last executing test programs: 3.708729039s ago: executing program 1 (id=2): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100), r0) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000001480)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4806}, 0x0) 3.63761517s ago: executing program 1 (id=5): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f00000000c0)=[{0x20, 0x0, 0x0, 0xfffff034}, {0x20, 0x0, 0x0, 0xfffff038}, {0x6}]}, 0x10) sendmmsg(r0, &(0x7f0000000180), 0x4000190, 0x0) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000100)) r2 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000000018105704da0700000000000109022400010000ba0009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000012c0)={0x24, 0x0, 0x0, &(0x7f0000001300)=ANY=[@ANYBLOB="0022220000009523b31ce93ee907000000002990370900be008300"], 0x0}, 0x0) syz_usb_control_io$hid(r2, &(0x7f0000001340)={0x24, 0x0, 0x0, &(0x7f0000001380)=ANY=[], 0x0}, 0x0) sendmsg$inet(r0, &(0x7f0000001280)={&(0x7f0000000040)={0x2, 0x4e21, @private=0xa010101}, 0x10, &(0x7f0000001240)=[{&(0x7f00000001c0)}, {&(0x7f00000011c0)="4f39275ad233cd6e99a4b8ea15c24ad939eba3cccc3b13f79f250a12a1fd3c4a86853540360f3ac43ed370711b61102fe7799656cd1ad40596e150b0268ae5fb104bc0615e07b9c1", 0x48}], 0x2}, 0x24040001) 3.209513811s ago: executing program 3 (id=11): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000180)=0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000380)=0x6) syz_open_dev$loop(0x0, 0x4, 0x901) timer_create(0x5, 0x0, 0x0) r3 = socket(0x1e, 0x4, 0x0) getsockopt$TIPC_IMPORTANCE(r3, 0x10f, 0x7f, 0x0, 0x0) setns(0xc9, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="1400"], 0x14}}, 0x44014) recvmmsg(0xffffffffffffffff, &(0x7f0000003900), 0x0, 0x102, 0x0) r4 = userfaultfd(0x80001) setrlimit(0x2, &(0x7f00000000c0)={0xe, 0xffffffffffffffff}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x280c02, 0x48) signalfd4(r5, &(0x7f0000000100)={[0xc35]}, 0x8, 0x80000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x4008032, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000000)) epoll_create(0x8) unshare(0x20000000) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x9, 0x4, 0x6, 0xfffa}, 0x1d, [0x3, 0xc95a, 0xfffffff3, 0x9, 0x6, 0x2, 0x3, 0x7f, 0x6, 0x4d, 0x39cc191a, 0x5c, 0x9, 0x80005, 0x2, 0x0, 0x6, 0x3, 0x0, 0x2ab, 0x4, 0x7, 0x4, 0x3c5b, 0x1, 0xb, 0x9, 0x1, 0x1f461e2c, 0x7, 0xe661, 0x7fff, 0xb, 0x3, 0x7fff, 0x4c74, 0x80000000, 0x800242, 0xffffffff, 0x10000e, 0x40, 0x71, 0x2, 0x406, 0x3, 0x2, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x3, 0x80092a3, 0x4, 0x1, 0x20000000, 0x82, 0x0, 0x7, 0x6, 0x8, 0x4, 0x1, 0x40], [0x193, 0xffff, 0x12f, 0x2ea9c1f6, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xd, 0x2bf, 0x5, 0x1000, 0xfffffffc, 0x43, 0x100, 0x7, 0x5, 0x2f, 0xe, 0x312, 0x1, 0x0, 0xfffffffe, 0x8, 0x4, 0x8000, 0x9, 0x6, 0x5, 0x6, 0x4, 0xfb, 0x1, 0x8000, 0x5f31, 0xbcf5, 0x1, 0x2, 0x5, 0x8000, 0x4, 0x9, 0x8, 0x9, 0x6, 0xb, 0xa, 0x1, 0x9, 0x9, 0x2, 0x7f, 0x9, 0x1, 0x3, 0x9, 0xffffffff, 0x7, 0x3, 0x8, 0x48c93690, 0x42, 0x400004], [0x6, 0x6, 0x80000001, 0x2, 0xff, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x3, 0xb, 0x4, 0x5, 0x1005, 0xfffffffe, 0x1f0, 0xfffffffd, 0xfffffffe, 0x86, 0x1, 0x9, 0x3e7, 0x9, 0x5, 0x2, 0x2, 0x800, 0x8, 0x5, 0x8001, 0x7, 0x38, 0x800003, 0x200, 0x80, 0xfffffffe, 0xcc52, 0xc, 0xfff, 0xa2, 0x7, 0x53cf697b, 0xfffffff9, 0x6, 0xac8, 0xbf, 0x10002, 0x403, 0x7ff, 0x3, 0x0, 0x1, 0xffff, 0x0, 0x6, 0x1c, 0x120000, 0x3ff, 0x6, 0xaaed, 0x4, 0xff], [0x9, 0xbb31, 0x3, 0x8, 0x5, 0x1, 0x6, 0x5, 0x0, 0xd2, 0x2, 0x1ff, 0x3, 0x7, 0x5, 0x1003, 0x101, 0x10000, 0x6, 0x7fff, 0xffff, 0xe620, 0x2, 0x2, 0x0, 0x2, 0x14c, 