last executing test programs: 34.882724853s ago: executing program 2 (id=1267): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$KVM_GET_EMULATED_CPUID(r0, 0xc008ae09, &(0x7f00000000c0)={0x1, 0x0, [{0x40000000, 0x4, 0x2, 0x100, 0x800, 0x1, 0x3}]}) (fail_nth: 3) 34.583311307s ago: executing program 2 (id=1269): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = socket$inet6(0xa, 0x80002, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540), 0x10000, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0xc) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(r2, 0x4068aea3, &(0x7f0000000580)={0xc5, 0x0, r3}) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000040)=0x91, 0x4) setsockopt$inet6_opts(r1, 0x29, 0x36, &(0x7f00000000c0)=@hopopts={0x33}, 0x8) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2002, 0x0) write(r4, &(0x7f0000000000)='7', 0x1) read$FUSE(r4, &(0x7f0000002200)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) fcntl$lock(r4, 0x5, &(0x7f0000004240)={0x2, 0x2, 0x8, 0x6, r5}) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) setsockopt$SO_BINDTODEVICE_wg(r1, 0x1, 0x19, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x29, 0xa2, 0x3, 0x8001, 0x44, @ipv4={'\x00', '\xff\xff', @empty}, @private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x40, 0x9, 0x5}}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'dvmrp1\x00'}) r6 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r6, r7, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f00000000c0)="410f01c866b8f8008ed0c48259bee70f2060440f20c03507000000440f22c042f77a6d66ba200066b8043866efc4e27d35b7d0f4bcc42e440fc72ca7c4a212f58706080000", 0x45}], 0x1, 0x2, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) 34.497804251s ago: executing program 2 (id=1270): mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./mnt_trace\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./mnt_trace\x00', &(0x7f0000000240)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001140)='./mnt_trace/trace_pipe\x00', 0x0, 0x0) r1 = add_key$keyring(&(0x7f0000000100), &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) r2 = add_key(&(0x7f00000001c0)='asymmetric\x00', 0x0, &(0x7f0000000d80)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbc1302f13583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825b04ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6c28ba2301195ea214b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r1) keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f0000000140)={r2}, &(0x7f0000000780)=ANY=[], 0x0, 0x0) read$char_usb(r0, &(0x7f0000000000)=""/193, 0xc1) 34.483778982s ago: executing program 2 (id=1271): ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x10b) write(r1, &(0x7f0000000000)='7', 0x1) seccomp$SECCOMP_GET_NOTIF_SIZES(0x3, 0x0, 0x0) accept(r0, 0x0, 0x0) 34.467233092s ago: executing program 2 (id=1272): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) mlock(&(0x7f0000001000/0x3000)=nil, 0x3000) r1 = syz_clone(0x0, 0x0, 0x43, 0x0, 0x0, 0x0) process_vm_writev(r1, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x100000000000026d, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/116, 0x20001c34}], 0x1, 0x0) ptrace$ARCH_GET_CPUID(0x1e, r1, 0x0, 0x1011) r2 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x48, r2, 0x100, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x10}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x7}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0xbe}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x8001}]}, 0x48}, 0x1, 0x0, 0x0, 0x24020001}, 0x4040002) 33.722101118s ago: executing program 2 (id=1283): syz_usb_control_io$uac3(0xffffffffffffffff, 0x0, &(0x7f00000006c0)={0x44, &(0x7f00000002c0)={0x40, 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) close(r0) openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x101180, 0x0) ioctl$TUNGETVNETLE(r0, 0x8010743f, &(0x7f00000002c0)) 18.63162558s ago: executing program 32 (id=1283): syz_usb_control_io$uac3(0xffffffffffffffff, 0x0, &(0x7f00000006c0)={0x44, &(0x7f00000002c0)={0x40, 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) close(r0) openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x101180, 0x0) ioctl$TUNGETVNETLE(r0, 0x8010743f, &(0x7f00000002c0)) 3.38208404s ago: executing program 3 (id=1606): r0 = syz_usb_connect(0x5, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b510f210950b2a7773820102030109022400010000000009042200028953950009050a02ff0300fa000905820250"], 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000001340)=ANY=[@ANYRES8, @ANYRES32=0x0, @ANYRES16=r1, @ANYBLOB="ffffffff0000000000000000000000000000000033000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000a0000008a000000000000001c0017000000000000000000ffffffff00000000ffffffff040000004800010073686132353600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500210001"], 0x15c}}, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000880)={0x44, &(0x7f0000000140)=ANY=[@ANYBLOB="40150000000000000007c6d8c20aa964a621c588fef17a042ff2ca5e00671691c33d86769274a17f7969ac2dc277b5957b4a820d370b9a40a3cdcc00"/70], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f0000000600)=ANY=[@ANYBLOB="001606"], 0x0, 0x0, 0x0, 0x0, 0x0}) socket(0xa, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x1000000, 0x50, 0xffffffffffffffff, 0x0) 2.434115375s ago: executing program 4 (id=1629): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000900), r0) (async) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @local}, 0xc) (async, rerun: 32) getsockopt$inet_buf(r2, 0x0, 0x29, &(0x7f0000000000)=""/145, &(0x7f0000695ffc)=0x24b) (async, rerun: 32) chdir(&(0x7f00000000c0)='./file0\x00') sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000008000100010200cc2c987d1adc8c86090000000000000000"], 0x2c}}, 0x64000) 2.433723404s ago: executing program 4 (id=1630): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) ioctl$USBDEVFS_CONTROL(r1, 0xc0105500, &(0x7f00000005c0)={0x80, 0x6, 0x303, 0x8, 0x0, 0x951, 0x0}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000180)={0x1}) 2.379714277s ago: executing program 4 (id=1632): r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f00000000c0)={0x1d, r1}, 0x10) sendmsg$can_bcm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="0100000003ece1e40ad8871461ab0800", @ANYRES64=r1, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64, @ANYBLOB="3bf81b"], 0x20000600}, 0x1, 0x0, 0x0, 0x40000}, 0x1) 2.366831528s ago: executing program 4 (id=1633): r0 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1, 0x810, r0, 0xd353b000) timer_create(0x3, 0x0, &(0x7f0000000140)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x1c, r3, 0x1, 0x0, 0x0, {}, [@NL80211_ATTR_REG_ALPHA2={0x6, 0x21, 'a\x00'}]}, 0x1c}}, 0x0) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x3000, 0x0, &(0x7f0000ffa000/0x3000)=nil) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x7c, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}, @NL80211_ATTR_BEACON_TAIL={0xc, 0xf, [@random={0xd4, 0x6, "090103030000"}]}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x1f4}], @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x2}, @NL80211_ATTR_BEACON_INTERVAL={0x8}]}, 0x7c}}, 0x0) sendmsg$NL80211_CMD_LEAVE_OCB(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="3d1862268ec3f5bc60bcd5245f202a8b5f5bafeb065ad7a99b85", @ANYRES16=r1, @ANYBLOB="000428bd7000fbdbdf256d00000008000300", @ANYRES32=r4, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=@newsa={0x15c, 0x10, 0x1, 0x0, 0xfffffffe, {{@in=@multicast2, @in6=@ipv4={'\x00', '\xff\xff', @private=0xa010102}}, {@in=@broadcast, 0x0, 0x33}, @in6=@ipv4={'\x00', '\xff\xff', @loopback}, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0x84}, [@replay_esn_val={0x1c, 0x17, {0x0, 0xffffffff, 0x0, 0x0, 0x14}}, @algo_auth={0x48, 0x1, {{'sha256\x00'}}}, @sa_dir={0x5, 0x21, 0x2}]}, 0x15c}}, 0x0) 2.347171839s ago: executing program 4 (id=1634): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$KVM_SIGNAL_MSI(r1, 0x4020aea5, &(0x7f0000000080)={0x25000, 0x41000, 0x9, 0x0, 0xfffffff9}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x82f41, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r4, &(0x7f0000000000)='7', 0x1) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f0000000480)='freezer.self_freezing\x00', 0x0, 0x0) readv(r6, &(0x7f0000000040)=[{&(0x7f0000001640)=""/244, 0xf4}], 0x1) ioctl$TCSETSF2(r4, 0x402c542d, &(0x7f0000000180)={0x9, 0xc, 0x2, 0xfffffffa, 0xfa, "6ca1b93ca4beb41b3ef734b770e02394f7472b", 0x715, 0x2}) sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="340400002000010000000000100000000a00000008000000ac1414aa18041680aef6"], 0x434}, 0x1, 0x0, 0x0, 0x14}, 0x0) r7 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFDSTADDR(r7, 0x8918, &(0x7f0000000080)={@loopback={0x0, 0x3fc}, 0x0, r8}) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r4, 0x0, 0x10, &(0x7f0000000280)={{{@in6=@remote, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@broadcast}}, &(0x7f0000000380)=0xe8) quotactl$Q_GETQUOTA(0xffffffff80000700, &(0x7f0000000240)=@md0, r9, &(0x7f00000003c0)) ioctl$KVM_GET_IRQCHIP(r1, 0xc208ae62, &(0x7f0000000480)={0x2, 0x0, @pic={0x2, 0x8, 0xa, 0x4, 0x1, 0x3, 0x5e, 0x8, 0x81, 0x3, 0x15, 0x7, 0xf7, 0x10, 0x80, 0x40}}) 1.974016166s ago: executing program 4 (id=1635): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000406c256d0000000200000109022400010000000009040000010300000009210000000122050009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000240), 0x8, &(0x7f0000000340)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8880, 0x85) lseek(r1, 0x100, 0x1) pwrite64(r1, &(0x7f0000000b00)="5a53e95d40e398c34aa840271b9db441f37047f2fde059d959ea39ef3a1f8ee5d878d5ee741b94b2a8a63eb8db136ecd648db831243a9496ee36aad4d21467304efbd50380d0a6c401e44415684f5a38786f3ccfd5d1918a9db3a9e38978f6bdeede70bfc0e8b0b0ac39ab49101dfc1d6e04c6c7b5cbed0069f5a1c5d2137a01e0c17f916ff516cbc20014f7604750084c670b2ff9f326808a3eb9b6aec85e53adda4da85286ffbaeeaaa01120de48fc5bcf9daa9378504c3eaa2cff40d67d58e86965719305a63cda2b21e6c18903531a0550ee5ad71af0ab9518881b8e920975320f3bc7a4ea6a4a60f803ddcdfeef50e590c941f6bcf782efcef95560698d28f97fea47216961b2c9671a012af7e48e0c3a788dd0076d831751c188e2e31152f124a32007becb7e2735a946e2ed88505d3e947dc0df93c1ce84f914349a0ce8a5652a35cf9cf3e6f47ba547b91f1b6f848725c81c06497691a511f823b64cc73c73287bddceb8979943245173a3c82df6ffadb4f5009487a122b576871148c299706c9dfb07b11394f882e1c1c591ca88181266002837dfdb8f643b70b7b5b0ad1557f00a9f65000302f38d85425b1c21c0bd5784208b29c6527ff5799a79d5a08a41b3e823d5335b59e7136545e70e6597c0d680d17a56dba4215743a99b2e1063edeb0f36c621b454c9caedacf10efe1e109065e87a4be736226ec77cfa0d0ad2345b9227c896ad6f6a038a76379af5f09b34005c4b17ffd78e6b0b3837be374ab9079822422165fe390846064c9506e357d75bc9e43cedbe5d588c92e9b43c4b0d4213849d79e1697b1f9bb91e6745eab45bc3895aad97e72f01c5537a6e58e2c70961e050f2b6b9c1aeac64a9bc0e2e7008d5b627a3d0897e43e0587c4002e573c848a7a83ac659fdc9e55476d57aca94a73191f6e7be68ca9648f1148c9f8c99e30cc4291c24f0f8b496a93024ed7dea2881953c19aae78c6b844230398ce180a60834ccc4d410639df197087d9b683f0ca1e88ccad5212cfa8e6625a88ef706b6ed4c937a6bd30569a84bf6023a405de0118fc004da6a0391294059cb5ba771968f1fd725ebf85601b7c3d7caabb465adabde6573c3adb04180e35fa0ff6784a0db3c367638e599176f5e523d0e26a5902289cdd73aee1ac79b507b7ea542aafbc2c6144535f09c2b567be3cf44068d04fe0b068d48dabedc8828e218e73031d5c5243c2315b1e859f9a9e186a9d16f9811ce6468437841a392beb79ae1b14f77c6a1344fd87ad0603168a9d97f976234a8dc6977bfbf6e3263f23d1c3ba40063432578ea6363b084b664619814c554b6e9563abac236e91b6ae2706c9815f9c7f6392cd65cce38000f4d6f27383a9575a69cbb6ee68a87eaae3959a2ed08053a1452fc20c35802edbf1f30aec1a15e06de252c6e0acf0f75205efca318913068807790c407cef888d4845d7b8b19fef5b71a489e786beed09b30997755ec684ed18112c0ccaac0158668f1c537c03d05715592121b593ddcc10b8c63a0fb11b4c7e8ab812b03b807748c5e7a9db5d20fe33c11fb7b585e63a75189eda179611f2bc7a2b4fdb2de4953c0c2d70982643132113b3bfba31df392306719d162d808ba53f0c9667c8088a9de54bd7e3989aa41abdd220d36d25cf31a1ce5258dd976b846564ae13bdf09eb82598306ef00c3ed9ed20fd1936575d730d2b97bdbceb6963a48f17383e49580149f7f9b081dcf7e1edcfd5fda1219588c8d720dab03de1d4fd782c7e3536d3f250fd46d82af36cc0a3aba898def4bded3acd03a5a846bcb0742515e0284a51f5082e92003bab2fdbd903aab943a7dcb05bee95d0cbf062984df1daedb08df67a4ad35e095f909365d4be7e2f9a44e7cac1080bc3e762a5204cffde520c2e528b70ec6a4fedc234488ed85ec2e95e248ce57ba220e4c612fbb62fcf4d25915267f1c34a207270dfd913a6561adf35e2cb260c23e8d233f6e6887732094ba8d51e56e764076f2fa91882a2ab780441cd8255df9ff28344b7055f11312a96129d7d6ea61ecb291d782bfd39e25a0176832cd9b41b337c5c6e829c1e7c1baec5e1fb9b67b8beb73df85fba38c69b526765437ae8130ea80e470b36db4772f3b438101660c0970e0abbb87c796413516b75f7d414a796de6f35c44f49d1e3912a5af3f6cc0958f116ec105c20487481eef8790bd1aff19cbb0ec2993ed09e49449ca3b2cf723f28266a3e5f2c5a736c6b719c1469b3de5d00e5b327e0e40e4e6646dad5ad1211b4555507e72dacdf496e343245a2658d5665c9bd44cf554e5b76967a54ae3d42103037c7859da68e2a2f546bff772210a55f88e0f52070f22c37ac61e7798837c939594007aa3cd5e707b98de480e72512bbae33c09562d7088b8a837a0faafd238188881506d6b710c097b60c48bdb4ed2bd9e2473d05103e96a28f4a4a4c41769f7d72365bd8bdfad7f8f87d288de63f42e3275c40909ea3dd055a8f52dbab994c18f4ed57aeb498b2e5e9ee78b9ae3e698f111d1a8d1203f0139b900473a7a31d3912e54c63083afe9d582f9e89b6445a8a90af736876cde9e03260f58231ce84acec827f2c81cfdedd558ad3aa327d09fb57a67b9a9fba306dc2895b31dec1c9d1996ed089c2f2fc538197d952ca586105c92d0d1dd5199b634c60e7b2a128763192c0ff8898e62826e268fa7ef93282d875b9508b670c2099af3f4d7071b138b56daf73400b4703f26d79e34d7faa7e59964fe60c490449832a6a5ed0c4e746f42d1c2f684c252d18700f2c208fb3468d3ea7e453fc487338898956692025bcf4ed989d57e4462151c88b7e331e857d75f5f978651456cff64fdfd12fed15e85b65da07b8a4e0616f6b2a1f556ee0504178061e8244d73630548ffd33e2bbb6957c5b0f749e98971cfd4fab47fff4119fd531616801de1cea28bfd85d40f43cba34c9760ebaee332d6b2a83f43a40059fd3c7d9e22035f7fef3b65b7aa83d28c267d11a9efbfb202831e730f2103df78e20d330b41aed4de05a5da13243d1448161f96581afc412146f1e10d94f6c3738dad1919dc1ed72cbd9b1db39972f9cb1379213c3e7c27dbcbe18e32bcd7296fbed5e93718e719deec81a8bf4f1c4ff7640c3fcb555b7388bd8dcdfdc273ab10438ec616db3b2cba76d1e3c6e40cffb0e02dc5e627e1bacdf3800ab770e7fbeadfa0e099f741be293494213b5fc57decd8da0365e4c2c105ddad0c7064298b42c2c0b3cdec1206af4d97ad50c78e078d8667edcc5a3056eec4c9d4da2110e85a8dcb9601fb3253b1667479bfcce9f7183d6210a1f62e9d70567514dce9c83e76406855a04b287f38daccdf62f9d76690a7d3b669e8ad32be1dd6c7ff9a901bc49df825e3ca2ec1ecbb8466ad8952d771a636d4648ff198aa61ff8e76776ae6bd520d551ec4f89a4448554a052a7d40923cb49fe235da0cad846ad5c0da6a11af467a33cb38e28304036194ac1ed8754205abdd866748ad51f86a16d565d52cac8934de1c1def11a84ecb08f70f4ad7c53c538650a43dbd9be00678d35a0c3a860c75357b56e9eb54c1e85711d3847351c5d7d5e14d6881e500d2c8f83506aa1651d63ac7f5285af4ab839a19bed999cd1385b637903fe38db0405ab64cfbf6da7805ad2d91e264df86593066dd7de0373317a014465d48703a1d57aba723c05678d5e861e7622e016e548812ad474ef4d3e0e3e0ee523e76eb7bc13550fedc7d1109bbdbb65b1037071daa062a56f973894ef06fcc53a090c1b638e5adca6cd4c4bd4d558270bf3b365e846285ba35890ae96e41cda72a71f7f0958daa2ad63dceba53c1e59559fbe9ea227f43adf6382c5824238beae407227770b6b0fe51575039b71f353c27b2f7d27d3b137a1d43cb208df8185f10589930d99dedd3be6472566d636e7c6a7a36feb9114554d84d002eb273f87ec5b635501a14e9fdf33126af0feec866476d66a992171584fe0f2390a28f2269b0188279805c8c6ae9dc5bd99b9273bcf95a5f94073ec24bacd7073debd40f4cb0575f9111a04ed868c0d814b0985505877c045c58b770241099317b3acc23a9680cae7ac4ed3c388a10b486aed0f2f5018c0d98cc88c4578c63e5ffd6150c0c4ad401dbf7cc1613b0873f2050eca1200506053a7504cfa4e3a937d45f43841fe115b14a3b6d2ac33176f1608ab9694cdf053dd6528f6411bb7e1085233b6f175476d2b1e9bc105f719431523bee524dd6a08b8825f9098770f88e259d4610cde688b18548f4a5f9377050213e51f0b3a359aee336031a2d65fb191238a23d7a2aefe50cbf947c57041fc734f9ea567b82c917cafc39ed5e40f9dd0435763675b83fd87d7ef8ec4230874401adc07e3411ffe48a7090a7632f2630e22940d03158da60d767624afcd2b84c3db942befaa17140b7a3e425c22a2e97adf5fd00d6ea874fcd548ebe1b3b616f6b4330f57e9d138f499383c6d5059e966bbe3f0fd583b2cd674e1884bb320468922c68f870ebd12e3142d54af74be49edf34964aea903f235de51c2890fb5c7e203646a6b2205069395de8b578b80457d540790ba8c2cb80fe0ca38e418ecc87cc60d997804f5b937cb714130ad3fbe222c10842f2de9856c46ed3c4755c34b5db7b20b7d0081ce735e7ceafdb83425abe620bf81b259a494370e02ef06b34b56dd41e38967514d9078c034173903177ec5785d53a83a5408881ac383eb5903294236ab35e28af1255b992720a85fca8d1f9c61f8f8cab30bd275e6365c8a27c9d4598bd3bac8ed81ae9adb6234ad2e7feb1b2c183b1d7c25acb8de119f450dda79bbe6448445131e1e46a12bc2a5ef212fb659aa6961f8c0fa61fedb0b2617732fe31fc082fe246d4a5116430923a4254673bb4a8c84b6240d291aeb2b723f84f78899bd166959b7c14554038292cd8b9ec5af00ebecfca2e2799203f896c8b05a5326e0d35cf634d87d0fb1aa574cb5ee26ce6e25550378b49ce28c391121b320e632847f8e3d2ccc83d77a81e9409141fff3f99e6b96622a31292e05174a2e478cc58d82063719cd3d5f1e96f7cb9d9a843368c0d47c5c3c49c62b307c283b3daa9d2acdb0e2d66828a34a83644b6d0da333899e7d9355b495e8baa7ad51de622ea7ac3e83a8f66c1418cc960e2b4b5408313e72a919b97af6505bb421106e0e9072e434cc9a1be93b8ec2112d154121dd2331c871ccfb0d9d1ac43446e60a0d2799aaca57baafda04d831dd6e344a172ce6354e390b9ad36f00e36e9df78fb972636551908020624f753d8e04fd0ed4d79608559b562f00ad2707c9a99981be9e2d88d224d185db1ed6f26dd1fd84945b408f2bf0237b2660c8b2e1f0d07f7c6daddd2b38482796193c573a730f24fc8584db9861c40b7e8f1ce73049db4405bc5b160e950f3c30b588b4ae5a84ae25e84741aa3a1627d3f611780b5f74819b340c385e8a1c47dd7d7a736afeae445bb1d9cb04432d29c3946ff91ddec1f31f0920440b5cf0f1d29f83a0eecd49480f21b059f5e327eff47f032f7fd164f88d3791a89fc0499289bf0d895ecb9fe5e66be41b1e88d51236bcbf7a2b24566787dd0305ccc9a7288424bdb323fec3f5a67f1082657d538d25c03b34bbf5381893a30090fe3bcaba25bed135809d0dd29ae58aae72cdb62cd9306104728bef66cabb1c1a5d78a97475a1d8f9ada8dab938183886fadaf5dbe7d9e9e22885552d67b41bd38d405d6ddc4ca3c1e6962626e337b82a51d16c4540a", 0x1000, 0x2) getdents64(r1, 0x0, 0x4f) r2 = syz_usb_connect$hid(0x1, 0x3f, &(0x7f0000000040)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x20, 0x1e5e, 0x313, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0xff, 0x10, 0x0, "", [{{0x9, 0x4, 0x0, 0x9, 0x1, 0x3, 0x1, 0x0, 0xa7, {0x9, 0x21, 0x2, 0x7, 0x1, {0x22, 0x393}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x7f, 0x0, 0x4}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0xa1, 0xfa}}]}}}]}}]}}, &(0x7f0000000240)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x200, 0x5f, 0x0, 0x0, 0x20, 0x9c}, 0x15, &(0x7f00000001c0)={0x5, 0xf, 0x15, 0x1, [@ssp_cap={0x10, 0x10, 0xa, 0x1, 0x1, 0x4bc1, 0x0, 0x3ff, [0x3f00]}]}, 0x1, [{0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x406}}]}) syz_usb_control_io$hid(r2, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000004500)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00030200008000035d2c9815b770aef015cd92a9ea07ee56a19a4bd470"], 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000007c0)={0x2c, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="4201000000000c03d307f44eb8a504d959961abf744bb4dd13acd37ff0a6d4befb0d9e8dd3c03b7323d266f18e9b59a59c63b2490bc576451b588ce5595a63a734a74b4a51ca8b88d571b52f883a889347a44faa9fea63dc53000061be31e8fc260dfb907b6de92bd16f0820d9ba694306a474248d03d238d3f80cae690d769a66f4b1e78f2f8f23d4bfcca98160c6465d11feb45b2e09de71a5ce4a7057a7cef96a84c6bf8e4cc4ff0f26deba5b59879d1b41d77104aa625f4f0544fa"], 0x0, 0x0, 0x0}, 0x0) 1.48354694s ago: executing program 1 (id=1639): sendmsg$TIPC_NL_NAME_TABLE_GET(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40400c0}, 0xd7983ab608da75d7) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40810}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x49, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000004, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x5, 0x5, 0xd500, 0x8, 0x79, 0x7, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0x9b54, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000183, 0x2, 0x7, 0xf2, 0x0, 0x7fffffffffffe, 0x7, 0x5, 0x8000b, 0x7, 0xfffffffffffffff8, 0x9, 0x4], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'ipvlan0\x00'}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r7 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(r7, 0x8918, &(0x7f0000000080)={@private1, 0x56}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000080)=[{0x6, 0x4, 0x0, 0x7fff0000}]}) close_range(r8, 0xffffffffffffffff, 0x0) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6(0x10, 0x3, 0x0) r9 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r9, 0x10e, 0xc, &(0x7f0000000280)={0x4000}, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6(0xa, 0x802, 0x0) 1.334439267s ago: executing program 1 (id=1640): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000000)={0x0, 0x0}) openat$uhid(0xffffffffffffff9c, 0x0, 0x802, 0x0) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) syz_usb_connect$printer(0x0, 0x36, 0x0, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000040)=0x1, 0x4) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_add_memb(r4, 0x107, 0x1, &(0x7f0000000040)={0x0, 0x1, 0x6, @broadcast}, 0x10) syz_usb_disconnect(0xffffffffffffffff) syz_open_dev$char_usb(0xc, 0xb4, 0x7fffffff) socket$inet6_udp(0xa, 0x2, 0x0) r5 = userfaultfd(0x80001) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x100}) ioctl$TIOCMBIS(0xffffffffffffffff, 0x5416, &(0x7f0000000200)=0x4bf) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000280)={{&(0x7f0000cb1000/0x4000)=nil, 0x4000}, 0x1}) syz_kvm_setup_cpu$x86(r1, r3, &(0x7f0000f1d000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, &(0x7f00000000c0)="360f6168f3362667df4c4ff566b9b70a000066b87826d96c66ba000000000f30260f79ca670f01cf66b80500000066b9f67a00000f01c166b9ae01000066b8e10f000066ba000000000f300f01f20fc77bc7baf80c66b89f3b8a8766efbafc0cec", 0x61}], 0x1, 0x41, &(0x7f0000000200), 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000020c0), 0xffffffffffffffff) ioctl$UFFDIO_WAKE(r5, 0x8010aa02, &(0x7f00000003c0)={&(0x7f0000000000/0x800000)=nil, 0x800000}) ioctl$KVM_CAP_HYPERV_SYNIC(r3, 0x4068aea3, &(0x7f0000000180)) openat$zero(0xffffffffffffff9c, 0x0, 0x80c42, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x22, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) r6 = syz_clone(0xae019011, 0x0, 0x29, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r6, 0x0, 0x0) 1.037662431s ago: executing program 0 (id=1643): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mount$incfs(&(0x7f0000000080)='./cgroup\x00', &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000100), 0xa18082, &(0x7f0000000180)=ANY=[@ANYBLOB='readahead=0', @ANYRESOCT]) ioprio_set$uid(0x3, 0x0, 0x0) r1 = open(&(0x7f0000000380)='./file0\x00', 0x143142, 0x88) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) ftruncate(r1, 0x2007ffb) sendfile(r1, r1, 0x0, 0x1000000201005) execve(&(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)={[&(0x7f00000000c0)='\x00', &(0x7f0000000140)='incremental-fs\x00', &(0x7f00000001c0)='incremental-fs\x00', &(0x7f0000000200)='-]/\x00']}, &(0x7f0000000340)={[&(0x7f0000000280)='\xb4)-[/.