last executing test programs: 1.889690311s ago: executing program 3 (id=542): rt_sigaction(0xd, &(0x7f0000000180)={0x0, 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r2, 0x0, 0x0, 0x805, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r3, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) r4 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(r5, 0x0) 1.814672249s ago: executing program 3 (id=544): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32=r0, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x8000) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r3, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000d00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="24000000000000000100000001", @ANYRES32, @ANYRES64, @ANYBLOB="2bd5bb48db59834b9328618036678ec4c6dac89cb841b8b4c8fd04de9f9a66cd495d5a1a543b82ba037c0c6e2fa0b40f4a5b546d90c1166fdd8b667154295b2d4a8097ec97e036e379d59aabd828b8f161c5fa95c5f4965b19d5b1198519c62a8c9a5e881822c07f3fd885ebf2c5f9dbb86654f0ce2bba773c64c3dd907d6f2443419a86b521da094260c5c326d9a0b9394be9c3230a8e7da852a30998bc476ae51f7d3896d507299d2f4ea3110377b9c3fd92ab6ab97f199b667aef67538172"], 0xf0, 0x1}}], 0x1, 0x44015) r4 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r4, 0x29, 0x2a, &(0x7f00000001c0)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r4, 0x29, 0x30, &(0x7f00000007c0)=ANY=[@ANYBLOB="01000000000000000a0000000000ff00ff010000000000000000000000000001000001000000000000000000ffff00000000000000bd0000000000000000000000e4ec01000000004000000000fc00000000000000000000000000013da51fd47aa2e2f700000000000000000000000000000000000000000000000000000000000000060000000000000000050000000a004e200e8a34c38f36f0c7eb2700d609bcf41076d88144448ebe7994dd1b33d7c8787734cc315672f62261ceeede940774fd94d2767288cfb3a20882449d601ff878eedd3d57c9eb3a723b62102bd534c8a304a975d752e82cc8d5f969771c94a1d69cfd8694e29b9468fca5df65ece31ed7c209325604001fcd06adc3ac391f60a3523d6d0b4a8a"], 0x310) setsockopt$inet6_group_source_req(r4, 0x29, 0x2c, &(0x7f00000005c0)={0x1, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @empty}}}, 0x108) 1.813771719s ago: executing program 3 (id=546): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x1]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x0, 0x0}) 1.730141617s ago: executing program 3 (id=547): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f00000000c0)) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r0, @ANYRES64], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r0, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r1, 0x0, 0x0, 0x805, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r2, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}], 0x1, 0x8014) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r3, 0x11b, 0x3, &(0x7f00000003c0)=0x800, 0x4) 1.727408427s ago: executing program 4 (id=548): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r2, 0x0, 0x0, 0x805, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r3, &(0x7f0000000440), 0x0, 0x8014) sendmmsg$inet6(r3, &(0x7f00000075c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40804) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r4, &(0x7f00000009c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.time_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5f114b64, 0x11, r5, 0x0) 1.673867022s ago: executing program 4 (id=549): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, 0x0, 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r0, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r1, 0x0, 0x0, 0x805, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r2, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}], 0x1, 0x8014) sendmmsg$inet6(r2, &(0x7f00000075c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40804) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000300)=0x1, 0x4) 1.577438622s ago: executing program 4 (id=550): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r0, @ANYRES64], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r0, 0x0) ioctl$KVM_X86_SETUP_MCE(r0, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r1 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r1, 0x0, 0x0, 0x805, 0x0, 0x0) sendto$inet(r1, 0x0, 0x0, 0x80, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r3, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r4 = gettid() process_vm_writev(r4, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0xf7}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) madvise(&(0x7f000042f000/0x800000)=nil, 0x800000, 0x15) 1.420647268s ago: executing program 2 (id=551): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x5c000004, 0x0, {[0x8000000002]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r1, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r2, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f00000002c0)={'wg2\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)={0x48, r5, 0x5, 0x70bd2a, 0x25dfdbfd, {}, [@WGDEVICE_A_PEERS={0x2c, 0x8, 0x0, 0x1, [{0x28, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24, 0x1, @b_g}]}]}, @WGDEVICE_A_IFINDEX={0x8, 0x1, r6}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x40) 999.71595ms ago: executing program 2 (id=555): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r0, @ANYRES64], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r0, 0x0) ioctl$KVM_X86_SETUP_MCE(r0, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r1 = dup(0xffffffffffffffff) sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x4004}, 0x10000) syslog(0xa, 0x0, 0x0) 930.242817ms