last executing test programs:

1m43.359727557s ago: executing program 1 (id=76):
r0 = memfd_create(&(0x7f00000009c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9\xd6\x1c\x1b*\x9a!?\x7f\xa5\xad\x9a,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf#2\x99\x1e\xa1`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\f<\x8f\xc1\x99\x89r\xe1?\xbdu\x98\xc3\xf8\xd2Q#\xc6g\xa0\x85\xd6G\x85\x11X\x8d,\x02\xd45\xb8\xca\x97\x9d\xcb\x1e\x80\xd6\xd5>N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec\x8aog\x87BR\x9d\xad\xd4FcB\xda\x95\xc3\xdd\x9d\x8f\x1a\xce\x18\x80\"j\xe1\xba\x1e\x97uX\xccv\xd6\vcz\x92A^\xbc\xceF\xf7\xe5:\xaf\xc5~\xbcJ e\r\x88c\x9d\xb92\xb6i4zq\xb3c\x0f\xb2t\x93\xf2E6b\xfa\xcdJ5\xe3W]`4\xd8D\x05\v\xfc)\xca\xedQ\xd0]Ot\'\xc2tDF\xf9\xa7\xb5(\x83\xa5\x0f\x1d\x1d\x06Dg\x13>\x19\xe85#\aaT\x89=\x104\xd5\x85Q\x96\x91\xea\x172P\xb3:\xadZ\xbc\xbe\x00\xf0\x14\x96\xd9M\xd7\x88QZs\xb2\xe1+$jfQodH\x05/y`~Mx\x02\x00(v\xe6`\x026\xfcgC\xb5\xf0\x13.zb\xc5bj+@\x00\x00\x00\x00\x00\x8e[\xb3\xa3\x87\xb9\xe2_Z\x11\xef\xc2]V\xf3\x03\x94\xb9\xe1\xa68\x8d\\\xe5\xef\xacpM\xf0\xa6\x04\x10\xb7\xc0t\x83\\\xf7\x12k\x9f\x10\xd5Z\x19\xc1\xc1\x80\\o\x97\xce=U\xdd\xaa\x1b\x05\x14\x13\xa6\xbd#\xde\x04\xe6$\xec$3\xf6\x97\xc6\xeaSL\xb7A72M\x88k@\xe5\xa3\n&\x1e\xc84\xa9\xe2\xccM\x906\x95xQ-2p\xd62\'\xec\x0f\x13;I\x95TE_\r\xe7\t!A\x05\xe4\x8f\x9e0\xf8/T\x18\xf7\xa1\x9f\xde1\xd5\x80<\xf5\b\xa9\xec\x85\xaeW\xb3\xd8#)bn \xfb\xf2\x88\xfaR\xff\xdd\x80\x96_\xec5\xf0\x1c\a\x8a\x80\x00@=\r8u+%f:\x1e\x82\xfap\xf6\x89\xea\xba\xe3\xbbM%F\xdb\\\xd1eJJ*\xc67\xca\x03\xa3\xf7(\xbb\xecN\xd4\xe7\xf2:u\x8a\b\xd5\v\xca\xfd\\\xd6\xe3\x05\xb3\x03\xd5\xe0\xd2\xf2{&\x8b\xdf\xa1\xbe}\xb2\xe4y\xbb\xe6\x1f\x10c\xf5WQ\x82\x04\x01C\x83,\x90\x1a\xfa\x8e\x17\x89\xe2\xedX\x8d\rmq\t\xb5$\xb4\x9b\x92z\xd6/-\x13,\xb5%\x8eM/\x04\xa7\x7f\x1b\x85\xf1\xa4X\x17\xbb\x1cR14\xfb!