last executing test programs: 4.930708963s ago: executing program 1 (id=45): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000140)={0x1, 0x6}, 0x4) (async) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000100)={0x1, &(0x7f0000000180)=[{0x28, 0x0, 0xd, 0xfffff034}]}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) (async, rerun: 64) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x4000)=nil, 0x5bbf91a1e7f99074, &(0x7f0000000000)) (rerun: 64) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x3000)=nil, 0x3000, &(0x7f0000000100)='\x00') prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffb000/0x3000)=nil, 0x3000, &(0x7f0000000000)='\xff\xff\xff\xff\xff\xff') (async) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, &(0x7f00000001c0)='9p\x00\xfal\x170\x10w\v\xc5\x7f\x1d\x9bZ\x9d\xc1\x91\xc7f#V\xba(\xe4\xbd\xb5\a\xab\x88\x8c\xd8@\x1c_\xf4Z\xff\x8d\xfdy\xb9O\x8e\x87\x03\xd3\x01\xcb\xae\xf1\xd3\xb7\xfa\x86\xef\xcf\x1f\xf3\xd4\xb4r{\x10i\xdeX\x03\x1d|_\'\xdeRc\xa4\xd7\xaab\x88?I*6\xd7\xe7\xa6\x9d\xbb \xa4\xae#w`\xb8\x1d\xb3\xdc\xbby\xf74\x1cd85A\xbdz\xff\xbc\x1d;,\xa9h\xf5K\xc06P') ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f00000002c0)={'ip6gre0\x00', @broadcast}) 4.812670307s ago: executing program 1 (id=47): r0 = syz_open_dev$loop(&(0x7f0000000200), 0x4, 0x40100) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cpuset.effective_cpus\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000005c0)={r1, 0x800, {0x2a00, 0x80010000, 0x0, 0x5, 0x0, 0x0, 0x0, 0x1c, 0x1c, "fee8a2ab78fc179fd1f8a0e9a1af1ea09dc2b7fb0a010000000000000000030000000000000000000000000000000000000000000000001b00", "28095397bab22d0000b42076c1ce8ef05f819e01177d3d458dac0000000000000000000800000000003788cf8f00", "90be8b1c5512406c7f00", [0x4, 0xa]}}) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xb) r2 = syz_open_dev$loop(&(0x7f0000000300), 0x8f, 0x40240) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000003280)={0x73622a85, 0xa, 0x4}) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@increfs], 0x0, 0x0, 0x0}) dup3(r4, r3, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000540)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0xfffffffffffffffd}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0xffffffffffffff67, 0x0, 0x0}) mount_setattr(0xffffffffffffffff, 0x0, 0x8100, 0x0, 0x0) r6 = socket$nl_audit(0x10, 0x3, 0x9) getsockopt(r6, 0x1, 0x9, 0x0, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000800)={@ptr={0x66642a85, 0x0, 0x0, 0x0, 0x2, 0x1a}, @ptr={0x70742a85, 0x20000000, &(0x7f0000001140)=""/236, 0xec, 0x1, 0x26}, @fda={0x66646185, 0x9, 0x1, 0xb8}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1040}], 0x0, 0x0, 0x0}) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f0000001280)={r0, 0x0, {0x2a12, 0x80010000, 0x0, 0x9, 0x5, 0x0, 0x0, 0x18, 0x11, "fee8a2ab78fc179fd1f809000006aca7ca64c6a4b4e00d9683dda1af01000000deff12001000000000000000000000000008000000000100", "2809e8dbe1b22d0000b420b4a93c7540f476779e01176100d4070000ebff08000000000000000000020000000800000000faffffff00", "e3460000102027000000e44400000020f1ff00000000720000002000", [0xe0, 0x4]}}) 4.794267697s ago: executing program 1 (id=48): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f00000000c0)={0xcf47, 0x4cc, 0xffff, 0x9dff, 0x1, "8003e3ffff072000"}) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000200)={0x0, 0x0, 0x3, 0x7fff, 0x16, "b0bf2ebb48c849ac0000000003000018bfff40"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000140)=0x12) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), r3) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r4, 0x1, 0x70bd26, 0x25dfdbfc, {}, [@NL80211_ATTR_REG_ALPHA2={0x6, 0x21, 'b\x00'}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x800) sendmsg$NL80211_CMD_RELOAD_REGDB(r2, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, r4, 0x2, 0x70bd27, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r2) sendmsg$TIPC_NL_BEARER_SET(r5, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000400)={0x7c, r6, 0x800, 0x70bd26, 0x25dfdbff, {}, [@TIPC_NLA_MON={0x3c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x85b}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xb37}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x800}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}]}, @TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7f}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x9b6}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x40000}, 0xd1) syz_usb_connect(0x0, 0x47, &(0x7f0000000380)={{0x12, 0x1, 0x200, 0xe1, 0xcd, 0x31, 0x40, 0x46d, 0x8c6, 0xc2f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x35, 0x1, 0x2, 0x69, 0x30, 0x2, "", [{{0x9, 0x4, 0xb8, 0x9, 0x0, 0x1, 0x1, 0xd0, 0x9, [@cdc_ecm={{0x5}, {0x5, 0x24, 0x0, 0x9}, {0xd, 0x24, 0xf, 0x1, 0x616, 0x401, 0x6, 0xff}, [@call_mgmt={0x5, 0x24, 0x1, 0x1, 0x6}, @network_terminal={0x7, 0x24, 0xa, 0x7, 0x95, 0x4d, 0xfd}]}]}}]}}]}}, 0x0) 4.368371442s ago: executing program 2 (id=54): syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000040)=ANY=[@ANYBLOB="1201100100000010cc17111040000102030109026e000301ffc000080b000201253007090400000001013049eb34433ac5ab522a39ee736cd8a935fb9f093b8a72beab1b6a498d362a14fdbece605b37e6a1e28c5dbb83056694b37734230ca1b229cb2fe8b510dc83fc20ce12716e80ad9e165027c16581ff49b6d6498674c5194547deb8cda1dc6da889ca4325d969bf547981f614ea7adee1dc66fb2c47"], 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x2, 0x0, 0x1}, {0x1d, 0x0, 0x0, 0x1}, {0x6, 0x0, 0x0, 0x7ffffcb9}]}) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000240)=0x1, 0x4) (async, rerun: 32) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e04, @dev={0xac, 0x14, 0x14, 0x59}}, 0x10) (async, rerun: 32) shutdown(r0, 0x1) (async) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f00000003c0)=0x2, 0x4) (async) recvmmsg(r0, &(0x7f00000005c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x40000142, 0x0) (async) socket$inet(0x2, 0x3, 0x1) mount$cgroup2(0x0, &(0x7f0000000240)='./cgroup\x00', &(0x7f0000000300), 0x4006, &(0x7f0000000480)={[{@memory_recursiveprot}]}) (async) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') pread64(r1, &(0x7f0000001240)=""/102400, 0x19000, 0xfffff7ff8) (async) r2 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) r3 = fcntl$dupfd(r2, 0x406, r2) ioctl$USBDEVFS_SUBMITURB(r3, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000080)={0x80, 0xa, 0x0, 0x0, 0x7995}, 0x8416, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) (async, rerun: 64) ioctl$USBDEVFS_REAPURB(r2, 0x4008550c, &(0x7f0000000140)) (async, rerun: 64) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) (async) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='fdinfo/3\x00') read$eventfd(r5, &(0x7f0000000380), 0x8) (async) ioctl$BTRFS_IOC_QUOTA_CTL(r5, 0xc0109428, &(0x7f0000000100)={0x3, 0x1}) syz_open_procfs(r4, 0x0) (async) openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x44040, 0x0) 3.647822046s ago: executing program 2 (id=57): setuid(0xee00) r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r0, 0x0, 0x1, &(0x7f00000015c0)=0x1, 0x4) getsockopt$WPAN_SECURITY(r0, 0x0, 0x1, 0x0, &(0x7f0000001640)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/wakeup_count', 0x202, 0x40) write$cgroup_pressure(r2, &(0x7f0000000080)={'some', 0x20, 0x56, 0x20, 0xe}, 0x19) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) ioprio_set$pid(0x2, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RELOAD_REGDB(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x14, r4, 0x421, 0x70bd2c, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0xc35d4f6d52288271}, 0x200048c4) ioctl$sock_SIOCETHTOOL(r1, 0x89f1, &(0x7f0000000340)={'ip6tnl0\x00', &(0x7f0000000180)=@ethtool_test={0x1a, 0x2ae, 0xfffffffc, 0x5, [0x6, 0x61000000000000, 0x967, 0x3, 0x28000000]}}) socket$xdp(0x2c, 0x3, 0x0) 3.5403168s ago: executing program 2 (id=58): socket(0x28, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001bc0), 0x0, 0x0) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa82, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x7, 0x12, r1, 0xe851000) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000001180)=[{{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000001680)="73e074f2d7eab2bbc3fcb67e77bf56c8a2b5b4f45212793fbfb236e9501cfe0dffaba7f967d4e0efde1b348a8f23b44c1383f8f074519768284015f10fe13abae7f30396dbc670ed678f0b0ffef64e5909fde990d89b2f4504d6320cf53d96dca9d6a0a0fa49adda31537a40b978642d6257b5667bd962b4d3fb59f0b140b15c4f59f486c80f9956f13bfeb0ab22e76102d5c9f98c3c407191ec6a1bc07abc2f74e624e035c31b3cc20b39639f4fb242cdd3ab129fc72c9349157b7dc4b0d207985a0f279257220298e860205b887d3cef07da78823dea9392691e20a468b178ecc5c2cd310a2fd7325f29c8b4b6dd6af8a1c03a1a5f8d573983a3b49ddfd83b609fa18bc5f12c3076129d5b5dfd4210577687e4a8e6230d3b78bc62fa3fbfe5914a1d31e47d8492a27a722047eca048f164eea6d973b8c8eb73071b7d88fdce3baebff359da6b5f0c46e22552eac15e0aa43b119e2b18adad65e79008add20cd564bff9d1e99e6c091b35cfb22af3d877c4a41a4aa0bdc44a492c8835481c7a2e89e81a87350eca266971f892995bfe73d61da9fc71dd1507006028e4ab4fa22ecbed838b5f0b0e0fc9a88f4928a07726f163a2926ebc6c359f56bd42c9abdcc6d91645c199a35002aaad42e18c496c772d94d156744af47143041ae6a0694871248fd6488baa1982c8e63d46453ca0d1d5b47ebd93f395fee3a60ea4871a58118e08f2db1aff6be66187c2411f495d136678be34939c36c6835de15a43c4cdf481b72721439974d32986248ef06cd276b4d2aa761b9d959baa2101df0fa7bcab1c2979d98dd26566677ee3889418e9661d1bb6dd8a32cb1b4ca26803f007353f7e9713fc50e6dbaa63e45e4f5f7675c28958110b4b295d1e3f0586ebb037f2831fbe0cef2b8f9cdf7fd4bcace9942ffd277a5d6c1e9d370b3c5a81d9cc5442f2776cf9706c5e45a5120f5f1f330559a0185cc61fbba410e541d69dcde0044a4ec7925deb4049eec0afdf1035a6f70e337c3f921f234e774c5b9a5e8393e898c66bb35ce1efca3b2f70f4b03dcd016b1d3b1d1b1389fc3b06ede3a7b80274b186f5b6ea42d9cfb6a03747465e56cae72cbda0a8b907ae488062de4b731326e2b8228d0a165695341e26a3b969d77fb3d5cef939650bd62cdef2492a8d3f695998388203b4a6f2cff4c472d6b8bc7a9f5d6c5743d967e40be80a1c1bc260d0798808a9e0a70abaa8deb8a7006545015facc6633ff91f5e225466c5de9e0f4407bfe0ba3c8f90ddcbd7905f4c728cf9285772c5987fa7f47b0fe79a5244a9b7d0debd1ad338d87eaa7dee62ad6c9b2a5ee62e890b2489190baa8ca3180df13fdabd5f122db0bd27ad2c1a1088c7c0b87c0ff2e2ddfea9049437ed381458512026981c97c7c72eee75e0be532cf7de915c6fe315b0cebf05d23c9098d85b8d7030370bbea97b1f970b04ae7c2dcf587a9ba2ea984859ff450555f7f48910093