last executing test programs: 2.196873993s ago: executing program 2 (id=3): r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$selinux_attr(r0, &(0x7f0000000640)='system_u:object_r:hugetlbfs_t:s0\x00', 0x1d) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000240), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000280)={'wg0\x00', 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000002a00)=0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r5, &(0x7f0000002980)={0x10, 0x0, 0x0, 0xfffffffffffffffd}, 0xc) r6 = socket$inet6(0xa, 0x3, 0x87) setsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f0000002c40)={{{@in6=@mcast2, @in=@empty, 0x0, 0x56, 0x2, 0x0, 0x2}, {0x0, 0x9, 0x1, 0x1, 0xfffffffffffffff6, 0x1fffffc, 0xfffffffffffffffc, 0x8}, {0x4, 0x4000, 0x5}, 0xf4, 0x0, 0x1, 0x0, 0x2, 0x3}, {{@in=@local, 0x4d2, 0x33}, 0x2, @in=@loopback, 0x3500, 0x4, 0x0, 0x0, 0xffffffff, 0x8, 0x1}}, 0xe8) connect$inet6(r6, &(0x7f0000002d40)={0xa, 0x4000, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}}, 0x1c) r7 = syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x1, r7, 0x0, 0x1000009, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched_retired(r8, &(0x7f0000003040)={&(0x7f0000002d80), 0xc, &(0x7f0000003000)={&(0x7f0000002dc0)=@deltclass={0x230, 0x29, 0x200, 0x70bd28, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {0x9, 0xe}, {0x2, 0x10}, {0xfff3, 0x2}}, [@c_atm={{0x8}, {0x4c, 0x2, [@TCA_ATM_FD={0x8, 0x1, r1}, @TCA_ATM_HDR={0x6, 0x3, "7082"}, @TCA_ATM_HDR={0x30, 0x3, "e1ebb76e28683c9a8f3cf54789d55cf2712156b896e0da51c3cfbe45506c5017931d91a10cdb96d031753d36"}, @TCA_ATM_FD={0x8, 0x1, r1}]}}, @c_atm={{0x8}, {0xc, 0x2, [@TCA_ATM_FD={0x8, 0x1, r6}]}}, @c_atm={{0x8}, {0xe0, 0x2, [@TCA_ATM_EXCESS={0x8, 0x4, {0xffe0, 0x6}}, @TCA_ATM_HDR={0x3f, 0x3, "87e5911ca9cbc407870b60fbdefbe23aa62a9c7ea6e3e2936050ed7b54c9f28ef62465b7fb8f4b3c5e312f5fc8d08c59312a6f73576b4df7a897be"}, @TCA_ATM_HDR={0x2c, 0x3, "48a2106cec5460dfd77b0f442e570c1a2a2baa5375e9f5d44a3e0b034e3d8f75850d40c0c6fde93b"}, @TCA_ATM_HDR={0x44, 0x3, "77f9101d8b1dd55788438777d1f73d99e4cf302bc20830b72b3d17c24d6748f8cb1da363b90efc2c21c4dc06ff9c0d8c1067e3001e8b7e1f6777065d8bb7d7d5"}, @TCA_ATM_HDR={0x23, 0x3, "2a9620869eb823784b811776adf233da5c2e6841cfae3a76df04e60f25ba65"}]}}, @c_cbq={{0x8}, {0x84, 0x2, [@TCA_CBQ_WRROPT={0x10, 0x2, {0x8, 0x6, 0x7, 0xf6, 0x3, 0x1}}, @TCA_CBQ_FOPT={0x10, 0x3, {{0xfff9, 0xfff3}, 0x4, 0x7}}, @TCA_CBQ_LSSOPT={0x18, 0x1, {0x36, 0x2, 0xa, 0x9, 0x4, 0x400, 0x663f, 0xff}}, @TCA_CBQ_WRROPT={0x10, 0x2, {0x8, 0x6, 0xd, 0xbb, 0x80000001, 0x9}}, @TCA_CBQ_FOPT={0x10, 0x3, {{0xfff1, 0x8}, 0x7, 0x3ff}}, @TCA_CBQ_LSSOPT={0x18, 0x1, {0x15, 0x3, 0x15, 0xf5, 0x4, 0x3, 0x3, 0x7}}, @TCA_CBQ_FOPT={0x10, 0x3, {{0x0, 0x8}, 0x2, 0x7}}]}}, @c_dsmark={{0xb}, {0xc, 0x2, @TCA_DSMARK_MASK={0x5, 0x4, 0x1}}}, @c_dsmark={{0xb}, {0xc, 0x2, @TCA_DSMARK_VALUE={0x5, 0x5, 0x9c}}}]}, 0x230}, 0x1, 0x0, 0x0, 0xc0}, 0x8000) sched_setscheduler(0x0, 0x5, &(0x7f00000029c0)) ioprio_set$pid(0x2, 0x0, 0x0) ioprio_get$pid(0x2, 0x0) link(&(0x7f0000002b40)='./cgroup\x00', &(0x7f0000002b80)='./cgroup/file0\x00') r9 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000002a80)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) syz_clone3(&(0x7f0000002ac0)={0xc004000, &(0x7f00000005c0), &(0x7f0000002840), &(0x7f0000002880), {0x2d}, &(0x7f00000028c0)=""/175, 0xaf, &(0x7f0000002bc0)=""/116, &(0x7f0000002a40)=[r4, r7], 0x2, {r9}}, 0x58) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYBLOB="2c020000", @ANYRES16=r2, @ANYBLOB="010000000000000000000100000024000300a05ca84f6c9c8e3853e2fd7a70ae0fb20fa152600cb00845174f08076f8d7843e40108804400208024000100000000000100000000000000fdffff01000000000000000000000000000000001400040003000000ac1414bb00000000000000000600050000000000000100802400020073e591ec06154031d3954ac0e16752e72640f08b5281a8461d17d26d12f2bbb6060005000021000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b39228c00098028000080060001000a0000001400020020010000000000000000000000000001050003000000000088000080060001000a0000001400020020010000000000000000000000000002050003000000001003800080060001008c0e000008000200ac1414aa05000300000000001c000080060001000200000008000200ac1414bb0500030000000000200004000e00000000000000fe800000000000000000000000000000000000009c0000802400020073961633df6dc9cb418b15afd0bae7b90f1e6cfed8bb423cf9285c474163154908000a00010000002400010000000000000000000000000000000000000000000000000000000000000000004800098028000080060001000a00000014000200fe8000000000000000000000010000bb05000300000000001c000080060001000200000008000200000000000500030000000000080005000100000008000100", @ANYRES32=r3], 0x22c}}, 0x0) setsockopt$sock_void(r1, 0x1, 0x24, 0x0, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000200)=0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000680)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) r12 = gettid() rt_sigqueueinfo(r12, 0x21, &(0x7f00000026c0)={0x1f}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000580), r1) r13 = openat$cgroup(0xffffffffffffffff, &(0x7f0000002780)='syz1\x00', 0x200002, 0x0) syz_clone3(&(0x7f00000027c0)={0x10400, &(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080), {0x1e}, &(0x7f00000000c0)=""/78, 0x4e, &(0x7f0000000140)=""/161, &(0x7f0000002740)=[r10, r11, r12, 0xffffffffffffffff], 0x4, {r13}}, 0x58) 2.196266023s ago: executing program 1 (id=2): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) io_submit(0x0, 0x1, &(0x7f0000000180)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0}]) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_connect(0x5, 0xfc, &(0x7f0000000600)={{0x12, 0x1, 0x250, 0x7c, 0x7a, 0xdf, 0x8, 0x106c, 0xece, 0xf737, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xea, 0x1, 0x75, 0x5, 0xa0, 0x3, "", [{{0x9, 0x4, 0x27, 0x5, 0x6, 0xff, 0xf0, 0xff, 0x0, [], [{{0x9, 0x5, 0xd, 0x10, 0x3ff, 0x5, 0x30}}, {{0x9, 0x5, 0xd, 0x0, 0x20, 0x7, 0xf9, 0x1}}, {{0x9, 0x5, 0x0, 0x10, 0x428, 0xa8, 0x9, 0x4, [@generic={0x1a, 0x8, "75cba389ff4d58a8856b59e8c23c08b573f2ddc22c81126a"}]}}, {{0x9, 0x5, 0x3, 0xc, 0x400, 0x34, 0x4, 0x4, [@generic={0x9, 0x3, "e2490c0bcf1525"}]}}, {{0x9, 0x5, 0xb, 0x10, 0x10, 0x6, 0x2, 0xe3, [@generic={0x74, 0xe, "c78a0c75e824938f73b82140534134f540d271605656d08d2464471742b488ebe817d118dbf97978198e59415828f26bb3a6807c9d612eb7c8286d4ef1ec75b1ca87c63c448e388f5f8d84efd685098520d32c16232e1b97ed2250be3225f73e6e212fea89982fdb5ec659290a682ed9ffee"}, @generic={0xb, 0x9, "9855c23adef5ca54ea"}]}}, {{0x9, 0x5, 0xf, 0x9ab3ac2d4fa6e2ed, 0x50, 0x8, 0xdb, 0x1}}]}}]}}]}}, &(0x7f0000001000)={0xa, &(0x7f0000000f80)={0xa, 0x6, 0x110, 0x7, 0x8, 0xc3, 0xff, 0x15}, 0x12, &(0x7f0000000fc0)={0x5, 0xf, 0x12, 0x2, [@ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x5, 0x9, 0xffff}]}}) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000") 2.180109354s ago: executing program 3 (id=4): r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_GET_REG_LIST(r0, 0xc008aeb0, &(0x7f0000000180)={0x5, [0x6, 0x74, 0x7, 0x8000000000000000, 0x200]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.kill\x00', 0x275a, 0x0) fcntl$lock(r1, 0x24, &(0x7f0000000140)={0x300, 0x0, 0x4000000081, 0xfffffffffffffff9}) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x2, 0x13) 2.176600865s ago: executing program 0 (id=1): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000180)="290000002000190f00003fffffffda060200000001e80001dd0000040d000600ea11004a35f4667d41", 0x29}], 0x1) r1 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f00000003c0)=0x40000, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f0000000340)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x18410, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x0, 