last executing test programs: 3.896228391s ago: executing program 0 (id=1): r0 = syz_socket_connect_nvme_tcp() recvmsg$inet_nvme(r0, &(0x7f0000001140)={&(0x7f0000000000)=@ieee802154, 0x80, &(0x7f0000000100)=[{&(0x7f0000000080)=""/87, 0x57}], 0x1, &(0x7f0000000140)=""/4096, 0x1000}, 0x40000122) ioctl$SIOCGSTAMP(r0, 0x8906, &(0x7f0000001180)) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$SEG6(&(0x7f0000001200), 0xffffffffffffffff) sendmsg$SEG6_CMD_DUMPHMAC(r1, &(0x7f00000012c0)={&(0x7f00000011c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000001280)={&(0x7f0000001240)={0x2c, r2, 0x400, 0x70bd26, 0x25dfdbfb, {}, [@SEG6_ATTR_DSTLEN={0x8, 0x2, 0x7}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x3}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000001}, 0xc0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000001300)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r1, 0x1) ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r3, 0x8983, &(0x7f0000001340)) pipe(&(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_pktinfo(r5, 0x0, 0x8, &(0x7f00000013c0)={0x0, @multicast2, @local}, &(0x7f0000001400)=0xc) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001480), r6) sendmsg$NL80211_CMD_NEW_KEY(r5, &(0x7f0000001580)={&(0x7f0000001440)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r8, 0x4, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0x7, 0x11}}}}, [@NL80211_ATTR_KEY={0x28, 0x50, 0x0, 0x1, [@NL80211_KEY_TYPE={0x8, 0x7, 0x2}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac01}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "3fa4c16be413867b9a60e2e741"}]}, @NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_KEY_DEFAULT={0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x4008035) sendmsg$tipc(r4, &(0x7f0000001ac0)={&(0x7f00000015c0)=@name={0x1e, 0x2, 0x3, {{0x42, 0x4}, 0x4}}, 0x10, &(0x7f0000001980)=[{&(0x7f0000001600)="67e7cd2e468bb97bb1ea624ae942685266c955736ba63536fed314f88cc17197f0a48128717b51413d381e70ce5d2d1271209111970d5a8385f33825a0cf1c7667342221", 0x44}, {&(0x7f0000001680)="bd18b23882ed5d88124dc906f982c7f03b4479d53f1547f005f2be715c37c1373a7cc81c93a77434895778055a33d9dd8b4b22", 0x33}, {&(0x7f00000016c0)="3361d03894998961707a9e3a5244", 0xe}, {&(0x7f0000001700)="4bbaee53e28f0f89f1d7ac413acd03376acaf195406728c347a84a9e504df033a392629aee00f407df834c1575378d604abfa2f02772c4393a48b9a70e0abbd107598189a75f5ad102a7e41d881351d840ae0c10f209b2a0528eddb97e573a2a34a7076b2d18d81cb215b1399efe1da560412f726a20fec098bb9f87caa4f091600120664a7640f92a99773abffd7f456cc6d4fa9be5b929a0393a3b2ca6f6609099b3e678487e36b299636e433edef9e9c86badd76d77", 0xb7}, {&(0x7f00000017c0)="4fff81d8f2d678cb322d43deea87fa11f767aec76dfee9da0e22faf56cb573295f2c8257a2d12625b2740453f0a61b310b5d5e8d00b72ccc45ab784ea3fd213babd2307b66e94753f522451835e0cc4956ae540333b8b095da4bd0b18005e2178d829c1764eda51a6d0365cd052c2bcc05421fef9a28c51f95e775bb2e411dbba5f0fc6246b200905fc9f3128724293d7c30dd3769f25ba4b0c02d69cb3ee488237f7d6afb9281756c1d6d48da9bfed4578b5a880696beb1d1714355b2597d9c69588b3fdbc54133fe217c9cac09c6de995d3eb96c771b7693cc1a1d199e7d0db681", 0xe2}, {&(0x7f00000018c0)="af3a3e5f97ece8b3a1949b676df8f9d49c47b865203ab617adc7c575953979183b5295a1bac48c225baf0da18586e94c701adfb3005c8969a302acfb5ab2980ad6504fa46396669ba1ec72fd73240f19136817c9339d76ce42e8596a2ace2deb2dc99eecd6bc105cfd81a72fe4f7d14a8360af871744a092689ee5fb8f314261bbcbfe5fe1445378", 0x88}], 0x6, &(0x7f0000001a00)="62c2b15f55f397d8de5f9d8f3c67a89522d6c663cfb11d989a42a8940ccc68deaf900a95a7823925f853548302c3648fc0bc72eeb5ad4af793503df2bd1691ca5d4c80a2665c730bac85950c22434872a8d94abba928204cbf71375d92ddcab2df9019a02585e424269341d5e7518086a868fa8a73d09cff3a2b74ef1c45622a3e94c526c95e474e51a19f88052f7254e5", 0x91, 0x8008}, 0xc0c0) r9 = syz_genetlink_get_family_id$team(&(0x7f0000001b40), r6) sendmsg$TEAM_CMD_OPTIONS_GET(r5, &(0x7f0000001d00)={&(0x7f0000001b00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001cc0)={&(0x7f0000001b80)={0x11c, r9, 0x200, 0x70bd28, 0x25dfdbff, {}, [{{0x8, 0x1, r7}, {0x100, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x7f}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x1ff}}, {0x8, 0x6, r7}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x400}}, {0x8, 0x6, r7}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r7}}}]}}]}, 0x11c}, 0x1, 0x0, 0x0, 0x800}, 0x8000) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r10 = syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) shutdown(r10, 0x1) ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r6, 0x8983, &(0x7f0000001d40)) read$FUSE(r6, &(0x7f0000001d80)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(r1, 0x8982, &(0x7f0000003dc0)={0x7, 'gretap0\x00', {0x7}, 0x1}) recvmsg$can_bcm(r5, &(0x7f0000005100)={0x0, 0x0, &(0x7f0000005000)=[{&(0x7f0000003e00)=""/209, 0xd1}, {&(0x7f0000003f00)=""/117, 0x75}, {&(0x7f0000003f80)=""/67, 0x43}, {&(0x7f0000004000)=""/4096, 0x1000}], 0x4, &(0x7f0000005040)=""/183, 0xb7}, 0x60) ioctl$sock_FIOSETOWN(r4, 0x8901, &(0x7f0000005140)=r11) sendmsg$GTP_CMD_GETPDP(r6, &(0x7f0000005240)={&(0x7f0000005180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000005200)={&(0x7f00000051c0)={0x2c, 0x0, 0x2, 0x70bd25, 0x25dfdbff, {}, [@GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_FLOW={0x6}, @GTPA_PEER_ADDRESS={0x8, 0x4, @private=0xa010100}]}, 0x2c}, 0x1, 0x0, 0x0, 0x10}, 0x20000010) r12 = dup2(r0, r1) sendmsg$sock(r6, &(0x7f00000059c0)={&(0x7f0000005280)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e24, @empty}}, 0x80, &(0x7f00000058c0)=[{&(0x7f0000005300)="5d8dec4566735846fa65fa74a3cbd39e20a6fb1aed7fa315b6cbfde9010ad6d7f30ea41f30483021d812b6e47a85064ead2d1b0cc32e92917d26089b8656c500806f77cc8606814771fa7d794d11b81ebcc3f704271a1b8839cae66b4e85ce34306b6b82f100e2676f42cfbe033f8b23a9dc254e78c13a9b5a8008ea36db2652b4359de6771c37d58ae01a677342300fc6f4be1d3b5d43adb57ac53647ee89a20c69427798525d016dd221c5d7597cae6c886e79d53adf9694767f93bbf27514dd8cc85addc74a6caa3fb0", 0xcb}, {&(0x7f0000005400)="d218c0cbcdd6c84d396f954b86f2e7dc522c7e93ec458438e7bb95223f8f50e42a88e052e94472da2079d9e80ac6c0e7d81037dba793da9526a229b310c5ed8e60b91cc4b9bed0b9e275a6a6e19df9", 0x4f}, {&(0x7f0000005480)="b2ba57a8ee111491abdad004491e9b11d893019f7b3a29123b8e0f721ba281f772846fafb2e71c4a48df3944d47fea8f74c6c157cdad8869bfdc916d899f7748ca42454d31c124744bdccd7aa5a3e59f5e69e05c82346158f8097d0c75c3b1dd18087539c69b95b386f8c4e1948adbb87eb80d3bbb98b83b1db869e7eb94871337246b1b4f1cd3be0142fd55d653917b7641b0ebbbbe7709f60a7c8ba0f316be", 0xa0}, {&(0x7f0000005540)="7550ed0fe5f873d02969cafc3c3fbe1035bb34c28e9049a10956335f7f5da3f700228125b8bd702764f454986f55e3477bb25a066e55c631543bbb7bde5246c1af719b27162ff53282b0128e768f0727d76ad4bf9c942cbbe4f78cd4dd0338dec62074ad7617eb7784d3bfcbc3bf46dab0bdbcc11e50ddfd10371e2a49923b5e322f9c6ad3519c935dd0f053821708b0960a8b2e15454d65dfba204b481c600c27ca26f382cfb95034395d3d98eec65d32ccd5d7da3f48c5cf847c7bd8ae028911a4b3563a6baeeef8917c125f0a33143867592d13d98f944b38598a5b27f58493413ddf29359a32b7f9a4b244", 0xed}, {&(0x7f0000005640)="93356aa50c89e8ae4cdba488c2e6e1c4a2eb9d25e64cc6c980ca2b17c09a57b566378b886965005e", 0x28}, {&(0x7f0000005680)="1cb172dca48751f20a4d6faab0144c864325741cc1335e652fda3383a66e527df6a4d8985adfcd105b7441778b09adb869e767c1c097e95031bb8daf88ed7526276b025861049eb54069db45388533caa495a8d10ea6135ae342c19ede5f6026ec4956ac8b5ee9a4785640906c4df462a60a9b7b7fd10d4f1643bb5c625445a9018b5dbe9b8b2c302d58c95512526d", 0x8f}, {&(0x7f0000005740)="0dd61fdce0ac9b9a29b1564a818dfeef52466f4b44e16682b40f4c0eed208d536cafa1044bcec591c97a21099a127485e479e3c72084a375f313d469ca22e8fe22e94d5240c9a79e06c708bc5670ec7c861b7c5a5559dff0e8566253efc044e62bc73e46d64df61e", 