}\x00', &(0x7f00000002c0)='\\\x00', &(0x7f0000000300)='\xee$\x00']}) setfsuid(0xee00) syz_clone(0x401000, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/sda\x00', 0x2, 0x0) ioctl$IOC_PR_RESERVE(r2, 0x401070c9, 0x0) r3 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x1, 0xb, @dev={0xfe, 0x80, '\x00', 0xd}, 0x9}, 0x1c) sendmmsg$unix(r3, &(0x7f0000007b80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2404c054}}], 0x1, 0xc880) sendmsg(r3, &(0x7f00000000c0)={0x0, 0x33, &(0x7f0000000100)=[{&(0x7f0000000000)=',', 0x588}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r2, 0x4048587b, &(0x7f0000000780)={{r1, &(0x7f00000003c0)='\xee$\x00', 0x2000, &(0x7f0000000400)={@_ha_fsid={[0x4, 0x5]}, {0x400, 0x8, 0x4, 0x9}}, 0x6, &(0x7f0000000440)={@_ha_fsid}, &(0x7f0000000480)=0x2}, 0x2, &(0x7f0000000740)=[{0x1, 0xfffffffb, &(0x7f00000004c0)='\xee$\x00', &(0x7f0000000500)="95851c11e1510a71c5df19af6e6d5932273751ef6bccf50796c83d2f9b9b2df8546ac69c40eeea00c11f6fa27595fd166db7dc21869e0937cf9f02ee82a731a88c28c63226f540a6e51ac9d2325a8fdba813b8960046c5029055d754fb67f4d8e9d0667af5f113c22dd2805eeb06064014ba8a256d35088b9dfdb7810f34fa77834e80997741862f004d85fb125e2654ccf684e966bddcdb4f0d5fd9c13eabfd7a373274f8bcb99ec5ae500ec24fc11b9f987aa26d0b1ca8fc01c31fa267cb77f266a3467257b49b354fcba2543b4ff93ca9a9455d3db39270405c422c5775e1089492ef94db8f05e37ee983fa", 0xed, 0x22}, {0x3, 0x1, &(0x7f0000000600)='\xb4)-[/.}\x00', &(0x7f0000000640)="6cc81ef29f753b1c061e20d154b48bd2e165f88f350003378f36475b2a685c67e88f9f149269158ab02d46845efce3b719ad1d2d80465255a212873638936eeba31c4fd0775de4bcdfa6149bc0023a37a7230a581079797b0ebfda1e5812e2cd47ec7bd7cd78f6c4636fb23aee32a4c34347d9a993e404ba6d72432f66eac980df36365c69d801495325448e64d92d852432f6100e627902467d658fc0aa674e47f0596c9711936b94b4c13788e711242827e92c033f34f8873828303b57ab93ae067fef67e7", 0xc6, 0xc}]}) setresuid(0x0, 0x0, 0xee00) setsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, 0x0, 0x0) 889.960088ms ago: executing program 0 (id=1644): umount2(&(0x7f0000000040)='./file0\x00', 0xc) (async) r0 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), r0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101200, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) (async) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r4, 0x40485404, 0xfffffffffffffffe) (async, rerun: 32) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) (rerun: 32) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, 0x0}], 0x1, 0x47, 0x0, 0x0) (async) ioctl$KVM_SET_VCPU_EVENTS(r5, 0x4040aea0, &(0x7f0000000180)=@arm64={0x3, 0x8, 0x3, '\x00', 0x8000}) ioctl$KVM_SET_NESTED_STATE(r5, 0x4080aebf, &(0x7f00000001c0)=@vmx={0xc, 0x0, 0x2080, {0xe000, 0x1000, {}, 0x0, 0xffffffffffffffff}, {"d07ee5110000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ccffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200", "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001b00000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fe2d1f2b6255614c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c955000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200"}}) (async) setns(0xc9, 0x20000) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000004c0)={'ip6tnl0\x00', &(0x7f0000000440)={'syztnl1\x00', r1, 0x4, 0x0, 0x0, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x1a}, @dev={0xfe, 0x80, '\x00', 0x30}, 0x80, 0x0, 0x4, 0x1}}) 865.448869ms ago: executing program 0 (id=1645): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000002e80), r0) sendmsg$IEEE802154_SCAN_REQ(r0, &(0x7f0000002f80)={0x0, 0x0, &(0x7f0000002f40)={&(0x7f0000002ec0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010026bd708dd11dd025001900000005040400fd000000"], 0x24}, 0x1, 0x0, 0x0, 0x24004800}, 0x200408c0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000), 0x8) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000000), 0x8) close(0x3) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/arp\x00') preadv(r4, &(0x7f0000000080)=[{&(0x7f0000000b40)=""/119, 0x77}], 0x1, 0x4000ffe, 0x0) 854.784569ms ago: executing program 0 (id=1646): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x67, &(0x7f0000000040)=0x91, 0x4) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x36, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2002, 0x0) setsockopt$SO_BINDTODEVICE_wg(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'dvmrp1\x00'}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f00000000c0)="410f01c866b8f8008ed0c48259bee70f2060440f20c03507000000440f22c042f77a6d66ba200066b8043866efc4e27d35b7d0f4bcc42e440fc72ca7c4a212f58706080000", 0x45}], 0x1, 0x2, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 798.105442ms ago: executing program 0 (id=1647): r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000000)={@initdev, 0x0}, &(0x7f0000000040)=0x14) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000300)={@remote, @empty, r1}, 0xffffffffffffff64) r2 = socket$nl_route(0x10, 0x3, 0x0) sendto(r2, &(0x7f0000000680)="340000001a00010001000000000000000220000000000000000000000800030001000000080002080101010108000100e101020303", 0x35, 0x80000, 0x0, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x408000, 0x0) 797.785902ms ago: executing program 0 (id=1648): socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$TIPC_SRC_DROPPABLE(r0, 0x10f, 0x80, &(0x7f0000001640)=0x4f1d, 0x4) (async) sendmsg(r0, &(0x7f00000008c0)={&(0x7f00000000c0)=@hci={0x1f, 0x4, 0x1}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000140)="43e30c2e17abe837e1a26f02647c1c5de631831a8cb80ecc7942cafd0b738ec4cea1420cc9630d05d7d4f50370e0370ab339c1f864bd7d9656ec2b3b176a2ea3ed877ab4467390cbd4fba8566c45c599a7fced38f409", 0x56}, {&(0x7f00000001c0)="38cde1b7e8e4c60aa01b3e7c34", 0xd}, {&(0x7f0000000200)="348b9c17e755dfa58e45ad0b6db3c994fd35041aa1ab84d20e8cfa042cf6169c6db68fe017138194cfeaa8cc997c60b98cdd8626239d83b4bc1e9c949918c15074e28674d98aa57ba4f94a275632b293b2fb8610da29107b67244fc168253b1d9e736e5f97e522da25f1a0f8869760e288900ca22f2f4e6d0ab17c84c3dfd3322a021faf323687c2659f46ea34d2e0b7e2ef08f7b974f612fa8b2f820e5568876d336171ee2b1d5b226d326af88a9516fcd967126c9923a6ec8d8dcea0ca6b75b4a225bd240abb7451958c395b41132b9b711adaedf2768bc56780868caf614eaba3a2f5a8ba1a352c70de", 0xeb}, {&(0x7f0000000300)="848100a0a54afe7ee74cedee89548af3d67fc53462ea8f1170b53e2e8c2ad64a86f8fc47bd605094be6f7cbb86a3ee054ee60bc6077c37bf61e363fd789a31a241f15fcb", 0x44}, {&(0x7f0000000380)="f4f7a5a3593feff5965cc405ab01fefffdeade9bd2c48076e8d4d954c34530620fe27315fa2b5798bd68fd2621e4bcc3d954a2ed2b8d16e1200ffe06c6821ac1b3a9f76c6b566913d9270c12cefd3e685012fad184bad5b916c0900671645cfea46c4daa575292204518cdb3f1bf4788115290b014b5ea30ffe7788885309b42894b8017329c39c99552b2d836d11297186c5939f5865a18fc5aaa421ecdd74aff0177c7a76f835be8405865", 0xac}, {&(0x7f0000000440)="cdc52533371e86b86fe41581b97ce3edfefffefd415b878ae01f2527a7d70522675b6418d0087a4263576c184ac23fd57854e011f74af8ef38db215aee00b79e975b47413e30241e60f95365c66cb9ab2003b8d668bd89135fc87a6e15ff323876459bf492db4d484396a49492e763eae2c6078bf9d94ff985a4d40865f1da2d8541b471b9c306980b615265332b3c856748ac622fe72fba0df8bc7cb496a7992d434778e11438f0e57492b4e999f420dbeb04ce186e1853ed7a6735738ce63de6a31f1046f57ea9c4d2d9ca", 0xcc}, {&(0x7f0000000540)="9a71", 0x2}], 0x7, &(0x7f0000000600)=[{0x108, 0x18d, 0x2, "e4c78065637071b82b22d02a77da42e4d90141e585760ab67a4939ec2f84ac61cd000dd2c267170d92a3563ba023476e275340c3d81fbe67a0950dd76c83b41aedd1191c5a216b74c58014753521000fe971bc8a0251a65dd61a0dcecc20bb707f64df34c832a7848453304c06bccc08daa5900ee60ca8beb6b0cdc248ff09686162663a38e44647b57157e4004e0fba4930b65e9288e21c2fd73b191669c9f4d2f2fc527c45b9860425430b9dd05022512bc18dbeec301ba76a9684fc8407741c9b50b635b5a5ceb72c5f80646542a747538d25e8ebd121032e874239985feb97f41dc6caa0a1ddee8e3cc254bcf8b8bd484dc81735"}, {0xc0, 0x10f, 0x0, "f6c574c53b79e44116b83e1f6a234c6f11a57b2a5cd0dcc7213efcf83689a84022425254df57fac58c3360fa7d35f611becca579206dbe69a0b2e96e09531507b6af64925488347451d194f450f408e5b5305a649c725308ad8e1566270d58d221808928e43b472cb7ee1767790e3e8847c964e1ac8fda1607e03b71a46ced65d4a86ab5421e2a2e762594e343017bec56606165387a3fced195917c0ba82615ddb18c1b7762905d5e922ea7"}, {0xc8, 0x10c, 0xffff, "753d0065658bd007c1e98608cefd1c54390863e9e9c2f0c0203d9f098c9e732ee216f5daef7a6475dfbe9829197ac61f6a47c42bd7cb7fc2d579bb2551c479f0d6743310cbb9add3e6438a0139d1f9110a5879b992032a28315e0d20276a6114fc23b0fb9c1fb9f4083fe8c3a23ee514b807b38fac1f229d60fd2e5723f8c5131979aec82ff0c2dc4fa470c58a67633d126584c238d18d17a22749f14b08880a92623db17a3cebedad3695bed50d2a7e2a7d"}], 0x290}, 0x8041) (async, rerun: 64) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (rerun: 64) copy_file_range(r1, 0x0, 0xffffffffffffffff, 0x0, 0x9, 0x0) (async) setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000040)={0x5}, 0x4) (async) sendmmsg$inet(r0, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0xf5) (async, rerun: 32) getsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000080), 0x0) (rerun: 32) 520.912765ms ago: executing program 1 (id=1649): creat(&(0x7f0000000180)='./file0\x00', 0x18b) socket$nl_generic(0x10, 0x3, 0x10) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000845, &(0x7f0000b63fe4), 0x1c) getsockopt$inet6_buf(r0, 0x29, 0x3d, 0x0, &(0x7f00000000c0)=0x37) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) syz_ublk_setup_queues(r3, r1, &(0x7f00000004c0)={0x0, 0xbd, 0x10, 0x1, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe708, 0x42, 0x1000015, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) 439.628579ms ago: executing program 1 (id=1650): sendmsg$TIPC_NL_NAME_TABLE_GET(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40400c0}, 0xd7983ab608da75d7) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40810}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x249, 0x9b99}, 0x35, [0xb, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x8, 0x2dcd, 0x3, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x401, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000004, 0xff, 0x0, 0x2, 0x2, 0xfffffffe, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0xa, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x7, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00064, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1ce, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffd, 0x9, 0xc, 0x2, 0x2e6bd783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x3ff, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x5, 0x5, 0xd500, 0x8, 0x79, 0x7, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x1c5a, 0x3, 0x6, 0xf, 0x9b54, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x0, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x1a9101, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000340)=0x14) ioctl$TUNSETIFINDEX(r4, 0x400454da, &(0x7f0000000380)=r5) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40800000000183, 0x7fffffff, 0x7, 0xf2, 0x0, 0x7fffffffffffe, 0x7, 0x5, 0x8000b, 0x7, 0x5, 0x9, 0x4], 0x25000, 0x12147}) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x89ff, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000400)=@ethtool_ringparam={0x6, 0x0, 0x20040001, 0xfffffffd, 0x0, 0x1}}) bind$unix(r6, &(0x7f0000000100)=@file={0x1, './file0\x00'}, 0x6e) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) setsockopt$sock_timeval(r6, 0x1, 0x15, &(0x7f0000000280)={r7, r8/1000+10000}, 0x10) ioctl$KVM_RUN(r3, 0xae80, 0x0) r9 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r10 = dup(r9) mlock(&(0x7f0000014000/0x1000)=nil, 0x1000) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r11 = socket$inet6_udplite(0xa, 0x2, 0x88) bind$inet6(r11, &(0x7f00000003c0)={0xa, 0x4e21, 0x101, @local, 0x3}, 0x1c) r12 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) mount$incfs(&(0x7f0000000080)='./cgroup\x00', &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000100), 0x80, &(0x7f0000000440)=ANY=[@ANYRES32=r6, @ANYRESOCT=r7, @ANYRESHEX=r12]) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r12, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r9, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r12, 0xae80, 0x0) 396.344841ms ago: executing program 3 (id=1651): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x400000, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000000c0)=0x2) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2b) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r3, &(0x7f0000000000), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vcan0\x00', 0x0}) setsockopt$CAN_RAW_ERR_FILTER(r3, 0x65, 0x2, &(0x7f0000000680)=0x600000, 0x4) bind$can_raw(r3, &(0x7f0000000080)={0x1d, r4}, 0x10) ioctl$KVM_SET_DEBUGREGS(r2, 0x4080aea2, &(0x7f00000002c0)={[0x80a0000, 0x1000, 0x100000, 0x4000], 0x9, 0x1, 0x2}) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/icmp\x00') preadv(r5, &(0x7f0000000700)=[{&(0x7f0000000300)=""/178, 0xb2}], 0x7, 0x9, 0x9) 290.079676ms ago: executing program 3 (id=1652): r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f00000000c0)={0x1d, r1}, 0x10) sendmsg$can_bcm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="0100000003ece1e40ad8871461ab0800", @ANYRES64=r1, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64, @ANYBLOB="3bf81bb9"], 0x20000600}, 0x1, 0x0, 0x0, 0x40000}, 0x1) 289.822026ms ago: executing program 3 (id=1653): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x6e0, 0xe0060000, 0x1}]}) 189.915871ms ago: executing program 3 (id=1654): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)={0x14, 0x0, 0x2, 0x301, 0x0, 0x0, {0x2, 0x0, 0x10}}, 0x14}, 0x1, 0x0, 0x0, 0x40810}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x49, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000004, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x5, 0x5, 0xd500, 0x8, 0x79, 0x7, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0x9b54, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000183, 0x2, 0x7, 0xf2, 0x0, 0x7fffffffffffe, 0x7, 0x5, 0x8000b, 0x7, 0xfffffffffffffff8, 0x9, 0x4], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0xfee00000) 112.355784ms ago: executing program 1 (id=1655): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x67, &(0x7f0000000040)=0x91, 0x4) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x36, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2002, 0x0) setsockopt$SO_BINDTODEVICE_wg(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'dvmrp1\x00'}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f00000000c0)="410f01c866b8f8008ed0c48259bee70f2060440f20c03507000000440f22c042f77a6d66ba200066b8043866efc4e27d35b7d0f4bcc42e440fc72ca7c4a212f58706080000", 0x45}], 0x1, 0x2, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.60948ms ago: executing program 3 (id=1656): r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f00000000c0)=0x6, 0x4) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x770, 0x0, 0xbabd}, 0x1c) openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000040)=0x80000001, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) sendto$packet(r2, &(0x7f0000000140)="280320000a00140000007ef506be00000000000000000000000000143baa111f1f858ce632f47042195eb3cf545a41b6d78839980700e67bee78895e16f37fe8", 0xffa9, 0x400c010, &(0x7f0000000080)={0x11, 0x3, r3, 0x1, 0xe5, 0x6, @random="76caa646ae4c"}, 0x14) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x20380, 0x30) fsconfig$FSCONFIG_SET_PATH(r4, 0x3, &(0x7f0000000040)='\x00', &(0x7f00000000c0)='./file0\x00', r4) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r4, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}}) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x3b4) 0s ago: executing program 1 (id=1657): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x109142, 0x5) pwrite64(r0, &(0x7f0000000100)='\n', 0x1, 0x8000c5b) fallocate(r0, 0x9100, 0x7d, 0x5) kernel console output (not intermixed with test programs): h-speed USB device number 37 using dummy_hcd [ 117.347174][ T315] usb 4-1: config 162 has an invalid interface number: 79 but max is 1 [ 117.355452][ T315] usb 4-1: config 162 has an invalid interface number: 183 but max is 1 [ 117.363877][ T315] usb 4-1: config 162 has no interface number 0 [ 117.370301][ T315] usb 4-1: config 162 has no interface number 1 [ 117.376597][ T315] usb 4-1: config 162 interface 79 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 117.389774][ T315] usb 4-1: config 162 interface 183 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 117.400653][ T315] usb 4-1: config 162 interface 183 altsetting 1 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 117.411837][ T315] usb 4-1: config 162 interface 183 altsetting 1 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 117.423178][ T315] usb 4-1: config 162 interface 183 altsetting 1 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 117.435042][ T315] usb 4-1: config 162 interface 183 altsetting 1 endpoint 0x86 has invalid maxpacket 23105, setting to 64 [ 117.446963][ T315] usb 4-1: config 162 interface 183 altsetting 1 endpoint 0x85 has an invalid bInterval 0, changing to 10 [ 117.458373][ T315] usb 4-1: config 162 interface 183 altsetting 1 endpoint 0x85 has invalid wMaxPacketSize 0 [ 117.468634][ T315] usb 4-1: config 162 interface 183 altsetting 1 has 5 endpoint descriptors, different from the interface descriptor's value: 4 [ 117.482013][ T315] usb 4-1: config 162 interface 79 has no altsetting 0 [ 117.482141][ T45] usb 2-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 117.498124][ T315] usb 4-1: config 162 interface 183 has no altsetting 0 [ 117.505160][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 117.514683][ T45] usb 2-1: config 0 descriptor?? [ 117.514804][ T315] usb 4-1: New USB device found, idVendor=056e, idProduct=5004, bcdDevice=db.d1 [ 117.528978][ T315] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.537103][ T315] usb 4-1: Product: syz [ 117.542101][ T315] usb 4-1: Manufacturer: syz [ 117.548381][ T315] usb 4-1: SerialNumber: syz [ 117.580357][ T3280] bridge0: port 2(bridge_slave_1) entered disabled state [ 117.587790][ T3280] netlink: 'syz.0.1058': attribute type 1 has an invalid length. [ 117.595627][ T3280] netlink: 9 bytes leftover after parsing attributes in process `syz.0.1058'. [ 117.626475][ T3284] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1060'. [ 117.663344][ T36] audit: type=1400 audit(125.646:478): avc: denied { listen } for pid=3287 comm="syz.0.1062" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 117.760482][ T315] pl2303 4-1:162.79: required endpoints missing [ 117.768060][ T315] pl2303 4-1:162.183: pl2303 converter detected [ 117.774634][ T315] pl2303 4-1:162.183: pl2303_vendor_read - failed to read [8484]: -71 [ 117.783253][ T315] pl2303 4-1:162.183: pl2303_vendor_write - failed to write [0404]: -71 [ 117.791846][ T315] pl2303 4-1:162.183: pl2303_vendor_read - failed to read [8484]: -71 [ 117.800532][ T315] pl2303 4-1:162.183: pl2303_vendor_read - failed to read [8383]: -71 [ 117.808898][ T315] pl2303 4-1:162.183: pl2303_vendor_read - failed to read [8484]: -71 [ 117.817511][ T315] pl2303 4-1:162.183: pl2303_vendor_write - failed to write [0404]: -71 [ 117.826193][ T315] pl2303 4-1:162.183: pl2303_vendor_read - failed to read [8484]: -71 [ 117.834634][ T315] pl2303 4-1:162.183: pl2303_vendor_read - failed to read [8383]: -71 [ 117.843163][ T315] pl2303 4-1:162.183: pl2303_vendor_write - failed to write [0000]: -71 [ 117.851773][ T315] pl2303 4-1:162.183: pl2303_vendor_write - failed to write [0001]: -71 [ 117.860385][ T315] pl2303 4-1:162.183: pl2303_vendor_write - failed to write [0002]: -71 [ 117.869755][ T315] usb 4-1: pl2303 converter now attached to ttyUSB0 [ 117.879754][ T315] usb 4-1: USB disconnect, device number 33 [ 117.889168][ T315] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 117.897585][ T315] pl2303 4-1:162.183: device disconnected [ 118.279238][ T3293] FAULT_INJECTION: forcing a failure. [ 118.279238][ T3293] name failslab, interval 1, probability 0, space 0, times 0 [ 118.292000][ T3293] CPU: 1 UID: 0 PID: 3293 Comm: syz.3.1063 Not tainted syzkaller #0 92ad247b86212872588e4244b63285ac9b5a817e [ 118.292021][ T3293] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 118.292029][ T3293] Call Trace: [ 118.292034][ T3293] [ 118.292041][ T3293] __dump_stack+0x21/0x30 [ 118.292064][ T3293] dump_stack_lvl+0x140/0x1c0 [ 118.292079][ T3293] ? __cfi_dump_stack_lvl+0x10/0x10 [ 118.292093][ T3293] dump_stack+0x19/0x20 [ 118.292107][ T3293] should_fail_ex+0x3c2/0x510 [ 118.292120][ T3293] should_failslab+0xac/0x100 [ 118.292134][ T3293] kmem_cache_alloc_noprof+0x42/0x410 [ 118.292145][ T3293] ? security_inode_alloc+0x51/0x230 [ 118.292167][ T3293] security_inode_alloc+0x51/0x230 [ 118.292180][ T3293] inode_init_always_gfp+0x756/0x9e0 [ 118.292194][ T3293] ? __cfi_sock_alloc_inode+0x10/0x10 [ 118.292206][ T3293] alloc_inode+0xc5/0x270 [ 118.292220][ T3293] new_inode_pseudo+0x19/0x40 [ 118.292233][ T3293] do_accept+0x13f/0x750 [ 118.292245][ T3293] ? __kasan_check_write+0x18/0x20 [ 118.292256][ T3293] ? _raw_spin_lock+0x92/0x120 [ 118.292267][ T3293] ? __cfi_do_accept+0x10/0x10 [ 118.292280][ T3293] __sys_accept4+0x12f/0x1f0 [ 118.292292][ T3293] ? __cfi___sys_accept4+0x10/0x10 [ 118.292304][ T3293] ? trace_event_raw_event_sys_enter+0xf5/0x130 [ 118.292320][ T3293] __x64_sys_accept+0x81/0xa0 [ 118.292332][ T3293] x64_sys_call+0x2bcc/0x2ee0 [ 118.292343][ T3293] do_syscall_64+0x57/0xf0 [ 118.292353][ T3293] ? clear_bhb_loop+0x50/0xa0 [ 118.292365][ T3293] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 118.292377][ T3293] RIP: 0033:0x7f69d559e159 [ 118.292388][ T3293] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 118.292398][ T3293] RSP: 002b:00007f69d64d0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002b [ 118.292412][ T3293] RAX: ffffffffffffffda RBX: 00007f69d5825fa0 RCX: 00007f69d559e159 [ 118.292420][ T3293] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 118.292427][ T3293] RBP: 00007f69d563503b R08: 0000000000000000 R09: 0000000000000000 [ 118.292435][ T3293] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 118.292446][ T3293] R13: 00007f69d5826038 R14: 00007f69d5825fa0 R15: 00007ffc7e03cd68 [ 118.292463][ T3293] [ 118.816893][ T315] usb 3-1: USB disconnect, device number 35 [ 118.888863][ T313] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 118.898666][ T45] usb 2-1: Cannot set autoneg [ 118.905125][ T45] MOSCHIP usb-ethernet driver 2-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 118.927346][ T45] usb 2-1: USB disconnect, device number 37 [ 119.055933][ T313] usb 4-1: Using ep0 maxpacket: 16 [ 119.062355][ T313] usb 4-1: config 0 has an invalid interface number: 8 but max is 0 [ 119.070465][ T313] usb 4-1: config 0 has no interface number 0 [ 119.076607][ T313] usb 4-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 119.087503][ T313] usb 4-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 119.098666][ T313] usb 4-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 119.107760][ T313] usb 4-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 119.115884][ T313] usb 4-1: Product: syz [ 119.120034][ T313] usb 4-1: SerialNumber: syz [ 119.125225][ T313] usb 4-1: config 0 descriptor?? [ 119.265890][ T370] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 119.332799][ T3299] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 119.342177][ T3299] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 119.355561][ T313] usb 4-1: USB disconnect, device number 34 [ 119.415903][ T370] usb 3-1: Using ep0 maxpacket: 16 [ 119.422142][ T370] usb 3-1: config 0 has an invalid interface number: 34 but max is 0 [ 119.430308][ T370] usb 3-1: config 0 has no interface number 0 [ 119.436476][ T370] usb 3-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 119.446684][ T370] usb 3-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 119.458267][ T370] usb 3-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 119.467368][ T370] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 119.475346][ T370] usb 3-1: Product: syz [ 119.479545][ T370] usb 3-1: Manufacturer: syz [ 119.484127][ T370] usb 3-1: SerialNumber: syz [ 119.489614][ T370] usb 3-1: config 0 descriptor?? [ 119.494882][ T3342] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 119.502239][ T3342] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 119.622223][ T3359] rust_binder: Write failure EFAULT in pid:575 [ 119.655681][ T36] audit: type=1400 audit(127.636:479): avc: denied { getopt } for pid=3362 comm="syz.1.1091" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 119.712645][ T3342] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1024 sclass=netlink_xfrm_socket pid=3342 comm=syz.2.1082 [ 119.726453][ T3342] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 119.733635][ T3342] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 119.823650][ T3375] FAULT_INJECTION: forcing a failure. [ 119.823650][ T3375] name failslab, interval 1, probability 0, space 0, times 0 [ 119.836596][ T3375] CPU: 0 UID: 0 PID: 3375 Comm: syz.1.1095 Not tainted syzkaller #0 92ad247b86212872588e4244b63285ac9b5a817e [ 119.836619][ T3375] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 119.836628][ T3375] Call Trace: [ 119.836633][ T3375] [ 119.836638][ T3375] __dump_stack+0x21/0x30 [ 119.836669][ T3375] dump_stack_lvl+0x140/0x1c0 [ 119.836696][ T3375] ? __cfi_dump_stack_lvl+0x10/0x10 [ 119.836723][ T3375] dump_stack+0x19/0x20 [ 119.836745][ T3375] should_fail_ex+0x3c2/0x510 [ 119.836761][ T3375] should_failslab+0xac/0x100 [ 119.836774][ T3375] kmem_cache_alloc_noprof+0x42/0x410 [ 119.836785][ T3375] ? security_inode_alloc+0x51/0x230 [ 119.836800][ T3375] security_inode_alloc+0x51/0x230 [ 119.836824][ T3375] inode_init_always_gfp+0x756/0x9e0 [ 119.836848][ T3375] ? __cfi_sock_alloc_inode+0x10/0x10 [ 119.836869][ T3375] alloc_inode+0xc5/0x270 [ 119.836893][ T3375] new_inode_pseudo+0x19/0x40 [ 119.836906][ T3375] do_accept+0x13f/0x750 [ 119.836928][ T3375] ? __kasan_check_write+0x18/0x20 [ 119.836952][ T3375] ? _raw_spin_lock+0x92/0x120 [ 119.836973][ T3375] ? __cfi_do_accept+0x10/0x10 [ 119.836998][ T3375] __sys_accept4+0x12f/0x1f0 [ 119.837020][ T3375] ? __cfi___sys_accept4+0x10/0x10 [ 119.837043][ T3375] ? trace_event_raw_event_sys_enter+0xf5/0x130 [ 119.837071][ T3375] __x64_sys_accept+0x81/0xa0 [ 119.837085][ T3375] x64_sys_call+0x2bcc/0x2ee0 [ 119.837095][ T3375] do_syscall_64+0x57/0xf0 [ 119.837112][ T3375] ? clear_bhb_loop+0x50/0xa0 [ 119.837135][ T3375] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 119.837158][ T3375] RIP: 0033:0x7ff25839e159 [ 119.837175][ T3375] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 119.837199][ T3375] RSP: 002b:00007ff2592e3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002b [ 119.837214][ T3375] RAX: ffffffffffffffda RBX: 00007ff258625fa0 RCX: 00007ff25839e159 [ 119.837223][ T3375] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 119.837231][ T3375] RBP: 00007ff25843503b R08: 0000000000000000 R09: 0000000000000000 [ 119.837239][ T3375] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 119.837246][ T3375] R13: 00007ff258626038 R14: 00007ff258625fa0 R15: 00007fffb9acd498 [ 119.837262][ T3375] [ 119.856532][ T3378] FAULT_INJECTION: forcing a failure. [ 119.856532][ T3378] name fail_usercopy, interval 1, probability 100, space 0, times -1 [ 119.999748][ T3382] fuse: Bad value for 'fd' [ 120.001803][ T370] asix 3-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 120.024198][ T36] audit: type=1400 audit(128.006:480): avc: denied { setattr } for pid=3381 comm="syz.3.1098" name="fuse" dev="devtmpfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 120.034101][ T3378] CPU: 1 UID: 0 PID: 3378 Comm: syz.1.1096 Not tainted syzkaller #0 92ad247b86212872588e4244b63285ac9b5a817e [ 120.034131][ T3378] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 120.034143][ T3378] Call Trace: [ 120.034151][ T3378] [ 120.034160][ T3378] __dump_stack+0x21/0x30 [ 120.034189][ T3378] dump_stack_lvl+0x140/0x1c0 [ 120.034211][ T3378] ? __cfi_dump_stack_lvl+0x10/0x10 [ 120.034236][ T3378] ? __kasan_check_read+0x15/0x20 [ 120.034256][ T3378] dump_stack+0x19/0x20 [ 120.034278][ T3378] should_fail_ex+0x3c2/0x510 [ 120.034301][ T3378] should_fail+0xf/0x20 [ 120.034320][ T3378] should_fail_usercopy+0x1e/0x30 [ 120.034342][ T3378] _copy_from_user+0x20/0xa0 [ 120.034365][ T3378] do_sock_getsockopt+0x1ed/0x6c0 [ 120.034389][ T3378] ? trace_buffer_unlock_commit_regs+0x14a/0x600 [ 120.034410][ T3378] ? __cfi_do_sock_getsockopt+0x10/0x10 [ 120.034433][ T3378] ? __fget_files+0x2bc/0x330 [ 120.034455][ T3378] __x64_sys_getsockopt+0x1aa/0x250 [ 120.034479][ T3378] x64_sys_call+0x10db/0x2ee0 [ 120.034496][ T3378] do_syscall_64+0x57/0xf0 [ 120.034513][ T3378] ? clear_bhb_loop+0x50/0xa0 [ 120.034535][ T3378] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 120.034556][ T3378] RIP: 0033:0x7ff25839e159 [ 120.034572][ T3378] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 120.034588][ T3378] RSP: 002b:00007ff2592e3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 120.034610][ T3378] RAX: ffffffffffffffda RBX: 00007ff258625fa0 RCX: 00007ff25839e159 [ 120.034624][ T3378] RDX: 0000000000000001 RSI: 0000000000000065 RDI: 0000000000000003 [ 120.034637][ T3378] RBP: 00007ff2592e3090 R08: 0000200000000200 R09: 0000000000000000 [ 120.034652][ T3378] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 120.034673][ T3378] R13: 00007ff258626038 R14: 00007ff258625fa0 R15: 00007fffb9acd498 [ 120.034690][ T3378] [ 120.034858][ T370] asix 3-1:0.34: probe with driver asix failed with error -61 [ 120.324117][ T3398] FAULT_INJECTION: forcing a failure. [ 120.324117][ T3398] name fail_usercopy, interval 1, probability 100, space 0, times -1 [ 120.339806][ T3398] CPU: 0 UID: 0 PID: 3398 Comm: syz.1.1104 Not tainted syzkaller #0 92ad247b86212872588e4244b63285ac9b5a817e [ 120.339836][ T3398] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 120.339849][ T3398] Call Trace: [ 120.339857][ T3398] [ 120.339866][ T3398] __dump_stack+0x21/0x30 [ 120.339895][ T3398] dump_stack_lvl+0x140/0x1c0 [ 120.339919][ T3398] ? __cfi_dump_stack_lvl+0x10/0x10 [ 120.339944][ T3398] ? check_stack_object+0x138/0x150 [ 120.339965][ T3398] dump_stack+0x19/0x20 [ 120.339988][ T3398] should_fail_ex+0x3c2/0x510 [ 120.340011][ T3398] should_fail+0xf/0x20 [ 120.340031][ T3398] should_fail_usercopy+0x1e/0x30 [ 120.340053][ T3398] _copy_to_user+0x24/0xa0 [ 120.340079][ T3398] simple_read_from_buffer+0xed/0x160 [ 120.340104][ T3398] proc_fail_nth_read+0x1aa/0x220 [ 120.340130][ T3398] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 120.340162][ T3398] ? bpf_lsm_file_permission+0xd/0x20 [ 120.340186][ T3398] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 120.340210][ T3398] vfs_read+0x28b/0xc70 [ 120.340230][ T3398] ? rb_commit+0x753/0x7b0 [ 120.340251][ T3398] ? __cfi_vfs_read+0x10/0x10 [ 120.340270][ T3398] ? __kasan_check_write+0x18/0x20 [ 120.340289][ T3398] ? mutex_lock+0x97/0x1d0 [ 120.340310][ T3398] ? __cfi_mutex_lock+0x10/0x10 [ 120.340333][ T3398] ksys_read+0x145/0x260 [ 120.340352][ T3398] ? __cfi_ksys_read+0x10/0x10 [ 120.340372][ T3398] ? trace_event_raw_event_sys_enter+0xf5/0x130 [ 120.340399][ T3398] __x64_sys_read+0x7f/0x90 [ 120.340418][ T3398] x64_sys_call+0x2638/0x2ee0 [ 120.340436][ T3398] do_syscall_64+0x57/0xf0 [ 120.340454][ T3398] ? clear_bhb_loop+0x50/0xa0 [ 120.340474][ T3398] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 120.340494][ T3398] RIP: 0033:0x7ff25835e98e [ 120.340511][ T3398] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 120.340528][ T3398] RSP: 002b:00007ff2592e2fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 120.340551][ T3398] RAX: ffffffffffffffda RBX: 00007ff2592e36c0 RCX: 00007ff25835e98e [ 120.340565][ T3398] RDX: 000000000000000f RSI: 00007ff2592e30a0 RDI: 0000000000000004 [ 120.340578][ T3398] RBP: 00007ff2592e3090 R08: 0000000000000000 R09: 0000000000000000 [ 120.340591][ T3398] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 120.340603][ T3398] R13: 00007ff258626038 R14: 00007ff258625fa0 R15: 00007fffb9acd498 [ 120.340619][ T3398] [ 120.378363][ T3400] FAULT_INJECTION: forcing a failure. [ 120.378363][ T3400] name failslab, interval 1, probability 0, space 0, times 0 [ 120.531811][ T3413] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1110'. [ 120.533531][ T3400] CPU: 1 UID: 0 PID: 3400 Comm: syz.1.1105 Not tainted syzkaller #0 92ad247b86212872588e4244b63285ac9b5a817e [ 120.533560][ T3400] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 120.533575][ T3400] Call Trace: [ 120.533583][ T3400] [ 120.533592][ T3400] __dump_stack+0x21/0x30 [ 120.533630][ T3400] dump_stack_lvl+0x140/0x1c0 [ 120.533656][ T3400] ? __cfi_dump_stack_lvl+0x10/0x10 [ 120.533684][ T3400] dump_stack+0x19/0x20 [ 120.533709][ T3400] should_fail_ex+0x3c2/0x510 [ 120.533733][ T3400] should_failslab+0xac/0x100 [ 120.533756][ T3400] kmem_cache_alloc_noprof+0x42/0x410 [ 120.533776][ T3400] ? security_capable+0x44/0x130 [ 120.533797][ T3400] ? alloc_empty_file+0xbf/0x270 [ 120.533822][ T3400] alloc_empty_file+0xbf/0x270 [ 120.533845][ T3400] ? _raw_spin_unlock+0x45/0x60 [ 120.533863][ T3400] alloc_file_pseudo+0x142/0x1f0 [ 120.533887][ T3400] ? __cfi_alloc_file_pseudo+0x10/0x10 [ 120.533910][ T3400] ? inode_init_always_gfp+0x76e/0x9e0 [ 120.533933][ T3400] ? __cfi_sock_alloc_inode+0x10/0x10 [ 120.533954][ T3400] sock_alloc_file+0xbe/0x2b0 [ 120.533973][ T3400] do_accept+0x375/0x750 [ 120.533993][ T3400] ? __kasan_check_write+0x18/0x20 [ 120.534013][ T3400] ? __cfi_do_accept+0x10/0x10 [ 120.534037][ T3400] __sys_accept4+0x12f/0x1f0 [ 120.534058][ T3400] ? __cfi___sys_accept4+0x10/0x10 [ 120.534079][ T3400] ? trace_event_raw_event_sys_enter+0xf5/0x130 [ 120.534108][ T3400] __x64_sys_accept+0x81/0xa0 [ 120.534129][ T3400] x64_sys_call+0x2bcc/0x2ee0 [ 120.534147][ T3400] do_syscall_64+0x57/0xf0 [ 120.534164][ T3400] ? clear_bhb_loop+0x50/0xa0 [ 120.534186][ T3400] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 120.534208][ T3400] RIP: 0033:0x7ff25839e159 [ 120.534224][ T3400] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 120.534241][ T3400] RSP: 002b:00007ff2592e3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002b [ 120.534263][ T3400] RAX: ffffffffffffffda RBX: 00007ff258625fa0 RCX: 00007ff25839e159 [ 120.534278][ T3400] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 120.534291][ T3400] RBP: 00007ff25843503b R08: 0000000000000000 R09: 0000000000000000 [ 120.534304][ T3400] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 120.534317][ T3400] R13: 00007ff258626038 R14: 00007ff258625fa0 R15: 00007fffb9acd498 [ 120.534335][ T3400] [ 120.952894][ T3425] netlink: 'syz.3.1115': attribute type 10 has an invalid length. [ 120.981187][ T64] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 120.989528][ T64] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz1] on syz0 [ 121.045608][ T36] audit: type=1400 audit(129.026:481): avc: denied { setopt } for pid=3418 comm="syz.0.1113" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 121.140447][ T36] audit: type=1326 audit(129.126:482): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3418 comm="syz.0.1113" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0e0e19e159 code=0x7fc00000 [ 121.165297][ T36] audit: type=1326 audit(129.126:483): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3418 comm="syz.0.1113" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f0e0e19e159 code=0x7fc00000 [ 121.190661][ T36] audit: type=1326 audit(129.126:484): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3418 comm="syz.0.1113" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0e0e19e159 code=0x7fc00000 [ 121.215879][ T36] audit: type=1326 audit(129.126:485): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3418 comm="syz.0.1113" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0e0e19e159 code=0x7fc00000 [ 121.240788][ T36] audit: type=1326 audit(129.126:486): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3418 comm="syz.0.1113" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0e0e19e159 code=0x7fc00000 [ 121.266687][ T36] audit: type=1326 audit(129.126:487): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3418 comm="syz.0.1113" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0e0e19e159 code=0x7fc00000 [ 121.294772][ T36] audit: type=1326 audit(129.126:488): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3418 comm="syz.0.1113" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0e0e19e159 code=0x7fc00000 [ 121.319810][ T36] audit: type=1326 audit(129.126:489): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3418 comm="syz.0.1113" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0e0e19e159 code=0x7fc00000 [ 121.344807][ T36] audit: type=1326 audit(129.126:490): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3418 comm="syz.0.1113" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0e0e19e159 code=0x7fc00000 [ 121.396507][ T370] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 121.525902][ T313] usb 2-1: new full-speed USB device number 38 using dummy_hcd [ 121.547027][ T370] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 121.557936][ T370] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 121.567709][ T370] usb 4-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 121.576770][ T370] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 121.585388][ T370] usb 4-1: config 0 descriptor?? [ 121.677104][ T313] usb 2-1: too many endpoints for config 0 interface 0 altsetting 12: 254, using maximum allowed: 30 [ 121.688127][ T313] usb 2-1: config 0 interface 0 altsetting 12 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 121.699264][ T313] usb 2-1: config 0 interface 0 altsetting 12 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 121.712367][ T313] usb 2-1: config 0 interface 0 has no altsetting 0 [ 121.719085][ T313] usb 2-1: New USB device found, idVendor=16c0, idProduct=75e1, bcdDevice= 0.00 [ 121.728175][ T313] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 121.737154][ T313] usb 2-1: config 0 descriptor?? [ 121.742802][ T3441] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 121.993615][ T370] cp2112 0003:10C4:EA90.0004: unknown main item tag 0x0 [ 122.003008][ T370] cp2112 0003:10C4:EA90.0004: item fetching failed at offset 1/7 [ 122.011238][ T370] cp2112 0003:10C4:EA90.0004: parse failed [ 122.017131][ T370] cp2112 0003:10C4:EA90.0004: probe with driver cp2112 failed with error -22 [ 122.039075][ T64] usb 3-1: USB disconnect, device number 36 [ 122.055399][ T3455] netlink: 57 bytes leftover after parsing attributes in process `syz.2.1124'. [ 122.253369][ T3461] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1119'. [ 122.510935][ T3472] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1130'. [ 122.752150][ T3483] netlink: 140 bytes leftover after parsing attributes in process `syz.0.1135'. [ 122.762204][ T3483] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1135'. [ 122.876352][ T45] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 123.035871][ T45] usb 3-1: Using ep0 maxpacket: 16 [ 123.042491][ T45] usb 3-1: config 0 has an invalid interface number: 34 but max is 0 [ 123.050917][ T45] usb 3-1: config 0 has no interface number 0 [ 123.057425][ T45] usb 3-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 123.067604][ T45] usb 3-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 123.079205][ T45] usb 3-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 123.088514][ T45] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 123.096602][ T45] usb 3-1: Product: syz [ 123.100814][ T45] usb 3-1: Manufacturer: syz [ 123.105421][ T45] usb 3-1: SerialNumber: syz [ 123.111269][ T45] usb 3-1: config 0 descriptor?? [ 