last executing test programs: 759.421912ms ago: executing program 1 (id=2): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff097b00000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x10012, &(0x7f0000000140)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00']) utimensat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x21c0, 0x103) 738.303423ms ago: executing program 1 (id=6): r0 = openat$dir(0xffffffffffffff9c, 0x0, 0x220000, 0x10) r1 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122350007058103"], 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="9feb01001800000000000000280000002800100005000000030000000200000f0000000405000000000000000d0000006cb100041000000000000009002000000000006100dec8cef3bf58522a8fc51ef0cdd12fdcd1329d1e29c7e46b942bdf775ee9f89fbe62496bc93254828164479eb33938ee08211a40d9546ecd4a7908e1d6722c740c1ba39b4cc281589e47df81e694e7d22447b417191a4f837fe165efdb11b681a30d408f507df0685b27d6301c9f50ecc2a018461dda1584871da2e51baf5ead2e1550ece4766682460a1e5e9eab9013e6b66d3be83c86a0de948e99f8a3a3490425da8c51ef356b1dba60fd419184e5b478b0a9b1b59ec7b1799406650f402c631bf06831928fc8bfe69b2593a63c16164016b5eb8f5b603dc20dca986bad1b66beeb49a294594a1cfee0c5f3d919b5bb766f09f013444af96f035f628457445c65dc18882f"], 0x0, 0x45}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000048000/0x1000)=nil, 0x1000, 0xb, 0x31, 0xffffffffffffffff, 0x0) futex(&(0x7f000000cffc), 0xb, 0x0, 0x0, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000000080), 0x2) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) write$P9_RVERSION(r3, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) r4 = dup(r3) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000000940)=ANY=[@ANYBLOB="61157000000000006113a00000000000bfa000000000000007000000ee0016055e03010000000000160500000000000869163e0000000000bf0700000000000026050700fcffffff6706000020000000140600000ee60060bf500000000000002f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05002000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ace0600006e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc0da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44e2a2235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d00c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932fb3bba54b3a6aa57f1ad2e99e0e67ab9ff16d20000009f0f53acbb40b4f8e2738270001562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43010000007b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000000000000000000000000000c1eb2d91fb79ea00000000815266b2c9e1bfadc7498e9dda5d000000bb0d00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631822a11dc3c693962895496d4f6e9cc54db6c7205a6b26f92121ef53e553acdf42068fff496d2da7d6327f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710eec53f1b11cced7bc3c8da0c44d2fbf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db80300c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f8709d87b27f8a5d9121fdc058447b728f134f72062fc4b1ca0780b1a7af137ff7b4ff139604faf0453b65586f65c7943d56b52f06c870edf0c5d744b5272b44c23480b2bdbff947c4dfa108cbb88202eeb81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2a3bc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca871073f6bd61940aabc86b94f8cbde4d47060400e722a6a2af483ad0d3415ed0f9db009acaba9eaea93f811d434e00000000000000000000d154672fea96aedf346279ec00000000000000000000d535d41b0067f01e2e54b9154d876020b669640ead4ca44631fadf7c4ac39a1b331dbdcd52b36df021b731ef1f92330d347f88ced5c1aaadbcdd8d2257e3a9a7c7494fadf9be36f7a2334ee6e9446fa1fd486f85d672a77dc5bd21463994d49f12016305a1e394d292b66840fe32b40ad665d241a8b8a32b3100450c32832789aa8a096f41201b585cd76631c88cf958e9e9047f5af1730c5e83db12460a0768fd4b62be6c41eed307048bac8d1f7f164574241e06027654b248dcc38749eee0c1ee7c61b3f6411a559c3d45637b11e440ed5a99109b8e71d28c3d677af5f0499c6d3fc6a129775056958c9df824ebe5fa9fb306b24a8a8334910627d03efe69d4b61c4345f048c5da8aca16cea848fa77d2507c920a6bd654b00e07789382ed902c80deeff2fd5c78f42e4353e5360c3e55962efd1331e6736eaf4ee27736fa54803ee8ec1a15266ffcd8b30368740b584c2559e691e542cab3d49db327db62328f159d1e0900b3e23e84dedcd1377aa15dbeab7db181bd66980c3557c7d9f7377fcb6023accb5c368a121acf70e5f4c3f2a0ea07011c7149ea979cab2ee65cf7ffa29152b7a8fed89575e6e6fd77d4d9463d21775abac886ee6a1f2d7d8523840438a73d6307a87e2f525867fc3af7ab74520a773ae26bae74cdd405a211e8833e1ba523cde51d04a7ca6732"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffd2}, 0x48) write$FUSE_BMAP(r4, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r4, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x2000008, &(0x7f0000000540)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r4}, 0x2c, {[{@access_uid}, {@noextend}]}}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(r4, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x14, r5, 0x100, 0x70bd27, 0x25dfdbfe, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40000b1}, 0x4) r6 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r6, 0x0, 0x30, &(0x7f0000000080)={0x800, {{0x2, 0x4e23, @multicast2}}}, 0x90) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f00000002c0), &(0x7f0000048000)=0x1, 0x0) fcntl$setpipe(r0, 0x407, 0x2) syz_usb_control_io$hid(r1, 0x0, 0x0) getdents(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022350000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff00750895019102c0"], 0x0}, 0x0) 571.247847ms ago: executing program 4 (id=5): syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x2a0471a, &(0x7f0000000280)={[{}]}, 0x82, 0x499, &(0x7f0000000840)="$eJzs3M1vVFUfAODfvf3gffmsigpItEqMjR8tLags3Gg0cYFRowvUVW0LIRRqaE0sIVCNwY2JIdG1ujTxL3DnxqgrExNXujckRNmAxsWYe+demE47dFqnM4V5nmSYc+acO+ecOffMPfccpgF0rcHsnyRia0T8GhE7qtHFGQarT9eunJ3468rZiSQqldf+SPJ8V6+cnSizlsdtKSJDaUT6YVIUstjs/JkT49PTU6eL+MjcyXdGZufPPHH85PixqWNTp8YOHTp4YPTpp8aebEk7s3Zd3XNuZu/uF9+4+NLEkYtv//B1Vt+tRXptO9akf+lLg1nD/6zk6tMejv//p+I2mm014aS3gxVhVXoiIuuuvmz8VyqV8zVpO+KFD1Y4fMs6Vw9YR9m1adMyrxfXxYVKQ8lNU4FbQRKdrgHQGeX1Prv/LR9tnH503OVnqzdAWbuvFY9qSm+kRZ6+uvvbVhqMiCMLf3+ePaIV6xAAACv4eOKzw/H4cvO/NO6pybe92EMZiIg7IuLOiLgrInZGxN0Red57I2JXM4XWbBDUbw0tnf+kl+qytHR3IZv/PVPsbS2e/5WzvxjoKWLb8vb3JUePT0/tLz6ToejblMVHb1LGt8///EmjtNr5X/bIyi/ngkU9LvXWLdBNjs+N55PSFrj8fsSe3vinUqnUtT+5/kEnEbE7Ivas7q23l4Hjj361t1Gmldu/5O1uaMGZUPky4pFq/y9EXftLydL9yf5tN/YnR/4X01P7R8qzYqkff7rwSqPym2//+sj6f/Pi879I+WK+CAy8VbtfOxsNdi63Nizjwm8fNbynWev535+8nn8flduu743PzZ0ejehPDufxRa+P3Ti2jJf5s/YP7ctSyvaXR6b5d1wU/X9fROwt9svuj4gHiro/GBEPRcS+hq2P+P65xmkbof8na/o/ifrzf9e56nPZ//OrDvSc+O6bRuU31/8H89BQ8Ur+/beCZiu49k8OAAAAbh1pvnKTpMPXw2k6PFz9j707Y3M6PTM799jRmXdPTVZXeAaiLy1XunbUrIeOJgvFO1bjY8VacZl+oFg3/rQn8vjwxMz0ZIfbDt1uS4Pxn/m9p9O1A9bdcvtoY8v8oA24/dSP/3Rx9PzL7awM0FZ+rw3da4Xxn7arHkD7uf5D91pu/J+vi9sLgNuT6z90L+MfupfxD92rbvz3xC+dqgnQRmv4Ob/Ahgm8OryaozZFK0uPdIN8CE0Emv97EOsdeHNjVKOJQKe/mQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFrj3wAAAP//dNXrDA==") (async) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x2a0471a, &(0x7f0000000280)={[{}]}, 0x82, 