last executing test programs: 3.045853866s ago: executing program 2 (id=1208): r0 = socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6(0xa, 0x3, 0x1) (async) r1 = socket$inet6(0xa, 0x3, 0x1) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x4, 0xfffffffffffffffc}, {0x0, 0x0, 0x25}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x33}, 0xfffffffd, 0x32}, 0x0, @in6=@dev={0xfe, 0x80, '\x00', 0xc}, 0x0, 0x0, 0x0, 0xfd, 0x0, 0xfffffff1, 0xfffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000480), 0x21, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000180)={'lo\x00', {0x2, 0x4e21, @empty=0x7f000000}}) (async) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000180)={'lo\x00', {0x2, 0x4e21, @empty=0x7f000000}}) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x98) fcntl$setlease(r2, 0x400, 0x0) mount$9p_fd(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000000080), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="6e733d66642c7266646e6f3db6b0651f798be9d5f7a1c8039663d5fac5d847e6ad6a95781e40fc5cbc9a6cb00200000000000000", @ANYRES64=r0, @ANYBLOB="927f769b3a971b7e2f4ab537499b71dafce29b888fb8622059da8bc863d24bf61edb9b5086f9c284c478ddcc09ba8de491834d856d6895bade", @ANYRESOCT=r2, @ANYBLOB=',msize=0x000000007fffffff,\x00']) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x41, &(0x7f0000000340)=0x63ba, 0x4) (async) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x41, &(0x7f0000000340)=0x63ba, 0x4) setsockopt$inet6_int(r4, 0x29, 0x33, &(0x7f0000000380)=0x8, 0x4) (async) setsockopt$inet6_int(r4, 0x29, 0x33, &(0x7f0000000380)=0x8, 0x4) sendmmsg$inet6(r4, &(0x7f0000000300)=[{{&(0x7f0000000000)={0xa, 0x4e1e, 0x3, @empty, 0xfff}, 0x1c, 0x0}}], 0x1, 0x60080004) recvmmsg(r4, &(0x7f0000005b40)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000039c0)=""/93, 0x5d}, 0x4}, {{0x0, 0x0, 0x0}, 0x800}], 0x2, 0x40002142, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x753800, 0x0) (async) r5 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x753800, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r5, 0xb522f000) ioctl$BLKFLSBUF(r5, 0x1261, &(0x7f0000000080)=0x1) 2.948448848s ago: executing program 2 (id=1210): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x8) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200003, 0x0, 0x0, 0xfffc}) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x8a86010000000000, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}, {@userxattr}], [], 0x2c}) 2.910307649s ago: executing program 2 (id=1211): mount$bpf(0x0, 0x0, 0x0, 0x1900050, &(0x7f0000000040)=ANY=[@ANYRESHEX]) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000240)={{{@in=@dev, @in6=@private1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@private}}}, &(0x7f0000000340)=0xe8) r3 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000003b00)={0x0, 0x0, 0x0}, &(0x7f0000003b40)=0xc) mount$bpf(0x0, &(0x7f0000000040)='./file0/../file0\x00', &(0x7f0000000100), 0x48, &(0x7f0000003b80)={[{@gid={'gid', 0x3d, r4}}]}) mount$bpf(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000003c0), 0x20000, &(0x7f0000000780)={[{@gid={'gid', 0x3d, r4}}], [{@func={'func', 0x3d, 'CREDS_CHECK'}}, {@obj_type={'obj_type', 0x3d, '-f\'{/'}}, {@subj_type={'subj_type', 0x3d, 'appraise'}}, {@obj_role={'obj_role', 0x3d, '%\xe4'}}]}) mount$bpf(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x20, &(0x7f00000006c0)={[{@mode}], [{@subj_user}, {@pcr={'pcr', 0x3d, 0x1d}}, {@dont_measure}, {@fscontext={'fscontext', 0x3d, 'system_u'}}, {@euid_eq={'euid', 0x3d, r2}}, {@dont_measure}, {@fsmagic={'fsmagic', 0x3d, 0x3}}, {@appraise}]}) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$INCFS_IOC_CREATE_FILE(r0, 0xc058671e, &(0x7f0000000640)={{'\x00', 0x3}, {0x8}, 0x6, 0x0, 0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)="ee7038ed3af6e357ee5d55d1d2935ec045327b402e2f372d633575548f5d33b60b79cc9d1ed1ca8757e54f686046ce44ae4720eb1c6ace4c4ff8ad40c814b1d52d38c2615a8f044f90afde8d3077", 0x4e, 0x0, &(0x7f0000000440)={0x2, 0x170, {0x1, 0xc, 0xdc, "fb175647ebd23f57a53b873325ad6f8a7fa4fcd0bb2804efc43c5310908031f386bf6dfded88f24951bca21eddabdae5dba95fa76222bb1859f8ce524e2f63d295c22dc30f296a3ff804b85abfd5bc484227c0d86a9d5e24419cc8462b6483c81aae431b1933b84f2684803682afc0ba2675d2a15efd14818ec85b4c3f6a1a9327da5055ef2f300f17ae98886170ac0cc93adf82fe1954d57fdab03ab9fabeeb1393aeeee9cca658b020c0759a0b33504fd75333dc5a14ed2bf043a3194e30072216ae547e9ccb62be6ab269c5ec2afa1a216cbc52a3f3319f2dc194", 0x87, "92c0da8600424800bcb7248a4680891ad195d19e6f7eece02d57fd85382d85acbafdfa8c2ccca2f24f1f7eda7c4d5b057fd5d4e7c699dd912fefc8f929b27661796ed7568c9de5d5256a9e6d91f5ae633027ac425d8214098fc09c90e3a80b05fa8f434f90bb642de002bea93f9df71024c7b0fe672832ff0fc67c008ebb09c000f352c01139e3"}, 0x69, "5e93e2e3f089223bb2eeff75d19249d2c722ae788576dd06fa0f1cdbd89a14c22b61daf59315485cded6cf6115ffd19bc450f2f3b30ae0be660b7e0f93d7b21a9579ff00aad105947a66b9f8858890f2835a2c63bf2b288ee77835eb56d8cfcd766260b22a6c6420bd"}, 0x1e5}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000134000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x7c, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 2.787433902s ago: executing program 2 (id=1214): read$FUSE(0xffffffffffffffff, &(0x7f0000000340)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) ptrace$getregset(0x4204, r0, 0x202, &(0x7f0000002480)={&(0x7f0000002380)=""/199, 0xc7}) syz_usb_connect$uac1(0x5, 0x82, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x40, 0x582, 0xc, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x70, 0x3, 0x1, 0x0, 0x80, 0x2, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x0, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x4, 0x7, 0x1001}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0xa, 0x0, 0x8, 0x1d, 0x36}]}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x7, 0xfb, 0x0, {0x7, 0x25, 0x1, 0xc, 0xfd, 0x205}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x9, 0x7f, 0xf, {0x7, 0x25, 0x1, 0x4, 0xd7, 0x8}}}}}}}}]}}, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x98, &(0x7f0000000100)=@string={0x98, 0x3, "a46dd0a6b7a29bcbf87f540c5f3ddf0fc3de7e1000fe2f951fb308059906b384a3a169e2bea99f2d570b5beebb77943a2da2168bfb9291be897b934deb6d5b200da211e694fb7ace37b80b73bbf7ddd60124781a0d8e4bad9ef0b8a831940d2d42eaeedfb629f89303cc94b33ea2a49b9bfd510a9f1bfa56a9d6cc1b0b4c2cfacc75fefda4bda2b3ef51924b25f90ad222ff1aef7d10"}}]}) 1.912723084s ago: executing program 0 (id=1221): r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r0) r2 = openat$selinux_policy(0xffffff9c, &(0x7f0000000300), 0x0, 0x0) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/kernel/rcu_expedited', 0x2, 0x0) write$FUSE_NOTIFY_STORE(r3, &(0x7f0000000140)=ANY=[@ANYBLOB='-', @ANYRESOCT, @ANYBLOB='8'], 0x28) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x10, 0x0, 0x0) socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r2, 0x0) write$selinux_load(r1, &(0x7f0000000000)=ANY=[], 0x17fc) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) mincore(&(0x7f0000701000/0x1000)=nil, 0x1000, &(0x7f00000004c0)=""/74) 1.875183894s ago: executing program 0 (id=1222): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x4, &(0x7f00000017c0)={0x2e, 0x1, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xc}, 0x0, 0x0, '\x00', {0x0, 0xdcd, 0x0, &(0x7f00000007c0)=@buf_512="0fae20849e711bdc0b7236150c001b03215504974253acd60a4c6de53b928be5252c007c75f5c9c394e9d2e698b8e630374d40feb41801c6336e9e5af2d3aab19a0a36656b28c1326c676aae7ecc96b4f6debd9dd50628edaaff8d7ed61dd45370f3ca09b352fa4e0c58c174d3fd3da385cd091e1303a41297f1afbc246fefaecda292d991729a1122dd03b051696ff5003a3443a4d97157260429d37cc7c114c36391a6ea7cbd9a7f39ff3bc573b7840ae4cd44113b034ede88e8ec2696976c6d7f2ae644d426cf91984c047ff5b9397db44621dcb58597118db46b95dbae8185dc13b9e40a385a75544682f5b4f49a7aa2a05f61d5f688106f2ce58c96b1cb06e75213769a57cfc7e1e00696c90822e4aad1f649eab99a441fe854de400e06f7fad97e3859a8de6ee15934bb41f5ba8a4be2a0b95b3fe4a472de2dce19c8f2d36df4c5bfd58a33e7dc541adaa56eef257f05401ffbcc9ad8ec241132068dc6588409a4103175d76e3cd9b4ee2b2ccca756c5030ab6d46bf0bdb8809929bd2b835a19d8e38526cac93420850301c4f95889b54eec0a53f2e6552793bc647c2a0360928912d76e4781336de655d348153b6b7799cdb31fc592035d6ef877ff3cab23495b155284a9ce75dd2cd1ae1f0bce510e3bfd675288708b50ad04ca1dfe4eae150597b5db7ed7c96e89baec75d69c305772ddd002010724cdff3a9b6e7f"}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)=ANY=[@ANYBLOB="480100001000010000000000000000000000000000000000000000000000000020010000000000000000000000000000fffd0000000000000000000021000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="200100000000000000000000000000010000004032000000fe88000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000001f0000000000000000000000000000000200020239000000000000004c001200726663343130362867636d286165732929000000000000000000000000000000000000000000000014000000000000000000000000000000000000000000000000000000400000000c0008"], 0x148}}, 0x24008814) 1.815715666s ago: executing program 0 (id=1223): socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000140)={0xffffffffffffffff}) ioctl$TIOCGDEV(r0, 0x80045432, &(0x7f0000000100)) sigaltstack(&(0x7f0000000000)={0x0, 0x2}, 0x0) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x40, 0x0) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) openat$ttynull(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fdinfo/3\x00') r2 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000040)='/\x00') ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000080)='\x00') r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) read$FUSE(r3, &(0x7f0000000400)={0x2020}, 0x2020) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000080)=0x7) r4 = socket$inet_tcp(0x2, 0x1, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x45a043, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r6, 0x4068aea3, &(0x7f0000000100)={0xc9, 0x0, 0x1f9d65e99c994181}) r7 = epoll_create1(0x80000) r8 = fcntl$dupfd(r4, 0x0, r4) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2280, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x2) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r10, r11, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0x31, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r11, 0x4008ae90, &(0x7f0000000200)={0x1, 0x0, [{0x1, 0x49, 0x0, 0x5, 0x2e9e, 0xa, 0x5}]}) ioctl$KVM_RUN(r11, 0xae80, 0x0) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r8, &(0x7f0000000000)) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r4, &(0x7f00000001c0)={0x10000014}) getpid() syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) 1.815550926s ago: executing program 0 (id=1224): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000a40)="00c575963f8864110000000000000000000008", 0x13}, {&(0x7f0000000140)='\x00\x00\x00', 0x3}], 0x2) 1.738818048s ago: executing program 0 (id=1225): openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) sendmsg$tipc(0xffffffffffffffff, 0x0, 0x2000c8c0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="001c86dd0700100000004000000060ec97000fc83a00fe8000000000000000000000000000aaff0200000000000000000000002c0001"], 0xffe) 1.738385468s ago: executing program 0 (id=1226): r0 = syz_usb_connect$uac3(0x3, 0x97, &(0x7f0000000240)=ANY=[], &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$SO_TIMESTAMP(r1, 0x1, 0x3f, 0x0, &(0x7f0000000780)) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000180)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) unshare(0x60000600) r3 = syz_io_uring_setup(0x48cc, &(0x7f0000000140)={0x0, 0xd350, 0x3200, 0x3, 0x19a}, &(0x7f0000000080)=0x0, &(0x7f0000000200)=0x0, &(0x7f0000000000)=0x0) syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000340)={0x2e, 0xb, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x1, 0x3b7, 0x0, 0x0, 0x1000, 0x7}}}, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f0000000340), 0xb, 0x0, &(0x7f0000000200)={0x77359400}, &(0x7f00000003c0)=0xfffffffd, 0x1) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000000c0)={'syz1\x00', {0xe, 0x7, 0x7, 0x81}, 0x15, [0x10001, 0x40000, 0x4, 0xf, 0x639, 0x4, 0x4, 0x6, 0x10, 0x9, 0x80000100, 0xb, 0xb0f, 0x4, 0x6, 0x5, 0x4, 0x4cb6, 0x0, 0x1, 0xa, 0x7, 0x8, 0x3, 0x10, 0x4, 0xb2f2, 0xb, 0x0, 0x9, 0x2, 0x2d, 0x0, 0x7, 0x1, 0xeb, 0x5743393a, 0x1, 0x2e, 0x8000, 0x2, 0x2, 0x8, 0xf, 0x10000, 0x3, 0x3, 0x20101, 0xc, 0x6, 0xc601, 0xa, 0x1, 0x5, 0x10001, 0x6, 0x5, 0x6, 0xfffff2e0, 0x4, 0x9, 0x8, 0x3, 0x100], [0x6, 0xc37, 0x7, 0x4, 0x5, 0x214, 0xd25, 0xf, 0x7, 0x7, 0x7, 0x8001, 0xfffffffb, 0x2, 0x8, 0x9, 0x9, 0x6, 0xcbdb, 0x6, 0x4, 0xfc, 0xe3, 0x11, 0xa39a, 0x8, 0x76, 0x2, 0x8, 0x3, 0xa, 0x40, 0x4, 0x4, 0x1, 0x0, 0x6, 0x8001, 0x7, 0x5a6, 0x3, 0x9, 0x3, 0x7d1b, 0x5, 0x5, 0x6, 0x6, 0x2, 0x2, 0x8, 0x69e, 0x6, 0x8244, 0x9, 0xacf, 0xedb, 0xe772, 0x0, 0x10000, 0xe0f9, 0x4, 0xd314], [0x5, 0x6, 0x9, 0x5, 0x10006, 0x0, 0x2, 0x0, 0x1, 0x8, 0xffff, 0x401, 0x3, 0x7f, 0xfffffff2, 0x672, 0x5, 0x0, 0x3, 0x6, 0x6, 0x80000002, 0x6, 0x0, 0x2, 0x4, 0xf46, 0x1, 0x8, 0x3ff, 0x2, 0x0, 0x8001, 0x33, 0x5, 0x0, 0x6, 0xaf, 0x1, 0x3ff, 0x80000001, 0x0, 0x2, 0x6, 0x20000000, 0x10001, 0x10001, 0x628e, 0x7, 0x2, 0x2, 0x7fffffff, 0xe, 0x1, 0xffffffff, 0xffffffff, 0x46, 0xa5f, 0xfff, 0x2, 0x7, 0xf, 0x1, 0x3db1], [0x0, 0x1, 0x1, 0xfffffff8, 0x3, 0x7fff, 0x4, 0x400008, 0x2, 0x4, 0x9, 0x2, 0x9, 0x2, 0x3fe, 0xd, 0x1, 0x401, 0x3, 0x7ff, 0x5, 0x4, 0x1, 0xd, 0x1, 0x8, 0x80000001, 0x7f97, 0x401, 0x80000000, 0xd191, 0xe, 0xfffffff9, 0x200, 0x5, 0x80, 0xd4, 0x9, 0x0, 0x8000, 0x1, 0x0, 0x101, 0x6, 0x8, 0x24, 0x5, 0x9, 0xffffffff, 0x80000000, 0x5c6, 0x9, 0x1, 0x9, 0xf1, 0x81, 0x9, 0x4, 0x3, 0x4, 0x1f8c, 0xffffefff, 0x5, 0xb]}, 0x45c) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000002c80)={0x2c, r8, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_PEERS={0x4}]}, 0x2c}}, 0x40000) close(r2) syz_usb_control_io$uac3(r0, &(0x7f0000000000)={0x14, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) syz_usb_control_io$uac3(r0, &(0x7f0000000800)={0x14, &(0x7f0000000300)=ANY=[@ANYRES16=r3], &(0x7f0000000040)=ANY=[@ANYBLOB="b91196672768bdc0e4793afe39f3d9019923bd5e012ab6cf146ca1cea357434de8dcd12afe881009287f53349f017810076a08c4746d65eda5a9a65cd8194844df7601579cafcddc6c08c039fdcedabed2799426efa3caf7eda7ca196302b7e7839ef4c2c54af338fd4dbfb7d71f333d24821b406ff0f7a1a8a4a18ee76c18dae1cb4ce24cb235"]}, 0x0) syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000100)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x20, 0xb05, 0x183d, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x0, 0xb, "", [{{0x9, 0x4, 0x0, 0x2, 0x1, 0x3, 0x1, 0x0, 0x10, {0x9, 0x21, 0x7, 0x80, 0x1, {0x22, 0x8e}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x45, 0x3, 0x1}}, [{{0x9, 0x5, 0x2, 0x3, 0x8, 0x80, 0x4, 0x3}}]}}}]}}]}}, &(0x7f0000000840)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x250, 0xfa, 0x0, 0x8, 0x40, 0x7}, 0x20, &(0x7f0000000240)={0x5, 0xf, 0x20, 0x2, [@ss_container_id={0x14, 0x10, 0x4, 0x2, "70c6d5c589184c41fb055f0ad02e372a"}, @ext_cap={0x7, 0x10, 0x2, 0x28, 0x2, 0x2, 0x9}]}, 0x5, [{0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x860}}, {0xff, &(0x7f0000000580)=@string={0xff, 0x3, "827925fee9b018d365ff86bec5a495575315a905b4629bd2d2ee383b275f9847559bf1788e7d9299502a747b475bdacce4778ce78aa05d065f6941162d046a5c8d86e0c2fbcb59a4488799b14ea5a965c59835514bcfb1ac1bdbcf564c248679145be51fa3a40be81347c9c3f9cfa8e921bb00b3b5ce1408ac63f19cd81235380ac479efff380e10f057da01b9312220819c7e197a33a80a231067c5e9ea350c7c451e021c070a08a0b019d73ee74687f2f7f61ab5091544b96e96658aead0404e7fd6616d6e3d4fa7804446be66d6e0b52cdb94f6657a81f2c52818a8d5b8cc41c8dce904f5af03519c87af817157fb68987fcddfdf4b1e58d0cf7b8a"}}, {0x4, &(0x7f0000000680)=@lang_id={0x4, 0x3, 0x1409}}, {0x49, &(0x7f00000006c0)=ANY=[@ANYBLOB="49292e090319d0a39affbe000080511c7c423698f5a490fe0ececfcc14ab88b4aa7ec56a05db960bc1d35c099ba85bc14873d69a8559e4e124f1000000000000"]}, {0x76, &(0x7f0000000740)=@string={0x76, 0x3, "7ae24ef7990b4de3a486a3f7257d70548488f434c75c4bc04deecd2b1ba34252377d85d634f5947cf99a58772d00a86afa32c30622eb460b3d4b394406fbfe664e5cbe6af337bb755baabb947002380f3e28daadd52bccd1905ca32deb225112f8fdcc5829d822961a93e31b090e18945cd889e5"}}]}) 1.577903111s ago: executing program 2 (id=1231): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x4, &(0x7f00000017c0)={0x2e, 0x1, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xc}, 0x0, 0x0, '\x00', {0x0, 0xdcd, 0x0, &(0x7f00000007c0)=@buf_512="0fae20849e711bdc0b7236150c001b03215504974253acd60a4c6de53b928be5252c007c75f5c9c394e9d2e698b8e630374d40feb41801c6336e9e5af2d3aab19a0a36656b28c1326c676aae7ecc96b4f6debd9dd50628edaaff8d7ed61dd45370f3ca09b352fa4e0c58c174d3fd3da385cd091e1303a41297f1afbc246fefaecda292d991729a1122dd03b051696ff5003a3443a4d97157260429d37cc7c114c36391a6ea7cbd9a7f39ff3bc573b7840ae4cd44113b034ede88e8ec2696976c6d7f2ae644d426cf91984c047ff5b9397db44621dcb58597118db46b95dbae8185dc13b9e40a385a75544682f5b4f49a7aa2a05f61d5f688106f2ce58c96b1cb06e75213769a57cfc7e1e00696c90822e4aad1f649eab99a441fe854de400e06f7fad97e3859a8de6ee15934bb41f5ba8a4be2a0b95b3fe4a472de2dce19c8f2d36df4c5bfd58a33e7dc541adaa56eef257f05401ffbcc9ad8ec241132068dc6588409a4103175d76e3cd9b4ee2b2ccca756c5030ab6d46bf0bdb8809929bd2b835a19d8e38526cac93420850301c4f95889b54eec0a53f2e6552793bc647c2a0360928912d76e4781336de655d348153b6b7799cdb31fc592035d6ef877ff3cab23495b155284a9ce75dd2cd1ae1f0bce510e3bfd675288708b50ad04ca1dfe4eae150597b5db7ed7c96e89baec75d69c305772ddd002010724cdff3a9b6e7f"}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)=ANY=[@ANYBLOB="480100001000010000000000000000000000000000000000000000000000000020010000000000000000000000000000fffd0000000000000000000021000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="200100000000000000000000000000010000004032000000fe880000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000140000000000000000000000000000000000000000000000000000000000000010000000000000000000000000001f0000000000000000000000000000000200020239000000000000004c001200726663343130362867636d286165732929000000000000000000000000000000000000000000000014000000000000000000000000000000000000000000000000000000400000000c0008"], 0x148}}, 0x24008814) 1.563849912s ago: executing program 2 (id=1232): r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000000480)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) timer_create(0x5, &(0x7f0000000500)={0x0, 0x39, 0x1, @tid=r1}, &(0x7f0000000540)) syz_io_uring_setup(0x4e2a, &(0x7f0000000180)={0x0, 0x6499, 0x8000, 0x0, 0x354}, 0x0, 0x0, &(0x7f0000000000)) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r2, 0xc400941d, &(0x7f0000001c00)={0x0, 0x80000000, 0x7, 0x1}) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000002000)={r3, 0x1, 0x10001, 0x3040feefd8f59c22}) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r4) r5 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_connect$cdc_ecm(0x2, 0x0, 0x0, &(0x7f00000005c0)={0x0, 0x0, 0x5, &(0x7f0000000640)=ANY=[@ANYBLOB="b52a2ab0da6c588030280a7ea52b376cd3ce513cd2b3396cae7fae441ec9a4f1ed44f219f44a102850a2185ce0663094bfc56494295fd16b8d3d1309a40ea57621d3a22c38dcf8daf282653b1b2e4933c1689823f3f752b45e1bf501b0af9df62ea5cf270822d8666a5e4bbcc084c8e3a72620063d6ad43ddc40c33f51ec8babafff1bc0a5fa052495c73521fb4b2f923e1cfcf69ccdf3accd6f49a6a43873cf92559de138dfbde4216c6b56eb2d126488f852944d16c12a4866a5acbf3fcb359b6499d6693dcc66b36ded1ea4c3c59064f0e6aecd7c8917c7710af173d6f119050f45ba3427718b65db85ec"], 0x1, [{0x0, 0x0}]}) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_ep_write(r4, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000") r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee1, &(0x7f0000000080)=@attr_riscv64=@attr_addr={0x0, 0x1, @aplic, 0x0}) sendmsg$ETHTOOL_MSG_STRSET_GET(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r0, @ANYBLOB="210342bd7000fbdbdf2d01000000"], 0x14}, 0x1, 0x0, 0x0, 0x404c855}, 0x4) recvmmsg(r2, &(0x7f00000001c0)=[{{0x0, 0x0, &(0x7f0000001bc0)=[{&(0x7f0000000bc0)=""/4069, 0xfe5}, {&(0x7f0000000000)=""/10, 0xa}], 0x2}, 0x1000008}], 0x1, 0x180, 0x0) r7 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r7, r8, r9, r10, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0xffffffffffffff0f, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r13 = socket$inet6_tcp(0xa, 0x1, 0x0) setgroups(0x2, &(0x7f0000000040)=[0x0, 0x0]) r14 = dup(r13) r15 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/mem_sleep', 0x101a02, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup/syz0\x00', 0x200002, 0x0) copy_file_range(r15, &(0x7f0000000000)=0xfffffffffffff61b, r15, 0x0, 0x4, 0x0) syz_ublk_setup_queues(r14, r12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x3, 0x255, 0x0, r14}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x2, 0x4, 0x28, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffc, 0x200, 0x0, 0x146, 0x0, r15}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x5, 0xbc, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x20002, 0x3, 0xffffffff}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, r14, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, r11, '\x00', {0x1, 0x5, 0x0, 0x0}}, 0x0) 582.812546ms ago: executing program 3 (id=1234): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000a40)="00c575963f8864110000000000000000000009", 0x13}, {&(0x7f0000000140)='\x00\x00\x00', 0x3}], 0x2) 570.047526ms ago: executing program 3 (id=1235): openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) sendmsg$tipc(0xffffffffffffffff, 0x0, 0x2000c8c0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="001c86dd0700100000004000000060ec97000fc83a00fe8000000000000000000000000000aaff020000000000000000000000330001"], 0xffe) 516.210687ms ago: executing program 3 (id=1236): r0 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r0, &(0x7f0000000140)="1ba0000016001d0d89fdc5cbdd045798707bed4dca141a780f0f8e", 0xff3b, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/sockstat\x00') r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) connect$pppl2tp(r2, &(0x7f00000001c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x2, 0x3}}, 0x2e) r4 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_CLEAR_HALT(r4, 