ago: executing program 2 (id=556): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r2, 0x0, 0x0, 0x805, 0x0, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000a00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="b00000000000000029000000360000006712000000000000040103061c8b5ad07e70126777779300ce2e0cea2b880000000000000000000000c2040000cd160401040401070502000404010f072000000003060c0600040000000000000072090000000000000000000000000000c910fe80000000000000000000000000001f0728000000010806feff02000000000000000800000000000000ff07000000660000010000000000000000000000130000010000000000002900000036"], 0x1b0}}], 0x1, 0x4) r3 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r3, 0x0, 0x0, 0xffe0) 903.45861ms ago: executing program 2 (id=559): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r2, 0x0, 0x0, 0x805, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r3, &(0x7f0000000440), 0x0, 0x8014) sendmmsg$inet6(r3, &(0x7f00000075c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40804) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r4, &(0x7f00000009c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.time_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5f114b64, 0x11, r5, 0x0) 839.345796ms ago: executing program 2 (id=563): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x1]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) 789.788831ms ago: executing program 2 (id=566): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmsg$TIPC_NL_NAME_TABLE_GET(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)={0xa0, 0x0, 0x200, 0x70bd25, 0x25dfdbfe, {}, [@TIPC_NLA_BEARER={0x24, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}, @TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x8001}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x4696}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xe5}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xfffffff7}]}, @TIPC_NLA_SOCK={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3}]}, @TIPC_NLA_BEARER={0x30, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffa44}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffff7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}]}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x810}, 0x4014000) sendmmsg$inet6(r2, &(0x7f0000003c00), 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000d000000000001"], 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x0) 754.176495ms ago: executing program 3 (id=567): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r2, 0x0, 0x0, 0x805, 0x0, 0x0) sendto$inet(r2, 0x0, 0x0, 0x80, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r3, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8], 0x118) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r4, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r5 = gettid() process_vm_writev(r5, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0xf7}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) madvise(&(0x7f000042f000/0x800000)=nil, 0x800000, 0x15) 544.846096ms ago: executing program 4 (id=575): mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cgroup.kill\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, 0x0) sendmmsg$inet6(r2, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000000)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) 492.472371ms ago: executing program 0 (id=578): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuacct.usage_sys\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r2, 0x0, 0x0, 0x805, 0x0, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="020100030e00000000000000fcdbdf2505000600001000000a004e2000000400fe800000000000000000000000000004000000000000000005000500320000000a004e2200000001fc0000000000000000000000000000000101000000000000010010"], 0x70}}, 0x0) 451.036075ms ago: executing program 0 (id=580): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, 0x0, 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r0, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r1, 0x0, 0x0, 0x805, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r2, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}], 0x1, 0x8014) sendmmsg$inet6(r2, &(0x7f00000075c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40804) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000300)=0x1, 0x4) 365.524794ms ago: executing program 0 (id=582): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000140)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000000)={0x3, 0x0, 0x0, 0x1, 0x7}, 0x4008000) 364.611304ms ago: executing program 0 (id=583): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x1]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x44, 0x0, 0x1, 0xfffffffc}]}) 337.442487ms ago: executing program 0 (id=584): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) ioctl$RTC_AIE_ON(r3, 0x7001) 285.115402ms ago: executing program 0 (id=585): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x5c000004, 0x0, {[0x8000000002]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r0, @ANYRES64], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r1, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r2, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f00000002c0)={'wg2\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)={0x48, r5, 0x5, 0x70bd2a, 0x25dfdbfd, {}, [@WGDEVICE_A_PEERS={0x2c, 0x8, 0x0, 0x1, [{0x28, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24, 0x1, @b_g}]}]}, @WGDEVICE_A_IFINDEX={0x8, 0x1, r6}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x40) 