0x499, &(0x7f0000000840)="$eJzs3M1vVFUfAODfvf3gffmsigpItEqMjR8tLags3Gg0cYFRowvUVW0LIRRqaE0sIVCNwY2JIdG1ujTxL3DnxqgrExNXujckRNmAxsWYe+demE47dFqnM4V5nmSYc+acO+ecOffMPfccpgF0rcHsnyRia0T8GhE7qtHFGQarT9eunJ3468rZiSQqldf+SPJ8V6+cnSizlsdtKSJDaUT6YVIUstjs/JkT49PTU6eL+MjcyXdGZufPPHH85PixqWNTp8YOHTp4YPTpp8aebEk7s3Zd3XNuZu/uF9+4+NLEkYtv//B1Vt+tRXptO9akf+lLg1nD/6zk6tMejv//p+I2mm014aS3gxVhVXoiIuuuvmz8VyqV8zVpO+KFD1Y4fMs6Vw9YR9m1adMyrxfXxYVKQ8lNU4FbQRKdrgHQGeX1Prv/LR9tnH503OVnqzdAWbuvFY9qSm+kRZ6+uvvbVhqMiCMLf3+ePaIV6xAAACv4eOKzw/H4cvO/NO6pybe92EMZiIg7IuLOiLgrInZGxN0Red57I2JXM4XWbBDUbw0tnf+kl+qytHR3IZv/PVPsbS2e/5WzvxjoKWLb8vb3JUePT0/tLz6ToejblMVHb1LGt8///EmjtNr5X/bIyi/ngkU9LvXWLdBNjs+N55PSFrj8fsSe3vinUqnUtT+5/kEnEbE7Ivas7q23l4Hjj361t1Gmldu/5O1uaMGZUPky4pFq/y9EXftLydL9yf5tN/YnR/4X01P7R8qzYqkff7rwSqPym2//+sj6f/Pi879I+WK+CAy8VbtfOxsNdi63Nizjwm8fNbynWev535+8nn8flduu743PzZ0ejehPDufxRa+P3Ti2jJf5s/YP7ctSyvaXR6b5d1wU/X9fROwt9svuj4gHiro/GBEPRcS+hq2P+P65xmkbof8na/o/ifrzf9e56nPZ//OrDvSc+O6bRuU31/8H89BQ8Ur+/beCZiu49k8OAAAAbh1pvnKTpMPXw2k6PFz9j707Y3M6PTM799jRmXdPTVZXeAaiLy1XunbUrIeOJgvFO1bjY8VacZl+oFg3/rQn8vjwxMz0ZIfbDt1uS4Pxn/m9p9O1A9bdcvtoY8v8oA24/dSP/3Rx9PzL7awM0FZ+rw3da4Xxn7arHkD7uf5D91pu/J+vi9sLgNuT6z90L+MfupfxD92rbvz3xC+dqgnQRmv4Ob/Ahgm8OryaozZFK0uPdIN8CE0Emv97EOsdeHNjVKOJQKe/mQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFrj3wAAAP//dNXrDA==") rename(&(0x7f0000000080)='./file0/file0\x00', &(0x7f0000000180)='./file1\x00') r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x2c) getdents64(r0, &(0x7f00000002c0)=""/139, 0x8b) 406.1431ms ago: executing program 4 (id=7): syz_usb_connect(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12f00f014a696d4003041060410100f60201090224000100b240792b8a"], 0x0) 403.178411ms ago: executing program 2 (id=3): syz_mount_image$exfat(&(0x7f0000002bc0), &(0x7f00000005c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x10000, &(0x7f00000000c0)=ANY=[@ANYBLOB='time_offset=0x0000000000000000,discard,namecase=1,dmask=00000000000000000000177,errors=continue,errors=remount-ro,iocharset=cp857,fmask=00000000000000000000075,namecase=1,uid=', @ANYRESHEX=0xee01, @ANYRES64=0x0], 0x1, 0x1550, &(0x7f0000000940)="$eJzs3AuYjVX7MPD7Xms9Y0jaTXIY1lr3w04OiyTJIUkOSVJJkpwSkiZ5JSEx5JQ0JCE5DMlhCMlhYtI4n8+HhCRpkiQkp2R918R8Km//3v97yPe97t917ctas/a9nnvt27P3s9feM992GlyjYc2q9YkI/iV4/p9EAIgFgP4AcA0ABABQNq5sXOZ4domJ/9pB2L/XwymXOwN2OXH9r2xc/ysb1//KxvW/snH9r2xc/ysb1//KxvVn7Eq2cWr+a/l25d54//+/gvrnwvj1/79IRsnRX64ueX1ngJh/NITr//8//Bdiuf7/tYJ/5E5c/ysb1/9KFXu5E2D/D+Dz/0qQ7Q9HuP5XNq4/Y1eyX+8Fx8J/ap85+4WjXf797t/fIPKf/AzE9/gf1521dXM5188YY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjP0FTvmLFABktf/g7vgXp8cYY4wxxhhjjLF/A5/tcmfAGGOMMcYYY4yx/zwEARIUBBAD2SAWskMOEAAxWePXQhxcB7nhesgDeSEf5Id4KAAFQYMBCwQhFILCEIUboAjcCEWhGBSHEuCgJJSCm6A03Axl4BYoC7dCObgNykMFqAiV4HaoDHdAFbgTqsJdUA2qQw2oCXdDLbgHasO9UAfug7pwPzwAD0I9eAjqw8PQAB6BhvAoNILHoDE0gabQDJr/Pt5n+wfiX4Ru8BJ0hx6QCD2hF7wMvaEP9IV+0B9egQHwKgyE1yAJBsFgeB2GwBswFN6EYTAcRsBbMBLehlEwGsbAWEiGcTAe3oEJ8C5MhEkwGaZACkyFafAeTIcZMBPeh1nwAcyGOTAX5kEqfAjzYQGkwUewED6GdFgEi2EJLIVlsBxWwEpYBathDayFdbAeNsBG2ASbYQtshW2wHT6BHfAp7IRdsBs+gz3w+W/js/9Z/MnfxXdGQECBAhUqjMEYjMVYzIE5MCfmxFyYCyMYwTiMw9yYG/NgHsyH+TAe47EgFkSDBgkJC2EhjGIUi2ARLIpFsTgWR4cOS2EpLI03Yxksg2WxLJbDclgeK2AFrISVsDJWxipYBatiVayG1bAG1sC78W7sibWxNtbBOlgX62ZtT2F9rI8NsAE2xIbYCBthY2yMTbEpNsfm2AJbYEtsia2xNbbBNtgW22ICJmA7bIftsT12wA7YETtiJ+yEnbELdsl4MRvgS/gS9sBqoif2wl7YG5Oy9cV+2A9fwQH4Kr6Kr2ESDsLB+Dq+jm/gUDyBw84NxxE4AiuLt3EUjkYSYzEZk3E8jscJOAEn4iSchFMwBafiNJyG03EGzsD3cRZ+gB/gHJyD8zAVU3E+LsA0TMOFeBLTcREuxiW4FJfhUlyBK3EFrsY1uBrX4TrcgBtwE27CLbgFt+E2/AQVAH6Ku3AXJuEe3IN7cS/uw324H/djBmbgATyAB/EgHsJDeBgP4xE8isfwKB7H43gCT+IpPIVn8Ayexefjv27wSbFVSSAyKaFEjIgRsSJW5BA5RE6RU+QSuURERESciBO5RW6RR+QR+UQ+ES/iRUFRUBhhBIkw85lCREVUFBFFRFFRVBQXxYUTTpQSpURpUVqUEWVEWXGrKCduE+VFBdHKVRKVRGXR2lURd4qqoqqoJqqLGqKmqClqiVqitqgt6og6oq6oKx4QD4p6oif2xYdFZmUaikHYSAzGxqKJkBeeoVqIodhStBKtxZNiOA7DtqKFSxDPiHZiFLYXfxOj8TnRUYzFTuIF0Vl0EV3Fi6KbaOm6ix5iIvYUvcQU7C36iL6in5iO1cX7OCt7DfGaSBKDxGDxupiHb4ih4ioxTAwXI8RbYqR4W4wSo8UYMVYki3FivHhHTBDviolikpgspogUMVVME++J6WKGmCneF7PEB2K2mCPminkiVXwo5osFIk18JBaKj0W6WCQWiyViqVgmlosVYqVYJVaLNWKtWCfWiw1io9gkNostYqvYJraLT8QO8anYKXaJ3eIzsUd8LvaKL8Q+8aXYL74SGeJrcUB8Iw6Kb8Uh8Z04LL4XR8RRcUz8II6LH8UJcVKcEqfFGfGTOCt+FueEF5B4/jFUMpAxMpuMldllDnmVzCmDrOd/GSevk7nl9TKPzCvzyfwyXhaQBaWWRlpJMpSFZGEZlTfIIvJGWVQWk8VlCelkSVlK3iRLy5tlGXmLLCtvleXkbbK8rCArykrydllZ3iEhcv4Y1WR1WUPWlHfLRLhH1pb3yjryPllX3i8fkA/KevIhWV8+LBvIR2RD+ahsJB+TjWUT2VQ2k83l47KFfEK2lK1ka/mkbCOfkm3l0zJBPiPbSX/hv8hzsqN8XnaSL8jOsovsKn+W56SX3WUPCT1B9pIvy96yj+wr+8n+8hU5QL4qB8rXZJIcJAfL1+UQ+YYcKt+Uw+RwOUK+JUfKt+UoOVqOkWNlshwnx8t35AT5rpwoJ8nJcopMkVNl3wszzZTyT+Pf+TvxA385+ga5UW6Sm+UWuVVuk9vlJ3KH3CF3yp1yt9wt98g9cq/cK/fJfXK/3C8zZIY8IA/Ig/KgPCQPycPysDwij8rT8gd5XP4oT8iT8qQ8Lc/IM/LshccAFCqhpFIqUDEqm4pV2VUOdZXKqa5WudQ1KqKuVXHqOpVbXa/yqLwqn8qv4lUBVVBpZZRVpEJVSBVWUXVD1ncDVXFVQjlVUpVSN/1v4lURdaMqqor9Jj4rv8Q/yK+5aq5aqBaqpWqpWqvWqo1qo9qqtipBJah2qp1qr9qrDqqD6qg6qk6qk+qsOquuqqvqprqp7qq7SlSJqpd6WfVWfVRf1U/1V6+IzDUMVANVkkpSg9VgNUQNUUPVUDVMDVMj1Ag1Uo1Uo9QoNUaNUckqWY1X49UENUFNVBPVZDVZpagUNU1NU9PVdDVTzVSzYrMembkqVaWq+Wq+SlNpaqFaqNLVIrVILVFL1DK1TK1QK9QqtUqtUWvUOrVOpauNaqParDarrWqr2q62qx1qh9qpdqrdarfao/aovWqv2qf2qf1qv8pQGeqAOqAOqoPqkDqkDqvD6og6oo6pY+q4Oq5OqBPqlDqlzqgz6qw6q86pc5mXfYEIRKACFcQEMUFsEBvkCHIEOYOcQa4gVxAJIkFcEBfkDq4P8gR5g3xB/iA+KBAUDHRgAhuIC0uLBjcERYIbg6JBsaB4UCJwQcmgVHBTUDq4OSgT3BKUDW4NygW3BeWDCkHFoFJwe1A5uCOoEtwZVA3uCqoF1YMaQc3g7qBWcE9QO7g3qBPcF9QN7g8eCB4M6gUPBfWDh4MGwSNBw+DRoFHwWNA4aBI0DZoFzf+t83t/Iu8TrrvuoRN1T91Lv6x76z66r+6n++tX9AD9qh6oX9NJepAerF/XQ/Qbeqh+Uw/Tw/UI/ZYeqd/Wo/RoPUaP1cl6nB6v39ET9Lt6op6kJ+spOkVP1dP0e3q6nqFn6vf1LP2Bnq3n6Ll6nk7VH+r5eoFO0x/phfpjna4X6cV6iV6ql+nleoVeqVfp1XqNXqvX6fV6g96oN+nNeoveqrfp7foTvUN/qnfqXXq3/kzv0Z/rvfoLvU9/qffrr3SG/lof0N/og/pbfUh/pw/r7/URfVSX0T/o4/pHfUKf1Kf0aX1G/6TP6p/1Oe0zL+4zX96NMsrEmBgTa2JNDpPD5DQ5TS6Ty0RMxMSZOJPb5DZ5TB6Tz+Qz8SbeFDQFTSYyZAqZQiZqoqaIKWKKmqKmuClunHGmlCllSpvSpowpY8qasqacKWfKm/Kmoqlobje3mzvMHeZOc6e5y9xlqpvqpqapaWqZWqa2qW3qmDqmrgIA84CpZ+qZ+qa+aWAamIamoWlkGpnGprFpapqa5qa5aWFamJampWltWps2po1pa9qaBJNg2pl2pr1pbzqYDqaj6Wg6mU6ms+lsupquppvpZrqb7ibRJJpeppfpbXqbvqav6W/6mwFmgBloBpokk2QGm8FmiBlihpqhZpgZbkZkg2xg3jajzGgzxow1ySbZjDfjzQQzwUw0E81kM9mkmBQzzUwz0810M9PMNLPMLDPbzDZzzVyTalLNfDPfpJm0zNPJpJt0s9gsNkvNUrPcLDcrzUqz2qw2a2GtWW/Wm41mo9lsNputZqvZbrabHWaH2Wl2mt1mt9lj9pi9Zq/ZZ/aZ/Wa/yTAZ5oA5YA6ag+aQOWQOm8PmiDlijplj5rg5bk6YE+aUOWXOmLwXXi+9ibXZbQ57lc1pr7a57DX29/18Nr+NtwVsQattHpv3N31jrS1qi9nitoR1tqQtZW+6pF/eVrAVbSV7u61s77BVLunXsvfY2vZeW8feZ2vau3/Tr2vvtw/YR209RADbxDawzWxD+6htZB+zjW0T29Q2s23sU7atfdom2GdsO/vsJf35doFdaVfZ1XaN3Wl32VP2tD1ov7Vn7E+2u+1h+9tX7AD7qh1oX7NJdtAl/RH2LTvSvm1H2dF2jB17SX+ynWJT7FQ7zb5np9sZl/RT7Yd2lk2zs+0cO9fO+6WfmVOa/cgutB/bdBvAYrvELrXL7HK74v/musSus+vtBrvDfmo32y12q91mt2ddCNtddrf9zO6xn9sD9hu7z35p99tDNsN+/Us/c32H7Hf2sP3eHrFH7TH7gz1uf1RZ0Zlr/8H+bM9Zb4GQgCQpCiiGslEsZaccdBXlpKspF11DEbqW4ug6yk3XUx7KS/koP8VTASpImgxZIgqpEBWmKN1AWekVpxLkqCSVopuoNN1MZegWKku3Ujm6jcpTBapIleh2qkx3UBW6k6rSXVSNqlMNqkl3Uy26h2rTvVSH7qO6dD89QA9SPXqI6tPD1IAeoYb0KDWix6gxNaGm1Iya0+PUgp6gltSKWtOT1Iaeorb0NCXQM9SOnqX29DfqQM9RR3qeOtEL1Jm6UFd6kbrRS9SdelAi9aRe9DL1pj7Ul/pRf3qFBtCrNJBeoyQaRIPpdRpCb9BQepOG0XAaQW/RSHqbRtFoGkNjKZnG0Xh6hybQuzSRJtFkmkIpNJWm0Xs0nWbQTHqfZtEHNJvm0FyaR6n0Ic2nBZRGH9FC+pjSaREtpiW0lJbRclpBK2kVraY1tJbW0XraQBtpE22mLbSVttF2+oR20Ke0k3bRbvqM9tDntJe+oH30Je2nryiDvqYD9A0dpG/pEH3ne9D3dISO0jH6gY7Tj3SCTtIpOk1n6Cc6Sz/TOfIEIYYilKEKgzAmzBbGhtnDHOFVYc7w6jBXeE0YCa8N48Lrwtzh9WGeMG+YL8wfxocFwoKhDk1oQwrDsFBYOIyGN4RFwhvDomGxsHhYInRhybBUeFNYOrw5LBPeEpYNbw3LhbeF5cMK4aP3VQpvDyuHd4RVwjvDquFdYbWwelgjrBneHdYK7wlrh/eGdcL7wjLh/eED4YNhvfChsH74cNggfCRsGD4aNgofCxuHTcKmYbOwefh42CJ8ImwZtgpbh1eFbcKnwrbh02FC+EzYLnz2l/H7F2SNP3nJeGLYM+wVvhy+HHp/r5wbnRdNjX4YnR9dEE2LfhRdmHnORBdFF0eXRJdGl0WXR1dEV0ZXRVdH10TXRtdF10c3RL2vmQ0cOuGkUy5wMS6bi3XZXQ53lcvprna53DUu4q51ce46l9td7/K4vC6fy+/iXQFX0GlnnHXkQlfIFXZRd4Mr4m50RV0xV9yVcM6VdKVcM9fcNXct3BOupWvlWrsn3ZPuKfeUe9o97Z5x7dyzrr37m+vgnnMd3fPuefeC6+y6uK7uRdfNjct1/pxMdL1cL9fb9XZ9XV/X3/V3A9wAN9ANdEkuyQ12g90QN8QNdUPdMDfMjXAj3Eg30o1yo9wYN8Ylu2Q33o13E9wEN9FNdJPdZJfiUtw0N81Nd9Nd5RnnjzLbzXZz3VyX6lLdfJd5zZjmFrqFLt2lu8VusVvqlrrlbrlb6Va61W61W+vWuvVuvdvoNrrNbrPb6ra67W672+F2uJ3+mvOTuj1ur9vr9rl9br/7ymW4r90B94076L51h9x37rD73h1xR90x94M77n50J9xJd8qddmfcT+6s+9mdc94lR8ZFxkfeiUyIvBuZGJkUmRyZEkmJTI1Mi7wXmR6ZEZkZeT8yK/JBZHZkTmRuZF4kNfJhZH5kQSQt8lFkYeTjSHpkUWRxZElkaWRZxPsCm0NfyBf2UX+DL+Jv9EV9MV/cl/DOl/Sl/E2+9Pm8072/1Zfzt/nyvoKv6B/zjX0T39Q38839476Ff8K39K18a/+kb+Of8m390z7BP+Pb+Wd9e/8338E/5zv6530n/4Lv7Lv4rv5F382/5Lv7Hj7R9/S9/Mu+t+/j+/p+vr9/xQ/wr/qB/jWf5Af5wf51P8S/4Yf6N/0wP9yPiHnLj8x6iwxjfbIf58f7d/wE/66f6Cf5yX6KT/FT/TT/np/uZ/iZ/n0/y3/gZ/s5fq6f51P9h36+X+DT/Ed+of/Yp/tFWZvGfrlf4Vf6VX61X+PX+nV+vd/gN/pNfrPf4rf6bX67/8Tv8J/6nX6X3+0/83v8536v/8Lv81/6/f4rn+G/9gf8N/6g/9Yf8t/5w/57f8Qf9cf8D/64/9Gf8Cf9KX/an/E/+bP+Z3/uj39njTHGGGOM/cq4i03x25Hz2/k9/06M+NWdewHA1VvyZ/x6PPOKcm2e8+0+Iv6X3e9nenR6OOtWrVpi4oWPnSBdQlB4DkDWJ0GZfvnqwYX+ImgNT0ECtILSfzf/PqLLGfqT+aO3AuT4VUxmQln9i/N/AYCJl6y3j3j8yRHzy4Wn4v6H+ecAFC18MSY7XOwvgta/7K+0gjJ/kH/eFn+Sf/YvkwFa/iomJ1zsX8y/FDwBz0LCb+7JGGOMMcYYY4yd10dU7JD1/jPrG59/7/15vLoYkw0u9v/s/TljjDHGGGOMMcYuv+e6dH368YSEVh3+940q/1TUP9xoBP+pmbnx20YuAGjV4TnvAbKGFAD8izMDZDbkX7mcTX/JsZIunDq/H1p62geQ9ROE879ZfdmL+083Lu/zEmOMMcYYY+zf7+JF/29/ri5XQowxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHG2BXor/hzYpd7jYwxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxtjl9n8CAAD//2Lv6gk=") bpf$MAP_CREATE(0x0, 0x0, 0x50) socket(0x10, 0x3, 0x0) syz_mount_image$vfat(&(0x7f0000000140), &(0x7f0000000080)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x399446c, 0x0, 0x1, 0x0, &(0x7f0000000080)) setresuid(0xee01, 0x0, 0x0) r0 = syz_clone(0x0, 0x0, 0x1d, 0x0, 0x0, 0x0) syz_open_procfs(r0, &(0x7f00000000c0)='environ\x00') r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000f00)=@base={0x5, 0x4, 0xfff, 0x7}, 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x15, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000080850000008200000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f00000021c0)={r3, 0x0, 0x0}, 0x10) timer_create(0x6613a8d3011ecee3, &(0x7f0000000000)={0x0, 0x39, 0x0, @tid=r0}, &(0x7f0000000100)) prlimit64(r0, 0x7, &(0x7f0000000040)={0xfffffffffffffffe, 0x800000002}, 0x0) syz_clone(0x44200400, 0x0, 0x0, 0x0, 0x0, 0x0) setreuid(0xee01, 0xee01) execve(0x0, 0x0, 0x0) lstat(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x1, &(0x7f0000000140)=[0xee01]) chown(&(0x7f0000000000)='./file0\x00', r4, r5) 372.111331ms ago: executing program 0 (id=1): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0xc0010002, 0x20000, 0x80ffffff}]}) socket(0x400000000010, 0x3, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0x3, 0x0, 0x0, 0x1, 0x7}, 0x0) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x21}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x1, &(0x7f0000000600)=0x0) io_submit(r4, 0x1, &(0x7f00000008c0)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x7fff, r3, &(0x7f0000000140)="b7", 0x1, 0x0, 0x0, 0x2}]) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000280)={{0x9000, 0x0, 0xc, 0x6, 0x4, 0xa, 0x3, 0xe, 0x0, 0x1, 0x3, 0x3}, {0x2, 0x1000, 0xe, 0x13, 0x1, 0x8, 0x3, 0x8, 0x0, 0x46, 0x6}, {0x1, 0x315a4c100da1da58, 0x4, 0xf, 0x5, 0xff, 0xc6, 0x6, 0x3, 0x6, 0x1, 0x3}, {0x3000, 0x4000, 0x1a, 0xc, 0x7f, 0x6, 0x8, 0x80, 0x9, 0x2, 0xf, 0x6}, {0x9000, 0x8000000, 0x0, 0xd, 0x59, 0x2d, 0x5, 0xc, 0xfc, 0x0, 0x3, 0xe5}, {0x2, 0x8092000, 0x8, 0xbd, 0x6, 0x7, 0x12, 0x1, 0xbf, 0x18, 0x2, 0x4}, {0x1, 0x1, 0xc, 0x9, 0x0, 0xf, 0x10, 0x3, 0x4, 0x0, 0x80, 0x9}, {0x26000, 0xffff, 0x10, 0x4, 0x3, 0x3, 0x0, 0xf9, 0x1, 0xfc, 0x0, 0xfe}, {0x4, 0xedd8}, {0xffff1000, 0x17}, 0x4004000f, 0x0, 0xd000, 0x100, 0x100000002, 0x0, 0xdddd1000, [0x5, 0x3, 0x4000000000000009, 0x7]}) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f00000002c0)=[@code={0xa, 0x5d, {"b8010000000f01c166bad104ec0fdb4d70b99f030000b8feffffffba000000000f300f20578f292098953200000066baf80cb8e68af88def66bafc0c66ed2666420fc737ff4d49c4c155f3e9"}}], 0x5d}) ioctl$KVM_RUN(r2, 0xae80, 0x0) getdents(r0, &(0x7f0000000440)=""/198, 0xc6) ioctl$KVM_RUN(r2, 0xae80, 0x0) 369.099911ms ago: executing program 3 (id=4): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) (async) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060", @ANYRESOCT], 0xb8}}, 0x20040014) ioctl$sock_SIOCGPGRP(r1, 0x8904, 0x0) (async) ioctl$sock_SIOCGPGRP(r1, 0x8904, 0x0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r3 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYRESDEC=r1, @ANYRESHEX=r0, @ANYRES32=0xee01, @ANYRESHEX=r3], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x4044051) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) (async) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r5, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r5, 0x0, 0x30, &(0x7f0000000600)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000002"], 0x110) setsockopt$inet_group_source_req(r5, 0x0, 0x2c, &(0x7f00000004c0)={0x2, {{0x2, 0x0, @multicast2}}, {{0x2, 0x4e20, @empty}}}, 0x108) (async) setsockopt$inet_group_source_req(r5, 0x0, 0x2c, &(0x7f00000004c0)={0x2, {{0x2, 0x0, @multicast2}}, {{0x2, 0x4e20, @empty}}}, 0x108) setsockopt$inet_group_source_req(r5, 0x0, 0x2b, &(0x7f0000000000)={0x2, {{0x2, 0x4e26, @multicast2}}, {{0x2, 0x4e22, @multicast2}}}, 0x108) setsockopt$inet6_buf(r4, 0x29, 0x39, &(0x7f0000000040), 0x0) (async) setsockopt$inet6_buf(r4, 0x29, 0x39, &(0x7f0000000040), 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r7 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r7, 0x1, &(0x7f0000000240)=0x7) (async) sched_setscheduler(r7, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r8, &(0x7f0000000180)=@abs, 0x6e) recvmmsg(r8, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, 0x0, 0x4001) (async) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, 0x0, 0x4001) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) openat(0xffffffffffffff9c, 0x0, 0x8541, 0x1a9) sendmsg$nl_xfrm(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c0200001900010026bd7800fedbdf25e0000002000000000000000000000000640101000000000000000000000000000000000600000000020000003c414c00", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000004000000000000000000000100000000000000000000000000000000000000000000000000000000040000000000000010000000000000000600000000000000990c0000100000000008000000000000de0200000000000000000000b06b6e00000101020000000084010500ac1414aa000000000000000000000000000004d33300000000000000fe8000000000000000000000000000bb000000000000ff00070000000000000000000000fe8000000000000000000000000000aa000000003200000000000000fc000000000000000000000000000001000000000000000000000000ff01000000000000fe880000000000000000000000000101000004d43c00000002000000fc0000000000000000000000000000010235000001030000000000000600000000000000fe8000000000000000000000000000bb000000003c00000002000000fe8000000000000000000000000000aa00000000020000000000000003000000286a8b27ac141443000000000000000000000000000004d5320000000200000000000000000000000000000000000000ffffffff0400000004000000000000000800000020010000000000000000000000000002000004d33300"], 