last executing test programs: 2.624567976s ago: executing program 2 (id=57): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c0000004a0001e000000000000000000a000003"], 0x1c}}, 0xeaffffff) 2.587164547s ago: executing program 2 (id=58): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000003280)={0x73622a85, 0x100b, 0x4}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@acquire], 0xffffffffffffff47, 0x0, 0x0}) dup3(r1, r0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000540)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0xfffffffffffffffd}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0xffffffffffffff67, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000940)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0xffd, 0x70, 0x28, &(0x7f0000000400)={@ptr={0x66642a85, 0x0, 0x0, 0x0, 0x80000001, 0x3e}, @ptr={0x70742a85, 0x20000000, &(0x7f0000000580)=""/226, 0xe2, 0x1, 0x17}, @fda={0x66646185, 0x9, 0x1, 0xb4}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1040}], 0x0, 0x0, 0x0}) 2.416774951s ago: executing program 2 (id=60): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000014c0)=ANY=[@ANYBLOB="7c010000190001000000000000000000fc02000000000000ff800000000000000000000000000000000000000000000000000003000000000a00002008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000dd0200000000000000000000000000000001000000000000c4000500fc010000000000000000000000000001000004d62b"], 0x17c}}, 0x0) 2.361258042s ago: executing program 2 (id=61): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f0000006680)={0x0, 0x0, &(0x7f0000006640)={&(0x7f0000000280)=ANY=[@ANYBLOB="500000000102010100000000000000000a0000003c0001802c00018014000300ff010000000000000000000000000001140004000000000000000000000000000088ff010c000280050001"], 0x50}, 0x1, 0x0, 0x0, 0x1}, 0x40810) 2.264800995s ago: executing program 2 (id=66): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="50010000100005000000000000000000010000000000000000000000000000000100000000000000000a00808000"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc02000000000000000000000000000000001234320000000000000000000080ffffffffffffff0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000a0000009200000000000000600012"], 0x150}}, 0x0) 2.187221257s ago: executing program 2 (id=68): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) lsm_get_self_attr(0x67, 0xfffffffffffffffc, &(0x7f0000000080), 0x1) copy_file_range(r3, 0x0, r3, 0x0, 0x22b1, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) eventfd2(0x8000, 0x80000) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='vfat\x00', 0x200000, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r6) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="090d2000000000f0ff000700000008000300", @ANYRES32=r8, @ANYBLOB="0800051d000000001400060076657468115f746f5f7465616d0000000400cc000800050006000000140004"], 0x58}}, 0x0) sendmsg$NL80211_CMD_DISCONNECT(r4, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x30, r5, 0x300, 0x70bd2a, 0x25dfdbff, {{}, {@val={0x8, 0x3, r8}, @val={0xc, 0x99, {0x5, 0x4f}}}}, [@NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x18}]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x40800) syz_usb_control_io(r0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) syz_usb_control_io$uac1(0xffffffffffffffff, &(0x7f0000000300)={0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="00236f0000006f23b852bb6953c25d39fd69e82fcef34119bf62d3caafb6e6bab2d754bd3e95897016d856e4d4e72ece58df2e25c243b1b5debe1cc5c94ee38859847a2173e4755214e52154dadfcea1f4378ff50b425423e9c6f3fb0d42de53d295c2404eaf86f822c873f02cd300000000000000"], 0x0}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0xffffffffffffff74, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000") 1.871306574s ago: executing program 0 (id=77): prlimit64(0x0, 0x7, &(0x7f0000000040)={0x0, 0x100}, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000140)={'veth1_to_bridge\x00', {0x2, 0x4e24, @empty}}) preadv(r0, &(0x7f0000002140)=[{&(0x7f00000010c0)=""/4096, 0x1000}, {&(0x7f00000020c0)=""/69, 0x45}], 0x2, 0x9, 0xfffffbf3) syz_io_uring_setup(0x2250, &(0x7f00000000c0)={0x0, 0x5085, 0x8, 0x0, 0x2ba}, 0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) writev(r1, &(0x7f0000000100)=[{&(0x7f0000000a40)="2e9b3d0007e03dd651930100c575963f886411", 0x13}, {&(0x7f0000000140)='\x00\x00\x00\x00\x00\x00!', 0x7}], 0x2) futex_waitv(&(0x7f0000001080)=[{0x3, &(0x7f0000001040)=0x3, 0x82}], 0x1, 0x0, 0x0, 0x1) 1.671152659s ago: executing program 0 (id=81): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@mcast1, @in6=@loopback, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x20}, {@in=@broadcast, 0x4d4, 0x32}, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, {0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x8}, {0x0, 0x0, 0x0, 0xfffe}, {}, 0x0, 0x1000, 0x2, 0x4}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @replay_val={0x10, 0xa, {0x70bd27, 0x70bd2b}}]}, 0x148}, 0x1, 0x0, 0x0, 0x40}, 0x40082) 1.670839809s ago: executing program 0 (id=82): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000007c0)=ANY=[@ANYBLOB="9c010000100001002cbc7000000000007f000001000000000000000000000000ac14142c00000000000000000000000000000003000000000a00000004000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000ffffe000000100000000320000000a010102000000000000000000000000fefffffffffffffffeffffffffffffff010000000000000000000000000000000000000000000000fcffffffffffffffff80000000000000090000000000000007000000000000000408400000000000090000000000000092020000000000000000b01c000000000000000000000000000000000a0004000000000000000000600002006362632874776f666973682900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c00000001a000b000000366a6a849a739045002400001d00020000004c001400"], 0x19c}}, 0x44850) 1.670626799s ago: executing program 0 (id=84): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="9c010000100001002cbc7000000000007f000001000000000000000000000000ac14142c00000000000000000000000000000003000000000a00000004000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000ffffe000000100000000320000000a010102000000000000000000000000fefffffffffffffffeffffffffffffff010000000000000000000000ffffff800000000000000000fcffffffffffffff0000000000000000090000000000000007000000000000000408400000000000090000000000000092020000000000000000b01c000000000000000000000000000000000a0004000000000000000000600002006362632874776f666973682900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c00000001a000b000000366a6a849a739045002400001d00020000004c0014"], 