0x68}, {&(0x7f00000057c0)="3f447c082fc810917c01cd3e0f612ae2f291df489b697f1860200a2e2706d9929ca8d4997a49df3711503124301d31d87dc2e4f86de68983159e441a527fbd022cfcc3779b4e55371084f9362a2e5dd8f1b77263672a128d1c396144d0b27c4f8eb9924a0239a0d130283812a1b3e802d2b3f996412c9d273db9f013ce1d72e4a8086f40f9505c2af16c35664639eedf1367d31f90928595055febccc28584390ade42f7dda0eb9c40508e23b386a0352a0a4c50be352df72d080500b760b120842d1769208ecbe2d1a1b6a1172d5dd7f1fa", 0xd2}], 0x8, &(0x7f0000005940)=[@mark={{0x14, 0x1, 0x24, 0x2}}, @timestamping={{0x14}}, @txtime={{0x18, 0x1, 0x3d, 0x3}}], 0x48}, 0x800) mknodat$loop(r6, &(0x7f0000005a00)='./file0\x00', 0x420, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000005ac0)={0xc, 0x0, &(0x7f0000005a40)=[@enter_looper, @enter_looper, @exit_looper], 0x13, 0x0, &(0x7f0000005a80)="599eff3364c139908b405a186fa972726d7bf5"}) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(r12, &(0x7f0000005c00)={&(0x7f0000005b00)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000005bc0)={&(0x7f0000005b80)={0x1c, r8, 0x300, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, ["", "", ""]}, 0x1c}}, 0x4000000) 3.857451642s ago: executing program 1 (id=2): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x2, &(0x7f0000000140)=0x5e9a, 0xfffffffffffffe43) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x2, @loopback}, 0x1c) dup(r0) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r1, 0x29, 0x36, &(0x7f0000000040)=ANY=[], 0x8) connect$inet6(r1, &(0x7f00000004c0)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) openat2$dir(0xffffffffffffff9c, 0x0, &(0x7f0000000300)={0x10002, 0x0, 0xb}, 0x18) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x541b, &(0x7f0000000100)={'veth1_to_hsr\x00', @link_local}) sendmmsg$inet6(r1, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="8f92a4b0e785", 0x6}], 0x1}}], 0x1, 0x4400c800) sendto$inet6(r1, &(0x7f0000000300), 0x1e, 0x3b00, 0x0, 0xfffffffffffffdfd) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000680)=@gcm_128={{0x303}, "000037d7009400", "c0b6c5b29ca2b838d41ac2fc7ddf972d", "e9be1eae", "c210000406002001"}, 0x28) 3.774377884s ago: executing program 1 (id=5): symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') (async, rerun: 64) setpriority(0x2, 0x0, 0xd2f4) (rerun: 64) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) (async) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ppoll(&(0x7f0000000040)=[{r0, 0xa0ff}], 0x1, &(0x7f0000000140)={0x0, 0x3938700}, &(0x7f0000000180)={[0x7fffffffffffffff]}, 0x8) sendmsg$nl_generic(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="280000001e00210000000000000000000700000005000000000004000a0002"], 0x28}}, 0x0) (async, rerun: 64) getsockopt$inet_buf(r1, 0x0, 0x34, 0x0, &(0x7f0000001000)) (async, rerun: 64) userfaultfd(0x80000) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_encap(r3, 0x11, 0x68, &(0x7f0000000040)=0x2, 0x4) (async) r4 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="0d01000009000008250592d20700006a3b010902241700fa0074980904e4ff11070103000905010200ffe0000009058202"], 0x0) syz_usb_control_io(r4, 0x0, &(0x7f0000000200)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB=' '], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 64) syz_open_dev$char_usb(0xc, 0xb4, 0x0) (rerun: 64) syz_usb_disconnect(r4) setresuid(0xee00, 0xee00, 0x0) (async) syz_usb_connect(0x3, 0x24, 0x0, 0x0) (async, rerun: 32) setsockopt$inet_udp_encap(r3, 0x11, 0x64, &(0x7f0000000140)=0x2, 0x4) (rerun: 32) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={0xa4, 0x1e, 0x21, 0x70bd2b, 0x0, {0x1d}, [@generic="4a420084c50cb61a526325c9a7e75829318f4d0cc5b384466dbc108a5f0358c01dc6e2f812e5640c9b900e665a5609a817c52ea599481ed85fc1fd51b0afe12394df3c032008ae07e2c6f251c5fcc27439f180467ecb7458d9636917f5837df67e99786bda8d06c72e0150368853bc777f0ec416044e73ed13b1a4bfae99c06ce2bb1d3fbd87712f5f76", @typed={0x4, 0x1, 0x0, 0x0, @binary}]}, 0xa4}}, 0x0) r6 = open(&(0x7f00000001c0)='./file0\x00', 0x680ff, 0xb8) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) write$evdev(r6, &(0x7f00000003c0)=[{{r7, r8/1000+10000}, 0x2, 0xfff7, 0x7ff}, {{}, 0x1f, 0x4, 0x50}], 0x30) (async, rerun: 64) socket$netlink(0x10, 0x3, 0xb) (async, rerun: 64) syz_open_dev$evdev(&(0x7f0000000340), 0xfffffffffffffff9, 0x105882) (async) r9 = open(&(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x10) fcntl$setlease(r6, 0x400, 0x0) (async, rerun: 64) fcntl$setlease(r9, 0x400, 0x1) (rerun: 64) 3.773668114s ago: executing program 0 (id=7): r0 = inotify_init1(0x800) ioctl$BTRFS_IOC_DEFRAG(r0, 0x50009402, 0x0) r1 = socket$netlink(0x10, 0x3, 0x4) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_CAP_HYPERV_SYNIC2(r4, 0x4068aea3, &(0x7f0000000140)={0xaf}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000180)={@loopback, 0x8000000, 0x0, 0x2, 0x1, 0x0, 0x8}, 0x20) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000180)={0x2, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) ioctl$sock_SIOCBRDELBR(r1, 0x89a2, &(0x7f0000000000)='bridge0\x00') syz_usb_connect$midi(0x2, 0x31, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000403e13150840000102030109021f00010109100409040000010103000b0905053f"], 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r8 = userfaultfd(0x1) syz_usb_connect$uac3(0x3, 0xa0, &(0x7f0000000c00)=ANY=[], &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x77, &(0x7f00000020c0)=@string={0x77, 0x3, "e1c04ae8b424621d9160626fdf599933eb1dfb7257bff4b4d7410c231765dec8e3f46ab96667abcc39f9019365348c69b2b4c1d9d0bb4f387d07cbad18b7405a14214aa4d88199fd4a018bf0d19faf449906f863a4cc19d2bf58ff9b06459789a63919a7972194521ef5d92a9605e0e560a5494a25"}}]}) ioctl$UFFDIO_API(r8, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x298}) ioctl$UFFDIO_REGISTER(r8, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r8, 0xc028aa03, &(0x7f0000000040)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00003dc000/0x3000)=nil, 0x400000, 0x3, 0x2}) ioctl$XFS_IOC_PATH_TO_HANDLE(r8, 0xc0385869, &(0x7f0000000280)={r7, &(0x7f00000000c0)=',{\xb2!}\x00', 0x496000, &(0x7f00000001c0)={@_ha_fsid={[0x7, 0x7]}, {0x8000, 0x6, 0x8, 0x5}}, 0x3, &(0x7f0000000200), &(0x7f0000000240)=0x3}) r9 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r10 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') read$FUSE(r10, &(0x7f0000000040)={0x2020}, 0x2020) ioctl$KVM_GET_DEVICE_ATTR_vm(r9, 0x4018aee2, &(0x7f0000000300)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000002080)={0x3, 0x3}}) ioctl$KVM_CAP_MSR_PLATFORM_INFO(r9, 0x4068aea3, &(0x7f0000000140)={0x9f, 0x0, 0x1}) r11 = openat$uhid(0xffffffffffffff9c, &(0x7f0000013180), 0x802, 0x0) write$UHID_INPUT2(r11, &(0x7f00000131c0)=ANY=[@ANYBLOB="03b00b"], 0x6) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) 3.772508405s ago: executing program 2 (id=8): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x440, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) sendto$inet6(r2, &(0x7f0000000000)="355e4b93b23cb9aa35ab3ee3edf4e0254881f4edcdd1fcf5339d3b12b0d50a8e875d65a20dd1dc649d77", 0x2a, 0x4040045, &(0x7f00000000c0)={0xa, 0x4e23, 0xd, @loopback, 0x3}, 0x1c) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x26e8, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f0000000100)="66baf80cb814a60580ef66bafc0ced644a0f7e5afcc744240027a05088c744240236190000c7442406000000000f011424662e400f32673e260f23f666bad104ecc4e1cdd86f0c0f01c9450fc7a8000000003e660f383336", 0x58}], 0x1, 0x4e, 0x0, 0x0) ioctl$KVM_NMI(r3, 0xae9a) ioctl$KVM_RUN(r3, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x440, 0x0) (async) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) dup(r1) (async) sendto$inet6(r2, &(0x7f0000000000)="355e4b93b23cb9aa35ab3ee3edf4e0254881f4edcdd1fcf5339d3b12b0d50a8e875d65a20dd1dc649d77", 