last executing test programs: 1.339605609s ago: executing program 0 (id=1): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x12, r0, 0x604ab000) r1 = userfaultfd(0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x6, 0x1, 0xffffbfff, 0x1, 0x1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r5}, 0x38) r6 = socket$inet6(0xa, 0x3, 0x6) setsockopt$inet6_buf(r6, 0x29, 0x39, &(0x7f0000000040)="ff02040000b5ffffffffffffffff2e2be82db1af00000000", 0x18) connect$inet6(r6, &(0x7f0000000080)={0xa, 0x4e20, 0x74df82a6, @private1={0xfc, 0x1, '\x00', 0xa}, 0xae3e}, 0x1c) sendmmsg$inet6(r6, &(0x7f0000002940)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}}], 0x62, 0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_PRI(r7, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={&(0x7f00000007c0)={0x68, r8, 0x1, 0x70bd2d, 0x25dfdbfd, {{}, {0x0, 0x4109}, {0x4c, 0x18, {0x52, @link='broadcast-link\x00'}}}}, 0x68}, 0x1, 0x0, 0x0, 0x8040}, 0x48804) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}, 0x1}) syz_mount_image$vfat(&(0x7f0000000400), &(0x7f0000000280)='./bus\x00', 0x8000, &(0x7f0000000300)=ANY=[@ANYRESOCT=r4, @ANYRES8=r2], 0x1, 0x2b2, &(0x7f0000000880)="$eJzs3NFLU28cx/Hvz6mbE91+EEFB9aVu6uag6w+oEQrRoDAn1UVwzLMaO21yzlgsIncT3fZ3SJfdBdU/4E100313EgTdeBGd8Jwd3XTa1M2t+X6BnO/xeT4+jzrlewSf9XtvnhZyrpEzyzIUUxkSqcmGSHKzqvuvfh3y61FpVJMr4z+/nrt7/8GtdCYzM6c6m56/mlLVyQsfnr14e/FTeXzh3eT7qKwlH67/SH1bO712Zv33/JO8q3lXi6WymrpYKpXNRdvSpbxbMFTv2JbpWpovupbTNJ6zS8vLVTWLSxPxZcdyXTWLVS1YVS2XtOxU1Xxs5otqGIZOxOVkG25jTnZ1bs5M7znsRTq6I3RetPl2rNUcx0nXWg9mV7u1LwAA0L/27/+DXn/v/j+zEFw73P+L0P93Sa3p7i/9PwaC46TNeP3ntxn9PwAAAAAAAAAAAAAAAAAAAAAA/4INz0t4npcIr+FbVERiIhLe93qf6I5Dfv+v9Wi76LCGf9yLidivK9lKNrgG4+mc5MUWS6YkIb/810NdUM/ezMxMqW+k/iE38yuVbMQ/m8DPh5Kt8uf/nw7yKh83c5V6fkTijeunJCGnWq+f2s6HxyGsVLKjcvlSQ96QhHx+JCWxZcl/XW/nX06r3rid2bH+mD8PAAAAAIBBYOiWZPPzb3D2o+FPiMnu8SB/gL8P7Hi+Hpaz7RxRCQAAAAAAjsytPi+Ytm05hyiiInKE+KAWEemLbeworotIH2zjuIqYiATv0cPEv2/F20p5bcwZFpGef1kOUPT6NxMAAACATttu+g8Q+vKqizsCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAODkafc8sHD+rqFwYJ94w3KRY/8EAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgD7yJwAA//+j7Rqj") mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') 1.294289301s ago: executing program 1 (id=2): syz_mount_image$ext4(&(0x7f0000000400)='ext4\x00', &(0x7f0000000280)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x40000, &(0x7f0000000340), 0x1, 0xbbb, &(0x7f0000002500)="$eJzs3M1rXFUbAPDn3ny2zftOKiLWTSMiLajTtJJii2ArlW5cCLoVGtJJCZl+kERq0iwm+gco6lpwI6hF6cKuu1Fw60br1uJCKBIbBRGN3PlIYjOTpHaSG9LfD87cc+65d87zzGVyz4G5CeCBNZC9pBH7IuJMElGo708jorta642o1I5bmJ8d+X1+diSJxcVXf0kiiYg787MjjfdK6ts99UZvRHz7YhIPvb163MnpmfHhcrk0UW8fmjp/6dDk9MwzY+eHz5XOlS4cPvrc0JGho4PHhtqW6x8/nrj+2+Onf6r8+elfV399/+MkTkRfvW9lHu0yEANLn8lKnREx3O7BctJRz+edjuV9SecaJ/RsRVQAALSSrpjDPRKF6IjlyVshvvou1+AAAACAtljsiFgEAAAAdrjE+h8AAAB2uMbvAO7Mz440Sr6/SNhat09GRH8t/4V6qfV0RqW67Y2uiNh9J4mVj7UmtdPu20BE3Prh2BdZiU16DnktlbmIeLTZ9U+q+fdXn+JenX8aEYNtGH/grvZ2y//p7tb5n2jD+HnnD8CD6cbJ2o1s9f0vXZr/RJP7X2eTe9d/kff9rzH/W1g1/1vOv6PF/O+VDY5x5ZMPL7fqy/J//vpLnzdKNn62va+k7sHtuYjHOpvlnyzln7TI/8wGxyj8fbnUqi/v/Bc/ijgQzfNvSNb+/0SHRsfKpcHaa9Mx5r4Z+qzV+Hnnn13/3S3yX+/6X9rgGK+fOnWtVd/6+ac/dyevVWvd9T1vDk9NTRyO6E5eXr3/SP2B9hYaxzTeI8v/4BNrf/+b5Z8NUal/DtlaYK6+zdpv3TXmC1evfLlW/tnaL8/rf3aj179r+bxs37sbHOPJr9872Kpv5fo3K9n4t5LaWhgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGtKI6IskLS7V07RYjNgTEQ/H7rR8cXLqqdGLb1w4m/VF9EdXOjpWLg1GRKHWTrL24Wp9uX3krvazEbE3Ij4o7Kq2iyMXy2fzTh4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAleyKiL5K0GBFpRCwU0rRYzDsqAAAAoO368w4AAAAA2HTW/wAAALDzWf8DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwyfbuv3EziYjK8V3Vkumu93XlGhmw2dK8AwBy05F3AEBuOvMOAMjNPa7xTRdgB0rW6e9t2dPT9lgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2L4O7LtxM4mIyvFd1ZLprvd1NT1j/xZGB2ymNO8AgNx0rNXZuXVxAFtv/a/46S2JA9h6zdf4wIMkWae/d/mYyr97ejYtJgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC2n75qSdJiRKTVepoWixH/i4j+6EpGx8qlwYj4f0R8X+jqydo9eQcNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABA201Oz4wPl8ulCRUVlXwryfYIo1bJ+y8TAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB5mJyeGR8ul0sTk3lHAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAORtcnpmfLhcLk1soHLtXg5eUck7RwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8vNPAAAA///y0Q7y") syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000300)) syz_mount_image$fuse(0x0, 0x0, 0x322020, &(0x7f0000000380)=ANY=[], 0x1, 0x0, 0x0) syz_io_uring_setup(0x1eab, &(0x7f00000001c0)={0x0, 0x667, 0x1, 0x2, 0x800335}, &(0x7f0000000500)=0x0, &(0x7f0000001080)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x40, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_usb_connect$cdc_ncm(0x5, 0x6e, &(0x7f0000000540)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c00020100800009000005240600016a050003000d240f017a850000030084000206241a00001009058103100000000d0904010000020d00000904010102020d0000090582020002fe000009050302ff0308000000000000000029d6d65c69c3784f0d19ce6401f9ae04eb014319202c4e35585520f07bd1ea35e43e523a1fbeba27567bb663afb429dfd7156d697faa6f75"], 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x200000000000000, &(0x7f0000002480)=ANY=[@ANYBLOB, @ANYRESHEX, @ANYRESDEC=0x0, @ANYBLOB=',group_id', @ANYRESDEC=0x0, @ANYBLOB="1a2c"], 0x0, 0x0, 0x0) mkdir(&(0x7f00000003c0)='./file0\x00', 