last executing test programs: 262.943705ms ago: executing program 1 (id=2): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/binder0\x00', 0x1800, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FILTER(r1, 0x65, 0x1, 0x0, 0x0) bind$can_raw(r1, &(0x7f00000000c0), 0x10) close_range(r0, 0xffffffffffffffff, 0x0) 243.951676ms ago: executing program 2 (id=3): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x800, 0x0) (async) syz_usb_connect(0x2, 0x0, 0x0, &(0x7f0000000d40)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x5f, &(0x7f0000000140)=@string={0x5f, 0x3, "534e188a05a79abb1688ff409ca16d9b99ae6f0301aea378e7b79396fc09641bc2b050e89ff85aece8bcb06b2296896aae0bff9d799b9d26f2cfb6f147c42a50e0b4198ee06b0f8331bd2cf98f55bd1c796daa26118b2d4b343029f229"}}]}) (async) r1 = socket$packet(0x11, 0x2, 0x300) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'batadv_slave_1\x00', 0x0}) (async) r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000001c0), 0x1, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r4, 0x11b, 0x6, &(0x7f0000000200)=0x1008281, 0x4) sendto$packet(r2, &(0x7f0000000180)="0b036800e0ff64000200475400f6a13bb1000000080086dd4803", 0x100a6, 0x0, &(0x7f0000000140)={0x11, 0x0, r3}, 0x14) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x4e1f, 0x6, @loopback, 0x2}, 0x1c) (async) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f0000000540), 0x3c) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpu.stat\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r6, 0x0) (async) setsockopt$inet6_tcp_int(r5, 0x11a, 0x3, &(0x7f0000000700)=0x4, 0x4) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r7, 0x0) mkdirat(r7, &(0x7f0000000040)='./file0\x00', 0x121) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x138a, 0x1000000003}) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) r8 = inotify_init() ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000440)={@ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/238, 0xee, 0x2, 0x7}, @fda={0x66646185, 0x1, 0x0, 0x35}, @fd={0x66642a85, 0x0, r8}}, &(0x7f0000000000)={0x0, 0x28, 0x48}}, 0x1000}], 0x0, 0x0, 0x0}) 228.526436ms ago: executing program 0 (id=1): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) futex(0x0, 0xd, 0x0, 0x0, 0x0, 0x2) futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, &(0x7f0000048000)=0x1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x7624f2802272dfdf, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x40000000000000, 0xe}, @flat=@binder={0x73622a85, 0x200, 0x2}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x1, 0x1d}}, &(0x7f0000000180)={0x0, 0x28, 0x40}}, 0x400}], 0x52, 0x0, &(0x7f0000000300)="6cc2517326f0182dfaea8b9b0efefe72ca2b3f10c526bb82d4a3786efb2df4fda2a1e2888f71a664cc5a261719fe4cead4d24dcc14edceace088490d882b563ef630b62d95fb3e1b01b472ec8da1d1df52fc"}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) umount2(0x0, 0x3) unshare(0x64000400) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c00000010008100000000000080000000000000", @ANYRES32=0x0, @ANYBLOB="1f043cbf", @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x9e, 0x17, 0x36, 0x10, 0x17ef, 0x721e, 0xde06, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6}}]}}]}}, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000000b00)={0x84, &(0x7f0000000640)={0x0, 0x0, 0x4, "0b0f2d5e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$binfmt_script(r1, &(0x7f0000000240), 0x3af4701e) mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x7) 160.918368ms ago: executing program 1 (id=5): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x0) syz_usb_connect(0x0, 0x4a, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0xc6) capset(&(0x7f0000000080)={0x20080522}, &(0x7f00000000c0)={0x200000, 0x200000, 0x7}) ioctl$NS_GET_OWNER_UID(r0, 0xb704, &(0x7f00000003c0)=0x0) setuid(r2) syz_open_procfs(0x0, &(0x7f00000009c0)='gid_map\x00') r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'lo\x00'}) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r5, 0x4048ae9b, &(0x7f0000000080)={0xe0003, 0x0, {[0x3, 0x8000006, 0x81, 0xffffffffefffff15, 0x3, 0x100000000, 0x3]}}) ioctl$KVM_RUN(r5, 0xae80, 0x0) mount(&(0x7f0000000080)=@filename='./file0\x00', &(0x7f0000001440)='./file0\x00', &(0x7f0000000040)='erofs\x00', 0x8800, 0x0) r6 = creat(&(0x7f0000000940)='./file0\x00', 