\b\x10\xe8\xb2\xd41gK\xe4\xea\xe39d\bL\xe5\x1b\xbd[\x9bWD:\r&\xe9\vn^\xcc\x86\xe3\xce1>3{\xaa{\xbd0P\x9f\xa68\xf5\x82\xb8\x9aD\x9c{\xe6\xf8\xcbD\xb5aJ\xb0\x92\x89\xbc\x80\x1ch\x89\xe7\xdd]q\x0e,>/\xaf|\xf0\x01V\x7f\xc9?\xba\x16\xe4$+\x02\x00\x00\x00\x00\x00\x00\x00\xa5\x94d9\xaf\xcfq\x8b=\x026\xef\r\x91\x18\xc5\xb6\xb9fM\x8ayZ\xbcd\xa5\x8a\x88\x98\xc3\xfc`\xa6\xba\x1f\x17\v$\x88g\xb4\xad\b\xc1\xddW\xa6\xc1\xb7\xb0\xa3\x84Q\x13GoU\xe2\xb7\x03\x9c\xd5\x0f\xa8\x0ef\"\x15\x82\xe7\xbd\xf8\xca\x10f\xfe6h\xe9\xc3\xc2\xa0O:\xac~\x1a\xf7\xbeF\xbe\xe5\xf0\x81\xd6&\xc0<Q8\xbeX\xde\xd6 \xef\x0e\xc2.\x9c=1\x15d\xddIv\x0fh\xe6M(D\xad\xeb\xcfX8\xb9\x8d\xbe(\xd3\x16?x\xbd@\x0f\xf5\xdb\xeb\xd7i*\xea\x86JX\xff;\x96\xbb\xa7\xa8u5R\xa2,\xba\xbc\x01\x12\xb3q,\x9d\xf8\xbdb`\xb3\xc6\x0f\xb3\xac\xc7\xa4O@\x81\xfc\x1a4$\x885\x97\xa9|\x99\x86*.\xda\x96RQ\xe5\xb1\xef\xb7\x10\x99\xd4\xa7\b\xcd\xe9\xa5\xf6wR\xc1\xdfH).\a\x9a\xab\x9e&+\xc4#\x90\xc9%\xb9\xd7o\x86\x13\a\xc0\x01w9u6\xdd\x9fJ^o\x1d\xda\x11?\xc1\xf5\xf7\xff\xec\x916\xceQ\xcfU\x035\x96\x8f\xc7\x84\"2\xef\x02\xcf\a+\x8a\xd1\x11\xb5\xa8\x92\f\xb3R\",\xfc!_&pD\xeb5\xc6\xc8\xff2\xee\x14\x83\x14l\x04\x80\xaa7\x80\xf1\x18\xf5\xa5\xd23\xe5\b\x00\xe8\x9c\xd4\xd0\a\x93#\xb9Z\xc0y\x97<\xe5i\xe9\xe4\xb02Cu\xe1d\r\x0e\xc1\xf1\x81^\xa7\xffz)\x19U\xe5\xd4\xf5@O#W\x8a\xbb3c+\n\x97\xa6\xf7\x90$\xd6*\xd0\x1b\x10\xe4HM:XO\x1b\rx\xc7\x12|\x7fN\xc9\xf9i\xe4\xe5-\x9b\xe407\x9d\xe8\xc6\x90\x9f_Jf\x05\r\x1b\x9af\v\xbcv\x83\xf3j\xaf\xd0F91 ^x\x85\x80[\xa3B\n#!\xc2R\xdd\xf4)\xba\x1e\xfb6U\xabc\xda\x9a)\xc3\x9a\x06\xc5\xccP)\xdf.\xa7-\x84\xdf8\xbf\xfc1^}B\xee\xccR/z\x1e\xe8\x1e\x99\x99\n\xf4u\xd4\xbd^L\xb2j\xda\xff\x1d\x10\xc8\xad\xbd_OI\xb1\xe8y\x003\a\x06\x92\x8e\n\x8b\xf3\xd4G\x85\xbd\x1a\x81+3\x99jq\xd1\xacK^\xef\xb6!8\xcd?\x1e\\\x16W2\xbd4$zn\xa9\x7f\x9dE\xaf\x0f\xdb\xe0\xfa\x10\xc3\xb2\xf8\x80\x8c\xec$\xda\xc0\x94y1\t\xc5', 0x3)
write$binfmt_misc(r0, &(0x7f0000000180)='Eh', 0x2)
execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000)