0x21) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000180)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]}) sysinfo(&(0x7f0000000540)=""/198) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mkdir(&(0x7f0000000480)='./bus\x00', 0xaf) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000021c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chroot(&(0x7f0000000000)='./bus\x00') openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet_group_source_req(0xffffffffffffffff, 0x0, 0x2e, &(0x7f0000000100)={0x4, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @local}}}, 0x108) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$KVM_GET_DEVICE_ATTR_vcpu(r3, 0x4018aee2, &(0x7f0000000100)=@attr_pvtime_ipa={0x0, 0x1, 0x1, 0x80000000}) timer_create(0x0, &(0x7f00000002c0)={0x0, 0x21, 0x2}, &(0x7f0000000b80)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x71258000) pipe2(&(0x7f0000000580), 0x0) 889.765076ms ago: executing program 2 (id=3): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f00000001c0)={0x3, 0x0, [{0xd, 0x7, 0x5, 0x7, 0x5, 0x100, 0x7fff}, {0x80000008, 0x0, 0x5, 0x852, 0x0, 0x7, 0x7}, {0x7, 0x6, 0x0, 0x8, 0x0, 0x7fff, 0x5}]}) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r3, &(0x7f0000000200)={0xa, 0x0, 0xfffffffd, @empty}, 0x1c) r4 = dup(r3) r5 = open(&(0x7f00000000c0)='./file0\x00', 0x1298c2, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000240)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd2d, 0x0, {{@in=@remote, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x30, 0x0, 0x32, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x0, 0x0, 0x3, 0xffffffffffffffff}, {0x0, 0xfffffffffffff8ea, 0x407ffffffffffe, 0x800000000000002}, 0x1, 0x0, 0x1}}, 0xb8}}, 0x0) ftruncate(r5, 0x200004) sendfile(r4, r5, 0x0, 0x80001d00c0d1) sendmsg$IPCTNL_MSG_CT_DELETE(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={0x0, 0xe4}}, 0x4040085) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xc) syz_open_procfs(0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000040)={@loopback, 0x2, 0x2, 0x1, 0x0, 0x6, 0xdc}, 0x20) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000100)={0x3, &(0x7f0000000080)=[{0x3, 0x4, 0x5}, {0x2, 0x80, 0xde, 0x30}, {0x6, 0x4, 0x0, 0x5}]}) 799.935352ms ago: executing program 3 (id=4): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000005180)=[{{0x0, 0x0, 0x0}, 0x2}], 0x1, 0x10000, &(0x7f0000005380)={0x0, 0x3938700}) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r3 = socket$packet(0x11, 0x3, 0x300) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xa, &(0x7f0000000200)=ANY=[@ANYBLOB="18320000", @ANYRES32=r2, @ANYBLOB="0000000000000000b708000062f3ffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400003b92f14285000000820000009500000000000000"], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f0000000040)=r4, 0x4) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1342, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket(0x2, 0x400000000002, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r5, &(0x7f0000000080)=[{&(0x7f0000000300)="89e70f0500000000000000000800", 0xe}], 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r8, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f0000005a40)=@name={0x1e, 0x2, 0x0, {{0x43, 0x2}, 0x4}}, 0x10) r9 = socket(0x1e, 0x1, 0x0) connect$tipc(r9, &(0x7f0000000000)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10) write$binfmt_misc(r9, &(0x7f0000000400), 0x2000011a) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000000600)=[{{&(0x7f0000000000)=@tipc=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x1}}, 0x80, 0x0, 0x0, 0x0, 0x0, 0x1000000}}, {{&(0x7f0000000080)=@tipc=@name={0x1e, 0x2, 0x1}, 0x80, 0x0}}], 0x2, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) 792.693692ms ago: executing program 4 (id=5): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x12, r0, 0x604ab000) r1 = userfaultfd(0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x6, 0x1, 0xffffbfff, 0x1, 0x1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r5}, 0x38) r6 = socket$inet6(0xa, 0x3, 0x6) setsockopt$inet6_buf(r6, 0x29, 0x39, &(0x7f0000000040)="ff02040000b5ffffffffffffffff2e2be82db1af00000000", 0x18) connect$inet6(r6, &(0x7f0000000080)={0xa, 0x4e20, 0x74df82a6, @private1={0xfc, 0x1, '\x00', 0xa}, 0xae3e}, 0x1c) sendmmsg$inet6(r6, &(0x7f0000002940)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}}], 0x62, 0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_PRI(r7, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={&(0x7f00000007c0)={0x68, r8, 0x1, 0x70bd2d, 0x25dfdbfd, {{}, {0x0, 0x4109}, {0x4c, 0x18, {0x52, @link='broadcast-link\x00'}}}}, 0x68}, 0x1, 0x0, 0x0, 0x8040}, 0x48804) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}, 0x1}) syz_mount_image$vfat(&(0x7f0000000400), &(0x7f0000000280)='./bus\x00', 0x8000, &(0x7f0000000300)=ANY=[@ANYRESOCT=r4, @ANYRES8=r2], 0x1, 0x2b2, &(0x7f0000000880)="$eJzs3NFLU28cx/Hvz6mbE91+EEFB9aVu6uag6w+oEQrRoDAn1UVwzLMaO21yzlgsIncT3fZ3SJfdBdU/4E100313EgTdeBGd8Jwd3XTa1M2t+X6BnO/xeT4+jzrlewSf9XtvnhZyrpEzyzIUUxkSqcmGSHKzqvuvfh3y61FpVJMr4z+/nrt7/8GtdCYzM6c6m56/mlLVyQsfnr14e/FTeXzh3eT7qKwlH67/SH1bO712Zv33/JO8q3lXi6WymrpYKpXNRdvSpbxbMFTv2JbpWpovupbTNJ6zS8vLVTWLSxPxZcdyXTWLVS1YVS2XtOxU1Xxs5otqGIZOxOVkG25jTnZ1bs5M7znsRTq6I3RetPl2rNUcx0nXWg9mV7u1LwAA0L/27/+DXn/v/j+zEFw73P+L0P93Sa3p7i/9PwaC46TNeP3ntxn9PwAAAAAAAAAAAAAAAAAAAAAA/4INz0t4npcIr+FbVERiIhLe93qf6I5Dfv+v9Wi76LCGf9yLidivK9lKNrgG4+mc5MUWS6YkIb/810NdUM/ezMxMqW+k/iE38yuVbMQ/m8DPh5Kt8uf/nw7yKh83c5V6fkTijeunJCGnWq+f2s6HxyGsVLKjcvlSQ96QhHx+JCWxZcl/XW/nX06r3rid2bH+mD8PAAAAAIBBYOiWZPPzb3D2o+FPiMnu8SB/gL8P7Hi+Hpaz7RxRCQAAAAAAjsytPi+Ytm05hyiiInKE+KAWEemLbeworotIH2zjuIqYiATv0cPEv2/F20p5bcwZFpGef1kOUPT6NxMAAACATttu+g8Q+vKqizsCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAODkafc8sHD+rqFwYJ94w3KRY/8EAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgD7yJwAA//+j7Rqj") mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x1c0) chdir(&(0x7f00000001c0)='./bus\x00') 