0x23c}, 0x1, 0x0, 0x0, 0x24008004}, 0x4c040) sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80004000000e9"], 0xb8}, 0x1, 0x0, 0x0, 0x8000010}, 0x4000000) (async) sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80004000000e9"], 0xb8}, 0x1, 0x0, 0x0, 0x8000010}, 0x4000000) 166.368686ms ago: executing program 3 (id=8): syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="61636c2c63616368655f73747261746567793d64697361626c65642c6e6f61636c2c757365725f7861747472006e6f757365725f78617474655f73747261746567793d7265616461686561642c00000000000000df2d11d05997f7982d4fa92373769456f415af7e729a6d57b8772d6796839f68a04c22d129ea3dace070456c3a534e0959e60ae8b95f19c7210842f7c3f30ce77f7b6c4114e66d658a83c8aee86b5c94c74f7e90183e311dabf7f87e1a495a67862c049b56104a9fb173e2b5bc89de7334f0f5a5bc7dc6a8dfcf394139bc6483ff6b9129f9b8c074208e5eaf4bb2654ba694"], 0x5, 0x182, &(0x7f00000001c0)="$eJzslM9KOlEUx7/3jjr447drF0SLhGzhODNWtImQXkDoH+2ynMQaU3SCtFW07SXa9gpugl6kWkXgsrUxc696C3WkKIXOZ3H8jPePZ47wBUEQf5bnp7fHm9fWpQbgPxLQ5fcvWn8PV/af5+KHM6nNuxYerjeqc5VBd3Y64/9+BMB9VoPXO/vxdEJ+boP3fAccS9L3wGBIPwDHrnQHDPvSTxSv+PsN47jkOsZRxS34YvrF8ovtl8zn/tpXDAWlP6as1xvN07zrOrUflLD5tbMc60p/6v/VnY2pzM8ChyU9A4Yt6WvQu7MRI1HefzbSv1/75fcnIQkRHVPRxtgSnY42vi368KV+PnVuGRaVfIoo+ZH2ytV0vdFMlcr5olN0zmw7s2oum+aKnQ6CSNQR+RcP8umfcn90yN4Yi+Ei73k1S9Tesy3qoMTlQf5xJBfEs5/9saHdiHUmz7HAktqI7QRBEBNjHizIzBDs3KQbJQiCIAiCIAiCIAjiy7wHAAD//w9ydCE=") r0 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000100), 0x4) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.net/syz1\x00', 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000005c0)={@map=0x1, 0xb, 0x0, 0x800, &(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x0, &(0x7f0000000500)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000540)=[0x0], &(0x7f0000000580)=[0x0], 0x0}, 0x40) r3 = ioctl$KVM_GET_STATS_FD_cpu(0xffffffffffffffff, 0xaece) r4 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000600)={r0, r1, 0x12, 0x0, @val=@netkit={@void, @value=r3, @void, @void, r2}}, 0x1c) bind$tipc(0xffffffffffffffff, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x2, {0x42, 0x4, 0xfffffffd}}, 0x10) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x301c48a, &(0x7f0000000380)=ANY=[@ANYRES8=r4], 0x1, 0x2d5, &(0x7f0000000680)="$eJzs3T+LHGUcB/Df7O3tTrTYLaxEcEALq5BLa7OHJCBeZdhCLfQwCcjtIiRw4B+cTWUl2FhY+AoEwRdi4zsQbAU7IwRGZnYmM5vbXPbk9sTc59PcM8883+f5zdxwO1fccx+9Mj+6ncXdB1/+FmmaRG8Sk3iYxDh60VgUS/nycPJtAAD/Zw+LIv6sP9/PkksiIt1eWQDAFm32+d9vmz9fSFkAwBbdeu/9d/YPDm68m2Vp3Jx/fTwtf7Mvvy7P79+NT2IWd+JajOJRRPWisBvV20LZvFkURd7PSuN4fZ4fT8vk/MNf6vn3/4io8nsxinHV9fhto8q/fXBjL1vq5POyjhfq9Sdl/nqM4qXH4ZX89TX5mA7ijdc69V+NUfz6cXwas7hdFdHmv9rLsreK7/764oOyvDKf5MfTYTWuVex0j65czLcHAAAAAAAAAAAAAAAAAAAAAIDn1NV675xhVPv3lF31/js7j8qD3cga49X9eZb5pJmouz9QURR5ET80++tcy7KsqAe2+X683O9uLAgAAAAAAAAAAAAAAAAAAACX1/3PPj86nM3u3DuXRrMbQD8i/r4V8W/nmXR6Xo3TBw/rNQ9ns17dXB3T7/bETjMmiTi1jPIizum2PKtx5UTNdePHnzaaJ4lY1D3psxfdXb/WeTaap+voMFl/D4fR9KT1Q/L9IKIdM4inLbFY7Rk8rYwizvL4DdaeGm0W/6a+2nKeF6uevDm1OJmK5InCkqQz5s3fl3PVPcmTVzGo7uq6MiJtGm18dUy60fMc6TJ+8mdFYrcOAAAAAAAAAAAAAAAAAADYqvavf9ecfHBqtFcMt1YWAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFyo9v//n6GR1+ENBg/i3v3/+BIBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC4BP4JAAD//47KXt4=") bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), 0x0) r5 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x31) r6 = epoll_create1(0x80000) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r8 = getpid() kcmp$KCMP_EPOLL_TFD(r8, r7, 0x7, r6, &(0x7f0000000200)={r6}) ioctl$KVM_CAP_EXIT_ON_EMULATION_FAILURE(r5, 0x4068aea3, &(0x7f0000000040)={0xcc, 0x0, 0x1}) 110.526958ms ago: executing program 0 (id=9): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) ioctl$AUTOFS_IOC_SETTIMEOUT(r0, 0x80049367, &(0x7f0000000040)=0x4f) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, r2, {0x2, 0x0, @loopback}, 0x80004, 0x0, 0xffffffff}}, 0x2e) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=@ipv4_newrule={0x24, 0x20, 0xf4db158ec847dc81, 0xfffffffb, 0x3, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1f}, [@FRA_GENERIC_POLICY=@FRA_FWMARK={0x8, 0xa, 0x81}]}, 0x24}}, 0x44004) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000540)={'gre0\x00', &(0x7f0000000480)={'ip_vti0\x00', 0x0, 0x1, 0x7ffd, 0x9, 0x79, {{0x5, 0x4, 0x2, 0x8, 0x14, 0x64, 0x0, 0x2, 0x4, 0x0, @rand_addr=0x64010100, @initdev={0xac, 0x1e, 0x1, 0x0}}}}}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000900), 0xa0002, 0x0) close(r4) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) ioctl$TUNSETVNETLE(r4, 0x400454dc, 0xfffffffffffffffe) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x18, 0x7, &(0x7f0000000200)=ANY=[], &(0x7f0000000100)='GPL\x00'}, 0x94) r6 = eventfd2(0xffffffff, 0x1) r7 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x3) ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(r7, 0x4010ae74, &(0x7f00000001c0)={0x2, 0x4, 0x8}) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r6, &(0x7f0000000180)={0x4}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) rmdir(&(0x7f0000000180)='./config/usb_gadget/g1/functions/ffs.usb0\x00') r8 = creat(&(0x7f0000000000)='./file0\x00', 0xc9a9c042ad77c5e5) socket$nl_xfrm(0x10, 0x3, 0x6) r9 = socket(0xa, 0x1, 0x0) ppoll(&(0x7f0000000180)=[{r9}], 0x1, 0x0, 0x0, 0x0) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r8) sendmsg$NL80211_CMD_EXTERNAL_AUTH(r9, &(0x7f0000000700)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x68, r10, 0x4, 0x70bd27, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x8000, 0x79}}}}, [@NL80211_ATTR_BSSID={0xa, 0xf5, @random="e59d4ed8f5b7"}, @NL80211_ATTR_BSSID={0xa, 0xf5, @random="80ee3b653cf4"}, @NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x60}, @NL80211_ATTR_BSSID={0xa, 0xf5, @random="efff103df9ab"}, @NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x4b}, @NL80211_ATTR_PMKID={0x14, 0x55, "be149398ee2ea80a72ffb7fc09b61a05"}]}, 0x68}, 0x1, 0x0, 0x0, 0x804c050}, 0x4) 62.187119ms ago: executing program 3 (id=10): openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) (async) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket(0x10, 0x3, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x80, 0x2}]}, 0x10) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)=ANY=[@ANYBLOB="00000a000000fe00fd09000000000000000000000000000000000000d9b5c240dd0e0ffcc7915e6228492d0aed220d3a7cbadfb992b103ecb1c2692816b29a9d5ed7c3ae82cf80ba6ddf355ff1a44cdaa4a1e74b67258168c09335003de8b54774d95af4a507e5d15caeb1f153a7bb10c66c2f1d5db95e8a408b6bafbf68e183854fe02a78b3ab273499211163668e0b82f4796a"], 0x1c}, 0x1, 0x0, 0x0, 