last executing test programs: 1m31.580684664s ago: executing program 1 (id=14): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_sco_SCO_CONNINFO(r0, 0x11, 0x2, &(0x7f0000000000)=""/39, &(0x7f0000000040)=0x27) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r0, 0x40089413, &(0x7f0000000080)=0x80000000) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) close_range(r0, r1, 0xabeeae1f81e8930d) (async) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, &(0x7f0000000100)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) (async) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000500)={{r0}, 0xc18b, 0x8, 0x5}) (async, rerun: 32) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x3d) (rerun: 32) ioctl$KVM_IRQ_LINE(r2, 0x4008ae61, &(0x7f0000000540)={0x7e2, 0x4}) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000580)={'raw\x00', 0x0, [0x3, 0x9000000, 0x4, 0xf48, 0xfffffffe]}, &(0x7f0000000600)=0x54) r3 = open(&(0x7f0000000640)='./file0\x00', 0x0, 0x4) write$eventfd(r3, &(0x7f0000000680)=0x6, 0x8) (async) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000700), r1) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r1, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x40, r4, 0x300, 0x70bd29, 0x25dfdbfb, {}, [@BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x1000}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xfffff000}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x7}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @random="1bbaab857bf1"}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x4) (async, rerun: 32) ioctl$NILFS_IOCTL_RESIZE(r1, 0x40086e8b, &(0x7f0000000800)=0x3) (rerun: 32) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000880), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(r5, &(0x7f0000000940)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000900)={&(0x7f00000008c0)={0x1c, r6, 0x10, 0x70bd26, 0x25dfdbfd, {}, [@NL802154_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x50}, 0x4000000) write$nbd(r1, &(0x7f0000000980)={0x67446698, 0x0, 0x3, 0x0, 0x4, "f1bb35023b4f701079bb64ebe7128d198f369298427382fca278273dbd56381dff94bf7c9528298636198ea5"}, 0x3c) r7 = openat$incfs(r1, &(0x7f00000009c0)='.pending_reads\x00', 0x400000, 0x8) ioctl$BTRFS_IOC_SPACE_INFO(r7, 0xc0109414, &(0x7f0000000a00)={0x8f2, 0xfffffffffffff2aa, ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}) (async, rerun: 64) r8 = socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 64) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r1) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f000000e100), r7) sendmsg$NL80211_CMD_SET_REG(r3, &(0x7f000000e1c0)={&(0x7f000000e0c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f000000e180)={&(0x7f000000e140)={0x34, r9, 0x100, 0x70bd28, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY={0x8, 0x1, 0x69}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x1}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x2}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x44000000}, 0x20040000) (async) r10 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x1c) ioctl$KVM_CAP_XEN_HVM(r10, 0x4068aea3, &(0x7f000000e200)={0x26, 0x0, 0x5a}) (async) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f000000e2c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_PAN_ID(r5, &(0x7f000000e380)={&(0x7f000000e280)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f000000e340)={&(0x7f000000e300)={0x34, 0x0, 0x100, 0x70bd29, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r11}]}, 0x34}, 0x1, 0x0, 0x0, 0x95}, 0x8004) (async) fcntl$F_SET_FILE_RW_HINT(r8, 0x40e, &(0x7f000000e3c0)=0x2) 1m31.502510286s ago: executing program 1 (id=16): r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=0x0, &(0x7f00000002c0)=0x0, &(0x7f0000000140)=0x0) r4 = syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0xc, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)) r6 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r4, 0x2) mount$binderfs(0x0, &(0x7f0000000100)='./binderfs\x00', 0x0, 0x4800, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r6, 0x4058587a, &(0x7f0000000400)={{r5, &(0x7f0000000000)='\x00', 0x400, &(0x7f0000000100)={@_ha_fsid={[0x1b1, 0xb5]}, {0x0, 0x6, 0xc}}, 0x9, &(0x7f0000000280)={@_ha_fsid}, &(0x7f0000000340)=0xe}, {[0x94, 0x6, 0x7, 0xfff]}, 0x0, 0x44, &(0x7f0000000380)=""/68}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x42400, 0x0) socket(0x80000000000000a, 0x2, 0x0) memfd_create(&(0x7f00000001c0)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xea)\xad\xc0\f\xb7Y\xdbh\x9f\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xb9\xa1JS\x92[\xd83\xf3\x85&r\xc9\xe0\xf9\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc2Gj+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sL~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\x9e\xb0EA*7\xd9\xd0\x12\xea\xc2\xd6\x04\xa7\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x9c\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2\xab\xff\xe4\xb0;\xd9', 0x2) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$inet_icmp_raw(0x2, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000a00)) socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = dup(r9) syz_ublk_setup_queues(r10, r8, &(0x7f0000000480)={0x0, 0x2, 0x1000, 0xfffffffe, 0x2f3, 0x0, r10}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x40, 0x1000000, 0x2033f, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffffff, 0x2000, 0x0, 0x77}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9b59, 0x400, 0x0, 0x0, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0xc4200, 0x2, 0xdfffffff}}], 0x1, 0x0, 0x0) 1m31.020729566s ago: executing program 1 (id=19): openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000040)={0x0, 