0x19c}, 0x1, 0x0, 0x0, 0xd0}, 0x44850) 1.65444909s ago: executing program 0 (id=85): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c0000004a0001e000000000000000000a000003"], 0x1c}}, 0xefffffff) 1.62957823s ago: executing program 0 (id=86): syz_usb_connect(0x0, 0x43, &(0x7f0000000400)=ANY=[@ANYBLOB="12010000e7c2f708210435030e5f0000000109023100010000000009040000000202ff00042406"], 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0xdeeb, 0x0, 0x1, 0x255, 0x0, r2}, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x54, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r3 = socket(0xa, 0x3, 0x3a) getsockopt$MRT6(r3, 0x29, 0xcf, 0x0, &(0x7f0000000140)=0xfffffffffffffcbf) (async) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) capset(&(0x7f00000001c0)={0x20080522, r4}, 0x0) unshare(0x60000600) (async) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) ioctl$FUSE_DEV_IOC_CLONE(r5, 0x8004e500, &(0x7f0000000040)=r5) (async, rerun: 32) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 32) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000340)={0x124, {0x0, 0x0, 0x0, 0x4, 0x8}}) (async) r6 = userfaultfd(0x80801) (async) close(0x3) (async, rerun: 64) r7 = userfaultfd(0x80801) (async, rerun: 64) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x100}) (async) ioctl$UFFDIO_REGISTER(r7, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000000000/0x400000)=nil, 0x400000}, 0x1}) (async) syz_genetlink_get_family_id$tipc2(&(0x7f00000020c0), 0xffffffffffffffff) read(r7, &(0x7f0000000000)=""/76, 0x4c) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1}) ioctl$UFFDIO_ZEROPAGE(r6, 0xc020aa04, &(0x7f00000001c0)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}}) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) (async) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000500)={0x0, 0x0, 0x0}, &(0x7f0000000180)=0xc) mount$bpf(0x0, 0x0, 0x0, 0x5805040, &(0x7f0000000100)={[{@gid={'gid', 0x3d, r9}}]}) 343.362372ms ago: executing program 1 (id=126): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000014c0)=ANY=[@ANYBLOB="7c010000190001000000000000000000fc0200000000000000000000000000ff8000000000000000000000000000000000000003000000000a00002008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000dd0200000000000000000000000000000001000000000000c40005"], 0x17c}}, 0x0) 331.592892ms ago: executing program 1 (id=127): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="0801000019000100000000000000000000000000000000000000000000000000ac1414bb0000000000000800000000000000fffd000000000a00008000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000fdffffffffffffff00000000000000000400000000000000000000000000000000000000000000000200000000000000ffffffffffffffff0000000000fcca0d0bb2da43bf0000000000000000000000000000000000000000000000b86b6e00000002000000000044000500ac1414aa000000000000000000000000000000002b00000000000000ffffffff000000000000000000000000000000000000000007000000a8000000000000000c0008"], 0x108}, 0x1, 0x0, 0x0, 0x9}, 0x4040000) 312.930283ms ago: executing program 1 (id=128): sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8004}, 0xa4) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0xcc) preadv(r2, &(0x7f0000000140)=[{0x0}, {&(0x7f0000002100)=""/4096, 0x1000}], 0x2, 0x81, 0x14) r3 = syz_genetlink_get_family_id$ethtool(0x0, r2) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x14, r3, 0x20, 0x70bd2a, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x24008850}, 0x0) (async) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$FS_IOC_FIEMAP(0xffffffffffffffff, 0xc020660b, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x400000, 0x0) (async) r5 = openat(r2, &(0x7f0000000040)='./file0\x00', 0x240002, 0x18) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) (async) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r8, r9, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) (async) syz_kvm_setup_cpu$x86(r9, r9, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000140)="0f01c80ffccf66b8f90000000f23d80f21f86635c00000c00f23f866d8cc0f20d86635080000000f22d866b98209000066b80c00000066ba000000000f3066b80500000066b9001800000f01d9ba200066ed66b9aa0100000f3281f7f08d", 0x5e}], 0x1, 0x77, 0x0, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) (async) ioctl$BTRFS_IOC_BALANCE_CTL(r1, 0x40049421, 0x3) (async) ioctl$KVM_SET_IRQCHIP(r4, 0x8208ae63, &(0x7f0000000880)={0x1, 0x0, @pic={0x8, 0x7, 0x8, 0x3, 0x2, 0x1, 0xc5, 0x9, 0x28, 0x2, 0x1, 0x95, 0xb, 0x8, 0x7f, 0x7}}) (async) ioctl$KVM_RUN(r6, 0xae80, 0x0) 176.404256ms ago: executing program 3 (id=132): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$sock(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000280)="64000000100001060000000000000000000000000002000000000000000000001000f90073657468300000000000000024001200080001007665746818000200142001000000000200000000000000000000c6b744604cd47f000010000300766574683100002000000000", 0x6b}], 0x1}, 0x4000000) 105.725477ms ago: executing program 3 (id=133): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000014c0)=ANY=[@ANYBLOB="7c010000190001000000000000000000fc0200000000000000000000000000000000000000000000000000000000000300000003000000000a00002008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000dd0200000000000000000000000000000001000000000000c4000500fc010000000000000000000000000001000004d62b00000002000000640101010000000000000000000000000000000004"], 0x17c}}, 0x0) 105.522357ms ago: executing program 1 (id=134): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8801}, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0xffb2) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f0000000280)=@ccm_128={{0x304}, "e3d9162be1b07411", "726c84d47b8e1c777b43316b24f98517", "6284695f", "296d4442c1ff8da4"}, 0x28) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x4, &(0x7f0000000100)=@gcm_256={{}, "24747942338921a1", "d830ce0a000000000000a7173985202bbfb61b36f3678de8ea2d0d6616076243", "558edb33", "7c5cec21291a43fe"}, 0x38) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB="04010000100007"], 0x104}}, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r2) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB="040100001c"], 0x104}}, 0x0) 105.419508ms ago: executing program 3 (id=135): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40e41, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller1\x00', 