0x2a, 0x4040045, &(0x7f00000000c0)={0xa, 0x4e23, 0xd, @loopback, 0x3}, 0x1c) (async) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x26e8, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f0000000100)="66baf80cb814a60580ef66bafc0ced644a0f7e5afcc744240027a05088c744240236190000c7442406000000000f011424662e400f32673e260f23f666bad104ecc4e1cdd86f0c0f01c9450fc7a8000000003e660f383336", 0x58}], 0x1, 0x4e, 0x0, 0x0) (async) ioctl$KVM_NMI(r3, 0xae9a) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) 3.729676086s ago: executing program 1 (id=9): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) r3 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r3, 0x89f9, &(0x7f0000000a40)={'ip6gre0\x00', 0x0}) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fdb000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x2a, 0x0, 0x0) syz_kvm_setup_cpu$x86(r2, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x61, &(0x7f0000000140)=[@cr4={0x1, 0x40bee}], 0x1) ioctl$KVM_RUN(r2, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) (async) socket$inet6(0xa, 0x2, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r3, 0x89f9, &(0x7f0000000a40)={'ip6gre0\x00', 0x0}) (async) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fdb000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x2a, 0x0, 0x0) (async) syz_kvm_setup_cpu$x86(r2, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x61, &(0x7f0000000140)=[@cr4={0x1, 0x40bee}], 0x1) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) 3.50839672s ago: executing program 3 (id=10): r0 = syz_ublk_setup_io_uring(0x533e, &(0x7f0000000000)={0x0, 0x7105, 0x40, 0x1, 0x398}, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100)) r1 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2) fcntl$addseals(r1, 0x409, 0x7) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000200)={0x0, 0x1, 0x9, 0x7}) mmap(&(0x7f0000c95000/0x1000)=nil, 0x1000, 0x0, 0x2000000000032, r0, 0x0) mlockall(0x7) 3.485504671s ago: executing program 3 (id=11): mremap(&(0x7f0000000000/0x9000)=nil, 0x600000, 0x600000, 0x3, &(0x7f0000a00000/0x600000)=nil) rt_sigsuspend(&(0x7f0000000040)={[0x1]}, 0x8) (async) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) mremap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) r1 = syz_open_dev$evdev(&(0x7f00000022c0), 0x12, 0x4208c0) ioctl$EVIOCGRAB(r1, 0x40044590, &(0x7f0000000000)=0x80000000) (async) ioctl$EVIOCGBITSND(r1, 0x40044591, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000400)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) (async) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) (async) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$FICLONERANGE(r3, 0x4020940d, &(0x7f0000000300)={{r4}, 0xf, 0x1, 0xff}) (async) r5 = landlock_create_ruleset(&(0x7f00000002c0)={0x7f6e}, 0x18, 0x0) (async) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) (async) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000540)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') landlock_restrict_self(r5, 0x0) (async) open(&(0x7f00000000c0)='.\x00', 0x517002, 0x0) (async) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (async) r7 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="120110010000008aee9df6e5ade2aa8473b4206a05180628b72fff9ad2254800ab000000230109022400010000d001094d040004020300030009218100fc01"], 0x0) syz_usb_control_io$hid(r7, 0x0, 0x0) (async) syz_usb_control_io(r7, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)={0x0, 0x3, 0x86, {0x86, 0xa, "83efb949f0ff7f562348d180df827ff0478fa22a61a54607b71ea9e43d359c479c37f525cde32758cc0738b40686064f096ac8db5dc7c7878f41d92d70cd7b3c21cca19ec0ae48dad85569e65dff074a6da426842ac1580e88251f83c7d309b57947280c65965b4ca7e785b8a009b165b84b68437350ff693be86063ffcade80938f54b1"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) socket$unix(0x1, 0x1, 0x0) (async) r8 = openat$cgroup_ro(r6, &(0x7f0000002280)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0) read$FUSE(r8, &(0x7f0000000240)={0x2020}, 0x2020) (async) close_range(r2, 0xffffffffffffffff, 0x0) (async) r9 = socket$unix(0x1, 0x1, 0x0) poll(&(0x7f0000000100)=[{r9, 0x3028}], 0x1, 0x1) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f00000013c0)={&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0}, &(0x7f0000000140)=0x40) 3.409277053s ago: executing program 1 (id=12): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r0) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040), 0x600000, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8924, &(0x7f0000000080)={'pim6reg\x00', @remote}) syz_usb_connect$uac3(0x1, 0xef, &(0x7f00000000c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0xff, 0x582, 0x29, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xdd, 0x3, 0x1, 0x1, 0x90, 0x4, {0x8, 0xb, 0x0, 0x1, 0x1, 0x25, 0x30, 0x1}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xf, 0x3e, 0xfffffffb}, [@extension_unit={0x9, 0x24, 0xa, 0x3, 0x2, [0x1]}, @output_terminal={0x13, 0x24, 0x3, 0x6, 0x303, 0x4, 0x5, 0x66, 0x5, 0x64, 0x70a8, 0x9}, @multiply_unit={0xb, 0x24, 0xd, 0x9, 0x5, 0xfff, 0xf}, @selector_unit={0xd, 0x24, 0xc, 0xff, 0x8, "654a66df835bf982"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0x4, 0x2, 0x8, 0x6, "c2", "ab616c"}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x8, 0x0, 0xe, 0x5, 0xf}]}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x5, 0x6, 0x0, {0xa, 0x25, 0x25, 0x9, 0xc, 0x8}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_ii_discrete={0xf, 0x24, 0x2, 0x2, 0x5, 0x1, 0x7f, "79759512ccf0"}, @as_header={0x17, 0x24, 0x1, 0x6, 0x49f, 0x5, 0x1002, 0x0, 0x6, 0x0, 0x8}]}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x7, 0x5, 0x7c, {0xa, 0x25, 0x25, 0x3, 0x81, 0x3}}}}}}}}]}}, &(0x7f0000000340)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x50, 0x6, 0x9, 0x20, 0xa}, 0xf, &(0x7f0000000200)={0x5, 0xf, 0xf, 0x1, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x9, 0x62, 0x4, 0x5}]}, 0x1, [{0xfa, &(0x7f0000000240)=@string={0xfa, 0x3, "7f4446378a90a315d7fc73a8082476dbfe4ffb2eed147e0794a3bb6e7c12a15d369a075a70a4a216107072ee6c1aa85a7e175fd08f3d0f801bcad1867d05f394d7c647f8a74502c98f495487b06073e21058ab067d9401c1835b5fa0f9d2ae52c6b89dca036ceeda4e6f9963c2dc6bda5ba44f02fa190f418779a775d117bbecf2fa7979d2730fb3bfe4ee346b7b45afe932c6ba019f2b1712c2b6668518665b26da47bd1c16309262cc1a1a79cddf5a81d212935b44eddd4ff20937dfd34d73f48b0116192e36654a4fc08d2d9c9839149e4498f8949637848deba94b8ac8d7357b83a19232e8461b7a9c4c4662dd345eee492f05a71fb4"}}]}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$fou(&(0x7f00000003c0), r1) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000480)={'sit0\x00', &(0x7f0000000400)={'ip_vti0\x00', 0x0, 0x40, 0x8, 0x200, 0x5, {{0xf, 0x4, 0x3, 0x6, 0x3c, 0x64, 0x0, 0x6, 0x4, 0x0, @private=0xa010101, @dev={0xac, 0x14, 0x14, 0x2b}, {[@rr={0x7, 0x23, 0x99, [@multicast1, @broadcast, @dev={0xac, 0x14, 0x14, 0x34}, @multicast1, @broadcast, @multicast2, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x1b}]}, @noop, @noop]}}}}}) sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000540)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x34, r3, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@FOU_ATTR_PORT={0x6, 0x1, 0x4e24}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @broadcast}, @FOU_ATTR_IFINDEX={0x8, 0xb, r4}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x2c}]}, 0x34}, 0x1, 0x0, 0x0, 0x48840}, 0x4000000) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f00000005c0), r2) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000680)={'erspan0\x00', &(0x7f0000000600)={'gre0\x00', r4, 0x10, 0x8000, 0x8, 0x9, {{0x11, 0x4, 0x2, 0x5, 0x44, 0x66, 0x0, 