last executing test programs: 3.555245634s ago: executing program 0 (id=55): r0 = memfd_create(&(0x7f0000000980)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7\xc6yE\xa8\xd6A\xe8*\xedEd\x14m|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6E&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa\x00'/717, 0x2) ftruncate(r0, 0x80079a0) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0xb, 0x2012, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) preadv2(r0, &(0x7f0000001d80)=[{&(0x7f0000000100)=""/89, 0x59}], 0x1, 0x4, 0x4040, 0x2) 3.436696126s ago: executing program 0 (id=58): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000000)=0x4) 3.27923675s ago: executing program 0 (id=65): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r0) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010329bd700000dcdf252400000018000180140002006c6f"], 0x2c}, 0x1, 0x0, 0x0, 0x44}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r0) sendmsg$NL80211_CMD_DEL_INTERFACE(0xffffffffffffffff, 0x0, 0x40080c4) 3.233753611s ago: executing program 0 (id=67): socket$key(0xf, 0x3, 0x2) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000600)=@newsa={0x128, 0x10, 0x7, 0x0, 0x0, {{@in6=@mcast2, @in=@multicast2, 0x4e20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x3, 0x1, 0x2, 0x0, 0x10000000, 0x1}, {0x0, 0x200000, 0x7}, {0x40000, 0xfffffffd, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0xfe, 0x34}, [@coaddr={0x14, 0xe, @in6=@remote}, @lifetime_val={0x24, 0x9, {0x6b8f, 0x8000000000000001, 0xb4, 0x5}}]}, 0x128}, 0x1, 0x0, 0x0, 0x1}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=@newsa={0x104, 0x1a, 0x7, 0x70bd2a, 0x0, {{@in6=@dev={0xfe, 0x80, '\x00', 0x1b}, @in=@multicast1, 0x3, 0x0, 0x4e22, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x5a, 0xb400, 0x2, 0xfeffff7f00000001, 0x0, 0x60000}, {0x0, 0x200000, 0x7, 0xfffffffffffffffd}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x104}}, 0x0) 3.233581611s ago: executing program 0 (id=68): r0 = syz_usb_connect(0x5, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000092ecc620ac0500773aeb010203010902240001000020000904c40102fffd0180090502021002020000090582020002"], 0x0) syz_usb_control_io$uac1(r0, &(0x7f0000000000)={0x14, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0003060000000603"]}, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000340)={0x1c, &(0x7f0000000080)=ANY=[@ANYBLOB="196406"], 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x50, &(0x7f0000000040)=ANY=[]) 3.135316084s ago: executing program 2 (id=74): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="00220f000000540b4550182195f57584b3"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCSUSAGE(r1, 0x4018480c, 0x0) 2.08389551s ago: executing program 3 (id=88): r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x298}) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) ioctl$UFFDIO_WRITEPROTECT(r0, 0xc018aa06, &(0x7f0000000000)={{&(0x7f0000e27000/0x4000)=nil, 0x4000}, 0xdd12b6ecfebc4ecc}) 2.070242179s ago: executing program 3 (id=89): mremap(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0x1000, 0x3, &(0x7f0000007000/0x1000)=nil) r0 = userfaultfd(0x80801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x100}) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f00000001c0)={&(0x7f0000d2b000/0xf000)=nil, 0xf000}) 2.0564847s ago: executing program 3 (id=90): r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x1082) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x11012, r0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000002000), 0x2, 0x0) prctl$PR_SET_MM_AUXV(0x23, 0xc, 0x0, 0x0) ioctl$USBDEVFS_RESETEP(r0, 0x80045503, 0x0) 2.013968741s ago: executing program 3 (id=91): syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)={0x90, 0xfffffffffffffffe, 0x7, {0x5, 0x3, 0x2, 0x8, 0x3, 0x33e, {0x6, 0x638, 0x80, 0x8, 0xc7de, 0x7, 0x14f5a307, 0x7, 0x1, 0x0, 0x4, 0x0, 0x0, 0x7, 0x8}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000880)={0xe4, 0x0, 0x2, 0x301, 0x0, 0x0, {0x7, 0x0, 