last executing test programs: 1.621379842s ago: executing program 0 (id=1): r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp6\x00') write$binfmt_elf64(r0, &(0x7f0000001240)={{0x7f, 0x45, 0x4c, 0x46, 0x1, 0xe6, 0x6, 0x7f, 0x0, 0x2, 0x3, 0xc6, 0x319, 0x40, 0x306, 0x9, 0x4, 0x38, 0x1, 0x9a1, 0x4, 0x3}, [{0x6, 0x3, 0x4, 0x80, 0xffffffffffff7fff, 0x0, 0x9, 0xfff}], "189606682cb38c658aea5213b5471451981faad9ab40e9d9c49892800d7f0dd95cb00038f67bb61faf49c001ab194092c7dbbcd7e89f15bc950095668d165a5157e2406315923056e779eb397454ff7c2598644cf01a3d6643caecef1d31405ec3ed155bfa73858d547d2cdc91e0db32356c83aac33c36e7b563395cb4d276842699980b4c3918233ef1938ea3056f000155706026d550623d86979ca493cbaa4f710850e1d0b070ecd99267d8eab959bdf8", ['\x00', '\x00']}, 0x32a) preadv(r0, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4111, 0x100f}], 0x1, 0x144, 0x64) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000080)={0x24, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x22, 0xf, {[@main=@item_4={0x3, 0x0, 0x8, '\t\x00'}, @local=@item_4={0x3, 0x2, 0x0, "112000"}, @main=@item_4={0x3, 0x0, 0xb, "7488dffc"}]}}, 0x0}, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x1, 0x0, 0x0) syz_usb_connect$hid(0x6, 0x3f, &(0x7f0000001580)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0xff, 0x57e, 0x2009, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x7, 0xe0, 0x8, "", [{{0x9, 0x4, 0x0, 0x8, 0x1, 0x3, 0x1, 0x1, 0x9, {0x9, 0x21, 0x0, 0x4, 0x1, {0x22, 0x533}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x9c, 0x1, 0x7}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0xfb, 0x1, 0xfa}}]}}}]}}]}}, &(0x7f00000019c0)={0xa, &(0x7f00000015c0)={0xa, 0x6, 0x300, 0xb9, 0x9, 0x1, 0x20}, 0x5, &(0x7f0000001600)={0x5, 0xf, 0x5}, 0x8, [{0x4, &(0x7f0000001640)=@lang_id={0x4, 0x3, 0x2809}}, {0x4f, &(0x7f0000001680)=@string={0x4f, 0x3, "d6683d0ab1b095e204f22541edf1cae65ae1e9531709895fd5c65edd779f964d7b7feecbe0339285d96b699cbc153fde1a919357c0b011de9974d291b0c3e137cd59cb5dd76a13b2e875df510a"}}, {0x52, &(0x7f0000001700)=@string={0x52, 0x3, "372eb36281733d16191b2e9146acfb8fce1b6be59d2022e519512b30f495e1cf6d4ef4ec3254b0ecf1e8116faee11a1c6e2dbcd23b597830f69f9ec707b6c6d67d64b2747d6433e52e83c09b6e1a3bcf"}}, {0x40, &(0x7f0000001780)=@string={0x40, 0x3, "685c395ff2b8aa09772227c3fd9204b32da966b7c7f779972e324233284fcc376d87dcbb116d3e01b95567aecb678ee6d94676b657cce8bc913fe9f6ff26"}}, {0x4, &(0x7f00000017c0)=@lang_id={0x4, 0x3, 0x1809}}, {0xd6, &(0x7f0000001800)=@string={0xd6, 0x3, "4d3bd7d6eb5ba427c0177c6e0991b9615b1198ad82cc47a59e0c8c61a3bf2f346382817e9c798b51baed913bfd83f25f4de8f744a56eebcac2eb588e335f198187f0d4ee4706cbf6d1ca86a703ffe02cce37c3d3b5849e273a93e7571f04410d135e39a68f0dd6965cacb11539c09a028a4b11adb3d9fb1a7f8a4f313e6d83da3a9e953d1c6d3b0d8149bb69b468b68b32856339f9435d3ba591bca258fd484148f207278779cb64d9b03b423086420754a677ed2e6edbfe4e5fb36af200d05c43a2e534584dca239dd57a0c60db7739f6ae6e91"}}, {0x4a, &(0x7f0000001900)=@string={0x4a, 0x3, "956a532a29cd5aaf2e3d19d67785888121530f44326537f1b88a6ada8a599765ddbb6a5e3654f5ad302aa1738fcb40d05904c0c69f7427258edf1954baa3b223706ad09d1e6b29f2"}}, {0x4, &(0x7f0000001980)=@lang_id={0x4, 0x3, 0x40c}}]}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r4, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x3, 0x5, 0x9c, '\x00', 0x1bd}) ioctl$KVM_RUN(r4, 0xae80, 0x0) getsockopt$XDP_STATISTICS(0xffffffffffffffff, 0x11b, 0x7, 0x0, 0x0) ioctl$KVM_SET_IRQCHIP(r3, 0x8208ae63, &(0x7f00000005c0)={0x2, 0x0, @ioapic={0x0, 0x1, 0x2, 0xfffffffe, 0x0, [{0x2, 0x4, 