last executing test programs: 6.87320315s ago: executing program 4 (id=201): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x805, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r3, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40004) sendmmsg$inet6(r2, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}], 0x1, 0x8014) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r4, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r5, 0x0, 0x30, &(0x7f0000000940)=ANY=[], 0x310) 6.835932324s ago: executing program 4 (id=202): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuset.memory_pressure\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r3, &(0x7f0000000780)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r4, 0x89f1, &(0x7f0000010640)={'tunl0\x00', &(0x7f00000001c0)=@ethtool_cmd={0x29, 0x5, 0x0, 0x4, 0x7, 0x0, 0x3, 0x28, 0x0, 0xfc, 0x3, 0x9, 0x4, 0xff, 0x0, 0x45}}) 5.97490162s ago: executing program 4 (id=219): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, 0x0) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r2, 0x0, 0x0, 0x805, 0x0, 0x0) sendto$inet(r2, 0x0, 0x0, 0x80, 0x0, 0xfcee) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r3, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) unshare(0x62020680) 5.059685132s ago: executing program 2 (id=223): rt_sigaction(0xd, &(0x7f0000000180)={0x0, 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r2, 0x0, 0x0, 0x805, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r3, &(0x7f00000009c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r4 = fsopen(&(0x7f0000000140)='ext3\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000100)='test_dummy_encryption', &(0x7f0000000240)='v1\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000000)='test_dummy_encryption', &(0x7f0000000080)='v1\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) 4.759627382s ago: executing program 4 (id=230): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r0, @ANYRES64], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r0, 0x0) ioctl$KVM_X86_SETUP_MCE(r0, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r1, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) write(r2, 0x0, 0x0) open_tree(0xffffffffffffff9c, 0x0, 0x89101) 4.727428775s ago: executing program 2 (id=231): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') r2 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r2, 0x0, 0x0, 0x805, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r4, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40004) sendmmsg$inet6(r3, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}], 0x1, 0x8014) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r5, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r6, 0x0, 0x30, &(0x7f0000000940)=ANY=[], 0x310) 4.711801857s ago: executing program 0 (id=232): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r3, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f0000000380)={'filter\x00', 0x7, 0x4, 0x4f0, 0x2f8, 0x2f8, 0x0, 0x408, 0x408, 0x408, 0x4, 0x0, {[{{@arp={@rand_addr=0x64010102, @private=0xa010100, 0xffff7f, 0xffffffff, 0x4, 0xb, {@mac=@local, {[0xff, 0xff, 0x0, 0xff, 0xff, 0xff]}}, {@empty, {[0x0, 0x0, 0x0, 0x0, 0xff]}}, 0x9, 0xffff, 0x1752, 0x2623, 0x8001, 0xf000, 'hsr0\x00', 'vxcan1\x00', {0xff}, {0xff}, 0x0, 0x1}, 0xc0, 0x1e8}, @unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0xfff, 'system_u:object_r:file_context_t:s0\x00'}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@remote, @empty, @dev={0xac, 0x14, 0x14, 0x13}, @rand_addr=0x64010101, 0x8, 0xffffffff}}}, {{@arp={@empty, @empty, 0xffffff00, 0xff, 0x4, 0x10, {@empty, {[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}}, {@empty, {[0xff]}}, 0x5, 0x26, 0x7, 0x1, 0x4, 0x1, 'veth1_to_bridge\x00', 'veth0_macvtap\x00', {}, {0xff}, 0x0, 0x300}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@random="abf5efb03c3c", @empty, @empty, @loopback, 0x4}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x540) 4.643854774s ago: executing program 0 (id=235): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r0, @ANYRES64], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r0, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r1, 0x0, 0x0, 0x805, 0x0, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xc, 0x0, 0x0) 436.585316ms ago: executing program 1 (id=239): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000004c0)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) sendmmsg$inet(r2, &(0x7f0000000a40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40040) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r3, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r4, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r5, 0x0, 0x2b, &(0x7f00000004c0)={0x2, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @empty}}}, 0x108) 436.311836ms ago: executing program 1 (id=240): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, 0x0) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r2, 0x0, 0x0, 0x805, 0x0, 0x0) sendto$inet(r2, 0x0, 0x0, 0x80, 0x0, 0xfcee) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r3, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) unshare(0x62020680) 