0xc5, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local, {[@timestamp_addr={0x44, 0x1c, 0xea, 0x1, 0x0, [{@private=0xa010102, 0x8}, {@local, 0x2}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x46}]}, @rr={0x7, 0xb, 0xd2, [@initdev={0xac, 0x1e, 0x1, 0x0}, @loopback]}, @ssrr={0x89, 0x7, 0x98, [@rand_addr=0x64010102]}, @end]}}}}}) sendmsg$ETHTOOL_MSG_DEBUG_GET(r0, &(0x7f0000000780)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x74, r5, 0x8, 0x70bd25, 0x25dfdbfb, {}, [@HEADER={0x60, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond0\x00'}]}]}, 0x74}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_FLUSH(r7, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x24, 0x0, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r8 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0xd) ioctl$KVM_CREATE_DEVICE(r8, 0xc00caee0, &(0x7f00000008c0)={0xb}) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000940), r0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000980)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_STATION(r7, &(0x7f0000000b00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000ac0)={&(0x7f00000009c0)={0xec, r9, 0x20, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r10}, @val={0xc, 0x99, {0x6, 0x5}}}}, [@NL80211_ATTR_STA_EXT_CAPABILITY={0xa8, 0xac, "43d137e1760444878afbeed8348a67a429ab0edcca0e3fa034c55e0e78d7efbe1a570130e3d15a658b4076e63be019ca7908f9d6a017961e4392659ac95a98f3360a4cb28fad233b990c521749358d371f9cb9ff63cc226c8919f2c9d2fae87eb6c015daececf9ebbbfb75549b82bd3e3ad50b34af738148bfc46a8d3d55aae2baabdbfec07204a1398f5394a0a20880cddbc0eefb5e7c0af0b99a37ba791936c12f9e5e"}, @NL80211_ATTR_STA_FLAGS2={0xc, 0x43, {0x4e5d51f0, 0x3}}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1}, @NL80211_ATTR_STA_TX_POWER={0x6, 0x114, 0x8}]}, 0xec}, 0x1, 0x0, 0x0, 0x4004}, 0x40804) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, &(0x7f0000000c00)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b80)={0x34, r5, 0x200, 0x70bd2c, 0x25dfdbfc, {}, [@ETHTOOL_A_FEATURES_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}]}, 0x34}, 0x1, 0x0, 0x0, 0xc0}, 0x11) r11 = getuid() quotactl_fd$Q_SETQUOTA(r0, 0xffffffff80000801, r11, &(0x7f0000000c40)={0x0, 0xb, 0xffffffff, 0xf048, 0x6, 0x8, 0x10, 0x48, 0xd1}) syz_io_uring_setup(0xf49, &(0x7f0000000cc0)={0x0, 0x79d, 0x2, 0x3, 0x12b, 0x0, r1}, &(0x7f0000000d40), &(0x7f0000000d80), &(0x7f0000000dc0)) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$devlink(&(0x7f0000000e40), r1) sendmsg$DEVLINK_CMD_RATE_SET(r12, &(0x7f0000001000)={&(0x7f0000000e00)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000e80)={0x10c, r13, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@DEVLINK_ATTR_RATE_PARENT_NODE_NAME={0x2b, 0xa9, @random="f3bad8b19a755532566c06bbf9af92f536fc841e699477490e784b622879fe4c944009c78c5509"}, @DEVLINK_ATTR_RATE_PARENT_NODE_NAME={0x5a, 0xa9, @random="f4cf8b0037dd8c9c0062af02a70c3d35d4d4431ab15961ae46c0a2621418138b0a39d0ccab8905b8ba3dd58fb0e58c32550bb89f432a5dcc9c2fb4af3cdd11818f414b963e4d34874d09f745cef2ef2d308112ac2510"}, @DEVLINK_ATTR_RATE_TX_MAX={0xc, 0xa7, 0x8}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @DEVLINK_ATTR_PORT_INDEX={0x8}, @handle=@pci={{0x8}, {0x11}}, @handle=@pci={{0x8}, {0x11}}, @handle=@pci={{0x8}, {0x11}}]}, 0x10c}}, 0x20000000) setresuid(r11, r11, r11) ioctl$KVM_RUN(r1, 0xae80, 0x0) ioctl$F2FS_IOC_ABORT_ATOMIC_WRITE(r8, 0xf505, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r7, &(0x7f0000001140)={&(0x7f0000001040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000001100)={&(0x7f00000010c0)={0x2c, 0x0, 0x10, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000050) 3.409117043s ago: executing program 2 (id=13): r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x40, 0x80) (async) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000000000), 0x10) (async) bind$can_raw(r2, &(0x7f0000000080), 0x10) (async) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRES32=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRES64=r1, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_NOTIFY_STORE(r1, &(0x7f00000001c0)=ANY=[@ANYBLOB="28000000040000000000004000000000060000000000000005000900"/40], 0x28) (async) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mtu(r3, 0x0, 0xa, &(0x7f00000019c0)=0x4, 0x4) (async) connect$inet(r3, &(0x7f0000001a00)={0x2, 0x4e23, @remote}, 0x10) (async) syz_usb_connect$uac1(0x5, 0xdc, &(0x7f00000017c0)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c240208000103000000ff000924060506020100000924030003030005490c240206"], 0x0) 2.967128093s ago: executing program 3 (id=14): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20040, 0x0) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$F2FS_IOC_WRITE_CHECKPOINT(r1, 0xf507, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000100), r2) sendmsg$WG_CMD_GET_DEVICE(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3b3cc175279b0d4cb05e00"/21, @ANYRES16=r3, @ANYBLOB="01032cbd7000fddbdf2500000000"], 0x14}, 0x1, 0x0, 0x0, 0x20004000}, 0x20040000) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='map_files\x00') getdents64(r4, 0x0, 0x0) r5 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000001100)={'veth1\x00', &(0x7f0000000040)=@ethtool_link_settings={0x4c, 0x100, 0x0, 0x4, 0x40, 0x7, 0x2c, 0x4b, 0x1, 0x4, [0x6, 0x8, 0xffff, 0xc1e, 0x47a3, 0x40d9e, 0x1d, 0x1]}}) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x8) r6 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000040), 0x422003, 0x0) ioctl$F2FS_IOC_SEC_TRIM_FILE(r5, 0x4018f514, &(0x7f0000000140)={0x6, 0x0, 0x3}) ioctl$KDSETMODE(r6, 0x4b3a, 0x0) 2.952220363s ago: executing program 3 (id=15): r0 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x20}}}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x9) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r2, &(0x7f00000007c0)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x4}, 0xe) sendmsg$IPCTNL_MSG_CT_GET_DYING(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x6, 0x1, 0x201, 0x0, 0x0, {0x0, 0x0, 0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x5}, 0x81) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x382, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xf) ioctl$TCFLSH(r4, 0x400455c8, 0x1000000000) socket$inet_tcp(0x2, 0x1, 0x0) unshare(0x60000600) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r6, 0xc004743e, &(0x7f0000000180)=0x4000000) ioctl$PPPIOCNEWUNIT(r5, 0xc004743e, &(0x7f00000000c0)) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r7, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)=ANY=[@ANYBLOB="20000000110001000000000000000000100000e60b"], 0x20}], 0x1}, 0x0) ioctl$sock_bt_hci(r3, 0x400448de, &(0x7f0000000040)) r8 = syz_usb_connect(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$hid(r8, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r1) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r10 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010008020000001800006600000008000300", @ANYRES32=r11, @ANYBLOB="08002600940900000800b700"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r12 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000005c0), 0x2, 0x0) r13 = openat$selinux_policy(0xffffff9c, &(0x7f00000000c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r13, 0x0) write$selinux_load(r12, &(0x7f0000000000)=ANY=[], 0x11217) 2.22162734s ago: executing program 2 (id=16): openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x8480, 0x0) (async) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') (async) r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f00000000c0)={0x40000039}) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) (async) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) eventfd(0x7fff) (async) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040), 