0x3}, {0x9, 0x8, 0x9, '\x00', 0xf}, {0xff, 0x7f, 0xd3, '\x00', 0xe9}, {0xfd, 0x5, 0xf5, '\x00', 0x13}, {0x7, 0x9, 0xf5, '\x00', 0xb4}, {0xf, 0x4, 0x54, '\x00', 0xff}, {0x75, 0xd5, 0xf1, '\x00', 0x7f}, {0x3, 0x5, 0xc, '\x00', 0x6}, {0x7f, 0x5, 0x4a, '\x00', 0x8}, {0xd7, 0xd, 0x8, '\x00', 0x6}, {0x0, 0x28, 0x80, '\x00', 0xdc}, {0xfb, 0x1, 0xff, '\x00', 0x1}, {0xd, 0x5, 0x26}, {0xcf, 0xf, 0x8, '\x00', 0x6}, {0xf, 0xee, 0x7, '\x00', 0x3}, {0x1, 0x2, 0x6, '\x00', 0xb}, {0x9, 0x6, 0x2, '\x00', 0x9}, {0x4, 0xe, 0x2, '\x00', 0xe9}, {0x7, 0x2, 0x1, '\x00', 0xc2}, {0x2, 0x80, 0xe, '\x00', 0x7f}, {0x1, 0xe, 0x87, '\x00', 0x7d}, {0x10, 0x9, 0x92, '\x00', 0x10}, {0x1, 0x3, 0xf3, '\x00', 0x4}, {0x7, 0x6, 0xa}]}}) munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f00007fe000/0x800000)=nil) r8 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r8, 0xc018480b, 0x0) syz_open_dev$usbmon(&(0x7f0000000080), 0x3, 0x181440) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000a40)=@newsa={0x158, 0x10, 0x1, 0x70bc2c, 0x0, {{@in6=@mcast2, @in=@dev={0xac, 0x14, 0x14, 0xd}, 0x0, 0xecdf, 0x0, 0x0, 0xa}, {@in6=@ipv4={'\x00', '\xff\xff', @multicast1}, 0x0, 0x32}, @in6=@empty, {0xfffffffffffffffe, 0xfffffffffffffffe, 0x3, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x9}, {0x2, 0x400804, 0x9, 0x292}, {0x1cb00000}, 0x0, 0x0, 0xa, 0x4, 0x0, 0x2c}, [@algo_crypt={0x68, 0x2, {{'cbc(aes)\x00'}, 0x100, "1a000b000000366a6a849a739045002400000000e80000000000606ea6b38500"}}]}, 0x158}}, 0x44050) 1.586554872s ago: executing program 2 (id=3): getpid() setsockopt$netlink_NETLINK_NO_ENOBUFS(0xffffffffffffffff, 0x10e, 0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) add_key$keyring(0x0, &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) r3 = add_key$keyring(&(0x7f0000000440), 0x0, 0x0, 0x0, 0x0) keyctl$invalidate(0x15, r3) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x40) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="02030609100000000000004c9e0000000200130002000000da16c167d803f1f805000600200000000a00060000000000ff0000000000000000001ffeff0001000003f1dc7f7c6e7c0200010000000000004000020000000005000500000000000a"], 0x80}}, 0x0) sendmmsg(r4, &(0x7f0000000180), 0x400008a, 0x0) 1.508989033s ago: executing program 1 (id=2): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000080)={'syz0\x00', {0x3, 0x0, 0x0, 0x1}, 0x0, [0x1, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x10, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x1db, 0x0, 0x10000000, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0xfffffffe, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0xf, 0x0, 0x0, 0x0, 0x1000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1000000, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0xfffffffd, 0x7, 0x2, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x9, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000, 0x0, 0x1, 0x0, 0x0, 0x0, 0xffffffff, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x8, 0x0, 0x2, 0x0, 0xfffffffe, 0x5d1d8547]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) ioctl$UI_SET_FFBIT(0xffffffffffffffff, 0x4004556b, 0x2c) ioctl$SNDRV_TIMER_IOCTL_TRIGGER(0xffffffffffffffff, 0x54a6) read$FUSE(r0, &(0x7f0000002600)={0x2020}, 0x2020) write$uinput_user_dev(r0, &(0x7f0000000640)={'syz1\x00', {0x7, 0x6, 0x1ff, 0xfac}, 0x16, [0x7, 0x3, 0x8108, 0x7, 0x101, 0x2c94cded, 0x4, 0x6, 0x2, 0x9, 0x4, 0x80000000, 0x4, 0xe1, 0x3ff, 0x8, 0x9, 0x9, 0x4, 0x40, 0xffffff01, 0xb, 0xa, 0x6, 0x7fffffff, 0x2, 0x1, 0xfffffffb, 0x4, 0x10, 0x9, 0x101, 