last executing test programs: 947.025985ms ago: executing program 1 (id=2): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f00000006c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x64}, {&(0x7f0000000280)=""/85, 0x55}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000000580)=""/106, 0x6a}, {0x0}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/141, 0x8d}, {&(0x7f00000001c0)=""/17, 0x11}], 0x8, &(0x7f0000000600)=""/191, 0xbf}, 0x5}], 0x1, 0x2000, &(0x7f0000003700)={0x77359400}) syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000") 911.207266ms ago: executing program 0 (id=1): r0 = socket(0x10, 0x803, 0x0) (async) r1 = syz_usb_connect$hid(0x4, 0x36, &(0x7f00000010c0)=ANY=[], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f00000003c0)={0x24, 0x0, 0x0, &(0x7f00000002c0)={0x0, 0x22, 0x7, {[@main=@item_012={0x1, 0x0, 0xa, "fc"}, @main=@item_4={0x3, 0x0, 0x9, "284e28b9"}]}}, 0x0}, 0x0) syz_usb_control_io(r1, &(0x7f0000002880)={0x2c, &(0x7f0000002540)={0x20, 0x2, 0xfb, {0xfb, 0x24, "bd23ed0290f415c606af5a639f7a0d3fe7aae07aabcabae3233bf15f55a59fea2e94b0c7205be29f80c12475dc7e8595b7ed46ae55336bf7794f2ae27fdca511ada7785db6c874cc8640dbed70a8d349f09ab1af228fa665dfbd74e9a5cf45c21faa2c89c7227ccddcc946f33e9263745496bd8c9bce54110d9a1d49fb2eb4c94b23a416fcf7122ff67cc5d7a24b10ea0aa79706b3a2d92ec46bda550791fed895dfd1719a51380423312c0e38f510db26f529e0d2e4bc7404707bb182fef01df377efa9bf3e0696b8ff1de7b7f1754355e9da2fc5c09019ada83f673b9331cf0a96ad032ecbec92b01690950dccee366f97a300f3df55a3e8"}}, &(0x7f0000002680)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x446}}, &(0x7f00000026c0)={0x0, 0xf, 0x131, {0x5, 0xf, 0x131, 0x5, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x2, 0x10, 0x3, 0xd8}, @generic={0xf3, 0x10, 0x2, "8845324a83d2d2eeb8f1f74399933a35e62815de4196daeeae3af5d72cf9e5fb67b66a9851d30e93d09ec98ef39a2706b70d6a1ad7faeb92ea2b530578496652cfbb0d3f762504fe9723157428079bb196d0cb7783acc553eb8d615a049824aff5318407b35560cfac3bd888186ac28248c46eb3cfa297bd9174f0b28dbac30931df72bb253df5430c4979fd80cb10e6efca37fd5fac4762a20d87192c5da05ea4a4dffb813d5512a15c3596fd579a8ca858177f8a1d0328ec31d31c490a956dace3d6b0f68f701cbe4cdf65696c54c604bf1de5638155462b56438501a70bf33fbaeb8185ed421c36638655e81d5f8b"}, @ssp_cap={0x10, 0x10, 0xa, 0x2, 0x1, 0xf, 0xff00, 0x1, [0x30]}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "89bf25af7d7b965dead0b80f3ed8081d"}, @wireless={0xb, 0x10, 0x1, 0xc, 0x8, 0x2, 0x4, 0xf57e, 0x4}]}}, &(0x7f0000002800)={0x20, 0x29, 0xf, {0xf, 0x29, 0x8, 0x60, 0x8, 0x9a, "e0ac524d", "c7794abc"}}, &(0x7f0000002840)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x6, 0x0, 0xbb, 0x0, 0x0, 0x3ff, 0x8}}}, &(0x7f0000002d00)={0x84, &(0x7f00000028c0)={0x40, 0x3, 0x67, "2cf9b5ec959f865041562581baa16d9784ba880dfb4ff5a674fd1cddc3e111480f86119a1cd0e578adbc2574453addee173cc340168f908e3b3c32697a2a87ddd7fc2feff2009ec51a27807acdd8c71fc956362f0f0329535d06d21627faedfe84dafa72c9b7e5"}, &(0x7f0000002940)={0x0, 0xa, 0x1, 0xf}, &(0x7f0000002980)={0x0, 0x8, 0x1, 0x5}, &(0x7f00000029c0)={0x20, 0x0, 0x4, {0x0, 0x1}}, &(0x7f0000002a00)={0x20, 0x0, 0x4, {0x1e0, 0x80}}, &(0x7f0000002a40)={0x40, 0x7, 0x2, 0xc9}, &(0x7f0000002a80)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000002ac0)={0x40, 0xb, 0x2, "c6da"}, &(0x7f0000002b00)={0x40, 0xf, 0x2, 0x2}, &(0x7f0000002b40)={0x40, 0x13, 0x6, @broadcast}, &(0x7f0000002b80)={0x40, 0x17, 0x6, @multicast}, &(0x7f0000002bc0)={0x40, 0x19, 0x2, "034e"}, &(0x7f0000002c00)={0x40, 0x1a, 0x2, 0x67}, &(0x7f0000002c40)={0x40, 0x1c, 0x1, 0x2}, &(0x7f0000002c80)={0x40, 0x1e, 0x1, 0x2}, &(0x7f0000002cc0)={0x40, 0x21, 0x1, 0x5}}) (async) sendto(r0, &(0x7f0000000140)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) (async) recvmmsg(r0, &(0x7f0000006a40)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000001440)=""/4112, 0x1010}, {&(0x7f0000000080)=""/105, 0x69}, {&(0x7f0000000300)=""/42, 0x2a}, {&(0x7f0000000340)=""/95, 0x5f}, {&(0x7f00000013c0)=""/75, 0x4b}, {&(0x7f00000003c0)=""/4084, 0xff4}], 0x6}, 0x8}, {{0x0, 0x0, 0x0}, 0x8000000}, {{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x8}], 0x4, 0x10040, 0x0) (async) mount(&(0x7f0000000040)=@filename='nodev\x00', 