0x2}, [@CTA_EXPECT_NAT={0xd0, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x58, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}]}, @CTA_EXPECT_NAT_TUPLE={0x74, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @multicast1}}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x12}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}]}]}, 0xe4}}, 0x10) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f00000006c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) 1.996801381s ago: executing program 3 (id=92): r0 = socket$inet6(0xa, 0x3, 0xff) shutdown(r0, 0x1) connect$inet6(r0, &(0x7f0000000200)={0xa, 0xf3, 0x14, @mcast1, 0x9}, 0x1c) r1 = dup2(r0, r0) write$tun(r1, 0x0, 0x46) 1.964256133s ago: executing program 3 (id=93): r0 = syz_usb_connect(0x3, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="12010000b510f210950b2a7773820102030109022400010000000009042200028953950009050a02ff0300fa000905820250"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000300)={0x34, &(0x7f0000000180)={0x20, 0xf, 0x6, "3914d77f99dd"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f0000000600)=ANY=[@ANYBLOB="001606"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000680)={0x34, &(0x7f0000000200)={0x20, 0x13, 0x1, "f0"}, 0x0, 0x0, 0x0, 0x0, 0x0}) 417.21869ms ago: executing program 2 (id=95): removexattr(0x0, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000200)) 401.40432ms ago: executing program 2 (id=96): chdir(&(0x7f0000000000)='./cgroup\x00') r0 = socket$inet_udp(0x2, 0x2, 0x0) fstat(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) setreuid(r1, r1) mknod$loop(&(0x7f0000000180)='./file0\x00', 0x6000, 0x0) 331.174142ms ago: executing program 2 (id=97): mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000200), 0x80, 0x0) setxattr$security_capability(0x0, &(0x7f0000000280), 0x0, 0x0, 0x0) lsetxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000580), &(0x7f0000000040)=@v2={0x2000000, [{0xfffffffa, 0x3}, {0x2, 0x6}]}, 0x14, 0x1) lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000280)=ANY=[], 0x0, 0x0) 331.014412ms ago: executing program 2 (id=98): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/ipv4/ping_group_range\x00', 0x2, 0x0) read(r0, &(0x7f0000000200), 0x100) write(r0, &(0x7f00000002c0)="89718b", 0x3) 327.449602ms ago: executing program 2 (id=99): futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0xffffffff) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000040)={0x0, 0x989680}, &(0x7f0000048000), 0x0) syz_clone(0x920011, 0x0, 0x0, 0x0, 0x0, 0x0) exit(0xffff) 209.287855ms ago: executing program 0 (id=100): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0xf, {[@main=@item_012={0x0, 0x0, 0xb}, @main=@item_4={0x3, 0x0, 0x8, "62966124"}, @global=@item_012={0x1, 0x1, 0x8, "f5"}, @global=@item_012={0x1, 0x1, 0x7, "86"}, @main=@item_4={0x3, 0x0, 0xb, "4070f43f"}]}}, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGCOLLECTIONINDEX(r1, 0x40184810, &(0x7f00000002c0)={0x3, 0xffffffff, 0xfffffffe, 0xffff01c2, 0x2, 0xa}) 209.116575ms ago: executing program 1 (id=101): r0 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r0, &(0x7f0000000000), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000040)={'vcan0\x00', 0x0}) setsockopt$CAN_RAW_ERR_FILTER(r0, 0x65, 0x2, &(0x7f0000000680)=0x600000, 0x4) bind$can_raw(r0, &(0x7f0000000080)={0x1d, r1}, 0x10) 131.105067ms ago: executing program 1 (id=102): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) 63.139719ms ago: executing program 1 (id=103): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f0000000800)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private0={0xfc, 0x0, '\x00', 0x1}, 0x0, 0x6, 0x0, 0x80, 0x6, 0x29a000d, r1}) 46.814329ms ago: executing program 1 (id=104): munmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000) r0 = userfaultfd(0x80801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x100}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) ioctl$UFFDIO_MOVE(r0, 0xc028aa05, &(0x7f0000000080)={&(0x7f0000189000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x2000}) 589.07µs ago: executing program 1 (id=105): creat(&(0x7f00000000c0)='./file0\x00', 