0x7, 0x9, 0xfffffffe, 0x3, 0x400000, 0xb, 0x1, 0x0, 0xc0000, 0x2, 0x4, 0x7, 0x1, 0x9, 0xf, 0x6, 0x1, 0x200, 0x40ba, 0x3, 0xbd7, 0x7, 0x4, 0x80000000, 0x54fc3549, 0x101, 0x6, 0x6, 0xd53, 0x71, 0x5, 0xe1d], [0x8, 0x1, 0xe2d, 0x8, 0x0, 0xfff, 0xfffff2d2, 0x4, 0x0, 0xc, 0x2, 0x5, 0x10001, 0x7bf, 0xa, 0x7ff, 0x3, 0xd6f, 0x5, 0xa, 0xc, 0x8, 0x1, 0x1, 0x3, 0x5, 0x2, 0xeff0, 0x0, 0x3b, 0x3, 0x475, 0x7, 0xfffd, 0x5, 0x39, 0xff, 0x6, 0xedd7, 0x2, 0x5421, 0xaf, 0xffffffff, 0x1ff, 0x10001, 0x1, 0x5, 0x2, 0x2, 0x6, 0x80e, 0x9, 0x5, 0x0, 0x7, 0x7fff, 0xeb1a, 0x0, 0x7, 0x4, 0x5, 0x8001, 0x10001, 0x5], [0xd, 0x4, 0x52c, 0xfb44, 0x7f, 0xe, 0x1ff, 0xfffffffa, 0x800, 0x9, 0x1ff, 0x401, 0xfffffff8, 0x7, 0x7, 0x3b, 0xffffffff, 0x8, 0x800, 0x10001, 0x2, 0x18b, 0x8000, 0x508, 0x7, 0x10, 0x6, 0x6, 0x6, 0x9b0, 0x7, 0x1, 0x9, 0x60000000, 0x8001, 0x200, 0x7, 0x3, 0x9, 0x3f, 0x1, 0x4, 0x4, 0x6, 0x5, 0x10000, 0xfffffff8, 0xc, 0xffffffff, 0x7ff, 0x5, 0x4, 0x8, 0x6, 0x7fff, 0x8001, 0x0, 0x80, 0xd0b, 0x800, 0x9, 0x1b, 0x5, 0xfffff432], [0x4, 0x9, 0x8, 0x2, 0x6, 0xfffff5c9, 0x0, 0x1000, 0x0, 0x4, 0x6, 0x8, 0x6, 0x0, 0x2, 0x1000081, 0x100, 0xfffffff7, 0x5, 0x3, 0x10, 0x7c1f, 0x8, 0x8, 0x2, 0x7, 0x7, 0x0, 0x1d, 0x80000000, 0x3, 0xfb0, 0xa, 0x3, 0x3d9, 0xc27, 0x1, 0x2, 0x8, 0x81, 0x7, 0x7, 0x0, 0x2, 0x1ff, 0x7, 0x6c56, 0x4, 0x29, 0x0, 0x3, 0x8001, 0x5, 0x149, 0x2, 0x3, 0x4, 0x4, 0xfff, 0x8, 0xa91, 0x101, 0x5, 0x4]}, 0x45c) 1.051422168s ago: executing program 1 (id=5): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) prlimit64(0x0, 0xe, 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000280), 0x88ce359bdb00143c, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r0, 0x400455c8, 0x0) ioctl$TIOCSTI(r0, 0x5412, &(0x7f00000002c0)=0x4) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000100)=0x2) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000080)=0xfe) syz_usb_connect$uac2(0x3, 0xab, &(0x7f00000001c0)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x10, 0x41e, 0x3000, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x99, 0x3, 0x1, 0x2, 0x40, 0x49, {0x8, 0xb, 0x1, 0x1, 0x1, 0x8, 0x20, 0x2}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x4, 0xa, 0x29, 0x80}, [@input_terminal={0x10, 0x24, 0x2, 0x1, 0x205, 0x2, 0x3, 0x3, 0x0, 0x8, 0x4}, @input_terminal={0x10, 0x24, 0x2, 0x1, 0x403, 0x2, 0x5, 0x3, 0x1, 0x2, 0x3, 0xa}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@as_header={0x10, 0x24, 0x1, 0x11, 0x86, 0x2, 0x4, 0x5, 0x1, 0x78}]}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0xf6, 0xf, 0x8, {0x8, 0x25, 0x1, 0xc2, 0x33, 0x1, 0x9}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x40, 0x8, 0x9, 0x0, {0x8, 0x25, 0x1, 0x3, 0x33, 0x1, 0x8}}}}}}}}]}}, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0}) 574.805983ms ago: executing program 2 (id=7): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) setpgid(r0, r0) setpgid(0x0, r0) wait4(r0, 0x0, 0x2, 0x0) ptrace$PTRACE_GETSIGMASK(0x420a, r0, 0x0, 0x0) 119.148319ms ago: executing program 3 (id=10): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) read$eventfd(r0, &(0x7f0000000080), 0x8) 104.274879ms ago: executing program 3 (id=11): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c0000004600030025bd70000000000001"], 0x1c}, 0x1, 0x0, 0x0, 0x4048011}, 0xc040) 89.261909ms ago: executing program 3 (id=12): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r0, &(0x7f0000004e80)={0x0, 0x0, &(0x7f0000004e40)={&(0x7f0000004d40)={0x24, 0x2, 0x1, 0x801, 0x0, 0x0, {0x2, 0x0, 