last executing test programs: 2.417087157s ago: executing program 1 (id=75): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r1, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r3 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE(r3, 0x80005520, 0x0) 2.279888402s ago: executing program 1 (id=77): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, 0x0) sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r3, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0xb, 0x84) r4 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r4, &(0x7f0000000140)={0xa, 0x4e26, 0x0, @mcast2}, 0x1c) 2.207985898s ago: executing program 0 (id=80): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r3, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000140)=ANY=[@ANYBLOB="28000000100001000000000000000000180000000c0000000000000000000000080001"], 0x28}], 0x1}, 0x0) 2.149513114s ago: executing program 0 (id=81): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r3, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCDELRT(r4, 0x890c, &(0x7f0000000000)={@ipv4={'\x00', '\xff\xff', @private=0xa010101}, @ipv4={'\x00', '\xff\xff', @empty}, @private1={0xfc, 0x1, '\x00', 0x1}, 0x8, 0xf031, 0x5d, 0x300, 0x10000, 0x81410008}) 2.110674708s ago: executing program 0 (id=82): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) sendmsg$inet(r2, &(0x7f00000005c0)={&(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10, &(0x7f0000000540)=[{&(0x7f00000001c0)="902fc404e2ab91e8f2ca36aad0cda029e182a78d1ec870814c475cadd8002020c591c7833a9f2176bbfd3feb76e60b62acba6a8fb97f0b8229758ac52f4d49a02ebfd080428d8df3face025e3e235da1045ea61853d3b64768cf960fc64fceb61be567499bdebc0a907815f2640dc256f933df2f3a3ebcdf7d1bd5b66a859eef2b9e5c4d86044ba0bda6fbc4", 0x8c}, {&(0x7f0000000100)="62d725ccad49870f43304ec5c0892fbf181dbf9d3ab0", 0x16}, {&(0x7f0000000280)="f5425b89bd93df056dc4714b397e35b0eb5c56b989dc4c4de0b53aab4887304217e477c043fd68aea87e5c5188e15f1a19a49fa46d37a0e354d3fb2480f1d4a3728936c1fbf61afeaad963fd4dfcd0b56a80", 0x52}, {&(0x7f0000000380)="712a9b76512aa6d387786c78102b4f96f64d88c338bae2b2ec947330ecbf9afcc9ad0be916a36f45300e3d021d06a003e331eb8352489e36c208f30094b513cb280a9a97ded59f662450d2b439fd7c811b8613689aee14281b8e7013b10257b94b7659b7cdbca390c1533a899ebc08fe7d1c857dd5a8778db60f48da827e45c809b5aceb55a7f33fcf5ebcac4260163a735d171c5349bade11086c4c7d29089590790e10e7dedce31e17dc6a640e50fd80b3329b", 0xb4}, {&(0x7f0000000440)="3e05c5b2470cd4ac3b5f539d337f7da6224600fc65edc6b5c359cbc96b6d6a412da31b606fe7eebf2a7faf0a6d6a20f6e645504e6296de6086709d115729b2ef6a2b0bbcc74e0acc29b95082edab1f0fcc89f1370929c3e0c14963738631f46dc4aa9f5e6b973384bef0c0a5b180eb121b993dd9634fb62c3bac29d0e3759a2eccfa99b6adaa6abd97ffe4892949988c7814bc62957ee5015ee716009b1341e3182550bd16eba2e0b9bba816422d9ed0bfba03813a495bd224597557db5f5ada6b01429f81e64c94091e9de2174558e217af2dca46196ef52cd46b626655e561734b5187313608906383148bd7edd38b486c04", 0xf3}], 0x5, &(0x7f0000000140)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x466f}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x1}}], 0x30}, 0x840) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) 1.876190172s ago: executing program 3 (id=83): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000340)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r1, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r2, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r3 = add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='k', 0x1, 0xfffffffffffffffb) keyctl$unlink(0x9, r3, 0xfffffffffffffffb) 1.711886398s ago: executing program 3 (id=85): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000340)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r1, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r2, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='k', 0x1, 0xfffffffffffffffb) 1.653606344s ago: executing program 3 (id=86): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r1, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r3 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE(r3, 0x80005520, 0x0) 1.572123002s ago: executing program 3 (id=87): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r3, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) futex(0x0, 0x86, 0x2, 