last executing test programs: 3.002756345s ago: executing program 0 (id=1): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000006c0)=ANY=[@ANYBLOB="1201000000000040c41090ea80000000000109022400010000000009040000010300000009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = eventfd(0x8c66) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000080)={0x2d1, 0x0, 0x1, r3}) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f00000000c0)={0x9f, 0x0, 0x4, r3}) syz_usb_control_io(r0, &(0x7f00000000c0)={0x2c, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00\x00\b'], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000000)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x20, 0x1, 0x3, "c282fe"}, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000940)={0x84, &(0x7f0000000340)={0x0, 0x14, 0xe, "0e738125f8d13f6b6487cf5dcfdd"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) 2.38621988s ago: executing program 2 (id=13): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c010000190001000000000000000000e0000001000000000000000000000000fe8000000000000000000000000000aa4e22000000002b000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000104000000000000feffffffffffffff03000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000840005"], 0x13c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040880) 2.38604312s ago: executing program 2 (id=14): mkdir(&(0x7f0000000300)='./bus\x00', 0x0) setxattr$system_posix_acl(0x0, &(0x7f0000000040)='system.posix_acl_access\x00', &(0x7f00000000c0)={{}, {}, [], {0x4, 0x1}, [{0x8, 0x3}], {0x10, 0x1}}, 0x2c, 0x3) getxattr(&(0x7f0000000100)='./bus\x00', 0x0, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) landlock_restrict_self(0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x105002, 0x0) renameat2(0xffffffffffffffff, 0x0, 0xffffffffffffff9c, 0x0, 0x6) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) write$tun(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="001c86dd0700100000004000000060ec97000fc83a00fe8000000000000000000000860000aaff020000000000000000000000000001"], 0xffe) 2.356429871s ago: executing program 2 (id=16): setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000a80)=0x1, 0x4) munmap(&(0x7f000045e000/0x1000)=nil, 0x1000) mremap(&(0x7f0000dde000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000bb3000/0x1000)=nil) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mremap(&(0x7f00006bd000/0x2000)=nil, 0x2000, 0x4000, 0x3, &(0x7f0000187000/0x4000)=nil) mremap(&(0x7f000061c000/0x13000)=nil, 0x13000, 0x4000, 0x3, &(0x7f0000fb0000/0x4000)=nil) mremap(&(0x7f000046b000/0x3000)=nil, 0x3000, 0x1000, 0x3, &(0x7f0000769000/0x1000)=nil) munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000080), 0x1c) shutdown(r0, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x3b) recvmmsg(r1, &(0x7f0000001040)=[{{0x0, 0x0, 0x0}, 0x400}], 0x1, 0x40000002, 0x0) prctl$PR_GET_NO_NEW_PRIVS(0x27) futex(0x0, 0x2, 0x1, 0x0, 0x0, 0x1) prctl$PR_GET_NO_NEW_PRIVS(0x27) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x39) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(r3, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0x14, 0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r3, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x3, 0x7, 0xe1, 0x81, 0x9, 0xd9, 0x40, 0x41, 0xfb, 0x1, 0xc, 0x2, 0x2, 0x41, 0x1, 0xf7}}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x5, 0x101, 0x3, 0x2, 0x106c, 0x100, 0x8000000000000001, 0x700000000000000, 0x380000, 0x8, 0x8, 0x4, 0x0, 0x7ffc], 0x1, 0x3c0251}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r7, 0x0) 2.239557354s ago: executing program 2 (id=18): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, &(0x7f0000000140)=@gcm_256={{0x303, 0x3a}, "0f6b01fa00a20c00", "9e8ecc7cb535247672a2eff75b30ff2bb17b550800", "0002d900", "a1014200000102a0"}, 0x38) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) newfstatat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x3080) write$tun(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="001c86dd0700100000002800000060ec97000fc83a00fe8000f5ff00000000000000000000aaff0200"/51], 0xffe) 2.180052036s ago: executing program 2 (id=21): setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, &(0x7f0000000140)=@gcm_256={{0x303, 0x3a}, "0f6b01fa00a20c00", "9e8ecc7cb535247672a2eff75b30ff2bb17b550800", "0002d900", "a1014200000102a0"}, 0x38) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) newfstatat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x3080) write$tun(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="001c86dd0700100000002800000060ec97000fc83a00fe8000002800000000000000000000aaff0200"/51], 0xffe) 2.116262127s ago: executing program 2 (id=22): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000020303000000000000000000000100000800010001"], 0x1c}}, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0xc00, 0x0) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) quotactl$Q_GETQUOTA(0xffffffff80000701, &(0x7f0000000000)=@sg0, 0x0, 0x0) ioctl$TIOCSIG(r2, 0x40045436, 