0xc0105502, 0x0) read$FUSE(r1, &(0x7f00000005c0)={0x2020}, 0x2020) recvfrom$inet6(r0, &(0x7f0000000000)=""/42, 0xffffffffffffff54, 0x0, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000000)="48050000150019", 0x7}], 0x1) r5 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r5, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) 516.068747ms ago: executing program 3 (id=1237): add_key$fscrypt_v1(0x0, 0x0, &(0x7f0000000100)={0x0, "de442bfc7910e10ac69ac014b0fa7807b11d2c99ed1f40d47a6edb3367b5cc888e1fd5902ae2d3d05f251f8d49025ceab4152b6e6d87cd60a8e97a9d06d29143"}, 0x48, 0xfffffffffffffffc) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x2000c8c0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) sendmsg$IEEE802154_ASSOCIATE_REQ(0xffffffffffffffff, &(0x7f0000002380)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x40) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="001c86dd0700100000004000000060ec97000fc83a00fe80000000000000000000ffa10000aaff020000000000000000000000000001"], 0xffe) 509.733167ms ago: executing program 3 (id=1238): r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$UHID_INPUT(r1, &(0x7f0000000940)={0x8, {"85f080a4933d55266e07e799aa0cc421388242df2a3c6b631b65b1c061edd2aa108c3528fe9b0bb3a53ab1200f5d01a68a4acdec8fee09648222f908c1fedc3000342e6139de28366c13509306d00ebcc67497181ac916db98af9d366b76e427d9ab5bb68095f0fb246df32b8af0783653136f8a04c03690312125b2ded6a24fda8685340c575ead69519e3583f89d467ec232d6a1ffd0463ba4ea3cbae5dae6654b5547b5458f02ac307729e57b09e134f68be44f88d72517b230b066f6315b5fb80206397bbff8cbc2a36e01c2e7b3aadb03bd3dd5288a69a991d9c674717e3abba7167280b2db3b1b8502afa4f3f296c532510c9d2dd79bb5eeb25adb5edddbdd069c09d14d15c2e7e1e2bb22e97d6992236d2273c8bb95536f7118d007965008b125c7daac2814e6bbe1adbfa3572ad0b7ad5c26c8014118d8374ca9f285779dfee7715a403908146a74de61b3853914c89f444c12e7a38bdd46c4ed36eb806ea598f44d1dec9eff9e2476f43802211f0762b66673b45d236b2391ce322e30fb9c69fe0d514dc1f8b6e3979c1205fd5224b07d18a44fec4f6f1a6f65158bb6adcc295bf2dd7dea107f59d7e03c61fe5822292e45968956b931bdc4d6445ff1631e0b98e4b4448774dd4b9cd53a45896fdb3f03702778741ae2b45a25bf9a23fc02fb97a630f132bf9def6c6d4a7baeb62972f1a814f6f2377bcfc78e2e86368c138510a04cedf7175af8c2033aae7413e3ace8c71ab9a0af1ca7042011a6ed028e205648535dabf3b2f85196ae18d36b839e3cd54ae4933ad529888fdac7bb8a70c72bc0fc81ba06506f2d5bc7686e219bbe5283959cbef9950e071cb6d9f341fc624a5110341f26cebd7100599a06e61f66fae120c7fc2b34c6221200eba75bd1277114671a3fa8f058b27fd897b052f4a52afcea814df526181c75c4497210a2b85b7b26601561e78735387cf123654b0295d1d60556956b36d96dd038866c4b4db31ebdcddd6929bbc2850cd4901389e6ea6e86041e0efa1111c2fb0e6df6364cb95659f506d5c7e63fb67c8116577d15e4a4b1fc4c27de2e52586cb1f52be9c3601f5066549de8bdc3ec07d1a84caf1961323ec2487a37b751aeabafcd647ce2dae5d9499c0f969467e6cabad198669ac96bd1488954eff0854ee0c83d7b596d273625bdb16270782321071fda5d980ded78ffa9dc2b56037d7cbf942547f48a5131f1991f6c17ae1ed5120ca6878f98e68e7997a9a2b70be640a70a34adb80de286c669bb5f092e4e3a15a83217e03d02a4054f34af3a65ff6b36f395b76a0579cffafd5d3bb0e704c935caecf3a7ab756c23fd60c9fe3f4fb2be7504f5bae22b116ff1588dcf02b327d31bf0488dba8af5b33ccf2d7d87f43bbc48fcd4f191ad6af9313ad38b8b2967cbfabd6651bc1f6ce5abb4a2f1413194f96b26d7d6edc4e013fba549075c97eef508af5ca7873664b058b7bcf455a8a04b591d29fab6366c844bb75576bac2d52323e747303d00a5736c9812922b0e17bcec9135550736b54cf6407d61e22e62d7bb75f62935b665acf33e75f688c36ef416f1b890d0f0c8ad1df00e02ec45967834d5649c8e7143978622fa3704672970b7993a87e97d3d926a14265647bc8b8c9e6f83e29572608d24b42c2635ef4abbd0af83860e99c90d7471cf6e8ce99507f5ec2bc572212fa9ee3f5a9dfa3815fe55f0bbb119acce062ae37f2ff921707abba139bcddf42bfd174d29b540161b4113c4e1a13f3a628c638ec4d3a884dfbc093e23ec0d0671b46b41dc8b42d950c8615ba5ee87f49b5d0910ffa4871207995001920db05a95199967f097ba7b55bbd271d818690c4238406b40a3dfc42fa56a67173b53a96b543326c56738b6d043195934018696f5ab49347e5148a78f2d1369a71afab8330273d46ecfba4ee05802a5385649851db949dbfb39e290941641c50b1ac20fb3102754a760b097f464ddb0b83f8168badfa71db6621dcf22fb081e3403f3bac5c7e65905aca52885c807f8ddab18bb2f12ef952c50483c0e251968bc70ff0d42a638ca744dea4c7ebb4fea777cf663bb4f1505ed79730c45bc86e488a13f924377a8e2ee6670a02ca52874ae1c42a35d55b9765757047b2cc3742aa51fa3e43fb2c113c92ad213bad252c1a82966dd016f12a7f1c3900c0f1ab455035163f31899bdd30f3ff43ad17d9e45bb7438c1c986712736f24be14f71ab1bfe92a25ec07f086ee8c7971b8077a13e58a8e8bea39c8e06b251909f02cb0080abf020f27ca160eb26c082dda1fa54ea4094dfdbcb2fa7bddccb67a844e8075f4cc08dad35757006d051e183dced336bc0c2502f93ffc87dca622286ba174c24e1f53f27dc2777baafe170348b0e8d3e743b3aa906bc0764bbe7da08ff403efe2212627d6748c2ce5bb513b7312517d1f88c61c7ba5f9647cd619281c5b390b48606ee39fb4171103df2e09d7cfd56c06c721f7c24ad8cce383623fc2dcb73f7b1b3b86df1b42490815513681aafbf7e871b4b9686efae6c45ecfca60a640a6f071dfd31f9437c3d03086164b48c1ed802986864bfe0d49bdd7709662262368dbc3ecc05eb240ecc41904c76d78ab5c52b66af5a720fdd6a92f52be0676427a56e32e5bc5085b25f90add28a76f2fce6f8f0ef74f4658098549646bd63175adf77b5cdcf102946554ba6136cbc83c6268ee40318f3c9d4718025688b35d2265bf60bf889ff629f7834586ef46eab7a9176337536bb6001e676546b987f36b1fe4baea02fa76fb4830aebbb9c14d8e2b43ea77ef887e5a26448f4086fa819a25e27725ac10298851c8bc45f2ce4430b07917ade5ea8c434c3f2576effbeb521173736e5c9557450643068b0c0fb132a7e99de6ca292246a9937fa7d7e06e59cf59ce5b9f8426a9049931146af40a8a1256ba373a88d09dc00cdf4453cc6ba78572bf3e1f2352a978cdbad60220cb8ac37d7f614a306492a4b5eee9244b0ca84b6cf2e23013bfb1cb92bf6d126fe550e58c19f84e7a4081437b75b31b2b9fb658dcd8ba077962e0f3359721a148d4fefe5c97941ca9688cb85adf38fd10f5811cdd8e074a21abfc9541c71465b08d7321281b68ed52bfab789b9c83849c09d52376d419b1e7ba367603236e119cdf4a7b7cf9d81f2229601deace53cea2f14a05f7fa0ca04b39e31c6453e332f4bd0915c0e09e28f4d1125c390c6ff0833a04b6fc37855e65de90333e505b9eb66e0068607000000fb7b8b215dbdc9787b5baa724cfa71ee6745b41e203de8b7794757ac328ec5567540b951b50530c3d4ee34705ea1c66fd6591e88561083e86d48c45ef3b83a3029319d8f3d8e65ce14c1dc3cb92d0a7dbeb609a8d2793928caa079f0fbbb2bc90b9fb4000000f4032041d14c5bca00e99b3027ec3a50c4957199cf016a4594069af8659df0973f20ffb15dbc265ac5b8a2203e90b114a3e9441e357c60ce0b550a7fe66fc34f5702ac8e8992a22e89194c1df69e81a9b7ad3d2634ea8c0388588192fd47d8e803b10044d558617fb2921b69eb4d85c051f86ef63a2f4382b9becd870fb2ecadca6902712b88680792e2f2ec89591cfebb6db3ad31c2a339af10465fcf7988519d382218df52261234f26a6f66ad0d1859de505d0fe819caf2f8d30aa9fd1228ac91d11ca67f1f8d50c8eefa5c441514321507dff6c6ea3cff6f340a1c11e0c40f419e8e60fc94d8828fa47a96cdf7ee4f61e23f40751b25cf9ca1295041a350f83f0e679515d6b4b46e2c9ce8999e07f835abc1663cefcf728df37831f4e17f8c8a4feaf1fbf44c38c9313284404a50ba4cd8abe835b33bfecb02cd6c9d7f435853b4c8d505ab83cf46512739116694765658bae64b3127152d216055aef9b25c70a8a3b302752d7b1e8791c657b9f3fc9001ef299fd1a349491ae6ee9940149160507fc4130fb825d47d97dc2c243209d2403583ac3ef6ddbedcaa76432255487c0a06e59e043e572ab3aec002afea6b6a2dc9cfaeefa70557886c4d12924a0388f2f1bc8e89e4cfa69705d1ef3c4658f8616278b588011d9dd914beec0b151d65b6524fba3e3f235d58373e021699b07622a51504eade747e0b2f9cf38bc167cabc8cb18c708d1337e25648707e8c0872876514c7a49c0b2aaee5ed9e9ecfcbcc23e032c4deb63e48e7120188056468fad31448e4b46e7d62fbcfc1c2cfb01fcf0db5e8a162bdb9bd820c763f17b96c23f32db9d1c1d74ddbe657b4f9595a9796982a0742153111b15e484d8ffebe47ce0a78a41e470a341616ec2eb6eef813fb415fab50fa965bec6a5977a0ade4fed67f86fc24e11b0e2f5364079f7c7c35b560cac726dbc80f29dbd248f7ecda0286a23ef172a28c96d9bdb1f598eab31c6baf0321312da23920c074b9d2d2e442717f2c21001142a39c2da6b8bd9d06b05a6a8deae1bd1be4108a636ddbebc682d113e715f2f3ee506abc28b1c654b3d2d28e02f73b171ed0deed71dda90ce4a0b728cc75cb576385e7418b545b992b1dd98e2ee53355f464f9250a2a03b3d1e4d2ac1aa71d01de2573530324e14d15a507883411ddbd37be21dc929db9b11f11010e4d2a04c7325a5ae6d24d19900ff97a8a89438f8676457a78cff05201528f4358fe67f61288bf042a8f3c2e0f8b4997b8fb74996b80d465489b2d7807a945eba72a945e8cf8625dbad6f6f6e30537b29e558ca8a8b0625f578c766d34f2d28d704715f94df1f6318a308042aa494baa295640679f1eab1e6a8308af8ce6441d5ad8a2f3d477eb5307af0dfae66444a8f1434030b8361621340ad3dcefa6d8f090ed3929d89ad9c0ba01a6903033428dd8f98619304b1803187d2a6130bf1e009b5eb0e7e21c75594b3b8470f3106c92a9e55bfeb026091ced127a90a1f1247f3c07e36d3572923e0de3f73518d0369a25fcd4e65d243b7eab91063a7bfd8bc8ac9e39fbbb32b5c9517886287a18eacd8dbfda9b91db693cb12e42cba5988280e09e51e72b91a0f360656d8f21cc1eb3248ac345ad51d1a6172b18419277851dab01e028c7e8e2cf34095efd28267852a08fccf61c45b5e46930160daf50282be058274e7ff58c48b60b86d0c8cc886ab8778a2a2b5fa2557ad7bf7f01f2175523ce758871d334c20a9839f7a89fe2867c06289c8a2f6456ac7e4fbadee53ac41aee68214bc76669853baa4f58255b39ba581414f2e8c4b49303f8936a33bae5cbc96b29a5c724d5b50e1614144c2acd03bd90de891c3d36ce040d57543682ecbfcae66c4153c337c3a5d01896524c8e0c27e9a08919821ca27bbfe3fc9ba24a823aeec8d4ad8ef8a65c585bee4dcf1acaa3da501a8c11a23b2e22920c1ad0129a038b31fe16c2abc80589dbf7c37211afc5d1a6db908bc5fe8a692060069fcbcdcba7c523d3c424aa3b0c6556387e0e51bcde9e5f850abf62d2c2101c3a2786a0cb94932877a09cb6b64aa61da8cab3b423e7adc4c4700418a65e87225710e1691f6d9cb2eb63cce5b605ce0a4a89cf519767e00845397c5e381141a0ed8a89b01064b495ec8d1e2da37433bf1597d919a69610d2ad26bdf6fca8de422bb2cb80d0516206e8194ee51445a3dcb5dee33c0c310b4751e68e58bebda2fb586985a5a5b06456756f44e6dbfef4bb99ca732f00fb9ea35775f7419681bfbe6f43dc7c4650c13b63d93c1d490bf0173f287a4309531f13ecb1a775d0bd881a00", 0xdd52d6c}}, 0x1006) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r0, 0x800448d2, &(0x7f0000000780)={0x0, 0x0}) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/arp\x00') preadv(r2, &(0x7f0000004080)=[{&(0x7f0000000240)=""/39, 0x27}], 0x1, 0x421a, 0x0) 498.086888ms ago: executing program 3 (id=1239): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0xf30, 0x111, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x30, 0x1, "", [{{0x9, 0x4, 0x0, 0x1, 0xb, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x8009, 0xa, 0x1, {0x22, 0x2c}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x10, 0x7}}}}}]}}]}}, 0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x48141, 0x0) fcntl$setlease(r1, 0x400, 0x1) fcntl$getflags(r1, 0x401) syz_usb_control_io$hid(r0, 0x0, 0x0) creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_usb_control_io(r0, &(0x7f0000000480)={0x2c, &(0x7f0000000240)={0x40, 0x5, 0x2c, {0x2c, 0x21, "e109031ddd69da995ab3aa4ee13eb7c02e4ecb1f1b4eb21f9ea0d53184d2706787542ec37e46e6b6fc9a"}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000980)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)={0x40, 0x7, 0x2, 0x1000}, 0x0, 0x0, &(0x7f0000000780)={0x40, 0xf, 0x2, 0x2}, &(0x7f00000007c0)={0x40, 0x13, 0x6, @local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 255.031914ms ago: executing program 1 (id=1240): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x8) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200003, 0x0, 0x0, 0xfffc}) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0xd8ffffffffffffff, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}, {@userxattr}], [], 0x2c}) 196.220125ms ago: executing program 1 (id=1241): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x4, &(0x7f00000017c0)={0x2e, 0x1, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xc}, 0x0, 0x0, '\x00', {0x0, 0xdcd, 0x0, &(0x7f00000007c0)=@buf_512="0fae20849e711bdc0b7236150c001b03215504974253acd60a4c6de53b928be5252c007c75f5c9c394e9d2e698b8e630374d40feb41801c6336e9e5af2d3aab19a0a36656b28c1326c676aae7ecc96b4f6debd9dd50628edaaff8d7ed61dd45370f3ca09b352fa4e0c58c174d3fd3da385cd091e1303a41297f1afbc246fefaecda292d991729a1122dd03b051696ff5003a3443a4d97157260429d37cc7c114c36391a6ea7cbd9a7f39ff3bc573b7840ae4cd44113b034ede88e8ec2696976c6d7f2ae644d426cf91984c047ff5b9397db44621dcb58597118db46b95dbae8185dc13b9e40a385a75544682f5b4f49a7aa2a05f61d5f688106f2ce58c96b1cb06e75213769a57cfc7e1e00696c90822e4aad1f649eab99a441fe854de400e06f7fad97e3859a8de6ee15934bb41f5ba8a4be2a0b95b3fe4a472de2dce19c8f2d36df4c5bfd58a33e7dc541adaa56eef257f05401ffbcc9ad8ec241132068dc6588409a4103175d76e3cd9b4ee2b2ccca756c5030ab6d46bf0bdb8809929bd2b835a19d8e38526cac93420850301c4f95889b54eec0a53f2e6552793bc647c2a0360928912d76e4781336de655d348153b6b7799cdb31fc592035d6ef877ff3cab23495b155284a9ce75dd2cd1ae1f0bce510e3bfd675288708b50ad04ca1dfe4eae150597b5db7ed7c96e89baec75d69c305772ddd002010724cdff3a9b6e7f"}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)=ANY=[@ANYBLOB="480100001000010000000000000000000000000000000000000000000000000020010000000000000000000000000000fffd0000000000000000000021000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="200100000000000000000000000000010000004032000000fe880000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000190000000000000000000000000000000000000000000000000000000000000010000000000000000000000000001f0000000000000000000000000000000200020239000000000000004c001200726663343130362867636d286165732929000000000000000000000000000000000000000000000014000000000000000000000000000000000000000000000000000000400000000c0008"], 0x148}}, 0x24008814) 195.991565ms ago: executing program 1 (id=1242): r0 = syz_ublk_setup_io_uring(0x21, &(0x7f0000000040)={0x0, 0x0, 0x40, 0x0, 0x4158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x20000, 0x0, 0x1, 0x154, 0x0, r6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x20, 0x1000004, 0x319}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6c71, 0x8000, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x1, 0xffffffde}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2e78, 0x8000, 0x1, 0x310}}], 0x1, &(0x7f0000000340)={0x2e, 0x4, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0xfff9, 0x42, 0x0, 0x0}}, 0x0) r7 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r7, 0x8946, &(0x7f0000000140)={'veth0_to_team\x00', &(0x7f0000000280)=@ethtool_channels={0x1d, 0xffffffff, 0x0, 0x0, 0x4, 0x2, 0x1}}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000080)={'syz1\x00', {0x3fe, 0x3, 0x4}, 0x4c, [0xd4, 0x5, 0x9, 0x8a4, 0x2, 0x2, 0x7fffffff, 0x80000001, 0x5, 0x1, 0x105, 0x403c6, 0xa, 0x6, 0xf70, 0x3, 0xe7, 0x7, 0x401, 0xbc5d, 0x0, 0x1, 0x8, 0xffff, 0x2, 0xb, 0x10, 0x20000000, 0x15098855, 0x6, 0x2, 0xfffffffb, 0x6, 0xc, 0xfffffff7, 0x4, 0xe79, 0x7, 0x1ff4, 0x1, 0x1, 0x80000000, 0x401, 0x9, 0xbdc7, 0xb, 0x1, 0x9, 0x1, 0x1, 0xa, 0x2, 0x5, 0x9, 0x5, 0x9, 0x0, 0x3a26, 0x1000, 0x57f5, 0x2, 0x6, 0x7ff, 0xb8547353], [0x80000000, 0xffffffff, 0x4, 0x5, 0x7fffffff, 0x1, 0x553, 0x7, 0x2, 0xfffffffc, 0x8, 0x40000c, 0x36, 0xa, 0x6, 0x2d, 0x9, 0x98, 0x8, 0x0, 0xa4, 0x4, 0x99d, 0x8, 0x0, 0x400d, 0x5, 0x0, 0x6e38, 0x6, 0x8, 0x1, 0x3, 0x0, 0x2, 0x7, 0x4, 0xd, 0x80000009, 0xfff, 0x4, 0x0, 0x40, 0x1, 0x8, 0x2, 0x8, 0x0, 0x34f1, 0x1fc, 0x4, 0x1b2c5a17, 0x2, 0x9, 0x7, 0x0, 0x2, 0x1, 0x9, 0x6, 0xac, 0x5, 0x54, 0xcfb9], [0x5, 0xdb8, 0x9, 0x6, 0x2, 0x6, 0x5, 0x5, 0x3, 0x5, 0xfffffffd, 0xc8d0, 0x34, 0x9a45, 0x0, 0xee40000, 0x1, 0x1, 0x43, 0x69d, 0x8, 0xffff, 0xfffffffe, 0x0, 0x8, 0x2, 0x4, 0x800, 0x7, 0x9, 0x1, 0x0, 0x1, 0xfffffffe, 0x6, 0x6, 0x9, 0x8c0, 0x9, 0x8000002, 0x9, 0x8, 0x6, 0x5, 0x81, 0xf7b4, 0xffffff20, 0x55f2, 0x9, 0xfffffffd, 0x7f, 0x9, 0x7ffc, 0x40, 0x3, 0x2, 0xece9165b, 0x6, 0x2, 0xffffff00, 0xda15, 0x7f, 0x3, 0x10], [0x0, 0x896, 0x8, 0x246d, 0x6, 0xfe, 0xfffff410, 0xd, 0x7ff, 0x606, 0x4, 0x0, 0x80000001, 0x2, 0x8000000b, 0x2, 0x7, 0x1, 0x80000000, 0x401, 0x7ff, 0x3ff, 0x0, 0x2, 0x9, 0x100, 0x2, 0xec9b, 0x61c8, 0x7, 0x0, 0x101, 0xff, 0x7, 0x9, 0x5, 0x7, 0x101, 0x9, 0x3000000, 0xe, 0x4000006, 0x7, 0x1, 0x7, 0x4f, 0x4, 0x100009, 0x100, 0x3, 0x3c, 0x7, 0x1000, 0xfffffffe, 0x15, 0x800a, 0x5, 0x81, 0x5, 0x7, 0xfff7fffc, 0x4, 0x6, 0xeff]}, 0x45c) 149.259046ms ago: executing program 1 (id=1243): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000a40)="00c575963f8864110000000000000000000012", 0x13}, {&(0x7f0000000140)='\x00\x00\x00', 0x3}], 0x2) 105.840567ms ago: executing program 1 (id=1244): openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) sendmsg$tipc(0xffffffffffffffff, 0x0, 0x2000c8c0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="001c86dd0700100000004000000060ec97000fc83a00fe8000000000000000000000000000aaff0200000000000000000000003b0001"], 0xffe) 0s ago: executing program 1 (id=1245): r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x56a, 0xcc, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x60, 0xc, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x4, 0xff, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0xb4, 0x83, 0xfe}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_clone(0x80000000, &(0x7f0000000240)="c7f374a28b7ce345996626a60b6009ae11f81d712a2457f9fde03498ef849b72351fb850b10a9521a384b2baf8632e556290ee933bac92400812de3e0e9396f311cf3f00ae44bb50e4ea332e5ba3370ab7902a68b9baf3d8b853b259698d47d33a99672126f6db40be2893efa2c9b8859995e13e49873bf4af1301dcfd06a065d401485240aac0535f00e8011f5fdd17528b54f602d8f18bee4663ec77f083696df3aeebcf1196d8f5bac9635344e1cc750044d2f09922019d04d13631541fb175b6035b5ad060db799968c1d8d592120912a8cb282d9d42a642a5c2cb3da4bad31c335ea74f429ae3f72fe77c0fdf0adaa86f591e059a", 0xf7, &(0x7f0000000340), &(0x7f0000000380), &(0x7f0000000400)="781d721787d90bb96fe49d96373a24a91b5ccd9fc685b36e0b2953d6e3177a06dcd4f3be0dd7b2d7f76e60d3630bb80b0000a4eec2fcc3017bcd0bf9d26b13ccb74267502947a4b130f59ab89d4e1ca6a33721e945852a707c29a07cf755ac3f5d08684923d0d255d0a18432e2541302eb4d521637c7d69cadf472db9917251efd4b6e725725cbcab052714d7d694287581b659888c78db162ed677e0e7f") syz_usb_control_io(r3, &(0x7f00000003c0)={0x2c, &(0x7f0000000040)={0x0, 0x4, 0x28, {0x28, 0x5, "83efb930f0187f62478fa22a61a54607b71ea9e43d359c479c37f525cde38bf7914077366b48"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000002940)=ANY=[@ANYBLOB="000f0000", @ANYRES16=r2, @ANYBLOB="050005000000fbdbdf250f00000008000300", @ANYRES32, @ANYBLOB="08000c006400000082039100f0073d1dc627fa07d52e08e153e002c88a1428362ae26227332c6de7297d5d6ea156cef80603a2a0f979b13c09b68cfcde385f053d4064fb8eb5fac6dadff5b4298a49a3f616da311c51673a9d8915ce852a230f86fd80ff9518f0171b24bc17c6060827df3e50b8aa35085cf2e752d516643297f0af7a390dcfa59d2785be3879d0ed46ea0bef4cc02f4447dde223a07dbc36221b8adafb8694b8b953573f4c776355bc48e4d7f81ebd2c5725da643443c2cd82b15a21f0c7057a10f53612547577d62e7bb7885f71d573a53897f0df1d2e257f1ec6cb0d927826cafe41b9726b1aeea853dcae6f60ac8bd05b067831b9746a51f15d23aadc08e11968b75ebf8d7876733834c2288bb96ae162a308b2b826221bb489cebad32b37bc0cf5294c18fde683b815907cae4154b152a2fc73ce6168007e970b7405bd4b555218e9dfd1a466646668b865905732f82ee8608e81d2076a5669f3ed7a5e98d1aa6b0bf4b6d5181669e8321a1584ff0bc2a8f68bf489c049deb7cb66507f0bce2c94ede55e085aa8d6a7b1748c955e860455d309d820fe3fecaae929ead46d088b55dd09f7ceb30e777b32992fe7bfd4aefa8ebbe6eb8b91e0925480722c564c179f00e30525f97f39d66e4996cb3d6689c54f08e4a313d7462fdf98a665ec365da7b6051a1376f09a9af017dc97aef28284b17d5196b6000690b89695c2a2c1fb9040c68426c64d560e3c67001b7d62bae22d004ee5f14bdb48b096948dd3c4751df74d137a23b89b0653122b70983e61242b47e53346743c24926164805318fe5c34e59ea2532040a724830dc7b272bc2ccd590b0ea09601da5311e3b1cca0a2f5175195bef0cd925171c81c823fecb2ac339508df0c43f8cc0f6646836c28881f1697e1c281c74d8058c5df02bc1485b890cb1ebd0d98e93ba23f2a865b3965f909fc9321c3f455c7dc067a520e0b92a02462331bdd390cf87ac7b120ffdbf86a1155c2ef136ad0304bfeb67a8849346975174738bdea2eb3107b193b6965ec48fec9d9d2eafde2367c9fc8eaadca18814733c15035927b759676ab94510249c2d029e0a753ffe4dd89d754c119c79c60c5838951a877a778fe036c7a2b7298cc36a27824136c0364a8226c07330c5b66fc147b38f9417e6613e68b523b977f1b969662d4db9a51ea94f30ef050ae1f768eee5909f3447e6351008befe11b291bec5ad18181d9cac402dfca4d922f43aaa8d077b7daa457600b44f4533f4ce2db0000140080000006020202020202760603260b0008000c002a0075060100c0ff0400d4000e800400"], 0xf00}, 0x1, 0x0, 0x0, 0x800}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000000c0)={0x2, 0x4, 0x0, 0x5, 0xe, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0xe, @in6={0xa, 0x4e20, 0x2, @mcast1, 0x8}}, @sadb_sa={0x2, 0x1, 0x0, 0x2, 0x8, 0x0, 0x4, 0x1}, @sadb_address={0x5, 0x5, 0x3c, 0x0, 0x0, @in6={0xa, 0x4e24, 0x58, @private1, 0x4a}}]}, 0x70}}, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r6, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)={0x98, r6, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x54, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @val={0x4, 0x6, {0x81, 0x25, 0x70, 0x3ff}}, @void, @void, @void, @void, @void, @val={0x2d, 0x1a, {0xc, 0x2, 0x5, 0x0, {0x93, 0x11df, 0x0, 0x3, 0x0, 0x1, 0x0, 0x2}, 0x1, 0x152a, 0x5}}, @void, @void, @val={0x76, 0x6, {0x7, 0x3, 0x24, 0x1}}}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x5}, @NL80211_ATTR_SSID={0x8, 0x34, @random="4fc4717f"}, @NL80211_ATTR_HIDDEN_SSID={0x8}]}, 0x98}}, 0x0) sendmsg$NL80211_CMD_LEAVE_OCB(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000140)={&(0x7f00000004c0)={0x1c, r2, 0x800, 0x70bd26, 0x24dfdbfe, {{}, {@val={0x8, 0x3, r7}, @void}}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000880}, 0x20004040) syz_usb_connect$uac1(0x3, 0x96, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000406b1d01014000010203010902840003010910080904000000010100000a240106000a00020102090401000001020000090401010101022000072401080901100b24020140040901b04f42090501090004"], 0x0) kernel console output (not intermixed with test programs): .099040][ T2377] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 91.204159][ T2382] netlink: 228 bytes leftover after parsing attributes in process `syz.3.782'. [ 91.529882][ T558] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 91.679895][ T558] usb 1-1: Using ep0 maxpacket: 32 [ 91.686423][ T558] usb 1-1: config 0 has an invalid interface number: 67 but max is 0 [ 91.694609][ T558] usb 1-1: config 0 has no interface number 0 [ 91.702296][ T558] usb 1-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 91.711404][ T558] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 91.719426][ T558] usb 1-1: Product: syz [ 91.723649][ T558] usb 1-1: Manufacturer: syz [ 91.728279][ T558] usb 1-1: SerialNumber: syz [ 91.733789][ T558] usb 1-1: config 0 descriptor?? [ 91.739857][ T558] smsc95xx v2.0.0 [ 91.739934][ T486] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 91.831341][ T10] aiptek 3-1:17.0: Aiptek using 400 ms programming speed [ 91.840527][ T10] input: Aiptek