291c1420361415d58b0f22da5c0d8bd809e0f4cf4e37e614a077723418a5ad21ff1d864a541c50f2559f4c4309070cae03a2e4db73f97a83bf1b39bd3175dd3158c2e665e325ed8d2cb6d70cc5d3a0cbee3df00c7dd744340802b3b9a02432912f5e063ee84839293324bda8b54cf0be2bbbc918a31582c257975f9923f5c1948a44580ec9f25510c5be28eca22e65c921eedf974f85e6aa399f62056659d74d069dc7e41855c0a64c46f8eebf3778367026415711d78d91a45ed32a0fc39ffb33b9bcefed1098d46e4130ca9e4feed811e4d127904e66565f9b13b402df94b2084d3dbdc861c2c04aae54befb70c61e6114993d1dd641f307d4ddb4b490dd3a3c86335488488a3ed06b435072a2f0818650e01d4228590d4a50c8c8c2853c055460ac3a9d5d3499d7a776bd47e585c3e3d2df680b8cac14b2b46d76ce893e47b6730e437fa18665edc29fae2316d28ba4149cf0e173a0c20532d4bbc407161ef76066d0bdd3409775ea7cff503d9c3dde7c4d99d54905abe71259505189438647af43e953fd84bfc1a3ee8cf4bfcd6b9a6119cc4c6070a5df565ffaa8d83b6d51b2697da1b02181381519e20bbab9fd37c303fbd3aa4bb2cb92a346d8902bc8b26e21e5200ae56a4f2d64c7f128932280bae60667e79fd0856ccae5fed8eb6bd5fdc68e6b1dc640fe2e714e8adc823aa07b25de7010f3638ae378864fca94c3ca3705bc0819a8bcd5c975e63130ac54fb2bb4512462e8d3725f4ed4a607c502eb082a5c99b517306b56360b98407e51dc52a20737794d81cd90a0f442f0cc88c7549eb9ffbd762cd50dac3043b410d7f1e52c82d91f95e6cb4d31e83f33ba0b97c834d31507593bc1380d20b94fdf100ffc3fa518a3e7e10ef82e85a4fd6f9b4b64c691b6363b6b3b336552575e3757293c7ab7e2ce8133cafb611ff2d1e1162e80c6fcf229fd9d5ca66325ce599419ab51ced744e5f42983fbdeca164e5bd94b4e01fc440cd38ee7893b5893c95e47748b86d50ab2dd4d01aeb698cdb2cd1d76d8c9a008cd08659ebe597d1464a21d4ab595060441c7ffd06033d798621998d8785f3e2430c74faa73d227bdb80114ea0b9e279395bb5d1ba8f385b9c13be01eb80ba171bd374724b319ed2494dfd6e7cc3fbaaaf00b66db8f1a48db2cf2769f1a007a690a498830125fac75091f2d9d5091ac9041b07e01b2b260d120fe4d6e2539a4db634e66521eada48b3fb5306c87d576fb6e14938c99f0cfb5f5553380ac26ccf24d4dbf9875b5667b2ab1537e1accc22e625aee2fa8aa33db8595edca378ffa6979347f065a998426d55d852acb71b87092ec02d03162272ce4788b8a02228cba857d6a13f0eb2ef7a27c3a5598e7e73559b8caa130d98ce1d74f95f6b864ead28f629ee0e02bbb488b2e677e80a506107962e7cbeea8f2454fc203dfb43336c635c2f014fa523f92525f516bec6432e87ff392d24dcaaac7e980b3731be0ce32790ffa8a7060e4be4cf3bc9b04ce7399019dccb3ffa908b61ff0b5d4be4a9ad8613109954ccda5156d67a2f1b4e8808b5c6dd47ba8a89f6719ccd964a31ca9c648fe864787a8e3a17d85f97922866e17b446c0b590e353bc5042a04886d46f2c12ae7ff9c29589002457218622a36e464fcf0b40397a086737a388b80cd4bc7fa49f2febcbd8fde7fc6d97d2e6ba6909ff6fffbc3842d8b7e0d0f55d5f9e86cfc9debd3aed622b66fbf47877b9a73b2092768c624286802c674dc79f1c3a9e1d60b4e40e168330eb192e78d2617057b953c32d8a41f02e8d29914ce8458d97300e16cf8e2f14775be9697d659e9b782cba5f56ebe3b4688dfe2baa9f7dd8b84fcc0edb1c0da66e641630f54f09e0eb711fb601a931092ea78b6a6a9554a4c730a1672c7b0d6cbd7d682d4b7b69c45eec90611179c92466072f06301b50f", 0x981}], 0x1}}], 0x1, 0x2404c050) madvise(&(0x7f00000b3000/0x2000)=nil, 0x2000, 0xe) ioctl$BLKRRPART(r1, 0x125f, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) ioctl$TCSBRK(r0, 0x5409, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) getegid() r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$packet_int(r2, 0x107, 0x10, &(0x7f00000007c0)=0x2, 0x4) socket$vsock_stream(0x28, 0x1, 0x0) sendmsg$SOCK_DIAG_BY_FAMILY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="2800000014001901000000000000000228"], 0x28}}, 0x0) 3.53953218s ago: executing program 1 (id=59): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000a00)={'syz1\x00', {0x9, 0x7, 0x5, 0x5}, 0x3f, [0x9, 0x2, 0x18, 0x2, 0x2, 0x400, 0x80000000, 0x0, 0x8, 0x0, 0x6, 0x1, 0xfffffffb, 0x39, 0x747d5e13, 0x800, 0xfffffb9a, 0xfffffffe, 0x0, 0xfffffffb, 0x2004, 0x3, 0x0, 0xf250, 0x80, 0x4800, 0x300000, 0x7, 0xe, 0x4623f, 0x0, 0x10001, 0x1ff, 0x8000, 0x0, 0x3, 0x0, 0x3, 0xba55, 0x8da8, 0x2, 0x200, 0xffffffff, 0x5, 0xe, 0x4, 0x2, 0x6f, 0x8, 0x9, 0x1, 0x199d, 0x6, 0x2, 0x9, 0xfffffffb, 0x4, 0x6, 0x1000, 0x5, 0x3d, 0x8, 0xa, 0x5], [0x7, 0x1e, 0x3, 0x8000, 0xfffffffd, 0x3, 0x3, 0x25, 0x7, 0xfffffffc, 0x8, 0x7fff, 0x72c, 0x1c32, 0x3, 0x5, 0x10000, 0x400, 0x7ffd, 0x3, 0x3, 0x297, 0x5, 0x0, 0x981, 0x4, 0x0, 0x3ff, 0x0, 0xfffffffe, 0x8, 0x1000001, 0x10, 0xfffffff9, 0xfffffffd, 0x7, 0x1, 0x3ff, 0x6, 0x2000008, 0x800, 0xff, 0x6, 0x96, 0xfffffffc, 0x2, 0x0, 0x2, 0x401, 0xc, 0x3, 0x379, 0x9, 0xe, 0x5, 0x7, 0x6, 0x2, 0x1, 0x1, 0x1, 0x7, 0x200, 0x3], [0x401, 0x8000c584, 0xffff, 0xcd3, 0xb, 0x1f, 0xc363, 0x4, 0x4008, 0xc, 0x7, 0x9, 0x1e88, 0x5, 0x80000001, 0x1, 0x3f92, 0x1000, 0x0, 0x10, 0x1, 0xfffffff9, 0x0, 0x1000, 0x80040101, 0xc77, 0x4, 0x5, 0x200003, 0x1, 0x5, 0x80, 0x9, 0x8001, 0x10001, 0x0, 0xffffffff, 0x400004, 0x3, 0x6d7e, 0x3, 0x40008, 0x3, 0xbf23, 0x6, 0x9, 0x956, 0x0, 0x5, 0xe, 0xa, 0x100fffd, 0x2005, 0x9, 0x4, 0xea, 0x9, 0x20000005, 0x3, 0x80, 0x0, 0x7d, 0x401, 0x5], [0x108f, 0xffff, 0x3, 0x3, 0x88, 0x2, 0x4000000, 0x4, 0x50, 0x2, 0x763, 0xb, 0x402, 0x1, 0x5, 0x1000, 0x7f, 0x5, 0x3fa6, 0x4, 0x0, 0x5, 0x8000, 0x4, 0xe47, 0x4, 0x3, 0x4, 0x200, 0x2851, 0x3b, 0x20000001, 0x5, 0x5, 0xa80a, 0x65f413f9, 0x4, 0x20008, 0x8a5, 0x8a, 0x100, 0x409, 0x6, 0x4, 0x4, 0xe, 0x4, 0xffffffff, 0x5, 0xffff8a33, 0xfffffff8, 0xf, 0x3, 0x200, 0x7, 0x4edf, 0xfffffffb, 0xa, 0xe, 0x101, 0xf, 0xf, 0x136, 0x6]}, 0x45c) (async) rt_sigprocmask(0x2, &(0x7f0000000080)={[0xffffffffffffffff]}, 0x0, 0x8) (async) r1 = gettid() (async) r2 = getpid() rt_tgsigqueueinfo(r2, r1, 0x28, &(0x7f0000000940)={0x1d, 0xfffff42f, 0x1}) (async) r3 = add_key$keyring(&(0x7f00000000c0), &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) keyctl$restrict_keyring(0x1d, r3, &(0x7f00000001c0)='keyring\x00', &(0x7f00000023c0)='\x00') (async) r4 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xfffffffffffffff7]}, 0x8, 0x0) read$watch_queue(r4, &(0x7f0000000300)=""/176, 0xb0) ioctl$UI_DEV_CREATE(r0, 0x5501) (async) ioctl$UI_ABS_SETUP(r0, 0x401c5504, 0x0) r5 = epoll_create1(0x80000) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r6, &(0x7f0000000040)={0x20000004}) (async) bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x4e21, @broadcast}, 0x10) (async) fcntl$F_GET_FILE_RW_HINT(0xffffffffffffffff, 0x40d, 0x0) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) (async) r7 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x4200c0, 0x52) (async) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r7, 0x0, 0x240000c0) (async) r8 = socket$inet6(0xa, 0x3, 0x87) r9 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, 0x0) connect$inet6(r8, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @local}, 0x1c) (async) syz_usb_connect$midi(0x0, 0x40, 0x0, &(0x7f0000000640)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x210, 0x9, 0xa, 0xc, 0x40, 0x2}, 0x8, 0x0}) (async) socket$igmp6(0xa, 0x3, 0x2) (async) r10 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') preadv(r10, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/241, 0xf1}], 0x1, 0x1ed, 0x4) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) 3.382126375s ago: executing program 2 (id=60): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000340)={'filter\x00', 0x7, 0x4, 0x3e8, 0x218, 0x218, 0x108, 0x300, 0x300, 0x300, 0x4, 0x0, {[{{@arp={@local, @broadcast, 0xff000000, 0xff000000, 0xf, 0xf, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x43}, {[0xff, 0xff, 0xff, 0xff]}}, {@mac=@local, {[0xff, 0xff, 0x0, 0xff]}}, 0xffff, 0x9, 0x0, 0x40, 0x3f0, 0x2, 'bond0\x00', 'pimreg0\x00', {}, {}, 0x0, 0x4}, 0xc0, 0x108}, @unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x6af, 'syz1\x00', {0xed}}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @remote, @broadcast, 0x8, 0x1}}}, {{@arp={@local, @initdev={0xac, 0x1e, 0x0, 0x0}, 0xffffff00, 0xffffff00, 0x5, 0xe, {@empty, {[0x0, 0x0, 0xff, 0xff, 0x0, 0xff]}}, {@empty, {[0x0, 0x0, 0xff, 0xff, 0xff]}}, 0x80, 0x9, 0x0, 0x6, 0x9, 0x5, 'veth0_to_bridge\x00', 'gretap0\x00', {0xff}, {0xff}, 0x0, 0x13}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x438) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x1fd, 0x0, 0x60000, 0x1000, &(0x7f0000ffe000/0x1000)=nil}) socket$inet_udp(0x2, 0x2, 0x0) (async) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000340)={'filter\x00', 0x7, 0x4, 0x3e8, 0x218, 0x218, 0x108, 0x300, 0x300, 0x300, 0x4, 0x0, {[{{@arp={@local, @broadcast, 0xff000000, 0xff000000, 0xf, 0xf, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x43}, {[0xff, 0xff, 0xff, 0xff]}}, {@mac=@local, {[0xff, 0xff, 0x0, 0xff]}}, 0xffff, 0x9, 0x0, 0x40, 0x3f0, 0x2, 'bond0\x00', 'pimreg0\x00', {}, {}, 0x0, 0x4}, 0xc0, 0x108}, @unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x6af, 'syz1\x00', {0xed}}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @remote, @broadcast, 0x8, 0x1}}}, {{@arp={@local, @initdev={0xac, 0x1e, 0x0, 0x0}, 0xffffff00, 0xffffff00, 0x5, 0xe, {@empty, {[0x0, 0x0, 0xff, 0xff, 0x0, 0xff]}}, {@empty, {[0x0, 0x0, 0xff, 0xff, 0xff]}}, 0x80, 0x9, 0x0, 0x6, 0x9, 0x5, 'veth0_to_bridge\x00', 'gretap0\x00', {0xff}, {0xff}, 0x0, 0x13}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x438) (async) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x1fd, 0x0, 0x60000, 0x1000, &(0x7f0000ffe000/0x1000)=nil}) (async) 3.361224246s ago: executing program 2 (id=61): r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x24020000) mount_setattr(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x0, &(0x7f0000001dc0)={0x8c, 0x0, 0x100000}, 0x20) syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f0000000640)=ANY=[@ANYBLOB="12011103020000082505a1a440000102030109025c00020105002f0904000001020d00000524060001052400302f0d240f010400000004000dff0506241a040006090581031000dd014c0904010000020d00000904010f"], &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0}) 2.842661184s ago: executing program 2 (id=66): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f0000000000)=@abs={0x1, 0x0, 0x4e24}, 0x48) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000000)=@abs={0x1, 0x0, 0x4e24}, 0x6e) sendmsg$nl_route_sched_retired(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000011c0)=@newtaction={0x44, 0x32, 0xc20bc6c7745b97d7, 0x70bd29, 0x25dfdbfc, {}, [{0x30, 0x1, [@m_ipt={0x2c, 0x1, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0x9, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1}}}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x60004004}, 0x9080) r3 = memfd_create(&(0x7f0000000580)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\xea7\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\x0f<\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xd9w\\\xf8\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xcd\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00\xd5\xf3\\\x00\xbe]Et\xad*\xecj\x02\xc8\xc4\f\x04\x99\xf6\xfc', 0x3) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r5, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r5, 0x40047451, &(0x7f0000000200)=0x8) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.effective_cpus\x00', 0x275a, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r6, 0x40305829, &(0x7f00000000c0)={0x17c04, 0xffffffffffffffff, 0x4000, 0x100000001}) close_range(r4, 0xffffffffffffffff, 0x0) fcntl$addseals(r3, 0x409, 0x7) ftruncate(r3, 0x101) r7 = socket(0x10, 0x803, 0x0) sendmsg$nl_xfrm(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYRESHEX=r0], 0x40}}, 0x90) r8 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYRES16=r7], 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r9, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="c40000000002010400000000000000000a000000380001802c00018014000300fe8000000000000000000000000000205dff0400ff01000000000000000000000000000106000340000300003c0003800c00028005000100890000002c00018014000300fe80000000000000000000000000002a140004260f75eb000000000000000000000000013c0002802c00018014000300ff0200000000000000000000000000011400040000000000000000000000ffffac1414170c000280050001"], 0xc4}, 0x1, 0x0, 0x0, 0x40}, 0x4) syz_usb_control_io$hid(r8, 0x0, 0x0) 1.838758738s ago: executing program 3 (id=77): mkdirat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x1f4) r0 = socket$netlink(0x10, 0x3, 0x0) mount$cgroup(0x0, &(0x7f0000000080)='./cgroup\x00', &(0x7f00000000c0), 0x800006, &(0x7f0000000300)={[{@subsystem='net_prio'}, {}]}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x22080, 0x0) ioctl$KVM_GET_MSRS_cpu(0xffffffffffffffff, 0xc008ae88, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(0xffffffffffffffff, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000e40)={0x3, &(0x7f00000001c0)=[{0x80, 0x0, 0x4, 0x1}, {0x5, 0xfe, 0xff}, {0x2, 0xa, 0xf, 0x4}]}) socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x9) r3 = socket$netlink(0x10, 0x3, 0x8000000004) listen(0xffffffffffffffff, 0x7c2) writev(r3, &(0x7f0000000040)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a06e7bc45ff810500000000000058000b480000945f64009400050028925a01000000000000008000f0fffeffa809000000fff5dd0000001000010002081000418e00000004fcff", 0x58}], 0x1) sendmsg$netlink(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000240)=ANY=[@ANYRES32=r0], 0x30}], 0x1, 0x0, 0x0, 0x8000}, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='tracefs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000280)='./cgroup\x00', &(0x7f0000000180), 0x0, &(0x7f0000000140)={[{@xino_on}, {@volatile, 0x3a}, {@redirect_dir_follow}], [], 0x2f}) r4 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY_LEVEL(r4, 0x0, 0x2, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100), 0x850480, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r5, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) syz_io_uring_setup(0x2bf3, &(0x7f0000000040)={0x0, 0x1323, 0x4000, 0x6, 0x3cb}, 0x0, 0x0, &(0x7f0000000000)) syz_init_net_socket$nfc_llcp(0x27, 0x0, 0x1) r6 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r6, 0x107, 0x9, &(0x7f0000000080), 0x4) 1.827325488s ago: executing program 0 (id=79): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x5543, 0x6e, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xff, 0x70, 0x1, "", [{{0x9, 0x4, 0x0, 0xd, 0x1, 0x3, 0x1, 0x0, 0x7, {0x9, 0x21, 0xff7f, 0x77, 0x1, {0x22, 0xfb1}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x3, 0x1, 0x1a}}}}}]}}]}}, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) r1 = syz_usb_connect(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000751c0110e60f00989ad1010203010902240001000000000904290202b48cbb0009050402100000fa000905820240"], 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)={0x40, 0x13, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r1, &(0x7f0000000240)={0x14, &(0x7f0000000100)={0x20, 0x1, 0xec, {0xec, 0x8, "c2a87ab3069baa41e05c15829cbb295db000e4235716f8aa05b7fb3c1020407afc75b6ac03f632ca6a5f9d027b2f3db78459dc6136c03302c03b87e6293e4431c774aac7faf5141f0db92bcbe543917a5e63a019a564367fda75237c66ee461be3f0259ac434a6a601d301524d23de846ce07ef5a9273809adce2f2c34e5b02b9cbf85211aaad39981eec49633d2b9891e7ec2f0a68bb3f1bfedd1664000e56a344b4ee80d990a05b4cb0d7897cdca4a0548d93fb02f3b77c439ef852f260b6624c46981226a82b0dd86b8facf68f2f9fcea6cb92a75b8a5ec45bda40e9bcc3fb28d3b2b15e144b22656"}}, &(0x7f0000000200)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000440)={0x1c, &(0x7f0000000280)={0x40, 0x0, 0xdd, "52a3e95f1a53f124da2eaf5a3047b0c8a9d497a89c50acac022ce21ed7533e1289ab8371bffb9001b793f1aee65626d627b072c1068306bff066dad6953e22bd634441722d494cfb6daa7bdabcb87c606411de152742ce742dce379f0f4b3b89b2a7032be580cebcfc27ca94f984fe016911ed2bda73884169b4ab7d7b13d6eefe36b1d17358be15698282fecc6398bbed78f7e0698b745b11d9ec65047ec027ad39ea2ff80049338f8872dc9452d05e2bb3616231fc016a92ff26fc5c1a9a2de2418ce099dd02468fe531893353ed514938e2cc20f73b75f5fd8d21b4"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x4}}) syz_usb_control_io$hid(r0, &(0x7f0000004600)={0x24, 0x0, 0x0, &(0x7f00000000c0), 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000380)={0x24, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x807}}, 0x0, 0x0}, 0x0) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x5543, 0x6e, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xff, 0x70, 0x1, "", [{{0x9, 0x4, 0x0, 0xd, 0x1, 0x3, 0x1, 0x0, 0x7, {0x9, 0x21, 0xff7f, 0x77, 0x1, {0x22, 0xfb1}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x3, 0x1, 0x1a}}}}}]}}]}}, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) (async) syz_usb_connect(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000751c0110e60f00989ad1010203010902240001000000000904290202b48cbb0009050402100000fa000905820240"], 0x0) (async) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) (async) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) (async) syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)={0x40, 0x13, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$cdc_ecm(r1, &(0x7f0000000240)={0x14, &(0x7f0000000100)={0x20, 0x1, 0xec, {0xec, 0x8, "c2a87ab3069baa41e05c15829cbb295db000e4235716f8aa05b7fb3c1020407afc75b6ac03f632ca6a5f9d027b2f3db78459dc6136c03302c03b87e6293e4431c774aac7faf5141f0db92bcbe543917a5e63a019a564367fda75237c66ee461be3f0259ac434a6a601d301524d23de846ce07ef5a9273809adce2f2c34e5b02b9cbf85211aaad39981eec49633d2b9891e7ec2f0a68bb3f1bfedd1664000e56a344b4ee80d990a05b4cb0d7897cdca4a0548d93fb02f3b77c439ef852f260b6624c46981226a82b0dd86b8facf68f2f9fcea6cb92a75b8a5ec45bda40e9bcc3fb28d3b2b15e144b22656"}}, &(0x7f0000000200)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000440)={0x1c, &(0x7f0000000280)={0x40, 0x0, 0xdd, "52a3e95f1a53f124da2eaf5a3047b0c8a9d497a89c50acac022ce21ed7533e1289ab8371bffb9001b793f1aee65626d627b072c1068306bff066dad6953e22bd634441722d494cfb6daa7bdabcb87c606411de152742ce742dce379f0f4b3b89b2a7032be580cebcfc27ca94f984fe016911ed2bda73884169b4ab7d7b13d6eefe36b1d17358be15698282fecc6398bbed78f7e0698b745b11d9ec65047ec027ad39ea2ff80049338f8872dc9452d05e2bb3616231fc016a92ff26fc5c1a9a2de2418ce099dd02468fe531893353ed514938e2cc20f73b75f5fd8d21b4"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x4}}) (async) syz_usb_control_io$hid(r0, &(0x7f0000004600)={0x24, 0x0, 0x0, &(0x7f00000000c0), 0x0}, 0x0) (async) syz_usb_control_io$hid(r0, &(0x7f0000000380)={0x24, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x807}}, 0x0, 0x0}, 0x0) (async) 1.729854561s ago: executing program 3 (id=80): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) creat(0x0, 0xd0) openat$ptmx(0xffffffffffffff9c, &(0x7f000000bc00), 0x8000, 0x0) syz_usb_connect(0x0, 0x5d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000551b8920b822276080c20102030109024b0001000000000904000000020a0000052406000005241d00000d240f0100000000000000020007241400000000042413"], 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x3, @loopback, 0x6}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000080), 0x4) 508.344113ms ago: executing program 3 (id=81): socket$tipc(0x1e, 0x2, 0x0) (async) r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000080)={0x2001}, 0x10) (async) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000080)={0x2001}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) (async) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) (async) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_CAP_EXCEPTION_PAYLOAD(r2, 0x4068aea3, &(0x7f0000000180)={0xa4, 0x0, 0x1}) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000240)={{0x8000000, 0xf000, 0x0, 0x2, 0x8, 0x0, 0x40, 0x2, 0x0, 0x8, 0x9, 0x10}, {0xffff1000, 0xd000, 0xc, 0x8, 0xfb, 0x9, 0x0, 0x2, 0x7, 0x7, 0x0, 0xff}, {0x6000, 0x3000, 0xc, 0x0, 0x7, 0x9, 0x40, 0x0, 0x3, 0x9, 0x0, 0xfc}, {0xeeef0000, 0xd000, 0x0, 0xff, 0x0, 0xfe, 0xa, 0x0, 0xfe, 0x3, 0x4}, {0xdddd0000, 0xf000, 0x4, 0x0, 0xff, 0x4, 0x6, 0xb, 0x0, 0x3c}, {0xeeee8000, 0x4000, 0x0, 0x3, 0x4, 0x2, 0x2, 0x1, 0x0, 0x0, 0x80}, {0xdddd1000, 0xdddd1000, 0x0, 0x2, 0xff, 0x0, 0xff, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x3000, 0xe, 0x0, 0x1, 0x1, 0x83, 0xa, 0x26, 0x96}, {0x1, 0x4}, {0x80a0000, 0xbf}, 0x9dfeffdb, 0x0, 0xeeee8000, 0x600, 0x1, 0x5800, 0x0, [0x13, 0x0, 0x1]}) r7 = mmap$KVM_VCPU(&(0x7f0000004000/0x2000)=nil, 0x930, 0x2800002, 0x11, r6, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r7, 0x20, &(0x7f0000000240)="fb4149dd053be3ac2cc4a22332a77b23b8898600087bb16c94a6ab80313804d92f00000000010000045a96383369d226270080ff000000000000000000a000", 0x0, 0xffa4) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1, 0x11, r6, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4040aea0, &(0x7f0000000080)=@arm64={0xa, 0x3, 0x0, '\x00', 0x3}) (async) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4040aea0, &(0x7f0000000080)=@arm64={0xa, 0x3, 0x0, '\x00', 0x3}) socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000d80), r8) sendmsg$TIPC_NL_MEDIA_GET(r8, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000080)={0x20, r9, 0x1, 