0x100}, 0x0) openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000100)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$VHOST_GET_VRING_ENDIAN(r0, 0x4008af14, &(0x7f0000000080)={0x1, 0x1}) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x4000) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$cgroup2(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0), 0x2000000, 0x0) mount$overlay(0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f0000000000)={[{@default_permissions}, {@xino_off}], [], 0x2f}) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x3, 0x13, 0xffffffffffffffff, 0x6a2a9000) bind$netlink(0xffffffffffffffff, &(0x7f0000000080)={0x10, 0x0, 0x0, 0xfffffffffffffffd}, 0xc) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$poke(0x4, 0x0, &(0x7f0000000340), 0x10000000000000cc) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x40000, 0xd5) newfstatat(0xffffffffffffff9c, &(0x7f0000000240)='./file1\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x400) setresuid(r4, r4, 0x0) openat$cgroup_ro(r3, 0x0, 0x0, 0x0) unshare(0x60000600) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) mremap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000001000/0x4000)=nil) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000180)) dup(r5) syz_open_procfs(0xffffffffffffffff, 0x0) 1m30.81847741s ago: executing program 1 (id=25): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) close_range(r1, 0xffffffffffffffff, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='huge=always,huge=within_size,nr_blocks=5']) setsockopt(r0, 0x410, 0x101, &(0x7f0000000240)="6e0ad9da56ac334a351bb4851ea12612060e5ca0a0fa005f1968ef105ca2c6e12d4551ea32de0b72ab5ff61c9a205a2463a89e4f02ccd690ea5a8d540df1768f0bc5d0b081f9137ce40af1ea60f918aecc4f4a694aaeb2cf6dfcc7ccfd1087105a9691e4f6cb3a4428db9ccb472d8c4f", 0x70) chdir(&(0x7f0000000140)='./file0\x00') r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r3, 0x4030582a, &(0x7f0000000300)={0x113e, 0x0, 0x2000000, 0x10000}) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) setresuid(0xee01, 0xee00, 0x0) prlimit64(0x0, 0x6, &(0x7f0000000040), 0x0) capset(&(0x7f0000000340)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x20000000}) syz_clone(0x44200400, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xc4, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast2, @in6=@loopback, 0x0, 0x8, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000200002}}, [@policy_type={0xa}]}, 0xc4}}, 0x0) ioctl$FS_IOC_GETFSLABEL(r2, 0x400452c8, &(0x7f0000000100)) 1m30.7963766s ago: executing program 1 (id=27): r0 = socket$inet6(0xa, 0x3, 0xff) r1 = dup2(r0, r0) sendmsg$NL80211_CMD_START_P2P_DEVICE(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x28, 0x0, 0x4, 0x70bd2d, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x7, 0xa}}}}, ["", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x884}, 0x1) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_WOWLAN(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x0) r2 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000140), 0x82084, 0x0) ioctl$TCSETSF2(r2, 0x402c542d, &(0x7f0000000100)={0xd13, 0x200, 0x6, 0x875f, 0x7, 'B\x00!_\x00', 0x4000000, 0x400}) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000180)=0x42) r3 = socket$inet_tcp(0x2, 0x1, 0x0) close(r3) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000280)={0xa, 0x4e22, 0xd, @loopback, 0x6}, 0x1c) connect$inet6(r4, &(0x7f0000000140)={0xa, 0x4e22, 0x20, @loopback, 0x23}, 0x1c) setsockopt$inet6_int(r4, 0x29, 0xb, &(0x7f0000000100)=0x80000002, 0x4) sendto$inet(r3, &(0x7f0000000900)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9025a01c95d4a068ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) recvfrom$inet(r3, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(0xffffffffffffffff, 0x1, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000009480)={'bridge_slave_1\x00', &(0x7f0000009440)=@ethtool_cmd={0x48, 0xeaa, 0x0, 0x34, 0xd2, 0x85, 0x3, 0x6, 0xed, 0x1, 0xfff, 0x3, 0x4, 0x67, 0x7, 0x4, [0x10000, 0x6]}}) 1m30.614489034s ago: executing program 1 (id=28): r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=0x0, &(0x7f00000002c0)=0x0, &(0x7f0000000140)=0x0) r4 = syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0xc, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)) r6 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r4, 0x2) mount$binderfs(0x0, &(0x7f0000000100)='./binderfs\x00', 0x0, 0x4800, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r6, 0x4058587a, &(0x7f0000000400)={{r5, &(0x7f0000000000)='\x00', 0x400, &(0x7f0000000100)={@_ha_fsid={[0x1b1, 0xb5]}, {0x0, 0x6, 0xc}}, 0x9, &(0x7f0000000280)={@_ha_fsid}, &(0x7f0000000340)=0xe}, {[0x94, 0x6, 0x7, 0xfff]}, 0x0, 0x44, &(0x7f0000000380)=""/68}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x42400, 0x0) socket(0x80000000000000a, 0x2, 0x0) memfd_create(&(0x7f00000001c0)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xea)\xad\xc0\f\xb7Y\xdbh\x9f\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xb9\xa1JS\x92[\xd83\xf3\x85&r\xc9\xe0\xf9\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc2Gj+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sL~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\x9e\xb0EA*7\xd9\xd0\x12\xea\xc2\xd6\x04\xa7\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x9c\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2\xab\xff\xe4\xb0;\xd9', 0x2) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$inet_icmp_raw(0x2, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000a00)) socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = dup(r9) syz_ublk_setup_queues(r10, r8, &(0x7f0000000480)={0x0, 0x2, 0x1000, 0xfffffffe, 0x2f3, 