last executing test programs: 7.714756293s ago: executing program 2 (id=29): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000240)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x56a, 0xd7, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x0, 0x3, 0x5, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x86b, 0x5f, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0xc, 0x0, 0x6}}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, &(0x7f0000002300)={0x2c, &(0x7f0000000040)={0x40, 0x23, 0x2f, {0x2f, 0x6, "25f4e4e9f494c657ebb4910a7d1e160d0e3c2199b77bb91ea647ba8c686a59370f60a1d38ebb6f07b1b1461dd1"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) (async) syz_open_dev$usbmon(&(0x7f0000000000), 0x1800, 0x30d180) 6.284559766s ago: executing program 2 (id=37): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000029c0)=@updpolicy={0x1fc, 0x19, 0x1, 0x0, 0x0, {{@in6=@private2, @in6=@empty, 0x0, 0x40, 0x0, 0x0, 0xa, 0x0, 0x0, 0x8}, {0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x1d}, {0x0, 0x0, 0x0, 0x2dd}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, [@tmpl={0x144, 0x5, [{{@in=@dev={0xac, 0x14, 0x14, 0x3b}, 0x4d3, 0x2b}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0xc}, 0x0, 0x0, 0x0, 0xff}, {{@in6=@private2, 0x0, 0x32}, 0x0, @in=@local, 0x0, 0x1, 0x0, 0x0, 0x0, 0xffffffff}, {{@in6=@loopback, 0x0, 0x3c}, 0x2, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x0, 0x1, 0x3, 0x0, 0x0, 0x6}, {{@in6=@private1, 0x0, 0x2b}, 0x2, @in=@empty, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3, 0x278b6a28}, {{@in6=@empty, 0x0, 0x6c}, 0x2, @in=@empty, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000}]}]}, 0x1fc}}, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendto$inet6(r1, &(0x7f0000000040)="2ae05a4d", 0x4, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty, 0x9}, 0x1c) recvmmsg(r1, &(0x7f0000000d80), 0x4000000000001e9, 0x10162, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) (async) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000029c0)=@updpolicy={0x1fc, 0x19, 0x1, 0x0, 0x0, {{@in6=@private2, @in6=@empty, 0x0, 0x40, 0x0, 0x0, 0xa, 0x0, 0x0, 0x8}, {0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x1d}, {0x0, 0x0, 0x0, 0x2dd}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, [@tmpl={0x144, 0x5, [{{@in=@dev={0xac, 0x14, 0x14, 0x3b}, 0x4d3, 0x2b}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0xc}, 0x0, 0x0, 0x0, 0xff}, {{@in6=@private2, 0x0, 0x32}, 0x0, @in=@local, 0x0, 0x1, 0x0, 0x0, 0x0, 0xffffffff}, {{@in6=@loopback, 0x0, 0x3c}, 0x2, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x0, 0x1, 0x3, 0x0, 0x0, 0x6}, {{@in6=@private1, 0x0, 0x2b}, 0x2, @in=@empty, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3, 0x278b6a28}, {{@in6=@empty, 0x0, 0x6c}, 0x2, @in=@empty, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000}]}]}, 0x1fc}}, 0x0) (async) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) (async) sendto$inet6(r1, &(0x7f0000000040)="2ae05a4d", 0x4, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty, 0x9}, 0x1c) (async) recvmmsg(r1, &(0x7f0000000d80), 0x4000000000001e9, 0x10162, 0x0) (async) 6.242806309s ago: executing program 2 (id=38): r0 = openat$selinux_create(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) pwrite64(r0, &(0x7f0000000d40)="3703c70f70e244b7878fedf0c0c6c2ff2f524255d61dbfb25921e3d3686454b93e5842722103c5c67b800da4173b9e63544ee1f32fd585dab49f06f4e7e92a867080b7b83c0a31253633", 0x4a, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000013c0)='./file0/file0\x00', 0x42, 0x44) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc0686611, &(0x7f0000000000)={0x67, 0x0, 0x4, 0x2000, &(0x7f0000b2c000/0x2000)=nil}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000004c0)={{{@in6, @in=@empty}}, {{@in=@loopback}, 0x0, @in=@empty}}, &(0x7f00000001c0)=0xe8) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000240), 0x10000, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file1'}}, {@xino_off}], [{@fowner_gt}, {@fsname}, {@appraise}, {@pcr={'pcr', 0x3d, 0x1d}}, {@fsmagic={'fsmagic', 0x3d, 0x1}}]}) r3 = open(&(0x7f0000000040)='./file0\x00', 0x400, 0x43) mknodat$loop(r3, &(0x7f0000000200)='./file1\x00', 0x40, 0x1) chdir(&(0x7f00000003c0)='./bus\x00') renameat2(0xffffffffffffff9c, &(0x7f0000000a00)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./file1\x00', 0x0) r4 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x109301) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TIOCPKT(r5, 0x5420, &(0x7f0000000100)=0xcf5) ppoll(&(0x7f0000000180)=[{r5, 0x1}], 0x1, &(0x7f00000001c0)={0x0, 0x3938700}, &(0x7f0000000200)={[0x200]}, 0x8) ioctl$USBDEVFS_CONTROL(r4, 0xc0185500, &(0x7f00000000c0)={0xa3, 0xd, 0x4, 0xff, 0x0, 0xfeff, 0x0}) rename(&(0x7f0000000100)='./file1\x00', &(0x7f0000000140)='./file0\x00') r6 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) write$UHID_CREATE2(r6, 0x0, 0x3000000) r7 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000040)=ANY=[], 0x0) syz_usb_control_io(r7, 0x0, 0x0) r8 = syz_open_dev$hiddev(&(0x7f0000000000), 0x2132, 0x2000) ioctl$HIDIOCGNAME(r8, 0x80404806, &(0x7f00000000c0)) syz_usb_control_io$hid(r7, &(0x7f0000000200)={0x24, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYRESOCT=r8], 0x0}, 0x0) 4.532378048s ago: executing program 3 (id=42): syz_usb_connect$uac1(0x7, 0x71, &(0x7f0000000040)=ANY=[@ANYBLOB="12011001000000406b1d010140000102030109025f0003010300f40904000000010100000a2401030003020102090401000001020000090401010101020000090501090000f7090607250183020c000904020000010200000904020000000000000010"], 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000300)={'veth0_to_team\x00', &(0x7f00000004c0)=@ethtool_cmd={0x4e, 0xa1, 0x9, 0x7, 0x2, 0x8, 0xff, 0xdb, 0x7c, 0xc5, 0x7, 0x8, 0x5, 0x1, 0x4, 0x7, [0x5, 0x9]}}) openat(0xffffffffffffff9c, &(0x7f00000013c0)='./file1\x00', 0x42, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000400)='./file0/file1\x00', 0x40, 0x83) fcntl$setstatus(r1, 0x4, 0x24400) lseek(r1, 0x100, 0x4) syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44000010203010902bf0002010650000900000000020d00000524060001082400a9b30d240f010a0000000300ff000606241a05001407240a050905580c240c00000000a90c0900030424020204240200042402024424"], 0x0) syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120001a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c2402"], 0x0) 4.49227625s ago: executing program 0 (id=43): mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x40) fadvise64(r0, 0x0, 0x2, 0x4) lsetxattr$security_capability(&(0x7f0000002580)='./file0\x00', &(0x7f00000025c0), 0x0, 0x0, 0x0) write$binfmt_elf32(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="7f454c460104028d0400000000000000020006000400000019060000380000005e0200000804000004002000010005"], 0x58) r1 = userfaultfd(0x80001) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000002a00)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = fcntl$dupfd(r2, 0x0, r1) connect$unix(r3, &(0x7f0000002ac0)=@file={0x0, './file0\x00'}, 0x6e) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1400000014090003000000ffdbdf250500000000"], 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x20004000) execveat(r4, &(0x7f0000000000)='./file0\x00', &(0x7f0000000340)={[&(0x7f0000000200)='security.capability\x00', &(0x7f0000000240)='-(]$^)}\\\'}*.*\xcc\':\f*\x1b}$:;!{@{\\.*:\x00']}, &(0x7f0000000600)={[&(0x7f0000000480)='security.capability\x00', &(0x7f00000004c0)='\x00', &(0x7f0000000500)='/dev/snd/timer\x00', &(0x7f0000000540)='Ai%#\x00', &(0x7f0000000580)='\x00', &(0x7f00000005c0)='\x00']}, 0x100) sendmmsg$inet(r2, &(0x7f0000000b80)=[{{&(0x7f0000000080)={0x2, 0x4e21, @private=0xa010100}, 0x0, &(0x7f0000000440)=[{&(0x7f0000000140)="f3af114031377a0e7b6b2bc57ec909780b62f6f862f22374d629fbefec3332acbd6477dea97d206a9ea691fdd5cee04091b2c7616805ff54f4cc8ada3ba3cb25d30d2cb0897e57de4da5026b7c35865b8a7dc98cc99a7b3d9c87c7e9ccb69619d97d535f232df7334179d10fc43ca7902aea20e99d332c86438f11f915efb6a04b51622196358280c9b721aba45160ad1894bd0f49377297cae5299fd505262614bfbccf8a05fb3706b418885739e2fe48c310eecc62341208872614d214b22f"}, {&(0x7f0000000280)="aeaf7f631f36ae222cc0e85f29f1178b72ae6aa45ae6aaea539228e9009878093342433084272dc02a0decdf44"}, {&(0x7f0000000380)="11e3dabb0119e94f78ef08c9dc122d00cb56932fbace0030b907d778859e1e93b93382864bfba145a122db511f69da6c880fc432e0a32f4ff919a1c126aa28a40f24e67bc76bbdf2ea7f60bfe1842dd10d6a5d1a04f99405a8ae7943138c57a5a634dd7c310366d2c66355c7063a1f7366efa8a195808a3ab52d27144d9eac6024ffba601da2e25e367ec2f6ee4c4ed0"}, {&(0x7f00000002c0)="864244722d52530eda69eba5f9d1cacdc1933ac8037945463ae73c9e816684d3c80237162ab74ee31e09e1f110b6a1f52b210213dc9482c5f059d1cdc026763911843a75525b0166524b946fb28d306060cccf0c8ad6774d51f76afed00653991de21e113d7004"}], 0x0, &(0x7f0000000640)=[@ip_pktinfo={{0x0, 0x0, 0x8, {0x0, @remote, @loopback}}}, @ip_ttl={{0x0, 0x0, 0x2, 0x3}}, @ip_pktinfo={{0x0, 0x0, 0x8, {0x0, @private=0xa010102, @rand_addr=0x64010100}}}, @ip_pktinfo={{0x0, 0x0, 0x8, {0x0, @loopback, @rand_addr=0x64010100}}}]}}, {{&(0x7f00000006c0)={0x2, 0x4e21, @local}, 0x0, &(0x7f0000000b00)=[{&(0x7f0000000700)="e399296d9bd322a1d12a561a43f2b65d59a2bf55134c6f684ab7069e9df69149c2b3e12a84f1b82f28d8fa6a8b280d1a3ec531", 