0x844}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)=ANY=[@ANYBLOB="00000a000000fe00fd09000000000000000000000000000000000000d9b5c240dd0e0ffcc7915e6228492d0aed220d3a7cbadfb992b103ecb1c2692816b29a9d5ed7c3ae82cf80ba6ddf355ff1a44cdaa4a1e74b67258168c09335003de8b54774d95af4a507e5d15caeb1f153a7bb10c66c2f1d5db95e8a408b6bafbf68e183854fe02a78b3ab273499211163668e0b82f4796a"], 0x1c}, 0x1, 0x0, 0x0, 0x844}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x121180, 0x0) ioctl$TUNDETACHFILTER(r1, 0x401054d6, 0x0) 814.92µs ago: executing program 3 (id=11): setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x8008000000010, &(0x7f0000000480)="17000000", 0x4) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_OPENQRY(r0, 0x4b4b, &(0x7f0000000480)) syz_usb_connect(0x1, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410217ff5d810009050f1f01040000000905830300b3b3831425fdc1ae69bee230c316816019a7dcb24d"], 0x0) setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x8008000000010, &(0x7f0000000480)="17000000", 0x4) (async) syz_open_dev$tty1(0xc, 0x4, 0x1) (async) ioctl$VT_OPENQRY(r0, 0x4b4b, &(0x7f0000000480)) (async) syz_usb_connect(0x1, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410217ff5d810009050f1f01040000000905830300b3b3831425fdc1ae69bee230c316816019a7dcb24d"], 0x0) (async) 0s ago: executing program 2 (id=12): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket(0x10, 0x3, 0x0) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xd0f, 0x70bd2a, 0x0, {0x60, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x0, 0x5, 0x1, 0x0, 0x7}, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x8000}, 0x0) (async, rerun: 64) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000180)={0x4, {{0x2, 0xffff, @local}}}, 0x88) (rerun: 64) r4 = syz_usb_connect$sierra_net(0x3, 0x3f, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x1199, 0x68a3, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x80, 0xfa, "", {{0x9, 0x4, 0x7, 0x0, 0x3, 0xff, 0x0, 0x0, 0x0, "", {{0x9, 0x5, 0x1, 0x2, 0x20, 0x4, 0x3, 0x1}, {0x9, 0x5, 0x8, 0x2, 0x3ff, 0xc3, 0x2, 0x27}, {0x9, 0x5, 0x6, 0x3, 0x8, 0x5, 0x7, 0x3e}}}}}}]}}, 0x0) syz_usb_control_io(r4, &(0x7f00000003c0)={0x2c, &(0x7f0000000240)={0x20, 0x29, 0x2e, {0x2e, 0x5, "9424912154b9466763af39585bcc37b21019c98ef869e45f645703ef78c1c844d1bff416c5f0cc98545fbd8e"}}, &(0x7f0000000280)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x100c}}, &(0x7f0000000300)={0x0, 0xf, 0x2b, {0x5, 0xf, 0x2b, 0x3, [@ss_container_id={0x14, 0x10, 0x4, 0x3, "4473b555295cbb3864f9ad4b6c4c7665"}, @ext_cap={0x7, 0x10, 0x2, 0x2, 0x1, 0x1, 0x6440}, @wireless={0xb, 0x10, 0x1, 0xc, 0x8, 0x5, 0x6b, 0x3, 0x4}]}}, &(0x7f0000000340)={0x20, 0x29, 0xf, {0xf, 0x29, 0x7, 0x2, 0x7, 0x4, "9d46d660", "1ca6636b"}}, &(0x7f0000000380)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x0, 0x4, 0x4f, 0x1, 0x0, 0x9, 0x8}}}, &(0x7f0000000b00)={0x84, &(0x7f0000000400)={0x20, 0xf, 0x8c, "63a64effc650042d1d9f4a3316766744d3b8ee21bc776671847ec7b09992821b32379c0a3728ea7c47bbace215706a112c5f196238129040a2da1f434527880efd7127efdc27a3bc04de6855b06d7469172acb2935e03b987df8a280f5b3192f0f436f3671b655508889c92a10cea36b964805e598f06015ef21e21ccd3d64f87e814f8da9b2af4b4b824b2f"}, &(0x7f0000000600)={0x0, 0xa, 0x1, 0x7}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0xf8}, &(0x7f0000000680)={0x20, 0x0, 0x4, {0x0, 0x1}}, &(0x7f00000006c0)={0x20, 0x0, 0x8, {0x2, 0x2, [0x1e00f]}}, &(0x7f0000000700)={0x40, 0x7, 0x2, 0xfff7}, &(0x7f0000000740)={0x40, 0x9, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0xb, 0x2, "6ee0"}, &(0x7f00000007c0)={0x40, 0xf, 0x2, 0x201}, &(0x7f0000000800)={0x40, 0x13, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, &(0x7f00000009c0)={0x40, 0x17, 0x6, @broadcast}, &(0x7f0000000880)={0x40, 0x19, 0x2, "1899"}, &(0x7f00000008c0)={0x40, 0x1a, 0x2, 0x40}, &(0x7f0000000900)={0x40, 0x1c, 0x1, 0x9}, &(0x7f0000000940)={0x40, 0x1e, 0x1, 0x5}, &(0x7f0000000980)={0x40, 0x21, 0x1, 0x2}}) (async, rerun: 64) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (rerun: 64) ioctl$sock_bt_hci(r5, 0x400448de, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x0, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000cc0)=@newqdisc={0x64, 0x24, 0x800, 0x70bd27, 0x4000000, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0xfff3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x38, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x1, 0x0, 0x0, 0x0, 0xefb2, 0x6}, {0xff, 0x2}, 0x0, 0x1}}, @TCA_TBF_RATE64={0xc, 0x4, 0xe58588735ea0c986}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4804}, 0x0) (async) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r8, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x3, 0x6, 0x101, 0x0, 0x0, {0x5, 0x0, 0x6}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4048810}, 0x44010) write$binfmt_register(0xffffffffffffffff, &(0x7f0000000000)={0x3a, 'syz0', 0x3a, 'M', 0x3a, 0xfffffffffffffffc, 0x3a, '%', 0x3a, '\\', 0x3a, './file0'}, 0x29) (async) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) request_key(&(0x7f0000000000)='asymmetric\x00', 0x0, 0x0, 0xfffffffffffffff8) (async) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000100)={@multicast1, @dev={0xac, 0x14, 0x14, 0xf}, @multicast1}, 0xc) setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f00000004c0)={0x2, {{0x2, 0x4e23, @multicast2}}, {{0x2, 0x4e20, @private=0xa010101}}}, 0x108) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.253' (ED25519) to the list of known hosts. [ 22.514587][ T24] audit: type=1400 audit(1786419587.270:64): avc: denied { mounton } for pid=271 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.515505][ T271] cgroup: Unknown subsys name 'net' [ 22.537338][ T24] audit: type=1400 audit(1786419587.270:65): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.564637][ T24] audit: type=1400 audit(1786419587.300:66): avc: denied { unmount } for pid=271 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.564804][ T271] cgroup: Unknown subsys name 'devices' [ 22.681030][ T271] cgroup: Unknown subsys name 'hugetlb' [ 22.686804][ T271] cgroup: Unknown subsys name 'rlimit' [ 22.852694][ T24] audit: type=1400 audit(1786419587.610:67): avc: denied { setattr } for pid=271 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.875890][ T24] audit: type=1400 audit(1786419587.610:68): avc: denied { mounton } for pid=271 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.900815][ T24] audit: type=1400 audit(1786419587.610:69): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.906359][ T273] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 22.932856][ T24] audit: type=1400 audit(1786419587.690:70): avc: denied { relabelto } for pid=273 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.958325][ T24] audit: type=1400 audit(1786419587.690:71): avc: denied { write } for pid=273 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.993644][ T24] audit: type=1400 audit(1786419587.750:72): avc: denied { read } for pid=271 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.019189][ T24] audit: type=1400 audit(1786419587.750:73): avc: denied { open } for pid=271 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.045212][ T271] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.552453][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.559813][ T279] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.567104][ T279] device bridge_slave_0 entered promiscuous mode [ 23.574952][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.582025][ T279] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.589300][ T279] device bridge_slave_1 entered promiscuous mode [ 23.669832][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.676883][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.684305][ T281] device bridge_slave_0 entered promiscuous mode [ 23.694962][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.702012][ T280] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.709265][ T280] device bridge_slave_0 entered promiscuous mode [ 23.715949][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.723020][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.730396][ T281] device bridge_slave_1 entered promiscuous mode [ 23.754359][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.761441][ T280] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.768803][ T280] device bridge_slave_1 entered promiscuous mode [ 23.785368][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.792451][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.799820][ T283] device bridge_slave_0 entered promiscuous mode [ 23.821428][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.828467][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.835852][ T283] device bridge_slave_1 entered promiscuous mode [ 23.855486][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.862552][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.869968][ T282] device bridge_slave_0 entered promiscuous mode [ 23.878978][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.886071][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.893541][ T282] device bridge_slave_1 entered promiscuous mode [ 24.005302][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.012374][ T280] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.019690][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.026718][ T280] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.037673][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.044735][ T283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.052018][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.059040][ T283] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.079594][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.087080][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.094595][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.101779][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.109388][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.116727][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.141967][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.150331][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.158435][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.165478][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.180043][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.187656][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.196118][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.204378][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.211453][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.247505][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.255736][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.274205][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.281993][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.289404][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.297523][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.304566][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.312132][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.320436][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.327443][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.334879][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.343098][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.350175][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.357540][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.365705][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.372730][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.398966][ T279] device veth0_vlan entered promiscuous mode [ 24.405230][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.413397][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.422323][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.430160][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.437503][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.445663][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.453788][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.461976][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.468992][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.476493][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.484650][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.491687][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.499087][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.507575][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.531218][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.538929][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.547123][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.556031][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.571189][ T279] device veth1_macvtap entered promiscuous mode [ 24.591806][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.600201][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.608423][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.616648][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.625603][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.634196][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.642659][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.650286][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.658301][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.666443][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.674968][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.683253][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.690314][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.697880][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.706335][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.714520][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.721658][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.729114][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.737659][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.745756][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.753970][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.762131][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.769635][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.777064][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.786787][ T280] device veth0_vlan entered promiscuous mode [ 