123.116787][ T3479] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 123.123967][ T3479] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 123.333885][ T3479] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1024 sclass=netlink_xfrm_socket pid=3479 comm=syz.2.1133 [ 123.346993][ T3479] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 123.354222][ T3479] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 123.562410][ T45] asix 3-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 123.572693][ T45] asix 3-1:0.34: probe with driver asix failed with error -61 [ 124.022083][ T313] usbhid 2-1:0.0: can't add hid device: -71 [ 124.029214][ T313] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 124.039474][ T313] usb 2-1: USB disconnect, device number 38 [ 124.069216][ T3513] FAULT_INJECTION: forcing a failure. [ 124.069216][ T3513] name failslab, interval 1, probability 0, space 0, times 0 [ 124.082024][ T3513] CPU: 0 UID: 0 PID: 3513 Comm: syz.1.1148 Not tainted syzkaller #0 92ad247b86212872588e4244b63285ac9b5a817e [ 124.082059][ T3513] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 124.082073][ T3513] Call Trace: [ 124.082079][ T3513] [ 124.082084][ T3513] __dump_stack+0x21/0x30 [ 124.082110][ T3513] dump_stack_lvl+0x140/0x1c0 [ 124.082125][ T3513] ? __cfi_dump_stack_lvl+0x10/0x10 [ 124.082141][ T3513] dump_stack+0x19/0x20 [ 124.082155][ T3513] should_fail_ex+0x3c2/0x510 [ 124.082168][ T3513] should_failslab+0xac/0x100 [ 124.082182][ T3513] kmem_cache_alloc_noprof+0x42/0x410 [ 124.082194][ T3513] ? security_inode_alloc+0x51/0x230 [ 124.082210][ T3513] security_inode_alloc+0x51/0x230 [ 124.082222][ T3513] inode_init_always_gfp+0x756/0x9e0 [ 124.082238][ T3513] ? __cfi_sock_alloc_inode+0x10/0x10 [ 124.082250][ T3513] alloc_inode+0xc5/0x270 [ 124.082263][ T3513] new_inode_pseudo+0x19/0x40 [ 124.082275][ T3513] do_accept+0x13f/0x750 [ 124.082287][ T3513] ? __kasan_check_write+0x18/0x20 [ 124.082309][ T3513] ? _raw_spin_lock+0x92/0x120 [ 124.082320][ T3513] ? __cfi_do_accept+0x10/0x10 [ 124.082334][ T3513] __sys_accept4+0x12f/0x1f0 [ 124.082346][ T3513] ? __cfi___sys_accept4+0x10/0x10 [ 124.082359][ T3513] ? trace_event_raw_event_sys_enter+0xf5/0x130 [ 124.082377][ T3513] __x64_sys_accept+0x81/0xa0 [ 124.082390][ T3513] x64_sys_call+0x2bcc/0x2ee0 [ 124.082402][ T3513] do_syscall_64+0x57/0xf0 [ 124.082411][ T3513] ? clear_bhb_loop+0x50/0xa0 [ 124.082425][ T3513] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 124.082437][ T3513] RIP: 0033:0x7ff25839e159 [ 124.082452][ T3513] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 124.082471][ T3513] RSP: 002b:00007ff2592e3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002b [ 124.082487][ T3513] RAX: ffffffffffffffda RBX: 00007ff258625fa0 RCX: 00007ff25839e159 [ 124.082496][ T3513] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 124.082504][ T3513] RBP: 00007ff25843503b R08: 0000000000000000 R09: 0000000000000000 [ 124.082516][ T3513] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 124.082523][ T3513] R13: 00007ff258626038 R14: 00007ff258625fa0 R15: 00007fffb9acd498 [ 124.082533][ T3513] [ 124.113031][ T45] usb 4-1: USB disconnect, device number 35 [ 124.345251][ T3529] FAULT_INJECTION: forcing a failure. [ 124.345251][ T3529] name failslab, interval 1, probability 0, space 0, times 0 [ 124.358127][ T3529] CPU: 0 UID: 0 PID: 3529 Comm: syz.3.1154 Not tainted syzkaller #0 92ad247b86212872588e4244b63285ac9b5a817e [ 124.358161][ T3529] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 124.358174][ T3529] Call Trace: [ 124.358182][ T3529] [ 124.358191][ T3529] __dump_stack+0x21/0x30 [ 124.358220][ T3529] dump_stack_lvl+0x140/0x1c0 [ 124.358243][ T3529] ? __cfi_dump_stack_lvl+0x10/0x10 [ 124.358267][ T3529] ? release_sock+0x171/0x1f0 [ 124.358287][ T3529] dump_stack+0x19/0x20 [ 124.358309][ T3529] should_fail_ex+0x3c2/0x510 [ 124.358331][ T3529] should_failslab+0xac/0x100 [ 124.358353][ T3529] kmem_cache_alloc_node_noprof+0x45/0x420 [ 124.358373][ T3529] ? netlink_data_ready+0x20/0x20 [ 124.358395][ T3529] ? __alloc_skb+0x10c/0x360 [ 124.358416][ T3529] __alloc_skb+0x10c/0x360 [ 124.358437][ T3529] netlink_alloc_large_skb+0xf7/0x1b0 [ 124.358459][ T3529] netlink_sendmsg+0x576/0xad0 [ 124.358483][ T3529] ? __cfi_netlink_sendmsg+0x10/0x10 [ 124.358508][ T3529] ? bpf_lsm_socket_sendmsg+0xd/0x20 [ 124.358529][ T3529] ? security_socket_sendmsg+0x3d/0x100 [ 124.358553][ T3529] ____sys_sendmsg+0x9a1/0xa00 [ 124.358577][ T3529] ? __import_iovec+0x5b9/0x7d0 [ 124.358594][ T3529] ? __sys_sendmsg_sock+0x50/0x50 [ 124.358614][ T3529] ? import_iovec+0x80/0xb0 [ 124.358627][ T3529] ___sys_sendmsg+0x2a6/0x370 [ 124.358651][ T3529] ? __sys_sendmsg+0x260/0x260 [ 124.358675][ T3529] ? rb_commit+0x753/0x7b0 [ 124.358696][ T3529] ? __fget_files+0x2bc/0x330 [ 124.358719][ T3529] __x64_sys_sendmsg+0x1be/0x2a0 [ 124.358743][ T3529] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 124.358768][ T3529] ? trace_event_raw_event_sys_enter+0xf5/0x130 [ 124.358795][ T3529] x64_sys_call+0x2a4c/0x2ee0 [ 124.358813][ T3529] do_syscall_64+0x57/0xf0 [ 124.358830][ T3529] ? clear_bhb_loop+0x50/0xa0 [ 124.358848][ T3529] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 124.358865][ T3529] RIP: 0033:0x7f69d559e159 [ 124.358879][ T3529] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 124.358892][ T3529] RSP: 002b:00007f69d64d0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 124.358910][ T3529] RAX: ffffffffffffffda RBX: 00007f69d5825fa0 RCX: 00007f69d559e159 [ 124.358931][ T3529] RDX: 0000000020040084 RSI: 0000200000000580 RDI: 0000000000000003 [ 124.358942][ T3529] RBP: 00007f69d64d0090 R08: 0000000000000000 R09: 0000000000000000 [ 124.358953][ T3529] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 124.358963][ T3529] R13: 00007f69d5826038 R14: 00007f69d5825fa0 R15: 00007ffc7e03cd68 [ 124.358976][ T3529] [ 124.668880][ T1993] Bluetooth: hci0: Frame reassembly failed (-84) [ 124.675409][ T1993] Bluetooth: hci0: Frame reassembly failed (-84) [ 124.682418][ T1993] Bluetooth: hci0: Frame reassembly failed (-84) [ 124.689540][ T1993] Bluetooth: hci0: Frame reassembly failed (-84) [ 124.936022][ T3562] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1165'. [ 125.095231][ T3579] netlink: 5 bytes leftover after parsing attributes in process `syz.0.1172'. [ 125.661062][ T45] usb 3-1: USB disconnect, device number 37 [ 125.706337][ T3589] rust_binder: Write failure EFAULT in pid:682 [ 126.715892][ T548] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 126.728250][ T53] Bluetooth: hci0: command 0x1003 tx timeout [ 126.826896][ T3616] FAULT_INJECTION: forcing a failure. [ 126.826896][ T3616] name fail_futex, interval 1, probability 0, space 0, times 0 [ 126.855916][ T3616] CPU: 1 UID: 16832 PID: 3616 Comm: syz.3.1185 Not tainted syzkaller #0 92ad247b86212872588e4244b63285ac9b5a817e [ 126.855953][ T3616] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 126.855969][ T3616] Call Trace: [ 126.855978][ T3616] [ 126.855987][ T3616] __dump_stack+0x21/0x30 [ 126.856019][ T3616] dump_stack_lvl+0x140/0x1c0 [ 126.856045][ T3616] ? __cfi_dump_stack_lvl+0x10/0x10 [ 126.856071][ T3616] dump_stack+0x19/0x20 [ 126.856093][ T3616] should_fail_ex+0x3c2/0x510 [ 126.856114][ T3616] should_fail+0xf/0x20 [ 126.856133][ T3616] get_futex_key+0x178/0x940 [ 126.856157][ T3616] ? __cfi_get_futex_key+0x10/0x10 [ 126.856183][ T3616] futex_wake+0x150/0x950 [ 126.856207][ T3616] ? __kasan_check_read+0x15/0x20 [ 126.856227][ T3616] ? __rb_reserve_next+0x794/0xd90 [ 126.856243][ T3616] ? __cfi_futex_wake+0x10/0x10 [ 126.856254][ T3616] ? __kasan_check_read+0x15/0x20 [ 126.856265][ T3616] ? rb_commit+0x753/0x7b0 [ 126.856277][ T3616] do_futex+0x37d/0x510 [ 126.856292][ T3616] ? __cfi_do_futex+0x10/0x10 [ 126.856306][ T3616] __se_sys_futex+0x13c/0x320 [ 126.856321][ T3616] ? __x64_sys_futex+0x110/0x110 [ 126.856335][ T3616] ? trace_event_raw_event_sys_enter+0xf5/0x130 [ 126.856350][ T3616] __x64_sys_futex+0xe9/0x110 [ 126.856363][ T3616] x64_sys_call+0x227f/0x2ee0 [ 126.856374][ T3616] do_syscall_64+0x57/0xf0 [ 126.856384][ T3616] ? clear_bhb_loop+0x50/0xa0 [ 126.856396][ T3616] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 126.856408][ T3616] RIP: 0033:0x7f69d559e159 [ 126.856419][ T3616] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 126.856430][ T3616] RSP: 002b:00007f69d64d00e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 126.856444][ T3616] RAX: ffffffffffffffda RBX: 00007f69d5825fa8 RCX: 00007f69d559e159 [ 126.856459][ T3616] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f69d5825fac [ 126.856467][ T3616] RBP: 00007f69d5825fa0 R08: 4000000000000000 R09: 0000000000000000 [ 126.856475][ T3616] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 126.856484][ T3616] R13: 00007f69d5826038 R14: 00007ffc7e03cc80 R15: 00007ffc7e03cd68 [ 126.856494][ T3616] [ 127.070967][ T3629] fuse: Unknown parameter 'ù' [ 127.135849][ T3636] FAULT_INJECTION: forcing a failure. [ 127.135849][ T3636] name failslab, interval 1, probability 0, space 0, times 0 [ 127.159549][ T3636] CPU: 1 UID: 0 PID: 3636 Comm: syz.3.1194 Not tainted syzkaller #0 92ad247b86212872588e4244b63285ac9b5a817e [ 127.159584][ T3636] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 127.159597][ T3636] Call Trace: [ 127.159605][ T3636] [ 127.159615][ T3636] __dump_stack+0x21/0x30 [ 127.159645][ T3636] dump_stack_lvl+0x140/0x1c0 [ 127.159669][ T3636] ? __cfi_dump_stack_lvl+0x10/0x10 [ 127.159696][ T3636] dump_stack+0x19/0x20 [ 127.159720][ T3636] should_fail_ex+0x3c2/0x510 [ 127.159744][ T3636] should_failslab+0xac/0x100 [ 127.159767][ T3636] kmem_cache_alloc_noprof+0x42/0x410 [ 127.159788][ T3636] ? getname_flags+0xcc/0x6b0 [ 127.159809][ T3636] getname_flags+0xcc/0x6b0 [ 127.159831][ T3636] __se_sys_newstat+0x11b/0x3e0 [ 127.159854][ T3636] ? __x64_sys_newstat+0x80/0x80 [ 127.159878][ T3636] ? __kasan_check_read+0x15/0x20 [ 127.159897][ T3636] ? ring_buffer_unlock_commit+0x473/0x5e0 [ 127.159922][ T3636] ? trace_event_raw_event_sys_enter+0xf5/0x130 [ 127.159950][ T3636] __x64_sys_newstat+0x5f/0x80 [ 127.159972][ T3636] x64_sys_call+0x5b6/0x2ee0 [ 127.159990][ T3636] do_syscall_64+0x57/0xf0 [ 127.160008][ T3636] ? clear_bhb_loop+0x50/0xa0 [ 127.160031][ T3636] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 127.160053][ T3636] RIP: 0033:0x7f69d559e159 [ 127.160071][ T3636] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 127.160088][ T3636] RSP: 002b:00007f69d64d0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 127.160111][ T3636] RAX: ffffffffffffffda RBX: 00007f69d5825fa0 RCX: 00007f69d559e159 [ 127.160128][ T3636] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 127.160142][ T3636] RBP: 00007f69d64d0090 R08: 0000000000000000 R09: 0000000000000000 [ 127.160156][ T3636] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 127.160169][ T3636] R13: 00007f69d5826038 R14: 00007f69d5825fa0 R15: 00007ffc7e03cd68 [ 127.160187][ T3636] [ 127.211423][ T36] kauditd_printk_skb: 66 callbacks suppressed [ 127.211441][ T36] audit: type=1400 audit(135.156:557): avc: denied { nlmsg_write } for pid=3633 comm="syz.0.1193" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 127.212094][ T315] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 127.217392][ T3634] ./dev/sda1: Can't lookup blockdev [ 127.375870][ T315] usb 2-1: Using ep0 maxpacket: 16 [ 127.408670][ T315] usb 2-1: config 0 has an invalid interface number: 34 but max is 0 [ 127.417204][ T315] usb 2-1: config 0 has no interface number 0 [ 127.440007][ T315] usb 2-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 127.450462][ T315] usb 2-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 127.465430][ T315] usb 2-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 127.475452][ T315] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 127.483586][ T315] usb 2-1: Product: syz [ 127.487961][ T315] usb 2-1: Manufacturer: syz [ 127.492911][ T315] usb 2-1: SerialNumber: syz [ 127.499810][ T315] usb 2-1: config 0 descriptor?? [ 127.505363][ T3614] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 127.521182][ T3614] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 127.533807][ T3653] ./dev/sda1: Can't lookup blockdev [ 127.631403][ T36] audit: type=1400 audit(135.616:558): avc: denied { create } for pid=3654 comm="syz.0.1203" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 127.738758][ T36] audit: type=1400 audit(135.726:559): avc: denied { mounton } for pid=3650 comm="syz.3.1200" path="/255/file0" dev="tmpfs" ino=1414 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 127.776133][ T3668] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1208'. [ 127.788439][ T3614] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1024 sclass=netlink_xfrm_socket pid=3614 comm=syz.1.1184 [ 127.829173][ T3614] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 127.837484][ T3614] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 127.874093][ T45] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 127.906021][ T45] hid-generic 0000:0000:0000.0005: hidraw1: HID v0.00 Device [syz1] on syz0 [ 128.009487][ T3684] fuse: Unknown parameter '0xffffffffffffffff0x00000000000000030x000000000000000300000000000000000000' [ 128.046585][ T315] asix 2-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 128.057398][ T315] asix 2-1:0.34: probe with driver asix failed with error -61 [ 128.429375][ T3696] FAULT_INJECTION: forcing a failure. [ 128.429375][ T3696] name failslab, interval 1, probability 0, space 0, times 0 [ 128.442198][ T3696] CPU: 1 UID: 0 PID: 3696 Comm: syz.2.1217 Not tainted syzkaller #0 92ad247b86212872588e4244b63285ac9b5a817e [ 128.442239][ T3696] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 128.442253][ T3696] Call Trace: [ 128.442262][ T3696] [ 128.442271][ T3696] __dump_stack+0x21/0x30 [ 128.442302][ T3696] dump_stack_lvl+0x140/0x1c0 [ 128.442327][ T3696] ? __cfi_dump_stack_lvl+0x10/0x10 [ 128.442352][ T3696] ? cond_bools_copy+0x60/0x180 [ 128.442373][ T3696] ? trace_event_raw_event_kmalloc+0xac/0xf0 [ 128.442398][ T3696] dump_stack+0x19/0x20 [ 128.442420][ T3696] should_fail_ex+0x3c2/0x510 [ 128.442443][ T3696] should_failslab+0xac/0x100 [ 128.442464][ T3696] kmem_cache_alloc_noprof+0x42/0x410 [ 128.442483][ T3696] ? kmemdup_noprof+0x5b/0x80 [ 128.442500][ T3696] ? hashtab_duplicate+0x1a0/0x6c0 [ 128.442524][ T3696] ? cond_bools_copy+0x71/0x180 [ 128.442543][ T3696] hashtab_duplicate+0x1a0/0x6c0 [ 128.442567][ T3696] ? __cfi_cond_bools_destroy+0x10/0x10 [ 128.442586][ T3696] ? __cfi_cond_bools_copy+0x10/0x10 [ 128.442606][ T3696] ? __kmalloc_noprof+0x40a/0x510 [ 128.442625][ T3696] cond_policydb_dup+0x129/0xc00 [ 128.442643][ T3696] ? kmemdup_noprof+0x5b/0x80 [ 128.442661][ T3696] security_set_bools+0xdf/0x630 [ 128.442679][ T3696] ? _copy_from_user+0x87/0xa0 [ 128.442703][ T3696] ? memdup_user_nul+0xad/0x1a0 [ 128.442720][ T3696] ? sel_commit_bools_write+0x137/0x400 [ 128.442742][ T3696] sel_commit_bools_write+0x2fa/0x400 [ 128.442764][ T3696] ? __cfi_sel_commit_bools_write+0x10/0x10 [ 128.442786][ T3696] ? bpf_lsm_file_permission+0xd/0x20 [ 128.442809][ T3696] vfs_writev+0x652/0xe90 [ 128.442831][ T3696] ? __cfi_sel_commit_bools_write+0x10/0x10 [ 128.442855][ T3696] ? do_writev+0x2e0/0x2e0 [ 128.442876][ T3696] ? __kasan_check_read+0x15/0x20 [ 128.442897][ T3696] ? __kasan_check_write+0x18/0x20 [ 128.442915][ T3696] ? mutex_lock+0x97/0x1d0 [ 128.442936][ T3696] ? __cfi_mutex_lock+0x10/0x10 [ 128.442957][ T3696] do_writev+0x151/0x2e0 [ 128.442979][ T3696] ? vfs_readv+0xa00/0xa00 [ 128.443001][ T3696] ? trace_event_raw_event_sys_enter+0xf5/0x130 [ 128.443028][ T3696] __x64_sys_writev+0x81/0x90 [ 128.443048][ T3696] x64_sys_call+0x1fbb/0x2ee0 [ 128.443066][ T3696] do_syscall_64+0x57/0xf0 [ 128.443083][ T3696] ? clear_bhb_loop+0x50/0xa0 [ 128.443105][ T3696] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 128.443126][ T3696] RIP: 0033:0x7efee9b9e159 [ 128.443143][ T3696] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 128.443159][ T3696] RSP: 002b:00007efeeaa1a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 128.443182][ T3696] RAX: ffffffffffffffda RBX: 00007efee9e25fa0 RCX: 00007efee9b9e159 [ 128.443199][ T3696] RDX: 0000000000000001 RSI: 0000200000003600 RDI: 0000000000000005 [ 128.443213][ T3696] RBP: 00007efee9c3503b R08: 0000000000000000 R09: 0000000000000000 [ 128.443236][ T3696] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 128.443249][ T3696] R13: 00007efee9e26038 R14: 00007efee9e25fa0 R15: 00007fffbc0bb1b8 [ 128.443266][ T3696] [ 128.790973][ T3705] FAULT_INJECTION: forcing a failure. [ 128.790973][ T3705] name failslab, interval 1, probability 0, space 0, times 0 [ 128.803766][ T3705] CPU: 1 UID: 0 PID: 3705 Comm: syz.2.1221 Not tainted syzkaller #0 92ad247b86212872588e4244b63285ac9b5a817e [ 128.803796][ T3705] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 128.803809][ T3705] Call Trace: [ 128.803817][ T3705] [ 128.803826][ T3705] __dump_stack+0x21/0x30 [ 128.803855][ T3705] dump_stack_lvl+0x140/0x1c0 [ 128.803879][ T3705] ? __cfi_dump_stack_lvl+0x10/0x10 [ 128.803905][ T3705] dump_stack+0x19/0x20 [ 128.803927][ T3705] should_fail_ex+0x3c2/0x510 [ 128.803950][ T3705] should_failslab+0xac/0x100 [ 128.803971][ T3705] __kmalloc_cache_noprof+0x41/0x470 [ 128.803993][ T3705] ? alloc_fs_context+0x6f/0x800 [ 128.804015][ T3705] ? __asan_memcpy+0x5a/0x80 [ 128.804035][ T3705] alloc_fs_context+0x6f/0x800 [ 128.804057][ T3705] ? __kasan_check_write+0x18/0x20 [ 128.804076][ T3705] fs_context_for_mount+0x26/0x40 [ 128.804099][ T3705] do_new_mount+0x116/0xb40 [ 128.804118][ T3705] ? security_capable+0x44/0x130 [ 128.804140][ T3705] path_mount+0x66a/0xff0 [ 128.804159][ T3705] ? putname+0x113/0x150 [ 128.804181][ T3705] __se_sys_mount+0x2bf/0x480 [ 128.804208][ T3705] ? __x64_sys_mount+0xf0/0xf0 [ 128.804228][ T3705] ? trace_event_raw_event_sys_enter+0xf5/0x130 [ 128.804255][ T3705] __x64_sys_mount+0xc3/0xf0 [ 128.804274][ T3705] x64_sys_call+0x2021/0x2ee0 [ 128.804292][ T3705] do_syscall_64+0x57/0xf0 [ 128.804310][ T3705] ? clear_bhb_loop+0x50/0xa0 [ 128.804333][ T3705] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 128.804355][ T3705] RIP: 0033:0x7efee9b9e159 [ 128.804372][ T3705] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 128.804389][ T3705] RSP: 002b:00007efeeaa1a028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 128.804412][ T3705] RAX: ffffffffffffffda RBX: 00007efee9e25fa0 RCX: 00007efee9b9e159 [ 128.804428][ T3705] RDX: 0000200000004500 RSI: 00002000000000c0 RDI: 0000000000000000 [ 128.804444][ T3705] RBP: 00007efeeaa1a090 R08: 0000200000000100 R09: 0000000000000000 [ 128.804459][ T3705] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 128.804472][ T3705] R13: 00007efee9e26038 R14: 00007efee9e25fa0 R15: 00007fffbc0bb1b8 [ 128.804489][ T3705] [ 128.850671][ T36] audit: type=1400 audit(136.808:560): avc: denied { execute } for pid=3713 comm="syz.0.1224" path="/292/file0" dev="tmpfs" ino=1624 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 129.116083][ T3733] vcan0: entered allmulticast mode [ 129.322325][ T3752] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1237'. [ 129.625913][ T315] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 129.765875][ T315] usb 4-1: device descriptor read/64, error -71 [ 129.791692][ T36] audit: type=1400 audit(137.778:561): avc: denied { watch } for pid=3768 comm="syz.0.1244" path="/297" dev="tmpfs" ino=1648 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 129.930584][ T3776] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1246'. [ 130.025909][ T315] usb 4-1: device descriptor read/64, error -71 [ 130.137284][ T64] usb 2-1: USB disconnect, device number 39 [ 130.205082][ T3797] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1255'. [ 130.267357][ T315] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 130.425922][ T315] usb 4-1: device descriptor read/64, error -71 [ 130.665904][ T315] usb 4-1: device descriptor read/64, error -71 [ 130.776101][ T315] usb usb4-port1: attempt power cycle [ 131.073723][ T3816] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=768 sclass=netlink_xfrm_socket pid=3816 comm=syz.0.1262 [ 131.120802][ T3821] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1264'. [ 131.130047][ T315] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 131.177948][ T315] usb 4-1: device descriptor read/8, error -71 [ 131.244436][ T3827] FAULT_INJECTION: forcing a failure. [ 131.244436][ T3827] name failslab, interval 1, probability 0, space 0, times 0 [ 131.257159][ T3827] CPU: 0 UID: 0 PID: 3827 Comm: syz.2.1267 Not tainted syzkaller #0 92ad247b86212872588e4244b63285ac9b5a817e [ 131.257189][ T3827] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 131.257202][ T3827] Call Trace: [ 131.257211][ T3827] [ 131.257220][ T3827] __dump_stack+0x21/0x30 [ 131.257247][ T3827] dump_stack_lvl+0x140/0x1c0 [ 131.257271][ T3827] ? __cfi_dump_stack_lvl+0x10/0x10 [ 131.257295][ T3827] ? avc_has_extended_perms+0x94b/0xe60 [ 131.257312][ T3827] dump_stack+0x19/0x20 [ 131.257325][ T3827] should_fail_ex+0x3c2/0x510 [ 131.257339][ T3827] should_failslab+0xac/0x100 [ 131.257353][ T3827] __kmalloc_node_noprof+0x69/0x500 [ 131.257366][ T3827] ? __kvmalloc_node_noprof+0x128/0x300 [ 131.257377][ T3827] __kvmalloc_node_noprof+0x128/0x300 [ 131.257387][ T3827] ? __cfi___kvmalloc_node_noprof+0x10/0x10 [ 131.257398][ T3827] ? __kasan_check_write+0x18/0x20 [ 131.257409][ T3827] kvm_dev_ioctl_get_cpuid+0x22b/0x1350 [ 131.257422][ T3827] ? ioctl_has_perm+0x39a/0x500 [ 131.257434][ T3827] ? __cfi_kvm_dev_ioctl_get_cpuid+0x10/0x10 [ 131.257446][ T3827] ? __kasan_check_write+0x18/0x20 [ 131.257456][ T3827] kvm_arch_dev_ioctl+0x3fd/0x990 [ 131.257467][ T3827] ? __cfi_kvm_arch_dev_ioctl+0x10/0x10 [ 131.257478][ T3827] ? selinux_file_ioctl+0x732/0x1480 [ 131.257489][ T3827] ? __kasan_check_read+0x15/0x20 [ 131.257500][ T3827] ? __kasan_check_read+0x15/0x20 [ 131.257511][ T3827] ? ring_buffer_unlock_commit+0x473/0x5e0 [ 131.257524][ T3827] kvm_dev_ioctl+0x48e/0x14c0 [ 131.257540][ T3827] ? __cfi_kvm_dev_ioctl+0x10/0x10 [ 131.257554][ T3827] ? bpf_lsm_file_ioctl+0xd/0x20 [ 131.257568][ T3827] ? security_file_ioctl+0x3e/0x110 [ 131.257579][ T3827] ? __cfi_kvm_dev_ioctl+0x10/0x10 [ 131.257593][ T3827] __se_sys_ioctl+0x126/0x1b0 [ 131.257606][ T3827] __x64_sys_ioctl+0x7f/0xa0 [ 131.257618][ T3827] x64_sys_call+0x1878/0x2ee0 [ 131.257629][ T3827] do_syscall_64+0x57/0xf0 [ 131.257639][ T3827] ? clear_bhb_loop+0x50/0xa0 [ 131.257652][ T3827] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 131.257664][ T3827] RIP: 0033:0x7efee9b9e159 [ 131.257675][ T3827] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 131.257685][ T3827] RSP: 002b:00007efeeaa1a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 131.257699][ T3827] RAX: ffffffffffffffda RBX: 00007efee9e25fa0 RCX: 00007efee9b9e159 [ 131.257707][ T3827] RDX: 00002000000000c0 RSI: 00000000c008ae09 RDI: 0000000000000003 [ 131.257715][ T3827] RBP: 00007efeeaa1a090 R08: 0000000000000000 R09: 0000000000000000 [ 131.257724][ T3827] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 131.257731][ T3827] R13: 00007efee9e26038 R14: 00007efee9e25fa0 R15: 00007fffbc0bb1b8 [ 131.257740][ T3827] [ 131.557044][ T315] usb 4-1: device descriptor read/8, error -71 [ 131.660148][ T3840] FAULT_INJECTION: forcing a failure. [ 131.660148][ T3840] name failslab, interval 1, probability 0, space 0, times 0 [ 131.673027][ T3840] CPU: 1 UID: 0 PID: 3840 Comm: syz.2.1272 Not tainted syzkaller #0 92ad247b86212872588e4244b63285ac9b5a817e [ 131.673060][ T3840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 131.673074][ T3840] Call Trace: [ 131.673083][ T3840] [ 131.673093][ T3840] __dump_stack+0x21/0x30 [ 131.673124][ T3840] dump_stack_lvl+0x140/0x1c0 [ 131.673139][ T3840] ? __cfi_dump_stack_lvl+0x10/0x10 [ 131.673155][ T3840] ? __cfi_trace_clock_local+0x10/0x10 [ 131.673166][ T3840] ? kvm_sched_clock_read+0x15/0x30 [ 131.673180][ T3840] ? sched_clock_noinstr+0xd/0x30 [ 131.673192][ T3840] dump_stack+0x19/0x20 [ 131.673206][ T3840] should_fail_ex+0x3c2/0x510 [ 131.673219][ T3840] should_failslab+0xac/0x100 [ 131.673233][ T3840] kmem_cache_alloc_noprof+0x42/0x410 [ 131.673244][ T3840] ? vm_area_dup+0x3f/0x560 [ 131.673256][ T3840] vm_area_dup+0x3f/0x560 [ 131.673266][ T3840] ? __split_vma+0x1b8/0xc10 [ 131.673278][ T3840] __split_vma+0x1ce/0xc10 [ 131.673289][ T3840] ? vms_gather_munmap_vmas+0xd90/0xd90 [ 131.673301][ T3840] ? trace_buffer_unlock_commit_regs+0x14a/0x600 [ 131.673314][ T3840] vma_modify+0x364/0x1540 [ 131.673326][ T3840] vma_modify_flags+0x182/0x1c0 [ 131.673346][ T3840] mlock_fixup+0x1c9/0x740 [ 131.673363][ T3840] apply_vma_lock_flags+0x28a/0x3b0 [ 131.673379][ T3840] ? do_mlock+0xa10/0xa10 [ 131.673394][ T3840] ? __cfi_down_write_killable+0x10/0x10 [ 131.673408][ T3840] ? __kasan_check_read+0x15/0x20 [ 131.673420][ T3840] ? ring_buffer_unlock_commit+0x473/0x5e0 [ 131.673433][ T3840] do_mlock+0x71d/0xa10 [ 131.673447][ T3840] ? trace_buffer_unlock_commit_regs+0x14a/0x600 [ 131.673459][ T3840] ? lru_gen_add_folio+0x880/0x880 [ 131.673474][ T3840] ? trace_event_raw_event_sys_enter+0xf5/0x130 [ 131.673490][ T3840] __x64_sys_mlock+0x64/0x80 [ 131.673503][ T3840] x64_sys_call+0x670/0x2ee0 [ 131.673514][ T3840] do_syscall_64+0x57/0xf0 [ 131.673523][ T3840] ? clear_bhb_loop+0x50/0xa0 [ 131.673536][ T3840] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 131.673548][ T3840] RIP: 0033:0x7efee9b9e159 [ 131.673559][ T3840] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 131.673569][ T3840] RSP: 002b:00007efeeaa1a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000095 [ 131.673583][ T3840] RAX: ffffffffffffffda RBX: 00007efee9e25fa0 RCX: 00007efee9b9e159 [ 131.673592][ T3840] RDX: 0000000000000000 RSI: 0000000000003000 RDI: 0000200000001000 [ 131.673600][ T3840] RBP: 00007efee9c3503b R08: 0000000000000000 R09: 0000000000000000 [ 131.673607][ T3840] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 131.673614][ T3840] R13: 00007efee9e26038 R14: 00007efee9e25fa0 R15: 00007fffbc0bb1b8 [ 131.673623][ T3840] [ 131.947552][ T3843] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1273'. [ 132.215886][ T315] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 132.232825][ T3861] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=768 sclass=netlink_xfrm_socket pid=3861 comm=syz.0.1281 [ 132.250536][ T315] usb 4-1: device descriptor read/8, error -71 [ 132.335772][ T3864] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1282'. [ 132.391256][ T315] usb 4-1: device descriptor read/8, error -71 [ 132.506074][ T315] usb usb4-port1: unable to enumerate USB device [ 132.823944][ T3885] fuse: Unknown parameter 'ÿÿÿÿ18446744073709551615' [ 132.928840][ T3890] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1294'. [ 133.065864][ T315] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 133.216417][ T315] usb 4-1: Using ep0 maxpacket: 8 [ 133.226668][ T315] usb 4-1: config 0 has an invalid interface number: 31 but max is 0 [ 133.234897][ T315] usb 4-1: config 0 has no interface number 0 [ 133.242857][ T315] usb 4-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 133.252127][ T315] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 133.260241][ T315] usb 4-1: Product: syz [ 133.265654][ T315] usb 4-1: Manufacturer: syz [ 133.273771][ T315] usb 4-1: SerialNumber: syz [ 133.281608][ T315] usb 4-1: config 0 descriptor?? [ 133.346391][ T45] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 133.491600][ T315] usb 4-1: USB disconnect, device number 40 [ 133.515961][ T45] usb 2-1: Using ep0 maxpacket: 16 [ 133.524280][ T45] usb 2-1: config 0 has an invalid interface number: 34 but max is 0 [ 133.532718][ T45] usb 2-1: config 0 has no interface number 0 [ 133.539103][ T45] usb 2-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 133.549397][ T45] usb 2-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 133.561440][ T45] usb 2-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 133.570782][ T45] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 133.579099][ T45] usb 2-1: Product: syz [ 133.583539][ T45] usb 2-1: Manufacturer: syz [ 133.588569][ T45] usb 2-1: SerialNumber: syz [ 133.596912][ T45] usb 2-1: config 0 descriptor?? [ 133.604727][ T3905] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 133.612230][ T3905] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 133.823048][ T3905] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1024 sclass=netlink_xfrm_socket pid=3905 comm=syz.1.1300 [ 133.836641][ T3905] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 133.843943][ T3905] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 134.052981][ T45] asix 2-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 134.064466][ T45] asix 2-1:0.34: probe with driver asix failed with error -61 [ 134.064770][ T3907] FAULT_INJECTION: forcing a failure. [ 134.064770][ T3907] name fail_usercopy, interval 1, probability 100, space 0, times -1 [ 134.085953][ T3907] CPU: 0 UID: 0 PID: 3907 Comm: syz.3.1301 Not tainted syzkaller #0 92ad247b86212872588e4244b63285ac9b5a817e [ 134.085985][ T3907] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 134.085998][ T3907] Call Trace: [ 134.086006][ T3907] [ 134.086015][ T3907] __dump_stack+0x21/0x30 [ 134.086045][ T3907] dump_stack_lvl+0x140/0x1c0 [ 134.086070][ T3907] ? __cfi_dump_stack_lvl+0x10/0x10 [ 134.086092][ T3907] ? kernel_text_address+0xa9/0xe0 [ 134.086116][ T3907] ? unwind_get_return_address+0x51/0x90 [ 134.086139][ T3907] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 134.086162][ T3907] dump_stack+0x19/0x20 [ 134.086185][ T3907] should_fail_ex+0x3c2/0x510 [ 134.086211][ T3907] should_fail+0xf/0x20 [ 134.086231][ T3907] should_fail_usercopy+0x1e/0x30 [ 134.086254][ T3907] _copy_from_user+0x20/0xa0 [ 134.086277][ T3907] ___sys_recvmsg+0x174/0x590 [ 134.086302][ T3907] ? kstrtoull+0x13b/0x1e0 [ 134.086321][ T3907] ? __sys_recvmsg+0x260/0x260 [ 134.086350][ T3907] do_recvmmsg+0x328/0x790 [ 134.086376][ T3907] ? __sys_recvmmsg+0x2a0/0x2a0 [ 134.086402][ T3907] ? trace_buffer_unlock_commit_regs+0x14a/0x600 [ 134.086426][ T3907] ? trace_event_buffer_commit+0x256/0x8f0 [ 134.086448][ T3907] __x64_sys_recvmmsg+0x199/0x250 [ 134.086473][ T3907] ? __cfi___x64_sys_recvmmsg+0x10/0x10 [ 134.086498][ T3907] x64_sys_call+0x292c/0x2ee0 [ 134.086516][ T3907] do_syscall_64+0x57/0xf0 [ 134.086534][ T3907] ? clear_bhb_loop+0x50/0xa0 [ 134.086556][ T3907] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 134.086587][ T3907] RIP: 0033:0x7f69d559e159 [ 134.086606][ T3907] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 134.086621][ T3907] RSP: 002b:00007f69d64d0028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 134.086645][ T3907] RAX: ffffffffffffffda RBX: 00007f69d5825fa0 RCX: 00007f69d559e159 [ 134.086660][ T3907] RDX: 0000000000000007 RSI: 0000200000000fc0 RDI: 0000000000000003 [ 134.086674][ T3907] RBP: 00007f69d64d0090 R08: 0000000000000000 R09: 0000000000000000 [ 134.086688][ T3907] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 134.086700][ T3907] R13: 00007f69d5826038 R14: 00007f69d5825fa0 R15: 00007ffc7e03cd68 [ 134.086719][ T3907] [ 135.370071][ T3920] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1304'. [ 135.586894][ T3935] FAULT_INJECTION: forcing a failure. [ 135.586894][ T3935] name failslab, interval 1, probability 0, space 0, times 0 [ 135.623938][ T3935] CPU: 0 UID: 0 PID: 3935 Comm: syz.3.1310 Not tainted syzkaller #0 92ad247b86212872588e4244b63285ac9b5a817e [ 135.623973][ T3935] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 135.623987][ T3935] Call Trace: [ 135.623995][ T3935] [ 135.624005][ T3935] __dump_stack+0x21/0x30 [ 135.624035][ T3935] dump_stack_lvl+0x140/0x1c0 [ 135.624060][ T3935] ? __cfi_dump_stack_lvl+0x10/0x10 [ 135.624085][ T3935] ? check_stack_object+0x81/0x150 [ 135.624105][ T3935] ? __virt_addr_valid+0x2a1/0x370 [ 135.624129][ T3935] dump_stack+0x19/0x20 [ 135.624152][ T3935] should_fail_ex+0x3c2/0x510 [ 135.624175][ T3935] should_failslab+0xac/0x100 [ 135.624198][ T3935] __kmalloc_cache_noprof+0x41/0x470 [ 135.624235][ T3935] ? memdup_user+0xb1/0x170 [ 135.624254][ T3935] ? __se_sys_mount+0x15f/0x480 [ 135.624276][ T3935] __se_sys_mount+0x15f/0x480 [ 135.624296][ T3935] ? __x64_sys_mount+0xf0/0xf0 [ 135.624317][ T3935] ? trace_event_raw_event_sys_enter+0xf5/0x130 [ 135.624344][ T3935] __x64_sys_mount+0xc3/0xf0 [ 135.624364][ T3935] x64_sys_call+0x2021/0x2ee0 [ 135.624382][ T3935] do_syscall_64+0x57/0xf0 [ 135.624401][ T3935] ? clear_bhb_loop+0x50/0xa0 [ 135.624422][ T3935] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 135.624445][ T3935] RIP: 0033:0x7f69d559e159 [ 135.624462][ T3935] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 135.624480][ T3935] RSP: 002b:00007f69d64d0028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 135.624503][ T3935] RAX: ffffffffffffffda RBX: 00007f69d5825fa0 RCX: 00007f69d559e159 [ 135.624519][ T3935] RDX: 0000200000000040 RSI: 00002000000001c0 RDI: 0000000000000000 [ 135.624534][ T3935] RBP: 00007f69d64d0090 R08: 0000200000000400 R09: 0000000000000000 [ 135.624548][ T3935] R10: 0000000000010000 R11: 0000000000000246 R12: 0000000000000001 [ 135.624561][ T3935] R13: 00007f69d5826038 R14: 00007f69d5825fa0 R15: 00007ffc7e03cd68 [ 135.624578][ T3935] [ 136.016824][ T3945] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1314'. [ 136.118336][ T3956] FAULT_INJECTION: forcing a failure. [ 136.118336][ T3956] name fail_usercopy, interval 1, probability 100, space 0, times -1 [ 136.132008][ T3956] CPU: 1 UID: 0 PID: 3956 Comm: syz.3.1319 Not tainted syzkaller #0 92ad247b86212872588e4244b63285ac9b5a817e [ 136.132039][ T3956] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 136.132053][ T3956] Call Trace: [ 136.132061][ T3956] [ 136.132069][ T3956] __dump_stack+0x21/0x30 [ 136.132096][ T3956] dump_stack_lvl+0x140/0x1c0 [ 136.132118][ T3956] ? __cfi_dump_stack_lvl+0x10/0x10 [ 136.132142][ T3956] ? check_stack_object+0x138/0x150 [ 136.132163][ T3956] dump_stack+0x19/0x20 [ 136.132185][ T3956] should_fail_ex+0x3c2/0x510 [ 136.132207][ T3956] should_fail+0xf/0x20 [ 136.132227][ T3956] should_fail_usercopy+0x1e/0x30 [ 136.132250][ T3956] _copy_to_user+0x24/0xa0 [ 136.132275][ T3956] simple_read_from_buffer+0xed/0x160 [ 136.132302][ T3956] proc_fail_nth_read+0x1aa/0x220 [ 136.132328][ T3956] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 136.132353][ T3956] ? bpf_lsm_file_permission+0xd/0x20 [ 136.132376][ T3956] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 136.132400][ T3956] vfs_read+0x28b/0xc70 [ 136.132420][ T3956] ? rb_commit+0x753/0x7b0 [ 136.132441][ T3956] ? __cfi_vfs_read+0x10/0x10 [ 136.132461][ T3956] ? __kasan_check_write+0x18/0x20 [ 136.132480][ T3956] ? mutex_lock+0x97/0x1d0 [ 136.132501][ T3956] ? __cfi_mutex_lock+0x10/0x10 [ 136.132524][ T3956] ksys_read+0x145/0x260 [ 136.132545][ T3956] ? __cfi_ksys_read+0x10/0x10 [ 136.132565][ T3956] ? trace_event_raw_event_sys_enter+0xf5/0x130 [ 136.132592][ T3956] __x64_sys_read+0x7f/0x90 [ 136.132612][ T3956] x64_sys_call+0x2638/0x2ee0 [ 136.132630][ T3956] do_syscall_64+0x57/0xf0 [ 136.132648][ T3956] ? clear_bhb_loop+0x50/0xa0 [ 136.132671][ T3956] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 136.132691][ T3956] RIP: 0033:0x7f69d555e98e [ 136.132707][ T3956] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 136.132723][ T3956] RSP: 002b:00007f69d64cffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 136.132746][ T3956] RAX: ffffffffffffffda RBX: 00007f69d64d06c0 RCX: 00007f69d555e98e [ 136.132763][ T3956] RDX: 000000000000000f RSI: 00007f69d64d00a0 RDI: 0000000000000006 [ 136.132776][ T3956] RBP: 00007f69d64d0090 R08: 0000000000000000 R09: 0000000000000000 [ 136.132790][ T3956] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 136.132803][ T3956] R13: 00007f69d5826038 R14: 00007f69d5825fa0 R15: 00007ffc7e03cd68 [ 136.132820][ T3956] [ 136.853547][ T369] usb 2-1: USB disconnect, device number 40 [ 136.927102][ T3977] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1327'. [ 137.075419][ T3991] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=8192 sclass=netlink_xfrm_socket pid=3991 comm=syz.0.1332 [ 137.125277][ T3991] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=8192 sclass=netlink_xfrm_socket pid=3991 comm=syz.0.1332 [ 137.142758][ T36] audit: type=1400 audit(145.128:562): avc: denied { execute_no_trans } for pid=3985 comm="syz.1.1330" path="/246/file0" dev="tmpfs" ino=1344 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 137.167172][ T3991] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=8192 sclass=netlink_xfrm_socket pid=3991 comm=syz.0.1332 [ 137.197103][ T3991] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=8192 sclass=netlink_xfrm_socket pid=3991 comm=syz.0.1332 [ 137.224072][ T3991] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=8192 sclass=netlink_xfrm_socket pid=3991 comm=syz.0.1332 [ 137.237530][ T3991] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=8192 sclass=netlink_xfrm_socket pid=3991 comm=syz.0.1332 [ 137.250570][ T3991] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=8192 sclass=netlink_xfrm_socket pid=3991 comm=syz.0.1332 [ 137.263623][ T3991] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=8192 sclass=netlink_xfrm_socket pid=3991 comm=syz.0.1332 [ 137.276689][ T3991] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=8192 sclass=netlink_xfrm_socket pid=3991 comm=syz.0.1332 [ 138.134002][ T4004] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1336'. [ 138.413473][ T4019] FAULT_INJECTION: forcing a failure. [ 138.413473][ T4019] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 138.426874][ T4019] CPU: 1 UID: 0 PID: 4019 Comm: syz.3.1342 Not tainted syzkaller #0 92ad247b86212872588e4244b63285ac9b5a817e [ 138.426905][ T4019] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 138.426919][ T4019] Call Trace: [ 138.426927][ T4019] [ 138.426936][ T4019] __dump_stack+0x21/0x30 [ 138.426965][ T4019] dump_stack_lvl+0x140/0x1c0 [ 138.426990][ T4019] ? __cfi_dump_stack_lvl+0x10/0x10 [ 138.427014][ T4019] ? __kasan_check_read+0x15/0x20 [ 138.427040][ T4019] ? __rb_reserve_next+0x794/0xd90 [ 138.427066][ T4019] dump_stack+0x19/0x20 [ 138.427089][ T4019] should_fail_ex+0x3c2/0x510 [ 138.427111][ T4019] should_fail_alloc_page+0xec/0x110 [ 138.427134][ T4019] __alloc_pages_noprof+0x1c0/0x7e0 [ 138.427160][ T4019] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 138.427187][ T4019] ? __kasan_check_read+0x15/0x20 [ 138.427206][ T4019] ? ring_buffer_unlock_commit+0x473/0x5e0 [ 138.427230][ T4019] get_free_pages_noprof+0x14/0x40 [ 138.427254][ T4019] kasan_populate_vmalloc_pte+0x4c/0x170 [ 138.427275][ T4019] __apply_to_page_range+0x7c2/0xd00 [ 138.427299][ T4019] ? __cfi_kasan_populate_vmalloc_pte+0x10/0x10 [ 138.427321][ T4019] ? apply_to_page_range+0x60/0x60 [ 138.427343][ T4019] ? __cfi_kasan_populate_vmalloc_pte+0x10/0x10 [ 138.427365][ T4019] apply_to_page_range+0x3f/0x60 [ 138.427386][ T4019] kasan_populate_vmalloc+0x64/0x80 [ 138.427406][ T4019] alloc_vmap_area+0x1e8e/0x26f0 [ 138.427433][ T4019] ? trace_event_raw_event_kmalloc+0xac/0xf0 [ 138.427460][ T4019] ? kasan_save_alloc_info+0x3a/0x50 [ 138.427480][ T4019] ? vm_map_ram+0xdd0/0xdd0 [ 138.427504][ T4019] ? __kmalloc_cache_node_noprof+0x225/0x430 [ 138.427526][ T4019] ? __get_vm_area_node+0x150/0x390 [ 138.427551][ T4019] __get_vm_area_node+0x1f8/0x390 [ 138.427577][ T4019] __vmalloc_node_range_noprof+0x340/0x1300 [ 138.427604][ T4019] ? copy_process+0x57c/0x3350 [ 138.427625][ T4019] ? trace_event_buffer_lock_reserve+0x115/0x730 [ 138.427660][ T4019] ? __cfi___vmalloc_node_range_noprof+0x10/0x10 [ 138.427688][ T4019] ? arch_dup_task_struct+0x5b/0xe0 [ 138.427714][ T4019] ? __asan_memcpy+0x5a/0x80 [ 138.427734][ T4019] dup_task_struct+0x5d6/0xd80 [ 138.427756][ T4019] ? copy_process+0x57c/0x3350 [ 138.427779][ T4019] ? _raw_spin_lock_irq+0x93/0x120 [ 138.427798][ T4019] ? copy_process+0x3350/0x3350 [ 138.427820][ T4019] ? __kasan_check_write+0x18/0x20 [ 138.427840][ T4019] copy_process+0x57c/0x3350 [ 138.427863][ T4019] ? kvm_sched_clock_read+0x15/0x30 [ 138.427887][ T4019] ? __kasan_check_read+0x15/0x20 [ 138.427929][ T4019] ? __rb_reserve_next+0x794/0xd90 [ 138.427954][ T4019] ? __cfi_copy_process+0x10/0x10 [ 138.427978][ T4019] kernel_clone+0x233/0x810 [ 138.428002][ T4019] ? rb_commit+0x753/0x7b0 [ 138.428022][ T4019] ? __cfi_kernel_clone+0x10/0x10 [ 138.428045][ T4019] ? __kasan_check_read+0x15/0x20 [ 138.428065][ T4019] __x64_sys_clone+0x1b7/0x230 [ 138.428088][ T4019] ? trace_buffer_unlock_commit_regs+0x14a/0x600 [ 138.428110][ T4019] ? __cfi___x64_sys_clone+0x10/0x10 [ 138.428135][ T4019] ? trace_event_raw_event_sys_enter+0xf5/0x130 [ 138.428163][ T4019] x64_sys_call+0x2b3c/0x2ee0 [ 138.428182][ T4019] do_syscall_64+0x57/0xf0 [ 138.428200][ T4019] ? clear_bhb_loop+0x50/0xa0 [ 138.428223][ T4019] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 138.428244][ T4019] RIP: 0033:0x7f69d559e159 [ 138.428262][ T4019] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 138.428280][ T4019] RSP: 002b:00007f69d64cffd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 138.428303][ T4019] RAX: ffffffffffffffda RBX: 00007f69d5825fa0 RCX: 00007f69d559e159 [ 138.428318][ T4019] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000011 [ 138.428332][ T4019] RBP: 00007f69d64d0090 R08: 0000000000000000 R09: 0000000000000000 [ 138.428346][ T4019] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000001 [ 138.428359][ T4019] R13: 00007f69d5826038 R14: 00007f69d5825fa0 R15: 00007ffc7e03cd68 [ 138.428376][ T4019] [ 138.428401][ T4019] syz.3.1342: vmalloc error: size 32768, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null) [ 138.435902][ T369] usb 