last executing test programs: 1m25.717995745s ago: executing program 3 (id=1181): r0 = syz_usb_connect(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000a1121710950b2a17f4f7010203010902340001000000000904fb00026c5d650009050402100000fa000905820240"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000080)={0x2001}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), 0xffffffffffffffff) bind$tipc(r2, 0x0, 0x0) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)={0x30, r4, 0x1, 0x0, 0x100000, {{}, {}, {0x14, 0x19, {0x2, 0x1, 0x0, 0x2000000}}}}, 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x1004) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x9}) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000380)={'team_slave_0\x00', &(0x7f00000003c0)=@ethtool_test={0x1a, 0x4, 0x4}}) userfaultfd(0x0) 1m24.235318324s ago: executing program 3 (id=1197): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x15) remap_file_pages(&(0x7f000051c000/0x400000)=nil, 0x400000, 0x0, 0x2, 0x0) syz_usb_connect(0x2, 0x137, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000210aee40b40b3c0a4c710102030109022501010501900a09044707000e0100a6062406000014f9d3110524125b0ccf121ad55496589f"], 0x0) 1m22.927721392s ago: executing program 3 (id=1213): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup(r0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="083c86dd0001110004600000a60c6eec00be00442cfffe8000000000000000000000000000aaff020000000000000000000000000001", @ANYRES32=r1], 0xfdef) 1m22.858811224s ago: executing program 3 (id=1214): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="300000001d00210000000000000000000700000005000000000000000a00020077a9c6f76f000000060005"], 0x30}}, 0x0) mount$bind(0x0, &(0x7f00000003c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x169030, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000180)='./file0/../file0\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x18d883, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) r2 = socket$unix(0x1, 0x1, 0x0) bind$unix(r2, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r2, 0xfffffc01) r3 = socket$unix(0x1, 0x1, 0x0) connect$unix(r3, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) renameat2(r1, &(0x7f0000000280)='./file0/file0\x00', r1, &(0x7f0000000340)='./file0/../file0\x00', 0x4) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000001240)={0x2, &(0x7f0000001200)=[{0x87, 0x0, 0x0, 0x4}, {0x6}]}) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x4000}}) open_tree(r1, &(0x7f0000000380)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x81000) 1m21.975258602s ago: executing program 3 (id=1224): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_XCRS(r2, 0x4188aea7, &(0x7f0000000780)={0xc, 0x0, [{0x9, 0x0, 0xffffffffffffffff}, {0x81, 0x0, 0x2c13ce6}, {0x0, 0x0, 0x1}, {0x400}, {0xc7b, 0x0, 0x6}, {0x3, 0x0, 0x400}, {0x0, 0x0, 0xef}, {0x1, 0x0, 0x5}, {0x0, 0x0, 0x6}, {0x487, 0x0, 0xff}, {0xffff8778, 0x0, 0x6}, {0x7, 0x0, 0x400000000005}, {0xffff7fff, 0x0, 0x8}, {0xffffff01, 0x0, 0x44}, {0x767d, 0x0, 0x3}, {0x468e532d, 0x0, 0x4}]}) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000080)={0x24, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x22, 0xf, {[@local=@item_012={0x2, 0x2, 0x9, 'h%'}, @local=@item_4={0x3, 0x2, 0x0, "112000"}, @main=@item_012={0x0, 0x0, 0x9}, @main=@item_4={0x3, 0x0, 0xa, "d10b4e33"}, @local=@item_012={0x0, 0x2, 0x1}]}}, 0x0}, 0x0) 1m21.972547452s ago: executing program 3 (id=1225): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000002380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000023c0)={'veth1_to_batadv\x00', 0x0}) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000002580)={0x0, 0x0, &(0x7f0000002540)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000080c0000000c00018008000100", @ANYRES32=r2, @ANYBLOB="0c00038004"], 0x2c}}, 0x0) 1m21.914165252s ago: executing program 32 (id=1225): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000002380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000023c0)={'veth1_to_batadv\x00', 0x0}) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000002580)={0x0, 0x0, &(0x7f0000002540)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000080c0000000c00018008000100", @ANYRES32=r2, @ANYBLOB="0c00038004"], 0x2c}}, 0x0) 26.623515058s ago: executing program 0 (id=1966): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup(r0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB], 0xfdef) 26.595976492s ago: executing program 0 (id=1968): mkdir(&(0x7f0000000300)='./file0\x00', 0xfffffffffffffffe) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) chdir(&(0x7f0000000140)='./file0\x00') r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f0000000440)=0x0) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x4000, 0xa00, 0x100000000000000}]) 26.507178947s ago: executing program 0 (id=1971): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c00000010008100000000000080000000000000", @ANYRES32=0x0, @ANYBLOB="1f04", @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) 26.481435371s ago: executing program 0 (id=1972): mkdir(&(0x7f0000000300)='./file0\x00', 0xfffffffffffffffe) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) chdir(&(0x7f0000000140)='./file0\x00') r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) tgkill(r0, r0, 0x35) ptrace$peeksig(0x4209, r0, &(0x7f0000000140)={0x0, 0x0, 0x4e}, &(0x7f0000000fc0)) r1 = creat(&(0x7f0000000040)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f0000000440)=0x0) io_submit(r2, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x4000, 0x8800000}]) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x250000, 0x4) 26.407030694s ago: executing program 0 (id=1977): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup(r0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB], 0xfdef) 26.347874513s ago: executing program 0 (id=1978): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x301142, 0x0) close(r3) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @broadcast}) close(r2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) ioctl$SIOCSIFHWADDR(r2, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random='\x00\a\x00'}) 26.323213358s ago: executing program 33 (id=1978): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x301142, 0x0) close(r3) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @broadcast}) close(r2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) ioctl$SIOCSIFHWADDR(r2, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random='\x00\a\x00'}) 2.186856054s ago: executing program 2 (id=2232): r0 = socket(0x10, 0x803, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='huge=always,huge=within_size,nr_blocks=5']) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) ftruncate(r1, 0x8008976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, r1, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000003500)=""/4096, 0x1000}], 0x1}, 0xe}, {{0x0, 0x0, 0x0}, 0x40000000}], 0x2, 0x40000100, 0x0) 2.169127917s ago: executing program 2 (id=2233): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000600)=ANY=[@ANYBLOB="0201000000000010ac05418200000000000109022400010000000009040000110300000009210000000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000700)={0x2c, 0x0, 0x0, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000640)=ANY=[@ANYBLOB="20015b000000d1b3d1e9527c50f0d5330820fd3634f8b181d532b5a8130abc0c2730289011fb3ea70b54f544af1f7245549f92b06494daa0e9bfff617a8b8547fffe633db5ee757eff716f0f8fd3ef46f2b55a2de5754c25519cf78755f1d6ff"], &(0x7f00000006c0)={0x20, 0x3, 0x1, 0x2}}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched_retired(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000600)=@newtaction={0x44, 0x1d, 0x1, 0x70bd29, 0x25dfdbfb, {}, [{0x30, 0x1, [@m_ipt={0x2c, 0x1, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x8080}, 0x9080) r2 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) ioctl$HIDIOCGUCODE(r2, 0xc018480d, 0x0) 1.119397683s ago: executing program 1 (id=2251): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1400000014000103f7000000010000000a"], 0x14}, 0x1, 0x0, 0xa00}, 0x4014) 1.059291192s ago: executing program 1 (id=2252): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000005e00)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r1, 0x5460, 0x0) socket(0x10, 0x3, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000002c0), 0x12) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4400ae8f, &(0x7f00000000c0)=@x86={0x60, 0x4, 0x9, 0x0, 0x8000000, 0x6, 0x10, 0x5, 0x0, 0x7f, 0x9, 0x1, 0x0, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, '\x00', 0x0, 0x1}) 1.024762568s ago: executing program 1 (id=2253): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, 0xffffffffffffffff, 0x1000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000280)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0}, 0x40}], 0x0, 0x0, 0x0}) 908.751738ms ago: executing program 5 (id=2256): mkdir(&(0x7f0000000300)='./file0\x00', 0xfffffffffffffffe) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) chdir(&(0x7f0000000140)='./file0\x00') r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f0000000440)=0x0) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x40000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x4000, 0x8800000}]) 828.360791ms ago: executing program 1 (id=2257): r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100), 0xe80, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0x4c) madvise(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4b0b361e70fab327) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x40000) poll(&(0x7f0000000080)=[{r1, 0x40}, {r1, 0x8100}, {r2, 0x4}, {}, {r0, 0x20}, {r1, 0x10}], 0x6, 0x6) ioctl$RTC_SET_TIME(r0, 0x4024700a, &(0x7f0000000000)={0x1c, 0xd, 0x7, 0x1b, 0x0, 0x7, 0x3, 0x5f, 0x1}) 828.045321ms ago: executing program 1 (id=2258): close(0x3) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000040), r0) unshare(0x60000600) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$bt_hci(r2, 0x0, 0x1, 0x0, &(0x7f0000000180)) process_vm_writev(r1, &(0x7f0000002340)=[{&(0x7f0000000100)=""/4096, 0x1000}], 0x1, &(0x7f0000003480)=[{&(0x7f00000023c0)=""/4096, 0x1000}], 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f00000000c0)=[{0x20, 0x5, 0x2, 0x70ff}, {0x6, 0xfe, 0x0, 0xa1a}]}, 0x10) sendmmsg(r4, &(0x7f0000002900)=[{{0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000b40)="97a797c5", 0xa797}], 0x1}}], 0x1, 0x0) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x5, 0x4, 0x6, 0xfffa}, 0x1d, [0x1, 0xc95a, 0xfffffff3, 0x9, 0x80, 0x2, 0x3, 0x7f, 0x6, 0x4d, 0x7fff, 0x2, 0x9, 0x5, 0x2, 0x0, 0x6, 0x3, 0x7, 0x4, 0x4, 0x7, 0x4, 0x3c5b, 0x1, 0x9, 0x9, 0x1, 0xfffff801, 0x7, 0xe261, 0x7fff, 0x4000b, 0x3, 0x7f7f, 0x4c74, 0x1, 0xc, 0xffffffff, 0xe, 0x0, 0x71, 0x2, 0x6, 0x3, 0x50, 0x5, 0x7fff, 0x8f, 0x4b, 0x6, 0x5, 0x80092a3, 0x4, 0x1, 0x20000000, 0x82, 0x0, 0x7, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x401, 0x12f, 0x6, 0x10, 0xfffffff3, 0x129432e6, 0x0, 0x3, 0xd, 0x2bf, 0x5, 0xffe, 0xfffffffc, 0x334000, 0x0, 0x7, 0x5, 0x2b, 0x5a04, 0x312, 0x1, 0x0, 0xfffffffe, 0x8, 0x4, 0x8000, 0x9, 0x3fe, 0x401, 0x6, 0x4, 0xfb, 0x5, 0x8000, 0x5f31, 0x3, 0x1, 0x2, 0x2, 0x9, 0x4, 0x9, 0x8, 0x9, 0x6, 0xb, 0xa, 0x1, 0x9, 0x9, 0x2, 0x7f, 0x9, 0x1, 0x3, 0x9, 0xffffffff, 0x7, 0x3, 0x9, 0x48c93690, 0x42, 0x400004], [0x6, 0x6, 0x80000001, 0x2, 0xff, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x1, 0xb, 0x3, 0x5, 0x1007, 0x0, 0xa40, 0xfffffffd, 0x2, 0x83, 0x1, 0x3, 0x3e7, 0x7, 0x5, 0x2, 0x2, 0x800, 0x8, 0x5, 0x8001, 0x7, 0x38, 0x800003, 0x200, 0x80, 0x2, 0xcc52, 0x950bfaf, 0x1000, 0xfffffff6, 0x7, 0x53cf697b, 0xfffffff9, 0x6, 0x3, 0xc0, 0x10002, 0x403, 0x7fd, 0x3, 0x0, 0xfffffffc, 0xffff, 0x5, 0xe, 0x1c, 0x120000, 0x3, 0x6, 0xaaed, 0x4, 0xff], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0x1, 0x6, 0x5, 0x0, 0x3, 0x80ce7, 0x100001ff, 0xb, 0x7, 0x5, 0x1003, 0x101, 0x10000, 0x6, 0x7fff, 0xffff, 0xe620, 0x2, 0x2, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x4, 0xffffffff, 0x80000001, 0x7, 0x8, 0xc8, 0xee1, 0x0, 0xffff, 0x3, 0x7f, 0x100, 0x9602, 0x5, 0x2, 0xffff, 0x6, 0x1, 0x10080, 0x6, 0xb, 0x30b1d693, 0x5a2b, 0xc, 0x7, 0x1, 0x6c1b, 0x0, 0x200000, 0x5, 0xb1c, 0x1, 0x20000200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) sendmsg$netlink(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000580)=ANY=[@ANYBLOB="3400000013000100000100dffddbdf25070000f61600000008000000", @ANYRES32, @ANYBLOB="14000c8008"], 0x34}], 0x1, 0x0, 0x0, 0x4000}, 0x0) 804.332405ms ago: executing program 5 (id=2259): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x9e65) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x2001, 0x0) clock_adjtime(0xffffffd3, &(0x7f0000002640)={0x2, 0x7253, 0xffffffffffffffdf, 0x696f, 0x9, 0x6, 0x52e6ac5d, 0x8, 0xc, 0x0, 0x0, 0x7fffffff, 0x6, 0x8000000b, 0x80000004000000, 0x9, 0xfffffffffffffffd, 0x89, 0x3, 0x8000001, 0x3, 0x3, 0x200000005, 0xfffffffffffffffb, 0x9dc6, 0xa}) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) ioctl$USBDEVFS_CONTROL(r1, 0xc0105500, &(0x7f0000000000)={0x80, 0x6, 0x300, 0x0, 0x0, 0x2, 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = memfd_secret(0x80000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000009, 0x12, r3, 0xffffe000) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$WG_CMD_GET_DEVICE(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x14, r4, 0x301, 0x70bd2c, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x40080c0}, 0x20040000) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'erspan0\x00', 0x1}) sendfile(r1, r0, &(0x7f0000000040)=0x7fffffffffffffff, 0x95) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000000)=0x4) 784.920539ms ago: executing program 5 (id=2260): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000002380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000023c0)={'veth1_to_batadv\x00', 0x0}) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000002580)={0x0, 0x0, &(0x7f0000002540)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000f0ffffff0000000c0000000c00018008000100", @ANYRES32=r2, @ANYBLOB="0c00038004"], 0x2c}}, 0x0) 727.247918ms ago: executing program 5 (id=2261): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000005e00)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r1, 0x5460, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000002c0), 0x12) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4400ae8f, &(0x7f00000000c0)=@x86={0x60, 0x4, 0x9, 0x0, 0x8000000, 0x6, 0x10, 0x5, 0x0, 0x7f, 0x9, 0x1, 0x0, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, '\x00', 0x0, 0x1}) 718.36454ms ago: executing program 1 (id=2262): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000001300)=ANY=[@ANYBLOB="12010000000000205804115000000000000109022400010000000009040000050300000009210000000122940309058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) clock_nanosleep(0xc, 0x1, 0x0, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x1, 0x4, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e23, 0x0, @mcast1}}}, 0x108) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x36, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) close_range(r1, 0xffffffffffffffff, 0x0) socket(0x80000000000000a, 0x2, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) getsockopt$SO_TIMESTAMPING(r2, 0x1, 0x41, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) 673.725467ms ago: executing program 5 (id=2263): ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000140)) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r1 = dup3(r0, 0xffffffffffffffff, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000340)={@fd={0x66642a85, 0x0, r0}, @flat=@weak_binder={0x77622a85, 0x1000}, @flat=@binder={0x73622a85, 0xa, 0x2}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 620.773656ms ago: executing program 5 (id=2264): socket$inet_udp(0x2, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000080)={0x50, 0x0, r1, {0x7, 0x29, 0x9, 0xffffffff9080edc4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x2}}, 0x50) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x2c) syz_fuse_handle_req(r0, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x0, {0x0, 0x1c}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r0, &(0x7f00000063c0)="99529ca7d265e2dba44891e35e7d5dab7921b730436ecd4e999a25bcf86a25f8f029c0dd50373e90b7cf7779b12ecd4423c5b13cfac186975cd723976f3c747612913029d42517c189364bc59d8ebad53ed1b86f8f66c99b1f9b5b40d78cef1f14f81815d53bdca7fef40607358db69eb8c0b1f6b0942ab4b1ee7ca8deb4eddef06381a3d1c52d6147fc5109c7c607591497a6b2477f60cc881d3219c96bffb34aadec3fa97250713cce17cd536721bf9c40a019531ed0bbad139e26a3d4d39b68ab1bf37cb1a4bd197a8789cb1940cd86d9e56713bc36c7cffd07a311f5bc2e91f16d152eb480645e85ec9b3bf09c7fa140dced0afd55d7b99e90a96e7748e2d0dc09672ac199ce529e631efe1783769819c182ca106f6184bcbb387ed246c43562d74c36ac3a7ec2f0e11f70bad0007c03bb9c0d2dacc2148cce4a4aea327c7319016ad146b52bfae0357f9e892e9bec61a13c93551cfa3d4f4bfa7585c93bb0bef01a9114f3dc54179cf9a57fe88f5cff3403e33c9d09e3e9c2e10f1f16894e1b59e3cad47c1f202cf7b756f2851fc96d09459c9a8d34c19e6a3525cd5001aac5181f57286d0e1e88ce5092c7c76b6abdaebf2c499aa47587b48eb12a2b72548c190b0324ebedb81a63333b6edb25550f859c5ccc404a944ff7f61af8800888192fbd4c8e0e417d1d181b4b335a6f52e0a7dae18397e81e3f747cab7be902ed903bdd6a622f178f9b4244718ee1206237257374d2fd1466ab6135ef7ef4a114ae170eafe9cd78cf9ffc36974cbc4b8003072bed78765a0b9f1240f24dec6a9e46db9bb498d40f727c0cbf8f4a6a49539bd0805caf65d80130d7fb60a69dc7ed890874a17530c042cf33a977d331435d68ef33885f638c777ad49564ca77d8b81ddd853a21cd55d95b627310dd633a4f005853a5506cd8f744c367f3cb6998b0fa97de6bb35b166b0c6408c4e0a38ed26235a88520c38ca97ac8a6dc81e6dc6483d383fa09f198997b8eea1c68c9e3320683c9a02dd89ddc34c241e7294ccc88d6b35762892e8746e558bfbc2251949f2ecb763dad5b975eaf36e2864be6a41d3e20514d32f5d4b6350dc7e3cc3a85428ea98efb3b1edc2a2ec1e618452949cc7e2ba1251990168fee342d4f304b7a7af9162bcbe6b09c75d7420d2c547b4e3cee1836df6eddd5dff73a4e308fcd8eaa7a33e6980a6f8ead03257a37d72d3b265d02fa42f57db877654ed513e31c35e1af0bd28511d6b57cfe07b27cbe9767a534b426dfc3dd257d5899444f34cbf4dc74b9eab2e7e3e1e1a8a6ac5e4359d653506b299a5b7c67b92dc462f1216655f952362a3387ad9966b606d98e8d1b544dc27dc6bc78fd18a446736e25c51143db9886b6c09812d5825b5d9e0932f218ff8bea4d9e1c4df9c9d4eb19336d48163a921c4ff1f0beef26b01b7e8c0d23fb59b84e229eaabb791f2cffc9aa4db75162cbfe4c9ae8d76a5b6bc4bff20e3f8f125b9aadb3e728d7f78d61fd55f46b7f59511b876e6563256686e44f25cf38d393a9b762bada272eba8df28e4086c4cd2fe3c9fab97756fb145373e6ca1991bb1ee6589e49c821ff29f047970819f88f724bd077cd3f0ae463d99b3e53078431e3f9bebabc5289a65479359efe3909186aac60a29f561de8c590988c913c9e693ab8106e8287f6565eee6735f7c88cad7124d1c8d9ff347e97912824088ee954de01c6d8a06447f06899607eadbfd078bc3df506252005749378dbd7399c9eca60b81dc0d88dedec31e5cf6e7b6d6d411958df8f9e0bf4443e8d3bdfe49d05f811d17088024d0629fc8ab8e05e309bf55e8e60d342623765f4e8d2dc4a90291cd4354ff9568c8170e6ea56e028bcf2719595253adb8c84050bb9ce4927a1c1f4560da87d109ceda90bbe45a1717763d8025f1ff40f157185ddf17079da272ae10c4f34162caf4b0d31221a57b3059fd449c87554d968a54b2eebd760dc3263c40d9eedf5905d5699d29706ea6e9e81ff2bf92489a06deffe7e978661f37a88450783e23f107c2bfce000dfc91c5fca49e46d9ea978f215a45984699f0d2503b30a741e13be56b7abe3e5663c0825c3cb04ead44ce97719c4ee6f4cdd3c452775ad7163d5c9034583cc2dbc2b0c04917a3e1aa3d0a8bb6fcf94d7922eb1d543c09185827aeb1b72ae7103ef2c014af2ff4b47fca40fb0e66ddf0264476d7a84e9b8dc551d4c407bdbac6757f7a25bd404b45bec1091696203cc438860131ad5f2fd80e3c45629864dd9f7d302b66fb8fb86735c9a6dcf8b135a273dd2ae9473bc905081be9fcb8f91b1ddba1ac692798dac0b9ccffe0319a779f5e10c65f294b22fe475283b023f9cd890e92c5447b1bc1528255c5af383bc1fb6e72cb9a67215a9e25cde63c89baa8c7125c7e8b748b728d07d9cb66778404f54e6a9e3ae1ae82f3d0ce77199f23f94a01b71b805b476fedbebeb52c83a1b857f23ba438c56a6c4c2a5909f721e6e3d240e4a16455e92220d13022ce7ec0b1365ba4e67aa6ecb324f8826579e12cebdfc0d8af63e83b5e5624d5b791f99093f9a27f7baea9fd10111209c0857a04f07408111063ef34026aee27a3d51b40e53883f9094402534bdd21cc49d7f5593e99cb204cd805bee4add0f82cf4b6dc5da14d6b79fbc68c9ccf7fb5fe774f8879e13079b024a8ad24bf123c420d630837a84ba05abf0ae4dc3fc04f25c7f74ff91d0d609c958642a48551e51b5c0074a56a7da10ce153b08cabea636f8489d8e7b655758a41d7f7474c9d76bf4d54d789bfceaffef139854065de6a94b0275a9626aab99