as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:17.0/input/input10 [ 91.856216][ T10] usb 3-1: USB disconnect, device number 26 [ 91.856329][ C1] aiptek 3-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 91.899890][ T486] usb 2-1: Using ep0 maxpacket: 16 [ 91.910617][ T486] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 91.920820][ T486] usb 2-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 91.931271][ T486] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 91.949967][ T486] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 91.958027][ T486] usb 2-1: SerialNumber: syz [ 92.075351][ T2413] FAULT_INJECTION: forcing a failure. [ 92.075351][ T2413] name failslab, interval 1, probability 0, space 0, times 0 [ 92.088062][ T2413] CPU: 0 UID: 0 PID: 2413 Comm: syz.3.795 Not tainted syzkaller #0 f10dc98c92500eb86b2a5bf5b389293121b4eb86 [ 92.088099][ T2413] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 92.088115][ T2413] Call Trace: [ 92.088124][ T2413] [ 92.088134][ T2413] __dump_stack+0x21/0x30 [ 92.088175][ T2413] dump_stack_lvl+0x140/0x1c0 [ 92.088199][ T2413] ? __cfi_dump_stack_lvl+0x10/0x10 [ 92.088224][ T2413] ? kasan_save_alloc_info+0x3a/0x50 [ 92.088272][ T2413] ? __kasan_kmalloc+0x96/0xb0 [ 92.088299][ T2413] dump_stack+0x19/0x20 [ 92.088331][ T2413] should_fail_ex+0x3c2/0x510 [ 92.088350][ T2413] ? ovl_fill_super+0x39a/0x3c10 [ 92.088370][ T2413] should_failslab+0xac/0x100 [ 92.088406][ T2413] __kmalloc_noprof+0x69/0x510 [ 92.088430][ T2413] ? ovl_fill_super+0x39a/0x3c10 [ 92.088457][ T2413] ovl_fill_super+0x39a/0x3c10 [ 92.088484][ T2413] ? __kasan_check_write+0x18/0x20 [ 92.088500][ T2413] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 92.088521][ T2413] ? xas_find_marked+0xc97/0xda0 [ 92.088560][ T2413] ? xas_nomem+0x71/0x2c0 [ 92.088587][ T2413] ? __kmalloc_cache_noprof+0x23c/0x470 [ 92.088633][ T2413] ? __cfi_ovl_fill_super+0x10/0x10 [ 92.088653][ T2413] ? __kasan_check_write+0x18/0x20 [ 92.088668][ T2413] ? mutex_unlock+0x90/0x240 [ 92.088709][ T2413] ? __cfi_mutex_unlock+0x10/0x10 [ 92.088739][ T2413] ? __kasan_check_write+0x18/0x20 [ 92.088765][ T2413] ? _raw_spin_lock+0x92/0x120 [ 92.088783][ T2413] ? __kasan_check_write+0x18/0x20 [ 92.088799][ T2413] ? shrinker_register+0x162/0x220 [ 92.088817][ T2413] ? sget_fc+0x97e/0xa70 [ 92.088856][ T2413] ? __cfi_set_anon_super_fc+0x10/0x10 [ 92.088892][ T2413] get_tree_nodev+0xcb/0x170 [ 92.088924][ T2413] ? __cfi_ovl_fill_super+0x10/0x10 [ 92.088944][ T2413] ovl_get_tree+0x20/0x30 [ 92.088961][ T2413] vfs_get_tree+0xa1/0x290 [ 92.088992][ T2413] do_new_mount+0x251/0xb40 [ 92.089015][ T2413] ? security_capable+0x44/0x130 [ 92.089041][ T2413] path_mount+0x66a/0xff0 [ 92.089065][ T2413] ? putname+0x113/0x150 [ 92.089083][ T2413] __se_sys_mount+0x2bf/0x480 [ 92.089102][ T2413] ? ksys_write+0x1f3/0x260 [ 92.089132][ T2413] ? __x64_sys_mount+0xf0/0xf0 [ 92.089158][ T2413] __x64_sys_mount+0xc3/0xf0 [ 92.089182][ T2413] x64_sys_call+0x2021/0x2ee0 [ 92.089207][ T2413] do_syscall_64+0x57/0xf0 [ 92.089225][ T2413] ? clear_bhb_loop+0x50/0xa0 [ 92.089247][ T2413] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 92.089282][ T2413] RIP: 0033:0x7f7925f9de99 [ 92.089302][ T2413] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.089324][ T2413] RSP: 002b:00007f7926f11028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 92.089353][ T2413] RAX: ffffffffffffffda RBX: 00007f7926225fa0 RCX: 00007f7925f9de99 [ 92.089367][ T2413] RDX: 0000200000000000 RSI: 0000200000000100 RDI: 0000000000000000 [ 92.089379][ T2413] RBP: 00007f7926f11090 R08: 0000200000000140 R09: 0000000000000000 [ 92.089391][ T2413] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 92.089401][ T2413] R13: 00007f7926226038 R14: 00007f7926225fa0 R15: 00007ffc0d7684f8 [ 92.089430][ T2413] [ 92.142492][ T558] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 92.266751][ T2415] netlink: 228 bytes leftover after parsing attributes in process `syz.3.796'. [ 92.281643][ T558] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 92.438271][ T2419] netlink: 12 bytes leftover after parsing attributes in process `syz.2.798'. [ 92.577102][ T2426] netlink: 8 bytes leftover after parsing attributes in process `syz.2.801'. [ 92.589939][ T486] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 92.636542][ T558] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 92.647425][ T558] smsc95xx 1-1:0.67: probe with driver smsc95xx failed with error -71 [ 92.658745][ T558] usb 1-1: USB disconnect, device number 25 [ 92.749918][ T486] usb 4-1: Using ep0 maxpacket: 32 [ 92.756306][ T486] usb 4-1: config 0 has an invalid interface number: 188 but max is 0 [ 92.764656][ T486] usb 4-1: config 0 has no interface number 0 [ 92.771114][ T486] usb 4-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 92.782655][ T486] usb 4-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 92.792935][ T486] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 92.803738][ T486] usb 4-1: Product: syz [ 92.807950][ T486] usb 4-1: Manufacturer: syz [ 92.812670][ T486] usb 4-1: SerialNumber: syz [ 92.820143][ T486] usb 4-1: config 0 descriptor?? [ 92.826486][ T9] usb 2-1: USB disconnect, device number 35 [ 92.833597][ T2417] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 92.879031][ T2435] netlink: 8 bytes leftover after parsing attributes in process `syz.1.804'. [ 93.043564][ T2417] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 93.239887][ T558] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 93.271032][ T2445] FAULT_INJECTION: forcing a failure. [ 93.271032][ T2445] name failslab, interval 1, probability 0, space 0, times 0 [ 93.283867][ T2445] CPU: 1 UID: 0 PID: 2445 Comm: syz.0.809 Not tainted syzkaller #0 f10dc98c92500eb86b2a5bf5b389293121b4eb86 [ 93.283906][ T2445] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 93.283921][ T2445] Call Trace: [ 93.283930][ T2445] [ 93.283940][ T2445] __dump_stack+0x21/0x30 [ 93.283978][ T2445] dump_stack_lvl+0x140/0x1c0 [ 93.284013][ T2445] ? __cfi_dump_stack_lvl+0x10/0x10 [ 93.284059][ T2445] dump_stack+0x19/0x20 [ 93.284090][ T2445] should_fail_ex+0x3c2/0x510 [ 93.284116][ T2445] ? ovl_fill_super+0x40a/0x3c10 [ 93.284143][ T2445] should_failslab+0xac/0x100 [ 93.284172][ T2445] __kmalloc_noprof+0x69/0x510 [ 93.284217][ T2445] ? ovl_fill_super+0x40a/0x3c10 [ 93.284246][ T2445] ovl_fill_super+0x40a/0x3c10 [ 93.284272][ T2445] ? __kasan_check_write+0x18/0x20 [ 93.284305][ T2445] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 93.284325][ T2445] ? xas_find_marked+0xc97/0xda0 [ 93.284360][ T2445] ? xas_nomem+0x71/0x2c0 [ 93.284389][ T2445] ? __kmalloc_cache_noprof+0x23c/0x470 [ 93.284413][ T2445] ? __cfi_ovl_fill_super+0x10/0x10 [ 93.284446][ T2445] ? __kasan_check_write+0x18/0x20 [ 93.284469][ T2445] ? mutex_unlock+0x90/0x240 [ 93.284491][ T2445] ? __cfi_mutex_unlock+0x10/0x10 [ 93.284536][ T2445] ? __kasan_check_write+0x18/0x20 [ 93.284563][ T2445] ? _raw_spin_lock+0x92/0x120 [ 93.284592][ T2445] ? __kasan_check_write+0x18/0x20 [ 93.284609][ T2445] ? shrinker_register+0x162/0x220 [ 93.284626][ T2445] ? sget_fc+0x97e/0xa70 [ 93.284663][ T2445] ? __cfi_set_anon_super_fc+0x10/0x10 [ 93.284699][ T2445] get_tree_nodev+0xcb/0x170 [ 93.284733][ T2445] ? __cfi_ovl_fill_super+0x10/0x10 [ 93.284758][ T2445] ovl_get_tree+0x20/0x30 [ 93.284776][ T2445] vfs_get_tree+0xa1/0x290 [ 93.284791][ T2445] do_new_mount+0x251/0xb40 [ 93.284828][ T2445] ? security_capable+0x44/0x130 [ 93.284854][ T2445] path_mount+0x66a/0xff0 [ 93.284876][ T2445] ? putname+0x113/0x150 [ 93.284908][ T2445] __se_sys_mount+0x2bf/0x480 [ 93.284925][ T2445] ? ksys_write+0x1f3/0x260 [ 93.284942][ T2445] ? __x64_sys_mount+0xf0/0xf0 [ 93.284981][ T2445] __x64_sys_mount+0xc3/0xf0 [ 93.285006][ T2445] x64_sys_call+0x2021/0x2ee0 [ 93.285026][ T2445] do_syscall_64+0x57/0xf0 [ 93.285055][ T2445] ? clear_bhb_loop+0x50/0xa0 [ 93.285078][ T2445] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 93.285099][ T2445] RIP: 0033:0x7fd35df9de99 [ 93.285133][ T2445] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.285155][ T2445] RSP: 002b:00007fd35ee9f028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 93.285181][ T2445] RAX: ffffffffffffffda RBX: 00007fd35e225fa0 RCX: 00007fd35df9de99 [ 93.285199][ T2445] RDX: 0000200000000000 RSI: 0000200000000100 RDI: 0000000000000000 [ 93.285222][ T2445] RBP: 00007fd35ee9f090 R08: 0000200000000140 R09: 0000000000000000 [ 93.285234][ T2445] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 93.285249][ T2445] R13: 00007fd35e226038 R14: 00007fd35e225fa0 R15: 00007ffe34467978 [ 93.285282][ T2445] [ 93.452540][ T486] asix 4-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 93.579944][ T558] usb 2-1: Using ep0 maxpacket: 32 [ 93.584573][ T486] asix 4-1:0.188: probe with driver asix failed with error -61 [ 93.594879][ T558] usb 2-1: unable to get BOS descriptor or descriptor too short [ 93.628146][ T558] usb 2-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 93.637328][ T558] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.645437][ T558] usb 2-1: Product: syz [ 93.649774][ T558] usb 2-1: Manufacturer: syz [ 93.654441][ T558] usb 2-1: SerialNumber: syz [ 93.677483][ T2451] netlink: 228 bytes leftover after parsing attributes in process `syz.2.811'. [ 93.698802][ T9] usb 4-1: USB disconnect, device number 27 [ 93.859930][ T486] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 93.867088][ T558] usb 2-1: unit 4 not found! [ 93.872237][ T558] usb 2-1: unit 0 not found! [ 94.011129][ T486] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 94.020914][ T486] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 94.034899][ T486] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 94.044300][ T486] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 94.052529][ T486] usb 1-1: SerialNumber: syz [ 94.058449][ T2447] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 94.066628][ T36] audit: type=1400 audit(2000000048.400:371): avc: denied { write } for pid=2440 comm="syz.1.807" name="rt_cache" dev="proc" ino=4026532382 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 94.077112][ T558] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 94.099656][ T558] usb 2-1: unit 4 not found! [ 94.104338][ T558] usb 2-1: unit 0 not found! [ 94.110597][ T558] snd-usb-audio 2-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 94.120708][ T558] usb 2-1: unit 4 not found! [ 94.125353][ T558] usb 2-1: unit 0 not found! [ 94.134412][ T558] snd-usb-audio 2-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 94.144573][ T558] usb 2-1: USB disconnect, device number 36 [ 94.156407][ T365] udevd[365]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.2/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 94.459980][ T9] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 94.609884][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 94.616506][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 94.627027][ T9] usb 4-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 94.637371][ T9] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 94.646576][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 94.654826][ T9] usb 4-1: SerialNumber: syz [ 94.669890][ T558] usb 3-1: new full-speed USB device number 27 using dummy_hcd [ 94.821302][ T558] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 94.832386][ T558] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 94.845460][ T558] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2ced, bcdDevice= 0.00 [ 94.854592][ T558] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.863676][ T558] usb 3-1: config 0 descriptor?? [ 94.949893][ T1071] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 95.072507][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.079377][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.086476][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.093452][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.100407][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.107236][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.114116][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.121072][ T1071] usb 2-1: Using ep0 maxpacket: 32 [ 95.126305][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.133434][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.140458][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.147496][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.154467][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.161434][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.168462][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.175749][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.182651][ T1071] usb 2-1: config 0 has an invalid interface number: 188 but max is 0 [ 95.190959][ T1071] usb 2-1: config 0 has no interface number 0 [ 95.197177][ T1071] usb 2-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 95.207281][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.214345][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.221376][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.228270][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.235222][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.242114][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.249089][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.255996][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.262940][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.269959][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.276850][ T1071] usb 2-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 95.286004][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.292847][ T1071] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.300996][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.307919][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.314857][ T1071] usb 2-1: Product: syz [ 95.319149][ T1071] usb 2-1: Manufacturer: syz [ 95.323881][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.330922][ T1071] usb 2-1: SerialNumber: syz [ 95.336131][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.343233][ T1071] usb 2-1: config 0 descriptor?? [ 95.348327][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.355216][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.355389][ T2473] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 95.362310][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.376614][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.383495][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.390344][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.397223][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.404114][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.410975][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.417816][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.424734][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.426161][ T9] usb 4-1: USB disconnect, device number 28 [ 95.431584][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.431618][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.451454][ T558] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 95.470215][ T558] kone 0003:1E7D:2CED.0006: hidraw0: USB HID v80.09 Device [HID 1e7d:2ced] on usb-dummy_hcd.2-1/input0 [ 95.502746][ T558] usb 3-1: USB disconnect, device number 27 [ 95.577047][ T2473] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 95.792320][ T2485] FAULT_INJECTION: forcing a failure. [ 95.792320][ T2485] name failslab, interval 1, probability 0, space 0, times 0 [ 95.805131][ T2485] CPU: 0 UID: 0 PID: 2485 Comm: syz.2.825 Not tainted syzkaller #0 f10dc98c92500eb86b2a5bf5b389293121b4eb86 [ 95.805170][ T2485] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 95.805184][ T2485] Call Trace: [ 95.805191][ T2485] [ 95.805201][ T2485] __dump_stack+0x21/0x30 [ 95.805238][ T2485] dump_stack_lvl+0x140/0x1c0 [ 95.805268][ T2485] ? __cfi_dump_stack_lvl+0x10/0x10 [ 95.805299][ T2485] dump_stack+0x19/0x20 [ 95.805326][ T2485] should_fail_ex+0x3c2/0x510 [ 95.805350][ T2485] ? ovl_fill_super+0x40a/0x3c10 [ 95.805376][ T2485] should_failslab+0xac/0x100 [ 95.805402][ T2485] __kmalloc_noprof+0x69/0x510 [ 95.805423][ T2485] ? ovl_fill_super+0x40a/0x3c10 [ 95.805450][ T2485] ovl_fill_super+0x40a/0x3c10 [ 95.805474][ T2485] ? __kasan_check_write+0x18/0x20 [ 95.805495][ T2485] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 95.805522][ T2485] ? xas_find_marked+0xc97/0xda0 [ 95.805557][ T2485] ? xas_nomem+0x71/0x2c0 [ 95.805581][ T2485] ? __kmalloc_cache_noprof+0x23c/0x470 [ 95.805604][ T2485] ? __cfi_ovl_fill_super+0x10/0x10 [ 95.805629][ T2485] ? __kasan_check_write+0x18/0x20 [ 95.805651][ T2485] ? mutex_unlock+0x90/0x240 [ 95.805679][ T2485] ? __cfi_mutex_unlock+0x10/0x10 [ 95.805707][ T2485] ? __kasan_check_write+0x18/0x20 [ 95.805727][ T2485] ? _raw_spin_lock+0x92/0x120 [ 95.805749][ T2485] ? __kasan_check_write+0x18/0x20 [ 95.805770][ T2485] ? shrinker_register+0x162/0x220 [ 95.805793][ T2485] ? sget_fc+0x97e/0xa70 [ 95.805821][ T2485] ? __cfi_set_anon_super_fc+0x10/0x10 [ 95.805853][ T2485] get_tree_nodev+0xcb/0x170 [ 95.805883][ T2485] ? __cfi_ovl_fill_super+0x10/0x10 [ 95.805909][ T2485] ovl_get_tree+0x20/0x30 [ 95.805932][ T2485] vfs_get_tree+0xa1/0x290 [ 95.805951][ T2485] do_new_mount+0x251/0xb40 [ 95.805973][ T2485] ? security_capable+0x44/0x130 [ 95.805996][ T2485] path_mount+0x66a/0xff0 [ 95.806015][ T2485] ? putname+0x113/0x150 [ 95.806040][ T2485] __se_sys_mount+0x2bf/0x480 [ 95.806065][ T2485] ? ksys_write+0x1f3/0x260 [ 95.806086][ T2485] ? __x64_sys_mount+0xf0/0xf0 [ 95.806109][ T2485] __x64_sys_mount+0xc3/0xf0 [ 95.806130][ T2485] x64_sys_call+0x2021/0x2ee0 [ 95.806149][ T2485] do_syscall_64+0x57/0xf0 [ 95.806171][ T2485] ? clear_bhb_loop+0x50/0xa0 [ 95.806202][ T2485] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 95.806228][ T2485] RIP: 0033:0x7fc458b9de99 [ 95.806246][ T2485] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.806265][ T2485] RSP: 002b:00007fc45999a028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 95.806288][ T2485] RAX: ffffffffffffffda RBX: 00007fc458e25fa0 RCX: 00007fc458b9de99 [ 95.806305][ T2485] RDX: 0000200000000000 RSI: 0000200000000100 RDI: 0000000000000000 [ 95.806322][ T2485] RBP: 00007fc45999a090 R08: 0000200000000140 R09: 0000000000000000 [ 95.806337][ T2485] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 95.806350][ T2485] R13: 00007fc458e26038 R14: 00007fc458e25fa0 R15: 00007ffcbe812558 [ 95.806369][ T2485] [ 96.112694][ T1071] asix 2-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 96.126968][ T1071] asix 2-1:0.188: probe with driver asix failed with error -61 [ 96.315248][ T9] usb 2-1: USB disconnect, device number 37 [ 96.410122][ T36] audit: type=1400 audit(2000000050.740:372): avc: denied { getopt } for pid=2488 comm="syz.3.827" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 96.495957][ T2492] netlink: 228 bytes leftover after parsing attributes in process `syz.3.828'. [ 96.500681][ T486] cdc_ether 1-1:1.0: probe with driver cdc_ether failed with error -71 [ 96.520706][ T486] usb 1-1: USB disconnect, device number 26 [ 97.102792][ T36] audit: type=1400 audit(2000000051.430:373): avc: denied { read } for pid=2514 comm="syz.1.837" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 97.122510][ T36] audit: type=1400 audit(2000000051.430:374): avc: denied { map } for pid=2514 comm="syz.1.837" path="socket:[14329]" dev="sockfs" ino=14329 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 97.146054][ T36] audit: type=1400 audit(2000000051.430:375): avc: denied { read } for pid=2514 comm="syz.1.837" path="socket:[14329]" dev="sockfs" ino=14329 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 97.183030][ T2520] rust_binder: 427: no such ref 0 [ 97.229941][ T9] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 97.237594][ T486] usb 3-1: new full-speed USB device number 28 using dummy_hcd [ 97.371345][ T2528] FAULT_INJECTION: forcing a failure. [ 97.371345][ T2528] name failslab, interval 1, probability 0, space 0, times 0 [ 97.384092][ T2528] CPU: 0 UID: 0 PID: 2528 Comm: syz.1.842 Not tainted syzkaller #0 f10dc98c92500eb86b2a5bf5b389293121b4eb86 [ 97.384125][ T2528] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 97.384137][ T2528] Call Trace: [ 97.384144][ T2528] [ 97.384151][ T2528] __dump_stack+0x21/0x30 [ 97.384179][ T2528] dump_stack_lvl+0x140/0x1c0 [ 97.384202][ T2528] ? __cfi_dump_stack_lvl+0x10/0x10 [ 97.384227][ T2528] dump_stack+0x19/0x20 [ 97.384249][ T2528] should_fail_ex+0x3c2/0x510 [ 97.384269][ T2528] should_failslab+0xac/0x100 [ 97.384290][ T2528] kmem_cache_alloc_noprof+0x42/0x410 [ 97.384307][ T2528] ? security_inode_alloc+0x51/0x230 [ 97.384328][ T2528] ? __cfi_make_kgid+0x10/0x10 [ 97.384349][ T2528] security_inode_alloc+0x51/0x230 [ 97.384369][ T2528] inode_init_always_gfp+0x756/0x9e0 [ 97.384390][ T2528] ? __cfi_ovl_inode_test+0x10/0x10 [ 97.384411][ T2528] ? __cfi_ovl_alloc_inode+0x10/0x10 [ 97.384431][ T2528] alloc_inode+0xc5/0x270 [ 97.384451][ T2528] ? __cfi_ovl_inode_set+0x10/0x10 [ 97.384471][ T2528] ? __cfi_ovl_inode_test+0x10/0x10 [ 97.384492][ T2528] iget5_locked+0x53/0xb0 [ 97.384512][ T2528] ? __cfi_ovl_inode_set+0x10/0x10 [ 97.384540][ T2528] ovl_get_trap_inode+0x91/0x1c0 [ 97.384561][ T2528] ovl_fill_super+0x868/0x3c10 [ 97.384580][ T2528] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 97.384600][ T2528] ? xas_find_marked+0xc97/0xda0 [ 97.384621][ T2528] ? xas_nomem+0x71/0x2c0 [ 97.384641][ T2528] ? __cfi_ovl_fill_super+0x10/0x10 [ 97.384662][ T2528] ? __kasan_check_write+0x18/0x20 [ 97.384677][ T2528] ? mutex_unlock+0x90/0x240 [ 97.384699][ T2528] ? __cfi_mutex_unlock+0x10/0x10 [ 97.384721][ T2528] ? __kasan_check_write+0x18/0x20 [ 97.384739][ T2528] ? sget_fc+0x97e/0xa70 [ 97.384762][ T2528] ? __cfi_set_anon_super_fc+0x10/0x10 [ 97.384787][ T2528] get_tree_nodev+0xcb/0x170 [ 97.384811][ T2528] ? __cfi_ovl_fill_super+0x10/0x10 [ 97.384830][ T2528] ovl_get_tree+0x20/0x30 [ 97.384848][ T2528] vfs_get_tree+0xa1/0x290 [ 97.384864][ T2528] do_new_mount+0x251/0xb40 [ 97.384880][ T2528] ? security_capable+0x44/0x130 [ 97.384899][ T2528] path_mount+0x66a/0xff0 [ 97.384914][ T2528] ? putname+0x113/0x150 [ 97.384933][ T2528] __se_sys_mount+0x2bf/0x480 [ 97.384949][ T2528] ? ksys_write+0x1f3/0x260 [ 97.384966][ T2528] ? __x64_sys_mount+0xf0/0xf0 [ 97.384985][ T2528] __x64_sys_mount+0xc3/0xf0 [ 97.385001][ T2528] x64_sys_call+0x2021/0x2ee0 [ 97.385017][ T2528] do_syscall_64+0x57/0xf0 [ 97.385034][ T2528] ? clear_bhb_loop+0x50/0xa0 [ 97.385057][ T2528] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 97.385078][ T2528] RIP: 0033:0x7fd752f9de99 [ 97.385092][ T2528] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 97.385107][ T2528] RSP: 002b:00007fd753efc028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 97.385125][ T2528] RAX: ffffffffffffffda RBX: 00007fd753225fa0 RCX: 00007fd752f9de99 [ 97.385138][ T2528] RDX: 0000200000000000 RSI: 0000200000000100 RDI: 0000000000000000 [ 97.385150][ T2528] RBP: 00007fd753efc090 R08: 0000200000000140 R09: 0000000000000000 [ 97.385162][ T2528] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 97.385173][ T2528] R13: 00007fd753226038 R14: 00007fd753225fa0 R15: 00007ffe64943b58 [ 97.385187][ T2528] [ 97.715009][ T367] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 97.724803][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 97.730517][ T486] usb 3-1: config 0 interface 0 altsetting 32 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 97.741742][ T486] usb 3-1: config 0 interface 0 altsetting 32 endpoint 0x81 has invalid maxpacket 1015, setting to 64 [ 97.749787][ T2530] netlink: 228 bytes leftover after parsing attributes in process `syz.1.843'. [ 97.752842][ T486] usb 3-1: config 0 interface 0 has no altsetting 0 [ 97.768437][ T486] usb 3-1: New USB device found, idVendor=056a, idProduct=0343, bcdDevice= 0.00 [ 97.777540][ T486] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 97.786799][ T486] usb 3-1: config 0 descriptor?? [ 97.794716][ T2504] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 97.798977][ T9] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 97.815786][ T9] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 97.825759][ T9] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 97.834908][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 97.842979][ T9] usb 1-1: SerialNumber: syz [ 97.889888][ T367] usb 4-1: Using ep0 maxpacket: 32 [ 97.896078][ T367] usb 4-1: config 0 has an invalid interface number: 188 but max is 0 [ 97.904353][ T367] usb 4-1: config 0 has no interface number 0 [ 97.910538][ T367] usb 4-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 97.922110][ T367] usb 4-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 97.931257][ T367] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 97.939285][ T367] usb 4-1: Product: syz [ 97.943539][ T367] usb 4-1: Manufacturer: syz [ 97.948176][ T367] usb 4-1: SerialNumber: syz [ 97.953636][ T367] usb 4-1: config 0 descriptor?? [ 97.958982][ T2522] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 98.049872][ T67] usb 2-1: new low-speed USB device number 38 using dummy_hcd [ 98.167619][ T2522] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 98.201505][ T67] usb 2-1: unable to get BOS descriptor or descriptor too short [ 98.209270][ T67] usb 2-1: too many configurations: 252, using maximum allowed: 8 [ 98.218274][ T67] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 98.226285][ T67] usb 2-1: can't read configurations, error -61 [ 98.228094][ T36] audit: type=1400 audit(2000000052.560:376): avc: denied { setcurrent } for pid=2502 comm="syz.2.834" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 98.254744][ T486] wacom 0003:056A:0343.0007: unknown main item tag 0x0 [ 98.261709][ T486] wacom 0003:056A:0343.0007: unknown main item tag 0x6 [ 98.268598][ T486] wacom 0003:056A:0343.0007: unknown main item tag 0x3 [ 98.275622][ T486] wacom 0003:056A:0343.0007: item fetching failed at offset 39/40 [ 98.283722][ T486] wacom 0003:056A:0343.0007: parse failed [ 98.289502][ T486] wacom 0003:056A:0343.0007: probe with driver wacom failed with error -22 [ 98.359944][ T67] usb 2-1: new low-speed USB device number 39 using dummy_hcd [ 98.455250][ T486] usb 3-1: USB disconnect, device number 28 [ 98.511490][ T67] usb 2-1: unable to get BOS descriptor or descriptor too short [ 98.519320][ T67] usb 2-1: too many configurations: 252, using maximum allowed: 8 [ 98.528648][ T67] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 98.536310][ T67] usb 2-1: can't read configurations, error -61 [ 98.542773][ T67] usb usb2-port1: attempt power cycle [ 98.576116][ T367] asix 4-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 98.586921][ T367] asix 4-1:0.188: probe with driver asix failed with error -61 [ 98.595589][ T558] usb 1-1: USB disconnect, device number 27 [ 98.631759][ T2536] tipc: Started in network mode [ 98.636823][ T2536] tipc: Node identity ac14140f, cluster identity 4711 [ 98.643885][ T2536] tipc: New replicast peer: 255.255.255.255 [ 98.650226][ T2536] tipc: Enabled bearer , priority 10 [ 98.778293][ T486] usb 4-1: USB disconnect, device number 29 [ 98.879909][ T67] usb 2-1: new low-speed USB device number 40 using dummy_hcd [ 98.911667][ T67] usb 2-1: unable to get BOS descriptor or descriptor too short [ 98.919470][ T67] usb 2-1: too many configurations: 252, using maximum allowed: 8 [ 98.928554][ T67] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 98.936537][ T67] usb 2-1: can't read configurations, error -61 [ 98.974274][ T36] audit: type=1400 audit(2000000053.300:377): avc: denied { read } for pid=2537 comm="syz.2.847" name="uvc.usb0" dev="configfs" ino=15533 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 98.996957][ T36] audit: type=1400 audit(2000000053.300:378): avc: denied { open } for pid=2537 comm="syz.2.847" path="/211/my_configfs/usb_gadget/g1/functions/uvc.usb0" dev="configfs" ino=15533 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 99.079973][ T67] usb 2-1: new low-speed USB device number 41 using dummy_hcd [ 99.101594][ T67] usb 2-1: unable to get BOS descriptor or descriptor too short [ 99.109314][ T67] usb 2-1: too many configurations: 252, using maximum allowed: 8 [ 99.128263][ T67] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 99.136094][ T67] usb 2-1: can't read configurations, error -61 [ 99.142900][ T67] usb usb2-port1: unable to enumerate USB device [ 99.172113][ T2549] netlink: 964 bytes leftover after parsing attributes in process `syz.0.850'. [ 99.539922][ T67] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 99.564702][ T2563] netlink: 4080 bytes leftover after parsing attributes in process `syz.2.856'. [ 99.690064][ T67] usb 4-1: Using ep0 maxpacket: 16 [ 99.696461][ T67] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 99.706623][ T67] usb 4-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 99.716440][ T67] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 99.725652][ T67] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 99.733770][ T67] usb 4-1: SerialNumber: syz [ 99.769900][ T67] tipc: Node number set to 2886997007 [ 99.812908][ T2569] FAULT_INJECTION: forcing a failure. [ 99.812908][ T2569] name failslab, interval 1, probability 0, space 0, times 0 [ 99.825669][ T2569] CPU: 1 UID: 0 PID: 2569 Comm: syz.0.858 Not tainted syzkaller #0 f10dc98c92500eb86b2a5bf5b389293121b4eb86 [ 99.825707][ T2569] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 99.825719][ T2569] Call Trace: [ 99.825725][ T2569] [ 99.825733][ T2569] __dump_stack+0x21/0x30 [ 99.825761][ T2569] dump_stack_lvl+0x140/0x1c0 [ 99.825784][ T2569] ? __cfi_dump_stack_lvl+0x10/0x10 [ 99.825807][ T2569] ? avc_has_perm_noaudit+0x289/0x360 [ 99.825828][ T2569] dump_stack+0x19/0x20 [ 99.825850][ T2569] should_fail_ex+0x3c2/0x510 [ 99.825870][ T2569] should_failslab+0xac/0x100 [ 99.825891][ T2569] kmem_cache_alloc_noprof+0x42/0x410 [ 99.825908][ T2569] ? alloc_vfsmnt+0x31/0x610 [ 99.825933][ T2569] alloc_vfsmnt+0x31/0x610 [ 99.825956][ T2569] clone_mnt+0x6e/0xbe0 [ 99.825980][ T2569] ? is_subdir+0x145/0x160 [ 99.825999][ T2569] clone_private_mount+0x29d/0x330 [ 99.826016][ T2569] ovl_fill_super+0x102e/0x3c10 [ 99.826036][ T2569] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 99.826057][ T2569] ? xas_find_marked+0xc97/0xda0 [ 99.826080][ T2569] ? xas_nomem+0x71/0x2c0 [ 99.826102][ T2569] ? __cfi_ovl_fill_super+0x10/0x10 [ 99.826122][ T2569] ? __kasan_check_write+0x18/0x20 [ 99.826138][ T2569] ? mutex_unlock+0x90/0x240 [ 99.826161][ T2569] ? __cfi_mutex_unlock+0x10/0x10 [ 99.826183][ T2569] ? __kasan_check_write+0x18/0x20 [ 99.826201][ T2569] ? sget_fc+0x97e/0xa70 [ 99.826224][ T2569] ? __cfi_set_anon_super_fc+0x10/0x10 [ 99.826250][ T2569] get_tree_nodev+0xcb/0x170 [ 99.826274][ T2569] ? __cfi_ovl_fill_super+0x10/0x10 [ 99.826293][ T2569] ovl_get_tree+0x20/0x30 [ 99.826332][ T2569] vfs_get_tree+0xa1/0x290 [ 99.826349][ T2569] do_new_mount+0x251/0xb40 [ 99.826365][ T2569] ? security_capable+0x44/0x130 [ 99.826384][ T2569] path_mount+0x66a/0xff0 [ 99.826399][ T2569] ? putname+0x113/0x150 [ 99.826418][ T2569] __se_sys_mount+0x2bf/0x480 [ 99.826435][ T2569] ? ksys_write+0x1f3/0x260 [ 99.826452][ T2569] ? __x64_sys_mount+0xf0/0xf0 [ 99.826470][ T2569] __x64_sys_mount+0xc3/0xf0 [ 99.826487][ T2569] x64_sys_call+0x2021/0x2ee0 [ 99.826502][ T2569] do_syscall_64+0x57/0xf0 [ 99.826520][ T2569] ? clear_bhb_loop+0x50/0xa0 [ 99.826542][ T2569] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 99.826563][ T2569] RIP: 0033:0x7fd35df9de99 [ 99.826584][ T2569] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 99.826599][ T2569] RSP: 002b:00007fd35ee9f028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 99.826617][ T2569] RAX: ffffffffffffffda RBX: 00007fd35e225fa0 RCX: 00007fd35df9de99 [ 99.826630][ T2569] RDX: 0000200000000000 RSI: 0000200000000100 RDI: 0000000000000000 [ 99.826642][ T2569] RBP: 00007fd35ee9f090 R08: 0000200000000140 R09: 0000000000000000 [ 99.826655][ T2569] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 99.826665][ T2569] R13: 00007fd35e226038 R14: 00007fd35e225fa0 R15: 00007ffe34467978 [ 99.826681][ T2569] [ 99.826689][ T2569] overlayfs: failed to clone upperpath [ 100.128317][ T367] usb 4-1: USB disconnect, device number 30 [ 100.149472][ T2571] netlink: 228 bytes leftover after parsing attributes in process `syz.0.859'. [ 100.172822][ T2573] batadv_slave_1: entered promiscuous mode [ 100.179572][ T36] audit: type=1400 audit(2000000054.500:379): avc: denied { accept } for pid=2572 comm="syz.0.860" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 100.183011][ T2572] batadv_slave_1: left promiscuous mode [ 100.259914][ T67] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 100.285906][ T2577] netlink: 'syz.0.862': attribute type 29 has an invalid length. [ 100.293813][ T2577] netlink: 64138 bytes leftover after parsing attributes in process `syz.0.862'. [ 100.411024][ T67] usb 3-1: config 0 has no interfaces? [ 100.416612][ T67] usb 3-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 100.425799][ T67] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 100.434475][ T67] usb 3-1: config 0 descriptor?? [ 100.599903][ T558] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 100.660183][ T2566] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 100.670286][ T2566] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 100.742478][ T367] usb 3-1: USB disconnect, device number 29 [ 100.749861][ T558] usb 1-1: Using ep0 maxpacket: 32 [ 100.760743][ T558] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 100.769288][ T558] usb 1-1: config 0 has no interface number 0 [ 100.779864][ T558] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 100.808243][ T558] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 100.829915][ T558] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 100.845685][ T558] usb 1-1: Product: syz [ 100.854758][ T558] usb 1-1: Manufacturer: syz [ 100.859495][ T558] usb 1-1: SerialNumber: syz [ 100.864951][ T558] usb 1-1: config 0 descriptor?? [ 100.870317][ T2579] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 101.078865][ T2579] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 101.168677][ T36] audit: type=1400 audit(2000000055.490:380): avc: denied { setattr } for pid=2607 comm="syz.1.873" name="[io_uring]" dev="anon_inodefs" ino=16659 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 101.347570][ T2614] netlink: 228 bytes leftover after parsing attributes in process `syz.2.876'. [ 101.361001][ T2615] FAULT_INJECTION: forcing a failure. [ 101.361001][ T2615] name failslab, interval 1, probability 0, space 0, times 0 [ 101.376724][ T2615] CPU: 0 UID: 0 PID: 2615 Comm: syz.1.875 Not tainted syzkaller #0 f10dc98c92500eb86b2a5bf5b389293121b4eb86 [ 101.376762][ T2615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 101.376776][ T2615] Call Trace: [ 101.376783][ T2615] [ 101.376793][ T2615] __dump_stack+0x21/0x30 [ 101.376831][ T2615] dump_stack_lvl+0x140/0x1c0 [ 101.376862][ T2615] ? __cfi_dump_stack_lvl+0x10/0x10 [ 101.376894][ T2615] ? xas_find_marked+0xc97/0xda0 [ 101.376930][ T2615] ? xas_nomem+0x71/0x2c0 [ 101.376958][ T2615] dump_stack+0x19/0x20 [ 101.376989][ T2615] should_fail_ex+0x3c2/0x510 [ 101.377016][ T2615] should_failslab+0xac/0x100 [ 101.377046][ T2615] __kmalloc_node_track_caller_noprof+0x65/0x4f0 [ 101.377074][ T2615] ? kstrdup_const+0x45/0x60 [ 101.377109][ T2615] kstrdup+0x4d/0x130 [ 101.377143][ T2615] ? kstrdup_const+0x3a/0x60 [ 101.377178][ T2615] kstrdup_const+0x45/0x60 [ 101.377212][ T2615] alloc_vfsmnt+0xed/0x610 [ 101.377246][ T2615] clone_mnt+0x6e/0xbe0 [ 101.377280][ T2615] ? is_subdir+0x145/0x160 [ 101.377307][ T2615] clone_private_mount+0x29d/0x330 [ 101.377333][ T2615] ovl_fill_super+0x102e/0x3c10 [ 101.377363][ T2615] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 101.377392][ T2615] ? xas_find_marked+0xc97/0xda0 [ 101.377423][ T2615] ? xas_nomem+0x71/0x2c0 [ 101.377453][ T2615] ? __cfi_ovl_fill_super+0x10/0x10 [ 101.377483][ T2615] ? __kasan_check_write+0x18/0x20 [ 101.377504][ T2615] ? mutex_unlock+0x90/0x240 [ 101.377535][ T2615] ? __cfi_mutex_unlock+0x10/0x10 [ 101.377565][ T2615] ? __kasan_check_write+0x18/0x20 [ 101.377590][ T2615] ? sget_fc+0x97e/0xa70 [ 101.377632][ T2615] ? __cfi_set_anon_super_fc+0x10/0x10 [ 101.377672][ T2615] get_tree_nodev+0xcb/0x170 [ 101.377707][ T2615] ? __cfi_ovl_fill_super+0x10/0x10 [ 101.377734][ T2615] ovl_get_tree+0x20/0x30 [ 101.377759][ T2615] vfs_get_tree+0xa1/0x290 [ 101.377781][ T2615] do_new_mount+0x251/0xb40 [ 101.377804][ T2615] ? security_capable+0x44/0x130 [ 101.377831][ T2615] path_mount+0x66a/0xff0 [ 101.377854][ T2615] ? putname+0x113/0x150 [ 101.377882][ T2615] __se_sys_mount+0x2bf/0x480 [ 101.377906][ T2615] ? ksys_write+0x1f3/0x260 [ 101.377929][ T2615] ? __x64_sys_mount+0xf0/0xf0 [ 101.377953][ T2615] __x64_sys_mount+0xc3/0xf0 [ 101.377978][ T2615] x64_sys_call+0x2021/0x2ee0 [ 101.378000][ T2615] do_syscall_64+0x57/0xf0 [ 101.378027][ T2615] ? clear_bhb_loop+0x50/0xa0 [ 101.378060][ T2615] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 101.378091][ T2615] RIP: 0033:0x7fd752f9de99 [ 101.378112][ T2615] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.378134][ T2615] RSP: 002b:00007fd753efc028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 101.378160][ T2615] RAX: ffffffffffffffda RBX: 00007fd753225fa0 RCX: 00007fd752f9de99 [ 101.378179][ T2615] RDX: 0000200000000000 RSI: 0000200000000100 RDI: 0000000000000000 [ 101.378197][ T2615] RBP: 00007fd753efc090 R08: 0000200000000140 R09: 0000000000000000 [ 101.378214][ T2615] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 101.378243][ T2615] R13: 00007fd753226038 R14: 00007fd753225fa0 R15: 00007ffe64943b58 [ 101.378265][ T2615] [ 101.507958][ T2615] overlayfs: failed to clone upperpath [ 101.608217][ T2617] netlink: 'syz.3.877': attribute type 27 has an invalid length. [ 101.608920][ T558] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 101.719246][ T558] asix 1-1:0.188: probe with driver asix failed with error -61 [ 101.759682][ T367] usb 1-1: USB disconnect, device number 28 [ 101.839996][ T46] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 101.990940][ T46] usb 3-1: config 220 has an invalid interface number: 76 but max is 2 [ 101.999285][ T46] usb 3-1: config 220 contains an unexpected descriptor of type 0x1, skipping [ 102.008223][ T46] usb 3-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 102.018610][ T46] usb 3-1: config 220 has no interface number 2 [ 102.025200][ T46] usb 3-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 102.038705][ T46] usb 3-1: config 220 interface 0 has no altsetting 0 [ 102.045596][ T46] usb 3-1: config 220 interface 76 has no altsetting 0 [ 102.052534][ T46] usb 3-1: config 220 interface 1 has no altsetting 0 [ 102.060725][ T46] usb 3-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 102.069785][ T46] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 102.078316][ T46] usb 3-1: Product: syz [ 102.082843][ T46] usb 3-1: Manufacturer: syz [ 102.087511][ T46] usb 3-1: SerialNumber: syz [ 102.200047][ T558] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 102.264215][ T2650] netlink: 228 bytes leftover after parsing attributes in process `syz.1.891'. [ 102.307539][ T2658] FAULT_INJECTION: forcing a failure. [ 102.307539][ T2658] name failslab, interval 1, probability 0, space 0, times 0 [ 102.320254][ T2658] CPU: 1 UID: 0 PID: 2658 Comm: syz.1.895 Not tainted syzkaller #0 f10dc98c92500eb86b2a5bf5b389293121b4eb86 [ 102.320292][ T2658] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 102.320309][ T2658] Call Trace: [ 102.320317][ T2658] [ 102.320328][ T2658] __dump_stack+0x21/0x30 [ 102.320371][ T2658] dump_stack_lvl+0x140/0x1c0 [ 102.320405][ T2658] ? __cfi_dump_stack_lvl+0x10/0x10 [ 102.320440][ T2658] ? xas_find_marked+0xc97/0xda0 [ 102.320473][ T2658] ? xas_nomem+0x71/0x2c0 [ 102.320502][ T2658] dump_stack+0x19/0x20 [ 102.320534][ T2658] should_fail_ex+0x3c2/0x510 [ 102.320581][ T2658] should_failslab+0xac/0x100 [ 102.320612][ T2658] __kmalloc_node_track_caller_noprof+0x65/0x4f0 [ 102.320641][ T2658] ? kstrdup_const+0x45/0x60 [ 102.320676][ T2658] kstrdup+0x4d/0x130 [ 102.320709][ T2658] ? kstrdup_const+0x3a/0x60 [ 102.320744][ T2658] kstrdup_const+0x45/0x60 [ 102.320778][ T2658] alloc_vfsmnt+0xed/0x610 [ 102.320813][ T2658] clone_mnt+0x6e/0xbe0 [ 102.320848][ T2658] ? is_subdir+0x145/0x160 [ 102.320875][ T2658] clone_private_mount+0x29d/0x330 [ 102.320900][ T2658] ovl_fill_super+0x102e/0x3c10 [ 102.320929][ T2658] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 102.320966][ T2658] ? xas_find_marked+0xc97/0xda0 [ 102.320998][ T2658] ? xas_nomem+0x71/0x2c0 [ 102.321027][ T2658] ? __cfi_ovl_fill_super+0x10/0x10 [ 102.321058][ T2658] ? __kasan_check_write+0x18/0x20 [ 102.321082][ T2658] ? mutex_unlock+0x90/0x240 [ 102.321114][ T2658] ? __cfi_mutex_unlock+0x10/0x10 [ 102.321147][ T2658] ? __kasan_check_write+0x18/0x20 [ 102.321174][ T2658] ? sget_fc+0x97e/0xa70 [ 102.321206][ T2658] ? __cfi_set_anon_super_fc+0x10/0x10 [ 102.321243][ T2658] get_tree_nodev+0xcb/0x170 [ 102.321278][ T2658] ? __cfi_ovl_fill_super+0x10/0x10 [ 102.321306][ T2658] ovl_get_tree+0x20/0x30 [ 102.321333][ T2658] vfs_get_tree+0xa1/0x290 [ 102.321357][ T2658] do_new_mount+0x251/0xb40 [ 102.321381][ T2658] ? security_capable+0x44/0x130 [ 102.321409][ T2658] path_mount+0x66a/0xff0 [ 102.321432][ T2658] ? putname+0x113/0x150 [ 102.321459][ T2658] __se_sys_mount+0x2bf/0x480 [ 102.321486][ T2658] ? ksys_write+0x1f3/0x260 [ 102.321512][ T2658] ? __x64_sys_mount+0xf0/0xf0 [ 102.321538][ T2658] __x64_sys_mount+0xc3/0xf0 [ 102.321564][ T2658] x64_sys_call+0x2021/0x2ee0 [ 102.321586][ T2658] do_syscall_64+0x57/0xf0 [ 102.321613][ T2658] ? clear_bhb_loop+0x50/0xa0 [ 102.321645][ T2658] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 102.321676][ T2658] RIP: 0033:0x7fd752f9de99 [ 102.321698][ T2658] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 102.321718][ T2658] RSP: 002b:00007fd753efc028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 102.321744][ T2658] RAX: ffffffffffffffda RBX: 00007fd753225fa0 RCX: 00007fd752f9de99 [ 102.321763][ T2658] RDX: 0000200000000000 RSI: 0000200000000100 RDI: 0000000000000000 [ 102.321781][ T2658] RBP: 00007fd753efc090 R08: 0000200000000140 R09: 0000000000000000 [ 102.321798][ T2658] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 102.321813][ T2658] R13: 00007fd753226038 R14: 00007fd753225fa0 R15: 00007ffe64943b58 [ 102.321835][ T2658] [ 102.321876][ T2658] overlayfs: failed to clone upperpath [ 102.649875][ T367] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 102.659861][ T558] usb 4-1: Using ep0 maxpacket: 16 [ 102.666235][ T558] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 248, changing to 11 [ 102.677650][ T558] usb 4-1: New USB device found, idVendor=04d9, idProduct=a0c2, bcdDevice= 0.00 [ 102.686850][ T558] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.695954][ T558] usb 4-1: config 0 descriptor?? [ 102.713670][ T46] usb 3-1: selecting invalid altsetting 0 [ 102.719656][ T46] usb 3-1: Found UVC 7.01 device syz (8086:0b07) [ 102.726110][ T46] usb 3-1: No valid video chain found. [ 102.736584][ T46] usb 3-1: USB disconnect, device number 30 [ 102.779623][ T36] audit: type=1400 audit(2000000057.100:381): avc: denied { setopt } for pid=2662 comm="syz.1.897" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 102.800245][ T367] usb 1-1: device descriptor read/64, error -71 [ 103.039963][ T367] usb 1-1: device descriptor read/64, error -71 [ 103.103618][ T558] holtek_mouse 0003:04D9:A0C2.0008: unknown main item tag 0x1 [ 103.111312][ T558] holtek_mouse 0003:04D9:A0C2.0008: unknown main item tag 0x4 [ 103.118862][ T558] holtek_mouse 0003:04D9:A0C2.0008: unknown main item tag 0xd [ 103.127151][ T558] holtek_mouse 0003:04D9:A0C2.0008: hidraw0: USB HID vf.49 Device [HID 04d9:a0c2] on usb-dummy_hcd.3-1/input0 [ 103.279916][ T367] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 103.317924][ T2673] syz.2.900 