0x70bd29, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0xc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async) sendmsg$TIPC_NL_MEDIA_GET(r8, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000080)={0x20, r9, 0x1, 0x70bd29, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0xc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r10 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), 0xffffffffffffffff) bind$tipc(r0, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4040aea0, &(0x7f0000000140)=@x86={0xff, 0xe, 0x2, 0x0, 0x80000000, 0x0, 0x26, 0x8, 0x9, 0x9, 0xba, 0x8, 0x0, 0x2, 0x5, 0xf2, 0x2, 0x0, 0x2, '\x00', 0x10, 0x4}) ioctl$AUTOFS_IOC_EXPIRE(r0, 0x810c9365, &(0x7f0000000400)={{0xea8, 0x8}, 0x100, './file0\x00'}) r11 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$FUSE_NOTIFY_RETRIEVE(r11, &(0x7f00000000c0)={0x30, 0x5, 0x0, {0x0, 0x3, 0xa8, 0x3}}, 0x30) r12 = creat(&(0x7f0000000380)='./file1\x00', 0x50) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r12, &(0x7f0000000100)={0x0, 0x1d, &(0x7f0000000040)={&(0x7f0000000280)={0x30, r10, 0x1, 0x0, 0x100000, {{}, {}, {0x14, 0x19, {0x2, 0x1, 0x0, 0xda8}}}}, 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x1044) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) getpid() (async) getpid() socket$inet6_tcp(0xa, 0x1, 0x0) 507.814573ms ago: executing program 0 (id=82): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, &(0x7f00000001c0)='veth0_to_bridge\x00') bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x6, &(0x7f0000001200)=0xd0, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000100)=[{0x6, 0x7, 0x0, 0x101}]}, 0x10) mprotect(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) open$dir(&(0x7f0000000080)='./file0\x00', 0x280001, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) getsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000200), &(0x7f0000000040)=0x4) 507.708803ms ago: executing program 1 (id=83): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) ioctl$int_in(r0, 0x5421, &(0x7f00000000c0)=0x7fffffffffffffff) listen(r0, 0x0) socket$tipc(0x1e, 0x2, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r1, &(0x7f00000002c0)={&(0x7f0000000080)=@nameseq={0x1e, 0x2, 0x2, {0x42, 0x0, 0xfffffffc}}, 0x10, 0x0}, 0x80) accept4(r0, 0x0, 0x0, 0x0) 435.498385ms ago: executing program 1 (id=84): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000300)={@in={{0x2, 0x4e23, @multicast1}}, 0x0, 0x0, 0x2d, 0x0, "f6a7346a1ca3caf66200f0e70b995efa20d5ddc09c0bc0c88e00bdea5e6998967d569964c8b68dae57dea91c0e3ef03a96483bcaaa5ab222d1993083e8e3619fbbff30da0288a8b78a3f921c40fdc06a"}, 0xd8) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, &(0x7f0000000180)="440f20c03505000000440f22c0f26df20f38f17a64b805000000b9e10d00000f01d9d8dd0f01728eb8010000000f01d94c0fc71d000000003ef245dbed410fc7f7", 0x41}], 0x1, 0x72, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4400ae8f, &(0x7f0000000140)=@x86={0x0, 0x1, 0x0, 0x0, 0x4, 0x0, 0x10, 0x1, 0x0, 0x2, 0x9, 0xd, 0x0, 0x0, 0x1049, 0x0, 0xff, 0xef, 0x0, '\x00', 0x70}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_CAP_X86_APIC_BUS_CYCLES_NS(r0, 0x4068aea3, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) syz_pidfd_open(r6, 0x0) syz_open_procfs(r6, &(0x7f00000000c0)='net/ip6_tables_names\x00') ioctl$KVM_X86_SET_MSR_FILTER(r5, 0x4188aec6, &(0x7f0000000cc0)={0x1, [{0x1, 0x8, 0x3b9, &(0x7f0000000040)='b'}, {0x3, 0x0, 0xfffffffc, 0x0}, {0x2, 0x0, 0x4, 0x0}, {0x1, 0x0, 0xa, 0x0}, {0x3, 0x0, 0x6, 0x0}, {0x4, 0x0, 0x5, 0x0}, {0x0, 0x0, 0x8, 0x0}, {0x1, 0x0, 0x9, 0x0}, {0x2, 0x0, 0xf, 0x0}, {0x3, 0x0, 0xa, 0x0}, {0x1, 0x0, 0x7, 0x0}, {0x3, 0x0, 0xffff, 0x0}, {0x1, 0x0, 0x80, 0x0}, {0x2, 0x0, 0x0, 0x0}, {0x1, 0x0, 0x5, 0x0}, {0x0, 0x0, 0x8, 0x0}]}) close(0x4) close(r5) 434.879675ms ago: executing program 0 (id=85): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r2, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000000c0)={[0x800, 0x3, 0x81, 0x4, 0x80, 0x0, 0x3, 0xfffffffffffff804, 0x0, 0x0, 0x0, 0x1fffffffffffe, 0x3, 0x5, 0x1, 0x7f], 0xeeee0000, 0xd7b40}) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000000)={0x7, {"a2e3ad21ed0d52f91b5d360987f70e06d038e7ff7fc6e5539b0d47078b089b3907376d090890e0878f0e1ac6e7049b334a959b669a240d5d67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d07670936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70fe98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf1a34af674f3f39fe23491235c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e470dea05918b41243513f000800000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3e3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14d9fdb8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a19000000000000006f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69b15c9f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d44400009a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc01008cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c16c02ed4b5d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaab1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106d26658b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6b14effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c110000a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b51028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6815d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3f3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51090840517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4e004a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6ce1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c817e9177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d543902113c4c859465c3c115c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c1050000002f7809959bc248850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafcc009fc074bb6b68a1f0c4649820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948998cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2fd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5dc4ff8f0104000000000000df72279fdb0d2b9e936e5a983c12fded79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d3700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc642df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa6e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9f07b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e3ebb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3fec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4cddd5d0fc5a752f9000", 0x1000}}, 0x1006) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000000)={0x1, 0x8000}, 0x4) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000001180)={'veth0_to_hsr\x00', 0x0}) sendto$packet(r4, &(0x7f0000000180)="0b032200e0ff25000200475400f6a13bb10000a8880008004803", 0x10000, 0x0, &(0x7f0000000140)={0x11, 0x0, r5}, 0x14) ioctl$KVM_RUN(r2, 0xae80, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r6, &(0x7f0000000000)={&(0x7f00000000c0)={0xa, 0x4e20, 0x7fe, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f00000004c0)=[@hoplimit={{0x14}}], 0x18}, 0x4000) 318.65788ms ago: executing program 0 (id=86): r0 = socket$netlink(0x10, 0x3, 0x4) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r0) writev(r0, &(0x7f0000000340)=[{&(0x7f00000000c0)="480000000500257f09004b01fcfc8c860a881300f217e0060000e3323909b8f8896e33719fe3bb036e0bc90900000000000000000000ffff5bf1090000d0bd5e000000006203005b", 0x48}, {&(0x7f0000000380)="2f21f0b617d027c90ff711555e9647a133a97afc2d99604cfa8ec37f5daecb0464f49be55ba77886e2d9b41bacf24c16ae373f3b7f9c3da15ce305d5589e095baa024e7e75173bc6850ad683f3b8744e904ff31591a9d412bc94f3a4a9cd59b3c53ff34914c08f165101aacf8567581da64e7328e5b8ab7393f9ae99898b91bf185815c00c1c2da37b334863d157c66c227ad92fdee2a3e78d4ff777a56bef1a25498caae8dd39a53f5cad9c979917cf157d54acb5a7ecb7c3c4e5394eb5a41f951d831aad2f0ff84703fbcfd0db3310c110c0b159cbd669639969cd679691d8c88a64f5dcb96ce9ad104a0181a4748335971c6eec850a23380228669ec6ea8f095387fbfb4350abd91bc6dedbf441308bcee859134c137550f8e4bd351d58cb36efc3f7757215342d86905e7c2988", 0x12f}, {&(0x7f0000000240)="0eeb82c5002856bdf6fce1e2f4568e2ec47e077c40c32cc01ab13de2cd84e63e30d81dd4aeb57f83ec153164299dce39a52eb1e96092f37617fa88c728b5a8bdc19537084261d262b8551d85755f4ccef3b9942f95c8859c24116b896cfec990bd4ac0226259e48d8a3fdd4ec02a85b50d7e40076fa4e80eb12f3ee84e21dbb58b3386ddc52beef25a46a1ad56cc9b72608f890d8a56434e3ebce2352ef2d1ed0d53419e1ef55b875035338cacd3762418de1b9bea521a3e6df1313dd0cbb667c1d4710f9a3d17ee19c5b21c0943609db968c9465b4e9a389b399ef28597de6dda0d2859875f16a066cc40cfb70387ed", 0xf0}, {&(0x7f0000000080)="0ca4a7b0fae46a245f974f3ee9def924df", 0x11}], 0x4) 226.405182ms ago: executing program 3 (id=87): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) (async) sendto$inet6(r0, &(0x7f00000001c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee059853", 0xfffffffffffffcc1, 0x840, 0x0, 0x56) (async) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000180)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x60}) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x604ab000) (async) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000001380)=""/4080, 0xfffffffffffffdcc, 0x0, 0x0, 0xffffffffffffff87}, &(0x7f0000000000)=0x40) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000100)={&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcdf, 0x1, 0x0}, &(0x7f00000000c0)=0x40) 226.221042ms ago: executing program 0 (id=88): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000280)={0xa, 0x2, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000000), 0x3) listen(r0, 0x2) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f00000000c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback}}}, &(0x7f0000000140)=0x80, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000845, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @rand_addr, 0x5}, 0x1c) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000840)={0x14, 0x1d, 0x1, 0x0, 0x2, {0x7}}, 0x14}, 0x1, 0x0, 0x0, 0x80000}, 0x0) 215.197333ms ago: executing program 3 (id=89): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x800, 0x0) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x110e22fff6) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x2001, 0x0) clock_adjtime(0xffffffd3, &(0x7f0000002740)={0xffffffffffffffee, 0x7253, 0xffffffffffffffdf, 0x696f, 0x9, 0x6, 0x52e6ac5d, 0x8, 0x0, 0x0, 0xd, 0x7fffffff, 0x6, 0x8000000b, 