0xfffffffffffffe74}, {&(0x7f0000000740)="b113762b00cc3bf397509f7ddddb6a770a374dd461f196dc5c0bc17111847144ea7721bd0bd20c441d09dda0514746ff514874c7b864c2647f7f4fe01c503ee28ebde5b37835c8"}, {&(0x7f00000007c0)="588d83f015ea7ac7746dc25184ae4b4637bac8224af57d93434b9ee301ce705f4f3ac4024f6b4fe4b3f06ed8555556cb5863fae799e2d04f2ce08c37add5b9279b8af3bfa60e7593c9ab867efa5625aff01de690bcb61f6094c54086b672211a965259b50f1477fae13931c0051cbd8a60cc53af750c0297d676d3dbe4d96c1af3a29590f0c4b42d1d82329ba4e75a4fed44b6cc50f90aa163c719a26913240bc4e0e504c7419fc2772421f14396c85b1684471bf2876afe7562c036080d8f92ed06c868fef1fffff69434e1bd4ba93845cb9ee0ee470c8dfd3d2e33be5602d244d3f64bfac4a0ecdd7408a042bed14d6a3e6d2154d1d6c895c6be236393"}, {&(0x7f00000008c0)="6cc23b617c5392979c2fb0fe8db8c2a42d44e271f6fe6d29"}, {&(0x7f0000000900)="bfc20d8845b3a5e7f9ee02886e4448b5515b2cad9260d2a126d7f7b773279b47e5263a928dc1f7f322c49f9ac7c930a14569eb172764731c106096031159b6a4b85db32476fa7e8c9560f1a12265980e2bbf2e2b23c9a1934becf1eee41c70f45e9ef29a394dc4f1dea25d9204a44a3d0cfcafc42c0f1a540c6aec9e8df054e4b12ef1fc6e12437a00302d0f01"}, {&(0x7f00000009c0)="b6194c5c607f5bf4d313a995e1acd398099919187ec2938157270819ca1727253c33599092fd6c5268fee86de5f38cbb170d7f8dd16e383ab411e8ddb75358712574b45c7404280a98692deaa3e313a596d30894014b68f1130c00ffa18f304a4c71ada9994a548a831290cabe97696aa395dd57408208ae5a7c2e4c428b10d76a1bcecef95637172ce36624457a1754f96e640a4ee4a819a1781f6c7e2c8b5eab65a58a72aa1136d5b182844e40fff8bf866844a4aa5489068b"}, {&(0x7f0000000a80)="d3ab3a5203a4eade3f1dc88112f335edc04899dd9b1f7d66e7ccf1fe9bd0a5df53f5c64ab4694bfe33355dd3aff1897291dcf813c6244a4e1fcfc16382fdb549146f4e3ad7dee11a55a2ff301f90c1d441ec062dd833e2afb9356a094a0e8bce136cd8b5c6237ae4d171098d5abedf909e"}]}}], 0x400000000000177, 0x4c854) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r6, 0x40045564, 0x3) ioctl$XFS_IOC_START_COMMIT(r3, 0x80585882, &(0x7f0000000c00)={0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000c80)="640b6629649e036c3da66225a73adb4c77f3b3903d6c55e27334a33b48ead25e1e6e420e89d9204f625734fbea408ad905e5926eb05a484e477917334a9c9981accbd352c54724ba4176d42d4f931ccee65a304a8e394eb212151c142bf3188d34e4fa6f6ee649229d7ad4450a26804b94d506f51ea64a", 0x77) write$uinput_user_dev(r6, &(0x7f0000001740)={'syz1\x00', {}, 0x0, [0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x3, 0x0, 0x0, 0x0, 0xffffffff, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5cc, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], [0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x200000, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdf51, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0xffff, 0x7fffffff, 0x0, 0x0, 0x10000], [0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x400, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xe8c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x3, 0xffffffff, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x2, 0x0, 0xfaea, 0x0, 0x0, 0x0, 0x6], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}, 0x45c) ioctl$UI_DEV_CREATE(r6, 0x5501) write$uinput_user_dev(r6, &(0x7f0000000300)={'syz0\x00', {0x9, 0xb7, 0x3, 0x9}, 0x26, [0x7ff, 0x3, 0xbd, 0xfff, 0x2, 0x5, 0x401, 0x2, 0x101, 0x2, 0x7fff, 0xaa, 0x7, 0x80000000, 0x1, 0x1ff, 0x7fff, 0x7fff, 0x5, 0x1, 0xda, 0x101, 0x80000400, 0x7b, 0xf, 0x4, 0x5, 0x2, 0xfffffff8, 0x80000001, 0x5, 0x3ff, 0x0, 0x3dab0, 0xffffff01, 0x1, 0x401, 0x9, 0x5, 0x0, 0x3c, 0x800, 0x400, 0x10001, 0x4, 0x9, 0x6, 0x6, 0x1, 0xa, 0x9, 0x2, 0xb9e4, 0xff, 0x8, 0x56, 0x8, 0x86f2, 0x9, 0x0, 0x9, 0x15, 0x6, 0x85f], [0xe, 0xfffffa6e, 0x7, 0x200, 0x1d2, 0x100, 0xfffffff8, 0x268000, 0x8, 0x800, 0x4, 0xfffffff7, 0x5, 0x5e82e2fe, 0x2, 0x7, 0xd, 0xd6c, 0x81, 0x2, 0x80000001, 0x1, 0x2, 0x0, 0x400, 0x1, 0x2, 0x5aaba633, 0xc2, 0x3, 0x6, 0x8000003, 0x3, 0xffffffff, 0x1, 0x400, 0x9, 0x9, 0x0, 0x80000000, 0x1, 0xd, 0x9, 0x8, 0x2, 0x5, 0xaf4, 0xc0, 0x0, 0xf, 0x1, 0x4, 0x5, 0x10000, 0x2, 0xa, 0x6, 0x8000, 0x1, 0x0, 0xb, 0xffffffff, 0x2, 0x9], [0x132e7003, 0x7fff, 0x3, 0xffffffff, 0x4d2, 0x5, 0x0, 0x8, 0xffffff52, 0x1, 0x6980, 0x4, 0x1, 0x4, 0xffffff81, 0x1000, 0x800, 0x1, 0x736, 0x9276, 0x4, 0x6, 0x5, 0x9, 0x3, 0x401, 0x7, 0xcf94, 0x5, 0x0, 0x40000000, 0x4, 0x8, 0x9, 0x6, 0x1ff, 0xffffffff, 0x6, 0x800, 0x8, 0x400, 0xffff0001, 0x2, 0x1, 0x6, 0x80, 0x2, 0xe, 0xc, 0x1000, 0x8, 0x7, 0x1, 0x9, 0x7fff, 0x38, 0x3, 0x1, 0x6, 0x0, 0x7fffffff, 0x9, 0x200, 0x8001], [0x5, 0xa38, 0xfffffff7, 0xfffffff0, 0x0, 0x1, 0xffff, 0x7f, 0x200, 0x5, 0x7, 0x5c5f, 0x5, 0x6, 0xffffffff, 0x6, 0x9, 0x71a3, 0xfffffffa, 0x1, 0x8000, 0xfffff801, 0x4, 0x1000, 0x9, 0xcb, 0xdac, 0x81, 0x0, 0xbd23, 0x8, 0x10000, 0xffffff37, 0x2, 0xd, 0x7f, 0x0, 0x80, 0x8001, 0x10001, 0x7, 0x659, 0x3, 0x0, 0x0, 0xfffffffd, 0x0, 0x7ff, 0x0, 0xffffff8e, 0x0, 0x6, 0x1, 0xffffff11, 0x2, 0xe, 0x1, 0x4, 0x100, 0x9, 0x6, 0x440, 0x7, 0x6]}, 0x45c) close_range(r1, 0xffffffffffffffff, 0x0) r8 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000180), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r8, 0x40345410, &(0x7f0000000040)={{0x1}}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r8, 0x5422) ioctl$SNDRV_TIMER_IOCTL_STOP(r8, 0x54a1) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r10, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f0000000000)=[{0x20, 0x0, 0x0, 0xfffff010}, {0x6}]}, 0x10) sendmmsg$inet(r9, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x4}], 0x1}}], 0x1, 0x800) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) 4.443888652s ago: executing program 0 (id=44): syz_usb_connect(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYRESHEX=0x0, @ANYRESDEC], 0x0) syz_usb_connect$printer(0x3, 0x2d, &(0x7f0000000080)={{0x12, 0x1, 0x65df2dac6b923e43, 0x0, 0x0, 0x0, 0x20, 0x4b8, 0x202, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x1, 0x10, 0x9, [{{0x9, 0x4, 0x0, 0x2, 0x1, 0x7, 0x1, 0x2, 0x1, "", {{{0x9, 0x5, 0x1, 0x2, 0x40, 0x7, 0x42, 0x7}}}}}]}}]}}, &(0x7f00000004c0)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x201, 0x70, 0x4, 0xfa, 0xff, 0x9}, 0x5, &(0x7f0000000100)={0x5, 0xf, 0x5}, 0xa, [{0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x83e}}, {0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x480a}}, {0x102, &(0x7f0000000580)=@string={0x102, 0x3, "03a06b16f0a16a0231d4a55ee86fb1ab9f0a544fb3c31a22a119fe534f2140ee525e49c734a7de26e8e804d5a62ed46c943a2a7de199d8c4f56831c00e1e5b3d5a00987247e8070ef5363c0c69aecd9f30e0a61b500600000000000000777b5ec7222fccbd0305811913f1880ff13e0bec5d3b30d71788266673390000ba11af192ce32b40dfe94c91750be18f68cb3361966e862a296a6284b9245eb785520aacb95cbfd4639e65ec945ba50ded6709b8b45191021585ddca4974d62ed0bbafd2dee5bdb2d27997760000e61e805bde2076371ce1657ebd6aabd9aa1a76d7b5cbfa3af2a9689f7ca1151e0de26d1e1e4a2eee98e10e0cf083a39ba559b3784c"}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0xf0ff}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x140a}}, {0xf, &(0x7f0000000340)=@string={0xf, 0x3, "18501e4fc8153a44347cf01d44"}}, {0xbf, &(0x7f00000006c0)=ANY=[@ANYBLOB="bf033d5123a0d2312425ba60df4aeeb8b28ed3e21178b06414cc362ae8bf6afa10d7e906bb0a1097f14cf2515e7830f9abeff5e59fe330fd80dc9b7632f04153cc7c4d7fdc9e6c58328c4a836447d7f613ebfcd5aba8656d0009ef9db376ab5dff983acfcfb47561b7409773a0fa11673c57bd001c4a05dc8c8e1ae7cc82f05b1d8d988723c516584080981a8464aeeeea44c3554be56496fa74861a371ccfb05c4d86bb90007caf69a8d49d135d557ef18f81918bde81926f30ad5aeaaa4b4e315074b00446cd45ac78e44dc5805c731f2eb983b21afb3f8f8ff9e08a8a90d40ba9338107736f14"]}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x426}}, {0x65, &(0x7f0000000400)=@string={0x65, 0x3, "4447c6f3dff9006e28590939f93f67fdbe64e3e447cc7410b2c6fb987a29e9f3bff95f0d90041139b752ea2ba89bd95ab97589e4123f19444eb57706720e369e6699c635436eff98e5798e173e866f128c814591eefb43c8135b3daf67a3ea743fa3dd"}}, {0x1f, &(0x7f0000000480)=@string={0x1f, 0x3, "8fe91f43f679847af9714d80fc7d4b9fbe0c68de6df1723e0870485f55"}}]}) 3.667215628s ago: executing program 1 (id=46): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_VENDOR(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000780)={0x38, r1, 0x701, 0x70bd28, 0x25dfdbfc, {{}, {@val={0x8, 0x1, 0xa}, @val={0x8}, @val={0xc, 0x99, {0x9, 0x58}}}}, [@NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x8080}, 0x40840) sendmsg$NL80211_CMD_START_P2P_DEVICE(r0, &(0x7f0000000100)={&(0x7f0000000040), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r1, 0x100, 0x70bd2a, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x8081) r3 = syz_open_dev$usbfs(&(0x7f0000000240), 0x75, 0x109301) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, &(0x7f0000002600)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, &(0x7f0000000040)=@usbdevfs_driver={0x0, 0xffffffff}) syz_usb_connect$uac1(0x2, 0xc2, &(0x7f0000000000)=ANY=[@ANYRESOCT=0x0], &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0}) 3.274092921s ago: executing program 3 (id=47): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x100, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000005c0)=ANY=[@ANYBLOB="1c0000005600010000000000000080000700fd0000000000040001"], 0x1c}], 0x1, 0x0, 0x0, 0x4000001}, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x13, r3, 0x0) read$usbmon(r3, &(0x7f0000000000)=""/62, 0x3e) r4 = dup(r2) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000000)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x72, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000001040)=ANY=[@ANYBLOB="88010000100013070000000000000000ffffffff000000000000000000000000fe8000000000000000000000000000bb00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb0000000032000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a48000200656362286369706865725f6e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004e001400636d616328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000a550000"], 0x188}}, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 3.219093723s ago: executing program 2 (id=48): chdir(&(0x7f0000000000)='./cgroup\x00') mknod$loop(&(0x7f0000000180)='./file0\x00', 0x6000, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x501500, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000440), 0xf, 0x183043) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cpuset.effective_cpus\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f00000005c0)={r3, 0x800, {0x2a00, 0x80010000, 0x0, 0x5, 0x0, 0x0, 0x0, 0x4, 0x5, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd6447a4b4e00d9683dda1af1ea09de2b7fb0a0100000000000000000300", "2809e8dbe10859892d0000b420a9c81f40f05f819e0117020000f20020000000e903001000", "90be8b1c5512406c7f00", [0x2, 