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 103.405242][ T2678] kvm: apic: phys broadcast and lowest prio [ 103.411311][ T367] usb 1-1: device descriptor read/64, error -71 [ 103.649909][ T367] usb 1-1: device descriptor read/64, error -71 [ 103.759980][ T367] usb usb1-port1: attempt power cycle [ 103.859900][ T9] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 104.009884][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 104.016271][ T9] usb 2-1: config 0 has an invalid interface number: 188 but max is 0 [ 104.024715][ T9] usb 2-1: config 0 has no interface number 0 [ 104.031223][ T9] usb 2-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 104.043017][ T9] usb 2-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 104.052334][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 104.060418][ T9] usb 2-1: Product: syz [ 104.064612][ T9] usb 2-1: Manufacturer: syz [ 104.069259][ T9] usb 2-1: SerialNumber: syz [ 104.074695][ T9] usb 2-1: config 0 descriptor?? [ 104.080061][ T2681] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 104.099886][ T367] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 104.120979][ T367] usb 1-1: device descriptor read/8, error -71 [ 104.250977][ T367] usb 1-1: device descriptor read/8, error -71 [ 104.288225][ T2681] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 104.489893][ T367] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 104.510981][ T367] usb 1-1: device descriptor read/8, error -71 [ 104.640833][ T367] usb 1-1: device descriptor read/8, error -71 [ 104.698389][ T9] asix 2-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 104.708685][ T9] asix 2-1:0.188: probe with driver asix failed with error -61 [ 104.749984][ T367] usb usb1-port1: unable to enumerate USB device [ 104.900536][ T9] usb 2-1: USB disconnect, device number 42 [ 104.965153][ T67] usb 4-1: USB disconnect, device number 31 [ 105.036228][ T2691] netlink: 228 bytes leftover after parsing attributes in process `syz.3.906'. [ 105.087312][ T2698] FAULT_INJECTION: forcing a failure. [ 105.087312][ T2698] name failslab, interval 1, probability 0, space 0, times 0 [ 105.100267][ T2698] CPU: 0 UID: 0 PID: 2698 Comm: syz.2.909 Not tainted syzkaller #0 f10dc98c92500eb86b2a5bf5b389293121b4eb86 [ 105.100302][ T2698] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 105.100318][ T2698] Call Trace: [ 105.100327][ T2698] [ 105.100336][ T2698] __dump_stack+0x21/0x30 [ 105.100376][ T2698] dump_stack_lvl+0x140/0x1c0 [ 105.100408][ T2698] ? __cfi_dump_stack_lvl+0x10/0x10 [ 105.100441][ T2698] ? __kasan_check_write+0x18/0x20 [ 105.100466][ T2698] ? _raw_spin_lock+0x92/0x120 [ 105.100493][ T2698] dump_stack+0x19/0x20 [ 105.100524][ T2698] should_fail_ex+0x3c2/0x510 [ 105.100551][ T2698] should_failslab+0xac/0x100 [ 105.100578][ T2698] ? __cfi_ovl_inode_test+0x10/0x10 [ 105.100607][ T2698] kmem_cache_alloc_lru_noprof+0x44/0x410 [ 105.100633][ T2698] ? ovl_alloc_inode+0x3b/0x130 [ 105.100661][ T2698] ? __cfi_ovl_inode_test+0x10/0x10 [ 105.100690][ T2698] ? __cfi_ovl_alloc_inode+0x10/0x10 [ 105.100717][ T2698] ovl_alloc_inode+0x3b/0x130 [ 105.100744][ T2698] ? __cfi_ovl_inode_test+0x10/0x10 [ 105.100773][ T2698] ? __cfi_ovl_alloc_inode+0x10/0x10 [ 105.100801][ T2698] alloc_inode+0x7a/0x270 [ 105.100831][ T2698] ? __cfi_mutex_unlock+0x10/0x10 [ 105.100863][ T2698] ? __cfi_ovl_inode_set+0x10/0x10 [ 105.100892][ T2698] ? __cfi_ovl_inode_test+0x10/0x10 [ 105.100922][ T2698] iget5_locked+0x53/0xb0 [ 105.100951][ T2698] ? __cfi_ovl_inode_set+0x10/0x10 [ 105.100981][ T2698] ovl_get_trap_inode+0x91/0x1c0 [ 105.101012][ T2698] ovl_get_workdir+0x259/0x16d0 [ 105.101041][ T2698] ? pcpu_alloc_noprof+0xd93/0x1440 [ 105.101069][ T2698] ? ovl_fill_super+0x3c10/0x3c10 [ 105.101097][ T2698] ? __kasan_check_write+0x18/0x20 [ 105.101120][ T2698] ? _raw_spin_lock+0x92/0x120 [ 105.101146][ T2698] ? __cfi__raw_spin_lock+0x10/0x10 [ 105.101171][ T2698] ? __asan_memset+0x39/0x50 [ 105.101195][ T2698] ? __kasan_check_write+0x18/0x20 [ 105.101228][ T2698] ? _raw_spin_lock+0x92/0x120 [ 105.101254][ T2698] ? __cfi__raw_spin_lock+0x10/0x10 [ 105.101281][ T2698] ? __kasan_check_write+0x18/0x20 [ 105.101304][ T2698] ? up_read+0x26/0x1c0 [ 105.101339][ T2698] ? _raw_spin_unlock+0x45/0x60 [ 105.101365][ T2698] ? ovl_inuse_trylock+0xbd/0x110 [ 105.101392][ T2698] ovl_fill_super+0x1521/0x3c10 [ 105.101421][ T2698] ? xas_find_marked+0xc97/0xda0 [ 105.101452][ T2698] ? xas_nomem+0x71/0x2c0 [ 105.101482][ T2698] ? __cfi_ovl_fill_super+0x10/0x10 [ 105.101512][ T2698] ? __kasan_check_write+0x18/0x20 [ 105.101536][ T2698] ? mutex_unlock+0x90/0x240 [ 105.101567][ T2698] ? __cfi_mutex_unlock+0x10/0x10 [ 105.101600][ T2698] ? __kasan_check_write+0x18/0x20 [ 105.101626][ T2698] ? sget_fc+0x97e/0xa70 [ 105.101658][ T2698] ? __cfi_set_anon_super_fc+0x10/0x10 [ 105.101695][ T2698] get_tree_nodev+0xcb/0x170 [ 105.101730][ T2698] ? __cfi_ovl_fill_super+0x10/0x10 [ 105.101758][ T2698] ovl_get_tree+0x20/0x30 [ 105.101784][ T2698] vfs_get_tree+0xa1/0x290 [ 105.101808][ T2698] do_new_mount+0x251/0xb40 [ 105.101832][ T2698] ? security_capable+0x44/0x130 [ 105.101860][ T2698] path_mount+0x66a/0xff0 [ 105.101882][ T2698] ? putname+0x113/0x150 [ 105.101909][ T2698] __se_sys_mount+0x2bf/0x480 [ 105.101934][ T2698] ? ksys_write+0x1f3/0x260 [ 105.101959][ T2698] ? __x64_sys_mount+0xf0/0xf0 [ 105.101985][ T2698] __x64_sys_mount+0xc3/0xf0 [ 105.102010][ T2698] x64_sys_call+0x2021/0x2ee0 [ 105.102033][ T2698] do_syscall_64+0x57/0xf0 [ 105.102059][ T2698] ? clear_bhb_loop+0x50/0xa0 [ 105.102091][ T2698] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 105.102122][ T2698] RIP: 0033:0x7fc458b9de99 [ 105.102143][ T2698] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 105.102165][ T2698] RSP: 002b:00007fc45999a028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 105.102192][ T2698] RAX: ffffffffffffffda RBX: 00007fc458e25fa0 RCX: 00007fc458b9de99 [ 105.102211][ T2698] RDX: 0000200000000000 RSI: 0000200000000100 RDI: 0000000000000000 [ 105.102246][ T2698] RBP: 00007fc45999a090 R08: 0000200000000140 R09: 0000000000000000 [ 105.102264][ T2698] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 105.102280][ T2698] R13: 00007fc458e26038 R14: 00007fc458e25fa0 R15: 00007ffcbe812558 [ 105.102301][ T2698] [ 105.568020][ T2714] tipc: Failed to remove unknown binding: 66,0,0/0:2696873324/2696873326 [ 105.576623][ T2714] tipc: Failed to remove unknown binding: 66,0,0/0:2696873324/2696873325 [ 105.586061][ T2714] tipc: Failed to remove unknown binding: 66,0,0/0:2696873324/2696873326 [ 105.594665][ T2714] tipc: Failed to remove unknown binding: 66,0,0/0:2696873324/2696873325 [ 105.695607][ T36] audit: type=1326 audit(2000000060.020:382): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2721 comm="syz.3.919" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7925f9de99 code=0x7ffc0000 [ 105.720870][ T36] audit: type=1326 audit(2000000060.020:383): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2721 comm="syz.3.919" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7925f9de99 code=0x7ffc0000 [ 105.746830][ T36] audit: type=1326 audit(2000000060.020:384): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2721 comm="syz.3.919" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7925f9de99 code=0x7ffc0000 [ 105.772535][ T36] audit: type=1326 audit(2000000060.020:385): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2721 comm="syz.3.919" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7925f9de99 code=0x7ffc0000 [ 105.798008][ T36] audit: type=1326 audit(2000000060.020:386): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2721 comm="syz.3.919" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7f7925f9de99 code=0x7ffc0000 [ 105.817618][ T2726] netlink: 228 bytes leftover after parsing attributes in process `syz.1.921'. [ 105.823208][ T36] audit: type=1326 audit(2000000060.020:387): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2721 comm="syz.3.919" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7925f9de99 code=0x7ffc0000 [ 105.857593][ T36] audit: type=1326 audit(2000000060.020:388): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2721 comm="syz.3.919" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7925f9de99 code=0x7ffc0000 [ 105.883047][ T36] audit: type=1326 audit(2000000060.020:389): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2721 comm="syz.3.919" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=323 compat=0 ip=0x7f7925f9de99 code=0x7ffc0000 [ 105.884048][ T2728] SELinux: policydb version 2070343011 does not match my version range 15-33 [ 105.908231][ T36] audit: type=1326 audit(2000000060.020:390): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2721 comm="syz.3.919" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7925f9de99 code=0x7ffc0000 [ 105.942931][ T2728] SELinux: failed to load policy [ 105.949893][ T367] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 106.031383][ T9] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 106.059896][ T2741] FAULT_INJECTION: forcing a failure. [ 106.059896][ T2741] name failslab, interval 1, probability 0, space 0, times 0 [ 106.072694][ T2741] CPU: 0 UID: 0 PID: 2741 Comm: syz.1.926 Not tainted syzkaller #0 f10dc98c92500eb86b2a5bf5b389293121b4eb86 [ 106.072728][ T2741] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 106.072743][ T2741] Call Trace: [ 106.072751][ T2741] [ 106.072759][ T2741] __dump_stack+0x21/0x30 [ 106.072795][ T2741] dump_stack_lvl+0x140/0x1c0 [ 106.072826][ T2741] ? __cfi_dump_stack_lvl+0x10/0x10 [ 106.072859][ T2741] dump_stack+0x19/0x20 [ 106.072890][ T2741] should_fail_ex+0x3c2/0x510 [ 106.072916][ T2741] should_failslab+0xac/0x100 [ 106.072970][ T2741] kmem_cache_alloc_noprof+0x42/0x410 [ 106.072995][ T2741] ? security_inode_alloc+0x51/0x230 [ 106.073023][ T2741] ? __cfi_make_kgid+0x10/0x10 [ 106.073052][ T2741] security_inode_alloc+0x51/0x230 [ 106.073080][ T2741] inode_init_always_gfp+0x756/0x9e0 [ 106.073109][ T2741] ? __cfi_ovl_inode_test+0x10/0x10 [ 106.073137][ T2741] ? __cfi_ovl_alloc_inode+0x10/0x10 [ 106.073164][ T2741] alloc_inode+0xc5/0x270 [ 106.073190][ T2741] ? __cfi_mutex_unlock+0x10/0x10 [ 106.073221][ T2741] ? __cfi_ovl_inode_set+0x10/0x10 [ 106.073250][ T2741] ? __cfi_ovl_inode_test+0x10/0x10 [ 106.073278][ T2741] iget5_locked+0x53/0xb0 [ 106.073313][ T2741] ? __cfi_ovl_inode_set+0x10/0x10 [ 106.073334][ T2741] ovl_get_trap_inode+0x91/0x1c0 [ 106.073355][ T2741] ovl_get_workdir+0x259/0x16d0 [ 106.073376][ T2741] ? pcpu_alloc_noprof+0xd93/0x1440 [ 106.073395][ T2741] ? ovl_fill_super+0x3c10/0x3c10 [ 106.073415][ T2741] ? __kasan_check_write+0x18/0x20 [ 106.073431][ T2741] ? _raw_spin_lock+0x92/0x120 [ 106.073474][ T2741] ? __cfi__raw_spin_lock+0x10/0x10 [ 106.073499][ T2741] ? __asan_memset+0x39/0x50 [ 106.073522][ T2741] ? __kasan_check_write+0x18/0x20 [ 106.073545][ T2741] ? _raw_spin_lock+0x92/0x120 [ 106.073570][ T2741] ? __cfi__raw_spin_lock+0x10/0x10 [ 106.073595][ T2741] ? __kasan_check_write+0x18/0x20 [ 106.073627][ T2741] ? up_read+0x26/0x1c0 [ 106.073664][ T2741] ? _raw_spin_unlock+0x45/0x60 [ 106.073713][ T2741] ? ovl_inuse_trylock+0xbd/0x110 [ 106.073740][ T2741] ovl_fill_super+0x1521/0x3c10 [ 106.073770][ T2741] ? xas_find_marked+0xc97/0xda0 [ 106.073800][ T2741] ? xas_nomem+0x71/0x2c0 [ 106.073829][ T2741] ? __cfi_ovl_fill_super+0x10/0x10 [ 106.073857][ T2741] ? __kasan_check_write+0x18/0x20 [ 106.073884][ T2741] ? mutex_unlock+0x90/0x240 [ 106.073906][ T2741] ? __cfi_mutex_unlock+0x10/0x10 [ 106.073928][ T2741] ? __kasan_check_write+0x18/0x20 [ 106.073946][ T2741] ? sget_fc+0x97e/0xa70 [ 106.073969][ T2741] ? __cfi_set_anon_super_fc+0x10/0x10 [ 106.073994][ T2741] get_tree_nodev+0xcb/0x170 [ 106.074018][ T2741] ? __cfi_ovl_fill_super+0x10/0x10 [ 106.074037][ T2741] ovl_get_tree+0x20/0x30 [ 106.074055][ T2741] vfs_get_tree+0xa1/0x290 [ 106.074071][ T2741] do_new_mount+0x251/0xb40 [ 106.074088][ T2741] ? security_capable+0x44/0x130 [ 106.074107][ T2741] path_mount+0x66a/0xff0 [ 106.074126][ T2741] ? putname+0x113/0x150 [ 106.074144][ T2741] __se_sys_mount+0x2bf/0x480 [ 106.074161][ T2741] ? ksys_write+0x1f3/0x260 [ 106.074178][ T2741] ? __x64_sys_mount+0xf0/0xf0 [ 106.074196][ T2741] __x64_sys_mount+0xc3/0xf0 [ 106.074213][ T2741] x64_sys_call+0x2021/0x2ee0 [ 106.074229][ T2741] do_syscall_64+0x57/0xf0 [ 106.074246][ T2741] ? clear_bhb_loop+0x50/0xa0 [ 106.074268][ T2741] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 106.074289][ T2741] RIP: 0033:0x7fd752f9de99 [ 106.074304][ T2741] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 106.074318][ T2741] RSP: 002b:00007fd753efc028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 106.074336][ T2741] RAX: ffffffffffffffda RBX: 00007fd753225fa0 RCX: 00007fd752f9de99 [ 106.074349][ T2741] RDX: 0000200000000000 RSI: 0000200000000100 RDI: 0000000000000000 [ 106.074361][ T2741] RBP: 00007fd753efc090 R08: 0000200000000140 R09: 0000000000000000 [ 106.074372][ T2741] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 106.074383][ T2741] R13: 00007fd753226038 R14: 00007fd753225fa0 R15: 00007ffe64943b58 [ 106.074397][ T2741] [ 106.473675][ T367] usb 3-1: device descriptor read/64, error -71 [ 106.499168][ T2745] syzkaller1: entered promiscuous mode [ 106.504745][ T2745] syzkaller1: entered allmulticast mode [ 106.559903][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 106.568552][ T9] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 106.577708][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.585747][ T9] usb 4-1: Product: syz [ 106.589999][ T9] usb 4-1: Manufacturer: syz [ 106.594674][ T9] usb 4-1: SerialNumber: syz [ 106.604791][ T9] r8152-cfgselector 4-1: Unknown version 0x0000 [ 106.611093][ T9] r8152-cfgselector 4-1: config 0 descriptor?? [ 106.739923][ T367] usb 3-1: device descriptor read/64, error -71 [ 106.769886][ T383] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 106.919874][ T383] usb 1-1: Using ep0 maxpacket: 32 [ 106.926301][ T383] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 106.934726][ T383] usb 1-1: config 0 has no interface number 0 [ 106.940971][ T383] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 106.952553][ T383] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 106.961704][ T383] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.969726][ T383] usb 1-1: Product: syz [ 106.973930][ T383] usb 1-1: Manufacturer: syz [ 106.978551][ T383] usb 1-1: SerialNumber: syz [ 106.983325][ T367] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 106.991761][ T383] usb 1-1: config 0 descriptor?? [ 106.997396][ T2748] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 107.090464][ T387] r8152-cfgselector 4-1: USB disconnect, device number 32 [ 107.129911][ T367] usb 3-1: device descriptor read/64, error -71 [ 107.205564][ T2748] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 107.369925][ T367] usb 3-1: device descriptor read/64, error -71 [ 107.480074][ T367] usb usb3-port1: attempt power cycle [ 107.544773][ T2761] netlink: 228 bytes leftover after parsing attributes in process `syz.1.935'. [ 107.615933][ T383] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 107.630479][ T383] asix 1-1:0.188: probe with driver asix failed with error -61 [ 107.648452][ T2773] overlayfs: failed to create directory ./file0/work (errno: 13); mounting read-only [ 107.664162][ T2773] FAULT_INJECTION: forcing a failure. [ 107.664162][ T2773] name failslab, interval 1, probability 0, space 0, times 0 [ 107.676947][ T2773] CPU: 1 UID: 0 PID: 2773 Comm: syz.1.941 Not tainted syzkaller #0 f10dc98c92500eb86b2a5bf5b389293121b4eb86 [ 107.676983][ T2773] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 107.676997][ T2773] Call Trace: [ 107.677004][ T2773] [ 107.677013][ T2773] __dump_stack+0x21/0x30 [ 107.677048][ T2773] dump_stack_lvl+0x140/0x1c0 [ 107.677077][ T2773] ? __cfi_dump_stack_lvl+0x10/0x10 [ 107.677107][ T2773] ? __kasan_check_write+0x18/0x20 [ 107.677128][ T2773] ? _raw_spin_lock+0x92/0x120 [ 107.677151][ T2773] dump_stack+0x19/0x20 [ 107.677178][ T2773] should_fail_ex+0x3c2/0x510 [ 107.677202][ T2773] should_failslab+0xac/0x100 [ 107.677228][ T2773] ? __cfi_ovl_inode_test+0x10/0x10 [ 107.677254][ T2773] kmem_cache_alloc_lru_noprof+0x44/0x410 [ 107.677277][ T2773] ? ovl_alloc_inode+0x3b/0x130 [ 107.677302][ T2773] ? __cfi_ovl_inode_test+0x10/0x10 [ 107.677327][ T2773] ? __cfi_ovl_alloc_inode+0x10/0x10 [ 107.677352][ T2773] ovl_alloc_inode+0x3b/0x130 [ 107.677375][ T2773] ? __cfi_ovl_inode_test+0x10/0x10 [ 107.677401][ T2773] ? __cfi_ovl_alloc_inode+0x10/0x10 [ 107.677425][ T2773] alloc_inode+0x7a/0x270 [ 107.677450][ T2773] ? __cfi_ovl_inode_set+0x10/0x10 [ 107.677475][ T2773] ? __cfi_ovl_inode_test+0x10/0x10 [ 107.677501][ T2773] iget5_locked+0x53/0xb0 [ 107.677526][ T2773] ? __cfi_ovl_inode_set+0x10/0x10 [ 107.677553][ T2773] ovl_get_trap_inode+0x91/0x1c0 [ 107.677579][ T2773] ovl_fill_super+0x1d3d/0x3c10 [ 107.677607][ T2773] ? __cfi_ovl_fill_super+0x10/0x10 [ 107.677633][ T2773] ? __cfi_mutex_unlock+0x10/0x10 [ 107.677663][ T2773] ? __kasan_check_write+0x18/0x20 [ 107.677685][ T2773] ? sget_fc+0x97e/0xa70 [ 107.677713][ T2773] ? __cfi_set_anon_super_fc+0x10/0x10 [ 107.677751][ T2773] get_tree_nodev+0xcb/0x170 [ 107.677780][ T2773] ? __cfi_ovl_fill_super+0x10/0x10 [ 107.677805][ T2773] ovl_get_tree+0x20/0x30 [ 107.677827][ T2773] vfs_get_tree+0xa1/0x290 [ 107.677847][ T2773] do_new_mount+0x251/0xb40 [ 107.677867][ T2773] ? security_capable+0x44/0x130 [ 107.677890][ T2773] path_mount+0x66a/0xff0 [ 107.677910][ T2773] ? putname+0x113/0x150 [ 107.677949][ T2773] __se_sys_mount+0x2bf/0x480 [ 107.677972][ T2773] ? ksys_write+0x1f3/0x260 [ 107.677992][ T2773] ? __x64_sys_mount+0xf0/0xf0 [ 107.678016][ T2773] __x64_sys_mount+0xc3/0xf0 [ 107.678036][ T2773] x64_sys_call+0x2021/0x2ee0 [ 107.678056][ T2773] do_syscall_64+0x57/0xf0 [ 107.678078][ T2773] ? clear_bhb_loop+0x50/0xa0 [ 107.678106][ T2773] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 107.678132][ T2773] RIP: 0033:0x7fd752f9de99 [ 107.678151][ T2773] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 107.678169][ T2773] RSP: 002b:00007fd753efc028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 107.678192][ T2773] RAX: ffffffffffffffda RBX: 00007fd753225fa0 RCX: 00007fd752f9de99 [ 107.678208][ T2773] RDX: 0000200000000000 RSI: 0000200000000100 RDI: 0000000000000000 [ 107.678224][ T2773] RBP: 00007fd753efc090 R08: 0000200000000140 R09: 0000000000000000 [ 107.678239][ T2773] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 107.678253][ T2773] R13: 00007fd753226038 R14: 00007fd753225fa0 R15: 00007ffe64943b58 [ 107.678271][ T2773] [ 107.823677][ T367] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 107.891197][ T67] usb 1-1: USB disconnect, device number 33 [ 107.931468][ T367] usb 3-1: device descriptor read/8, error -71 [ 108.151348][ T367] usb 3-1: device descriptor read/8, error -71 [ 108.181467][ T2801] netlink: 228 bytes leftover after parsing attributes in process `syz.3.951'. [ 108.367842][ T36] kauditd_printk_skb: 76 callbacks suppressed [ 108.367864][ T36] audit: type=1400 audit(2000000062.688:467): avc: denied { cmd } for pid=2812 comm="syz.1.955" path="socket:[18461]" dev="sockfs" ino=18461 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 108.396828][ T367] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 108.420992][ T367] usb 3-1: device descriptor read/8, error -71 [ 108.431678][ T2813] kvm: vcpu 0: requested 128 ns lapic timer period limited to 200000 ns [ 108.440186][ T2813] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 108.550880][ T367] usb 3-1: device descriptor read/8, error -71 [ 108.580368][ T2820] overlayfs: failed to create directory ./file0/work (errno: 13); mounting read-only [ 108.590118][ T2820] FAULT_INJECTION: forcing a failure. [ 108.590118][ T2820] name failslab, interval 1, probability 0, space 0, times 0 [ 108.603161][ T2820] CPU: 1 UID: 0 PID: 2820 Comm: syz.3.957 Not tainted syzkaller #0 f10dc98c92500eb86b2a5bf5b389293121b4eb86 [ 108.603196][ T2820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 108.603212][ T2820] Call Trace: [ 108.603220][ T2820] [ 108.603230][ T2820] __dump_stack+0x21/0x30 [ 108.603270][ T2820] dump_stack_lvl+0x140/0x1c0 [ 108.603303][ T2820] ? __cfi_dump_stack_lvl+0x10/0x10 [ 108.603339][ T2820] dump_stack+0x19/0x20 [ 108.603371][ T2820] should_fail_ex+0x3c2/0x510 [ 108.603400][ T2820] should_failslab+0xac/0x100 [ 108.603430][ T2820] kmem_cache_alloc_noprof+0x42/0x410 [ 108.603455][ T2820] ? security_inode_alloc+0x51/0x230 [ 108.603485][ T2820] ? __cfi_make_kgid+0x10/0x10 [ 108.603514][ T2820] security_inode_alloc+0x51/0x230 [ 108.603544][ T2820] inode_init_always_gfp+0x756/0x9e0 [ 108.603575][ T2820] ? __cfi_ovl_inode_test+0x10/0x10 [ 108.603605][ T2820] ? __cfi_ovl_alloc_inode+0x10/0x10 [ 108.603634][ T2820] alloc_inode+0xc5/0x270 [ 108.603664][ T2820] ? __cfi_ovl_inode_set+0x10/0x10 [ 108.603694][ T2820] ? __cfi_ovl_inode_test+0x10/0x10 [ 108.603724][ T2820] iget5_locked+0x53/0xb0 [ 108.603755][ T2820] ? __cfi_ovl_inode_set+0x10/0x10 [ 108.603785][ T2820] ovl_get_trap_inode+0x91/0x1c0 [ 108.603816][ T2820] ovl_fill_super+0x1d3d/0x3c10 [ 108.603857][ T2820] ? __cfi_ovl_fill_super+0x10/0x10 [ 108.603888][ T2820] ? __cfi_mutex_unlock+0x10/0x10 [ 108.603921][ T2820] ? __kasan_check_write+0x18/0x20 [ 108.603950][ T2820] ? sget_fc+0x97e/0xa70 [ 108.603983][ T2820] ? __cfi_set_anon_super_fc+0x10/0x10 [ 108.604019][ T2820] get_tree_nodev+0xcb/0x170 [ 108.604054][ T2820] ? __cfi_ovl_fill_super+0x10/0x10 [ 108.604082][ T2820] ovl_get_tree+0x20/0x30 [ 108.604108][ T2820] vfs_get_tree+0xa1/0x290 [ 108.604132][ T2820] do_new_mount+0x251/0xb40 [ 108.604156][ T2820] ? security_capable+0x44/0x130 [ 108.604183][ T2820] path_mount+0x66a/0xff0 [ 108.604206][ T2820] ? putname+0x113/0x150 [ 108.604232][ T2820] __se_sys_mount+0x2bf/0x480 [ 108.604257][ T2820] ? ksys_write+0x1f3/0x260 [ 108.604282][ T2820] ? __x64_sys_mount+0xf0/0xf0 [ 108.604309][ T2820] __x64_sys_mount+0xc3/0xf0 [ 108.604334][ T2820] x64_sys_call+0x2021/0x2ee0 [ 