235.394667ms ago: executing program 1 (id=586): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r2, 0x0, 0x0, 0x805, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r3, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}], 0x1, 0x8014) sendmmsg$inet6(r3, 0x0, 0x0, 0x40804) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r4, &(0x7f00000009c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.time_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5f114b64, 0x11, r5, 0x0) 183.383862ms ago: executing program 1 (id=587): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(r0, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) utimensat(0xffffffffffffffff, 0x0, &(0x7f0000000880)={{0x0, 0xea60}, {0x0, 0x3ffffffe}}, 0x0) 179.573892ms ago: executing program 3 (id=588): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, 0x0) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r2, 0x0, 0x0, 0x805, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r3, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_buf(r4, 0x0, 0x20, &(0x7f0000000880)="66be8f037545cda1", 0x8) 100.542351ms ago: executing program 1 (id=589): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, 0x0, 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r0, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r1, 0x0, 0x0, 0x805, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r2, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}], 0x1, 0x8014) sendmmsg$inet6(r2, &(0x7f00000075c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40804) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r3, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) 99.5582ms ago: executing program 1 (id=590): mmap(&(0x7f0000ff4000/0xc000)=nil, 0xc000, 0x2000000, 0x20031, 0xffffffffffffffff, 0x2000) rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, 0x0, 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r0, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r1, 0x0, 0x0, 0x805, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r2, &(0x7f0000005800)=[{{0x0, 0x0, 0x0}}], 0x1, 0x8014) mlock2(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0) remap_file_pages(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x9, 0x10000) 85.955712ms ago: executing program 4 (id=591): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r3, &(0x7f0000000340)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r3, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) write(r2, 0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r4, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r5 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r5, 0x0, 0x0, 0x805, 0x0, 0x0) sendto$inet(r5, 0x0, 0x0, 0x80, 0x0, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r6, &(0x7f0000003c00), 0x0, 0x4) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r7, 0x0) 17.292109ms ago: executing program 1 (id=592): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuacct.usage_sys\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r2, 0x0, 0x0, 0x805, 0x0, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="020100030e00000000000000fcdbdf2505000600001000000a004e2000000400fe800000000000000000000000000004000000000000000005000500320000000a004e2200000001fc0000000000000000000000000000000101000000000000010010"], 0x70}}, 0x0) 3.71124ms ago: executing program 4 (id=593): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000340)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r0, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r1, 0x0, 0x0, 0x805, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r2, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}], 0x1, 0x8014) sendmmsg$inet6(r2, &(0x7f00000075c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40804) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000300)=0x1, 0x4) 0s ago: executing program 1 (id=594): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000140)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000000)={0x3, 0x0, &(0x7f0000000340)={0x0, 0x80}, 0x1, 0x7}, 0x4008000) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.147' (ED25519) to the list of known hosts. [ 22.149571][ T24] audit: type=1400 audit(1763219840.010:64): avc: denied { mounton } for pid=267 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.151263][ T267] cgroup: Unknown subsys name 'net' [ 22.172659][ T24] audit: type=1400 audit(1763219840.010:65): avc: denied { mount } for pid=267 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.200481][ T24] audit: type=1400 audit(1763219840.040:66): avc: denied { unmount } for pid=267 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.200930][ T267] cgroup: Unknown subsys name 'devices' [ 22.343536][ T267] cgroup: Unknown subsys name 'hugetlb' [ 22.349289][ T267] cgroup: Unknown subsys name 'rlimit' [ 22.550755][ T24] audit: type=1400 audit(1763219840.410:67): avc: denied { setattr } for pid=267 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.574267][ T24] audit: type=1400 audit(1763219840.410:68): avc: denied { mounton } for pid=267 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.581811][ T269] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.599496][ T24] audit: type=1400 audit(1763219840.410:69): avc: denied { mount } for pid=267 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 22.631239][ T24] audit: type=1400 audit(1763219840.480:70): avc: denied { relabelto } for pid=269 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.657149][ T24] audit: type=1400 audit(1763219840.480:71): avc: denied { write } for pid=269 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.690781][ T24] audit: type=1400 audit(1763219840.550:72): avc: denied { read } for pid=267 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.716607][ T24] audit: type=1400 audit(1763219840.550:73): avc: denied { open } for pid=267 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.743175][ T267] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 29.897135][ T24] kauditd_printk_skb: 1 callbacks suppressed [ 29.897147][ T24] audit: type=1400 audit(1763219847.760:75): avc: denied { read } for pid=276 comm="syz-executor" dev="nsfs" ino=4026531999 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 29.968589][ T24] audit: type=1400 audit(1763219847.770:76): avc: denied { open } for pid=275 comm="syz-executor" path="net:[4026531999]" dev="nsfs" ino=4026531999 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 30.009623][ T275] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.014190][ T24] audit: type=1400 audit(1763219847.770:77): avc: denied { mounton } for pid=275 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 30.016993][ T275] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.040283][ T24] audit: type=1400 audit(1763219847.770:78): avc: denied { module_request } for pid=275 comm="syz-executor" kmod="netdev-nr1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 30.045855][ T275] device bridge_slave_0 entered promiscuous mode [ 30.074911][ T275] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.082017][ T275] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.089345][ T275] device bridge_slave_1 entered promiscuous mode [ 30.151337][ T278] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.158730][ T278] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.166295][ T278] device bridge_slave_0 entered promiscuous mode [ 30.182520][ T278] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.189586][ T278] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.197214][ T278] device bridge_slave_1 entered promiscuous mode [ 30.262427][ T277] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.269494][ T277] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.276955][ T277] device bridge_slave_0 entered promiscuous mode [ 30.285195][ T276] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.292297][ T276] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.299832][ T276] device bridge_slave_0 entered promiscuous mode [ 30.307904][ T276] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.314993][ T276] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.322519][ T276] device bridge_slave_1 entered promiscuous mode [ 30.333574][ T277] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.340722][ T277] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.348187][ T277] device bridge_slave_1 entered promiscuous mode [ 30.361818][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.368882][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.376476][ T282] device bridge_slave_0 entered promiscuous mode [ 30.385361][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.392470][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.399968][ T282] device bridge_slave_1 entered promiscuous mode [ 30.451550][ T24] audit: type=1400 audit(1763219848.320:79): avc: denied { create } for pid=275 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 30.471989][ T24] audit: type=1400 audit(1763219848.320:80): avc: denied { write } for pid=275 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 30.485380][ T275] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.492508][ T24] audit: type=1400 audit(1763219848.320:81): avc: denied { read } for pid=275 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 30.499388][ T275] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.527015][ T275] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.534059][ T275] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.573564][ T277] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.580639][ T277] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.587946][ T277] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.595099][ T277] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.612254][ T278] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.619336][ T278] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.626651][ T278] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.633733][ T278] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.673611][ T48] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.680940][ T48] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.688475][ T48] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.695696][ T48] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.703494][ T48] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.710949][ T48] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.719072][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 30.726540][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 30.762779][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 30.770263][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 30.778143][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 30.786725][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.793779][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.801470][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 