0x121) ioctl$TCGETS2(r6, 0x802c542a, &(0x7f0000000980)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r7 = userfaultfd(0x80001) ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f00000000c0)) readv(r7, &(0x7f0000000540)=[{&(0x7f0000000280)=""/164, 0xa4}], 0x1) readv(r7, &(0x7f0000000240)=[{&(0x7f0000000140)=""/202, 0xca}], 0x1) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r8, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) getsockopt$inet6_tcp_int(r8, 0x6, 0x2, 0x0, &(0x7f0000000480)) r9 = syz_usb_connect$hid(0x6, 0x3f, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x18d1, 0x502b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x2, 0xe0, 0xbc, [{{0x9, 0x4, 0x0, 0x80, 0x2, 0x3, 0x1, 0x1, 0xc, {0x9, 0x21, 0x571b, 0x6, 0x1, {0x22, 0x6a0}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x0, 0x92, 0x5}}, [{{0x9, 0x5, 0x2, 0x3, 0x420, 0xff, 0x0, 0xa}}]}}}]}}]}}, &(0x7f0000000400)={0xa, &(0x7f0000000340)={0xa, 0x6, 0x110, 0x5, 0xc, 0x3, 0xff, 0xcf}, 0x25, &(0x7f0000000380)={0x5, 0xf, 0x25, 0x1, [@ssp_cap={0x20, 0x10, 0xa, 0x7, 0x5, 0x2, 0xf000, 0x2, [0x0, 0xc0, 0xf, 0x4f07a6af512f041c, 0xff0000]}]}, 0x1, [{0xfffffffffffffca5, &(0x7f0000000b00)=@string={0x102, 0x3, "c1c9b0eca58e716d7eb6d2f88d7f1138d7c1ab256eeace3da1d7189fcbd4ca735409000000000000005b564dd0f26f3cfa01a205f1d23ad3cc6d86094a0125d1c022832f3d2f4b0583649093a85f600fee2a6d74553e225d652e69d1c05d8fa08b98438923381129640d5b3bb86d419806a6df41428035fad1289cb816ed121df1b183d41280b75ca16395e3687c9178a30c80148a32d6b461573ecee1687c5861e7e3d92931afa5eda0f470ce22c3c49e7ae3e876f5312cf7c113c02d72598fd7435ff6cfb51417a8d7ff7f8ac09a8c1a9881514c9d1cfbedfad814303c60731dc65b56b14544ce19c18a1d3ac5b7776df190a054b61a8cc598372b1d1477f1"}}, {0x0, &(0x7f0000000440)=@lang_id={0x0, 0x3, 0x843}}]}) syz_usb_control_io$hid(r9, &(0x7f0000000680)={0x24, &(0x7f0000000a00)=ANY=[@ANYBLOB="400886000000860b4418023cf3065a93fdb465376e6c203bcc29e4dd17004fc4adb350a1ba87bb840a2e4c92668758d6489d373e7d31336d2d65120561ef0bedfb72db14f8d2dc582c071ab077fbfbf7f398bf08fa69f96bfb67f66c857c4a0c3b18263e98fa9eee4389f9404ebb54738adb88f48a076eca6e8fe3da8eb60ee70ab5fe1311b6481900267120173dd4f68bb552b28a1bde38dc5a2457b5b96c86f20c7735ce15c570f3dc707ccf7528f3751ba5841e53117fb334d8bf66c0a99fda8b297a708cc479f0"], &(0x7f00000004c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x422}}, &(0x7f0000000500)={0x0, 0x22, 0x5, {[@global=@item_4={0x3, 0x1, 0x5, "cb03d951"}]}}, &(0x7f0000000640)={0x0, 0x21, 0x9, {0x9, 0x21, 0xc2e, 0xf, 0x1, {0x22, 0x2e0}}}}, &(0x7f0000000900)={0x2c, &(0x7f00000006c0)={0x40, 0x15, 0xeb, "3970395e0e6130ecd6d2c074ebc4c13a89c5503350045e6e708cf24f1d1fdc72e88c373f6e233bc8ecc7de8d40bec6cb3442ca4789a1319f7f5870c5854669d92929a6c0e0de41059d5f34c622cd6d345f344259cfb65dca30c51ed9ed95a4d59ba5d25b8f8db2ad81f380a0ff4f6f2e60a144ff3cbb43838eb6f4b8291798f8b933878dfa307ff9290ada835c4040a621bc92315bdc6e912fbc6a0b7c2e823f86c50cbcf5e9db4f5a583f1295aca62dfb8d5b23ccd032f85a1233444fe3190d20ebc880cd72012a03f8afbbc85069b5d369b920eeadc40dbd9dc6f5f695a9611e5b84ca2f3dbf22ac8185"}, &(0x7f00000007c0)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000800)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000840)={0x20, 0x1, 0x61, "33f40e120a694eeac89b5d07d2b9c11020b77162c74c7148fa0a33d01aba1474978c8a8f9504fd19557e18a4b0e2035f4da66bf0cee2258738e274140e02c0934b144a09c7f00603edcbb9de60eb85dbd55518eec83a3918d02e54348028fbc563"}, &(0x7f00000008c0)={0x20, 0x3, 0x1, 0x5}}) 160.765538ms ago: executing program 2 (id=6): mkdir(&(0x7f00000000c0)='./bus\x00', 0x50) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000a00)={[{}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@volatile}]}) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') read$FUSE(r0, &(0x7f0000003480)={0x2020}, 0x2020) (async) ioctl$VFAT_IOCTL_READDIR_BOTH(r0, 0x82307201, &(0x7f00000003c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) 160.043337ms ago: executing program 3 (id=4): r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_buf(r0, 0x6, 0x33, 0x0, &(0x7f0000000080)) setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, &(0x7f0000000040)=ANY=[@ANYBLOB="e0000001ac1414aa0000000003"], 0x1c) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) mount$binderfs(0x0, &(0x7f0000000080)='./binderfs\x00', 0x0, 