0x0) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) (async) r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r4) (async) tkill(r4, 0x2f) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) ptrace(0x10, r4) ptrace$peeksig(0x4209, 0x0, &(0x7f0000000140)={0x1}, &(0x7f0000000fc0)) (async) r5 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) read$char_usb(0xffffffffffffffff, &(0x7f0000000080)=""/64, 0x40) (async) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x8, &(0x7f0000000200)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) (async) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file2\x00', 0x40, 0x23) lseek(r6, 0x10, 0x3) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r5, 0x4010ae67, 0x0) (async) ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) (async) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000340)={0x1, 0x0, @ioapic={0x80a0000, 0x2, 0x6, 0x2, 0x0, [{0xcd, 0xd2, 0x3, '\x00', 0x2}, {0x9, 0x9, 0x52, '\x00', 0xf5}, {0x1, 0xa, 0x3, '\x00', 0x2}, {0x7, 0x89, 0x8, '\x00', 0x80}, {0x83, 0x3, 0x7, '\x00', 0x1e}, {0xc4, 0x3, 0x2, '\x00', 0x95}, {0xab, 0x4, 0x4, '\x00', 0x6}, {0x9, 0x7, 0x5, '\x00', 0x1}, {0xc, 0x6, 0xe}, {0xff, 0x3, 0x9, '\x00', 0xd}, {0x3, 0x13, 0xd, '\x00', 0x4}, {0x9, 0x9b, 0x6, '\x00', 0x6}, {0x2, 0x3, 0xff, '\x00', 0x9}, {0x8, 0x9, 0x5, '\x00', 0x6}, {0x37, 0x5, 0x8, '\x00', 0x92}, {0x3, 0x9, 0x9, '\x00', 0x1}, {0x3, 0x6, 0x9, '\x00', 0x3f}, {0x0, 0x8, 0x7, '\x00', 0xb}, {0xf8, 0x0, 0x7, '\x00', 0x6}, {0xff, 0x3, 0x6, '\x00', 0x29}, {0x40, 0x9, 0x2, '\x00', 0x94}, {0x8e, 0x21, 0x8, '\x00', 0x5}, {0x7, 0x4, 0x2, '\x00', 0xf}, {0x6, 0x6, 0x7, '\x00', 0x6}]}}) 2.059437423s ago: executing program 2 (id=17): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000040)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x4e23, 0x3, @ipv4={'\x00', '\xff\xff', @remote}, 0xffffffff}, 0x1c) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000002700), r1) sendmsg$ETHTOOL_MSG_STRSET_GET(r1, &(0x7f0000002c40)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x20, r2, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_STRSET_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x4}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x44804}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000000c0)='team_slave_0\x00', 0x10) sendto$inet6(r0, 0x0, 0x0, 0x800, 0x0, 0x0) 2.047406434s ago: executing program 2 (id=18): r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB="2c005f4d479ac157ac04acb269792b35e9663e84c002000000fa0200d0b7ef4a3c3d97e83b713c5b811a3e01bea86c86db43b350"]) socket$nl_generic(0x10, 0x3, 0x10) epoll_pwait(r1, &(0x7f00000003c0)=[{}, {}, {}, {}], 0x4, 0xb7, &(0x7f0000000400)={[0x6]}, 0x8) ioctl$USBDEVFS_SETCONFIGURATION(r1, 0x80045505, &(0x7f0000000580)=0x6) r2 = syz_io_uring_setup(0x42f0a, &(0x7f0000000080)={0x0, 0x8552, 0x100, 0x3, 0x230}, 0x0, 0x0, &(0x7f0000000000)) pwritev2(r2, &(0x7f00000006c0)=[{&(0x7f0000000280)="d4791a9103520fb5f28c9de93880d7b8a06ec3975b5f49cffa4881ef19f81f58382bff8e4ba414abbeb18a507b6378fb7d1d150609168267e9d0249396e3f4b20577555ad4eba926aea690869b4f198083c53fe09a53efe07fc3f1aaba83e233e6287087c871e7ebf1ae7b16eb7c20ebee355c44ecc910461a215d9330fdb1baf31b0df58e2fa1744f43dac59add090b46f080de7ea18104f82b192744a36256ffe6dbc025c7de60adec9b9c07a18586e0bffc9a7a2e6372ef6bee6c1a9c9748c253f3c5a878cf8e030f7dc3c58bb2", 0xcf}], 0x1, 0x4, 0x2, 0x2) syz_io_uring_setup(0x123b, &(0x7f0000000100)={0x0, 0x9b06, 0x240, 0x3, 0x5f}, &(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000000200)) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) r4 = userfaultfd(0x80801) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f6, 0x0) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x100}) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000080)={&(0x7f00007ee000/0x2000)=nil, 0x2000}) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000100)=0x2, 0x4) connect$inet(r3, &(0x7f0000000040)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x58}}, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), r5) recvmmsg(r5, &(0x7f0000000b80)=[{{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000540)=""/137, 0x89}, {&(0x7f0000000600)=""/180, 0xb4}, {&(0x7f0000000400)=""/168, 0xa8}, {&(0x7f0000001a40)=""/222, 0xde}, {&(0x7f0000003f00)=""/4010, 0xfaa}, {&(0x7f0000000180)=""/119, 0x77}, {&(0x7f0000000340)=""/147, 0x93}], 0x7}, 0x2}], 0x1, 0x40010080, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000200)=ANY=[@ANYBLOB="18000000", @ANYRES16=r6, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) sendto(r3, &(0x7f0000000140)='A', 0xfffff, 0x40008c1, 0x0, 0x0) ioctl$EXT4_IOC_CLEAR_ES_CACHE(r1, 0x6628) recvmmsg(r3, &(0x7f00000005c0)=[{{0x0, 0x0, 0x0}, 0x40000001}, {{&(0x7f0000000440)=@ax25={{0x3, @bcast}, [@remote, @default, @bcast, @bcast, @rose, @netrom, @bcast]}, 0x80, &(0x7f0000000540)=[{&(0x7f00000004c0)=""/78, 0x4e}], 0x1, &(0x7f0000000580)}, 0x4}], 0x2, 0x817ce1671d4ecdb5, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r7 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000180), 0x400, &(0x7f00000000c0)=ANY=[@ANYBLOB="656719d2", @ANYRESHEX=r8, @ANYBLOB=',\x00']) 1.161720113s ago: executing program 2 (id=19): r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="0d01000009000008250592d20700006a3b010902241700fa0074980904e4ff11070103000905010200ffe0000009058202"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000200)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB=' '], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x3f) syz_usb_disconnect(r0) setresuid(0xee00, 0xee00, 0x0) syz_usb_connect(0x3, 0x24, 0x0, 0x0) 848.836921ms ago: executing program 3 (id=20): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c020000190001000000000000000000e0000001000000000004000000000000ac1414bb00000000000000000000000000000009000201ff0a00008000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff0000000000000000000000000000000000000000000001004000000000000000000000000000000084010500ffffffff000000000000000000000000000000003c00000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000ac1e0001000000000000000000000000000000003c00000000000000fe800000ff03000000000000000000000000000000000000000000000700000000000000fe8000000000000000000000000000bb000000006c00000000000000ac1414bb0000000000000000000000000000000001000000000000000000000000000000fe8000000000000000000000000000aa000000003300000000000000fc02000000000000000000000000000100000000000200000000000000000000000000000a0101020000000000000000000000000000000033000000"], 0x23c}}, 0x0) 834.496911ms ago: executing program 3 (id=21): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000600)=@newsa={0x148, 0x10, 0x1, 0xbffffffe, 0x100, {{@in=@loopback, @in6=@mcast2, 0x1, 0x394, 0x4e21, 0x5, 0x0, 0x0, 0x80, 0x3a}, {@in6=@remote, 0x4d4, 0x6c}, @in=@multicast1, {0x800000000, 0x9, 0x6, 0xffff, 0x3, 0x2, 0xfffffffffffffff8}, {0x6, 0x0, 0x1f, 0x1ff}, {0x2, 0xca, 0x4000000}, 0x70bd2a, 0x3504, 0xa, 0x4, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @XFRMA_SET_MARK={0x8, 0x1d, 0x5}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x401}]}, 0x148}, 0x1, 0x0, 0x0, 0x8801}, 0x10) syz_usb_connect$uac1(0x3, 0x84, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x763, 0x2030, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x72, 0x3, 0x1, 0x5, 0x0, 0x8, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x7, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0xb, 0x24, 0x2, 0x1, 0xe, 0x2, 0xc7, 0x1, "019b5b"}, @as_header={0x7, 0x24, 0x1, 0x22, 0x47, 0x4}]}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x9, 0x3, 0x7, {0x7, 0x25, 0x1, 