0x5]}}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r4) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @broadcast}) write$FUSE_NOTIFY_POLL(r6, &(0x7f0000000040)={0x18, 0x1, 0x0, {0x200}}, 0x18) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0xae44, 0xffffffffffffffff) socket$inet_tcp(0x2, 0x1, 0x0) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f00000000c0), 0x4) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000), 0xda082, 0x0) sendmsg$NFQNL_MSG_VERDICT(r0, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0xd23d8e87f728f128}, 0xc, &(0x7f0000000240)={&(0x7f0000000500)={0x98, 0x1, 0x3, 0x101, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFQA_VLAN={0x24, 0x13, 0x0, 0x1, [@NFQA_VLAN_PROTO={0x6}, @NFQA_VLAN_TCI={0x6, 0x2, 0x1, 0x0, 0xfffa}, @NFQA_VLAN_TCI={0x6, 0x2, 0x1, 0x0, 0x1}, @NFQA_VLAN_PROTO={0x6, 0x1, 0x1, 0x0, 0x88a8}]}, @NFQA_VERDICT_HDR={0xc, 0x2, {0x0, 0xfffffffa}}, @NFQA_VLAN={0x54, 0x13, 0x0, 0x1, [@NFQA_VLAN_TCI={0x6, 0x2, 0x1, 0x0, 0x44}, @NFQA_VLAN_PROTO={0x6, 0x1, 0x1, 0x0, 0x8100}, @NFQA_VLAN_PROTO={0x6, 0x1, 0x1, 0x0, 0x88a8}, @NFQA_VLAN_TCI={0x6, 0x2, 0x1, 0x0, 0x7ff}, @NFQA_VLAN_PROTO={0x6, 0x1, 0x1, 0x0, 0x8100}, @NFQA_VLAN_TCI={0x6, 0x2, 0x1, 0x0, 0x1ff}, @NFQA_VLAN_PROTO={0x6, 0x1, 0x1, 0x0, 0x88a8}, @NFQA_VLAN_TCI={0x6, 0x2, 0x1, 0x0, 0x9}, @NFQA_VLAN_PROTO={0x6, 0x1, 0x1, 0x0, 0x8100}, @NFQA_VLAN_TCI={0x6, 0x2, 0x1, 0x0, 0x6}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4004000}, 0x48010) open_tree(0xffffffffffffff9c, 0x0, 0x89901) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r6, 0x28, 0x0, &(0x7f0000000140)=0x8000, 0x8) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000600)={0x1, &(0x7f0000000000)=[{0x6, 0x3, 0x8, 0x7fff7ffd}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) openat$dir(0xffffffffffffff9c, &(0x7f0000000400)='./file0/file1\x00', 0x40, 0x83) 3.177882645s ago: executing program 2 (id=49): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f00000006c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x6cb, 0x73f4, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x8, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x5, 0x0, {0x9, 0x21, 0x2, 0x6, 0x1, {0x22, 0x3}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x4}}}}}]}}]}}, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0) (async) r2 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_ADD_RULE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)={0x420, 0x3f3, 0x4, 0x70bd2a, 0x25dfdbfe, {0x6, 0x1, 0x40000005, [0x0, 0x4, 0x0, 0x8, 0x9, 0x2, 0x4, 0x9, 0x7, 0x8, 0x3, 0xb, 0xa0000, 0x2, 0x10000, 0x2, 0x4, 0x3, 0x1, 0x3409, 0x98, 0x9f, 0x3741, 0x1, 0x10003, 0x9, 0x10, 0x7, 0x1000, 0x9ae3, 0x7f, 0x2, 0x1, 0x2, 0xffffe59a, 0x3, 0x2, 0x1, 0xfffffffd, 0x81, 0xffffffff, 0x1, 0x6, 0x1, 0xffffffff, 0x10000, 0x100, 0x2094, 0xf8ad, 0x1, 0x7fff, 0x6, 0x9, 0x480, 0x6, 0x0, 0xfffff000, 0x5d, 0x0, 0x7ff, 0x8, 0x5, 0x81], [0x8000, 0x3, 0x9, 0xa57c, 0xa, 0x45ad, 0x7, 0xfffffff8, 0xff, 0xc, 0x9, 0x3, 0x1, 0xff, 0x4, 0x4, 0xdb, 0x10, 0x5, 0x7fff, 0x7, 0x800, 0x2298a23a, 0x0, 0xffff8000, 0x7fffffff, 0x0, 0x4, 0xe, 0x4, 0x9, 0xa, 0x5, 0x81, 0x3, 0x1, 0xfffffff8, 0x0, 0x4, 0x3, 0x1, 0x5, 0x8, 0x8, 0x100, 0x1, 0x5, 0x4, 0x9, 0x2, 0x3, 0x800, 0xfff, 0x0, 0x2, 0xfffffff7, 0xff, 0x81, 0x4, 0x5, 0xfffffffe, 0x3, 0x80, 0x5], [0x2, 0xd662822c, 0x0, 0x4, 0x7, 0x2, 0x8001, 0x5, 0x3, 0x8, 0xffffffff, 0x9, 0x6, 0x400, 0x1cce, 0xe, 0xbc3, 0x8, 0x6, 0x5, 0xe, 0x5, 0x800, 0x6, 0x7ff, 0xc, 0x4, 0xd044, 0x1, 0x8, 0x268, 0x1, 0x81, 0xdfc, 0x320, 0x5, 0x8, 0x7ff, 0x8, 0x1, 0x9, 0xe17d, 0x6, 0xfffffff9, 0x8000, 0x8, 0x5, 0x0, 0x6, 0x0, 0x7, 0x0, 0x80000000, 0x9, 0x6, 0xff, 0xff, 0xffffca95, 0x1, 0x7f, 0x734, 0x650a, 0x8, 0x7bfe], [0xffff, 0x5, 0x2, 0x6, 0x101, 0x3, 0x7fff, 0x3, 0x7, 0x9, 0x40, 0xe2a, 0x2, 0x4, 0x0, 0x7fff, 0xa6dd2fe, 0xd, 0x8, 0x9, 0x7, 0x2, 0x7, 0xfffffffa, 0x7ff, 0x6, 0x5e10, 0x2, 0x8, 0xfffff535, 0x1, 0xd, 0xfffd, 0x3, 0x80000007, 0x3, 0x90000, 0x80, 0x9, 0x1e5, 0x4, 0x2, 0x5, 0x2, 0xbb09, 0x4b5, 0x6, 0x2, 0x7fff, 0x8, 0x8, 0x9, 0x721, 0x7, 0x9, 0x3, 0x1, 0x101, 0x91, 0xe156, 0x3, 0xfffffff7, 0x3, 0xcfba]}}, 0x420}, 0x1, 0x0, 0x0, 0x4040000}, 0x814) (async) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) (async) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, &(0x7f0000000440)={0x2c, &(0x7f0000000300)={0x40, 0x1a, 0x5, {0x5, 0x21, "ccc0eb"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 3.176756576s ago: executing program 3 (id=50): r0 = socket(0x1e, 0x1, 0x0) connect$tipc(r0, &(0x7f0000000040)=@id, 0x10) shutdown(r0, 0x2) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x14, 0x16, 0x1, 0x0, 0x0, {0xa}}, 0x14}}, 0x0) 3.116786489s ago: executing program 3 (id=51): socket$nl_xfrm(0x10, 0x3, 0x6) (async) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.bfq.io_merged\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)={'#! ', './file0'}, 0xb) (async) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x10012, r0, 0x0) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) (async) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r1, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000000000107d1e5a2d000000000001090224000100000000090400000103004d00092100000001220500090581030000000000"], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) (async) syz_usb_control_io$hid(r2, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="002205000000"], 0x0}, 0x0) getpid() (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000004540), 0x0, 0x240080e4) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48014}, 0x4) 1.432476247s ago: executing program 0 (id=52): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0xc6225a99193a0f6e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40}], 0x0, 0x0, 0x0}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$TUNSETLINK(r1, 0x400454cd, 0x305) r2 = socket$netlink(0x10, 0x3, 0x15) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000080)="390000001300090468fe0700200000000000ff3f08000000480100100000000019002b000a0001000500000000000072080003000500000000", 0x39}], 0x1) 1.316687753s ago: executing program 0 (id=53): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)=ANY=[@ANYBLOB="800000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c000280050001000000000008000740000000011c"], 0x80}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)={0xc8, 0x0, 0x1, 0x5, 0x0, 0x0, {0x0, 0x0, 0x6}, [@CTA_NAT_SRC={0x4c, 0x6, 0x0, 0x1, [@CTA_NAT_PROTO={0x34, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e21}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e23}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e22}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e23}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e21}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e20}]}, @CTA_NAT_PROTO={0x14, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e22}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e23}]}]}, @CTA_SEQ_ADJ_REPLY={0x54, 0x10, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0xc}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x6}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0xfff}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0xd}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x3}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x4}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0xdb}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x1f}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x5}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x7}]}, @CTA_SYNPROXY={0xc, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x8a}]}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x3}]}, 0xc8}, 0x1, 0x0, 0x0, 0xb69a170422020e84}, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = creat(&(0x7f0000000040)='./bus\x00', 0x0) io_setup(0x202, &(0x7f0000000200)=0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='net/tcp\x00') read$FUSE(r4, &(0x7f0000002500)={0x2020}, 0x2020) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x0, 0x1, 0x0, r2, 0x0, 0xfe, 0xa00}]) clock_gettime(0x0, &(0x7f0000000280)) io_getevents(r3, 0x1, 0x8, &(0x7f0000000340)=[{}, {}, {}, {}, {}, {}, {}, {}], &(0x7f00000002c0)) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x38, 0x3, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}]}, 0x38}}, 0x0) 1.224594109s ago: executing program 0 (id=54): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x5}]}) socket$key(0xf, 0x3, 0x2) (async) socket$key(0xf, 0x3, 0x2) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) (async) connect$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x4e1f, 0x6, @loopback, 0x2}, 0x1c) r2 = socket(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a0001002abd700000ffffff81"], 0x78}], 0x1, 0x0, 0x0, 0x20400}, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000300)='task\x00') lseek(r3, 0x4, 0x4) (async) r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r5, 0xc040aed5, &(0x7f0000000240)={0x0, 0x107000}) ioctl$KVM_GET_DIRTY_LOG(r4, 0x4010ae42, &(0x7f0000000040)={0x10004, 0x0, &(0x7f0000ffc000/0x1000)=nil}) (async) close_range(r0, 0xffffffffffffffff, 0x0) 673.59388ms ago: executing program 1 (id=55): add_key$fscrypt_provisioning(&(0x7f00000001c0), 0x0, 0x0, 0x0, 0xfffffffffffffffb) r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x40902, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000e, 0x12, r0, 0x6762d000) ioctl$EXT4_IOC_GET_ES_CACHE(0xffffffffffffffff, 0xc020662a, &(0x7f00000023c0)={0x6, 0x5ce, 0x0, 0x3c}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f000027c000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000080)="f00fba30000f01df3e6464650f01cfc4e27d1852ccb9800000c00f3235000400000f30f30fc7362e0f4e88ce2aac0df2362eff184ef4", 0x36}], 0x1, 