0x60a7, 0x6, 0x4, 0xffffffff, 0x80000000, 0xc5a, 0x8, 0xc8, 0xee1, 0x0, 0xffff, 0x3, 0x400007f, 0x100, 0x9602, 0x4, 0x2, 0xffff, 0x6, 0x1, 0x10080, 0x6, 0x5, 0x30b1d693, 0x5a2b, 0xc, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x7, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 1.037486385s ago: executing program 3 (id=20): pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x8000002, 0x2004}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x22008041, &(0x7f0000000180)={0xa, 0x2, 0x2, @loopback, 0xfffffffd}, 0x20) sendto$inet6(r1, &(0x7f00000001c0)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090000006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5753444fe05f33e5f91045540836c3cd6af10f0cd", 0xac, 0x1, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x406f413, 0x0) 1.009731725s ago: executing program 3 (id=23): r0 = socket(0x10, 0x803, 0x0) connect$802154_dgram(r0, &(0x7f0000000180)={0x24, @none={0x0, 0xffff}}, 0x14) 907.816537ms ago: executing program 2 (id=24): r0 = socket(0x10, 0x80003, 0x0) write(r0, &(0x7f0000000480)="240000001a005f0214f9f4e6ff0804000a000000fe0000000000aa0008000f00fd000000", 0x24) close_range(r0, 0xffffffffffffffff, 0x0) 907.709037ms ago: executing program 3 (id=25): r0 = fsopen(&(0x7f0000000280)='gadgetfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x5) fchdir(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='.\x00', 0x0, 0x0) lseek(r2, 0x2, 0x0) getdents64(r2, 0x0, 0x22) getdents64(r2, 0x0, 0x0) 907.663017ms ago: executing program 2 (id=26): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r0, 0x0) r1 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_TABLE(r1, 0x29, 0xd1, &(0x7f0000000040)=0xfe, 0x4) 907.536257ms ago: executing program 3 (id=27): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x20004084) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_clone(0x1200111, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) listen(r2, 0x801) accept(r3, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000004680), 0xffffffffffffffff) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) 907.493208ms ago: executing program 2 (id=28): r0 = fsopen(&(0x7f00000003c0)='gadgetfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x0, 0xf) fsconfig$FSCONFIG_CMD_RECONFIGURE(r0, 0x7, 0x0, 0x0, 0x0) 891.266488ms ago: executing program 2 (id=29): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x5, 0x20000000000002, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) getpid() sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000000240)=[{{0x0, 0xf5ffffff, 0x0, 0x0, 0x0, 0x4000000}}], 0xf00, 0x4c42bb4f92, 0x0) shutdown(r1, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x4008032, 0xffffffffffffffff, 0x0) 531.208907ms ago: executing program 2 (id=30): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x8, 0x0, &(0x7f0000000240)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000280)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000380)={0x4c, 0x0, &(0x7f00000003c0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000440)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000005c0)={0x44, 0x0, &(0x7f0000000600)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 336.269892ms ago: executing program 2 (id=31): r0 = syz_create_resource$futex(&(0x7f0000000400)=0x1) r1 = syz_create_resource$futex(&(0x7f0000000080)=0x1) futex(r0, 0xb, 0x1, 0x0, r1, 0x2) r2 = syz_create_resource$futex(&(0x7f0000000480)=0x2) futex(r0, 0x5, 0x1, 0x0, r2, 0x0) 221.796694ms ago: executing program 0 (id=32): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x11, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x1}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) epoll_pwait(0xffffffffffffffff, 