ae838364b1a491e55017e4212b6b01f7a41bc9c215ecd17c49a8610db28c699259c58b81a0e84c45fd8e719c05c48501c49e8a6515044d247f58e4cd0bf22fd6ae31f45339d1f801196d426c52269b1aaffaf18e2a03760bb231cb7cefa6d72f1d7eb6a3bbd65d0914221b8fbf531dbd562eb4a1b28983ac7d83d4813b10b34c9525ba644f61a2c4800d4fe96a7bca63da1041ed73cc57fb9d42f9dfc8ca41d80292bbb311c89b0a0fcee1d88a025a7416863342aea00e6f049cb2ddebd17c5c617ff562a8af0c965cbe8341431a30ea239e4a62aa2b19757a3b0de04229a9907f8610c27b26591405845bf8b5b83706ed18d910c4f68777378366ff565617b19168a04560a32ce5ad64aaef9f4377118c4335b24826cdcde78fb4bdb11498553f56d8dfeb3a482c70cc6580c399b92339cbdb3464fcc7b00e9839fd0d2b8b6db90c56b33593a0048bf7983421f29b1285c81a239045b96a9b0cacd70d6d9853206471f06915efc8d3ec4c50fb13601abc73247a656066fd7b329159b3ce9e3302b4c0d6aec58cb0946a8ee8e7f55f1af604f1edb4d887fa6292dc0ce57705c1a25dc62650c127d11a364b397aefc2fcc3a164bdc53165a461b01de9180c1461b309c75af0911b4cc1b8aa05652b62119c87b4b235c573aa15b1516cddf61efd6a7f8c953fbaaee9c0e800e8f519e1494de850ddb976864088fe0cf90bbc54395078ea2501e8baa84d6807e184105bc2a140b663416496886422643bbf764d406af06e7d086678828defda0b648b25666b7b5ea29e927141740d5be0e61bf25d40b8404ffd3c67bb855b11d4faf82b7b8051615c101c3deb0601a0fa9ecd8b4a95082ccbc8222b0982802dd8430e653d6eea2786dc3a91397135faffdc65a5bae048f5c463b1a6648becce961d39d063d28d1ad6dafcea0b0878379adb16cc0d4cea572abeacd9a168a4fe2e338092b5bc93ecf02ac6ccda03e5b23adf511fdf7a79442093233b79c67d3fdd3c36c96a8f67aa79e4743d99cf963ae6161877f73656eb0314d889f4b8649bbce8a759f90eac6c006197b54b2bbac7c9b237f1e3dc099c62a65481960e6ad697fc66316ac084ba99c60f58bf44ff45f3b2006cbc4196a25f124dfaf247e863a855ef6070deb45219a922dcf2be9bd01c340e1ca5ed7c3ddac9f7a677c5d00610991d21e0751ac8044585b39f3fec5b672a11a9bce32196c2003d01ea50b0f0403e16df188ecbbb74f295f01398363ddfecdb63a49347c912c125670205d7b6be999688df85bb7d5ac12b62b4fdc4eadcc2a9a7897028404f697b007603a0ad588c772952d6670ee870771774ad157c0b9cccd4b2192d835606198ea0c65036ae4e406cdc539ff3aa81fa20b7ab58d6f3abdb69cc1f503d593f7025d2035e7f21db76336efc2843a0dc9bd2eb8794718134ee68fc57d4d2bcc18969d08177f442b87433b48540c661940cf9e2462c53efa310c7e47487deab2ae15b1978ef05aa1e14110943f649d82486f710a39854409e74edcaf06b4a92d3580b9cdabf83c6351657698d3d5af7514f382e75d1c912cded577258603fc9ed002e010747cddf7885d34afc9a84d82696c6660cb5ecafb68b564908fc49c4db6a187d037241a26b1141cf20f2e968a53366db0f60b79cd98cf3c897c50b7b9728e6e7100f99e4d5ed2428dbd285516ca6660777a39b4b2617c1be5b0232d60b9c8099f5daedbf190109439c40b46090985200d6c0501313f3fa4d244864575c275faca47aeff32c7b3e3c59392618562a7c2d4b3af85a37a8847f595352024cb63d3a9085c2a502c6a3248f43c5fc828e636cb634b2d393d853ae2dc9605985cf85c060860a90256c7b574c1e01c320687a2bb0b2d51cc2950c485f2ffa5db0ad7aaf753f543de7f86efb775c6bac2989a33757a28836fd27f9347229a0004bd2e546994c69c678fe5717f613f905d945c072004c3a80e0e54215e19ff9972521890d4e705e429f16fc35fe5a15f2e6b75cd719d38f76b087b62e4b5dcdb35f4baa2bab167150bafb6c69e260ca51004bc826d46b77c3f67eaa08497294868e6d91b7b867e4da62052f4f891677256cfbaf19cf32bad99a7da69d8a66537686f89a58d78c7eeaa99cd38009a1a32582bedc5c718e57b19cd405ae659a89909356a07fcef89384d160fa5ae6683cc379642aea4f0c915f72d679bd521399cb16112f2abdede3001400b4a64d2173e153a68631183679b56b8f389ba889784133453a7e892fd3b092f5040870a3cfd6f982990143e7c0882b4ff4c5d049192d36925a25ae4be441aa30dc7e74398b340c45b52c73ed3b0cd640e3cc9fd4be24e7355f386106f65895f1ee850b2a781d1d1d322ca5a3b0fdb78ce1eda048ece94af25437969c99c58c08f1446ca5541e03987a20fd75283e3e116dc4c9222ab7522e4ccf6da14aef49cac9a6a2cd4aba1c54d49e6da4179a66b84e384cd3da53908579b28c11d525ebdc4dc69074cef8a9ecd3aab98f2858769d656b46141c3a4e69a5ed6c0a732c9ec1fce080eaebf537fa5e17236a44ba9c931f555d193e475ffafd20c53ccbab607c1a15fd06742a64691205eb0d00f7f40e4dd8efb279cf09b2522aac0729a631aacb92d5cfa2ce6bb07385b981890b5916755d5cc3a51c8c36bd2987068cc24fcf73840895469bbb9aff1059601f771afedf0a48d5921103920515b27d7e607951982feba197df8c61600feb3622b9eea13a4db4068728cb98cca76cfae197f6258758490bf41673ee29acd91fd296ec863c646e0ca6a0f0e9de146c663ba13d962964d7c32804fd12a14c1ca7212ad48bdfab469c6570dca562220ecbe7b6b163ed4c9361c5c10bed5c92861b8786ada20a99245d282e4454187ec02adfe354e30647cb10661c85168f7958e3ce69ab48c9455214707a63c9b1167f0845a6bfcce2a96cd53eab430f13cd527f1666290719a47c517cfa22fec2e9916af8aa93c78e567993d7fb8ee60fc4b903b8c67a3658302c5e5f35250c30427e4c055b6c54705bc599861f80b7200d361965ff98c88cc698a2615cadeac4bdfd3d613377cea52d2bbcb7e6b78ac31d4b2c33eaf0b2ed40b963e3cb25c7dfea3ebfe7b4aff2aaaaf184dc80ab649a108e2c830ce7eaea58a263392aa9cd13d7f7bd607dc7c804b19dfa41b3e5a5155201a87311e22062c93896e70f3a5c4b03521300b61cc311ebd5beb9838d0ed207c6bfc99e4392508e95804b10b36024f32e1fe1138e9ee7773f797b2bc6be7416f4e9691ef4c2a8d06af6c8b84bd1e6fd1ba3d3183475ef6c139ccf8dcf37671fbb96a2ab5e0e042f7c4728cf30bcc1a0de28a5024276ceaa194b4926e7f6a97b78bac36e47f832d56a96cd266434d37bcf2c2f57877717d91b1854972f832354acc207a2ee8caace7504e0e6197dd7e64a01c4c67bb2de8acc0cccc6c6bff0b0cbfe345542c5a795dfa48cc0990ab5702574d36494bc44c20f5b324f7c984d986cc8cb40cb2550076d96a069b6688d22171beed2dc5b6ff3ede8fff4c4a9de6d3817357a7ca7d24d87300b4545ebbac8cf7f09ec637a4f4d6bd07673709b6c363a75ccef585610c5f15de7851b5ab53e02a757bfc3caeb9a9a8996beffdc0cfd1201b6cd99cb035584e51a6c15a5d2e17d2f8aa6b41e26809392fac6caed1e02a53dcea8a413203608780dab33315a76eba24d540e4c5b9790420834bc8d4e47bc65ae52a54c0ff308427a8d7aff746aa6589d17514e40fee5d0b3533cf4ad2c5f9d96db9f50bd69ed8c92b860e199a35cf268c66ed13516a3b4b024f62d4b2a656067eece95575bdb4907efc488a9821bc3a9c81dd11b2128b7a01aa7a9ce6e73de3b4e9beced70206f91575baddbcbe5722337953c8016a0f4b62120d776c43b7d1a879b692107954f45acdf8967dcaa994aad4922d4fe093e16c2d0090906f5036af99e50bb09b04e9c9b3b5085abf621297ce203010249cede92e9b66b446b86b43eaaae228dfdd3b4408c12b404bb727f7e969e7da04fc59900112bf8d38af0416dc616e75f167aa1352215f07115a6f4eb6bb5fff6f5c2fc9ab906392036b44090e65fdaf017dc53bc94e0807d679d793df18cc44e6c846d414cef1569530f7692daf91eaaf4ae89fe2522f2c9cf33b6ca508ebcd006bc1a61f0c800553aff9dc7d57200b25ecb83e1e0b8cd29520b63aa649d3f71a62570eee56e03223ddf31f0c04fa686b7f6dd054e7a259d9ba335c2c5b2c508897506c0db7f01878dec1411c33f0af61b81dbcf9ff8bdc0c50044963a79f3ee1462150c6bd03a32dbdfef8d72f0b8b3a395ffb0cc85792e7bc867feb5e312cb64e29e193388e9f173c162f4a1320a6f99ea3795fb77d982605959909a1aa11076fcc779ea6b80ec1bf0edfc2569ec04d15a0bdeebccf3c75393dca5e81663532f8ced12d08e4c2ae6e2954d427c7bf053dc4718f56f453bc88d74045bd2f9747aae9b5298a0de927f1d6b1308f4e1483487f083e71ed09298deb52bb10079b13def7453eb432498069edb5ade70c5c54913684d934a3febf78753ac13300a91f467ff3f6e2f00898f015d08f7739047b321b3eaee5ad8aa7adbf7833f014d8c576a491af9fca6843b327ed513821cb3951b2e67a275225d7af6b382e2f955adaacba5d1fdea2223202dee132b91d5cf381b51da94145255f584a70c5e8d11e06a44afa6599bf3ed0cb61703eba254333af53afac60e54cf6397f9f7302249ab644f0b576c713b15007be1f4f9bb213660bca8a70251472b86669d361ef968f542e81ddbe8f4d2e9cabe8d7bf6a31f14a2cc272963553a424c105e7750437ec5bf316e30ce60b4b0c27ccc1eb27e60f6472fef27654da49905ff9c01b28695310ecd8701aedff25a83da4b7c41995f902bdf249769dcb53a3efa894710dd66ba8745ae2253cc6b75a038183a0bee21226d48239320efad6727093e4f94bbc2fdcc216200d903c32bb9f16dd17d5dac423ae0696f3decc576b8f1fdce63d0532370af7d1e2fa2ca5c5d17bd88f5e3abb4792dac8689ca13752f83d753b06b037bf5a80a3748983790352775685b0414c9d74849fd217e388f904278ddb6b0abdda941b61579c796e2bb77a9bc363b18642c401faa502a31011544111b6eedaa369976c814773d83220a75f31026d6ad0b8b4298ea6062234db232bc435e096e84f740e55bb14d46ae04af0500aa5bb218aff6c76aa8a8e3140a1b0d6638538fd7f30fa8d992e53abf8af2fbc16b9e8a668c1aac72cea1a746ee5f7f3392a4ec8f1d19f2f426b6069b1cd347cbc38bceba96ce5da49198083403143c740c04639cd1089abb34fe812d85921c47437604f684bca44a1eaa965c0a6e1c1fd1f70ee932af3455b36184cc15934cdb3f28959d37d8fc10696f8ec1e4b0c3d1b9ff74a01b796d1bb68954a3768c8bcec741b3b69da892f8922142b16b2cabb469a9906b34216243fac80374c10e178c5fd36440f8d7a8588a9c2510d86ffa8cb68ce8c330d2111c94724e522f04573dad43bce252eb505d29ca9379a6b281519d38b7174f3ae8f185544f3003c936a7e6b23ca97a313aac6a061caa45fda73522f3061767bb4e33dbe4bde390eb0f07225a8aef939cb6ab2ada10c02527281abad394cd4ea9f59467a08b72047cdb75d7b2b98e5b4542554a60f953ac7a4b980f42518eec05ff2c044549cab0cf33eef36dfbabcbc0300009d898862d2194cfcdd9a713c30bbe52291105193656ea5eb830873ac956469d31689cc3c69edb5cb9a6e31ce3e6fb50ddd4e52ef9fdeacfc0db21e1e83e0d8d0a64f17cacb4dc208a893e7fd8ffa86cfc554dfba3d9fd281115eccb4b9d909f2fbf3fbb66bedd7b5db3f6d4f076f5d8fb54f8832896f8ef6f624162f1dd589be7a8e87dd5065708a8b0bfb18a5c2299f5605ac8a11c1add55b2018e6099380a70bee3e0727ca6ec58928fe6eb3147b47401e8d822eebade713b58335787669e5e0de5d328a1067df4cd9124665bb02ee8adfd1b3618374ef167df1f0fe79456f78aee3da4c1bf397e4637b0cf41a0f4a2910efd02b17bf5f3c15b0084b36fa7d4e85a53e5be366b428244eeba7499c3e54397227928e2ff6e583f332d6f7e8cf4d058f379b58a7d03a4bfa454bb4b6d543804b8970e6a9fe8886179eb418a8ce9e509e8433571f7d32378f2e983fa418c8c91760ec9fb20968e7fc23b7c4ac71693b2576ac0f8ce2020ff1e7a7ff24301b48b544fb29a1ca4f2502daded865e488a16dd33ec67b2eee3025cdc5ef90f253c4b5e0a61d51e495b675c5a1d55b4ba3812c5f44cd08487e61d36b0c2dc32d27333a5ee8a0906bfbcd388bd9389d1509912c0471c7b706a5aff880569a3fb11ac5f14d780deb4c1b1afe30fb6b8daf87b27a4ceb869d587a97f2f5af8d819aa47bbf207db68a6ecbbefb1e109ed0bfbbf3b54fba9e79de8fad9c3bcd3e74b8b92ccea3ff5c558c6cd72d78a711fc39df603bd4aa1439dd302258edd2204e52d7f435c6f552b612fbc321bea971195cd4d8bb033e2a779e239164d7eea6d8fd233b0b9b776246564cfcf44b31a83031a2413bf98a398c9f93da243cef9ce73d81bade8ad551fb0ffa75bc874c11d23ac9d7752f22a0f54c3870f3314a83e64332db810da1ebb288e10c4eb9be9ec037317b8f813e68160a887da3f5c0389510a0734b69ef275e19973b169d340610cf2112e9964cc0566b9b690c3feb36c8526491d3a563f0bead2abbcf0665e048aa3f929351b2f89876580633a403250ae3b5244c8c0e996bf888938dfc8920348d88e272e6eadc7c0387ca1dae228bd620ce3975d43b58758d9412d304a227245587065f58c4573ba2557f1d8333ba007709b1239d682f03405b22135757178fb701bbde81d2f8faaa7666c025d8a8bb426dc4b8e61aed79b3b3d3a9b01ee9142772d869677ede166e7a8be8ab84cdd6946b1478ce77ba307213971cfb24c86c344310f279e38d22254bf4caf83c02e715cb0550e615dc9f8dd2400fa749e3527493c15fb454c158e4c0603ae6e962b7890058ec7c10f0618ee274a15bca6ca9fe5bc5f9e7797c0950299912be9c58463c07d667d4bffe8aa590ae43db08512b40f3d265026bef2facdd508984e5f6d2ac7ef573397f14ed2e2ccdcbe5796e60ae64d173814906d1da5a5bfe8a2a4c5d6bb0b3315b878b4877d0c045f6e6cfa0dfc1ea4de7abe26f2b2d8c93299ed1d83f1b7853c756bfa346cd53b008fec169883983fe0f2405777dd85e17b2e4e8b23432c0dc4c386d67b6597184d0b4b95877362304638484cc0951400f66ee8391dd44417c58b3d46a8345a8049fcd70f7b5f4a6f912e2b18760947c74ef2b732b342878d7e7cc99902de87db36469555fbbfe76189f108d6ab31f4727fe4e22d075afaf6cc726ab17a5e1b4ab6c8f29a459da3c4266b5ad8ff55906a190f8b19a3bb92a50df49647c03d5d6106ec07e9300038d059a75b54ac31683ef8e5eee946e1c84d016ee1e7800a92c0a3823b62e0417fe86b191951f65abc0c38c1e0e8f1121a04b62a8a720790560f922804b1b7e7eaa497e1bede6e3d0dcf0312dbf221561958fa1e85a8f99e6fc82f919e78c17d1beda16cfef25fb5d00f7c32df9a51eac76000c988ffdf011564aa0e319764b16a5a7c728a470ff70772fb76c9ada26a0ac073fcbfa12501c2454b19e02d928e3939a40bfff76c002533b3849cdf8016728445131e5f1e292b7d3dc06bb3a3cfff6fabae0b7341694a8938c1d2497cd70b76c337c9a312e96c8f736d7625a535e1906eba53d199221ca60202a65be0f7e530aca10e61fa39c7601d65954e5ed4cab94345c6b89c7f8a0de5c61a7945e1564731b6715331d13263b2961a163382f7c4934d847033860e402f3aadb4f3e6cf47a97a2031401da4d2c8de8c80cdad71b97b4deb2075a02282f958ac6772354e67f097ca693778224b80892490015e7d697fb9107f75cea708178ffec93fb1d44e8493bad1d42c918e661219ea819e0200759037a5a585c0fe074fd407536fe58013f42612c41bfc66e16870d7a9c00ee93a3122b253fecbf5de3837641f4a1376af0f053463413c26c29f9a346318565276856b963da30ba6ab8c4c8ef6cfddc432328586d9d9829895835759bcde0851ae0c838a3927ea63fe5ba793fae94da61cab00fc05f3a265a2da1221bb2b66775ed7ba856b41011652d4984991e56249360ddfc997245ac1547a1c16382d42df383a8d1c852643b24895c422712e79c436fdfffece4ed1c50922d4f25296aaf6b204522086d188bee254f8303b60537ead1195ac5dd301286f0042dd68aa05a70e4beb779aa0b61a316f736b72c9ab7ed860a0908a078f4b8a53f2df0abf993f689de4b02b9138ca5047fb0bfc9ba3b92bff033e36fc9553260b008cef3d147c62d1d3944fd1eaff79bc5a922ec2190907bfda1b51c2c7fb867db1f8e13a37b5e3ae0165e93350b958a239ec1f2b78561cff854b975307b5b5dd23b040602a5a36bd79947ee04c7d0e5e30f9c4c79f7b4e6eada98bfc6c357cdf8939213423f1b21ba26cfc2b2756ea3eb992372db0ab8a7c37d8ae96bf3ed6be873c1891550ef741812032e1ae938326c399ee43a3061602dda006f1b6b620bebb6a5752bee77e8acf9921ebf4d4c8af7eb5e937c65697c0664c594e31a62377a25605051996c474ca322ce8e0e6ef8a7988be", 0x2000, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="d800000000"], 0x0, 0x0, 0x0}) getdents64(r2, 0x0, 0x0) getdents(r2, 0x0, 0x3705) r3 = socket$netlink(0x10, 0x3, 0x0) writev(r3, &(0x7f0000000000)=[{&(0x7f0000000280)="390000001300090468fe0700000000001000ff3f04000000480100100000000004002b000a00010014a4ee1ee438d2fd000000000000007208", 0x39}], 0x1) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={0x34, 0x14, 0x1, 0x4, 0x25dfdbfe, {0xa}, [@typed={0x4}, @nested={0x8, 0x8, 0x0, 0x1, [@nested={0x4, 0x147}]}, @nested={0x14, 0x2, 0x0, 0x1, [@generic="bf74a7dffdd8f8331b9dd3f2f9834b7f"]}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000804}, 0x4800) r5 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) setsockopt$nfc_llcp_NFC_LLCP_MIUX(r5, 0x118, 0x1, 0x0, 0x0) writev(r3, &(0x7f0000000040)=[{&(0x7f0000000380)="3900000013000318680907070000000f0000ff3f04000000170a001700000000040037000f00030001332564aaee7b1d58b9a64411f6bbf44d", 0x39}], 0x1) 433.191157ms ago: executing program 4 (id=2268): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002001100000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x8090) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[], 0x44}}, 0x0) r4 = dup(r0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) 314.341577ms ago: executing program 2 (id=2269): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x0, 0x800300, &(0x7f0000000080)={&(0x7f0000000400)={0x2, 0xa, 0x5, 0x3, 0x2, 0x0, 0x70bd2c, 0x25dfdbfd}, 0x10}}, 0x40004) 314.050587ms ago: executing program 4 (id=2270): mkdirat(0xffffffffffffffff, &(0x7f0000000200)='./file0\x00', 0x0) r0 = open$dir(&(0x7f0000000880)='./file0\x00', 0x404800, 0x0) unlinkat(r0, &(0x7f00000008c0)='./file0\x00', 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) accept$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @multicast2}}, &(0x7f0000000480)=0xfffffffffffffd4a) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') lseek(r3, 0x3, 0x0) getdents64(r3, &(0x7f0000000200)=""/70, 0x46) socket(0x1d, 0x3, 0x0) r4 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x753803, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0xb, 0x10, r4, 0xb522f000) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x143802, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f00000006c0)={'wg2\x00', 0x0}) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/cpuinfo\x00', 0x0, 0x0) ioctl$KVM_SET_CPUID(r3, 0x4008ae8a, 0x0) bind$tipc(r6, &(0x7f0000000100)=@name={0x1e, 0x2, 0x1, {{0x43, 0x1}, 0x3}}, 0x10) userfaultfd(0x80800) sendmsg$inet(r6, &(0x7f0000000840)={&(0x7f00000000c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x26}}, 0x10, &(0x7f0000000640)=[{&(0x7f0000000280)="69d062d2d9fc57915b574c7db437e8c0540d7ab7119a5ecf3b90964359a8808e94fdb332294700000000dcf92957a0c204191ac5adebf7d59c9da4ce91e90344c89aeb02e2a9f7b350b8eb9828fe268147b33d2a69075c3e2f", 0x59}, {&(0x7f0000000300)="45e703997823d134ab38c28f2a8f669ea135816fd81dee01c9de4b9fbe5ba219b50ae00170038516a791afe23997ab52a07929ca7a978af8fb0976ce784f117167b15143b6f6f3c17f4f4d2f380a8eb926d52cfe2f4dfdee05f34b91129100828c272e1b5cb2e9bb190a42e8e91c386a599500ea7454e49096e507d956a7aa2ee6467669fc21a4b2edd5a27b209864da412e1216cc043b702def6de7a65cfde40b9c0feb9793f7aa61fa1bddd7bae15d44261e5da42710df83a9d970", 0xbc}, {&(0x7f00000003c0)="f998e7b5ba0da463dfa754f95a29851cfaa0bfa36f1a48fcc6e76aac3bcf11bebc8d46093aedc03ba4c8e04846a82e466d63a9ba162b6367cc0a0c078a4ed2d986c47cf21c0a79644daaec20c7fd6287829cdc941052bc7b6fa6794c7239a27ee0f9908d6ccf2c486107498a8d692fe4fccc278813fbd2f5efd633079cb33b000000", 0x82}, {&(0x7f00000009c0)="203075a0e2413a7ce2619f196234c615eb067ff70f8ab6c921dd2995192ae29d93a7e74f40af41e7be0cfdb3c374abd70d87bba3575fd323299f07c333de739d12396eb40d144a8ad1538c1ac0f8d5ad7c3f6a822d51a7c7e6398baecc4f72f1fd6c941b131b92358e5a0f4fc3935c1b2a762cac8d0f7d3d26e722aa2446f00bbbcb", 0x82}, {&(0x7f0000000500)="8fb3e38d1faca0c6653bfa3b2ac0b961e2dc83c0bbc49010f2f01b7f09752a85883e837101a30924138450970223e68d3541c8629d63e29a4f8ebdad3c4629853176e709bb5c57a6d9f9a5e31516998fc73a9acafc356055469b904341e513aa4b1aba241dfda4ee5999120b2a695536d70aa1888d1d7c2225922e0a7d13dac53d65da512e05dc9d58f92290b5f84401a94c1a03c9a671c73eba97b636f508f481b4edd556887d7f424a30493c8c2f6d1b7cd297a045945f15152501d802522d505adc9af81757d5", 0xc8}, {&(0x7f0000000900)="ef55f065a7cf949ad8008c96a8791faad97a6eb7801c569a13784c1daf4fdb9a2018c84605a1184a329eee119da14b16afebf9eaed5d2c2f4314740b262defad27753b21bbcf8175265b28ae6e03b61a053cabba8ec5225bfe380934ee51174e92fb93c2ea58457de263078c0a2fc303dae654d78803d9ceccf22bf064cdbc34165edab948b96198f6718c58799afde087b38af74c9b63b2582f05cf35c6d64971204ee9", 0xa4}], 0x6, &(0x7f0000000700)=ANY=[@ANYBLOB="14000000000000000000000001000000ff03000000000000140000000000000000000000010000000200000000000000140000000000000000000000020000000000008000000000a8000000000000000000000007000000866f0000000001113f4405a0a66a0d52f6c5f4d210ccf0010e2b6ba0082130ea399e4fd85d0a12eba1d371e47394e875736749eb8c65d9021079b94952305f9656aea54706cb460310bd42cc2156ccbd03e117a913dbf006078d3f12e851050480a407098aaa42f3115d763ca1e401e10004ad098808d105886057658313dd00000000ffffffffe00000020000000001440c3183ac14141800000003001400000000000000000000000100000003000000000000001c00"/280, @ANYRES32=r5, @ANYBLOB="0000000180af00"], 0x128}, 0x4844) r7 = dup(r2) r8 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x40982, 0x0) ioctl$TIOCSETD(r8, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r8, 0x400455c8, 0x4) ioctl$TCFLSH(r8, 0x800455ca, 0x2) r9 = socket$unix(0x1, 0x5, 0x0) flock(r9, 0xb) r10 = socket$inet6(0xa, 0x2, 0x0) getsockopt$IP6T_SO_GET_INFO(r10, 0x29, 0x40, &(0x7f0000000180)={'security\x00', 0x0, [0x6, 0x0, 0x8, 0x6, 0x17]}, &(0x7f0000000240)=0x54) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='r3dno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r7, @ANYBLOB=',msize=0x0000000000001000,k']) 235.23261ms ago: executing program 2 (id=2271): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000005e00)) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000002c0), 0x12) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f00000000c0)=@x86={0x60, 0x4, 0x9, 0x0, 0x8000000, 0x6, 0x10, 0x5, 0x0, 0x7f, 0x9, 0x1, 0x0, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, '\x00', 0x0, 0x1}) 193.292998ms ago: executing program 4 (id=2272): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f00000015c0)=ANY=[@ANYBLOB="0a0088a80180c2000002aaaaaaaaaabb86dd694f9206"], 0x1222) 112.069781ms ago: executing program 2 (id=2273): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001c00210000000000000000000700000016000000020000210a0002"], 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x50) 51.157991ms ago: executing program 2 (id=2274): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x40000073, 0x0, 0x100}]}) syz_open_dev$evdev(&(0x7f0000000200), 0x2, 0x40800) (async) r3 = syz_open_dev$evdev(&(0x7f0000000200), 0x2, 0x40800) ioctl$EVIOCSKEYCODE_V2(r3, 0x40284504, &(0x7f0000000000)={0x2, 0x1, 0x7f, 0x2, "aa9485eba56b29482f2fd37987d43b946701d3929596f415af592498a08390bd"}) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003500)='./binderfs/binder-control\x00', 0x800, 0x0) syz_usb_connect(0x0, 0x223, &(0x7f0000000240)={{0x12, 0x1, 0x300, 0x9d, 0x8, 0x1e, 0x10, 0x1bc7, 0x10b0, 0x929f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x211, 0x1, 0x9, 0x8, 0x10, 0x1, "", [{{0x9, 0x4, 0x6e, 0x6, 0x9, 0xff, 0xff, 0x60, 0x33, [], [{{0x9, 0x5, 0x80, 0x10, 0x10, 0x3, 0x8b, 0xb}}, {{0x9, 0x5, 0x7, 0x1, 0x0, 0x9, 0x9, 0x7f}}, {{0x9, 0x5, 0xb, 0x3, 0x400, 0x22, 0x8f, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0x2, 0x8}]}}, {{0x9, 0x5, 0x4, 0x0, 0x9140ad3853133ee4, 0x6, 0x7, 0x7f, [@generic={0x21, 0x11, "21c9292308bc54043f04fd4db6ae19503997ef85615ccf18d46b7d800d23c4"}]}}, {{0x9, 0x5, 0xf, 0x8, 0x8, 0xb, 0x4, 0xe}}, {{0x9, 0x5, 0x80, 0x0, 0x10, 0x2, 0x3, 0x3}}, {{0x9, 0x5, 0x1, 0xc, 0x10, 0x6, 