0xc201}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/oops_count', 0x101a82, 0x30) write$tun(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000001400000060ec97000fc83c00fe8000000000000000000000000000aaff02000000050000000000000000000111"], 0xffe) 85.985308ms ago: executing program 1 (id=136): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000540)=ANY=[@ANYBLOB="020300030c0000000007000000000000020009001800000053bb469700000000030006000000000002001000000000000000000000001f0002000100000000000000080b00000000030005000000000002"], 0x60}, 0x1, 0x7}, 0x0) 69.618508ms ago: executing program 1 (id=137): syz_clone(0x2000400, 0x0, 0xfffffebf, 0x0, 0x0, 0x0) r0 = getpgid(0x0) mknodat(0xffffffffffffff9c, 0x0, 0x100, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x21040, 0x0) read$FUSE(r1, 0x0, 0x0) syz_fuse_handle_req(r1, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4050) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) newfstatat(0xffffffff0000005d, 0x0, 0x0, 0x1000) r4 = getpid() r5 = syz_pidfd_open(r4, 0x0) setns(r5, 0x24020000) setreuid(0xee01, 0xee01) syz_clone(0xf21e8000, 0x0, 0xa, 0x0, 0x0, 0x0) r6 = syz_pidfd_open(r0, 0x0) pidfd_send_signal(r6, 0x21, 0x0, 0x4) syz_usb_connect(0x0, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB], 0x0) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, 0x0, 0x0, 0x0, 0x0) syz_usb_connect$printer(0x3, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0) setsockopt$packet_fanout_data(0xffffffffffffffff, 0x107, 0x16, 0x0, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0xfffffffffffffffe) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) ioctl$KVM_REINJECT_CONTROL(r8, 0xae71, &(0x7f0000000080)={0x40}) ioctl$sock_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, 0x0) 7.56418ms ago: executing program 3 (id=138): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@mcast1, @in6=@loopback, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x20}, {@in=@broadcast, 0x4d4, 0x32}, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, {0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x8}, {0x0, 0x0, 0x0, 0x2000000}, {}, 0x0, 0x1000, 0x2, 0x4}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @replay_val={0x10, 0xa, {0x70bd27, 0x70bd2b}}]}, 0x148}, 0x1, 0x0, 0x0, 0x40}, 0x40082) 6.57944ms ago: executing program 3 (id=139): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000007c0)=ANY=[@ANYBLOB="9c010000100001002cbc7000000000007f000001000000000000000000000000ac14142c00000000000000000000000000000003000000000a00000004000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000ffffe000000100000000320000000a010102000000000000000000000000fefffffffffffffffeffffffffffffff010000000000000000000000000000000000000000000000fcffffffffffffffffffff8000000000090000000000000007000000000000000408400000000000090000000000000092020000000000000000b01c000000000000000000000000000000000a0004000000000000000000600002006362632874776f666973682900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c00000001a000b000000366a6a849a739045002400001d00020000004c001400"], 0x19c}}, 0x44850) 0s ago: executing program 3 (id=140): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$UHID_CREATE2(r0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r0, 0x1000) r1 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0xbb42) ioctl$HIDIOCGFEATURE(r1, 0x4004480d, 0x0) unshare(0x64000400) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000180)={'lo\x00', {0x2, 0x4e21, @broadcast}}) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000b00)=ANY=[@ANYBLOB="4800000020000100020000000000000002"], 0x48}, 0x1, 0x0, 0x0, 0x40940}, 0x0) kernel console output (not intermixed with test programs): T36] audit: type=1400 audit(1786666629.580:62): avc: denied { rlimitinh } for pid=232 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.904679][ T36] audit: type=1400 audit(1786666629.580:63): avc: denied { siginh } for pid=232 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.179' (ED25519) to the list of known hosts. [ 22.552338][ T36] audit: type=1400 audit(1786666637.230:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.555406][ T286] cgroup: Unknown subsys name 'net' [ 22.574978][ T36] audit: type=1400 audit(1786666637.230:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.602302][ T36] audit: type=1400 audit(1786666637.260:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.602650][ T286] cgroup: Unknown subsys name 'devices' [ 22.725642][ T286] cgroup: Unknown subsys name 'hugetlb' [ 22.731245][ T286] cgroup: Unknown subsys name 'rlimit' [ 22.826012][ T36] audit: type=1400 audit(1786666637.510:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.849174][ T36] audit: type=1400 audit(1786666637.510:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.874017][ T36] audit: type=1400 audit(1786666637.510:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.892409][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 22.905921][ T36] audit: type=1400 audit(1786666637.590:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.931336][ T36] audit: type=1400 audit(1786666637.590:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.952980][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.957402][ T36] audit: type=1400 audit(1786666637.630:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.991192][ T36] audit: type=1400 audit(1786666637.630:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.402085][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.409181][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.416326][ T296] bridge_slave_0: entered allmulticast mode [ 24.422612][ T296] bridge_slave_0: entered promiscuous mode [ 24.429046][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.436126][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.443188][ T296] bridge_slave_1: entered allmulticast mode [ 24.449565][ T296] bridge_slave_1: entered promiscuous mode [ 24.458302][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.465360][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.472395][ T295] bridge_slave_0: entered allmulticast mode [ 24.478698][ T295] bridge_slave_0: entered promiscuous mode [ 24.487618][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.494710][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.501763][ T295] bridge_slave_1: entered allmulticast mode [ 24.508107][ T295] bridge_slave_1: entered