0x0, 0x0, 0x0, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) renameat2(0xffffffffffffffff, &(0x7f0000000100)='nodev\x00', 0xffffffffffffff9c, &(0x7f0000000180)='nodev\x00', 0x4) r3 = socket$inet_tcp(0x2, 0x1, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, &(0x7f0000002ec0)={0x14, &(0x7f0000002dc0)={0x40, 0x7, 0xb5, {0xb5, 0x1f, "425eeba7d4e31bc08cf98b1356608674d499df6cb1006942f66e338c19de3eeb7c24b55bf36d58af930d861a64afa99887ea4227814137d81213f1c127baa6405521ccb84f3922ed5ef2329cc3555ec71b892c82b7f8b02d47133f2150bd7dd167656f78e1d6c14c132c168431221c21bc679ae25b8bf00239d4a37eb4b34fd3e12e719ca3b74a12b0315c997ed655241e2e00a5060e3f44c88318328a41cfbb47e8b61a036aba560e35d8435a8f580044e522"}}, &(0x7f0000002e80)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000003100)={0x44, &(0x7f0000002f00)={0x40, 0x0, 0xb, "3e964b08e448c0f99c38bc"}, &(0x7f0000002f40)={0x0, 0xa, 0x1}, &(0x7f0000002f80)={0x0, 0x8, 0x1, 0x60}, &(0x7f0000002fc0)={0x20, 0x80, 0x1c, {0x0, 0x4, 0x6, 0x6, 0x9, 0x2401, 0x3, 0x1, 0x82, 0x81, 0x8, 0x3}}, &(0x7f00000001c0)={0x20, 0x85, 0x4, 0xf0}, &(0x7f0000003040)={0x20, 0x83, 0x2}, &(0x7f0000003080)={0x20, 0x87, 0xc2, 0x5}, &(0x7f00000030c0)={0x20, 0x89, 0x2}}) (async) close(r3) ioctl$RTC_ALM_READ(r2, 0x40187013, &(0x7f0000000040)) getresuid(&(0x7f0000002480), &(0x7f00000024c0), &(0x7f0000002500)) 905.267466ms ago: executing program 2 (id=3): unshare(0x64000600) timer_settime(0x0, 0x0, 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) r0 = socket$inet6(0x10, 0x2, 0x0) write(r0, &(0x7f0000000000)="fc0000001c000705ab092509b86813000aab080102000000b85b0e93210001c0f0060848050000010000000000039815fa2c53c28648000000b937799f377a00bc000c00f0036cdf0db400600033d44000040060b16a482c0a3c313012dafd5a32e273fc83ab82d710f74cec18444ef90d475ef8b2863ef3d92c94170e5bba2e177312e081f691bc5110556888100000463ae4f5df1b394cfd6239ec2a0f0d1bcae5f5502943283f4b9e611183b102b2b8f5566791cb19020191bd0733802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4794eedfca92c09d776e7a90ab79a6f00a1960548deac279c00"/252, 0xfc) 891.060687ms ago: executing program 3 (id=4): r0 = socket(0x10, 0x3, 0x0) sendto$inet6(r0, &(0x7f0000000100)="c10e000018001f06b9409b0dffff110d0207be040205060506100a0443000b0018000000fac8388827a685a168d9a44604094565360c648dcaaf6c26c291214549932fde4a460c89b6ec0cff3959547f509058ba86c902fc3a10004a320c0400160012000a00000000000000000000080756ede4ccbe5880", 0xec1, 0x0, 0x0, 0x9e5e111c47e3504f) bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfb, 0x10000000}, 0xc) r1 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1b96, 0x11, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, "", [{{0x9, 0x4, 0x0, 0x3, 0x1, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x1, 0xfc, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x420, 0x8, 0x81, 0x2}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000040)={0x2c, &(0x7f00000005c0)={0x20, 0x2, 0x28, {0x28, 0x21, "83efb930f0187ff047a22a61a54607b71ea9e442359c479c37f525cde38bf4fd6ef4366b4800"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000540), 0x3c) 802.161949ms ago: executing program 2 (id=5): mount$9p_tcp(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x80000, &(0x7f00000000c0)={'trans=tcp,', {'port', 0x3d, 0x4e22}, 0x2c, {[{@cache_readahead}], [{@dont_measure}]}}) r0 = openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) splice(r0, &(0x7f0000000140)=0x7, r1, &(0x7f0000000180)=0xd374, 0x3, 0x3) r2 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x1) ioctl$TIOCMGET(r2, 0x5415, &(0x7f00000001c0)) ioctl$TIOCVHANGUP(r2, 0x5437, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000200), 0x10080, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000240)={{{@in=@private, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@loopback}}, &(0x7f0000000340)=0xe8) quotactl_fd$Q_GETINFO(r1, 0xffffffff80000501, r4, &(0x7f0000000380)) ioctl$RTC_EPOCH_READ(0xffffffffffffffff, 0x8008700d, &(0x7f00000003c0)) ioctl$TIOCGISO7816(r3, 0x80285442, &(0x7f0000000400)) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_udp_SIOCINQ(r5, 0x541b, &(0x7f0000000440)) ioctl$F2FS_IOC_RESIZE_FS(r2, 0x4008f510, &(0x7f0000000480)=0xaf89) r6 = openat$uhid(0xffffffffffffff9c, &(0x7f00000004c0), 0x802, 0x0) write$UHID_INPUT2(r6, &(0x7f0000000500)={0xc, {0x5c, "6b35d39d8db8a5c28d45d36c47e03845c59cff9a897c265673205e58fcdc2e5fdfb5bc2a65d678d52252d0c7da2f3ac0728f022746cfe4ca12701bec3897d7a5eeb18894658e9939f5d49c36ba03b416fb0f4b714ff55a1f8dab4539"}}, 0x62) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = fcntl$dupfd(r8, 0x0, r6) landlock_restrict_self(r9, 0x5) ioctl$XFS_IOC_GETBMAPX(r0, 0xc0205838, &(0x7f00000005c0)={0x8, 0xd4, 0x0, 0x80000001, 0x1, 0x10, 0x4}) getsockopt$inet6_buf(r9, 0x29, 0xcd, &(0x7f0000000600)=""/196, &(0x7f0000000700)=0xc4) mprotect(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xb) mount$9p_fd(0x0, &(0x7f0000000740)='./file0\x00', &(0x7f0000000780), 0x0, &(0x7f00000007c0)={'trans=fd,', {'rfdno', 0x3d, r9}, 0x2c, {'wfdno', 0x3d, r7}, 0x2c, {[{@aname={'aname', 0x3d, '!#@'}}, {@privport}, {@cache_readahead}, {@version_9p2000}, {@cache_fscache}, {@cache_loose}, {@afid={'afid', 0x3d, 0x4}}, {@afid={'afid', 0x3d, 0x9}}, {@directio}, {@dfltuid={'dfltuid', 0x3d, r4}}], [{@permit_directio}, {@seclabel}, {@obj_role={'obj_role', 0x3d, '/selinux/create\x00'}}, {@smackfsfloor={'smackfsfloor', 0x3d, '&}-'}}]}}) r10 = syz_genetlink_get_family_id$batadv(&(0x7f0000000940), r9) sendmsg$BATADV_CMD_GET_BLA_CLAIM(r5, &(0x7f0000000a40)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000a00)={&(0x7f0000000980)={0x54, r10, 0x0, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x7}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x4}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x3}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x8}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}]}, 0x54}, 0x1, 0x0, 0x0, 0x1}, 0x40004) socket$nl_generic(0x10, 0x3, 0x10) ioctl$TIOCGDEV(r9, 0x80045432, &(0x7f0000000a80)) fcntl$addseals(r0, 0x409, 0x1) fcntl$getown(r6, 0x9) 380.14584ms ago: executing program 0 (id=6): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf85, 0x3}, 0x1c) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x129042, 0x15) pwrite64(r1, &(0x7f0000000200)='\x00', 0x1, 0x2e7a) ioctl$SIOCGETSGCNT_IN6(r1, 0x89e1, &(0x7f00000003c0)={@rand_addr=' \x01\x00', @private2={0xfc, 0x2, '\x00', 0x1}}) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_async', 0x20000, 0xf3) read$FUSE(r2, &(0x7f0000001540)={0x2020}, 0x2020) ioctl$PIO_FONT(r2, 0x4b61, &(0x7f0000000300)="505987b13cb64c0108cafdd9742f2e6b9c82abcb7c4658532a68d3ee9a6bae1129b820812c011e52dac5d2346252ab0ebf43a96ecf71973725b68adf5e7704772bf77ff3cc6d591a0a1ffe21b4b8737910e4b8f481ec62a6446d09a05b318f2422d805f3dd750099162fd69542c457c0cc3d6f12c5bc75a36ce4ec4db8bb76cfe077a8d39648f02cbddd9f64dfca1487680c4ca54a94b33f124f5d52296c0950b13832ed19aa68c8c8614cf3c3fe95466bc93a0ae15bf6b4aea95d97a2456bcf") r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'ip6gretap0\x00', 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x42081, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000140)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x2b5b09b, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) ioctl$VT_ACTIVATE(r5, 0x5606, 0x9) umount2(&(0x7f00000001c0)='./file0/../file0\x00', 0x8) write(r5, &(0x7f00000005c0)='dummy_udc.0\n', 0xc) sendto$packet(r3, &(0x7f0000000180)="0b032200e0ff25000200475400f6a13bb10000a8880088ca4803", 0x10000, 0x0, &(0x7f0000000140)={0x11, 0x0, r4}, 0x14) r6 = socket$igmp(0x2, 0x3, 0x2) sendto$inet(r6, &(0x7f00000001c0)="05051befd977fd45cf858567349c20c5601d4ca391101e3f98bacc38d7864c89b0659a6f9041605fda89406bfbea8ae81ad74d2ea7e60d9e989e269176bcffc79427dbbeda80170595c4560391a61964aeb6fec84523b29d2961af02777037ac584ec58680598886aeb273dd5f75c3ec92d8d9d7fbbe752c5adde7e1de7a9c01ccd025416366aefc5d9f1956f23c08c4559d87f72a6bd5a0999a11c5ea81adbf8af7ca46d7a910f966518843a5abfa1110defed2fc7d3416a64a3a56fc1126af006bc400f097f1dfeaf6c120699723eb", 0xd0, 0x20004080, &(0x7f00000002c0)={0x2, 0x4e22, @local}, 0x10) syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[], 0x0) 0s ago: executing program 2 (id=7): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x2a, &(0x7f0000000040)=ANY=[@ANYBLOB="020000000000000002000000e0"], 