0x0, 0x0, 0xfffffffc) 1.464131303s ago: executing program 1 (id=89): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r3, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) keyctl$instantiate(0xc, 0x0, &(0x7f0000000040)=@encrypted_update={'update ', 'default', 0x20, 'user:', 'blkio.bfq.group_wait_time\x00'}, 0x2f, 0xffffffffffffffff) 1.259435084s ago: executing program 0 (id=93): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r1, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r2, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r3 = add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='k', 0x1, 0xfffffffffffffffb) keyctl$unlink(0x9, r3, 0xfffffffffffffffb) 1.139075475s ago: executing program 1 (id=94): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r1, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r2, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='k', 0x1, 0xfffffffffffffffb) 1.09907563s ago: executing program 1 (id=95): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuacct.usage_sys\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r0, @ANYRES64], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r1, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r3 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE(r3, 0x80005520, 0x0) 955.841074ms ago: executing program 0 (id=96): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuacct.usage_sys\x00', 0x275a, 0x0) ioctl$KVM_CLEAR_DIRTY_LOG(0xffffffffffffffff, 0xc018aec0, &(0x7f0000000100)={0x10003, 0x400, 0x300, &(0x7f00000003c0)=[0x450fd3d7, 0xfffffffffffffcda, 0xff, 0x9, 0x10001, 0x4, 0xffffffffffffeff9, 0x3, 0x5, 0x23b, 0x8, 0x2b, 0xb79d, 0x79800000000, 0x2, 0x9, 0xa, 0x4ce3d10b, 0x5, 0x1, 0x35b, 0x1, 0x8, 0x7, 0x6, 0xf8, 0x5, 0x3, 0x6, 0x10, 0xffffffff, 0x101, 0x100000001, 0x3ff, 0xa4d, 0x1, 0x2, 0x3, 0x65, 0x40000000000, 0x10000, 0x1, 0x525, 0x100, 0x10, 0x6, 0x8, 0x8, 0xb48, 0xe6, 0x2, 0x9, 0x200, 0x4596371f, 0x8, 0x7, 0x8, 0x44ce, 0x6, 0xfffffffffffffffc, 0x8, 0x1, 0x10001, 0x3, 0x3, 0x0, 0x1, 0x7f, 0x2, 0x1, 0xffffffffffffff00, 0xffffffffffffff7a, 0x7ff, 0x3ff, 0x1, 0x6, 0x100, 0x5, 0x3, 0x33, 0x8f0, 0x2, 0x8, 0x7fffffffffffffff, 0xfffffffffffffff8, 0x8e2f, 0x5, 0x0, 0x0, 0xa, 0x3, 0x0, 0x7, 0xc0, 0xff, 0x0, 0x5, 0x7, 0x7fff, 0x40, 0x9, 0x1, 0x0, 0x9649, 0x0, 0x0, 0x3, 0x0, 0x6, 0x2, 0x3, 0x1, 0xd, 0x8, 0x2, 0x10000, 0x8, 0x3, 0x10000000000003cc, 0x3, 0x4, 0x5, 0x2, 0x0, 0x915a, 0x2, 0x3, 0x9]}) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000240), r3) 696.32639ms ago: executing program 3 (id=97): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x1]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000240)={'gre0\x00', 0x0}) sendto$packet(0xffffffffffffffff, &(0x7f0000000380)="05", 0x1, 0x0, &(0x7f0000000a80)={0x11, 0x4, r3, 0x1, 0x0, 0x6, @random="0c5d4f602aff"}, 0x14) 476.429302ms ago: executing program 2 (id=98): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r2, 0x0, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r3, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0xb, 0x84) r4 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r4, &(0x7f0000000140)={0xa, 0x4e26, 0x0, @mcast2}, 0x1c) 427.925817ms ago: executing program 3 (id=99): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x1]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r3, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r3, @ANYRES64=r2], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r3, 0x0) ioctl$KVM_X86_SETUP_MCE(r3, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4}) sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r4 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r4, 0x0, 0x0, 0x805, 0x0, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r5, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r6, &(0x7f0000000040)={0x1f, 0x0, @none, 0x0, 0x2}, 0xe) listen(r6, 0x6) getsockopt$bt_BT_DEFER_SETUP(r6, 0x112, 0x7, &(0x7f00000000c0)=0x1, &(0x7f0000000100)=0x4) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) r7 = socket$inet(0x2, 0x3, 0x4) setsockopt$inet_opts(r7, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r7, 0x1, 0x19, &(0x7f00000000c0)='xfrm0\x00', 0x10) connect$inet(r7, &(0x7f0000000080)={0x2, 0x4e20, @private=0xa010100}, 