0x4, 0x5, 0x1}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x40, 0x7, 0x7, 0x6, {0x7, 0x25, 0x1, 0x4, 0x1, 0x6}}}}}}}}]}}, 0x0) 549.700768ms ago: executing program 0 (id=22): mount$binderfs(0x0, &(0x7f00000000c0)='./binderfs\x00', &(0x7f0000000140), 0x0, &(0x7f0000000280)={[{@max={'max', 0x3d, 0x7fffffff}}]}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2c0000001400010000000000000000000a0000000400000014"], 0x2c}}, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0xc0686611, &(0x7f0000000180)={0x67, 0x0, 0x18, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r1 = socket(0x10, 0x3, 0x0) sendto$inet6(r1, &(0x7f0000000100)="c10e000018001f06b9409b0dffff110d0207be040205060506100a044300040018000000fac8388827a685a168d9a44604094565360c648dcaaf6c26c291214549932fde4a460c89b6ec0cff3959547f509058ba86c902fc3a10004a320c0400160009000a00000000000000000000080756ede4ccbe5880", 0xec1, 0x0, 0x0, 0x9e5e111c47e3504f) syz_usb_connect$uac3(0x6, 0x97, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0x644, 0x800e, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x85, 0x3, 0x1, 0xff, 0xc0, 0xc, {0x8, 0xb, 0x0, 0x2, 0x1, 0x1, 0x30, 0x7}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x3ff}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@as_header={0x17, 0x24, 0x1, 0x3, 0x4, 0x7fff, 0x4, 0x7, 0x1, 0xfc00, 0x9}]}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x40, 0xd0, 0x4, {0xa, 0x25, 0x25, 0x7fff, 0x1, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0xfa, 0x1a, 0x2, {0xa, 0x25, 0x25, 0x4, 0x5, 0x5d}}}}}}}}]}}, 0x0) 438.434001ms ago: executing program 1 (id=23): r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="0d01000009000008250592d20700006a3b010902241700fa0074980904e4ff11070103000905010200ffe0000009058202"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000200)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB=' '], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) (fail_nth: 6) syz_usb_disconnect(r0) setresuid(0xee00, 0xee00, 0x0) syz_usb_connect(0x3, 0x24, 0x0, 0x0) 0s ago: executing program 0 (id=24): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e20, @broadcast}, 0x10) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r1 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x40000000, 0x5c}, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)) (async) r2 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x40000000, 0x5c}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r6 = syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x12, 0x0, r1, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x400000000000000, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0xaa6, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x2}}}, &(0x7f0000000300)=0x0) fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) (async) r8 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r8, 0x6, 0x0, 0x0, 0x0) r9 = fsmount(r8, 0x1, 0x0) fchdir(r9) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) move_mount(r9, &(0x7f00000004c0)='.\x00', r9, &(0x7f0000000480)='./file0\x00', 0x121) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xfffffdff}) r10 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r6, 0x2) syz_ublk_setup_queues(r10, r7, &(0x7f0000000700), &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x0, 0x4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfb26, 0x0, 0x0, 0x3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x3}}], 0x1, &(0x7f00000003c0)={0x2e, 0x0, 0x0, r10, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, 0x0) (async) syz_ublk_setup_queues(r10, r7, &(0x7f0000000700), &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x0, 0x4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfb26, 0x0, 0x0, 0x3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x3}}], 0x1, &(0x7f00000003c0)={0x2e, 0x0, 0x0, r10, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, 0x0) sendto$inet(r0, &(0x7f0000000000)="ca", 0x1, 0x20000005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) recvfrom$inet(r0, &(0x7f0000000140)=""/161, 0xa1, 0x1a1, 0x0, 0x0) (async) recvfrom$inet(r0, &(0x7f0000000140)=""/161, 0xa1, 0x1a1, 0x0, 0x0) getpid() (async) r11 = getpid() syz_pidfd_open(r11, 0x0) setpriority(0x2, r11, 0x1129) (async) setpriority(0x2, r11, 0x1129) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.216' (ED25519) to the list of known hosts. [ 28.479863][ T286] cgroup: Unknown subsys name 'net' [ 28.485672][ T36] audit: type=1400 audit(1784171526.020:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 28.488291][ T286] cgroup: Unknown subsys name 'devices' [ 28.509276][ T36] audit: type=1400 audit(1784171526.020:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 28.537564][ T36] audit: type=1400 audit(1784171526.020:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 28.640244][ T286] cgroup: Unknown subsys name 'hugetlb' [ 28.646256][ T286] cgroup: Unknown subsys name 'rlimit' [ 28.759566][ T36] audit: type=1400 audit(1784171526.300:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 28.783734][ T36] audit: type=1400 audit(1784171526.300:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 28.785842][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 28.809851][ T36] audit: type=1400 audit(1784171526.300:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 28.842688][ T36] audit: type=1400 audit(1784171526.360:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.868295][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 28.868626][ T36] audit: type=1400 audit(1784171526.360:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.903545][ T36] audit: type=1400 audit(1784171526.410:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.929664][ T36] audit: type=1400 audit(1784171526.410:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.770250][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.779752][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.787465][ T296] bridge_slave_0: entered allmulticast mode [ 29.795479][ T296] bridge_slave_0: entered promiscuous mode [ 29.802831][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.810994][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.818728][ T294] bridge_slave_0: entered allmulticast mode [ 29.825824][ T294] bridge_slave_0: entered promiscuous mode [ 29.832622][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.839814][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.847135][ T294] bridge_slave_1: entered allmulticast mode [ 29.853752][ T294] bridge_slave_1: entered promiscuous mode [ 29.869153][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.876213][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.883508][ T296] bridge_slave_1: entered allmulticast mode [ 29.889978][ T296] bridge_slave_1: entered promiscuous mode [ 29.937173][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.944364][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.952325][ T293] bridge_slave_0: entered allmulticast mode [ 29.958733][ T293] bridge_slave_0: entered promiscuous mode [ 29.968621][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.976513][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.983788][ T293] bridge_slave_1: entered allmulticast mode [ 29.990287][ T293] bridge_slave_1: entered promiscuous mode [ 30.013405][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.021013][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.029226][ T295] bridge_slave_0: entered allmulticast mode [ 30.035754][ T295] bridge_slave_0: entered promiscuous mode [ 30.047095][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.054376][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.062132][ T295] bridge_slave_1: entered allmulticast mode [ 30.069207][ T295] bridge_slave_1: entered promiscuous mode [ 30.215878][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.223301][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.230975][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.238130][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.255300][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.263203][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.270681][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.278363][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.290684][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.297841][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.306765][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.314017][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.329008][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.336430][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.344142][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.351764][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.402830][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.410726][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.419647][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.427234][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.436150][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.444848][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.452903][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.460215][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.476427][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.483529][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.491421][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.498616][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.520213][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.527557][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.535953][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.543378][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.552168][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.559610][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.574277][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.581558][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.610770][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.617939][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.625584][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.633283][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.666201][ T294] veth0_vlan: entered promiscuous mode [ 30.681616][ T295] veth0_vlan: entered promiscuous mode [ 30.697095][ T294] veth1_macvtap: entered promiscuous mode [ 30.719179][ T295] veth1_macvtap: entered promiscuous mode [ 30.728059][ T296] veth0_vlan: entered promiscuous mode [ 30.743217][ T293] veth0_vlan: entered promiscuous mode [ 30.770268][ T296] veth1_macvtap: entered promiscuous mode [ 30.799710][ T293] veth1_macvtap: entered promiscuous mode [ 30.807790][ T295] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 30.911189][ T319] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 30.951134][ T327] overlay: Unknown parameter './file0' [ 31.020918][ T339] kvm: emulating exchange as write [ 31.268604][ T10] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 31.311056][ T362] fuse: Bad value for 'fd' [ 31.398921][ T10] usb 1-1: device descriptor read/64, error -71 [ 31.538101][ T310] usb 2-1: new low-speed USB device number 2 using dummy_hcd [ 31.548128][ T9] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 31.640266][ T10] usb 1-1: device descriptor read/64, error -71 [ 31.668130][ T310] usb 2-1: device descriptor read/64, error -71 [ 31.708132][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 31.714645][ T9] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 31.726439][ T9] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 31.737416][ T9] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 31.746644][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 31.754917][ T9] usb 3-1: Product: syz [ 31.759940][ T9] usb 3-1: Manufacturer: syz [ 31.765091][ T9] usb 3-1: SerialNumber: syz [ 31.803774][ T13] Bluetooth: hci0: Frame reassembly failed (-84) [ 31.849440][ T366] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=366 comm=syz.3.15 [ 31.888170][ T10] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 31.892053][ T366] SELinux: failed to load policy [ 31.908139][ T310] usb 2-1: device descriptor read/64, error -71 [ 31.973682][ T9] usb 3-1: 0:2 : does not exist [ 31.981466][ T9] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 31.992512][ T9] usb 3-1: USB disconnect, device number 2 [ 32.005457][ T316] udevd[316]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 32.018121][ T10] usb 1-1: device descriptor read/64, error -71 [ 32.148123][ T310] usb 2-1: new low-speed USB device number 3 using dummy_hcd [ 32.268082][ T10] usb 1-1: device descriptor read/64, error -71 [ 32.298151][ T310] usb 2-1: device descriptor read/64, error -71 [ 32.378302][ T10] usb usb1-port1: attempt power cycle [ 32.548369][ T310] usb 2-1: device descriptor read/64, error -71 [ 32.658256][ T310] usb usb2-port1: attempt power cycle [ 32.703555][ T31] kernel read not supported for file /rfkill (pid: 31 comm: kworker/1:0) [ 32.718385][ T10] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 32.740373][ T10] usb 1-1: device descriptor read/8, error -71 [ 32.765896][ T380] Zero length message leads to an empty skb [ 32.869629][ T10] usb 1-1: device descriptor read/8, error -71 [ 33.008319][ T310] usb 2-1: new low-speed USB device number 4 using dummy_hcd [ 33.029648][ T310] usb 2-1: device descriptor read/8, error -71 [ 33.108158][ T10] usb 1-1: new full-speed USB device number 5 using dummy_hcd [ 33.129361][ T10] usb 1-1: device descriptor read/8, error -71 [ 33.159565][ T310] usb 2-1: device descriptor read/8, error -71 [ 33.259528][ T10] usb 1-1: device descriptor read/8, error -71 [ 33.368280][ T10] usb usb1-port1: unable to enumerate USB device [ 33.398300][ T310] usb 2-1: new low-speed USB device number 5 using dummy_hcd [ 33.419268][ T310] usb 2-1: device descriptor read/8, error -71 [ 33.549562][ T310] usb 2-1: device descriptor read/8, error -71 [ 33.668209][ T310] usb usb2-port1: unable to enumerate USB device [ 33.778184][ T311] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 33.878274][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 33.878548][ T368] Bluetooth: hci0: command 0x1003 tx timeout [ 33.900185][ T36] kauditd_printk_skb: 73 callbacks suppressed [ 33.900203][ T36] audit: type=1400 audit(1784171531.440:147): avc: denied { create } for pid=384 comm="syz.3.20" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 33.927723][ T36] audit: type=1400 audit(1784171531.440:148): avc: denied { write } for pid=384 comm="syz.3.20" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 33.948750][ T36] audit: type=1400 audit(1784171531.440:149): avc: denied { nlmsg_write } for pid=384 comm="syz.3.20" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 33.969527][ T311] usb 3-1: Using ep0 maxpacket: 8 [ 33.976052][ T311] usb 3-1: config index 0 descriptor too short (expected 5924, got 36) [ 33.985022][ T311] usb 3-1: config 250 has an invalid interface number: 228 but max is -1 [ 33.993730][ T311] usb 3-1: config 250 has 1 interface, different from the descriptor's value: 0 [ 34.004416][ T311] usb 3-1: config 250 has no interface number 0 [ 34.011223][ T311] usb 3-1: config 250 interface 228 altsetting 255 endpoint 0x1 has invalid maxpacket 65280, setting to 1024 [ 34.024263][ T311] usb 3-1: config 250 interface 