IORING_OFF_SQ_RING(0x0, 0x8000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000940)={r8, 0x9f}, 0x0, &(0x7f0000000b80)="cb44032c2a3a518de9000000c11a536275a146d65e2988ef1a4992f9a2675b2853d82c107d0fd00990b531004a27f0395fdb7d3b545b60ff5be75bcb1d85878c1cbdb120730ded7b4d10b0612763631dd3db62ddf7f799a4257d4bf67e86244beee88b1e3e5bac3ad4dea44fc08db9f741b76996bf785368bc3b20816471f5254e6e9e7a9ccd90d32ebcf5ea2c79482fb0e0cfb8bf19da1095e6b47db929f5", 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000180)={'ip6tnl0\x00', r5, 0x0, 0x0, 0x0, 0x4, 0x8, @remote, @dev={0xfe, 0x80, '\x00', 0xe}, 0x0, 0x1, 0xfffffffe, 0x1}}) r9 = socket$inet(0xa, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r9, 0x0, 0x40, &(0x7f00000002c0)=@mangle={'mangle\x00', 0x44, 0x6, 0x410, 0x138, 0x98, 0x138, 0x0, 0x0, 0x378, 0x378, 0x378, 0x378, 0x378, 0x6, 0x0, {[{{@ip={@loopback, @multicast1=0xe0007600, 0x0, 0x0, 'gre0\x00', 'ip6gre0\x00', {}, {}, 0x0, 0x0, 0x11}, 0x7a00, 0x70, 0x98}, @inet=@DSCP={0x28, 'DSCP\x00', 0x0, {0x3}}}, {{@ip={@multicast1, @local, 0x0, 0x0, 'wg1\x00', 'nicvf0\x00', {}, {}, 0x11}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0xb8, 0x100, 0x0, {}, [@common=@unspec=@limit={{0x48}, {0x0, 0x28, 0x9, 0x0, 0x0, 0x1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private2, 'veth0_virt_wifi\x00', {0x7}}}}, {{@ip={@rand_addr, @private, 0xffffffff, 0xff, 'syzkaller0\x00', 'veth1_to_team\x00', {}, {0xff}}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @empty}}}, {{@ip={@empty, @empty, 0xff000000, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x1fb, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x470) r10 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r10, 0x29, 0x40, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0xa7ae6000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000700)={&(0x7f0000000900)=ANY=[@ANYBLOB="9feb0100181800000017fffff00400000002000000010000"], &(0x7f0000000640)=""/192, 0x34, 0xc0, 0x1}, 0x28) statx(0xffffffffffffffff, 0x0, 0x400, 0x404, 0x0) 205.46264ms ago: executing program 0 (id=274): sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sendmsg$inet6(0xffffffffffffffff, 0x0, 0xc000) syz_open_dev$loop(0x0, 0x6b, 0x901) futex(0x0, 0x85, 0x0, 0x0, 0x0, 0xb0090199) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', 0x0, 0x20, 0x7, 0x8, 0xe, {{0x5, 0x4, 0x3, 0x1b, 0x14, 0x65, 0x0, 0x8, 0x0, 0x0, @empty, @multicast2}}}}) keyctl$set_reqkey_keyring(0xe, 0x2) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r2, 0x89f3, &(0x7f0000000940)={'syztnl0\x00', 0x0}) 169.274842ms ago: executing program 1 (id=275): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000140)='ramfs\x00', 0x14011, 0x0) syz_mount_image$fuse(&(0x7f0000000180), &(0x7f0000000040)='./file0\x00', 0x1484a8, &(0x7f0000000340)=ANY=[], 0x21, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) syz_mount_image$vfat(&(0x7f0000000300), &(0x7f0000000280)='./bus\x00', 0x28f4f8, 0x0, 0x0, 0x0, &(0x7f0000000140)) mount$overlay(0x0, &(0x7f0000000580)='./file0\x00', &(0x7f0000000b80), 0x4008, &(0x7f0000000340)={[{@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@metacopy_on}, {@xino_auto}]}) 66.694557ms ago: executing program 3 (id=276): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) mremap(&(0x7f00008cc000/0x4000)=nil, 0x4000, 0x2000, 0x3, &(0x7f000046d000/0x2000)=nil) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) 0s ago: executing program 1 (id=277): accept4$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_usb_connect$uac1(0x0, 0xa7, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902950003010000020904000000010100000a240100000302010213240600000600000800000000000a0000000009240300000000030009240603010102008c09240300fe020404000824050402"], 0x0) writev(0xffffffffffffffff, 0x0, 0x0) read(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.228' (ED25519) to the list of known hosts. [ 22.654112][ T28] audit: type=1400 audit(1789397906.090:64): avc: denied { mounton } for pid=279 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.655141][ T279] cgroup: Unknown subsys name 'net' [ 22.676757][ T28] audit: type=1400 audit(1789397906.090:65): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.704029][ T28] audit: type=1400 audit(1789397906.120:66): avc: denied { unmount } for pid=279 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.704221][ T279] cgroup: Unknown subsys name 'devices' [ 22.821329][ T279] cgroup: Unknown subsys name 'hugetlb' [ 22.826946][ T279] cgroup: Unknown subsys name 'rlimit' [ 22.929826][ T28] audit: type=1400 audit(1789397906.370:67): avc: denied { setattr } for pid=279 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.953033][ T28] audit: type=1400 audit(1789397906.370:68): avc: denied { mounton } for pid=279 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.977795][ T28] audit: type=1400 audit(1789397906.370:69): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.014794][ T281] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 23.023647][ T28] audit: type=1400 audit(1789397906.460:70): avc: denied { relabelto } for pid=281 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.049120][ T28] audit: type=1400 audit(1789397906.460:71): avc: denied { write } for pid=281 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.085864][ T28] audit: type=1400 audit(1789397906.520:72): avc: denied { read } for pid=279 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.111469][ T279] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.120528][ T28] audit: type=1400 audit(1789397906.520:73): avc: denied { open } for pid=279 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.827180][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.834279][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.841942][ T288] device bridge_slave_0 entered promiscuous mode [ 23.855850][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.863055][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.870519][ T287] device bridge_slave_0 entered promiscuous mode [ 23.878336][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.885482][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.892789][ T287] device bridge_slave_1 entered promiscuous mode [ 23.899307][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.906397][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.913716][ T288] device bridge_slave_1 entered promiscuous mode [ 24.064100][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.071442][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.078860][ T289] device bridge_slave_0 entered promiscuous mode [ 24.087719][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.094799][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.102105][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.109126][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.122859][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.129943][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.137204][ T289] device bridge_slave_1 entered promiscuous mode [ 24.165593][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.172899][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.180291][ T290] device bridge_slave_0 entered promiscuous mode [ 24.197152][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.204338][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.211731][ T290] device bridge_slave_1 entered promiscuous mode [ 24.229240][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.236384][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.243907][ T293] device bridge_slave_0 entered promiscuous mode [ 24.253467][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.260559][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.267829][ T293] device bridge_slave_1 entered promiscuous mode [ 