0x0, r10}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x40, 0x1000000, 0x2033f, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffffff, 0x2000, 0x0, 0x77}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9b59, 0x400, 0x0, 0x0, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0xc4200, 0x2, 0xdfffffff}}], 0x1, 0x0, 0x0) 1m30.614342514s ago: executing program 32 (id=28): r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=0x0, &(0x7f00000002c0)=0x0, &(0x7f0000000140)=0x0) r4 = syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0xc, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)) r6 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r4, 0x2) mount$binderfs(0x0, &(0x7f0000000100)='./binderfs\x00', 0x0, 0x4800, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r6, 0x4058587a, &(0x7f0000000400)={{r5, &(0x7f0000000000)='\x00', 0x400, &(0x7f0000000100)={@_ha_fsid={[0x1b1, 0xb5]}, {0x0, 0x6, 0xc}}, 0x9, &(0x7f0000000280)={@_ha_fsid}, &(0x7f0000000340)=0xe}, {[0x94, 0x6, 0x7, 0xfff]}, 0x0, 0x44, &(0x7f0000000380)=""/68}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x42400, 0x0) socket(0x80000000000000a, 0x2, 0x0) memfd_create(&(0x7f00000001c0)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xea)\xad\xc0\f\xb7Y\xdbh\x9f\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xb9\xa1JS\x92[\xd83\xf3\x85&r\xc9\xe0\xf9\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc2Gj+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sL~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\x9e\xb0EA*7\xd9\xd0\x12\xea\xc2\xd6\x04\xa7\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x9c\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2\xab\xff\xe4\xb0;\xd9', 0x2) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$inet_icmp_raw(0x2, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000a00)) socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = dup(r9) syz_ublk_setup_queues(r10, r8, &(0x7f0000000480)={0x0, 0x2, 0x1000, 0xfffffffe, 0x2f3, 0x0, r10}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x40, 0x1000000, 0x2033f, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffffff, 0x2000, 0x0, 0x77}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9b59, 0x400, 0x0, 0x0, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0xc4200, 0x2, 0xdfffffff}}], 0x1, 0x0, 0x0) 53.559365107s ago: executing program 0 (id=366): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000040)=ANY=[@ANYRESHEX=r0], 0x624}], 0x1, 0x0, 0x0, 0x20400}, 0x4004) mkdir(&(0x7f0000000400)='./file0\x00', 0x3f) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080), 0x4003, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_VRING_ERR(r1, 0x8001af84, &(0x7f00000001c0)) 53.490335678s ago: executing program 0 (id=367): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) chdir(&(0x7f0000000100)='./file0\x00') r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000240)='./bus\x00', 0x101000, 0x107) lseek(r0, 0x2, 0x1) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'bridge_slave_1\x00', 0x10}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) write$tun(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="0300080001000a000000140000004500005c14000000000152f30a010100ac1414aa0400907800000000400000000000001100110000ac1414aa7f000001890740ac1e0101008621000000010707d0a747a378060e17893b0b53f5543f901e0e770606a169a31a000000e660fe135dcd2dae5f88b1ca9a2206ca888336eaf0e2bc6890c95a972f88f50c842fbe56c7e4a9294b8fec6467db10bd869488591fbccc8fa60d8d3d46535df83b472ef7754eb27f3e42760b3051fef347fb8c42ac621aa2d7d72e3a4565ac5db4d230aebfff6bf1bcf171a3ab484966c5f764ac85d646c405b6fd8d68fa3c50532c9cb2d92d607f56ca1b51c65a7a23745e03730dcb45"], 0x6a) r5 = syz_open_dev$mouse(&(0x7f0000000400), 0xa9, 0x10b002) setrlimit(0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) accept(r4, &(0x7f0000000540)=@alg, &(0x7f00000005c0)=0x80) getsockopt$inet_IP_IPSEC_POLICY(r4, 0x0, 0x10, &(0x7f0000000640)={{{@in=@broadcast, @in6=@private0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@private2}, 0x0, @in6=@mcast1}}, &(0x7f0000000600)=0xe8) r7 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000180), 0x400, &(0x7f00000001c0)=ANY=[@ANYBLOB="6769643dc7000000000000740a18e091d698165b5d2f31835187aa78b5", @ANYRESHEX=r8, @ANYBLOB=',\x00']) lchown(&(0x7f00000000c0)='./bus\x00', r6, r8) r9 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) close(r9) syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x1) ioctl$TUNSETOFFLOAD(r9, 0x400454d0, 0x2) fsync(r5) 53.242143234s ago: executing program 0 (id=369): memfd_create(&(0x7f00000000c0)=',\xea\xc9t\x8b\xb7\x04\x1d^s^\t5\xa1i\x01\x00\xd4\xd7\x02\x8dmbs\x0f3\x92\'\x94N\b\xe0m\xa4\x01\x00\xe5\x00\x00\x00\x00\x00-\xb3\x8d\xa1v\xe5\x8a0\x05\x00\xa4\xed\x94 \x15Y\x1f\xccY\xff\xb4\xa2\xa62:\xfa\xf9\xb7\x05q\xa4d\xda0y\xd3\xd6\x98\x9f\x11\n\xf44Q\xff\xff)\xb3|\x04\x00\x00\x80FD\xb8\xc2\x8a\x99Y\xf6:\xfeT\xa1', 0x4) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000040), 0x4) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='fdinfo/3\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r2, 0xae9a) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x28}}, 0x0) accept4$inet6(r1, &(0x7f0000000300)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000340)=0x1c, 0x80000) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1a1740, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000080)={0x0, &(0x7f00000001c0)=[@wrmsr={0x65, 0x20, {0x40000000, 0x3}}, @wrmsr={0x65, 0x20, {0x32b, 0x3f}}], 0x40}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000440)={[0x0, 0x100000000, 0x0, 0x7f, 0x100000, 0x3, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x8, 0x2, 0xffffffffffffffff], 0x0, 0x200}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0x101, 