0x10) sendmmsg$inet(r7, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}], 0x68000, 0x0) 236.398236ms ago: executing program 1 (id=100): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, 0x0, 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r1, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000140)=ANY=[@ANYBLOB="28000000100001000000000000000000180000000c0000000000000000000000080001"], 0x28}], 0x1}, 0x0) 164.289374ms ago: executing program 2 (id=101): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r2, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCDELRT(r3, 0x890c, &(0x7f0000000000)={@ipv4={'\x00', '\xff\xff', @private=0xa010101}, @ipv4={'\x00', '\xff\xff', @empty}, @private1={0xfc, 0x1, '\x00', 0x1}, 0x8, 0xf031, 0x5d, 0x300, 0x10000, 0x81410008}) 136.744236ms ago: executing program 0 (id=102): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r3, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) keyctl$instantiate(0xc, 0x0, &(0x7f0000000040)=@encrypted_update={'update ', 'default', 0x20, 'user:', 'blkio.bfq.group_wait_time\x00'}, 0x2f, 0xffffffffffffffff) 91.267581ms ago: executing program 2 (id=103): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r1, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r2, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='k', 0x1, 0xfffffffffffffffb) 90.897371ms ago: executing program 2 (id=104): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(r1, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r2, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r3 = add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='k', 0x1, 0xfffffffffffffffb) keyctl$unlink(0x9, r3, 0xfffffffffffffffb) 49.120925ms ago: executing program 2 (id=105): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f27, 0x4}) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) sendmsg$inet(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10, &(0x7f0000000540)=[{&(0x7f00000001c0)="902fc404e2ab91e8f2ca36aad0cda029e182a78d1ec870814c475cadd8002020c591c7833a9f2176bbfd3feb76e60b62acba6a8fb97f0b8229758ac52f4d49a02ebfd080428d8df3face025e3e235da1045ea61853d3b64768cf960fc64fceb61be567499bdebc0a907815f2640dc256f933df2f3a3ebcdf7d1bd5b66a859eef2b9e5c4d86044ba0bda6fbc4", 0x8c}, {&(0x7f0000000100)="62d725ccad49870f43304ec5c0892fbf181dbf9d3ab0", 0x16}, {&(0x7f0000000280)="f5425b89bd93df056dc4714b397e35b0eb5c56b989dc4c4de0b53aab4887304217e477c043fd68aea87e5c5188e15f1a19a49fa46d37a0e354d3fb2480f1d4a3728936c1fbf61afeaad963fd4dfcd0b56a80", 0x52}, {&(0x7f0000000380)="712a9b76512aa6d387786c78102b4f96f64d88c338bae2b2ec947330ecbf9afcc9ad0be916a36f45300e3d021d06a003e331eb8352489e36c208f30094b513cb280a9a97ded59f662450d2b439fd7c811b8613689aee14281b8e7013b10257b94b7659b7cdbca390c1533a899ebc08fe7d1c857dd5a8778db60f48da827e45c809b5aceb55a7f33fcf5ebcac4260163a735d171c5349bade11086c4c7d29089590790e10e7dedce31e17dc6a640e50fd80b3329b", 0xb4}, {&(0x7f0000000440)="3e05c5b2470cd4ac3b5f539d337f7da6224600fc65edc6b5c359cbc96b6d6a412da31b606fe7eebf2a7faf0a6d6a20f6e645504e6296de6086709d115729b2ef6a2b0bbcc74e0acc29b95082edab1f0fcc89f1370929c3e0c14963738631f46dc4aa9f5e6b973384bef0c0a5b180eb121b993dd9634fb62c3bac29d0e3759a2eccfa99b6adaa6abd97ffe4892949988c7814bc62957ee5015ee716009b1341e3182550bd16eba2e0b9bba816422d9ed0bfba03813a495bd224597557db5f5ada6b01429f81e64c94091e9de2174558e217af2dca46196ef52cd46b626655e561734b5187313608906383148bd7edd38b486c04", 0xf3}], 0x5, &(0x7f0000000140)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x466f}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x1}}], 0x30}, 0x840) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) 0s ago: executing program 2 (id=106): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0x44000004, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES8, @ANYRES8=r1, @ANYRES64=r0], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f26, 0x4}) sendmmsg$inet6(r3, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) futex(0x0, 0x86, 0x2, 0x0, 0x0, 0xfffffffc) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.164' (ED25519) to the list of known hosts. [ 23.580876][ T36] audit: type=1400 audit(1763107601.670:64): avc: denied { mounton } for pid=284 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.582317][ T284] cgroup: Unknown