0xdafbe5d6891b6e4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x13e) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') lchown(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) 0s ago: executing program 1 (id=106): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f0000424000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) madvise(&(0x7f0000000000/0x400000)=nil, 0x40001e, 0x15) kernel console output (not intermixed with test programs): cess permissive=1 [ 21.979505][ T36] audit: type=1400 audit(1786392732.920:63): avc: denied { siginh } for pid=275 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.175' (ED25519) to the list of known hosts. [ 30.152513][ T36] audit: type=1400 audit(1786392741.100:64): avc: denied { mounton } for pid=287 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 30.156022][ T287] cgroup: Unknown subsys name 'net' [ 30.176404][ T36] audit: type=1400 audit(1786392741.100:65): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 30.202601][ T36] audit: type=1400 audit(1786392741.130:66): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 30.203135][ T287] cgroup: Unknown subsys name 'devices' [ 30.311702][ T287] cgroup: Unknown subsys name 'hugetlb' [ 30.317383][ T287] cgroup: Unknown subsys name 'rlimit' [ 30.412941][ T36] audit: type=1400 audit(1786392741.360:67): avc: denied { setattr } for pid=287 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 30.436263][ T36] audit: type=1400 audit(1786392741.360:68): avc: denied { mounton } for pid=287 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 30.461109][ T36] audit: type=1400 audit(1786392741.360:69): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 30.485622][ T289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 30.494492][ T36] audit: type=1400 audit(1786392741.440:70): avc: denied { relabelto } for pid=289 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.520185][ T36] audit: type=1400 audit(1786392741.440:71): avc: denied { write } for pid=289 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.556542][ T36] audit: type=1400 audit(1786392741.500:72): avc: denied { read } for pid=287 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.582442][ T36] audit: type=1400 audit(1786392741.500:73): avc: denied { open } for pid=287 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.583202][ T287] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 31.459981][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.467103][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.474558][ T297] bridge_slave_0: entered allmulticast mode [ 31.481161][ T297] bridge_slave_0: entered promiscuous mode [ 31.487851][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.494978][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.502328][ T297] bridge_slave_1: entered allmulticast mode [ 31.508618][ T297] bridge_slave_1: entered promiscuous mode [ 31.578695][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.585936][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.593441][ T295] bridge_slave_0: entered allmulticast mode [ 31.599793][ T295] bridge_slave_0: entered promiscuous mode [ 31.609834][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.617090][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.624236][ T295] bridge_slave_1: entered allmulticast mode [ 31.630733][ T295] bridge_slave_1: entered promiscuous mode [ 31.638934][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.646089][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.653302][ T294] bridge_slave_0: entered allmulticast mode [ 31.659703][ T294] bridge_slave_0: entered promiscuous mode [ 31.668961][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.676113][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.683287][ T294] bridge_slave_1: entered allmulticast mode [ 31.689728][ T294] bridge_slave_1: entered promiscuous mode [ 31.743867][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.751058][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.758232][ T296] bridge_slave_0: entered allmulticast mode [ 31.764698][ T296] bridge_slave_0: entered promiscuous mode [ 31.787840][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.795037][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.802181][ T296] bridge_slave_1: entered allmulticast mode [ 31.808450][ T296] bridge_slave_1: entered promiscuous mode [ 31.868222][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.875804][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.883274][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.890340][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.944218][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.951589][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.959101][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.966266][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.997905][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.005022][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.012448][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.019603][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.045289][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.052404][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.059780][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.066842][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.077624][ T44] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.085116][ T44] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.093102][ T44] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.100671][ T44] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.108058][ T44] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.115532][ T44] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.123728][ T44] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.131140][ T44] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.150141][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.157320][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.165415][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.172514][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.189331][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.196429][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.204052][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.211138][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.234898][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.242127][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.249870][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.256997][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.283349][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.290553][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.298408][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.306069][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.347471][ T294] veth0_vlan: entered promiscuous mode [ 32.374603][ T295] veth0_vlan: entered promiscuous mode [ 32.387259][ T294] veth1_macvtap: entered promiscuous mode [ 32.396553][ T297] veth0_vlan: entered promiscuous mode [ 32.410543][ T296] veth0_vlan: entered promiscuous mode [ 32.426146][ T296] veth1_macvtap: entered promiscuous mode [ 32.441863][ T295] veth1_macvtap: entered promiscuous mode [ 32.466927][ T297] veth1_macvtap: entered promiscuous mode [ 32.474726][ T294] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 32.552076][ T317] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 32.669653][ T319] usb usb8: check_ctrlrecip: process 319 (syz.2.3) requesting ep 01 but needs 81 [ 32.679446][ T319] usb usb8: usbfs: process 319 (syz.2.3) did not claim interface 0 before use [ 32.833117][ T350] veth0: entered allmulticast mode [ 32.859331][ T311] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 32.999457][ T312] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 33.030547][ T311] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 33.041712][ T311] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 33.052290][ T311] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 33.061747][ T311] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.071841][ T311] usb 