0x190) r1 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000080)={0x7, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1001, 0x3a, 0x1000, 0x3a, 0x9, 0x0, 0xffffffff}, 0x1c) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x2, 0x0, 0x60000, 0x4002004c4, 0x1004, 0x8000000000000000, 0xc595, 0x9, 0x1, 0x7f, 0x2000000000000000, 0xb3, 0x95], 0xeeee8000, 0x2829d5}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x2a, &(0x7f0000000000)=ANY=[@ANYBLOB="020000000000000002000000e001"], 0x190) r4 = socket$inet_udp(0x2, 0x2, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000980)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x13e) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') r5 = socket$nl_audit(0x10, 0x3, 0x9) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4}, 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r6) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r6) sendmsg$NL802154_CMD_SET_MAX_FRAME_RETRIES(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000280)={0x14, r7, 0x1, 0x70bd27, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x200048c1}, 0x4004) getsockopt$netlink(r5, 0x10e, 0x3, 0x0, &(0x7f0000000080)) rename(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000200)='./file0\x00') close(0x3) setsockopt$inet_MCAST_JOIN_GROUP(r4, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) kernel console output (not intermixed with test programs): ess permissive=1 [ 12.610614][ T36] audit: type=1400 audit(1785935173.859:63): avc: denied { siginh } for pid=230 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.186' (ED25519) to the list of known hosts. [ 19.599452][ T36] audit: type=1400 audit(1785935180.859:64): avc: denied { mounton } for pid=273 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 19.600657][ T273] cgroup: Unknown subsys name 'net' [ 19.622163][ T36] audit: type=1400 audit(1785935180.859:65): avc: denied { mount } for pid=273 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.649501][ T36] audit: type=1400 audit(1785935180.889:66): avc: denied { unmount } for pid=273 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.649686][ T273] cgroup: Unknown subsys name 'devices' [ 19.766027][ T273] cgroup: Unknown subsys name 'hugetlb' [ 19.771651][ T273] cgroup: Unknown subsys name 'rlimit' [ 19.883437][ T36] audit: type=1400 audit(1785935181.139:67): avc: denied { setattr } for pid=273 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 19.906846][ T36] audit: type=1400 audit(1785935181.139:68): avc: denied { mounton } for pid=273 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 19.915856][ T289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 19.931970][ T36] audit: type=1400 audit(1785935181.139:69): avc: denied { mount } for pid=273 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 19.964426][ T36] audit: type=1400 audit(1785935181.199:70): avc: denied { relabelto } for pid=289 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.990066][ T36] audit: type=1400 audit(1785935181.199:71): avc: denied { write } for pid=289 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.015302][ T273] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 20.015993][ T36] audit: type=1400 audit(1785935181.279:72): avc: denied { read } for pid=273 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.050774][ T36] audit: type=1400 audit(1785935181.279:73): avc: denied { open } for pid=273 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.056098][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.063178][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.070348][ T296] bridge_slave_0: entered allmulticast mode [ 21.076609][ T296] bridge_slave_0: entered promiscuous mode [ 21.090033][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.097146][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.104335][ T296] bridge_slave_1: entered allmulticast mode [ 21.110522][ T296] bridge_slave_1: entered promiscuous mode [ 21.150468][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.157724][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.165239][ T294] bridge_slave_0: entered allmulticast mode [ 