subsys name 'net' [ 23.603676][ T36] audit: type=1400 audit(1763107601.670:65): avc: denied { mount } for pid=284 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.631025][ T36] audit: type=1400 audit(1763107601.700:66): avc: denied { unmount } for pid=284 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.631247][ T284] cgroup: Unknown subsys name 'devices' [ 23.799511][ T284] cgroup: Unknown subsys name 'hugetlb' [ 23.805147][ T284] cgroup: Unknown subsys name 'rlimit' [ 23.961507][ T36] audit: type=1400 audit(1763107602.050:67): avc: denied { setattr } for pid=284 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.984816][ T36] audit: type=1400 audit(1763107602.050:68): avc: denied { mounton } for pid=284 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 24.009739][ T36] audit: type=1400 audit(1763107602.050:69): avc: denied { mount } for pid=284 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 24.021154][ T286] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 24.041675][ T36] audit: type=1400 audit(1763107602.130:70): avc: denied { relabelto } for pid=286 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.067329][ T36] audit: type=1400 audit(1763107602.130:71): avc: denied { write } for pid=286 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.105355][ T36] audit: type=1400 audit(1763107602.190:72): avc: denied { read } for pid=284 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.130955][ T36] audit: type=1400 audit(1763107602.190:73): avc: denied { open } for pid=284 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.131269][ T284] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 25.486469][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.493627][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.501298][ T291] bridge_slave_0: entered allmulticast mode [ 25.507718][ T291] bridge_slave_0: entered promiscuous mode [ 25.515309][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.522424][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.529762][ T291] bridge_slave_1: entered allmulticast mode [ 25.536099][ T291] bridge_slave_1: entered promiscuous mode [ 25.569205][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.576281][ T292] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.583436][ T292] bridge_slave_0: entered allmulticast mode [ 25.589834][ T292] bridge_slave_0: entered promiscuous mode [ 25.602603][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.609694][ T292] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.616785][ T292] bridge_slave_1: entered allmulticast mode [ 25.623159][ T292] bridge_slave_1: entered promiscuous mode [ 25.661566][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.668682][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.675897][ T293] bridge_slave_0: entered allmulticast mode [ 25.682294][ T293] bridge_slave_0: entered promiscuous mode [ 25.688725][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.695803][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.703258][ T294] bridge_slave_0: entered allmulticast mode [ 25.709817][ T294] bridge_slave_0: entered promiscuous mode [ 25.719551][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.726612][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.733725][ T293] bridge_slave_1: entered allmulticast mode [ 25.740126][ T293] bridge_slave_1: entered promiscuous mode [ 25.746237][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.753413][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.760736][ T294] bridge_slave_1: entered allmulticast mode [ 25.766963][ T294] bridge_slave_1: entered promiscuous mode [ 25.937975][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.945051][ T292] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.952541][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.959606][ T292] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.970344][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.977425][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.984744][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.991812][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.001558][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.008628][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.015901][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.022983][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.041496][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.048582][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.055862][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.062915][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.102081][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.109426][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.116984][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.125045][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.132391][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.139781][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.147041][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.154527][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.170695][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.177809][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.185540][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.192619][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.219970][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.227054][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.235371][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.242435][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.272294][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.279414][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.287024][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.294082][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.314327][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.321418][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.329669][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.336712][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.353997][ T293] veth0_vlan: entered promiscuous mode [ 26.381693][ T291] veth0_vlan: entered promiscuous mode [ 26.388158][ T292] veth0_vlan: entered promiscuous mode [ 26.400082][ T293] veth1_macvtap: entered promiscuous mode [ 26.411759][ T292] veth1_macvtap: entered promiscuous mode [ 26.455248][ T291] veth1_macvtap: entered promiscuous mode [ 26.465757][ T292] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 26.476371][ T294] veth0_vlan: entered promiscuous mode [ 26.522669][ T294] veth1_macvtap: entered promiscuous mode [ 28.848744][ T36] kauditd_printk_skb: 39 callbacks suppressed [ 28.848802][ T36] audit: type=1400 audit(1763107606.940:113): avc: denied { ioctl } for pid=466 comm="syz.3.64" path="socket:[4358]" dev="sockfs" ino=4358 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 31.630079][ T539] incfs: Unexpected inode type [ 31.660554][ T291] ------------[ cut here ]------------ [ 31.666186][ T291] WARNING: CPU: 1 PID: 291 at fs/inode.c:340 drop_nlink+0xce/0x110 [ 31.674206][ T291] Modules linked in: [ 31.678271][ T291] CPU: 1 UID: 0 PID: 291 Comm: syz-executor Not tainted syzkaller #0 0b5ffdee5fcd2f7749818d1ff954e9c21353764e [ 31.687288][ T36] audit: type=1400 audit(1763107609.750:114): avc: denied { unmount } for pid=291 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 31.690331][ T291] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 31.720363][ T291] RIP: 0010:drop_nlink+0xce/0x110 [ 31.725439][ T291] Code: 04 00 00 be 08 00 00 00 e8 cf 54 ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 32 e4 97 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c [ 31.745199][ T291] RSP: 0018:ffffc9000112fc60 EFLAGS: 00010293 [ 31.751322][ T291] RAX: ffffffff81ee1a7e RBX: ffff888116fec428 RCX: ffff888102bb3900 [ 31.759459][ T291] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 31.768155][ T291] RBP: ffffc9000112fc88 R08: 0000000000000003 R09: 0000000000000004 [ 31.776373][ T291] R10: dffffc0000000000 R11: fffff52000225f7c R12: dffffc0000000000 [ 31.784449][ T291] R13: 1ffff11022dfd88e R14: ffff888116fec470 R15: 0000000000000000 [ 31.792483][ T291] FS: 0000555586d2c500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 31.801505][ T291] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 31.808152][ T291] CR2: 0000555586d4f4e8 CR3: 000000012fe4e000 CR4: 00000000003526b0 [ 31.816258][ T291] Call Trace: [ 31.819642][ T291] [ 