108.604357][ T2820] do_syscall_64+0x57/0xf0 [ 108.604383][ T2820] ? clear_bhb_loop+0x50/0xa0 [ 108.604415][ T2820] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 108.604446][ T2820] RIP: 0033:0x7f7925f9de99 [ 108.604466][ T2820] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 108.604506][ T2820] RSP: 002b:00007f7926f11028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 108.604539][ T2820] RAX: ffffffffffffffda RBX: 00007f7926225fa0 RCX: 00007f7925f9de99 [ 108.604557][ T2820] RDX: 0000200000000000 RSI: 0000200000000100 RDI: 0000000000000000 [ 108.604607][ T2820] RBP: 00007f7926f11090 R08: 0000200000000140 R09: 0000000000000000 [ 108.604624][ T2820] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 108.604640][ T2820] R13: 00007f7926226038 R14: 00007f7926225fa0 R15: 00007ffc0d7684f8 [ 108.604662][ T2820] [ 108.660352][ T367] usb usb3-port1: unable to enumerate USB device [ 108.918557][ T9] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 109.028570][ T2834] netlink: 72 bytes leftover after parsing attributes in process `syz.3.963'. [ 109.037840][ T2834] netlink: 12 bytes leftover after parsing attributes in process `syz.3.963'. [ 109.047000][ T2834] netlink: 16 bytes leftover after parsing attributes in process `syz.3.963'. [ 109.065643][ T2834] rust_binder: 2833:2834 transaction to 0 failed: ENOENT [ 109.069864][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 109.091387][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 109.100313][ T9] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 109.110638][ T9] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 109.126348][ T9] usb 1-1: New USB device found, idVendor=0499, idProduct=1057, bcdDevice= 0.40 [ 109.137501][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 109.149893][ T9] usb 1-1: Product: syz [ 109.154199][ T9] usb 1-1: Manufacturer: syz [ 109.158929][ T9] usb 1-1: SerialNumber: syz [ 109.220016][ T36] audit: type=1400 audit(2000000063.538:468): avc: denied { associate } for pid=2843 comm="syz.3.967" name="bus" scontext=root:object_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 109.287515][ T2848] netlink: 228 bytes leftover after parsing attributes in process `syz.1.969'. [ 109.366139][ T2816] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 109.374905][ T2816] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 109.382795][ T67] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 109.386456][ T2816] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 109.399038][ T2816] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 109.407389][ T2816] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 109.416093][ T2816] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 109.424316][ T2816] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 109.432982][ T2816] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 109.443320][ T2816] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 109.453052][ T2816] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 109.469002][ T9] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 109.479044][ T9] usb 1-1: USB disconnect, device number 34 [ 109.488833][ T323] udevd[323]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 109.539849][ T67] usb 3-1: Using ep0 maxpacket: 32 [ 109.546121][ T67] usb 3-1: config 0 has an invalid interface number: 188 but max is 0 [ 109.554411][ T67] usb 3-1: config 0 has no interface number 0 [ 109.560590][ T67] usb 3-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 109.572076][ T67] usb 3-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 109.581184][ T67] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 109.589311][ T67] usb 3-1: Product: syz [ 109.594491][ T67] usb 3-1: Manufacturer: syz [ 109.599123][ T67] usb 3-1: SerialNumber: syz [ 109.604786][ T67] usb 3-1: config 0 descriptor?? [ 109.610150][ T2840] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 109.689852][ T367] usb 2-1: new full-speed USB device number 43 using dummy_hcd [ 109.818241][ T2840] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 109.841089][ T367] usb 2-1: config 0 interface 0 altsetting 88 has 1 endpoint descriptor, different from the interface descriptor's value: 13 [ 109.854258][ T367] usb 2-1: config 0 interface 0 has no altsetting 0 [ 109.861065][ T367] usb 2-1: New USB device found, idVendor=06a3, idProduct=0621, bcdDevice= 0.00 [ 109.870167][ T367] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 109.879051][ T367] usb 2-1: config 0 descriptor?? [ 110.226565][ T67] asix 3-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 110.230073][ T9] usb 1-1: new full-speed USB device number 35 using dummy_hcd [ 110.237110][ T67] asix 3-1:0.188: probe with driver asix failed with error -61 [ 110.286748][ T367] saitek 0003:06A3:0621.0009: unknown main item tag 0x0 [ 110.299849][ T367] saitek 0003:06A3:0621.0009: unknown main item tag 0x0 [ 110.306860][ T367] saitek 0003:06A3:0621.0009: unknown main item tag 0x0 [ 110.314139][ T367] saitek 0003:06A3:0621.0009: unknown main item tag 0x0 [ 110.321507][ T367] saitek 0003:06A3:0621.0009: unknown main item tag 0x0 [ 110.328695][ T367] saitek 0003:06A3:0621.0009: unknown main item tag 0x0 [ 110.335936][ T367] saitek 0003:06A3:0621.0009: unknown main item tag 0x0 [ 110.343122][ T367] saitek 0003:06A3:0621.0009: unknown main item tag 0x0 [ 110.350283][ T367] saitek 0003:06A3:0621.0009: unknown global tag 0xd [ 110.356999][ T367] saitek 0003:06A3:0621.0009: item 0 2 1 13 parsing failed [ 110.364724][ T367] saitek 0003:06A3:0621.0009: parse failed [ 110.370823][ T367] saitek 0003:06A3:0621.0009: probe with driver saitek failed with error -22 [ 110.401122][ T9] usb 1-1: too many endpoints for config 1 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 110.414454][ T9] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 30064, setting to 64 [ 110.425898][ T9] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 255 [ 110.442009][ T367] usb 3-1: USB disconnect, device number 35 [ 110.450639][ T9] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 110.460041][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 110.468064][ T9] usb 1-1: SerialNumber: syz [ 110.473713][ T2860] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 110.682331][ T9] cdc_acm 1-1:1.0: skipping garbage [ 110.689036][ T9] usb 1-1: USB disconnect, device number 35 [ 110.964135][ T2884] netlink: 228 bytes leftover after parsing attributes in process `syz.3.983'. [ 111.281318][ T2914] netlink: 228 bytes leftover after parsing attributes in process `syz.2.997'. [ 111.449888][ T67] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 111.599846][ T67] usb 1-1: Using ep0 maxpacket: 32 [ 111.606103][ T67] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 111.614392][ T67] usb 1-1: config 0 has no interface number 0 [ 111.620533][ T67] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 111.631988][ T67] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 111.641103][ T67] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.649123][ T67] usb 1-1: Product: syz [ 111.653360][ T67] usb 1-1: Manufacturer: syz [ 111.657980][ T67] usb 1-1: SerialNumber: syz [ 111.663373][ T67] usb 1-1: config 0 descriptor?? [ 111.668699][ T2906] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 111.852073][ T36] audit: type=1400 audit(2000000066.178:469): avc: denied { watch_reads } for pid=2938 comm="syz.3.1009" path="/269" dev="tmpfs" ino=1477 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 111.877112][ T2906] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 112.209146][ T2943] netlink: 228 bytes leftover after parsing attributes in process `syz.2.1011'. [ 112.285453][ T67] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 112.295777][ T67] asix 1-1:0.188: probe with driver asix failed with error -61 [ 112.333528][ T9] usb 2-1: USB disconnect, device number 43 [ 112.487186][ T486] usb 1-1: USB disconnect, device number 36 [ 112.589846][ T367] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 112.641385][ T2968] netlink: 228 bytes leftover after parsing attributes in process `syz.1.1023'. [ 112.740960][ T367] usb 3-1: config 0 descriptor has 1 excess byte, ignoring [ 112.748251][ T367] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 112.757979][ T367] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xA has an invalid bInterval 0, changing to 7 [ 112.770563][ T367] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 112.779724][ T367] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.788303][ T367] usb 3-1: Product: syz [ 112.792799][ T367] usb 3-1: Manufacturer: syz [ 112.797480][ T367] usb 3-1: SerialNumber: syz [ 112.803548][ T367] usb 3-1: config 0 descriptor?? [ 112.809042][ T2978] syzkaller1: entered promiscuous mode [ 112.814652][ T2978] syzkaller1: entered allmulticast mode [ 112.816064][ T367] usb 3-1: 0:0 : invalid sync pipe. is_playback 1, ep 0a, bSynchAddress f8 [ 112.826745][ T2978] overlayfs: conflicting options: metacopy=on,redirect_dir=follow [ 112.915498][ T2984] input: syz1 as /devices/virtual/input/input11 [ 112.941978][ T2986] FAULT_INJECTION: forcing a failure. [ 112.941978][ T2986] name failslab, interval 1, probability 0, space 0, times 0 [ 112.954780][ T2986] CPU: 1 UID: 0 PID: 2986 Comm: syz.1.1032 Not tainted syzkaller #0 f10dc98c92500eb86b2a5bf5b389293121b4eb86 [ 112.954813][ T2986] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 112.954829][ T2986] Call Trace: [ 112.954838][ T2986] [ 112.954847][ T2986] __dump_stack+0x21/0x30 [ 112.954886][ T2986] dump_stack_lvl+0x140/0x1c0 [ 112.954920][ T2986] ? __cfi_dump_stack_lvl+0x10/0x10 [ 112.954955][ T2986] dump_stack+0x19/0x20 [ 112.954986][ T2986] should_fail_ex+0x3c2/0x510 [ 112.955011][ T2986] should_failslab+0xac/0x100 [ 112.955039][ T2986] __kmalloc_node_noprof+0x69/0x500 [ 112.955062][ T2986] ? __kvmalloc_node_noprof+0x128/0x300 [ 112.955098][ T2986] __kvmalloc_node_noprof+0x128/0x300 [ 112.955134][ T2986] ? __cfi___kvmalloc_node_noprof+0x10/0x10 [ 112.955179][ T2986] traverse+0xfe/0x700 [ 112.955208][ T2986] ? mutex_lock+0x97/0x1d0 [ 112.955245][ T2986] ? __cfi_mutex_lock+0x10/0x10 [ 112.955295][ T2986] seq_read_iter+0xdbd/0xf30 [ 112.955330][ T2986] ? __asan_memset+0x39/0x50 [ 112.955359][ T2986] ? iov_iter_init+0xc0/0x180 [ 112.955382][ T2986] seq_read+0x368/0x490 [ 112.955403][ T2986] ? __cfi_seq_read+0x10/0x10 [ 112.955446][ T2986] ? __cfi_selinux_file_permission+0x10/0x10 [ 112.955482][ T2986] ? __import_iovec+0x5b9/0x7d0 [ 112.955520][ T2986] ? __cfi_seq_read+0x10/0x10 [ 112.955549][ T2986] proc_reg_read+0x1f7/0x2f0 [ 112.955576][ T2986] vfs_readv+0x5e4/0xa00 [ 112.955606][ T2986] ? __cfi_proc_reg_read+0x10/0x10 [ 112.955629][ T2986] ? do_readv+0x2e0/0x2e0 [ 112.955663][ T2986] ? __cfi_mutex_unlock+0x10/0x10 [ 112.955693][ T2986] __x64_sys_preadv+0x19f/0x2c0 [ 112.955716][ T2986] ? __cfi___x64_sys_preadv+0x10/0x10 [ 112.955739][ T2986] ? __kasan_check_read+0x15/0x20 [ 112.955776][ T2986] x64_sys_call+0x1ee9/0x2ee0 [ 112.955799][ T2986] do_syscall_64+0x57/0xf0 [ 112.955825][ T2986] ? clear_bhb_loop+0x50/0xa0 [ 112.955861][ T2986] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 112.955883][ T2986] RIP: 0033:0x7fd752f9de99 [ 112.955898][ T2986] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 112.955929][ T2986] RSP: 002b:00007fd753efc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 112.955955][ T2986] RAX: ffffffffffffffda RBX: 00007fd753225fa0 RCX: 00007fd752f9de99 [ 112.955973][ T2986] RDX: 0000000000000001 RSI: 0000200000004080 RDI: 0000000000000003 [ 112.955988][ T2986] RBP: 00007fd753efc090 R08: 0000000000000000 R09: 0000000000000000 [ 112.956009][ T2986] R10: 000000000000421a R11: 0000000000000246 R12: 0000000000000001 [ 112.956020][ T2986] R13: 00007fd753226038 R14: 00007fd753225fa0 R15: 00007ffe64943b58 [ 112.956035][ T2986] [ 113.018974][ T2987] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 113.106479][ T2990] netlink: 57 bytes leftover after parsing attributes in process `syz.1.1034'. [ 113.118138][ T2991] rust_binder: Write failure EFAULT in pid:642 [ 113.183687][ T2987] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 113.254248][ T2997] syzkaller1: left promiscuous mode [ 113.263315][ T2997] syzkaller1: left allmulticast mode [ 113.271459][ T367] usb 3-1: USB disconnect, device number 36 [ 113.283091][ T366] udevd[366]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 113.310664][ T36] audit: type=1400 audit(2000000067.638:470): avc: denied { accept } for pid=2998 comm="syz.0.1037" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 113.337416][ T3001] netlink: 228 bytes leftover after parsing attributes in process `syz.0.1038'. [ 113.409880][ T387] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 113.539877][ T387] usb 2-1: device descriptor read/64, error -71 [ 113.781655][ T387] usb 2-1: device descriptor read/64, error -71 [ 113.806126][ T36] audit: type=1400 audit(2000000068.128:471): avc: denied { mounton } for pid=3014 comm="syz.3.1044" path="/file0" dev="rootfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 113.837977][ T36] audit: type=1400 audit(2000000068.158:472): avc: denied { associate } for pid=3016 comm="syz.3.1044" name="core" scontext=root:object_r:etc_runtime_t tcontext=system_u:object_r:root_t tclass=filesystem permissive=1 [ 114.019858][ T387] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 114.029843][ T67] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 114.149973][ T387] usb 2-1: device descriptor read/64, error -71 [ 114.179815][ T67] usb 3-1: Using ep0 maxpacket: 32 [ 114.186296][ T67] usb 3-1: config 0 has an invalid interface number: 188 but max is 0 [ 114.194816][ T67] usb 3-1: config 0 has no interface number 0 [ 114.201174][ T67] usb 3-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 114.213292][ T67] usb 3-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 114.222659][ T67] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 114.230910][ T67] usb 3-1: Product: syz [ 114.235219][ T67] usb 3-1: Manufacturer: syz [ 114.240123][ T67] usb 3-1: SerialNumber: syz [ 114.244856][ T3025] FAULT_INJECTION: forcing a failure. [ 114.244856][ T3025] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 114.257990][ T3025] CPU: 0 UID: 0 PID: 3025 Comm: syz.0.1048 Not tainted syzkaller #0 f10dc98c92500eb86b2a5bf5b389293121b4eb86 [ 114.258025][ T3025] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 114.258040][ T3025] Call Trace: [ 114.258048][ T3025] [ 114.258058][ T3025] __dump_stack+0x21/0x30 [ 114.258096][ T3025] dump_stack_lvl+0x140/0x1c0 [ 114.258128][ T3025] ? __cfi_dump_stack_lvl+0x10/0x10 [ 114.258170][ T3025] ? check_stack_object+0x138/0x150 [ 114.258197][ T3025] dump_stack+0x19/0x20 [ 114.258228][ T3025] should_fail_ex+0x3c2/0x510 [ 114.258257][ T3025] should_fail+0xf/0x20 [ 114.258281][ T3025] should_fail_usercopy+0x1e/0x30 [ 114.258310][ T3025] _copy_to_user+0x24/0xa0 [ 114.258342][ T3025] simple_read_from_buffer+0xed/0x160 [ 114.258376][ T3025] proc_fail_nth_read+0x1aa/0x220 [ 114.258412][ T3025] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 114.258446][ T3025] ? bpf_lsm_file_permission+0xd/0x20 [ 114.258477][ T3025] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 114.258512][ T3025] vfs_read+0x28b/0xc70 [ 114.258536][ T3025] ? __cfi_vfs_read+0x10/0x10 [ 114.258560][ T3025] ? __kasan_check_write+0x18/0x20 [ 114.258583][ T3025] ? mutex_lock+0x97/0x1d0 [ 114.258616][ T3025] ? __cfi_mutex_lock+0x10/0x10 [ 114.258651][ T3025] ksys_read+0x145/0x260 [ 114.258674][ T3025] ? fput+0x1a4/0x230 [ 114.258703][ T3025] ? __cfi_ksys_read+0x10/0x10 [ 114.258727][ T3025] ? __x64_sys_preadv+0x215/0x2c0 [ 114.258755][ T3025] ? __kasan_check_read+0x15/0x20 [ 114.258779][ T3025] __x64_sys_read+0x7f/0x90 [ 114.258804][ T3025] x64_sys_call+0x2638/0x2ee0 [ 114.258827][ T3025] do_syscall_64+0x57/0xf0 [ 114.258854][ T3025] ? clear_bhb_loop+0x50/0xa0 [ 114.258885][ T3025] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 114.258916][ T3025] RIP: 0033:0x7fd35df5e6ce [ 114.258937][ T3025] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 114.258959][ T3025] RSP: 002b:00007fd35ee9efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 114.258985][ T3025] RAX: ffffffffffffffda RBX: 00007fd35ee9f6c0 RCX: 00007fd35df5e6ce [ 114.259003][ T3025] RDX: 000000000000000f RSI: 00007fd35ee9f0a0 RDI: 0000000000000004 [ 114.259019][ T3025] RBP: 00007fd35ee9f090 R08: 0000000000000000 R09: 0000000000000000 [ 114.259036][ T3025] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 114.259051][ T3025] R13: 00007fd35e226038 R14: 00007fd35e225fa0 R15: 00007ffe34467978 [ 114.259072][ T3025] [ 114.260177][ T67] usb 3-1: config 0 descriptor?? [ 114.510179][ T3013] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 114.555303][ T3028] kvm: MWAIT instruction emulated as NOP! [ 114.585549][ T36] audit: type=1326 audit(2000000068.908:473): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3031 comm="syz.3.1050" exe="/root/ci2-android-6-12-rust/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7925f9de99 code=0x0 [ 114.636944][ T36] audit: type=1326 audit(2000000068.958:474): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3031 comm="syz.3.1050" exe="/root/ci2-android-6-12-rust/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7925f9de99 code=0x0 [ 114.671929][ T387] usb 2-1: device descriptor read/64, error -71 [ 114.691974][ T3039] netlink: 228 bytes leftover after parsing attributes in process `syz.3.1052'. [ 114.718269][ T3013] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 114.791245][ T387] usb usb2-port1: attempt power cycle [ 115.017517][ T3070] netlink: 228 bytes leftover after parsing attributes in process `syz.3.1064'. [ 115.127203][ T67] asix 3-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 115.137416][ T387] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 115.145126][ T67] asix 3-1:0.188: probe with driver asix failed with error -61 [ 115.170869][ T387] usb 2-1: device descriptor read/8, error -71 [ 115.301081][ T387] usb 2-1: device descriptor read/8, error -71 [ 115.331448][ T67] usb 3-1: USB disconnect, device number 37 [ 115.539856][ T387] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 115.566410][ T387] usb 2-1: device descriptor read/8, error -71 [ 115.623924][ T3085] ip6gre0: mtu less than device minimum [ 115.701153][ T387] usb 2-1: device descriptor read/8, error -71 [ 115.811397][ T387] usb usb2-port1: unable to enumerate USB device [ 115.821904][ T3095] netlink: 228 bytes leftover after parsing attributes in process `syz.0.1076'. [ 116.013395][ T3111] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 116.233284][ T3131] netlink: 228 bytes leftover after parsing attributes in process `syz.1.1089'. [ 116.309887][ T67] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 116.404521][ T36] audit: type=1400 audit(2000000070.728:475): avc: denied { watch watch_reads } for pid=3150 comm="syz.2.1096" path="/260/file1" dev="tmpfs" ino=1420 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 116.461143][ T67] usb 1-1: config index 0 descriptor too short (expected 45, got 28) [ 116.469372][ T67] usb 1-1: config 1 descriptor has 1 excess byte, ignoring [ 116.476953][ T67] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 116.491844][ T67] usb 1-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 116.500972][ T67] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 116.509007][ T67] usb 1-1: Product: syz [ 116.513529][ T67] usb 1-1: Manufacturer: syz [ 116.518695][ T67] usb 1-1: SerialNumber: syz [ 116.540235][ T67] rtl8150 1-1:1.0: couldn't find required endpoints [ 116.548293][ T67] rtl8150 1-1:1.0: probe with driver rtl8150 failed with error -5 [ 116.738883][ T67] usb 1-1: USB disconnect, device number 37 [ 116.789860][ T486] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 116.939816][ T486] usb 3-1: Using ep0 maxpacket: 8 [ 116.946076][ T486] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 116.954447][ T486] usb 3-1: config 179 has no interface number 0 [ 116.960814][ T486] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 116.971923][ T486] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 116.983220][ T486] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 116.994407][ T486] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 117.005894][ T486] usb 3-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 117.019202][ T486] usb 3-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 117.028406][ T486] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 117.038002][ T3160] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 117.246133][ T3160] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 117.254845][ T3160] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 117.290689][ T3170] netlink: 228 bytes leftover after parsing attributes in process `syz.0.1103'. [ 117.316536][ T3174] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 117.471360][ T387] usb 3-1: USB disconnect, device number 38 [ 117.471506][ C0] xpad 3-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 117.485839][ C0] dummy_hcd dummy_hcd.2: timer fired with no URBs pending? [ 117.506915][ T3187] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1109'. [ 117.549915][ T67] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 117.598463][ T36] audit: type=1400 audit(2000000071.918:476): avc: denied { cmd } for pid=3193 comm="iou-wrk-3194" path="/dev/ublk-control" dev="devtmpfs" ino=82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=io_uring permissive=1 [ 117.622449][ T3195] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 117.631191][ T3195] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 117.649848][ T367] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 117.709825][ T67] usb 1-1: Using ep0 maxpacket: 16 [ 117.716992][ T67] usb 1-1: unable to get BOS descriptor or descriptor too short [ 117.725574][ T67] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 117.735783][ T67] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 117.746325][ T67] usb 1-1: New USB