0x79, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = dup(0xffffffffffffffff) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f0000000080)={r4, 0x581b812c, {0x0, 0x0, 0x0, 0x1, 0x2, 0x0, 0x9, 0x14, 0x0, "8c2c36ef8bcb2845f6e2be9c23405b4bd6edafb30757e0149af80be4e60a78ce83004f687b1ef8ca9b8f755fa2c872ae0166d522e0ac4009a57873a31a72fc14", "9f4b9b4190081e2a650c41673901add666c95481c85f6311b7f6f3102d7f605ed0775d68eee17d905718ed03a8707d8b4a5e919c81ae30514af8a1fe02b6afd7", "bc122ab24e5ce687f24e398141ad8b49b5dad8dd6e551629510d1efc46130ac6", [0x800000]}}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x4a2080, 0x0) r6 = open(&(0x7f0000000000)='./file0\x00', 0x1607c0, 0x78e22799f4a46ffe) flock(r6, 0x5) ioctl$UFFDIO_ZEROPAGE(r6, 0xc020aa04, &(0x7f0000000040)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}}) ioctl$RTC_WIE_ON(r5, 0x700f) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 505.10003ms ago: executing program 1 (id=56): openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/key-users\x00', 0x0, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) (async) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x0) (async) ptrace$ARCH_SHSTK_LOCK(0x1e, 0xffffffffffffffff, 0x2, 0x5003) (async) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) prlimit64(r0, 0xe, &(0x7f0000000040)={0x7, 0x6}, &(0x7f0000000140)) (async) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) (async) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) (async) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r5, 0x4004ae99, &(0x7f0000000080)) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) (async) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x19ca, 0x4) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) (async) sendto$packet(r2, &(0x7f00000000c0)="3f03fe7f0302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c153cfdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r6, 0x1, 0x0, 0x6, @multicast}, 0x14) 357.942678ms ago: executing program 0 (id=57): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x504c2, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x1002, 0x0) socket$inet(0x2, 0x1, 0x0) (async) r2 = socket$inet(0x2, 0x1, 0x0) socket$inet(0x2, 0x1, 0x0) (async) r3 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0x2, &(0x7f0000000040)=0x7f, 0x4) bind$inet(r3, &(0x7f0000e15000)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$sock_int(r2, 0x1, 0x2, &(0x7f0000000040)=0x7f, 0x4) bind$inet(r2, &(0x7f0000e15000)={0x2, 0x4e20, @empty=0xe0000002}, 0x10) munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f00007fe000/0x800000)=nil) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x5, 0x0, 0x40000, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x5, 0x0, 0x40000, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x3, 0x2, 0xeeee0000, 0x2000, &(0x7f0000fee000/0x2000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x3, 0x2, 0xeeee0000, 0x2000, &(0x7f0000fee000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe2000/0x18000)=nil, &(0x7f0000000b40)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) (async) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe2000/0x18000)=nil, &(0x7f0000000b40)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000080)=0x0) fcntl$lock(r3, 0x24, &(0x7f0000000100)={0x1, 0x0, 0x6, 0x1, r4}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x20, 0x0, 0x0) r5 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x458, 0x5012, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0xc6, [{{0x9, 0x4, 0x0, 0x7, 0x2, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x0, 0x5, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x0, 0x0, 0x3}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x22, 0x5, {[@main=@item_4={0x3, 0x0, 0x9, "f5c49b82"}]}}, 0x0}, 0x0) (async) syz_usb_control_io$hid(r5, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x22, 0x5, {[@main=@item_4={0x3, 0x0, 0x9, "f5c49b82"}]}}, 0x0}, 0x0) 337.410639ms ago: executing program 1 (id=58): chdir(&(0x7f0000000000)='./cgroup\x00') mknod$loop(&(0x7f0000000180)='./file0\x00', 0x6000, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x501500, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000440), 0xf, 0x183043) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cpuset.effective_cpus\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f00000005c0)={r3, 0x800, {0x2a00, 0x80010000, 0x0, 0x5, 0x0, 0x0, 0x0, 0x4, 0x5, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd6447a4b4e00d9683dda1af1ea09de2b7fb0a0100000000000000000300", "2809e8dbe10859892d0000b420a9c81f40f05f819e0117020000f20020000000e903001000", "90be8b1c5512406c7f00", [0x2, 0x5]}}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r4) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @broadcast}) write$FUSE_NOTIFY_POLL(r6, &(0x7f0000000040)={0x18, 0x1, 0x0, {0x200}}, 0x18) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0xae44, 0xffffffffffffffff) socket$inet_tcp(0x2, 0x1, 0x0) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f00000000c0), 0x4) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000), 0xda082, 0x0) sendmsg$NFQNL_MSG_VERDICT(r0, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0xd23d8e87f728f128}, 0xc, &(0x7f0000000240)={&(0x7f0000000500)={0x98, 0x1, 0x3, 0x101, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFQA_VLAN={0x24, 0x13, 0x0, 0x1, [@NFQA_VLAN_PROTO={0x6}, @NFQA_VLAN_TCI={0x6, 0x2, 0x1, 0x0, 0xfffa}, @NFQA_VLAN_TCI={0x6, 0x2, 0x1, 0x0, 0x1}, @NFQA_VLAN_PROTO={0x6, 0x1, 0x1, 0x0, 0x88a8}]}, @NFQA_VERDICT_HDR={0xc, 0x2, {0x0, 0xfffffffa}}, @NFQA_VLAN={0x54, 0x13, 0x0, 0x1, [@NFQA_VLAN_TCI={0x6, 0x2, 0x1, 0x0, 0x44}, @NFQA_VLAN_PROTO={0x6, 0x1, 0x1, 0x0, 0x8100}, @NFQA_VLAN_PROTO={0x6, 0x1, 0x1, 0x0, 0x88a8}, @NFQA_VLAN_TCI={0x6, 0x2, 0x1, 0x0, 0x7ff}, @NFQA_VLAN_PROTO={0x6, 0x1, 0x1, 0x0, 0x8100}, @NFQA_VLAN_TCI={0x6, 0x2, 0x1, 0x0, 0x1ff}, @NFQA_VLAN_PROTO={0x6, 0x1, 0x1, 0x0, 0x88a8}, @NFQA_VLAN_TCI={0x6, 0x2, 0x1, 0x0, 0x9}, @NFQA_VLAN_PROTO={0x6, 0x1, 0x1, 0x0, 0x8100}, @NFQA_VLAN_TCI={0x6, 0x2, 0x1, 0x0, 0x6}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4004000}, 0x48010) open_tree(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x89901) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r6, 0x28, 0x0, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000600)={0x1, &(0x7f0000000000)=[{0x6, 0x3, 0x8, 0x7fff7ffd}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) openat$dir(0xffffffffffffff9c, &(0x7f0000000400)='./file0/file1\x00', 0x40, 0x83) 287.366253ms ago: executing program 1 (id=59): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000180)='/sys/power/reserved_size', 0x80802, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='veth1_virt_wifi\x00', 0x10) setsockopt$sock_int(r1, 0x1, 0x28, &(0x7f00000001c0)=0x7004, 0x4) r2 = dup(r1) sendmsg$inet(r2, &(0x7f0000000780)={&(0x7f0000000100)={0x2, 0x0, @multicast1}, 0x10, &(0x7f0000001600)=[{&(0x7f0000000240)="9e7937f06f510ad2", 0x8}], 0x1}, 0x0) read$eventfd(r2, &(0x7f0000001580), 0xfe8e) write$UHID_CREATE2(r0, &(0x7f0000000500)=ANY=[@ANYBLOB='\v\x00'], 0x1c7) 208.648087ms ago: executing program 1 (id=60): r0 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) (async) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRES8=r1, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) (async) fchownat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0xee01, 0xee01, 0x1000) openat(r0, 0x0, 0x2445c0, 0x0) (async, rerun: 32) close(r1) (async, rerun: 32) syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[], &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xbc, &(0x7f0000000040)=@string={0xbc, 0x3, "150eadf66cfc7bab0daa36d28387d20616cbf0093c09bfd98e7352ee19db4aecb4701fb1a0495a5955f632401c0cf4682f5e72a5f0eceeae9d78fe6d6ea1f6a0d4a77c2c22246045e444bdcc9d8419ed4ac16b836db2076fd98b878843827e2e2fac72822536c1f9a32a9aecebc6bde3c7a50db11f317c61e60b1da361a5bb544db389858f4a10cd1e27f4a2ac943e0cf34ba60be82c83db1d0df3d6b021527edd1af4559846bfd14c55fe25ecb09b5bdf59955f60f2c7f6dd43"}}]}) 152.602951ms ago: executing program 2 (id=61): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000480)=ANY=[@ANYBLOB="1201000000000040d80472f300000000000109022400010000100009040000010300000009210000080122070009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b04, 0x0) fdatasync(0xffffffffffffffff) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24004045) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a1ceb3497300ba69a7f6748deb83c659ea74f7e56c16136f838d96ba4ba0f1120d3b9a91114e5bc736c8da0003e0915a90a927f518836663ee7416d09cd5635ab2fbd330e03d970c90d42cc58e122806254f97cf1c45052018bdbac3573bdc206fdc7ea82004159e76352c28b006b1aeded7c184839f72fb10aea071fde05aab931b4e658b23271d4e0f58c4c6218bb35c72db6b74835a1d2e0869d32b4d8e667186f8717ac3f62c0f9e90fdbc0ad5f6ab7a77ec6620be826545717fa01d50c08c71b491f70cc3a816e0d82"], 0x0}, 0x0) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x14f006, 0x0) r2 = syz_open_pts(0xffffffffffffffff, 0x101140) ioctl$FITRIM(r2, 0xc0185879, &(0x7f0000000200)={0x9, 0xffffff7ffffffff3, 0x8003}) ioctl$PTP_PEROUT_REQUEST(r1, 0x40383d03, &(0x7f0000000040)={{0x7, 0x80}, {0x0, 0x200}, 0x6, 0x1}) 133.424542ms ago: executing program 3 (id=62): read$FUSE(0xffffffffffffffff, &(0x7f0000000380)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x1, 0x2, @tid=r0}, &(0x7f0000000340)=0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) (async) capset(0x0, 0x0) (async) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffa) (async) openat$selinux_relabel(0xffffffffffffff9c, 0x0, 0x2, 0x0) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="180000000101010100000000400000eceb"], 0x18}, 0x1, 0x0, 0x0, 0x40000}, 0x20048000) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x0, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) (async) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) (async) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r4, 