31.822606][ T291] shmem_rmdir+0x5f/0x90 [ 31.826894][ T291] vfs_rmdir+0x3dd/0x560 [ 31.831235][ T291] incfs_kill_sb+0x109/0x230 [ 31.835866][ T291] deactivate_locked_super+0xd5/0x2a0 [ 31.841401][ T291] deactivate_super+0xb8/0xe0 [ 31.846121][ T291] cleanup_mnt+0x3f1/0x480 [ 31.850762][ T291] __cleanup_mnt+0x1d/0x40 [ 31.855224][ T291] task_work_run+0x1e0/0x250 [ 31.859923][ T291] ? __cfi_task_work_run+0x10/0x10 [ 31.865077][ T291] ? __x64_sys_umount+0x126/0x170 [ 31.870195][ T291] ? __cfi___x64_sys_umount+0x10/0x10 [ 31.875623][ T291] ? __kasan_check_read+0x15/0x20 [ 31.880735][ T291] resume_user_mode_work+0x36/0x50 [ 31.886058][ T291] syscall_exit_to_user_mode+0x64/0xb0 [ 31.891625][ T291] do_syscall_64+0x64/0xf0 [ 31.896090][ T291] ? clear_bhb_loop+0x50/0xa0 [ 31.900846][ T291] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 31.906785][ T291] RIP: 0033:0x7f89e43909f7 [ 31.911309][ T291] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 31.931077][ T291] RSP: 002b:00007fff515063f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 31.939690][ T291] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f89e43909f7 [ 31.947718][ T291] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff515064b0 [ 31.955713][ T291] RBP: 00007fff515064b0 R08: 0000000000000000 R09: 0000000000000000 [ 31.963764][ T291] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fff51507540 [ 31.971889][ T291] R13: 00007f89e4411d7d R14: 0000000000007b7a R15: 00007fff51507580 [ 31.979947][ T291] [ 31.982992][ T291] ---[ end trace 0000000000000000 ]--- [ 31.988769][ T291] ================================================================== [ 31.996877][ T291] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 [ 32.003163][ T291] Write of size 4 at addr 0000000000000168 by task syz-executor/291 [ 32.011254][ T291] [ 32.013607][ T291] CPU: 1 UID: 0 PID: 291 Comm: syz-executor Tainted: G W syzkaller #0 0b5ffdee5fcd2f7749818d1ff954e9c21353764e [ 32.013644][ T291] Tainted: [W]=WARN [ 32.013653][ T291] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 32.013667][ T291] Call Trace: [ 32.013674][ T291] [ 32.013683][ T291] __dump_stack+0x21/0x30 [ 32.013719][ T291] dump_stack_lvl+0x10c/0x190 [ 32.013749][ T291] ? __cfi_dump_stack_lvl+0x10/0x10 [ 32.013781][ T291] print_report+0x3d/0x70 [ 32.013805][ T291] kasan_report+0x163/0x1a0 [ 32.013832][ T291] ? ihold+0x24/0x70 [ 32.013856][ T291] ? _raw_spin_unlock+0x45/0x60 [ 32.013885][ T291] ? ihold+0x24/0x70 [ 32.013909][ T291] kasan_check_range+0x299/0x2a0 [ 32.013937][ T291] __kasan_check_write+0x18/0x20 [ 32.013970][ T291] ihold+0x24/0x70 [ 32.013993][ T291] vfs_rmdir+0x26a/0x560 [ 32.014022][ T291] incfs_kill_sb+0x109/0x230 [ 32.014056][ T291] deactivate_locked_super+0xd5/0x2a0 [ 32.014087][ T291] deactivate_super+0xb8/0xe0 [ 32.014115][ T291] cleanup_mnt+0x3f1/0x480 [ 32.014140][ T291] __cleanup_mnt+0x1d/0x40 [ 32.014163][ T291] task_work_run+0x1e0/0x250 [ 32.014191][ T291] ? __cfi_task_work_run+0x10/0x10 [ 32.014217][ T291] ? __x64_sys_umount+0x126/0x170 [ 32.014248][ T291] ? __cfi___x64_sys_umount+0x10/0x10 [ 32.014280][ T291] ? __kasan_check_read+0x15/0x20 [ 32.014313][ T291] resume_user_mode_work+0x36/0x50 [ 32.014349][ T291] syscall_exit_to_user_mode+0x64/0xb0 [ 32.014374][ T291] do_syscall_64+0x64/0xf0 [ 32.014402][ T291] ? clear_bhb_loop+0x50/0xa0 [ 32.014428][ T291] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 32.014451][ T291] RIP: 0033:0x7f89e43909f7 [ 32.014470][ T291] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 32.014488][ T291] RSP: 002b:00007fff515063f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 32.014512][ T291] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f89e43909f7 [ 32.014527][ T291] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff515064b0 [ 32.014541][ T291] RBP: 00007fff515064b0 R08: 0000000000000000 R09: 0000000000000000 [ 32.014556][ T291] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fff51507540 [ 32.014571][ T291] R13: 00007f89e4411d7d R14: 0000000000007b7a R15: 00007fff51507580 [ 32.014589][ T291] [ 32.014597][ T291] ================================================================== [ 32.261363][ T291] Disabling lock debugging due to kernel taint [ 32.267644][ T291] BUG: kernel NULL pointer dereference, address: 