0xaec4, 0x6, 0x4004, 0x2, 0x4, 0xefffffffffffffff, 0x0, 0x0, 0x2000000, 0x20000, 0x1c, 0x0, 0x5, 0x1], 0x0, 0x41981}) ioctl$KVM_RUN(r2, 0xae80, 0x300) 53.082503707s ago: executing program 0 (id=370): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000200), 0x82, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@new_dev={0x4, 0xf16, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x100}}}, &(0x7f0000000480)=0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x511085527ae815eb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r2, 0x40046205, &(0x7f0000000140)=0x881) r3 = dup(r1) syz_ublk_setup_queues(r3, r0, &(0x7f0000000180)={0x0, 0xdeeb, 0x0, 0x1, 0x255}, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x54, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000340)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x9}, 0x1c) setregid(0xee00, 0x0) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(r4, 0x2, 0x0, 0x0) mkdir(&(0x7f00000003c0)='./file0\x00', 0x137) 52.998502278s ago: executing program 0 (id=371): r0 = openat$rnullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000e, 0x12, r0, 0xcc25f000) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000191000/0x400000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 52.867787081s ago: executing program 0 (id=372): socket(0x80000000000000a, 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x3a04) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000140)={0xfffffffffffffc04, 0x0, 0x1, r2, 0x11}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000240)={0x27800000000, 0x0, 0x1, r2, 0x1}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000040)={0x277ffffffff, 0x0, 0x8, r2, 0x1}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r3, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010126bd7000ffdbdf25060000e620000180140002006c6f0000000000000000000000000000080003"], 0x34}, 0x1, 0x0, 0x0, 0x20004000}, 0x4040) 52.822973302s ago: executing program 33 (id=372): socket(0x80000000000000a, 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x3a04) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000140)={0xfffffffffffffc04, 0x0, 0x1, r2, 0x11}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000240)={0x27800000000, 0x0, 0x1, r2, 0x1}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000040)={0x277ffffffff, 0x0, 0x8, r2, 0x1}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r3, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010126bd7000ffdbdf25060000e620000180140002006c6f0000000000000000000000000000080003"], 0x34}, 0x1, 0x0, 0x0, 0x20004000}, 0x4040) 5.605882364s ago: executing program 3 (id=628): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @none}, 0xe) listen(r0, 0x1) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100), 0x0, 0x0, 0x0, 0xf5ffffff}, 0x101) sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0, 0x0, 0x4049}, 0x0) sendmmsg$sock(r1, &(0x7f0000002c80)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000b80)=[{&(0x7f0000000f40)="9a1646e333841dd817f884072bcfc4e86d09eae42c771150d2a0f7409c1370d3638a8b435039d8f5f5a58fd9696b618dee51e4869aced576ce4348d9b259fb3273c6a36fc309164021180c785a3c299cbf15a38790db0474eb0b41d11d4893959adec407e9ba742652a28fc5165a05b7593682298736a7ccd86db5f3758d2939e9992035d6de58a4b803a94a72a31139fd6e1f77b7e96492191da02c8bfd789de8bc6acd5484430d64a233fd9512f3d646d33db37e305f92dc1db89bd85b2689c942b596c0a45c4efff576", 0xcb}, {&(0x7f0000000140)="efaf7a93d21cbcbd56d058e53b498eb5aec446ded5a0a15afc4a85e66ba967dd32bdaa041334d821c83f07626dff625725d9d7f2454a3c0354409cd461092701a394007cca7bf7ed39cb6d0860fc9fffc3867688808a0900a32d9c9f797ac6d2f35665413642d174ba233adaa36bf0d40144a05abc9458f98e5738d6952053397589681183bf74246782eaa788d1afbf227f54319c50de9f30c83766e8911ed5b621c7395f1678a3165181261067977d2cc5ce2f9a8ca0b99fa09f8e95675cd7666c5e2edb4b8029c371ccfe0497285e0e223106e4b43dbbdae8faa67a625fff23346e701f1c8cf9b6cd0d485c422d1c07b63988d3377dfe6634b1e184", 0xfd}, {&(0x7f0000000280)="3b3d07b7091f697381965e2e79090900f54a284af3f8fdb1c24e6d0c4a7f58ffca9b24b191f510fbf55fd3e76154e2a4fe1e14c7bbff4c24907805f79e2a90f0d8c8faccbd2243475ecfa1f5fac83b8910ba0500000000000000b8eb9cfa683836af5e50b1bc4f815b49fc47f85fe32f63a26492042b663d8c955bfad12d47e833e91977ac7c7a90b3589931b620784b65b952a0", 0x94}, {&(0x7f0000001040)="476760797e45f0a946021e0f9abf9eecf488bebdc3b9519e0953c736a9e9faf07151bd5c90e9816f2f3ffc4a7fa0785a80b320a23bcf9cd7e3eecc65664f45384ff030fa1ec94bb9d3d88b000000000000ece6a99f2f0bbf67c2e4234fc73b95258c4282b0251b7536d2e5de7b214fc3030dbe0d0619b99380de471c5d93b1296625d7af1494febdad75370ca52e6078f2a77cb8456afe7b7c6ae6cab664ceeb48d6c1368761dd08c3cc103dbb6c75b9113d82c3eab5414aeecb9270c1dae23862962c5209758df4423c1a8ca6b27176e4fefc2c63e16c2ef28fb10ef61a9a5f29c63a0f65933135601553703af853816b519a89c6991b6679909ce40574450181a878ca28e71a79f397ad4872c9dd10900c04c2ed124541ffffad82bdacd38b0819607fdb58492f9bda408e3d90413377661ef6dc854b3c27c2c740bd", 0x13d}], 0x4}}, {{0x0, 0x0, 0x0}}], 0x3, 0x4000000) r2 = syz_open_dev$loop(&(0x7f0000000000), 0x8000000, 0xc0000) r3 = socket$nl_route(0x10, 0x3, 0x0) lsetxattr$security_capability(0x0, &(0x7f00000000c0), 0x0, 0x0, 0x0) sendmsg$netlink(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000007d00)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="180000006a0015"], 0x1c}], 0x1}, 0x4000080) ioctl$IOC_PR_RELEASE(r2, 0x401070ca, 0x0) 5.526539806s ago: executing program 3 (id=629): landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x18, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) pivot_root(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='./file0\x00') r1 = dup2(r0, r0) sendmsg$NL80211_CMD_START_P2P_DEVICE(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x28, 0x0, 0x4, 0x70bd2d, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x7, 0xa}}}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x884}, 0x1) write$tun(r1, 0x0, 0x46) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_WOWLAN(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x0) r2 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000140), 0x82084, 0x0) ioctl$TCSETSF2(r2, 0x402c542d, &(0x7f0000000100)={0xd13, 0x200, 0x6, 0x875f, 0x7, 'B\x00!