0x1f) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001300)={0x1c, 0x19, 0x1, 0x0, 0x0, {0x1d, 0xd601, 0x9}, [@nested={0x8, 0x9, 0x0, 0x1, [@nested={0x4, 0x75}]}]}, 0x1c}, 0x1, 0x0, 0x0, 0x5}, 0x804) r3 = getpid() process_vm_readv(r3, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x7ffff000}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640)=[{&(0x7f0000000040)=""/103, 0x28e8719a}], 0x286, 0x0) sendmsg$nl_generic(r1, &(0x7f00000005c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x2dc, 0x12, 0x200, 0x70bd27, 0x25dfdbfe, {0x11}, [@nested={0x14e, 0xc6, 0x0, 0x1, [@generic="31773f747cc89a7dda74a7448a460dde00961d653ac0397faec54169d34edd9813399c2101b242eb5a859f667137c7c3b57b9a7347739d19f4ff37f0a138e9f67b591c6af04019e5e51d4734a9e99dbe24af04fb9efd7ae862ade0abac453f338ac2ecb0c7f299e73df75374ae1d9277dea70d60c76d18b44117ac384321990844f583059048ca0fb69a4bd92dd5170ccd61d5942ee65ca51ff5227e9f3b820c20f21d4be6bcc9a5616c08a458", @generic="5925d94ba4626fcf9009f914aaa5fc0de4846185cab1827228053286978fe29f9b6698ffc7ae33b25b19379834dad44f1eca855f85ed96be52879e9db7f5a77c1d03bb32c41862a5b0a0ac150dec32db63910557384d1cc19a626d6f5efd5f33b7", @nested={0x4, 0x4d}, @generic="9529cf052d06be6525d9f5a8dddc0e93509b2ac12a2d3ea14d8eb59c2d4181a0fbdf3c3211e896cf91eed53a0222df4b", @nested={0x4, 0xd1}, @nested={0x4, 0x88}]}, @generic="602f222666d88e04731ec0fb2f1a227c43590bb287d80f07d8ae81c290613aac0735ce5851e3bbab64e03749f33f11fd6b8998c394842299edb17a15594e8820fd475c64ee3032649e8eda467c2d35b890338db18f09362db7d07be93829aee12435c313f4ea432fbd164b5abd2d4e6e0bc1bff2552e27cc7b392095956132102d5434601d7c29d06293ac6785cab5bc139b5d7dee76cb4e404941c452a201b8972be0f405fc16d42cf563ddc1f250291952b3454705bb7a4efe540abdd38511685d24223831a6f683ed58abf11a1969f58f60150d06dcaa2ed8b31053421f4f4a76dde6e274527c544893a97c0ea2d12d02", @nested={0x79, 0x10a, 0x0, 0x1, [@typed={0x8, 0x92, 0x0, 0x0, @pid=r3}, @generic="d7eea01961eb662802b44e96a8c3b3f137f3b6f42cecabb7c9e29bef26f0f4c45ba4345ed819ff83bd627631bde946d3132fc9c7d2e6eb555aa4ae76326ab9a3b1519ba7c4fc88d657c443d7834385f0d63a7d794b07bfb053b5619c12995ee4540758b2f9d5c9da3e03dd18c7"]}, @generic="08bcabd5dbf443594a"]}, 0x2dc}, 0x1, 0x0, 0x0, 0x40}, 0x40800) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) syz_usb_connect_ath9k(0x3, 0x56, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x38e38e38e38e402, [{{0x9, 0x2, 0xfffffffffffffc3f}}]}}, 0x7fe782539b0b) 1.401505165s ago: executing program 3 (id=33): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/slabinfo\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000000)=[{&(0x7f0000000100)=""/4147, 0x1033}], 0x1, 0x8b3, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c010000190001000000000000000000e0000001000000000000000000000000fe8000000000000000000000000000aa4e220000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000104000000000000feffffffffffffff03000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000ffffff8000000000000001000000000000008400050020010000000000000000000000000000000000002b0000000000"], 0x13c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040880) 1.336255227s ago: executing program 3 (id=34): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x7c, 0x0, 0x0) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000880)={{0x80e3000, 0x3000, 0x8, 0xd, 0x3, 0x0, 0x45, 0x5, 0x0, 0x2e, 0x19}, {0x5000, 0x0, 0x8, 0x22, 0x3e, 0x9, 0x7f, 0x0, 0x1, 0x5, 0x3}, {0x1000, 0xfec00000, 0xe, 0x1f, 0x1, 0x0, 0x7, 0x60, 0x0, 0xa7, 0x3}, {0x4000, 0x10000, 0xa, 0x6, 0x4, 0x2, 0x1, 0xf8, 0x9, 0x9, 0xf}, {0x60000, 0x70000, 0xc, 0x2, 0x15, 0x6, 0xab, 0x7c, 0x1, 0x83, 0xf7, 0x6}, {0x1000, 0xdddd1000, 0x10, 0x4b, 0x3, 0x8, 0x7, 0x9, 0x9, 0x13, 0x8, 0x10}, {0xeeee8000, 0x1, 0x9, 0x14, 0x0, 0x5, 0x4, 0x3, 0x3, 0x84, 0x3, 0x79}, {0xffffffff, 0xeeef0000, 0xc, 0x5, 0xf, 0x7, 0x4, 0xe2, 0x2, 0x8, 0xf0, 0x7}, {0x0, 0x802f}, {0x3000, 0xfffd}, 0xc0000025, 0x0, 0x501, 0x2024, 0x5, 0x0, 0x50000, [0x7, 0x9, 0x60, 0x6]}) 1.319463667s ago: executing program 3 (id=35): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/slabinfo\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000000)=[{&(0x7f0000000100)=""/4147, 0x1033}], 0x1, 0x8b3, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c010000190001000000000000000000e0000001000000000000000000000000fe8000000000000000000000000000aa4e220000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000104000000000000feffffffffffffff030000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000001000000000000008400050020010000000000000000000000000000000000002b0000000000000000000000000000000000000000050000000000000200"], 0x13c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040880) 1.298980347s ago: executing program 3 (id=36): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x50, r0, 0x0) (async) r1 = userfaultfd(0x1) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) (async) ioctl$UFFDIO_POISON(r1, 0xc020aa08, &(0x7f0000000380)={{&(0x7f0000ffe000/0x2000)=nil, 0x2000}}) (async, rerun: 64) syz_usb_connect$uac3(0x5, 