17.038459ms ago: executing program 0 (id=6): syz_mount_image$vfat(&(0x7f0000000140), &(0x7f00000001c0)='./file0\x00', 0x2048c5, &(0x7f0000000440)={[{@fat=@dmask={'dmask', 0x3d, 0x10}}, {@fat=@discard}, {@utf8no}, {@shortname_mixed}, {@fat=@usefree}, {@shortname_winnt}, {@shortname_win95}, {@shortname_win95}, {@fat=@nocase}, {@uni_xlate}, {@shortname_winnt}, {@iocharset={'iocharset', 0x3d, 'cp932'}}, {@shortname_win95}]}, 0x0, 0x2a1, &(0x7f0000000840)="$eJzs3UFrE1sYxvGnSdukKW2yKBfuhYsvutHN0MZPEKQFMaDURtSFMLUTDRmTkomRiNju3Po5iktXCuoX6Made3FTBMFNF2KkScamNWBaW6ea/w/CnJxz3pkzOTPhnYFMtq4/vVcuBk7RrSuWNMWkdW1LmZ1S10h3GWuXx9VrXecmP7/7/+qNm5dy+fz8otlCbul81symT7168OjZ6Tf1yWvPp18mtJm5tfUp+37zn81/t74uhWuvSq4tV6t1d9n3bKUUlB2zK77nBp6VKoFXq1tPe9Gvrq42za2sTKVWa14QmFtpWtlrWr1q9VrT3DtuqWKO49hUSsMmfuCIwsbiops7lsEgChP9Kmu1nJvo21jY+B2DAgAAJ0tU+f/dUmClwCrVPfl9mP9LYf4f0wHyf2mo8/+DI/8fBjv5f6p7/u5F/g8AAAAAAAAAAAAAAAAAAAAAwJ9gu9VKt1qtdLgMXwlJSUnh+6jHiePB/A+3nh/uJSX/SaPQKHSWnfZcUSX58jQ7Jn1pHw9dnfLCxfz8rLVl9Npf68avNQpxJcL4UKZ//Fwn3nrj1zSmVO/2s0prpn98tk98ozCus2daie6WPTlK6+1tVeVrpX1c78Y/njO7cDm/L36i3Q8AAAAAgL+BY9/9cP3ebncsfGzIvvZO5e79AaV/cn9g3/X1qP4bjW6/AQAAAAAYJkHzYdn1fa82BIXw/w+OZIXRf3TJQTuPSurWvDgpczFIISbpsOHxX5vlj5L21MxEPt1HUfhwv3MGDNI5ym8lAAAAAMchTPpHoh4IAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABDbNCHh4X9D/PssZ7NxaPZSwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBk+BYAAP//lOkWvQ==") (async) r0 = syz_open_procfs(0x0, &(0x7f0000000540)='mounts\x00') mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) (async) mount$bind(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1333c06, 0x0) mount$bind(&(0x7f0000000300)='./file0\x00', &(0x7f0000000040)='./file0/file0\x00', 0x0, 0x11080, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1005848, 0x0) (async, rerun: 64) read$FUSE(r0, &(0x7f0000000b00)={0x2020}, 0x2020) (async, rerun: 64) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x4a, &(0x7f0000001600)=0xffffffff, 0x4) r1 = fsopen(&(0x7f0000000040)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) (async) fsmount(r1, 0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='@@$\x00', &(0x7f0000000200)='/$^,*\x00', 0x0) (async) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='bridge0\x00', 0x10) sendto$inet(r2, &(0x7f0000000040)="255f5a03204f8e0b", 0xdd86, 0x804, &(0x7f0000000080)={0x2, 0x4e22, @multicast1=0xe000006a}, 0x10) 0s ago: executing program 2 (id=7): r0 = syz_mount_image$vfat(&(0x7f00000000c0), &(0x7f0000000080)='./bus\x00', 0x1000840, &(0x7f0000000c00)=ANY=[@ANYBLOB='shortname=mixed,sys_immutable,nfs,iocharset=cp936,shortname=lower,rodir,nocase,codepage=860,shortname=lower,shortname=lower,shortname=win95,uid=', @ANYRESHEX=0x0, @ANYBLOB="2c646973636172642c73686f72746e616d653d77696e39352c756e695f786c6174653d302c0061a98eed20cb46078e5a4a40eed4c77e7462b84482aa7061236bf6bf5f48d7580feb45e35df449cbc10bccc2d8eb7a405ecd33c7efe0552ac1485c1dc47fec07062af97740e17f7fed7c51b26811fd16e28ca3f29cfad88fc4c5504243392e01cbdde7b5c763979598f95f09b95d2c45628665902b30ddfbf9bbd38185eabec1312bac0ff85a1ffbe2a612f453253bf5fcac7dd1e683bf671e2c5362e5a7"], 0x43, 0x36e, &(0x7f0000000100)="$eJzs3U2IG+UbAPAnnWyyLfS/e/hDURBGb0Jd2ooHxcOWsoViLirBj4MY7FYlWQsbDO4emq4X8Sh41JM3D3oo2LMIinjz4NUKUhUP2lvB4kiSSTLZZPsBZqXs73cIT973ffI+k5ndzM6Sd15djeb5hbhw48b1WFwsRXn1zGrcLMVyJBGHou9yRFyJSZUAAO5XN7Ms/swG7jKlNOeSAIA563/+v3600PLu16OwPD0+8+kPAPe9/O//w3sOqEQsFp8XrxJcnGdlAMC8TF3/f2SiuzL5r/5yJPtdIADwr3v+pZefOV2LeC5NFyI23uvUO/V4atx/+kK8Ga1YjxOxFLciBicKvYdS//HsudraiTRNu/HLctR7GZ16xEa3Ux+cKZxO+vnVOBlLsZzn52cbWZYlZ6/U1k6mfRFxudufPzZKnfpCHMnn//FIrMepSOP/U/kR52prp9L8Beobw/xuxM74ukWv/pVYiu9fi4vRivPRyx2e1tTWLp1M0zNZbSK/U6/2xw0s7t8OAQAAAAAAAAAAAAAAAAAAAADgQFhJR5ZH699k4/V7VlZm9PfXxxnk5+sD7QzWB8qqWWTZH+88Vn8/iYn1gXavz9Opl4e3FwQAAAAAAAAAAAAAAAAAAIADr71ViUartb7Z3tpuFoPuZnvrUET0Wt769rOvDsf0mDsE5XyOQleaN203G1kyHJwlE2PyIOlNPmz59Oqo4uKY6mgrZpZR3bur1Tr68M8fjVseSoav/Pd4TBKzNzDZVUYx2PjfoKR7eaNGwak7jLmWZdle6Zdemc6KUkT53nfc7YOsF3xz/Y0HHm8fe6L3bjS+zAYePb70wrUPP/mt2Wj1Zo7+Hixvtm9lzUb+fPbBtneQFI6fUgyCUvFIKN8ufWeypfHFD7+/+OAH393d7Fmx5e0ZY5LB5ny+u6syCHpl7uo6PGuuhRkH/xyCYx+vNq5e+unXqa5y8QdtHBR+SVioAwAAAAAAAAAAAAAAAAAA9kXhu+K5/Mu+C7fLevLZ+VcGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPunvbV9/On+/f+3tpuNPNhp7G65m+Cvbkx3Vdc32xGV/3ozAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA44P4JAAD//09Xbl4=") r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) (async) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) dup3(r2, r1, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f0000000800)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000007c0)={&(0x7f00000006c0)={0xe0, r3, 0x100, 0x70bd26, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x3, 0x7b}}}}, [@NL80211_ATTR_KEY={0x38, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac01}, @NL80211_KEY_MODE={0x5, 0x9, 0x1}, @NL80211_KEY_TYPE={0x8, 