2-1: new full-speed USB device number 41 using dummy_hcd [ 138.442710][ T4019] ,cpuset= [ 138.632894][ T369] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 138.636418][ T4019] syz3 [ 138.642447][ T369] usb 2-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=33.f9 [ 138.648950][ T4019] ,mems_allowed=0 [ 138.660544][ T369] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.670531][ T4019] [ 138.692300][ T369] usb 2-1: Product: syz [ 138.695449][ T4019] CPU: 1 UID: 0 PID: 4019 Comm: syz.3.1342 Not tainted syzkaller #0 92ad247b86212872588e4244b63285ac9b5a817e [ 138.695475][ T4019] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 138.695487][ T4019] Call Trace: [ 138.695495][ T4019] [ 138.695503][ T4019] __dump_stack+0x21/0x30 [ 138.695530][ T4019] dump_stack_lvl+0x140/0x1c0 [ 138.695554][ T4019] ? __cfi_dump_stack_lvl+0x10/0x10 [ 138.695577][ T4019] dump_stack+0x19/0x20 [ 138.695599][ T4019] warn_alloc+0x1e7/0x2c0 [ 138.695622][ T4019] ? kasan_save_track+0x3e/0x80 [ 138.695642][ T4019] ? __cfi_warn_alloc+0x10/0x10 [ 138.695664][ T4019] ? __get_vm_area_node+0x211/0x390 [ 138.695689][ T4019] ? __get_vm_area_node+0x211/0x390 [ 138.695713][ T4019] __vmalloc_node_range_noprof+0x365/0x1300 [ 138.695738][ T4019] ? trace_event_buffer_lock_reserve+0x115/0x730 [ 138.695762][ T4019] ? __cfi___vmalloc_node_range_noprof+0x10/0x10 [ 138.695792][ T4019] ? arch_dup_task_struct+0x5b/0xe0 [ 138.695816][ T4019] ? __asan_memcpy+0x5a/0x80 [ 138.695835][ T4019] dup_task_struct+0x5d6/0xd80 [ 138.695856][ T4019] ? copy_process+0x57c/0x3350 [ 138.695877][ T4019] ? _raw_spin_lock_irq+0x93/0x120 [ 138.695896][ T4019] ? copy_process+0x3350/0x3350 [ 138.695916][ T4019] ? __kasan_check_write+0x18/0x20 [ 138.695935][ T4019] copy_process+0x57c/0x3350 [ 138.695956][ T4019] ? kvm_sched_clock_read+0x15/0x30 [ 138.695979][ T4019] ? __kasan_check_read+0x15/0x20 [ 138.695996][ T4019] ? __rb_reserve_next+0x794/0xd90 [ 138.696019][ T4019] ? __cfi_copy_process+0x10/0x10 [ 138.696041][ T4019] kernel_clone+0x233/0x810 [ 138.696061][ T4019] ? rb_commit+0x753/0x7b0 [ 138.696080][ T4019] ? __cfi_kernel_clone+0x10/0x10 [ 138.696102][ T4019] ? __kasan_check_read+0x15/0x20 [ 138.696121][ T4019] __x64_sys_clone+0x1b7/0x230 [ 138.696144][ T4019] ? trace_buffer_unlock_commit_regs+0x14a/0x600 [ 138.696165][ T4019] ? __cfi___x64_sys_clone+0x10/0x10 [ 138.696188][ T4019] ? trace_event_raw_event_sys_enter+0xf5/0x130 [ 138.696214][ T4019] x64_sys_call+0x2b3c/0x2ee0 [ 138.696238][ T4019] do_syscall_64+0x57/0xf0 [ 138.696255][ T4019] ? clear_bhb_loop+0x50/0xa0 [ 138.696276][ T4019] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 138.696296][ T4019] RIP: 0033:0x7f69d559e159 [ 138.696313][ T4019] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 138.696332][ T4019] RSP: 002b:00007f69d64cffd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 138.696355][ T4019] RAX: ffffffffffffffda RBX: 00007f69d5825fa0 RCX: 00007f69d559e159 [ 138.696369][ T4019] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000011 [ 138.696381][ T4019] RBP: 00007f69d64d0090 R08: 0000000000000000 R09: 0000000000000000 [ 138.696394][ T4019] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000001 [ 138.696407][ T4019] R13: 00007f69d5826038 R14: 00007f69d5825fa0 R15: 00007ffc7e03cd68 [ 138.696423][ T4019] [ 138.696858][ T4019] Mem-Info: [ 138.712540][ T369] usb 2-1: Manufacturer: syz [ 138.719207][ T4019] active_anon:8723 inactive_anon:41 isolated_anon:0 [ 138.719207][ T4019] active_file:9973 inactive_file:12432 isolated_file:0 [ 138.719207][ T4019] unevictable:0 dirty:260 writeback:0 [ 138.719207][ T4019] slab_reclaimable:4271 slab_unreclaimable:80810 [ 138.719207][ T4019] mapped:26195 shmem:168 pagetables:2053 [ 138.719207][ T4019] sec_pagetables:0 bounce:0 [ 138.719207][ T4019] kernel_misc_reclaimable:0 [ 138.719207][ T4019] free:1510956 free_pcp:1414 free_cma:0 [ 138.739454][ T369] usb 2-1: SerialNumber: syz [ 138.743100][ T4019] Node 0 active_anon:34892kB inactive_anon:164kB active_file:39892kB inactive_file:49728kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:104780kB dirty:1040kB writeback:0kB shmem:672kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:7604kB pagetables:8212kB sec_pagetables:0kB all_unreclaimable? no [ 138.766340][ T369] usb 2-1: config 0 descriptor?? [ 138.770164][ T4019] DMA32 free:2959660kB boost:0kB min:4464kB low:7424kB high:10384kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3145324kB managed:2963372kB mlocked:0kB bounce:0kB free_pcp:3712kB local_pcp:0kB free_cma:0kB [ 139.004688][ T369] usb 2-1: USB disconnect, device number 41 [ 139.036707][ T4019] lowmem_reserve[]: 0 3921 3921 [ 139.308645][ T4019] Normal free:3083360kB boost:0kB min:6048kB low:10060kB high:14072kB reserved_highatomic:0KB free_highatomic:0KB active_anon:34864kB inactive_anon:164kB active_file:39956kB inactive_file:50740kB unevictable:0kB writepending:1072kB present:5242880kB managed:4015864kB mlocked:0kB bounce:0kB free_pcp:1192kB local_pcp:704kB free_cma:0kB [ 139.342356][ T4019] lowmem_reserve[]: 0 0 0 [ 139.347746][ T4019] DMA32: 5*4kB (M) 3*8kB (M) 4*16kB (M) 6*32kB (M) 4*64kB (M) 4*128kB (M) 5*256kB (M) 4*512kB (M) 4*1024kB (UM) 3*2048kB (M) 719*4096kB (M) = 2959660kB [ 139.365585][ T4019] Normal: 191*4kB (ME) 1265*8kB (UME) 975*16kB (UME) 695*32kB (UME) 289*64kB (UME) 64*128kB (UME) 58*256kB (UME) 32*512kB (UME) 22*1024kB (M) 12*2048kB (ME) 715*4096kB (UM) = 3082388kB [ 139.385144][ T4019] 22895 total pagecache pages [ 139.390063][ T4019] 46 pages in swap cache [ 139.394602][ T4019] Free swap = 112972kB [ 139.394628][ T4033] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1347'. [ 139.398911][ T4019] Total swap = 124996kB [ 139.412057][ T4019] 2097051 pages RAM [ 139.415892][ T4019] 0 pages HighMem/MovableOnly [ 139.420559][ T4019] 352242 pages reserved [ 139.424887][ T4019] 0 pages cma reserved [ 139.437772][ T4019] Memory allocations: [ 139.441804][ T4019] 0 B 0 init/main.c:1477 func:do_initcalls [ 139.451189][ T4019] 0 B 0 init/do_mounts.c:186 func:mount_root_generic [ 139.460461][ T4019] 0 B 0 init/do_mounts.c:158 func:do_mount_root [ 139.468359][ T4019] 0 B 0 init/do_mounts.c:352 func:mount_nodev_root [ 139.476519][ T4019] 0 B 0 init/do_mounts_rd.c:241 func:rd_load_image [ 139.484665][ T4019] 0 B 0 init/do_mounts_rd.c:72 func:identify_ramdisk_image [ 139.493581][ T4019] 0 B 0 init/initramfs.c:507 func:unpack_to_rootfs [ 139.501991][ T4019] 0 B 0 init/initramfs.c:508 func:unpack_to_rootfs [ 139.510329][ T4019] 0 B 0 init/initramfs.c:509 func:unpack_to_rootfs [ 139.523719][ T4019] 0 B 0 init/initramfs.c:101 func:find_link [ 139.663283][ T36] audit: type=1326 audit(147.648:563): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4049 comm="syz.0.1355" exe="/root/ci2-android-6-12-rust/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f0e0e19e159 code=0x0 [ 139.711026][ T4052] netlink: 'syz.3.1356': attribute type 27 has an invalid length. [ 139.835899][ T64] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 139.985966][ T64] usb 2-1: Using ep0 maxpacket: 16 [ 139.992908][ T64] usb 2-1: config 0 has an invalid interface number: 34 but max is 0 [ 140.001595][ T64] usb 2-1: config 0 has no interface number 0 [ 140.008443][ T64] usb 2-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 140.018950][ T64] usb 2-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 140.031634][ T64] usb 2-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 140.041209][ T64] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 140.049598][ T64] usb 2-1: Product: syz [ 140.054032][ T64] usb 2-1: Manufacturer: syz [ 140.059066][ T64] usb 2-1: SerialNumber: syz [ 140.067661][ T64] usb 2-1: config 0 descriptor?? [ 140.073259][ T4043] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 140.081538][ T4043] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 140.292072][ T4043] selinux_netlink_send: 25 callbacks suppressed [ 140.292097][ T4043] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1024 sclass=netlink_xfrm_socket pid=4043 comm=syz.1.1352 [ 140.313201][ T4043] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 140.321111][ T4043] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 140.530753][ T64] asix 2-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 140.546471][ T64] asix 2-1:0.34: probe with driver asix failed with error -61 [ 140.631930][ T2007] Bluetooth: hci0: Frame reassembly failed (-84) [ 142.706034][ T53] Bluetooth: hci0: command 0x1003 tx timeout [ 142.712215][ T548] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 142.822194][ T9] usb 2-1: USB disconnect, device number 42 [ 142.858552][ T4080] netlink: 'syz.1.1365': attribute type 27 has an invalid length. [ 143.327941][ T4092] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 143.909818][ T4106] netlink: 'syz.0.1374': attribute type 27 has an invalid length. [ 143.940825][ T2007] bridge0: port 2(bridge_slave_1) entered blocking state [ 143.947959][ T2007] bridge0: port 2(bridge_slave_1) entered forwarding state [ 144.006332][ T4109] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=768 sclass=netlink_xfrm_socket pid=4109 comm=syz.0.1375 [ 144.065961][ T9] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 144.225868][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 144.239200][ T9] usb 4-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 144.255309][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 144.272535][ T9] usb 4-1: Product: syz [ 144.281409][ T9] usb 4-1: Manufacturer: syz [ 144.290552][ T9] usb 4-1: SerialNumber: syz [ 144.719142][ T4127] netlink: 'syz.0.1383': attribute type 27 has an invalid length. [ 144.965885][ T315] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 145.112017][ T4104] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 145.131442][ T4104] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 145.140464][ T315] usb 2-1: Using ep0 maxpacket: 16 [ 145.163287][ T315] usb 2-1: config 0 has an invalid interface number: 34 but max is 0 [ 145.181679][ T315] usb 2-1: config 0 has no interface number 0 [ 145.191786][ T315] usb 2-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 145.221447][ T315] usb 2-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 145.235376][ T9] usb 4-1: 1:1: cannot get freq (v2/v3): err -71 [ 145.240472][ T315] usb 2-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 145.254090][ T9] usb 4-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 145.255833][ T315] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 145.271150][ T9] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 145.285837][ T315] usb 2-1: Product: syz [ 145.290013][ T315] usb 2-1: Manufacturer: syz [ 145.292412][ T9] snd-usb-audio 4-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 145.305389][ T315] usb 2-1: SerialNumber: syz [ 145.315873][ T315] usb 2-1: config 0 descriptor?? [ 145.325119][ T4128] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 145.335766][ T4128] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 145.359276][ T9] snd-usb-audio 4-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 145.388917][ T1393] udevd[1393]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.2/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 145.405111][ T9] usb 4-1: USB disconnect, device number 41 [ 145.559977][ T4128] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1024 sclass=netlink_xfrm_socket pid=4128 comm=syz.1.1384 [ 145.573298][ T4128] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 145.580545][ T4128] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 145.771670][ T4137] bridge0: entered allmulticast mode [ 145.789616][ T315] asix 2-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 145.803634][ T315] asix 2-1:0.34: probe with driver asix failed with error -61 [ 145.978699][ T4145] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1391'. [ 146.037001][ T4149] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1393'. [ 146.049175][ T4151] netlink: 'syz.3.1394': attribute type 27 has an invalid length. [ 146.075857][ T36] audit: type=1400 audit(154.058:564): avc: denied { accept } for pid=4148 comm="syz.0.1393" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 146.548340][ T4172] syz.3.1400 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 146.565878][ T4172] CPU: 1 UID: 0 PID: 4172 Comm: syz.3.1400 Not tainted syzkaller #0 92ad247b86212872588e4244b63285ac9b5a817e [ 146.565918][ T4172] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 146.565933][ T4172] Call Trace: [ 146.565942][ T4172] [ 146.565952][ T4172] __dump_stack+0x21/0x30 [ 146.565987][ T4172] dump_stack_lvl+0x140/0x1c0 [ 146.566015][ T4172] ? __cfi_dump_stack_lvl+0x10/0x10 [ 146.566040][ T4172] ? ___ratelimit+0x41c/0x5c0 [ 146.566063][ T4172] ? __kasan_check_write+0x18/0x20 [ 146.566084][ T4172] dump_stack+0x19/0x20 [ 146.566111][ T4172] dump_header+0xd9/0x460 [ 146.566138][ T4172] oom_kill_process+0x35d/0x640 [ 146.566164][ T4172] out_of_memory+0x5d1/0xa20 [ 146.566187][ T4172] ? __cfi_out_of_memory+0x10/0x10 [ 146.566210][ T4172] ? mutex_lock_killable+0x97/0x1d0 [ 146.566233][ T4172] ? __cfi_mutex_lock_killable+0x10/0x10 [ 146.566259][ T4172] mem_cgroup_out_of_memory+0x2c5/0x390 [ 146.566282][ T4172] ? css_next_descendant_pre+0x1ec/0x210 [ 146.566306][ T4172] ? __kasan_check_write+0x18/0x20 [ 146.566326][ T4172] ? drain_obj_stock+0xec0/0xec0 [ 146.566349][ T4172] ? memcg1_oom_prepare+0x2c5/0x3a0 [ 146.566370][ T4172] try_charge_memcg+0x925/0xe10 [ 146.566398][ T4172] ? __cfi_try_charge_memcg+0x10/0x10 [ 146.566428][ T4172] ? __alloc_pages_noprof+0x793/0x7e0 [ 146.566454][ T4172] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 146.566484][ T4172] __mem_cgroup_charge+0xfc/0x420 [ 146.566505][ T4172] ? __cfi___mem_cgroup_charge+0x10/0x10 [ 146.566526][ T4172] ? folio_add_lru+0x116/0x400 [ 146.566550][ T4172] ? __cfi_folio_add_lru+0x10/0x10 [ 146.566575][ T4172] folio_prealloc+0x67/0x220 [ 146.566599][ T4172] do_pte_missing+0x16af/0x4440 [ 146.566625][ T4172] ? trace_event_buffer_commit+0x256/0x8f0 [ 146.566648][ T4172] ? pte_marker_clear+0x1b0/0x1b0 [ 146.566671][ T4172] ? cgroup_rstat_updated+0x144/0x800 [ 146.566696][ T4172] ? pte_offset_map_rw_nolock+0x236/0x2c0 [ 146.566717][ T4172] handle_mm_fault+0x1189/0x1ba0 [ 146.566740][ T4172] ? __kasan_check_write+0x18/0x20 [ 146.566763][ T4172] ? __cfi_handle_mm_fault+0x10/0x10 [ 146.566786][ T4172] ? follow_page_pte+0x4b2/0xba0 [ 146.566816][ T4172] ? gup_must_unshare+0x1e0/0x1e0 [ 146.566851][ T4172] ? vma_is_secretmem+0x11/0x50 [ 146.566879][ T4172] ? check_vma_flags+0x36d/0x3a0 [ 146.566906][ T4172] __get_user_pages+0x114b/0x22d0 [ 146.566931][ T4172] ? trace_event_raw_event_mmap_lock_acquire_returned+0x19d/0x320 [ 146.566966][ T4172] ? populate_vma_page_range+0x220/0x220 [ 146.566991][ T4172] ? __mmap_lock_do_trace_acquire_returned+0x23a/0x250 [ 146.567022][ T4172] ? __cfi___mmap_lock_do_trace_acquire_returned+0x10/0x10 [ 146.567053][ T4172] __gup_longterm_locked+0x3c8/0x1570 [ 146.567083][ T4172] pin_user_pages+0x101/0x160 [ 146.567110][ T4172] xdp_umem_pin_pages+0x133/0x410 [ 146.567134][ T4172] xdp_umem_create+0x60f/0x950 [ 146.567157][ T4172] xsk_setsockopt+0x672/0x760 [ 146.567178][ T4172] ? __cfi_xsk_setsockopt+0x10/0x10 [ 146.567201][ T4172] ? bpf_lsm_socket_setsockopt+0xd/0x20 [ 146.567225][ T4172] ? security_socket_setsockopt+0x3d/0x100 [ 146.567253][ T4172] ? __cfi_xsk_setsockopt+0x10/0x10 [ 146.567273][ T4172] do_sock_setsockopt+0x27f/0x410 [ 146.567300][ T4172] ? trace_buffer_unlock_commit_regs+0x14a/0x600 [ 146.567324][ T4172] ? __cfi_do_sock_setsockopt+0x10/0x10 [ 146.567351][ T4172] ? __fget_files+0x2bc/0x330 [ 146.567377][ T4172] __x64_sys_setsockopt+0x18c/0x220 [ 146.567404][ T4172] x64_sys_call+0x2adc/0x2ee0 [ 146.567424][ T4172] do_syscall_64+0x57/0xf0 [ 146.567442][ T4172] ? clear_bhb_loop+0x50/0xa0 [ 146.567467][ T4172] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 146.567492][ T4172] RIP: 0033:0x7f69d559e159 [ 146.567512][ T4172] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 146.567532][ T4172] RSP: 002b:00007f69d64d0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 146.567558][ T4172] RAX: ffffffffffffffda RBX: 00007f69d5825fa0 RCX: 00007f69d559e159 [ 146.567575][ T4172] RDX: 0000000000000004 RSI: 000000000000011b RDI: 0000000000000005 [ 146.567589][ T4172] RBP: 00007f69d563503b R08: 0000000000000020 R09: 0000000000000000 [ 146.567605][ T4172] R10: 0000200000000340 R11: 0000000000000246 R12: 0000000000000000 [ 146.567620][ T4172] R13: 00007f69d5826038 R14: 00007f69d5825fa0 R15: 00007ffc7e03cd68 [ 146.567640][ T4172] [ 146.571045][ T4172] memory: usage 96kB, limit 96kB, failcnt 3057 [ 147.005896][ T4172] memory+swap: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 147.019464][ T4172] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 147.036852][ T4172] Memory cgroup stats for /syz3/test: [ 147.037016][ T4172] cache 0 [ 147.052185][ T4172] rss 98304 [ 147.058836][ T4172] rss_huge 0 [ 147.065532][ T4172] shmem 0 [ 147.073281][ T4172] mapped_file 0 [ 147.081373][ T4172] dirty 0 [ 147.089078][ T4172] writeback 0 [ 147.095867][ T4172] workingset_refault_anon 0 [ 147.105899][ T4172] workingset_refault_file 0 [ 147.110496][ T4172] swap 0 [ 147.113353][ T4172] swapcached 0 [ 147.129515][ T4172] pgpgin 2901 [ 147.133531][ T4172] pgpgout 2877 [ 147.137255][ T4172] pgfault 2907 [ 147.140961][ T4172] pgmajfault 0 [ 147.144764][ T4172] inactive_anon 98304 [ 147.149154][ T4172] active_anon 0 [ 147.152752][ T4172] inactive_file 0 [ 147.157996][ T4172] active_file 0 [ 147.161670][ T4172] unevictable 0 [ 147.175886][ T4172] hierarchical_memory_limit 98304 [ 147.181262][ T4172] hierarchical_memsw_limit 9223372036854771712 [ 147.188119][ T4172] total_cache 0 [ 147.191880][ T4172] total_rss 98304 [ 147.196018][ T4172] total_rss_huge 0 [ 147.200589][ T4177] overlayfs: failed to clone lowerpath [ 147.206198][ T4172] total_shmem 0 [ 147.209772][ T4172] total_mapped_file 0 [ 147.213900][ T4172] total_dirty 0 [ 147.218343][ T4172] total_writeback 0 [ 147.222279][ T4172] total_workingset_refault_anon 0 [ 147.227756][ T4172] total_workingset_refault_file 0 [ 147.233026][ T4172] total_swap 0 [ 147.234125][ T4177] EXT4-fs warning (device sda1): ext4_dirblock_csum_verify:406: inode #274: comm syz.0.1402: No space for directory leaf checksum. Please run e2fsck -D. [ 147.236710][ T4172] total_swapcached 0 [ 147.256221][ T4172] total_pgpgin 2901 [ 147.260160][ T4172] total_pgpgout 2877 [ 147.264157][ T4172] total_pgfault 2907 [ 147.268531][ T4172] total_pgmajfault 0 [ 147.272289][ T4177] EXT4-fs error (device sda1): __ext4_find_entry:1658: inode #274: comm syz.0.1402: checksumming directory block 0 [ 147.272522][ T4172] total_inactive_anon 98304 [ 147.294450][ T4177] platform regulatory.0: loading /lib/firmware/updates/syzkaller/regulatory.db failed with error -74 [ 147.305629][ T4172] total_active_anon 0 [ 147.317559][ T4172] total_inactive_file 0 [ 147.326015][ T4177] EXT4-fs warning (device sda1): ext4_dirblock_csum_verify:406: inode #274: comm syz.0.1402: No space for directory leaf checksum. Please run e2fsck -D. [ 147.327379][ T4172] total_active_file 0 [ 147.351939][ T4177] EXT4-fs error (device sda1): __ext4_find_entry:1658: inode #274: comm syz.0.1402: checksumming directory block 0 [ 147.361439][ T4172] total_unevictable 0 [ 147.375882][ T4172] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0,oom_memcg=/syz3/test,task_memcg=/syz3/test,task=syz.3.1400,pid=4171,uid=0 [ 147.386492][ T4177] platform regulatory.0: loading /lib/firmware/updates/regulatory.db failed with error -74 [ 147.406273][ T4172] Memory cgroup out of memory: Killed process 4171 (syz.3.1400) total-vm:94104kB, anon-rss:1368kB, file-rss:22412kB, shmem-rss:0kB, UID:0 pgtables:140kB oom_score_adj:1000 [ 147.415910][ T4177] EXT4-fs warning (device sda1): ext4_dirblock_csum_verify:406: inode #274: comm syz.0.1402: No space for directory leaf checksum. Please run e2fsck -D. [ 147.465965][ T4177] EXT4-fs error (device sda1): __ext4_find_entry:1658: inode #274: comm syz.0.1402: checksumming directory block 0 [ 147.490036][ T4177] platform regulatory.0: loading /lib/firmware/syzkaller/regulatory.db failed with error -74 [ 147.509650][ T4177] EXT4-fs warning (device sda1): ext4_dirblock_csum_verify:406: inode #274: comm syz.0.1402: No space for directory leaf checksum. Please run e2fsck -D. [ 147.532760][ T4177] EXT4-fs error (device sda1): __ext4_find_entry:1658: inode #274: comm syz.0.1402: checksumming directory block 0 [ 147.556458][ T4177] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -74 [ 147.578313][ T4177] platform regulatory.0: Direct firmware load for regulatory.db failed with error -74 [ 147.721441][ T4198] FAULT_INJECTION: forcing a failure. [ 147.721441][ T4198] name fail_futex, interval 1, probability 0, space 0, times 0 [ 147.739550][ T4198] CPU: 0 UID: 0 PID: 4198 Comm: syz.3.1405 