0x0, 0x0, 0xfffffff8, 0x0, 0x0) 148.149986ms ago: executing program 1 (id=33): r0 = openat(0xffffffffffffff9c, &(0x7f0000001200)='./file2\x00', 0x101042, 0x15) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x2000) modify_ldt$write2(0x11, &(0x7f0000000180)={0x3fe, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x10) 136.391127ms ago: executing program 0 (id=34): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000480)=0x79, 0x4) bind$inet(r0, &(0x7f00000004c0)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000580)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r0, &(0x7f0000000600)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000680)="91f8a984851bde", 0x7}], 0x1}}], 0x1, 0x2090) writev(r0, &(0x7f0000000900)=[{&(0x7f0000000940)="396cf87d", 0x4}], 0x1) write(r0, &(0x7f0000000a40)="39270725d93c4ab6cb559938ef75d3d7fd5c06a228a59b717b6934bdefb8b8e2dfca955f26b8cab29bdfdce27e4f9cb112fe41e0a6799578f252519cd4a289985be050d209b4c9617cfb94f1bed81696b0c741f6d366efd7ad3dc7cef66647abaf4108076fdffecb7457f5b6b01835a3c79b873f6ebbcb5ee659861a7b4cce43711bbd6b13c941fbb38ef7e1fe0c70fa4aa49b98b43615605d51cc4d742b364a4e7a2f3dee73b86af3fa4ca8f616eaaedcf155820e1767f7d66ecd818ece03f32c3367bbd9ce6656123f394b7f26f1e0420a9ac4cb25638c75fc3c487ba76fd64c26da6d7ce7f1ee8f49d6e9cc95f5c94bf93183ebf8e6be081e0b9f34bd6c2fe5f895dc1cc01e3018cef11ad9e2e1baf35254258efbaf3e8898f561bdb5c4c49f9d3146503df48e194ea3d06396e970ea9fc7c47eb9988477ed1a7e8641dfeea7b57b5a9967c58762574262efde8795f20f2d45e964ede39c7a6502c03f863e6a21a33ba324e6474d4f0495054745f3a80e6554d4d1fd5ddbca11c5e3e6f9087ca1981a14baa3a2956faa8f6b1652e8cf30d7c37a060bc6c836862451c4e76fc9cb221db8d4b449c27aa44564cb33ef144ed0c51bdd66675302692d979297f30e2d9523f85afbbf54c5b5e2261f8b792f83b33cca78c44a5c4e6ff96273979acbb447d49c0502cc9f8991e9bc784a2e978912d8102d867b631d54269936f54bb20ee57e2b4ba4b6c44e767aef24f6c3a8bb5a3b2084d793082e4c5e517694b220e35ac140913e0e55257af03c4dcf376f24773642c14279e2b55906b0b8a4a34fa4d73f37a5feeca1cf93395b998ddcc557d0e2ae112cf1566f7097e7acb6c0bdf9350781341bb83936b355779417839a70c3cbe13e9561b0820df44dbd2a24bd3d6d8b0d9e83983cb7ad8f147f", 0x28e) 6.29683ms ago: executing program 0 (id=35): mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r0 = socket(0x40000000015, 0x5, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000040)={0xa, 0x5, 0x0, @mcast1, 0xe75}, 0x1c) 6.19096ms ago: executing program 0 (id=36): mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000380)='./proc_mnt\x00', &(0x7f00000003c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc_mnt/sys/net/ipv4/vs/svc_lfactor\x00', 0x101002, 0x0) sendfile(r0, r0, 0x0, 0xf2) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000480)='E', 0x1}], 0x1) 6.16309ms ago: executing program 1 (id=37): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0) write(r0, &(0x7f0000000080)='252:0 1', 0x7) 6.10273ms ago: executing program 0 (id=38): r0 = add_key$user(&(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180), 0xc9, 0xfffffffffffffffd) r1 = add_key$fscrypt_v1(&(0x7f0000000180), &(0x7f0000000280)={'fscrypt:', @desc4}, &(0x7f00000002c0)={0x0, "de442bfc7910e10ac69ac014b0fa7807b11d2c99ed1f40d47a6edb3367b5cc888e1fd5102ae2d3d05f251f8d49025ceab4152b6e6d87cd6088e97a9d06d29143"}, 0x48, 0xffffffffffffffff) r2 = add_key$keyring(&(0x7f0000000340), &(0x7f0000000380)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_MOVE(0x1e, r0, r1, r2, 0x1) 6.04467ms ago: executing program 1 (id=39): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sec\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./sec\x00', &(0x7f00000002c0)='securityfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sec/integrity/ima/binary_runtime_measurements\x00', 