promiscuous mode [ 24.519060][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.526130][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.533182][ T293] bridge_slave_0: entered allmulticast mode [ 24.539427][ T293] bridge_slave_0: entered promiscuous mode [ 24.556639][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.563726][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.570770][ T293] bridge_slave_1: entered allmulticast mode [ 24.577061][ T293] bridge_slave_1: entered promiscuous mode [ 24.635009][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.642082][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.649192][ T294] bridge_slave_0: entered allmulticast mode [ 24.655788][ T294] bridge_slave_0: entered promiscuous mode [ 24.662219][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.669298][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.676425][ T294] bridge_slave_1: entered allmulticast mode [ 24.682673][ T294] bridge_slave_1: entered promiscuous mode [ 24.770134][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.777209][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.784518][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.791555][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.828520][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.835584][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.842861][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.849915][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.865435][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.872481][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.879808][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.886854][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.898299][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.905378][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.912693][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.919783][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.954611][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.962093][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.969376][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.977012][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.984327][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.991508][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.998838][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.006003][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.032592][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.039660][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.054281][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.061324][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.069791][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.076847][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.091770][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.098804][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.106390][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.113468][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.122266][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.129380][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.137817][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.144878][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.158061][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.165106][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.216116][ T293] veth0_vlan: entered promiscuous mode [ 25.231944][ T295] veth0_vlan: entered promiscuous mode [ 25.242943][ T296] veth0_vlan: entered promiscuous mode [ 25.252973][ T294] veth0_vlan: entered promiscuous mode [ 25.273711][ T295] veth1_macvtap: entered promiscuous mode [ 25.281792][ T293] veth1_macvtap: entered promiscuous mode [ 25.289757][ T294] veth1_macvtap: entered promiscuous mode [ 25.299034][ T296] veth1_macvtap: entered promiscuous mode [ 25.347615][ T295] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 25.406222][ T317] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.467992][ T317] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1'. [ 25.498631][ T330] netlink: 36 bytes leftover after parsing attributes in process `syz.2.8'. [ 25.673512][ T310] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 25.705746][ T359] netlink: 96 bytes leftover after parsing attributes in process `syz.1.16'. [ 25.760626][ T368] netlink: 16 bytes leftover after parsing attributes in process `syz.1.18'. [ 25.770600][ T368] netlink: 20 bytes leftover after parsing attributes in process `syz.1.18'. [ 25.823499][ T9] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 25.834897][ T310] usb 4-1: unable to get BOS descriptor or descriptor too short [ 25.845381][ T310] usb 4-1: not running at top speed; connect to a high speed hub [ 25.854356][ T310] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 25.866103][ T310] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 25.877405][ T310] usb 4-1: string descriptor 0 read error: -22 [ 25.884692][ T310] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 25.894766][ T310] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.912190][ T310] usb 4-1: 0:2 : does not exist [ 25.943515][ T64] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 25.985714][ T9] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 25.995456][ T9] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 26.006684][ T9] usb 3-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01 [ 26.015889][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.024030][ T9] usb 3-1: Product: syz [ 26.028211][ T9] usb 3-1: Manufacturer: syz [ 26.032821][ T9] usb 3-1: SerialNumber: syz [ 26.046368][ T9] ums-karma 3-1:1.0: USB Mass Storage device detected [ 26.060953][ T9] ums-karma 3-1:1.0: This device (045a,5210,0101 S 06 P f5) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel syzkaller) [ 26.060953][ T9] Please send a copy of this message to and [ 26.103482][ T64] usb 1-1: Using ep0 maxpacket: 32 [ 26.109498][ T9] ums-karma 3-1:1.0: probe with driver ums-karma failed with error -5 [ 26.118121][ T64] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 26.130825][ T64] usb 1-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 26.140441][ T64] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.148481][ T64] usb 1-1: Product: syz [ 26.152721][ T64] usb 1-1: Manufacturer: syz [ 26.157376][ T64] usb 1-1: SerialNumber: syz [ 26.162734][ T64] usb 1-1: config 0 descriptor?? [ 26.168650][ T64] usb 1-1: bad CDC descriptors [ 26.173708][ T64] usb 1-1: unsupported MDLM descriptors [ 26.183472][ T361] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 26.253373][ T333] raw_sendmsg: syz.2.9 forgot to set AF_INET. Fix it! [ 26.322466][ T312] Zero length message leads to an empty skb [ 26.334340][ T361] usb 2-1: not running at top speed; connect to a high speed hub [ 26.342843][ T361] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 26.353217][ T361] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 26.362482][ T361] usb 2-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 26.371778][ T361] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.426318][ T361] usb 1-1: USB disconnect, device number 2 [ 26.644944][ T392] usb 2-1: USB disconnect, device number 2 [ 26.777344][ T31] usb 3-1: USB disconnect, device number 2 [ 26.991318][ T430] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 26.991347][ T430] rust_binder: Read failure Err(EFAULT) in pid:20 [ 27.004557][ T439] netlink: 4 bytes leftover after parsing attributes in process `syz.3.29'. [ 27.020458][ T430] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 27.020478][ T430] rust_binder: Read failure Err(EFAULT) in pid:20 [ 27.037764][ T430] rust_binder: 429:430 got transaction with invalid offset [ 27.051789][ T430] rust_binder: Failure in copy_transaction_data: EINVAL [ 27.051836][ T430] rust_binder: 429:430 transaction call to 429:0 failed EINVAL, code 0 size 112-40 [ 27.074987][ T64] rust_binder: 429: undelivered TRANSACTION_ERROR: 29201 [ 27.160627][ T455] veth1_macvtap: left promiscuous mode [ 27.190431][ T455] macsec0: entered promiscuous mode [ 27.198351][ T460] netlink: 36 bytes leftover after parsing attributes in process `syz.3.36'. [ 27.210983][ T455] macsec0: entered allmulticast mode [ 27.226429][ T456] veth1_macvtap: entered promiscuous mode [ 27.241323][ T456] veth1_macvtap: entered allmulticast mode [ 27.258606][ T456] macsec0: left promiscuous mode [ 27.267456][ T456] macsec0: left allmulticast mode [ 27.274945][ T456] veth1_macvtap: left allmulticast mode [ 27.392701][ T494] netlink: 96 bytes leftover after parsing attributes in process `syz.0.45'. [ 27.448328][ T498] netlink: 16 bytes leftover after parsing attributes in process `syz.3.46'. [ 27.465905][ T501] x_tables: unsorted underflow at hook 4 [ 27.474339][ T498] netlink: 20 bytes leftover after parsing attributes in process `syz.3.46'. [ 27.530204][ T508] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 27.540223][ T508] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 27.543550][ T64] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 27.578698][ T36] kauditd_printk_skb: 98 callbacks suppressed [ 27.578713][ T36] audit: type=1400 audit(1786666642.260:172): avc: denied { create } for pid=509 comm="syz.2.51" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 27.605088][ T36] audit: type=1400 audit(1786666642.290:173): avc: denied { write } for pid=509 comm="syz.2.51" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 27.675104][ T36] audit: type=1400 audit(1786666642.360:174): avc: denied { mounton } for pid=514 comm="syz.2.53" path="/14/file0" dev="tmpfs" ino=89 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 27.697805][ T36] audit: type=1400 audit(1786666642.360:175): avc: denied { mount } for pid=514 comm="syz.2.53" name="/" dev="incremental-fs" ino=89 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 27.713525][ T392] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 27.728319][ T36] audit: type=1400 audit(1786666642.360:176): avc: denied { read } for pid=514 comm="syz.2.53" name=".log" dev="incremental-fs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 27.729628][ T64] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 50, changing to 9 [ 27.751972][ T36] audit: type=1400 audit(1786666642.360:177): avc: denied { open } for pid=514 comm="syz.2.53" path="/14/file0/.log" dev="incremental-fs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 27.767423][ T64] usb 2-1: New USB device found, idVendor=056a, idProduct=00b1, bcdDevice= 0.00 [ 27.793976][ T36] audit: type=1400 audit(1786666642.380:178): avc: denied { watch } for pid=514 comm="syz.2.53" path="/14" dev="tmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 27.813582][ T64] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.851992][ T36] audit: type=1400 audit(1786666642.530:179): avc: denied { unmount } for pid=295 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 27.900144][ T392] usb 1-1: config 32 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 27.910148][ T392] usb 1-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice=98.c7 [ 27.928858][ T36] audit: type=1400 audit(1786666642.610:180): avc: denied { read } for pid=520 comm="syz.2.56" name="binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 27.930489][ T392] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.974569][ T36] audit: type=1400 audit(1786666642.640:181): avc: denied { open } for pid=520 comm="syz.2.56" path="/dev/binderfs/binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 28.053272][ T525] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 28.054135][ T525] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 28.060670][ T525] rust_binder: Read failure Err(EFAULT) in pid:48 [ 28.075178][ T525] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 28.081862][ T525] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 28.088566][ T525] rust_binder: Read failure Err(EFAULT) in pid:48 [ 28.116004][ T525] rust_binder: 524:525 got transaction to invalid handle 1 [ 28.153453][ T525] rust_binder: 524:525 transaction call to 0:0 failed ENOENT, code 0 size 112-40 [ 28.163142][ T9] rust_binder: 524: undelivered TRANSACTION_ERROR: 29201 [ 28.170598][ T392] usb 1-1: string descriptor 0 read error: -71 [ 28.183651][ T392] hub 1-1:32.0: bad descriptor, ignoring hub [ 28.195910][ T392] hub 1-1:32.0: probe with driver hub failed with error -5 [ 28.227494][ T464] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3343437945 (53495007120 ns) > initial count (12288 ns). Using initial count to start timer. [ 28.270576][ T64] usbhid 2-1:1.0: can't add hid device: -71 [ 28.276638][ T64] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 28.290864][ T64] usb 2-1: USB