0xa0, &(0x7f00000000c0)=ANY=[@ANYBLOB="12011001000000203512020040000102030109028e0003010f10fa080b0002010130030904000000010130000a2401042a001b0000000d240901010000000001000000132403020303050105020000000300ff7f10000904010000010230000904010101010230000905ea08ff030680010a2525020000000701000904020000010230000904020101010230000905820940000104090a2525020000000304000a5e9a"], 0x0) (rerun: 64) 488.077608ms ago: executing program 1 (id=37): syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000080)={0x0, &(0x7f0000000500)=[@nested_amd_vmload={0x182, 0x18}, @enable_nested={0x12c, 0x18}, @wr_crn={0x67, 0x20, {0x8, 0x5}}, @wr_crn={0x67, 0x20, {0x0, 0x2}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x2, @save_area=0x688, 0x2, 0x0, 0x9}}, @nested_amd_stgi={0x17e, 0x10}, @wrmsr={0x65, 0x20, {0xa54, 0x2}}, @wr_crn={0x67, 0x20, {0x4, 0x3}}, @wrmsr={0x65, 0x20, {0x994, 0x7ff}}, @nested_amd_stgi={0x17e, 0x10}, @code={0xa, 0x76, {"b805000000b900a000000f01c1440fc7790466b889008ed066baf80cb83e831b8fef66bafc0c66ed48b809000000000000000f23d80f21f835c00000000f23f864430f22de2642f40f20e035800000000f22e0b9800000c00f3235002000000f3046d36ff4"}}, @uexit={0x0, 0x18, 0x636}], 0x1b6}) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x14, &(0x7f0000000080)=0xfff, 0x4) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) r1 = syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_GET(0xffffffffffffffff, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f0000000200)=ANY=[@ANYBLOB="1400", @ANYRES16=r1, @ANYBLOB="8fdf2cbd7000"], 0x14}, 0x1, 0x0, 0x0, 0x4005}, 0x40000) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)={@multicast1, @local}, 0xc) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r3, 0xae9a) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000440)={[0x0, 0x100000000, 0x0, 0x7f, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x8, 0x2, 0xffffffffffffffff], 0x0, 0x200}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000380)={[0x101, 0xaec4, 0x6, 0x4004, 0x2, 0x4, 0xefffffffffffffff, 0x0, 0x0, 0x2000000, 0x20000, 0x1c, 0x0, 0x5, 0x1], 0x0, 0x41981}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 446.281409ms ago: executing program 1 (id=38): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) r1 = dup3(r0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x14, 0x0, &(0x7f00000003c0)=[@increfs={0x40046304, 0x2}, @acquire_done={0x40106309, 0x2}], 0xfffffffffffffe44, 0x0, 0x0}) 437.052669ms ago: executing program 1 (id=39): r0 = socket(0x2, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000240)={0x1, &(0x7f0000000080)=[{0x6, 0x1, 0x86, 0x17}]}, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x60001, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) write$tun(r3, &(0x7f0000000380)=ANY=[@ANYBLOB="080086dd0001280004000003a60c6eec00be00442ffffe800000000088fc70738daf7b3200aaff020000000000000000000000000003"], 0xfdef) socket$tipc(0x1e, 0x5, 0x0) 332.157311ms ago: executing program 1 (id=40): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) io_setup(0x4, &(0x7f0000002380)=0x0) r2 = eventfd2(0xd81, 0x80000) io_submit(r1, 0x2, &(0x7f0000000280)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x9, r2, 0x0, 0x0, 0xc3, 0x0, 0x1, r2}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2, 0xf4, r2, &(0x7f0000000040), 0x0, 0x4, 0x0, 0x2}]) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=ANY=[@ANYBLOB="020300030e0000002cbd7000fcdbdf2503000900800000001cdc0dca1d9f68846960e56de42944af030006f7ffffffffffffff24ac14142600e5ffffffffffff0100"], 0x70}, 0x1, 0x7}, 0x0) mount(0x0, 0x0, &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r4, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) sendmsg$inet(r0, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x4048011) r5 = open$dir(&(0x7f0000000140)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x202000, 0x4) getdents64(r5, &(0x7f0000000380)=""/207, 0xcf) 327.419572ms ago: executing program 1 (id=41): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/slabinfo\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000000)=[{&(0x7f0000000100)=""/4147, 0x1033}], 0x1, 0x8b3, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c010000190001000000000000000000e0000001000000000000000000000000fe8000000000000000000000000000aa4e220000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000104000000000000feffffffffffffff0300000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000010000000000000084000500"], 0x13c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040880) 317.394532ms ago: executing program 1 (id=42): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e21, 0x659, @empty, 0xff}, 0x1c) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0x1bf5f000) r1 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) fchdir(r2) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='memory.swap.current\x00', 0x275a, 0x0) r4 = userfaultfd(0x80001) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x268}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x80000a, 0x31, 0xffffffffffffffff, 0xd0fb8000) ioctl$UFFDIO_CONTINUE(r4, 