_\x00', 0x4000000, 0x400}) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000180)=0x42) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GET(r3, &(0x7f0000000480)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800800}, 0xc, &(0x7f0000000440)={&(0x7f0000000340)={0x100, r4, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@pci={{0x8}, {0x11}}, {0x1c}}]}, 0x100}}, 0x1) close(r3) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r5, &(0x7f0000000280)={0xa, 0x4e22, 0xd, @loopback, 0x6}, 0x1c) connect$inet6(r5, &(0x7f0000000140)={0xa, 0x4e22, 0x20, @loopback, 0x23}, 0x1c) setsockopt$inet6_int(r5, 0x29, 0xb, &(0x7f0000000100)=0xd, 0x4) sendto$inet(r3, &(0x7f0000000900)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9025a01c95d4a068ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) recvfrom$inet(r3, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 4.399497569s ago: executing program 3 (id=636): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e3, 0x0) 3.904004849s ago: executing program 3 (id=637): llistxattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000400)=""/4096, 0x1000) (async) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000001a00), 0x2080, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x133) (async) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) (async) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) lsm_set_self_attr(0x66, &(0x7f0000000440)={0x65, 0x5, 0x22, 0x2, "cfa7"}, 0x22, 0x0) (async) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x2, &(0x7f0000000040)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) (async) chdir(&(0x7f0000000140)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x84242, 0x1df2a23c5997fad6) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2}) (async) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @multicast}) (async, rerun: 64) write$tun(r1, &(0x7f0000000200)=ANY=[@ANYBLOB="0000c08dbbbbbbbbbbbbaaaaaaaaaabb810000000800451e007000684000070190780000001cac1414aa0304907800c60000450204030067000209044002ac1414bbe0000001070b647f0000010a010101891f13e0000002ac1414bb0a010100e0000002ac1414aaffffffff00000000890ff17f000001e0000001ac1414aa830789e0000002d9f706c634e35cae59c8461c3102c5ceb106da75919057328fb680a2573ca5eb32a6f07450c5ff84e17bac172e7b9679a759aac81e4c68ddb0b721f5fc8387a6e86d8bcc54988747b43fa9cf8515a5990a05a36e"], 0x86) (rerun: 64) getdents(r0, 0x0, 0x0) (async, rerun: 32) syz_usb_connect(0x3, 0x30, &(0x7f0000000080)=ANY=[@ANYBLOB="12010102a0788a20b00e20906e4f0102f10109021e0001010380050904630101dfba7b0709058010200007050603096e819c4db09410f8c72af41caeae336ae6da83aa712cd674ff79694de775cbd9d1038587bda20bfb496cdc4c6405a5d88ae8f07d25bad04c6c6b45e0f29e72ae57e09d274fd9e448837bd58a8c660000"], &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0}) (rerun: 32) 3.758389952s ago: executing program 3 (id=639): socket$inet6_tcp(0xa, 0x1, 0x0) (async) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) (async) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) (async) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r1, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) r2 = socket(0x8000000010, 0x2, 0x0) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000000)={'veth1_macvtap\x00', 0x3e8b}) (async) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000000)={'veth1_macvtap\x00', 0x3e8b}) recvfrom$inet(r1, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) (async) recvfrom$inet(r1, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000037a500206d040ec70000140000010902240001000030a0090410000203001b0009217700020122290009058103"], 0x0) (async) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000037a500206d040ec70000140000010902240001000030a0090410000203001b0009217700020122290009058103"], 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) (async) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io(r3, &(0x7f0000000540)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB="0006290000"], 0x0, 0x0, 0x0, 0x0}, 0x0) listen(r0, 0x5) r4 = eventfd2(0x0, 0x0) io_setup(0x4, &(0x7f0000000080)) (async) io_setup(0x4, &(0x7f0000000080)=0x0) io_submit(r5, 0x2, &(0x7f00000000c0)=[&(0x7f0000000000)={0x1802, 0x0, 0x0, 0x5, 0xfffe, r0, 0x0, 0x0, 0x0, 0x0, 0x3, r4}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}]) io_getevents(r5, 0x2, 0x2, &(0x7f0000000c80)=[{}, {}], 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x1, 0x0) capset(&(0x7f0000001440)={0x19980330}, &(0x7f0000001400)={0x0, 0x2}) llistxattr(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) fsync(r0) bind$unix(r6, &(0x7f0000000300)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r6, 0x0) (async) listen(r6, 0x0) socket$unix(0x1, 0x1, 0x0) (async) r7 = socket$unix(0x1, 0x1, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) connect$unix(r7, &(0x7f0000000640)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r8, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(0x3) shutdown(r0, 0x0) 3.527177007s ago: executing program 4 (id=642): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2840, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000021c0)=[{&(0x7f00000018c0)={0x14, 0x25, 0x1, 0x70bd2b, 0x25dfdbfd, "", [@generic='&']}, 0x14}], 0x1, 0x0, 0x0, 0x4050}, 0x40) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0xeb) 