0000000000000168 [ 32.275465][ T291] #PF: supervisor write access in kernel mode [ 32.281570][ T291] #PF: error_code(0x0002) - not-present page [ 32.287557][ T291] PGD 800000010e79f067 P4D 800000010e79f067 PUD 0 [ 32.294084][ T291] Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI [ 32.300175][ T291] CPU: 1 UID: 0 PID: 291 Comm: syz-executor Tainted: G B W syzkaller #0 0b5ffdee5fcd2f7749818d1ff954e9c21353764e [ 32.313312][ T291] Tainted: [B]=BAD_PAGE, [W]=WARN [ 32.318347][ T291] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 32.328406][ T291] RIP: 0010:ihold+0x2a/0x70 [ 32.332921][ T291] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 1d db 97 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 8c 4b ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 2d [ 32.352527][ T291] RSP: 0018:ffffc9000112fca0 EFLAGS: 00010246 [ 32.358597][ T291] RAX: ffff888102bb3900 RBX: 0000000000000000 RCX: ffff888102bb3900 [ 32.366569][ T291] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 32.375319][ T291] RBP: ffffc9000112fcb0 R08: ffffffff88972947 R09: 1ffffffff112e528 [ 32.383315][ T291] R10: dffffc0000000000 R11: fffffbfff112e529 R12: ffff888116fec434 [ 32.391294][ T291] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 [ 32.399264][ T291] FS: 0000555586d2c500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 32.408202][ T291] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.414791][ T291] CR2: 0000000000000168 CR3: 000000012fe4e000 CR4: 00000000003526b0 [ 32.422770][ T291] Call Trace: [ 32.426055][ T291] [ 32.428996][ T291] vfs_rmdir+0x26a/0x560 [ 32.433255][ T291] incfs_kill_sb+0x109/0x230 [ 32.437860][ T291] deactivate_locked_super+0xd5/0x2a0 [ 32.443250][ T291] deactivate_super+0xb8/0xe0 [ 32.447935][ T291] cleanup_mnt+0x3f1/0x480 [ 32.452356][ T291] __cleanup_mnt+0x1d/0x40 [ 32.456773][ T291] task_work_run+0x1e0/0x250 [ 32.461376][ T291] ? __cfi_task_work_run+0x10/0x10 [ 32.466489][ T291] ? __x64_sys_umount+0x126/0x170 [ 32.471552][ T291] ? __cfi___x64_sys_umount+0x10/0x10 [ 32.476983][ T291] ? __kasan_check_read+0x15/0x20 [ 32.482025][ T291] resume_user_mode_work+0x36/0x50 [ 32.487151][ T291] syscall_exit_to_user_mode+0x64/0xb0 [ 32.492631][ T291] do_syscall_64+0x64/0xf0 [ 32.497059][ T291] ? clear_bhb_loop+0x50/0xa0 [ 32.501761][ T291] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 32.507666][ T291] RIP: 0033:0x7f89e43909f7 [ 32.512081][ T291] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 32.531811][ T291] RSP: 002b:00007fff515063f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 32.540244][ T291] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f89e43909f7 [ 32.548271][ T291] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff515064b0 [ 32.556338][ T291] RBP: 00007fff515064b0 R08: 0000000000000000 R09: 0000000000000000 [ 32.564316][ T291] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fff51507540 [ 32.572306][ T291] R13: 00007f89e4411d7d R14: 0000000000007b7a R15: 00007fff51507580 [ 32.580289][ T291] [ 32.583393][ T291] Modules linked in: [ 32.587283][ T291] CR2: 0000000000000168 [ 32.591435][ T291] ---[ end trace 0000000000000000 ]--- [ 32.596901][ T291] RIP: 0010:ihold+0x2a/0x70 [ 32.601411][ T291] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 1d db 97 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 8c 4b ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 2d [ 32.621134][ T291] RSP: 0018:ffffc9000112fca0 EFLAGS: 00010246 [ 32.627205][ T291] RAX: ffff888102bb3900 RBX: 0000000000000000 RCX: ffff888102bb3900 [ 32.635185][ T291] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 32.643167][ T291] RBP: ffffc9000112fcb0 R08: ffffffff88972947 R09: 1ffffffff112e528 [ 32.651141][ T291] R10: dffffc0000000000 R11: fffffbfff112e529 R12: ffff888116fec434 [ 32.659122][ T291] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 [ 32.667100][ T291] FS: 0000555586d2c500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 32.676038][ T291] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.682636][ T291] CR2: 0000000000000168 CR3: 000000012fe4e000 CR4: 00000000003526b0 [ 32.690615][ T291] Kernel panic - not syncing: Fatal exception [ 32.696982][ T291] Kernel Offset: disabled [ 32.701311][ T291] Rebooting in 86400 seconds..