1m31.607035008s ago: executing program 0 (id=78):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100))
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
r4 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}, @flat=@binder={0x73622a85, 0x0, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x50, 0x0, &(0x7f0000000740)=[@free_buffer={0x40086303, r4}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

1m28.489451755s ago: executing program 1 (id=79):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000200)='proc\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/kallsyms\x00', 0x0, 0x0)

1m22.560586671s ago: executing program 0 (id=80):
r0 = syz_usb_connect$cdc_ncm(0x0, 0x92, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902800002010000000904000001020d0000052406000105240000000d240f0100000000000000000006241a000000072414060005001524120004a317a88b045e4f01a607c0ffcb7e392a08241c0200bed49f090581030002f800000904010000020d000009040101"], 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000640)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000500)={0x20, 0x80, 0x1c, {0x8, 0x3, 0x279, 0x8, 0x2, 0x200, 0x46e, 0x1, 0x40, 0xd1, 0x805, 0xffff}}, 0x0, 0x0, 0x0, 0x0})

1m20.352542273s ago: executing program 1 (id=81):
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$inet_int(r0, 0x0, 0xb, &(0x7f0000000040)=0x3, 0x4)
setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x1a, &(0x7f0000000240)={0x1, 'veth0_to_team\x00'}, 0x18)
syz_emit_ethernet(0xb6, &(0x7f0000000080)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x1b, 0xa8, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x23, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x7, @loopback, @rand_addr=0x640100fe, {[@cipso={0x86, 0x70, 0xffffffffffffffff, [{0x0, 0xe, "08c82ce8da6ee06cb8dd9452"}, {0x5, 0x9, "020007651442eb"}, {0x1, 0xe, "7434954373561de584b703c8"}, {0x0, 0x2}, {0x2, 0x7, "cfa11cab1a"}, {0x0, 0x10, "84a4913275be675de6a70a05a0dc"}, {0x6, 0xa, "ed66554900000000"}, {0x2, 0x12, "73bc23f9ffffffa30900a301c8460028"}, {0x0, 0x10, "c8f46976e79ea788f03d9d320592"}]}, @cipso={0x86, 0x6, 0x20}]}}}}}}}, 0x0)

1m1.624805715s ago: executing program 0 (id=82):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x1, 0x1, 0x201, 0x0, 0x0, {0x0, 0x0, 0x6}, [@CTA_MARK={0x8, 0x8, 0x1, 0x0, 0xc}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004094}, 0x4010)

58.826955712s ago: executing program 1 (id=83):
r0 = getpid()
r1 = syz_pidfd_open(r0, 0x0)
setns(r1, 0x24020000)
r2 = landlock_create_ruleset(&(0x7f0000000080)={0xc0d8, 0x1, 0x3}, 0x18, 0x0)
landlock_restrict_self(r2, 0x0)
landlock_restrict_self(r2, 0x0)
landlock_restrict_self(r2, 0x0)
r3 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0)
r4 = landlock_create_ruleset(&(0x7f0000000080)={0x2832, 0x0, 0x2}, 0x18, 0x0)
landlock_restrict_self(r4, 0x0)
landlock_restrict_self(r3, 0x0)
landlock_restrict_self(r3, 0x0)
umount2(&(0x7f0000000040)='.\x00', 0x2)

42.14958223s ago: executing program 0 (id=84):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100))
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
r4 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}, @flat=@binder={0x73622a85, 0x0, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x50, 0x0, &(0x7f0000000740)=[@free_buffer={0x40086303, r4}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

35.040624348s ago: executing program 1 (id=85):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000200)='proc\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/kallsyms\x00', 0x0, 0x0)

17.446676238s ago: executing program 0 (id=86):
r0 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0xf7d2e009596a8169})

10.194479072s ago: executing program 1 (id=87):
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil)
sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0)
write$char_usb(r0, &(0x7f0000000300)="c4", 0x1)

0s ago: executing program 0 (id=88):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000003280)={0x73622a85, 0x100b, 0x4})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@acquire], 0xffffffffffffff47, 0x0, 0x0})
dup3(r1, r0, 0x0)
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x10000000000)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0xfffffffffffffffd})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000940)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000400)={@ptr={0x66642a85, 0x0, 0x0, 0x0, 0x80000001, 0x3e}, @ptr={0x70742a85, 0x20000000, &(0x7f0000000580)=""/226, 0xe2, 0x1, 0x17}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x1, 0x12}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1040}], 0x0, 0x0, 0x0})