0x0) accept$unix(r2, 0x0, &(0x7f00000001c0)) readahead(r2, 0x6, 0x10) write$evdev(r2, &(0x7f00000000c0), 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x59fc02, 0x0) mkdir(&(0x7f0000000200)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./mysys\x00', &(0x7f0000000280)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./mysys/bus/pci/devices/0000:00:01.0/enable\x00', 0x1, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) write(r4, &(0x7f0000000300)='1', 0x1) write$selinux_create(r4, &(0x7f0000000380)=@objname={'/sbin/dhclient', 0x20, '/usr/sbin/ntpd', 0x20, 0x5, 0x20, './dev\x00'}, 0x39) ioctl$FS_IOC_RESVSP(r3, 0x40305828, &(0x7f0000000040)={0x0, 0x1, 0x6, 0xfffffffffffffffe}) write(r3, &(0x7f0000001640)="8b", 0xffe4) 2.1197704s ago: executing program 0 (id=5): syz_usb_connect$cdc_ecm(0x0, 0x4d, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x0, 0x0, 0xffffffffffff8001, 0x1, [{{0x9, 0x2, 0x3b, 0x1, 0x1, 0x0, 0xc0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x12, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0xffffffff}}, {[], {{0x9, 0x5, 0x82, 0x2, 0x200, 0x1}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}]}}]}}, 0x0) 2.11858042s ago: executing program 3 (id=6): r0 = openat$binderfs_log(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder_logs/failed_transaction_log\x00', 0x0, 0x0) (async) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) (async, rerun: 64) r2 = socket$netlink(0x10, 0x3, 0x0) (rerun: 64) sendmsg$nl_netfilter(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x28, 0x11, 0x0, 0x401, 0x0, 0x0, {0xa}, [@typed={0x8, 0x2, 0x0, 0x0, @uid=0xffffffffffffffff}, @nested={0xc, 0x0, 0x0, 0x1, [@typed={0x8, 0x31, 0x0, 0x0, @binary="748cf8e8"}]}]}, 0x28}}, 0x0) (async, rerun: 32) bind$bt_l2cap(r1, &(0x7f0000000180)={0x1f, 0x80, @any, 0x0, 0x1}, 0x10) (async, rerun: 32) r3 = openat$dm_control(0xffffffffffffff9c, &(0x7f00000010c0), 0x4a800, 0x0) ioctl$DM_DEV_CREATE(r3, 0xc138fd03, &(0x7f0000001100)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x88001, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) ioctl$DM_TABLE_LOAD(r3, 0xc138fd09, &(0x7f00000003c0)={0x4, 0x0, 0x0, 0x198, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_dev={r4}, [@snapshot={0x0, 0x1008, 0x0, 0x60, 'snapshot\x00', {@rnull={'/dev/syzrnull', 0x0}, 0x20, @ram={'/dev/ram', 0x0}, 0x20, 'n', 0x20, '0', ' 1 discard_zeroes_cow'}}]}) (async) socket$nl_xfrm(0x10, 0x3, 0x6) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r5) (async) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x81c0, 0x0) (async, rerun: 32) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x2, 0x0) (async, rerun: 32) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) (async, rerun: 32) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 32) sendmsg$inet(r7, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=ANY=[], 0x128}, 0x0) (async, rerun: 64) recvmsg$unix(r6, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x10}}], 0x70}, 0x80) (rerun: 64) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) socketpair$unix(0x1, 0x0, 0x0, 0x0) (rerun: 64) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000680)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f00000006c0)=0x0) (async, rerun: 64) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) (rerun: 64) r10 = dup(r9) syz_ublk_setup_queues(r10, r8, &(0x7f0000000700)={0x0, 0x9436, 0x0, 0x1, 0x1f4}, &(0x7f0000000780)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x40040001, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) (async) openat(r0, &(0x7f0000000140)='./file0\x00', 0xc0, 0x1d0) 2.077664545s ago: executing program 2 (id=7): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x181403, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x11) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe0000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000000)="660ffbfb3e36f30f1af3ea0090250036360f03fc0f780d26c0ce04670f01c50f234366b8c50000000f23c00f21f8663502000c000f23f8660f72d600", 0x3c}], 0x1, 0x21, &(0x7f0000000140)=[@cr0={0x0, 0x80000024}], 0x1) sigaltstack(&(0x7f0000000200)={0x0, 0x1, 0xfffffffffffffe63}, 0x0) sigaltstack(&(0x7f0000000500)={0x0, 0x2}, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x47) setsockopt$inet_tcp_int(r3, 0x6, 0x210000000013, &(0x7f00000001c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000240)=0x2, 0x4) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) syslog(0x2, &(0x7f0000000680)=""/146, 0x92) getsockopt$inet6_tcp_int(r4, 0x6, 0x6, 0x0, &(0x7f00000000c0)) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x41, &(0x7f0000000280)=0xd52, 0x4) r5 = inotify_init() syz_ublk_setup_io_uring(0x2e15, &(0x7f0000000540)={0x0, 0x40000, 0x1, 0x2, 0x158}, 0x0, 0x0, 0x0) read(r5, 0x0, 0x0) close_range(r5, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0xc) connect$inet(r3, &(0x7f00000002c0)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r3, &(0x7f0000000300)="9fd8da8e45bcce079f16b15e72c2bb973672753c8b8d7f0ef25c250e8b631670f8a559c56c", 0x25, 0xc0814, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000340)=[@timestamp, @window={0x3, 0x6, 0x7}, @mss={0x2, 0x7}, @window={0x3, 0x0, 0x4}, @window={0x3, 0x8, 0x6}, @timestamp, @window={0x3, 0xfffe}, @sack_perm], 0x2000000000000061) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000380), 0x4) sendto$inet(r3, &(0x7f00000003c0)='<', 0x381, 0x805, 0x0, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r2, 0x4048ae9b, &(0x7f0000000400)={0x9f63422128970807, 0x0, {[0xa000000000000, 0xf7, 0x3, 0xfffffffffffffff6, 0x1, 0xa, 0x11, 0x3]}}) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text32={0x20, &(0x7f0000000480)="b8009000000f0ad00f213c35200000050f23f866baf80cb88200dc8dc4c15ddae666bafc0c0f01d1b973000040b8332c0000ba000000000f300000670f05cab972090000b815314c56ba000000000f30eae00822cc7500c4e2a547a56b7ebdaf0f0966ba6100ef", 0x67}], 0x1, 0xb, 0x0, 0x0) mount$cgroup(0x0, &(0x7f00000005c0)='.\x00', &(0x7f0000000600), 0x0, &(0x7f0000000640)={[{@subsystem='cpu'}]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.859549797s ago: executing program 2 (id=8): mkdir(&(0x7f00000000c0)='./file0\x00', 0x25) syz_usb_connect(0x2, 0xb3, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ef0201405a22d4e1ada7f5c200010902a1000201008032080b00020e03000009040000000e0100000d240100012700006cdc020101112403010102000000000000000002000009240302010100"], 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) syz_open_procfs(0x0, 0x0) (async) syz_open_procfs(0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)={0x1c, 0x2, 0x3, 0x101, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x2, 0x0, 0x11}}]}, 0x1c}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x1c0) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000700)={0xaa, 0x380}) (async) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000700)={0xaa, 0x380}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000740)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000780)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00001b1000/0x4000)=nil, 0x400000, 0x2, 0x2}) (async) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000780)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00001b1000/0x4000)=nil, 0x400000, 0x2, 0x2}) r2 = syz_open_procfs$pagemap(0x0, &(0x7f00000007c0)) ioctl$PAGEMAP_SCAN(r2, 0xc0606610, &(0x7f0000000800)={0x60, 0x0, &(0x7f00001c9000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./bus\x00', 0x180) mount$overlay(0x0, &(0x7f0000000280)='./bus\x00', &(0x7f00000002c0), 