435.861816ms ago: executing program 2 (id=242): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x24000]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r2, &(0x7f0000005800)=[{{0x0, 0x0, 0x0}}], 0x1, 0x8014) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r3, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) syz_open_procfs(0x0, 0x0) 434.488806ms ago: executing program 0 (id=245): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r2, 0x0, 0x0, 0x805, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r3, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r4, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r5, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) process_vm_writev(0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)=""/256, 0x100}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xe7}], 0x1, 0x0) 432.986446ms ago: executing program 0 (id=247): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000340)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r3, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r4 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r4, 0x0, 0x0, 0x805, 0x0, 0x0) sendto$inet(r4, 0x0, 0x0, 0x80, 0x0, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r5, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 432.778176ms ago: executing program 1 (id=248): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet_tcp(0x2, 0x1, 0x0) sendmmsg$inet(r2, &(0x7f0000000a40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40040) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r3, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') r4 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r4, &(0x7f0000005800)=[{{0x0, 0x0, 0x0}}], 0x1, 0x8014) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r5, &(0x7f0000000340)=ANY=[], 0x118) 432.589996ms ago: executing program 2 (id=249): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r2, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r3, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r5, 0x0, 0x0, 0x4) write$UHID_CREATE2(r4, 0x0, 0x118) 432.197257ms ago: executing program 4 (id=251): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r3, &(0x7f0000003c00), 0x0, 0x4) unshare(0x60000600) r4 = socket(0x10, 0x803, 0x0) sendto(r4, &(0x7f0000000740)="1200", 0x2, 0x0, 0x0, 0x0) 401.45786ms ago: executing program 0 (id=253): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x1]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r0, 0x0, 0x0, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) 393.71484ms ago: executing program 2 (id=254): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r2, 0x0, 0x0, 0x805, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r4, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40004) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r3, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}], 0x1, 0x8014) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r5 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_MSFILTER(r5, 0x29, 0x30, &(0x7f0000000380)=ANY=[], 0x190) 387.622711ms ago: executing program 1 (id=255): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r3, 0x0, 0x0, 0x4) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r4, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) shutdown(r5, 0x0) 336.544286ms ago: executing program 0 (id=257): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000140)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000040)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x2000001, 0x6031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000ceb000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) munlock(&(0x7f0000623000/0x4000)=nil, 0x4000) munlock(&(0x7f0000ffc000/0x1000)=nil, 0x1000) munlockall() 336.085656ms ago: executing program 1 (id=258): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r2, 0x0, 0x0, 0x805, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r3, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r4, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r5, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) process_vm_writev(0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)=""/256, 0x100}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xe7}], 0x1, 0x0) 331.536656ms ago: executing program 2 (id=259): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r0, @ANYRES64], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r0, 0x0) ioctl$KVM_X86_SETUP_MCE(r0, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r1, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) write(r2, 0x0, 0x0) open_tree(0xffffffffffffff9c, 0x0, 0x89101) 321.794857ms ago: executing program 4 (id=260): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') r2 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r2, 0x0, 0x0, 0x805, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r4, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40004) sendmmsg$inet6(r3, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}], 0x1, 