0x2010860, &(0x7f0000000200)=ANY=[@ANYBLOB="636f6e746578743d73792274656d5f75dd47d0b90b893a03ffdf"]) 113.631508ms ago: executing program 3 (id=7): newfstatat(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500), 0x6000) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000580)=0x0) r1 = syz_open_procfs(r0, &(0x7f00000007c0)='net/protocols\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x1000000, &(0x7f0000000140)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) mount$incfs(&(0x7f00000007c0)='./bus\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) r3 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x40) r4 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) unlinkat(r4, &(0x7f0000000280)='./file0\x00', 0x200) getdents64(r3, &(0x7f0000000480)=""/145, 0x91) setsockopt$inet6_int(r2, 0x29, 0xb, &(0x7f0000000040)=0x9, 0x4) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000002f00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000002e40)=""/153, 0x99}, 0x3}], 0x1, 0x2, 0x0) ioctl$sock_inet_SIOCGIFNETMASK(r1, 0x891b, &(0x7f0000000200)={'batadv_slave_0\x00', {0x2, 0x0, @private}}) setsockopt$inet6_int(r2, 0x29, 0x46, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x42, &(0x7f0000000100)=0x1e79, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@xino_auto}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) read$FUSE(r1, &(0x7f00000042c0)={0x2020}, 0x2020) fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f0000000300)='%\x00', &(0x7f0000000340)='./file0\x00', r1) openat$fuse(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280), &(0x7f00000002c0)=0xc) r5 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) fcntl$lock(r5, 0x24, &(0x7f0000000640)={0x1, 0x4, 0xa5, 0x2}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_sys\x00', 0x275a, 0x0) 105.874619ms ago: executing program 2 (id=8): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x100, 0x0) mprotect(&(0x7f00001d3000/0x3000)=nil, 0x3000, 0x3000000) (async) mprotect(&(0x7f00001d3000/0x3000)=nil, 0x3000, 0x3000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0x8fe69000) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0x8fe69000) ioctl$USBDEVFS_SETINTERFACE(0xffffffffffffffff, 0x80085504, 0x0) (async) ioctl$USBDEVFS_SETINTERFACE(0xffffffffffffffff, 0x80085504, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) r1 = socket$inet(0x2, 0x801, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @multicast2}, 0x10) (async) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r1, 0x0, 0xe803, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x3c}}, 0x10) sendto$inet(r1, &(0x7f0000000140)="236f1174cb4ce474dc22697877eaf1cae3866313f7e61fe16b1957ff6206d8feea96dbd9eac97ce6fa516cc3739af35926e1ee398238c76765fd029118630609787dacf0dc7fb8ce2f6d2a55e3cc5363a272a1964a1dbd8332019e", 0x5b, 0x0, &(0x7f0000000080)={0x2, 0x4e23, @rand_addr=0x64010100}, 0x10) (async) sendto$inet(r1, &(0x7f0000000140)="236f1174cb4ce474dc22697877eaf1cae3866313f7e61fe16b1957ff6206d8feea96dbd9eac97ce6fa516cc3739af35926e1ee398238c76765fd029118630609787dacf0dc7fb8ce2f6d2a55e3cc5363a272a1964a1dbd8332019e", 0x5b, 0x0, &(0x7f0000000080)={0x2, 0x4e23, @rand_addr=0x64010100}, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x8001, 0x0) ioctl$TIOCNOTTY(r3, 0x5422) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000040)={'lo\x00'}) sendmmsg$inet(r1, &(0x7f0000000a80)=[{{0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000200)='\\Q', 0x2}], 0x1}}], 0x1, 0x4000000) socket$xdp(0x2c, 0x3, 0x0) (async) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/59, 0x304000, 0x800, 0x0, 0x3}, 0x20) 4.997381ms ago: executing program 2 (id=9): madvise(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x19) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r2, &(0x7f00000020c0)={0x0, 0x0, &(0x7f0000002080)={&(0x7f0000001f80)={0x5c, 0x2, 0x1, 0x101, 0x0, 0x0, {0x2, 0x0, 0xa}, [@CTA_FILTER={0x14, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x10a}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x608}]}, @CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @loopback}}}]}, @CTA_TUPLE_REPLY={0x10, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x840}, 0x8c4) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f0000000000)={0x1}) ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000040)) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="7c010000190001000000000000000000fc0200000000000000000000000000016401010000000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000000010000000000000000700000000000000a80c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000200000000c4000500ac1414aa000000000000000000000000000004d53c00000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff0a010102000000003c00000000000000fe8000000000000000000000000000000000000000000000000800000000000001000000fc00000000000000000001000000016c000400000000007f00000100000000000000000000000000000000010080000000000000000000fdffffff0000000000"], 0x17c}}, 0x0) r3 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x167342, 0x0) readv(r3, &(0x7f0000000140)=[{&(0x7f0000001400)=""/4096, 0x1000}, {0x0, 0xfffffe28}], 0x2) 3.460911ms ago: executing program 2 (id=10): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000280)=0x40) openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x802, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/custom0\x00', 0x802, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f0000000080)={0x0, 0x0, 0xfffffffffffffffc, 0x1, 0x0, 0xffffffffffffff18}, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) connect$inet(r4, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r4, &(0x7f00000004c0)="3ce2de4d8d", 0x5, 0x805, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f00000002c0)={0x0, 0x0}) ptrace$poke(0xffffffffffffffff, r5, &(0x7f0000000100), 0x8) recvmmsg(r4, &(0x7f00000003c0)=[{{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000003100)=""/4099, 0x1003}], 0x1}, 0x100}], 0x1, 0x10022, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000040)={0x2}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000200)=[@acquire_done={0x40106309, 0x3}], 0xe, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000280)=0x40) (async) openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x802, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/custom0\x00', 0x802, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$netlink(r2, &(0x7f0000000080)={0x0, 0x0, 0xfffffffffffffffc, 0x1, 0x0, 0xffffffffffffff18}, 0x0) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) setsockopt$inet_tcp_int(r4, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) (async) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) (async) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) (async) connect$inet(r4, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) (async) sendto$inet(r4, &(0x7f00000004c0)="3ce2de4d8d", 0x5, 0x805, 0x0, 0x0) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f00000002c0)) (async) ptrace$poke(0xffffffffffffffff, r5, &(0x7f0000000100), 0x8) (async) recvmmsg(r4, &(0x7f00000003c0)=[{{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000003100)=""/4099, 0x1003}], 0x1}, 0x100}], 0x1, 0x10022, 0x0) (async) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000040)={0x2}) (async) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000200)=[@acquire_done={0x40106309, 0x3}], 0xe, 0x0, 0x0}) (async) 161.631µs ago: executing program 3 (id=11): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs2/custom0\x00', 0x802, 0x0) (async) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0x3) (async) ioctl$TCFLSH(r1, 0x400455c8, 0x0) (async) syz_usb_connect(0x0, 0x4a, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) close_range(r0, 0xffffffffffffffff, 0x0) 0s ago: executing program 2 (id=12): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) bind$unix(r2, &(0x7f0000000dc0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000001400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000480)={@flat=@binder={0x73622a85, 0x100, 0x2}, @fda={0x66646185, 0xa, 0x2, 0x7}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x38}}}], 0x0, 0x0, 0x0}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.45' (ED25519) to the list of known hosts. [ 21.975937][ T36] audit: type=1400 audit(1759001063.520:64): avc: denied { mounton } for pid=282 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.977322][ T282] cgroup: Unknown subsys name 'net' [ 21.998615][ T36] audit: type=1400 audit(1759001063.520:65): avc: denied { mount } for pid=282 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.025920][ T36] audit: type=1400 audit(1759001063.560:66): avc: denied { unmount } for pid=282 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.026100][ T282] cgroup: Unknown subsys name 'devices' [ 22.212614][ T282] cgroup: Unknown subsys name 'hugetlb' [ 22.218250][ T282] cgroup: Unknown subsys name 'rlimit' [ 22.314340][ T36] audit: type=1400 audit(1759001063.860:67): avc: denied { setattr } for pid=282 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.337540][ T36] audit: type=1400 audit(1759001063.860:68): avc: denied { mounton } for pid=282 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.348432][ T284] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.362418][ T36] audit: type=1400 audit(1759001063.860:69): avc: denied { mount } for pid=282 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 22.393991][ T36] audit: type=1400 audit(1759001063.920:70): avc: denied { relabelto } for pid=284 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.419441][ T36] audit: type=1400 audit(1759001063.920:71): avc: denied { write } for pid=284 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.449402][ T36] audit: type=1400 audit(1759001064.000:72): avc: denied { read } for pid=282 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.450003][ T282] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.474935][ T36] audit: type=1400 audit(1759001064.000:73): avc: denied { open } for pid=282 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.315459][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.322683][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.329944][ T289] bridge_slave_0: entered allmulticast mode [ 23.336182][ T289] bridge_slave_0: entered promiscuous mode [ 23.351123][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.358271][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.365351][ T289] bridge_slave_1: entered allmulticast mode [ 23.371578][ T289] bridge_slave_1: entered promiscuous mode [ 23.378656][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.385737][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.392850][ T291] bridge_slave_0: entered allmulticast mode [ 23.399054][ T291] bridge_slave_0: entered promiscuous mode [ 23.406984][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.414059][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.421355][ T291] bridge_slave_1: entered allmulticast mode [ 23.427561][ T291] bridge_slave_1: entered promiscuous mode [ 23.506640][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.513712][ T292] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.520800][ T292] bridge_slave_0: entered allmulticast mode [ 23.527031][ T292] bridge_slave_0: entered promiscuous mode [ 23.542778][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.549841][ T292] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.556917][ T292] bridge_slave_1: entered allmulticast mode [ 23.563285][ T292] bridge_slave_1: entered promiscuous mode [ 23.596511][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.603611][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.610905][ T290] bridge_slave_0: entered allmulticast mode [ 23.617150][ T290] bridge_slave_0: entered promiscuous mode [ 23.623624][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.630681][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.637796][ T290] bridge_slave_1: entered allmulticast mode [ 23.644139][ T290] bridge_slave_1: entered promiscuous mode [ 23.715208][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.722288][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.729596][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.736679][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.801266][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.808348][ T292] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.815636][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.822679][ T292] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.844500][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.851617][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.858912][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.865992][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.889147][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.896698][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.904091][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.911747][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.919286][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.926560][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.948299][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.955391][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.970180][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.977241][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.985203][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.992257][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.003267][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.010332][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.037141][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.044219][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.051958][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.059015][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.098588][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.105763][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.113748][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.120834][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.135780][ T289] veth0_vlan: entered promiscuous mode [ 24.167095][ T292] veth0_vlan: entered promiscuous mode [ 24.175253][ T291] veth0_vlan: entered promiscuous mode [ 24.184546][ T289] veth1_macvtap: entered promiscuous mode [ 24.207061][ T292] veth1_macvtap: entered promiscuous mode [ 24.227554][ T291] veth1_macvtap: entered promiscuous mode [ 24.238291][ T290] veth0_vlan: entered promiscuous mode [ 24.263395][ T289] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 24.295147][ T290] veth1_macvtap: entered promiscuous mode [ 24.370159][ T345] overlayfs: missing 'lowerdir' [ 24.375989][ T341] rust_binder: Failed to allocate buffer. len:1176, is_oneway:true [ 24.376747][ T344] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 24.403645][ T341] netlink: 'syz.0.1': attribute type 27 has an invalid length. [ 24.409496][ T12] Bluetooth: hci0: Frame reassembly failed (-84) [ 24.414109][ T341] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 24.464848][ T354] incfs: ino conflict with backing FS 2 [ 24.512030][ T360] Zero length message leads to an empty skb [ 24.524104][ T362] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 24.546153][ T290] ------------[ cut here ]------------ [ 24.551708][ T290] WARNING: CPU: 0 PID: 290 at fs/overlayfs/util.c:602 ovl_dir_modified+0x15a/0x190 [ 24.561112][ T290] Modules linked in: [ 24.565058][ T290] CPU: 0 UID: 0 PID: 290 Comm: syz-executor Not tainted syzkaller #0 98bacdaf52065bb91416bd5578e49f5aee2639ea [ 24.576781][ T290] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 24.582477][ T369] rust_binder: Error while translating object. [ 24.586905][ T290] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 24.586996][ T369] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 24.593126][ T290] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 ae 49 99 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d e9 cc 66 4c 03 cc e8 46 f9 42 ff <0f> 0b e9 3e ff ff ff e8 3a f9 42 ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 24.593151][ T290] RSP: 0018:ffffc9000b65fb68 EFLAGS: 00010293 [ 24.593174][ T290] RAX: ffffffff8243049a RBX: 0000000000000000 RCX: ffff888122d99300 [ 24.598949][ T369] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:20 [ 24.608258][ T290] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 24.659123][ T290] RBP: ffffc9000b65fb90 R08: ffff88811b8ce15f R09: 1ffff11023719c2b [ 24.667180][ T290] R10: dffffc0000000000 R11: ffffed1023719c2c R12: 0000000000000000 [ 24.675303][ T290] R13: dffffc0000000000 R14: ffff88811b8ce0c0 R15: ffff888129cb8550 [ 24.683367][ T290] FS: 000055556a85e500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 24.692367][ T290] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 24.698960][ T290] CR2: 00007ffec0d57ef8 CR3: 000000011f6a4000 CR4: 00000000003526b0 [ 24.699799][ T64] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 24.707036][ T290] Call Trace: [ 24.717784][ T290] [ 24.720747][ T290] ovl_do_remove+0x7b8/0xcf0 [ 24.725364][ T290] ? ovl_set_redirect+0x780/0x780 [ 24.730458][ T290] ? down_write+0xe9/0x2a0 [ 24.734916][ T290] ? __cfi_down_write+0x10/0x10 [ 24.739819][ T290] ovl_rmdir+0x1e/0x30 [ 24.743911][ T290] vfs_rmdir+0x3dd/0x560 [ 24.748172][ T290] incfs_kill_sb+0x109/0x230 [ 24.752851][ T290] deactivate_locked_super+0xd8/0x2a0 [ 24.758247][ T290] deactivate_super+0xb8/0xe0 [ 24.762959][ T290] cleanup_mnt+0x3f1/0x480 [ 24.767415][ T290] __cleanup_mnt+0x1d/0x40 [ 24.771852][ T290] task_work_run+0x1e0/0x250 [ 24.776464][ T290] ? __cfi_task_work_run+0x10/0x10 [ 24.781630][ T290] ? __x64_sys_umount+0x126/0x170 [ 24.786683][ T290] ? __cfi___x64_sys_umount+0x10/0x10 [ 24.792128][ T290] ? __kasan_check_read+0x15/0x20 [ 24.797194][ T290] resume_user_mode_work+0x36/0x50 [ 24.802370][ T290] syscall_exit_to_user_mode+0x64/0xb0 [ 24.807850][ T290] do_syscall_64+0x64/0xf0 [ 24.812535][ T290] ? clear_bhb_loop+0x50/0xa0 [ 24.817265][ T290] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 24.823274][ T290] RIP: 0033:0x7f866ef901f7 [ 24.827756][ T290] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 24.847531][ T290] RSP: 002b:00007ffec0d586a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 24.856045][ T290] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f866ef901f7 [ 24.864107][ T290] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffec0d58760 [ 24.869836][ T64] usb 1-1: Using ep0 maxpacket: 16 [ 24.872132][ T290] RBP: 00007ffec0d58760 R08: 0000000000000000 R09: 0000000000000000 [ 24.883096][ T64] usb 1-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 24.885249][ T290] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffec0d597f0 [ 24.901719][ T64] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 24.902582][ T290] R13: 00007f866f011d7d R14: 0000000000005fca R15: 00007ffec0d59830 [ 24.911410][ T64] usb 1-1: Product: syz [ 24.918852][ T290] [ 24.918866][ T290] ---[ end trace 0000000000000000 ]--- [ 24.930606][ T290] ------------[ cut here ]------------ [ 24.932889][ T64] usb 1-1: Manufacturer: syz [ 24.937913][ T290] WARNING: CPU: 0 PID: 290 at fs/overlayfs/util.c:602 ovl_dir_modified+0x15a/0x190 [ 24.947293][ T64] usb 1-1: SerialNumber: syz [ 24.952234][ T290] Modules linked in: [ 24.952255][ T290] CPU: 0 UID: 0 PID: 290 Comm: syz-executor Tainted: G W syzkaller #0 98bacdaf52065bb91416bd5578e49f5aee2639ea [ 24.952293][ T290] Tainted: [W]=WARN [ 24.952301][ T290] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 24.952315][ T290] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 24.952358][ T290] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 ae 49 99 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d e9 cc 66 4c 03 cc e8 46 f9 42 ff <0f> 0b e9 3e ff ff ff e8 3a f9 42 ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 24.952378][ T290] RSP: 0018:ffffc9000b65fb68 EFLAGS: 00010293 [ 24.952398][ T290] RAX: ffffffff8243049a RBX: 0000000000000000 RCX: ffff888122d99300 [ 24.952417][ T290] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 24.967568][ T64] r8152-cfgselector 1-1: Unknown version 0x0000 [ 24.974732][ T290] RBP: ffffc9000b65fb90 R08: ffff88811b8ce15f R09: 1ffff11023719c2b [ 24.980511][ T64] r8152-cfgselector 1-1: config 0 descriptor?? [ 24.988823][ T290] R10: dffffc0000000000 R11: ffffed1023719c2c R12: 0000000000000000 [ 24.988848][ T290] R13: dffffc0000000000 R14: ffff88811b8ce0c0 R15: ffff888129cb8550 [ 24.988867][ T290] FS: 000055556a85e500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 25.082541][ T290] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.089264][ T290] CR2: 00007ffec0d57ef8 CR3: 000000011f6a4000 CR4: 00000000003526b0 [ 25.097292][ T290] Call Trace: [ 25.100619][ T290] [ 25.103580][ T290] ovl_do_remove+0x7b8/0xcf0 [ 25.108210][ T290] ? ovl_set_redirect+0x780/0x780 [ 25.113314][ T290] ? down_write+0xe9/0x2a0 [ 25.117768][ T290] ? __cfi_down_write+0x10/0x10 [ 25.122699][ T290] ovl_rmdir+0x1e/0x30 [ 25.126807][ T290] vfs_rmdir+0x3dd/0x560 [ 25.131273][ T290] incfs_kill_sb+0x1a0/0x230 [ 25.135914][ T290] deactivate_locked_super+0xd8/0x2a0 [ 25.141376][ T290] deactivate_super+0xb8/0xe0 [ 25.146099][ T290] cleanup_mnt+0x3f1/0x480 [ 25.150605][ T290] __cleanup_mnt+0x1d/0x40 [ 25.155061][ T290] task_work_run+0x1e0/0x250 [ 25.159691][ T290] ? __cfi_task_work_run+0x10/0x10 [ 25.164873][ T290] ? __x64_sys_umount+0x126/0x170 [ 25.169975][ T290] ? __cfi___x64_sys_umount+0x10/0x10 [ 25.175397][ T290] ? __kasan_check_read+0x15/0x20 [ 25.180518][ T290] resume_user_mode_work+0x36/0x50 [ 25.185665][ T290] syscall_exit_to_user_mode+0x64/0xb0 [ 25.191197][ T290] do_syscall_64+0x64/0xf0 [ 25.195653][ T290] ? clear_bhb_loop+0x50/0xa0 [ 25.200473][ T290] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 25.206411][ T290] RIP: 0033:0x7f866ef901f7 [ 25.211021][ T290] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 25.230706][ T290] RSP: 002b:00007ffec0d586a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 25.239161][ T290] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f866ef901f7 [ 25.247200][ T290] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffec0d58760 [ 25.255254][ T290] RBP: 00007ffec0d58760 R08: 0000000000000000 R09: 0000000000000000 [ 25.263292][ T290] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffec0d597f0 [ 25.271325][ T290] R13: 00007f866f011d7d R14: 0000000000005fca R15: 00007ffec0d59830 [ 25.279328][ T290] [ 25.282429][ T290] ---[ end trace 0000000000000000 ]--- Stopping sshd: stopped /usr/sbin/sshd (pid 201) OK Stopping crond: stopped /usr/sbin/crond (pid 194) OK Stopping dhcpcd... stopped /sbin/dhcpcd (pid 148) Stopping network: OK Stopping iptables: OK Stopping system message bus: done Stopping klogd: OK Stopping acpid: [ 26.090741][ T9] r8152-cfgselector 1-1: USB disconnect, device number 2 [ 26.409856][ T349] Bluetooth: hci0: command 0x1003 tx timeout [ 26.409860][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -110 OK Stopping syslogd: stopped /sbin/syslogd (pid 92) OK umount: can't remount debugfs read-only Connection to 10.128.1.45 closed by remote host. umount: sysfs busy - remounted read-only umount: devtmpfs busy - remounted read-only umount: can't remount /dev/root read-only The system is going down NOW! Sent SIGTERM to all processes [ 27.048605][ T36] kauditd_printk_skb: 91 callbacks suppressed [ 27.048626][ T36] audit: type=1400 audit(1759001068.580:165): avc: denied { write } for pid=282 comm="syz-executor" path="pipe:[2786]" dev="pipefs" ino=2786 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 27.185506][ T372] bridge_slave_1: left allmulticast mode [ 27.191274][ T372] bridge_slave_1: left promiscuous mode [ 27.196908][ T372] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.206693][ T372] bridge_slave_0: left allmulticast mode [ 27.212422][ T372] bridge_slave_0: left promiscuous mode [ 27.219174][ T372] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.395795][ T372] veth1_macvtap: left promiscuous mode [ 27.401373][ T372] veth0_vlan: left promiscuous mode [ 27.632050][ T372] bridge_slave_1: left allmulticast mode [ 27.637704][ T372] bridge_slave_1: left promiscuous mode [ 27.643372][ T372] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.650802][ T372] bridge_slave_0: left allmulticast mode [ 27.656442][ T372] bridge_slave_0: left promiscuous mode [ 27.662094][ T372] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.669641][ T372] bridge_slave_1: left allmulticast mode [ 27.675326][ T372] bridge_slave_1: left promiscuous mode [ 27.680936][ T372] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.688333][ T372] bridge_slave_0: left allmulticast mode [ 27.694177][ T372] bridge_slave_0: left promiscuous mode [ 27.699822][ T372] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.707365][ T372] bridge_slave_1: left allmulticast mode [ 27.713034][ T372] bridge_slave_1: left promiscuous mode [ 27.718616][ T372] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.726048][ T372] bridge_slave_0: left allmulticast mode [ 27.731823][ T372] bridge_slave_0: left promiscuous mode [ 27.737548][ T372] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.004932][ T372] veth1_macvtap: left promiscuous mode [ 28.010535][ T372] veth0_vlan: left promiscuous mode [ 28.016182][ T372] veth1_macvtap: left promiscuous mode [ 28.021767][ T372] veth0_vlan: left promiscuous mode [ 28.027310][ T372] veth1_macvtap: left promiscuous mode [ 28.032878][ T372] veth0_vlan: left promiscuous mode Sent SIGKILL to all processes Requesting system poweroff [ 29.154829][ T424] sd 0:0:1:0: [sda] Synchronizing SCSI cache [ 29.161611][ T424] ACPI: PM: Preparing to enter system sleep state S5 [ 29.168660][ T424] kvm: exiting hardware virtualization [ 29.174243][ T424] reboot: Power down serialport: VM disconnected.