0x5}, [@CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x21}]}, @CTA_TUPLE_REPLY={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x20048084}, 0x20048000) 27.036329ms ago: executing program 3 (id=13): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW2(r0, 0x402c542c, &(0x7f0000000000)={0x80000000, 0x6, 0x3, 0x2, 0x9e, "3f3c5e0000ff775cfffffffff903e7ffffff00", 0x401, 0x91}) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000040)=0xff) ppoll(&(0x7f0000000100)=[{0xffffffffffffffff, 0x482}, {r0, 0x4018}], 0x2, &(0x7f00000001c0)={0x0, 0x989680}, 0x0, 0x0) 26.858949ms ago: executing program 3 (id=14): unshare(0x22020600) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x6, 0x9, &(0x7f0000000080)={{0x101, @multicast2, 0x0, 0x2, 'wlc\x00', 0x6, 0x1, 0x3}, {@empty, 0x2, 0x2, 0x7, 0x0, 0x3}}, 0x44) 0s ago: executing program 3 (id=15): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0/file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0/file1/file2\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file1/file2/file3\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1/file2/file3/file4\x00', 0x1c0) mknodat(0xffffffffffffff9c, &(0x7f0000000200)='./file0/file1/file2/file3/file5\x00', 0x81c0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0/file6\x00', 0x1c0) mount$bind(&(0x7f0000000300)='./file0/file1\x00', &(0x7f0000000340)='./file0/file6\x00', 0x0, 0x5000, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file6/file2\x00', 0x0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file1/file2\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./file0/file2\x00', 0x0) r1 = landlock_create_ruleset(&(0x7f0000000440)={0x2004}, 0x18, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000480)='./file0/file2/file3/file4\x00', 0x0, 0x0) landlock_restrict_self(r1, 0x0) renameat2(r0, &(0x7f0000000540)='file3/file5\x00', r0, &(0x7f0000000580)='file3/file4/file5\x00', 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.182' (ED25519) to the list of known hosts. [ 24.769969][ T36] audit: type=1400 audit(1778330666.870:64): avc: denied { mounton } for pid=287 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 24.773992][ T287] cgroup: Unknown subsys name 'net' [ 24.792662][ T36] audit: type=1400 audit(1778330666.870:65): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.820071][ T36] audit: type=1400 audit(1778330666.900:66): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.820566][ T287] cgroup: Unknown subsys name 'devices' [ 24.979049][ T287] cgroup: Unknown subsys name 'hugetlb' [ 24.984771][ T287] cgroup: Unknown subsys name 'rlimit' [ 25.100466][ T36] audit: type=1400 audit(1778330667.200:67): avc: denied { setattr } for pid=287 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.123690][ T36] audit: type=1400 audit(1778330667.200:68): avc: denied { mounton } for pid=287 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 25.148598][ T36] audit: type=1400 audit(1778330667.200:69): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 25.171189][ T289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 25.180583][ T36] audit: type=1400 audit(1778330667.280:70): avc: denied { relabelto } for pid=289 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.206049][ T36] audit: type=1400 audit(1778330667.280:71): avc: denied { write } for pid=289 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.218930][ T287] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 25.232187][ T36] audit: type=1400 audit(1778330667.310:72): avc: denied { read } for pid=287 