0x8014) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r5, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r6, 0x0, 0x30, &(0x7f0000000940)=ANY=[], 0x310) 264.408713ms ago: executing program 1 (id=261): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r3, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) close_range(r3, 0xffffffffffffffff, 0x4dad8a8fd16c448c) 214.005468ms ago: executing program 3 (id=263): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r2, 0x0, 0x0, 0x805, 0x0, 0x0) sendto$inet(r2, 0x0, 0x0, 0x80, 0x0, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0x11, &(0x7f0000000100)=0x8000009, 0x4) 179.380592ms ago: executing program 3 (id=264): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r2, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r3, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r5, &(0x7f0000003c00), 0x0, 0x4) write$UHID_CREATE2(r4, 0x0, 0x118) 126.957627ms ago: executing program 3 (id=265): rt_sigaction(0xd, 0x0, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet_tcp(0x2, 0x1, 0x0) sendmmsg$inet(r2, &(0x7f0000000a40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40040) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r3, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') r4 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r4, &(0x7f0000005800)=[{{0x0, 0x0, 0x0}}], 0x1, 0x8014) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r5, &(0x7f0000000340)=ANY=[], 0x118) 85.703531ms ago: executing program 3 (id=266): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r3, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r4, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) shutdown(r5, 0x0) 36.984966ms ago: executing program 3 (id=267): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x1]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00), 0x0, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) 0s ago: executing program 3 (id=268): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000340)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r3 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r3, 0x0, 0x0, 0x805, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x80, 0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r4, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.159' (ED25519) to the list of known hosts. [ 22.019256][ T24] audit: type=1400 audit(1763220111.550:64): avc: denied { mounton } for pid=267 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.020593][ T267] cgroup: Unknown subsys name 'net' [ 22.043416][ T24] audit: type=1400 audit(1763220111.550:65): avc: denied { mount } for pid=267 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.071207][ T24] audit: type=1400 audit(1763220111.580:66): avc: denied { unmount } for pid=267 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.071425][ T267] cgroup: Unknown subsys name 'devices' [ 22.275313][ T267] cgroup: Unknown subsys name 'hugetlb' [ 22.280969][ T267] cgroup: Unknown subsys name 'rlimit' [ 22.481733][ T24] audit: type=1400 audit(1763220112.010:67): avc: denied { setattr } for pid=267 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.505244][ T24] audit: type=1400 audit(1763220112.010:68): avc: denied { mounton } for pid=267 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.512465][ T269] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.530798][ T24] audit: type=1400 audit(1763220112.010:69): avc: denied { mount } for pid=267 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 22.562382][ T24] audit: type=1400 audit(1763220112.080:70): avc: denied { relabelto } for pid=269 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.588161][ T24] audit: type=1400 audit(1763220112.080:71): avc: denied { write } for pid=269 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.622502][ T24] audit: type=1400 audit(1763220112.150:72): avc: denied { read } for pid=267 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.648227][ T24] audit: type=1400 audit(1763220112.150:73): avc: denied { open } for pid=267 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.674284][ T267] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 28.292069][ T24] kauditd_printk_skb: 1 callbacks suppressed [ 28.292080][ T24] audit: type=1400 audit(1763220117.820:75): avc: denied { read } for pid=275 comm="syz-executor" dev="nsfs" ino=4026531999 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 28.343460][ T24] audit: type=1400 audit(1763220117.850:76): avc: denied { open } for pid=275 comm="syz-executor" path="net:[4026531999]" dev="nsfs" ino=4026531999 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 28.367176][ T24] audit: type=1400 audit(1763220117.850:77): avc: denied { mounton } for pid=275 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 28.396915][ T24] audit: type=1400 audit(1763220117.850:78): avc: denied { module_request } for pid=275 comm="syz-executor" kmod="netdev-nr0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 28.436114][ T277] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.443612][ T277] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.450991][ T277] device bridge_slave_0 