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:11494' (ED25519) to the list of known hosts.
syzkaller login: [  698.687523][ T3218] cgroup: Unknown subsys name 'net'
[  699.547890][ T3218] cgroup: Unknown subsys name 'cpuset'
[  699.754224][ T3218] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[  796.020600][ T3218] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[  942.811410][ T3225] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  943.057768][ T3225] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  949.512184][ T3224] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  950.016002][ T3224] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  967.450424][ T3225] hsr_slave_0: entered promiscuous mode
[  967.569692][ T3225] hsr_slave_1: entered promiscuous mode
[  980.640441][ T3224] hsr_slave_0: entered promiscuous mode
[  980.693020][ T3224] hsr_slave_1: entered promiscuous mode
[  980.728904][ T3224] debugfs: 'hsr0' already exists in 'hsr'
[  980.731590][ T3224] Cannot create hsr debugfs directory
[  983.971792][ T3225] netdevsim netdevsim0 netdevsim0: renamed from eth0
[  984.232976][ T3225] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  984.300474][ T3225] netdevsim netdevsim0 netdevsim1: renamed from eth1
[  984.409953][ T3225] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  985.288237][ T3225] netdevsim netdevsim0 netdevsim2: renamed from eth2
[  985.397134][ T3225] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  985.778375][ T3225] netdevsim netdevsim0 netdevsim3: renamed from eth3
[  986.309167][ T3225] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  995.172485][ T3224] netdevsim netdevsim1 netdevsim0: renamed from eth0
[  995.389616][ T3224] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  995.553655][ T3224] netdevsim netdevsim1 netdevsim1: renamed from eth1
[  995.829567][ T3224] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  995.991934][ T3224] netdevsim netdevsim1 netdevsim2: renamed from eth2
[  996.202496][ T3224] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  996.291474][ T3224] netdevsim netdevsim1 netdevsim3: renamed from eth3
[  996.903883][ T3224] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 1012.517393][ T3225] 8021q: adding VLAN 0 to HW filter on device bond0
[ 1026.740027][ T3224] 8021q: adding VLAN 0 to HW filter on device bond0
[ 1126.896081][ T3225] veth0_vlan: entered promiscuous mode
[ 1127.990960][ T3225] veth1_vlan: entered promiscuous mode
[ 1131.701617][ T3225] veth0_macvtap: entered promiscuous mode
[ 1132.469246][ T3225] veth1_macvtap: entered promiscuous mode
[ 1139.351339][   T53] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 1139.763777][   T53] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 1141.160466][ T3224] veth0_vlan: entered promiscuous mode
[ 1141.271322][ T3361] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 1142.430382][ T3356] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 1144.744997][ T3224] veth1_vlan: entered promiscuous mode
[ 1151.783465][ T3224] veth0_macvtap: entered promiscuous mode
[ 1153.108304][ T3224] veth1_macvtap: entered promiscuous mode
[ 1155.315793][ T3225] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 1160.521256][  T991] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 1161.377208][ T3356] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 1161.396164][ T3356] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 1161.952351][ T3356] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 1231.110910][ T3728] usb 2-1: new high-speed USB device number 2 using dummy_hcd
[ 1233.962818][ T3728] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 1233.988809][ T3728] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[ 1235.131749][ T3728] usb 2-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00
[ 1235.143891][ T3728] usb 2-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0
[ 1235.160633][ T3728] usb 2-1: Manufacturer: syz
[ 1236.571103][ T3728] usb 2-1: config 0 descriptor??
[ 1241.660668][ T3728] usb 2-1: can't set config #0, error -71
[ 1242.080879][ T3728] usb 2-1: USB disconnect, device number 2
[ 1247.731450][ T3887] capability: warning: `syz.1.10' uses deprecated v2 capabilities in a way that may be insecure
[ 1322.968935][ T3923] binder_alloc: 3922: binder_alloc_buf, no vma
[ 1375.565965][   T24] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[ 1378.699137][   T24] usb 1-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[ 1378.707316][   T24] usb 1-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7
[ 1378.712950][   T24] usb 1-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024
[ 1378.724079][   T24] usb 1-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00
[ 1378.739926][   T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1379.385553][ T3957] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[ 1387.092586][   T24] aiptek 1-1:17.0: Aiptek using 400 ms programming speed
[ 1388.384022][   T24] input: Aiptek as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:17.0/input/input1
[ 1391.170872][ T3971] binder: 3963:3971 ioctl 4018620d 0 returned -22