24.339595][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.346691][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.353997][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.361032][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.390577][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.397830][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.405116][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.412642][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.420668][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.428029][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.474298][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.482534][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.489544][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.514058][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.521779][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.529167][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.537607][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.544669][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.552163][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.560433][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.567437][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.587305][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.596450][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.604700][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.611726][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.636061][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.643861][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.651885][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.660817][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.667834][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.675526][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.691958][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.700098][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.707112][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.722603][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.730459][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.738552][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.745586][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.752986][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.761655][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.768672][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.776229][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.787188][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.798296][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.816368][ T287] device veth0_vlan entered promiscuous mode [ 24.825785][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.834729][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.842929][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.851056][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.860299][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.868348][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.876375][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.884561][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.892848][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.900099][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.916010][ T287] device veth1_macvtap entered promiscuous mode [ 24.930878][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.938742][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.947011][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.955469][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.963788][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.972084][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.980443][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.988531][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.996248][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.004929][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.013593][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.020648][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.028092][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.036205][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.044166][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.052392][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.061905][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.070432][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.087783][ T288] device veth0_vlan entered promiscuous mode [ 25.095422][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.103843][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.112409][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.120429][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.128992][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.136778][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.151748][ T289] device veth0_vlan entered promiscuous mode [ 25.164440][ T293] device veth0_vlan entered promiscuous mode [ 25.170761][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.179044][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.188247][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.196791][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.205248][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.213663][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.222085][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.230288][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.238203][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.246245][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.256189][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.263721][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.271223][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.278595][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.286218][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.294631][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.307406][ T288] device veth1_macvtap entered promiscuous mode [ 25.316553][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.324916][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.333169][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.354813][ T290] device veth0_vlan entered promiscuous mode [ 25.355130][ T287] request_module fs-gadgetfs succeeded, but still no fs? [ 25.368379][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.377477][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.385715][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.393548][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.402627][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.410917][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.419028][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.426617][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.434724][ T289] device veth1_macvtap entered promiscuous mode [ 25.443693][ T293] device veth1_macvtap entered promiscuous mode [ 25.458047][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.466014][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.473896][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.485009][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.493572][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.503295][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.508478][ T316] loop3: detected capacity change from 0 to 256 [ 25.511890][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.526193][ T316] exFAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 25.526673][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.536821][ T316] exFAT-fs (loop3): Medium has reported failures. Some data may be lost. [ 25.538924][ T316] exFAT-fs (loop3): failed to load upcase table (idx : 0x0000ff98, chksum : 0x84a6b859, utbl_chksum : 0xe619d30d) [ 25.569295][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.580376][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.601767][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.610603][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.619186][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.632505][ T290] device veth1_macvtap entered promiscuous mode [ 25.690731][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.707777][ T328] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.715719][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.734748][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.743521][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.765018][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.773901][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.930956][ T347] loop0: detected capacity change from 0 to 4096 [ 25.951597][ T347] EXT4-fs: Ignoring removed nomblk_io_submit option [ 25.979388][ T347] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 25.988274][ T347] EXT4-fs (loop0): Test dummy encryption mode enabled [ 25.997141][ T347] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=2842c198, mo2=0003] [ 26.005497][ T347] System zones: 0-5 [ 26.015778][ T347] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 26.044257][ T347] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 26.056993][ T347] fscrypt: AES-256-XTS using blk-crypto-fallback [ 26.085202][ T347] syz.0.13 (347) used greatest stack depth: 22464 bytes left [ 26.098379][ T289] EXT4-fs (loop0): unmounting filesystem. [ 26.296136][ T371] loop0: detected capacity change from 0 to 40427 [ 26.309053][ T371] F2FS-fs (loop0): Invalid log_blocksize (268), supports only 12 [ 26.319602][ T371] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 26.331074][ T384] kvm [383]: vcpu2, guest rIP: 0x9132 Unhandled WRMSR(0xc1) = 0xd105af [ 26.344281][ T384] kvm [383]: vcpu2, guest rIP: 0x9132 Unhandled WRMSR(0xc2) = 0xd105af [ 26.355636][ T384] kvm [383]: vcpu2, guest rIP: 0x9132 Unhandled WRMSR(0x11e) = 0xd105af [ 26.359146][ T371] F2FS-fs (loop0): Found nat_bits in checkpoint [ 26.382652][ T384] kvm [383]: vcpu2, guest rIP: 0x9132 Unhandled WRMSR(0x186) = 0xd105af [ 26.402388][ T371] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 26.403527][ T384] kvm [383]: vcpu2, guest rIP: 0x9132 Unhandled WRMSR(0x187) = 0xd105af [ 26.409553][ T371] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 26.449297][ T384] kvm [383]: vcpu2, guest rIP: 0x9132 Unhandled WRMSR(0x1d9) = 0xd105af [ 26.970274][ T431] loop1: detected capacity change from 0 to 2048 [ 26.999464][ T428] 9pnet: p9_errstr2errno: server reported unknown error 0x0 [ 27.019187][ T431] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 27.024821][ T444] FAULT_INJECTION: forcing a failure. [ 27.024821][ T444] name failslab, interval 1, probability 0, space 0, times 1 [ 27.036639][ T430] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 25 vs 281 free clusters [ 27.055375][ T430] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 27.056523][ T444] CPU: 1 PID: 444 Comm: syz.4.47 Not tainted syzkaller #0 [ 27.067624][ T430] EXT4-fs (loop1): This should not happen!! Data will be lost [ 27.067624][ T430] [ 27.074642][ T444] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 27.074669][ T444] Call Trace: [ 27.084287][ T430] EXT4-fs (loop1): Total free blocks count 0 [ 27.094307][ T444] [ 27.094316][ T444] __dump_stack+0x21/0x24 [ 27.097587][ T430] EXT4-fs (loop1): Free/Dirty block details [ 27.103536][ T444] dump_stack_lvl+0x110/0x170 [ 27.103557][ T444] ? __cfi_dump_stack_lvl+0x8/0x8 [ 27.103583][ T444] dump_stack+0x15/0x24 [ 27.103602][ T444] should_fail_ex+0x3bf/0x510 [ 27.103619][ T444] __should_failslab+0xac/0xf0 [ 27.119661][ T430] EXT4-fs (loop1): free_blocks=4096 [ 27.121351][ T444] should_failslab+0x9/0x20 [ 27.126349][ T430] EXT4-fs (loop1): dirty_blocks=64 [ 27.130474][ T444] __kmem_cache_alloc_node+0x3d/0x2d0 [ 27.130497][ T444] ? kvmalloc_node+0x28a/0x460 [ 27.135421][ T430] EXT4-fs (loop1): Block reservation details [ 27.139972][ T444] ? kasan_save_alloc_info+0x1f/0x30 [ 27.139992][ T444] ? kvmalloc_node+0x28a/0x460 [ 27.145169][ T430] EXT4-fs (loop1): i_reserved_data_blocks=4 [ 27.149646][ T444] __kmalloc_node+0xa2/0x1e0 [ 27.149662][ T444] kvmalloc_node+0x28a/0x460 [ 27.149677][ T444] ? __cfi_kvmalloc_node+0x10/0x10 [ 27.149692][ T444] ? memset+0x35/0x40 [ 27.156530][ T431] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 27.160131][ T444] alloc_netdev_mqs+0xa2d/0xfb0 [ 27.160157][ T444] tun_set_iff+0x547/0xee0 [ 27.160176][ T444] __tun_chr_ioctl+0x88c/0x1ef0 [ 27.231144][ T444] ? tun_flow_create+0x320/0x320 [ 27.236066][ T444] ? mutex_unlock+0x8f/0x230 [ 27.240634][ T444] tun_chr_ioctl+0x2a/0x40 [ 27.245040][ T444] ? __cfi_tun_chr_ioctl+0x10/0x10 [ 27.250152][ T444] __se_sys_ioctl+0x12f/0x1b0 [ 27.254828][ T444] __x64_sys_ioctl+0x7b/0x90 [ 27.259393][ T444] x64_sys_call+0x58b/0x9a0 [ 27.263873][ T444] do_syscall_64+0x4c/0xa0 [ 27.268284][ T444] ? clear_bhb_loop+0x30/0x80 [ 27.272943][ T444] ? clear_bhb_loop+0x30/0x80 [ 27.277595][ T444] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 27.283461][ T444] RIP: 0033:0x7f6092d9e159 [ 27.287859][ T444] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 27.307440][ T444] RSP: 002b:00007f6093c0a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 27.315839][ T444] RAX: ffffffffffffffda RBX: 00007f6093025fa0 RCX: 00007f6092d9e159 [ 27.323803][ T444] RDX: 00002000000000c0 RSI: 00000000400454ca RDI: 0000000000000003 [ 27.331771][ T444] RBP: 00007f6092e3503b R08: 0000000000000000 R09: 0000000000000000 [ 27.339730][ T444] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 27.347690][ T444] R13: 00007f6093026038 R14: 00007f6093025fa0 R15: 00007fffc997dc88 [ 27.355658][ T444] [ 27.428822][ T460] loop1: detected capacity change from 0 to 16 [ 27.429859][ T39] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 27.435689][ T460] erofs: (device loop1): EXPERIMENTAL compressed fragments feature in use. Use at your own risk! [ 27.453341][ T460] erofs: (device loop1): EXPERIMENTAL global deduplication feature in use. Use at your own risk! [ 27.466139][ T460] erofs: (device loop1): EXPERIMENTAL EROFS subpage compressed block support in use. Use at your own risk! [ 27.484543][ T460] erofs: (device loop1): mounted with root inode @ nid 36. [ 27.515463][ T460] erofs: (device loop1): z_erofs_fill_inode_lazy: per-inode big pcluster without sb feature for nid 36 [ 27.516005][ T467] loop4: detected capacity change from 0 to 512 [ 27.526963][ T460] erofs: (device loop1): z_erofs_read_folio: failed to read, err [-117] [ 27.536665][ T467] ======================================================= [ 27.536665][ T467] WARNING: The mand mount option has been deprecated and [ 27.536665][ T467] and is ignored by this kernel. Remove the mand [ 27.536665][ T467] option from the mount to silence this warning. [ 27.536665][ T467] ======================================================= [ 27.551119][ T460] erofs: (device loop1): z_erofs_fill_inode_lazy: per-inode big pcluster without sb feature for nid 36 [ 27.588266][ T467] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 27.601451][ T467] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 27.607716][ T460] erofs: (device loop1): z_erofs_read_folio: failed to read, err [-117] [ 27.613899][ T469] loop2: detected capacity change from 0 to 256 [ 27.629105][ T469] FAT-fs (loop2): Unrecognized mount option "utf8=0•4\7p̀âme=lower" or missing value [ 27.641334][ T467] EXT4-fs (loop4): 1 truncate cleaned up [ 27.646278][ T460] erofs: (device loop1): z_erofs_fill_inode_lazy: per-inode big pcluster without sb feature for nid 36 [ 27.646981][ T467] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 27.658441][ T460] erofs: (device loop1): z_erofs_read_folio: failed to read, err [-117] [ 27.666759][ T39] usb 1-1: Using ep0 maxpacket: 32 [ 27.680108][ T60] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 27.690621][ T324] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 27.701049][ T28] kauditd_printk_skb: 105 callbacks suppressed [ 27.701062][ T28] audit: type=1400 audit(1789397911.140:179): avc: denied { mount } for pid=468 comm="syz.2.58" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 27.706888][ T39] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 27.707595][ T28] audit: type=1400 audit(1789397911.140:180): avc: denied { ioctl } for pid=468 comm="syz.2.58" path="/12/dev/mapper/control" dev="devtmpfs" ino=266 ioctlcmd=0xfd11 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 27.729849][ T39] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 27.776125][ T39] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 27.785210][ T39] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.794418][ T39] usb 1-1: config 0 descriptor?? [ 27.801028][ T39] hub 1-1:0.0: USB hub found [ 27.805774][ T28] audit: type=1400 audit(1789397911.140:181): avc: denied { unmount } for pid=290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 27.839779][ T28] audit: type=1400 