0xc020aa07, &(0x7f00000004c0)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x1}) write$binfmt_script(r3, &(0x7f0000000340)={'#! ', './file0'}, 0xb) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x28011, r3, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) syz_io_uring_setup(0x6c0b, &(0x7f0000000040)={0x0, 0x1323, 0xc002, 0x6, 0x3e7}, 0x0, 0x0, 0x0) mount$tmpfs(0x0, 0x0, &(0x7f0000000180), 0x88, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) fcntl$setflags(r2, 0x2, 0x1) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) getsockopt$inet_buf(r5, 0x0, 0x30, 0x0, &(0x7f0000000180)) setsockopt$inet6_udp_int(r0, 0x11, 0xa, &(0x7f0000000280)=0x7ff, 0x4) write(r0, 0x0, 0x0) 249.02µs ago: executing program 3 (id=43): openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r0, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x7c, 0x0, 0x0) ioctl$KVM_SET_SREGS(r0, 0x4138ae84, &(0x7f0000000880)={{0x80e3000, 0x3000, 0x8, 0xd, 0x3, 0x0, 0x45, 0x5, 0x0, 0x2e, 0x19}, {0x5000, 0x0, 0x8, 0x22, 0x3e, 0x9, 0x7f, 0x0, 0x1, 0x5, 0x3}, {0x1000, 0xfec00000, 0xe, 0x1f, 0x1, 0x0, 0x7, 0x60, 0x0, 0xa7, 0x3}, {0x4000, 0x10000, 0xa, 0x6, 0x4, 0x2, 0x1, 0xf8, 0x9, 0x9, 0xf}, {0x60000, 0x70000, 0xc, 0x2, 0x15, 0x6, 0xab, 0x7c, 0x1, 0x83, 0xf7, 0x6}, {0x1000, 0xdddd1000, 0x10, 0x4b, 0x3, 0x8, 0x7, 0x9, 0x9, 0x13, 0x8, 0x10}, {0xeeee8000, 0x1, 0x9, 0x14, 0x0, 0x5, 0x4, 0x3, 0x3, 0x84, 0x3, 0x79}, {0xffffffff, 0xeeef0000, 0xc, 0x5, 0xf, 0x7, 0x4, 0xe2, 0x2, 0x8, 0xf0, 0x7}, {0x0, 0x802f}, {0x3000, 0xfffd}, 0xc0000025, 0x0, 0x501, 0x2024, 0x5, 0x0, 0x50000, [0x7, 0x9, 0x60, 0x6]}) 0s ago: executing program 3 (id=44): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x201, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x4000000, @mcast1}}}, 0x32) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x9) socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x2, 0x4, 0xfffffffe) r5 = socket$inet_icmp(0x2, 0x2, 0x1) bind$inet(r5, &(0x7f0000000100)={0x2, 0x4e24, @private=0xa010181}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r7, 0x10e, 0xc, 0x0, 0x0) sendmsg$nl_generic(r7, 0x0, 0x40816) mmap(&(0x7f0000336000/0x1000)=nil, 0x1000, 0x0, 0x4010, r4, 0x66451000) r8 = openat$cgroup_type(r6, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r8, &(0x7f0000000340), 0x9) sendmmsg(r3, &(0x7f0000004140)=[{{&(0x7f0000001c00)=@rxrpc=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x4e20, @local}}, 0x80, 0x0}}, {{&(0x7f0000002b80)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x1, 0x0, 0x4, 0x1, {0xa, 0x4e21, 0x2, @mcast2, 0x9}}}, 0x80, 0x0, 0x0, &(0x7f0000004500)=ANY=[], 0x1100}}], 0x2, 0x6) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000a80)={'filter\x00', 0xb001, 0x4, 0x3e8, 0x1f8, 0x1f8, 0x110, 0x300, 0x300, 0x300, 0x7fffffe, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@multicast, @rand_addr=0x64010102, @broadcast, 0x4}}}, {{@arp={@broadcast, @loopback, 0x0, 0x0, 0x16, 0x70, {@mac=@random="c1328a2329f2", {[0xff, 0xff, 0xff, 0x0, 0xff]}}, {@mac=@random="d82d6bab149c", {[0x0, 0x0, 0x0, 0xff]}}, 0x2, 0x7, 0xfffd, 0x0, 0x0, 0x0, 'veth0_to_team\x00', 'vxcan1\x00', {0xff}, {0xff}}, 0xc0, 0xe8}, @unspec=@CLASSIFY={0x28, 'CLASSIFY\x00', 0x0, {0x80000001}}}, {{@uncond, 0xc0, 0x108}, @unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x2, 'syz0\x00', {0x9}}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x438) r9 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) r12 = ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x0) ioctl$KVM_CAP_HYPERV_SYNIC2(r12, 0x4068aea3, 0x0) ioctl$KVM_CREATE_IRQCHIP(r9, 0xae60) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r14 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r14, &(0x7f0000000080), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r13, 0x8933, &(0x7f0000000180)={'vcan0\x00'}) kernel console output (not intermixed with test programs): T36] audit: type=1400 audit(1786158186.420:62): avc: denied { rlimitinh } for pid=232 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.860894][ T36] audit: type=1400 audit(1786158186.420:63): avc: denied { siginh } for pid=232 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.52' (ED25519) to the list of known hosts. [ 21.251065][ T36] audit: type=1400 audit(1786158193.820:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.252214][ T286] cgroup: Unknown subsys name 'net' [ 21.273795][ T36] audit: type=1400 audit(1786158193.820:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.301085][ T36] audit: type=1400 audit(1786158193.850:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.301251][ T286] cgroup: Unknown subsys name 'devices' [ 21.425312][ T286] cgroup: Unknown subsys name 'hugetlb' [ 21.430935][ T286] cgroup: Unknown subsys name 'rlimit' [ 21.523211][ T36] audit: type=1400 audit(1786158194.090:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.546384][ T36] audit: type=1400 audit(1786158194.090:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 21.555458][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 