entered promiscuous mode [ 28.458196][ T277] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.465326][ T277] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.472673][ T277] device bridge_slave_1 entered promiscuous mode [ 28.546131][ T275] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.553193][ T275] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.560738][ T275] device bridge_slave_0 entered promiscuous mode [ 28.567793][ T275] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.574890][ T275] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.582221][ T275] device bridge_slave_1 entered promiscuous mode [ 28.608602][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.615706][ T279] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.623123][ T279] device bridge_slave_0 entered promiscuous mode [ 28.632167][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.639239][ T279] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.646740][ T279] device bridge_slave_1 entered promiscuous mode [ 28.688855][ T276] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.696048][ T276] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.703503][ T276] device bridge_slave_0 entered promiscuous mode [ 28.710153][ T278] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.717303][ T278] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.725029][ T278] device bridge_slave_0 entered promiscuous mode [ 28.731902][ T278] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.739098][ T278] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.746587][ T278] device bridge_slave_1 entered promiscuous mode [ 28.757605][ T276] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.764690][ T276] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.772001][ T276] device bridge_slave_1 entered promiscuous mode [ 28.822349][ T24] audit: type=1400 audit(1763220118.350:79): avc: denied { create } for pid=277 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 28.845105][ T24] audit: type=1400 audit(1763220118.370:80): avc: denied { write } for pid=277 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 28.865682][ T24] audit: type=1400 audit(1763220118.370:81): avc: denied { read } for pid=277 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 28.909287][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 28.916852][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.945131][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 28.953558][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 28.961728][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.968775][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.003920][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 29.012199][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 29.021809][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.030123][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.037191][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.044699][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.068635][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.076741][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.085000][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.092020][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.100254][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.108660][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.115736][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.123285][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.131426][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 29.159135][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.173688][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 29.182471][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.201431][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.225628][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 29.234182][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 29.241918][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 29.249986][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.258382][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.267042][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.274144][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.282035][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.290344][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.297388][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.304991][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.313255][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.320313][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.328177][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.336420][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.343466][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.350805][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.358974][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.367110][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.375253][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 