last executing test programs: 2.617690175s ago: executing program 2 (id=3): r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r1, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x40}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000180)={0x40}, 0x10) sendmsg$tipc(r0, &(0x7f0000000140)={&(0x7f0000000080), 0x10, 0x0}, 0x0) dup2(r0, r1) 2.528856642s ago: executing program 2 (id=6): bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x8, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000047b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000007b00000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0xff, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='timer_start\x00', r1}, 0x10) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) 2.462366858s ago: executing program 3 (id=4): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f00000007c0)='./file0\x00', 0x480, &(0x7f0000000180)={[{@nobarrier}, {@grpjquota}]}, 0x1, 0x765, &(0x7f0000000800)="$eJzs3c1rHOUfAPDvbJKmv7Q/E0HQegoIGijdmBpbBQ8VDyJYKOjZdtlsQ80mW7Kb0oSAFhG8CCoeBL307Eu9efXlqv+FB2mpmhYrHiQyu7PpNtltN22SRffzgWmf55nZPPPdZ2aeZ/cZdgLoW+PpP7mIQxHxQRIxmpUnETFUTw1GnGhsd2tttZguSayvv/ZbUt/m5tpqMVpekzqQZR6LiO/fjTic21pvdXllrlAulxaz/GRt/vxkdXnlyLn5wmxptrRwbGp6+ujxZ48f27lY//hp5eC1D19+6qsTf73z6JX3f0jiRBzM1rXGsVPGYzx7T4bSt/AOL+10ZT2W9HoHuC/pqTnQOMvjUIzGQD0FAPyXvRUR6wBAn0n0/wDQZ5rfA9xcWy02l95+I7G3rr8YEfsb8TfnNxtrBrM5u/31edCRm0k2M9KYzEwiYmwH6h+PiM++eeOLdIldmocEaOftSxFxZmx86/U/2XLPwnY93cU245vyrn+wd75Nxz/PtRv/5TbGP3HH+KdhuM25ez/uff7nru5ANR2l478XWu5tu9USf2ZsIMv9vz7mG0rOniuX0mvbQxExEUPDaX7qLnVM3Pj7Rqd1reO/3z968/O0/vT/21vkrg4O3/mamUKt8CAxt7p+KeLxwXbxJxvtn7Rp/7TsVJd1vPL8e592WpfGn8bbXLbGv7vWL0c82bb9b9/Rltz1/sTJ+uEw2Two2vj6509G2pUf2dT+6ZLW3/wssBfS9h+5e/xjSev9mtXt1/Hj5dHvOq27d/ztj/99yev19L6s7GKhVlucitiXvLq1/Ojt1zbzze3T+CeeaH/+bz7+11v2If1MeKbL+Aev/frl/ce/u9L4Z7bV/ttPXLk1N9Cp/u7af7qemshKurn+dbuDD/LeAQAAAAAAAAAAAAAAAAAAAAAAAEC3chFxMJJcfiOdy+XzjWd4PxIjuXKlWjt8trK0MBP1Z2WPxVCu+VOXoy2/hzqV/R5+M390U/6ZiHg4Ij4e/l89ny9WyjO9Dh4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMgc6PP8/9ctwr/cOANg1+3u9AwDAntP/A0D/0f8DQP/R/wNA/9H/A0D/0f8DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwy06dPJku63+urRbT/MyF5aW5yoUjM6XqXH5+qZgvVhbP52crldlyKV+szN/r75UrlfPTsbB0cbJWqtYmq8srp+crSwu10+fmC7Ol06WhPYkKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALanurwyVyiXS4sSEhISG4leX5kAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/h3+CQAA///Q6StZ") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.avg_queue_size\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800006, 0x11, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) 2.210984021s ago: executing program 1 (id=7): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0x8, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000180)='sys_enter\x00', r1}, 0x10) clock_adjtime(0x0, &(0x7f0000000000)={0x3fd, 0x0, 0x0, 0x0, 0x0, 0x67, 0x4005, 0x0, 0x0, 0x100}) 2.183997643s ago: executing program 2 (id=8): r0 = syz_usb_connect$cdc_ncm(0x2, 0x15f, &(0x7f0000000880)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109024d0102010000000904000001020d00000524060001052400fcff0d240f0100000000000006000006241a0000001524120900a317a88b045e4f01a607c0ffcb7e392a08241c0600000700c42413005da99c25dd0add3dc099d058f718dfc160010f5229796cf899ef665687a1a97cfe38a553c73c928f19b2fea1b6e9918f3ea47b7ec2fbde01223197b550070766d000eb598c8425b61acfe497b3c935a95de366e950376757ed6ccbbbcc68ba8eb8519076ab9690a08e4f6e63c406b50dcaf86bd07f44b5b90c347cb930107ac77ec6ed6c0d86139fea8cbc9e67c7c87659958507c2f5fd23036cb4a7532ebfec106d5cd65eadc955ed98ab1ea63951efc1693672329e73834ddd68d3c2c528fb04240208052415040007240a074000080905810320000000000904010000020d00000904010102020d00000905820200020005000905030210"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000600)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000080)={0x20, 0x80, 0x1c, {0x5, 0x401, 0x3, 0x1, 0x63bf, 0x8000, 0x7b00, 0x1000, 0x8, 0x6, 0x401, 0xffff}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) 2.168817195s ago: executing program 1 (id=9): r0 = socket(0x10, 0x2, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000140), r1) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl1\x00', r2, 0x0, 0x6, 0x0, 0x0, 0x0, @dev, @dev={0xfe, 0x80, '\x00', 0x31}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000180)={'syztnl1\x00', r3, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @rand_addr=' \x01\x00'}}) 2.156045666s ago: executing program 3 (id=10): syz_emit_ethernet(0x5e, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaa"], 0x0) syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x1000004, &(0x7f0000000300)=ANY=[@ANYBLOB='shortname=lower,iocharset=iso8859-1,fmask=00000000000000000000066,uni_xlate=1,uni_xlate=0,fmask=00000000000000000000003,uid=', @ANYRESHEX=0x0, @ANYBLOB=',uni_xlate=0,utf8=1,check=strict,nonumtail=0,rodir,errors=continue,shortname=lower,umaQk=00000000000000000000007,rodir,sys_immutable,\x00'], 0x6, 0x2ba, &(0x7f0000000640)="$eJzs3U9rK1UYB+B30mQSFUwWrkRwQBeuLrd36yZF7gWxKy9ZqAst3hakCUILBf9g7MqtGxcu/ASC4Adx4zcQ3ArurFAYmclMk7QxTaRp1fs8m749c34z70wP7XTR0w9eGh0+yeLg9PNfotNJotGPfpwl0YtG1L6MOf2vAwD4LzvL8/g9n1gnl0REZ3NtAQAbtOLP/+cvqh9vpS0AYIMev/PuWzu7uw/fzrJOPBp9dTIofrMvPk6O7xzERzGM/bgf3TiPKF8UWlG+LRTlozzPx82s0ItXR+OTQZEcvf9Tdf6d3yLK/HZ0o1cOXbxtlPk3dx9uZxMz+XHRx7PV9ftF/kF044WL8Fz+wYJ8DNJ47ZWZ/u9FN37+MD6OYTwpm5jmv9jOsjfyb/747L2ivSKfjE8G7XLeVL51y18aAAAAAAAAAAAAAAAAAAAAAAD+x+5Ve+e0o9y/pxiq9t/ZOi8+aUVW683vzzPJJ/WJZvcHyvN8nMd39f4697Msy6uJ03wzXmxG827uGgAAAAAAAAAAAAAAAAAAAP5djj/59HBvONw/upGi3g2gGRF/Po74p+fpz4y8HMsnt6tr7g2Hjaqcn9OcHYmtek4SsbSN4iZu6LFcVzxzpeeq+P6HdU/YuX5Oa/G1brKoV9fhXrL4GbajHulUi+TbNGI6J40Vr5X+3aE81ll+6cJD3bXvPX2uLMZL5kSyrLHXf508uWokuXwXaflUF8ZbVTETv7Q2VlrP0ZnEr36vSOzWAQAAAAAAAAAAAAAAAAAAGzX9698FB0+XRht5e2NtAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMCtmv7//zWKcRVeYXIaR8d3fIsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Bf4KAAD//5daXJw=") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000040)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) 2.121062119s ago: executing program 1 (id=11): memfd_create(&(0x7f0000000140)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\xea7\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xd9w\\\xf8\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xcd\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00', 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="12010100000000105801000100000000000109022400010000002009040000010300000009210000000122dc01090589"], 0x0) syz_usb_connect$hid(0x4, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x46d, 