0x7, 0x2}, @NL80211_KEY_DEFAULT={0x4}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "688895b6dd4c002fd94788de25"}]}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x40, 0x50, 0x0, 0x1, [@NL80211_KEY_TYPE={0x8}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "b23147d67a6ad27db844aed0ef"}, @NL80211_KEY_SEQ={0x8, 0x4, "8865a9d3"}, @NL80211_KEY_IDX={0x5, 0x2, 0x4}, @NL80211_KEY_IDX={0x5, 0x2, 0x2}, @NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_DEFAULT={0x4}]}, @NL80211_ATTR_KEY_IDX={0x5}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x14, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "66d12fba80"}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x1c, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}]}, 0xe0}, 0x1, 0x0, 0x0, 0x80}, 0x4048801) (async) openat(r0, &(0x7f0000000080)='./bus\x00', 0x9a002, 0x0) (async) timer_create(0x7, &(0x7f0000000000)={0x0, 0x1d, 0x4, @thr={&(0x7f0000000480)="91ab529cdb20f48847beeb80d2c8e40e86a3c2abdbe14aef193b23ad33321d4a09a2ef6d447c6a491853cc5af680f579703fbf02f3466f3863f6caeaace6b741eed335e4f93c390716d06c9bea5fd6505b40644d240b7531b6210f6bc1ceb6e84bc7ce41828c735557596cdea62f39bc97d7f72794d49ab93e23486409261778ecbbb520c0c57f1b4ff5b23c4452e77e95f87b8c15681a30daca50cb77e6a0f2ee8a68b16763a3c6b721eb2567bd34972d31144bafd99fba54d9253c0852a045a9307bb8bfcd7b97f72ad91892dd729f4801187eadca27812608691fb4bece6be7ea0fac9265a1b968e91e32f788a895db588249", &(0x7f0000000580)="04220511307fc389d1ae46f264616591451da0d5704ad80de436065e522a1646d7b6a804b9acb36956615188339bd021edf2a26eeef4cf8e1446882c3f86c13cb2b872aef1c2bb2b60b005e258733bc6c0216c6db21b7575e5f6ac845051c3b569d99e8553b19e4bb414172aba7a395a703d3aaba1fc61e833bb67497d7ecf03225959004eb3dc066a249486c2428e"}}, &(0x7f0000000040)) (async) lseek(r0, 0x1, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.177' (ED25519) to the list of known hosts. [ 21.202426][ T28] audit: type=1400 audit(1769416623.124:64): avc: denied { mounton } for pid=276 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.203643][ T276] cgroup: Unknown subsys name 'net' [ 21.225083][ T28] audit: type=1400 audit(1769416623.124:65): avc: denied { mount } for pid=276 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.252856][ T28] audit: type=1400 audit(1769416623.154:66): avc: denied { unmount } for pid=276 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.253041][ T276] cgroup: Unknown subsys name 'devices' [ 21.395275][ T276] cgroup: Unknown subsys name 'hugetlb' [ 21.400907][ T276] cgroup: Unknown subsys name 'rlimit' [ 21.503299][ T28] audit: type=1400 audit(1769416623.434:67): avc: denied { setattr } for pid=276 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.526482][ T28] audit: type=1400 audit(1769416623.434:68): avc: denied { mounton } for pid=276 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 21.540515][ T278] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 21.551388][ T28] audit: type=1400 audit(1769416623.434:69): avc: denied { mount } for pid=276 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.583124][ T28] audit: type=1400 audit(1769416623.484:70): avc: denied { relabelto } for pid=278 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.601779][ T276] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.608551][ T28] audit: type=1400 audit(1769416623.484:71): avc: denied { write } for pid=278 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.642921][ T28] audit: type=1400 audit(1769416623.514:72): avc: denied { read } for pid=276 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.668551][ T28] audit: type=1400 audit(1769416623.514:73): avc: denied { open } for pid=276 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.501784][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.508871][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.516388][ T287] device bridge_slave_0 entered promiscuous mode [ 22.523323][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.530347][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.537988][ T287] device bridge_slave_1 entered promiscuous mode [ 22.584810][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.591944][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.599652][ T285] device bridge_slave_0 entered promiscuous mode [ 22.609394][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.616605][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.624017][ T285] device bridge_slave_1 entered promiscuous mode [ 22.639468][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.646605][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.654004][ T286] device bridge_slave_0 entered promiscuous mode [ 22.660927][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.668000][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.675534][ T286] device bridge_slave_1 entered promiscuous mode [ 22.682093][ T284] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.689156][ T284] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.696583][ T284] device bridge_slave_0 entered promiscuous mode [ 22.706892][ T284] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.714002][ T284] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.721302][ T284] device bridge_slave_1 entered promiscuous mode [ 22.798110][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.805406][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.812935][ T288] device bridge_slave_0 entered promiscuous mode [ 22.822812][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.829981][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.837655][ T288] device bridge_slave_1 entered promiscuous mode [ 22.975846][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.982907][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.990212][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.997340][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.036737][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.043798][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.051142][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.058182][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.072011][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.079085][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.086376][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.093413][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.103713][ T284] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.110754][ T284] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.118055][ T284] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.125097][ T284] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.137575][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.145183][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.152518][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.159853][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.167258][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.174585][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.181801][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.189396][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.196628][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.221824][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.230066][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.237110][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.254561][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.262277][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.270574][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.277720][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.290562][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.307895][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.315372][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.322774][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.331698][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.340101][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.347366][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.355275][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.363799][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.372003][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.379064][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.386481][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 23.403213][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.411395][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.418532][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.426275][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.434289][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.442442][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.449505][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.457021][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.466440][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.474693][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.481729][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.510126][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.522546][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.530544][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.538743][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.546941][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.555064][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.563296][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.570323][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.577908][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.586272][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.594592][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.601602][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.609085][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.617380][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.625721][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.632758][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.651215][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.659752][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.668014][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.676271][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.684817][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.696185][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.704551][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.713023][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.721494][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.734398][ T288] device veth0_vlan entered promiscuous mode [ 