29.383107][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 29.392355][ T277] device veth0_vlan entered promiscuous mode [ 29.399352][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 29.421050][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 29.429228][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 29.436853][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 29.445077][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.455654][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 29.464018][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.472133][ T279] device veth0_vlan entered promiscuous mode [ 29.481789][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 29.490271][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 29.504249][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 29.512697][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.521146][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.528197][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.535754][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 29.544547][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.552690][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.559733][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.567442][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 29.577195][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 29.585549][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 29.601607][ T275] device veth0_vlan entered promiscuous mode [ 29.610069][ T279] device veth1_macvtap entered promiscuous mode [ 29.617065][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 29.625789][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 29.634314][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 29.642545][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 29.650807][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.658969][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 29.667152][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.675331][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 29.683439][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 29.691611][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 29.699914][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 29.708262][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 29.715982][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 29.727735][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 29.736300][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 29.748449][ T278] device veth0_vlan entered promiscuous mode [ 29.762328][ T276] device veth0_vlan entered promiscuous mode [ 29.768890][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 29.777327][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 29.786124][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 29.795173][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 29.803705][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 29.811500][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 29.819707][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 29.827202][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 29.834627][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 29.842345][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 29.859054][ T278] device veth1_macvtap entered promiscuous mode [ 29.866701][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 29.875189][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 29.884262][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 29.892690][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 29.901204][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 29.909074][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 29.917461][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 29.931950][ T277] device veth1_macvtap entered promiscuous mode [ 29.940087][ T275] device veth1_macvtap entered promiscuous mode [ 29.948664][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 29.956535][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 29.964461][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 29.972663][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 29.981036][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 29.989404][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 29.999252][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 30.007485][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 30.025000][ T24] audit: type=1400 audit(1763220119.550:82): avc: denied { mounton } for pid=279 comm="syz-executor" path="/root/syzkaller.nPYJFu/syz-tmp" dev="sda1" ino=2041 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 30.049622][ T24] audit: type=1400 audit(1763220119.560:83): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 30.050229][ T279] request_module fs-gadgetfs succeeded, but still no fs? [ 30.071805][ T24] audit: type=1400 audit(1763220119.560:84): avc: denied { mounton } for pid=279 comm="syz-executor" path="/root/syzkaller.nPYJFu/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 30.106470][ T276] device