0x89f3, &(0x7f0000001040)={'sit0\x00', &(0x7f0000000f40)={'syztnl1\x00', 0x0, 0x8000, 0x1, 0x7, 0x0, {{0x5, 0x4, 0x3, 0x31, 0x14, 0x68, 0x0, 0x8b, 0x2f, 0x0, @loopback, @multicast2}}}}) (async) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) r5 = userfaultfd(0x801) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r6, 0x29, 0x11, 0x0, 0x0) (async) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x108}) (async) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) (async) r7 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_serviced_recursive\x00', 0x0, 0x0) syz_io_uring_setup(0x868, &(0x7f0000000140)={0x0, 0x21b5, 0x1000, 0x1, 0x359, 0x0, r7}, &(0x7f00000002c0), &(0x7f0000ff4000)) (async) close_range(r5, r5, 0x0) 0s ago: executing program 3 (id=63): r0 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000080)=0xc) sendmsg$netlink(r0, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="380000002e000100000000000000000008000200", @ANYRES32=r1, @ANYBLOB="0b000280976b64086860300081747bdbf701800000f431b2173b2a550f80b63fb936c6534343010081dc2b000000"], 0x38}], 0x1}, 0xcc000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) r2 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'bridge0\x00', 0x0}) setsockopt$MRT6_ADD_MIF(0xffffffffffffffff, 0x29, 0xca, &(0x7f0000000240)={0x0, 0x0, 0x2, r3, 0x9}, 0xc) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000000300)={'syztnl2\x00', &(0x7f0000000280)={'syztnl2\x00', 0x0, 0x2f, 0xfc, 0x1, 0x4, 0x41, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast2, 0x7, 0x40, 0x3745c586, 0x7}}) getsockopt$inet6_mreq(r2, 0x29, 0x1c, &(0x7f0000000380)={@mcast1, 0x0}, &(0x7f00000003c0)=0x14) r6 = socket$packet(0x11, 0x3, 0x300) r7 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r7, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'veth1_to_hsr\x00', 0x0}) sendto$packet(r7, &(0x7f0000000180)="02033e00d3fc02000000ab5d71b9edd7c9560385dcb188a8", 0xfc9c, 0x2004c8a1, &(0x7f00000001c0)={0x11, 0x0, r8, 0x1, 0x0, 0x6, @broadcast}, 0x14) r9 = socket$packet(0x11, 0x2, 0x300) r10 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r10, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f00000000c0)={'batadv_slave_1\x00', 0x0}) sendto$packet(r10, &(0x7f0000000180)="0b036800e0ff64000200475400f6a13bb1000000080086dd4803", 0x100a6, 0x0, &(0x7f0000000140)={0x11, 0x0, r11}, 0x14) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000400)={'veth0_virt_wifi\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000440)={'batadv_slave_1\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_GET(r0, &(0x7f00000007c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000780)={&(0x7f0000000480)=ANY=[@ANYBLOB="dc020000", @ANYRES16=0x0, @ANYBLOB="00022abd7000fddbdf250200000008000100", @ANYRES32=r3, @ANYBLOB="840002804000010024000008000000000000685f737461747300000000000000000000000000000000000000050003000b00000008000400070000000800070000000000400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000100000008000600", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="bc0002803c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=r5, @ANYBLOB="40000100240001006d6f64650000000000000000000000000000000000000000000000000000000005000300050000000f000400726f756e64726f62696e00003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=r8, @ANYBLOB="08000100", @ANYRES32=r11, @ANYBLOB="700102803c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=r12, @ANYBLOB="40000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000050003000300000008000400", @ANYRES32=r13, @ANYBLOB="080007000000000038000100240001006e6f746966795f70656572735f696e74657276616c00000000000000000000000500030003000000080004000200000040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000050003000b000000080004000000000008000600", @ANYRES32=0x0, @ANYBLOB="40000100240001006c625f686173685f737461747300000000000000000000000000000000000000050003000b0000000800040009000000080007000000000038000100240001006c625f73746174735f726566726573685f696e74657276616c0000000000000005000300030000000800040002000000"], 0x2dc}, 0x1, 0x0, 0x0, 0x4085}, 0x40) request_key(&(0x7f0000000100)='asymmetric\x00', &(0x7f0000000200)={'syz', 0x2}, 0x0, 0xffffffffffffffff) r14 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r15 = openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0) setfsuid(0xffffffffffffffff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x12, r15, 0x0) keyctl$join(0x1, &(0x7f0000000340)={'syz', 0x1}) clock_gettime(0x4, &(0x7f00000000c0)) write$selinux_load(r14, &(0x7f0000000000)=ANY=[], 0x2000) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.27' (ED25519) to the list of known hosts. [ 21.954098][ T36] audit: type=1400 audit(1770734212.120:64): avc: denied { mounton } for pid=283 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.957707][ T283] cgroup: Unknown subsys name 'net' [ 21.976798][ T36] audit: type=1400 audit(1770734212.120:65): avc: denied { mount } for pid=283 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.004131][ T36] audit: type=1400 audit(1770734212.150:66): avc: denied { unmount } for pid=283 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.004639][ T283] cgroup: Unknown subsys name 'devices' [ 22.188305][ T283] cgroup: Unknown subsys name 'hugetlb' [ 22.193949][ T283] cgroup: Unknown subsys name 'rlimit' [ 22.371221][ T36] audit: type=1400 audit(1770734212.540:67): avc: denied { setattr } for pid=283 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.394479][ T36] audit: type=1400 audit(1770734212.540:68): avc: denied { mounton } for pid=283 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.419330][ T36] audit: type=1400 audit(1770734212.540:69): avc: denied { mount } for pid=283 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.446182][ T285] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 22.455032][ T36] audit: type=1400 audit(1770734212.620:70): avc: denied { relabelto } for pid=285 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.480529][ T36] audit: type=1400 audit(1770734212.620:71): avc: denied { write } for pid=285 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.505286][ T283] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.506511][ T36] audit: type=1400 audit(1770734212.660:72): avc: denied { read } for pid=283 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.540370][ T36] audit: type=1400 audit(1770734212.660:73): avc: denied { open } for pid=283 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.377000][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.384104][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.391247][ T290] bridge_slave_0: entered allmulticast mode [ 23.397910][ T290] bridge_slave_0: entered promiscuous mode [ 23.406002][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.413077][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.420203][ T290] bridge_slave_1: entered allmulticast mode [ 23.426618][ T290] bridge_slave_1: entered promiscuous mode [ 23.453006][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.460205][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.467521][ T293] bridge_slave_0: entered allmulticast mode [ 23.473808][ T293] bridge_slave_0: entered promiscuous mode [ 23.482192][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.489313][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.496511][ T293] bridge_slave_1: entered allmulticast mode [ 23.502812][ T293] bridge_slave_1: entered promiscuous mode [ 23.579530][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.586720][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.593800][ T291] bridge_slave_0: entered allmulticast mode [ 23.600238][ T291] bridge_slave_0: entered promiscuous mode [ 23.606581][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.613645][ T292] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.620825][ T292] bridge_slave_0: entered allmulticast mode [ 23.627189][ T292] bridge_slave_0: entered promiscuous mode [ 23.636770][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.643848][ T292] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.651108][ T292] bridge_slave_1: entered allmulticast mode [ 23.657449][ T292] bridge_slave_1: entered promiscuous mode [ 23.667279][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.674368][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.681494][ T291] bridge_slave_1: entered allmulticast mode [ 23.687836][ T291] bridge_slave_1: entered promiscuous mode [ 23.799965][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.807079][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.814418][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.821585][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.851202][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.858321][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.865593][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.872672][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.903958][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.911074][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.918417][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.925479][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.958471][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.965571][ T292] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.972906][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.980144][ T292] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.991852][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.999669][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.007121][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.014465][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.022086][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.029459][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.036810][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.044002][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.064044][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.071152][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.081993][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.089106][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.105666][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.112820][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.120607][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.127667][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.135963][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.143068][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.157623][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.164678][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.205060][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.212170][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.237726][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.244785][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.253072][ T291] veth0_vlan: entered promiscuous mode [ 24.261359][ T293] veth0_vlan: entered promiscuous mode [ 24.281082][ T290] veth0_vlan: entered promiscuous mode [ 24.289902][ T291] veth1_macvtap: entered promiscuous mode [ 24.300844][ T293] veth1_macvtap: entered promiscuous mode [ 24.318519][ T290] veth1_macvtap: entered promiscuous mode [ 24.371186][ T291] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 24.388689][ T292] veth0_vlan: entered promiscuous mode [ 24.410333][ T292] veth1_macvtap: entered promiscuous mode [ 24.568341][ T362] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 24.668743][ T364] process 'syz.1.8' launched '/dev/fd/10' with NULL argv: empty string added [ 24.695945][ T31] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 24.745831][ T331] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 24.765851][ T9] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 24.829070][ T366] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 24.847706][ T31] usb 4-1: unable to get BOS descriptor or descriptor too short [ 24.861901][ T31] usb 4-1: config 128 has an invalid interface number: 172 but max is 0 [ 24.872476][ T31] usb 4-1: config 128 has no interface number 0 [ 24.881219][ T31] usb 4-1: config 128 interface 172 has no altsetting 0 [ 24.890820][ T31] usb 4-1: string descriptor 0 read error: -22 [ 24.897511][ T31] usb 4-1: New USB device found, idVendor=11ca, idProduct=0201, bcdDevice=d2.0a [ 24.906790][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 24.915876][ T331] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 24.927853][ T9] usb 3-1: config 220 has an invalid interface number: 76 but max is 2 [ 24.929618][ T31] cdc_acm 4-1:128.172: invalid descriptor buffer length [ 24.943521][ T331] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 24.953973][ T9] usb 3-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 24.956781][ T331] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 24.975551][ T9] usb 3-1: config 220 has no interface number 2 [ 24.990299][ T9] usb 3-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 24.994911][ T331] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 25.005221][ T9] usb 3-1: config 220 interface 0 has no altsetting 0 [ 25.014092][ T331] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.029797][ T9] usb 3-1: config 220 interface 76 has no altsetting 0 [ 25.035993][ T331] usb 1-1: config 0 descriptor?? [ 25.037244][ T9] usb 3-1: config 220 interface 1 has no altsetting 0 [ 25.051307][ T9] usb 3-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 25.063103][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.071711][ T9] usb 3-1: Product: syz [ 25.075937][ T9] usb 3-1: Manufacturer: syz [ 25.080558][ T9] usb 3-1: SerialNumber: syz [ 25.145566][ T363] usb 4-1: USB disconnect, device number 2 [ 25.226168][ T64] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 25.287838][ T353] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 25.296644][ T353] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 25.308381][ T9] usb 3-1: selecting invalid altsetting 0 [ 25.314279][ T9] usb 3-1: Found UVC 7.01 device syz (8086:0b07) [ 25.321178][ T9] usb 3-1: No valid video chain found. [ 25.330144][ T9] usb 3-1: USB disconnect, device number 2 [ 25.380943][ T64] usb 2-1: config 0 interface 0 has no altsetting 0 [ 25.387739][ T64] usb 2-1: New USB device found, idVendor=046d, idProduct=ca04, bcdDevice= 0.00 [ 25.396892][ T64] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.405789][ T64] usb 2-1: config 0 descriptor?? [ 25.449559][ T331] plantronics 0003:047F:FFFF.0001: No inputs registered, leaving [ 25.464582][ T331] plantronics 0003:047F:FFFF.0001: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 25.812463][ T370] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 25.825540][ T370] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 25.980015][ T9] usb 1-1: USB disconnect, device number 2 [ 26.085821][ T331] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 26.249462][ T331] usb 3-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 26.258876][ T331] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.269323][ T331] usb 3-1: config 0 descriptor?? [ 26.447161][ T64] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 26.454376][ T64] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 26.476103][ T64] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 26.484545][ T64] logitech 0003:046D:CA04.0002: hidraw0: USB HID v0.03 Device [HID 046d:ca04] on usb-dummy_hcd.1-1/input0 [ 26.497110][ T64] logitech 0003:046D:CA04.0002: no inputs found [ 26.566935][ T331] usb 3-1: Cannot set MAC address [ 26.595894][ T331] MOSCHIP usb-ethernet driver 3-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 26.622379][ T331] usb 3-1: USB disconnect, device number 3 [ 26.759270][ T419] syzkaller0: entered promiscuous mode [ 26.764837][ T419] syzkaller0: entered allmulticast mode [ 26.967133][ T36] kauditd_printk_skb: 73 callbacks suppressed [ 26.967152][ T36] audit: type=1400 audit(1770734217.140:147): avc: denied { ioctl } for pid=428 comm="syz.3.26" path="socket:[4727]" dev="sockfs" ino=4727 ioctlcmd=0x48cc scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 26.977452][ T429] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 26.999186][ T36] audit: type=1400 audit(1770734217.140:148): avc: denied { getopt } for pid=428 comm="syz.3.26" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 27.030628][ T427] ======================================================= [ 27.030628][ T427] WARNING: The mand mount option has been deprecated and [ 27.030628][ T427] and is ignored by this kernel. Remove the mand [ 27.030628][ T427] option from the mount to silence this warning. [ 27.030628][ T427] ======================================================= [ 27.074119][ T36] audit: type=1400 audit(1770734217.210:149): avc: denied { create } for pid=426 comm="syz.0.25" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 27.094894][ T36] audit: type=1400 audit(1770734217.210:150): avc: denied { read } for pid=426 comm="syz.0.25" name="file0" dev="tmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 27.118679][ T36] audit: type=1400 audit(1770734217.210:151): avc: denied { open } for pid=426 comm="syz.0.25" path="/6/file0" dev="tmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 27.141727][ T36] audit: type=1400 audit(1770734217.210:152): avc: denied { ioctl } for pid=426 comm="syz.0.25" path="/6/file0" dev="tmpfs" ino=50 ioctlcmd=0x125d scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 27.175503][ T36] audit: type=1400 audit(1770734217.210:153): avc: denied { mounton } for pid=426 comm="syz.0.25" path="/syzcgroup/unified/syz0" dev="cgroup2" ino=113 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 27.199424][ T36] audit: type=1400 audit(1770734217.210:154): avc: denied { write } for pid=432 comm="syz.2.27" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 27.219280][ T36] audit: type=1400 audit(1770734217.240:155): avc: denied { unlink } for pid=292 comm="syz-executor" name="file0" dev="tmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 27.242516][ T36] audit: type=1400 audit(1770734217.320:156): avc: denied { write } for pid=434 comm="syz.0.28" name="rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 27.265397][ T435] cgroup: Need name or subsystem set [ 27.283431][ T435] syzkaller0: entered promiscuous mode [ 27.289164][ T435] syzkaller0: entered allmulticast mode [ 27.405802][ T331] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 27.413626][ T31] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 27.546265][ T331] usb 4-1: device descriptor read/64, error -71 [ 27.565802][ T31] usb 3-1: Using ep0 maxpacket: 16 [ 27.572130][ T31] usb 3-1: config 0 interface 0 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 27.585190][ T31] usb 3-1: config 0 interface 0 has no altsetting 0 [ 27.591875][ T31] usb 3-1: New USB device found, idVendor=056a, idProduct=00d7, bcdDevice= 0.00 [ 27.600981][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.609890][ T31] usb 3-1: config 0 descriptor?? [ 27.785865][ T331] usb 4-1: device descriptor read/64, error -71 [ 27.819214][ T31] wacom 0003:056A:00D7.0003: Unknown device_type for 'HID 056a:00d7'. Assuming pen. [ 27.829538][ T31] wacom 0003:056A:00D7.0003: hidraw0: USB HID v8.6b Device [HID 056a:00d7] on usb-dummy_hcd.2-1/input0 [ 27.841548][ T31] input: Wacom BambooPT 2FG Small Pen as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:056A:00D7.0003/input/input4 [ 27.998926][ T31] usb 2-1: USB disconnect, device number 2 [ 28.027351][ T331] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 