2-1: config 0 descriptor?? [ 33.149266][ T312] usb 4-1: Using ep0 maxpacket: 16 [ 33.155886][ T312] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 33.164257][ T312] usb 4-1: config 0 has no interface number 0 [ 33.170963][ T312] usb 4-1: New USB device found, idVendor=28bd, idProduct=0071, bcdDevice= 0.00 [ 33.180455][ T312] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.189972][ T312] usb 4-1: config 0 descriptor?? [ 33.312898][ T381] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 33.364874][ T384] netlink: 'syz.0.33': attribute type 9 has an invalid length. [ 33.484995][ T311] keytouch 0003:0926:3333.0001: fixing up Keytouch IEC report descriptor [ 33.495785][ T311] input: HID 0926:3333 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0926:3333.0001/input/input4 [ 33.588672][ T311] keytouch 0003:0926:3333.0001: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.1-1/input0 [ 33.708185][ T9] usb 2-1: USB disconnect, device number 2 [ 33.721560][ T409] fido_id[409]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 33.810788][ T312] uclogic 0003:28BD:0071.0002: failed retrieving string descriptor #100: -71 [ 33.830009][ T312] uclogic 0003:28BD:0071.0002: failed retrieving pen parameters: -71 [ 33.838177][ T312] uclogic 0003:28BD:0071.0002: pen probing failed: -71 [ 33.868076][ T312] uclogic 0003:28BD:0071.0002: failed probing parameters: -71 [ 33.881760][ T312] uclogic 0003:28BD:0071.0002: probe with driver uclogic failed with error -71 [ 33.903777][ T312] usb 4-1: USB disconnect, device number 2 [ 34.192467][ T457] device-mapper: ioctl: Invalid ioctl structure: name m, dev fc00 [ 34.401835][ T484] overlayfs: invalid origin (0000) [ 34.579142][ T63] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 34.730637][ T63] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 34.741913][ T63] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 34.752439][ T63] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 34.765601][ T63] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 34.774746][ T63] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.788723][ T63] usb 3-1: config 0 descriptor?? [ 34.806814][ T506] syz.1.87 uses obsolete (PF_INET,SOCK_PACKET) [ 35.197889][ T63] plantronics 0003:047F:FFFF.0003: No inputs registered, leaving [ 35.207637][ T63] plantronics 0003:047F:FFFF.0003: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 35.390221][ T36] kauditd_printk_skb: 123 callbacks suppressed [ 35.390240][ T36] audit: type=1400 audit(1786392746.340:197): avc: denied { map } for pid=513 comm="syz.3.90" path="/dev/bus/usb/006/001" dev="devtmpfs" ino=111 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 35.449496][ T36] audit: type=1400 audit(1786392746.400:198): avc: denied { shutdown } for pid=517 comm="syz.3.92" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 35.719139][ T63] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 35.869179][ T63] usb 4-1: Using ep0 maxpacket: 16 [ 35.876225][ T63] usb 4-1: config 0 has an invalid interface number: 34 but max is 0 [ 35.884432][ T63] usb 4-1: config 0 has no interface number 0 [ 35.890739][ T63] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 35.899197][ T312] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 35.900972][ T63] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 35.920200][ T63] usb 4-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 35.930102][ T63] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.939599][ T63] usb 4-1: Product: syz [ 35.944955][ T63] usb 4-1: Manufacturer: syz [ 35.950781][ T63] usb 4-1: SerialNumber: syz [ 35.956654][ T63] usb 4-1: config 0 descriptor?? [ 35.962672][ T520] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 35.971416][ T520] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 36.050278][ T312] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 36.060754][ T312] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 36.072566][ T312] usb 2-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 36.081791][ T312] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.090158][ T312] usb 2-1: Product: syz [ 36.094397][ T312] usb 2-1: Manufacturer: syz [ 36.099056][ T312] usb 2-1: SerialNumber: syz [ 36.181405][ T520] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 36.188674][ T520] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 36.307625][ T312] usblp 2-1:1.0: usblp0: USB Bidirectional printer dev 3 if 0 alt 0 proto 2 vid 0x0711 pid 0x0900 [ 36.396927][ T63] asix 4-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 36.508434][ T36] audit: type=1400 audit(1786392747.450:199): avc: denied { read write } for pid=522 comm="syz.1.94" name="lp0" dev="devtmpfs" ino=455 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 36.532064][ T36] audit: type=1400 audit(1786392747.450:200): avc: denied { open } for pid=522 comm="syz.1.94" path="/dev/usb/lp0" dev="devtmpfs" ino=455 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 36.711355][ T312] usb 2-1: USB disconnect, device number 3 [ 36.718487][ T312] usblp0: removed [ 36.998383][ T63] asix 4-1:0.34 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 37.008768][ T63] asix 4-1:0.34 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x0080: ffffffb9 [ 37.039145][ T63] asix 4-1:0.34: probe with driver asix failed with error -71 [ 37.051550][ T63] usb 4-1: USB disconnect, device number 3 [ 37.073469][ T36] audit: type=1400 audit(1786392748.020:201): avc: denied { setattr } for pid=529 comm="syz.2.97" name="/" dev="incremental-fs" ino=227 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 37.242135][ T36] audit: type=1400 audit(1786392748.190:202): avc: denied { bind } for pid=538 comm="syz.1.101" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 37.269610][ T9] usb 3-1: USB disconnect, device number 2 [ 37.414095][ T36] audit: type=1400 audit(1786392748.360:203): avc: denied { setattr } for pid=548 comm="syz.1.105" name="file0" dev="incremental-fs" ino=116 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 37.439064][ T297] ------------[ cut here ]------------ [ 37.444581][ T297] WARNING: CPU: 1 PID: 297 at fs/inode.c:340 drop_nlink+0xce/0x110 [ 37.452763][ T297] Modules linked in: [ 37.456717][ T297] CPU: 1 UID: 0 PID: 297 Comm: syz-executor Not tainted syzkaller #0 c3f4dbd045f6512adf9f342f5895bf9281952f81 [ 37.468420][ T297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 37.478546][ T297] RIP: 0010:drop_nlink+0xce/0x110 [ 37.483670][ T297] Code: 04 00 00 be 08 00 00 00 e8 5f 13 ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 d2 4b 95 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c [ 37.503383][ T297] RSP: 0018:ffffc9000b65fc88 EFLAGS: 00010293 [ 37.509562][ T297] RAX: ffffffff81f225ee RBX: ffff888119248b98 RCX: ffff888123bc3900 [ 37.517598][ T297] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 37.525698][ T297] RBP: ffffc9000b65fcb0 R08: 0000000000000003 R09: 0000000000000004 [ 37.533983][ T297] R10: dffffc0000000000 R11: fffff520016cbf80 R12: dffffc0000000000 [ 37.542225][ T297] R13: 1ffff1102324917c R14: ffff888119248be0 R15: 0000000000000000 [ 37.550411][ T297] FS: 000055558aad7500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 37.559449][ T297] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.566085][ T297] CR2: 000055558aafa958 CR3: 000000012a3b6000 CR4: 00000000003526b0 [ 37.574124][ T297] Call Trace: [ 37.577476][ T297] [ 37.580554][ T297] shmem_rmdir+0x5f/0x90 [ 37.584844][ T297] vfs_rmdir+0x3de/0x560 [ 37.589177][ T297] incfs_kill_sb+0x102/0x220 [ 37.593811][ T297] deactivate_locked_super+0xd5/0x270 [ 37.599262][ T297] deactivate_super+0xb8/0xe0 [ 37.603990][ T297] cleanup_mnt+0x438/0x4d0 [ 37.608454][ T297] __cleanup_mnt+0x1d/0x40 [ 37.613220][ T297] task_work_run+0x1e8/0x260 [ 37.617880][ T297] ? __cfi_task_work_run+0x10/0x10 [ 37.623134][ T297] ? __x64_sys_umount+0x12e/0x180 [ 37.628307][ T297] ? __cfi___x64_sys_umount+0x10/0x10 [ 37.633767][ T297] ? __kasan_check_read+0x15/0x20 [ 37.639132][ T297] resume_user_mode_work+0x35/0x50 [ 37.644289][ T297] syscall_exit_to_user_mode+0x63/0xb0 [ 37.649845][ T297] do_syscall_64+0x63/0xf0 [ 37.654314][ T297] ? clear_bhb_loop+0x50/0xa0 [ 37.659119][ T297] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 37.665087][ T297] RIP: 0033:0x7fe63639f317 [ 37.669569][ T297] Code: a2 c7 05 dc 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 37.689471][ T297] RSP: 002b:00007ffc9ae35828 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 37.697939][ T297] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fe63639f317 [ 37.706030][ T297] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc9ae358e0 [ 37.714080][ T297] RBP: 00007ffc9ae358e0 R08: 00007ffc9ae368e0 R09: 00000000ffffffff [ 37.722503][ T297] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc9ae36970 [ 37.730529][ T297] R13: 00007fe636434474 R14: 0000000000009220 R15: 00007ffc9ae369b0 [ 37.738536][ T297] [ 37.741642][ T297] ---[ end trace 0000000000000000 ]--- [ 37.747248][ T297] ================================================================== [ 37.755362][ T297] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 [ 37.761636][ T297] Write of size 4 at addr 0000000000000168 by task syz-executor/297 [ 37.769635][ T297] [ 37.771968][ T297] CPU: 0 UID: 0 PID: 297 Comm: syz-executor Tainted: G W syzkaller #0 c3f4dbd045f6512adf9f342f5895bf9281952f81 [ 37.771993][ T297] Tainted: [W]=WARN [ 37.771999][ T297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 37.772008][ T297] Call Trace: [ 37.772014][ T297] [ 37.772020][ T297] __dump_stack+0x21/0x30 [ 37.772046][ T297] dump_stack_lvl+0x140/0x1c0 [ 37.772068][ T297] ? __cfi_dump_stack_lvl+0x10/0x10 [ 37.772091][ T297] print_report+0x3d/0x70 [ 37.772115][ T297] kasan_report+0x162/0x1a0 [ 37.772136][ T297] ? ihold+0x24/0x70 [ 37.772154][ T297] ? ihold+0x24/0x70 [ 37.772172][ T297] kasan_check_range+0x25a/0x2b0 [ 37.772193][ T297] __kasan_check_write+0x18/0x20 [ 37.772208][ T297] ihold+0x24/0x70 [ 37.772226][ T297] vfs_rmdir+0x25c/0x560 [ 37.772248][ T297] incfs_kill_sb+0x102/0x220 [ 37.772266][ T297] deactivate_locked_super+0xd5/0x270 [ 37.772289][ T297] deactivate_super+0xb8/0xe0 [ 37.772310][ T297] cleanup_mnt+0x438/0x4d0 [ 37.772330][ T297] __cleanup_mnt+0x1d/0x40 [ 37.772348][ T297] task_work_run+0x1e8/0x260 [ 37.772368][ T297] ? __cfi_task_work_run+0x10/0x10 [ 37.772388][ T297] ? __x64_sys_umount+0x12e/0x180 [ 37.772402][ T297] ? __cfi___x64_sys_umount+0x10/0x10 [ 37.772416][ T297] ? __kasan_check_read+0x15/0x20 [ 37.772431][ T297] resume_user_mode_work+0x35/0x50 [ 37.772446][ T297] syscall_exit_to_user_mode+0x63/0xb0 [ 37.772467][ T297] do_syscall_64+0x63/0xf0 [ 37.772486][ T297] ? clear_bhb_loop+0x50/0xa0 [ 37.772508][ T297] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 37.772530][ T297] RIP: 0033:0x7fe63639f317 [ 37.772544][ T297] Code: a2 c7 05 dc 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 37.772557][ T297] RSP: 002b:00007ffc9ae35828 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 37.772573][ T297] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fe63639f317 [ 37.772584][ T297] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc9ae358e0 [ 37.772594][ T297] RBP: 00007ffc9ae358e0 R08: 00007ffc9ae368e0 R09: 00000000ffffffff [ 37.772606][ T297] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc9ae36970 [ 37.772616][ T297] R13: 00007fe636434474 R14: 0000000000009220 R15: 00007ffc9ae369b0 [ 37.772629][ T297] [ 37.772635][ T297] ================================================================== [ 38.016243][ T297] Disabling lock debugging due to kernel taint [ 38.022558][ T297] BUG: kernel NULL pointer dereference, address: 0000000000000168 [ 38.030406][ T297] #PF: supervisor write access in kernel mode [ 38.031262][ T36] audit: type=1400 audit(1786392748.970:204): avc: denied { read } for pid=93 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 38.036704][ T297] #PF: error_code(0x0002) - not-present page [ 38.064415][ T297] PGD 800000013208c067 P4D 800000013208c067 PUD 0 [ 38.070991][ T297] Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI [ 38.072843][ T36] audit: type=1400 audit(1786392748.970:205): avc: denied { search } for pid=93 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 38.077095][ T297] CPU: 0 UID: 0 PID: 297 