21.171401][ T294] bridge_slave_0: entered promiscuous mode [ 21.179077][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.186164][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.193229][ T294] bridge_slave_1: entered allmulticast mode [ 21.199558][ T294] bridge_slave_1: entered promiscuous mode [ 21.215794][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.222854][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.229995][ T295] bridge_slave_0: entered allmulticast mode [ 21.236198][ T295] bridge_slave_0: entered promiscuous mode [ 21.243010][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.250220][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.257336][ T295] bridge_slave_1: entered allmulticast mode [ 21.263756][ T295] bridge_slave_1: entered promiscuous mode [ 21.314536][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.321603][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.329012][ T297] bridge_slave_0: entered allmulticast mode [ 21.335237][ T297] bridge_slave_0: entered promiscuous mode [ 21.341588][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.348891][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.355977][ T297] bridge_slave_1: entered allmulticast mode [ 21.362240][ T297] bridge_slave_1: entered promiscuous mode [ 21.474511][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.481570][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.488864][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.495950][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.504422][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.511490][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.518777][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.525824][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.546605][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.553662][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.561252][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.568308][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.576871][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.583918][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.591788][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.598851][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.632529][ T60] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.640035][ T60] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.648208][ T60] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.655422][ T60] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.662566][ T60] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.670193][ T60] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.677437][ T60] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.684729][ T60] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.696946][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.704127][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.713233][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.720305][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.735442][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.742854][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.753012][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.760100][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.785725][ T60] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.792793][ T60] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.800789][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.807880][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.820108][ T60] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.827179][ T60] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.845118][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.852322][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.872725][ T295] veth0_vlan: entered promiscuous mode [ 21.903704][ T297] veth0_vlan: entered promiscuous mode [ 21.913574][ T295] veth1_macvtap: entered promiscuous mode [ 21.922418][ T294] veth0_vlan: entered promiscuous mode [ 21.931363][ T296] veth0_vlan: entered promiscuous mode [ 21.946276][ T294] veth1_macvtap: entered