3.39464503s ago: executing program 4 (id=644): socket$nl_xfrm(0x10, 0x3, 0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x1000000, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x5, 0xfffffffffffffffb}, {0x0, 0x40000000000000, 0x200000000000000}, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) 3.38721479s ago: executing program 2 (id=646): madvise(&(0x7f00001bf000/0x1000)=nil, 0x1000, 0x4) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, &(0x7f0000000200)=ANY=[@ANYBLOB="6e6174000100000000000000000000f7efb144deb8af8b1f00df00000000000000000000000000000002000d000000000000000000000000000000bdd9e402f029f6a067052573700588e0f2a9074fcef8929ceb0bc6dbc25fd9b196c1e5c8bedba82e08443449378770eac45731f06eb8c6fea54935364c8393935cb08a34edd39fc9b41fbc8f69cffbd82c3d6e1a915fe207f2601084dc3de7197ae8f4dd06c4950fdb6e540fd9524b0cd8a76c8f8b00de27d60eccd55f4e8116329cdcc1813d2e5a183b41588d28f5d2f7b68b51e6b31de4ce8ee08c9fe7d4300c1620a01564316979318bbbeeeb407e49a6535ab2e9d56f01fdc78cb0d01a45a5a3f371e23e371339953d8d9f0b7f7583c4240ac50a1929a8f94d4ba1"], 0x48) setpriority(0x1, 0x0, 0xe) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$sock_linger(r1, 0x1, 0x3d, &(0x7f0000000080)={0xb}, 0x8) sendmmsg$sock(r1, &(0x7f0000000b40)=[{{&(0x7f00000000c0)=@in6={0xa, 0x4e20, 0x1, @private0={0xfc, 0x0, '\x00', 0x1}, 0x56f6}, 0x80, 0x0, 0x0, &(0x7f0000000180)=[@mark={{0x10, 0x1, 0x24, 0x9e2e0000}}], 0x10}}], 0x1, 0x0) syz_clone3(&(0x7f0000000180)={0x42907480, &(0x7f00000000c0), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) 3.222338173s ago: executing program 2 (id=648): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)=@newsa={0x138, 0x10, 0x1, 0x70bd28, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x2}, 0x1, 0x15b2, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x2c}, {@in=@local, 0x4d4, 0x32}, @in=@loopback, {0x0, 0x195, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x23, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x0, 0x20}, [@algo_auth={0x48, 0x1, {{'hmac(sha256)\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8005}, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_X86_DISABLE_EXITS(r2, 0x4068aea3, &(0x7f0000000180)={0x8f, 0x0, 0x2}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000080)="66baf80cb88c965884ef66bafc0cb000ee66ba6100b80b000000ef440fc71ca3400f212e26410f30c442f932013e2e66410f38805a93c744240000000000c74424027f070000c7442406000000000f011424c4c1df7c1366bad00466b8000066ef", 0x61}], 0x1, 0x38, 0x0, 0x0) pipe2(&(0x7f00000000c0), 0x80000) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) capget(&(0x7f0000000000)={0x19980330, 0xffffffffffffffff}, &(0x7f0000000040)={0x5, 0x6, 0x5, 0x2, 0x80000000, 0x2}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) splice(r5, &(0x7f0000000040), r4, 0x0, 0x800000000ff, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 3.222027593s ago: executing program 4 (id=649): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x7, 0x0, 0x7fffffff, 0x0, 0x2}, {0xfffffffffffffffe, 0xffffffffffffffff}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3}, [@tmpl={0x44, 0x5, [{{@in6=@rand_addr=' \x01\x00', 0x2, 0x2b}, 0xa, @in6=@private1, 0x0, 0x4, 0x2, 0x0, 0x0, 0x0, 0x8003}]}]}, 0xfc}}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'hsr0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000000340)={@remote, r2}, 0x14) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = dup3(r4, r3, 0x80000) sendmsg$NFULNL_MSG_CONFIG(r5, &(0x7f0000013740)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x28, 0x1, 0x4, 0x201, 0x0, 0x0, {0xc, 0x0, 0x6}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}, @NFULA_CFG_MODE={0xa, 0x2, {0xfffffffc, 0x2}}]}, 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x20008054) r6 = geteuid() getresuid(&(0x7f0000000080), &(0x7f0000000100)=0x0, &(0x7f0000000140)) sendmsg$NFULNL_MSG_CONFIG(r4, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x24, 0x1, 0x4, 0x101, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0xbb1f}, @NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x200c0080}, 0x2400c004) r8 = socket$packet(0x11, 0x2, 0x300) syz_genetlink_get_family_id$tipc2(&(0x7f0000000240), 0xffffffffffffffff) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000a40), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000b80)={&(0x7f0000000580)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r9, @ANYBLOB="01002bbd7000ffdbdf2502"], 0x20}, 0x1, 0x0, 0x0, 0x8050}, 0x0) sendmsg$MPTCP_PM_CMD_SET_FLAGS(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000005c0)={&(0x7f00000004c0)={0xfc, r9, 0x10, 0x70bd28, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x1}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x40, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r2}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @ipv4={'\x00', '\xff\xff', @loopback}}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r2}]}, @MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @loopback}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r2}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xf8}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x9}, @MPTCP_PM_ATTR_ADDR={0x4c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @loopback}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x4}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x1c, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xff}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xf4}]}, 0xfc}, 0x1, 0x0, 0x0, 0x4840}, 0x40) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) bind$packet(r8, &(0x7f0000000000)={0x11, 0x6, r11, 0x1, 