audit(1789397911.270:182): avc: denied { create } for pid=474 comm="syz.1.61" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 27.868222][ T28] audit: type=1400 audit(1789397911.270:183): avc: denied { write } for pid=474 comm="syz.1.61" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 27.888771][ T28] audit: type=1400 audit(1789397911.270:184): avc: denied { nlmsg_write } for pid=474 comm="syz.1.61" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 27.909214][ T28] audit: type=1400 audit(1789397911.280:185): avc: denied { create } for pid=476 comm="syz.2.62" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 27.929182][ T28] audit: type=1400 audit(1789397911.280:186): avc: denied { setopt } for pid=476 comm="syz.2.62" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 27.935762][ T293] EXT4-fs (loop4): unmounting filesystem. [ 27.955291][ T60] usb 4-1: unable to get BOS descriptor or descriptor too short [ 27.966146][ T482] Driver unsupported XDP return value 0 on prog (id 18) dev N/A, expect packet loss! [ 27.978365][ T60] usb 4-1: not running at top speed; connect to a high speed hub [ 27.986033][ T28] audit: type=1400 audit(1789397911.300:187): avc: denied { create } for pid=478 comm="syz.1.63" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 28.003043][ T39] hub 1-1:0.0: config failed, can't read hub descriptor (err -22) [ 28.012961][ T28] audit: type=1400 audit(1789397911.300:188): avc: denied { mounton } for pid=478 comm="syz.1.63" path="/11/file0" dev="tmpfs" ino=77 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 28.018757][ T60] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 28.047509][ T60] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 28.058584][ T60] usb 4-1: New USB device found, idVendor=200c, idProduct=1018, bcdDevice= 0.40 [ 28.079688][ T60] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.087713][ T60] usb 4-1: Product: syz [ 28.093053][ T60] usb 4-1: Manufacturer: syz [ 28.097673][ T60] usb 4-1: SerialNumber: syz [ 28.260123][ T39] hid-generic 0003:046D:C31C.0001: hidraw0: USB HID v8.00 Device [HID 046d:c31c] on usb-dummy_hcd.0-1/input0 [ 28.323795][ T60] usb 4-1: USB disconnect, device number 2 [ 28.336535][ T490] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.352660][ T324] udevd[324]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 28.358963][ T490] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.378457][ T490] device bridge_slave_0 entered promiscuous mode [ 28.386079][ T490] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.400443][ T490] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.408040][ T490] device bridge_slave_1 entered promiscuous mode [ 28.423329][ T503] loop1: detected capacity change from 0 to 512 [ 28.490171][ T503] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 28.499297][ T503] ext4 filesystem being mounted at /15/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 28.512226][ T490] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.519341][ T490] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.526660][ T490] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.533731][ T490] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.567872][ T288] EXT4-fs (loop1): unmounting filesystem. [ 28.574222][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.584526][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 28.598136][ T317] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.618195][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 28.634311][ T317] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.641404][ T317] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.656399][ T43] device bridge_slave_1 left promiscuous mode [ 28.664420][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.669792][ T6] usb 1-1: USB disconnect, device number 2 [ 28.679854][ T43] device bridge_slave_0 left promiscuous mode [ 28.686098][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.694423][ T43] device veth1_macvtap left promiscuous mode [ 28.701179][ T43] device veth0_vlan left promiscuous mode [ 28.726312][ T517] loop2: detected capacity change from 0 to 512 [ 28.747020][ T517] EXT4-fs error (device loop2): ext4_orphan_get:1405: inode #15: comm syz.2.75: inode has both inline data and extents flags [ 28.761675][ T517] EXT4-fs error (device loop2): ext4_orphan_get:1410: comm syz.2.75: couldn't read orphan inode 15 (err -117) [ 28.775488][ T517] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 28.849603][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 28.868454][ T521] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 28.889481][ T521] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 28.898417][ T521] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 28.911937][ T490] device veth0_vlan entered promiscuous mode [ 28.920376][ T521] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 28.928364][ T521] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 28.937286][ T290] EXT4-fs (loop2): unmounting filesystem. [ 28.945026][ T521] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 28.957052][ T521] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 28.976801][ T490] device veth1_macvtap entered promiscuous mode [ 28.979795][ T529] fuse: Unknown parameter '000000000000000000000xffffffffffffffff00000000000000000000' [ 28.983671][ T521] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 28.998325][ T529] ext2: Unexpected value for 'acl' [ 29.002272][ T521] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 29.014427][ T521] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 29.035806][ T521] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 29.048994][ T531] loop1: detected capacity change from 0 to 256 [ 29.051260][ T521] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 29.079995][ T531] exFAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 29.080957][ T521] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 29.107698][ T521] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 29.117380][ T531] exFAT-fs (loop1): Medium has reported failures. Some data may be lost. [ 29.122979][ T533] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 29.127027][ T531] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d) [ 29.134675][ T533] ext4 filesystem being mounted at /20/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 29.224527][ T290] EXT4-fs error (device loop2): ext4_readdir:263: inode #2: block 16: comm syz-executor: path /20/file0: bad entry in directory: rec_len is smaller than minimal - offset=108, inode=646161, rec_len=0, size=4096 fake=0 [ 29.249059][ T290] EXT4-fs (loop2): unmounting filesystem. [ 29.315234][ T555] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 29.325145][ T555] ext4 filesystem being mounted at /22/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 29.355238][ T288] EXT4-fs (loop1): unmounting filesystem. [ 29.379741][ T60] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 29.455272][ T572] exfat: Deprecated parameter 'namecase' [ 29.468209][ T576] netlink: 8 bytes leftover after parsing attributes in process `syz.1.96'. [ 29.469875][ T572] exfat: Deprecated parameter 'namecase' [ 29.486284][ T572] exFAT-fs (loop5): failed to load upcase table (idx : 0x0001fe89, chksum : 0xc374f927, utbl_chksum : 0xe619d30d) [ 29.560543][ T309] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 29.574646][ T60] usb 1-1: too many endpoints for config 1 interface 0 altsetting 13: 65, using maximum allowed: 30 [ 29.586254][ T60] usb 1-1: config 1 interface 0 altsetting 13 has 1 endpoint descriptor, different from the interface descriptor's value: 65 [ 29.604263][ T60] usb 1-1: config 1 interface 0 has no altsetting 0 [ 29.611493][ T490] syz-executor (490) used greatest stack depth: 22344 bytes left [ 29.628669][ T60] usb 1-1: New USB device found, idVendor=046d, idProduct=c626, bcdDevice= 0.40 [ 29.639354][ T60] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.647711][ T60] usb 1-1: Product: syz [ 29.652148][ T60] usb 1-1: Manufacturer: syz [ 29.656742][ T60] usb 1-1: SerialNumber: syz [ 29.753748][ T309] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 29.777673][ T309] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 29.788854][ T309] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 