0x0, 0x0) read(r3, 0x0, 0x0) read$FUSE(r3, &(0x7f0000000740)={0x2020}, 0x2020) 3.97965ms ago: executing program 3 (id=40): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./proc\x00', 0x1bb) mount(0x0, &(0x7f0000000a40)='./proc\x00', &(0x7f0000000a80)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/netfilter/nfnetlink_queue\x00', 0x0, 0x0) read(r0, &(0x7f00000003c0), 0x1000) 0s ago: executing program 0 (id=41): openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/split_huge_pages\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)="2fa2df97", 0x4) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.111' (ED25519) to the list of known hosts. [ 30.081795][ T36] audit: type=1400 audit(1791709523.590:64): avc: denied { mounton } for pid=287 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 30.085001][ T287] cgroup: Unknown subsys name 'net' [ 30.104524][ T36] audit: type=1400 audit(1791709523.590:65): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 30.131862][ T36] audit: type=1400 audit(1791709523.620:66): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 30.132386][ T287] cgroup: Unknown subsys name 'devices' [ 30.244027][ T287] cgroup: Unknown subsys name 'hugetlb' [ 30.249695][ T287] cgroup: Unknown subsys name 'rlimit' [ 30.345387][ T36] audit: type=1400 audit(1791709523.850:67): avc: denied { setattr } for pid=287 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 30.368602][ T36] audit: type=1400 audit(1791709523.850:68): avc: denied { mounton } for pid=287 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 30.393581][ T36] audit: type=1400 audit(1791709523.850:69): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 30.417867][ T289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 30.426678][ T36] audit: type=1400 audit(1791709523.930:70): avc: denied { relabelto } for pid=289 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.452163][ T36] audit: type=1400 audit(1791709523.930:71): avc: denied { write } for pid=289 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.487063][ T36] audit: type=1400 audit(1791709523.990:72): avc: denied { read } for pid=287 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.512747][ T36] audit: type=1400 audit(1791709523.990:73): avc: denied { open } for pid=287 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.513373][ T287] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 31.286109][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.298001][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.305401][ T294] bridge_slave_0: entered allmulticast mode [ 31.312486][ T294] bridge_slave_0: entered promiscuous mode [ 31.319208][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.326513][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.333778][ T294] bridge_slave_1: entered allmulticast mode [ 31.340190][ T294] bridge_slave_1: entered promiscuous mode [ 31.476239][ T300] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.483397][ T300] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.490492][ T300] bridge_slave_0: entered allmulticast mode [ 31.496913][ T300] bridge_slave_0: entered promiscuous mode [ 31.505231][ T300] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.512423][ T300] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.519515][ T300] bridge_slave_1: entered allmulticast mode [ 31.525870][ T300] bridge_slave_1: entered promiscuous mode [ 31.546163][ T298] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.553445][ T298] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.560522][ T298] bridge_slave_0: entered allmulticast mode [ 31.567146][ T298] bridge_slave_0: entered promiscuous mode [ 31.584550][ T298] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.591661][ T298] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.598758][ T298] bridge_slave_1: entered allmulticast mode [ 31.605198][ T298] bridge_slave_1: entered promiscuous mode [ 31.631007][ T299] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.638153][ T299] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.645292][ T299] bridge_slave_0: entered allmulticast mode [ 31.651693][ T299] bridge_slave_0: entered promiscuous mode [ 31.665928][ T299] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.673035][ T299] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.680134][ T299] bridge_slave_1: entered allmulticast mode [ 31.686579][ T299] bridge_slave_1: entered promiscuous mode [ 31.724680][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.731801][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.739136][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.746267][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.841769][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.849291][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.863819][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.870890][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.878657][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.885777][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.965427][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.972536][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.980920][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.988035][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.999244][ T294] veth0_vlan: entered promiscuous mode [ 32.016088][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.023175][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.032049][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.039090][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.053247][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.060334][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.075644][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.082756][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.091440][ T294] veth1_macvtap: entered promiscuous mode [ 32.120838][ T299] veth0_vlan: entered promiscuous mode [ 32.143336][ T299] veth1_macvtap: entered promiscuous mode [ 32.154149][ T298] veth0_vlan: entered promiscuous mode [ 32.178275][ T294] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 32.205204][ T298] veth1_macvtap: entered promiscuous mode [ 32.216839][ T300] veth0_vlan: entered promiscuous mode [ 32.245819][ T300] veth1_macvtap: entered promiscuous mode [ 32.621770][ T45] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 33.726315][ T45] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 33.751588][ T45] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 33.761429][ T45] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 34.692460][ T342] mmap: syz.3.11 (342): VmData 29261824 exceed data ulimit 14. Update limits or use boot option ignore_rlimit_data. [ 34.692465][ T45] usb 2-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 34.692497][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.752891][ T351] ======================================================= [ 34.752891][ T351] WARNING: The mand mount option has been deprecated and [ 34.752891][ T351] and is ignored by this kernel. Remove the mand [ 34.752891][ T351] option from the mount to silence this warning. [ 34.752891][ T351] ======================================================= [ 