228 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 1024 [ 34.035815][ T311] usb 3-1: config 250 interface 228 altsetting 255 endpoint 0x82 has invalid wMaxPacketSize 0 [ 34.048560][ T311] usb 3-1: config 250 interface 228 altsetting 255 bulk endpoint 0x82 has invalid maxpacket 0 [ 34.059750][ T311] usb 3-1: config 250 interface 228 altsetting 255 has 2 endpoint descriptors, different from the interface descriptor's value: 17 [ 34.073614][ T311] usb 3-1: config 250 interface 228 has no altsetting 0 [ 34.082575][ T311] usb 3-1: New USB device found, idVendor=0525, idProduct=d292, bcdDevice= 0.07 [ 34.091681][ T311] usb 3-1: New USB device strings: Mfr=0, Product=106, SerialNumber=59 [ 34.100088][ T311] usb 3-1: Product: syz [ 34.104456][ T311] usb 3-1: SerialNumber: syz [ 34.110974][ T311] hub 3-1:250.228: bad descriptor, ignoring hub [ 34.117599][ T311] hub 3-1:250.228: probe with driver hub failed with error -5 [ 34.159905][ T389] binder: Bad value for 'max' [ 34.168095][ T10] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 34.208721][ T389] netlink: 'syz.0.22': attribute type 4 has an invalid length. [ 34.216721][ T389] netlink: 3657 bytes leftover after parsing attributes in process `syz.0.22'. [ 34.316640][ T311] usblp 3-1:250.228: usblp0: USB Bidirectional printer dev 3 if 228 alt 255 proto 3 vid 0x0525 pid 0xD292 [ 34.338213][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 34.346450][ T10] usb 4-1: New USB device found, idVendor=0763, idProduct=2030, bcdDevice= 0.40 [ 34.355645][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.363821][ T10] usb 4-1: Product: syz [ 34.368236][ T10] usb 4-1: Manufacturer: syz [ 34.373083][ T10] usb 4-1: SerialNumber: syz [ 34.585729][ T10] usb 4-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 34.599923][ T10] usb 4-1: USB disconnect, device number 2 [ 34.613650][ T321] udevd[321]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 34.628147][ T9] usb 3-1: USB disconnect, device number 3 [ 34.636783][ T9] usblp0: removed [ 34.708106][ T45] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 34.751260][ T36] audit: type=1400 audit(1784171532.290:150): avc: denied { name_bind } for pid=392 comm="syz.0.24" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 34.773429][ T36] audit: type=1400 audit(1784171532.290:151): avc: denied { node_bind } for pid=392 comm="syz.0.24" saddr=255.255.255.255 src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 34.797900][ T36] audit: type=1400 audit(1784171532.340:152): avc: denied { cmd } for pid=392 comm="iou-wrk-393" path="/dev/ublk-control" dev="devtmpfs" ino=82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=io_uring permissive=1 [ 34.823573][ T36] audit: type=1400 audit(1784171532.360:153): avc: denied { mount } for pid=392 comm="syz.0.24" name="/" dev="ramfs" ino=4491 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 34.845835][ T36] audit: type=1400 audit(1784171532.360:154): avc: denied { mounton } for pid=392 comm="syz.0.24" path="/file0" dev="ramfs" ino=4492 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=dir permissive=1 [ 34.867882][ T36] audit: type=1400 audit(1784171532.360:155): avc: denied { map } for pid=392 comm="syz.0.24" path="/dev/ublkc0" dev="devtmpfs" ino=448 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 34.889205][ T46] ------------[ cut here ]------------ [ 34.890888][ T45] usb 2-1: Using ep0 maxpacket: 8 [ 34.896321][ T46] WARNING: CPU: 0 PID: 46 at drivers/block/ublk_drv.c:1579 ublk_uring_cmd_cancel_fn+0x351/0x410 [ 34.914213][ T46] Modules linked in: [ 34.918515][ T46] CPU: 0 UID: 0 PID: 46 Comm: kworker/u8:2 Not tainted syzkaller #0 ea5b7897df5a307b165a8956328ee25f321bdeb9 [ 34.930702][ T46] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 34.939838][ T45] usb 2-1: config index 0 descriptor too short (expected 5924, got 36) [ 34.941104][ T46] Workqueue: iou_exit io_ring_exit_work [ 34.955723][ T46] RIP: 0010:ublk_uring_cmd_cancel_fn+0x351/0x410 [ 34.958093][ T45] usb 2-1: config 250 has an invalid interface number: 228 but max is -1 [ 34.962697][ T46] Code: 5d e9 53 16 52 02 cc e8 5d a9 33 fe 0f 0b eb e3 e8 54 a9 33 fe 0f 0b eb da e8 4b a9 33 fe 0f 0b e9 4d fe ff ff e8 3f a9 33 fe <0f> 0b eb c5 44 89 e1 80 e1 07 fe c1 38 c1 0f 8c 0a fd ff ff 4c 89 [ 34.982081][ T45] usb 2-1: config 250 has 1 interface, different from the descriptor's value: 0 [ 34.992205][ T46] RSP: 0018:ffffc900002ff990 EFLAGS: 00010293 [ 34.992238][ T46] RAX: ffffffff8353c8b1 RBX: 1ffff11022ae102d RCX: ffff88810ae5cc00 [ 35.018517][ T46] RDX: 0000000000000000 RSI: 00000000000000ea RDI: 0000000000000aa6 [ 35.022738][ T45] usb 2-1: config 250 has no interface number 0 [ 35.027175][ T46] RBP: ffffc900002ff9e0 R08: 0000000000000003 R09: 0000000000000004 [ 35.042207][ T46] R10: 0000000000000000 R11: ffffffff8353b890 R12: ffff888115743900 [ 35.045891][ T45] usb 2-1: config 250 interface 228 altsetting 255 endpoint 0x1 has invalid maxpacket 65280, setting to 1024 [ 35.050649][ T46] R13: ffff888115708140 R14: ffff888114420000 R15: ffff888114420010 [ 35.071138][ T46] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 35.079766][ T45] usb 2-1: config 250 interface 228 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 1024 [ 35.081333][ T46] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 35.098792][ T46] CR2: 0000000000000000 CR3: 000000010c7c2000 CR4: 00000000003526b0 [ 35.105085][ T45] usb 2-1: config 250 interface 228 altsetting 255 endpoint 0x82 has invalid wMaxPacketSize 0 [ 35.108324][ T46] Call Trace: [ 35.108343][ T46] [ 35.108354][ T46] ublk_ch_uring_cmd+0x6f/0xa0 [ 35.131716][ T46] io_uring_try_cancel_uring_cmd+0x196/0x280 [ 35.138379][ T46] io_uring_try_cancel_requests+0x4d6/0x5b5 [ 35.145373][ T46] ? io_uring_cancel_generic+0x6eb/0x6eb [ 35.148411][ T45] usb 2-1: config 250 interface 228 altsetting 255 bulk endpoint 0x82 has invalid maxpacket 0 [ 35.151546][ T46] io_ring_exit_work+0x23d/0x83b [ 35.167439][ T46] ? finish_task_switch+0x139/0x770 [ 35.173268][ T46] ? __cfi_io_ring_exit_work+0x10/0x10 [ 35.177511][ T45] usb 2-1: config 250 interface 228 altsetting 255 has 2 endpoint descriptors, different from the interface descriptor's value: 17 [ 35.179593][ T46] ? kick_pool+0xb9/0x540 [ 35.198154][ T46] process_scheduled_works+0x7f7/0x1060 [ 35.204456][ T46] worker_thread+0xc99/0x13f0 [ 35.209865][ T46] ? __cfi_set_cpus_allowed_ptr+0x10/0x10 [ 35.211164][ T45] usb 2-1: config 250 interface 228 has no altsetting 0 [ 35.215843][ T46] ? __kasan_check_read+0x15/0x20 [ 35.215870][ T46] kthread+0x2c7/0x360 [ 35.232657][ T46] ? __cfi_worker_thread+0x10/0x10 [ 35.238368][ T46] ? __cfi_kthread+0x10/0x10 [ 35.243113][ T46] ret_from_fork+0x67/0xa0 [ 35.249011][ T46] ? __cfi_kthread+0x10/0x10 [ 35.250525][ T45] usb 2-1: New USB device found, idVendor=0525, idProduct=d292, bcdDevice= 0.07 [ 35.254025][ T46] ret_from_fork_asm+0x1a/0x30 [ 35.254056][ T46] [ 35.264851][ T45] usb 2-1: New USB device strings: Mfr=0, Product=106, SerialNumber=59 [ 35.268092][ T46] ---[ end trace 0000000000000000 ]--- [ 35.271351][ T45] usb 2-1: Product: syz [ 35.309203][ T45] usb 2-1: SerialNumber: syz [ 35.330001][ T45] hub 2-1:250.228: bad descriptor, ignoring hub [ 35.343579][ T45] hub 2-1:250.228: probe with driver hub failed with error -5 [ 35.527197][ T45] usblp 2-1:250.228: usblp0: USB Bidirectional printer dev 6 if 228 alt 255 proto 3 vid 0x0525 pid 0xD292 [ 35.727541][ T36] audit: type=1400 audit(1784171533.260:156): avc: denied { read write } for pid=390 comm="syz.1.23" name="lp0" dev="devtmpfs" ino=453 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 38.839772][ T45] usb 2-1: USB disconnect, device number 6 [ 38.849097][ T45] usblp0: removed