device found, idVendor=2b73, idProduct=0034, bcdDevice= 0.40 [ 117.755502][ T67] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.763722][ T67] usb 1-1: Product: syz [ 117.767975][ T67] usb 1-1: Manufacturer: syz [ 117.772841][ T67] usb 1-1: SerialNumber: syz [ 117.799826][ T367] usb 2-1: Using ep0 maxpacket: 32 [ 117.806304][ T367] usb 2-1: config 0 has an invalid interface number: 188 but max is 0 [ 117.814751][ T367] usb 2-1: config 0 has no interface number 0 [ 117.821068][ T367] usb 2-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 117.832849][ T367] usb 2-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 117.842100][ T367] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.850217][ T367] usb 2-1: Product: syz [ 117.854483][ T367] usb 2-1: Manufacturer: syz [ 117.859138][ T367] usb 2-1: SerialNumber: syz [ 117.864665][ T367] usb 2-1: config 0 descriptor?? [ 117.871660][ T3182] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 117.958107][ T36] audit: type=1400 audit(2000000072.278:477): avc: denied { accept } for pid=3205 comm="syz.2.1115" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 117.985879][ T67] usb 1-1: 1:1 : no or invalid class specific endpoint descriptor [ 117.994566][ T67] usb 1-1: 1:1 : format type 0 is detected, processed as PCM [ 118.002308][ T67] usb 1-1: 1:1 : sample bitwidth 249 in over sample bytes 4 [ 118.009927][ T67] usb 1-1: parse_audio_format_rates_v2v3(): unable to find clock source (clock -22) [ 118.015982][ T3206] syz.2.1115: vmalloc error: size 16781312, failed to allocated page array size 32776, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=syz2,mems_allowed=0 [ 118.021463][ T67] usb 1-1: unit 3 not found! [ 118.037661][ T3206] CPU: 0 UID: 0 PID: 3206 Comm: syz.2.1115 Not tainted syzkaller #0 f10dc98c92500eb86b2a5bf5b389293121b4eb86 [ 118.037766][ T3206] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 118.037808][ T3206] Call Trace: [ 118.037830][ T3206] [ 118.037861][ T3206] __dump_stack+0x21/0x30 [ 118.037964][ T3206] dump_stack_lvl+0x140/0x1c0 [ 118.038048][ T3206] ? __cfi_dump_stack_lvl+0x10/0x10 [ 118.038132][ T3206] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 118.038207][ T3206] dump_stack+0x19/0x20 [ 118.038289][ T3206] warn_alloc+0x1e7/0x2c0 [ 118.038366][ T3206] ? x64_sys_call+0x2adc/0x2ee0 [ 118.038419][ T3206] ? __cfi_warn_alloc+0x10/0x10 [ 118.038496][ T3206] ? __get_vm_area_node+0x150/0x390 [ 118.038580][ T3206] ? __get_vm_area_node+0x1f8/0x390 [ 118.038674][ T3206] ? __get_vm_area_node+0x276/0x390 [ 118.038759][ T3206] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 118.038895][ T3206] ? xskq_create+0xdb/0x290 [ 118.038985][ T3206] __vmalloc_node_range_noprof+0x65f/0x1300 [ 118.039091][ T3206] ? __cfi___vmalloc_node_range_noprof+0x10/0x10 [ 118.039214][ T3206] ? kasan_save_alloc_info+0x3a/0x50 [ 118.039306][ T3206] ? __kasan_kmalloc+0x96/0xb0 [ 118.039373][ T3206] ? __kmalloc_cache_noprof+0x23c/0x470 [ 118.039437][ T3206] vmalloc_user_noprof+0x77/0x90 [ 118.039523][ T3206] ? xskq_create+0xdb/0x290 [ 118.039596][ T3206] xskq_create+0xdb/0x290 [ 118.039677][ T3206] xsk_init_queue+0xb2/0x120 [ 118.039743][ T3206] xsk_setsockopt+0x4c5/0x760 [ 118.039815][ T3206] ? __cfi_xsk_setsockopt+0x10/0x10 [ 118.039889][ T3206] ? do_futex+0x32a/0x510 [ 118.039971][ T3206] ? bpf_lsm_socket_setsockopt+0xd/0x20 [ 118.040043][ T3206] ? security_socket_setsockopt+0x3d/0x100 [ 118.040126][ T3206] ? __cfi_xsk_setsockopt+0x10/0x10 [ 118.040211][ T3206] do_sock_setsockopt+0x27c/0x410 [ 118.040301][ T3206] ? __cfi_do_sock_setsockopt+0x10/0x10 [ 118.040367][ T3206] ? __fget_files+0x2bc/0x330 [ 118.040434][ T3206] __x64_sys_setsockopt+0x1b7/0x250 [ 118.040496][ T3206] x64_sys_call+0x2adc/0x2ee0 [ 118.040555][ T3206] do_syscall_64+0x57/0xf0 [ 118.040620][ T3206] ? clear_bhb_loop+0x50/0xa0 [ 118.040702][ T3206] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 118.040780][ T3206] RIP: 0033:0x7fc458b9de99 [ 118.040833][ T3206] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 118.040903][ T3206] RSP: 002b:00007fc45999a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 118.040969][ T3206] RAX: ffffffffffffffda RBX: 00007fc458e25fa0 RCX: 00007fc458b9de99 [ 118.041019][ T3206] RDX: 0000000000000003 RSI: 000000000000011b RDI: 0000000000000007 [ 118.041061][ T3206] RBP: 00007fc458c33eaf R08: 0000000000000004 R09: 0000000000000000 [ 118.041101][ T3206] R10: 0000200000000200 R11: 0000000000000246 R12: 0000000000000000 [ 118.041143][ T3206] R13: 00007fc458e26038 R14: 00007fc458e25fa0 R15: 00007ffcbe812558 [ 118.041195][ T3206] [ 118.041296][ T3206] Mem-Info: [ 118.069314][ T67] usb 1-1: USB disconnect, device number 38 [ 118.091756][ T3206] active_anon:26259 inactive_anon:3 isolated_anon:0 [ 118.091756][ T3206] active_file:20197 inactive_file:2333 isolated_file:0 [ 118.091756][ T3206] unevictable:16453 dirty:114 writeback:0 [ 118.091756][ T3206] slab_reclaimable:5217 slab_unreclaimable:74992 [ 118.091756][ T3206] mapped:25841 shmem:16616 pagetables:1067 [ 118.091756][ T3206] sec_pagetables:0 bounce:0 [ 118.091756][ T3206] kernel_misc_reclaimable:0 [ 118.091756][ T3206] free:1481194 free_pcp:2693 free_cma:0 [ 118.112057][ T3182] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 118.122384][ T3206] Node 0 active_anon:105036kB inactive_anon:12kB active_file:80788kB inactive_file:9332kB unevictable:65812kB isolated(anon):0kB isolated(file):0kB mapped:103364kB dirty:456kB writeback:0kB shmem:66464kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:6856kB pagetables:4268kB sec_pagetables:0kB all_unreclaimable? no [ 118.127680][ T365] udevd[365]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 118.130432][ T3206] DMA32 free:2958164kB boost:0kB min:19080kB low:23848kB high:28616kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3145324kB managed:2963400kB mlocked:0kB bounce:0kB free_pcp:5236kB local_pcp:5236kB free_cma:0kB [ 118.468808][ T3206] lowmem_reserve[]: 0 3921 3921 [ 118.474162][ T3206] Normal free:2968024kB boost:0kB min:25972kB low:32464kB high:38956kB reserved_highatomic:0KB free_highatomic:0KB active_anon:105176kB inactive_anon:12kB active_file:80788kB inactive_file:9332kB unevictable:65812kB writepending:456kB present:5242880kB managed:4015864kB mlocked:0kB bounce:0kB free_pcp:3380kB local_pcp:3380kB free_cma:0kB [ 118.508586][ T3206] lowmem_reserve[]: 0 0 0 [ 118.513560][ T3206] DMA32: 5*4kB (M) 4*8kB (M) 4*16kB (M) 5*32kB (M) 3*64kB (M) 5*128kB (M) 5*256kB (M) 5*512kB (M) 4*1024kB (UM) 4*2048kB (M) 718*4096kB (M) = 2958164kB [ 118.529681][ T3206] Normal: 136*4kB (UME) 69*8kB (UME) 31*16kB (UME) 42*32kB (UME) 23*64kB (UME) 26*128kB (UME) 11*256kB (UME) 9*512kB (UME) 15*1024kB (UM) 8*2048kB (UME) 714*4096kB (M) = 2971448kB [ 118.533496][ T3211] netlink: 228 bytes leftover after parsing attributes in process `syz.0.1116'. [ 118.548852][ T3206] 55599 total pagecache pages [ 118.561934][ T3206] 3 pages in swap cache [ 118.566229][ T3206] Free swap = 124984kB [ 118.570679][ T3206] Total swap = 124996kB [ 118.574997][ T3206] 2097051 pages RAM [ 118.578915][ T3206] 0 pages HighMem/MovableOnly [ 118.584181][ T3206] 352235 pages reserved [ 118.588633][ T3206] 0 pages cma reserved [ 118.596588][ T3206] Memory allocations: [ 118.600728][ T3206] 0 B 0 init/main.c:1477 func:do_initcalls [ 118.607995][ T3206] 0 B 0 init/do_mounts.c:186 func:mount_root_generic [ 118.616169][ T3206] 0 B 0 init/do_mounts.c:158 func:do_mount_root [ 118.623871][ T3206] 0 B 0 init/do_mounts.c:352 func:mount_nodev_root [ 118.631867][ T3206] 0 B 0 init/do_mounts_rd.c:241 func:rd_load_image [ 118.639844][ T3206] 0 B 0 init/do_mounts_rd.c:72 func:identify_ramdisk_image [ 118.648482][ T3206] 0 B 0 init/initramfs.c:507 func:unpack_to_rootfs [ 118.656460][ T3206] 0 B 0 init/initramfs.c:508 func:unpack_to_rootfs [ 118.664414][ T3206] 0 B 0 init/initramfs.c:509 func:unpack_to_rootfs [ 118.672368][ T367] asix 2-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 118.672443][ T367] asix 2-1:0.188: probe with driver asix failed with error -61 [ 118.690548][ T3206] 0 B 0 init/initramfs.c:101 func:find_link [ 118.797512][ T36] audit: type=1400 audit(2000000073.118:478): avc: denied { mounton } for pid=3223 comm="syz.2.1121" path="/273/file0" dev="tmpfs" ino=1488 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 118.883168][ T387] usb 2-1: USB disconnect, device number 48 [ 118.943928][ T3235] batadv_slave_1: entered allmulticast mode [ 118.952652][ T3235] input: syz1 as /devices/virtual/input/input12 [ 118.966992][ T3234] batadv_slave_1: left allmulticast mode [ 119.010188][ T36] audit: type=1400 audit(2000000073.338:479): avc: denied { create } for pid=3238 comm="syz.0.1127" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=key permissive=1 [ 119.044904][ T3241] netlink: 228 bytes leftover after parsing attributes in process `syz.0.1128'. [ 119.319828][ T367] usb 1-1: new full-speed USB device number 39 using dummy_hcd [ 119.405560][ T3248] netlink: 'syz.1.1131': attribute type 15 has an invalid length. [ 119.413500][ T3248] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1131'. [ 119.471644][ T367] usb 1-1: unable to get BOS descriptor or descriptor too short [ 119.479834][ T367] usb 1-1: not running at top speed; connect to a high speed hub [ 119.488508][ T367] usb 1-1: config 8 has an invalid interface number: 43 but max is 1 [ 119.497426][ T367] usb 1-1: config 8 has an invalid interface number: 35 but max is 1 [ 119.505594][ T367] usb 1-1: config 8 has no interface number 0 [ 119.511830][ T367] usb 1-1: config 8 has no interface number 1 [ 119.517958][ T367] usb 1-1: config 8 interface 43 altsetting 17 has an endpoint descriptor with address 0xE5, changing to 0x85 [ 119.530349][ T367] usb 1-1: config 8 interface 43 has no altsetting 0 [ 119.537092][ T367] usb 1-1: config 8 interface 35 has no altsetting 0 [ 119.543904][ T36] audit: type=1400 audit(2000000073.868:480): avc: denied { create } for pid=3251 comm="syz.1.1133" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 119.557869][ T36] audit: type=1400 audit(2000000073.878:481): avc: denied { write } for pid=3251 comm="syz.1.1133" name="file0" dev="tmpfs" ino=1422 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 119.566691][ T367] usb 1-1: New USB device found, idVendor=0584, idProduct=0008, bcdDevice= 1.02 [ 119.590859][ T3253] 9p: Unknown uid 00000000004294967295 [ 119.597512][ T367] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 119.610158][ T367] usb 1-1: Product: syz [ 119.614403][ T367] usb 1-1: Manufacturer: syz [ 119.619064][ T367] usb 1-1: SerialNumber: syz [ 119.620042][ T36] audit: type=1400 audit(2000000073.898:482): avc: denied { open } for pid=3251 comm="syz.1.1133" path="/259/file0" dev="tmpfs" ino=1422 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 119.650497][ T36] audit: type=1400 audit(2000000073.978:483): avc: denied { mounton } for pid=3251 comm="syz.1.1133" path="/259/file0" dev="tmpfs" ino=1422 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 119.706350][ T36] audit: type=1400 audit(2000000074.028:484): avc: denied { execute } for pid=3258 comm="syz.3.1136" name="file0" dev="tmpfs" ino=1630 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 119.739119][ T36] audit: type=1400 audit(2000000074.028:485): avc: denied { execute_no_trans } for pid=3258 comm="syz.3.1136" path="/297/file0" dev="tmpfs" ino=1630 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 119.798425][ T3266] loop5: detected capacity change from 0 to 7 [ 119.853299][ T367] ums-alauda 1-1:8.43: USB Mass Storage device detected [ 119.862399][ T367] scsi host1: usb-storage 1-1:8.43 [ 119.871444][ T367] hub 1-1:8.35: Invalid hub with more than one config or interface [ 119.887418][ T367] hub 1-1:8.35: probe with driver hub failed with error -22 [ 119.903174][ T367] ums-alauda 1-1:8.35: USB Mass Storage device detected [ 119.929768][ C0] invalid error, dev loop5, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 2 [ 119.939628][ C0] Buffer I/O error on dev loop5, logical block 0, lost async page write [ 119.965730][ T3277] netlink: 228 bytes leftover after parsing attributes in process `syz.2.1141'. [ 119.994775][ T367] usb 1-1: USB disconnect, device number 39 [ 120.350681][ T3291] overlayfs: failed to clone upperpath [ 120.494087][ T3304] netlink: 228 bytes leftover after parsing attributes in process `syz.0.1151'. [ 120.759817][ T46] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 120.909795][ T46] usb 1-1: Using ep0 maxpacket: 32 [ 120.920946][ T46] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 120.931219][ T46] usb 1-1: config 0 has no interface number 0 [ 120.937361][ T46] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 120.948652][ T3314] Invalid logical block size (16384) [ 120.955667][ T46] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 120.965006][ T46] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 120.973241][ T46] usb 1-1: Product: syz [ 120.977491][ T46] usb 1-1: Manufacturer: syz [ 120.982315][ T46] usb 1-1: SerialNumber: syz [ 120.987855][ T46] usb 1-1: config 0 descriptor?? [ 120.993318][ T3306] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 121.179188][ T3332] netlink: 228 bytes leftover after parsing attributes in process `syz.3.1163'. [ 121.201578][ T3306] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 121.465490][ T367] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 121.530862][ T3364] netlink: 228 bytes leftover after parsing attributes in process `syz.1.1175'. [ 121.569771][ T3368] tmpfs: Bad value for 'size' [ 121.602359][ T36] audit: type=1400 audit(2000000075.928:486): avc: denied { read } for pid=3372 comm="syz.3.1179" path="socket:[19580]" dev="sockfs" ino=19580 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 121.627455][ T46] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 121.637791][ T46] asix 1-1:0.188: probe with driver asix failed with error -71 [ 121.642950][ T367] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 121.652798][ T46] usb 1-1: USB disconnect, device number 40 [ 121.689767][ T367] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 121.719303][ T367] usb 3-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 121.748908][ T367] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 121.769880][ T367] usb 3-1: config 0 descriptor?? [ 122.025807][ T1105] Bluetooth: hci0: Frame reassembly failed (-84) [ 122.034347][ T1105] Bluetooth: hci0: Frame reassembly failed (-84) [ 122.147128][ T3394] netlink: 228 bytes leftover after parsing attributes in process `syz.0.1187'. [ 122.183834][ T367] cp2112 0003:10C4:EA90.000A: unknown main item tag 0x0 [ 122.190942][ T367] cp2112 0003:10C4:EA90.000A: unknown main item tag 0x0 [ 122.197941][ T367] cp2112 0003:10C4:EA90.000A: unknown main item tag 0x0 [ 122.205000][ T367] cp2112 0003:10C4:EA90.000A: unknown main item tag 0x0 [ 122.212020][ T367] cp2112 0003:10C4:EA90.000A: unknown main item tag 0x0 [ 122.219018][ T367] cp2112 0003:10C4:EA90.000A: unknown main item tag 0x0 [ 122.226138][ T367] cp2112 0003:10C4:EA90.000A: unknown main item tag 0x0 [ 122.233988][ T367] cp2112 0003:10C4:EA90.000A: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.2-1/input0 [ 122.320452][ T3401] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1190'. [ 122.330086][ T3401] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1190'. [ 122.340493][ T36] audit: type=1326 audit(2000000076.668:487): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3400 comm="syz.3.1190" exe="/root/ci2-android-6-12-rust/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7925f9de99 code=0x0 [ 122.380580][ T367] cp2112 0003:10C4:EA90.000A: Part Number: 0x82 Device Version: 0xFE [ 122.429796][ T46] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 122.581090][ T46] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 122.592124][ T46] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 122.601952][ T46] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 122.614958][ T46] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 122.624088][ T46] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 122.633318][ T46] usb 1-1: config 0 descriptor?? [ 123.041290][ T46] usbhid 1-1:0.0: can't add hid device: -71 [ 123.047627][ T46] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 123.056854][ T46] usb 1-1: USB disconnect, device number 41 [ 123.809795][ T46] usb 1-1: new full-speed USB device number 42 using dummy_hcd [ 123.840241][ T367] cp2112 0003:10C4:EA90.000A: error setting SMBus config [ 123.849052][ T367] cp2112 0003:10C4:EA90.000A: probe with driver cp2112 failed with error -71 [ 123.859899][ T367] usb 3-1: USB disconnect, device number 39 [ 123.960510][ T46] usb 1-1: not running at top speed; connect to a high speed hub [ 123.969114][ T46] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 1616, setting to 1023 [ 123.981752][ T46] usb 1-1: New USB device found, idVendor=2a39, idProduct=3f8c, bcdDevice= 0.40 [ 123.990919][ T46] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 123.998945][ T46] usb 1-1: Product: syz [ 124.003279][ T46] usb 1-1: Manufacturer: syz [ 124.007927][ T46] usb 1-1: SerialNumber: syz [ 124.069826][ T55] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 124.069845][ T1228] Bluetooth: hci0: command 0x1003 tx timeout [ 124.243271][ T46] usb 1-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 124.254043][ T46] usb 1-1: unit 14 not found! [ 124.268754][ T46] usb 1-1: USB disconnect, device number 42 [ 124.284640][ T323] udevd[323]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 124.343518][ T3423] netlink: 228 bytes leftover after parsing attributes in process `syz.1.1198'. [ 124.389395][ T3430] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1202'. [ 124.569848][ T46] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 124.603250][ T3442] netlink: 228 bytes leftover after parsing attributes in process `syz.2.1207'. [ 124.720853][ T46] usb 1-1: Using ep0 maxpacket: 32 [ 124.727637][ T46] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 124.737468][ T46] usb 1-1: config 0 has no interface number 0 [ 124.743749][ T46] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 124.755822][ T46] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 124.767291][ T46] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 124.775643][ T46] usb 1-1: Product: syz [ 124.780265][ T46] usb 1-1: Manufacturer: syz [ 124.785016][ T46] usb 1-1: SerialNumber: syz [ 124.798084][ T46] usb 1-1: config 0 descriptor?? [ 124.805607][ T3419] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 125.015190][ T3466] cgroup: fork rejected by pids controller in /syz1 [ 125.017505][ T3419] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 125.119825][ T367] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 125.231061][ T46] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 125.241410][ T46] asix 1-1:0.188: probe with driver asix failed with error -71 [ 125.250524][ T46] usb 1-1: USB disconnect, device number 43 [ 125.300148][ T367] usb 3-1: unable to get BOS descriptor or descriptor too short [ 125.311253][ T367] usb 3-1: New USB device found, idVendor=0582, idProduct=000c, bcdDevice= 0.40 [ 125.329863][ T367] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 125.337898][ T367] usb 3-1: Product: syz [ 125.342131][ T367] usb 3-1: Manufacturer: syz [ 125.346754][ T367] usb 3-1: SerialNumber: syz [ 125.479155][ T3473] bridge0: port 1(bridge_slave_0) entered blocking state [ 125.486360][ T3473] bridge0: port 1(bridge_slave_0) entered disabled state [ 125.493645][ T3473] bridge_slave_0: entered allmulticast mode [ 125.500286][ T3473] bridge_slave_0: entered promiscuous mode [ 125.507262][ T3473] bridge0: port 2(bridge_slave_1) entered blocking state [ 125.514511][ T3473] bridge0: port 2(bridge_slave_1) entered disabled state [ 125.521694][ T3473] bridge_slave_1: entered allmulticast mode [ 125.528060][ T3473] bridge_slave_1: entered promiscuous mode [ 125.534450][ T1105] bridge_slave_1: left allmulticast mode [ 125.540258][ T1105] bridge_slave_1: left promiscuous mode [ 125.545981][ T1105] bridge0: port 2(bridge_slave_1) entered disabled state [ 125.553819][ T1105] bridge_slave_0: left allmulticast mode [ 125.557916][ T367] usb 3-1: 1:1: invalid format type 0x1001 is detected, processed as PCM [ 125.560224][ T1105] bridge_slave_0: left promiscuous mode [ 125.574209][ T1105] bridge0: port 1(bridge_slave_0) entered disabled state [ 125.574379][ T367] usb 3-1: 1:1 : sample bitwidth 8 in over sample bytes 0 [ 125.588560][ T367] usb 3-1: 1:1 : unsupported sample bitwidth 8 in 0 bytes [ 125.596170][ T367] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 125.606623][ T367] usb 3-1: 1:1: invalid format type 0x1001 is detected, processed as PCM [ 125.615230][ T367] usb 3-1: 1:1 : sample bitwidth 8 in over sample bytes 0 [ 125.622417][ T367] usb 3-1: 1:1 : unsupported sample bitwidth 8 in 0 bytes [ 125.629960][ T367] snd-usb-audio 3-1:1.1: probe with driver snd-usb-audio failed with error -2 [ 125.640596][ T367] usb 3-1: 1:1: invalid format type 0x1001 is detected, processed as PCM [ 125.649079][ T367] usb 3-1: 1:1 : sample bitwidth 8 in over sample bytes 0 [ 125.656509][ T367] usb 3-1: 1:1 : unsupported sample bitwidth 8 in 0 bytes [ 125.665461][ T367] snd-usb-audio 3-1:1.2: probe with driver snd-usb-audio failed with error -2 [ 125.677341][ T367] usb 3-1: USB disconnect, device number 40 [ 125.686640][ T323] udevd[323]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.2/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 125.723213][ T1105] veth1_macvtap: left promiscuous mode [ 125.728827][ T1105] veth0_vlan: left promiscuous mode [ 125.774948][ T3478] SELinux: failed to load policy [ 125.833052][ T3473] bridge0: port 2(bridge_slave_1) entered blocking state [ 125.840178][ T3473] bridge0: port 2(bridge_slave_1) entered forwarding state [ 125.847533][ T3473] bridge0: port 1(bridge_slave_0) entered blocking state [ 125.854676][ T3473] bridge0: port 1(bridge_slave_0) entered forwarding state [ 125.886236][ T1114] bridge0: port 1(bridge_slave_0) entered