23.743639][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.751763][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.759837][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.767358][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.775582][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.783777][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.791746][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.804387][ T285] device veth0_vlan entered promiscuous mode [ 23.813578][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.821647][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.829665][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.837729][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.849389][ T287] device veth0_vlan entered promiscuous mode [ 23.855729][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.863721][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.873919][ T288] device veth1_macvtap entered promiscuous mode [ 23.886748][ T285] device veth1_macvtap entered promiscuous mode [ 23.895470][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.902956][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.910621][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.919013][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.927338][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.935692][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.943424][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.951666][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.961469][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.970018][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.982277][ T284] device veth0_vlan entered promiscuous mode [ 23.997428][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.005472][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.014172][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.022345][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.030827][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.039230][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.047884][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.056280][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.064721][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.072286][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.088154][ T287] device veth1_macvtap entered promiscuous mode [ 24.097226][ T285] request_module fs-gadgetfs succeeded, but still no fs? [ 24.107015][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.115981][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.124230][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.139308][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.155682][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.164208][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.177520][ T286] device veth0_vlan entered promiscuous mode [ 24.185643][ T284] device veth1_macvtap entered promiscuous mode [ 24.197119][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.210137][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.218435][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.221309][ T339] loop1: detected capacity change from 0 to 4096 [ 24.227588][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.242072][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.251370][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.325571][ T341] loop0: detected capacity change from 0 to 128 [ 24.501418][ T336] I/O error, dev loop1, sector 3968 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 24.508097][ T339] overlayfs: missing 'lowerdir' [ 24.515517][ T286] device veth1_macvtap entered promiscuous mode [ 24.530345][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.540513][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.549067][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.564148][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.572924][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.586556][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.595803][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.604598][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.610298][ T349] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 24.613073][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.647879][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.658239][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.259744][ T345] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 25.269596][ T285] ------------[ cut here ]------------ [ 25.275202][ T285] WARNING: CPU: 0 PID: 285 at fs/inode.c:335 drop_nlink+0xc5/0x110 [ 25.283244][ T285] Modules linked in: [ 25.287225][ T285] CPU: 0 PID: 285 Comm: syz-executor Not tainted syzkaller #0 [ 25.294982][ T285] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 25.305661][ T285] RIP: 0010:drop_nlink+0xc5/0x110 [ 25.310694][ T285] Code: 1b 48 8d bb b8 04 00 00 be 08 00 00 00 e8 53 b5 f0 ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 fb 83 ab ff <0f> 0b eb 86 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 5e ff ff ff 4c [ 25.330534][ T285] RSP: 0018:ffffc9000d30fc38 EFLAGS: 00010293 [ 25.336771][ T285] RAX: ffffffff81c5e815 RBX: ffff88813297daf8 RCX: ffff88810d3bbcc0 [ 25.344823][ T285] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 25.352796][ T285] RBP: ffffc9000d30fc60 R08: 0000000000000003 R09: 0000000000000004 [ 25.360946][ T285] R10: dffffc0000000000 R11: fffff52001a61f78 R12: dffffc0000000000 [ 25.369094][ T285] R13: 1ffff1102652fb68 R14: ffff88813297db40 R15: 0000000000000000 [ 25.377323][ T285] FS: 0000555567380500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 25.386363][ T285] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.393110][ T285] CR2: 0000001b2ed19ff8 CR3: 000000012ed23000 CR4: 00000000003526b0 [ 25.401380][ T285] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 25.409480][ T285] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 25.417606][ T285] Call Trace: [ 25.420970][ T285] [ 25.424002][ T285] shmem_rmdir+0x5b/0x90 [ 25.428341][ T285] vfs_rmdir+0x393/0x500 [ 25.432780][ T285] incfs_kill_sb+0x105/0x220 [ 25.437638][ T285] deactivate_locked_super+0xb5/0x120 [ 25.443170][ T285] deactivate_super+0xaf/0xe0 [ 25.447859][ T285] cleanup_mnt+0x474/0x500 [ 25.452288][ T285] __cleanup_mnt+0x19/0x20 [ 25.456789][ T285] task_work_run+0x1e1/0x250 [ 25.461409][ T285] ? __cfi_task_work_run+0x10/0x10 [ 25.466560][ T285] ? __x64_sys_umount+0x12d/0x170 [ 25.471606][ T285] ? __cfi___x64_sys_umount+0x10/0x10 [ 25.476459][ T360] loop2: detected capacity change from 0 to 256 [ 25.477050][ T285] exit_to_user_mode_loop+0x9b/0xb0 [ 25.489120][ T285] exit_to_user_mode_prepare+0x87/0xd0 [ 25.493677][ T360] ======================================================= [ 25.493677][ T360] WARNING: The mand mount option has been deprecated and [ 25.493677][ T360] and is ignored by this kernel. Remove the mand [ 25.493677][ T360] option from the mount to silence this warning. [ 25.493677][ T360] ======================================================= [ 25.494929][ T285] syscall_exit_to_user_mode+0x1a/0x30 [ 25.535049][ T285] do_syscall_64+0x58/0xa0 [ 25.538932][ T360] FAT-fs (loop2): Directory bread(block 64) failed [ 25.539939][ T285] ? clear_bhb_loop+0x30/0x80 [ 25.546582][ T360] FAT-fs (loop2): Directory bread(block 65) failed [ 25.551156][ T285] ? clear_bhb_loop+0x30/0x80 [ 25.562413][ T285] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 25.567552][ T360] FAT-fs (loop2): Directory bread(block 66) failed [ 25.568346][ T285] RIP: 0033:0x7f2cb8b9bf17 [ 25.579227][ T285] Code: a2 c7 05 7c 96 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 25.579250][ T360] FAT-fs (loop2): Directory bread(block 67) failed [ 25.598857][ T285] RSP: 002b:00007fff58f223e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 25.598879][ T285] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f2cb8b9bf17 [ 25.598888][ T285] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff58f224a0 [ 25.598896][ T285] RBP: 00007fff58f224a0 R08: 00007fff58f234a0 R09: 00000000ffffffff [ 25.598906][ T285] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff58f23530 [ 25.598916][ T285] R13: 00007f2cb8c0471f R14: 0000000000005f9f R15: 00007fff58f23570 [ 25.606097][ T360] FAT-fs (loop2): Directory bread(block 68) failed [ 25.613819][ T285] [ 25.613828][ T285] ---[ end trace 0000000000000000 ]--- [ 25.622297][ T360] FAT-fs (loop2): Directory bread(block 69) failed [ 25.639562][ T285] ================================================================== [ 25.648815][ T360] FAT-fs (loop2): Directory bread(block 70) failed [ 25.653986][ T285] BUG: KASAN: null-ptr-deref in ihold+0x20/0x60 [ 25.654008][ T285] Write of size 4 at addr 0000000000000170 by task syz-executor/285 [ 25.654020][ T285] [ 25.654025][ T285] CPU: 0 PID: 285 Comm: syz-executor Tainted: G W syzkaller #0 [ 25.654040][ T285] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 25.654048][ T285] Call Trace: [ 25.654053][ T285] [ 25.654059][ T285] __dump_stack+0x21/0x24 [ 25.654080][ T285] dump_stack_lvl+0x110/0x170 [ 25.654098][ T285] ? __cfi_dump_stack_lvl+0x8/0x8 [ 25.654116][ T285] ? __cfi_call_rcu+0x10/0x10 [ 25.661234][ T360] FAT-fs (loop2): Directory bread(block 71) failed [ 25.663641][ T285] ? ihold+0x20/0x60 [ 25.663660][ T285] ? ihold+0x20/0x60 [ 25.663673][ T285] print_report+0x3d/0x60 [ 25.663690][ T285] kasan_report+0x122/0x150 [ 25.669654][ T360] FAT-fs (loop2): Directory bread(block 72) failed [ 25.675689][ T285] ? ihold+0x20/0x60 [ 25.675710][ T285] kasan_check_range+0x249/0x2a0 [ 25.675728][ T285] __kasan_check_write+0x14/0x20 [ 25.675742][ T285] ihold+0x20/0x60 [ 25.684162][ T360] FAT-fs (loop2): Directory bread(block 73) failed [ 25.690280][ T285] vfs_rmdir+0x25f/0x500 [ 25.808193][ T285] incfs_kill_sb+0x105/0x220 [ 25.812772][ T285] deactivate_locked_super+0xb5/0x120 [ 25.818144][ T285] deactivate_super+0xaf/0xe0 [ 25.822825][ T285] cleanup_mnt+0x474/0x500 [ 25.827230][ T285] __cleanup_mnt+0x19/0x20 [ 25.831635][ T285] task_work_run+0x1e1/0x250 [ 25.836212][ T285] ? __cfi_task_work_run+0x10/0x10 [ 25.841458][ T285] ? __x64_sys_umount+0x12d/0x170 [ 25.846490][ T285] ? __cfi___x64_sys_umount+0x10/0x10 [ 25.851860][ T285] exit_to_user_mode_loop+0x9b/0xb0 [ 25.857139][ T285] exit_to_user_mode_prepare+0x87/0xd0 [ 25.862599][ T285] syscall_exit_to_user_mode+0x1a/0x30 [ 25.868129][ T285] do_syscall_64+0x58/0xa0 [ 25.872530][ T285] ? clear_bhb_loop+0x30/0x80 [ 25.877185][ T285] ? clear_bhb_loop+0x30/0x80 [ 25.881843][ T285] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 25.887809][ T285] RIP: 0033:0x7f2cb8b9bf17 [ 25.892382][ T285] Code: a2 c7 05 7c 96 