0x8, &(0x7f0000000300)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) (async) mount$overlay(0x0, &(0x7f0000000280)='./bus\x00', &(0x7f00000002c0), 0x8, &(0x7f0000000300)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000340)='./bus\x00') (async) chdir(&(0x7f0000000340)='./bus\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x1cd042, 0x224) io_setup(0x20fe, &(0x7f00000003c0)=0x0) io_submit(r4, 0x1, &(0x7f0000000400)=[&(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, r3, &(0x7f0000000480)='p', 0x1, 0x8800000}]) (async) io_submit(r4, 0x1, &(0x7f0000000400)=[&(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, r3, &(0x7f0000000480)='p', 0x1, 0x8800000}]) mount$bpf(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x1600019, 0x0) chroot(&(0x7f0000000180)='./file0\x00') r5 = socket$unix(0x1, 0x1, 0x0) bind$unix(r5, &(0x7f0000000640)=@file={0x1, './file0\x00'}, 0x6e) keyctl$clear(0x11, 0xfffffffffffffffd) (async) keyctl$clear(0x11, 0xfffffffffffffffd) listen(r5, 0x58b) (async) listen(r5, 0x58b) add_key$keyring(&(0x7f00000006c0), 0x0, 0x0, 0x0, 0xfffffffffffffffe) listen(r5, 0x8) (async) listen(r5, 0x8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r6, 0x29, 0x48, &(0x7f0000000000)=ANY=[@ANYBLOB="d036"], 0x8) 1.278887388s ago: executing program 3 (id=9): r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl(r2, 0x8921, &(0x7f0000000140)='veth0:') mount(0x0, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x103100, 0x4) r3 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r3, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) r4 = memfd_create(&(0x7f0000000040)='-\x00', 0x0) ioctl$XFS_IOC_SCRUBV_METADATA(r4, 0xc0285840, &(0x7f00000000c0)={0x8000, 0x5, 0x9, 0x0, 0x400, 0x3, 0x0, &(0x7f0000000080)=[{0x3, 0x101, 0x3}, {0x13, 0x101, 0x5}, {0xd, 0xfe, 0x3}]}) r5 = inotify_init1(0x80800) close(r5) write$cgroup_subtree(r3, &(0x7f0000000180)=ANY=[@ANYBLOB='+cpu +pids'], 0xb) 1.240474652s ago: executing program 3 (id=10): syz_fuse_handle_req(0xffffffffffffffff, &(0x7f0000003540)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0xef) (async) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0xef) socket$inet(0x2, 0x3, 0x6) (async) r0 = socket$inet(0x2, 0x3, 0x6) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000380)={{0x2, 0x0, @broadcast}, {0x307, @local}, 0x48, {0x2, 0x0, @local}, 'bridge_slave_1\x00'}) socket$netlink(0x10, 0x3, 0x0) (async) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f0000000400)=[{&(0x7f0000000440)="290000001e00190f00003fffffffda060200000000e80001dd0008040d0009000d0000000005000000", 0x29}], 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracing\x00', 0x1ff) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracing\x00', 0x1ff) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000100)={0x2001, 0x4, 0x1}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)={0x30, r4, 0x1, 0x70bd2a, 0x0, {{}, {}, {0x14, 0x19, {0x0, 0x1}}}}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x4080) utimensat(0xffffffffffffff9c, 0x0, &(0x7f0000000680)={{0x0, 0x3ffffffe}, {0x0, 0x3ffffffe}}, 0x0) mount(0x0, &(0x7f0000000080)='./tracing\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) r5 = syz_usb_connect$cdc_ncm(0x5, 0x7a, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902680002010040000904000001020e0000052406000105240000000d370f0100000000000020000006241a0000000c241b4800f3ff00050080050905810300020000000904010000020d00000904010102020d0000090582020004000000090503020002"], 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) (async) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) ioctl$XFS_IOC_GETPARENTS_BY_HANDLE(r1, 0xc040583f, &(0x7f0000000540)={{@_ha_fsid={[0x0, 0x2]}, {0x7, 0xa2f, 0x2, 0x2}}, {{[0x3950, 0x1, 0x9]}, 0x0, 0x2, 0x6, 0x0, &(0x7f0000000480)=[{{@align=0x9, {0x24, 0x686, 0x2, 0x1}}, 0x7fffffff, 0x0, 'system.posix_acl_access\x00'}, {{@align=0x54, {0x0, 0x4, 0x5, 0x3}}, 0x7f, 0x0, '%\x00'}, {{@align=0xffffffffffffffff, {0xcb5, 0x6, 0x6, 0x2}}, 0x7ff, 0x0, 'tracefs\x00'}, {{@align=0x463c, {0x4, 0x5, 0x9, 0x80}}, 0x80000000, 0x0, '\xaa\xaa\xaa\xaa\xaa'}]}}) syz_usb_control_io$cdc_ncm(r5, 0x0, &(0x7f0000000200)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x20, 0x80, 0x1c, {0x1, 0x24, 0x0, 0x3d9, 0x5, 0xffdf, 0x9, 0xc, 0xfffe, 0x7542, 0x0, 0x9}}, 0x0, 0x0, 0x0, 0x0}) mkdirat(0xffffffffffffff9c, 0x0, 0x140) chdir(0x0) open(&(0x7f00000002c0)='./file0\x00', 0x80140, 0x0) (async) r6 = open(&(0x7f00000002c0)='./file0\x00', 0x80140, 0x0) fcntl$setlease(r6, 0x400, 0x0) (async) fcntl$setlease(r6, 0x400, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='system.posix_acl_access\x00', 0x0, 0x0, 0x2) ioctl$BTRFS_IOC_QGROUP_CREATE(r6, 0x4010942a, &(0x7f00000006c0)={0x1, 0xe9}) (async) ioctl$BTRFS_IOC_QGROUP_CREATE(r6, 0x4010942a, &(0x7f00000006c0)={0x1, 0xe9}) syz_usb_control_io(r5, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000140)='p:t_st/event1 ./file0:0x0 +u', 0x1c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001300)) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001300)={0xffffffffffffffff}) sendmmsg$inet(r7, &(0x7f0000001340)=[{{0x0, 0x0, &(0x7f0000001380)=[{&(0x7f00000013c0)="2a73ed35", 0x732a}]}}], 0x400000000000292, 0xfe) 918.597665ms ago: executing program 0 (id=11): epoll_create1(0x0) capset(&(0x7f0000000000)={0x20071026}, 0x0) mremap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000e00)={0x8, 0x80000100008b}, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000ec0)='net/rt_cache\x00') sched_setscheduler(0x0, 0x3, &(0x7f0000000f00)=0x5) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000f40)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x2, 0x0) r2 = getpid() syz_clone(0x1a2400, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000f80)='task\x00') fchdir(r3) mount(0x0, &(0x7f0000000fc0)='.\x00', &(0x7f0000001000)='proc\x00', 0x0, 0x0) r4 = syz_open_procfs(r2, &(0x7f00000000c0)='numa_maps\x00') pread64(r4, 0x0, 0x0, 0x1000000000) write$uinput_user_dev(r0, &(0x7f0000000580)={'syz1\x00', {0x9, 0x7, 0x5, 0x7}, 0x3f, [0x3, 0x2, 0x18, 0x2, 0x2, 0x400, 0x80000000, 0x9, 0xfffffc01, 0x0, 0x4, 0x1, 0xfffffffb, 0x8e, 0x747d5e13, 0x800, 0xfffffb9a, 0xfffffffe, 0x1, 0xfffffffb, 0x2004, 0x3, 0x0, 0xa, 0x482, 0x4800, 0x4, 0x7, 0xe, 0x4623f, 0x0, 0x10001, 0x9, 0x8000, 0x0, 0x8, 0x0, 0x0, 0x4, 0x8da8, 0xf2a2, 0x200, 0x2, 0x5, 0xe, 0x4, 0x2, 0x6d, 0xe, 0x5, 0x1, 0x19a1, 0x6, 0x3, 0x9, 0xffffffff, 0x4, 0x1, 0x1000, 0x5, 0x3d, 0x8, 0xa, 0x5], [0x7, 0x1e, 0x6, 0x4, 0xfffffffd, 0xffffffff, 0x9, 0x25, 0xf, 0xfffffff9, 0x3, 0x7fff, 0x730, 0x1c32, 0x2, 0x8, 0x10000, 0x20003fe, 0x7ffd, 0x3, 0x3, 0x297, 0x5, 0x0, 0x8, 0x4, 0xa, 0x3ff, 0x4, 0xfffffffe, 0x9, 0x1000003, 0xd3e, 0xfffff7f9, 0xffffffff, 0xc, 0x101, 0xffffffff, 0x6, 0x2000008, 0x1, 0xfdff, 0x2, 0x96, 0xfffffffb, 0x2, 0x800, 0x2, 0x5, 0xc, 0x2, 0xb, 0x9, 0x3, 0x5, 0x7, 0x9, 0x2, 0x1, 0x9, 0x6, 0x4, 0x1fe, 0x3], [0x401, 0x8000e584, 0xffff, 0xcd3, 0x8, 0x23, 0x404, 0xffb, 0x4008, 0xc, 0x8, 0x9, 0x0, 0x5, 0x80000001, 0x8, 0x3f92, 0x6, 0x0, 0x14, 0xfffffffe, 0xfffffff9, 0xffffffff, 0x1000, 0x6e, 0xffff, 0x4, 0x5, 0x200003, 0x100, 0x5, 0xffffffff, 0x9, 0x8001, 0x10000, 0xfffffffc, 0x3, 0x400004, 0x3, 0x6d7e, 0x9, 0x97, 0x3, 0xbf23, 0x9, 0xa, 0x956, 0x0, 0x5, 0xe, 0x6, 0x4100fffd, 0x2, 0x9, 0x7, 0xea, 0x9, 0x20000005, 0x3, 0x80, 0x0, 0x9, 0x401, 0x5], [0x108f, 0x10003, 0x5, 0xfffffffc, 0x88, 0x2, 0x4000000, 0xfffffff9, 0x9, 0x737, 0x763, 0xb, 0x10001, 0x8, 0x5, 0x4, 0x81, 0x5, 0x3fa6, 0x2, 0x0, 0x5, 0x8000, 0x4, 0xe47, 0x4, 0x8, 0x4000004, 0x0, 0x0, 0x3b, 0x20000001, 0x4, 0x5, 0xa80a, 0x65f413f9, 0x2, 0x20008, 0x8a5, 0x8a, 0x46, 0x409, 0x8003, 0x5, 0x168, 0x800, 0x4, 0xffffffff, 