34.770045][ T45] usb 2-1: config 0 descriptor?? [ 35.165038][ T36] kauditd_printk_skb: 46 callbacks suppressed [ 35.165090][ T36] audit: type=1400 audit(1791709528.660:120): avc: denied { create } for pid=373 comm="syz.3.27" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 35.192077][ T36] audit: type=1400 audit(1791709528.660:121): avc: denied { listen } for pid=373 comm="syz.3.27" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 35.212477][ T36] audit: type=1400 audit(1791709528.670:122): avc: denied { accept } for pid=373 comm="syz.3.27" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 35.233309][ T36] audit: type=1400 audit(1791709528.670:123): avc: denied { read } for pid=373 comm="syz.3.27" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 35.251765][ T45] usbhid 2-1:0.0: can't add hid device: -71 [ 35.261114][ T45] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 35.267652][ T36] audit: type=1400 audit(1791709528.670:124): avc: denied { create } for pid=373 comm="syz.3.27" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 35.308853][ T45] usb 2-1: USB disconnect, device number 2 [ 35.436228][ T36] audit: type=1400 audit(1791709528.940:125): avc: denied { read } for pid=384 comm="syz.2.30" name="binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 35.451092][ T385] rust_binder: Failed to allocate buffer. len:8, is_oneway:false [ 35.460381][ T36] audit: type=1400 audit(1791709528.940:126): avc: denied { open } for pid=384 comm="syz.2.30" path="/dev/binderfs/binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 35.461244][ T311] rust_binder: 384: undelivered TRANSACTION_COMPLETE [ 35.499175][ T36] audit: type=1400 audit(1791709528.940:127): avc: denied { ioctl } for pid=384 comm="syz.2.30" path="/dev/binderfs/binder0" dev="binder" ino=10 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 35.519556][ T31] rust_binder: 384: undelivered TRANSACTION_ERROR: 29189 [ 35.558956][ T36] audit: type=1400 audit(1791709528.940:128): avc: denied { set_context_mgr } for pid=384 comm="syz.2.30" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 35.579315][ T36] audit: type=1400 audit(1791709528.940:129): avc: denied { map } for pid=384 comm="syz.2.30" path="/dev/binderfs/binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 35.952643][ T409] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI [ 35.965294][ T409] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 35.973763][ T409] CPU: 0 UID: 0 PID: 409 Comm: syz.0.41 Not tainted syzkaller #0 9109b4058d136ef0ac9398910d6f8e272823abe4 [ 35.985089][ T409] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 35.995185][ T409] RIP: 0010:vsscanf+0x18c/0x24b0 [ 36.000186][ T409] Code: 48 c7 c6 d0 3a 64 88 e8 e2 5d e4 fb 41 83 fe 25 74 4d 45 85 f6 0f 84 a4 21 00 00 48 ff c3 48 89 5c 24 58 4c 89 f8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 8e 1b 00 00 41 0f b6 1f 45 0f b6 f6 44 [ 36.019827][ T409] RSP: 0018:ffffc9000c1f75a0 EFLAGS: 00010246 [ 36.025960][ T409] RAX: 0000000000000000 RBX: ffffffff86368881 RCX: 0000000000000001 [ 36.033969][ T409] RDX: ffffffff85a4f45e RSI: ffffffff88643ad0 RDI: 0000000000000030 [ 36.041985][ T409] RBP: ffffc9000c1f76b0 R08: ffff888113cd62c0 R09: 0000000000000002 [ 36.049996][ T409] R10: 0000000000000025 R11: 0000000000000002 R12: ffffffff86368880 [ 36.058004][ T409] R13: dffffc0000000000 R14: 0000000000000030 R15: 0000000000000000 [ 36.066022][ T409] FS: 00007efe432e86c0(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 [ 36.075036][ T409] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.081662][ T409] CR2: 000000110c30f204 CR3: 0000000112fee000 CR4: 00000000003526b0 [ 