30.809632][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.816690][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.824231][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 30.832434][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.839457][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.846875][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 30.855035][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.862079][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.903167][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 30.913010][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 30.922246][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 30.930216][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 30.937962][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 30.945512][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 30.954004][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 30.962004][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 30.970126][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.977178][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.984555][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 30.992769][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.999891][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.008225][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 31.016212][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 31.024520][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.031680][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.039046][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 31.047474][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.054662][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.062439][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 31.070466][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 31.078966][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 31.091024][ T277] device veth0_vlan entered promiscuous mode [ 31.100933][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 31.109408][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 31.117649][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 31.127005][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 31.135179][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 31.143314][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 31.154787][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 31.162383][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 31.176440][ T278] device veth0_vlan entered promiscuous mode [ 31.192330][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 31.200789][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 31.209224][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 31.217644][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 31.226398][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 31.234661][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 31.242965][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 31.251485][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 31.259782][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.266856][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.274593][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 31.282105][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 31.289514][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 31.303346][ T277] device veth1_macvtap entered promiscuous mode [ 31.310341][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 31.318284][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 31.327044][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 31.335744][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.342813][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.350292][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 31.358846][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 31.367250][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 31.375698][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 31.394616][ T276] device veth0_vlan entered promiscuous mode [ 31.402744][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 31.410794][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 31.419823][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 31.428015][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 31.436256][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 31.443978][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 31.451702][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 31.459139][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 31.468856][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 31.477039][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 31.488150][ T278] device veth1_macvtap entered promiscuous mode [ 31.495614][ T275] device veth0_vlan entered promiscuous mode [ 31.503193][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 31.511829][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 31.519953][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 31.527802][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 31.536254][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 31.545372][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 31.553724][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 31.571801][ T276] device veth1_macvtap entered promiscuous mode [ 31.579248][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 31.587450][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 