0x7fff, 0xffff8a33, 0xfffffff8, 0x4d8da2af, 0x3, 0x5, 0xb, 0xd4, 0xfffffffd, 0xa, 0xe, 0x101, 0xfff, 0x10, 0x136, 0x6]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) write$input_event(r0, &(0x7f0000000a00)={{0x77359400}, 0x15}, 0xfe4f) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x2a, &(0x7f0000000080)=0x77, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000a40)={0x9, 0x20000008b}, 0x0) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000d00), 0x41, 0x0) ioctl$TCSETAF(r6, 0x5408, &(0x7f0000000d40)={0xcf50, 0x0, 0xffff, 0x99fe, 0x11, ')\x00'}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000d80)={0x1, &(0x7f0000000dc0)=[{0x7fff, 0x9, 0x3, 0x4}]}) write$binfmt_aout(r6, &(0x7f0000000e00)=ANY=[], 0xff2e) ioctl$TCSETS(r6, 0x40045431, &(0x7f0000000e40)={0x0, 0x0, 0xfffffff9, 0x7fff, 0x16, "0062007d82000000000000002240f7ffffff00"}) syz_open_pts(r6, 0x0) 900.072036ms ago: executing program 0 (id=12): mkdir(&(0x7f0000000300)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x143142, 0x120) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000000c0)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r1, 0xc0182101, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000200)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r1, 0x40082102, &(0x7f0000000280)=r2) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f00000002c0)={r2, 0x1, r0, 0x1}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x8, &(0x7f0000000080)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) mount$incfs(&(0x7f0000000380)='./file0\x00', &(0x7f0000002480)='./file0\x00', &(0x7f00000024c0), 0x80, 0x0) linkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file2\x00', 0x1000) 869.16219ms ago: executing program 2 (id=13): r0 = gettid() ptrace(0x11, r0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$TIOCSPGRP(r1, 0x5410, &(0x7f0000000040)=r0) mount(&(0x7f0000000080)=@nullb, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='fuse\x00', 0x40011, &(0x7f0000000140)='\x00') r2 = dup(r1) pread64$ublk_ch(r2, &(0x7f0000000180)=@buf_4k, 0x1000, 0x7) r3 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001180), r1) ioctl$KDENABIO(r2, 0x4b36) sendto$inet6(r2, &(0x7f00000011c0)="622cf6985e7cf796c30dc2492d57342bc0e4537b734548918f57b57a673e2aa711df4247dc0f0298a90f9de4923ce95761cc8ba318a5a5f2", 0x38, 0x800, &(0x7f0000001200)={0xa, 0x4e20, 0x1, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x80}, 0x1c) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DEL(r5, &(0x7f0000001340)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001300)={&(0x7f0000001280)={0x64, 0xa, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x6}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0xe}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x4}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x8}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0xffffff01}]}, 0x64}, 0x1, 0x0, 0x0, 0x40805}, 0x10) r6 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_FD_FRAMES(r6, 0x65, 0x5, &(0x7f0000001380), &(0x7f00000013c0)=0x4) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r1, &(0x7f0000001580)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001540)={&(0x7f0000001440)={0xc4, r4, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@ETHTOOL_A_LINKMODES_OURS={0x64, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0xd, 0x4, "d0fb62f9e95bf1e521"}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_BITS={0x44, 0x3, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x6}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1000}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1ff}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, '$#\x00'}]}]}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x5}]}, @ETHTOOL_A_LINKMODES_OURS={0x44, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x1}, @ETHTOOL_A_BITSET_BITS={0x38, 0x3, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xfff}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}]}]}, @ETHTOOL_A_LINKMODES_LANES={0x8, 0x9, 0x6}]}, 0xc4}, 0x1, 0x0, 0x0, 0x48081}, 0x40) ptrace$getsig(0x4202, r0, 0x6, &(0x7f00000015c0)) setsockopt$inet6_MCAST_LEAVE_GROUP(r1, 0x29, 0x2d, &(0x7f0000001640)={0x7, {{0xa, 0x4e20, 0x9, @mcast2, 0x1}}}, 0x88) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000001700)={0x40, 0x4}, 0x10) setxattr(&(0x7f0000001740)='./file0/file0\x00', &(0x7f0000001780)=@random={'security.', 'fuse\x00'}, &(0x7f00000017c0)='\x00', 0x1, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000001800)={0x40, 0x1}, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001880), r2) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000018c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NOTIFY_RADAR(r3, &(0x7f00000019c0)={&(0x7f0000001840)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001980)={&(0x7f0000001900)={0x50, r7, 0x200, 0x70bd27, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r8}, @val={0xc, 0x99, {0x1, 0x5f}}}}, [@NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xd}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x5}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000040}, 0x4c895) r9 = add_key$keyring(&(0x7f0000001b00), &(0x7f0000001b40)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff8) add_key$fscrypt_v1(&(0x7f0000001a00), &(0x7f0000001a40)={'fscrypt:', @desc2}, &(0x7f0000001a80)={0x0, "dd20c2ec33cdc5d996e2f612890cca63cee59e3dc097d381ab6f0b811286846043e7922057622b245db12c80e1d09a980f8ae6efe18c3d55dbc09ec2598aeb72", 0x34}, 0x48, r9) llistxattr(&(0x7f0000001b80)='./file0/file0\x00', &(0x7f0000001bc0)=""/220, 0xdc) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001d00), r3) sendmsg$NL80211_CMD_STOP_SCHED_SCAN(r2, &(0x7f0000001e00)={&(0x7f0000001cc0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000001dc0)={&(0x7f0000001d40)={0x68, r10, 0x2, 0x70bd27, 0x10, {{}, {@void, @val={0xc, 0x99, {0x6, 0x22}}}}, [@NL80211_ATTR_COOKIE={0xc, 0x58, 0x54}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x68}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x5}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x66}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x14}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x11}]}, 0x68}, 0x1, 0x0, 0x0, 0x5d76177f3de0cb55}, 0x20000000) 795.420178ms ago: executing program 2 (id=14): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000180)="290000002000190f00003fffffffda060200000001e80001dd0000040d000600ea11004a35f4667d41", 0x29}], 0x1) r1 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f00000003c0)=0x40000, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f0000000340)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x18410, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x0, 0x0) accept$unix(r2, 0x0, &(0x7f00000001c0)) readahead(r2, 0x6, 0x10) write$evdev(r2, &(0x7f00000000c0), 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x59fc02, 0x0) mkdir(&(0x7f0000000200)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./mysys\x00', &(0x7f0000000280)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./mysys/bus/pci/devices/0000:00:01.0/enable\x00', 0x1, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) write(r4, &(0x7f0000000300)='1', 0x1) write$selinux_create(r4, &(0x7f0000000380)=@objname={'/sbin/dhclient', 0x20, '/usr/sbin/ntpd', 0x20, 0x5, 0x20, './dev\x00'}, 0x39) ioctl$FS_IOC_RESVSP(r3, 0x40305828, &(0x7f0000000040)={0x0, 0x1, 0x6, 0xfffffffffffffffe}) write(r3, &(0x7f0000001640)="8b", 0xffe4) 743.722543ms ago: executing program 2 (id=15): mkdirat(0xffffffffffffff9c, &(0x7f0000001940)='./proc\x00', 