Comm: syz-executor Tainted: G B W syzkaller #0 c3f4dbd045f6512adf9f342f5895bf9281952f81 [ 38.101512][ T36] audit: type=1400 audit(1786392748.970:206): avc: denied { write } for pid=93 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 38.111477][ T297] Tainted: [B]=BAD_PAGE, [W]=WARN [ 38.111487][ T297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 38.111501][ T297] RIP: 0010:ihold+0x2a/0x70 [ 38.152684][ T297] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 bd 42 95 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 1c 0a ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 cd [ 38.172327][ T297] RSP: 0018:ffffc9000b65fcc8 EFLAGS: 00010246 [ 38.178408][ T297] RAX: ffff888123bc3900 RBX: 0000000000000000 RCX: ffff888123bc3900 [ 38.186474][ T297] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 38.194458][ T297] RBP: ffffc9000b65fcd8 R08: ffffffff88bb6947 R09: 1ffffffff1176d28 [ 38.202615][ T297] R10: dffffc0000000000 R11: fffffbfff1176d29 R12: 0000000000000000 [ 38.210947][ T297] R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 [ 38.219050][ T297] FS: 000055558aad7500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 38.228706][ T297] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 38.235396][ T297] CR2: 0000000000000168 CR3: 000000012a3b6000 CR4: 00000000003526b0 [ 38.243566][ T297] Call Trace: [ 38.247299][ T297] [ 38.250521][ T297] vfs_rmdir+0x25c/0x560 [ 38.254783][ T297] incfs_kill_sb+0x102/0x220 [ 38.259386][ T297] deactivate_locked_super+0xd5/0x270 [ 38.264827][ T297] deactivate_super+0xb8/0xe0 [ 38.269527][ T297] cleanup_mnt+0x438/0x4d0 [ 38.273962][ T297] __cleanup_mnt+0x1d/0x40 [ 38.278393][ T297] task_work_run+0x1e8/0x260 [ 38.283015][ T297] ? __cfi_task_work_run+0x10/0x10 [ 38.288139][ T297] ? __x64_sys_umount+0x12e/0x180 [ 38.293168][ T297] ? __cfi___x64_sys_umount+0x10/0x10 [ 38.298562][ T297] ? __kasan_check_read+0x15/0x20 [ 38.303592][ T297] resume_user_mode_work+0x35/0x50 [ 38.308712][ T297] syscall_exit_to_user_mode+0x63/0xb0 [ 38.314174][ T297] do_syscall_64+0x63/0xf0 [ 38.318603][ T297] ? clear_bhb_loop+0x50/0xa0 [ 38.323304][ T297] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 38.329232][ T297] RIP: 0033:0x7fe63639f317 [ 38.333682][ T297] Code: a2 c7 05 dc 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 38.353498][ T297] RSP: 002b:00007ffc9ae35828 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 38.362114][ T297] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fe63639f317 [ 38.370270][ T297] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc9ae358e0 [ 38.378243][ T297] RBP: 00007ffc9ae358e0 R08: 00007ffc9ae368e0 R09: 00000000ffffffff [ 38.386239][ T297] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc9ae36970 [ 38.394242][ T297] R13: 00007fe636434474 R14: 0000000000009220 R15: 00007ffc9ae369b0 [ 38.402226][ T297] [ 38.405252][ T297] Modules linked in: [ 38.409160][ T297] CR2: 0000000000000168 [ 38.413316][ T297] ---[ end trace 0000000000000000 ]--- [ 38.418778][ T297] RIP: 0010:ihold+0x2a/0x70 [ 38.423296][ T297] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 bd 42 95 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 1c 0a ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 cd [ 38.442912][ T297] RSP: 0018:ffffc9000b65fcc8 EFLAGS: 00010246 [ 38.448984][ T297] RAX: ffff888123bc3900 RBX: 0000000000000000 RCX: ffff888123bc3900 [ 38.456974][ T297] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 38.465218][ T297] RBP: ffffc9000b65fcd8 R08: ffffffff88bb6947 R09: 1ffffffff1176d28 [ 38.473469][ T297] R10: dffffc0000000000 R11: fffffbfff1176d29 R12: 0000000000000000 [ 38.481465][ T297] R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 [ 38.489460][ T297] FS: 000055558aad7500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 38.498683][ T297] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 38.505331][ T297] CR2: 0000000000000168 CR3: 000000012a3b6000 CR4: 00000000003526b0 [ 38.513441][ T297] Kernel panic - not syncing: Fatal exception [ 38.520317][ T297] Kernel Offset: disabled [ 38.524666][ T297] Rebooting in 86400 seconds..