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.265947][ T36] audit: type=1400 audit(1778330667.310:73): avc: denied { open } for pid=287 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 26.144654][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.151814][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.159090][ T297] bridge_slave_0: entered allmulticast mode [ 26.165461][ T297] bridge_slave_0: entered promiscuous mode [ 26.173560][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.180696][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.187864][ T297] bridge_slave_1: entered allmulticast mode [ 26.194145][ T297] bridge_slave_1: entered promiscuous mode [ 26.234954][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.242052][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.249299][ T294] bridge_slave_0: entered allmulticast mode [ 26.255564][ T294] bridge_slave_0: entered promiscuous mode [ 26.264317][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.271471][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.278749][ T294] bridge_slave_1: entered allmulticast mode [ 26.284984][ T294] bridge_slave_1: entered promiscuous mode [ 26.305362][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.312476][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.319752][ T296] bridge_slave_0: entered allmulticast mode [ 26.325999][ T296] bridge_slave_0: entered promiscuous mode [ 26.335567][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.342790][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.350043][ T296] bridge_slave_1: entered allmulticast mode [ 26.356295][ T296] bridge_slave_1: entered promiscuous mode [ 26.436398][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.443845][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.451108][ T295] bridge_slave_0: entered allmulticast mode [ 26.457578][ T295] bridge_slave_0: entered promiscuous mode [ 26.477258][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.484355][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.491828][ T295] bridge_slave_1: entered allmulticast mode [ 26.498321][ T295] bridge_slave_1: entered promiscuous mode [ 26.587469][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.594573][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.601921][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.608997][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.622730][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.629840][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.637255][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.644319][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.655221][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.662402][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.669734][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.676818][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.715428][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.722541][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.729890][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.736964][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.769802][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.777834][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.785364][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.793145][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.800911][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.808507][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