veth1_macvtap entered promiscuous mode [ 30.115331][ T279] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 30.127760][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 30.135979][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 30.148960][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 30.161799][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 30.170525][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 30.179783][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 30.188222][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 30.199451][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 30.207984][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 30.239333][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 30.248164][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 30.277516][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 30.295906][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 30.362779][ T313] fuseblk: Invalid rootmode [ 30.385891][ T317] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 33.308999][ T24] kauditd_printk_skb: 23 callbacks suppressed [ 33.309011][ T24] audit: type=1400 audit(1763220122.840:108): avc: denied { setopt } for pid=354 comm="syz.3.24" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 33.400964][ T367] fuseblk: Invalid rootmode [ 35.020847][ T417] fuseblk: Invalid rootmode [ 36.294884][ T438] fuseblk: Invalid rootmode [ 37.799914][ T475] fuseblk: Invalid rootmode [ 37.919650][ T24] audit: type=1400 audit(1763220127.450:109): avc: denied { create } for pid=495 comm="syz.2.91" dev="anon_inodefs" ino=16421 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 37.990416][ T24] audit: type=1400 audit(1763220127.490:110): avc: denied { ioctl } for pid=495 comm="syz.2.91" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=16421 ioctlcmd=0xaa00 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 38.057403][ T514] fuseblk: Invalid rootmode [ 38.117763][ T520] x_tables: duplicate underflow at hook 1 [ 38.750766][ T555] fuseblk: Invalid rootmode [ 39.270054][ T584] fuseblk: Invalid rootmode [ 39.387234][ T24] audit: type=1400 audit(1763220128.920:111): avc: denied { read write } for pid=591 comm="syz.4.136" name="ashmem" dev="devtmpfs" ino=263 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 39.432801][ T24] audit: type=1400 audit(1763220128.920:112): avc: denied { open } for pid=591 comm="syz.4.136" path="/dev/ashmem" dev="devtmpfs" ino=263 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 39.463864][ T24] audit: type=1400 audit(1763220128.950:113): avc: denied { ioctl } for pid=591 comm="syz.4.136" path="/dev/ashmem" dev="devtmpfs" ino=263 ioctlcmd=0x7705 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 41.018170][ T750] x_tables: duplicate underflow at hook 1 [ 42.913674][ T802] x_tables: duplicate underflow at hook 1 [ 47.216871][ T847] incfs: Unexpected inode type [ 47.241351][ T24] audit: type=1400 audit(1763220136.770:114): avc: denied { unmount } for pid=275 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 47.273560][ T275] ------------[ cut here ]------------ [ 47.291946][ T275] WARNING: CPU: 1 PID: 275 at fs/inode.c:304 drop_nlink+0xc5/0x110 [ 47.300231][ T275] Modules linked in: [ 47.304404][ T275] CPU: 1 PID: 275 Comm: syz-executor Not tainted syzkaller #0 [ 47.314117][ T275] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 47.329530][ T275] RIP: 0010:drop_nlink+0xc5/0x110 [ 47.335277][ T275] Code: 1b 48 8d bb b8 04 00 00 be 08 00 00 00 e8 93 22 f2 ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 bb 30 b8 ff <0f> 0b eb 86 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 5e ff ff ff 4c [ 47.361413][ T275] RSP: 0018:ffffc90000bb7cd0 EFLAGS: 00010293 [ 47.369138][ T275] RAX: ffffffff81ab74e5 RBX: ffff8881279699c0 RCX: ffff88811e00cf00 [ 47.388060][ T275] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 47.404618][ T275] RBP: ffffc90000bb7cf8 R08: 0000000000000004 R09: 0000000000000003 [ 47.438386][ T275] R10: fffff52000176f88 R11: 1ffff92000176f88 R12: dffffc0000000000 [ 47.454553][ T275] R13: 1ffff11024f2d341 R14: ffff888127969a08 R15: 0000000000000000 [ 47.493560][ T275] FS: 00005555824e2500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 47.526705][ T275] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 47.533798][ T275] CR2: 0000200000000340 CR3: 000000012344b000 CR4: 00000000003506a0 [ 47.541828][ T275] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 47.570476][ T275] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 47.583393][ T275] Call Trace: [ 47.586745][ T275] shmem_rmdir+0x5b/0x90 [ 47.594374][ T276] ------------[ cut here ]------------ [ 47.600322][ T275] vfs_rmdir+0x1b3/0x3e0 [ 47.606524][ T275] incfs_kill_sb+0xfe/0x210 [ 47.611189][ T275] deactivate_locked_super+0xa0/0x100 [ 47.616876][ T276] WARNING: CPU: 1 PID: 276 at fs/inode.c:304 drop_nlink+0xc5/0x110 [ 47.624964][ T276] Modules linked in: [ 47.628963][ T275] deactivate_super+0xaf/0xe0 [ 47.634012][ T276] CPU: 1 PID: 276 Comm: syz-executor Not tainted syzkaller #0 [ 47.641748][ T275] cleanup_mnt+0x446/0x500 [ 47.646565][ T275] __cleanup_mnt+0x19/0x20 [ 47.651005][ T275] task_work_run+0x127/0x190 [ 47.657429][ T276] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 47.668049][ T275] exit_to_user_mode_loop+0xcb/0xe0 [ 47.673710][ T276] RIP: 0010:drop_nlink+0xc5/0x110 [ 47.679381][ T275] exit_to_user_mode_prepare+0x76/0xa0 [ 47.685463][ T276] Code: 1b 48 8d bb b8 04 00 00 be 08 00 00 00 e8 93 22 f2 ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 bb 30 b8 ff <0f> 0b eb 86 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 5e ff ff ff 4c [ 47.713534][ T275] syscall_exit_to_user_mode+0x1d/0x40 [ 47.723551][ T275] do_syscall_64+0x3d/0x40 [ 47.733554][ T275] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 47.749665][ T275] RIP: 0033:0x7f97aaca79f7 [ 47.754189][ T276] RSP: 0018:ffffc90000bc7cd0 EFLAGS: 00010293 [ 47.760371][ T276] RAX: ffffffff81ab74e5 RBX: ffff88810d1a19c0 RCX: ffff88811e00e2c0 [ 47.768470][ T275] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 47.793372][ T276] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 47.801484][ T276] RBP: ffffc90000bc7cf8 R08: 0000000000000004 R09: 0000000000000003 [ 47.809570][ T275] RSP: 002b:00007ffd6bd279a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 47.818208][ T276] R10: fffff52000178f88 R11: 1ffff92000178f88 R12: dffffc0000000000 [ 47.826295][ T275] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f97aaca79f7 [ 47.834427][ T276] R13: 1ffff11021a34341 R14: ffff88810d1a1a08 R15: 0000000000000000 [ 47.842443][ T276] FS: 0000555592762500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 47.851937][ T275] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd6bd27a60 [ 47.860259][ T275] RBP: 00007ffd6bd27a60 R08: 0000000000000000 R09: 0000000000000000 [ 47.868381][ T276] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 47.875308][ T275] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd6bd28af0 [ 47.883433][ T276] CR2: 00005555927854e8 CR3: 00000001242d8000 CR4: 00000000003506a0 [ 47.891784][ T276] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 47.899904][ T275] R13: 00007f97aad28d7d R14: 000000000000b86c R15: 00007ffd6bd28b30 [ 47.908036][ T276] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 47.916163][ T275] ---[ end trace fe34029d1834c4d0 ]--- [ 47.921944][ T275] ================================================================== [ 47.930047][ T275] BUG: KASAN: null-ptr-deref in ihold+0x20/0x60 [ 47.936314][ T275] Write of size 4 at addr 0000000000000170 by task syz-executor/275 [ 47.944393][ T275] [ 47.947496][ T275] CPU: 1 PID: 275 Comm: syz-executor Tainted: G W syzkaller #0 [ 47.956458][ T275] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 47.966530][ T275] Call Trace: [ 47.969843][ T275] __dump_stack+0x21/0x24 [ 47.974201][ T275] dump_stack_lvl+0x169/0x1d8 [ 47.978898][ T275] ? thaw_kernel_threads+0x220/0x220 [ 47.984302][ T275] ? show_regs_print_info+0x18/0x18 [ 47.989605][ T275] ? _raw_spin_lock+0x8e/0xe0 [ 47.994307][ T275] ? _raw_spin_trylock_bh+0x130/0x130 [ 47.999695][ T275] ? ihold+0x20/0x60 [ 48.003608][ T275] kasan_report+0xd8/0x130 [ 48.008037][ T275] ? ihold+0x20/0x60 [ 48.011957][ T275] kasan_check_range+0x280/0x290 [ 48.016908][ T275] __kasan_check_write+0x14/0x20 [ 48.021866][ T275] ihold+0x20/0x60 [ 48.025692][ T275] vfs_rmdir+0x247/0x3e0 [ 48.030046][ T275] incfs_kill_sb+0xfe/0x210 [ 48.034570][ T275] deactivate_locked_super+0xa0/0x100 [ 48.039975][ T275] deactivate_super+0xaf/0xe0 [ 48.044677][ T275] cleanup_mnt+0x446/0x500 [ 48.049116][ T275] __cleanup_mnt+0x19/0x20 [ 48.053553][ T275] task_work_run+0x127/0x190 [ 48.058180][ T275] exit_to_user_mode_loop+0xcb/0xe0 [ 48.063401][ T275] exit_to_user_mode_prepare+0x76/0xa0 [ 48.068885][ T275] syscall_exit_to_user_mode+0x1d/0x40 [ 48.074361][ T275] do_syscall_64+0x3d/0x40 [ 48.078794][ T275] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 48.084700][ T275] RIP: 0033:0x7f97aaca79f7 [ 48.089166][ T275] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 48.108790][ T275] RSP: 002b:00007ffd6bd279a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 48.117238][ T275] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f97aaca79f7 [ 48.125225][ T275] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd6bd27a60 [ 48.133216][ T275] RBP: 00007ffd6bd27a60 R08: 0000000000000000 R09: 0000000000000000 [ 48.141209][ T275] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd6bd28af0 [ 48.149201][ T275] R13: 00007f97aad28d7d R14: 000000000000b86c R15: 00007ffd6bd28b30 [ 48.157195][ T275] ================================================================== [ 48.165280][ T275] Disabling lock debugging due to kernel taint [ 48.172237][ T276] Call Trace: [ 48.176195][ T276] shmem_rmdir+0x5b/0x90 [ 48.180546][ T276] vfs_rmdir+0x1b3/0x3e0 [ 48.185080][ T276] incfs_kill_sb+0xfe/0x210 [ 48.189744][ T276] deactivate_locked_super+0xa0/0x100 [ 48.195261][ T276] deactivate_super+0xaf/0xe0 [ 48.200186][ T276] cleanup_mnt+0x446/0x500 [ 48.204701][ T276] __cleanup_mnt+0x19/0x20 [ 48.209370][ T276] task_work_run+0x127/0x190 [ 48.214078][ T276] exit_to_user_mode_loop+0xcb/0xe0 [ 48.219438][ T276] exit_to_user_mode_prepare+0x76/0xa0 [ 48.225010][ T276] syscall_exit_to_user_mode+0x1d/0x40 [ 48.230735][ T276] do_syscall_64+0x3d/0x40 [ 48.235272][ T276] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 48.241338][ T276] RIP: 0033:0x7f4491cd29f7 [ 48.246071][ T276] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 48.273397][ T276] RSP: 002b:00007ffc55dae608 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 48.284226][ T276] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f4491cd29f7 [ 48.294473][ T276] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc55dae6c0 [ 48.302539][ T276] RBP: 00007ffc55dae6c0 R08: 0000000000000000 R09: 0000000000000000 [ 48.310619][ T276] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffc55daf750 [ 48.318762][ T276] R13: 00007f4491d53d7d R14: 000000000000b9cf R15: 00007ffc55daf790 [ 48.326947][ T276] ---[ end trace fe34029d1834c4d1 ]--- [ 48.332612][ T276] BUG: kernel NULL pointer dereference, address: 0000000000000170 [ 48.340447][ T276] #PF: supervisor write access in kernel mode [ 48.346530][ T276] #PF: error_code(0x0002) - not-present page [ 48.352516][ T276] PGD 127cee067 P4D 127cee067 PUD 0 [ 48.357837][ T276] Oops: 0002 [#1] PREEMPT SMP KASAN [ 48.363053][ T276] CPU: 1 PID: 276 Comm: syz-executor Tainted: G B W syzkaller #0 [ 48.371905][ T276] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 48.381995][ T276] RIP: 0010:ihold+0x26/0x60 [ 48.386527][ T276] Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 d1 28 b8 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 80 1a f2 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 51 [ 48.406175][ T276] RSP: 0018:ffffc90000bc7d10 EFLAGS: 00010202 [ 48.412256][ T276] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000286 [ 48.420245][ T276] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000170 [ 48.428240][ T276] RBP: ffffc90000bc7d20 R08: 0000000000000000 R09: ffffed10234856d8 [ 48.436323][ T276] R10: ffffed10234856d8 R11: 1ffff110234856d7 R12: 1ffff110234a6ab0 [ 48.444319][ T276] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 [ 48.452337][ T276] FS: 0000555592762500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 48.461286][ T276] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 48.467880][ T276] CR2: 0000000000000170 CR3: 00000001242d8000 CR4: 00000000003506a0 [ 48.475874][ T276] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 48.483876][ T276] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 48.491863][ T276] Call Trace: [ 48.495168][ T276] vfs_rmdir+0x247/0x3e0 [ 48.499699][ T276] incfs_kill_sb+0xfe/0x210 [ 48.504323][ T276] deactivate_locked_super+0xa0/0x100 [ 48.509724][ T276] deactivate_super+0xaf/0xe0 [ 48.514424][ T276] cleanup_mnt+0x446/0x500 [ 48.518940][ T276] __cleanup_mnt+0x19/0x20 [ 48.523543][ T276] task_work_run+0x127/0x190 [ 48.528291][ T276] exit_to_user_mode_loop+0xcb/0xe0 [ 48.533506][ T276] exit_to_user_mode_prepare+0x76/0xa0 [ 48.538975][ T276] syscall_exit_to_user_mode+0x1d/0x40 [ 48.544632][ T276] do_syscall_64+0x3d/0x40 [ 48.549065][ T276] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 48.554969][ T276] RIP: 0033:0x7f4491cd29f7 [ 48.559397][ T276] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 48.579021][ T276] RSP: 002b:00007ffc55dae608 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 48.587548][ T276] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f4491cd29f7 [ 48.595620][ T276] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc55dae6c0 [ 48.603621][ T276] RBP: 00007ffc55dae6c0 R08: 0000000000000000 R09: 0000000000000000 [ 48.611612][ T276] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffc55daf750 [ 48.619611][ T276] R13: 00007f4491d53d7d R14: 000000000000b9cf R15: 00007ffc55daf790 [ 48.627705][ T276] Modules linked in: [ 48.631619][ T276] CR2: 0000000000000170 [ 48.635797][ T276] ---[ end trace fe34029d1834c4d2 ]--- [ 48.641382][ T276] RIP: 0010:ihold+0x26/0x60 [ 48.646075][ T276] Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 d1 28 b8 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 80 1a f2 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 51 [ 48.665979][ T276] RSP: 0018:ffffc90000bc7d10 EFLAGS: 00010202 [ 48.672069][ T276] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000286 [ 48.680161][ T276] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000170 [ 48.688355][ T276] RBP: ffffc90000bc7d20 R08: 0000000000000000 R09: ffffed10234856d8 [ 48.696420][ T276] R10: ffffed10234856d8 R11: 1ffff110234856d7 R12: 1ffff110234a6ab0 [ 48.704600][ T276] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 [ 48.712605][ T276] FS: 0000555592762500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 48.721763][ T276] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 48.728459][ T276] CR2: 0000000000000170 CR3: 00000001242d8000 CR4: 00000000003506a0 [ 48.736471][ T276] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 48.744458][ T276] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 48.752444][ T276] Kernel panic - not syncing: Fatal exception [ 48.758846][ T276] Kernel Offset: disabled [ 48.763178][ T276] Rebooting in 86400 seconds..