29.804445][ T594] netlink: 4 bytes leftover after parsing attributes in process `syz.3.107'. [ 29.809100][ T309] usb 3-1: New USB device found, idVendor=046d, idProduct=c262, bcdDevice= 0.00 [ 29.824200][ T309] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.833176][ T309] usb 3-1: config 0 descriptor?? [ 29.877965][ T60] usbhid 1-1:1.0: can't add hid device: -71 [ 29.888347][ T60] usbhid: probe of 1-1:1.0 failed with error -71 [ 29.898997][ T591] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.906586][ T591] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.921209][ T60] usb 1-1: USB disconnect, device number 3 [ 29.929439][ T591] device bridge_slave_0 entered promiscuous mode [ 29.946074][ T591] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.953248][ T591] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.960843][ T591] device bridge_slave_1 entered promiscuous mode [ 30.015314][ T591] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.022405][ T591] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.046179][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.058806][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 30.068759][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 30.078663][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 30.087328][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 30.095862][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.102954][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.121204][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 30.129406][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.136455][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.144145][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 30.152356][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 30.173422][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 30.188248][ T591] device veth0_vlan entered promiscuous mode [ 30.195248][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 30.204108][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 30.213046][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 30.229917][ T591] device veth1_macvtap entered promiscuous mode [ 30.237136][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 30.246365][ T309] logitech-hidpp-device 0003:046D:C262.0002: item fetching failed at offset 20/24 [ 30.263269][ T309] logitech-hidpp-device 0003:046D:C262.0002: hidpp_probe:parse failed [ 30.272203][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 30.280859][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 30.289039][ T309] logitech-hidpp-device: probe of 0003:046D:C262.0002 failed with error -22 [ 30.332147][ T626] input: syz1 as /devices/virtual/input/input4 [ 30.402198][ T636] FAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 30.476885][ T24] usb 3-1: USB disconnect, device number 2 [ 30.523163][ T636] FAT-fs (loop0): error, invalid FAT chain (i_pos 196, last_block 8200) [ 30.532279][ T636] FAT-fs (loop0): Filesystem has been set read-only [ 30.833061][ T647] set_capacity_and_notify: 5 callbacks suppressed [ 30.833079][ T647] loop0: detected capacity change from 0 to 40427 [ 30.854544][ T647] F2FS-fs (loop0): Invalid log_blocksize (268), supports only 12 [ 30.862466][ T647] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 30.871032][ T647] F2FS-fs (loop0): invalid crc value [ 30.877575][ T647] F2FS-fs (loop0): Found nat_bits in checkpoint [ 30.900329][ T647] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 30.907439][ T647] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 30.936429][ T647] syz.0.126: attempt to access beyond end of device [ 30.936429][ T647] loop0: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 30.957150][ T647] syz.0.126: attempt to access beyond end of device [ 30.957150][ T647] loop0: rw=0, sector=45096, nr_sectors = 8 limit=40427 [ 31.036017][ T289] syz-executor: attempt to access beyond end of device [ 31.036017][ T289] loop0: rw=2051, sector=45096, nr_sectors = 8 limit=40427 [ 31.050330][ T289] F2FS-fs (loop0): Issue discard(5637, 5637, 1) failed, ret: -5 [ 31.228670][ T659] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 31.357980][ T661] loop6: detected capacity change from 0 to 512 [ 31.370955][ T661] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 31.380011][ T661] ext4 filesystem being mounted at /4/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 31.421188][ T513] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 31.422597][ T591] EXT4-fs (loop6): unmounting filesystem. [ 31.609733][ T513] usb 1-1: Using ep0 maxpacket: 32 [ 31.617305][ T513] usb 1-1: unable to get BOS descriptor or descriptor too short [ 31.626999][ T513] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 31.637324][ T513] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 31.640143][ T682] loop6: detected capacity change from 512 to 64 [ 31.661191][ T513] usb 1-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 31.670808][ T513] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 31.682268][ T513] usb 1-1: Product: syz [ 31.686808][ T513] usb 1-1: Manufacturer: syz [ 31.703831][ T513] usb 1-1: SerialNumber: syz [ 31.718964][ T513] usb 1-1: selecting invalid altsetting 1 [ 31.905027][ T703] netlink: 8 bytes leftover after parsing attributes in process `syz.6.148'. [ 31.914984][ T657] netlink: 12 bytes leftover after parsing attributes in process `syz.0.129'. [ 31.925446][ T657] netlink: 44 bytes leftover after parsing attributes in process `syz.0.129'. [ 31.934240][ T705] binder: 704:705 ioctl 4018620d 0 returned -22 [ 31.934523][ T657] netlink: 43 bytes leftover after parsing attributes in process `syz.0.129'. [ 31.949461][ T657] netlink: 'syz.0.129': attribute type 5 has an invalid length. [ 31.957378][ T657] netlink: 43 bytes leftover after parsing attributes in process `syz.0.129'. [ 31.971360][ T308] device bridge_slave_1 left promiscuous mode [ 31.979331][ T308] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.004291][ T308] device bridge_slave_0 left promiscuous mode [ 32.011291][ T308] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.030705][ T308] device veth1_macvtap left promiscuous mode [ 32.037320][ T308] device veth0_vlan left promiscuous mode [ 32.767449][ T28] kauditd_printk_skb: 79 callbacks suppressed [ 32.767469][ T28] audit: type=1400 audit(1789397916.200:268): avc: denied { create } for pid=711 comm="syz.1.152" name="#9" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 32.833577][ T28] audit: type=1400 audit(1789397916.230:269): avc: denied { link } for pid=711 comm="syz.1.152" name="#9" dev="tmpfs" ino=271 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 32.839623][ T715] process 'syz.0.153' launched './file0' with NULL argv: empty string added [ 32.855571][ T513] usb 1-1: 6:0: failed to get current value for ch 0 (-71) [ 32.872191][ T28] audit: type=1400 audit(1789397916.240:270): avc: denied { rename } for pid=711 comm="syz.1.152" name="#a" dev="tmpfs" ino=271 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 32.892034][ T43] tipc: Subscription rejected, illegal request [ 32.901368][ T513] snd-usb-audio: probe of 1-1:1.0 failed with error -22 [ 32.908674][ T28] audit: type=1400 audit(1789397916.340:271): avc: denied { read } for pid=716 comm="syz.6.154" path="socket:[18716]" dev="sockfs" ino=18716 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 32.933235][ T513] usb 1-1: USB disconnect, device number 4 [ 32.958568][ T724] loop3: detected capacity change from 0 to 128 [ 32.986226][ T724] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 32.995043][ T724] ext4 filesystem being mounted at /30/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 33.030586][ T28] audit: type=1400 audit(1789397916.470:272): avc: denied { create } for pid=718 comm="syz.3.155" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 33.074646][ T28] audit: type=1400 audit(1789397916.470:273): avc: denied { create } for pid=718 comm="syz.3.155" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 33.095002][ T28] audit: type=1400 audit(1789397916.470:274): avc: denied { write } for pid=718 comm="syz.3.155" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 33.172174][ T730] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 33.299697][ T287] EXT4-fs (loop3): unmounting filesystem. [ 33.320469][ T324] udevd[324]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 33.352759][ T28] audit: type=1400 audit(1789397916.790:275): avc: denied { connect } for pid=734 comm="syz.3.159" lport=60 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 33.373225][ T735] loop3: detected capacity change from 0 to 16 [ 33.616878][ T28] audit: type=1400 audit(1789397917.050:276): avc: denied { create } for pid=741 comm="syz.0.162" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 33.638389][ T28] audit: type=1400 audit(1789397917.050:277): avc: denied { ioctl } for pid=741 comm="syz.0.162" path="socket:[18765]" dev="sockfs" ino=18765 ioctlcmd=0x52d2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 33.672635][ T746] loop0: detected capacity change from 0 to 512 [ 33.679575][ T746] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 33.691364][ T746] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2802: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 33.704610][ T746] EXT4-fs (loop0): 1 truncate cleaned up [ 33.711204][ T746] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 33.726367][ T746] xt_hashlimit: size too large, truncated to 1048576 [ 33.864247][ T754] kvm [753]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0x11e) = 0xb4004000 [ 33.875559][ T754] kvm [753]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0x186) = 0xb4004000 [ 33.884638][ T754] kvm [753]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0x187) = 0xb4004000 [ 33.903685][ T289] EXT4-fs (loop0): unmounting filesystem. [ 33.922104][ T731] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 33.940217][ T731] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz1] on syz0 [ 34.079704][ T443] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 34.260726][ T773] loop0: detected capacity change from 0 to 40427 [ 34.268884][ T775] kvm [774]: vcpu8, guest rIP: 0x9132 Unhandled WRMSR(0xc1) = 0xd105af [ 34.275702][ T773] F2FS-fs (loop0): Invalid log_blocksize (268), supports only 12 [ 34.277517][ T775] kvm [774]: vcpu8, guest rIP: 0x9132 Unhandled WRMSR(0xc2) = 0xd105af [ 34.286483][ T443] usb 2-1: unable to get BOS descriptor or descriptor too short [ 34.295945][ T775] kvm [774]: vcpu8, guest rIP: 0x9132 Unhandled WRMSR(0x11e) = 0xd105af [ 34.305531][ T773] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 34.312102][ T775] kvm [774]: vcpu8, guest rIP: 0x9132 Unhandled WRMSR(0x186) = 0xd105af [ 34.318928][ T443] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 34.326180][ T775] kvm [774]: vcpu8, guest rIP: 0x9132 Unhandled WRMSR(0x187) = 0xd105af [ 34.336198][ T773] F2FS-fs (loop0): invalid crc value [ 34.346478][ T775] kvm [774]: vcpu8, guest rIP: 0x9132 Unhandled WRMSR(0x1d9) = 0xd105af [ 34.349845][ T443] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 34.368776][ T773] F2FS-fs (loop0): Found nat_bits in checkpoint [ 34.372851][ T443] usb 2-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 34.389737][ T443] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.402605][ T773] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 34.403921][ T443] usb 2-1: Product: syz [ 34.409842][ T773] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 34.418532][ T443] usb 2-1: Manufacturer: syz [ 34.430052][ T443] usb 2-1: SerialNumber: syz [ 34.440370][ T443] usb 2-1: selecting invalid altsetting 1 [ 34.446301][ T443] usb 2-1: unit 6 not found! [ 34.693168][ T796] loop3: detected capacity change from 0 to 4096 [ 34.705882][ T796] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 34.724335][ T796] EXT4-fs (loop3): Test dummy encryption mode enabled [ 34.732035][ T796] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=280ec1a8, mo2=0003] [ 34.740435][ T796] System zones: 0-5 [ 34.745234][ T796] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 34.799409][ T287] EXT4-fs (loop3): unmounting filesystem. [ 34.832165][ T800] loop3: detected capacity change from 0 to 512 [ 34.897574][ T802] binder: 801:802 ioctl c0306201 2000000003c0 returned -14 [ 34.927586][ T800] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e826c018, mo2=0002] [ 34.938216][ T800] System zones: 1-12 [ 34.943947][ T800] EXT4-fs error (device loop3): ext4_do_update_inode:5281: inode #15: comm syz.3.181: corrupted inode contents [ 34.956124][ T800] EXT4-fs error (device loop3) in ext4_orphan_del:303: Corrupt filesystem [ 34.967407][ T789] loop0: detected capacity change from 0 to 131072 [ 34.978448][ T800] EXT4-fs error (device loop3): ext4_do_update_inode:5281: inode #15: comm syz.3.181: corrupted inode contents [ 34.990710][ T789] F2FS-fs (loop0): Test dummy encryption mode enabled [ 35.006356][ T800] EXT4-fs error (device loop3): ext4_evict_inode:329: inode #15: comm syz.3.181: mark_inode_dirty error [ 35.023446][ T789] F2FS-fs (loop0): invalid crc value [ 35.033084][ T800] EXT4-fs (loop3): 1 orphan inode deleted [ 35.039422][ T443] usb 2-1: 2:0: failed to get current value for ch 0 (-32) [ 35.047883][ T800] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 35.064633][ T789] F2FS-fs (loop0): Found nat_bits in checkpoint [ 35.074645][ T287] EXT4-fs (loop3): unmounting filesystem. [ 35.109762][ T789] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 35.167937][ T789] fscrypt: AES-256-XTS using implementation "xts-aes-aesni" [ 35.229552][ T824] exFAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 35.241324][ T824] exFAT-fs (loop3): Medium has reported failures. Some data may be lost. [ 35.253766][ T824] exFAT-fs (loop3): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d) [ 35.269719][ T443] snd-usb-audio: probe of 2-1:1.0 failed with error -22 [ 35.281955][ T443] usb 2-1: USB disconnect, device number 3 [ 35.291743][ T731] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 35.300467][ T324] udevd[324]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 35.316445][ T731] hid-generic 0000:0000:0000.0004: hidraw0: HID v0.00 Device [syz1] on syz0 [ 35.364044][ T831] exFAT-fs (loop3): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x99a53fd9, utbl_chksum : 0xe619d30d) [ 35.489694][ T731] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 35.919750][ T443] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 36.151784][ T443] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 36.193128][ T443] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 36.274681][ T443] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 36.356147][ T443] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 36.430313][ T731] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 36.441016][ T443] usb 4-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice= 1.00 [ 36.449687][ T731] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 36.461127][ T443] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.469156][ T443] usb 4-1: Product: syz [ 36.474016][ T443] usb 4-1: Manufacturer: syz [ 36.478680][ T443] usb 4-1: SerialNumber: syz [ 36.483387][ T731] usb 7-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice= 1.00 [ 36.490770][ T443] usbserial_generic 4-1:1.0: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 36.499684][ T731] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.503851][ T443] usbserial_generic 4-1:1.0: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 36.519672][ T731] usb 7-1: Product: syz [ 36.523077][ T443] usbserial_generic 4-1:1.0: generic converter detected [ 36.536958][ T443] usb 4-1: generic converter now attached to ttyUSB0 [ 36.539691][ T731] usb 7-1: Manufacturer: syz [ 36.548249][ T731] usb 7-1: SerialNumber: syz [ 36.560105][ T826] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 36.567604][ T826] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 36.575576][ T731] usbserial_generic 7-1:1.0: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 36.586841][ T731] usbserial_generic 7-1:1.0: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 36.597558][ T731] usbserial_generic 7-1:1.0: generic converter detected [ 36.605242][ T731] usb 7-1: generic converter now attached to ttyUSB1 [ 36.696209][ T731] usb 4-1: USB disconnect, device number 3 [ 36.706972][ T731] generic ttyUSB0: generic converter now disconnected from ttyUSB0 [ 36.716363][ T731] usbserial_generic 4-1:1.0: device disconnected [ 36.761106][ T852] set_capacity_and_notify: 2 callbacks suppressed [ 36.761118][ T852] loop1: detected capacity change from 0 to 131072 [ 36.785268][ T852] F2FS-fs (loop1): Invalid segment/section count (458783, 24 x 150994945) [ 36.799699][ T852] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 36.808438][ T443] usb 7-1: USB disconnect, device number 2 [ 36.816591][ T443] generic ttyUSB1: generic converter now disconnected from ttyUSB1 [ 36.817868][ T852] F2FS-fs (loop1): invalid crc value [ 36.827019][ T443] usbserial_generic 7-1:1.0: device disconnected [ 36.841312][ T852] F2FS-fs (loop1): Found nat_bits in checkpoint [ 36.864095][ T852] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 36.871213][ T852] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e4 [ 36.899262][ T852] F2FS-fs (loop1): sanity_check_inode: inode (ino=4, mode=16877) should not have inline_data, run fsck to fix [ 37.158419][ T873] user requested TSC rate below hardware speed [ 37.166265][ T873] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (148514 ns). Using initial count to start timer. [ 37.415631][ T900] netlink: 24 bytes leftover after parsing attributes in process `syz.3.219'. [ 37.774828][ T908] netlink: 24 bytes leftover after parsing attributes in process `syz.3.220'. [ 38.282225][ T915] loop1: detected capacity change from 0 to 4096 [ 38.336171][ T915] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 38.371864][ T915] EXT4-fs (loop1): Test dummy encryption mode enabled [ 38.384529][ T915] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=280ec1a8, mo2=0003] [ 38.394785][ T915] System zones: 0-5 [ 38.400780][ T915] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 38.510566][ T28] kauditd_printk_skb: 27 callbacks suppressed [ 38.510579][ T28] audit: type=1400 audit(1789397921.950:305): avc: denied { getopt } for pid=923 comm="syz.6.227" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 38.512117][ T924] loop6: detected capacity change from 0 to 256 [ 38.601026][ T288] EXT4-fs (loop1): unmounting filesystem. [ 38.607720][ T924] exFAT-fs (loop6): failed to load upcase table (idx : 0x00010000, chksum : 0x204dac4c, utbl_chksum : 0xe619d30d) [ 38.649202][ T924] capability: warning: `syz.6.227' uses deprecated v2 capabilities in a way that may be insecure [ 38.651628][ T936] loop1: detected capacity change from 0 to 256 [ 38.661011][ T28] audit: type=1400 audit(1789397922.100:306): avc: denied { setattr } for pid=923 comm="syz.6.227" name="/" dev="loop6" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 38.691704][ T936] FAT-fs (loop1): error, invalid access to FAT (entry 0x00000001) [ 38.721577][ T936] FAT-fs (loop1): Filesystem has been set read-only [ 38.740640][ T946] netlink: 24 bytes leftover after parsing attributes in process `syz.0.231'. [ 38.749921][ T28] audit: type=1400 audit(1789397922.170:307): avc: denied { append } for pid=933 comm="syz.1.233" name="loop1" dev="devtmpfs" ino=119 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 38.880611][ T28] audit: type=1400 audit(1789397922.320:308): avc: denied { watch } for pid=953 comm="syz.1.240" path="/58/file0" dev="tmpfs" ino=337 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 38.917140][ T28] audit: type=1400 audit(1789397922.340:309): avc: denied { ioctl } for pid=954 comm="syz.2.239" path="socket:[20156]" dev="sockfs" ino=20156 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 38.937166][ T959] loop2: detected capacity change from 0 to 512 [ 38.975438][ T959] EXT4-fs (loop2): 1 truncate cleaned up [ 38.981354][ T959] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 39.010220][ T290] EXT4-fs (loop2): unmounting filesystem. [ 39.810883][ T972] futex_wake_op: syz.2.245 tries to shift op by 144; fix this program [ 39.990038][ T983] loop0: detected capacity change from 0 to 16 [ 40.005619][ T983] erofs: (device loop0): mounted with root inode @ nid 36. [ 40.016536][ T983] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop0 ino=46 [ 40.729522][ T1009] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 40.789024][ T1011] netlink: 24 bytes leftover after parsing attributes in process `syz.6.256'. [ 40.824558][ T28] audit: type=1400 audit(1789398180.262:310): avc: denied { watch_reads } for pid=1013 comm="syz.3.257" path="/proc/166/task/167/ns" dev="proc" ino=19443 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 41.039232][ T1025] futex_wake_op: syz.0.261 tries to shift op by 144; fix this program [ 41.179692][ T6] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 41.360780][ T6] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 41.370945][ T6] usb 4-1: config 0 has no interfaces? [ 41.376467][ T6] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 41.385557][ T6] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 41.394446][ T6] usb 4-1: config 0 descriptor?? [ 41.470445][ T1027] loop2: detected capacity change from 0 to 256 [ 41.603272][ T1021] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 41.612524][ T1021] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 41.621272][ T443] usb 4-1: USB disconnect, device number 4 [ 41.799244][ T28] audit: type=1400 audit(1789398181.232:311): avc: denied { map } for pid=1040 comm="syz.6.266" path="socket:[20298]" dev="sockfs" ino=20298 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 41.824735][ T1041] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=3835797286 (7671594572 ns) > initial count (4918772610 ns). Using initial count to start timer. [ 41.849845][ T1041] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=2527804186 (323558935808 ns) > initial count (117850194176 ns). Using initial count to start timer. [ 41.859730][ T28] audit: type=1400 audit(1789398181.232:312): avc: denied { read accept } for pid=1040 comm="syz.6.266" path="socket:[20298]" dev="sockfs" ino=20298 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 42.738055][ T28] audit: type=1400 audit(1789398182.172:313): avc: denied { read write } for pid=1054 comm="syz.1.269" name="file1" dev="tmpfs" ino=350 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 42.785341][ T28] audit: type=1400 audit(1789398182.202:314): avc: denied { open } for pid=1054 comm="syz.1.269" path="/60/bus/file1" dev="overlay" ino=350 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 43.719638][ C1] sched: RT throttling activated [ 43.870417][ T28] audit: type=1400 audit(1789398183.312:315): avc: denied { ioctl } for pid=1071 comm="syz.1.272" path="socket:[20588]" dev="sockfs" ino=20588 ioctlcmd=0x7452 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 43.905539][ T28] audit: type=1400 audit(1789398183.342:316): avc: denied { remount } for pid=1077 comm="syz.1.275" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 43.919712][ T443] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 43.939387][ T1079] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 43.951355][ T1078] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 43.969080][ T1078] overlayfs: failed to set xattr on upper [ 43.975183][ T28] audit: type=1400 audit(1789398183.392:317): avc: denied { mounton } for pid=1077 comm="syz.1.275" path="/63/file0/file0" dev="ramfs" ino=20603 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=dir permissive=1 [ 44.020628][ T1078] overlayfs: ...falling back to index=off,metacopy=off. [ 44.027961][ T1078] overlayfs: ...falling back to xino=off. [ 44.034020][ T1078] overlayfs: conflicting lowerdir path [ 44.040961][ T1082] futex_wake_op: syz.0.274 tries to shift op by 144; fix this program [ 44.071815][ T28] audit: type=1400 audit(1789398183.502:318): avc: denied { unmount } for pid=288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 44.099881][ C1] ================================================================== [ 44.108067][ C1] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x6c/0xb0 [ 44.115460][ C1] Read of size 8 at addr ffff8881313f8d90 by task ksoftirqd/1/23 [ 44.123182][ C1] [ 44.125543][ C1] CPU: 1 PID: 23 Comm: ksoftirqd/1 Not tainted syzkaller #0 [ 44.132831][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 44.142889][ C1] Call Trace: [ 44.146173][ C1] [ 44.149102][ C1] __dump_stack+0x21/0x24 [ 44.153446][ C1] dump_stack_lvl+0x110/0x170 [ 44.158142][ C1] ? __cfi_dump_stack_lvl+0x8/0x8 [ 44.163183][ C1] ? debug_smp_processor_id+0x17/0x20 [ 44.168574][ C1] ? rcu_cblist_dequeue+0x6c/0xb0 [ 44.173608][ C1] print_address_description+0x71/0x200 [ 44.179163][ C1] print_report+0x4a/0x60 [ 44.183498][ C1] kasan_report+0x122/0x150 [ 44.188011][ C1] ? rcu_cblist_dequeue+0x6c/0xb0 [ 44.193040][ C1] __asan_report_load8_noabort+0x14/0x20 [ 44.198672][ C1] rcu_cblist_dequeue+0x6c/0xb0 [ 44.203530][ C1] rcu_do_batch+0x4bc/0xc30 [ 44.208039][ C1] ? rcu_core+0xf00/0xf00 [ 44.212379][ C1] ? _raw_spin_unlock_irqrestore+0x5a/0x80 [ 44.218203][ C1] ? swake_up_one+0x12d/0x140 [ 44.222902][ C1] ? swake_up_one_online+0x66/0x110 [ 44.228115][ C1] ? rcu_report_qs_rnp+0x37b/0x390 [ 44.233236][ C1] rcu_core+0x486/0xf00 [ 44.237395][ C1] ? rcu_cpu_kthread_park+0x90/0x90 [ 44.242595][ C1] ? __schedule+0xcbb/0x1700 [ 44.247198][ C1] ? irqtime_account_irq+0x75/0x240 [ 44.252491][ C1] rcu_core_si+0x9/0x10 [ 44.256662][ C1] handle_softirqs+0x1d7/0x600 [ 44.261431][ C1] ? __cfi_run_ksoftirqd+0x10/0x10 [ 44.266549][ C1] run_ksoftirqd+0x28/0x30 [ 44.271008][ C1] smpboot_thread_fn+0x48c/0x8e0 [ 44.275951][ C1] kthread+0x281/0x320 [ 44.280026][ C1] ? __cfi_smpboot_thread_fn+0x10/0x10 [ 44.285581][ C1] ? __cfi_kthread+0x10/0x10 [ 44.290175][ C1] ret_from_fork+0x1f/0x30 [ 44.294597][ C1] [ 44.297616][ C1] [ 44.299931][ C1] Allocated by task 1072: [ 44.304250][ C1] kasan_set_track+0x4b/0x70 [ 44.308852][ C1] kasan_save_alloc_info+0x1f/0x30 [ 44.313964][ C1] __kasan_kmalloc+0x95/0xb0 [ 44.318598][ C1] __kmalloc+0xb4/0x1e0 [ 44.322758][ C1] l2tp_session_create+0x38/0xbd0 [ 44.327786][ C1] pppol2tp_connect+0xbf5/0x1640 [ 44.332733][ C1] __sys_connect+0x3da/0x460 [ 44.337330][ C1] __x64_sys_connect+0x7a/0x90 [ 44.342196][ C1] x64_sys_call+0x88d/0x9a0 [ 44.346705][ C1] do_syscall_64+0x4c/0xa0 [ 44.351132][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 44.357027][ C1] [ 44.359344][ C1] Freed by task 308: [ 44.363234][ C1] kasan_set_track+0x4b/0x70 [ 44.367828][ C1] kasan_save_free_info+0x2b/0x40 [ 44.372849][ C1] ____kasan_slab_free+0x132/0x180 [ 44.377963][ C1] __kasan_slab_free+0x11/0x20 [ 44.382728][ C1] slab_free_freelist_hook+0xc2/0x190 [ 44.388098][ C1] __kmem_cache_free+0xb7/0x1b0 [ 44.392952][ C1] kfree+0x6f/0xf0 [ 44.396670][ C1] l2tp_session_put+0xaf/0x1a0 [ 44.401435][ C1] l2tp_session_delete+0x3df/0x4d0 [ 44.406549][ C1] l2tp_tunnel_del_work+0x199/0x410 [ 44.409693][ T731] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 44.411747][ C1] process_one_work+0x717/0xc30 [ 44.411769][ C1] worker_thread+0xa4d/0x11d0 [ 44.428688][ C1] kthread+0x281/0x320 [ 44.432761][ C1] ret_from_fork+0x1f/0x30 [ 44.437181][ C1] [ 44.439497][ C1] Last potentially related work creation: [ 44.445199][ C1] kasan_save_stack+0x3a/0x60 [ 44.449883][ C1] __kasan_record_aux_stack+0xb6/0xc0 [ 44.455253][ C1] kasan_record_aux_stack_noalloc+0xb/0x10 [ 44.461161][ C1] call_rcu+0xcf/0xf50 [ 44.465248][ C1] pppol2tp_release+0x1e3/0x2b0 [ 44.470118][ C1] sock_close+0xc9/0x220 [ 44.474370][ C1] __fput+0x1fd/0x8f0 [ 44.478358][ C1] ____fput+0x15/0x20 [ 44.482344][ C1] task_work_run+0x1e1/0x250 [ 44.486944][ C1] do_exit+0xb03/0x2970 [ 44.491110][ C1] __cfi___ia32_sys_exit+0x0/0x10 [ 44.496144][ C1] x64_sys_call+0x67/0x9a0 [ 44.500569][ C1] do_syscall_64+0x4c/0xa0 [ 44.504993][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 44.510894][ C1] [ 44.513219][ C1] Second to last potentially related work creation: [ 44.519803][ C1] kasan_save_stack+0x3a/0x60 [ 44.524491][ C1] __kasan_record_aux_stack+0xb6/0xc0 [ 44.529868][ C1] kasan_record_aux_stack_noalloc+0xb/0x10 [ 44.535674][ C1] kvfree_call_rcu+0x8b/0x7a0 [ 44.540360][ C1] neigh_destroy+0x476/0x5b0 [ 44.544964][ C1] neigh_cleanup_and_release+0x76/0x1a0 [ 44.550524][ C1] neigh_remove_one+0x4ae/0x530 [ 44.555388][ C1] ___neigh_create+0x484/0x1db0 [ 44.560250][ C1] __neigh_create+0x31/0x40 [ 44.564763][ C1] ip6_finish_output2+0xaaf/0x18b0 [ 44.569873][ C1] ip6_finish_output+0x60b/0xbe0 [ 44.574854][ C1] ip6_output+0x1fa/0x410 [ 44.579192][ C1] ndisc_send_skb+0x7c8/0xcd0 [ 44.583877][ C1] ndisc_send_rs+0x66a/0x870 [ 44.588469][ C1] addrconf_dad_completed+0x958/0xe80 [ 44.593837][ C1] addrconf_dad_work+0xc1b/0x14a0 [ 44.598869][ C1] process_one_work+0x717/0xc30 [ 44.603724][ C1] worker_thread+0xa4d/0x11d0 [ 44.608414][ C1] kthread+0x281/0x320 [ 44.612494][ C1] ret_from_fork+0x1f/0x30 [ 44.616920][ C1] [ 44.619242][ C1] The buggy address belongs to the object at ffff8881313f8c00 [ 44.619242][ C1] which belongs to the cache kmalloc-512 of size 512 [ 44.633296][ C1] The buggy address is located 400 bytes inside of [ 44.633296][ C1] 512-byte region [ffff8881313f8c00, ffff8881313f8e00) [ 44.646666][ C1] [ 44.648994][ C1] The buggy address belongs to the physical page: [ 44.655395][ C1] page:ffffea0004c4fe00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8881313f8800 pfn:0x1313f8 [ 44.659820][ T731] usb 2-1: Using ep0 maxpacket: 16 [ 44.666946][ C1] head:ffffea0004c4fe00 order:2 compound_mapcount:0 compound_pincount:0 [ 44.666966][ C1] flags: 0x4000000000010200(slab|head|zone=1) [ 44.666999][ C1] raw: 4000000000010200 ffffea0004ca4b00 dead000000000002 ffff888100042f00 [ 44.678560][ T731] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 44.680386][ C1] raw: ffff8881313f8800 000000008010000e 00000001ffffffff 0000000000000000 [ 44.680396][ C1] page dumped because: kasan: bad access detected [ 44.680415][ C1] page_owner tracks the page as allocated [ 44.689204][ T28] audit: type=1400 audit(1789398184.102:319): avc: denied { read } for pid=85 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 44.695018][ C1] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 39, tgid 39 (kworker/1:1), ts 24024391007, free_ts 0 [ 44.695046][ C1] post_alloc_hook+0x1f5/0x210 [ 44.710698][ T731] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 44.713790][ C1] prep_new_page+0x1c/0x110 [ 44.724627][ T28] audit: type=1400 audit(1789398184.102:320): avc: denied { search } for pid=85 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 44.725920][ C1] get_page_from_freelist+0x2ca9/0x2d20 [ 44.753356][ T731] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 44.765550][ C1] __alloc_pages+0x1fa/0x610 [ 44.765583][ C1] alloc_slab_page+0x6e/0xf0 [ 44.765595][ C1] new_slab+0x98/0x3e0 [ 44.765606][ C1] ___slab_alloc+0x70f/0xb70 [ 44.783345][ T731] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 44.783684][ C1] __slab_alloc+0x5e/0xa0 [ 44.805249][ T28] audit: type=1400 audit(1789398184.102:321): avc: denied { write } for pid=85 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 44.810477][ C1] __kmem_cache_alloc_node+0x204/0x2d0 [ 44.810504][ C1] __kmalloc+0xa4/0x1e0 [ 44.830700][ T28] audit: type=1400 audit(1789398184.102:322): avc: denied { add_name } for pid=85 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 44.833238][ C1] ___neigh_create+0x6e3/0x1db0 [ 44.840017][ T28] audit: type=1400 audit(1789398184.102:323): avc: denied { create } for pid=85 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 44.845777][ C1] __neigh_create+0x31/0x40 [ 44.845806][ C1] ip6_finish_output2+0xaaf/0x18b0 [ 44.853579][ T731] usb 2-1: Product: syz [ 44.871433][ C1] ip6_finish_output+0x60b/0xbe0 [ 44.871467][ C1] ip6_output+0x1fa/0x410 [ 44.871486][ C1] ndisc_send_skb+0x7c8/0xcd0 [ 44.871504][ C1] page_owner free stack trace missing [ 44.871510][ C1] [ 44.871514][ C1] Memory state around the buggy address: [ 44.881750][ T28] audit: type=1400 audit(1789398184.102:324): avc: denied { append open } for pid=85 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 44.901560][ C1] ffff8881313f8c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 44.901574][ C1] ffff8881313f8d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 44.901583][ C1] >ffff8881313f8d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 44.901590][ C1] ^ [ 44.901597][ C1] ffff8881313f8e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.901606][ C1] ffff8881313f8e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.901613][ C1] ================================================================== [ 44.901656][ C1] Disabling lock debugging due to kernel taint [ 44.919798][ T731] usb 2-1: Manufacturer: syz [ 45.055397][ T731] usb 2-1: SerialNumber: syz [ 45.273437][ T731] usb 2-1: 0:2 : does not exist [ 45.283076][ T731] usb 2-1: USB disconnect, device number 4