Not tainted syzkaller #0 92ad247b86212872588e4244b63285ac9b5a817e [ 147.739583][ T4198] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 147.739598][ T4198] Call Trace: [ 147.739607][ T4198] [ 147.739618][ T4198] __dump_stack+0x21/0x30 [ 147.739651][ T4198] dump_stack_lvl+0x140/0x1c0 [ 147.739679][ T4198] ? __cfi_dump_stack_lvl+0x10/0x10 [ 147.739708][ T4198] dump_stack+0x19/0x20 [ 147.739738][ T4198] should_fail_ex+0x3c2/0x510 [ 147.739763][ T4198] should_fail+0xf/0x20 [ 147.739786][ T4198] get_futex_key+0x178/0x940 [ 147.739812][ T4198] ? __cfi_get_futex_key+0x10/0x10 [ 147.739838][ T4198] futex_wake+0x150/0x950 [ 147.739857][ T4198] ? __kasan_check_read+0x15/0x20 [ 147.739881][ T4198] ? __rb_reserve_next+0x794/0xd90 [ 147.739909][ T4198] ? __cfi_futex_wake+0x10/0x10 [ 147.739946][ T4198] ? __kasan_check_read+0x15/0x20 [ 147.739967][ T4198] ? rb_commit+0x753/0x7b0 [ 147.739990][ T4198] do_futex+0x37d/0x510 [ 147.740018][ T4198] ? __cfi_do_futex+0x10/0x10 [ 147.740045][ T4198] __se_sys_futex+0x13c/0x320 [ 147.740071][ T4198] ? __x64_sys_futex+0x110/0x110 [ 147.740097][ T4198] ? trace_event_raw_event_sys_enter+0xf5/0x130 [ 147.740126][ T4198] __x64_sys_futex+0xe9/0x110 [ 147.740150][ T4198] x64_sys_call+0x227f/0x2ee0 [ 147.740169][ T4198] do_syscall_64+0x57/0xf0 [ 147.740187][ T4198] ? clear_bhb_loop+0x50/0xa0 [ 147.740213][ T4198] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 147.740236][ T4198] RIP: 0033:0x7f69d559e159 [ 147.740256][ T4198] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 147.740274][ T4198] RSP: 002b:00007f69d648e0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 147.740309][ T4198] RAX: ffffffffffffffda RBX: 00007f69d5826188 RCX: 00007f69d559e159 [ 147.740326][ T4198] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f69d582618c [ 147.740342][ T4198] RBP: 00007f69d5826180 R08: 4000000000000000 R09: 0000000000000000 [ 147.740358][ T4198] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 147.740374][ T4198] R13: 00007f69d5826218 R14: 00007ffc7e03cc80 R15: 00007ffc7e03cd68 [ 147.740392][ T4198] [ 147.780247][ T4195] bridge0: port 1(bridge_slave_0) entered blocking state [ 147.789003][ T369] usb 2-1: USB disconnect, device number 43 [ 147.806737][ T4205] VFS: file-max limit 0 reached [ 147.857167][ T4195] bridge0: port 1(bridge_slave_0) entered disabled state [ 148.026297][ T4195] bridge_slave_0: entered allmulticast mode [ 148.033249][ T4195] bridge_slave_0: entered promiscuous mode [ 148.044544][ T4214] EXT4-fs warning (device sda1): ext4_dirblock_csum_verify:406: inode #274: comm syz.1.1414: No space for directory leaf checksum. Please run e2fsck -D. [ 148.060154][ T1991] bridge_slave_1: left allmulticast mode [ 148.065939][ T1991] bridge_slave_1: left promiscuous mode [ 148.072762][ T1991] bridge0: port 2(bridge_slave_1) entered disabled state [ 148.080540][ T4214] EXT4-fs error (device sda1): __ext4_find_entry:1658: inode #274: comm syz.1.1414: checksumming directory block 0 [ 148.093086][ T1991] bridge_slave_0: left allmulticast mode [ 148.098819][ T1991] bridge_slave_0: left promiscuous mode [ 148.104442][ T1991] bridge0: port 1(bridge_slave_0) entered disabled state [ 148.111996][ T4214] platform regulatory.0: loading /lib/firmware/updates/syzkaller/regulatory.db failed with error -74 [ 148.134352][ T4214] EXT4-fs warning (device sda1): ext4_dirblock_csum_verify:406: inode #274: comm syz.1.1414: No space for directory leaf checksum. Please run e2fsck -D. [ 148.164494][ T4214] EXT4-fs error (device sda1): __ext4_find_entry:1658: inode #274: comm syz.1.1414: checksumming directory block 0 [ 148.178419][ T4214] platform regulatory.0: loading /lib/firmware/updates/regulatory.db failed with error -74 [ 148.188684][ T4214] EXT4-fs warning (device sda1): ext4_dirblock_csum_verify:406: inode #274: comm syz.1.1414: No space for directory leaf checksum. Please run e2fsck -D. [ 148.204123][ T4214] EXT4-fs error (device sda1): __ext4_find_entry:1658: inode #274: comm syz.1.1414: checksumming directory block 0 [ 148.216464][ T4214] platform regulatory.0: loading /lib/firmware/syzkaller/regulatory.db failed with error -74 [ 148.230683][ T4214] EXT4-fs warning (device sda1): ext4_dirblock_csum_verify:406: inode #274: comm syz.1.1414: No space for directory leaf checksum. Please run e2fsck -D. [ 148.246304][ T4214] EXT4-fs error (device sda1): __ext4_find_entry:1658: inode #274: comm syz.1.1414: checksumming directory block 0 [ 148.259654][ T4195] bridge0: port 2(bridge_slave_1) entered blocking state [ 148.259740][ T4214] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -74 [ 148.267965][ T4195] bridge0: port 2(bridge_slave_1) entered disabled state [ 148.276045][ T4214] platform regulatory.0: Direct firmware load for regulatory.db failed with error -74 [ 148.304208][ T4195] bridge_slave_1: entered allmulticast mode [ 148.318540][ T4195] bridge_slave_1: entered promiscuous mode [ 148.327815][ T1991] veth1_macvtap: left promiscuous mode [ 148.333314][ T1991] veth0_vlan: left promiscuous mode [ 148.431753][ T36] audit: type=1400 audit(156.418:565): avc: denied { watch_reads } for pid=4218 comm="syz.3.1416" path="/316" dev="tmpfs" ino=1732 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 148.582348][ T4195] bridge0: port 2(bridge_slave_1) entered blocking state [ 148.589470][ T4195] bridge0: port 2(bridge_slave_1) entered forwarding state [ 148.596821][ T4195] bridge0: port 1(bridge_slave_0) entered blocking state [ 148.603861][ T4195] bridge0: port 1(bridge_slave_0) entered forwarding state [ 148.655751][ T4229] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=768 sclass=netlink_xfrm_socket pid=4229 comm=syz.0.1420 [ 148.668501][ T1976] bridge0: port 1(bridge_slave_0) entered disabled state [ 148.676938][ T1976] bridge0: port 2(bridge_slave_1) entered disabled state [ 148.690797][ T1976] bridge0: port 1(bridge_slave_0) entered blocking state [ 148.697915][ T1976] bridge0: port 1(bridge_slave_0) entered forwarding state [ 148.720916][ T1976] bridge0: port 2(bridge_slave_1) entered blocking state [ 148.728054][ T1976] bridge0: port 2(bridge_slave_1) entered forwarding state [ 148.775284][ T4195] veth0_vlan: entered promiscuous mode [ 148.794622][ T4195] veth1_macvtap: entered promiscuous mode [ 148.857834][ T4231] netlink: 'syz.4.1403': attribute type 27 has an invalid length. [ 149.021039][ T315] logitech-hidpp-device 0003:046D:C082.0006: hidraw1: USB HID v0.00 Device [syz0] on syz0 [ 149.058270][ T4240] random: crng reseeded on system resumption [ 149.069472][ T4238] fido_id[4238]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 149.096549][ T36] audit: type=1400 audit(157.088:566): avc: denied { getopt } for pid=4241 comm="syz.1.1425" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 149.119529][ T4243] rust_binder: 4241:4243 got transaction to invalid handle 1 [ 149.137410][ T4243] rust_binder: 4241:4243 transaction call to 0:0 failed ENOENT, code 0 size 0-0 [ 149.151508][ T369] rust_binder: 4241: undelivered TRANSACTION_ERROR: 29201 [ 149.189948][ T4253] netlink: 'syz.4.1429': attribute type 27 has an invalid length. [ 149.406676][ T36] audit: type=1400 audit(157.398:567): avc: denied { bind } for pid=4267 comm="syz.4.1435" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 149.407001][ T4268] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1435'. [ 149.753117][ T4288] netlink: 'syz.4.1441': attribute type 27 has an invalid length. [ 149.896029][ T369] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 149.948449][ T4314] netlink: 'syz.0.1452': attribute type 27 has an invalid length. [ 150.045903][ T369] usb 4-1: Using ep0 maxpacket: 16 [ 150.052375][ T369] usb 4-1: config 0 has an invalid interface number: 34 but max is 0 [ 150.061251][ T369] usb 4-1: config 0 has no interface number 0 [ 150.068084][ T369] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 150.079068][ T369] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 150.079624][ T4318] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3780442281 (7560884562 ns) > initial count (4669583980 ns). Using initial count to start timer. [ 150.091386][ T369] usb 4-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 150.116460][ T369] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 150.124461][ T369] usb 4-1: Product: syz [ 150.128996][ T369] usb 4-1: Manufacturer: syz [ 150.133590][ T369] usb 4-1: SerialNumber: syz [ 150.139389][ T369] usb 4-1: config 0 descriptor?? [ 150.144686][ T4281] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 150.152131][ T4281] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 150.209832][ T4324] netlink: 'syz.1.1457': attribute type 16 has an invalid length. [ 150.372095][ T4281] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1024 sclass=netlink_xfrm_socket pid=4281 comm=syz.3.1438 [ 150.387685][ T4281] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 150.394946][ T4281] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 150.455000][ T4334] netlink: 'syz.1.1461': attribute type 27 has an invalid length. [ 150.605540][ T369] asix 4-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 150.615736][ T369] asix 4-1:0.34: probe with driver asix failed with error -61 [ 150.656695][ T4342] netlink: 80 bytes leftover after parsing attributes in process `syz.0.1465'. [ 150.670620][ T36] audit: type=1400 audit(158.658:568): avc: denied { write } for pid=4341 comm="syz.1.1464" name="functions" dev="configfs" ino=16478 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 150.693236][ T36] audit: type=1400 audit(158.658:569): avc: denied { add_name } for pid=4341 comm="syz.1.1464" name="uac2.0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 150.717114][ T36] audit: type=1400 audit(158.658:570): avc: denied { read write } for pid=4341 comm="syz.1.1464" name="c_chmask" dev="configfs" ino=39684 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 150.740067][ T36] audit: type=1400 audit(158.658:571): avc: denied { open } for pid=4341 comm="syz.1.1464" path="/272/config/usb_gadget/g1/functions/uac2.0/c_chmask" dev="configfs" ino=39684 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 150.793417][ T4354] netlink: 'syz.0.1470': attribute type 27 has an invalid length. [ 151.462274][ T4381] netlink: 'syz.0.1481': attribute type 27 has an invalid length. [ 151.729160][ T36] audit: type=1400 audit(159.718:572): avc: denied { create } for pid=4396 comm="syz.1.1487" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 151.775750][ T36] audit: type=1400 audit(159.758:573): avc: denied { listen } for pid=4400 comm="syz.1.1489" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 151.776877][ T4401] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1489'. [ 151.825910][ T4405] netlink: 'syz.1.1490': attribute type 27 has an invalid length. [ 152.124293][ T36] audit: type=1400 audit(160.108:574): avc: denied { create } for pid=4414 comm="syz.1.1494" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 152.370069][ T4417] netlink: 'syz.0.1496': attribute type 10 has an invalid length. [ 152.423752][ T4421] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1497'. [ 152.659552][ T315] usb 4-1: USB disconnect, device number 42 [ 152.677820][ T4430] netlink: 'syz.3.1500': attribute type 27 has an invalid length. [ 152.745349][ T4432] syzkaller1: entered promiscuous mode [ 152.751127][ T4432] syzkaller1: entered allmulticast mode [ 152.926940][ T2007] Bluetooth: hci0: Frame reassembly failed (-84) [ 153.411628][ T36] audit: type=1400 audit(161.398:575): avc: denied { create } for pid=4449 comm="syz.0.1507" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 153.457502][ T4452] veth0_to_batadv: mtu greater than device maximum [ 153.496781][ T4454] netlink: 'syz.0.1509': attribute type 27 has an invalid length. [ 153.536079][ T4456] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=768 sclass=netlink_xfrm_socket pid=4456 comm=syz.0.1510 [ 153.879671][ T4461] FAULT_INJECTION: forcing a failure. [ 153.879671][ T4461] name failslab, interval 1, probability 0, space 0, times 0 [ 153.892449][ T4461] CPU: 1 UID: 0 PID: 4461 Comm: syz.3.1512 Not tainted syzkaller #0 92ad247b86212872588e4244b63285ac9b5a817e [ 153.892471][ T4461] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 153.892480][ T4461] Call Trace: [ 153.892487][ T4461] [ 153.892493][ T4461] __dump_stack+0x21/0x30 [ 153.892514][ T4461] dump_stack_lvl+0x140/0x1c0 [ 153.892530][ T4461] ? __cfi_dump_stack_lvl+0x10/0x10 [ 153.892546][ T4461] dump_stack+0x19/0x20 [ 153.892560][ T4461] should_fail_ex+0x3c2/0x510 [ 153.892573][ T4461] should_failslab+0xac/0x100 [ 153.892592][ T4461] kmem_cache_alloc_noprof+0x42/0x410 [ 153.892605][ T4461] ? create_new_namespaces+0x48/0x6f0 [ 153.892623][ T4461] create_new_namespaces+0x48/0x6f0 [ 153.892638][ T4461] __se_sys_setns+0x2e3/0x1310 [ 153.892653][ T4461] ? trace_event_buffer_commit+0x256/0x8f0 [ 153.892666][ T4461] ? __x64_sys_setns+0x80/0x80 [ 153.892680][ T4461] ? trace_event_raw_event_sys_enter+0xf5/0x130 [ 153.892695][ T4461] __x64_sys_setns+0x5f/0x80 [ 153.892709][ T4461] x64_sys_call+0x2de8/0x2ee0 [ 153.892719][ T4461] do_syscall_64+0x57/0xf0 [ 153.892730][ T4461] ? clear_bhb_loop+0x50/0xa0 [ 153.892742][ T4461] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 153.892754][ T4461] RIP: 0033:0x7f69d559e159 [ 153.892766][ T4461] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 153.892775][ T4461] RSP: 002b:00007f69d64d0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000134 [ 153.892790][ T4461] RAX: ffffffffffffffda RBX: 00007f69d5825fa0 RCX: 00007f69d559e159 [ 153.892799][ T4461] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000000000c9 [ 153.892806][ T4461] RBP: 00007f69d563503b R08: 0000000000000000 R09: 0000000000000000 [ 153.892814][ T4461] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 153.892821][ T4461] R13: 00007f69d5826038 R14: 00007f69d5825fa0 R15: 00007ffc7e03cd68 [ 153.892831][ T4461] [ 154.196537][ T4466] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 154.205277][ T4467] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 154.313019][ T2007] tipc: Subscription rejected, illegal request [ 154.354579][ T4484] rust_binder: 4483:4484 got transaction to invalid handle 1 [ 154.362013][ T4484] rust_binder: 4483:4484 transaction async to 0:0 failed ENOENT, code 0 size 104-24 [ 154.372301][ T45] rust_binder: 4483: undelivered TRANSACTION_ERROR: 29201 [ 154.505896][ T36] audit: type=1400 audit(162.488:576): avc: denied { ioctl } for pid=4488 comm="syz.3.1522" path="/330/tracing/uprobe_events" dev="tracefs" ino=1043 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 154.775915][ T45] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 154.851170][ T36] audit: type=1400 audit(162.838:577): avc: denied { lock } for pid=4495 comm="syz.0.1525" path="socket:[40697]" dev="sockfs" ino=40697 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 154.935947][ T45] usb 4-1: Using ep0 maxpacket: 16 [ 154.945981][ T53] Bluetooth: hci0: command 0x1003 tx timeout [ 154.952045][ T548] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 154.956439][ T45] usb 4-1: config 0 has an invalid interface number: 34 but max is 0 [ 154.976228][ T45] usb 4-1: config 0 has no interface number 0 [ 154.983177][ T45] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 155.021997][ T45] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 155.047499][ T45] usb 4-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 155.064458][ T45] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 155.087049][ T45] usb 4-1: Product: syz [ 155.091243][ T45] usb 4-1: Manufacturer: syz [ 155.105848][ T45] usb 4-1: SerialNumber: syz [ 155.116229][ T45] usb 4-1: config 0 descriptor?? [ 155.126504][ T4497] overlayfs: missing 'lowerdir' [ 155.132884][ T4492] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 155.149615][ T4492] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 155.189346][ T4498] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1525'. [ 155.199101][ T4498] netlink: 1 bytes leftover after parsing attributes in process `syz.0.1525'. [ 155.361299][ T4492] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1024 sclass=netlink_xfrm_socket pid=4492 comm=syz.3.1523 [ 155.374506][ T4492] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 155.381750][ T4492] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 155.581133][ T4507] validate_nla: 1 callbacks suppressed [ 155.581155][ T4507] netlink: 'syz.1.1528': attribute type 27 has an invalid length. [ 155.595407][ T45] asix 4-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 155.606621][ T45] asix 4-1:0.34: probe with driver asix failed with error -61 [ 155.895907][ T45] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 156.057880][ T45] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 156.070252][ T45] usb 2-1: config 0 interface 0 has no altsetting 0 [ 156.077220][ T45] usb 2-1: New USB device found, idVendor=06cb, idProduct=73f5, bcdDevice= 0.00 [ 156.086695][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 156.099125][ T45] usb 2-1: config 0 descriptor?? [ 156.232835][ T4532] netlink: 'syz.4.1537': attribute type 27 has an invalid length. [ 156.334635][ T36] audit: type=1400 audit(164.318:578): avc: denied { name_bind } for pid=4536 comm="syz.4.1539" src=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=udp_socket permissive=1 [ 156.347549][ T4537] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1539'. [ 156.475924][ T4509] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 156.489679][ T4509] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 156.501637][ T45] itetech 0003:06CB:73F5.0007: unknown main item tag 0x0 [ 156.509016][ T45] itetech 0003:06CB:73F5.0007: unknown main item tag 0x0 [ 156.516124][ T45] itetech 0003:06CB:73F5.0007: collection stack underflow [ 156.523825][ T45] itetech 0003:06CB:73F5.0007: item 0 2 0 12 parsing failed [ 156.531829][ T45] itetech 0003:06CB:73F5.0007: probe with driver itetech failed with error -22 [ 156.703754][ T369] usb 2-1: USB disconnect, device number 44 [ 157.434368][ T4558] netlink: 'syz.1.1547': attribute type 27 has an invalid length. [ 157.540297][ T315] usb 4-1: USB disconnect, device number 43 [ 157.908794][ T4582] netlink: 'syz.0.1556': attribute type 27 has an invalid length. [ 157.927812][ T45] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 157.968312][ T4586] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=768 sclass=netlink_xfrm_socket pid=4586 comm=syz.0.1558 [ 158.105931][ T45] usb 2-1: Using ep0 maxpacket: 16 [ 158.114033][ T45] usb 2-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 158.135870][ T45] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 158.143867][ T45] usb 2-1: Product: syz [ 158.155847][ T45] usb 2-1: Manufacturer: syz [ 158.160470][ T45] usb 2-1: SerialNumber: syz [ 158.178556][ T45] r8152-cfgselector 2-1: Unknown version 0x0000 [ 158.184818][ T45] r8152-cfgselector 2-1: config 0 descriptor?? [ 158.196915][ T45] hub 2-1:0.0: bad descriptor, ignoring hub [ 158.202843][ T45] hub 2-1:0.0: probe with driver hub failed with error -5 [ 158.408473][ T4589] overlay: filesystem on ./file0 not supported as upperdir [ 158.416526][ T4590] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 158.436050][ T4590] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 158.596024][ T369] r8152-cfgselector 2-1: USB disconnect, device number 45 [ 158.756140][ T4610] netlink: 'syz.0.1565': attribute type 27 has an invalid length. [ 158.865988][ T45] usb 4-1: new full-speed USB device number 44 using dummy_hcd [ 159.017103][ T45] usb 4-1: config 0 interface 0 has no altsetting 0 [ 159.023760][ T45] usb 4-1: New USB device found, idVendor=056a, idProduct=00d0, bcdDevice= 0.00 [ 159.033445][ T45] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 159.042256][ T45] usb 4-1: config 0 descriptor?? [ 159.325891][ T64] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 159.451561][ T45] wacom 0003:056A:00D0.0008: collection stack underflow [ 159.458834][ T45] wacom 0003:056A:00D0.0008: item 0 2 0 12 parsing failed [ 159.466282][ T45] wacom 0003:056A:00D0.0008: parse failed [ 159.472033][ T45] wacom 0003:056A:00D0.0008: probe with driver wacom failed with error -22 [ 159.475896][ T64] usb 2-1: Using ep0 maxpacket: 16 [ 159.487160][ T64] usb 2-1: config 0 has an invalid interface number: 34 but max is 0 [ 159.495303][ T64] usb 2-1: config 0 has no interface number 0 [ 159.501456][ T64] usb 2-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 159.511593][ T64] usb 2-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 159.523221][ T64] usb 2-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 159.532299][ T64] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 159.540323][ T64] usb 2-1: Product: syz [ 159.544490][ T64] usb 2-1: Manufacturer: syz [ 159.549136][ T64] usb 2-1: SerialNumber: syz [ 159.555509][ T64] usb 