21.571229][ T36] audit: type=1400 audit(1786158194.100:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.591374][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.602818][ T36] audit: type=1400 audit(1786158194.150:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.636784][ T36] audit: type=1400 audit(1786158194.150:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.662383][ T36] audit: type=1400 audit(1786158194.150:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.687966][ T36] audit: type=1400 audit(1786158194.150:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.415131][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.422188][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.429276][ T294] bridge_slave_0: entered allmulticast mode [ 22.435560][ T294] bridge_slave_0: entered promiscuous mode [ 22.454803][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.461841][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.468903][ T294] bridge_slave_1: entered allmulticast mode [ 22.475127][ T294] bridge_slave_1: entered promiscuous mode [ 22.484037][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.491067][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.498162][ T296] bridge_slave_0: entered allmulticast mode [ 22.504467][ T296] bridge_slave_0: entered promiscuous mode [ 22.521644][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.528701][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.535798][ T296] bridge_slave_1: entered allmulticast mode [ 22.541931][ T296] bridge_slave_1: entered promiscuous mode [ 22.567757][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.574816][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.581852][ T295] bridge_slave_0: entered allmulticast mode [ 22.588112][ T295] bridge_slave_0: entered promiscuous mode [ 22.597317][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.604376][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.611414][ T295] bridge_slave_1: entered allmulticast mode [ 22.617703][ T295] bridge_slave_1: entered promiscuous mode [ 22.639640][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.646700][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.653768][ T293] bridge_slave_0: entered allmulticast mode [ 22.660034][ T293] bridge_slave_0: entered promiscuous mode [ 22.666463][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.673547][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.680578][ T293] bridge_slave_1: entered allmulticast mode [ 22.686842][ T293] bridge_slave_1: entered promiscuous mode [ 22.820275][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.827345][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.834658][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.841676][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.868583][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.875658][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.882913][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.889941][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.900946][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.908001][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.915276][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.922304][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.931724][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.938778][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.946055][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.953068][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.995297][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.002591][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.009794][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.017652][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.024854][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.032132][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.039528][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.046731][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.058092][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.065132][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.080871][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.087923][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.107220][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.114270][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.121707][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.128732][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.136989][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.144035][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.151505][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.158551][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.176770][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.183833][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.191545][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.198585][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.244076][ T293] veth0_vlan: entered promiscuous mode [ 23.252432][ T295] veth0_vlan: entered promiscuous mode [ 23.259180][ T296] veth0_vlan: entered promiscuous mode [ 23.278262][ T294] veth0_vlan: entered promiscuous mode [ 23.287675][ T293] veth1_macvtap: entered promiscuous mode [ 23.298857][ T296] veth1_macvtap: entered promiscuous mode [ 23.317391][ T294] veth1_macvtap: entered promiscuous mode [ 23.328673][ T295] veth1_macvtap: entered promiscuous mode [ 23.361108][ T296] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 23.412848][ T316] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 23.462131][ T323] dummy_hcd dummy_hcd.0: remove, state 1 [ 23.555491][ T31] hub 1-0:1.0: activate --> -108 [ 23.560712][ T323] usb usb1: USB disconnect, device number 1 [ 23.574652][ T323] dummy_hcd dummy_hcd.0: stopped [ 23.579970][ T323] dummy_hcd dummy_hcd.0: USB bus 1 deregistered [ 23.695082][ T339] FAULT_INJECTION: forcing a failure. [ 23.695082][ T339] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 23.708223][ T339] CPU: 0 UID: 0 PID: 339 Comm: syz.1.11 Not tainted syzkaller #0 4d4a838cf2fc485b043991145ccf8426a0241c16 [ 23.708245][ T339] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 23.708257][ T339] Call Trace: [ 23.708261][ T339] [ 23.708266][ T339] __dump_stack+0x21/0x30 [ 23.708288][ T339] dump_stack_lvl+0x140/0x1c0 [ 23.708301][ T339] ? __cfi_dump_stack_lvl+0x10/0x10 [ 23.708315][ T339] ? do_vfs_ioctl+0x182d/0x2010 [ 23.708328][ T339] ? __ia32_compat_sys_ioctl+0x920/0x920 [ 23.708341][ T339] dump_stack+0x19/0x20 [ 23.708353][ T339] should_fail_ex+0x3c2/0x510 [ 23.708365][ T339] should_fail+0xf/0x20 [ 23.708375][ T339] should_fail_usercopy+0x1e/0x30 [ 23.708387][ T339] _copy_from_user+0x20/0xa0 [ 23.708400][ T339] kvm_vm_ioctl+0x6c2/0xc40 [ 23.708414][ T339] ? __cfi_kvm_vm_ioctl+0x10/0x10 [ 23.708428][ T339] ? ioctl_has_perm+0x1bc/0x500 [ 23.708437][ T339] ? __asan_memcpy+0x5a/0x80 [ 23.708448][ T339] ? ioctl_has_perm+0x408/0x500 [ 23.708457][ T339] ? has_cap_mac_admin+0xd0/0xd0 [ 23.708466][ T339] ? proc_fail_nth_write+0x184/0x220 [ 23.708481][ T339] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 23.708495][ T339] ? selinux_file_ioctl+0x732/0x1480 [ 23.708505][ T339] ? vfs_write+0xbcf/0xfd0 [ 23.708514][ T339] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 23.708524][ T339] ? __cfi_vfs_write+0x10/0x10 [ 23.708534][ T339] ? __kasan_check_write+0x18/0x20 [ 23.708543][ T339] ? mutex_unlock+0x90/0x240 [ 23.708558][ T339] ? __cfi_mutex_unlock+0x10/0x10 [ 23.708572][ T339] ? bpf_lsm_file_ioctl+0xd/0x20 [ 23.708585][ T339] ? security_file_ioctl+0x3e/0x110 [ 23.708601][ T339] ? __cfi_kvm_vm_ioctl+0x10/0x10 [ 23.708614][ T339] __se_sys_ioctl+0x135/0x1b0 [ 23.708626][ T339] __x64_sys_ioctl+0x7f/0xa0 [ 23.708637][ T339] x64_sys_call+0x1878/0x2ee0 [ 23.708646][ T339] do_syscall_64+0x57/0xf0 [ 23.708657][ T339] ? clear_bhb_loop+0x50/0xa0 [ 23.708672][ T339] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 23.708684][ T339] RIP: 0033:0x7f231599e0d9 [ 23.708694][ T339] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 23.708703][ T339] RSP: 002b:00007f2316856028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 23.708718][ T339] RAX: ffffffffffffffda RBX: 00007f2315c25fa0 RCX: 00007f231599e0d9 [ 23.708725][ T339] RDX: 0000200000000140 RSI: 00000000c008ae67 RDI: 0000000000000004 [ 23.708732][ T339] RBP: 00007f2316856090 R08: 0000000000000000 R09: 0000000000000000 [ 23.708738][ T339] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 23.708745][ T339] R13: 00007f2315c26038 R14: 00007f2315c25fa0 R15: 00007ffe57400d98 [ 23.708753][ T339] [ 23.873503][ T45] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 24.156253][ T45] usb 4-1: unable to get BOS descriptor or descriptor too short [ 24.165181][ T45] usb 4-1: not running at top speed; connect to a high speed hub [ 24.176313][ T45] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 215, changing to 4 [ 24.191178][ T45] usb 4-1: language id specifier not provided by device, defaulting to English [ 24.201489][ T45] usb 4-1: New USB device found, idVendor=04b4, idProduct=931d, bcdDevice= 0.40 [ 24.211973][ T45] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 24.220181][ T45] usb 4-1: Product: syz [ 24.224556][ T45] usb 4-1: Manufacturer: 鴪ꋾ犪䍌甩㪖Ᶎ䑕炗ꃗ㯑ꚕ䄝隇텝⽺䰸㰚힇阚电둰₶헒ⷡ셌孾種⺗⟗轈헴ꄦ큠㷽ꮓኍ㞪噞ഐ㏯쨀行袡ᒏ檧鐞澁ﮱ쏑݇䱮괙ᮋ汖ႋँ錎㜇䊠⑱ຐꨣ衟ꁭ悝粈赤㶯춎敧 [ 24.249765][ T45] usb 4-1: SerialNumber: syz [ 24.327424][ T362] Zero length message leads to an empty skb [ 24.463984][ T45] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 24.471553][ T45] usb 4-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 24.484854][ T45] usb 4-1: USB disconnect, device number 2 [ 24.576866][ T363] udevd[363]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 24.593559][ T31] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 24.595764][ T381] netlink: 140 bytes leftover after parsing attributes in process `syz.1.30'. [ 24.733455][ T31] usb 3-1: device descriptor read/64, error -71 [ 24.933457][ T10] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 