0x70, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0xf, 0x1}, @generic={0xc2, 0x21, "6e38bee46d8d8dbc3b6e9dd4b0076f264a0527c9d40f6b6793b354161050857c6a3d1b8ef14672ef979deda3609d530299f240385dd6cecca6c6ba1df7baf75199e435df34ead9fa6b3652cf381020edd4845610c30f6f17cbf018a23c4e72f19cc286985cefd826a3f48e1b020369c32fe9bf851ead6f12dcaf4502605b9549b58e20f6287fe3e928903a3fd006377e8da246989a904e8c7888f89624cf470433623c395808a2765d528646e88f68c29ff7aa10363ebdca8ccc17ccf99365e6"}]}}, {{0x9, 0x5, 0xb, 0x10, 0x400, 0x3, 0xb3, 0x3, [@generic={0x8b, 0x30, "85443edd9863327537f465dbc118e481a0ac5229bcec51e879e77f7d0d65aea5dfc88267f38fda590d6e0eb056b30e87bc59cde51c969dd3ae7c03f492ff3e4e50fed095277b29ca437c98a02749d23123168f0c3b2f856f74175391d8a772eca253ab7b866917ed7fb8ba349a00141d97c267d6b41816087bc5dc776386f025ad16c4cb75fb769258"}, @generic={0x32, 0x5, "be07be513b326e5f646c31334e4cacda855a91248a7079c5f07f4ed3153139aad74230d9df310b4f66a2d811d8ae590d"}]}}, {{0x9, 0x5, 0x4, 0x10, 0x400, 0x60, 0x82, 0xe}}]}}]}}]}}, &(0x7f0000000840)={0xa, &(0x7f0000000480)={0xa, 0x6, 0x110, 0x7, 0x3, 0x1a, 0x20, 0x4}, 0xec, &(0x7f00000004c0)={0x5, 0xf, 0xec, 0x6, [@generic={0x75, 0x10, 0x1, "276403b91b3d14bc8eed1913c779719c3bdbf3fce3cf53acc2e80193e439c4dadcfb609a9a6b64c2f91054b9213b5e7a3f71b86a7b981098379a6809278f26696a3ff493c86256436165bee3907a55d6e63d3b9a2e96b90960a005cb5b7036b2b33ddae607d00c8b35b2a2d3bef98a244f23"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "c168adb9f9bc812c5f294f8da2a8f7b9"}, @ss_container_id={0x14, 0x10, 0x4, 0xf0, "fcb86eca258e8409b0542638eb458e70"}, @ssp_cap={0x20, 0x10, 0xa, 0x4, 0x5, 0x8001, 0xf000, 0xa, [0xc000, 0xc0c0, 0xf, 0x30, 0x0]}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x36, 0x3, 0x3}, @ssp_cap={0x20, 0x10, 0xa, 0x2, 0x5, 0x3ff, 0xf01e, 0x1, [0xfe80ff, 0x60, 0xffc0, 0xc000, 0xff0030]}]}, 0x6, [{0xe9, &(0x7f00000005c0)=@string={0xe9, 0x3, "237ea3653026a8ffa3298c83a87d39866d06b4713b39b919a7ccb53f153e1a3b8b66b15a7a52580a6bbaaff56466bc77c70200b6feb8ca52a8a788f393093b491f03b0f40c579fba6c25db5e9cec228d90163d1231d8b52cda9050d9c5462ab382d0fcd5e2d3d66b6454b217acc720d7ea179dbbdcd5e1e9902463708a1936bf1462532d717d5c5752576d569c72c3b940529ca2a025edf00823eb3129617f927d6a742e919aed1d8134fad9220a369597e94a6c376d20de184eb33bd60f874193cd23af500ec24cf14cb3aac40566c43157a784704a364d6225d65ffdc3d574776f5e3e474807"}}, {0x59, &(0x7f00000006c0)=@string={0x59, 0x3, "0bead9d2896f2ba42352296d98e856cac9fc157f7e408b585508fbc94abcbe651cbbe5a93836451dd7cc6283f2a00d5bd75440218801eaed351615b479426720a3d7372b904487ecb8f592c9c2d6364705fd9d57e0d029"}}, {0x4, &(0x7f0000000740)=@lang_id={0x4, 0x3, 0x1401}}, {0x4, &(0x7f0000000780)=@lang_id={0x4, 0x3, 0x2409}}, {0x4, &(0x7f00000007c0)=@lang_id={0x4, 0x3, 0x1809}}, {0x4, &(0x7f0000000800)=@lang_id={0x4, 0x3, 0x40c}}]}) ioctl$BINDER_CTL_ADD(r4, 0xc1086201, &(0x7f0000003540)={'binder0\x00'}) 44.121143ms ago: executing program 4 (id=2275): r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) bind$can_raw(r0, &(0x7f00000001c0)={0x1d, r1}, 0x10) sendmsg$can_raw(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@can={{0x2, 0x0, 0x1, 0x1}, 0x8}, 0x10}}, 0xd209f6d81482fb57) 30.792054ms ago: executing program 4 (id=2276): r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000100), 0x2) r1 = memfd_create(&(0x7f0000000340)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\xdenJ\xeb\x87\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\x008\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38\x14\xcb\xfa\xb3j\x92\f\xe0\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xd9w\\\xf0\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xd9\xbd\xd9\xaf\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x2) ftruncate(r1, 0xffff) fcntl$addseals(r1, 0x409, 0x7) r2 = ioctl$UDMABUF_CREATE(r0, 0x40187542, &(0x7f0000000140)={r1, 0x0, 0x0, 0x4000}) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x200000a, 0x11, r2, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 0s ago: executing program 4 (id=2277): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000100), 0xffffffffffffffff) syz_usb_connect(0x3, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="1201000092ecc620ac0500773aeb010203010902240001000020000904c40102fffd018009f80202100202000009058202", @ANYRESDEC], 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) kernel console output (not intermixed with test programs): T4945] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 176.942438][ T4945] RIP: 0033:0x7ff088f9c819 [ 176.942457][ T4945] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 176.942473][ T4945] RSP: 002b:00007ff089eb0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 176.942496][ T4945] RAX: ffffffffffffffda RBX: 00007ff089215fa0 RCX: 00007ff088f9c819 [ 176.942512][ T4945] RDX: 000000000000007a RSI: 0000200000002140 RDI: 0000000000000003 [ 176.942526][ T4945] RBP: 00007ff089eb0090 R08: 0000000000000000 R09: 0000000000000000 [ 176.942539][ T4945] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 176.942551][ T4945] R13: 00007ff089216038 R14: 00007ff089215fa0 R15: 00007ffffc4bb078 [ 176.942568][ T4945] [ 177.150901][ T380] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 177.166907][ T339] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 177.174958][ T380] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 177.182695][ T339] usb 5-1: Product: syz [ 177.255564][ T339] usb 5-1: Manufacturer: syz [ 177.260390][ T339] usb 5-1: SerialNumber: syz [ 177.275417][ T339] r8152-cfgselector 5-1: Unknown version 0x0000 [ 177.281745][ T339] r8152-cfgselector 5-1: config 0 descriptor?? [ 177.529666][ T4959] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1820'. [ 177.565276][ T4964] fuse: Unknown parameter 'user_id00000000000000000000' [ 177.716010][ T36] audit: type=1400 audit(1776112232.609:570): avc: denied { setattr } for pid=4922 comm="syz.4.1806" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 177.716484][ T31] r8152-cfgselector 5-1: USB disconnect, device number 22 [ 177.992654][ T380] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 178.003578][ T380] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 178.013283][ T380] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 178.022787][ T380] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -32 [ 178.224845][ T4967] binder: Unknown parameter '00000000000000000003' [ 178.297076][ T4981] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1829'. [ 179.070675][ T380] usb 3-1: USB disconnect, device number 71 [ 179.087295][ T4998] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 179.097726][ T4998] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 179.223483][ T5009] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1839'. [ 179.285457][ T5014] binder: Unknown parameter '00000000000000000003' [ 179.485536][ T5031] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1849'. [ 179.543716][ T339] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 179.544011][ T5036] syzkaller0: entered promiscuous mode [ 179.556843][ T5036] syzkaller0: entered allmulticast mode [ 179.579790][ T36] audit: type=1400 audit(1776112234.469:571): avc: denied { read } for pid=5037 comm="syz.4.1852" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 179.628930][ T5040] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 179.640942][ T5040] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 179.681587][ T5046] netlink: 'syz.2.1856': attribute type 3 has an invalid length. [ 179.699991][ T5048] netlink: 228 bytes leftover after parsing attributes in process `syz.2.1857'. [ 179.703698][ T339] usb 2-1: Using ep0 maxpacket: 8 [ 179.718831][ T339] usb 2-1: config 3 has an invalid descriptor of length 0, skipping remainder of the config [ 179.730773][ T339] usb 2-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice=95.29 [ 179.731546][ T5051] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1858'. [ 179.740399][ T339] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 179.759032][ T339] usb 2-1: Product: syz [ 179.763796][ T339] usb 2-1: Manufacturer: syz [ 179.768623][ T339] usb 2-1: SerialNumber: syz [ 179.813721][ T10] usb 5-1: new low-speed USB device number 23 using dummy_hcd [ 179.963687][ T10] usb 5-1: Invalid ep0 maxpacket: 16 [ 179.982087][ T339] usbserial_generic 2-1:3.0: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 179.993418][ T339] usbserial_generic 2-1:3.0: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 180.004353][ T339] usbserial_generic 2-1:3.0: device has no bulk endpoints [ 180.014284][ T339] usb 2-1: USB disconnect, device number 73 [ 180.033765][ T9] usb 3-1: new high-speed USB device number 72 using dummy_hcd [ 180.093730][ T10] usb 5-1: new low-speed USB device number 24 using dummy_hcd [ 180.183678][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 180.190174][ T9] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 180.199663][ T9] usb 3-1: config 0 has no interface number 0 [ 180.206032][ T9] usb 3-1: config 0 interface 184 altsetting 7 endpoint 0x82 has invalid maxpacket 59136, setting to 1024 [ 180.218436][ T9] usb 3-1: config 0 interface 184 altsetting 7 bulk endpoint 0x82 has invalid maxpacket 1024 [ 180.228995][ T9] usb 3-1: config 0 interface 184 has no altsetting 0 [ 180.237638][ T9] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 180.246782][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 180.255443][ T10] usb 5-1: Invalid ep0 maxpacket: 16 [ 180.260917][ T10] usb usb5-port1: attempt power cycle [ 180.266687][ T9] usb 3-1: Product: syz [ 180.271447][ T9] usb 3-1: Manufacturer: syz [ 180.276193][ T9] usb 3-1: SerialNumber: syz [ 180.279667][ T36] audit: type=1400 audit(1776112235.169:572): avc: denied { lock } for pid=5064 comm="syz.0.1865" path="socket:[29535]" dev="sockfs" ino=29535 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 180.305314][ T9] usb 3-1: config 0 descriptor?? [ 180.312104][ T5065] tracefs: Bad value for 'mode' [ 180.312651][ T5057] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 180.317341][ T36] audit: type=1400 audit(1776112235.199:573): avc: denied { remount } for pid=5064 comm="syz.0.1865" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 180.325218][ T9] smsc75xx v1.0.0 [ 180.461280][ T36] audit: type=1400 audit(1776112235.349:574): avc: denied { unmount } for pid=3720 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 180.483393][ T5072] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 180.492214][ T5072] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 180.532904][ T5057] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 180.613752][ T10] usb 5-1: new low-speed USB device number 25 using dummy_hcd [ 180.633995][ T10] usb 5-1: Invalid ep0 maxpacket: 16 [ 180.763648][ T10] usb 5-1: new low-speed USB device number 26 using dummy_hcd [ 180.784000][ T10] usb 5-1: Invalid ep0 maxpacket: 16 [ 180.789418][ T10] usb usb5-port1: unable to enumerate USB device [ 180.853684][ T380] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 180.941167][ T9] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 180.952284][ T9] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 181.005081][ T380] usb 2-1: unable to get BOS descriptor or descriptor too short [ 181.013749][ T380] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 181.024009][ T380] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 181.034580][ T380] usb 2-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice=e1.40 [ 181.043802][ T380] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 181.052021][ T380] usb 2-1: Product: syz [ 181.056398][ T380] usb 2-1: Manufacturer: syz [ 181.061007][ T380] usb 2-1: SerialNumber: syz [ 181.069433][ T380] usb 2-1: selecting invalid altsetting 1 [ 181.075519][ T380] usb 2-1: unit 6 not found! [ 181.080584][ T380] usb 2-1: unit 2 not found! [ 181.087859][ T380] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 181.106638][ T310] udevd[310]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 181.241930][ T5093] netlink: 104 bytes leftover after parsing attributes in process `syz.0.1874'. [ 181.279044][ T5095] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 181.287869][ T5095] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 181.764287][ T9] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 181.775674][ T9] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 181.785451][ T9] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 181.795065][ T9] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -32 [ 181.884111][ T5102] tipc: Started in network mode [ 181.889077][ T5102] tipc: Node identity 2007ff, cluster identity 4711 [ 181.895820][ T5102] tipc: Node number set to 2099199 [ 181.910185][ T5107] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 181.918773][ T5107] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 181.927653][ T5107] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 181.936364][ T5107] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 181.945165][ T5107] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 181.953754][ T5107] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 181.964018][ T5107] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 181.972538][ T5107] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 182.688571][ T5128] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1887'. [ 182.713395][ T5133] fuse: Unknown parameter '0x0000000000000003' [ 182.804710][ T9] usb 3-1: USB disconnect, device number 72 [ 182.940590][ T5149] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1895'. [ 183.003570][ T380] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 183.026192][ T36] audit: type=1400 audit(1776112237.919:575): avc: denied { map } for pid=5153 comm="syz.2.1897" path="socket:[30833]" dev="sockfs" ino=30833 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 183.049432][ T36] audit: type=1400 audit(1776112237.919:576): avc: denied { read } for pid=5153 comm="syz.2.1897" path="socket:[30833]" dev="sockfs" ino=30833 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 183.063918][ T5156] FAULT_INJECTION: forcing a failure. [ 183.063918][ T5156] name failslab, interval 1, probability 0, space 0, times 0 [ 183.085365][ T5156] CPU: 0 UID: 0 PID: 5156 Comm: syz.2.1898 Not tainted syzkaller #0 962c4f53752c25f9427fc034aff9bf9776e8b502 [ 183.085400][ T5156] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 183.085413][ T5156] Call Trace: [ 183.085420][ T5156] [ 183.085428][ T5156] __dump_stack+0x21/0x30 [ 183.085458][ T5156] dump_stack_lvl+0x140/0x1c0 [ 183.085481][ T5156] ? __cfi_dump_stack_lvl+0x10/0x10 [ 183.085505][ T5156] ? mutex_unlock+0x90/0x240 [ 183.085526][ T5156] ? pcpu_alloc_noprof+0x13f0/0x13f0 [ 183.085556][ T5156] dump_stack+0x19/0x20 [ 183.085577][ T5156] should_fail_ex+0x3d7/0x530 [ 183.085601][ T5156] should_failslab+0xac/0x100 [ 183.085619][ T5156] kmem_cache_alloc_node_noprof+0x45/0x420 [ 183.085645][ T5156] ? alloc_workqueue+0xb39/0x1cc0 [ 183.085670][ T5156] alloc_workqueue+0xb39/0x1cc0 [ 183.085694][ T5156] ? __cfi_alloc_workqueue+0x10/0x10 [ 183.085718][ T5156] ? dentry_needs_remove_privs+0x30/0x110 [ 183.085740][ T5156] ? ovl_path_type+0x1c1/0x3f0 [ 183.085762][ T5156] ? ovl_path_realdata+0x154/0x370 [ 183.085785][ T5156] sb_init_dio_done_wq+0x2f/0x90 [ 183.085810][ T5156] backing_file_write_iter+0x3fc/0x890 [ 183.085832][ T5156] ovl_write_iter+0x3a5/0x4b0 [ 183.085852][ T5156] ? __cfi_ovl_write_iter+0x10/0x10 [ 183.085871][ T5156] ? __cfi_ovl_file_end_write+0x10/0x10 [ 183.085902][ T5156] ? security_file_permission+0x38/0xf0 [ 183.085925][ T5156] ? rw_verify_area+0xac/0x230 [ 183.085952][ T5156] aio_write+0x4e5/0x720 [ 183.085973][ T5156] ? aio_read+0x500/0x500 [ 183.085993][ T5156] ? __fget_files+0x2c5/0x340 [ 183.086132][ T5156] io_submit_one+0xc5d/0x1980 [ 183.086153][ T5156] ? lookup_ioctx+0x360/0x360 [ 183.086173][ T5156] ? asm_exc_page_fault+0x2b/0x30 [ 183.086200][ T5156] ? __asan_memset+0x39/0x50 [ 183.086224][ T5156] ? blk_start_plug+0x71/0x1c0 [ 183.086249][ T5156] __se_sys_io_submit+0x17f/0x3f0 [ 183.086278][ T5156] ? __x64_sys_io_submit+0xa0/0xa0 [ 183.086302][ T5156] ? ksys_write+0x1f3/0x260 [ 183.086329][ T5156] ? __kasan_check_read+0x15/0x20 [ 183.086352][ T5156] __x64_sys_io_submit+0x7f/0xa0 [ 183.086379][ T5156] x64_sys_call+0x1c95/0x2ee0 [ 183.086404][ T5156] do_syscall_64+0x57/0xf0 [ 183.086430][ T5156] ? clear_bhb_loop+0x50/0xa0 [ 183.086449][ T5156] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 183.086474][ T5156] RIP: 0033:0x7f65b299c819 [ 183.086492][ T5156] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 183.086508][ T5156] RSP: 002b:00007f65b37e8028 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 183.086530][ T5156] RAX: ffffffffffffffda RBX: 00007f65b2c15fa0 RCX: 00007f65b299c819 [ 183.086546][ T5156] RDX: 0000200000000540 RSI: 000000000000003b RDI: 00007f65b37bf000 [ 183.086560][ T5156] RBP: 00007f65b37e8090 R08: 0000000000000000 R09: 0000000000000000 [ 183.086573][ T5156] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 183.086585][ T5156] R13: 00007f65b2c16038 R14: 00007f65b2c15fa0 R15: 00007ffda3b14038 [ 183.086602][ T5156] [ 183.223522][ T380] usb 5-1: Using ep0 maxpacket: 16 [ 183.395734][ T380] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 183.405645][ T380] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 183.418621][ T380] usb 5-1: New USB device found, idVendor=05ac, idProduct=8241, bcdDevice= 0.00 [ 183.427793][ T380] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 183.437538][ T380] usb 5-1: config 0 descriptor?? [ 183.446901][ T380] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 183.456356][ T5158] fuse: Unknown parameter '0x0000000000000003' [ 183.621086][ T9] usb 2-1: USB disconnect, device number 74 [ 183.626509][ T5167] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 183.635919][ T5167] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 183.713530][ T380] usb 3-1: new high-speed USB device number 73 using dummy_hcd [ 183.806336][ T5180] fuse: Unknown parameter '0x0000000000000003' [ 183.863556][ T380] usb 3-1: Using ep0 maxpacket: 32 [ 183.869960][ T380] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 183.878296][ T380] usb 3-1: config 0 has no interface number 0 [ 183.884505][ T380] usb 3-1: config 0 interface 184 altsetting 7 endpoint 0x82 has invalid maxpacket 59136, setting to 1024 [ 183.901856][ T380] usb 3-1: config 0 interface 184 altsetting 7 bulk endpoint 0x82 has invalid maxpacket 1024 [ 183.914768][ T380] usb 3-1: config 0 interface 184 has no altsetting 0 [ 183.917749][ T5186] netlink: 'syz.1.1911': attribute type 1 has an invalid length. [ 183.930073][ T5186] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=5186 comm=syz.1.1911 [ 183.930217][ T5187] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 183.951856][ T380] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 183.951874][ T5187] overlayfs: missing 'lowerdir' [ 183.951893][ T380] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 183.973884][ T380] usb 3-1: Product: syz [ 183.978084][ T380] usb 3-1: Manufacturer: syz [ 183.983282][ T380] usb 3-1: SerialNumber: syz [ 183.988657][ T380] usb 3-1: config 0 descriptor?? [ 183.993945][ T5160] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 184.002067][ T380] smsc75xx v1.0.0 [ 184.174278][ T5194] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 184.182916][ T5194] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 184.202411][ T5160] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 184.213570][ T9] usb 2-1: new high-speed USB device number 75 using dummy_hcd [ 184.364946][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 184.373371][ T9] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 184.383738][ T9] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 184.392857][ T9] usb 2-1: too many endpoints for config 1 interface 1 altsetting 0: 165, using maximum allowed: 30 [ 184.403711][ T9] usb 2-1: config 1 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 165 [ 184.418299][ T9] usb 2-1: New USB device found, idVendor=041e, idProduct=3f02, bcdDevice= 0.40 [ 184.427434][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 184.435476][ T9] usb 2-1: Product: syz [ 184.439657][ T9] usb 2-1: Manufacturer: syz [ 184.444293][ T9] usb 2-1: SerialNumber: syz [ 184.617436][ T380] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 184.628400][ T380] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 184.652623][ T9] usb 2-1: 0:2 : does not exist [ 184.657594][ T9] usb 2-1: unit 2 not found! [ 184.662392][ T9] usb 2-1: unit 9 not found! [ 184.670752][ T9] usb 2-1: USB disconnect, device number 75 [ 184.679122][ T310] udevd[310]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 184.708361][ T5198] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 184.717047][ T5198] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 184.744969][ T5198] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 184.753639][ T5198] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 185.165913][ T5200] netlink: 'syz.1.1915': attribute type 3 has an invalid length. [ 185.197947][ T5204] fuse: Unknown parameter '0x0000000000000003' [ 185.292721][ T5212] fuse: Bad value for 'group_id' [ 185.297943][ T5212] fuse: Bad value for 'group_id' [ 185.298088][ T5213] fuseblk: Bad value for 'user_id' [ 185.308265][ T5213] fuseblk: Bad value for 'user_id' [ 185.342091][ T36] audit: type=1400 audit(1776112240.229:577): avc: denied { associate } for pid=5220 comm="syz.0.1924" name="pfkey" scontext=root:object_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 185.356078][ T5221] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 185.418879][ T5224] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 185.427700][ T5224] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 185.439442][ T380] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 185.455261][ T380] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 185.465261][ T380] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 185.474934][ T380] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -32 [ 185.659671][ T5237] bridge: RTM_NEWNEIGH with invalid ether address [ 185.688787][ T5241] netlink: 'syz.1.1933': attribute type 64 has an invalid length. [ 185.696685][ T5241] netlink: 5 bytes leftover after parsing attributes in process `syz.1.1933'. [ 185.707873][ T1658] Bluetooth: hci0: Frame reassembly failed (-84) [ 185.707937][ T5242] netlink: 'syz.1.1933': attribute type 64 has an invalid length. [ 185.722240][ T5242] netlink: 5 bytes leftover after parsing attributes in process `syz.1.1933'. [ 185.725076][ T9] usb 5-1: USB disconnect, device number 27 [ 186.153425][ T9] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 186.303393][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 186.309593][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 186.320589][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 186.330389][ T9] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 186.343205][ T9] usb 5-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 186.352288][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 186.361013][ T9] usb 5-1: config 0 descriptor?? [ 186.476757][ T10] usb 3-1: USB disconnect, device number 73 [ 186.776631][ T9] input: HID 0458:5011 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:0458:5011.001F/input/input52 [ 186.789029][ T9] input: HID 0458:5011 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:0458:5011.001F/input/input53 [ 186.803779][ T9] kye 0003:0458:5011.001F: input,hiddev96,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.4-1/input0 [ 186.973775][ T380] usb 5-1: USB disconnect, device number 28 [ 187.542410][ T5263] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1940'. [ 187.633347][ T380] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 187.733400][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 187.733595][ T2141] Bluetooth: hci0: command 0x1003 tx timeout [ 187.783459][ T380] usb 3-1: Using ep0 maxpacket: 32 [ 187.789852][ T380] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 187.800808][ T380] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 187.810598][ T380] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 187.823606][ T380] usb 3-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 187.832656][ T380] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 187.841433][ T380] usb 3-1: config 0 descriptor?? [ 187.907043][ T31] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 188.003317][ T9] usb 2-1: new high-speed USB device number 76 using dummy_hcd [ 188.057487][ T380] input: HID 0458:5011 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0458:5011.0020/input/input54 [ 188.069106][ T31] usb 5-1: Using ep0 maxpacket: 16 [ 188.075628][ T380] input: HID 0458:5011 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0458:5011.0020/input/input55 [ 188.089455][ T31] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 188.099422][ T31] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 188.118590][ T380] kye 0003:0458:5011.0020: input,hiddev96,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.2-1/input0 [ 188.130911][ T31] usb 5-1: New USB device found, idVendor=05ac, idProduct=8241, bcdDevice= 0.00 [ 188.141592][ T380] usb 3-1: USB disconnect, device number 74 [ 188.147994][ T31] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 188.162500][ T31] usb 5-1: config 0 descriptor?? [ 188.163292][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 188.173800][ T31] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 188.182160][ T9] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 188.190745][ T9] usb 2-1: config 0 has no interface number 0 [ 188.196914][ T9] usb 2-1: config 0 interface 184 altsetting 7 endpoint 0x82 has invalid maxpacket 59136, setting to 1024 [ 188.208635][ T9] usb 2-1: config 0 interface 184 altsetting 7 bulk endpoint 0x82 has invalid maxpacket 1024 [ 188.219302][ T9] usb 2-1: config 0 interface 184 has no altsetting 0 [ 188.228149][ T9] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 188.237371][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 188.245665][ T9] usb 2-1: Product: syz [ 188.249846][ T9] usb 2-1: Manufacturer: syz [ 188.254466][ T9] usb 2-1: SerialNumber: syz [ 188.259806][ T9] usb 2-1: config 0 descriptor?? [ 188.265158][ T5273] raw-gadget.4 gadget.1: fail, usb_ep_enable returned -22 [ 188.273020][ T9] smsc75xx v1.0.0 [ 188.354121][ T5283] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 188.362793][ T5283] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 188.474015][ T5273] raw-gadget.4 gadget.1: fail, usb_ep_enable returned -22 [ 188.882207][ T9] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 188.893186][ T9] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 188.916604][ T5290] rust_binder: Error while translating object. [ 188.916629][ T5290] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 188.923109][ T5290] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:457 [ 189.107555][ T5308] FAULT_INJECTION: forcing a failure. [ 189.107555][ T5308] name failslab, interval 1, probability 0, space 0, times 0 [ 189.129487][ T5308] CPU: 1 UID: 0 PID: 5308 Comm: syz.0.1958 Not tainted syzkaller #0 962c4f53752c25f9427fc034aff9bf9776e8b502 [ 189.129656][ T5308] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 189.129680][ T5308] Call Trace: [ 189.129689][ T5308] [ 189.129699][ T5308] __dump_stack+0x21/0x30 [ 189.129722][ T5308] dump_stack_lvl+0x140/0x1c0 [ 189.129737][ T5308] ? __cfi_dump_stack_lvl+0x10/0x10 [ 189.129756][ T5308] ? stack_depot_save_flags+0x38/0x800 [ 189.129785][ T5308] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 189.129809][ T5308] dump_stack+0x19/0x20 [ 189.129832][ T5308] should_fail_ex+0x3d7/0x530 [ 189.129856][ T5308] should_failslab+0xac/0x100 [ 189.129868][ T5308] __kmalloc_cache_noprof+0x41/0x470 [ 189.129893][ T5308] ? __kthread_create_on_node+0x13b/0x4b0 [ 189.129906][ T5308] ? __cfi_rescuer_thread+0x10/0x10 [ 189.129926][ T5308] __kthread_create_on_node+0x13b/0x4b0 [ 189.129947][ T5308] ? string+0x292/0x2c0 [ 189.129973][ T5308] ? kthread_create_on_node+0x160/0x160 [ 189.129993][ T5308] ? __cfi_rescuer_thread+0x10/0x10 [ 189.130016][ T5308] ? __cfi_rescuer_thread+0x10/0x10 [ 189.130028][ T5308] kthread_create_on_node+0xec/0x160 [ 189.130040][ T5308] ? __cfi_kthread_create_on_node+0x10/0x10 [ 189.130052][ T5308] ? __kmalloc_cache_node_noprof+0x225/0x430 [ 189.130084][ T5308] ? init_rescuer+0x149/0x5c0 [ 189.130112][ T5308] init_rescuer+0x2af/0x5c0 [ 189.130138][ T5308] ? bh_pool_irq_work+0x150/0x150 [ 189.130161][ T5308] ? __cfi_mutex_unlock+0x10/0x10 [ 189.130175][ T5308] ? wq_adjust_max_active+0x148/0x7c0 [ 189.130192][ T5308] alloc_workqueue+0x1329/0x1cc0 [ 189.130208][ T5308] ? __cfi_alloc_workqueue+0x10/0x10 [ 189.130231][ T5308] ? dentry_needs_remove_privs+0x30/0x110 [ 189.130255][ T5308] ? ovl_path_type+0x1c1/0x3f0 [ 189.130277][ T5308] ? ovl_path_realdata+0x154/0x370 [ 189.130302][ T5308] sb_init_dio_done_wq+0x2f/0x90 [ 189.130327][ T5308] backing_file_write_iter+0x3fc/0x890 [ 189.130342][ T5308] ovl_write_iter+0x3a5/0x4b0 [ 189.130355][ T5308] ? __cfi_ovl_write_iter+0x10/0x10 [ 189.130372][ T5308] ? __cfi_ovl_file_end_write+0x10/0x10 [ 189.130394][ T5308] ? security_file_permission+0x38/0xf0 [ 189.130419][ T5308] ? rw_verify_area+0xac/0x230 [ 189.130445][ T5308] aio_write+0x4e5/0x720 [ 189.130463][ T5308] ? aio_read+0x500/0x500 [ 189.130476][ T5308] ? __fget_files+0x2c5/0x340 [ 189.130489][ T5308] io_submit_one+0xc5d/0x1980 [ 189.130502][ T5308] ? lookup_ioctx+0x360/0x360 [ 189.130515][ T5308] ? asm_exc_page_fault+0x2b/0x30 [ 189.130550][ T5308] ? __asan_memset+0x39/0x50 [ 189.130576][ T5308] ? blk_start_plug+0x71/0x1c0 [ 189.130603][ T5308] __se_sys_io_submit+0x17f/0x3f0 [ 189.130623][ T5308] ? __x64_sys_io_submit+0xa0/0xa0 [ 189.130640][ T5308] ? ksys_write+0x1f3/0x260 [ 189.130656][ T5308] ? __kasan_check_read+0x15/0x20 [ 189.130677][ T5308] __x64_sys_io_submit+0x7f/0xa0 [ 189.130705][ T5308] x64_sys_call+0x1c95/0x2ee0 [ 189.130733][ T5308] do_syscall_64+0x57/0xf0 [ 189.130759][ T5308] ? clear_bhb_loop+0x50/0xa0 [ 189.130771][ T5308] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 189.130789][ T5308] RIP: 0033:0x7ff088f9c819 [ 189.130802][ T5308] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 189.130813][ T5308] RSP: 002b:00007ff089eb0028 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 189.130836][ T5308] RAX: ffffffffffffffda RBX: 00007ff089215fa0 RCX: 00007ff088f9c819 [ 189.130853][ T5308] RDX: 0000200000000540 RSI: 000000000000003b RDI: 00007ff089e87000 [ 189.130868][ T5308] RBP: 00007ff089eb0090 R08: 0000000000000000 R09: 0000000000000000 [ 189.130882][ T5308] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 189.130896][ T5308] R13: 00007ff089216038 R14: 00007ff089215fa0 R15: 00007ffffc4bb078 [ 189.130913][ T5308] [ 189.130944][ T5308] workqueue: Failed to create a rescuer kthread for wq "dio/overlay": -ENOMEM [ 189.585336][ T5313] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 189.603178][ T5313] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 189.614601][ T5313] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 189.624328][ T5313] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 189.633254][ T380] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 189.634070][ T5313] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 189.650876][ T5313] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 189.700566][ T5330] netlink: 104 bytes leftover after parsing attributes in process `syz.0.1963'. [ 189.709897][ T36] audit: type=1400 audit(1776112244.589:578): avc: denied { create } for pid=5329 comm="syz.0.1963" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 189.710055][ T9] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 189.730186][ T36] audit: type=1400 audit(1776112244.589:579): avc: denied { write } for pid=5329 comm="syz.0.1963" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 189.752706][ T9] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 189.769879][ T36] audit: type=1400 audit(1776112244.589:580): avc: denied { nlmsg_write } for pid=5329 comm="syz.0.1963" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 189.775797][ T9] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 189.791406][ T380] usb 3-1: Using ep0 maxpacket: 32 [ 189.801251][ T9] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -32 [ 189.814861][ T36] audit: type=1400 audit(1776112244.589:581): avc: denied { nlmsg_read } for pid=5329 comm="syz.0.1963" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 189.836463][ T380] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 189.847582][ T380] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 189.857366][ T380] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 189.870205][ T380] usb 3-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 189.879303][ T380] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 189.887956][ T380] usb 3-1: config 0 descriptor?? [ 190.303880][ T380] input: HID 0458:5011 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0458:5011.0021/input/input56 [ 190.316923][ T380] input: HID 0458:5011 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0458:5011.0021/input/input57 [ 190.335592][ T380] kye 0003:0458:5011.0021: input,hiddev96,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.2-1/input0 [ 190.500921][ T9] usb 3-1: USB disconnect, device number 75 [ 190.638869][ T339] usb 5-1: USB disconnect, device number 29 [ 190.647883][ T36] audit: type=1400 audit(1776112245.539:582): avc: denied { bind } for pid=5341 comm="syz.4.1967" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 190.688680][ T36] audit: type=1400 audit(1776112245.579:583): avc: denied { write } for pid=5347 comm="syz.4.1970" name="/" dev="incremental-fs" ino=847 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 190.689083][ T5348] overlayfs: workdir and upperdir must reside under the same mount [ 190.711361][ T36] audit: type=1400 audit(1776112245.579:584): avc: denied { getattr } for pid=5347 comm="syz.4.1970" name="/" dev="incremental-fs" ino=847 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 190.762416][ T5350] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1971'. [ 190.784081][ T380] usb 2-1: USB disconnect, device number 76 [ 190.798861][ T5353] devtmpfs: Unknown parameter '/dev/uinput' [ 190.869415][ T4139] raw-gadget.0 gadget.0: failed to queue disconnect event [ 190.948925][ T36] audit: type=1400 audit(1776112245.839:585): avc: denied { execmem } for pid=5364 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 191.030378][ T5365] bridge0: port 1(bridge_slave_0) entered blocking state [ 191.037503][ T5365] bridge0: port 1(bridge_slave_0) entered disabled state [ 191.044860][ T5365] bridge_slave_0: entered allmulticast mode [ 191.051241][ T5365] bridge_slave_0: entered promiscuous mode [ 191.057686][ T5365] bridge0: port 2(bridge_slave_1) entered blocking state [ 191.064752][ T5365] bridge0: port 2(bridge_slave_1) entered disabled state [ 191.071885][ T5365] bridge_slave_1: entered allmulticast mode [ 191.078839][ T5365] bridge_slave_1: entered promiscuous mode [ 191.088883][ T1658] bridge_slave_1: left allmulticast mode [ 191.095826][ T1658] bridge_slave_1: left promiscuous mode [ 191.101570][ T1658] bridge0: port 2(bridge_slave_1) entered disabled state [ 191.109229][ T1658] bridge_slave_0: left allmulticast mode [ 191.115203][ T1658] bridge_slave_0: left promiscuous mode [ 191.120958][ T1658] bridge0: port 1(bridge_slave_0) entered disabled state [ 191.133422][ T339] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 191.176887][ T5370] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1980'. [ 191.199146][ T1658] tipc: Left network mode [ 191.263460][ T5365] bridge0: port 2(bridge_slave_1) entered blocking state [ 191.270683][ T5365] bridge0: port 2(bridge_slave_1) entered forwarding state [ 191.278122][ T5365] bridge0: port 1(bridge_slave_0) entered blocking state [ 191.285306][ T5365] bridge0: port 1(bridge_slave_0) entered forwarding state [ 191.303253][ T339] usb 5-1: Using ep0 maxpacket: 16 [ 191.309665][ T339] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 191.324765][ T339] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 191.338014][ T339] usb 5-1: New USB device found, idVendor=05ac, idProduct=8241, bcdDevice= 0.00 [ 191.348616][ T339] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 191.352052][ T5365] veth0_vlan: entered promiscuous mode [ 191.357431][ T339] usb 5-1: config 0 descriptor?? [ 191.371292][ T5365] veth1_macvtap: entered promiscuous mode [ 191.373477][ T339] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 191.463523][ T31] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 191.613231][ T31] usb 3-1: Using ep0 maxpacket: 32 [ 191.619601][ T31] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 191.628082][ T31] usb 3-1: config 0 has no interface number 0 [ 191.634280][ T31] usb 3-1: config 0 interface 184 altsetting 7 endpoint 0x82 has invalid maxpacket 59136, setting to 1024 [ 191.645706][ T31] usb 3-1: config 0 interface 184 altsetting 7 bulk endpoint 0x82 has invalid maxpacket 1024 [ 191.652461][ T5388] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1988'. [ 191.661380][ T31] usb 3-1: config 0 interface 184 has no altsetting 0 [ 191.681535][ T31] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 191.691969][ T5392] rust_binder: Error while translating object. [ 191.692002][ T5392] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 191.696392][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 191.698679][ T5392] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:1027 [ 191.707822][ T31] usb 3-1: Product: syz [ 191.728947][ T31] usb 3-1: Manufacturer: syz [ 191.733706][ T31] usb 3-1: SerialNumber: syz [ 191.741265][ T31] usb 3-1: config 0 descriptor?? [ 191.746709][ T5374] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 191.754819][ T31] smsc75xx v1.0.0 [ 191.812086][ T5398] FAULT_INJECTION: forcing a failure. [ 191.812086][ T5398] name failslab, interval 1, probability 0, space 0, times 0 [ 191.825090][ T5398] CPU: 1 UID: 0 PID: 5398 Comm: syz.1.1993 Not tainted syzkaller #0 962c4f53752c25f9427fc034aff9bf9776e8b502 [ 191.825130][ T5398] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 191.825145][ T5398] Call Trace: [ 191.825152][ T5398] [ 191.825161][ T5398] __dump_stack+0x21/0x30 [ 191.825194][ T5398] dump_stack_lvl+0x140/0x1c0 [ 191.825261][ T5398] ? __cfi_dump_stack_lvl+0x10/0x10 [ 191.825291][ T5398] dump_stack+0x19/0x20 [ 191.825314][ T5398] should_fail_ex+0x3d7/0x530 [ 191.825340][ T5398] should_failslab+0xac/0x100 [ 191.825358][ T5398] __kmalloc_node_track_caller_noprof+0x68/0x4f0 [ 191.825376][ T5398] ? __kthread_create_on_node+0x1fb/0x4b0 [ 191.825389][ T5398] kvasprintf+0xf1/0x260 [ 191.825403][ T5398] ? kasan_save_alloc_info+0x40/0x50 [ 191.825418][ T5398] ? __cfi_kvasprintf+0x10/0x10 [ 191.825430][ T5398] ? __kmalloc_cache_noprof+0x23c/0x470 [ 191.825446][ T5398] ? __kthread_create_on_node+0x13b/0x4b0 [ 191.825459][ T5398] __kthread_create_on_node+0x1fb/0x4b0 [ 191.825471][ T5398] ? string+0x292/0x2c0 [ 191.825487][ T5398] ? kthread_create_on_node+0x160/0x160 [ 191.825499][ T5398] ? __cfi_rescuer_thread+0x10/0x10 [ 191.825511][ T5398] ? __cfi_rescuer_thread+0x10/0x10 [ 191.825523][ T5398] kthread_create_on_node+0xec/0x160 [ 191.825535][ T5398] ? __cfi_kthread_create_on_node+0x10/0x10 [ 191.825547][ T5398] ? __kmalloc_cache_node_noprof+0x225/0x430 [ 191.825563][ T5398] ? init_rescuer+0x149/0x5c0 [ 191.825580][ T5398] init_rescuer+0x2af/0x5c0 [ 191.825596][ T5398] ? bh_pool_irq_work+0x150/0x150 [ 191.825613][ T5398] ? __cfi_mutex_unlock+0x10/0x10 [ 191.825627][ T5398] ? wq_adjust_max_active+0x148/0x7c0 [ 191.825643][ T5398] alloc_workqueue+0x1329/0x1cc0 [ 191.825659][ T5398] ? __cfi_alloc_workqueue+0x10/0x10 [ 191.825674][ T5398] ? dentry_needs_remove_privs+0x30/0x110 [ 191.825689][ T5398] ? ovl_path_type+0x1c1/0x3f0 [ 191.825703][ T5398] ? ovl_path_realdata+0x154/0x370 [ 191.825718][ T5398] sb_init_dio_done_wq+0x2f/0x90 [ 191.825733][ T5398] backing_file_write_iter+0x3fc/0x890 [ 191.825748][ T5398] ovl_write_iter+0x3a5/0x4b0 [ 191.825761][ T5398] ? __cfi_ovl_write_iter+0x10/0x10 [ 191.825773][ T5398] ? __cfi_ovl_file_end_write+0x10/0x10 [ 191.825786][ T5398] ? security_file_permission+0x38/0xf0 [ 191.825801][ T5398] ? rw_verify_area+0xac/0x230 [ 191.825817][ T5398] aio_write+0x4e5/0x720 [ 