0xc517, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x9, 0x50, 0x2b, [{{0x9, 0x4, 0x0, 0x1, 0x1, 0x3, 0x1, 0x2, 0x7f, {0x9, 0x21, 0x7f, 0x2, 0x1, {0x22, 0xba1}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x7, 0x4}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12011003000012002505a8a4f0"], 0x0) syz_usb_control_io(r0, &(0x7f00000000c0)={0x2c, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0}, 0x0) 2.074980713s ago: executing program 0 (id=1): syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='./mnt\x00', 0x0, &(0x7f00000002c0), 0x0, 0x236, &(0x7f0000000300)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=") mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='mnt/encrypted_dir\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000680)='mnt/encrypted_dir\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000540)='mnt\x00', 0x0, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r1, 0xc0506617, &(0x7f0000000580)={@desc={0x1, 0x0, @auto="697bb55abf8e23d7"}, 0x21, 0x0, '\x00', @c}) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000000)=@v2={0x2, @adiantum, 0x0, '\x00', @a}) 2.040386026s ago: executing program 3 (id=12): r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x769}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ppoll(&(0x7f0000000180)=[{r0, 0x4047, 0x700}], 0x1, 0x0, 0x0, 0x0) close(r0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) 1.993014541s ago: executing program 0 (id=14): mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x6004, 0x1) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x5, 0x4, 0x7fdf, 0x1, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0x3, &(0x7f00000001c0)=@framed, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r2 = dup2(r1, r0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sys_enter\x00', r2}, 0x10) utime(&(0x7f0000000200)='./file0\x00', 0x0) 1.932258576s ago: executing program 3 (id=16): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc9ffb}]}) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r1}, 0x10) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) 1.926957357s ago: executing program 0 (id=17): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0xff, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r1}, 0x10) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r2, &(0x7f0000004440)={&(0x7f0000000ec0)=@id={0x1e, 0x3, 0x2, {0x4e20, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x80}, 0x0) 1.88428142s ago: executing program 0 (id=19): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0xff, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x9e, 0x17, 0x36, 0x10, 0x17ef, 0x721e, 0xde06, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6}}]}}]}}, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) syz_usb_control_io(r1, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000000)=ANY=[@ANYBLOB="000004"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.736077614s ago: executing program 4 (id=21): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x18, 0xb, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000004f4b00000000001b000000180100002020702000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000006ffffff850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) r1 = eventfd(0x800a6) write$eventfd(r1, &(0x7f0000000300)=0xfffffffffffffffb, 0x8) r2 = dup(r1) read$eventfd(r2, &(0x7f0000000040), 0x8) 1.637351883s ago: executing program 4 (id=22): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0xff, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='rss_stat\x00', r1}, 0x10) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r2, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x1, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/116, 0x20001c34}], 0x1, 0x0) 1.609237085s ago: executing program 4 (id=23): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/bus/input/devices\x00', 0x0, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$uinput_user_dev(r1, &(0x7f0000000080)={'syz0\x00', {0x4}, 0x8, [0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0xfffffffc, 0x0, 0xffffffff, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x4, 0x0, 0xfffffff, 0xd, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x1, 0x0, 0x0, 0x0, 0x4000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40002000, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa0000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0xef6], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xa, 0x7fff, 0x0, 0x0, 0x1, 0x0, 0xb, 0x40000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1000, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0xfffffffc]}, 0x45c) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x5) ioctl$UI_DEV_CREATE(r1, 0x5501) preadv(r0, &(0x7f0000003780)=[{&(0x7f0000001300)=""/170, 0xaa}], 0x1, 0xffff, 0x0) 1.583388878s ago: executing program 4 (id=24): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000180)='./bus\x00', 0xe, &(0x7f00000002c0)={[{@init_itable}, {@noacl}, {@stripe}]}, 0x3, 0x445, &(0x7f0000000b00)="$eJzs28+PE1UcAPDvTLeLCLgr4g9+qKto3PhjlwVUDh7UaOIBExM96HGzuxCksIZdEyFEwRg8GWPi3Xj0X/CkF2M8mXjVuyEhhgvgqWbaGbYtbdktLUX6+SQD78282fe+nXnte/PaAEbWVPZPErE1Iv6MiIl6trnAVP2/q5fPLly7fHYhiWr13X+SWrkrl88uFEWL87bkmek0Iv0iid1t6l05feb4fKWydCrPz66e+Gh25fSZF46dmD+6dHTp5P5Dhw4emHv5pf0v9iXOrE1Xdn26vGfnWx988/bhr5rib4mjT6a6HXy6Wu1zdcO1rSGdjA2xIWxIKSKyy1Wu9f+JKMXaxZuINz8fauOAgapWq9UtnQ+fqwJ3sSSa87o8jIrigz6b/xZb6yDg1cENP4bu0mv1CVAW99V8qx8ZizQvU26Z3/bTVES8f+7f77ItBvMcAgCgyU/Z+Of5duO/NB5qKHdfvjY0GRH3R8T2iHggInZExIMRtbIPR8QjG6y/dZHkxvFPerGnwNYpG/+9kq9tNY//itFfTJby3LZa/OXkyLHK0r78NZmO8qYsP9eljp/f+OPrTscax3/ZltVfjAXzdlwc29R8zuL86vytxNzo0vmIXWPt4k+urwQkEbEzInb1WMexZ3/Y0+nYzePvog/rTNXvI56pX/9z0RJ/Iem+Pjl7T1SW9s0Wd8WNfvv9wjud6r+l+Psgu/73tr3/r8c/mTSu165svI4Lf33ZcU7T6/0/nrxXS4/n+z6ZX109NRcxnhyuN7px//61c4t8UT6Lf3pv+/6/PdZeid0Rkd3Ej0bEYxHxeN72JyLiyYjY2yX+X19/6sPe4x+sLP7FDV3/tcR4tO5pnygd/+XHpkonb4j/Wvfrf7CWms73rOf9bz3t6u1uBgAAgP+fNCK2RpLOXE+n6cxM/fvyOyLSyvLK6nNHlj8+uVj/jcBklNPiSddEw/PQuXxaX8+fj4j6VwuK4wfy58bfljbX8jMLy5XFYQcPI25Lh/6f+bs07NYBA+f3WjC69H8YXfo/jC79H0ZXm/6/eRjtAG6/dp//nw2hHcDt19L/LfvBCDH/h9Gl/8Po0v9hJK1sjpv/SL5rovhLPZ5+1yaifEc0Y2CJSO+IZkgMKDHc9yUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIB++S8AAP///fHg0g==") syz_mount_image$fuse(0x0, &(0x7f0000000180)='./file2\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000002100180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000004000000b703000000000aaa850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='ext4_unlink_enter\x00', r0}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) 