0x0, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x14) fstat(r1, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_xfrm(r5, &(0x7f0000000e80)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000e40)={&(0x7f0000000940)=@migrate={0x500, 0x21, 0x200, 0x70bd2b, 0x25dfdbfd, {{@in=@private=0xa010100, @in6=@empty, 0x4e22, 0x0, 0x4e24, 0x2, 0x2, 0xc0, 0x80, 0x43, 0x0, r6}, 0x6e6bb9, 0x1}, [@sa={0xe4, 0x6, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @in=@local, 0x4e22, 0x5ab, 0x4e24, 0x0, 0xa, 0x80, 0xa0, 0x17, 0x0, r7}, {@in=@empty, 0x4d6, 0xff}, @in6=@remote, {0x2, 0x6, 0x2, 0xa975, 0x1, 0x4, 0x3, 0x750}, {0x3, 0xa2, 0x4, 0x5}, {0x9, 0x4, 0x4}, 0x70bd2a, 0x3502, 0xa, 0x1, 0x6, 0xeb}}, @algo_comp={0x13a, 0x3, {{'lzjh\x00'}, 0x790, "5225c5f4450932138b8fd27829be9815f67c9e9ea8a85acdeb1f73e4a7e19e38b353f6beead5755ded522ac6fc82a58dd14ddd3d35c36151ee4c324e102c1da7846c5bf56b61e493e1684d6cc244da5cb1ffdc6b641608d4054f1e12315618f9a7e8f24a8866670154b01918516a9563b6892fe89d677061e8df0cff9cf5b2ba086180d70454f32b26689f149416f793964b5344b63c6493466c588f451b06d692f2e11950960d415e8e87db1647e6f83d2b0f0f0d96e1d17d257bab84753ad303e66ec98ba590dae4e4b1514b0d788488793104d938ba2c5d37a3abdcf6442ac4fdaca5832982c2d1317b9e7a8b305bdc14"}}, @tfcpad={0x8, 0x16, 0x9554}, @algo_aead={0xc5, 0x12, {{'seqiv(essiv(gcm(aes),sha1_mb))\x00'}, 0x3c8, 0x0, "703f6c323a539bae20d12eb44a0f27f5c09028984684edd12d76d01d69018e678a556eeff2ac8f2ece494b8943f8ea35871ed396721c7877d3071186f1db5c3f13cb2c07bc314f7a5b2dc5fc0809ec57f569698d83dcba1cee46b5351e60b042548254b478b96256fb390b62a486b622c1c05c7b173f6ec905"}}, @extra_flags={0x8, 0x18, 0x8}, @sa={0xe4, 0x6, {{@in=@private=0xa010101, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e20, 0x7ff, 0x4e23, 0x7ff, 0xa, 0xc0, 0x0, 0x8, r11, r12}, {@in6=@private2, 0x4d2, 0x32}, @in6=@empty, {0xffffffffffffffff, 0x3, 0x1, 0x200, 0x6318, 0x8, 0x4, 0xac44}, {0x8, 0x2, 0x10001}, {0xfff, 0x3, 0x2}, 0x70bd2b, 0x3506, 0x8, 0x4, 0x7, 0x20}}, @algo_comp={0xc9, 0x3, {{'deflate\x00'}, 0x408, "6597fc42d4640344c0634f1b81fa0874f1f85de8676a87255fc3d9738907ca85d149f0ed6f0e27dae1dafeb45de6093165da09e4143fa0b803b5516394e21735e3e7ae24709ec2fa3667ea13d01b5b0cf29ec8b8187a1ea1f7baca50f0835da1adc32e0bd339c1a2c7af0991b50aaabc81cb518d0b9e51d53d91fdc4e337ace6c5"}}, @tfcpad={0x8, 0x16, 0x3ff}]}, 0x500}, 0x1, 0x0, 0x0, 0x20004080}, 0x4000085) r13 = fsopen(&(0x7f0000000000)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r13, 0x6, 0x0, 0x0, 0x0) r14 = fsopen(&(0x7f00000000c0)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r14, 0x6, 0x0, 0x0, 0x0) connect$inet(r1, &(0x7f0000000380)={0x2, 0x0, @remote}, 0x10) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000000)='veth0_to_team\x00', 0x10) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x810) connect$inet(r1, &(0x7f0000000400)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x10}}, 0x10) 3.180017484s ago: executing program 5 (id=650): r0 = syz_usb_connect(0x5, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b510f210950b2a7773820102030109022400010000000009042200028953950009050a02ff0300fa000905820250"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f0000000600)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) socket$nl_xfrm(0x10, 0x3, 0x6) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000380)={0x2c, &(0x7f0000000180)={0x40, 0xf, 0x2, "e805"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f00000009c0)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)={0x40, 0x9, 0x1, 0x4}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000480)={0x2c, &(0x7f00000001c0)={0x20, 0x8, 0x84, {0x84, 0x31, "77b284cf753e92282707739ed2c50a8018aa0fd7debd5e24048287501c9983f44fffdbc400d1e43ecd2c71b4ad344ac8ab48e3795e17be926012a747afcef50bea56b5a481539a1f4c49e6568d1b74a232ec1d11c59c036a4eb6b1836a2ad736d97bc0ab53b19679ab098e172fdc1c8a0f823536baa5da422771a4ed23556efb308b"}}, &(0x7f0000000280)={0x0, 0x3, 0xbc, @string={0xbc, 0x3, "31eb85d0c66898ee11e3a75e2cf41c045527645588b2e5e04895b7e3ffa2bcb838131c8525288098d103d50f57ed861905c3e05cc8c7ac53cd72a02c5241f6eab04e2951aca39fea6426bb158b9ed1788f7aad3cfbf244d60793ca2f37bddf2996514e66b1aae78360a7932d0d07285456d81e1875a90bddad729d88daad896ddaa2284151733b4a3ed429f06bcc23d27b615ab5e1021ce53ef78abc404b86c97ce3e133e6d20580c77e48400cf5c16885908fddc22c73c5146c"}}, &(0x7f00000003c0)={0x0, 0xf, 0x19, {0x5, 0xf, 0x19, 0x1, [@ss_container_id={0x14, 0x10, 0x4, 0x6, "c4019a576849d9e438a99b6459e5e085"}]}}, &(0x7f0000000400)={0x20, 0x29, 0xf, {0xf, 0x29, 0x10, 0x8, 0x8c, 0x5, "77943803", "71dfa597"}}, &(0x7f0000000440)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xaf, 0x18, 0x2, 0x6, 0x7, 0x2, 0x4}}}, &(0x7f0000000ac0)={0x84, &(0x7f00000004c0)={0x0, 0xd, 0x43, "79d317a2de6d0a3dea9e92f6117daf03b884679af4beee3adff8c51dc6726ff2e2c35a0bdbf16c446557f3d36e079ab9df258527ff74d96806a80e6aa3468a5005e801"}, &(0x7f0000000580)={0x0, 0xa, 0x1, 0xa}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000680)={0x20, 0x0, 0x4, {0x3, 0x1}}, &(0x7f00000006c0)={0x20, 0x0, 0x4, {0x0, 0x2}}, &(0x7f0000000700)={0x40, 0x7, 0x2, 0xe4}, &(0x7f0000000780)={0x40, 0x9, 0x1, 0x8}, &(0x7f00000007c0)={0x40, 0xb, 0x2, "bb93"}, &(0x7f0000000800)={0x40, 0xf, 0x2, 0xffff}, &(0x7f0000000840)={0x40, 0x13, 0x6, @remote}, &(0x7f0000000880)={0x40, 0x17, 0x6, @local}, &(0x7f00000008c0)={0x40, 0x19, 0x2, "5d9b"}, &(0x7f0000000900)={0x40, 0x1a, 0x2, 0x205e}, &(0x7f0000000940)={0x40, 0x1c, 0x1, 0x5}, &(0x7f0000000980)={0x40, 0x1e, 0x1, 0x62}, &(0x7f0000000a80)={0x40, 0x21, 0x1, 0x3}}) 3.070190396s ago: executing program 4 (id=651): r0 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000080)=ANY=[@ANYRESOCT], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f0000000300)=ANY=[@ANYBLOB="00dc6b"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_connect$hid(0x6, 0x3f, &(0x7f0000000280)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x0, 