28.036288][ T443] usb 3-1: USB disconnect, device number 4 [ 28.165953][ T331] usb 4-1: device descriptor read/64, error -71 [ 28.345839][ T31] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 28.415830][ T331] usb 4-1: device descriptor read/64, error -71 [ 28.495854][ T31] usb 2-1: Using ep0 maxpacket: 32 [ 28.502460][ T31] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 28.510765][ T31] usb 2-1: config 0 has no interface number 0 [ 28.516941][ T31] usb 2-1: config 0 interface 184 has no altsetting 0 [ 28.525473][ T31] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 28.534719][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.542931][ T331] usb usb4-port1: attempt power cycle [ 28.548808][ T31] usb 2-1: Product: syz [ 28.553016][ T31] usb 2-1: Manufacturer: syz [ 28.557709][ T443] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 28.565292][ T31] usb 2-1: SerialNumber: syz [ 28.575012][ T31] usb 2-1: config 0 descriptor?? [ 28.581327][ T31] smsc75xx v1.0.0 [ 28.605297][ T472] overlay: Unknown parameter 'fowner>00000000000000000000' [ 28.716956][ T443] usb 1-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 28.728499][ T443] usb 1-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid wMaxPacketSize 0 [ 28.738374][ T443] usb 1-1: config 0 interface 0 has no altsetting 0 [ 28.745048][ T443] usb 1-1: New USB device found, idVendor=17ef, idProduct=60ee, bcdDevice= 0.00 [ 28.754152][ T443] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.763242][ T443] usb 1-1: config 0 descriptor?? [ 28.886021][ T331] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 28.905890][ T64] usb 3-1: new full-speed USB device number 5 using dummy_hcd [ 28.907630][ T331] usb 4-1: device descriptor read/8, error -71 [ 29.035811][ T64] usb 3-1: device descriptor read/64, error -71 [ 29.057006][ T331] usb 4-1: device descriptor read/8, error -71 [ 29.181078][ T465] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 29.190289][ T31] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -61 [ 29.198434][ T465] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 29.201722][ T31] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 29.275860][ T64] usb 3-1: device descriptor read/64, error -71 [ 29.306294][ T331] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 29.314789][ T443] usbhid 1-1:0.0: can't add hid device: -71 [ 29.321056][ T443] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 29.330264][ T331] usb 4-1: device descriptor read/8, error -71 [ 29.337358][ T443] usb 1-1: USB disconnect, device number 3 [ 29.391171][ T31] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 29.402096][ T31] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 29.411813][ T31] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 29.422199][ T31] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 29.431774][ T31] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -32 [ 29.477201][ T331] usb 4-1: device descriptor read/8, error -71 [ 29.515878][ T64] usb 3-1: new full-speed USB device number 6 using dummy_hcd [ 29.586005][ T331] usb usb4-port1: unable to enumerate USB device [ 29.645969][ T443] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 29.645969][ T64] usb 3-1: device descriptor read/64, error -71 [ 29.795814][ T443] usb 1-1: Using ep0 maxpacket: 16 [ 29.802241][ T443] usb 1-1: config 0 has no interfaces? [ 29.808610][ T443] usb 1-1: config 0 has no interfaces? [ 29.814855][ T443] usb 1-1: config 0 has no interfaces? [ 29.821175][ T478] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 29.829858][ T478] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 29.839076][ T443] usb 1-1: string descriptor 0 read error: -71 [ 29.845390][ T443] usb 1-1: New USB device found, idVendor=0403, idProduct=e80c, bcdDevice=fb.ba [ 29.854753][ T443] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.863608][ T443] usb 1-1: rejected 3 configurations due to insufficient available bus power [ 29.872508][ T443] usb 1-1: no configuration chosen from 3 choices [ 29.880077][ T443] usb 1-1: USB disconnect, device number 4 [ 29.896019][ T64] usb 3-1: device descriptor read/64, error -71 [ 30.006114][ T64] usb usb3-port1: attempt power cycle [ 30.345864][ T64] usb 3-1: new full-speed USB device number 7 using dummy_hcd [ 30.359777][ T491] input: syz1 as /devices/virtual/input/input7 [ 30.373494][ T491] Invalid argument reading file caps for ./file0 [ 30.381116][ T64] usb 3-1: device descriptor read/8, error -71 [ 30.517005][ T64] usb 3-1: device descriptor read/8, error -71 [ 30.575845][ T443] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 30.635827][ T331] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 30.727117][ T443] usb 4-1: config 220 has an invalid interface number: 76 but max is 2 [ 30.735464][ T443] usb 4-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 30.744438][ T443] usb 4-1: config 220 has an invalid descriptor of length 46, skipping remainder of the config [ 30.754852][ T443] usb 4-1: config 220 has no interface number 2 [ 30.761181][ T443] usb 4-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 30.765927][ T64] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 30.774398][ T331] usb 1-1: device descriptor read/64, error -71 [ 30.788167][ T443] usb 4-1: config 220 interface 0 has no altsetting 0 [ 30.794941][ T443] usb 4-1: config 220 interface 76 has no altsetting 0 [ 30.801855][ T443] usb 4-1: config 220 interface 1 has no altsetting 0 [ 30.807599][ T64] usb 3-1: device descriptor read/8, error -71 [ 30.810758][ T443] usb 4-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 30.823941][ T443] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.832062][ T443] usb 4-1: Product: syz [ 30.836291][ T443] usb 4-1: Manufacturer: syz [ 30.840897][ T443] usb 4-1: SerialNumber: syz [ 30.937045][ T64] usb 3-1: device descriptor read/8, error -71 [ 31.045853][ T331] usb 1-1: device descriptor read/64, error -71 [ 31.046048][ T64] usb usb3-port1: unable to enumerate USB device [ 31.059242][ T443] uvcvideo 4-1:220.1: Unknown video format 00000000-0000-0000-0000-000000000000 [ 31.068521][ T443] usb 4-1: Found UVC 7.01 device syz (8086:0b07) [ 31.074869][ T443] usb 4-1: No valid video chain found. [ 31.080477][ T443] usb 4-1: selecting invalid altsetting 0 [ 31.089071][ T443] usb 4-1: USB disconnect, device number 7 [ 31.114641][ T64] usb 2-1: USB disconnect, device number 3 [ 31.285852][ T331] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 31.415814][ T331] usb 1-1: device descriptor read/64, error -71 [ 31.455867][ T64] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 31.585894][ T64] usb 2-1: device descriptor read/64, error -71 [ 31.635051][ T502] overlayfs: failed to create directory ./file0/work (errno: 22); mounting read-only [ 31.668553][ T331] usb 1-1: device descriptor read/64, error -71 [ 31.795926][ T331] usb usb1-port1: attempt power cycle [ 31.825809][ T64] usb 2-1: device descriptor read/64, error -71 [ 31.925830][ T363] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 32.005844][ T466] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 32.055802][ T363] usb 4-1: device descriptor read/64, error -71 [ 32.065911][ T64] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 32.135855][ T466] usb 3-1: device descriptor read/64, error -71 [ 32.142303][ T331] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 32.167064][ T331] usb 1-1: device descriptor read/8, error -71 [ 32.195801][ T64] usb 2-1: device descriptor read/64, error -71 [ 32.295830][ T363] usb 4-1: device descriptor read/64, error -71 [ 32.297554][ T331] usb 1-1: device descriptor read/8, error -71 [ 32.385818][ T466] usb 3-1: device descriptor read/64, error -71 [ 32.435821][ T64] usb 2-1: device descriptor read/64, error -71 [ 32.535787][ T363] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 32.545924][ T64] usb usb2-port1: attempt power cycle [ 32.546076][ T331] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 32.576946][ T331] usb 1-1: device descriptor read/8, error -71 [ 32.625812][ T466] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 32.665857][ T363] usb 4-1: device descriptor read/64, error -71 [ 32.707052][ T331] usb 1-1: device descriptor read/8, error -71 [ 32.755824][ T466] usb 3-1: device descriptor read/64, error -71 [ 32.815949][ T331] usb usb1-port1: unable to enumerate USB device [ 32.885813][ T64] usb 2-1: new full-speed USB device number 6 using dummy_hcd [ 32.905897][ T363] usb 4-1: device descriptor read/64, error -71 [ 32.913256][ T64] usb 2-1: device descriptor read/8, error -71 [ 32.995894][ T466] usb 3-1: device descriptor read/64, error -71 [ 33.015921][ T363] usb usb4-port1: attempt power cycle [ 33.047153][ T64] usb 2-1: device descriptor read/8, error -71 [ 33.105939][ T466] usb usb3-port1: attempt power cycle [ 33.285826][ T64] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 33.307147][ T64] usb 2-1: device descriptor read/8, error -71 [ 33.355822][ T363] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 33.376870][ T363] usb 4-1: device descriptor read/8, error -71 [ 33.412765][ T36] kauditd_printk_skb: 32 callbacks suppressed [ 33.412783][ T36] audit: type=1400 audit(1770734223.580:189): avc: denied { ioctl } for pid=513 comm="syz.0.52" path="/dev/binderfs/binder1" dev="binder" ino=14 ioctlcmd=0x6201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 33.412794][ T514] rust_binder: Write failure EFAULT in pid:50 [ 33.446905][ T466] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 33.448375][ T36] audit: type=1400 audit(1770734223.620:190): avc: denied { create } for pid=513 comm="syz.0.52" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 33.481814][ T64] usb 2-1: device descriptor read/8, error -71 [ 33.487306][ T466] usb 3-1: device descriptor read/8, error -71 [ 33.507065][ T363] usb 4-1: device descriptor read/8, error -71 [ 33.577795][ T36] audit: type=1326 audit(1770734223.750:191): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=517 comm="syz.0.54" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb636f9bf79 code=0x0 [ 33.596218][ T64] usb usb2-port1: unable to enumerate USB device [ 33.616975][ T466] usb 3-1: device descriptor read/8, error -71 [ 33.745798][ T363] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 33.767025][ T363] usb 4-1: device descriptor read/8, error -71 [ 33.855823][ T466] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 33.876927][ T466] usb 3-1: device descriptor read/8, error -71 [ 33.896995][ T363] usb 4-1: device descriptor read/8, error -71 [ 34.005899][ T363] usb usb4-port1: unable to enumerate USB device [ 34.007408][ T466] usb 3-1: device descriptor read/8, error -71 [ 34.125962][ T466] usb usb3-port1: unable to enumerate USB device [ 34.394223][ T36] audit: type=1400 audit(1770734224.560:192): avc: denied { setopt } for pid=524 comm="syz.1.56" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 34.414160][ T36] audit: type=1400 audit(1770734224.560:193): avc: denied { write } for pid=524 comm="syz.1.56" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 34.455828][ T36] audit: type=1400 audit(1770734224.620:194): avc: denied { write } for pid=528 comm="syz.0.57" name="binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 34.503921][ T36] audit: type=1400 audit(1770734224.670:195): avc: denied { lock } for pid=528 comm="syz.0.57" path="socket:[3945]" dev="sockfs" ino=3945 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 34.532937][ T533] overlayfs: failed to create directory ./file0/work (errno: 22); mounting read-only [ 34.558014][ T36] audit: type=1400 audit(1770734224.730:196): avc: denied { setopt } for pid=534 comm="syz.1.59" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 34.711130][ T544] netlink: 4 bytes leftover after parsing attributes in process `syz.3.62'. [ 34.735833][ T466] usb 1-1: new full-speed USB device number 9 using dummy_hcd [ 34.778819][ T548] netlink: 20 bytes leftover after parsing attributes in process `syz.3.63'. [ 34.790482][ T548] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=548 comm=syz.3.63 [ 34.810662][ T36] audit: type=1400 audit(1770734224.980:197): avc: denied { load_policy } for pid=547 comm="syz.3.63" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 34.811354][ T548] ------------[ cut here ]------------ [ 34.830605][ T31] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 34.836685][ T548] WARNING: CPU: 0 PID: 548 at mm/page_alloc.c:5234 __alloc_pages_noprof+0x109/0x7e0 [ 34.853508][ T548] Modules linked in: [ 34.857527][ T548] CPU: 0 UID: 0 PID: 548 Comm: syz.3.63 Not tainted syzkaller #0 4ae5b12b683c07c90cf68c53485f2a5719abf10e [ 34.868923][ T548] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 34.879094][ T548] RIP: 0010:__alloc_pages_noprof+0x109/0x7e0 [ 34.885238][ T548] Code: 00 0f 1f 44 00 00 83 fb 0b 72 28 b8 00 20 00 00 23 44 24 40 75 1d 80 3d 0a b4 0b 06 00 0f 85 c2 00 00 00 c6 05 fd b3 0b 06 01 <0f> 0b 31 c0 e9 b4 00 00 00 83 fb 0a 0f 87 a9 00 00 00 44 8b 64 24 [ 34.905188][ T548] RSP: 0018:ffffc9000e097560 EFLAGS: 00010246 [ 34.908500][ T466] usb 1-1: config 0 interface 0 altsetting 7 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 34.911421][ T548] RAX: 0000000000000000 RBX: 0000000000000016 RCX: 0000000000000000 [ 34.924070][ T466] usb 1-1: config 0 interface 0 altsetting 7 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 34.930701][ T548] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000e097618 [ 34.942254][ T466] usb 1-1: config 0 interface 0 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 34.949354][ T548] RBP: ffffc9000e0976a0 R08: ffffc9000e097617 R09: 0000000000000000 [ 34.949376][ T548] R10: ffffc9000e097600 R11: fffff52001c12ec3 R12: ffffc9000e0975a0 [ 34.963246][ T466] usb 1-1: config 0 interface 0 has no altsetting 0 [ 34.970200][ T548] R13: dffffc0000000000 R14: 1ffff92001c12eb0 R15: 0000000000000000 [ 34.978606][ T31] usb 2-1: device descriptor read/64, error -71 [ 34.984836][ T548] FS: 00007f1c489e46c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 34.984863][ T548] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 34.994395][ T466] usb 1-1: New USB device found, idVendor=0458, idProduct=5012, bcdDevice= 0.00 [ 34.999138][ T548] CR2: 0000200000001000 CR3: 00000001148b4000 CR4: 00000000003526b0 [ 35.009132][ T466] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 35.014712][ T548] Call Trace: [ 35.014724][ T548] [ 35.014734][ T548] ? vfs_write+0x3c8/0xf90 [ 35.035922][ T466] usb 1-1: config 0 descriptor?? [ 35.039952][ T548] ? ksys_write+0x145/0x260 [ 35.043731][ T529] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 35.046153][ T548] ? x64_sys_call+0x271c/0x2ee0 [ 35.072023][ T548] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 35.077813][ T548] ? hashtab_init+0xdb/0x1f0 [ 35.082445][ T548] ___kmalloc_large_node+0x81/0x210 [ 35.087778][ T548] ? hashtab_init+0xdb/0x1f0 [ 35.092407][ T548] __kmalloc_large_node_noprof+0x1e/0xd0 [ 35.098134][ T548] ? hashtab_init+0xdb/0x1f0 [ 35.102780][ T548] __kmalloc_noprof+0x326/0x500 [ 35.107697][ T548] ? kasan_save_alloc_info+0x40/0x50 [ 35.113022][ T548] hashtab_init+0xdb/0x1f0 [ 35.117534][ T548] ? common_read+0x175/0x490 [ 35.122176][ T548] symtab_init+0x44/0x70 [ 35.126505][ T548] common_read+0x1e6/0x490 [ 35.130960][ T548] ? hashtab_init+0xdb/0x1f0 [ 35.135585][ T548] ? __cfi_common_read+0x10/0x10 [ 35.140615][ T548] ? hashtab_init+0x105/0x1f0 [ 35.145344][ T548] policydb_read+0xabb/0x28b0 [ 35.150100][ T548] ? __kasan_kmalloc+0x96/0xb0 [ 35.154917][ T548] ? __cfi_policydb_read+0x10/0x10 [ 35.160146][ T548] ? security_load_policy+0x130/0x12d0 [ 35.165661][ T548] security_load_policy+0x16a/0x12d0 [ 35.171038][ T548] ? irqentry_exit+0x4a/0x60 [ 35.175674][ T548] ? asm_exc_page_fault+0x2b/0x30 [ 35.180970][ T548] ? __cfi_security_load_policy+0x10/0x10 [ 35.186790][ T548] ? rep_movs_alternative+0x4a/0xa0 [ 35.192028][ T548] sel_write_load+0x2a7/0x5f0 [ 35.196807][ T548] ? __cfi_sel_write_load+0x10/0x10 [ 35.202062][ T548] ? bpf_lsm_file_permission+0xd/0x20 [ 35.207645][ T548] ? __cfi_sel_write_load+0x10/0x10 [ 35.212897][ T548] vfs_write+0x3c8/0xf90 [ 35.217272][ T548] ? __cfi_vfs_write+0x10/0x10 [ 35.222091][ T548] ? __kasan_check_write+0x18/0x20 [ 35.227285][ T548] ? mutex_lock+0x97/0x1d0 [ 35.231752][ T548] ? __cfi_mutex_lock+0x10/0x10 [ 35.236707][ T548] ? __fget_files+0x2c5/0x340 [ 35.241436][ T548] ksys_write+0x145/0x260 [ 35.245859][ T548] ? __cfi_ksys_write+0x10/0x10 [ 35.246920][ T31] usb 2-1: device descriptor read/64, error -71 [ 35.250754][ T548] ? __x64_sys_clock_gettime+0x241/0x2a0 [ 35.250798][ T548] ? __kasan_check_write+0x18/0x20 [ 35.268137][ T548] ? fpregs_restore_userregs+0x11c/0x260 [ 35.273837][ T548] __x64_sys_write+0x7f/0x90 [ 35.278528][ T548] x64_sys_call+0x271c/0x2ee0 [ 35.283261][ T548] do_syscall_64+0x57/0xf0 [ 35.287771][ T548] ? clear_bhb_loop+0x50/0xa0 [ 35.292490][ T548] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 35.298487][ T548] RIP: 0033:0x7f1c47b9bf79 [ 35.302949][ T548] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.322652][ T548] RSP: 002b:00007f1c489e4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 35.331144][ T548] RAX: ffffffffffffffda RBX: 00007f1c47e15fa0 RCX: 00007f1c47b9bf79 [ 35.339198][ T548] RDX: 0000000000002000 RSI: 0000200000000000 RDI: 0000000000000008 [ 35.347235][ T548] RBP: 00007f1c47c327e0 R08: 0000000000000000 R09: 0000000000000000 [ 35.355235][ T548] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 35.363258][ T548] R13: 00007f1c47e16038 R14: 00007f1c47e15fa0 R15: 00007ffd02904018 [ 35.371302][ T548] [ 35.374424][ T548] ---[ end trace 0000000000000000 ]--- [ 35.380134][ T548] SELinux: failed to load policy [ 35.459813][ T466] kye 0003:0458:5012.0004: tablet report size too small, or kye_tablet_rdesc unexpectedly large [ 35.471401][ T466] kye 0003:0458:5012.0004: hidraw0: USB HID v0.00 Device [HID 0458:5012] on usb-dummy_hcd.0-1/input0 [ 35.482513][ T466] kye 0003:0458:5012.0004: tablet-enabling feature report not found [ 35.490695][ T466] kye 0003:0458:5012.0004: tablet enabling failed [ 35.497317][ T31] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 35.635821][ T31] usb 2-1: device descriptor read/64, error -71 [ 35.635821][ T363] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 35.787025][ T363] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 35.798065][ T363] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 35.807867][ T363] usb 3-1: New USB device found, idVendor=04d8, idProduct=f372, bcdDevice= 0.00 [ 35.817136][ T363] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 35.826374][ T363] usb 3-1: config 0 descriptor?? [ 35.885822][ T31] usb 2-1: device descriptor read/64, error -71 [ 35.995942][ T31] usb usb2-port1: attempt power cycle [ 36.234672][ T36] audit: type=1400 audit(1770734226.400:198): avc: denied { read write } for pid=540 comm="syz.2.61" name="ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 36.259175][ T363] usbhid 3-1:0.0: can't add hid device: -71 [ 36.265215][ T363] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 36.274032][ T363] usb 3-1: USB disconnect, device number 13 [ 36.345803][ T31] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 36.367147][ T31] usb 2-1: device descriptor read/8, error -71 [ 36.496902][ T31] usb 2-1: device descriptor read/8, error -71 [ 36.735857][ T31] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 36.757308][ T31] usb 2-1: device descriptor read/8, error -71 [ 36.887255][ T31] usb 2-1: device descriptor read/8, error -71 [ 36.995986][ T31] usb usb2-port1: unable to enumerate USB device [ 37.467944][ T363] usb 1-1: USB disconnect, device number 9