0x1ff) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000001940)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001980)='./proc\x00', &(0x7f00000019c0)='proc\x00', 0x4000, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched_retired(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newtaction={0x18, 0x31, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [{0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x8080}, 0x9080) r1 = openat(0xffffffffffffff9c, &(0x7f0000001a00)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000001a40)='100', 0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0x1c8) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0x1c8) setresgid(0xee00, 0x0, 0x0) syz_usb_connect$uac2(0x0, 0x98, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000200000008732b1e00400001020301090286b53f2af3a6000301804004080b019666e6a88c75f7778bf479087ac5bc0401010a200009040000000101200009240102000b26000211240806060000010001000200feff03000c2403fd0607a80506f9ff0a090401000001022000090401010101022000090501094000050400082501810909020009040200000102200009040201010102200009058209ff0305041008250183300a0200"], 0x0) (async) syz_usb_connect$uac2(0x0, 0x98, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000200000008732b1e00400001020301090286b53f2af3a6000301804004080b019666e6a88c75f7778bf479087ac5bc0401010a200009040000000101200009240102000b26000211240806060000010001000200feff03000c2403fd0607a80506f9ff0a090401000001022000090401010101022000090501094000050400082501810909020009040200000102200009040201010102200009058209ff0305041008250183300a0200"], 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) 0s ago: executing program 0 (id=16): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) io_submit(0x0, 0x1, &(0x7f0000000180)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0}]) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_connect(0x5, 0x50a, &(0x7f0000000600)={{0x12, 0x1, 0x250, 0x7c, 0x7a, 0xdf, 0x8, 0x106c, 0xece, 0xf737, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x4f8, 0x1, 0x75, 0x5, 0xa0, 0x3, "", [{{0x9, 0x4, 0x27, 0x5, 0xe, 0xff, 0xf0, 0xff, 0x0, [], [{{0x9, 0x5, 0xd, 0x10, 0x3ff, 0x5, 0x30}}, {{0x9, 0x5, 0xd, 0x0, 0x20, 0x7, 0xf9, 0x1}}, {{0x9, 0x5, 0x0, 0x10, 0x428, 0xa8, 0x9, 0x4, [@generic={0x1a, 0x8, "75cba389ff4d58a8856b59e8c23c08b573f2ddc22c81126a"}]}}, {{0x9, 0x5, 0x3, 0xc, 0x400, 0x34, 0x4, 0x4, [@generic={0x9, 0x3, "e2490c0bcf1525"}]}}, {{0x9, 0x5, 0xb, 0x10, 0x10, 0x6, 0x2, 0xe3, [@generic={0x74, 0xe, "c78a0c75e824938f73b82140534134f540d271605656d08d2464471742b488ebe817d118dbf97978198e59415828f26bb3a6807c9d612eb7c8286d4ef1ec75b1ca87c63c448e388f5f8d84efd685098520d32c16232e1b97ed2250be3225f73e6e212fea89982fdb5ec659290a682ed9ffee"}, @generic={0xb, 0x9, "9855c23adef5ca54ea"}]}}, {{0x9, 0x5, 0xf, 0x9ab3ac2d4fa6e2ed, 0x50, 0x8, 0xdb, 0x1}}, {{0x9, 0x5, 0x2, 0xc, 0xd814e8dcd409bd56, 0xc, 0x4, 0xc, [@generic={0x9a, 0x22, "9aafe0eec00de3b04a18b6316d25baf655912f932d55212512cf19c70fb0b09f6e1a6eddc1bd5c7acebd6ec6401cf0d62d72737a78d3be1b26450cef3b0ceaffa01326ef23dd5214dfffea7961afd2d70ce144d14f32dc2a8e52d4a55f7c69c970bba959832d7021fb5d2268cdfe48563ad03151e47a639dce4d6c8b7d558cb425e0800359b0993f585ba714a681df6b1ed4de1b1f65ee8b"}, @generic={0x73, 0x4, "06d5bc34cd7f57de93efce7f3b477aad4670aee7a9a1c9b3a89228d104f9e30c9be3652a2331d068fb8d7fa6e872d2f4313c95e93f61ee1e448fd6484016c34c4c5b0b9093dbcf9713a51ef6d8ee70f3e0f46a67cc35ef7a3be1e0157d187c5a90fadb6eabdea718ab642abf35bb2ffe0d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x8, 0x7, 0x3, [@generic={0xf2, 0x6, "9a4752879e51669c4e9b346da28439294c916db0fed80ff3ad65b33481b1c703e2fed2804f369d15f76dba1526379922e9cb5cef52c76e01656e22f16f61d82e014510d2a9108a33fc8d7bd3689cdf576201cf4a9b8384a70a0fcf98bed3e8cf6036e6d521a01414b18c7fbb455b6e7588225a8897edf1bdd305e65a51580c095cd97c9fa3a0b1245567263f2be1605b503e53ebd0814cadedf060765fa08aec0d2ad74957feb75c681556851c3adb7df899fe49e8438bca2cc07d6467c7ee03e44f01f9d921b9f3581b959a67b5cfc52cadd3dbb63886c42f5882346f964791892a7b5525b286dafda5d589d23101dc"}]}}, {{0x9, 0x5, 0xa, 0x0, 0x200, 0x0, 0x5, 0x0, [@generic={0x6d, 0x8, "4439891c2a450b05eeb3be8f2eac6d46514aaeb9fdb4bb48647e9967f97007b9c9d6e16631434d8fe028f55061329a7bfb5d6c354cc222ca9dbf2dcf9f6e1e35e7ff1b8404accf4b97f9ada9cf926febceeaafaa74cbe862e478bdbd62300f09bee203e4e564e469aa4998"}]}}, {{0x9, 0x5, 0xc, 0x0, 0x8, 0x6, 0x9, 0x4}}, {{0x9, 0x5, 0xa, 0x0, 0x400, 0x9, 0x15, 0xf}}, {{0x9, 0x5, 0xf, 0x0, 0x10, 0x80, 0x9, 0x9b, [@generic={0xf9, 0x23, "2691df76999eb0e86129eb2ffd16ed7afbfd708761476f1a5f94f4ce6107491c2c1968bac46f27ad075d5817f699a06e0576b5f5bd6b1ddc15adc232dacb6257ff37d3d534648ad523b31e9a17e94e64689c445ec56712411b64ff069dfe415fda3d55a912156f24256c26d1de4f69769af3b106257066678c959b0a6bad6ae6c1a5d43966b8d29fe03cee1b33d7f661ff1feaa7faa358da7f1ce39540c1a061039058f58019dc531ff98fe1e3ba1adf31f4ddeb6854fcb963f1e5682edd7cbbe72dcbe364a7cd9084a33360edcfb1eda8f1678b95580c5ed6364873b78ba8d579652be37d408f5ffb894a3dd4e3e6d81ac71451417bd3"}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0x6, 0x81}]}}, {{0x9, 0x5, 0xf, 0x0, 0x200, 0x1, 0x7, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x4, 0x9}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0xff, 0x8}]}}, {{0x9, 0x5, 0x5, 0x0, 0x10, 0xbc, 0xb9, 0x5, [@generic={0x4c, 0x8, "a53630087914977a47a5b9402c41fde52abda27c74656e39afbcb2bc355124ae828f85574495256006de5e5590fddea5cef0adab628463a7516a9860f7581422e39b7dfd3932a71acd66"}]}}]}}]}}]}}, &(0x7f0000001000)={0xa, &(0x7f0000000f80)={0xa, 0x6, 0x110, 0x7, 0x8, 0xc3, 0xff, 0x15}, 0x12, &(0x7f0000000fc0)={0x5, 0xf, 0x12, 0x2, [@ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x5, 0x9, 0xffff}]}}) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000") kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.89' (ED25519) to the list of known hosts. [ 29.845254][ T36] audit: type=1400 audit(1793409192.500:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 29.848832][ T286] cgroup: Unknown subsys name 'net' [ 29.868041][ T36] audit: type=1400 audit(1793409192.500:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.895625][ T36] audit: type=1400 audit(1793409192.530:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.896603][ T286] cgroup: Unknown subsys name 'devices' [ 30.016938][ T286] cgroup: Unknown subsys name 'hugetlb' [ 30.022687][ T286] cgroup: Unknown subsys name 'rlimit' [ 30.138170][ T36] audit: type=1400 audit(1793409192.790:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 30.161478][ T36] audit: type=1400 audit(1793409192.790:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 30.186262][ T36] audit: type=1400 audit(1793409192.790:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 30.212500][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 30.221414][ T36] audit: type=1400 audit(1793409192.870:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.246968][ T36] audit: type=1400 audit(1793409192.870:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.270638][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 30.273409][ T36] audit: type=1400 audit(1793409192.920:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.307297][ T36] audit: type=1400 audit(1793409192.920:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 31.617175][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.624283][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.631540][ T296] bridge_slave_0: entered allmulticast mode [ 31.638188][ T296] bridge_slave_0: entered promiscuous mode [ 31.653317][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.660574][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.667831][ T296] bridge_slave_1: entered allmulticast mode [ 31.674187][ T296] bridge_slave_1: entered promiscuous mode [ 31.695109][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.702199][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.709413][ T293] bridge_slave_0: entered allmulticast mode [ 31.715718][ T293] bridge_slave_0: entered promiscuous mode [ 31.728556][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.735708][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.742908][ T294] bridge_slave_0: entered allmulticast mode [ 31.749327][ T294] bridge_slave_0: entered promiscuous mode [ 31.757471][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.764723][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.771821][ T294] bridge_slave_1: entered allmulticast mode [ 31.778183][ T294] bridge_slave_1: entered promiscuous mode [ 31.784291][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.791525][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.798678][ T293] bridge_slave_1: entered allmulticast mode [ 31.805057][ T293] bridge_slave_1: entered promiscuous mode [ 31.849742][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.856859][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.863954][ T295] bridge_slave_0: entered allmulticast mode [ 31.870444][ T295] bridge_slave_0: entered promiscuous mode [ 31.877063][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.884126][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.891409][ T295] bridge_slave_1: entered allmulticast mode [ 31.897808][ T295] bridge_slave_1: entered promiscuous mode [ 32.039174][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.046286][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.060654][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.067757][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.075179][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.082282][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.100970][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.108159][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.115475][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.122558][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.155199][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.162306][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.169649][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.176711][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.205470][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.212843][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.220444][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.228760][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.236094][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.243489][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.250968][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.271345][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.278452][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.286278][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.293417][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.308237][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.315348][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.332661][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.339764][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.350993][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.358141][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.370490][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.377624][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.403108][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.410200][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.418124][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.425190][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.473080][ T296] veth0_vlan: entered promiscuous mode [ 32.487352][ T295] veth0_vlan: entered promiscuous mode [ 32.496511][ T294] veth0_vlan: entered promiscuous mode [ 32.509324][ T293] veth0_vlan: entered promiscuous mode [ 32.521457][ T296] veth1_macvtap: entered promiscuous mode [ 32.540334][ T294] veth1_macvtap: entered promiscuous mode [ 32.548744][ T295] veth1_macvtap: entered promiscuous mode [ 32.576906][ T293] veth1_macvtap: entered promiscuous mode [ 32.605089][ T295] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 32.672993][ T318] netlink: 'syz.0.1': attribute type 6 has an invalid length. [ 32.734075][ T327] device-mapper: table: 252:0: snapshot: Cannot get origin device (-ENOENT) [ 32.743236][ T327] device-mapper: ioctl: error adding target to table [ 32.904714][ T31] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 32.964892][ T310] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 33.055842][ T31] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 33.067000][ T31] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 33.076312][ T31] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.086471][ T31] usb 2-1: config 0 descriptor?? [ 33.116297][ T310] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 33.130522][ T310] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 33.140169][ T310] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 33.148446][ T310] usb 1-1: SerialNumber: syz [ 33.214770][ T10] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 33.296670][ T31] usbhid 2-1:0.0: can't add hid device: -71 [ 33.302725][ T31] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 33.311760][ T31] usb 2-1: USB disconnect, device number 2 [ 33.356432][ T310] cdc_ether 1-1:1.0: probe with driver cdc_ether failed with error -71 [ 33.366242][ T310] usb 1-1: USB disconnect, device number 2 [ 33.377524][ T339] overlay: filesystem on ./bus not supported as upperdir [ 33.402015][ T10] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 33.409727][ T10] usb 3-1: can't read configurations, error -71 [ 33.607571][ T345] netlink: 'syz.3.10': attribute type 9 has an invalid length. [ 33.744713][ T31] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 33.854742][ T9] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 33.875338][ T348] capability: warning: `syz.0.11' uses deprecated v2 capabilities in a way that may be insecure [ 33.893731][ T348] input: syz1 as /devices/virtual/input/input4 [ 33.913168][ T31] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 33.924737][ T31] usb 2-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 33.934198][ T31] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.947147][ T31] usb 2-1: config 0 descriptor?? [ 34.005786][ T9] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 34.020236][ T9] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 34.032796][ T355] netlink: 'syz.2.14': attribute type 6 has an invalid length. [ 34.033878][ T9] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 34.051565][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.062552][ T9] usb 4-1: Product: syz [ 34.067093][ T9] usb 4-1: Manufacturer: syz [ 34.071822][ T9] usb 4-1: SerialNumber: syz [ 34.082266][ T9] cdc_mbim 4-1:1.0: skipping garbage [ 34.120505][ T359] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 34.145978][ T359] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 34.154695][ T359] FAULT_INJECTION: forcing a failure. [ 34.154695][ T359] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 34.168513][ T359] CPU: 1 UID: 0 PID: 359 Comm: syz.2.15 Not tainted syzkaller #0 04b5f10b80d13b0533bf6aaa302b886c75cf6d37 [ 34.168553][ T359] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 34.168580][ T359] Call Trace: [ 34.168591][ T359] [ 34.168600][ T359] __dump_stack+0x21/0x30 [ 34.168644][ T359] dump_stack_lvl+0x140/0x1c0 [ 34.168678][ T359] ? __cfi_dump_stack_lvl+0x10/0x10 [ 34.168716][ T359] dump_stack+0x19/0x20 [ 34.168749][ T359] should_fail_ex+0x3c2/0x510 [ 34.168775][ T359] should_fail_alloc_page+0xec/0x110 [ 34.168800][ T359] __alloc_pages_noprof+0x1c0/0x7e0 [ 34.168831][ T359] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 34.168861][ T359] ? __alloc_pages_noprof+0x35a/0x7e0 [ 34.168892][ T359] pte_alloc_one+0x92/0x530 [ 34.168922][ T359] ? __cfi_pte_alloc_one+0x10/0x10 [ 34.168948][ T359] ? _raw_spin_unlock+0x45/0x60 [ 34.168975][ T359] ? __pmd_alloc+0x5a6/0x9a0 [ 34.168998][ T359] __pte_alloc+0x79/0x440 [ 34.169031][ T359] ? __cfi___pte_alloc+0x10/0x10 [ 34.169065][ T359] copy_page_range+0x3347/0x3990 [ 34.169096][ T359] ? __cfi_mas_destroy+0x10/0x10 [ 34.169127][ T359] ? kasan_save_track+0x4f/0x80 [ 34.169170][ T359] ? __cfi_copy_page_range+0x10/0x10 [ 34.169205][ T359] ? mas_store+0x897/0xcc0 [ 34.169237][ T359] ? __vma_enter_locked+0x24d/0x3c0 [ 34.169260][ T359] ? vma_interval_tree_augment_rotate+0x1bb/0x1f0 [ 34.169298][ T359] ? __rb_insert_augmented+0x6e5/0x730 [ 34.169331][ T359] ? __kasan_check_write+0x18/0x20 [ 34.169364][ T359] copy_mm+0x10cd/0x1da0 [ 34.169399][ T359] ? copy_signal+0x6a0/0x6a0 [ 34.169431][ T359] ? _raw_spin_lock+0x92/0x120 [ 34.169458][ T359] ? __asan_memset+0x39/0x50 [ 34.169489][ T359] ? __init_rwsem+0x110/0x1f0 [ 34.169526][ T359] ? copy_signal+0x4d5/0x6a0 [ 34.169558][ T359] copy_process+0x12a4/0x3370 [ 34.169596][ T359] ? __cfi_copy_process+0x10/0x10 [ 34.169631][ T359] kernel_clone+0x233/0x810 [ 34.169664][ T359] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 34.169700][ T359] ? __cfi_kernel_clone+0x10/0x10 [ 34.169733][ T359] ? do_futex+0x32a/0x510 [ 34.169761][ T359] __x64_sys_clone+0x1b7/0x230 [ 34.169796][ T359] ? __cfi___x64_sys_clone+0x10/0x10 [ 34.169835][ T359] ? __kasan_check_write+0x18/0x20 [ 34.169868][ T359] ? fpregs_restore_userregs+0x11c/0x260 [ 34.169901][ T359] ? switch_fpu_return+0x12/0x20 [ 34.169932][ T359] x64_sys_call+0x2b3c/0x2ee0 [ 34.169958][ T359] do_syscall_64+0x57/0xf0 [ 34.169984][ T359] ? clear_bhb_loop+0x50/0xa0 [ 34.170021][ T359] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 34.170054][ T359] RIP: 0033:0x7fe14519f559 [ 34.170085][ T359] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.170105][ T359] RSP: 002b:00007fe145fbbfd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 34.170136][ T359] RAX: ffffffffffffffda RBX: 00007fe145426090 RCX: 00007fe14519f559 [ 34.170154][ T359] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000011 [ 34.170169][ T359] RBP: 00007fe145236b20 R08: 0000000000000000 R09: 0000000000000000 [ 34.170184][ T359] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 34.170198][ T359] R13: 00007fe145426128 R14: 00007fe145426090 R15: 00007ffd159077b8 [ 34.170219][ T359] [ 34.370254][ T313] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 34.390375][ T345] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 34.425489][ T313] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 34.524903][ T10] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 34.675651][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 34.685438][ T10] usb 3-1: config index 0 descriptor too short (expected 46470, got 134) [ 34.693944][ T10] usb 3-1: config 42 has too many interfaces: 63, using maximum allowed: 32 [ 34.724682][ T10] usb 3-1: config 42 contains an unexpected descriptor of type 0x1, skipping [ 34.733578][ T10] usb 3-1: config 42 has an invalid descriptor of length 253, skipping remainder of the config [ 34.764629][ T10] usb 3-1: config 42 has 1 interface, different from the descriptor's value: 63 [ 34.773914][ T10] usb 3-1: config 42 has no interface number 0 [ 34.794647][ T10] usb 3-1: config 42 interface 8 altsetting 11 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 34.824689][ T10] usb 3-1: config 42 interface 8 has no altsetting 0 [ 34.833035][ T10] usb 3-1: New USB device found, idVendor=2b73, idProduct=001e, bcdDevice= 0.40 [ 34.844142][ T293] ------------[ cut here ]------------ [ 34.850138][ T293] WARNING: CPU: 1 PID: 293 at fs/overlayfs/util.c:605 ovl_dir_modified+0x15a/0x190 [ 34.854850][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.860241][ T293] Modules linked in: [ 34.871683][ T293] CPU: 1 UID: 0 PID: 293 Comm: syz-executor Not tainted syzkaller #0 04b5f10b80d13b0533bf6aaa302b886c75cf6d37 [ 34.883509][ T293] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 34.884687][ T10] usb 3-1: Product: syz [ 34.893782][ T293] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 34.902913][ T10] usb 3-1: Manufacturer: syz [ 34.903577][ T293] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 9e 55 97 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d e9 cc e0 5f 03 cc e8 b6 c2 3d ff <0f> 0b e9 3e ff ff ff e8 aa c2 3d ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 34.903600][ T293] RSP: 0018:ffffc9000116fb88 EFLAGS: 00010293 [ 34.913394][ T10] usb 3-1: SerialNumber: syz [ 34.927904][ T293] [ 34.927917][ T293] RAX: ffffffff824b931a RBX: 0000000000000000 RCX: ffff88812d2162c0 [ 34.927938][ T293] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 34.927951][ T293] RBP: ffffc9000116fbb0 R08: ffff88812f8440bf R09: 1ffff11025f08817 [ 34.927965][ T293] R10: dffffc0000000000 R11: ffffed1025f08818 R12: 0000000000000000 [ 34.927980][ T293] R13: dffffc0000000000 R14: ffff88812f844020 R15: ffff88811052d770 [ 34.927995][ T293] FS: 0000555561cbc500(0000) GS:ffff8881f6d00000(0000) knlGS:0000000000000000 [ 34.928014][ T293] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 34.997053][ T293] CR2: 00007ffefb455ff8 CR3: 000000012c6f0000 CR4: 00000000003526b0 [ 35.005122][ T293] Call Trace: [ 35.008434][ T293] [ 35.011410][ T293] ovl_do_remove+0x824/0xd10 [ 35.016088][ T293] ? ovl_set_redirect+0x780/0x780 [ 35.021168][ T293] ? __cfi_down_write+0x10/0x10 [ 35.026113][ T293] ovl_rmdir+0x1e/0x30 [ 35.030255][ T293] vfs_rmdir+0x3de/0x560 [ 35.034625][ T293] incfs_kill_sb+0x102/0x220 [ 35.039273][ T293] deactivate_locked_super+0xd5/0x270 [ 35.044715][ T293] deactivate_super+0xb8/0xe0 [ 35.046660][ T344] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 35.049440][ T293] cleanup_mnt+0x438/0x4d0 [ 35.061034][ T293] __cleanup_mnt+0x1d/0x40 [ 35.063843][ T9] cdc_mbim 4-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048 [ 35.065521][ T293] task_work_run+0x1e8/0x260 [ 35.074008][ T9] cdc_mbim 4-1:1.0: setting rx_max = 2048 [ 35.077651][ T293] ? __cfi_task_work_run+0x10/0x10 [ 35.077688][ T293] ? __x64_sys_umount+0x12e/0x180 [ 35.093692][ T293] ? __cfi___x64_sys_umount+0x10/0x10 [ 35.099169][ T293] ? __kasan_check_read+0x15/0x20 [ 35.104263][ T293] resume_user_mode_work+0x35/0x50 [ 35.109452][ T293] syscall_exit_to_user_mode+0x63/0xb0 [ 35.115001][ T293] do_syscall_64+0x63/0xf0 [ 35.119474][ T293] ? clear_bhb_loop+0x50/0xa0 [ 35.124225][ T293] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 35.130424][ T293] RIP: 0033:0x7f71a99a0797 [ 35.134918][ T293] Code: a2 c7 05 5c 9f 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 35.154664][ T293] RSP: 002b:00007ffefb4561a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 35.163227][ T293] RAX: 0000000000000000 RBX: 00007f71a9a35f63 RCX: 00007f71a99a0797 [ 35.171278][ T293] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffefb456260 [ 35.179337][ T293] RBP: 00007ffefb456260 R08: 00007ffefb457260 R09: 00000000ffffffff [ 35.187417][ T293] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffefb4572f0 [ 35.195460][ T293] R13: 