disabled state [ 125.900935][ T1114] bridge0: port 2(bridge_slave_1) entered disabled state [ 125.914542][ T430] bridge0: port 1(bridge_slave_0) entered blocking state [ 125.921703][ T430] bridge0: port 1(bridge_slave_0) entered forwarding state [ 125.932280][ T430] bridge0: port 2(bridge_slave_1) entered blocking state [ 125.939396][ T430] bridge0: port 2(bridge_slave_1) entered forwarding state [ 125.968368][ T3473] veth0_vlan: entered promiscuous mode [ 125.982253][ T3473] veth1_macvtap: entered promiscuous mode [ 126.149846][ T558] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 126.259912][ T367] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 126.279824][ T558] usb 1-1: device descriptor read/64, error -71 [ 126.339868][ T383] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 126.410082][ T367] usb 2-1: Using ep0 maxpacket: 32 [ 126.416619][ T367] usb 2-1: config 0 has an invalid interface number: 188 but max is 0 [ 126.424969][ T367] usb 2-1: config 0 has no interface number 0 [ 126.431199][ T367] usb 2-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 126.443054][ T367] usb 2-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 126.452213][ T367] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 126.460386][ T367] usb 2-1: Product: syz [ 126.464598][ T367] usb 2-1: Manufacturer: syz [ 126.469225][ T367] usb 2-1: SerialNumber: syz [ 126.474782][ T367] usb 2-1: config 0 descriptor?? [ 126.480627][ T3500] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 126.491250][ T383] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 126.502362][ T383] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 126.511483][ T383] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 126.519879][ T558] usb 1-1: device descriptor read/64, error -71 [ 126.522201][ T383] usb 3-1: config 0 descriptor?? [ 126.688822][ T3500] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 126.734229][ T383] usbhid 3-1:0.0: can't add hid device: -71 [ 126.740377][ T383] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 126.750272][ T383] usb 3-1: USB disconnect, device number 41 [ 126.759785][ T558] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 126.889845][ T558] usb 1-1: device descriptor read/64, error -71 [ 126.898063][ T367] asix 2-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 126.908435][ T367] asix 2-1:0.188: probe with driver asix failed with error -71 [ 126.917411][ T367] usb 2-1: USB disconnect, device number 49 [ 127.114971][ T3517] netlink: 679 bytes leftover after parsing attributes in process `syz.3.1236'. [ 127.139807][ T558] usb 1-1: device descriptor read/64, error -71 [ 127.169799][ T46] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 127.249906][ T558] usb usb1-port1: attempt power cycle [ 127.320978][ T46] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 127.332394][ T46] usb 3-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 127.341692][ T46] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 127.351195][ T46] usb 3-1: config 0 descriptor?? [ 127.589846][ T558] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 127.611147][ T558] usb 1-1: device descriptor read/8, error -71 [ 127.740762][ T558] usb 1-1: device descriptor read/8, error -71 [ 127.859812][ T67] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 127.979895][ T558] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 128.010965][ T558] usb 1-1: device descriptor read/8, error -71 [ 128.017247][ T67] usb 2-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 180, changing to 11 [ 128.028516][ T67] usb 2-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 128.041370][ T67] usb 2-1: config 0 interface 0 has no altsetting 0 [ 128.048004][ T67] usb 2-1: New USB device found, idVendor=056a, idProduct=00cc, bcdDevice= 0.00 [ 128.057130][ T67] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 128.065902][ T67] usb 2-1: config 0 descriptor?? [ 128.140857][ T558] usb 1-1: device descriptor read/8, error -71 [ 128.160367][ T46] aiptek 3-1:0.0: Aiptek using 400 ms programming speed [ 128.168092][ T46] input: Aiptek as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input13 [ 128.208677][ C1] ------------[ cut here ]------------ [ 128.214169][ C1] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:724:31 [ 128.222772][ C1] index 93 is out of range for type 'const int[34]' [ 128.229368][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 f10dc98c92500eb86b2a5bf5b389293121b4eb86 [ 128.229395][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 128.229407][ C1] Call Trace: [ 128.229414][ C1] [ 128.229422][ C1] __dump_stack+0x21/0x30 [ 128.229452][ C1] dump_stack_lvl+0x140/0x1c0 [ 128.229477][ C1] ? __cfi_dump_stack_lvl+0x10/0x10 [ 128.229502][ C1] ? input_event_dispose+0x2f5/0x6d0 [ 128.229531][ C1] dump_stack+0x19/0x20 [ 128.229554][ C1] ubsan_epilogue+0xe/0x40 [ 128.229569][ C1] __ubsan_handle_out_of_bounds+0xe8/0xf0 [ 128.229595][ C1] aiptek_irq+0x2317/0x2a00 [ 128.229617][ C1] ? __cfi_mon_bin_complete+0x10/0x10 [ 128.229642][ C1] ? _raw_spin_unlock+0x45/0x60 [ 128.229662][ C1] ? kcov_remote_start+0x1d2/0x3c0 [ 128.229682][ C1] __usb_hcd_giveback_urb+0x371/0x530 [ 128.229727][ C1] usb_hcd_giveback_urb+0x12b/0x400 [ 128.229762][ C1] dummy_timer+0xa3f/0x4900 [ 128.229795][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 128.229821][ C1] ? timerqueue_del+0xd7/0x130 [ 128.229848][ C1] ? __hrtimer_run_queues+0x2bd/0x8e0 [ 128.229875][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 128.229891][ C1] __hrtimer_run_queues+0x3ab/0x8e0 [ 128.229919][ C1] ? hrtimer_interrupt+0xf30/0xf30 [ 128.229962][ C1] ? read_tsc+0xd/0x20 [ 128.229997][ C1] ? ktime_get_update_offsets_now+0x3c0/0x3e0 [ 128.230031][ C1] hrtimer_run_softirq+0x159/0x560 [ 128.230047][ C1] ? irqtime_account_irq+0x51/0x1c0 [ 128.230073][ C1] handle_softirqs+0x1aa/0x620 [ 128.230092][ C1] __irq_exit_rcu+0x47/0xb0 [ 128.230109][ C1] irq_exit_rcu+0xd/0x30 [ 128.230125][ C1] sysvec_apic_timer_interrupt+0x82/0x90 [ 128.230158][ C1] [ 128.230164][ C1] [ 128.230171][ C1] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 128.230196][ C1] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 128.230224][ C1] Code: cc cc cc cc cc cc cc b8 96 c8 fe 40 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 23 c9 43 00 55 48 89 e5 fb f4 <5d> c3 cc cc cc cc cc cc cc cc cc cc cc b8 00 00 00 00 90 90 90 90 [ 128.230241][ C1] RSP: 0018:ffffc900001a7e00 EFLAGS: 000002c2 [ 128.230257][ C1] RAX: ffff8881f6f00000 RBX: ffff88810366b900 RCX: ffffffff85a394fd [ 128.230272][ C1] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 00000000001cafc4 [ 128.230284][ C1] RBP: ffffc900001a7e00 R08: ffff8881f6f395eb R09: 1ffff1103ede72bd [ 128.230298][ C1] R10: dffffc0000000000 R11: ffffed103ede72be R12: 0000000000000000 [ 128.230311][ C1] R13: 1ffff110206cd720 R14: dffffc0000000000 R15: ffffffff87ecb528 [ 128.230326][ C1] ? ct_kernel_exit+0x7d/0xb0 [ 128.230342][ C1] default_idle+0x17/0x30 [ 128.230358][ C1] arch_cpu_idle+0xd/0x20 [ 128.230374][ C1] default_idle_call+0x3e/0x80 [ 128.230390][ C1] do_idle+0x2fc/0x570 [ 128.230409][ C1] ? idle_inject_timer_fn+0x80/0x80 [ 128.230430][ C1] cpu_startup_entry+0x47/0x60 [ 128.230449][ C1] start_secondary+0x12e/0x140 [ 128.230474][ C1] common_startup_64+0x13b/0x157 [ 128.230500][ C1] [ 128.230507][ C1] ---[ end trace ]--- [ 128.529624][ C1] ================================================================== [ 128.537707][ C1] BUG: KASAN: global-out-of-bounds in aiptek_irq+0x2335/0x2a00 [ 128.545299][ C1] Read of size 4 at addr ffffffff867047b4 by task swapper/1/0 [ 128.552768][ C1] [ 128.555128][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 f10dc98c92500eb86b2a5bf5b389293121b4eb86 [ 128.555172][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 128.555186][ C1] Call Trace: [ 128.555193][ C1] [ 128.555202][ C1] __dump_stack+0x21/0x30 [ 128.555235][ C1] dump_stack_lvl+0x140/0x1c0 [ 128.555262][ C1] ? __cfi_dump_stack_lvl+0x10/0x10 [ 128.555291][ C1] ? __cfi__printk+0x10/0x10 [ 128.555317][ C1] print_address_description+0x71/0x210 [ 128.555346][ C1] print_report+0x4a/0x70 [ 128.555373][ C1] kasan_report+0x162/0x1a0 [ 128.555399][ C1] ? aiptek_irq+0x2335/0x2a00 [ 128.555427][ C1] ? aiptek_irq+0x2335/0x2a00 [ 128.555453][ C1] __asan_report_load4_noabort+0x18/0x20 [ 128.555473][ C1] aiptek_irq+0x2335/0x2a00 [ 128.555498][ C1] ? __cfi_mon_bin_complete+0x10/0x10 [ 128.555524][ C1] ? _raw_spin_unlock+0x45/0x60 [ 128.555549][ C1] ? kcov_remote_start+0x1d2/0x3c0 [ 128.555572][ C1] __usb_hcd_giveback_urb+0x371/0x530 [ 128.555610][ C1] usb_hcd_giveback_urb+0x12b/0x400 [ 128.555640][ C1] dummy_timer+0xa3f/0x4900 [ 128.555668][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 128.555687][ C1] ? timerqueue_del+0xd7/0x130 [ 128.555705][ C1] ? __hrtimer_run_queues+0x2bd/0x8e0 [ 128.555735][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 128.555753][ C1] __hrtimer_run_queues+0x3ab/0x8e0 [ 128.555784][ C1] ? hrtimer_interrupt+0xf30/0xf30 [ 128.555813][ C1] ? read_tsc+0xd/0x20 [ 128.555839][ C1] ? ktime_get_update_offsets_now+0x3c0/0x3e0 [ 128.555865][ C1] hrtimer_run_softirq+0x159/0x560 [ 128.555883][ C1] ? irqtime_account_irq+0x51/0x1c0 [ 128.555912][ C1] handle_softirqs+0x1aa/0x620 [ 128.555934][ C1] __irq_exit_rcu+0x47/0xb0 [ 128.555953][ C1] irq_exit_rcu+0xd/0x30 [ 128.555971][ C1] sysvec_apic_timer_interrupt+0x82/0x90 [ 128.556001][ C1] [ 128.556008][ C1] [ 128.556015][ C1] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 128.556048][ C1] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 128.556079][ C1] Code: cc cc cc cc cc cc cc b8 96 c8 fe 40 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 23 c9 43 00 55 48 89 e5 fb f4 <5d> c3 cc cc cc cc cc cc cc cc cc cc cc b8 00 00 00 00 90 90 90 90 [ 128.556098][ C1] RSP: 0018:ffffc900001a7e00 EFLAGS: 000002c2 [ 128.556116][ C1] RAX: ffff8881f6f00000 RBX: ffff88810366b900 RCX: ffffffff85a394fd [ 128.556133][ C1] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 00000000001cafc4 [ 128.556147][ C1] RBP: ffffc900001a7e00 R08: ffff8881f6f395eb R09: 1ffff1103ede72bd [ 128.556163][ C1] R10: dffffc0000000000 R11: ffffed103ede72be R12: 0000000000000000 [ 128.556178][ C1] R13: 1ffff110206cd720 R14: dffffc0000000000 R15: ffffffff87ecb528 [ 128.556219][ C1] ? ct_kernel_exit+0x7d/0xb0 [ 128.556257][ C1] default_idle+0x17/0x30 [ 128.556277][ C1] arch_cpu_idle+0xd/0x20 [ 128.556295][ C1] default_idle_call+0x3e/0x80 [ 128.556314][ C1] do_idle+0x2fc/0x570 [ 128.556336][ C1] ? idle_inject_timer_fn+0x80/0x80 [ 128.556360][ C1] cpu_startup_entry+0x47/0x60 [ 128.556383][ C1] start_secondary+0x12e/0x140 [ 128.556410][ C1] common_startup_64+0x13b/0x157 [ 128.556441][ C1] [ 128.556449][ C1] [ 128.867968][ C1] The buggy address belongs to the variable: [ 128.873960][ C1] .str.9+0x34/0x60 [ 128.877804][ C1] [ 128.880150][ C1] The buggy address belongs to the physical page: [ 128.886602][ C1] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6704 [ 128.895286][ C1] flags: 0x4000(reserved|zone=0) [ 128.900242][ C1] raw: 0000000000004000 ffffea000019c108 ffffea000019c108 0000000000000000 [ 128.909107][ C1] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 128.917720][ C1] page dumped because: kasan: bad access detected [ 128.924343][ C1] page_owner info is not present (never set?) [ 128.930407][ C1] [ 128.934256][ C1] Memory state around the buggy address: [ 128.940002][ C1] ffffffff86704680: 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 [ 128.948223][ C1] ffffffff86704700: 00 00 00 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 128.956424][ C1] >ffffffff86704780: 00 00 00 00 06 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 [ 128.964756][ C1] ^ [ 128.970775][ C1] ffffffff86704800: 00 03 f9 f9 f9 f9 f9 f9 00 00 00 00 00 f9 f9 f9 [ 128.978858][ C1] ffffffff86704880: f9 f9 f9 f9 00 02 f9 f9 00 00 00 00 00 03 f9 f9 [ 128.987536][ C1] ================================================================== [ 128.995677][ C1] Disabling lock debugging due to kernel taint [ 129.003489][ T558] usb usb1-port1: unable to enumerate USB device [ 129.012527][ T36] audit: type=1400 audit(2000000083.328:488): avc: denied { write } for pid=287 comm="syz-executor" path="pipe:[2527]" dev="pipefs" ino=2527 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 129.054188][ T36] audit: type=1400 audit(2000000083.368:489): avc: denied { read } for pid=93 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 129.101984][ T36] audit: type=1400 audit(2000000083.368:490): avc: denied { search } for pid=93 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 129.169214][ T36] audit: type=1400 audit(2000000083.368:491): avc: denied { write } for pid=93 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 129.194091][ T36] audit: type=1400 audit(2000000083.368:492): avc: denied { add_name } for pid=93 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 129.249763][ T36] audit: type=1400 audit(2000000083.368:493): avc: denied { create } for pid=93 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 129.296261][ T36] audit: type=1400 audit(2000000083.368:494): avc: denied { append open } for pid=93 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 129.329830][ T1121] bridge_slave_1: left allmulticast mode [ 129.336186][ T1121] bridge0: port 2(bridge_slave_1) entered disabled state [ 129.339925][ T36] audit: type=1400 audit(2000000083.368:495): avc: denied { getattr } for pid=93 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 129.366978][ T1121] bridge_slave_0: left allmulticast mode [ 129.374222][ T1121] bridge_slave_0: left promiscuous mode [ 129.380198][ T1121] bridge0: port 1(bridge_slave_0) entered disabled state [ 129.502614][ T1121] veth1_macvtap: left promiscuous mode [ 129.508210][ T1121] veth0_vlan: left promiscuous mode [ 129.521321][ T67] usbhid 2-1:0.0: can't add hid device: -71 [ 129.527347][ T67] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 129.563308][ T67] usb 2-1: USB disconnect, device number 50 [ 129.602002][ T9] usb 3-1: USB disconnect, device number 42 [ 129.602028][ C1] aiptek 3-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 129.921921][ T1121] bridge_slave_1: left allmulticast mode [ 129.927597][ T1121] bridge_slave_1: left promiscuous mode [ 129.933312][ T1121] bridge0: port 2(bridge_slave_1) entered disabled state [ 129.941125][ T1121] bridge_slave_0: left allmulticast mode [ 129.946796][ T1121] bridge_slave_0: left promiscuous mode [ 129.952609][ T1121] bridge0: port 1(bridge_slave_0) entered disabled state [ 129.960685][ T1121] bridge_slave_1: left allmulticast mode [ 129.966375][ T1121] bridge_slave_1: left promiscuous mode [ 129.972204][ T1121] bridge0: port 2(bridge_slave_1) entered disabled state [ 129.980215][ T1121] bridge_slave_0: left allmulticast mode [ 129.985878][ T1121] bridge_slave_0: left promiscuous mode [ 129.991720][ T1121] bridge0: port 1(bridge_slave_0) entered disabled state [ 130.172923][ T1121] tipc: Disabling bearer [ 130.178303][ T1121] tipc: Left network mode [ 130.186110][ T1121] veth1_macvtap: left promiscuous mode [ 130.191799][ T1121] veth0_vlan: left promiscuous mode [ 130.197261][ T1121] veth1_macvtap: left promiscuous mode [ 130.202860][ T1121] veth0_vlan: left promiscuous mode [ 130.208300][ T1121] veth1_macvtap: left promiscuous mode [ 130.213883][ T1121] veth0_vlan: left promiscuous mode [ 130.722241][ T1121] ------------[ cut here ]------------ [ 130.727837][ T1121] WARNING: CPU: 0 PID: 1121 at net/ipv6/xfrm6_tunnel.c:341 xfrm6_tunnel_net_exit+0xc4/0x140 [ 130.738002][ T1121] Modules linked in: [ 130.741967][ T1121] CPU: 0 UID: 0 PID: 1121 Comm: kworker/u8:42 Tainted: G B syzkaller #0 f10dc98c92500eb86b2a5bf5b389293121b4eb86 [ 130.755346][ T1121] Tainted: [B]=BAD_PAGE [ 130.759500][ T1121] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 130.769990][ T1121] Workqueue: netns cleanup_net [ 130.774805][ T1121] RIP: 0010:xfrm6_tunnel_net_exit+0xc4/0x140 [ 130.780881][ T1121] Code: e8 a1 f3 d6 fc 4b 83 3c 3e 00 75 19 e8 35 42 7e fc 49 81 ff f8 07 00 00 74 1b e8 27 42 7e fc 49 83 c7 08 eb c9 e8 1c 42 7e fc <0f> 0b 49 81 ff f8 07 00 00 75 e5 49 8d 9e 00 08 00 00 45 31 ff 4a [ 130.800665][ T1121] RSP: 0018:ffffc9000ffcfb90 EFLAGS: 00010293 [ 130.806759][ T1121] RAX: ffffffff85093184 RBX: ffff888128700000 RCX: ffff888133cecc00 [ 130.814808][ T1121] RDX: 0000000000000000 RSI: 0000000000c00000 RDI: ffff8881023800b8 [ 130.822863][ T1121] RBP: ffffc9000ffcfbb0 R08: ffffffff87d41e27 R09: 1ffffffff0fa83c4 [ 130.830908][ T1121] R10: dffffc0000000000 R11: fffffbfff0fa83c5 R12: dffffc0000000000 [ 130.838916][ T1121] R13: dffffc0000000000 R14: ffff888102380000 R15: 00000000000000b8 [ 130.846985][ T1121] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 130.856020][ T1121] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 130.862719][ T1121] CR2: 000055f452e82af8 CR3: 000000010cb18000 CR4: 00000000003526b0 [ 130.870812][ T1121] Call Trace: [ 130.874119][ T1121] [ 130.877062][ T1121] cleanup_net+0x6bd/0xc90 [ 130.881549][ T1121] ? __cfi_cleanup_net+0x10/0x10 [ 130.886535][ T1121] ? kick_pool+0xb9/0x540 [ 130.891051][ T1121] process_scheduled_works+0x7f7/0x1060 [ 130.896694][ T1121] worker_thread+0xc99/0x13f0 [ 130.901455][ T1121] kthread+0x2c7/0x360 [ 130.905558][ T1121] ? __cfi_worker_thread+0x10/0x10 [ 130.910737][ T1121] ? __cfi_kthread+0x10/0x10 [ 130.915395][ T1121] ret_from_fork+0x67/0xa0 [ 130.919892][ T1121] ? __cfi_kthread+0x10/0x10 [ 130.924516][ T1121] ret_from_fork_asm+0x1a/0x30 [ 130.929303][ T1121] [ 130.932547][ T1121] ---[ end trace 0000000000000000 ]--- [ 130.938379][ T1121] ------------[ cut here ]------------ [ 130.943899][ T1121] WARNING: CPU: 1 PID: 1121 at net/ipv6/xfrm6_tunnel.c:344 xfrm6_tunnel_net_exit+0x119/0x140 [ 130.954142][ T1121] Modules linked in: [ 130.958076][ T1121] CPU: 1 UID: 0 PID: 1121 Comm: kworker/u8:42 Tainted: G B W syzkaller #0 f10dc98c92500eb86b2a5bf5b389293121b4eb86 [ 130.971433][ T1121] Tainted: [B]=BAD_PAGE, [W]=WARN [ 130.976480][ T1121] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 130.986604][ T1121] Workqueue: netns cleanup_net [ 130.991481][ T1121] RIP: 0010:xfrm6_tunnel_net_exit+0x119/0x140 [ 130.997680][ T1121] Code: fc 4b 83 bc 3e 00 08 00 00 00 75 19 e8 e0 41 7e fc 49 81 ff f8 07 00 00 74 1b e8 d2 41 7e fc 49 83 c7 08 eb c5 e8 c7 41 7e fc <0f> 0b 49 81 ff f8 07 00 00 75 e5 e8 b7 41 7e fc 5b 41 5c 41 5e 41 [ 131.017423][ T1121] RSP: 0018:ffffc9000ffcfb90 EFLAGS: 00010293 [ 131.023637][ T1121] RAX: ffffffff850931d9 RBX: ffff888102380800 RCX: ffff888133cecc00 [ 131.031706][ T1121] RDX: 0000000000000000 RSI: 0000000000c00000 RDI: ffff888102380808 [ 131.039779][ T1121] RBP: ffffc9000ffcfbb0 R08: ffffffff87d41e27 R09: 1ffffffff0fa83c4 [ 131.047803][ T1121] R10: dffffc0000000000 R11: fffffbfff0fa83c5 R12: dffffc0000000000 [ 131.055856][ T1121] R13: dffffc0000000000 R14: ffff888102380000 R15: 0000000000000008 [ 131.063923][ T1121] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 131.072934][ T1121] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 131.079558][ T1121] CR2: 00007fc4575f7d58 CR3: 000000010c758000 CR4: 00000000003526b0 [ 131.087644][ T1121] Call Trace: [ 131.091016][ T1121] [ 131.093977][ T1121] cleanup_net+0x6bd/0xc90 [ 131.098437][ T1121] ? __cfi_cleanup_net+0x10/0x10 [ 131.103920][ T1121] ? kick_pool+0xb9/0x540 [ 131.108308][ T1121] process_scheduled_works+0x7f7/0x1060 [ 131.113935][ T1121] worker_thread+0xc99/0x13f0 [ 131.118663][ T1121] kthread+0x2c7/0x360 [ 131.122808][ T1121] ? __cfi_worker_thread+0x10/0x10 [ 131.127968][ T1121] ? __cfi_kthread+0x10/0x10 [ 131.132660][ T1121] ret_from_fork+0x67/0xa0 [ 131.137204][ T1121] ? __cfi_kthread+0x10/0x10 [ 131.142272][ T1121] ret_from_fork_asm+0x1a/0x30 [ 131.147080][ T1121] [ 131.150165][ T1121] ---[ end trace 0000000000000000 ]--- [ 131.160263][ T1121] ------------[ cut here ]------------ [ 131.165745][ T1121] WARNING: CPU: 0 PID: 1121 at net/xfrm/xfrm_state.c:3217 xfrm_state_fini+0x2be/0x310 [ 131.175388][ T1121] Modules linked in: [ 131.179310][ T1121] CPU: 0 UID: 0 PID: 1121 Comm: kworker/u8:42 Tainted: G B W syzkaller #0 f10dc98c92500eb86b2a5bf5b389293121b4eb86 [ 131.192770][ T1121] Tainted: [B]=BAD_PAGE, [W]=WARN [ 131.197819][ T1121] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 131.207947][ T1121] Workqueue: netns cleanup_net [ 131.212890][ T1121] RIP: 0010:xfrm_state_fini+0x2be/0x310 [ 131.218558][ T1121] Code: 3c 20 00 74 08 48 89 df e8 df b1 f1 fc 48 8b 3b e8 f7 a4 dc fc 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 62 00 99 fc <0f> 0b e9 b0 fd ff ff e8 56 00 99 fc 0f 0b e9 18 fe ff ff e8 4a 00 [ 131.238328][ T1121] RSP: 0018:ffffc9000ffcfb70 EFLAGS: 00010293 [ 131.244508][ T1121] RAX: ffffffff84ee733e RBX: ffff888128700000 RCX: ffff888133cecc00 [ 131.252575][ T1121] RDX: 0000000000000000 RSI: 0000000000c00000 RDI: ffff888133cecc00 [ 131.260717][ T1121] RBP: ffffc9000ffcfb98 R08: ffffffff87d41e27 R09: 1ffffffff0fa83c4 [ 131.268713][ T1121] R10: dffffc0000000000 R11: fffffbfff0fa83c5 R12: 1ffffffff0fa8118 [ 131.276825][ T1121] R13: dffffc0000000000 R14: ffff888128700c00 R15: dffffc0000000000 [ 131.284886][ T1121] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 131.293933][ T1121] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 131.300595][ T1121] CR2: 000055f452e82af8 CR3: 000000010cb18000 CR4: 00000000003526b0 [ 131.308602][ T1121] Call Trace: [ 131.312052][ T1121] [ 131.315070][ T1121] xfrm_net_exit+0x31/0x80 [ 131.319517][ T1121] cleanup_net+0x6bd/0xc90 [ 131.324013][ T1121] ? __cfi_cleanup_net+0x10/0x10 [ 131.328990][ T1121] ? kick_pool+0xb9/0x540 [ 131.333392][ T1121] process_scheduled_works+0x7f7/0x1060 [ 131.339012][ T1121] worker_thread+0xc99/0x13f0 [ 131.343873][ T1121] kthread+0x2c7/0x360 [ 131.347997][ T1121] ? __cfi_worker_thread+0x10/0x10 [ 131.353208][ T1121] ? __cfi_kthread+0x10/0x10 [ 131.357849][ T1121] ret_from_fork+0x67/0xa0 [ 131.362418][ T1121] ? __cfi_kthread+0x10/0x10 [ 131.367042][ T1121] ret_from_fork_asm+0x1a/0x30 [ 131.371872][ T1121] [ 131.374913][ T1121] ---[ end trace 0000000000000000 ]---