1.418693852s ago: executing program 4 (id=25): r0 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x10000000004e20, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0xb, &(0x7f00000000c0)=0x4027e, 0x4) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000080)=0x3, 0x4) syz_emit_ethernet(0x83, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaf9ff030486dd601b8b97004d88c19e9ace00000000000000002100000002ff02000000000000000000000000000104004e200023b0"], 0x0) 1.271063066s ago: executing program 4 (id=26): r0 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r0, 0x8922, &(0x7f0000000080)={'wg0\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f0000000240)={'wg0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2c00000018001108000000000000000002000000fd00fe020030000008000400", @ANYRES32=r3], 0x2c}}, 0x0) 1.270957166s ago: executing program 32 (id=26): r0 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r0, 0x8922, &(0x7f0000000080)={'wg0\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f0000000240)={'wg0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2c00000018001108000000000000000002000000fd00fe020030000008000400", @ANYRES32=r3], 0x2c}}, 0x0) 1.082149823s ago: executing program 3 (id=28): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0x1, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000480)={{0x12, 0x1, 0x0, 0x9, 0x96, 0x8, 0x10, 0x4752, 0x11, 0x324f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0xff, 0x1, 0x32, 0x0, [], [{{0x9, 0x5, 0xd, 0x3}}]}}]}}]}}, 0x0) 760.026252ms ago: executing program 5 (id=30): bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r0}, 0x10) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8924, &(0x7f0000000000)={'bridge_slave_0\x00', @random="010000201000"}) 649.135941ms ago: executing program 5 (id=31): bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000001100)={{}, 0x0, 0x0}, 0x20) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000840)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="180000000000000000000000fd00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000021c0)={&(0x7f0000000140)='rss_stat\x00', r1}, 0x10) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 623.480604ms ago: executing program 5 (id=32): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000001000000b703000000000000850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r0}, 0x10) r1 = creat(&(0x7f0000000600)='./file0\x00', 0xfb) write$binfmt_script(r1, &(0x7f0000000040)={'#! ', '', [{0x20, '\xd2\xb2\x10\f\x0e\xcef\xd4\x0f\xe2\xbe>S\x0f\x17o\xa4\x1c\t{I\xfb5Ar\x84\x89\xc9\xdd\xff\xdf\xd3\xf1\xd9\xe4\xb8\fub\xff\x961\xf2\xcd\\\xc1\xbb\xc2\xc0\xd3\xf7\x10\xda\xfe\xb6/\x15\x17\xbb\xe2\x02\xdaZ\xac\x13\xde\xab\x8f\xac\xa6U`A\xa5\b\x00\x00\x00\x1c\x01a\x83\xc5X\xed?\x82\x8f\\Vr\xda\xf6\x82\xe6,m \"-\xf2\xbf\x12\x95|\xaf\xe0\xd5\x0e0\xde:\xcf'}]}, 0x76) close(r1) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 602.683376ms ago: executing program 5 (id=33): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="1500000065ffff018000000800395032303030"], 0x15) r2 = dup(r1) write$P9_RLERRORu(r2, &(0x7f0000000880)=ANY=[@ANYBLOB="5300000007000046009de8f1e236dc88dde8f31de3c78264e925fcb5fc"], 0x53) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[], [], 0x6b}}) 565.766649ms ago: executing program 5 (id=34): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup(r2) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000100)={r3, 0x7fff, 0x1, r3}) 521.666123ms ago: executing program 5 (id=35): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000011c0)=ANY=[@ANYBLOB="12010001090003206d0414c340000000000109022400010000a000090400000103010100092100080001220300090581", @ANYRES64], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000180000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000f0850000002d00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r1}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000240)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x1, 0x1f, 0x7, 0x9, 0x1, 0x6c, 0x1ff}}}, 0x0) 135.328888ms ago: executing program 1 (id=36): mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) unshare(0x22040400) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r0, 0x107, 0x16, 0x0, 0x0) syz_emit_ethernet(0x46, 0x0, 0x0) 94.837121ms ago: executing program 1 (id=37): r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="180000000000000400000000dfffff1918120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f00000003c0)='sched_switch\x00', r2}, 0x10) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x8, 0x3, 0x650, 0x0, 0xa, 0x148, 0x0, 0x10, 0x5b8, 0x2a8, 0x2a8, 0x5b8, 0x2a8, 0x3, 0x0, {[{{@ip={@multicast2=0xe000000b, @multicast2, 0x0, 0x0, 'bridge0\x00', 'rose0\x00', {}, {}, 0x0, 0x1}, 0x0, 0x2f8, 0x368, 0x0, {0x200003ae, 0x7f00}, [@common=@inet=@hashlimit1={{0x58}, {'veth1_to_team\x00', {0x7a, 0x8000000, 0x0, 0x0, 0x0, 0xffffffff, 0x7}}}, @common=@unspec=@bpf1={{0x230, 'bpf\x00', 0x0}, @pinned={0x1, 0x0, 0x64, './file0\x00'}}]}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "f2f7b9f28413d9d8ad470ad2b60c45cb4ea6e7bf902bdc2ff8a9304d9f655c746adc0bdc773506378bc2d27efd6abb05175089830cc46186074d7de46d5af300"}}}, {{@ip={@empty, @broadcast, 0x0, 0x0, 'syzkaller0\x00', 'veth0_to_team\x00'}, 0x0, 0x1f0, 0x250, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth1_to_bond\x00'}}, @inet=@rpfilter={{0x28}}]}, @common=@SET={0x60}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x6b0) 11.190629ms ago: executing program 1 (id=38): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/27], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000002000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r1}, 0x10) r2 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x802) write$evdev(r2, &(0x7f0000000000), 0x100000008) ioctl$EVIOCGVERSION(r2, 0x80044502, 0x0) 0s ago: executing program 0 (id=39): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x54c, 0x24b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x4f8}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000004b64ffec850000006d000000850000000f00000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000100)='kfree\x00', r1}, 0x10) syz_usb_control_io(0xffffffffffffffff, &(0x7f00000001c0)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="000706000000ff"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.239' (ED25519) to the list of known hosts. [ 24.660419][ T30] audit: type=1400 audit(1731089979.246:66): avc: denied { integrity } for pid=281 comm="syz-executor" lockdown_reason="debugfs access" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=lockdown permissive=1 [ 24.685841][ T30] audit: type=1400 audit(1731089979.276:67): avc: denied { mounton } for pid=281 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1925 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 24.687078][ T281] cgroup: Unknown subsys name 'net' [ 24.709309][ T30] audit: type=1400 audit(1731089979.276:68): avc: denied { mount } for pid=281 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.739609][ T30] audit: type=1400 audit(1731089979.306:69): avc: denied { unmount } for pid=281 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.739774][ T281] cgroup: Unknown subsys name 'devices' [ 24.882104][ T281] cgroup: Unknown subsys name 'hugetlb' [ 24.888840][ T281] cgroup: Unknown subsys name 'rlimit' [ 25.019679][ T30] audit: type=1400 audit(1731089979.606:70): avc: denied { setattr } for pid=281 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=250 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.043984][ T30] audit: type=1400 audit(1731089979.606:71): avc: denied { mounton } for pid=281 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 25.072720][ T30] audit: type=1400 audit(1731089979.606:72): avc: denied { mount } for pid=281 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 25.082378][ T284] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 25.106659][ T30] audit: type=1400 audit(1731089979.696:73): avc: denied { relabelto } for pid=284 comm="mkswap" name="swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.135138][ T30] audit: type=1400 audit(1731089979.696:74): avc: denied { write } for pid=284 comm="mkswap" path="/root/swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.158304][ T281] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 25.162670][ T30] audit: type=1400 audit(1731089979.746:75): avc: denied { read } for pid=281 comm="syz-executor" name="swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.593479][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.600819][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.608564][ T290] device bridge_slave_0 entered promiscuous mode [ 25.616958][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.624739][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.632805][ T290] device bridge_slave_1 entered promiscuous mode [ 25.725348][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.733201][ T292] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.741065][ T292] device bridge_slave_0 entered promiscuous mode [ 25.748330][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.755997][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.763535][ T291] device bridge_slave_0 entered promiscuous mode [ 25.772693][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.779796][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.787480][ T291] device bridge_slave_1 entered promiscuous mode [ 25.797703][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.804800][ T292] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.812270][ T292] device bridge_slave_1 entered promiscuous mode [ 25.864428][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.872505][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.880736][ T294] device bridge_slave_0 entered promiscuous mode [ 25.893548][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.900715][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.908270][ T294] device bridge_slave_1 entered promiscuous mode [ 25.939375][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.946782][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.955135][ T295] device bridge_slave_0 entered promiscuous mode [ 25.974025][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.981110][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.988933][ T295] device bridge_slave_1 entered promiscuous mode [ 26.102629][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.110249][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.118032][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.125653][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.177321][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.184510][ T292] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.192747][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.199916][ T292] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.212223][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.219782][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.227889][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.235601][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.253543][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.260688][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.268079][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.275896][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.284570][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.292081][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.299948][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.307276][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.328751][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.337043][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.345309][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.353228][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.361188][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.368662][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.376814][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.385737][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.393988][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.401831][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.411940][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 26.420289][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.452666][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.460630][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.469671][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.477030][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.490142][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.514575][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.523919][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.532726][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.540587][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.548422][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.557346][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.564958][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.573236][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.583143][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.590197][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.598434][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.607012][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.616156][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.624272][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.638552][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 