.815755][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.823307][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.843453][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.850575][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.858281][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.865351][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.880885][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.887984][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.895835][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.902918][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.912572][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.919670][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.945248][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.952332][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.960352][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.967430][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.975218][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.982300][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.009991][ T296] veth0_vlan: entered promiscuous mode [ 27.034553][ T294] veth0_vlan: entered promiscuous mode [ 27.045983][ T296] veth1_macvtap: entered promiscuous mode [ 27.076396][ T295] veth0_vlan: entered promiscuous mode [ 27.085763][ T294] veth1_macvtap: entered promiscuous mode [ 27.098325][ T297] veth0_vlan: entered promiscuous mode [ 27.120429][ T295] veth1_macvtap: entered promiscuous mode [ 27.132183][ T296] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 27.166307][ T297] veth1_macvtap: entered promiscuous mode [ 27.319200][ T323] input: syz0 as /devices/virtual/input/input4 [ 27.376950][ T324] tipc: Failed to remove unknown binding: 66,0,0/0:812184696/812184698 [ 27.394966][ T321] tipc: Failed to remove unknown binding: 66,0,0/0:3064072811/3064072812 [ 27.482597][ T321] tipc: Failed to remove unknown binding: 66,0,0/0:3064072811/3064072812 [ 27.932233][ T9] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 28.136952][ T313] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 28.258335][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 28.269528][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 28.279658][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 28.287434][ T313] usb 2-1: device descriptor read/64, error -71 [ 28.293343][ T9] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 28.308240][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.318549][ T9] usb 1-1: config 0 descriptor?? [ 28.536834][ T313] usb 2-1: device descriptor read/64, error -71 [ 28.638098][ T343] netlink: 76 bytes leftover after parsing attributes in process `syz.3.9'. [ 28.728904][ T9] plantronics 0003:047F:FFFF.0001: No inputs registered, leaving [ 28.742655][ T9] plantronics 0003:047F:FFFF.0001: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 28.782872][ T313] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 28.806148][ T356] ------------[ cut here ]------------ [ 28.811733][ T356] WARNING: CPU: 0 PID: 356 at security/landlock/fs.c:1025 collect_domain_accesses+0x327/0x390 [ 28.822101][ T356] Modules linked in: [ 28.826066][ T356] CPU: 0 UID: 0 PID: 356 Comm: syz.3.15 Not tainted syzkaller #0 88ceac27f2f759e3bbd2a088bdce4bdb7d92b188 [ 28.837438][ T356] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 28.847587][ T356] RIP: 0010:collect_domain_accesses+0x327/0x390 [ 28.853886][ T356] Code: bf c5 72 ff eb 08 e8 a8 4f 09 ff 41 b4 01 44 