24.798885][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.807350][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.815948][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.824363][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.833053][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.841114][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.849086][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.856653][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.866135][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.874638][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.883262][ T283] device veth0_vlan entered promiscuous mode [ 24.892161][ T280] device veth1_macvtap entered promiscuous mode [ 24.902552][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.910770][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.918888][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.936664][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.945576][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.945949][ T279] request_module fs-gadgetfs succeeded, but still no fs? [ 24.954277][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.969916][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.978213][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.986579][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.996902][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.004844][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.017166][ T279] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 25.019920][ T281] device veth0_vlan entered promiscuous mode [ 25.036052][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.050968][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.059029][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.067868][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.076651][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.085144][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.094027][ T283] device veth1_macvtap entered promiscuous mode [ 25.110085][ T282] device veth0_vlan entered promiscuous mode [ 25.133052][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.141450][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.149233][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.157592][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.166567][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.174685][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.182877][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.191491][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.198861][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.207707][ T281] device veth1_macvtap entered promiscuous mode [ 25.216418][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.224245][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.232820][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.244146][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.256995][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.277278][ T282] device veth1_macvtap entered promiscuous mode [ 25.286937][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.287590][ T311] EXT4-fs (loop4): 1 truncate cleaned up [ 25.296577][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.308884][ T311] EXT4-fs (loop4): mounted filesystem without journal. Opts: bsddf,,errors=continue [ 25.309280][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.327235][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.336469][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.359313][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.367851][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.376831][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.380246][ T317] exfat: Deprecated parameter 'namecase' [ 25.385204][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.390981][ T317] exfat: Deprecated parameter 'namecase' [ 25.399542][ T300] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 25.487516][ T317] exFAT-fs (loop2): failed to load upcase table (idx : 0x0001fe89, chksum : 0xef5d2b8f, utbl_chksum : 0xe619d30d) [ 25.496819][ T325] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.559653][ T325] kvm [322]: vcpu0, guest rIP: 0xfff0 disabled perfctr wrmsr: 0xc0010002 data 0x80ffffff [ 25.701847][ T332] erofs: (device loop3): erofs_superblock_csum_verify: invalid checksum 0x7cda66ab, 0x7bbbea8c expected [ 25.713685][ T303] udevd[303]: incorrect erofs checksum on /dev/loop3 [ 25.728756][ T337] file system registered [ 25.735165][ T337] unloading [ 25.759390][ T20] usb 5-1: new low-speed USB device number 2 using dummy_hcd [ 25.780540][ T300] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 25.795290][ T300] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 25.805777][ T300] usb 2-1: New USB device found, idVendor=04d8, idProduct=c002, bcdDevice= 0.00 [ 25.814890][ T300] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.823342][ T336] ================================================================== [ 25.831557][ T336] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 [ 25.838237][ T336] Write of size 8 at addr ffff888129b0b950 by task syz.0.9/336 [ 25.845773][ T336] [ 25.848100][ T336] CPU: 1 PID: 336 Comm: syz.0.9 Not tainted syzkaller #0 [ 25.855112][ T336] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 25.865170][ T336] Call Trace: [ 25.868456][ T336] __dump_stack+0x21/0x24 [ 25.872785][ T336] dump_stack_lvl+0x1a7/0x208 [ 25.877457][ T336] ? show_regs_print_info+0x18/0x18 [ 25.882647][ T336] ? thaw_kernel_threads+0x220/0x220 [ 25.887925][ T336] ? debug_smp_processor_id+0x17/0x20 [ 25.893290][ T336] print_address_description+0x7f/0x2c0 [ 25.898825][ T336] ? mutex_lock+0x85/0xf0 [ 25.903170][ T336] kasan_report+0x100/0x140 [ 25.907667][ T336] ? mutex_lock+0x85/0xf0 [ 25.911989][ T336] kasan_check_range+0x249/0x2a0 [ 25.916924][ T336] __kasan_check_write+0x14/0x20 [ 25.921861][ T336] mutex_lock+0x85/0xf0 [ 25.926014][ T336] ? mutex_trylock+0xb0/0xb0 [ 25.930601][ T336] ? l2tp_session_put+0xb2/0x1a0 [ 25.935626][ T336] ? l2tp_session_delete+0x3a9/0x4a0 [ 25.940917][ T336] pppol2tp_release+0x178/0x2b0 [ 25.945793][ T336] sock_close+0xb8/0x200 [ 25.950032][ T336] ? sock_mmap+0xa0/0xa0 [ 25.954267][ T336] __fput+0x2dc/0x730 [ 25.958242][ T336] ____fput+0x15/0x20 [ 25.962218][ T336] task_work_run+0x127/0x190 [ 25.966802][ T336] exit_to_user_mode_loop+0xcb/0xe0 [ 25.972012][ T336] exit_to_user_mode_prepare+0x76/0xa0 [ 25.977465][ T336] syscall_exit_to_user_mode+0x1d/0x40 [ 25.982915][ T336] do_syscall_64+0x3d/0x40 [ 25.987327][ T336] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.993219][ T336] RIP: 0033:0x7fa5501040d9 [ 25.997626][ T336] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 26.017326][ T336] RSP: 002b:00007fffd370a448 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 26.025734][ T336] RAX: 0000000000000000 RBX: 00007fffd370a530 RCX: 00007fa5501040d9 [ 26.033701][ T336] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 26.042187][ T336] RBP: 0000000000006451 R08: 0000000000000001 R09: 