last executing test programs: 3.426809056s ago: executing program 3 (id=12): syz_usb_connect(0x0, 0x4b, &(0x7f0000000240)=ANY=[@ANYBLOB="1201000200000040480b0510000101020001090239000201008032090400000000000000090401"], 0x0) 3.343759488s ago: executing program 0 (id=16): socket(0x1e, 0x4, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1f}}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000380)='scalable', 0x8) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) 3.343615598s ago: executing program 1 (id=17): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)={0x4c, 0x2, 0x6, 0x201, 0x0, 0x0, {0xa}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20044000}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, 0x4, 0x6, 0x101, 0x0, 0x0, {0x1, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0xc40) 3.343457008s ago: executing program 1 (id=19): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) r1 = socket(0x840000000002, 0x3, 0x100) connect$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r1, &(0x7f0000005240), 0x4000095, 0x0) r2 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @remote, @loopback}, 0xc) r3 = socket$netlink(0x10, 0x3, 0x0) writev(r3, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) 3.246829551s ago: executing program 1 (id=22): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) keyctl$set_reqkey_keyring(0xe, 0x5) request_key(0x0, &(0x7f0000000100)={'syz', 0x0}, &(0x7f00000010c0)='\xc9\x8d\n$\x11J\x06t\x8e\xa6ZH\x88\x9967\xd1\xe6zy\xb1\xc7\xcbB-\xacbe\xad\xc4\xc4o\x1f\x00\x00\x82*\f\x00\x00AT\xe49\xcf\x00', 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={0x0, 0x54}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="44000000090601020000000000000000000000000900020073797a31000000000500010007ffe2001c0007800c00018008000140f60000020c00028008000140"], 0x44}, 0x1, 0x0, 0x0, 0x10040047}, 0x240008c4) 3.097586974s ago: executing program 1 (id=24): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000000c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096231b26e53f070100002d96900683749e821dab8b9236592b0004000093"], 0x0}, 0x0) 2.535256978s ago: executing program 0 (id=27): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) write(0xffffffffffffffff, 0x0, 0x0) syz_usb_ep_write(0xffffffffffffffff, 0x3, 0x0, 0x0) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x2, 0x0, 0x1, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) 2.227905176s ago: executing program 3 (id=28): sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x20008820) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x138, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1, 0x4e24, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in=@multicast2, 0x4d4, 0x6c}, @in6=@loopback, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0xae26}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3505, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) 1.333835467s ago: executing program 2 (id=30): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x20040005) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = getpid() kcmp(r1, r1, 0x3, 0xffffffffffffffff, 0xffffffffffffffff) r2 = socket$inet_udp(0x2, 0x2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) r3 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {}, 0xa}}, 0x26) 1.333665687s ago: executing program 3 (id=31): syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000e80)={0x44, r1, 0x801, 0x400, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_KEY={0x28, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x14, 0x1, "4abee33957edf8aaae14574df4"}, @NL80211_KEY_IDX={0x5, 0x2, 0x2}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac04}]}]}, 0x44}}, 0x0) 1.333538527s ago: executing program 2 (id=32): r0 = epoll_create1(0x80000) r1 = epoll_create1(0x0) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000100)={0xa000000d}) 1.333436587s ago: executing program 3 (id=33): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='1', 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x2000003, 0x6031, 0xffffffffffffffff, 0x0) 1.333396647s ago: executing program 3 (id=34): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000040)={0x3, 0x0, 0x1, 0xffffffffffffffff, 0x5}) 1.333293207s ago: executing program 0 (id=35): sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) r0 = socket$netlink(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x38, 0x9, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x10, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty=0xfffffffe}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x10048047}, 0x4000050) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.333233027s ago: executing program 0 (id=36): openat$binderfs_feature(0xffffffffffffff9c, &(0x7f00000003c0)='./binderfs/features/oneway_spam_detection\x00', 0x0, 0x0) 1.333164327s ago: executing program 0 (id=37): r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = gettid() r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) kcmp(r4, r5, 0x1, 0xffffffffffffffff, 0xffffffffffffffff) 1.185288541s ago: executing program 2 (id=38): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000200)=@newsa={0x104, 0x10, 0x7, 0x0, 0x0, {{@in=@broadcast, @in=@multicast2, 0x4e20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x0, 0x2b}, @in6=@private0, {0x3, 0x1, 0x2, 0x0, 0x10000000, 0x1, 0x1}, {0x0, 0x4, 0x7}, {0x40000, 0x8, 0x10001}, 0x0, 0x0, 0xa, 0x2, 0xfe, 0x34}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x104}, 0x1, 0x0, 0x0, 0x41}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=@newsa={0x104, 0x1a, 0x7, 0x70bd2a, 0x0, {{@in6=@dev={0xfe, 0x80, '\x00', 0x1b}, @in=@multicast1, 0x3, 0x0, 0x4e22, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x5a, 0xb400, 0x2, 0xfeffff7f00000001, 0x0, 0x60000}, {0x0, 0x200000, 0x7, 0xfffffffffffffffd}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x104}}, 0x0) 1.130959712s ago: executing program 2 (id=39): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='huge=always,huge=within_size,nr_blocks=5']) chdir(&(0x7f0000000140)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) openat$dir(0xffffffffffffff9c, &(0x7f0000000540)='./file0/file1\x00', 0x143843, 0x0) 1.046282174s ago: executing program 3 (id=40): munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) futex(&(0x7f0000004000)=0x2, 0x8d, 0x1, 0x0, 0x0, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000080)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) write$UHID_CREATE2(r1, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x900, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f000000e000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x10, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x7) ioctl$HIDIOCGRDESC(r5, 0x90044802, &(0x7f0000000040)={0x4000}) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000000)={'nat\x00', 0x0, 0x0, 0x0, [0x7, 0x8ead, 0x3, 0x3, 0x9, 0x2]}, &(0x7f0000000080)=0x78) 945.347617ms ago: executing program 1 (id=41): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) ioctl$BTRFS_IOC_INO_PATHS(r0, 0xc0389423, 0x0) mremap(&(0x7f0000001000/0x3000)=nil, 0x4000, 0x3021, 0x3, &(0x7f0000ffd000/0x3000)=nil) 795.551541ms ago: executing program 2 (id=42): landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x8, &(0x7f0000000200)=0x9) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r4 = landlock_create_ruleset(&(0x7f00000002c0)={0x7f6e}, 0x18, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r4, 0x1, &(0x7f0000000000)={0x210a, r3}, 0x0) landlock_restrict_self(r4, 0x0) 86.294658ms ago: executing program 0 (id=43): r0 = socket$inet_udp(0x2, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f0000005480), 0x0, 0x28008004) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8040000, 0x2000009, 0x401d031, 0xffffffffffffffff, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) keyctl$chown(0x4, 0x0, 0xee01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) 86.181178ms ago: executing program 1 (id=44): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x103}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x46032, 0xffffffffffffffff, 0x0) 0s ago: executing program 2 (id=45): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r1, &(0x7f0000000000)='9', 0x1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.171' (ED25519) to the list of known hosts. [ 31.023468][ T36] audit: type=1400 audit(1791226245.120:64): avc: denied { mounton } for pid=287 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 31.026938][ T287] cgroup: Unknown subsys name 'net' [ 31.046672][ T36] audit: type=1400 audit(1791226245.120:65): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 31.074016][ T36] audit: type=1400 audit(1791226245.150:66): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 31.074451][ T287] cgroup: Unknown subsys name 'devices' [ 31.207532][ T287] cgroup: Unknown subsys name 'hugetlb' [ 31.213178][ T287] cgroup: Unknown subsys name 'rlimit' [ 31.308714][ T36] audit: type=1400 audit(1791226245.410:67): avc: denied { setattr } for pid=287 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 31.331911][ T36] audit: type=1400 audit(1791226245.410:68): avc: denied { mounton } for pid=287 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 31.356661][ T36] audit: type=1400 audit(1791226245.410:69): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 31.386853][ T289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 31.395734][ T36] audit: type=1400 audit(1791226245.500:70): avc: denied { relabelto } for pid=289 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 31.421194][ T36] audit: type=1400 audit(1791226245.500:71): avc: denied { write } for pid=289 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 31.456759][ T36] audit: type=1400 audit(1791226245.560:72): avc: denied { read } for pid=287 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 31.457986][ T287] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 31.482555][ T36] audit: type=1400 audit(1791226245.560:73): avc: denied { open } for pid=287 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 32.353135][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.360348][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.367578][ T297] bridge_slave_0: entered allmulticast mode [ 32.373975][ T297] bridge_slave_0: entered promiscuous mode [ 32.381387][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.388547][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.395678][ T297] bridge_slave_1: entered allmulticast mode [ 32.401919][ T297] bridge_slave_1: entered promiscuous mode [ 32.408124][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.415210][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.422289][ T295] bridge_slave_0: entered allmulticast mode [ 32.428700][ T295] bridge_slave_0: entered promiscuous mode [ 32.436372][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.443442][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.450567][ T295] bridge_slave_1: entered allmulticast mode [ 32.457041][ T295] bridge_slave_1: entered promiscuous mode [ 32.506900][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.513995][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.521185][ T294] bridge_slave_0: entered allmulticast mode [ 32.527528][ T294] bridge_slave_0: entered promiscuous mode [ 32.541860][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.548951][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.556061][ T294] bridge_slave_1: entered allmulticast mode [ 32.562389][ T294] bridge_slave_1: entered promiscuous mode [ 32.616853][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.623938][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.631257][ T296] bridge_slave_0: entered allmulticast mode [ 32.637604][ T296] bridge_slave_0: entered promiscuous mode [ 32.647148][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.654587][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.661709][ T296] bridge_slave_1: entered allmulticast mode [ 32.668075][ T296] bridge_slave_1: entered promiscuous mode [ 32.771053][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.778156][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.785502][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.792551][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.811706][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.818800][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.826117][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.833163][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.846622][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.853693][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.861052][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.868117][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.914648][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.921753][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.929097][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.936162][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.953689][ T44] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.961572][ T44] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.968833][ T44] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.976460][ T44] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.984019][ T44] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.991354][ T44] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.017179][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.024264][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.031916][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.038974][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.046615][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.053661][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.061391][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.068464][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.109311][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.116416][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.124567][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.131674][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.168006][ T294] veth0_vlan: entered promiscuous mode [ 33.178205][ T295] veth0_vlan: entered promiscuous mode [ 33.187433][ T297] veth0_vlan: entered promiscuous mode [ 33.202591][ T294] veth1_macvtap: entered promiscuous mode [ 33.221738][ T297] veth1_macvtap: entered promiscuous mode [ 33.229056][ T295] veth1_macvtap: entered promiscuous mode [ 33.244543][ T296] veth0_vlan: entered promiscuous mode [ 33.287570][ T297] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 33.289103][ T296] veth1_macvtap: entered promiscuous mode [ 33.334639][ T313] rust_binder: 312:313 got transaction to invalid handle 3 [ 33.346458][ T313] rust_binder: 312:313 transaction call to 0:0 failed ENOENT, code 0 size 0-0 [ 33.358706][ T313] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 33.358728][ T313] rust_binder: Read failure Err(EFAULT) in pid:2 [ 33.369125][ T311] rust_binder: 312: undelivered TRANSACTION_ERROR: 29201 [ 33.380564][ T316] FAULT_INJECTION: forcing a failure. [ 33.380564][ T316] name failslab, interval 1, probability 0, space 0, times 1 [ 33.401748][ T316] CPU: 0 UID: 0 PID: 316 Comm: syz.2.3 Not tainted syzkaller #0 60889c1c5e6bdc1f3cb1b6a230ba908545dccc71 [ 33.401789][ T316] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 33.401814][ T316] Call Trace: [ 33.401822][ T316] [ 33.401832][ T316] __dump_stack+0x21/0x30 [ 33.401898][ T316] dump_stack_lvl+0x140/0x1c0 [ 33.401934][ T316] ? __cfi_dump_stack_lvl+0x10/0x10 [ 33.401971][ T316] ? selinux_kernfs_init_security+0x14b/0x4b0 [ 33.402005][ T316] dump_stack+0x19/0x20 [ 33.402043][ T316] should_fail_ex+0x3c2/0x510 [ 33.402075][ T316] should_failslab+0xac/0x100 [ 33.402112][ T316] kmem_cache_alloc_noprof+0x42/0x410 [ 33.402140][ T316] ? __kernfs_new_node+0xf1/0x740 [ 33.402173][ T316] ? bpf_lsm_kernfs_init_security+0xd/0x20 [ 33.402208][ T316] __kernfs_new_node+0xf1/0x740 [ 33.402240][ T316] ? __kasan_check_write+0x18/0x20 [ 33.402266][ T316] ? kernfs_new_node+0x280/0x280 [ 33.402298][ T316] ? down_write+0xee/0x2b0 [ 33.402339][ T316] ? __cfi_down_write+0x10/0x10 [ 33.402374][ T316] ? __kasan_check_write+0x18/0x20 [ 33.402400][ T316] ? up_write+0x66/0x280 [ 33.402436][ T316] ? kernfs_activate+0x1ee/0x200 [ 33.402470][ T316] kernfs_new_node+0x154/0x280 [ 33.402503][ T316] __kernfs_create_file+0x52/0x280 [ 33.402542][ T316] sysfs_add_file_mode_ns+0x1d2/0x280 [ 33.402568][ T316] internal_create_group+0x66c/0xe70 [ 33.402597][ T316] ? __kasan_check_write+0x18/0x20 [ 33.402624][ T316] ? sysfs_create_group+0x40/0x40 [ 33.402653][ T316] ? kernfs_activate+0x1ee/0x200 [ 33.402688][ T316] sysfs_create_groups+0x5c/0x130 [ 33.402718][ T316] device_add_attrs+0x12d/0x850 [ 33.402742][ T316] ? device_add_class_symlinks+0x260/0x260 [ 33.402765][ T316] ? __kasan_check_write+0x18/0x20 [ 33.402790][ T316] ? kobject_put+0x1cc/0x2a0 [ 33.402815][ T316] ? device_add_class_symlinks+0x22e/0x260 [ 33.402839][ T316] device_add+0x4db/0xbf0 [ 33.402861][ T316] input_register_device+0x9af/0x1080 [ 33.402893][ T316] uinput_create_device+0x416/0x670 [ 33.402923][ T316] uinput_ioctl_handler+0x3ea/0x1360 [ 33.402952][ T316] ? uinput_release+0x70/0x70 [ 33.402979][ T316] ? mutex_unlock+0x90/0x240 [ 33.403012][ T316] ? __fget_files+0x2bc/0x330 [ 33.403043][ T316] uinput_ioctl+0x2c/0x40 [ 33.403068][ T316] ? __cfi_uinput_ioctl+0x10/0x10 [ 33.403092][ T316] __se_sys_ioctl+0x126/0x1b0 [ 33.403123][ T316] __x64_sys_ioctl+0x7f/0xa0 [ 33.403151][ T316] x64_sys_call+0x1878/0x2ee0 [ 33.403172][ T316] do_syscall_64+0x57/0xf0 [ 33.403195][ T316] ? clear_bhb_loop+0x50/0xa0 [ 33.403226][ T316] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 33.403258][ T316] RIP: 0033:0x7f905b39e199 [ 33.403289][ T316] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 33.403309][ T316] RSP: 002b:00007f905c315028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 33.403351][ T316] RAX: ffffffffffffffda RBX: 00007f905b625fa0 RCX: 00007f905b39e199 [ 33.403369][ T316] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000003 [ 33.403386][ T316] RBP: 00007f905b4350b8 R08: 0000000000000000 R09: 0000000000000000 [ 33.403402][ T316] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 33.403418][ T316] R13: 00007f905b626038 R14: 00007f905b625fa0 R15: 00007fff9b575718 [ 33.403440][ T316] [ 33.596246][ T326] rust_binder: Write failure EFAULT in pid:10 [ 33.642012][ T328] ======================================================= [ 33.642012][ T328] WARNING: The mand mount option has been deprecated and [ 33.642012][ T328] and is ignored by this kernel. Remove the mand [ 33.642012][ T328] option from the mount to silence this warning. [ 33.642012][ T328] ======================================================= [ 33.717895][ T330] overlayfs: overlapping lowerdir path [ 33.801177][ T334] UDC core: g1: couldn't find an available UDC or it's busy [ 33.830526][ T341] netlink: 48 bytes leftover after parsing attributes in process `syz.2.13'. [ 33.946801][ T359] netlink: 'syz.1.19': attribute type 4 has an invalid length. [ 33.956533][ T360] rust_binder: 357:360 got reply transaction with no transaction stack [ 33.964855][ T360] rust_binder: 357:360 transaction reply to 0:0 failed EINVAL, code 0 size 0-0 [ 33.978395][ T49] rust_binder: 357: undelivered TRANSACTION_ERROR: 29201 [ 34.035061][ T311] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 34.186200][ T311] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 34.197650][ T311] usb 4-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice= 1.00 [ 34.206963][ T311] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 34.215038][ T311] usb 4-1: Product: syz [ 34.219327][ T311] usb 4-1: Manufacturer: syz [ 34.405172][ T10] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 34.442258][ T311] usb 4-1: USB disconnect, device number 2 [ 34.565045][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 34.571384][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 34.582624][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 34.592744][ T10] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 34.605819][ T10] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 34.614908][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.624379][ T10] usb 2-1: config 0 descriptor?? [ 35.100038][ T383] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 35.100106][ T383] rust_binder: Read failure Err(EFAULT) in pid:21 [ 35.275637][ T386] FAULT_INJECTION: forcing a failure. [ 35.275637][ T386] name failslab, interval 1, probability 0, space 0, times 0 [ 35.294968][ T386] CPU: 1 UID: 0 PID: 386 Comm: syz.2.30 Not tainted syzkaller #0 60889c1c5e6bdc1f3cb1b6a230ba908545dccc71 [ 35.295013][ T386] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 35.295029][ T386] Call Trace: [ 35.295037][ T386] [ 35.295046][ T386] __dump_stack+0x21/0x30 [ 35.295088][ T386] dump_stack_lvl+0x140/0x1c0 [ 35.295124][ T386] ? __cfi_dump_stack_lvl+0x10/0x10 [ 35.295169][ T386] ? __kasan_check_write+0x18/0x20 [ 35.295198][ T386] dump_stack+0x19/0x20 [ 35.295233][ T386] should_fail_ex+0x3c2/0x510 [ 35.295264][ T386] ? l2tp_session_create+0x56/0xd80 [ 35.295295][ T386] should_failslab+0xac/0x100 [ 35.295327][ T386] __kmalloc_noprof+0x69/0x510 [ 35.295353][ T386] ? l2tp_session_create+0x56/0xd80 [ 35.295382][ T386] ? __cfi_l2tp_udp_encap_recv+0x10/0x10 [ 35.295409][ T386] ? __cfi_l2tp_udp_encap_err_recv+0x10/0x10 [ 35.295440][ T386] l2tp_session_create+0x56/0xd80 [ 35.295470][ T386] pppol2tp_connect+0xbf7/0x1750 [ 35.295504][ T386] ? __cfi_pppol2tp_connect+0x10/0x10 [ 35.295536][ T386] ? __check_object_size+0xdc/0x870 [ 35.295564][ T386] ? selinux_socket_connect+0x27/0x40 [ 35.295598][ T386] ? bpf_lsm_socket_connect+0xd/0x20 [ 35.295626][ T386] ? security_socket_connect+0x3d/0x100 [ 35.295662][ T386] __sys_connect+0x337/0x460 [ 35.295695][ T386] ? __cfi___sys_connect+0x10/0x10 [ 35.295730][ T386] ? __kasan_check_write+0x18/0x20 [ 35.295755][ T386] ? fpregs_restore_userregs+0x11c/0x260 [ 35.295788][ T386] __x64_sys_connect+0x7e/0x90 [ 35.295821][ T386] x64_sys_call+0x1c2f/0x2ee0 [ 35.295844][ T386] do_syscall_64+0x57/0xf0 [ 35.295868][ T386] ? clear_bhb_loop+0x50/0xa0 [ 35.295901][ T386] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 35.295934][ T386] RIP: 0033:0x7f905b39e199 [ 35.295955][ T386] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.295976][ T386] RSP: 002b:00007f905c315028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 35.296004][ T386] RAX: ffffffffffffffda RBX: 00007f905b625fa0 RCX: 00007f905b39e199 [ 35.296022][ T386] RDX: 0000000000000026 RSI: 0000200000000000 RDI: 0000000000000005 [ 35.296039][ T386] RBP: 00007f905b4350b8 R08: 0000000000000000 R09: 0000000000000000 [ 35.296055][ T386] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 35.296071][ T386] R13: 00007f905b626038 R14: 00007f905b625fa0 R15: 00007fff9b575718 [ 35.296092][ T386] [ 35.600321][ T391] oom_control is deprecated and will be removed. Please report your usecase to linux-mm-@kvack.org if you depend on this functionality. [ 35.710442][ T393] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 35.787244][ T395] Zero length message leads to an empty skb [ 35.908119][ T10] microsoft 0003:045E:07DA.0001: No inputs registered, leaving [ 35.918175][ T10] microsoft 0003:045E:07DA.0001: hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.1-1/input0 [ 35.929724][ T10] microsoft 0003:045E:07DA.0001: no inputs found [ 35.936112][ T10] microsoft 0003:045E:07DA.0001: could not initialize ff, continuing anyway [ 35.946239][ T10] usb 2-1: USB disconnect, device number 2 [ 36.182566][ T36] kauditd_printk_skb: 84 callbacks suppressed [ 36.182616][ T36] audit: type=1400 audit(1791226250.280:158): avc: denied { read write } for pid=406 comm="syz.3.40" name="uhid" dev="devtmpfs" ino=199 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 36.187196][ T373] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 36.225600][ T36] audit: type=1400 audit(1791226250.280:159): avc: denied { open } for pid=406 comm="syz.3.40" path="/dev/uhid" dev="devtmpfs" ino=199 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 36.249418][ T373] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz0 [ 36.255724][ T401] fido_id[401]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 36.317102][ T36] audit: type=1400 audit(1791226250.420:160): avc: denied { unlink } for pid=407 comm="syz.2.39" name="#1" dev="tmpfs" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 36.363792][ T411] FAULT_INJECTION: forcing a failure. [ 36.363792][ T411] name failslab, interval 1, probability 0, space 0, times 0 [ 36.370945][ T36] audit: type=1400 audit(1791226250.420:161): avc: denied { mount } for pid=407 comm="syz.2.39" name="/" dev="overlay" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 36.442748][ T411] CPU: 1 UID: 0 PID: 411 Comm: syz.1.41 Not tainted syzkaller #0 60889c1c5e6bdc1f3cb1b6a230ba908545dccc71 [ 36.442789][ T411] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 36.442804][ T411] Call Trace: [ 36.442812][ T411] [ 36.442822][ T411] __dump_stack+0x21/0x30 [ 36.442865][ T411] dump_stack_lvl+0x140/0x1c0 [ 36.442902][ T411] ? __cfi_dump_stack_lvl+0x10/0x10 [ 36.442939][ T411] dump_stack+0x19/0x20 [ 36.442972][ T411] should_fail_ex+0x3c2/0x510 [ 36.443003][ T411] should_failslab+0xac/0x100 [ 36.443035][ T411] kmem_cache_alloc_noprof+0x42/0x410 [ 36.443062][ T411] ? vm_area_dup+0x3f/0x560 [ 36.443090][ T411] vm_area_dup+0x3f/0x560 [ 36.443116][ T411] ? __split_vma+0x1b8/0xc10 [ 36.443144][ T411] __split_vma+0x1ce/0xc10 [ 36.443173][ T411] ? vms_gather_munmap_vmas+0xd90/0xd90 [ 36.443204][ T411] ? mas_find+0x415/0x620 [ 36.443254][ T411] vms_gather_munmap_vmas+0x446/0xd90 [ 36.443285][ T411] do_vmi_align_munmap+0x251/0x5f0 [ 36.443315][ T411] ? __cfi_do_vmi_align_munmap+0x10/0x10 [ 36.443348][ T411] do_vmi_munmap+0x245/0x2e0 [ 36.443377][ T411] move_vma+0xac3/0x1210 [ 36.443412][ T411] ? vma_expandable+0x100/0x100 [ 36.443447][ T411] ? cap_mmap_addr+0x169/0x2e0 [ 36.443475][ T411] ? security_mmap_addr+0x31/0xe0 [ 36.443501][ T411] mremap_to+0x544/0x610 [ 36.443538][ T411] __se_sys_mremap+0x898/0x10f0 [ 36.443576][ T411] ? __x64_sys_mremap+0xf0/0xf0 [ 36.443612][ T411] ? preempt_schedule_irq+0xab/0x110 [ 36.443642][ T411] ? __cfi_preempt_schedule_irq+0x10/0x10 [ 36.443674][ T411] ? raw_irqentry_exit_cond_resched+0x32/0x40 [ 36.443712][ T411] ? irqentry_exit+0x4a/0x60 [ 36.443747][ T411] ? sysvec_reschedule_ipi+0x72/0x80 [ 36.443781][ T411] ? asm_sysvec_reschedule_ipi+0x1f/0x30 [ 36.443817][ T411] __x64_sys_mremap+0xc3/0xf0 [ 36.443852][ T411] x64_sys_call+0x2ac4/0x2ee0 [ 36.443876][ T411] do_syscall_64+0x57/0xf0 [ 36.443900][ T411] ? clear_bhb_loop+0x50/0xa0 [ 36.443933][ T411] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 36.443965][ T411] RIP: 0033:0x7fac5519e199 [ 36.443986][ T411] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 36.444007][ T411] RSP: 002b:00007fac53be3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 [ 36.444033][ T411] RAX: ffffffffffffffda RBX: 00007fac55425fa0 RCX: 00007fac5519e199 [ 36.444053][ T411] RDX: 0000000000003021 RSI: 0000000000004000 RDI: 0000200000001000 [ 36.444070][ T411] RBP: 00007fac552350b8 R08: 0000200000ffd000 R09: 0000000000000000 [ 36.444088][ T411] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 [ 36.444104][ T411] R13: 00007fac55426038 R14: 00007fac55425fa0 R15: 00007ffed31e88b8 [ 36.444125][ T411] [ 36.450651][ T36] audit: type=1400 audit(1791226250.520:162): avc: denied { unmount } for pid=297 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 37.256174][ T421] FAULT_INJECTION: forcing a failure. [ 37.256174][ T421] name failslab, interval 1, probability 0, space 0, times 0 [ 37.753873][ T421] CPU: 1 UID: 0 PID: 421 Comm: syz.2.45 Not tainted syzkaller #0 60889c1c5e6bdc1f3cb1b6a230ba908545dccc71 [ 37.753916][ T421] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 37.753931][ T421] Call Trace: [ 37.753939][ T421] [ 37.753949][ T421] __dump_stack+0x21/0x30 [ 37.754001][ T421] dump_stack_lvl+0x140/0x1c0 [ 37.754036][ T421] ? __cfi_dump_stack_lvl+0x10/0x10 [ 37.754071][ T421] ? __kasan_check_write+0x18/0x20 [ 37.754095][ T421] ? down_write+0xee/0x2b0 [ 37.754131][ T421] dump_stack+0x19/0x20 [ 37.754167][ T421] should_fail_ex+0x3c2/0x510 [ 37.754203][ T421] should_failslab+0xac/0x100 [ 37.754234][ T421] __kmalloc_cache_noprof+0x41/0x470 [ 37.754261][ T421] ? cgroup_mkdir+0xbe2/0x1600 [ 37.754294][ T421] cgroup_mkdir+0xbe2/0x1600 [ 37.754324][ T421] ? __cfi_cgroup_mkdir+0x10/0x10 [ 37.754351][ T421] kernfs_iop_mkdir+0x1be/0x2d0 [ 37.754383][ T421] vfs_mkdir+0x591/0x810 [ 37.754416][ T421] do_mkdirat+0x240/0x530 [ 37.754447][ T421] ? __cfi_do_mkdirat+0x10/0x10 [ 37.754479][ T421] ? __kasan_check_write+0x18/0x20 [ 37.754502][ T421] ? getname_flags+0x203/0x6b0 [ 37.754527][ T421] ? __kasan_check_write+0x18/0x20 [ 37.754550][ T421] __x64_sys_mkdirat+0x8b/0xa0 [ 37.754581][ T421] x64_sys_call+0x2ba8/0x2ee0 [ 37.754611][ T421] do_syscall_64+0x57/0xf0 [ 37.754634][ T421] ? clear_bhb_loop+0x50/0xa0 [ 37.754665][ T421] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 37.754696][ T421] RIP: 0033:0x7f905b39e199 [ 37.754715][ T421] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 37.754734][ T421] RSP: 002b:00007f905c315028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 37.754758][ T421] RAX: ffffffffffffffda RBX: 00007f905b625fa0 RCX: 00007f905b39e199 [ 37.754776][ T421] RDX: 00000000000001ff RSI: 0000200000000000 RDI: ffffffffffffff9c [ 37.754794][ T421] RBP: 00007f905b4350b8 R08: 0000000000000000 R09: 0000000000000000 [ 37.754810][ T421] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 37.754825][ T421] R13: 00007f905b626038 R14: 00007f905b625fa0 R15: 00007fff9b575718 [ 37.754845][ T421] [ 37.765558][ T421] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000021: 0000 [#1] PREEMPT SMP KASAN PTI [ 37.908110][ T36] audit: type=1400 audit(1791226251.970:163): avc: denied { write } for pid=406 comm="syz.3.40" name="hidraw0" dev="devtmpfs" ino=441 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 37.921489][ T421] KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f] [ 37.921512][ T421] CPU: 0 UID: 0 PID: 421 Comm: syz.2.45 Not tainted