2-1: config 0 descriptor?? [ 159.560903][ T4615] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 159.568587][ T4615] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 159.652764][ T369] usb 4-1: USB disconnect, device number 44 [ 159.778215][ T4615] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1024 sclass=netlink_xfrm_socket pid=4615 comm=syz.1.1567 [ 159.791281][ T4615] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 159.798519][ T4615] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 160.007138][ T64] asix 2-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 160.013309][ T4631] netlink: 'syz.0.1575': attribute type 27 has an invalid length. [ 160.017435][ T64] asix 2-1:0.34: probe with driver asix failed with error -61 [ 160.047666][ T4633] ./dev/sda1: Can't lookup blockdev [ 160.055143][ T4633] netlink: 'syz.0.1576': attribute type 1 has an invalid length. [ 160.062910][ T4633] netlink: 'syz.0.1576': attribute type 2 has an invalid length. [ 160.071115][ T4633] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1576'. [ 160.395926][ T313] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 160.546212][ T313] usb 4-1: Using ep0 maxpacket: 32 [ 160.552572][ T313] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 160.562813][ T313] usb 4-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 160.574731][ T313] usb 4-1: New USB device found, idVendor=0763, idProduct=0150, bcdDevice= 0.40 [ 160.587261][ T313] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 160.595264][ T313] usb 4-1: Product: syz [ 160.599483][ T313] usb 4-1: Manufacturer: syz [ 160.604091][ T313] usb 4-1: SerialNumber: syz [ 160.812835][ T4635] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=28286 sclass=netlink_route_socket pid=4635 comm=syz.3.1577 [ 160.857271][ T313] usb 4-1: USB disconnect, device number 45 [ 160.885889][ T4655] netlink: 'syz.0.1584': attribute type 27 has an invalid length. [ 161.534000][ T4666] mmap: syz.3.1589 (4666): VmData 29073408 exceed data ulimit 1587. Update limits or use boot option ignore_rlimit_data. [ 161.550015][ T4668] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=7995 sclass=netlink_route_socket pid=4668 comm=syz.0.1590 [ 161.670437][ T4676] netlink: 'syz.0.1593': attribute type 27 has an invalid length. [ 162.095121][ T369] usb 2-1: USB disconnect, device number 46 [ 162.936032][ T369] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 163.033756][ T4736] FAULT_INJECTION: forcing a failure. [ 163.033756][ T4736] name fail_usercopy, interval 1, probability 100, space 0, times -1 [ 163.047269][ T4736] CPU: 1 UID: 0 PID: 4736 Comm: syz.4.1616 Not tainted syzkaller #0 92ad247b86212872588e4244b63285ac9b5a817e [ 163.047299][ T4736] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 163.047312][ T4736] Call Trace: [ 163.047319][ T4736] [ 163.047325][ T4736] __dump_stack+0x21/0x30 [ 163.047344][ T4736] dump_stack_lvl+0x140/0x1c0 [ 163.047358][ T4736] ? __cfi_dump_stack_lvl+0x10/0x10 [ 163.047372][ T4736] ? getname_flags+0xcc/0x6b0 [ 163.047385][ T4736] dump_stack+0x19/0x20 [ 163.047398][ T4736] should_fail_ex+0x3c2/0x510 [ 163.047412][ T4736] should_fail+0xf/0x20 [ 163.047423][ T4736] should_fail_usercopy+0x1e/0x30 [ 163.047437][ T4736] strncpy_from_user+0x29/0x280 [ 163.047449][ T4736] getname_flags+0x106/0x6b0 [ 163.047461][ T4736] getname+0x1b/0x30 [ 163.047472][ T4736] do_sys_openat2+0xda/0x1d0 [ 163.047487][ T4736] ? do_sys_open+0x100/0x100 [ 163.047502][ T4736] ? trace_event_raw_event_sys_enter+0xf5/0x130 [ 163.047518][ T4736] __x64_sys_creat+0x92/0xc0 [ 163.047527][ T4736] x64_sys_call+0x2710/0x2ee0 [ 163.047537][ T4736] do_syscall_64+0x57/0xf0 [ 163.047548][ T4736] ? clear_bhb_loop+0x50/0xa0 [ 163.047561][ T4736] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 163.047573][ T4736] RIP: 0033:0x7fde5039e159 [ 163.047583][ T4736] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 163.047593][ T4736] RSP: 002b:00007fde512cf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 [ 163.047607][ T4736] RAX: ffffffffffffffda RBX: 00007fde50625fa0 RCX: 00007fde5039e159 [ 163.047616][ T4736] RDX: 0000000000000000 RSI: 0000000000000118 RDI: 0000200000000080 [ 163.047624][ T4736] RBP: 00007fde512cf090 R08: 0000000000000000 R09: 0000000000000000 [ 163.047631][ T4736] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 163.047638][ T4736] R13: 00007fde50626038 R14: 00007fde50625fa0 R15: 00007ffceba51ce8 [ 163.047648][ T4736] [ 163.115918][ T64] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 163.277325][ T369] usb 4-1: Using ep0 maxpacket: 16 [ 163.284015][ T369] usb 4-1: config 0 has an invalid interface number: 34 but max is 0 [ 163.292289][ T369] usb 4-1: config 0 has no interface number 0 [ 163.298767][ T369] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 163.309152][ T369] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 163.320969][ T369] usb 4-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 163.332027][ T369] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 163.340121][ T369] usb 4-1: Product: syz [ 163.344427][ T369] usb 4-1: Manufacturer: syz [ 163.349983][ T369] usb 4-1: SerialNumber: syz [ 163.356716][ T369] usb 4-1: config 0 descriptor?? [ 163.362536][ T4709] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 163.371628][ T4709] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 163.408158][ T64] usb 2-1: too many endpoints for config 0 interface 0 altsetting 8: 34, using maximum allowed: 30 [ 163.424632][ T64] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 163.436206][ T64] usb 2-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 34 [ 163.449240][ T64] usb 2-1: config 0 interface 0 has no altsetting 0 [ 163.455970][ T64] usb 2-1: New USB device found, idVendor=056a, idProduct=00c0, bcdDevice= 0.00 [ 163.465052][ T64] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 163.475374][ T64] usb 2-1: config 0 descriptor?? [ 163.586111][ T4709] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1024 sclass=netlink_xfrm_socket pid=4709 comm=syz.3.1606 [ 163.601990][ T4709] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 163.609827][ T4709] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 163.682587][ T4720] netlink: 'syz.1.1610': attribute type 1 has an invalid length. [ 163.786322][ T4778] FAULT_INJECTION: forcing a failure. [ 163.786322][ T4778] name failslab, interval 1, probability 0, space 0, times 0 [ 163.799277][ T4778] CPU: 1 UID: 0 PID: 4778 Comm: syz.4.1634 Not tainted syzkaller #0 92ad247b86212872588e4244b63285ac9b5a817e [ 163.799312][ T4778] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 163.799327][ T4778] Call Trace: [ 163.799336][ T4778] [ 163.799345][ T4778] __dump_stack+0x21/0x30 [ 163.799378][ T4778] dump_stack_lvl+0x140/0x1c0 [ 163.799404][ T4778] ? __cfi_dump_stack_lvl+0x10/0x10 [ 163.799422][ T4778] dump_stack+0x19/0x20 [ 163.799435][ T4778] should_fail_ex+0x3c2/0x510 [ 163.799459][ T4778] should_failslab+0xac/0x100 [ 163.799486][ T4778] __kmalloc_node_noprof+0x69/0x500 [ 163.799509][ T4778] ? __kvmalloc_node_noprof+0x128/0x300 [ 163.799530][ T4778] __kvmalloc_node_noprof+0x128/0x300 [ 163.799545][ T4778] ? __cfi_dev_addr_init+0x10/0x10 [ 163.799559][ T4778] ? __cfi___kvmalloc_node_noprof+0x10/0x10 [ 163.799569][ T4778] ? __asan_memset+0x39/0x50 [ 163.799580][ T4778] alloc_netdev_mqs+0xaf4/0x13d0 [ 163.799595][ T4778] tun_set_iff+0x543/0xec0 [ 163.799618][ T4778] __tun_chr_ioctl+0x852/0x1fb0 [ 163.799640][ T4778] ? tun_flow_create+0x400/0x400 [ 163.799662][ T4778] ? __fget_files+0x2bc/0x330 [ 163.799686][ T4778] tun_chr_ioctl+0x2e/0x40 [ 163.799703][ T4778] ? __cfi_tun_chr_ioctl+0x10/0x10 [ 163.799713][ T4778] __se_sys_ioctl+0x126/0x1b0 [ 163.799726][ T4778] __x64_sys_ioctl+0x7f/0xa0 [ 163.799738][ T4778] x64_sys_call+0x1878/0x2ee0 [ 163.799756][ T4778] do_syscall_64+0x57/0xf0 [ 163.799775][ T4778] ? clear_bhb_loop+0x50/0xa0 [ 163.799800][ T4778] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 163.799822][ T4778] RIP: 0033:0x7fde5039e159 [ 163.799840][ T4778] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 163.799852][ T4778] RSP: 002b:00007fde512cf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 163.799866][ T4778] RAX: ffffffffffffffda RBX: 00007fde50625fa0 RCX: 00007fde5039e159 [ 163.799875][ T4778] RDX: 00002000000000c0 RSI: 00000000400454ca RDI: 0000000000000006 [ 163.799883][ T4778] RBP: 00007fde5043503b R08: 0000000000000000 R09: 0000000000000000 [ 163.799890][ T4778] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 163.799903][ T4778] R13: 00007fde50626038 R14: 00007fde50625fa0 R15: 00007ffceba51ce8 [ 163.799922][ T4778] [ 163.802524][ T4778] netlink: 'syz.4.1634': attribute type 22 has an invalid length. [ 163.828482][ T369] asix 4-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 164.049696][ T64] wacom 0003:056A:00C0.0009: ignoring exceeding usage max [ 164.058632][ T369] asix 4-1:0.34: probe with driver asix failed with error -61 [ 164.066591][ T64] wacom 0003:056A:00C0.0009: hidraw1: USB HID vff.fc Device [HID 056a:00c0] on usb-dummy_hcd.1-1/input0 [ 164.118953][ T45] usb 2-1: USB disconnect, device number 47 [ 165.701783][ T313] usb 4-1: USB disconnect, device number 46 [ 165.741014][ T36] audit: type=1400 audit(173.728:579): avc: denied { bind } for pid=4821 comm="syz.3.1651" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 165.764171][ T4819] incfs: Options parsing error. -22 [ 165.771832][ T4819] incfs: mount failed -22 [ 165.781428][ T36] audit: type=1400 audit(173.758:580): avc: denied { setopt } for pid=4821 comm="syz.3.1651" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 166.121126][ T4814] ================================================================== [ 166.129217][ T4814] BUG: KASAN: slab-use-after-free in tipc_skb_dump+0x138b/0x17e0 [ 166.136952][ T4814] Read of size 4 at addr ffff888144d1b8b4 by task syz.0.1648/4814 [ 166.144761][ T4814] [ 166.147086][ T4814] CPU: 1 UID: 0 PID: 4814 Comm: syz.0.1648 Not tainted syzkaller #0 92ad247b86212872588e4244b63285ac9b5a817e [ 166.147110][ T4814] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 166.147120][ T4814] Call Trace: [ 166.147126][ T4814] [ 166.147134][ T4814] __dump_stack+0x21/0x30 [ 166.147158][ T4814] dump_stack_lvl+0x140/0x1c0 [ 166.147177][ T4814] ? __cfi_dump_stack_lvl+0x10/0x10 [ 166.147197][ T4814] ? __cfi__printk+0x10/0x10 [ 166.147215][ T4814] print_address_description+0x71/0x210 [ 166.147235][ T4814] print_report+0x4a/0x70 [ 166.147254][ T4814] kasan_report+0x162/0x1a0 [ 166.147272][ T4814] ? tipc_skb_dump+0x138b/0x17e0 [ 166.147291][ T4814] ? tipc_skb_dump+0x138b/0x17e0 [ 166.147309][ T4814] __asan_report_load4_noabort+0x18/0x20 [ 166.147324][ T4814] tipc_skb_dump+0x138b/0x17e0 [ 166.147343][ T4814] tipc_list_dump+0x22f/0x300 [ 166.147361][ T4814] tipc_sk_dump+0xa16/0xfd0 [ 166.147378][ T4814] trace_event_raw_event_tipc_sk_class+0x290/0x4d0 [ 166.147396][ T4814] ? __cfi_trace_event_raw_event_tipc_sk_class+0x10/0x10 [ 166.147414][ T4814] ? __cfi__raw_spin_lock_bh+0x10/0x10 [ 166.147430][ T4814] ? ring_buffer_unlock_commit+0x473/0x5e0 [ 166.147448][ T4814] tipc_sk_rcv+0x165f/0x2c70 [ 166.147470][ T4814] ? __cfi_tipc_sk_rcv+0x10/0x10 [ 166.147484][ T4814] ? netif_rx+0x8c/0x290 [ 166.147498][ T4814] tipc_node_xmit+0x346/0x10e0 [ 166.147512][ T4814] ? __cfi_tipc_node_xmit+0x10/0x10 [ 166.147525][ T4814] ? __cfi_trace_event_raw_event_tipc_sk_class+0x10/0x10 [ 166.147538][ T4814] ? tipc_node_get_mtu+0x1ee/0x620 [ 166.147550][ T4814] ? __kasan_check_read+0x15/0x20 [ 166.147561][ T4814] __tipc_sendmsg+0x1b36/0x28a0 [ 166.147574][ T4814] ? tipc_sk_respond+0x430/0x430 [ 166.147586][ T4814] ? avc_has_perm_noaudit+0x26b/0x360 [ 166.147599][ T4814] ? __asan_memcpy+0x5a/0x80 [ 166.147610][ T4814] ? avc_has_perm_noaudit+0x289/0x360 [ 166.147623][ T4814] ? avc_has_perm+0x155/0x240 [ 166.147635][ T4814] ? __cfi_avc_has_perm+0x10/0x10 [ 166.147647][ T4814] ? __kasan_check_write+0x18/0x20 [ 166.147658][ T4814] ? _raw_spin_lock_bh+0x96/0x130 [ 166.147668][ T4814] ? __cfi__raw_spin_lock_bh+0x10/0x10 [ 166.147678][ T4814] ? selinux_socket_sendmsg+0x281/0x380 [ 166.147692][ T4814] ? rb_commit+0x753/0x7b0 [ 166.147703][ T4814] ? lock_sock_nested+0x216/0x2a0 [ 166.147713][ T4814] ? __cfi_lock_sock_nested+0x10/0x10 [ 166.147724][ T4814] ? __cfi_woken_wake_function+0x10/0x10 [ 166.147737][ T4814] ? trace_buffer_unlock_commit_regs+0x14a/0x600 [ 166.147750][ T4814] tipc_sendmsg+0x59/0x90 [ 166.147761][ T4814] ____sys_sendmsg+0x9a1/0xa00 [ 166.147775][ T4814] ? __import_iovec+0x3fa/0x7d0 [ 166.147786][ T4814] ? __sys_sendmsg_sock+0x50/0x50 [ 166.147799][ T4814] ? import_iovec+0x80/0xb0 [ 166.147810][ T4814] ___sys_sendmsg+0x2a6/0x370 [ 166.147824][ T4814] ? __cfi_trace_clock_local+0x10/0x10 [ 166.147834][ T4814] ? __sys_sendmsg+0x260/0x260 [ 166.147855][ T4814] ? __fget_files+0x2bc/0x330 [ 166.147868][ T4814] __sys_sendmmsg+0x292/0x490 [ 166.147883][ T4814] ? __cfi___sys_sendmmsg+0x10/0x10 [ 166.147897][ T4814] ? trace_buffer_unlock_commit_regs+0x14a/0x600 [ 166.147910][ T4814] ? trace_event_raw_event_sys_enter+0xf5/0x130 [ 166.147926][ T4814] __x64_sys_sendmmsg+0xa4/0xc0 [ 166.147940][ T4814] x64_sys_call+0xfec/0x2ee0 [ 166.147950][ T4814] do_syscall_64+0x57/0xf0 [ 166.147960][ T4814] ? clear_bhb_loop+0x50/0xa0 [ 166.147973][ T4814] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 166.147985][ T4814] RIP: 0033:0x7f0e0e19e159 [ 166.147996][ T4814] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 166.148005][ T4814] RSP: 002b:00007f0e0f0db028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 166.148019][ T4814] RAX: ffffffffffffffda RBX: 00007f0e0e425fa0 RCX: 00007f0e0e19e159 [ 166.148027][ T4814] RDX: 00000000040001b6 RSI: 0000200000001540 RDI: 0000000000000003 [ 166.148035][ T4814] RBP: 00007f0e0e23503b R08: 0000000000000000 R09: 0000000000000000 [ 166.148043][ T4814] R10: 00000000000000f5 R11: 0000000000000246 R12: 0000000000000000 [ 166.148050][ T4814] R13: 00007f0e0e426038 R14: 00007f0e0e425fa0 R15: 00007ffc0ef30168 [ 166.148059][ T4814] [ 166.148064][ T4814] [ 166.552139][ T4814] Allocated by task 4814: [ 166.556450][ T4814] kasan_save_track+0x3e/0x80 [ 166.561126][ T4814] kasan_save_alloc_info+0x3a/0x50 [ 166.566215][ T4814] __kasan_slab_alloc+0x73/0x90 [ 166.571050][ T4814] kmem_cache_alloc_node_noprof+0x1ca/0x420 [ 166.576918][ T4814] kmalloc_reserve+0xcf/0x4f0 [ 166.581571][ T4814] __alloc_skb+0x13f/0x360 [ 166.585969][ T4814] tipc_msg_build+0x160/0xf20 [ 166.590637][ T4814] __tipc_sendmsg+0x1693/0x28a0 [ 166.595465][ T4814] tipc_sendmsg+0x59/0x90 [ 166.599774][ T4814] ____sys_sendmsg+0x9a1/0xa00 [ 166.604516][ T4814] ___sys_sendmsg+0x2a6/0x370 [ 166.609169][ T4814] __sys_sendmmsg+0x292/0x490 [ 166.613828][ T4814] __x64_sys_sendmmsg+0xa4/0xc0 [ 166.618656][ T4814] x64_sys_call+0xfec/0x2ee0 [ 166.623223][ T4814] do_syscall_64+0x57/0xf0 [ 166.627615][ T4814] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 166.633489][ T4814] [ 166.635792][ T4814] Freed by task 4813: [ 166.639756][ T4814] kasan_save_track+0x3e/0x80 [ 166.644426][ T4814] kasan_save_free_info+0x44/0x50 [ 166.649428][ T4814] __kasan_slab_free+0x5f/0x80 [ 166.654185][ T4814] kfree+0x158/0x440 [ 166.658082][ T4814] skb_free_head+0xf7/0x300 [ 166.662563][ T4814] skb_release_data+0x6d0/0x860 [ 166.667411][ T4814] __kfree_skb+0x62/0x210 [ 166.671722][ T4814] sk_skb_reason_drop+0xd8/0x310 [ 166.676654][ T4814] tipc_msg_reverse+0x1a8/0x950 [ 166.681579][ T4814] tipc_sk_respond+0x139/0x430 [ 166.686321][ T4814] __tipc_shutdown+0x9b1/0x14e0 [ 166.691163][ T4814] tipc_release+0xe0/0x1c40 [ 166.695641][ T4814] sock_close+0xb4/0x220 [ 166.699863][ T4814] __fput+0x208/0xa30 [ 166.703823][ T4814] ____fput+0x20/0x30 [ 166.707798][ T4814] task_work_run+0x1e5/0x260 [ 166.712369][ T4814] resume_user_mode_work+0x35/0x50 [ 166.717458][ T4814] syscall_exit_to_user_mode+0x63/0xb0 [ 166.722902][ T4814] do_syscall_64+0x63/0xf0 [ 166.727296][ T4814] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 166.733168][ T4814] [ 166.735470][ T4814] The buggy address belongs to the object at ffff888144d1b800 [ 166.735470][ T4814] which belongs to the cache skbuff_small_head of size 768 [ 166.750028][ T4814] The buggy address is located 180 bytes inside of [ 166.750028][ T4814] freed 768-byte region [ffff888144d1b800, ffff888144d1bb00) [ 166.763802][ T4814] [ 166.766110][ T4814] The buggy address belongs to the physical page: [ 166.772507][ T4814] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x144d18 [ 166.781331][ T4814] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 166.789809][ T4814] flags: 0x4000000000000040(head|zone=1) [ 166.795416][ T4814] page_type: f5(slab) [ 166.799379][ T4814] raw: 4000000000000040 ffff888101a4c8c0 dead000000000122 0000000000000000 [ 166.807939][ T4814] raw: 0000000000000000 0000000000120012 00000001f5000000 0000000000000000 [ 166.816506][ T4814] head: 4000000000000040 ffff888101a4c8c0 dead000000000122 0000000000000000 [ 166.825158][ T4814] head: 0000000000000000 0000000000120012 00000001f5000000 0000000000000000 [ 166.833804][ T4814] head: 4000000000000002 ffffea0005134601 ffffffffffffffff 0000000000000000 [ 166.842452][ T4814] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000 [ 166.851103][ T4814] page dumped because: kasan: bad access detected [ 166.857496][ T4814] page_owner tracks the page as allocated [ 166.863186][ T4814] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 4814, tgid 4813 (syz.0.1648), ts 165302243293, free_ts 162112308813 [ 166.885931][ T4814] post_alloc_hook+0x37d/0x3b0 [ 166.890705][ T4814] prep_new_page+0x2d/0x180 [ 166.895187][ T4814] get_page_from_freelist+0x4aea/0x4ba0 [ 166.900714][ T4814] __alloc_pages_noprof+0x35a/0x7e0 [ 166.905895][ T4814] alloc_slab_page+0x6b/0x1e0 [ 166.910556][ T4814] allocate_slab+0x69/0x430 [ 166.915036][ T4814] ___slab_alloc+0x591/0x8c0 [ 166.919602][ T4814] kmem_cache_alloc_node_noprof+0x29b/0x420 [ 166.925471][ T4814] kmalloc_reserve+0xcf/0x4f0 [ 166.930129][ T4814] __alloc_skb+0x13f/0x360 [ 166.934535][ T4814] tipc_msg_build+0x160/0xf20 [ 166.939201][ T4814] __tipc_sendmsg+0x1693/0x28a0 [ 166.944030][ T4814] tipc_sendmsg+0x59/0x90 [ 166.948337][ T4814] ____sys_sendmsg+0x9a1/0xa00 [ 166.953102][ T4814] ___sys_sendmsg+0x2a6/0x370 [ 166.957756][ T4814] __sys_sendmmsg+0x292/0x490 [ 166.962415][ T4814] page last free pid 1393 tgid 1393 stack trace: [ 166.968737][ T4814] free_unref_page+0xbb8/0xf70 [ 166.973483][ T4814] __free_pages+0x6b/0x3b0 [ 166.977877][ T4814] __free_slab+0xb2/0x110 [ 166.982198][ T4814] free_slab+0x18/0xe0 [ 166.986246][ T4814] __put_partials+0x115/0x150 [ 166.990908][ T4814] put_cpu_partial+0x91/0xc0 [ 166.995472][ T4814] __slab_free+0x1cf/0x2a0 [ 166.999863][ T4814] ___cache_free+0xc9/0xe0 [ 167.004256][ T4814] qlist_free_all+0xb5/0x130 [ 167.008820][ T4814] kasan_quarantine_reduce+0x14f/0x180 [ 167.014258][ T4814] __kasan_slab_alloc+0x28/0x90 [ 167.019090][ T4814] kmem_cache_alloc_noprof+0x1bf/0x410 [ 167.024534][ T4814] getname_flags+0xcc/0x6b0 [ 167.029017][ T4814] user_path_at+0x2b/0x60 [ 167.033324][ T4814] do_faccessat+0x58c/0xd00 [ 167.037800][ T4814] __x64_sys_faccessat2+0x9e/0xb0 [ 167.042805][ T4814] [ 167.045132][ T4814] Memory state around the buggy address: [ 167.050737][ T4814] ffff888144d1b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 167.058773][ T4814] ffff888144d1b800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 167.066808][ T4814] >ffff888144d1b880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 167.074843][ T4814] ^ [ 167.080501][ T4814] ffff888144d1b900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 167.088649][ T4814] ffff888144d1b980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 167.096705][ T4814] ================================================================== [ 167.104832][ T4814] Disabling lock debugging due to kernel taint [ 167.117665][ T4835] Invalid logical block size (948) [ 167.126959][ T36] audit: type=1400 audit(175.108:581): avc: denied { read } for pid=92 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 167.176351][ T36] audit: type=1400 audit(175.108:582): avc: denied { search } for pid=92 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 167.197635][ T36] audit: type=1400 audit(175.108:583): avc: denied { write } for pid=92 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 167.218340][ T36] audit: type=1400 audit(175.108:584): avc: denied { add_name } for pid=92 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 167.240694][ T36] audit: type=1400 audit(175.108:585): avc: denied { create } for pid=92 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 167.260624][ T36] audit: type=1400 audit(175.108:586): avc: denied { append open } for pid=92 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 167.283029][ T36] audit: type=1400 audit(175.108:587): avc: denied { getattr } for pid=92 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1