0000000000000000 [ 26.050152][ T336] R10: 0000001b2d220000 R11: 0000000000000246 R12: 00007fffd370a570 [ 26.058115][ T336] R13: 00007fa55038bfac R14: 000000000000649f R15: 00007fa55038bfa0 [ 26.066076][ T336] [ 26.068395][ T336] Allocated by task 337: [ 26.072633][ T336] __kasan_kmalloc+0xd4/0x100 [ 26.077302][ T336] __kmalloc+0x19f/0x330 [ 26.081534][ T336] l2tp_session_create+0x39/0xb60 [ 26.086546][ T336] pppol2tp_connect+0xbf5/0x1640 [ 26.091490][ T336] __sys_connect+0x3ce/0x450 [ 26.096074][ T336] __x64_sys_connect+0x7a/0x90 [ 26.100826][ T336] do_syscall_64+0x31/0x40 [ 26.105234][ T336] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.111110][ T336] [ 26.113432][ T336] Freed by task 336: [ 26.117321][ T336] kasan_set_track+0x4a/0x70 [ 26.121901][ T336] kasan_set_free_info+0x23/0x40 [ 26.126833][ T336] ____kasan_slab_free+0x125/0x160 [ 26.131936][ T336] __kasan_slab_free+0x11/0x20 [ 26.136693][ T336] slab_free_freelist_hook+0xc5/0x190 [ 26.142054][ T336] kfree+0xc0/0x270 [ 26.145856][ T336] l2tp_session_put+0xb2/0x1a0 [ 26.150629][ T336] l2tp_session_delete+0x3a9/0x4a0 [ 26.155730][ T336] pppol2tp_release+0x169/0x2b0 [ 26.160569][ T336] sock_close+0xb8/0x200 [ 26.164802][ T336] __fput+0x2dc/0x730 [ 26.168774][ T336] ____fput+0x15/0x20 [ 26.172748][ T336] task_work_run+0x127/0x190 [ 26.177327][ T336] exit_to_user_mode_loop+0xcb/0xe0 [ 26.182514][ T336] exit_to_user_mode_prepare+0x76/0xa0 [ 26.187964][ T336] syscall_exit_to_user_mode+0x1d/0x40 [ 26.193413][ T336] do_syscall_64+0x3d/0x40 [ 26.197828][ T336] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.203703][ T336] [ 26.206023][ T336] The buggy address belongs to the object at ffff888129b0b800 [ 26.206023][ T336] which belongs to the cache kmalloc-512 of size 512 [ 26.220070][ T336] The buggy address is located 336 bytes inside of [ 26.220070][ T336] 512-byte region [ffff888129b0b800, ffff888129b0ba00) [ 26.233332][ T336] The buggy address belongs to the page: [ 26.238967][ T336] page:ffffea0004a6c200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x129b08 [ 26.249191][ T336] head:ffffea0004a6c200 order:2 compound_mapcount:0 compound_pincount:0 [ 26.257522][ T336] flags: 0x4000000000010200(slab|head) [ 26.262979][ T336] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 [ 26.271557][ T336] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 26.280128][ T336] page dumped because: kasan: bad access detected [ 26.286529][ T336] page_owner tracks the page as allocated [ 26.292247][ T336] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 299, ts 25689627792, free_ts 25686293395 [ 26.312026][ T336] prep_new_page+0x176/0x190 [ 26.316609][ T336] get_page_from_freelist+0x225f/0x23f0 [ 26.322144][ T336] __alloc_pages_nodemask+0x29a/0x640 [ 26.327504][ T336] new_slab+0x84/0x3f0 [ 26.331565][ T336] ___slab_alloc+0x2f8/0x4c0 [ 26.336142][ T336] __slab_alloc+0x63/0xa0 [ 26.340463][ T336] __kmalloc_track_caller+0x1e4/0x310 [ 26.345828][ T336] __alloc_skb+0xdc/0x520 [ 26.350149][ T336] ndisc_send_ns+0x347/0xb10 [ 26.354733][ T336] addrconf_dad_work+0xa40/0x1480 [ 26.359747][ T336] process_one_work+0x6fd/0xbc0 [ 26.364588][ T336] worker_thread+0xa8e/0x13c0 [ 26.369256][ T336] kthread+0x324/0x3b0 [ 26.373321][ T336] ret_from_fork+0x1f/0x30 [ 26.377726][ T336] page last free stack trace: [ 26.382396][ T336] __free_pages_ok+0x80b/0x830 [ 26.387159][ T336] free_compound_page+0x73/0x90 [ 26.391999][ T336] __put_compound_page+0x77/0xb0 [ 26.396926][ T336] __put_page+0xbd/0xe0 [ 26.401075][ T336] skb_release_data+0x221/0x690 [ 26.405918][ T336] __kfree_skb+0x50/0x70 [ 26.410155][ T336] tcp_rtx_queue_unlink_and_free+0x205/0x740 [ 26.416123][ T336] tcp_ack+0x2198/0x5ec0 [ 26.420357][ T336] tcp_rcv_established+0xd35/0x19c0 [ 26.425545][ T336] tcp_v4_do_rcv+0x3e4/0x7c0 [ 26.430131][ T336] tcp_v4_rcv+0x2295/0x2810 [ 26.434627][ T336] ip_protocol_deliver_rcu+0x302/0x650 [ 26.440075][ T336] ip_local_deliver+0x2dd/0x530 [ 26.444919][ T336] ip_sublist_rcv+0x75b/0x8b0 [ 26.449589][ T336] ip_list_rcv+0x3e4/0x430 [ 26.453996][ T336] __netif_receive_skb_list_core+0x57e/0x770 [ 26.459964][ T336] [ 26.462285][ T336] Memory state around the buggy address: [ 26.467906][ T336] ffff888129b0b800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.475960][ T336] ffff888129b0b880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.484016][ T336] >ffff888129b0b900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.492087][ T336] ^ [ 26.498750][ T336] ffff888129b0b980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.506804][ T336] ffff888129b0ba00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.514851][ T336] ================================================================== [ 26.522901][ T336] Disabling lock debugging due to kernel taint [ 26.699384][ T307] usb 4-1: new low-speed USB device number 2 using dummy_hcd [ 26.759493][ T20] usb 5-1: device descriptor read/64, error -71 [ 27.059477][ T307] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 27.067757][ T307] usb 4-1: config 179 has no interface number 0 [ 27.074229][ T307] usb 4-1: config 179 interface 65 altsetting 2 endpoint 0xF has an invalid bInterval 0, changing to 10 [ 27.085690][ T307] usb 4-1: config 179 interface 65 altsetting 2 endpoint 0xF has invalid maxpacket 1025, setting to 8 [ 27.096982][ T307] usb 4-1: config 179 interface 65 altsetting 2 endpoint 0x83 has invalid maxpacket 45824, setting to 8 [ 27.108257][ T307] usb 4-1: config 179 interface 65 altsetting 2 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 27.121689][ T307] usb 4-1: config 179 interface 65 has no altsetting 0 [ 27.128558][ T307] usb 4-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 27.137870][ T307] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.149374][ T20] usb 5-1: device descriptor read/64, error -71 [ 27.159618][ T343] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 27.166661][ T343] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 27.250080][ T300] input: HID 04d8:c002 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/0003:04D8:C002.0001/input/input4 [ 27.262578][ T300] hid-picolcd 0003:04D8:C002.0001: No report with id 0x94 found [ 27.270614][ T300] hid-picolcd 0003:04D8:C002.0001: failed to configure display [ 27.390308][ T307] usb 4-1: USB disconnect, device number 2 [ 27.399355][ C1] xpad 4-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 27.407645][ C1] xpad 4-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 27.419374][ T20] usb 5-1: new low-speed USB device number 3 using dummy_hcd [ 27.600346][ T9] device bridge_slave_1 left promiscuous mode [ 27.606552][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.614547][ T9] device bridge_slave_0 left promiscuous mode [ 27.620803][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.628826][ T9] device veth1_macvtap left promiscuous mode [ 27.635141][ T9] device veth0_vlan left promiscuous mode [ 27.689371][ T20] usb 5-1: device descriptor read/64, error -71 [ 28.079374][ T20] usb 5-1: device descriptor read/64, error -71 [ 28.199440][ T20] usb usb5-port1: attempt power cycle [ 28.405148][ T345] usb 2-1: USB disconnect, device number 2