[ 1393.197970][    C1] aiptek 1-1:17.0: aiptek_irq - usb_submit_urb failed with result -19
[ 1393.209546][   T24] usb 1-1: USB disconnect, device number 2
[ 1448.968252][ T4003] binder: 4000:4003 ioctl 4018620d 0 returned -22
[ 1492.376331][ T4025] binder: BINDER_SET_CONTEXT_MGR already set
[ 1492.396258][ T4025] binder: 4024:4025 ioctl 4018620d 200000004a80 returned -16
[ 1492.747616][ T4025] binder: 4024:4025 ioctl c0306201 0 returned -14
[ 1535.571398][ T4049] binder: 4045:4049 ioctl c0306201 0 returned -14
[ 1540.002541][ T4053] netlink: 12 bytes leftover after parsing attributes in process `syz.1.51'.
[ 1540.034152][ T4053] netlink: 20 bytes leftover after parsing attributes in process `syz.1.51'.
[ 1565.280356][ T4068] binder: 4067:4068 ioctl c0306201 0 returned -14
[ 1625.437814][   T24] usb 1-1: new high-speed USB device number 3 using dummy_hcd
[ 1626.970098][   T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 1626.981472][   T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[ 1627.008674][   T24] usb 1-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00
[ 1627.022385][   T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1628.019131][   T24] usb 1-1: config 0 descriptor??
[ 1635.403101][   T24] usbhid 1-1:0.0: can't add hid device: -32
[ 1635.438171][   T24] usbhid 1-1:0.0: probe with driver usbhid failed with error -32
[ 1637.417225][ T3152] usb 1-1: USB disconnect, device number 3
[ 1718.251154][ T4144] process 'syz.1.76' launched '/dev/fd/3' with NULL argv: empty string added
[ 1739.236955][ T4106] usb 1-1: new high-speed USB device number 4 using dummy_hcd
[ 1740.857983][ T4106] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 1740.868934][ T4106] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 248, changing to 11
[ 1743.247742][ T4106] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[ 1743.256682][ T4106] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1743.262196][ T4106] usb 1-1: Product: syz
[ 1743.263760][ T4106] usb 1-1: Manufacturer: syz
[ 1743.268907][ T4106] usb 1-1: SerialNumber: syz
[ 1750.160010][ T4106] cdc_ncm 1-1:1.0: bind() failure
[ 1750.667364][ T4106] cdc_ncm 1-1:1.1: CDC Union missing and no IAD found
[ 1750.680462][ T4106] cdc_ncm 1-1:1.1: bind() failure
[ 1751.839532][ T3220] usb 1-1: USB disconnect, device number 4
[ 1816.286017][    C0] ------------[ cut here ]------------
[ 1816.286437][    C0] kernel BUG at [] mm/page_table_check.c:118!
[ 1816.287932][    C0] Kernel BUG [#1]
[ 1816.288269][    C0] Modules linked in:
[ 1816.289704][    C0] CPU: 0 UID: 0 PID: 4183 Comm: syz.1.87 Not tainted syzkaller #0 PREEMPT 
[ 1816.290365][    C0] Hardware name: riscv-virtio,qemu (DT)
[ 1816.291072][    C0] epc : page_table_check_set+0x9ca/0xc72
[ 1816.293554][    C0]  ra : page_table_check_set+0x9ca/0xc72
[ 1816.294232][    C0] epc : ffffffff80c81874 ra : ffffffff80c81874 sp : ffff8f800a5d6fd0
[ 1816.294642][    C0]  gp : ffffffff8a4a7c60 tp : ffffaf801c338000 t0 : ffffaf801a2ea130
[ 1816.295031][    C0]  t1 : fffff5ef027a5809 t2 : ffffffff80a99cc0 s0 : ffff8f800a5d7050
[ 1816.295421][    C0]  s1 : 0000000000000001 a0 : 0000000000000001 a1 : 0000000000000000
[ 1816.295787][    C0]  a2 : 0000000000080000 a3 : ffffffff80c81874 a4 : ffff8f800515c1b8
[ 1816.296176][    C0]  a5 : 00000000000af1b8 a6 : 0000000000000003 a7 : ffffaf8013d2c04b
[ 1816.296580][    C0]  s2 : 00000000000b3c00 s3 : 0000000000000000 s4 : ffffaf8013d2c000
[ 1816.297360][    C0]  s5 : 0000000000000200 s6 : 0000000000000001 s7 : dfffffff00000000
[ 1816.297842][    C0]  s8 : ffffffff88c5a580 s9 : 0000000000007fff s10: 0000000000000000
[ 1816.298279][    C0]  s11: ffffffff8a5c6ce0 t3 : 0000000000000001 t4 : fffff5ef027a5809
[ 1816.298698][    C0]  t5 : fffff5ef027a580a t6 : 0000000000000002 ssp : 0000000000000000
[ 1816.299085][    C0] status: 0000000200000120 badaddr: ffffffff80c81874 cause: 0000000000000003
[ 1816.299635][    C0] [<ffffffff80c81874>] page_table_check_set+0x9ca/0xc72
[ 1816.300645][    C0] [<ffffffff80c81fe4>] __page_table_check_ptes_set+0x264/0x47c
[ 1816.301293][    C0] [<ffffffff80c0a63e>] split_huge_pmd_locked+0x1eb2/0x23f0
[ 1816.301897][    C0] [<ffffffff80c0ae26>] __split_huge_pmd+0x2aa/0x3d4
[ 1816.302418][    C0] [<ffffffff80a7eee8>] move_page_tables+0x9f6/0x3cc4
[ 1816.303137][    C0] [<ffffffff80a823ec>] copy_vma_and_data+0x236/0x692
[ 1816.303859][    C0] [<ffffffff80a82d48>] move_vma+0x500/0x16d6
[ 1816.304599][    C0] [<ffffffff80a8413a>] mremap_to+0x21c/0x474
[ 1816.305278][    C0] [<ffffffff80a84a8a>] __do_sys_mremap+0x6f8/0x16ca
[ 1816.305986][    C0] [<ffffffff80a85afc>] __riscv_sys_mremap+0xa0/0x124
[ 1816.306702][    C0] [<ffffffff80078f30>] syscall_handler+0x92/0x114
[ 1816.307350][    C0] [<ffffffff8651fb84>] do_trap_ecall_u+0x3e4/0x636
[ 1816.307912][    C0] [<ffffffff8654beb0>] handle_exception+0x168/0x174
[ 1816.309488][    C0] Code: c097 ff8a 80e7 f460 82e3 e404 c097 ff8a 80e7 4440 (9002) c097 
[ 1816.311236][    C0] ---[ end trace 0000000000000000 ]---
[ 1816.313727][    C0] Kernel panic - not syncing: Fatal exception in interrupt
[ 1816.315425][    C0] SMP: stopping secondary CPUs