syzkaller #0 60889c1c5e6bdc1f3cb1b6a230ba908545dccc71 [ 37.921543][ T421] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 37.921557][ T421] RIP: 0010:cgroup_mkdir+0x122a/0x1600 [ 37.958821][ T36] audit: type=1400 audit(1791226252.030:164): avc: denied { read } for pid=93 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 37.961956][ T421] Code: eb 05 e8 79 4d 08 00 48 89 df e8 11 9e 00 00 48 81 fb 01 f0 ff ff 0f 83 9a fb ff ff 4c 8d b3 08 01 00 00 4d 89 f4 49 c1 ec 03 <43> 80 3c 2c 00 74 08 4c 89 f7 e8 17 35 61 00 48 8b bb 08 01 00 00 [ 37.961982][ T421] RSP: 0018:ffffc9000ca27c88 EFLAGS: 00010206 [ 37.977761][ T36] audit: type=1400 audit(1791226252.030:165): avc: denied { search } for pid=93 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 37.985597][ T421] RAX: 0cc4e36126d58d00 RBX: 0000000000000000 RCX: ffff8881f6e3acc0 [ 37.985622][ T421] RDX: ffff888114591300 RSI: ffff888114827000 RDI: ffff888100042000 [ 37.985642][ T421] RBP: ffffc9000ca27d38 R08: ffffffff81dc1178 R09: ffffffff81e02e5f [ 38.045121][ T36] audit: type=1400 audit(1791226252.030:166): avc: denied { write } for pid=93 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 38.065353][ T421] R10: ffffffff81e05944 R11: ffffffff81e0297e R12: 0000000000000021 [ 38.065382][ T421] R13: dffffc0000000000 R14: 0000000000000108 R15: ffff888114827010 [ 38.065401][ T421] FS: 00007f905c3156c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 38.137702][ T36] audit: type=1400 audit(1791226252.030:167): avc: denied { add_name } for pid=93 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 38.157597][ T421] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 38.157620][ T421] CR2: 00007f609efeb880 CR3: 0000000114516000 CR4: 00000000003526b0 [ 38.157641][ T421] Call Trace: [ 38.157650][ T421] [ 38.157661][ T421] ? __cfi_cgroup_mkdir+0x10/0x10 [ 38.228946][ T421] kernfs_iop_mkdir+0x1be/0x2d0 [ 38.233834][ T421] vfs_mkdir+0x591/0x810 [ 38.238111][ T421] do_mkdirat+0x240/0x530 [ 38.242479][ T421] ? __cfi_do_mkdirat+0x10/0x10 [ 38.247363][ T421] ? __kasan_check_write+0x18/0x20 [ 38.252497][ T421] ? getname_flags+0x203/0x6b0 [ 38.257289][ T421] ? __kasan_check_write+0x18/0x20 [ 38.262436][ T421] __x64_sys_mkdirat+0x8b/0xa0 [ 38.267233][ T421] x64_sys_call+0x2ba8/0x2ee0 [ 38.271936][ T421] do_syscall_64+0x57/0xf0 [ 38.276379][ T421] ? clear_bhb_loop+0x50/0xa0 [ 38.281087][ T421] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 38.287007][ T421] RIP: 0033:0x7f905b39e199 [ 38.291441][ T421] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 38.311069][ T421] RSP: 002b:00007f905c315028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 38.319511][ T421] RAX: ffffffffffffffda RBX: 00007f905b625fa0 RCX: 00007f905b39e199 [ 38.327509][ T421] RDX: 00000000000001ff RSI: 0000200000000000 RDI: ffffffffffffff9c [ 38.335506][ T421] RBP: 00007f905b4350b8 R08: 0000000000000000 R09: 0000000000000000 [ 38.343498][ T421] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 38.351493][ T421] R13: 00007f905b626038 R14: 00007f905b625fa0 R15: 00007fff9b575718 [ 38.359497][ T421] [ 38.362546][ T421] Modules linked in: [ 38.366843][ T421] ---[ end trace 0000000000000000 ]--- [ 38.385299][ T421] RIP: 0010:cgroup_mkdir+0x122a/0x1600 [ 38.393943][ T421] Code: eb 05 e8 79 4d 08 00 48 89 df e8 11 9e 00 00 48 81 fb 01 f0 ff ff 0f 83 9a fb ff ff 4c 8d b3 08 01 00 00 4d 89 f4 49 c1 ec 03 <43> 80 3c 2c 00 74 08 4c 89 f7 e8 17 35 61 00 48 8b bb 08 01 00 00 [ 38.455785][ T421] RSP: 0018:ffffc9000ca27c88 EFLAGS: 00010206 [ 38.462077][ T421] RAX: 0cc4e36126d58d00 RBX: 0000000000000000 RCX: ffff8881f6e3acc0 [ 38.470415][ T421] RDX: ffff888114591300 RSI: ffff888114827000 RDI: ffff888100042000 [ 38.478526][ T421] RBP: ffffc9000ca27d38 R08: ffffffff81dc1178 R09: ffffffff81e02e5f [ 38.487392][ T421] R10: ffffffff81e05944 R11: ffffffff81e0297e R12: 0000000000000021 [ 38.495549][ T421] R13: dffffc0000000000 R14: 0000000000000108 R15: ffff888114827010 [ 38.503627][ T421] FS: 00007f905c3156c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 38.514330][ T421] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 38.521125][ T421] CR2: 00007fac553f02f8 CR3: 0000000114516000 CR4: 00000000003526b0 [ 38.529348][ T421] Kernel panic - not syncing: Fatal exception [ 38.536007][ T421] Kernel Offset: disabled [ 38.540348][ T421] Rebooting in 86400 seconds..