31.596031][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 31.604665][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 31.613167][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 31.620752][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 31.629032][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 31.637483][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 31.646176][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 31.662805][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 31.671316][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 31.685725][ T275] device veth1_macvtap entered promiscuous mode [ 31.696154][ T24] audit: type=1400 audit(1763219849.560:82): avc: denied { mounton } for pid=277 comm="syz-executor" path="/root/syzkaller.uWnfJM/syz-tmp" dev="sda1" ino=2041 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 31.721028][ T24] audit: type=1400 audit(1763219849.560:83): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 31.745121][ T277] request_module fs-gadgetfs succeeded, but still no fs? [ 31.748642][ T24] audit: type=1400 audit(1763219849.560:84): avc: denied { mounton } for pid=277 comm="syz-executor" path="/root/syzkaller.uWnfJM/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 31.778969][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 31.787425][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 31.795583][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 31.803542][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 31.811802][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 31.822784][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 31.831490][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 31.845684][ T277] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 31.850184][ T282] device veth0_vlan entered promiscuous mode [ 31.876818][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 31.885285][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 31.893769][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 31.903272][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 31.912095][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 31.920426][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 31.930521][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 31.944696][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 31.983666][ T279] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 31.995934][ T279] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 32.008029][ T282] device veth1_macvtap entered promiscuous mode [ 32.046787][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 32.071995][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 32.082022][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 32.102522][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 32.131871][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 33.395325][ T381] mmap: syz.2.41 (381) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 34.927852][ T24] kauditd_printk_skb: 38 callbacks suppressed [ 34.927865][ T24] audit: type=1326 audit(1763219852.790:123): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=550 comm="syz.2.125" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f431e4256c9 code=0x0 [ 35.912090][ T637] process 'syz.3.169' launched './file1' with NULL argv: empty string added [ 35.935329][ T24] audit: type=1400 audit(1763219853.800:124): avc: denied { execute_no_trans } for pid=634 comm="syz.3.169" path="/25/file1" dev="tmpfs" ino=180 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 36.021209][ T24] audit: type=1326 audit(1763219853.860:125): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=640 comm="syz.2.173" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f431e4256c9 code=0x0 [ 36.136307][ T24] audit: type=1400 audit(1763219854.000:126): avc: denied { create } for pid=652 comm="syz.3.178" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 36.186307][ T24] audit: type=1400 audit(1763219854.020:127): avc: denied { bind } for pid=652 comm="syz.3.178" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 38.735332][ T24] audit: type=1400 audit(1763219856.600:128): avc: denied { create } for pid=836 comm="syz.3.267" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 38.782189][ T24] audit: type=1400 audit(1763219856.620:129): avc: denied { setopt } for pid=836 comm="syz.3.267" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 47.094238][ T1007] Zero length message leads to an empty skb [ 47.183919][ T1019] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=65535 sclass=netlink_xfrm_socket pid=1019 comm=syz.4.356 [ 47.249783][ T24] audit: type=1326 audit(1763219865.110:130): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1022 comm="syz.2.358" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f431e4256c9 code=0x0 [ 47.500108][ T24] audit: type=1326 audit(1763219865.360:131): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1050 comm="syz.2.372" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f431e4256c9 code=0x0 [ 48.008933][ T1103] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=118 sclass=netlink_route_socket pid=1103 comm=syz.3.399 [ 48.263743][ T24] audit: type=1326 audit(1763219866.130:132): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1130 comm="syz.0.387" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f4ed4b736c9 code=0x0 [ 48.504148][ T24] audit: type=1326 audit(1763219866.370:133): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1157 