0x80000004000000, 0x9, 0xfffffffffffffffd, 0x89, 0x8000000003, 0x8000003, 0x5, 0x3, 0x200000005, 0xfffffffffffffffe, 0x3, 0xa}) socket$netlink(0x10, 0x3, 0x0) symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./file7\x00', 0x1c0) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file7/file0\x00', 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file7/file0\x00', 0x101000, 0x108) lseek(r1, 0x9, 0x1) preadv(0xffffffffffffffff, 0x0, 0x0, 0xe, 0x80006) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r2, 0x4004743d, 0x110e22fff6) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f00000005c0), 0x2010800, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8c) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) writev(r3, &(0x7f00000025c0)=[{&(0x7f0000000280)="ee9b54d5c52de74bc11929b4f7339f46a4dc4839d17a1b9e03e2ce69afed774cb2276e227ae9d83df84640e7e25d6b6f21739af6ac22f4a8d46297331fe07a9663439359e5ab250641951e468c32873bbe32d917c32758c28f92f174829489a3806973d364d55e048bd5fe4406c73b835adea9c7a5bb2fe7c76fe0dfd49ae778d16c08506073f83e488a01c3754a96646184a4411cac4527c289911a1ba019dfa979da298a9c0b2f30c48a519e1bd78e2ac5861b2b96450970378e28", 0xbc}, {&(0x7f0000000340)="6803062fc1b12cb7ae54a10da81c9cbc45498f51828819eb9b98665e897dfbac0bedea5072700a2b75646bf0644cb8f7c248c2d1889a6e6614336a3129590c", 0x3f}, {&(0x7f00000023c0)="17957d577136297f37e8baa0b6b6c35897ef890bce45419b5ef5660522427d42bf94789fb6d89f4117d8dd39eb090f4bfccb1c4ed1718f4bd9753f20b5b4ae6edfcab4beaf4a9f0b9f9b51c18afdedad57b2c6f9e3ec5c36e783750c86a2630cd25204db7c0aace1bc42373e3c665021cae3b9a77cf27058a923934aa5f3a13b232332115efa13edb991be5aeef3f3b7c3a3863588398c2e08d6e6434192726169a71fa10f42f2133eab12712a5d95ef047d6648986fe9bbee6f8ded899b6289b8f4c8cae7de10eb9bdd1abf6f021ebb41dbcbc591c381ef6afe46f05c89ea825f289f", 0xe3}, {&(0x7f00000024c0)="feb4b658aac22d5de0ad88dcfdfb914e43d9e54944c69704a938a4ed7afed6e17671af1b54a2219a136593c01f54cf853ec3dc0dbe0dceb4fc7a373c57a1dfd6b3621727a6fac43520976a646ebf86bb2d104b780aeba4c38446fac163ea315b28a19c66989905e4e41038e4d33b515e1bd62aca91dde246eb88012d78f3e12ead765f9c7ba9accd4740550c237ff61b0e8eaf25f124b68918778fec5ea380b9eab7999006f0b6151415d51ad0540607cf7684ecb19ed48557374a1c88315b8f7b224d4e6218ca7d51a53a806b46fad2d28504b32ea7fbcedefe63d7e13ba69cfabfb9", 0xe3}], 0x4) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0x40106726, &(0x7f00000000c0)) ioctl$PPPIOCGIDLE(r2, 0x8010743f, &(0x7f0000000000)) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r5, &(0x7f0000000380)={0x2020}, 0x2020) 122.098076ms ago: executing program 0 (id=90): write(0xffffffffffffffff, &(0x7f0000000000)="fc0000004800071fab092504090007000aab60000a0000000008e293210001", 0x1f) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendmmsg(r0, &(0x7f0000006ac0)=[{{&(0x7f0000000240)=@nfc={0x27, 0x0, 0x0, 0x3}, 0x80, 0x0}}], 0x1, 0x20000000) r1 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r1, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) 0s ago: executing program 3 (id=91): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000640)={0x28, 0x0, 0x2710}, 0x10) r2 = accept(r0, 0x0, 0x0) shutdown(r2, 0x1) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x9, 0x4, 0x6, 0xfffa}, 0x1d, [0x1, 0xc95a, 0xfffffff3, 0x3ee9, 0x80, 0x2, 0x6, 0x7f, 0x6, 0x4d, 0x39cc1918, 0x5c, 0x9, 0x3, 0x2, 0x0, 0x6, 0x3, 0x0, 0x2ab, 0x104, 0x7, 0x4, 0x3c5b, 0x1, 0x1ff, 0x9, 0x1, 0x7, 0x7, 0xe661, 0x0, 0xb, 0x3, 0x7fff, 0xfffffffe, 0x80000000, 0x800242, 0xffffffff, 0x7f, 0xfffffffe, 0x71, 0x2, 0x6, 0x3, 0x2, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x3, 0x80092a7, 0x4, 0x1, 0x20000000, 0x82, 0x0, 0x7, 0x7, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0xffff, 0x12f, 0x9, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xd, 0x2bf, 0x7ff, 0x80001000, 0xfffffffc, 0x0, 0x0, 0x7, 0x5, 0x2f, 0xe, 0x312, 0x1, 0x0, 0x9, 0x8, 0x8, 0x8000, 0xd, 0x3fe, 0x401, 0xfff, 0x4, 0xfb, 0x5, 0x8000, 0x5f31, 0x9, 0x4, 0x2, 0x2, 0x20009, 0x4, 0x9, 0x8, 0x9, 0x6, 0x7f, 0xa, 0x1, 0x9, 0x9, 0x2, 0x7f, 0x9, 0x6, 0x3, 0x9, 0xffffffff, 0x7, 0x3, 0x9, 0x48c93690, 0x42, 0x400004], [0x6, 0x6, 0x80000001, 0x2, 0xff, 0x40000100, 0x8d2, 0x9, 0x5, 0x7fff, 0x8, 0x1, 0x4, 0xa, 0x5, 0x1005, 0x0, 0x1f0, 0xfffffffd, 0x2, 0xb, 0x1, 0x9, 0x3e7, 0x9, 0x5, 0x2, 0x2, 0x800, 0x8, 0x5, 0x8001, 0x7, 0x38, 0x800003, 0x200, 0x80, 0x2, 0xcc52, 0x950bfaf, 0x1000, 0xa2, 0x7, 0x51cf697b, 0xfffffff9, 0x6, 0xac8, 0xbf, 0x10002, 0x403, 0x7ff, 0x8000003, 0x0, 0x54, 0xffff, 0x0, 0x6, 0x1c, 0x120000, 0xc00, 0x6, 0xaaed, 0x4, 0xff], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0xfffffffe, 0x6, 0x3, 0x0, 0x3, 0x80ce8, 0x1ff, 0x4, 0x7, 0x5, 0x1007, 0x101, 0x10000, 0x6, 0x7fff, 0xffff, 0xe620, 0x2, 0x2, 0x1, 0x2, 0x14c, 0x100060a7, 0x6, 0xb6, 0xffffffff, 0x80000000, 0x7, 0x4, 0xc8, 0xee1, 0x0, 0xffff, 0x3, 0x7f, 0x100, 0x9602, 0x4, 0x2, 0xffff, 0x4006, 0x1, 0x10080, 0x6, 0x8, 0x30b1d693, 0x5a2d, 0xc, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x3, 0xb1c, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) close(0x4) r3 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r3, 0x0, 0x0) ioctl$BTRFS_IOC_TREE_SEARCH_V2(0xffffffffffffffff, 0xc0709411, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r4, 0xc0502100, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r4, 0x40182103, &(0x7f0000000240)={0x0, 0x1, r4, 0x6}) ioctl$EVIOCGABS0(0xffffffffffffffff, 0x80184540, &(0x7f00000000c0)=""/195) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f00000001c0)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) connect$pptp(r3, &(0x7f0000000080)={0x18, 0x2, {0x0, @rand_addr=0x64010102}}, 0x1e) r5 = syz_io_uring_complete(0x0, 0x0) r6 = gettid() madvise(&(0x7f0000004000/0x4000)=nil, 0x4000, 0xf) write$cgroup_pid(r5, &(0x7f0000000000)=r6, 0x12) syz_usb_connect(0x0, 0x5d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000551b8920b822276080c20102030109024b0001000000000904000000020a"], 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.226' (ED25519) to the list of known hosts. [ 23.394930][ T36] audit: type=1400 audit(1774795894.250:64): avc: denied { mounton } for pid=283 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.398729][ T283] cgroup: Unknown subsys name 'net' [ 23.417891][ T36] audit: type=1400 audit(1774795894.250:65): avc: denied { mount } for pid=283 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.446138][ T36] audit: type=1400 audit(1774795894.280:66): avc: denied { unmount } for pid=283 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.446595][ T283] cgroup: Unknown subsys name 'devices' [ 23.631155][ T283] cgroup: Unknown subsys name 'hugetlb' [ 23.636820][ T283] cgroup: Unknown subsys name 'rlimit' [ 23.813758][ T36] audit: type=1400 audit(1774795894.670:67): avc: denied { setattr } for pid=283 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.837712][ T36] audit: type=1400 audit(1774795894.670:68): avc: denied { mounton } for pid=283 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.862884][ T36] audit: type=1400 audit(1774795894.670:69): avc: denied { mount } for pid=283 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.893528][ T285] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 23.903106][ T36] audit: type=1400 audit(1774795894.760:70): avc: denied { relabelto } for pid=285 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.928746][ T36] audit: type=1400 audit(1774795894.760:71): avc: denied { write } for pid=285 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.948378][ T283] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.954606][ T36] audit: type=1400 audit(1774795894.790:72): avc: denied { read } for pid=283 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.989255][ T36] audit: type=1400 audit(1774795894.790:73): avc: denied { open } for pid=283 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.843561][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.850747][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.857897][ T291] bridge_slave_0: entered allmulticast mode [ 24.864369][ T291] bridge_slave_0: entered promiscuous mode [ 24.874238][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.881621][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.888736][ T291] bridge_slave_1: entered allmulticast mode [ 24.895273][ T291] bridge_slave_1: entered promiscuous mode [ 24.911785][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.918975][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.926153][ T293] bridge_slave_0: entered allmulticast mode [ 24.932626][ T293] bridge_slave_0: entered promiscuous mode [ 24.939753][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.946829][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.953998][ T293] bridge_slave_1: entered allmulticast mode [ 24.960408][ T293] bridge_slave_1: entered promiscuous mode [ 25.005424][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.013137][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.020465][ T290] bridge_slave_0: entered allmulticast mode [ 25.026751][ T290] bridge_slave_0: entered promiscuous mode [ 25.036480][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.043594][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.050733][ T290] bridge_slave_1: entered allmulticast mode [ 25.057087][ T290] bridge_slave_1: entered promiscuous mode [ 25.129305][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.136400][ T292] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.143610][ T292] bridge_slave_0: entered allmulticast mode [ 25.150431][ T292] bridge_slave_0: entered promiscuous mode [ 25.157018][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.164176][ T292] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.171835][ T292] bridge_slave_1: entered allmulticast mode [ 25.178113][ T292] bridge_slave_1: entered promiscuous mode [ 25.280863][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.287962][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.295349][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.302514][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.318516][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.325628][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.333050][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.340225][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.361940][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.369044][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.376347][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.383675][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.410861][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.417944][ T292] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.425458][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.432671][ T292] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.447862][ T44] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.455269][ T44] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.462911][ T44] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.470617][ T44] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.477978][ T44] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.485396][ T44] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.493157][ T44] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.500720][ T44] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.531660][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.538726][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.546409][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.553521][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.574856][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.581987][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.592853][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.599962][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.622847][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.629948][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.637595][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.644670][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.653421][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.660528][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.668092][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.675238][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.708029][ T293] veth0_vlan: entered promiscuous mode [ 25.726056][ T293] veth1_macvtap: entered promiscuous mode [ 25.758124][ T291] veth0_vlan: entered promiscuous mode [ 25.771524][ T292] veth0_vlan: entered promiscuous mode [ 25.780552][ T290] veth0_vlan: entered promiscuous mode [ 25.801132][ T292] veth1_macvtap: entered promiscuous mode [ 25.808457][ T291] veth1_macvtap: entered promiscuous mode [ 25.830121][ T290] veth1_macvtap: entered promiscuous mode [ 25.857571][ T293] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 26.017856][ T332] Zero length message leads to an empty skb [ 26.134392][ T347] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=4178 sclass=netlink_route_socket pid=347 comm=syz.3.10 [ 26.189048][ T10] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 26.289129][ T68] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 26.349613][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 26.359491][ T10] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 26.367683][ T10] usb 2-1: config 0 has no interface number 0 [ 26.381747][ T10] usb 2-1: config 0 interface 184 has no altsetting 0 [ 26.393188][ T10] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 26.405293][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.413700][ T10] usb 2-1: Product: syz [ 26.418480][ T10] usb 2-1: Manufacturer: syz [ 26.423324][ T10] usb 2-1: SerialNumber: syz [ 26.430290][ T10] usb 2-1: config 0 descriptor?? [ 26.436449][ T10] smsc75xx v1.0.0 [ 26.468870][ T68] usb 1-1: Using ep0 maxpacket: 16 [ 26.483029][ T68] usb 1-1: unable to get BOS descriptor or descriptor too short [ 26.491815][ T68] usb 1-1: config 12 has an invalid interface number: 249 but max is 0 [ 26.500251][ T68] usb 1-1: config 12 has no interface number 0 [ 26.506519][ T68] usb 1-1: config 12 interface 249 has no altsetting 0 [ 26.515112][ T68] usb 1-1: New USB device found, idVendor=1a0a, idProduct=0102, bcdDevice=f1.c2 [ 26.524268][ T68] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.532524][ T68] usb 1-1: Product: syz [ 26.536821][ T68] usb 1-1: Manufacturer: syz [ 26.541515][ T68] usb 1-1: SerialNumber: syz [ 26.708918][ T306] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 26.748985][ T366] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 26.780763][ T366] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 26.789498][ T366] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 26.859107][ T306] usb 4-1: Using ep0 maxpacket: 16 [ 26.865567][ T306] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 26.876905][ T306] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 26.890791][ T306] usb 4-1: New USB device found, idVendor=1b96, idProduct=0008, bcdDevice= 0.00 [ 26.897229][ T68] usb_ehset_test 1-1:12.249: probe with driver usb_ehset_test failed with error -32 [ 26.908253][ T306] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.919220][ T306] usb 4-1: config 0 descriptor?? [ 26.926825][ T68] usb 1-1: USB disconnect, device number 2 [ 27.038718][ T10] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 27.049715][ T10] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 27.059361][ T10] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 27.070311][ T10] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 27.080430][ T10] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 27.090770][ T10] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 27.100459][ T10] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -32 [ 27.421657][ T306] usbhid 4-1:0.0: can't add hid device: -71 [ 27.427875][ T306] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 27.438526][ T306] usb 4-1: USB disconnect, device number 2 [ 27.459686][ T374] netlink: 8 bytes leftover after parsing attributes in process `syz.0.18'. [ 27.728846][ T10] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 27.878903][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 27.887420][ T10] usb 1-1: New USB device found, idVendor=0d8c, idProduct=0102, bcdDevice= 0.40 [ 27.896752][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.904926][ T10] usb 1-1: Product: syz [ 27.909152][ T10] usb 1-1: Manufacturer: syz [ 27.913917][ T10] usb 1-1: SerialNumber: syz [ 27.960205][ T68] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 27.973560][ T381] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:25 [ 28.126735][ T68] usb 3-1: unable to get BOS descriptor or descriptor too short [ 28.147637][ T68] usb 3-1: not running at top speed; connect to a high speed hub [ 28.157870][ T68] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1024, setting to 64 [ 28.173440][ T369] usb 2-1: USB disconnect, device number 2 [ 28.205895][ T68] usb 3-1: New USB device found, idVendor=0582, idProduct=0114, bcdDevice= 0.40 [ 28.215955][ T68] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.231339][ T10] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 28.246881][ T68] usb 3-1: Product: syz [ 28.256922][ T10] usb 1-1: USB disconnect, device number 3 [ 28.269947][ T68] usb 3-1: Manufacturer: syz [ 28.274701][ T68] usb 3-1: SerialNumber: syz [ 28.288037][ T379] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 28.295449][ T379] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 28.402428][ T407] kvm: kvm [406]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0x11e) = 0x0 [ 28.412748][ T409] netlink: 'syz.1.29': attribute type 6 has an invalid length. [ 28.434483][ T36] kauditd_printk_skb: 87 callbacks suppressed [ 28.434503][ T36] audit: type=1400 audit(1774795899.290:161): avc: denied { write } for pid=406 comm="syz.3.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 28.464642][ T36] audit: type=1400 audit(1774795899.290:162): avc: denied { nlmsg_write } for pid=406 comm="syz.3.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 28.728992][ T10] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 28.748933][ T306] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 28.880242][ T10] usb 2-1: config 0 has an invalid interface number: 123 but max is 0 [ 28.888987][ T10] usb 2-1: config 0 has no interface number 0 [ 28.895134][ T10] usb 2-1: config 0 interface 123 altsetting 193 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 28.908969][ T10] usb 2-1: config 0 interface 123 has no altsetting 0 [ 28.916372][ T36] audit: type=1400 audit(1774795899.770:163): avc: denied { unmount } for pid=290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 28.944246][ T420] netlink: 1335 bytes leftover after parsing attributes in process `syz.0.32'. [ 28.951000][ T10] usb 2-1: New USB device found, idVendor=0403, idProduct=f850, bcdDevice=a4.46 [ 28.967380][ T306] usb 4-1: unable to get BOS descriptor or descriptor too short [ 28.975846][ T10] usb 2-1: New USB device strings: Mfr=133, Product=2, SerialNumber=0 [ 28.984726][ T36] audit: type=1400 audit(1774795899.800:164): avc: denied { block_suspend } for pid=419 comm="syz.0.32" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 29.006398][ T10] usb 2-1: Product: syz [ 29.011775][ T10] usb 2-1: Manufacturer: syz [ 29.016749][ T306] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 37, changing to 7 [ 29.028468][ T306] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 116, changing to 7 [ 29.040191][ T10] usb 2-1: config 0 descriptor?? [ 29.047154][ T306] usb 4-1: New USB device found, idVendor=07fd, idProduct=0004, bcdDevice= 0.40 [ 29.056719][ T306] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.065137][ T306] usb 4-1: Product: syz [ 29.069539][ T306] usb 4-1: Manufacturer: syz [ 29.078834][ T306] usb 4-1: SerialNumber: syz [ 29.086878][ T68] usb 3-1: MIDIStreaming interface descriptor not found [ 29.096249][ T36] audit: type=1400 audit(1774795899.950:165): avc: denied { nlmsg_write } for pid=421 comm="syz.0.33" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 29.117806][ T68] usb 3-1: too many endpoints [ 29.140674][ T68] usb 3-1: USB disconnect, device number 2 [ 29.165407][ T36] audit: type=1400 audit(1774795900.020:166): avc: denied { create } for pid=428 comm="syz.2.34" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 29.190124][ T310] udevd[310]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 29.211793][ T36] audit: type=1400 audit(1774795900.020:167): avc: denied { read write } for pid=430 