promiscuous mode [ 21.975418][ T297] veth1_macvtap: entered promiscuous mode [ 21.990708][ T295] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 22.006688][ T296] veth1_macvtap: entered promiscuous mode [ 22.094871][ T324] netlink: 'syz.3.4': attribute type 11 has an invalid length. [ 22.102520][ T324] netlink: 3657 bytes leftover after parsing attributes in process `syz.3.4'. [ 22.112444][ T321] netlink: 'syz.2.3': attribute type 12 has an invalid length. [ 22.264495][ T45] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 22.384290][ T65] usb 4-1: new low-speed USB device number 2 using dummy_hcd [ 22.415535][ T45] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 22.426549][ T45] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 22.435654][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 22.445062][ T45] usb 2-1: config 0 descriptor?? [ 22.535326][ T65] usb 4-1: config 0 interface 0 altsetting 3 endpoint 0x81 has invalid maxpacket 1056, setting to 8 [ 22.546462][ T65] usb 4-1: config 0 interface 0 has no altsetting 0 [ 22.553064][ T65] usb 4-1: New USB device found, idVendor=1b96, idProduct=0011, bcdDevice= 0.00 [ 22.562211][ T65] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 22.570972][ T65] usb 4-1: config 0 descriptor?? [ 22.576380][ T324] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 22.609065][ T329] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 22.617747][ T329] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 22.653510][ T45] usbhid 2-1:0.0: can't add hid device: -71 [ 22.659547][ T45] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 22.668266][ T45] usb 2-1: USB disconnect, device number 2 [ 22.977492][ T332] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 22.997569][ T65] ntrig 0003:1B96:0011.0001: unknown main item tag 0x2 [ 23.007750][ T65] ntrig 0003:1B96:0011.0001: unknown main item tag 0x6 [ 23.016212][ T65] ntrig 0003:1B96:0011.0001: unknown main item tag 0x4 [ 23.023218][ T65] ntrig 0003:1B96:0011.0001: unknown main item tag 0x0 [ 23.031691][ T65] ntrig 0003:1B96:0011.0001: hidraw0: USB HID v0.01 Device [HID 1b96:0011] on usb-dummy_hcd.3-1/input0 [ 23.094222][ T9] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 23.109540][ T297] ------------[ cut here ]------------ [ 23.115157][ T297] WARNING: CPU: 0 PID: 297 at fs/inode.c:340 drop_nlink+0xce/0x110 [ 23.123100][ T297] Modules linked in: [ 23.127050][ T297] CPU: 0 UID: 0 PID: 297 Comm: syz-executor Not tainted syzkaller #0 d75e9a393de9c6a33055d5e25749154d2cb9f431 [ 23.138757][ T297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 23.148908][ T297] RIP: 0010:drop_nlink+0xce/0x110 [ 23.153965][ T297] Code: 04 00 00 be 08 00 00 00 e8 5f 13 ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 c2 4c 95 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c [ 23.173856][ T297] RSP: 0018:ffffc900011efc88 EFLAGS: 00010293 [ 23.179966][ T297] RAX: ffffffff81f224fe RBX: ffff88811391e5a0 RCX: ffff888101fc4c00 [ 23.187994][ T297] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 23.196107][ T297] RBP: ffffc900011efcb0 R08: 0000000000000003 R09: 0000000000000004 [ 23.204119][ T297] R10: dffffc0000000000 R11: fffff5200023df80 R12: dffffc0000000000 [ 23.212135][ T297] R13: 1ffff11022723cbd R14: ffff88811391e5e8 R15: 0000000000000000 [ 23.220134][ T297] FS: 000055558c942500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 23.229107][ T297] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 23.235726][ T297] CR2: 000055558c965958 CR3: 00000001251c4000 CR4: 00000000003526b0 [ 23.243709][ T297] Call Trace: [ 23.247136][ T297] [ 23.250072][ T297] shmem_rmdir+0x5f/0x90 [ 23.254370][ T297] vfs_rmdir+0x3de/0x560 [ 23.258625][ T297] incfs_kill_sb+0x102/0x220 [ 23.263226][ T297] deactivate_locked_super+0xd5/0x270 [ 23.268633][ T297] deactivate_super+0xb8/0xe0 [ 23.273329][ T297] cleanup_mnt+0x438/0x4d0 [ 23.277792][ T297] __cleanup_mnt+0x1d/0x40 [ 23.282215][ T297] task_work_run+0x1e8/0x260 [ 23.286835][ T297] ? __cfi_task_work_run+0x10/0x10 [ 23.291979][ T297] ? __x64_sys_umount+0x12e/0x180 [ 23.297067][ T297] ? __cfi___x64_sys_umount+0x10/0x10 [ 23.302552][ T297] ? __kasan_check_read+0x15/0x20 [ 23.307611][ T297] resume_user_mode_work+0x35/0x50 [ 23.312748][ T297] syscall_exit_to_user_mode+0x63/0xb0 [ 23.318244][ T297] do_syscall_64+0x63/0xf0 [ 23.322667][ T297] ? clear_bhb_loop+0x50/0xa0 [ 23.327540][ T297] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 23.333474][ T297] RIP: 0033:0x7f3802f9f257 [ 23.337979][ T297] Code: a2 c7 05 9c 44 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 23.357966][ T297] RSP: 002b:00007ffdedc419a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 23.366547][ T297] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f3802f9f257 [ 23.374561][ T297] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdedc41a60 [ 23.382531][ T297] RBP: 00007ffdedc41a60 R08: 00007ffdedc42a60 R09: 00000000ffffffff [ 23.390560][ T297] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdedc42af0 [ 23.398587][ T297] R13: 00007f380303445c R14: 00000000000059ed R15: 00007ffdedc42b30 [ 23.406670][ T297] [ 23.409721][ T297] ---[ end trace 0000000000000000 ]--- [ 23.416187][ T297] ================================================================== [ 23.418794][ T65] usb 4-1: USB disconnect, device number 2 [ 23.424271][ T297] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 [ 23.424303][ T297] Write of size 4 at addr 0000000000000168 by task syz-executor/297 [ 23.444279][ T297] [ 23.446589][ T297] CPU: 1 UID: 0 PID: 297 Comm: syz-executor Tainted: G W syzkaller #0 d75e9a393de9c6a33055d5e25749154d2cb9f431 [ 23.446608][ T297] Tainted: [W]=WARN [ 23.446616][ T297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 23.446623][ T297] Call Trace: [ 23.446627][ T297] [ 23.446632][ T297] __dump_stack+0x21/0x30 [ 23.446651][ T297] dump_stack_lvl+0x140/0x1c0 [ 23.446665][ T297] ? __cfi_dump_stack_lvl+0x10/0x10 [ 23.446679][ T297] print_report+0x3d/0x70 [ 23.446693][ T297] kasan_report+0x162/0x1a0 [ 23.446706][ T297] ? ihold+0x24/0x70 [ 23.446718][ T297] ? ihold+0x24/0x70 [ 23.446729][ T297] kasan_check_range+0x25a/0x2b0 [ 23.446741][ T297] __kasan_check_write+0x18/0x20 [ 23.446751][ T297] ihold+0x24/0x70 [ 23.446762][ T297] vfs_rmdir+0x25c/0x560 [ 23.446776][ T297] incfs_kill_sb+0x102/0x220 [ 23.446787][ T297] deactivate_locked_super+0xd5/0x270 [ 23.446801][ T297] deactivate_super+0xb8/0xe0 [ 23.446814][ T297] cleanup_mnt+0x438/0x4d0 [ 23.446827][ T297] __cleanup_mnt+0x1d/0x40 [ 23.446838][ T297] task_work_run+0x1e8/0x260 [ 23.446851][ T297] ? __cfi_task_work_run+0x10/0x10 [ 23.446863][ T297] ? __x64_sys_umount+0x12e/0x180 [ 23.446872][ T297] ? __cfi___x64_sys_umount+0x10/0x10 [ 23.446881][ T297] ? __kasan_check_read+0x15/0x20 [ 23.446890][ T297] resume_user_mode_work+0x35/0x50 [ 23.446899][ T297] syscall_exit_to_user_mode+0x63/0xb0 [ 23.446910][ T297] do_syscall_64+0x63/0xf0 [ 23.446920][ T297] ? clear_bhb_loop+0x50/0xa0 [ 23.446935][ T297] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 23.446947][ T297] RIP: 0033:0x7f3802f9f257 [ 23.446958][ T297] Code: a2 c7 05 9c 44 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 23.446966][ T297] RSP: 002b:00007ffdedc419a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 23.446978][ T297] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f3802f9f257 [ 23.446985][ T297] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdedc41a60 [ 23.446991][ T297] RBP: 00007ffdedc41a60 R08: 00007ffdedc42a60 R09: 00000000ffffffff [ 23.446998][ T297] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdedc42af0 [ 23.447005][ T297] R13: 00007f380303445c R14: 00000000000059ed R15: 00007ffdedc42b30 [ 23.447013][ T297] [ 23.447017][ T297] ================================================================== [ 23.505440][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 23.510039][ T297] Disabling lock debugging due to kernel taint [ 23.514076][ T9] usb 2-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 23.515863][ T297] BUG: kernel NULL pointer dereference, address: 0000000000000168 [ 23.520821][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 23.524391][ T297] #PF: supervisor write access in kernel mode [ 23.524413][ T297] #PF: error_code(0x0002) - not-present page [ 23.524424][ T297] PGD 