comm="syz.4.426" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f18988886c9 code=0x0 [ 48.630385][ T24] audit: type=1400 audit(1763219866.490:134): avc: denied { read } for pid=1179 comm="syz.2.435" name="binder1" dev="binder" ino=5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 48.674282][ T24] audit: type=1400 audit(1763219866.490:135): avc: denied { open } for pid=1179 comm="syz.2.435" path="/dev/binderfs/binder1" dev="binder" ino=5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 48.779742][ T24] audit: type=1400 audit(1763219866.530:136): avc: denied { map } for pid=1179 comm="syz.2.435" path="/dev/binderfs/binder1" dev="binder" ino=5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 48.871825][ T24] audit: type=1400 audit(1763219866.530:137): avc: denied { ioctl } for pid=1179 comm="syz.2.435" path="/dev/binderfs/binder1" dev="binder" ino=5 ioctlcmd=0x6201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 48.907061][ T24] audit: type=1400 audit(1763219866.580:138): avc: denied { create } for pid=1183 comm="syz.2.438" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 48.959290][ T24] audit: type=1400 audit(1763219866.580:139): avc: denied { getopt } for pid=1183 comm="syz.2.438" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 49.160694][ T1255] mmap: syz.2.474 (1255): VmData 40833024 exceed data ulimit 68. Update limits or use boot option ignore_rlimit_data. [ 49.499982][ T1318] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 51.253329][ T1448] incfs: Unexpected inode type [ 51.271403][ T277] ------------[ cut here ]------------ [ 51.309698][ T277] WARNING: CPU: 0 PID: 277 at fs/inode.c:304 drop_nlink+0xc5/0x110 [ 51.331469][ T277] Modules linked in: [ 51.335474][ T277] CPU: 0 PID: 277 Comm: syz-executor Not tainted syzkaller #0 [ 51.372151][ T277] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 51.388927][ T277] RIP: 0010:drop_nlink+0xc5/0x110 [ 51.408970][ T277] Code: 1b 48 8d bb b8 04 00 00 be 08 00 00 00 e8 93 22 f2 ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 bb 30 b8 ff <0f> 0b eb 86 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 5e ff ff ff 4c [ 51.438241][ T277] RSP: 0018:ffffc90000ba7cd0 EFLAGS: 00010293 [ 51.461501][ T277] RAX: ffffffff81ab74e5 RBX: ffff88811ec2c7a0 RCX: ffff888124124f00 [ 51.490910][ T277] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 51.521284][ T277] RBP: ffffc90000ba7cf8 R08: 0000000000000004 R09: 0000000000000003 [ 51.531584][ T277] R10: fffff52000174f88 R11: 1ffff92000174f88 R12: dffffc0000000000 [ 51.540011][ T277] R13: 1ffff11023d858fd R14: ffff88811ec2c7e8 R15: 0000000000000000 [ 51.584671][ T277] FS: 0000555587979500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 51.612439][ T277] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 51.619218][ T277] CR2: 00000000000000da CR3: 000000012505e000 CR4: 00000000003506b0 [ 51.657649][ T277] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 51.676637][ T277] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 51.704543][ T277] Call Trace: [ 51.711390][ T277] shmem_rmdir+0x5b/0x90 [ 51.728068][ T277] vfs_rmdir+0x1b3/0x3e0 [ 51.738140][ T277] incfs_kill_sb+0xfe/0x210 [ 51.744551][ T277] deactivate_locked_super+0xa0/0x100 [ 51.763859][ T277] deactivate_super+0xaf/0xe0 [ 51.768850][ T277] cleanup_mnt+0x446/0x500 [ 51.791904][ T277] __cleanup_mnt+0x19/0x20 [ 51.796379][ T277] task_work_run+0x127/0x190 [ 51.801098][ T277] exit_to_user_mode_loop+0xcb/0xe0 [ 51.830547][ T277] exit_to_user_mode_prepare+0x76/0xa0 [ 51.837503][ T277] syscall_exit_to_user_mode+0x1d/0x40 [ 51.851336][ T277] do_syscall_64+0x3d/0x40 [ 51.861473][ T277] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 51.871401][ T277] RIP: 0033:0x7f431e4269f7 [ 51.890126][ T277] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 51.943752][ T277] RSP: 002b:00007ffc1059cd78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 51.966581][ T277] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f431e4269f7 [ 51.985387][ T277] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc1059ce30 [ 52.017715][ T277] RBP: 00007ffc1059ce30 R08: 0000000000000000 R09: 0000000000000000 [ 52.050009][ T277] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffc1059dec0 [ 52.068474][ T277] R13: 00007f431e4a7d7d R14: 000000000000c827 R15: 00007ffc1059df00 [ 52.080836][ T277] ---[ end trace 1c93d1d0b73581d9 ]--- [ 52.096793][ T277] ================================================================== [ 52.104914][ T277] BUG: KASAN: null-ptr-deref in ihold+0x20/0x60 [ 52.111173][ T277] Write of size 4 at addr 0000000000000170 by task syz-executor/277 [ 52.119152][ T277] [ 52.121496][ T277] CPU: 0 PID: 277 Comm: syz-executor Tainted: G W syzkaller #0 [ 52.130367][ T277] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 52.140453][ T277] Call Trace: [ 52.143774][ T277] __dump_stack+0x21/0x24 [ 52.148215][ T277] dump_stack_lvl+0x169/0x1d8 [ 52.152919][ T277] ? thaw_kernel_threads+0x220/0x220 [ 52.158228][ T277] ? show_regs_print_info+0x18/0x18 [ 52.163460][ T277] ? _raw_spin_lock+0x8e/0xe0 [ 52.168173][ T277] ? _raw_spin_trylock_bh+0x130/0x130 [ 52.173568][ T277] ? ihold+0x20/0x60 [ 52.177670][ T277] kasan_report+0xd8/0x130 [ 52.182123][ T277] ? ihold+0x20/0x60 [ 52.186050][ T277] kasan_check_range+0x280/0x290 [ 52.191015][ T277] __kasan_check_write+0x14/0x20 [ 52.196097][ T277] ihold+0x20/0x60 [ 52.199846][ T277] vfs_rmdir+0x247/0x3e0 [ 52.204114][ T277] incfs_kill_sb+0xfe/0x210 [ 52.208736][ T277] deactivate_locked_super+0xa0/0x100 [ 52.214152][ T277] deactivate_super+0xaf/0xe0 [ 52.218854][ T277] cleanup_mnt+0x446/0x500 [ 52.223302][ T277] __cleanup_mnt+0x19/0x20 [ 52.227746][ T277] task_work_run+0x127/0x190 [ 52.232366][ T277] exit_to_user_mode_loop+0xcb/0xe0 [ 52.237642][ T277] exit_to_user_mode_prepare+0x76/0xa0 [ 52.243127][ T277] syscall_exit_to_user_mode+0x1d/0x40 [ 52.248909][ T277] do_syscall_64+0x3d/0x40 [ 52.253368][ T277] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 52.259288][ T277] RIP: 0033:0x7f431e4269f7 [ 52.263724][ T277] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 52.283710][ T277] RSP: 002b:00007ffc1059cd78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 52.292147][ T277] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f431e4269f7 [ 52.300139][ T277] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc1059ce30 [ 52.308136][ T277] RBP: 00007ffc1059ce30 R08: 0000000000000000 R09: 0000000000000000 [ 52.316296][ T277] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffc1059dec0 [ 52.325699][ T277] R13: 00007f431e4a7d7d R14: 000000000000c827 R15: 00007ffc1059df00 [ 52.333923][ T277] ================================================================== [ 52.342482][ T277] Disabling lock debugging due to kernel taint [ 52.481218][ T277] BUG: kernel NULL pointer dereference, address: 0000000000000170 [ 52.489220][ T277] #PF: supervisor write access in kernel mode [ 52.495395][ T277] #PF: error_code(0x0002) - not-present page [ 52.501391][ T277] PGD 127a1d067 P4D 127a1d067 PUD 0 [ 52.506721][ T277] Oops: 0002 [#1] PREEMPT SMP KASAN [ 52.511949][ T277] CPU: 1 PID: 277 Comm: syz-executor Tainted: G B W syzkaller #0 [ 52.520897][ T277] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 52.530996][ T277] RIP: 0010:ihold+0x26/0x60 [ 52.535523][ T277] Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 d1 28 b8 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 80 1a f2 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 51 [ 52.555355][ T277] RSP: 0018:ffffc90000ba7d10 EFLAGS: 00010246 [ 52.561452][ T277] RAX: ffff888124124f00 RBX: 0000000000000000 RCX: 0000000000000286 [ 52.569665][ T277] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff [ 52.577664][ T277] RBP: ffffc90000ba7d20 R08: 0000000000000004 R09: 0000000000000003 [ 52.585661][ T277] R10: fffffbfff0d8ee48 R11: 1ffffffff0d8ee48 R12: 1ffff110219b67e2 [ 52.593659][ T277] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 [ 52.601958][ T277] FS: 0000555587979500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 52.611086][ T277] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 52.617708][ T277] CR2: 0000000000000170 CR3: 000000012505e000 CR4: 00000000003506a0 [ 52.625709][ T277] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 52.633701][ T277] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 52.641799][ T277] Call Trace: [ 52.645292][ T277] vfs_rmdir+0x247/0x3e0 [ 52.649572][ T277] incfs_kill_sb+0xfe/0x210 [ 52.654103][ T277] deactivate_locked_super+0xa0/0x100 [ 52.659510][ T277] deactivate_super+0xaf/0xe0 [ 52.664220][ T277] cleanup_mnt+0x446/0x500 [ 52.668662][ T277] __cleanup_mnt+0x19/0x20 [ 52.673191][ T277] task_work_run+0x127/0x190 [ 52.678092][ T277] exit_to_user_mode_loop+0xcb/0xe0 [ 52.683350][ T277] exit_to_user_mode_prepare+0x76/0xa0 [ 52.688853][ T277] syscall_exit_to_user_mode+0x1d/0x40 [ 52.694338][ T277] do_syscall_64+0x3d/0x40 [ 52.698766][ T277] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 52.704804][ T277] RIP: 0033:0x7f431e4269f7 [ 52.709247][ T277] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 52.728964][ T277] RSP: 002b:00007ffc1059cd78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 52.737577][ T277] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f431e4269f7 [ 52.745845][ T277] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc1059ce30 [ 52.753933][ T277] RBP: 00007ffc1059ce30 R08: 0000000000000000 R09: 0000000000000000 [ 52.761927][ T277] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffc1059dec0 [ 52.769924][ T277] R13: 00007f431e4a7d7d R14: 000000000000c827 R15: 00007ffc1059df00 [ 52.777920][ T277] Modules linked in: [ 52.781831][ T277] CR2: 0000000000000170 [ 52.786014][ T277] ---[ end trace 1c93d1d0b73581da ]--- [ 52.791672][ T277] RIP: 0010:ihold+0x26/0x60 [ 52.796189][ T277] Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 d1 28 b8 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 80 1a f2 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 51 [ 52.815807][ T277] RSP: 0018:ffffc90000ba7d10 EFLAGS: 00010246 [ 52.821887][ T277] RAX: ffff888124124f00 RBX: 0000000000000000 RCX: 0000000000000286 [ 52.830125][ T277] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff [ 52.838156][ T277] RBP: ffffc90000ba7d20 R08: 0000000000000004 R09: 0000000000000003 [ 52.846157][ T277] R10: fffffbfff0d8ee48 R11: 1ffffffff0d8ee48 R12: 1ffff110219b67e2 [ 52.854233][ T277] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 [ 52.862230][ T277] FS: 0000555587979500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 52.871172][ T277] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 52.877768][ T277] CR2: 0000000000000170 CR3: 000000012505e000 CR4: 00000000003506a0 [ 52.885756][ T277] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 52.893848][ T277] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 52.901831][ T277] Kernel panic - not syncing: Fatal exception [ 52.908035][ T277] Kernel Offset: disabled [ 52.912364][ T277] Rebooting in 86400 seconds..