89 e0 48 83 c4 18 5b 41 5c 41 5d 41 5e 41 5f 5d e9 8f d5 2b 03 cc e8 89 4f 09 ff <0f> 0b 45 31 e4 eb cb e8 7d 4f 09 ff 0f 0b eb d1 89 d9 80 e1 07 80 [ 28.873575][ T356] RSP: 0018:ffffc9000b84faf0 EFLAGS: 00010287 [ 28.879710][ T356] RAX: ffffffff827e6d17 RBX: ffff88811473c220 RCX: 0000000000080000 [ 28.887768][ T356] RDX: ffffc90001e93000 RSI: 00000000000001f8 RDI: 00000000000001f9 [ 28.895787][ T356] RBP: ffffc9000b84fb30 R08: ffff888132082600 R09: 0000000000000002 [ 28.903840][ T356] R10: 0000000000000002 R11: 0000000000000002 R12: 0000000000000000 [ 28.911921][ T356] R13: 0000000000002004 R14: 1ffffffff0e43898 R15: dffffc0000000000 [ 28.920011][ T356] FS: 00007f21f4c0f6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 28.926843][ T313] usb 2-1: device descriptor read/64, error -71 [ 28.929207][ T356] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 28.941925][ T356] CR2: 000000110c24a177 CR3: 0000000113ea0000 CR4: 00000000003526b0 [ 28.950019][ T356] Call Trace: [ 28.953342][ T356] [ 28.956316][ T356] current_check_refer_path+0x8ee/0xd40 [ 28.961987][ T356] ? hook_file_free_security+0xc0/0xc0 [ 28.967543][ T356] hook_path_rename+0x44/0x60 [ 28.972283][ T356] security_path_rename+0x1d8/0x2a0 [ 28.977591][ T356] do_renameat2+0x634/0xc40 [ 28.982156][ T356] ? __cfi_do_renameat2+0x10/0x10 [ 28.987278][ T356] ? strncpy_from_user+0x14d/0x270 [ 28.992441][ T356] ? __kasan_check_write+0x18/0x20 [ 28.997639][ T356] ? __kasan_check_write+0x18/0x20 [ 29.002800][ T356] __x64_sys_renameat2+0xdc/0x100 [ 29.007952][ T356] x64_sys_call+0x2e18/0x2ee0 [ 29.012923][ T356] do_syscall_64+0x57/0xf0 [ 29.017468][ T356] ? clear_bhb_loop+0x50/0xa0 [ 29.022200][ T356] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 29.028154][ T356] RIP: 0033:0x7f21f3d9cdd9 [ 29.032627][ T356] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 29.052366][ T356] RSP: 002b:00007f21f4c0f028 EFLAGS: 00000246 ORIG_RAX: 000000000000013c [ 29.060877][ T356] RAX: ffffffffffffffda RBX: 00007f21f4015fa0 RCX: 00007f21f3d9cdd9 [ 29.061491][ T315] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 29.068935][ T356] RDX: 0000000000000003 RSI: 0000200000000540 RDI: 0000000000000003 [ 29.068955][ T356] RBP: 00007f21f3e32d69 R08: 0000000000000000 R09: 0000000000000000 [ 29.068972][ T356] R10: 0000200000000580 R11: 0000000000000246 R12: 0000000000000000 [ 29.068989][ T356] R13: 00007f21f4016038 R14: 00007f21f4015fa0 R15: 00007fff9b0feff8 [ 29.069010][ T356] [ 29.069019][ T356] ---[ end trace 0000000000000000 ]--- [ 29.186768][ T313] usb 2-1: device descriptor read/64, error -71 [ 29.296840][ T313] usb usb2-port1: attempt power cycle [ 29.342047][ T357] Zero length message leads to an empty skb [ 29.636749][ T313] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 29.657712][ T313] usb 2-1: device descriptor read/8, error -71 [ 29.786760][ T332] Bluetooth: hci0: command 0x1003 tx timeout [ 29.790762][ T313] usb 2-1: device descriptor read/8, error -71 [ 29.792899][ T55] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 30.036757][ T313] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 30.057770][ T313] usb 2-1: device descriptor read/8, error -71 [ 30.188091][ T313] usb 2-1: device descriptor read/8, error -71 [ 30.296855][ T313] usb usb2-port1: unable to enumerate USB device [ 30.326839][ C1] plantronics 0003:047F:FFFF.0001: usb_submit_urb(ctrl) failed: -1 [ 30.456830][ T313] usb 1-1: reset high-speed USB device number 2 using dummy_hcd [ 31.227288][ T31] usb 1-1: USB disconnect, device number 2