800000010ff5b067 P4D 800000010ff5b067 PUD 0 [ 23.524447][ T297] Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI [ 23.533260][ T9] usb 2-1: config 0 descriptor?? [ 23.538598][ T297] CPU: 1 UID: 0 PID: 297 Comm: syz-executor Tainted: G B W syzkaller #0 d75e9a393de9c6a33055d5e25749154d2cb9f431 [ 23.538638][ T297] Tainted: [B]=BAD_PAGE, [W]=WARN [ 23.538644][ T297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 23.538654][ T297] RIP: 0010:ihold+0x2a/0x70 [ 23.538679][ T297] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 ad 43 95 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 1c 0a ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 bd [ 23.810079][ T297] RSP: 0018:ffffc900011efcc8 EFLAGS: 00010246 [ 23.816164][ T297] RAX: ffff888101fc4c00 RBX: 0000000000000000 RCX: ffff888101fc4c00 [ 23.824129][ T297] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 23.832105][ T297] RBP: ffffc900011efcd8 R08: ffffffff88bb6947 R09: 1ffffffff1176d28 [ 23.840124][ T297] R10: dffffc0000000000 R11: fffffbfff1176d29 R12: 0000000000000000 [ 23.848202][ T297] R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 [ 23.856272][ T297] FS: 000055558c942500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 23.868079][ T297] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 23.874673][ T297] CR2: 0000000000000168 CR3: 00000001251c4000 CR4: 00000000003526b0 [ 23.883206][ T297] Call Trace: [ 23.886503][ T297] [ 23.889436][ T297] vfs_rmdir+0x25c/0x560 [ 23.893691][ T297] incfs_kill_sb+0x102/0x220 [ 23.898284][ T297] deactivate_locked_super+0xd5/0x270 [ 23.903773][ T297] deactivate_super+0xb8/0xe0 [ 23.908496][ T297] cleanup_mnt+0x438/0x4d0 [ 23.912915][ T297] __cleanup_mnt+0x1d/0x40 [ 23.917316][ T297] task_work_run+0x1e8/0x260 [ 23.921905][ T297] ? __cfi_task_work_run+0x10/0x10 [ 23.927018][ T297] ? __x64_sys_umount+0x12e/0x180 [ 23.932031][ T297] ? __cfi___x64_sys_umount+0x10/0x10 [ 23.937391][ T297] ? __kasan_check_read+0x15/0x20 [ 23.942438][ T297] resume_user_mode_work+0x35/0x50 [ 23.947536][ T297] syscall_exit_to_user_mode+0x63/0xb0 [ 23.952988][ T297] do_syscall_64+0x63/0xf0 [ 23.957387][ T297] ? clear_bhb_loop+0x50/0xa0 [ 23.962048][ T297] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 23.967923][ T297] RIP: 0033:0x7f3802f9f257 [ 23.972339][ T297] Code: a2 c7 05 9c 44 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 23.991957][ T297] RSP: 002b:00007ffdedc419a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 24.000387][ T297] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f3802f9f257 [ 24.008387][ T297] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdedc41a60 [ 24.016350][ T297] RBP: 00007ffdedc41a60 R08: 00007ffdedc42a60 R09: 00000000ffffffff [ 24.024323][ T297] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdedc42af0 [ 24.032276][ T297] R13: 00007f380303445c R14: 00000000000059ed R15: 00007ffdedc42b30 [ 24.040249][ T297] [ 24.043269][ T297] Modules linked in: [ 24.047167][ T297] CR2: 0000000000000168 [ 24.051306][ T297] ---[ end trace 0000000000000000 ]--- [ 24.056772][ T297] RIP: 0010:ihold+0x2a/0x70 [ 24.061271][ T297] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 ad 43 95 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 1c 0a ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 bd [ 24.080872][ T297] RSP: 0018:ffffc900011efcc8 EFLAGS: 00010246 [ 24.086930][ T297] RAX: ffff888101fc4c00 RBX: 0000000000000000 RCX: ffff888101fc4c00 [ 24.094990][ T297] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 24.102986][ T297] RBP: ffffc900011efcd8 R08: ffffffff88bb6947 R09: 1ffffffff1176d28 [ 24.111258][ T297] R10: dffffc0000000000 R11: fffffbfff1176d29 R12: 0000000000000000 [ 24.119310][ T297] R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 [ 24.127277][ T297] FS: 000055558c942500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 24.136194][ T297] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 24.142763][ T297] CR2: 0000000000000168 CR3: 00000001251c4000 CR4: 00000000003526b0 [ 24.151482][ T297] Kernel panic - not syncing: Fatal exception [ 24.158198][ T297] Kernel Offset: disabled [ 24.162762][ T297] Rebooting in 86400 seconds..