VM DIAGNOSIS:
04:25:20  Registers:
info registers vcpu 0

CPU#0
 V      =   0
 pc       ffffffff81fd9b00
 mhartid  0000000000000000
 mstatus  0000000a000001a0
 hstatus  0000000200000000
 vsstatus 0000000a00000000
 mip      0000000000000220
 mie      000000000000022a
 mideleg  0000000000001666
 hideleg  0000000000000000
 medeleg  0000000000f4b509
 hedeleg  0000000000000000
 mtvec    00000000800004f8
 stvec    ffffffff8654bd48
 vstvec   0000000000000000
 mepc     ffffffff80092d8e
 sepc     ffffffff80c81874
 vsepc    0000000000000000
 mcause   0000000000000009
 scause   0000000000000003
 vscause  0000000000000000
 mtval    0000000000000000
 stval    ffffffff80c81874
 htval    0000000000000000
 mtval2   0000000000000000
 mscratch 0000000080049000
 sscratch 0000000000000000
 satp     90218000000a2802
 x0/zero  0000000000000000 x1/ra    ffffffff81fd9ad0 x2/sp    ffff8f800a5d6790 x3/gp    ffffffff8a4a7c60
 x4/tp    ffffaf801c338000 x5/t0    4900000000000000 x6/t1    ffffffff8a5bba40 x7/t2    49552030203a5550
 x8/s0    ffff8f800a5d67d0 x9/s1    0000000000000000 x10/a0   ffffffff9186d308 x11/a1   000000000000001f
 x12/a2   0000000000000000 x13/a3   ffffffff81fd9ad0 x14/a4   1ffffffff230da61 x15/a5   ffff8f800006b000
 x16/a6   0000000000ff0100 x17/a7   0000000000000003 x18/s2   ffffffff9186d2c0 x19/s3   0000000000000061
 x20/s4   0000000000000000 x21/s5   0000000000000000 x22/s6   0000000000000000 x23/s7   0000000000000003
 x24/s8   0000000000000001 x25/s9   1ffff1f0014bad04 x26/s10  ffffffff9186d318 x27/s11  0000000000000061
 x28/t3   ffffffff81fec9b6 x29/t4   fffff1ef014bace4 x30/t5   fffff1ef014bace5 x31/t6   ffffffff9167b1f7
 fcsr     0000000000000000
 f0/ft0   0000000000000000 f1/ft1   0000000000000000 f2/ft2   0000000000000000 f3/ft3   0000000000000000
 f4/ft4   0000000000000000 f5/ft5   0000000000000000 f6/ft6   0000000000000000 f7/ft7   0000000000000000
 f8/fs0   0000000000000000 f9/fs1   0000000000000000 f10/fa0  0000000000000000 f11/fa1  0000000000000000
 f12/fa2  0000000000000000 f13/fa3  0000000000000000 f14/fa4  0000000000000000 f15/fa5  0000000000000000
 f16/fa6  0000000000000000 f17/fa7  0000000000000000 f18/fs2  0000000000000000 f19/fs3  0000000000000000
 f20/fs4  0000000000000000 f21/fs5  0000000000000000 f22/fs6  0000000000000000 f23/fs7  0000000000000000
 f24/fs8  0000000000000000 f25/fs9  0000000000000000 f26/fs10 0000000000000000 f27/fs11 0000000000000000
 f28/ft8  0000000000000000 f29/ft9  0000000000000000 f30/ft10 0000000000000000 f31/ft11 0000000000000000
info registers vcpu 1