191.825830][ T5398] ? aio_read+0x500/0x500 [ 191.825843][ T5398] ? __fget_files+0x2c5/0x340 [ 191.825854][ T5398] io_submit_one+0xc5d/0x1980 [ 191.825868][ T5398] ? lookup_ioctx+0x360/0x360 [ 191.825880][ T5398] ? asm_exc_page_fault+0x2b/0x30 [ 191.825899][ T5398] ? __asan_memset+0x39/0x50 [ 191.825914][ T5398] ? blk_start_plug+0x71/0x1c0 [ 191.825931][ T5398] __se_sys_io_submit+0x17f/0x3f0 [ 191.825949][ T5398] ? __x64_sys_io_submit+0xa0/0xa0 [ 191.825968][ T5398] ? ksys_write+0x1f3/0x260 [ 191.825986][ T5398] ? __kasan_check_read+0x15/0x20 [ 191.826002][ T5398] __x64_sys_io_submit+0x7f/0xa0 [ 191.826018][ T5398] x64_sys_call+0x1c95/0x2ee0 [ 191.826035][ T5398] do_syscall_64+0x57/0xf0 [ 191.826051][ T5398] ? clear_bhb_loop+0x50/0xa0 [ 191.826063][ T5398] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 191.826081][ T5398] RIP: 0033:0x7fa31559c819 [ 191.826094][ T5398] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 191.826106][ T5398] RSP: 002b:00007fa3163a6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 191.826122][ T5398] RAX: ffffffffffffffda RBX: 00007fa315815fa0 RCX: 00007fa31559c819 [ 191.826132][ T5398] RDX: 0000200000000540 RSI: 000000000000003b RDI: 00007fa31637d000 [ 191.826141][ T5398] RBP: 00007fa3163a6090 R08: 0000000000000000 R09: 0000000000000000 [ 191.826149][ T5398] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 191.826158][ T5398] R13: 00007fa315816038 R14: 00007fa315815fa0 R15: 00007ffddc5f53c8 [ 191.826168][ T5398] [ 191.826191][ T5398] workqueue: Failed to create a rescuer kthread for wq "dio/overlay": -ENOMEM [ 191.959851][ T5374] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 191.964764][ T380] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 192.393253][ T380] usb 6-1: Using ep0 maxpacket: 32 [ 192.399713][ T380] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 192.410710][ T380] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 192.420562][ T380] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 192.433612][ T380] usb 6-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 192.442712][ T31] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 192.453676][ T31] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 192.462930][ T380] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 192.471713][ T380] usb 6-1: config 0 descriptor?? [ 192.563220][ T339] usb 2-1: new high-speed USB device number 77 using dummy_hcd [ 192.671606][ T31] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -32 [ 192.682785][ T31] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -32 [ 192.692653][ T31] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 192.702236][ T31] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -32 [ 192.724880][ T339] usb 2-1: unable to get BOS descriptor or descriptor too short [ 192.733474][ T339] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 192.743734][ T339] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 192.754189][ T339] usb 2-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice=e1.40 [ 192.763576][ T339] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 192.771637][ T339] usb 2-1: Product: syz [ 192.776014][ T339] usb 2-1: Manufacturer: syz [ 192.780694][ T339] usb 2-1: SerialNumber: syz [ 192.788663][ T339] usb 2-1: selecting invalid altsetting 1 [ 192.794698][ T339] usb 2-1: unit 6 not found! [ 192.799323][ T339] usb 2-1: unit 2 not found! [ 192.806149][ T339] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 192.829791][ T852] udevd[852]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 192.901607][ T380] input: HID 0458:5011 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:0458:5011.0022/input/input58 [ 192.915622][ T380] input: HID 0458:5011 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:0458:5011.0022/input/input59 [ 192.933150][ T380] kye 0003:0458:5011.0022: input,hiddev96,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.5-1/input0 [ 193.101957][ T339] usb 6-1: USB disconnect, device number 2 [ 193.842477][ T339] usb 5-1: USB disconnect, device number 30 [ 193.852313][ T5414] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1997'. [ 193.885360][ T1658] Bluetooth: hci0: Frame reassembly failed (-84) [ 193.891850][ T1658] Bluetooth: hci0: Frame reassembly failed (-84) [ 193.904146][ T5424] rust_binder: Error while translating object. [ 193.904177][ T5424] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 193.910561][ T5424] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:376 [ 193.929730][ T5426] netlink: 104 bytes leftover after parsing attributes in process `syz.4.2001'. [ 194.034475][ T36] audit: type=1400 audit(1776112248.929:586): avc: denied { mounton } for pid=5435 comm="syz.4.2005" path="/158/file0" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:devpts_t tclass=dir permissive=1 [ 194.034540][ T5436] incfs: Can't find or create .index dir in ./file0 [ 194.063321][ T5436] incfs: mount failed -1 [ 194.073002][ T5436] overlayfs: workdir and upperdir must reside under the same mount [ 194.234520][ T31] usb 3-1: USB disconnect, device number 76 [ 194.249297][ T5441] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2007'. [ 194.281604][ T5445] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:523 [ 194.303974][ T5449] netlink: 'syz.2.2011': attribute type 3 has an invalid length. [ 194.323186][ T380] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 194.332799][ T5451] netlink: 188 bytes leftover after parsing attributes in process `syz.2.2012'. [ 194.483135][ T380] usb 5-1: Using ep0 maxpacket: 16 [ 194.489644][ T380] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 194.500739][ T380] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 194.516473][ T380] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 194.527653][ T5455] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2014'. [ 194.534754][ T380] usb 5-1: New USB device found, idVendor=05ac, idProduct=8241, bcdDevice= 0.00 [ 194.552866][ T380] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 194.561899][ T380] usb 5-1: config 0 descriptor?? [ 194.683152][ T31] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 194.783124][ T9] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 194.833612][ T31] usb 3-1: too many configurations: 72, using maximum allowed: 8 [ 194.847783][ T31] usb 3-1: New USB device found, idVendor=7de0, idProduct=676e, bcdDevice=77.db [ 194.857362][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 194.866269][ T31] usb 3-1: config 0 descriptor?? [ 194.933132][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 194.939934][ T9] usb 6-1: config 0 has an invalid interface number: 184 but max is 0 [ 194.948491][ T9] usb 6-1: config 0 has no interface number 0 [ 194.954744][ T9] usb 6-1: config 0 interface 184 altsetting 7 endpoint 0x82 has invalid maxpacket 59136, setting to 1024 [ 194.966166][ T9] usb 6-1: config 0 interface 184 altsetting 7 bulk endpoint 0x82 has invalid maxpacket 1024 [ 194.972311][ T380] usbhid 5-1:0.0: can't add hid device: -71 [ 194.976391][ T9] usb 6-1: config 0 interface 184 has no altsetting 0 [ 194.979287][ T9] usb 6-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 194.982480][ T380] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 194.989342][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 195.003314][ T380] usb 5-1: USB disconnect, device number 31 [ 195.006208][ T9] usb 6-1: Product: syz [ 195.025113][ T9] usb 6-1: Manufacturer: syz [ 195.029822][ T9] usb 6-1: SerialNumber: syz [ 195.035289][ T9] usb 6-1: config 0 descriptor?? [ 195.040824][ T5457] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 195.048876][ T9] smsc75xx v1.0.0 [ 195.075544][ T31] usb 3-1: string descriptor 0 read error: -71 [ 195.082828][ T31] usb 3-1: USB disconnect, device number 77 [ 195.249757][ T5457] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 195.336589][ T31] usb 2-1: USB disconnect, device number 77 [ 195.347624][ T5459] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2016'. [ 195.384093][ T5463] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:1043 [ 195.587991][ T36] audit: type=1400 audit(1776112250.479:587): avc: denied { create } for pid=5478 comm="syz.4.2024" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=decnet_socket permissive=1 [ 195.624399][ T5483] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2026'. [ 195.656181][ T5487] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:402 [ 195.657899][ T9] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 195.678370][ T9] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 195.678471][ T5489] netlink: 'syz.4.2029': attribute type 27 has an invalid length. [ 195.823177][ T380] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 195.888430][ T9] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -32 [ 195.893118][ T2141] Bluetooth: hci0: command 0x1003 tx timeout [ 195.899383][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 195.911516][ T9] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -32 [ 195.921364][ T9] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 195.930844][ T9] smsc75xx 6-1:0.184: probe with driver smsc75xx failed with error -32 [ 195.973134][ T1035] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 195.984572][ T380] usb 3-1: unable to get BOS descriptor or descriptor too short [ 195.993274][ T380] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 196.003525][ T380] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 196.014399][ T380] usb 3-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice=e1.40 [ 196.023590][ T380] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 196.031611][ T380] usb 3-1: Product: syz [ 196.035812][ T380] usb 3-1: Manufacturer: syz [ 196.040426][ T380] usb 3-1: SerialNumber: syz [ 196.047801][ T380] usb 3-1: selecting invalid altsetting 1 [ 196.053713][ T380] usb 3-1: unit 6 not found! [ 196.058312][ T380] usb 3-1: unit 2 not found! [ 196.064700][ T380] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 196.080406][ T852] udevd[852]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 196.123120][ T1035] usb 5-1: Using ep0 maxpacket: 16 [ 196.129388][ T1035] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 196.140365][ T1035] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 196.150294][ T1035] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 196.163253][ T1035] usb 5-1: New USB device found, idVendor=05ac, idProduct=8241, bcdDevice= 0.00 [ 196.172327][ T1035] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 196.181069][ T1035] usb 5-1: config 0 descriptor?? [ 196.553093][ T380] usb 2-1: new high-speed USB device number 78 using dummy_hcd [ 196.589761][ T1035] usbhid 5-1:0.0: can't add hid device: -71 [ 196.595815][ T1035] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 196.605021][ T1035] usb 5-1: USB disconnect, device number 32 [ 196.703100][ T380] usb 2-1: Using ep0 maxpacket: 32 [ 196.709425][ T380] usb 2-1: config 0 interface 0 altsetting 129 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 196.720577][ T380] usb 2-1: config 0 interface 0 altsetting 129 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 196.733639][ T380] usb 2-1: config 0 interface 0 has no altsetting 0 [ 196.740341][ T380] usb 2-1: New USB device found, idVendor=5543, idProduct=0004, bcdDevice= 0.00 [ 196.749414][ T380] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 196.758014][ T380] usb 2-1: config 0 descriptor?? [ 197.017558][ T380] usbhid 2-1:0.0: can't add hid device: -71 [ 197.023635][ T380] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 197.032223][ T380] usb 2-1: USB disconnect, device number 78 [ 197.133729][ T5511] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:416 [ 197.157062][ T5516] FAULT_INJECTION: forcing a failure. [ 197.157062][ T5516] name failslab, interval 1, probability 0, space 0, times 0 [ 197.179016][ T5516] CPU: 1 UID: 0 PID: 5516 Comm: syz.4.2039 Not tainted syzkaller #0 962c4f53752c25f9427fc034aff9bf9776e8b502 [ 197.179052][ T5516] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 197.179063][ T5516] Call Trace: [ 197.179068][ T5516] [ 197.179073][ T5516] __dump_stack+0x21/0x30 [ 197.179095][ T5516] dump_stack_lvl+0x140/0x1c0 [ 197.179110][ T5516] ? __cfi_dump_stack_lvl+0x10/0x10 [ 197.179126][ T5516] dump_stack+0x19/0x20 [ 197.179141][ T5516] should_fail_ex+0x3d7/0x530 [ 197.179162][ T5516] should_failslab+0xac/0x100 [ 197.179175][ T5516] kmem_cache_alloc_noprof+0x42/0x410 [ 197.179197][ T5516] ? backing_file_write_iter+0x28f/0x890 [ 197.179213][ T5516] backing_file_write_iter+0x28f/0x890 [ 197.179226][ T5516] ovl_write_iter+0x3a5/0x4b0 [ 197.179241][ T5516] ? __cfi_ovl_write_iter+0x10/0x10 [ 197.179253][ T5516] ? __cfi_ovl_file_end_write+0x10/0x10 [ 197.179266][ T5516] ? security_file_permission+0x38/0xf0 [ 197.179281][ T5516] ? rw_verify_area+0xac/0x230 [ 197.179297][ T5516] aio_write+0x4e5/0x720 [ 197.179310][ T5516] ? aio_read+0x500/0x500 [ 197.179323][ T5516] ? __fget_files+0x2c5/0x340 [ 197.179335][ T5516] io_submit_one+0xc5d/0x1980 [ 197.179349][ T5516] ? lookup_ioctx+0x360/0x360 [ 197.179361][ T5516] ? asm_exc_page_fault+0x2b/0x30 [ 197.179380][ T5516] ? __asan_memset+0x39/0x50 [ 197.179396][ T5516] ? blk_start_plug+0x71/0x1c0 [ 197.179412][ T5516] __se_sys_io_submit+0x17f/0x3f0 [ 197.179430][ T5516] ? __x64_sys_io_submit+0xa0/0xa0 [ 197.179447][ T5516] ? ksys_write+0x1f3/0x260 [ 197.179463][ T5516] ? __kasan_check_read+0x15/0x20 [ 197.179479][ T5516] __x64_sys_io_submit+0x7f/0xa0 [ 197.179496][ T5516] x64_sys_call+0x1c95/0x2ee0 [ 197.179512][ T5516] do_syscall_64+0x57/0xf0 [ 197.179529][ T5516] ? clear_bhb_loop+0x50/0xa0 [ 197.179541][ T5516] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 197.179558][ T5516] RIP: 0033:0x7f3311f9c819 [ 197.179571][ T5516] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 197.179582][ T5516] RSP: 002b:00007f3312d99028 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 197.179599][ T5516] RAX: ffffffffffffffda RBX: 00007f3312215fa0 RCX: 00007f3311f9c819 [ 197.179615][ T5516] RDX: 0000200000000540 RSI: 000000000000003b RDI: 00007f3312d70000 [ 197.179631][ T5516] RBP: 00007f3312d99090 R08: 0000000000000000 R09: 0000000000000000 [ 197.179646][ T5516] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 197.179658][ T5516] R13: 00007f3312216038 R14: 00007f3312215fa0 R15: 00007ffcea025178 [ 197.179669][ T5516] [ 197.559272][ T339] usb 6-1: USB disconnect, device number 3 [ 197.739172][ T5535] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:35 [ 197.743258][ T1035] usb 2-1: new high-speed USB device number 79 using dummy_hcd [ 197.763112][ T9] usb 5-1: new full-speed USB device number 33 using dummy_hcd [ 197.903100][ T1035] usb 2-1: Using ep0 maxpacket: 16 [ 197.909415][ T1035] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 197.920362][ T1035] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 197.930424][ T1035] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 197.943508][ T1035] usb 2-1: New USB device found, idVendor=05ac, idProduct=8241, bcdDevice= 0.00 [ 197.952608][ T1035] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 197.961741][ T9] usb 5-1: config index 0 descriptor too short (expected 9, got 0) [ 197.969926][ T1035] usb 2-1: config 0 descriptor?? [ 197.975024][ T9] usb 5-1: can't read configurations, error -22 [ 197.993096][ T380] usb 6-1: new full-speed USB device number 4 using dummy_hcd [ 198.103107][ T9] usb 5-1: new full-speed USB device number 34 using dummy_hcd [ 198.144249][ T380] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 198.155129][ T380] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 198.168615][ T380] usb 6-1: New USB device found, idVendor=09da, idProduct=001a, bcdDevice= 0.00 [ 198.177815][ T380] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 198.186741][ T380] usb 6-1: config 0 descriptor?? [ 198.192024][ T5537] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 198.254561][ T9] usb 5-1: config index 0 descriptor too short (expected 9, got 0) [ 198.262551][ T9] usb 5-1: can't read configurations, error -22 [ 198.269237][ T9] usb usb5-port1: attempt power cycle [ 198.390711][ T1035] usbhid 2-1:0.0: can't add hid device: -71 [ 198.396794][ T1035] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 198.401412][ T5537] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 198.405521][ T1035] usb 2-1: USB disconnect, device number 79 [ 198.417257][ T5537] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 198.604218][ T1035] usb 3-1: USB disconnect, device number 78 [ 198.614934][ T9] usb 5-1: new full-speed USB device number 35 using dummy_hcd [ 198.633617][ T380] a4tech 0003:09DA:001A.0023: unknown main item tag 0x0 [ 198.640796][ T380] a4tech 0003:09DA:001A.0023: unknown global tag 0xe [ 198.652927][ T9] usb 5-1: config index 0 descriptor too short (expected 9, got 0) [ 198.653297][ T380] a4tech 0003:09DA:001A.0023: item 0 2 1 14 parsing failed [ 198.661816][ T9] usb 5-1: can't read configurations, error -22 [ 198.669348][ T380] a4tech 0003:09DA:001A.0023: parse failed [ 198.680427][ T380] a4tech 0003:09DA:001A.0023: probe with driver a4tech failed with error -22 [ 198.803067][ T9] usb 5-1: new full-speed USB device number 36 using dummy_hcd [ 198.824869][ T9] usb 5-1: config index 0 descriptor too short (expected 9, got 0) [ 198.832959][ T9] usb 5-1: can't read configurations, error -22 [ 198.833849][ T5537] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 198.839880][ T9] usb usb5-port1: unable to enumerate USB device [ 198.848934][ T5537] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 198.865534][ T9] usb 6-1: USB disconnect, device number 4 [ 198.932771][ T5556] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:48 [ 198.943148][ T1035] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 199.103069][ T1035] usb 3-1: Using ep0 maxpacket: 32 [ 199.109468][ T1035] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 199.117883][ T1035] usb 3-1: config 0 has no interface number 0 [ 199.124214][ T1035] usb 3-1: config 0 interface 184 altsetting 7 endpoint 0x82 has invalid maxpacket 59136, setting to 1024 [ 199.135739][ T1035] usb 3-1: config 0 interface 184 altsetting 7 bulk endpoint 0x82 has invalid maxpacket 1024 [ 199.146013][ T1035] usb 3-1: config 0 interface 184 has no altsetting 0 [ 199.154655][ T1035] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 199.163853][ T1035] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 199.171955][ T1035] usb 3-1: Product: syz [ 199.176479][ T1035] usb 3-1: Manufacturer: syz [ 199.181090][ T1035] usb 3-1: SerialNumber: syz [ 199.186423][ T1035] usb 3-1: config 0 descriptor?? [ 199.191777][ T5543] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 199.199679][ T1035] smsc75xx v1.0.0 [ 199.253597][ T9] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 199.313042][ T10] usb 2-1: new high-speed USB device number 80 using dummy_hcd [ 199.400711][ T5543] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 199.414583][ T9] usb 6-1: unable to get BOS descriptor or descriptor too short [ 199.423355][ T9] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 199.433638][ T9] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 199.443089][ T10] usb 2-1: device descriptor read/64, error -71 [ 199.450509][ T9] usb 6-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice=e1.40 [ 199.459645][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 199.467724][ T9] usb 6-1: Product: syz [ 199.472005][ T9] usb 6-1: Manufacturer: syz [ 199.476644][ T9] usb 6-1: SerialNumber: syz [ 199.484588][ T9] usb 6-1: selecting invalid altsetting 1 [ 199.490447][ T9] usb 6-1: unit 6 not found! [ 199.495114][ T9] usb 6-1: unit 2 not found! [ 199.501415][ T9] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 199.518431][ T310] udevd[310]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 199.685002][ T10] usb 2-1: device descriptor read/64, error -71 [ 199.809070][ T1035] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 199.820230][ T1035] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 199.923048][ T10] usb 2-1: new high-speed USB device number 81 using dummy_hcd [ 200.030545][ T1035] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -32 [ 200.041487][ T1035] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -32 [ 200.051103][ T1035] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 200.060804][ T1035] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -32 [ 200.069126][ T10] usb 2-1: device descriptor read/64, error -71 [ 200.313049][ T10] usb 2-1: device descriptor read/64, error -71 [ 200.423162][ T10] usb usb2-port1: attempt power cycle [ 200.568802][ T5571] syzkaller0: entered promiscuous mode [ 200.574341][ T5571] syzkaller0: entered allmulticast mode [ 200.647740][ T5575] 8021q: VLANs not supported on ip_vti0 [ 200.763048][ T10] usb 2-1: new high-speed USB device number 82 using dummy_hcd [ 200.784182][ T10] usb 2-1: device descriptor read/8, error -71 [ 200.904133][ T5587] netlink: 'syz.4.2071': attribute type 1 has an invalid length. [ 200.912121][ T5587] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2071'. [ 200.922404][ T10] usb 2-1: device descriptor read/8, error -71 [ 201.163028][ T10] usb 2-1: new high-speed USB device number 83 using dummy_hcd [ 201.184354][ T10] usb 2-1: device descriptor read/8, error -71 [ 201.314027][ T10] usb 2-1: device descriptor read/8, error -71 [ 201.423529][ T10] usb usb2-port1: unable to enumerate USB device [ 201.657095][ T380] usb 3-1: USB disconnect, device number 79 [ 201.777763][ T5606] overlayfs: conflicting options: userxattr,verity=on [ 201.785491][ T36] audit: type=1400 audit(1776112256.679:588): avc: denied { getopt } for pid=5605 comm="syz.2.2079" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 201.895401][ T5622] FAULT_INJECTION: forcing a failure. [ 201.895401][ T5622] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 201.908762][ T5622] CPU: 0 UID: 0 PID: 5622 Comm: syz.2.2086 Not tainted syzkaller #0 962c4f53752c25f9427fc034aff9bf9776e8b502 [ 201.908800][ T5622] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 201.908809][ T5622] Call Trace: [ 201.908813][ T5622] [ 201.908819][ T5622] __dump_stack+0x21/0x30 [ 201.908840][ T5622] dump_stack_lvl+0x140/0x1c0 [ 201.908859][ T5622] ? __cfi_dump_stack_lvl+0x10/0x10 [ 201.908874][ T5622] ? iocb_put+0x933/0xbc0 [ 201.908888][ T5622] dump_stack+0x19/0x20 [ 201.908902][ T5622] should_fail_ex+0x3d7/0x530 [ 201.908918][ T5622] should_fail+0xf/0x20 [ 201.908931][ T5622] should_fail_usercopy+0x1e/0x30 [ 201.908948][ T5622] _copy_from_user+0x20/0xa0 [ 201.908959][ T5622] io_submit_one+0xe3/0x1980 [ 201.908973][ T5622] ? lookup_ioctx+0x360/0x360 [ 201.908985][ T5622] ? asm_exc_page_fault+0x2b/0x30 [ 201.909003][ T5622] ? __asan_memset+0x39/0x50 [ 201.909019][ T5622] ? blk_start_plug+0x71/0x1c0 [ 201.909036][ T5622] __se_sys_io_submit+0x17f/0x3f0 [ 201.909054][ T5622] ? __x64_sys_io_submit+0xa0/0xa0 [ 201.909071][ T5622] ? ksys_write+0x1f3/0x260 [ 201.909087][ T5622] ? __kasan_check_read+0x15/0x20 [ 201.909119][ T5622] __x64_sys_io_submit+0x7f/0xa0 [ 201.909136][ T5622] x64_sys_call+0x1c95/0x2ee0 [ 201.909155][ T5622] do_syscall_64+0x57/0xf0 [ 201.909172][ T5622] ? clear_bhb_loop+0x50/0xa0 [ 201.909184][ T5622] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 201.909201][ T5622] RIP: 0033:0x7f65b299c819 [ 201.909213][ T5622] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 201.909224][ T5622] RSP: 002b:00007f65b37e8028 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 201.909240][ T5622] RAX: ffffffffffffffda RBX: 00007f65b2c15fa0 RCX: 00007f65b299c819 [ 201.909250][ T5622] RDX: 0000200000000540 RSI: 000000000000003b RDI: 00007f65b37bf000 [ 201.909259][ T5622] RBP: 00007f65b37e8090 R08: 0000000000000000 R09: 0000000000000000 [ 201.909268][ T5622] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 201.909276][ T5622] R13: 00007f65b2c16038 R14: 00007f65b2c15fa0 R15: 00007ffda3b14038 [ 201.909286][ T5622] [ 201.953842][ T380] usb 6-1: USB disconnect, device number 5 [ 202.235756][ T36] audit: type=1400 audit(1776112257.129:589): avc: denied { mounton } for pid=5632 comm="syz.5.2091" path="/dev/binderfs/binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 202.260496][ T5637] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2093'. [ 202.272985][ T31] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 202.294415][ T5641] rust_binder: Failed to allocate buffer. len:96, is_oneway:false [ 202.405841][ T5648] netlink: 'syz.1.2098': attribute type 3 has an invalid length. [ 202.423203][ T31] usb 5-1: Using ep0 maxpacket: 32 [ 202.432892][ T31] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 202.443808][ T31] usb 5-1: config 0 has no interface number 0 [ 202.450036][ T31] usb 5-1: config 0 interface 184 altsetting 7 endpoint 0x82 has invalid maxpacket 59136, setting to 1024 [ 202.461955][ T31] usb 5-1: config 0 interface 184 altsetting 7 bulk endpoint 0x82 has invalid maxpacket 1024 [ 202.472340][ T31] usb 5-1: config 0 interface 184 has no altsetting 0 [ 202.484827][ T31] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 202.494715][ T31] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 202.502715][ T31] usb 5-1: Product: syz [ 202.506922][ T31] usb 5-1: Manufacturer: syz [ 202.511566][ T31] usb 5-1: SerialNumber: syz [ 202.517152][ T31] usb 5-1: config 0 descriptor?? [ 202.522546][ T5608] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 202.532203][ T31] smsc75xx v1.0.0 [ 202.543026][ T45] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 202.544911][ T5652] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2100'. [ 202.550735][ T380] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 202.561547][ T5652] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2100'. [ 202.576375][ T5652] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2100'. [ 202.585461][ T5652] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2100'. [ 202.594602][ T5652] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2100'. [ 202.603793][ T5652] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2100'. [ 202.613152][ T5652] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2100'. [ 202.622306][ T5652] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2100'. [ 202.724658][ T380] usb 6-1: device descriptor read/64, error -71 [ 202.732536][ T45] usb 3-1: unable to get BOS descriptor or descriptor too short [ 202.732837][ T5608] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 202.744528][ T45] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 202.765799][ T45] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 202.776365][ T45] usb 3-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice=e1.40 [ 202.785699][ T45] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 202.794191][ T45] usb 3-1: Product: syz [ 202.798421][ T45] usb 3-1: Manufacturer: syz [ 202.803116][ T45] usb 3-1: SerialNumber: syz [ 202.811490][ T45] usb 3-1: selecting invalid altsetting 1 [ 202.817599][ T45] usb 3-1: unit 6 not found! [ 202.822262][ T45] usb 3-1: unit 2 not found! [ 202.829183][ T45] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 202.848441][ T310] udevd[310]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 202.963016][ T380] usb 6-1: device descriptor read/64, error -71 [ 203.170342][ T31] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 203.181633][ T31] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 203.203067][ T380] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 203.333004][ T380] usb 6-1: device descriptor read/64, error -71 [ 203.391588][ T31] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 203.402592][ T31] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 203.412471][ T31] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 203.422789][ T31] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 203.432456][ T31] smsc75xx 5-1:0.184: probe with driver smsc75xx failed with error -32 [ 203.573031][ T380] usb 6-1: device descriptor read/64, error -71 [ 203.683144][ T380] usb usb6-port1: attempt power cycle [ 203.725846][ T5672] FAULT_INJECTION: forcing a failure. [ 203.725846][ T5672] name failslab, interval 1, probability 0, space 0, times 0 [ 203.738735][ T5672] CPU: 1 UID: 0 PID: 5672 Comm: syz.1.2108 Not tainted syzkaller #0 962c4f53752c25f9427fc034aff9bf9776e8b502 [ 203.738772][ T5672] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 203.738784][ T5672] Call Trace: [ 203.738792][ T5672] [ 203.738799][ T5672] __dump_stack+0x21/0x30 [ 203.738820][ T5672] dump_stack_lvl+0x140/0x1c0 [ 203.738836][ T5672] ? __cfi_dump_stack_lvl+0x10/0x10 [ 203.738852][ T5672] ? __asan_set_shadow_00+0x12/0x20 [ 203.738867][ T5672] dump_stack+0x19/0x20 [ 203.738882][ T5672] should_fail_ex+0x3d7/0x530 [ 203.738897][ T5672] ? fuse_do_ioctl+0x2a1/0x1ff0 [ 203.738917][ T5672] should_failslab+0xac/0x100 [ 203.738929][ T5672] __kmalloc_noprof+0x69/0x500 [ 203.738946][ T5672] ? _parse_integer+0x2e/0x40 [ 203.738959][ T5672] ? fuse_do_ioctl+0x2a1/0x1ff0 [ 203.738975][ T5672] fuse_do_ioctl+0x2a1/0x1ff0 [ 203.738991][ T5672] ? ioctl_has_perm+0x39a/0x500 [ 203.739007][ T5672] ? __cfi_fuse_do_ioctl+0x10/0x10 [ 203.739022][ T5672] ? has_cap_mac_admin+0xd0/0xd0 [ 203.739037][ T5672] ? proc_fail_nth_write+0x184/0x220 [ 203.739052][ T5672] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 203.739069][ T5672] ? __fget_files+0x2c5/0x340 [ 203.739081][ T5672] fuse_file_ioctl+0x177/0x190 [ 203.739096][ T5672] ? __cfi_fuse_file_ioctl+0x10/0x10 [ 203.739111][ T5672] __se_sys_ioctl+0x132/0x1b0 [ 203.739123][ T5672] __x64_sys_ioctl+0x7f/0xa0 [ 203.739135][ T5672] x64_sys_call+0x1878/0x2ee0 [ 203.739162][ T5672] do_syscall_64+0x57/0xf0 [ 203.739179][ T5672] ? clear_bhb_loop+0x50/0xa0 [ 203.739192][ T5672] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 203.739210][ T5672] RIP: 0033:0x7fa31559c819 [ 203.739223][ T5672] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 203.739233][ T5672] RSP: 002b:00007fa3163a6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 203.739249][ T5672] RAX: ffffffffffffffda RBX: 00007fa315815fa0 RCX: 00007fa31559c819 [ 203.739259][ T5672] RDX: 0000000000000000 RSI: 000000008010aa01 RDI: 0000000000000003 [ 203.739268][ T5672] RBP: 00007fa3163a6090 R08: 0000000000000000 R09: 0000000000000000 [ 203.739283][ T5672] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 203.739291][ T5672] R13: 00007fa315816038 R14: 00007fa315815fa0 R15: 00007ffddc5f53c8 [ 203.739302][ T5672] [ 204.064141][ T5678] fuse: Bad value for 'user_id' [ 204.069051][ T5678] fuse: Bad value for 'user_id' [ 204.087709][ T5680] syzkaller0: entered promiscuous mode [ 204.093491][ T5680] syzkaller0: entered allmulticast mode [ 204.243052][ T380] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 204.264133][ T380] usb 6-1: device descriptor read/8, error -71 [ 204.394333][ T380] usb 6-1: device descriptor read/8, error -71 [ 204.632984][ T380] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 204.654155][ T380] usb 6-1: device descriptor read/8, error -71 [ 204.784166][ T380] usb 6-1: device descriptor read/8, error -71 [ 204.826605][ T1035] usb 5-1: USB disconnect, device number 37 [ 204.893117][ T380] usb usb6-port1: unable to enumerate USB device [ 204.955772][ T5700] rust_binder: Error in use_page_slow: ESRCH [ 204.955794][ T5700] rust_binder: use_range failure ESRCH [ 204.961907][ T5700] rust_binder: Failed to allocate buffer. len:64, is_oneway:true [ 204.967470][ T5700] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 204.975261][ T5700] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:457 [ 205.109886][ T5711] netlink: 'syz.1.2119': attribute type 1 has an invalid length. [ 205.314499][ T9] usb 3-1: USB disconnect, device number 80 [ 205.350089][ T5718] overlayfs: conflicting lowerdir path [ 205.412586][ T36] audit: type=1326 audit(1776112260.299:590): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5722 comm="syz.2.2126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65b299c819 code=0x7ffc0000 [ 205.412940][ T1035] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 205.436104][ T36] audit: type=1326 audit(1776112260.299:591): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5722 comm="syz.2.2126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65b299c819 code=0x7ffc0000 [ 205.467054][ T36] audit: type=1326 audit(1776112260.299:592): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5722 comm="syz.2.2126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65b299c819 code=0x7ffc0000 [ 205.490636][ T36] audit: type=1326 audit(1776112260.299:593): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5722 comm="syz.2.2126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65b299c819 code=0x7ffc0000 [ 205.514451][ T36] audit: type=1326 audit(1776112260.299:594): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5722 comm="syz.2.2126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f65b299c819 code=0x7ffc0000 [ 205.537792][ T36] audit: type=1326 audit(1776112260.339:595): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5722 comm="syz.2.2126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65b299c819 code=0x7ffc0000 [ 205.561275][ T36] audit: type=1326 audit(1776112260.339:596): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5722 comm="syz.2.2126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65b299c819 code=0x7ffc0000 [ 205.584867][ T36] audit: type=1326 audit(1776112260.339:597): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5722 comm="syz.2.2126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65b299c819 code=0x7ffc0000 [ 205.622984][ T1035] usb 5-1: Using ep0 maxpacket: 32 [ 205.629452][ T1035] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 205.637770][ T1035] usb 5-1: config 0 has no interface number 0 [ 205.643952][ T1035] usb 5-1: config 0 interface 184 altsetting 7 endpoint 0x82 has invalid maxpacket 59136, setting to 1024 [ 205.656409][ T1035] usb 5-1: config 0 interface 184 altsetting 7 bulk endpoint 0x82 has invalid maxpacket 1024 [ 205.669528][ T1035] usb 5-1: config 0 interface 184 has no altsetting 0 [ 205.682754][ T1035] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 205.694262][ T1035] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 205.695033][ T5730] FAULT_INJECTION: forcing a failure. [ 205.695033][ T5730] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 205.702328][ T1035] usb 5-1: Product: syz [ 205.702350][ T1035] usb 5-1: Manufacturer: syz [ 205.702367][ T1035] usb 5-1: SerialNumber: syz [ 205.703495][ T1035] usb 5-1: config 0 descriptor?? [ 205.715796][ T5730] CPU: 1 UID: 0 PID: 5730 Comm: syz.5.2129 Not tainted syzkaller #0 962c4f53752c25f9427fc034aff9bf9776e8b502 [ 205.715828][ T5730] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 205.715840][ T5730] Call Trace: [ 205.715847][ T5730] [ 205.715854][ T5730] __dump_stack+0x21/0x30 [ 205.715957][ T5730] dump_stack_lvl+0x140/0x1c0 [ 205.715983][ T5730] ? __cfi_dump_stack_lvl+0x10/0x10 [ 205.716007][ T5730] ? kasan_save_alloc_info+0x40/0x50 [ 205.716031][ T5730] dump_stack+0x19/0x20 [ 205.716053][ T5730] should_fail_ex+0x3d7/0x530 [ 205.716077][ T5730] should_fail+0xf/0x20 [ 205.716099][ T5730] should_fail_usercopy+0x1e/0x30 [ 205.716123][ T5730] _copy_from_iter+0x1a9/0x1510 [ 205.716164][ T5730] ? __cfi__copy_from_iter+0x10/0x10 [ 205.716191][ T5730] tun_get_user+0x235/0x36c0 [ 205.716212][ T5730] ? __kernel_text_address+0x11/0x40 [ 205.716236][ T5730] ? arch_stack_walk+0x10a/0x170 [ 205.716263][ T5730] ? _parse_integer_limit+0x195/0x1e0 [ 205.716286][ T5730] ? ptr_ring_consume+0x430/0x430 [ 205.716305][ T5730] ? _parse_integer+0x2e/0x40 [ 205.716326][ T5730] ? kstrtoull+0x13b/0x1e0 [ 205.716348][ T5730] ? __kasan_check_write+0x18/0x20 [ 205.716372][ T5730] ? ref_tracker_alloc+0x30d/0x590 [ 205.716397][ T5730] ? __cfi_ref_tracker_alloc+0x10/0x10 [ 205.716421][ T5730] ? selinux_file_permission+0x318/0xb60 [ 205.716447][ T5730] ? __kasan_check_write+0x18/0x20 [ 205.716471][ T5730] tun_chr_write_iter+0x1fc/0x310 [ 205.716491][ T5730] vfs_write+0x764/0xf90 [ 205.716516][ T5730] ? __cfi_vfs_write+0x10/0x10 [ 205.716544][ T5730] ksys_write+0x145/0x260 [ 205.716568][ T5730] ? __cfi_ksys_write+0x10/0x10 [ 205.716593][ T5730] ? __kasan_check_read+0x15/0x20 [ 205.716617][ T5730] __x64_sys_write+0x7f/0x90 [ 205.716641][ T5730] x64_sys_call+0x271c/0x2ee0 [ 205.716667][ T5730] do_syscall_64+0x57/0xf0 [ 205.716706][ T5730] ? clear_bhb_loop+0x50/0xa0 [ 205.716732][ T5730] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 205.716760][ T5730] RIP: 0033:0x7fe11759c819 [ 205.716778][ T5730] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 205.716794][ T5730] RSP: 002b:00007fe118418028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 205.716818][ T5730] RAX: ffffffffffffffda RBX: 00007fe117815fa0 RCX: 00007fe11759c819 [ 205.716834][ T5730] RDX: 000000000000fdef RSI: 0000200000000080 RDI: 0000000000000005 [ 205.716847][ T5730] RBP: 00007fe118418090 R08: 0000000000000000 R09: 0000000000000000 [ 205.716862][ T5730] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 205.716874][ T5730] R13: 00007fe117816038 R14: 00007fe117815fa0 R15: 00007ffc37d3cd38 [ 205.716892][ T5730] [ 206.003004][ T5714] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 206.012518][ T1035] smsc75xx v1.0.0 [ 206.148026][ T5742] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8 sclass=netlink_route_socket pid=5742 comm=syz.5.2133 [ 206.214527][ T5714] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 206.403015][ T380] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 206.422917][ T9] usb 2-1: new high-speed USB device number 84 using dummy_hcd [ 206.518484][ T5751] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:590 [ 206.552952][ T380] usb 6-1: Using ep0 maxpacket: 32 [ 206.568470][ T380] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 206.579790][ T380] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 206.589597][ T380] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 206.592907][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 206.602453][ T380] usb 6-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 206.608932][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 206.616813][ T380] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 206.617575][ T380] usb 6-1: config 0 descriptor?? [ 206.628818][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 206.651310][ T1035] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 206.662174][ T1035] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 206.671783][ T9] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 206.684781][ T9] usb 2-1: New USB device found, idVendor=05ac, idProduct=8241, bcdDevice= 0.00 [ 206.694541][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 206.703454][ T9] usb 2-1: config 0 descriptor?? [ 206.792957][ T10] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 206.894314][ T1035] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 206.905351][ T1035] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 206.915091][ T1035] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 206.925591][ T1035] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 206.935233][ T1035] smsc75xx 5-1:0.184: probe with driver smsc75xx failed with error -32 [ 206.952996][ T10] usb 3-1: Using ep0 maxpacket: 32 [ 206.959321][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 206.970744][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 206.980553][ T10] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 206.990027][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 206.999372][ T10] usb 3-1: config 0 descriptor?? [ 207.007720][ T10] hub 3-1:0.0: USB hub found [ 207.053315][ T380] input: HID 0458:5011 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:0458:5011.0024/input/input60 [ 207.072674][ T380] input: HID 0458:5011 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:0458:5011.0024/input/input61 [ 207.089708][ T380] kye 0003:0458:5011.0024: input,hiddev96,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.5-1/input0 [ 207.205464][ T10] hub 3-1:0.0: 1 port detected [ 207.251458][ T380] usb 6-1: USB disconnect, device number 10 [ 207.333591][ T9] usbhid 2-1:0.0: can't add hid device: -71 [ 207.339695][ T9] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 207.349506][ T9] usb 2-1: USB disconnect, device number 84 [ 207.807783][ T10] hub 3-1:0.0: activate --> -90 [ 207.819482][ T5760] FAULT_INJECTION: forcing a failure. [ 207.819482][ T5760] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 207.832634][ T5760] CPU: 0 UID: 0 PID: 5760 Comm: syz.5.2139 Not tainted syzkaller #0 962c4f53752c25f9427fc034aff9bf9776e8b502 [ 207.832679][ T5760] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 207.832699][ T5760] Call Trace: [ 207.832705][ T5760] [ 207.832720][ T5760] __dump_stack+0x21/0x30 [ 207.832766][ T5760] dump_stack_lvl+0x140/0x1c0 [ 207.832803][ T5760] ? __cfi_dump_stack_lvl+0x10/0x10 [ 207.832834][ T5760] ? check_stack_object+0x12b/0x150 [ 207.832877][ T5760] dump_stack+0x19/0x20 [ 207.832909][ T5760] should_fail_ex+0x3d7/0x530 [ 207.832944][ T5760] should_fail+0xf/0x20 [ 207.832979][ T5760] should_fail_usercopy+0x1e/0x30 [ 207.833005][ T5760] _copy_to_user+0x24/0xa0 [ 207.833024][ T5760] simple_read_from_buffer+0xed/0x160 [ 207.833054][ T5760] proc_fail_nth_read+0x1aa/0x220 [ 207.833096][ T5760] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 207.833128][ T5760] ? __cfi_blk_mq_flush_plug_list+0x10/0x10 [ 207.833161][ T5760] ? bpf_lsm_file_permission+0xd/0x20 [ 207.833190][ T5760] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 207.833213][ T5760] vfs_read+0x289/0xcb0 [ 207.833247][ T5760] ? __cfi_vfs_read+0x10/0x10 [ 207.833272][ T5760] ? __kasan_check_write+0x18/0x20 [ 207.833300][ T5760] ? mutex_lock+0x97/0x1d0 [ 207.833325][ T5760] ? __cfi_mutex_lock+0x10/0x10 [ 207.833349][ T5760] ? __fget_files+0x2c5/0x340 [ 207.833372][ T5760] ksys_read+0x145/0x260 [ 207.833399][ T5760] ? xfd_validate_state+0x68/0x140 [ 207.833426][ T5760] ? __cfi_ksys_read+0x10/0x10 [ 207.833455][ T5760] ? __kasan_check_write+0x18/0x20 [ 207.833482][ T5760] ? fpregs_restore_userregs+0x11c/0x260 [ 207.833504][ T5760] __x64_sys_read+0x7f/0x90 [ 207.833529][ T5760] x64_sys_call+0x2638/0x2ee0 [ 207.833556][ T5760] do_syscall_64+0x57/0xf0 [ 207.833584][ T5760] ? clear_bhb_loop+0x50/0xa0 [ 207.833604][ T5760] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 207.833635][ T5760] RIP: 0033:0x7fe11755d04e [ 207.833654][ T5760] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 207.833671][ T5760] RSP: 002b:00007fe118417fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 207.833695][ T5760] RAX: ffffffffffffffda RBX: 00007fe1184186c0 RCX: 00007fe11755d04e [ 207.833711][ T5760] RDX: 000000000000000f RSI: 00007fe1184180a0 RDI: 0000000000000004 [ 207.833726][ T5760] RBP: 00007fe118418090 R08: 0000000000000000 R09: 0000000000000000 [ 207.833740][ T5760] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 207.833754][ T5760] R13: 00007fe117816038 R14: 00007fe117815fa0 R15: 00007ffc37d3cd38 [ 207.833773][ T5760] [ 207.854620][ T380] kernel read not supported for file /syz1/syz0 (pid: 380 comm: kworker/1:5) [ 208.183917][ T45] usb 5-1: USB disconnect, device number 38 [ 208.227041][ T9] usb 3-1: USB disconnect, device number 81 [ 208.255927][ T5778] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 208.402958][ T380] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 208.502994][ T10] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 208.565789][ T380] usb 2-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 208.575191][ T380] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 208.583412][ T380] usb 2-1: Product: syz [ 208.587688][ T380] usb 2-1: Manufacturer: syz [ 208.592416][ T380] usb 2-1: SerialNumber: syz [ 208.652917][ T10] usb 6-1: Using ep0 maxpacket: 32 [ 208.659259][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 208.670476][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 208.680289][ T10] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 208.693243][ T10] usb 6-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 208.702323][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 208.711458][ T10] usb 6-1: config 0 descriptor?? [ 209.046709][ T5797] netlink: 'syz.4.2153': attribute type 3 has an invalid length. [ 209.132956][ T45] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 209.133834][ T10] input: HID 0458:5011 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:0458:5011.0025/input/input62 [ 209.154665][ T10] input: HID 0458:5011 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:0458:5011.0025/input/input63 [ 209.160175][ T5801] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 209.179238][ T10] kye 0003:0458:5011.0025: input,hiddev96,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.5-1/input0 [ 209.257995][ T5811] __nla_validate_parse: 29 callbacks suppressed [ 209.258019][ T5811] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2159'. [ 209.293009][ T45] usb 3-1: Using ep0 maxpacket: 32 [ 209.299526][ T45] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 209.308000][ T45] usb 3-1: config 0 has no interface number 0 [ 209.314197][ T45] usb 3-1: config 0 interface 184 altsetting 7 endpoint 0x82 has invalid maxpacket 59136, setting to 1024 [ 209.329452][ T45] usb 3-1: config 0 interface 184 altsetting 7 bulk endpoint 0x82 has invalid maxpacket 1024 [ 209.339723][ T45] usb 3-1: config 0 interface 184 has no altsetting 0 [ 209.340348][ T10] usb 6-1: USB disconnect, device number 11 [ 209.349967][ T45] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 209.361815][ T45] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 209.370017][ T45] usb 3-1: Product: syz [ 209.374421][ T45] usb 3-1: Manufacturer: syz [ 209.379165][ T45] usb 3-1: SerialNumber: syz [ 209.386808][ T45] usb 3-1: config 0 descriptor?? [ 209.393524][ T5795] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 209.401586][ T45] smsc75xx v1.0.0 [ 209.406103][ T380] (unnamed net_device) (uninitialized): Assigned a random MAC address: 56:75:d6:61:a8:5e [ 209.417806][ T380] rtl8150 2-1:1.0: eth1: rtl8150 is detected [ 209.425440][ T380] usb 2-1: USB disconnect, device number 85 [ 209.522936][ T31] usb 5-1: new full-speed USB device number 39 using dummy_hcd [ 209.602572][ T5795] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 209.674042][ T31] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 209.685175][ T31] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 255, setting to 64 [ 209.697783][ T31] usb 5-1: New USB device found, idVendor=18ec, idProduct=3288, bcdDevice=69.cf [ 209.706915][ T31] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 209.714990][ T31] usb 5-1: Product: syz [ 209.719211][ T31] usb 5-1: Manufacturer: syz [ 209.723904][ T31] usb 5-1: SerialNumber: syz [ 209.729278][ T31] usb 5-1: config 0 descriptor?? [ 209.734624][ T5813] raw-gadget.3 gadget.4: fail, usb_ep_enable returned -22 [ 209.742603][ T31] usb 5-1: Found UVC 0.00 device syz (18ec:3288) [ 209.749055][ T31] usb 5-1: No valid video chain found. [ 209.928856][ T5818] netlink: 104 bytes leftover after parsing attributes in process `syz.1.2162'. [ 209.946684][ T5813] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 209.956000][ T5819] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 209.959518][ T5813] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 209.965514][ T5819] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 210.010917][ T45] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 210.022018][ T45] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 210.037430][ T5825] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 210.059441][ T5813] syzkaller1: entered promiscuous mode [ 210.071947][ T5813] syzkaller1: entered allmulticast mode [ 210.085536][ T5813] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 210.094236][ T5813] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 210.237668][ T45] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 210.262911][ T45] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 210.272610][ T45] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 210.283214][ T45] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 210.285307][ T1035] usb 5-1: USB disconnect, device number 39 [ 210.292878][ T45] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -32 [ 210.662921][ T10] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 210.812653][ T5848] SELinux: security_context_str_to_sid (sysadm_u) failed with errno=-22 [ 210.821216][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 210.827816][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 210.839001][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 210.849211][ T10] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 210.862228][ T10] usb 2-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 210.871553][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 210.880884][ T10] usb 2-1: config 0 descriptor?? [ 210.962936][ T45] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 211.114510][ T45] usb 6-1: unable to get BOS descriptor or descriptor too short [ 211.123186][ T45] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 211.133344][ T45] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 211.144025][ T45] usb 6-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice=e1.40 [ 211.153161][ T45] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 211.161188][ T45] usb 6-1: Product: syz [ 211.165488][ T45] usb 6-1: Manufacturer: syz [ 211.170113][ T45] usb 6-1: SerialNumber: syz [ 211.174776][ T380] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 211.185874][ T45] usb 6-1: selecting invalid altsetting 1 [ 211.191879][ T45] usb 6-1: unit 6 not found! [ 211.196737][ T45] usb 6-1: unit 2 not found! [ 211.300797][ T10] input: HID 0458:5011 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0458:5011.0026/input/input64 [ 211.317753][ T10] input: HID 0458:5011 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0458:5011.0026/input/input65 [ 211.333581][ T10] kye 0003:0458:5011.0026: input,hiddev96,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.1-1/input0 [ 211.342937][ T380] usb 5-1: Using ep0 maxpacket: 16 [ 211.352650][ T380] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 211.363904][ T380] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 211.374323][ T380] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 211.395179][ T380] usb 5-1: New USB device found, idVendor=05ac, idProduct=8241, bcdDevice= 0.00 [ 211.405044][ T380] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 211.414521][ T45] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 211.424802][ T45] usb 6-1: USB disconnect, device number 12 [ 211.431096][ T380] usb 5-1: config 0 descriptor?? [ 211.436740][ T852] udevd[852]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 211.494409][ T31] usb 2-1: USB disconnect, device number 86 [ 211.922780][ T10] usb 3-1: USB disconnect, device number 82 [ 212.039361][ T380] usbhid 5-1:0.0: can't add hid device: -71 [ 212.046832][ T380] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 212.055939][ T380] usb 5-1: USB disconnect, device number 40 [ 212.115776][ T5887] FAULT_INJECTION: forcing a failure. [ 212.115776][ T5887] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 212.129601][ T5887] CPU: 0 UID: 0 PID: 5887 Comm: syz.1.2188 Not tainted syzkaller #0 962c4f53752c25f9427fc034aff9bf9776e8b502 [ 212.129635][ T5887] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 212.129649][ T5887] Call Trace: [ 212.129656][ T5887] [ 212.129664][ T5887] __dump_stack+0x21/0x30 [ 212.129696][ T5887] dump_stack_lvl+0x140/0x1c0 [ 212.129720][ T5887] ? __cfi_dump_stack_lvl+0x10/0x10 [ 212.129747][ T5887] ? check_stack_object+0x12b/0x150 [ 212.129777][ T5887] dump_stack+0x19/0x20 [ 212.129800][ T5887] should_fail_ex+0x3d7/0x530 [ 212.129825][ T5887] should_fail+0xf/0x20 [ 212.129848][ T5887] should_fail_usercopy+0x1e/0x30 [ 212.129873][ T5887] _copy_to_user+0x24/0xa0 [ 212.129892][ T5887] simple_read_from_buffer+0xed/0x160 [ 212.129914][ T5887] proc_fail_nth_read+0x1aa/0x220 [ 212.129937][ T5887] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 212.129960][ T5887] ? bpf_lsm_file_permission+0xd/0x20 [ 212.129980][ T5887] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 212.130002][ T5887] vfs_read+0x289/0xcb0 [ 212.130028][ T5887] ? __cfi_vfs_read+0x10/0x10 [ 212.130064][ T5887] ? __kasan_check_write+0x18/0x20 [ 212.130090][ T5887] ? mutex_lock+0x97/0x1d0 [ 212.130111][ T5887] ? __cfi_mutex_lock+0x10/0x10 [ 212.130130][ T5887] ? __fget_files+0x2c5/0x340 [ 212.130151][ T5887] ksys_read+0x145/0x260 [ 212.130175][ T5887] ? __cfi_ksys_read+0x10/0x10 [ 212.130202][ T5887] ? __kasan_check_read+0x15/0x20 [ 212.130228][ T5887] __x64_sys_read+0x7f/0x90 [ 212.130253][ T5887] x64_sys_call+0x2638/0x2ee0 [ 212.130290][ T5887] do_syscall_64+0x57/0xf0 [ 212.130316][ T5887] ? clear_bhb_loop+0x50/0xa0 [ 212.130337][ T5887] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 212.130367][ T5887] RIP: 0033:0x7fa31555d04e [ 212.130385][ T5887] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 212.130403][ T5887] RSP: 002b:00007fa3163a5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 212.130426][ T5887] RAX: ffffffffffffffda RBX: 00007fa3163a66c0 RCX: 00007fa31555d04e [ 212.130442][ T5887] RDX: 000000000000000f RSI: 00007fa3163a60a0 RDI: 0000000000000004 [ 212.130475][ T5887] RBP: 00007fa3163a6090 R08: 0000000000000000 R09: 0000000000000000 [ 212.130490][ T5887] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 212.130503][ T5887] R13: 00007fa315816038 R14: 00007fa315815fa0 R15: 00007ffddc5f53c8 [ 212.130520][ T5887] [ 212.131913][ T5889] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 212.383806][ T10] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 212.422881][ T31] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 212.542863][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 212.554529][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 212.572872][ T31] usb 6-1: Using ep0 maxpacket: 16 [ 212.572890][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 212.572920][ T10] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 212.584542][ T31] usb 6-1: config index 0 descriptor too short (expected 51443, got 18) [ 212.592012][ T10] usb 2-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 212.623641][ T31] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 212.632722][ T31] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 212.641076][ T31] usb 6-1: Product: syz [ 212.645480][ T31] usb 6-1: Manufacturer: syz [ 212.650364][ T31] usb 6-1: SerialNumber: syz [ 212.662766][ T31] r8152-cfgselector 6-1: Unknown version 0x0000 [ 212.668798][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 212.681338][ T31] r8152-cfgselector 6-1: config 0 descriptor?? [ 212.690383][ T10] usb 2-1: config 0 descriptor?? [ 212.862504][ T5913] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 213.098701][ T380] r8152-cfgselector 6-1: USB disconnect, device number 13 [ 213.118273][ T10] input: HID 0458:5011 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0458:5011.0027/input/input66 [ 213.131540][ T10] input: HID 0458:5011 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0458:5011.0027/input/input67 [ 213.148659][ T10] kye 0003:0458:5011.0027: input,hiddev96,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.1-1/input0 [ 213.212960][ T31] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 213.319342][ T10] usb 2-1: USB disconnect, device number 87 [ 213.362945][ T31] usb 5-1: Using ep0 maxpacket: 16 [ 213.369696][ T31] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 213.380759][ T31] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 213.390640][ T31] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 213.403779][ T31] usb 5-1: New USB device found, idVendor=05ac, idProduct=8241, bcdDevice= 0.00 [ 213.412929][ T31] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 213.421538][ T31] usb 5-1: config 0 descriptor?? [ 213.556199][ T5947] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 213.613687][ T5955] FAULT_INJECTION: forcing a failure. [ 213.613687][ T5955] name failslab, interval 1, probability 0, space 0, times 0 [ 213.634708][ T5955] CPU: 0 UID: 0 PID: 5955 Comm: syz.2.2212 Not tainted syzkaller #0 962c4f53752c25f9427fc034aff9bf9776e8b502 [ 213.634746][ T5955] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 213.634759][ T5955] Call Trace: [ 213.634766][ T5955] [ 213.634773][ T5955] __dump_stack+0x21/0x30 [ 213.634805][ T5955] dump_stack_lvl+0x140/0x1c0 [ 213.634830][ T5955] ? __cfi_dump_stack_lvl+0x10/0x10 [ 213.634857][ T5955] dump_stack+0x19/0x20 [ 213.634880][ T5955] should_fail_ex+0x3d7/0x530 [ 213.634905][ T5955] ? kobject_get_path+0xc3/0x2d0 [ 213.634933][ T5955] should_failslab+0xac/0x100 [ 213.634953][ T5955] __kmalloc_noprof+0x69/0x500 [ 213.634980][ T5955] ? kasan_save_alloc_info+0x40/0x50 [ 213.635003][ T5955] ? kobject_get_path+0xc3/0x2d0 [ 213.635027][ T5955] ? __kasan_kmalloc+0x96/0xb0 [ 213.635063][ T5955] kobject_get_path+0xc3/0x2d0 [ 213.635094][ T5955] kobject_uevent_env+0x2bc/0x7e0 [ 213.635116][ T5955] kobject_uevent+0x21/0x40 [ 213.635136][ T5955] lo_ioctl+0x1481/0x2070 [ 213.635165][ T5955] ? arch_stack_walk+0x10a/0x170 [ 213.635193][ T5955] ? __cfi_lo_ioctl+0x10/0x10 [ 213.635221][ T5955] ? stack_depot_save_flags+0x38/0x800 [ 213.635247][ T5955] ? stack_trace_save+0xaa/0x100 [ 213.635268][ T5955] ? kasan_save_track+0x4f/0x80 [ 213.635296][ T5955] ? kasan_save_track+0x3e/0x80 [ 213.635323][ T5955] ? kasan_save_alloc_info+0x40/0x50 [ 213.635346][ T5955] ? __kasan_slab_alloc+0x73/0x90 [ 213.635365][ T5955] ? kmem_cache_alloc_noprof+0x1bf/0x410 [ 213.635391][ T5955] ? security_inode_alloc+0x51/0x230 [ 213.635420][ T5955] ? inode_init_always_gfp+0x756/0x9e0 [ 213.635440][ T5955] ? alloc_inode+0xc5/0x270 [ 213.635457][ T5955] ? new_inode+0x25/0x1e0 [ 213.635476][ T5955] ? proc_pid_make_inode+0x25/0x140 [ 213.635504][ T5955] ? proc_pident_instantiate+0x6d/0x2c0 [ 213.635523][ T5955] ? proc_pident_lookup+0x1c7/0x270 [ 213.635541][ T5955] ? proc_tid_base_lookup+0x2f/0x40 [ 213.635564][ T5955] ? path_openat+0x1315/0x34f0 [ 213.635596][ T5955] ? do_filp_open+0x1f5/0x440 [ 213.635616][ T5955] ? do_sys_openat2+0x134/0x1d0 [ 213.635639][ T5955] ? __x64_sys_openat+0x13a/0x170 [ 213.635662][ T5955] ? x64_sys_call+0xe69/0x2ee0 [ 213.635689][ T5955] ? do_syscall_64+0x57/0xf0 [ 213.635718][ T5955] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 213.635750][ T5955] ? avc_has_perm_noaudit+0x26c/0x360 [ 213.635779][ T5955] ? __asan_memcpy+0x5a/0x80 [ 213.635804][ T5955] ? avc_has_perm_noaudit+0x28a/0x360 [ 213.635834][ T5955] ? avc_has_perm+0x155/0x240 [ 213.635861][ T5955] ? __cfi_avc_has_perm+0x10/0x10 [ 213.635886][ T5955] ? kasan_save_alloc_info+0x40/0x50 [ 213.635912][ T5955] ? selinux_file_open+0x46c/0x630 [ 213.635938][ T5955] ? __cfi_selinux_file_open+0x10/0x10 [ 213.635966][ T5955] ? avc_has_extended_perms+0x80b/0xe70 [ 213.635994][ T5955] ? __asan_memcpy+0x5a/0x80 [ 213.636019][ T5955] ? avc_has_extended_perms+0x969/0xe70 [ 213.636057][ T5955] ? __asan_set_shadow_00+0x12/0x20 [ 213.636081][ T5955] ? do_vfs_ioctl+0x182d/0x2010 [ 213.636102][ T5955] ? arch_stack_walk+0x10a/0x170 [ 213.636130][ T5955] ? __ia32_compat_sys_ioctl+0x920/0x920 [ 213.636152][ T5955] ? _parse_integer+0x2e/0x40 [ 213.636176][ T5955] ? __asan_set_shadow_00+0x12/0x20 [ 213.636200][ T5955] ? blkdev_common_ioctl+0x11d8/0x2730 [ 213.636226][ T5955] ? blkdev_bszset+0x230/0x230 [ 213.636249][ T5955] ? has_cap_mac_admin+0xd0/0xd0 [ 213.636275][ T5955] ? proc_fail_nth_write+0x184/0x220 [ 213.636297][ T5955] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 213.636322][ T5955] ? selinux_file_ioctl+0x732/0x1480 [ 213.636346][ T5955] ? vfs_write+0x9a4/0xf90 [ 213.636372][ T5955] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 213.636397][ T5955] ? __cfi_vfs_write+0x10/0x10 [ 213.636424][ T5955] ? __kasan_check_write+0x18/0x20 [ 213.636449][ T5955] ? mutex_unlock+0x90/0x240 [ 213.636472][ T5955] ? __cfi_mutex_unlock+0x10/0x10 [ 213.636494][ T5955] ? __fget_files+0x2c5/0x340 [ 213.636512][ T5955] ? __cfi_lo_ioctl+0x10/0x10 [ 213.636541][ T5955] blkdev_ioctl+0x548/0x690 [ 213.636565][ T5955] ? __cfi_blkdev_ioctl+0x10/0x10 [ 213.636589][ T5955] ? bpf_lsm_file_ioctl+0xd/0x20 [ 213.636610][ T5955] ? security_file_ioctl+0x3e/0x110 [ 213.636657][ T5955] ? __cfi_blkdev_ioctl+0x10/0x10 [ 213.636680][ T5955] __se_sys_ioctl+0x132/0x1b0 [ 213.636700][ T5955] __x64_sys_ioctl+0x7f/0xa0 [ 213.636718][ T5955] x64_sys_call+0x1878/0x2ee0 [ 213.636745][ T5955] do_syscall_64+0x57/0xf0 [ 213.636771][ T5955] ? clear_bhb_loop+0x50/0xa0 [ 213.636791][ T5955] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 213.636820][ T5955] RIP: 0033:0x7f65b299c819 [ 213.636839][ T5955] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 213.636857][ T5955] RSP: 002b:00007f65b37e8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 213.636881][ T5955] RAX: ffffffffffffffda RBX: 00007f65b2c15fa0 RCX: 00007f65b299c819 [ 213.636898][ T5955] RDX: 0000000000000003 RSI: 0000000000004c06 RDI: 0000000000000005 [ 213.636912][ T5955] RBP: 00007f65b37e8090 R08: 0000000000000000 R09: 0000000000000000 [ 213.636926][ T5955] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 213.636939][ T5955] R13: 00007f65b2c16038 R14: 00007f65b2c15fa0 R15: 00007ffda3b14038 [ 213.636958][ T5955] [ 213.764233][ T36] kauditd_printk_skb: 59 callbacks suppressed [ 213.764272][ T36] audit: type=1400 audit(1776112268.659:657): avc: denied { read } for pid=5959 comm="poweroff" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 214.043681][ T5971] rust_binder: 1182: no such ref 0 [ 214.047253][ T36] audit: type=1400 audit(1776112268.739:658): avc: denied { ioctl } for pid=5936 comm="syz.4.2204" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 214.056091][ T5971] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:1182 [ 214.058448][ T31] usbhid 5-1:0.0: can't add hid device: -71 [ 214.248866][ T31] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 214.258686][ T31] usb 5-1: USB disconnect, device number 41 [ 214.282683][ T5980] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2221'. [ 214.334499][ T36] audit: type=1400 audit(1776112269.219:659): avc: denied { read write } for pid=5982 comm="syz.5.2223" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 214.340449][ T5984] FAULT_INJECTION: forcing a failure. [ 214.340449][ T5984] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 214.375631][ T5984] CPU: 1 UID: 0 PID: 5984 Comm: syz.2.2222 Not tainted syzkaller #0 962c4f53752c25f9427fc034aff9bf9776e8b502 [ 214.375668][ T5984] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 214.375680][ T5984] Call Trace: [ 214.375688][ T5984] [ 214.375696][ T5984] __dump_stack+0x21/0x30 [ 214.375726][ T5984] dump_stack_lvl+0x140/0x1c0 [ 214.375751][ T5984] ? __cfi_dump_stack_lvl+0x10/0x10 [ 214.375777][ T5984] ? _parse_integer+0x2e/0x40 [ 214.375800][ T5984] ? kstrtoull+0x13b/0x1e0 [ 214.375820][ T5984] dump_stack+0x19/0x20 [ 214.375842][ T5984] should_fail_ex+0x3d7/0x530 [ 214.375866][ T5984] should_fail+0xf/0x20 [ 214.375886][ T5984] should_fail_usercopy+0x1e/0x30 [ 214.375910][ T5984] _copy_from_user+0x20/0xa0 [ 214.375927][ T5984] ___sys_sendmsg+0x1c7/0x370 [ 214.375954][ T5984] ? __sys_sendmsg+0x2a0/0x2a0 [ 214.375981][ T5984] ? proc_fail_nth_write+0x184/0x220 [ 214.376003][ T5984] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 214.376031][ T5984] __x64_sys_sendmsg+0x1fb/0x2d0 [ 214.376059][ T5984] ? fput+0x1a4/0x240 [ 214.376092][ T5984] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 214.376118][ T5984] ? ksys_write+0x1f3/0x260 [ 214.376146][ T5984] ? __kasan_check_read+0x15/0x20 [ 214.376173][ T5984] x64_sys_call+0x2a4c/0x2ee0 [ 214.376200][ T5984] do_syscall_64+0x57/0xf0 Stopping sshd: [ 214.376227][ T5984] ? clear_bhb_loop+0x50/0xa0 [ 214.376248][ T5984] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 214.376275][ T5984] RIP: 0033:0x7f65b299c819 stopped /usr/sbi[ 214.376294][ T5984] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 n/sshd (pid 202)[ 214.376310][ T5984] RSP: 002b:00007f65b37e8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e OK[ 214.376334][ T5984] RAX: ffffffffffffffda RBX: 00007f65b2c15fa0 RCX: 00007f65b299c819 [ 214.376351][ T5984] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 0000000000000003 [ 214.376364][ T5984] RBP: 00007f65b37e8090 R08: 0000000000000000 R09: 0000000000000000 [ 214.376378][ T5984] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 214.376391][ T5984] R13: 00007f65b2c16038 R14: 00007f65b2c15fa0 R15: 00007ffda3b14038 [ 214.376408][ T5984] [ 214.376741][ T36] audit: type=1400 audit(1776112269.219:660): avc: denied { open } for pid=5982 comm="syz.5.2223" path="/dev/raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 214.580988][ T9] usb 6-1: new high-speed USB device number 14 using dummy_hcd Stopping crond: stopped /usr/sbi[ 214.658143][ T5997] netlink: 'syz.4.2225': attribute type 27 has an invalid length. n/crond (pid 194) OK [ 214.714615][ T5997] veth0_vlan: left promiscuous mode [ 214.721159][ T5997] veth0_vlan: entered promiscuous mode [ 214.728593][ T5997] veth1_macvtap: left promiscuous mode [ 214.735172][ T5997] veth1_macvtap: entered promiscuous mode [ 214.743698][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 214.750821][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state Stopping dhcpcd... stopped /sbin/dhcpcd (pid 148) [ 214.783470][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 214.790767][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 214.807650][ T6008] rust_binder: 524: no such ref 0 [ 214.814396][ T6008] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:524 [ 214.829477][ T6000] netlink: 'syz.2.2226': attribute type 27 has an invalid length. Stopping network: [ 214.894256][ T6000] veth0_vlan: left promiscuous mode [ 214.899962][ T6000] veth0_vlan: entered promiscuous mode [ 214.907224][ T6000] veth1_macvtap: left promiscuous mode [ 214.914217][ T6000] veth1_macvtap: entered promiscuous mode [ 214.926216][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 214.933351][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 214.941573][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 214.963350][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 214.974707][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 214.985593][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 214.993030][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 214.995822][ T6023] netlink: 104 bytes leftover after parsing attributes in process `syz.2.2231'. [ 215.012864][ T9] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 215.025785][ T36] audit: type=1400 audit(1776112269.889:661): avc: denied { read write } for pid=6018 comm="ip" path="/dev/console" dev="rootfs" ino=21 scontext=system_u:system_r:ifconfig_t tcontext=system_u:object_r:root_t tclass=chr_file permissive=1 [ 215.029802][ T9] usb 6-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 215.069341][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 215.129042][ T9] usb 6-1: config 0 descriptor?? [ 215.170900][ T6036] rust_binder: 1191: no such ref 0 OK [ 215.179531][ T6036] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:1191 [ 215.207970][ T36] audit: type=1400 audit(1776112270.099:662): avc: denied { unlink } for pid=149 comm="dhcpcd" name="sock" dev="tmpfs" ino=423 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=sock_file permissive=1 Stopping iptables: OK [ 215.288448][ T36] audit: type=1400 audit(1776112270.159:663): avc: denied { read write } for pid=6045 comm="iptables" path="/dev/console" dev="rootfs" ino=21 scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:root_t tclass=chr_file permissive=1 [ 215.293094][ T6049] fuse: Bad value for 'user_id' [ 215.313822][ T36] audit: type=1400 audit(1776112270.159:664): avc: denied { search } for pid=6045 comm="iptables" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 215.340932][ T6049] fuse: Bad value for 'user_id' [ 215.345078][ T36] audit: type=1400 audit(1776112270.159:665): avc: denied { write } for pid=6045 comm="iptables" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Stopping system [ 215.370407][ T1035] usb 3-1: new high-speed USB device number 83 using dummy_hcd message bus: [ 215.380793][ T36] audit: type=1400 audit(1776112270.159:666): avc: denied { add_name } for pid=6045 comm="iptables" name="xtables.lock" scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 215.406855][ T6054] FAULT_INJECTION: forcing a failure. [ 215.406855][ T6054] name failslab, interval 1, probability 0, space 0, times 0 [ 215.414197][ T6055] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2241'. [ 215.421386][ T6054] CPU: 1 UID: 0 PID: 6054 Comm: syz.1.2238 Not tainted syzkaller #0 962c4f53752c25f9427fc034aff9bf9776e8b502 [ 215.421416][ T6054] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 215.421428][ T6054] Call Trace: [ 215.421436][ T6054] [ 215.421444][ T6054] __dump_stack+0x21/0x30 [ 215.421473][ T6054] dump_stack_lvl+0x140/0x1c0 [ 215.421497][ T6054] ? __cfi_dump_stack_lvl+0x10/0x10 [ 215.421521][ T6054] ? __kasan_check_write+0x18/0x20 [ 215.421547][ T6054] dump_stack+0x19/0x20 [ 215.421569][ T6054] should_fail_ex+0x3d7/0x530 [ 215.421593][ T6054] should_failslab+0xac/0x100 [ 215.421612][ T6054] kmem_cache_alloc_noprof+0x42/0x410 done[ 215.421637][ T6054] ? getname_flags+0xc5/0x700 [ 215.421662][ T6054] ? __cfi_ksys_write+0x10/0x10 [ 215.421688][ T6054] getname_flags+0xc5/0x700 [ 215.421713][ T6054] __x64_sys_rename+0x61/0xa0 [ 215.421747][ T6054] x64_sys_call+0x150b/0x2ee0 [ 215.421773][ T6054] do_syscall_64+0x57/0xf0 [ 215.421799][ T6054] ? clear_bhb_loop+0x50/0xa0 [ 215.421818][ T6054] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 215.421845][ T6054] RIP: 0033:0x7fa31559c819 [ 215.421861][ T6054] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 215.421879][ T6054] RSP: 002b:00007fa313ff7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000052 [ 215.421901][ T6054] RAX: ffffffffffffffda RBX: 00007fa315816180 RCX: 00007fa31559c819 [ 215.421916][ T6054] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000200000000100 [ 215.421939][ T6054] RBP: 00007fa313ff7090 R08: 0000000000000000 R09: 0000000000000000 [ 215.421952][ T6054] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 215.421964][ T6054] R13: 00007fa315816218 R14: 00007fa315816180 R15: 00007ffddc5f53c8 [ 215.421981][ T6054] [ 215.637080][ T9] input: HID 0458:5011 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:0458:5011.0028/input/input68 [ 215.650155][ T9] input: HID 0458:5011 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:0458:5011.0028/input/input69 [ 215.669995][ T9] kye 0003:0458:5011.0028: input,hiddev96,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.5-1/input0 [ 215.712867][ T1035] usb 3-1: Using ep0 maxpacket: 16 [ 215.742897][ T1035] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 215.760668][ T1035] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 215.770992][ T1035] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 215.784581][ T1035] usb 3-1: New USB device found, idVendor=05ac, idProduct=8241, bcdDevice= 0.00 [ 215.794346][ T380] usb 6-1: USB disconnect, device number 14 [ 215.795448][ T1035] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 215.809618][ T1035] usb 3-1: config 0 descriptor?? Stopping klogd: [ 215.851304][ T6075] rust_binder: 545: no such ref 0 OK Stopping acpid: [ 216.152893][ T45] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 216.310492][ T6102] rust_binder: Error in use_page_slow: ESRCH [ 216.310519][ T6102] rust_binder: use_range failure ESRCH [ 216.316937][ T6102] rust_binder: Failed to allocate buffer. len:64, is_oneway:true [ 216.321080][ T6104] rust_binder: 109: no such ref 0 [ 216.322463][ T6102] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 216.335738][ T6102] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:1219 [ 216.420334][ T1035] usbhid 3-1:0.0: can't add hid device: -71 [ 216.436700][ T1035] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 216.445735][ T1035] usb 3-1: USB disconnect, device number 83 [ 216.595096][ T6125] rust_binder: 121: no such ref 0 [ 216.763163][ T6132] netlink: 9 bytes leftover after parsing attributes in process `syz.5.2264'. [ 216.772499][ T6132] gretap0: entered promiscuous mode [ 216.780080][ T6132] netlink: 5 bytes leftover after parsing attributes in process `syz.5.2264'. [ 216.782969][ T380] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 216.789334][ T6132] 0ªî{X¹¦: renamed from gretap0 [ 216.803122][ T6132] 0ªî{X¹¦: left promiscuous mode [ 216.808171][ T6132] 0ªî{X¹¦: entered allmulticast mode [ 216.814483][ T6132] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. OK [ 216.943058][ T380] usb 2-1: Using ep0 maxpacket: 32 Stopping syslogd: [ 216.953495][ T380] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 216.965908][ T380] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 216.979694][ T6142] can: request_module (can-proto-0) failed. [ 216.989221][ T380] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 stopped /sbin/syslogd (pid 92)[ 217.004335][ T380] usb 2-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 217.014759][ T380] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 OK [ 217.024894][ T380] usb 2-1: config 0 descriptor?? [ 217.159142][ T6152] bridge: RTM_NEWNEIGH with invalid ether address umount: can't remount debugfs read-only umount: sysfs busy - remounted read-only umount: devtmpfs busy - remounted read-only umount: can't remount /dev/root read-only The system is going down NOW! Sent SIGTERM to all processes Connection to 10.128.1.33 closed by remote host. [ 217.520371][ T293] bridge_slave_1: left allmulticast mode [ 217.526333][ T293] bridge_slave_1: left promiscuous mode [ 217.532020][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 217.539717][ T293] bridge_slave_0: left allmulticast mode [ 217.545438][ T293] bridge_slave_0: left promiscuous mode [ 217.551034][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 217.618402][ T380] usbhid 2-1:0.0: can't add hid device: -71 [ 217.626826][ T380] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 217.642908][ T380] usb 2-1: USB disconnect, device number 88 [ 217.657532][ T293] veth1_macvtap: left promiscuous mode [ 217.663172][ T293] veth0_vlan: left promiscuous mode [ 217.995834][ T293] bridge_slave_1: left allmulticast mode [ 218.001510][ T293] bridge_slave_1: left promiscuous mode [ 218.007465][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 218.015166][ T293] bridge_slave_0: left allmulticast mode [ 218.020880][ T293] bridge_slave_0: left promiscuous mode [ 218.026645][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 218.034240][ T293] bridge_slave_1: left allmulticast mode [ 218.039892][ T293] bridge_slave_1: left promiscuous mode [ 218.045624][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 218.052997][ T293] bridge_slave_0: left allmulticast mode [ 218.058662][ T293] bridge_slave_0: left promiscuous mode [ 218.064271][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 218.072153][ T293] bridge_slave_1: left allmulticast mode [ 218.077865][ T293] bridge_slave_1: left promiscuous mode [ 218.084337][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 218.092070][ T293] bridge_slave_0: left allmulticast mode [ 218.097881][ T293] bridge_slave_0: left promiscuous mode [ 218.104123][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 218.386466][ T293] tipc: Left network mode [ 218.392841][ T293] veth1_macvtap: left promiscuous mode [ 218.398402][ T293] veth0_vlan: left promiscuous mode Sent SIGKILL to[ 218.404466][ T293] veth1_macvtap: left promiscuous mode all processes [ 218.410987][ T293] veth0_vlan: left promiscuous mode Requesting system poweroff [ 219.014923][ T293] ------------[ cut here ]------------ [ 219.020436][ T293] WARNING: CPU: 1 PID: 293 at net/ipv6/xfrm6_tunnel.c:341 xfrm6_tunnel_net_exit+0xc4/0x140 [ 219.030686][ T293] Modules linked in: [ 219.034711][ T293] CPU: 1 UID: 0 PID: 293 Comm: kworker/u8:3 Not tainted syzkaller #0 962c4f53752c25f9427fc034aff9bf9776e8b502 [ 219.046397][ T293] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 219.056859][ T293] Workqueue: netns cleanup_net [ 219.061653][ T293] RIP: 0010:xfrm6_tunnel_net_exit+0xc4/0x140 [ 219.067786][ T293] Code: e8 91 42 d9 fc 4b 83 3c 3e 00 75 19 e8 85 04 81 fc 49 81 ff f8 07 00 00 74 1b e8 77 04 81 fc 49 83 c7 08 eb c9 e8 6c 04 81 fc <0f> 0b 49 81 ff f8 07 00 00 75 e5 49 8d 9e 00 08 00 00 45 31 ff 4a [ 219.088067][ T293] RSP: 0018:ffffc9000b6dfb90 EFLAGS: 00010293 [ 219.094292][ T293] RAX: ffffffff8506a654 RBX: ffff88811fbc11c0 RCX: ffff88811fbddf00 [ 219.102330][ T293] RDX: 0000000000000000 RSI: 0000000000c00000 RDI: ffff8881033d00b8 [ 219.110448][ T293] RBP: ffffc9000b6dfbb0 R08: ffffffff87d38f47 R09: 1ffffffff0fa71e8 [ 219.118448][ T293] R10: dffffc0000000000 R11: fffffbfff0fa71e9 R12: dffffc0000000000 [ 219.126536][ T293] R13: dffffc0000000000 R14: ffff8881033d0000 R15: 00000000000000b8 [ 219.134523][ T293] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 219.144074][ T293] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 219.150651][ T293] CR2: 00007fd89f1f84c0 CR3: 000000010b376000 CR4: 00000000003526b0 [ 219.158633][ T293] Call Trace: [ 219.161992][ T293] [ 219.164960][ T293] cleanup_net+0x6bd/0xc90 [ 219.169392][ T293] ? __cfi_cleanup_net+0x10/0x10 [ 219.174339][ T293] ? kick_pool+0xb9/0x550 [ 219.178681][ T293] process_scheduled_works+0x7d1/0x1020 [ 219.184239][ T293] worker_thread+0xc70/0x10b0 [ 219.189020][ T293] ? __cfi_try_to_wake_up+0x10/0x10 [ 219.194225][ T293] kthread+0x2c6/0x370 [ 219.198287][ T293] ? __cfi_worker_thread+0x10/0x10 [ 219.203535][ T293] ? __cfi_kthread+0x10/0x10 [ 219.208174][ T293] ret_from_fork+0x67/0xa0 [ 219.212607][ T293] ? __cfi_kthread+0x10/0x10 [ 219.217344][ T293] ret_from_fork_asm+0x1a/0x30 [ 219.222147][ T293] [ 219.225276][ T293] ---[ end trace 0000000000000000 ]--- [ 219.230976][ T293] ------------[ cut here ]------------ [ 219.236634][ T293] WARNING: CPU: 1 PID: 293 at net/ipv6/xfrm6_tunnel.c:344 xfrm6_tunnel_net_exit+0x119/0x140 [ 219.246767][ T293] Modules linked in: [ 219.250781][ T293] CPU: 1 UID: 0 PID: 293 Comm: kworker/u8:3 Tainted: G W syzkaller #0 962c4f53752c25f9427fc034aff9bf9776e8b502 [ 219.265656][ T293] Tainted: [W]=WARN [ 219.269558][ T293] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 219.279856][ T293] Workqueue: netns cleanup_net [ 219.284687][ T293] RIP: 0010:xfrm6_tunnel_net_exit+0x119/0x140 [ 219.290763][ T293] Code: fc 4b 83 bc 3e 00 08 00 00 00 75 19 e8 30 04 81 fc 49 81 ff f8 07 00 00 74 1b e8 22 04 81 fc 49 83 c7 08 eb c5 e8 17 04 81 fc <0f> 0b 49 81 ff f8 07 00 00 75 e5 e8 07 04 81 fc 5b 41 5c 41 5e 41 [ 219.310396][ T293] RSP: 0018:ffffc9000b6dfb90 EFLAGS: 00010293 [ 219.316575][ T293] RAX: ffffffff8506a6a9 RBX: ffff8881033d0800 RCX: ffff88811fbddf00 [ 219.324592][ T293] RDX: 0000000000000000 RSI: 0000000000c00000 RDI: ffff8881033d0808 [ 219.332651][ T293] RBP: ffffc9000b6dfbb0 R08: ffffffff87d38f47 R09: 1ffffffff0fa71e8 [ 219.340726][ T293] R10: dffffc0000000000 R11: fffffbfff0fa71e9 R12: dffffc0000000000 [ 219.349245][ T293] R13: dffffc0000000000 R14: ffff8881033d0000 R15: 0000000000000008 [ 219.357435][ T293] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 219.366482][ T293] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 219.373174][ T293] CR2: 00007fd89f1f84c0 CR3: 000000010b376000 CR4: 00000000003526b0 [ 219.381236][ T293] Call Trace: [ 219.384582][ T293] [ 219.388399][ T293] cleanup_net+0x6bd/0xc90 [ 219.393074][ T293] ? __cfi_cleanup_net+0x10/0x10 [ 219.398060][ T293] ? kick_pool+0xb9/0x550 [ 219.402738][ T293] process_scheduled_works+0x7d1/0x1020 [ 219.408428][ T293] worker_thread+0xc70/0x10b0 [ 219.413164][ T293] ? __cfi_try_to_wake_up+0x10/0x10 [ 219.418425][ T293] kthread+0x2c6/0x370 [ 219.422700][ T293] ? __cfi_worker_thread+0x10/0x10 [ 219.428388][ T293] ? __cfi_kthread+0x10/0x10 [ 219.428949][ T6163] sd 0:0:1:0: [sda] Synchronizing SCSI cache [ 219.433072][ T293] ret_from_fork+0x67/0xa0 [ 219.443910][ T293] ? __cfi_kthread+0x10/0x10 [ 219.448526][ T293] ret_from_fork_asm+0x1a/0x30 [ 219.453394][ T293] [ 219.454081][ T6163] ACPI: PM: Preparing to enter system sleep state S5 [ 219.456518][ T293] ---[ end trace 0000000000000000 ]--- [ 219.463610][ T6163] kvm: exiting hardware virtualization [ 219.474622][ T6163] reboot: Power down [ 219.477174][ T293] ------------[ cut here ]------------ [ 219.484132][ T293] WARNING: CPU: 1 PID: 293 at net/xfrm/xfrm_state.c:3216 xfrm_state_fini+0x2be/0x310 [ 219.493708][ T293] Modules linked in: [ 219.497898][ T293] CPU: 1 UID: 0 PID: 293 Comm: kworker/u8:3 Tainted: G W syzkaller #0 962c4f53752c25f9427fc034aff9bf9776e8b502 serialport: VM disconnected.