00007f71a9a35f63 R14: 00000000000087e0 R15: 00007ffefb457330 [ 35.203489][ T293] [ 35.206581][ T293] ---[ end trace 0000000000000000 ]--- [ 35.213632][ T293] ------------[ cut here ]------------ [ 35.219201][ T293] WARNING: CPU: 1 PID: 293 at fs/overlayfs/util.c:605 ovl_dir_modified+0x15a/0x190 [ 35.228572][ T293] Modules linked in: [ 35.232506][ T293] CPU: 1 UID: 0 PID: 293 Comm: syz-executor Tainted: G W syzkaller #0 04b5f10b80d13b0533bf6aaa302b886c75cf6d37 [ 35.239988][ T10] usb 3-1: USB disconnect, device number 3 [ 35.245952][ T293] Tainted: [W]=WARN [ 35.255401][ T293] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 35.265537][ T293] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 35.271250][ T293] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 9e 55 97 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d e9 cc e0 5f 03 cc e8 b6 c2 3d ff <0f> 0b e9 3e ff ff ff e8 aa c2 3d ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 35.291036][ T293] RSP: 0018:ffffc9000116fb88 EFLAGS: 00010293 [ 35.297174][ T293] RAX: ffffffff824b931a RBX: 0000000000000000 RCX: ffff88812d2162c0 [ 35.304294][ T9] cdc_mbim 4-1:1.0: setting tx_max = 60 [ 35.305212][ T293] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 35.318866][ T293] RBP: ffffc9000116fbb0 R08: ffff88812f8440bf R09: 1ffff11025f08817 [ 35.318883][ T9] cdc_mbim 4-1:1.0: cdc-wdm0: USB WDM device [ 35.325766][ T9] wwan wwan0: port wwan0mbim0 attached [ 35.326918][ T293] R10: dffffc0000000000 R11: ffffed1025f08818 R12: 0000000000000000 [ 35.346667][ T293] R13: dffffc0000000000 R14: ffff88812f844020 R15: ffff88811052d770 [ 35.354711][ T293] FS: 0000555561cbc500(0000) GS:ffff8881f6d00000(0000) knlGS:0000000000000000 [ 35.359467][ T9] cdc_mbim 4-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.3-1, CDC MBIM, b6:d7:8a:7f:7d:e9 [ 35.363679][ T293] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 35.380835][ T293] CR2: 00007ffefb455ff8 CR3: 000000012c6f0000 CR4: 00000000003526b0 [ 35.388895][ T293] Call Trace: [ 35.392211][ T293] [ 35.395226][ T293] ovl_do_remove+0x824/0xd10 [ 35.399867][ T293] ? ovl_set_redirect+0x780/0x780 [ 35.404969][ T293] ? __cfi_down_write+0x10/0x10 [ 35.409878][ T293] ovl_rmdir+0x1e/0x30 [ 35.409920][ T9] usb 4-1: USB disconnect, device number 2 [ 35.413992][ T293] vfs_rmdir+0x3de/0x560 [ 35.424125][ T293] incfs_kill_sb+0x197/0x220 [ 35.428815][ T293] deactivate_locked_super+0xd5/0x270 [ 35.434241][ T293] deactivate_super+0xb8/0xe0 [ 35.439059][ T293] cleanup_mnt+0x438/0x4d0 [ 35.443520][ T293] __cleanup_mnt+0x1d/0x40 [ 35.448046][ T293] task_work_run+0x1e8/0x260 [ 35.452700][ T293] ? __cfi_task_work_run+0x10/0x10 [ 35.457905][ T293] ? __x64_sys_umount+0x12e/0x180 [ 35.462983][ T293] ? __cfi___x64_sys_umount+0x10/0x10 [ 35.468498][ T293] ? __kasan_check_read+0x15/0x20 [ 35.471359][ T9] cdc_mbim 4-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.3-1, CDC MBIM [ 35.473573][ T293] resume_user_mode_work+0x35/0x50 [ 35.487471][ T293] syscall_exit_to_user_mode+0x63/0xb0 [ 35.492989][ T293] do_syscall_64+0x63/0xf0 [ 35.497492][ T293] ? clear_bhb_loop+0x50/0xa0 [ 35.502220][ T293] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 35.508195][ T293] RIP: 0033:0x7f71a99a0797 [ 35.512649][ T293] Code: a2 c7 05 5c 9f 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 35.532374][ T293] RSP: 002b:00007ffefb4561a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 35.540872][ T293] RAX: 0000000000000000 RBX: 00007f71a9a35f63 RCX: 00007f71a99a0797 [ 35.548912][ T293] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffefb456260 [ 35.556991][ T293] RBP: 00007ffefb456260 R08: 00007ffefb457260 R09: 00000000ffffffff [ 35.565028][ T293] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffefb4572f0 [ 35.566677][ T36] kauditd_printk_skb: 76 callbacks suppressed [ 35.566719][ T36] audit: type=1400 audit(1793409198.110:150): avc: denied { read } for pid=149 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 35.573038][ T293] R13: 00007f71a9a35f63 R14: 00000000000087e0 R15: 00007ffefb457330 [ 35.573064][ T293] [ 35.573072][ T293] ---[ end trace 0000000000000000 ]--- [ 35.616864][ T31] aiptek 2-1:0.0: Aiptek using 400 ms programming speed [ 35.624879][ T31] input: Aiptek as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input5 [ 35.635156][ T36] audit: type=1400 audit(1793409198.290:151): avc: denied { read } for pid=95 comm="acpid" name="event4" dev="devtmpfs" ino=450 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 35.683525][ T36] audit: type=1400 audit(1793409198.290:152): avc: denied { open } for pid=95 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=450 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 35.719198][ T9] wwan wwan0: port wwan0mbim0 disconnected [ 35.736397][ T36] audit: type=1400 audit(1793409198.290:153): avc: denied { ioctl } for pid=95 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=450 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 35.780525][ T36] audit: type=1400 audit(1793409198.430:154): avc: denied { getattr } for pid=371 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf/eth0.dhcp" dev="tmpfs" ino=435 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 35.820413][ T36] audit: type=1400 audit(1793409198.470:155): avc: denied { read } for pid=373 comm="sed" name="eth0.dhcp" dev="tmpfs" ino=435 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 35.852971][ T36] audit: type=1400 audit(1793409198.470:156): avc: denied { open } for pid=373 comm="sed" path="/run/dhcpcd/hook-state/resolv.conf/eth0.dhcp" dev="tmpfs" ino=435 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 35.887769][ T36] audit: type=1400 audit(1793409198.500:157): avc: denied { unmount } for pid=295 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 35.904769][ T31] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 35.940675][ T9] usb 2-1: USB disconnect, device number 3 [ 35.940719][ C1] aiptek 2-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 35.977378][ T36] audit: type=1400 audit(1793409198.630:158): avc: denied { create } for pid=370 comm="dhcpcd-run-hook" name="resolv.conf.wwan0.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 36.023356][ T36] audit: type=1400 audit(1793409198.630:159): avc: denied { write } for pid=370 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf.wwan0.link" dev="tmpfs" ino=489 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 36.075914][ T31] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 36.087052][ T31] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 36.096544][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.105683][ T31] usb 1-1: config 0 descriptor?? [ 36.314855][ T31] usbhid 1-1:0.0: can't add hid device: -71 [ 36.320957][ T31] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 36.329924][ T31] usb 1-1: USB disconnect, device number 3 [ 36.754710][ T31] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 36.905908][ T31] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 36.916918][ T31] usb 1-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 36.926035][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.934882][ T31] usb 1-1: config 0 descriptor?? [ 37.342507][ T368] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 37.351184][ T368] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 37.765134][ T31] aiptek 1-1:0.0: Aiptek using 400 ms programming speed [ 37.773593][ T31] input: Aiptek as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input6 [ 38.062520][ T9] usb 1-1: USB disconnect, device number 4 [ 38.062561][ C1] aiptek 1-1:0.0: aiptek_irq - usb_submit_urb failed with result -19