disconnect, device number 3 [ 28.369372][ T546] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 28.383268][ T546] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 28.639471][ T566] binder: Bad value for 'max' [ 28.663480][ T31] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 28.814579][ T31] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 28.825574][ T31] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 28.834714][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.862302][ T31] usb 3-1: config 0 descriptor?? [ 28.992835][ T593] SELinux: failed to load policy [ 29.018318][ T599] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 29.018337][ T599] rust_binder: Read failure Err(EFAULT) in pid:48 [ 29.027069][ T599] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 29.034671][ T599] rust_binder: Read failure Err(EFAULT) in pid:48 [ 29.043117][ T599] rust_binder: 598:599 got transaction with invalid offset [ 29.056941][ T599] rust_binder: Failure in copy_transaction_data: EINVAL [ 29.057134][ T599] rust_binder: 598:599 transaction call to 598:0 failed EINVAL, code 0 size 112-40 [ 29.075351][ T361] rust_binder: 598: undelivered TRANSACTION_ERROR: 29201 [ 29.083880][ T31] usbhid 3-1:0.0: can't add hid device: -71 [ 29.092042][ T31] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 29.102265][ T31] usb 3-1: USB disconnect, device number 3 [ 29.275723][ T628] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 29.603448][ T31] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 29.626689][ T665] 9p: Unknown Cache mode or invalid value dev/kvm [ 29.663762][ T670] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 29.663784][ T670] rust_binder: Read failure Err(EFAULT) in pid:85 [ 29.685649][ T670] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 29.692127][ T670] rust_binder: Read failure Err(EFAULT) in pid:85 [ 29.713805][ T672] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 29.714220][ T670] rust_binder: 669:670 got transaction with invalid offset [ 29.720571][ T672] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 29.730576][ T670] rust_binder: Failure in copy_transaction_data: EINVAL [ 29.743960][ T670] rust_binder: 669:670 transaction call to 669:0 failed EINVAL, code 0 size 112-40 [ 29.762218][ T395] rust_binder: 669: undelivered TRANSACTION_ERROR: 29201 [ 29.784565][ T31] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 29.795676][ T31] usb 3-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 29.805007][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.814303][ T31] usb 3-1: config 0 descriptor?? [ 29.866778][ T679] tipc: Started in network mode [ 29.871964][ T679] tipc: Node identity 0010000000000000002, cluster identity 4711 [ 30.046693][ T686] ======================================================= [ 30.046693][ T686] WARNING: The mand mount option has been deprecated and [ 30.046693][ T686] and is ignored by this kernel. Remove the mand [ 30.046693][ T686] option from the mount to silence this warning. [ 30.046693][ T686] ======================================================= [ 30.120213][ T686] mmap: syz.1.122 (686) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 30.230735][ T552] FAT-fs (rnullb0): bogus number of reserved sectors [ 30.243498][ T552] FAT-fs (rnullb0): Can't find a valid FAT filesystem [ 30.261541][ T552] netlink: 'syz.2.68': attribute type 11 has an invalid length. [ 30.416690][ T708] tap0: tun_chr_ioctl cmd 1074025676 [ 30.422160][ T708] tap0: owner set to 0 [ 30.507420][ T715] __nla_validate_parse: 14 callbacks suppressed [ 30.507438][ T715] netlink: 20 bytes leftover after parsing attributes in process `syz.1.134'. [ 30.526630][ T715] netlink: 240 bytes leftover after parsing attributes in process `syz.1.134'. [ 30.646437][ T641] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 30.664211][ T641] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 30.683833][ T31] aiptek 3-1:0.0: Aiptek using 400 ms programming speed [ 30.698619][ T31] input: Aiptek as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input4 [ 30.726075][ C1] ------------[ cut here ]------------ [ 30.731577][ C1] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31 [ 30.740197][ C1] index 13823 is out of range for type 'const int[34]' [ 30.747090][ C1] CPU: 1 UID: 0 PID: 733 Comm: syz.3.140 Not tainted syzkaller #0 530bafefbfb71712cc923bbf40d44c9abc20558f [ 30.747138][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 30.747161][ C1] Call Trace: [ 30.747170][ C1] [ 30.747179][ C1] __dump_stack+0x21/0x30 [ 30.747224][ C1] dump_stack_lvl+0x140/0x1c0 [ 30.747257][ C1] ? __cfi_dump_stack_lvl+0x10/0x10 [ 30.747297][ C1] ? get_page_from_freelist+0x4aea/0x4ba0 [ 30.747333][ C1] ? shmem_get_folio_gfp+0x5cd/0x12e0 [ 30.747359][ C1] ? do_pte_missing+0x364c/0x4440 [ 30.747390][ C1] dump_stack+0x19/0x20 [ 30.747420][ C1] ubsan_epilogue+0xe/0x40 [ 30.747440][ C1] __ubsan_handle_out_of_bounds+0xe8/0xf0 [ 30.747473][ C1] aiptek_irq+0x208d/0x2a00 [ 30.747505][ C1] ? _raw_spin_unlock+0x45/0x60 [ 30.747533][ C1] ? kcov_remote_start+0x1d2/0x3c0 [ 30.747558][ C1] __usb_hcd_giveback_urb+0x36e/0x530 [ 30.747595][ C1] usb_hcd_giveback_urb+0x12b/0x400 [ 30.747628][ C1] dummy_timer+0xa3f/0x4900 [ 30.747661][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 30.747682][ C1] ? _raw_spin_lock_irq+0x93/0x120 [ 30.747709][ C1] ? timerqueue_del+0xd7/0x130 [ 30.747732][ C1] ? __hrtimer_run_queues+0x2bd/0x8e0 [ 30.747766][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 30.747787][ C1] __hrtimer_run_queues+0x3ae/0x8e0 [ 30.747823][ C1] ? hrtimer_interrupt+0xf30/0xf30 [ 30.747855][ C1] ? read_tsc+0xd/0x20 [ 30.747885][ C1] ? ktime_get_update_offsets_now+0x3c0/0x3e0 [ 30.747914][ C1] hrtimer_run_softirq+0x159/0x560 [ 30.747935][ C1] ? irqtime_account_irq+0x51/0x1c0 [ 30.747967][ C1] handle_softirqs+0x1aa/0x620 [ 30.747992][ C1] __irq_exit_rcu+0x47/0xb0 [ 30.748014][ C1] irq_exit_rcu+0xd/0x30 [ 30.748035][ C1] sysvec_apic_timer_interrupt+0x82/0x90 [ 30.748071][ C1] [ 30.748078][ C1] [ 30.748087][ C1] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 30.748119][ C1] RIP: 0010:stack_trace_consume_entry+0x81/0x2a0 [ 30.748150][ C1] Code: 3c 4c 8d 67 0c 4d 89 e7 49 c1 ef 03 41 0f b6 04 17 84 c0 0f 85 58 01 00 00 45 8b 34 24 45 85 f6 74 22 41 ff ce 41 0f b6 04 17 <84> c0 0f 85 8d 01 00 00 45 89 34 24 b0 01 e9 a2 00 00 00 31 c0 e9 [ 30.748171][ C1] RSP: 0018:ffffc9000e7aea50 EFLAGS: 