CPU#1
 V      =   0
 pc       ffffffff800894b0
 mhartid  0000000000000001
 mstatus  0000000a000001a0
 hstatus  0000000200000000
 vsstatus 0000000a00000000
 mip      0000000000000020
 mie      000000000000022a
 mideleg  0000000000001666
 hideleg  0000000000000000
 medeleg  0000000000f4b509
 hedeleg  0000000000000000
 mtvec    00000000800004f8
 stvec    ffffffff8654bd48
 vstvec   0000000000000000
 mepc     ffffffff81919cea
 sepc     ffffffff81919cea
 vsepc    0000000000000000
 mcause   8000000000000003
 scause   8000000000000001
 vscause  0000000000000000
 mtval    0000000000000000
 stval    0000000000000000
 htval    0000000000000000
 mtval2   0000000000000000
 mscratch 0000000080047000
 sscratch 0000000000000000
 satp     90131000000afa83
 x0/zero  0000000000000000 x1/ra    ffffffff800894ac x2/sp    ffff8f8000017e10 x3/gp    ffffffff8a4a7c60
 x4/tp    ffffaf801b501ac0 x5/t0    ffff8f8000010000 x6/t1    fffffffef14b7720 x7/t2    ffffffff9187f628
 x8/s0    ffff8f8000017e40 x9/s1    ffffffff86a0cd08 x10/a0   0000000000000001 x11/a1   0000000000000004
 x12/a2   0000000000000001 x13/a3   ffffffff800894ac x14/a4   0000000000000000 x15/a5   ffffaf801b501ac0
 x16/a6   fffffffef14b7721 x17/a7   0000000000000003 x18/s2   0000000000000001 x19/s3   ffffffff86868000
 x20/s4   ffffffff800891f6 x21/s5   ffffaf8012118800 x22/s6   0000000000000000 x23/s7   0000000000000001
 x24/s8   0000000000000007 x25/s9   ffffffff9187f628 x26/s10  ffffffff86a70da0 x27/s11  0000000000000004
 x28/t3   ffffffff8809bec8 x29/t4   fffffffef14b7720 x30/t5   fffffffef14b7721 x31/t6   ffffffff8687fb00
 fcsr     0000000000000000
 f0/ft0   0000000000000000 f1/ft1   0000000000000000 f2/ft2   0000000000000000 f3/ft3   0000000000000000
 f4/ft4   0000000000000000 f5/ft5   0000000000000000 f6/ft6   0000000000000000 f7/ft7   0000000000000000
 f8/fs0   0000000000000000 f9/fs1   0000000000000000 f10/fa0  0000000000000000 f11/fa1  0000000000000000
 f12/fa2  0000000000000000 f13/fa3  0000000000000000 f14/fa4  0000000000000000 f15/fa5  0000000000000000
 f16/fa6  0000000000000000 f17/fa7  0000000000000000 f18/fs2  0000000000000000 f19/fs3  0000000000000000
 f20/fs4  0000000000000000 f21/fs5  0000000000000000 f22/fs6  0000000000000000 f23/fs7  0000000000000000
 f24/fs8  0000000000000000 f25/fs9  0000000000000000 f26/fs10 0000000000000000 f27/fs11 0000000000000000
 f28/ft8  0000000000000000 f29/ft9  0000000000000000 f30/ft10 0000000000000000 f31/ft11 0000000000000000