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 25.912001][ T285] RSP: 002b:00007fff58f223e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 25.920401][ T285] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f2cb8b9bf17 [ 25.928358][ T285] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff58f224a0 [ 25.936318][ T285] RBP: 00007fff58f224a0 R08: 00007fff58f234a0 R09: 00000000ffffffff [ 25.944297][ T285] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff58f23530 [ 25.952256][ T285] R13: 00007f2cb8c0471f R14: 0000000000005f9f R15: 00007fff58f23570 [ 25.960215][ T285] [ 25.963218][ T285] ================================================================== [ 25.972947][ T356] loop4: detected capacity change from 0 to 128 [ 25.981276][ T285] Disabling lock debugging due to kernel taint [ 25.987723][ T285] BUG: kernel NULL pointer dereference, address: 0000000000000170 [ 25.995537][ T285] #PF: supervisor write access in kernel mode [ 26.001597][ T285] #PF: error_code(0x0002) - not-present page [ 26.007654][ T285] PGD 132a40067 P4D 132a40067 PUD 0 [ 26.012961][ T285] Oops: 0002 [#1] PREEMPT SMP KASAN [ 26.018290][ T285] CPU: 0 PID: 285 Comm: syz-executor Tainted: G B W syzkaller #0 [ 26.027217][ T285] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 26.037258][ T285] RIP: 0010:ihold+0x26/0x60 [ 26.041748][ T285] Code: 33 36 7c df 55 48 89 e5 41 56 53 48 89 fb e8 61 7b ab ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 90 ac f0 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 51 [ 26.061698][ T285] RSP: 0018:ffffc9000d30fc78 EFLAGS: 00010246 [ 26.067749][ T285] RAX: ffff88810d3bbc00 RBX: 0000000000000000 RCX: ffff88810d3bbcc0 [ 26.075790][ T285] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 26.083765][ T285] RBP: ffffc9000d30fc88 R08: ffffffff87b717e7 R09: 1ffffffff0f6e2fc [ 26.091804][ T285] R10: dffffc0000000000 R11: fffffbfff0f6e2fd R12: ffff88813297db04 [ 26.099756][ T285] R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000 [ 26.107798][ T285] FS: 0000555567380500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 26.116712][ T285] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 26.123510][ T285] CR2: 0000000000000170 CR3: 000000012ed23000 CR4: 00000000003506b0 [ 26.131562][ T285] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 26.139534][ T285] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 26.147500][ T285] Call Trace: [ 26.150762][ T285] [ 26.153702][ T285] vfs_rmdir+0x25f/0x500 [ 26.158017][ T285] incfs_kill_sb+0x105/0x220 [ 26.162649][ T285] deactivate_locked_super+0xb5/0x120 [ 26.168001][ T285] deactivate_super+0xaf/0xe0 [ 26.172661][ T285] cleanup_mnt+0x474/0x500 [ 26.177053][ T285] __cleanup_mnt+0x19/0x20 [ 26.181445][ T285] task_work_run+0x1e1/0x250 [ 26.186012][ T285] ? __cfi_task_work_run+0x10/0x10 [ 26.191111][ T285] ? __x64_sys_umount+0x12d/0x170 [ 26.196132][ T285] ? __cfi___x64_sys_umount+0x10/0x10 [ 26.201579][ T285] exit_to_user_mode_loop+0x9b/0xb0 [ 26.206758][ T285] exit_to_user_mode_prepare+0x87/0xd0 [ 26.212198][ T285] syscall_exit_to_user_mode+0x1a/0x30 [ 26.217645][ T285] do_syscall_64+0x58/0xa0 [ 26.222054][ T285] ? clear_bhb_loop+0x30/0x80 [ 26.226759][ T285] ? clear_bhb_loop+0x30/0x80 [ 26.231432][ T285] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 26.237413][ T285] RIP: 0033:0x7f2cb8b9bf17 [ 26.241832][ T285] Code: a2 c7 05 7c 96 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 26.261543][ T285] RSP: 002b:00007fff58f223e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 26.270118][ T285] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f2cb8b9bf17 [ 26.278108][ T285] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff58f224a0 [ 26.286063][ T285] RBP: 00007fff58f224a0 R08: 00007fff58f234a0 R09: 00000000ffffffff [ 26.294099][ T285] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff58f23530 [ 26.302068][ T285] R13: 00007f2cb8c0471f R14: 0000000000005f9f R15: 00007fff58f23570 [ 26.310044][ T285] [ 26.313065][ T285] Modules linked in: [ 26.317048][ T285] CR2: 0000000000000170 [ 26.321211][ T285] ---[ end trace 0000000000000000 ]--- [ 26.326643][ T285] RIP: 0010:ihold+0x26/0x60 [ 26.331130][ T285] Code: 33 36 7c df 55 48 89 e5 41 56 53 48 89 fb e8 61 7b ab ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 90 ac f0 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 51 [ 26.350811][ T285] RSP: 0018:ffffc9000d30fc78 EFLAGS: 00010246 [ 26.356951][ T285] RAX: ffff88810d3bbc00 RBX: 0000000000000000 RCX: ffff88810d3bbcc0 [ 26.364922][ T285] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 26.372880][ T285] RBP: ffffc9000d30fc88 R08: ffffffff87b717e7 R09: 1ffffffff0f6e2fc [ 26.380832][ T285] R10: dffffc0000000000 R11: fffffbfff0f6e2fd R12: ffff88813297db04 [ 26.388811][ T285] R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000 [ 26.396765][ T285] FS: 0000555567380500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 26.405764][ T285] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 26.412328][ T285] CR2: 0000000000000170 CR3: 000000012ed23000 CR4: 00000000003506b0 [ 26.420286][ T285] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 26.428238][ T285] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 26.436455][ T285] Kernel panic - not syncing: Fatal exception [ 26.442903][ T285] Kernel Offset: disabled [ 26.447209][ T285] Rebooting in 86400 seconds..