comm="syz.0.35" name="rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 29.250348][ T36] audit: type=1400 audit(1774795900.020:168): avc: denied { open } for pid=430 comm="syz.0.35" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 29.283974][ T36] audit: type=1400 audit(1774795900.020:169): avc: denied { map } for pid=430 comm="syz.0.35" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 29.307947][ T36] audit: type=1400 audit(1774795900.020:170): avc: denied { execute } for pid=430 comm="syz.0.35" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 29.365160][ T10] ftdi_sio 2-1:0.123: FTDI USB Serial Device converter detected [ 29.374514][ T10] ftdi_sio ttyUSB0: unknown device type: 0xa446 [ 29.388902][ T306] usb 4-1: Can't get UAC3 power state for id 10 [ 29.410776][ T10] usb 2-1: USB disconnect, device number 3 [ 29.417423][ T306] usb 4-1: 2:0: failed to get current value for ch 0 (-71) [ 29.428973][ T10] ftdi_sio 2-1:0.123: device disconnected [ 29.441150][ T306] usb 4-1: 2:0: cannot get min/max values for control 2 (id 2) [ 29.467351][ T306] usb 4-1: USB disconnect, device number 3 [ 29.482718][ T324] udevd[324]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 29.578868][ T68] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 29.730732][ T68] usb 3-1: unable to get BOS descriptor or descriptor too short [ 29.739526][ T68] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 37, changing to 7 [ 29.750558][ T68] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 116, changing to 7 [ 29.765308][ T68] usb 3-1: New USB device found, idVendor=2b73, idProduct=001b, bcdDevice= 0.40 [ 29.774617][ T68] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.782782][ T68] usb 3-1: Product: syz [ 29.787001][ T68] usb 3-1: Manufacturer: syz [ 29.791711][ T68] usb 3-1: SerialNumber: syz [ 29.885727][ T459] netlink: 8 bytes leftover after parsing attributes in process `syz.3.41'. [ 29.895454][ T459] input: syz1 as /devices/virtual/input/input5 [ 30.006724][ T68] usb 3-1: Can't get UAC3 power state for id 10 [ 30.022751][ T68] usb 3-1: 2:0: failed to get current value for ch 0 (-71) [ 30.042479][ T68] usb 3-1: 2:0: cannot get min/max values for control 2 (id 2) [ 30.053549][ T471] ip6gre0: mtu less than device minimum [ 30.072766][ T68] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 30.092915][ T324] udevd[324]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 30.112367][ T68] usb 3-1: USB disconnect, device number 3 [ 30.123634][ T477] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 30.123725][ T477] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 30.138100][ T477] rust_binder: Read failure Err(EFAULT) in pid:30 [ 30.147023][ T477] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:30 [ 30.468866][ T31] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 30.502727][ T493] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65 sclass=netlink_route_socket pid=493 comm=syz.3.53 [ 30.515307][ T493] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=55 sclass=netlink_route_socket pid=493 comm=syz.3.53 [ 30.516428][ T46] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 30.630095][ T31] usb 2-1: config 2 has an invalid interface number: 184 but max is 0 [ 30.638647][ T31] usb 2-1: config 2 has no interface number 0 [ 30.645147][ T31] usb 2-1: config 2 interface 184 has no altsetting 0 [ 30.654161][ T31] usb 2-1: New USB device found, idVendor=046d, idProduct=08c6, bcdDevice= c.2f [ 30.664467][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.672759][ T31] usb 2-1: Product: syz [ 30.677114][ T31] usb 2-1: Manufacturer: syz [ 30.682331][ T31] usb 2-1: SerialNumber: syz [ 30.698841][ T46] usb 1-1: Using ep0 maxpacket: 16 [ 30.705187][ T46] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 30.725586][ T46] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 30.736097][ T46] usb 1-1: config 0 interface 0 has no altsetting 0 [ 30.743188][ T46] usb 1-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 30.752594][ T46] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.766096][ T46] usb 1-1: config 0 descriptor?? [ 30.788878][ T363] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 30.894748][ T31] usb 2-1: unknown interface protocol 0xd0, assuming v1 [ 30.902019][ T31] usb 2-1: cannot find UAC_HEADER [ 30.910615][ T31] snd-usb-audio 2-1:2.184: probe with driver snd-usb-audio failed with error -22 [ 30.922949][ T31] usb 2-1: USB disconnect, device number 4 [ 30.959729][ T363] usb 3-1: Using ep0 maxpacket: 16 [ 30.966091][ T363] usb 3-1: config 1 has an invalid descriptor of length 235, skipping remainder of the config [ 30.977052][ T363] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 30.987574][ T363] usb 3-1: New USB device found, idVendor=17cc, idProduct=1011, bcdDevice= 0.40 [ 30.996740][ T363] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 31.002780][ T335] udevd[335]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:2.184/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 31.015173][ T363] usb 3-1: Product: syz [ 31.025348][ T363] usb 3-1: Manufacturer: syz [ 31.038908][ T384] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 31.043095][ T363] usb 3-1: SerialNumber: syz [ 31.190504][ T46] usbhid 1-1:0.0: can't add hid device: -71 [ 31.199813][ T384] usb 4-1: Using ep0 maxpacket: 8 [ 31.205566][ T46] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 31.214804][ T384] usb 4-1: config 0 has an invalid interface number: 31 but max is 0 [ 31.227652][ T384] usb 4-1: config 0 has no interface number 0 [ 31.235377][ T46] usb 1-1: USB disconnect, device number 4 [ 31.243544][ T384] usb 4-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 31.257248][ T384] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 31.265890][ T384] usb 4-1: Product: syz [ 31.271162][ T384] usb 4-1: Manufacturer: syz [ 31.276530][ T384] usb 4-1: SerialNumber: syz [ 31.290083][ T384] usb 4-1: config 0 descriptor?? [ 31.310823][ T363] usb 3-1: 0:1 : does not exist [ 31.315901][ T363] usb 3-1: BAAD HEADSET ADAPTER c_chmask mismatch [ 31.327463][ T363] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 31.349715][ T363] usb 3-1: USB disconnect, device number 4 [ 31.365595][ T335] udevd[335]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 31.499775][ T384] usb 4-1: Found UVC 0.04 device syz (046d:08c3) [ 31.506978][ T516] input: syz1 as /devices/virtual/input/input6 [ 31.516625][ T384] usb 4-1: No valid video chain found. [ 31.534679][ T384] usb 4-1: USB disconnect, device number 4 [ 31.584273][ T520] x_tables: duplicate underflow at hook 1 [ 31.806297][ T531] capability: warning: `syz.0.63' uses 32-bit capabilities (legacy support in use) [ 32.089037][ T384] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 32.126392][ T543] tc_dump_action: action bad kind [ 32.240466][ T384] usb 1-1: unable to get BOS descriptor or descriptor too short [ 32.248972][ T384] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 32.259518][ T384] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 32.270885][ T384] usb 1-1: New USB device found, idVendor=0763, idProduct=2081, bcdDevice= 0.40 [ 32.280026][ T384] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.288475][ T384] usb 1-1: Product: syz [ 32.292880][ T384] usb 1-1: Manufacturer: syz [ 32.297523][ T384] usb 1-1: SerialNumber: syz [ 32.398902][ T10] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 32.511498][ T384] usb 1-1: 0:1 : does not exist [ 32.516545][ T384] usb 1-1: BAAD GENERIC IO: no channels? [ 32.524386][ T384] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 32.529073][ T10] usb 3-1: device descriptor read/64, error -71 [ 32.538031][ T384] usb 1-1: USB disconnect, device number 5 [ 32.553134][ T335] udevd[335]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 32.778897][ T10] usb 3-1: device descriptor read/64, error -71 [ 33.018880][ T10] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 33.082853][ T581] cgroup: subsys name conflicts with all [ 33.112790][ T581] overlay: Unknown parameter 'volatile:redirect_dir' [ 33.149047][ T10] usb 3-1: device descriptor read/64, error -71 [ 33.368888][ T46] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 33.388908][ T10] usb 3-1: device descriptor read/64, error -71 [ 33.468856][ T306] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 33.498965][ T10] usb usb3-port1: attempt power cycle [ 33.520291][ T46] usb 1-1: config 1 interface 0 has no altsetting 0 [ 33.529283][ T46] usb 1-1: string descriptor 0 read error: -22 [ 33.535591][ T46] usb 1-1: New USB device found, idVendor=5543, idProduct=006e, bcdDevice= 0.40 [ 33.545148][ T46] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.618872][ T306] usb 4-1: Using ep0 maxpacket: 32 [ 33.625500][ T306] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 33.637362][ T306] usb 4-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 33.646670][ T306] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.654736][ T306] usb 4-1: Product: syz [ 33.659012][ T306] usb 4-1: Manufacturer: syz [ 33.663643][ T306] usb 4-1: SerialNumber: syz [ 33.669269][ T306] usb 4-1: config 0 descriptor?? [ 33.675504][ T306] usb 4-1: bad CDC descriptors [ 33.680600][ T306] usb 4-1: unsupported MDLM descriptors [ 33.838900][ T10] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 33.860346][ T10] usb 3-1: device descriptor read/8, error -71 [ 33.877227][ T384] usb 4-1: USB disconnect, device number 5 [ 33.956295][ T586] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.965453][ T586] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.989896][ T10] usb 3-1: device descriptor read/8, error -71 [ 34.228926][ T10] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 34.250279][ T10] usb 3-1: device descriptor read/8, error -71 [ 34.374769][ T586] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 34.377693][ T46] uclogic 0003:5543:006E.0001: interface is invalid, ignoring [ 34.387654][ T10] usb 3-1: device descriptor read/8, error -71 [ 34.403172][ T586] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 34.418179][ T306] usb 1-1: USB disconnect, device number 6 [ 34.453552][ T36] kauditd_printk_skb: 43 callbacks suppressed [ 34.453580][ T36] audit: type=1400 audit(1774795905.310:214): avc: denied { append } for pid=593 comm="syz.3.81" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 