24.973527][ T31] usb 3-1: device descriptor read/64, error -71 [ 25.083504][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 25.089676][ T10] usb 2-1: config 0 has an invalid interface number: 196 but max is 0 [ 25.098167][ T10] usb 2-1: config 0 has no interface number 0 [ 25.104490][ T10] usb 2-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 25.114964][ T10] usb 2-1: config 0 interface 196 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 25.125303][ T10] usb 2-1: config 0 interface 196 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 25.135702][ T10] usb 2-1: config 0 interface 196 has no altsetting 0 [ 25.144127][ T10] usb 2-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 25.153161][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.161168][ T10] usb 2-1: Product: syz [ 25.165542][ T10] usb 2-1: Manufacturer: syz [ 25.170118][ T10] usb 2-1: SerialNumber: syz [ 25.175853][ T10] usb 2-1: config 0 descriptor?? [ 25.181062][ T385] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 25.213458][ T31] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 25.343468][ T31] usb 3-1: device descriptor read/64, error -71 [ 25.383432][ T45] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 25.394751][ T10] ipheth 2-1:0.196: ipheth_get_macaddr: usb_control_msg: -71 [ 25.402150][ T10] ipheth 2-1:0.196: probe with driver ipheth failed with error -71 [ 25.411356][ T10] usb 2-1: USB disconnect, device number 2 [ 25.533426][ T45] usb 4-1: Using ep0 maxpacket: 32 [ 25.539668][ T45] usb 4-1: config 1 interface 1 altsetting 1 has an endpoint descriptor with address 0xEA, changing to 0x8A [ 25.551227][ T45] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x8A has invalid maxpacket 1023, setting to 64 [ 25.563481][ T45] usb 4-1: New USB device found, idVendor=1235, idProduct=0002, bcdDevice= 0.40 [ 25.572783][ T45] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.580780][ T45] usb 4-1: Product: syz [ 25.585002][ T31] usb 3-1: device descriptor read/64, error -71 [ 25.585039][ T45] usb 4-1: Manufacturer: syz [ 25.595894][ T45] usb 4-1: SerialNumber: syz [ 25.703542][ T31] usb usb3-port1: attempt power cycle [ 25.801815][ T395] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 25.810390][ T395] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 25.818502][ T395] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 25.826986][ T395] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 25.835098][ T395] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 25.843577][ T395] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 25.851547][ T395] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 25.860166][ T395] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 25.868276][ T395] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 25.876737][ T395] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 25.889494][ T45] usb 4-1: unit 5 not found! [ 25.897410][ T45] usb 4-1: USB disconnect, device number 3 [ 25.912745][ T363] udevd[363]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 26.002007][ T403] syz.1.39 uses obsolete (PF_INET,SOCK_PACKET) [ 26.043584][ T31] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 26.064482][ T31] usb 3-1: device descriptor read/8, error -71 [ 26.121481][ T409] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 26.194413][ T31] usb 3-1: device descriptor read/8, error -71 [ 26.407389][ T36] kauditd_printk_skb: 76 callbacks suppressed [ 26.407406][ T36] audit: type=1400 audit(1786158198.980:150): avc: denied { create } for pid=413 comm="syz.3.44" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 26.432781][ T36] audit: type=1400 audit(1786158198.980:151): avc: denied { connect } for pid=413 comm="syz.3.44" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 26.452422][ T36] audit: type=1400 audit(1786158198.980:152): avc: denied { create } for pid=413 comm="syz.3.44" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 26.456866][ T322] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI [ 26.472056][ T36] audit: type=1400 audit(1786158198.980:153): avc: denied { bind } for pid=413 comm="syz.3.44" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 26.484080][ T322] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 26.484097][ T322] CPU: 1 UID: 0 PID: 322 Comm: syz.0.1 Not tainted syzkaller #0 4d4a838cf2fc485b043991145ccf8426a0241c16 [ 26.484119][ T322] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.484129][ T322] RIP: 0010:set_link_state+0x2a/0x1240 [ 26.504269][ T36] audit: type=1400 audit(1786158198.980:154): avc: denied { node_bind } for pid=413 comm="syz.3.44" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 26.511419][ T322] Code: 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 60 49 89 fd 48 bb 00 00 00 00 00 fc ff df e8 1d 00 ce fd 4c 89 e8 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 ef e8 78 c4 26 fe 4d 8b 75 00 49 8d 95 93 [ 26.511437][ T322] RSP: 0018:ffffc9000b7af718 EFLAGS: 00010046 [ 26.511453][ T322] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff88810cfedf00 [ 26.511465][ T322] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 26.511476][ T322] RBP: ffffc9000b7af7a0 R08: 0000000000000003 R09: 0000000000000004 [ 26.511486][ T322] R10: dffffc0000000000 R11: fffff520016f5ee0 R12: 0000000000000000 [ 26.511497][ T322] R13: 0000000000000000 R14: 0000000000000000 R15: ffff888104bf4000 [ 26.511507][ T322] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 26.511521][ T322] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 26.511533][ T322] CR2: 000000110c262168 CR3: 00000000074aa000 CR4: 00000000003526b0 [ 26.524291][ T36] audit: type=1400 audit(1786158198.980:155): avc: denied { write } for pid=413 comm="syz.3.44" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 26.532766][ T322] Call Trace: [ 26.532776][ T322] [ 26.532785][ T322] ? __kasan_check_write+0x18/0x20 [ 26.538624][ T36] audit: type=1400 audit(1786158198.990:156): avc: denied { create } for pid=413 comm="syz.3.44" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 26.557724][ T322] dummy_pullup+0xd1/0x130 [ 26.557756][ T322] ? __cfi_dummy_pullup+0x10/0x10 [ 26.557779][ T322] usb_gadget_disconnect_locked+0x151/0x400 [ 26.577731][ T36] audit: type=1400 audit(1786158198.990:157): avc: denied { connect } for pid=413 comm="syz.3.44" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 26.583411][ T322] gadget_unbind_driver+0xaf/0x3f0 [ 26.583436][ T322] ? __cfi_gadget_unbind_driver+0x10/0x10 [ 26.591659][ T36] audit: type=1400 audit(1786158199.030:158): avc: denied { read } for pid=92 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 26.599340][ T322] device_release_driver_internal+0x4ad/0x830 [ 26.599371][ T322] driver_detach+0x1f5/0x2d0 [ 26.599394][ T322] bus_remove_driver+0x254/0x2b0 [ 26.599411][ T322] driver_unregister+0x79/0xb0 [ 26.607769][ T36] audit: type=1400 audit(1786158199.030:159): avc: denied { search } for pid=92 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 26.615321][ T322] usb_gadget_unregister_driver+0x52/0x80 [ 26.615345][ T322] raw_release+0xdb/0x280 [ 26.814168][ T322] ? __cfi_raw_release+0x10/0x10 [ 26.819121][ T322] __fput+0x208/0xa30 [ 26.823096][ T322] ____fput+0x20/0x30 [ 26.827070][ T322] task_work_run+0x1e8/0x260 [ 26.831660][ T322] ? __cfi_task_work_run+0x10/0x10 [ 26.836754][ T322] ? __kasan_check_write+0x18/0x20 [ 26.841856][ T322] do_exit+0xa46/0x2850 [ 26.845994][ T322] ? __cfi_do_exit+0x10/0x10 [ 26.850567][ T322] ? __kasan_check_write+0x18/0x20 [ 26.855664][ T322] ? _raw_spin_lock_irq+0x93/0x120 [ 26.860777][ T322] do_group_exit+0x21f/0x2f0 [ 26.865370][ T322] ? __kasan_check_write+0x18/0x20 [ 26.870472][ T322] ? recalc_sigpending+0x184/0x1d0 [ 26.875574][ T322] get_signal+0x134c/0x1490 [ 26.880064][ T322] arch_do_signal_or_restart+0xbc/0x700 [ 26.885596][ T322] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 26.891748][ T322] ? __se_sys_ioctl+0x198/0x1b0 [ 26.896590][ T322] syscall_exit_to_user_mode+0x57/0xb0 [ 26.902049][ T322] do_syscall_64+0x63/0xf0 [ 26.906472][ T322] ? clear_bhb_loop+0x50/0xa0 [ 26.911148][ T322] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 26.917065][ T322] RIP: 0033:0x7f22a239dd6b [ 26.921480][ T322] Code: Unable to access opcode bytes at 0x7f22a239dd41. [ 26.928477][ T322] RSP: 002b:00007f22a0df4f00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 26.936873][ T322] RAX: fffffffffffffffc RBX: 0000000000000003 RCX: 00007f22a239dd6b [ 26.944835][ T322] RDX: 00007f22a0df5fd0 RSI: 0000000080085502 RDI: 0000000000000003 [ 26.952797][ T322] RBP: 00007f22a0df5fd0 R08: 0000000000000001 R09: 00000000ffffffff [ 26.960754][ T322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000080085502 [ 26.968708][ T322] R13: 0000000800000000 R14: 0000000000000000 R15: 00007f22a2453882 [ 26.976664][ T322] [ 26.979666][ T322] Modules linked in: [ 26.983546][ T322] ---[ end trace 0000000000000000 ]--- [ 26.989011][ T322] RIP: 0010:set_link_state+0x2a/0x1240 [ 26.994460][ T322] Code: 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 60 49 89 fd 48 bb 00 00 00 00 00 fc ff df e8 1d 00 ce fd 4c 89 e8 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 ef e8 78 c4 26 fe 4d 8b 75 00 49 8d 95 93 [ 27.014091][ T322] RSP: 0018:ffffc9000b7af718 EFLAGS: 00010046 [ 27.020150][ T322] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff88810cfedf00 [ 27.028105][ T322] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 27.036058][ T322] RBP: ffffc9000b7af7a0 R08: 0000000000000003 R09: 0000000000000004 [ 27.044013][ T322] R10: dffffc0000000000 R11: fffff520016f5ee0 R12: 0000000000000000 [ 27.051990][ T322] R13: 0000000000000000 R14: 0000000000000000 R15: ffff888104bf4000 [ 27.059946][ T322] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 27.068859][ T322] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.075424][ T322] CR2: 000000110c262168 CR3: 00000000074aa000 CR4: 00000000003526b0 [ 27.083401][ T322] Kernel panic - not syncing: Fatal exception [ 27.089693][ T322] Kernel Offset: disabled [ 27.094003][ T322] Rebooting in 86400 seconds..