36.089680][ T409] Call Trace: [ 36.092991][ T409] [ 36.095960][ T409] ? __switch_to+0xc6b/0x1320 [ 36.100683][ T409] ? __cfi_vsscanf+0x10/0x10 [ 36.105335][ T409] ? __cfi___switch_to+0x10/0x10 [ 36.110318][ T409] sscanf+0xe3/0x150 [ 36.114268][ T409] ? __cfi_sscanf+0x10/0x10 [ 36.118858][ T409] ? mutex_lock_interruptible+0x97/0x1d0 [ 36.124544][ T409] ? __asan_memcpy+0x5a/0x80 [ 36.129195][ T409] split_huge_pages_write+0x3c7/0x1220 [ 36.134705][ T409] ? __sched_text_start+0x10/0x10 [ 36.139738][ T409] ? enqueue_task+0x1049/0x1100 [ 36.144601][ T409] ? __cfi_split_huge_pages_write+0x10/0x10 [ 36.150540][ T409] ? preempt_schedule_thunk+0x1a/0x40 [ 36.155927][ T409] ? try_to_wake_up+0x119e/0x1fd0 [ 36.160969][ T409] ? plist_check_list+0x2a8/0x2c0 [ 36.166048][ T409] ? __kasan_check_write+0x18/0x20 [ 36.171188][ T409] ? debugfs_file_get+0x3be/0x590 [ 36.176248][ T409] ? __cfi_futex_wake+0x10/0x10 [ 36.181140][ T409] full_proxy_write+0x128/0x1e0 [ 36.186046][ T409] ? __cfi_full_proxy_write+0x10/0x10 [ 36.191435][ T409] vfs_write+0x3c4/0xfd0 [ 36.195725][ T409] ? __cfi_vfs_write+0x10/0x10 [ 36.200512][ T409] ? __kasan_check_write+0x18/0x20 [ 36.205774][ T409] ? mutex_lock+0x97/0x1d0 [ 36.210305][ T409] ? __cfi_mutex_lock+0x10/0x10 [ 36.215175][ T409] ksys_write+0x145/0x260 [ 36.219561][ T409] ? xfd_validate_state+0x68/0x140 [ 36.224717][ T409] ? __cfi_ksys_write+0x10/0x10 [ 36.229596][ T409] ? __kasan_check_write+0x18/0x20 [ 36.234743][ T409] ? fpregs_restore_userregs+0x11c/0x260 [ 36.240423][ T409] __x64_sys_write+0x7f/0x90 [ 36.245039][ T409] x64_sys_call+0x271c/0x2ee0 [ 36.249758][ T409] do_syscall_64+0x57/0xf0 [ 36.254188][ T409] ? clear_bhb_loop+0x50/0xa0 [ 36.258924][ T409] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 36.264844][ T409] RIP: 0033:0x7efe4239e1d9 [ 36.269369][ T409] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 36.289036][ T409] RSP: 002b:00007efe432e8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 36.297476][ T409] RAX: ffffffffffffffda RBX: 00007efe42625fa0 RCX: 00007efe4239e1d9 [ 36.305468][ T409] RDX: 0000000000000004 RSI: 0000200000000200 RDI: 0000000000000003 [ 36.313461][ T409] RBP: 00007efe42435888 R08: 0000000000000000 R09: 0000000000000000 [ 36.321448][ T409] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 36.329431][ T409] R13: 00007efe42626038 R14: 00007efe42625fa0 R15: 00007ffefaca0988 [ 36.337428][ T409] [ 36.340467][ T409] Modules linked in: [ 36.345198][ T409] ---[ end trace 0000000000000000 ]--- [ 36.352413][ T409] RIP: 0010:vsscanf+0x18c/0x24b0 [ 36.357418][ T409] Code: 48 c7 c6 d0 3a 64 88 e8 e2 5d e4 fb 41 83 fe 25 74 4d 45 85 f6 0f 84 a4 21 00 00 48 ff c3 48 89 5c 24 58 4c 89 f8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 8e 1b 00 00 41 0f b6 1f 45 0f b6 f6 44 [ 36.378549][ T409] RSP: 0018:ffffc9000c1f75a0 EFLAGS: 00010246 [ 36.385399][ T409] RAX: 0000000000000000 RBX: ffffffff86368881 RCX: 0000000000000001 [ 36.393701][ T409] RDX: ffffffff85a4f45e RSI: ffffffff88643ad0 RDI: 0000000000000030 [ 36.403201][ T409] RBP: ffffc9000c1f76b0 R08: ffff888113cd62c0 R09: 0000000000000002 [ 36.411215][ T409] R10: 0000000000000025 R11: 0000000000000002 R12: ffffffff86368880 [ 36.421722][ T409] R13: dffffc0000000000 R14: 0000000000000030 R15: 0000000000000000 [ 36.508146][ T409] FS: 00007efe432e86c0(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 [ 36.517826][ T409] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.531564][ T409] CR2: 00007f13f47eb8c0 CR3: 0000000112fee000 CR4: 00000000003526b0 [ 36.539803][ T409] Kernel panic - not syncing: Fatal exception [ 36.546487][ T409] Kernel Offset: disabled [ 36.550838][ T409] Rebooting in 86400 seconds..