26.647240][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.669434][ T294] device veth0_vlan entered promiscuous mode [ 26.680289][ T290] device veth0_vlan entered promiscuous mode [ 26.689127][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 26.697970][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.707224][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 26.715670][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.723781][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 26.733344][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.743847][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 26.754077][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.762876][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.771225][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.778717][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 26.786872][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.795922][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.804255][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.812295][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.819990][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.831699][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 26.840183][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.848709][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.856527][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.871971][ T294] device veth1_macvtap entered promiscuous mode [ 26.880869][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.889756][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 26.899607][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.909709][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.917684][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.925401][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 26.934178][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.943817][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.951987][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.963317][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.972133][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.000099][ T290] device veth1_macvtap entered promiscuous mode [ 27.007613][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 27.015926][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 27.024922][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.033697][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.041131][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.048980][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 27.058371][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.067205][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.074445][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.083046][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 27.092412][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.101037][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 27.110306][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.119338][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 27.128394][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.137823][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 27.146859][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.155894][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 27.165283][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.174699][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 27.183480][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.201804][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.211046][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 27.220034][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.230102][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 27.239324][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.258956][ T295] device veth0_vlan entered promiscuous mode [ 27.271026][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.281296][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.289103][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.297866][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 27.307787][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.317227][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 27.325593][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.336050][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 27.345657][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.366442][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 27.375520][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.388009][ T291] device veth0_vlan entered promiscuous mode [ 27.395343][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 27.403721][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.413491][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.421410][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.429507][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 27.437759][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.453750][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.461471][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.477641][ T292] device veth0_vlan entered promiscuous mode [ 27.486672][ T313] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.499331][ T291] device veth1_macvtap entered promiscuous mode [ 27.510005][ T295] device veth1_macvtap entered promiscuous mode [ 27.532039][ T313] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.554099][ T322] loop3: detected capacity change from 0 to 2048 [ 27.570323][ T313] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 27.601325][ T313] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.615393][ T313] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 27.624598][ T313] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.634679][ T313] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 27.645011][ T313] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.654488][ T322] EXT4-fs (loop3): mounted filesystem without journal. Opts: nobarrier,grpjquota=,,errors=continue. Quota mode: none. [ 27.667980][ T313] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 27.692060][ T313] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.726680][ T292] device veth1_macvtap entered promiscuous mode [ 27.738916][ T313] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 27.758362][ T313] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.784824][ T313] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 27.827867][ T313] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 27.837999][ T313] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.849577][ T313] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 27.859551][ T313] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.888801][ T342] loop4: detected capacity change from 0 to 128 [ 27.901398][ T341] loop3: detected capacity change from 0 to 256 [ 27.909088][ T345] loop0: detected capacity change from 0 to 128 [ 27.947316][ T345] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 27.962091][ T345] ext4 filesystem being mounted at /0/mnt supports timestamps until 2038 (0x7fffffff) [ 28.080447][ T299] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 28.112848][ T367] capability: warning: `syz.4.20' uses deprecated v2 capabilities in a way that may be insecure [ 28.126292][ T367] loop4: detected capacity change from 0 to 512 [ 28.170487][ T6] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 28.183489][ T367] EXT4-fs (loop4): 1 orphan inode deleted [ 28.190055][ T367] EXT4-fs (loop4): mounted filesystem without journal. Opts: resgid=0x000000000000ee00,grpquota,noblock_validity,init_itable,stripe=0x000000000000002e,resgid=0x0000000000000000,sysvgroups,norecovery,usrquota,,errors=continue. Quota mode: writeback. [ 28.216626][ T367] ext4 filesystem being mounted at /4/file1 supports timestamps until 2038 (0x7fffffff) [ 28.376796][ T377] input: syz0 as /devices/virtual/input/input4 [ 28.383394][ T20] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 28.403253][ T379] loop4: detected capacity change from 0 to 512 [ 28.430582][ T6] usb 2-1: Using ep0 maxpacket: 16 [ 28.450870][ T379] EXT4-fs (loop4): Mount option "noacl" will be removed by 3.5 [ 28.450870][ T379] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 28.450870][ T379] [ 28.470245][ T379] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 28.470252][ T299] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 28.485267][ T379] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 28.496429][ T299] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 28.519579][ T379] EXT4-fs (loop4): 1 truncate cleaned up [ 28.526020][ T379] EXT4-fs (loop4): mounted filesystem without journal. Opts: init_itable,noacl,stripe=0x0000000000000000,,errors=continue. Quota mode: none. [ 28.560830][ T6] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid maxpacket 33032, setting to 1024 [ 28.573164][ T6] usb 2-1: New USB device found, idVendor=0158, idProduct=0100, bcdDevice= 0.00 [ 28.583330][ T6] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.595516][ T6] usb 2-1: config 0 descriptor?? [ 28.630558][ T20] usb 1-1: Using ep0 maxpacket: 16 [ 28.663455][ T295] syz-executor (295) used greatest stack depth: 20688 bytes left [ 28.710490][ T299] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 28.720116][ T299] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.728532][ T299] usb 3-1: Product: syz [ 28.732812][ T299] usb 3-1: Manufacturer: syz [ 28.737248][ T299] usb 3-1: SerialNumber: syz [ 28.752710][ T384] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.759564][ T384] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.767156][ T384] device bridge_slave_0 entered promiscuous mode [ 28.775669][ T384] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.782586][ T384] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.790404][ T384] device bridge_slave_1 entered promiscuous mode [ 28.834357][ T384] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.841526][ T384] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.849500][ T384] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.856573][ T384] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.877768][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.885210][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.895649][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 28.906887][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.910466][ T20] usb 1-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 28.923552][ T20] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.931519][ T20] usb 1-1: Product: syz [ 28.935530][ T20] usb 1-1: Manufacturer: syz [ 28.943836][ T20] usb 1-1: SerialNumber: syz [ 28.948483][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 28.959057][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.961056][ T20] r8152-cfgselector 1-1: config 0 descriptor?? [ 28.966272][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.981661][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 28.990128][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.997885][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.002207][ T332] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 29.021892][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.033189][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.050177][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 29.060748][ T343] UDC core: couldn't find an available UDC or it's busy: -16 [ 29.066446][ T384] device veth0_vlan entered promiscuous mode [ 29.068467][ T343] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 29.082228][ T384] device veth1_macvtap entered promiscuous mode [ 29.089510][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 29.100833][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 29.108475][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 29.116184][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 29.127133][ T6] hid (null): unknown global tag 0x83 [ 29.132676][ T6] hid (null): unknown global tag 0xc [ 29.138973][ T6] hid-generic 0003:0158:0100.0001: unknown main item tag 0x1 [ 29.146827][ T6] hid-generic 0003:0158:0100.0001: unexpected long global item [ 29.148563][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 29.162658][ T6] hid-generic: probe of 0003:0158:0100.0001 failed with error -22 [ 29.163505][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 29.212049][ T313] device bridge_slave_1 left promiscuous mode [ 29.218284][ T313] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.231832][ T313] device bridge_slave_0 left promiscuous mode [ 29.237835][ T313] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.245347][ T20] r8152-cfgselector 1-1: Unknown version 0x0000 [ 29.251702][ T313] device veth1_macvtap left promiscuous mode [ 29.257517][ T313] device veth0_vlan left promiscuous mode [ 29.260592][ T42] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 29.335328][ T26] usb 2-1: USB disconnect, device number 2 [ 29.363181][ T401] process 'syz.5.32' launched './file0' with NULL argv: empty string added [ 29.383186][ T403] 9pnet: p9_errstr2errno: server reported unknown error 6܈ǂd% [ 29.419907][ T405] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 29.460440][ T20] r8152-cfgselector 1-1: Unknown version 0x0000 [ 29.466971][ T20] r8152-cfgselector 1-1: bad CDC descriptors [ 29.490621][ T20] r8152-cfgselector 1-1: Unknown version 0x0000 [ 29.497851][ T20] r8152-cfgselector 1-1: USB disconnect, device number 2 [ 29.550411][ T42] usb 4-1: Using ep0 maxpacket: 16 [ 29.670522][ T42] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xD has an invalid bInterval 0, changing to 7 [ 29.681496][ T42] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 29.681605][ T332] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 29.740485][ T407] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 29.848303][ T30] kauditd_printk_skb: 104 callbacks suppressed [ 29.848318][ T30] audit: type=1400 audit(1731090240.432:180): avc: denied { setopt } for pid=412 comm="syz.1.36" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 29.854974][ T42] usb 4-1: New USB device found, idVendor=4752, idProduct=0011, bcdDevice=32.4f [ 29.888662][ T42] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.896857][ T42] usb 4-1: Product: syz [ 29.901159][ T42] usb 4-1: Manufacturer: syz [ 29.905576][ T42] usb 4-1: SerialNumber: syz [ 29.910585][ T299] cdc_ncm 3-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 29.920114][ T42] usb 4-1: config 0 descriptor?? [ 29.920149][ T30] audit: type=1400 audit(1731090240.502:181): avc: denied { setopt } for pid=414 comm="syz.1.37" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 29.924946][ T299] cdc_ncm 3-1:1.0: dwNtbInMaxSize=3 is too small. Using 2048 [ 29.945070][ T415] xt_bpf: check failed: parse error [ 29.952641][ T299] cdc_ncm 3-1:1.0: setting rx_max = 2048 [ 29.991093][ T42] hub 4-1:0.0: bad descriptor, ignoring hub [ 29.998494][ T42] hub: probe of 4-1:0.0 failed with error -5 [ 30.004716][ T407] usb 6-1: Using ep0 maxpacket: 32 [ 30.010914][ T42] snd-usb-audio: probe of 4-1:0.0 failed with error -12 [ 30.122015][ T299] cdc_ncm 3-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.2-1, CDC NCM, 42:42:42:42:42:42 [ 30.132215][ T407] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 30.143318][ T407] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59391, setting to 1024 [ 30.158559][ T299] usb 3-1: USB disconnect, device number 2 [ 30.164776][ T299] cdc_ncm 3-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.2-1, CDC NCM [ 30.173402][ T407] usb 6-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 30.182833][ T407] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.207727][ T30] audit: type=1400 audit(1731090240.792:182): avc: denied { read } for pid=139 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 30.211168][ T407] usb 6-1: config 0 descriptor?? [ 30.250518][ T410] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 30.280542][ T42] ================================================================== [ 30.288606][ T42] BUG: KASAN: use-after-free in worker_thread+0xaaa/0x12a0 [ 30.295634][ T42] Read of size 8 at addr ffff888128dccc60 by task kworker/1:1/42 [ 30.303183][ T42] [ 30.305442][ T42] CPU: 1 PID: 42 Comm: kworker/1:1 Not tainted 5.15.167-syzkaller-android13-5.15.167_r00 #0 [ 30.315604][ T42] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 30.325502][ T42] Workqueue: 0x0 (events) [ 30.329751][ T42] Call Trace: [ 30.332891][ T42] [ 30.335658][ T42] dump_stack_lvl+0x151/0x1c0 [ 30.340504][ T42] ? io_uring_drop_tctx_refs+0x190/0x190 [ 30.345972][ T42] ? panic+0x760/0x760 [ 30.349872][ T42] ? __schedule+0xcd4/0x1590 [ 30.354577][ T42] print_address_description+0x87/0x3b0 [ 30.360132][ T42] kasan_report+0x179/0x1c0 [ 30.364476][ T42] ? _raw_spin_lock_irqsave+0x210/0x210 [ 30.369905][ T42] ? worker_thread+0xaaa/0x12a0 [ 30.374538][ T42] ? worker_thread+0xaaa/0x12a0 [ 30.379410][ T42] __asan_report_load8_noabort+0x14/0x20 [ 30.384973][ T42] worker_thread+0xaaa/0x12a0 [ 30.389593][ T42] kthread+0x421/0x510 [ 30.393488][ T42] ? worker_clr_flags+0x180/0x180 [ 30.398513][ T42] ? kthread_blkcg+0xd0/0xd0 [ 30.402971][ T42] ret_from_fork+0x1f/0x30 [ 30.407202][ T42] [ 30.410069][ T42] [ 30.412320][ T42] Allocated by task 299: [ 30.416398][ T42] ____kasan_kmalloc+0xdb/0x110 [ 30.421177][ T42] __kasan_kmalloc+0x9/0x10 [ 30.425605][ T42] __kmalloc+0x13a/0x270 [ 30.429857][ T42] kvmalloc_node+0x1f0/0x4d0 [ 30.434369][ T42] alloc_netdev_mqs+0x8c/0xc90 [ 30.439066][ T42] alloc_etherdev_mqs+0x33/0x40 [ 30.443753][ T42] usbnet_probe+0x1fc/0x2840 [ 30.448264][ T42] usb_probe_interface+0x5b6/0xa90 [ 30.453221][ T42] really_probe+0x28d/0x970 [ 30.457634][ T42] __driver_probe_device+0x1a0/0x310 [ 30.463454][ T42] driver_probe_device+0x54/0x3d0 [ 30.468428][ T42] __device_attach_driver+0x2c5/0x470 [ 30.473620][ T42] bus_for_each_drv+0x183/0x200 [ 30.478313][ T42] __device_attach+0x312/0x510 [ 30.482907][ T42] device_initial_probe+0x1a/0x20 [ 30.487774][ T42] bus_probe_device+0xbe/0x1e0 [ 30.492366][ T42] device_add+0xb60/0xf10 [ 30.496565][ T42] usb_set_configuration+0x190f/0x1e80 [ 30.501825][ T42] usb_generic_driver_probe+0x8b/0x150 [ 30.507129][ T42] usb_probe_device+0x144/0x260 [ 30.511905][ T42] really_probe+0x28d/0x970 [ 30.516238][ T42] __driver_probe_device+0x1a0/0x310 [ 30.521367][ T42] driver_probe_device+0x54/0x3d0 [ 30.526218][ T42] __device_attach_driver+0x2c5/0x470 [ 30.531520][ T42] bus_for_each_drv+0x183/0x200 [ 30.536199][ T42] __device_attach+0x312/0x510 [ 30.540959][ T42] device_initial_probe+0x1a/0x20 [ 30.545758][ T42] bus_probe_device+0xbe/0x1e0 [ 30.550810][ T42] device_add+0xb60/0xf10 [ 30.555404][ T42] usb_new_device+0x1038/0x1c00 [ 30.560355][ T42] hub_event+0x2def/0x4770 [ 30.564707][ T42] process_one_work+0x6bb/0xc10 [ 30.569384][ T42] worker_thread+0xad5/0x12a0 [ 30.573994][ T42] kthread+0x421/0x510 [ 30.578000][ T42] ret_from_fork+0x1f/0x30 [ 30.582227][ T42] [ 30.584410][ T42] Freed by task 299: [ 30.588132][ T42] kasan_set_track+0x4b/0x70 [ 30.592642][ T42] kasan_set_free_info+0x23/0x40 [ 30.597430][ T42] ____kasan_slab_free+0x126/0x160 [ 30.602624][ T42] __kasan_slab_free+0x11/0x20 [ 30.607317][ T42] slab_free_freelist_hook+0xbd/0x190 [ 30.612552][ T42] kfree+0xc8/0x220 [ 30.616263][ T42] kvfree+0x35/0x40 [ 30.619994][ T42] netdev_freemem+0x3f/0x60 [ 30.624346][ T42] netdev_release+0x7f/0xb0 [ 30.628856][ T42] device_release+0x95/0x1c0 [ 30.633287][ T42] kobject_put+0x178/0x260 [ 30.637543][ T42] put_device+0x1f/0x30 [ 30.641534][ T42] free_netdev+0x34f/0x440 [ 30.645782][ T42] usbnet_disconnect+0x245/0x390 [ 30.650660][ T42] usb_unbind_interface+0x1fa/0x8c0 [ 30.655916][ T42] device_release_driver_internal+0x50b/0x7d0 [ 30.661759][ T42] device_release_driver+0x19/0x20 [ 30.667069][ T42] bus_remove_device+0x2f8/0x360 [ 30.671917][ T42] device_del+0x663/0xe90 [ 30.676097][ T42] usb_disable_device+0x380/0x720 [ 30.680940][ T42] usb_disconnect+0x32a/0x890 [ 30.685455][ T42] hub_event+0x1d42/0x4770 [ 30.689738][ T42] process_one_work+0x6bb/0xc10 [ 30.694493][ T42] worker_thread+0xe02/0x12a0 [ 30.699083][ T42] kthread+0x421/0x510 [ 30.703165][ T42] ret_from_fork+0x1f/0x30 [ 30.707503][ T42] [ 30.709680][ T42] Last potentially related work creation: [ 30.715488][ T42] kasan_save_stack+0x3b/0x60 [ 30.720084][ T42] __kasan_record_aux_stack+0xd3/0xf0 [ 30.725320][ T42] kasan_record_aux_stack_noalloc+0xb/0x10 [ 30.732507][ T42] insert_work+0x56/0x320 [ 30.736676][ T42] __queue_work+0x92a/0xcd0 [ 30.741091][ T42] queue_work_on+0x105/0x170 [ 30.745517][ T42] usbnet_link_change+0xeb/0x100 [ 30.750430][ T42] usbnet_probe+0x1dcb/0x2840 [ 30.755018][ T42] usb_probe_interface+0x5b6/0xa90 [ 30.760137][ T42] really_probe+0x28d/0x970 [ 30.764469][ T42] __driver_probe_device+0x1a0/0x310 [ 30.769601][ T42] driver_probe_device+0x54/0x3d0 [ 30.774639][ T42] __device_attach_driver+0x2c5/0x470 [ 30.779846][ T42] bus_for_each_drv+0x183/0x200 [ 30.785236][ T42] __device_attach+0x312/0x510 [ 30.790582][ T42] device_initial_probe+0x1a/0x20 [ 30.795871][ T42] bus_probe_device+0xbe/0x1e0 [ 30.801323][ T42] device_add+0xb60/0xf10 [ 30.805592][ T42] usb_set_configuration+0x190f/0x1e80 [ 30.811623][ T42] usb_generic_driver_probe+0x8b/0x150 [ 30.817184][ T42] usb_probe_device+0x144/0x260 [ 30.821869][ T42] really_probe+0x28d/0x970 [ 30.826403][ T42] __driver_probe_device+0x1a0/0x310 [ 30.831613][ T42] driver_probe_device+0x54/0x3d0 [ 30.836478][ T42] __device_attach_driver+0x2c5/0x470 [ 30.842398][ T42] bus_for_each_drv+0x183/0x200 [ 30.847292][ T42] __device_attach+0x312/0x510 [ 30.851936][ T42] device_initial_probe+0x1a/0x20 [ 30.856967][ T42] bus_probe_device+0xbe/0x1e0 [ 30.861762][ T42] device_add+0xb60/0xf10 [ 30.865916][ T42] usb_new_device+0x1038/0x1c00 [ 30.870790][ T42] hub_event+0x2def/0x4770 [ 30.875224][ T42] process_one_work+0x6bb/0xc10 [ 30.880165][ T42] worker_thread+0xad5/0x12a0 [ 30.884666][ T42] kthread+0x421/0x510 [ 30.888844][ T42] ret_from_fork+0x1f/0x30 [ 30.893127][ T42] [ 30.895356][ T42] The buggy address belongs to the object at ffff888128dcc000 [ 30.895356][ T42] which belongs to the cache kmalloc-4k of size 4096 [ 30.909611][ T42] The buggy address is located 3168 bytes inside of [ 30.909611][ T42] 4096-byte region [ffff888128dcc000, ffff888128dcd000) [ 30.923416][ T42] The buggy address belongs to the page: [ 30.928902][ T42] page:ffffea0004a37200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x128dc8 [ 30.939393][ T42] head:ffffea0004a37200 order:3 compound_mapcount:0 compound_pincount:0 [ 30.947633][ T42] flags: 0x4000000000010200(slab|head|zone=1) [ 30.953659][ T42] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100043380 [ 30.963282][ T42] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 30.971881][ T42] page dumped because: kasan: bad access detected [ 30.978507][ T42] page_owner tracks the page as allocated [ 30.984729][ T42] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 384, ts 28800229704, free_ts 0 [ 31.004937][ T42] post_alloc_hook+0x1a3/0x1b0 [ 31.010112][ T42] prep_new_page+0x1b/0x110 [ 31.014716][ T42] get_page_from_freelist+0x3550/0x35d0 [ 31.020715][ T42] __alloc_pages+0x27e/0x8f0 [ 31.025237][ T42] new_slab+0x9a/0x4e0 [ 31.029128][ T42] ___slab_alloc+0x39e/0x830 [ 31.033547][ T42] __slab_alloc+0x4a/0x90 [ 31.037740][ T42] __kmalloc_track_caller+0x16c/0x260 [ 31.043029][ T42] __alloc_skb+0x10c/0x550 [ 31.047347][ T42] rtmsg_ifinfo_build_skb+0x7f/0x180 [ 31.052579][ T42] rtmsg_ifinfo+0x78/0x120 [ 31.056981][ T42] __dev_notify_flags+0xdd/0x610 [ 31.061797][ T42] rtnl_configure_link+0x221/0x320 [ 31.066709][ T42] veth_newlink+0x819/0xe20 [ 31.071133][ T42] rtnl_newlink+0x14c7/0x2050 [ 31.076172][ T42] rtnetlink_rcv_msg+0x951/0xc40 [ 31.081028][ T42] page_owner free stack trace missing [ 31.086245][ T42] [ 31.088403][ T42] Memory state around the buggy address: [ 31.093879][ T42] ffff888128dccb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.101774][ T42] ffff888128dccb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.109761][ T42] >ffff888128dccc00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.117652][ T42] ^ [ 31.124684][ T42] ffff888128dccc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.133111][ T42] ffff888128dccd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.141171][ T42] ================================================================== [ 31.149686][ T42] Disabling lock debugging due to kernel taint [ 31.156355][ T409] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 31.221376][ T407] hub 6-1:0.0: USB hub found [ 31.300575][ T335] usb 4-1: USB disconnect, device number 2 [ 31.490685][ T407] hub 6-1:0.0: 1 port detected [ 31.550521][ T410] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 31.562801][ T410] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 31.573976][ T410] usb 1-1: New USB device found, idVendor=054c, idProduct=024b, bcdDevice= 0.00 [ 31.585658][ T410] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.596296][ T410] usb 1-1: config 0 descriptor?? [ 31.700556][ T407] hub 6-1:0.0: hub_hub_status failed (err = -71) [ 31.707715][ T407] hub 6-1:0.0: config failed, can't get hub status (err -71) [ 31.810489][ T407] usbhid 6-1:0.0: can't add hid device: -71 [ 31.817280][ T407] usbhid: probe of 6-1:0.0 failed with error -71 [ 31.862431][ T407] usb 6-1: USB disconnect, device number 2 [ 32.071309][ T410] sony 0003:054C:024B.0002: unexpected long global item [ 32.079194][ T410] sony 0003:054C:024B.0002: parse failed [ 32.085325][ T410] sony: probe of 0003:054C:024B.0002 failed with error -22 [ 32.273871][ T410] usb 1-1: USB disconnect, device number 3