34.498688][ T36] audit: type=1400 audit(1774795905.340:215): avc: denied { ioctl } for pid=593 comm="syz.3.81" path="socket:[5447]" dev="sockfs" ino=5447 ioctlcmd=0x9365 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 34.529205][ T10] usb usb3-port1: unable to enumerate USB device [ 34.565792][ T36] audit: type=1400 audit(1774795905.350:216): avc: denied { listen } for pid=600 comm="syz.1.83" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 34.585887][ T36] audit: type=1400 audit(1774795905.350:217): avc: denied { accept } for pid=600 comm="syz.1.83" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 34.651720][ T608] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=608 comm=syz.0.86 [ 34.665700][ T608] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=5 sclass=netlink_tcpdiag_socket pid=608 comm=syz.0.86 [ 34.709302][ T36] audit: type=1400 audit(1774795905.560:218): avc: denied { map } for pid=610 comm="syz.3.87" path="socket:[6411]" dev="sockfs" ino=6411 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 34.749308][ T36] audit: type=1400 audit(1774795905.600:219): avc: denied { name_bind } for pid=614 comm="syz.0.88" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 34.784503][ T36] audit: type=1400 audit(1774795905.640:220): avc: denied { rename } for pid=617 comm="syz.3.89" name="file0" dev="tmpfs" ino=205 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 34.813082][ T36] audit: type=1400 audit(1774795905.670:221): avc: denied { read } for pid=617 comm="syz.3.89" name=".pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 34.840637][ T36] audit: type=1400 audit(1774795905.670:222): avc: denied { open } for pid=617 comm="syz.3.89" path="/31/bus/file0/.pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 34.865886][ T36] audit: type=1400 audit(1774795905.670:223): avc: denied { ioctl } for pid=617 comm="syz.3.89" path="/31/bus/file0/.pending_reads" dev="incremental-fs" ino=2 ioctlcmd=0x6726 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 34.892577][ T621] raw_sendmsg: syz.0.90 forgot to set AF_INET. Fix it! [ 34.924998][ T621] netlink: 51 bytes leftover after parsing attributes in process `syz.0.90'. [ 34.941422][ T559] ------------[ cut here ]------------ [ 34.946986][ T559] WARNING: CPU: 1 PID: 559 at fs/overlayfs/util.c:602 ovl_dir_modified+0x15a/0x190 [ 34.956535][ T559] Modules linked in: [ 34.960595][ T559] CPU: 1 UID: 0 PID: 559 Comm: syz.3.70 Not tainted syzkaller #0 9f86d9c18f1652eb5f7cacfb207b3899f57a91b2 [ 34.972186][ T559] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 34.982430][ T559] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 34.988149][ T559] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 de 75 97 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 f6 48 3f ff <0f> 0b e9 3e ff ff ff e8 ea 48 3f ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 35.007875][ T559] RSP: 0018:ffffc9000e2d7748 EFLAGS: 00010293 [ 35.014129][ T559] RAX: ffffffff824861ba RBX: 0000000000000000 RCX: ffff88811bc5cc00 [ 35.022201][ T559] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 35.030430][ T559] RBP: ffffc9000e2d7770 R08: ffff8881319d47ff R09: 1ffff1102633a8ff [ 35.038453][ T559] R10: dffffc0000000000 R11: ffffed102633a900 R12: 0000000000000000 [ 35.046519][ T559] R13: dffffc0000000000 R14: ffff8881319d4760 R15: ffff888117edd550 [ 35.054756][ T559] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 35.063869][ T559] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 35.070546][ T559] CR2: 0000200000010000 CR3: 0000000131244000 CR4: 00000000003526b0 [ 35.078589][ T559] Call Trace: [ 35.081960][ T559] [ 35.084943][ T559] ovl_do_remove+0x81b/0xda0 [ 35.089645][ T559] ? ovl_set_redirect+0x780/0x780 [ 35.094842][ T559] ? down_write+0xee/0x2b0 [ 35.099480][ T559] ? __cfi_down_write+0x10/0x10 [ 35.104561][ T559] ovl_rmdir+0x1e/0x30 [ 35.108927][ T559] vfs_rmdir+0x3e3/0x560 [ 35.113234][ T559] incfs_kill_sb+0x109/0x230 [ 35.118071][ T559] deactivate_locked_super+0xd5/0x2a0 [ 35.123588][ T559] deactivate_super+0xb8/0xe0 [ 35.128340][ T559] cleanup_mnt+0x406/0x4a0 [ 35.132849][ T559] __cleanup_mnt+0x1d/0x40 [ 35.137319][ T559] task_work_run+0x1e5/0x260 [ 35.142145][ T559] ? __cfi_task_work_run+0x10/0x10 [ 35.147383][ T559] ? free_nsproxy+0x223/0x290 [ 35.152180][ T559] do_exit+0x9ad/0x2720 [ 35.156416][ T559] ? __cfi_do_exit+0x10/0x10 [ 35.161099][ T559] ? __kasan_check_write+0x18/0x20 [ 35.166281][ T559] ? _raw_spin_lock_irq+0x93/0x120 [ 35.171496][ T559] ? __kasan_check_read+0x15/0x20 [ 35.176585][ T559] ? cgroup_update_frozen+0x160/0x970 [ 35.182073][ T559] do_group_exit+0x229/0x2f0 [ 35.186799][ T559] ? cgroup_leave_frozen+0x16b/0x2b0 [ 35.192208][ T559] get_signal+0x1398/0x14e0 [ 35.196799][ T559] arch_do_signal_or_restart+0xbc/0x760 [ 35.202504][ T559] ? common_nsleep+0x93/0xb0 [ 35.207144][ T559] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 35.213373][ T559] ? __se_sys_clock_nanosleep+0x321/0x3b0 [ 35.219172][ T559] ? __kasan_check_read+0x15/0x20 [ 35.224251][ T559] ? fpregs_assert_state_consistent+0xb6/0xe0 [ 35.230613][ T559] syscall_exit_to_user_mode+0x57/0xb0 [ 35.236172][ T559] do_syscall_64+0x63/0xf0 [ 35.240844][ T559] ? clear_bhb_loop+0x50/0xa0 [ 35.245583][ T559] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 35.251833][ T559] RIP: 0033:0x7f040db5d04e [ 35.256324][ T559] Code: Unable to access opcode bytes at 0x7f040db5d024. [ 35.263411][ T559] RSP: 002b:00007f040e9fff58 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 [ 35.271998][ T559] RAX: fffffffffffffdfc RBX: 00007f040ea006c0 RCX: 00007f040db5d04e [ 35.280097][ T559] RDX: 00007f040e9fffb0 RSI: 0000000000000000 RDI: 0000000000000000 [ 35.288200][ T559] RBP: 00007f040dc32c91 R08: 0000000000000000 R09: 0000000000000000 [ 35.296408][ T559] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 35.304485][ T559] R13: 00007f040de16038 R14: 00007f040de15fa0 R15: 00007fff6479ee68 [ 35.312581][ T559] [ 35.315655][ T559] ---[ end trace 0000000000000000 ]--- [ 35.321885][ T559] ------------[ cut here ]------------ [ 35.327382][ T559] WARNING: CPU: 1 PID: 559 at fs/overlayfs/util.c:602 ovl_dir_modified+0x15a/0x190 [ 35.336835][ T559] Modules linked in: [ 35.340873][ T559] CPU: 1 UID: 0 PID: 559 Comm: syz.3.70 Tainted: G W syzkaller #0 9f86d9c18f1652eb5f7cacfb207b3899f57a91b2 [ 35.353889][ T559] Tainted: [W]=WARN [ 35.357760][ T559] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 35.368097][ T559] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 35.373845][ T559] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 de 75 97 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 f6 48 3f ff <0f> 0b e9 3e ff ff ff e8 ea 48 3f ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 35.393911][ T559] RSP: 0018:ffffc9000e2d7748 EFLAGS: 00010293 [ 35.400061][ T559] RAX: ffffffff824861ba RBX: 0000000000000000 RCX: ffff88811bc5cc00 [ 35.408087][ T559] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 35.416242][ T559] RBP: ffffc9000e2d7770 R08: ffff8881319d47ff R09: 1ffff1102633a8ff [ 35.424472][ T559] R10: dffffc0000000000 R11: ffffed102633a900 R12: 0000000000000000 [ 35.432520][ T559] R13: dffffc0000000000 R14: ffff8881319d4760 R15: ffff888117edd550 [ 35.440564][ T559] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 35.449851][ T559] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 35.456833][ T559] CR2: 0000200000010000 CR3: 0000000131244000 CR4: 00000000003526b0 [ 35.465154][ T559] Call Trace: [ 35.468522][ T559] [ 35.471652][ T559] ovl_do_remove+0x81b/0xda0 [ 35.476401][ T559] ? ovl_set_redirect+0x780/0x780 [ 35.481707][ T559] ? down_write+0xee/0x2b0 [ 35.486166][ T559] ? __cfi_down_write+0x10/0x10 [ 35.491121][ T559] ovl_rmdir+0x1e/0x30 [ 35.495242][ T559] vfs_rmdir+0x3e3/0x560 [ 35.499567][ T559] incfs_kill_sb+0x1a0/0x230 [ 35.504208][ T559] deactivate_locked_super+0xd5/0x2a0 [ 35.510271][ T559] deactivate_super+0xb8/0xe0 [ 35.514989][ T559] cleanup_mnt+0x406/0x4a0 [ 35.519521][ T559] __cleanup_mnt+0x1d/0x40 [ 35.523981][ T559] task_work_run+0x1e5/0x260 [ 35.528649][ T559] ? __cfi_task_work_run+0x10/0x10 [ 35.533819][ T559] ? free_nsproxy+0x223/0x290 [ 35.538724][ T559] do_exit+0x9ad/0x2720 [ 35.542977][ T559] ? __cfi_do_exit+0x10/0x10 [ 35.547793][ T559] ? __kasan_check_write+0x18/0x20 [ 35.553021][ T559] ? _raw_spin_lock_irq+0x93/0x120 [ 35.558287][ T559] ? __kasan_check_read+0x15/0x20 [ 35.563403][ T559] ? cgroup_update_frozen+0x160/0x970 [ 35.568862][ T559] do_group_exit+0x229/0x2f0 [ 35.573497][ T559] ? cgroup_leave_frozen+0x16b/0x2b0 [ 35.578863][ T559] get_signal+0x1398/0x14e0 [ 35.583529][ T559] arch_do_signal_or_restart+0xbc/0x760 [ 35.589243][ T559] ? common_nsleep+0x93/0xb0 [ 35.594046][ T559] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 35.600372][ T559] ? __se_sys_clock_nanosleep+0x321/0x3b0 [ 35.606158][ T559] ? __kasan_check_read+0x15/0x20 [ 35.611348][ T559] ? fpregs_assert_state_consistent+0xb6/0xe0 [ 35.617457][ T559] syscall_exit_to_user_mode+0x57/0xb0 [ 35.623079][ T559] do_syscall_64+0x63/0xf0 [ 35.627561][ T559] ? clear_bhb_loop+0x50/0xa0 [ 35.632344][ T559] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 35.638280][ T559] RIP: 0033:0x7f040db5d04e [ 35.642784][ T559] Code: Unable to access opcode bytes at 0x7f040db5d024. [ 35.650269][ T559] RSP: 002b:00007f040e9fff58 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 [ 35.658851][ T559] RAX: fffffffffffffdfc RBX: 00007f040ea006c0 RCX: 00007f040db5d04e [ 35.667393][ T559] RDX: 00007f040e9fffb0 RSI: 0000000000000000 RDI: 0000000000000000 [ 35.675451][ T559] RBP: 00007f040dc32c91 R08: 0000000000000000 R09: 0000000000000000 [ 35.683675][ T559] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 35.692254][ T559] R13: 00007f040de16038 R14: 00007f040de15fa0 R15: 00007fff6479ee68 [ 35.700803][ T559] [ 35.703951][ T559] ---[ end trace 0000000000000000 ]--- [ 35.781474][ T12] bridge_slave_1: left allmulticast mode [ 35.787326][ T12] bridge_slave_1: left promiscuous mode [ 35.793178][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.801597][ T12] bridge_slave_0: left allmulticast mode [ 35.807534][ T12] bridge_slave_0: left promiscuous mode [ 35.813629][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.912013][ T12] veth1_macvtap: left promiscuous mode [ 35.917619][ T12] veth0_vlan: left promiscuous mode