00000202 [ 30.748201][ C1] RAX: 0000000000000000 RBX: 1ffff92001cf5d6e RCX: 0000000001cf5d00 [ 30.748218][ C1] RDX: dffffc0000000000 RSI: ffffffff81e66d75 RDI: ffffc9000e7aeb60 [ 30.748237][ C1] RBP: ffffc9000e7aea98 R08: ffffc9000e7aeb70 R09: ffffc9000e7aeb68 [ 30.748255][ C1] R10: 0000000000000000 R11: ffffffff81759ed0 R12: ffffc9000e7aeb6c [ 30.748278][ C1] R13: 1ffff92001cf5d6d R14: 0000000000000001 R15: 1ffff92001cf5d6d [ 30.748296][ C1] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 30.748325][ C1] ? save_stack+0x125/0x240 [ 30.748357][ C1] ? __kernel_text_address+0x11/0x40 [ 30.748390][ C1] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 30.748417][ C1] arch_stack_walk+0x12c/0x170 [ 30.748441][ C1] ? save_stack+0x125/0x240 [ 30.748469][ C1] stack_trace_save+0xaa/0x100 [ 30.748494][ C1] ? __cfi_stack_trace_save+0x10/0x10 [ 30.748519][ C1] ? stack_depot_save_flags+0x38/0x800 [ 30.748548][ C1] ? __asan_memset+0x39/0x50 [ 30.748570][ C1] save_stack+0x125/0x240 [ 30.748598][ C1] ? __reset_page_owner+0x450/0x450 [ 30.748626][ C1] ? __schedule+0x152e/0x20b0 [ 30.748657][ C1] ? kvm_sched_clock_read+0x15/0x30 [ 30.748678][ C1] ? sched_clock_noinstr+0xd/0x30 [ 30.748710][ C1] __set_page_owner+0x8e/0x600 [ 30.748739][ C1] ? __cfi___set_page_owner+0x10/0x10 [ 30.748767][ C1] ? __cfi_sched_clock_cpu+0x10/0x10 [ 30.748799][ C1] ? kasan_unpoison+0x4a/0x70 [ 30.748822][ C1] post_alloc_hook+0x37d/0x3b0 [ 30.748853][ C1] ? __cfi_post_alloc_hook+0x10/0x10 [ 30.748883][ C1] ? gfp_to_alloc_flags_cma+0x1c0/0x1c0 [ 30.748907][ C1] ? _raw_spin_trylock+0xb5/0x140 [ 30.748932][ C1] ? __cfi__raw_spin_trylock+0x10/0x10 [ 30.748959][ C1] prep_new_page+0x2d/0x180 [ 30.748990][ C1] get_page_from_freelist+0x4aea/0x4ba0 [ 30.749025][ C1] ? folios_put_refs+0x746/0x860 [ 30.749057][ C1] ? __cfi_folios_put_refs+0x10/0x10 [ 30.749087][ C1] ? xas_create+0xe23/0xf80 [ 30.749116][ C1] ? __cfi_cgroup_rstat_updated+0x10/0x10 [ 30.749142][ C1] ? __alloc_pages_noprof+0x7e0/0x7e0 [ 30.749175][ C1] ? static_key_count+0x45/0x70 [ 30.749204][ C1] ? gfp_to_alloc_flags_cma+0x96/0x1c0 [ 30.749228][ C1] ? lruvec_init+0x1f1/0x280 [ 30.749254][ C1] __alloc_pages_noprof+0x35a/0x7e0 [ 30.749296][ C1] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 30.749331][ C1] ? folio_add_lru+0x116/0x400 [ 30.749358][ C1] ? __cfi_folio_add_lru+0x10/0x10 [ 30.749406][ C1] __folio_alloc_noprof+0x14/0x80 [ 30.749442][ C1] shmem_alloc_and_add_folio+0x45f/0x10b0 [ 30.749475][ C1] ? shmem_replace_folio+0x9b0/0x9b0 [ 30.749505][ C1] ? shmem_huge_global_enabled+0x2da/0x360 [ 30.749534][ C1] ? shmem_allowable_huge_orders+0x405/0x430 [ 30.749563][ C1] shmem_get_folio_gfp+0x5cd/0x12e0 [ 30.749594][ C1] ? shmem_get_folio+0xc0/0xc0 [ 30.749621][ C1] ? __cfi_filemap_map_pages+0x10/0x10 [ 30.749653][ C1] ? folio_unlock+0x137/0x1b0 [ 30.749682][ C1] shmem_fault+0x17d/0x350 [ 30.749713][ C1] do_pte_missing+0x364c/0x4440 [ 30.749748][ C1] ? _raw_spin_unlock+0x45/0x60 [ 30.749777][ C1] ? finish_task_switch+0x139/0x770 [ 30.749810][ C1] ? pte_marker_clear+0x1b0/0x1b0 [ 30.749842][ C1] ? cgroup_rstat_updated+0x144/0x800 [ 30.749869][ C1] ? irqentry_exit+0x4a/0x60 [ 30.749892][ C1] ? __cfi_cgroup_rstat_updated+0x10/0x10 [ 30.749920][ C1] ? asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 30.749971][ C1] ? pte_offset_map_rw_nolock+0x236/0x2c0 [ 30.749998][ C1] handle_mm_fault+0x1189/0x1ba0 [ 30.750027][ C1] ? __kasan_check_write+0x18/0x20 [ 30.750057][ C1] ? __cfi_handle_mm_fault+0x10/0x10 [ 30.750087][ C1] ? follow_page_pte+0x4b2/0xba0 [ 30.750124][ C1] ? gup_must_unshare+0x1e0/0x1e0 [ 30.750161][ C1] __get_user_pages+0x114b/0x22d0 [ 30.750200][ C1] ? populate_vma_page_range+0x220/0x220 [ 30.750232][ C1] ? down_read+0x7f/0xe0 [ 30.750254][ C1] ? __cfi_down_read+0x10/0x10 [ 30.750287][ C1] __mm_populate+0x300/0x440 [ 30.750322][ C1] vm_mmap_pgoff+0x426/0x4b0 [ 30.750346][ C1] ? __cfi_vm_mmap_pgoff+0x10/0x10 [ 30.750372][ C1] ? xfd_validate_state+0x68/0x140 [ 30.750409][ C1] ksys_mmap_pgoff+0xfa/0x1e0 [ 30.750432][ C1] ? __kasan_check_write+0x18/0x20 [ 30.750458][ C1] __x64_sys_mmap+0x121/0x140 [ 30.750483][ C1] x64_sys_call+0x13bf/0x2ee0 [ 30.750506][ C1] do_syscall_64+0x57/0xf0 [ 30.750535][ C1] ? clear_bhb_loop+0x50/0xa0 [ 30.750571][ C1] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 30.750614][ C1] RIP: 0033:0x7f201c19e0d9 [ 30.750634][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 30.750654][ C1] RSP: 002b:00007f201cfc6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 30.750679][ C1] RAX: ffffffffffffffda RBX: 00007f201c425fa0 RCX: 00007f201c19e0d9 [ 30.750697][ C1] RDX: 000000000000000f RSI: 0000000000b36000 RDI: 0000200000000000 [ 30.750714][ C1] RBP: 00007f201c235024 R08: 0000000000000003 R09: 0000000000001000 [ 30.750730][ C1] R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000 [ 30.750756][ C1] R13: 00007f201c426038 R14: 00007f201c425fa0 R15: 00007ffcbb04f408 [ 30.750774][ C1] [ 30.750782][ C1] ---[ end trace ]--- [ 31.483070][ C1] ------------[ cut here ]------------ [ 31.488642][ C1] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30 [ 31.497259][ C1] index 13824 is out of range for type 'const int[34]' [ 31.504134][ C1] CPU: 1 UID: 0 PID: 733 Comm: syz.3.140 Not tainted syzkaller #0 530bafefbfb71712cc923bbf40d44c9abc20558f [ 31.504170][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 31.504186][ C1] Call Trace: [ 31.504194][ C1] [ 31.504202][ C1] __dump_stack+0x21/0x30 [ 31.504243][ C1] dump_stack_lvl+0x140/0x1c0 [ 31.504278][ C1] ? __cfi_dump_stack_lvl+0x10/0x10 [ 31.504311][ C1] ? input_event_dispose+0x2f5/0x6d0 [ 31.504351][ C1] dump_stack+0x19/0x20 [ 31.504383][ C1] ubsan_epilogue+0xe/0x40 [ 31.504405][ C1] __ubsan_handle_out_of_bounds+0xe8/0xf0 [ 31.504441][ C1] aiptek_irq+0x1f3c/0x2a00 [ 31.504475][ C1] ? kcov_remote_start+0x1d2/0x3c0 [ 31.504501][ C1] __usb_hcd_giveback_urb+0x36e/0x530 [ 31.504540][ C1] usb_hcd_giveback_urb+0x12b/0x400 [ 31.504576][ C1] dummy_timer+0xa3f/0x4900 [ 31.504610][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 31.504633][ C1] ? _raw_spin_lock_irq+0x93/0x120 [ 31.504662][ C1] ? timerqueue_del+0xd7/0x130 [ 31.504686][ C1] ? __hrtimer_run_queues+0x2bd/0x8e0 [ 31.504731][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 31.504753][ C1] __hrtimer_run_queues+0x3ae/0x8e0 [ 31.504792][ C1] ? hrtimer_interrupt+0xf30/0xf30 [ 31.504826][ C1] ? read_tsc+0xd/0x20 [ 31.504857][ C1] ? ktime_get_update_offsets_now+0x3c0/0x3e0 [ 31.504889][ C1] hrtimer_run_softirq+0x159/0x560 [ 31.504911][ C1] ? irqtime_account_irq+0x51/0x1c0 [ 31.504946][ C1] handle_softirqs+0x1aa/0x620 [ 31.504972][ C1] __irq_exit_rcu+0x47/0xb0 [ 31.504995][ C1] irq_exit_rcu+0xd/0x30 [ 31.505017][ C1] sysvec_apic_timer_interrupt+0x82/0x90 [ 31.505054][ C1] [ 31.505062][ C1] [ 31.505071][ C1] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 31.505105][ C1] RIP: 0010:stack_trace_consume_entry+0x81/0x2a0 [ 31.505139][ C1] Code: 3c 4c 8d 67 0c 4d 89 e7 49 c1 ef 03 41 0f b6 04 17 84 c0 0f 85 58 01 00 00 45 8b 34 24 45 85 f6 74 22 41 ff ce 41 0f b6 04 17 <84> c0 0f 85 8d 01 00 00 45 89 34 24 b0 01 e9 a2 00 00 00 31 c0 e9 [ 31.505159][ C1] RSP: 0018:ffffc9000e7aea50 EFLAGS: 00000202 [ 31.505182][ C1] RAX: 0000000000000000 RBX: 1ffff92001cf5d6e RCX: 0000000001cf5d00 [ 31.505201][ C1] RDX: dffffc0000000000 RSI: ffffffff81e66d75 RDI: ffffc9000e7aeb60 [ 31.505221][ C1] RBP: ffffc9000e7aea98 R08: ffffc9000e7aeb70 R09: ffffc9000e7aeb68 [ 31.505239][ C1] R10: 0000000000000000 R11: ffffffff81759ed0 R12: ffffc9000e7aeb6c [ 31.505257][ C1] R13: 1ffff92001cf5d6d R14: 0000000000000001 R15: 1ffff92001cf5d6d [ 31.505275][ C1] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 31.505305][ C1] ? save_stack+0x125/0x240 [ 31.505336][ C1] ? __kernel_text_address+0x11/0x40 [ 31.505370][ C1] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 31.505398][ C1] arch_stack_walk+0x12c/0x170 [ 31.505423][ C1] ? save_stack+0x125/0x240 [ 31.505453][ C1] stack_trace_save+0xaa/0x100 [ 31.505480][ C1] ? __cfi_stack_trace_save+0x10/0x10 [ 31.505506][ C1] ? stack_depot_save_flags+0x38/0x800 [ 31.505537][ C1] ? __asan_memset+0x39/0x50 [ 31.505560][ C1] save_stack+0x125/0x240 [ 31.505590][ C1] ? __reset_page_owner+0x450/0x450 [ 31.505619][ C1] ? __schedule+0x152e/0x20b0 [ 31.505653][ C1] ? kvm_sched_clock_read+0x15/0x30 [ 31.505675][ C1] ? sched_clock_noinstr+0xd/0x30 [ 31.505717][ C1] __set_page_owner+0x8e/0x600 [ 31.505748][ C1] ? __cfi___set_page_owner+0x10/0x10 [ 31.505780][ C1] ? __cfi_sched_clock_cpu+0x10/0x10 [ 31.505815][ C1] ? kasan_unpoison+0x4a/0x70 [ 31.505839][ C1] post_alloc_hook+0x37d/0x3b0 [ 31.505871][ C1] ? __cfi_post_alloc_hook+0x10/0x10 [ 31.505903][ C1] ? gfp_to_alloc_flags_cma+0x1c0/0x1c0 [ 31.505927][ C1] ? _raw_spin_trylock+0xb5/0x140 [ 31.505955][ C1] ? __cfi__raw_spin_trylock+0x10/0x10 [ 31.505984][ C1] prep_new_page+0x2d/0x180 [ 31.506015][ C1] get_page_from_freelist+0x4aea/0x4ba0 [ 31.506052][ C1] ? folios_put_refs+0x746/0x860 [ 31.506087][ C1] ? __cfi_folios_put_refs+0x10/0x10 [ 31.506119][ C1] ? xas_create+0xe23/0xf80 [ 31.506151][ C1] ? __cfi_cgroup_rstat_updated+0x10/0x10 [ 31.506179][ C1] ? __alloc_pages_noprof+0x7e0/0x7e0 [ 31.506214][ C1] ? static_key_count+0x45/0x70 [ 31.506245][ C1] ? gfp_to_alloc_flags_cma+0x96/0x1c0 [ 31.506270][ C1] ? lruvec_init+0x1f1/0x280 [ 31.506298][ C1] __alloc_pages_noprof+0x35a/0x7e0 [ 31.506335][ C1] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 31.506372][ C1] ? folio_add_lru+0x116/0x400 [ 31.506402][ C1] ? __cfi_folio_add_lru+0x10/0x10 [ 31.506434][ C1] __folio_alloc_noprof+0x14/0x80 [ 31.506469][ C1] shmem_alloc_and_add_folio+0x45f/0x10b0 [ 31.506502][ C1] ? shmem_replace_folio+0x9b0/0x9b0 [ 31.506532][ C1] ? shmem_huge_global_enabled+0x2da/0x360 [ 31.506561][ C1] ? shmem_allowable_huge_orders+0x405/0x430 [ 31.506591][ C1] shmem_get_folio_gfp+0x5cd/0x12e0 [ 31.506621][ C1] ? shmem_get_folio+0xc0/0xc0 [ 31.506647][ C1] ? __cfi_filemap_map_pages+0x10/0x10 [ 31.506679][ C1] ? folio_unlock+0x137/0x1b0 [ 31.506715][ C1] shmem_fault+0x17d/0x350 [ 31.506745][ C1] do_pte_missing+0x364c/0x4440 [ 31.506778][ C1] ? _raw_spin_unlock+0x45/0x60 [ 31.506806][ C1] ? finish_task_switch+0x139/0x770 [ 31.506838][ C1] ? pte_marker_clear+0x1b0/0x1b0 [ 31.506869][ C1] ? cgroup_rstat_updated+0x144/0x800 [ 31.506896][ C1] ? irqentry_exit+0x4a/0x60 [ 31.506919][ C1] ? __cfi_cgroup_rstat_updated+0x10/0x10 [ 31.506946][ C1] ? asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 31.506982][ C1] ? pte_offset_map_rw_nolock+0x236/0x2c0 [ 31.507007][ C1] handle_mm_fault+0x1189/0x1ba0 [ 31.507035][ C1] ? __kasan_check_write+0x18/0x20 [ 31.507063][ C1] ? __cfi_handle_mm_fault+0x10/0x10 [ 31.507092][ C1] ? follow_page_pte+0x4b2/0xba0 [ 31.507127][ C1] ? gup_must_unshare+0x1e0/0x1e0 [ 31.507163][ C1] __get_user_pages+0x114b/0x22d0 [ 31.507200][ C1] ? populate_vma_page_range+0x220/0x220 [ 31.507232][ C1] ? down_read+0x7f/0xe0 [ 31.507252][ C1] ? __cfi_down_read+0x10/0x10 [ 31.507275][ C1] __mm_populate+0x300/0x440 [ 31.507308][ C1] vm_mmap_pgoff+0x426/0x4b0 [ 31.507332][ C1] ? __cfi_vm_mmap_pgoff+0x10/0x10 [ 31.507356][ C1] ? xfd_validate_state+0x68/0x140 [ 31.507391][ C1] ksys_mmap_pgoff+0xfa/0x1e0 [ 31.507415][ C1] ? __kasan_check_write+0x18/0x20 [ 31.507440][ C1] __x64_sys_mmap+0x121/0x140 [ 31.507464][ C1] x64_sys_call+0x13bf/0x2ee0 [ 31.507487][ C1] do_syscall_64+0x57/0xf0 [ 31.507515][ C1] ? clear_bhb_loop+0x50/0xa0 [ 31.507549][ C1] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 31.507581][ C1] RIP: 0033:0x7f201c19e0d9 [ 31.507602][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 31.507622][ C1] RSP: 002b:00007f201cfc6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 31.507649][ C1] RAX: ffffffffffffffda RBX: 00007f201c425fa0 RCX: 00007f201c19e0d9 [ 31.507668][ C1] RDX: 000000000000000f RSI: 0000000000b36000 RDI: 0000200000000000 [ 31.507685][ C1] RBP: 00007f201c235024 R08: 0000000000000003 R09: 0000000000001000 [ 31.507708][ C1] R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000 [ 31.507724][ C1] R13: 00007f201c426038 R14: 00007f201c425fa0 R15: 00007ffcbb04f408 [ 31.507745][ C1] [ 31.507754][ C1] ---[ end trace ]--- [ 31.705317][ T361] usb 3-1: USB disconnect, device number 4 [ 31.706158][ C1] aiptek 3-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 32.246229][ T310] usb 4-1: 5:0: cannot get min/max values for control 2 (id 5) [ 32.256063][ T310] usb 4-1: 5:0: cannot get min/max values for control 3 (id 5) [ 32.268400][ T310] usb 4-1: 5:0: failed to get current value for ch 1 (-22) [ 32.334083][ T392] usb 1-1: USB disconnect, device number 3 [ 32.346332][ T322] udevd[322]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:32.0/sound/card1/controlC1/../uevent} for writing: No such file or directory [ 32.368494][ T733] netlink: 44 bytes leftover after parsing attributes in process `syz.3.140'.