0x4d8, 0xdd, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x1a, 0xa0, 0xd, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x1, 0x3, 0x6, {0x9, 0x21, 0x800, 0x0, 0x1, {0x22, 0xa97}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x2, 0x5, 0x9}}, [{{0x9, 0x5, 0x2, 0x3, 0x200, 0x81, 0x29, 0x1}}]}}}]}}]}}, &(0x7f0000000d00)={0xa, &(0x7f00000002c0)={0xa, 0x6, 0x250, 0x10, 0x81, 0x3, 0x20, 0x4}, 0x4d, &(0x7f0000000a40)={0x5, 0xf, 0x4d, 0x6, [@ssp_cap={0x1c, 0x10, 0xa, 0x4, 0x4, 0x558, 0x11, 0x5, [0xf, 0xff000f, 0xc0f0, 0xff0011]}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x0, "a50ad02be6dc3d6596fd0a2812431ef9"}, @ptm_cap={0x3}, @ext_cap={0x7, 0x10, 0x2, 0xa, 0x9, 0x2, 0xfff}, @wireless={0xb, 0x10, 0x1, 0x8, 0x17a, 0x10, 0xf8, 0x2, 0x8}]}, 0x6, [{0x6a, &(0x7f0000000ac0)=@string={0x6a, 0x3, "b430aaa74f0022b8b1e7f71751c53034a59748b4c38c05ea015f9fe43d73a330bfb79b9193c78fd493343c0329bd0715ce3d74274158e7ceb6a4f710d0fa3eb927211fb4ff507bf92fcb6d9600dd77ae16955b0ae7caa16d2a97dce81ca1259b8822bab449f81e2c"}}, {0x4, &(0x7f0000000b40)=@lang_id={0x4, 0x3, 0x408}}, {0x30, &(0x7f0000000b80)=@string={0x30, 0x3, "913e7c683fe9c8671a70e1fff7492b6e7bcfaee491e93064436dd6c8532796daabd79a1f1998ac583299a9d490a3"}}, {0x4, &(0x7f0000000bc0)=@lang_id={0x4, 0x3, 0x380a}}, {0x4, &(0x7f0000000c00)=@lang_id={0x4, 0x3, 0x2409}}, {0xa3, &(0x7f0000000c40)=@string={0xa3, 0x3, "b83172e3152fc3bf5241194ad41d630c5528364103a5775e71b88864a9dbb147bb5266a00c1fc28b21b60d085f2c7358dfc5cbe2172cb91d16a010df5e23250b5a801e51da71dd74a0080682e99247474da32fa77aa8bbf96e6c8070473547956ab889a91790478d3de2b763079e3e220e2dde1fe567dac2d147a2e38e662951b1f54f8d96cace0682e983d1f2a6c47dcf1d21775fdce8c8b89df715eef9496116"}}]}) syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x41b}}, 0x0, 0x0}, 0x0) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000440)={0x900, 0x0, &(0x7f0000000400)={&(0x7f0000000300)={0x2, 0xa, 0xfc, 0x3, 0x2, 0x0, 0x70bd28, 0x25dfdbfe}, 0x10}}, 0x40408c0) (async) r2 = syz_usb_connect$hid(0x1, 0x3f, &(0x7f00000000c0)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x1b1c, 0x1c09, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x2, 0x40, 0x2, "", [{{0x9, 0x4, 0x0, 0x6, 0x2, 0x3, 0x1, 0x2, 0x8, {0x9, 0x21, 0x2, 0x5, 0x1, {0x22, 0x368}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x4, 0xc0, 0xff}}, [{{0x9, 0x5, 0x2, 0x3, 0x8, 0x2, 0x2}}]}}}]}}]}}, &(0x7f00000001c0)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x1, 0x81, 0x7, 0x5, 0x8}, 0x21, &(0x7f0000000140)={0x5, 0xf, 0x21, 0x1, [@ssp_cap={0x1c, 0x10, 0xa, 0xfb, 0x4, 0x3, 0x0, 0x7, [0x0, 0xff000f, 0x0, 0xc03f]}]}, 0x1, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x140a}}]}) syz_usb_control_io$hid(r2, &(0x7f0000000200)={0x24, 0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0003020000000203"], 0x0, 0x0}, 0x0) pipe(&(0x7f0000000000)) (async) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r3, &(0x7f0000000980), 0xfdef) r4 = socket$netlink(0x10, 0x3, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x9, 0x4, 0x6, 0xfffa}, 0x1d, [0x1, 0xc95a, 0xfffffff3, 0x9, 0x80, 0x2, 0x3, 0x7f, 0x6, 0x4d, 0x39cc191a, 0x2, 0x9, 0x5, 0x2, 0x0, 0x6, 0x3, 0x0, 0x2ab, 0x4, 0x7, 0x4, 0x3c5b, 0x4, 0xb, 0x9, 0x1, 0x1f461e2c, 0x7, 0xe661, 0x7fff, 0xb, 0x3, 0x7fff, 0x4c74, 0x80000000, 0x800242, 0xffffffff, 0xe, 0x0, 0x71, 0x2, 0x6, 0x3, 0x50, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x3, 0x80092a3, 0x4, 0x1, 0x20000000, 0x82, 0x0, 0x7, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x401, 0x12f, 0x6, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xd, 0x2bf, 0x5, 0xffe, 0xfffffffc, 0x334000, 0x0, 0x7, 0x5, 0x2f, 0x4, 0x312, 0x1, 0x0, 0xfffffffe, 0x8, 0x4, 0x8000, 0x9, 0x3fe, 0x401, 0x6, 0x4, 0xfb, 0x5, 0x8000, 0x5f31, 0xbcf5, 0x3, 0x2, 0x2, 0x9, 0x3000000, 0x9, 0x8, 0x9, 0x6, 0xb, 0xa, 0x1, 0x9, 0x9, 0x2, 0x7f, 0x9, 0x1, 0x3, 0x9, 0xffffffff, 0x7, 0x3, 0x9, 0x48c93690, 0x42, 0x400004], [0x6, 0x6, 0x80000001, 0x2, 0xff, 0x100, 0x2c, 0x9, 0x5, 0x7fff, 0x0, 0x1, 0xb, 0x4, 0x5, 0x1005, 0x0, 0x1f0, 0xfffffffd, 0x2, 0x86, 0x1, 0x9, 0x3e7, 0x9, 0x5, 0x2, 0x2, 0x800, 0x8, 0x5, 0x8001, 0x7, 0x38, 0x800003, 0x200, 0x80, 0x2, 0xcc52, 0x950bfaf, 0x1000, 0xfffffff6, 0x7, 0x7, 0xfffffff9, 0x6, 0xb8d, 0xbf, 0x10002, 0x403, 0x7ff, 0x3, 0x0, 0x1, 0xffff, 0x5, 0x6, 0x1c, 0x120000, 0x3, 0x6, 0xaaed, 0x4, 0xff], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0x1, 0x6, 0x1, 0x0, 0x3, 0x80ce7, 0x1ff, 0x3, 0x7, 0x3112, 0x1003, 0x101, 0x10000, 0x6, 0x7fff, 0xffff, 0xe620, 0x2, 0x2, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x4, 0xffffffff, 0x80000000, 0x7, 0x8, 0xc8, 0xee1, 0x0, 0xffff, 0x3, 0x7f, 0x100, 0x9602, 0x5, 0x2, 0xffff, 0x6, 0x1, 0x10080, 0x6, 0x8, 0x30b1d693, 0x5a2b, 0xc, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x200, 0xffff3440, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) sendmsg$netlink(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000580)=ANY=[@ANYBLOB="3400000013000100000100dffddbdf25070000f61600000008000000", @ANYRES32, @ANYBLOB="14000c8008"], 0x34}], 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, &(0x7f0000000500)={0x2c, &(0x7f0000000340)={0x40, 0x23, 0x99, {0x99, 0x23, "3d9ba430826385a5d526caabe7d84d255cf51526bcca4815b3376e91b0b0dca354f7c5ac0f06ca4fe031612b72524b51c1e94a3a6b6c6b1d14f6784003a357574e172feca850d54cf0c40f431c832716ddddc9d765959fba29b786de3b1f883ebea3e753a4aa5427786c9d0fab07f5ad62c9c242ce582bb63e1a1cccd603f78209f99f623350584b4dcead3af12e9d6beca07cb782dc99"}}, &(0x7f0000000400)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c01}}, &(0x7f0000000440)={0x0, 0xf, 0x1e, {0x5, 0xf, 0x1e, 0x3, [@wireless={0xb, 0x10, 0x1, 0x4, 0x80, 0x4, 0x2, 0x5, 0xf7}, @ext_cap={0x7, 0x10, 0x2, 0x0, 0x4, 0x5, 0x10}, @ext_cap={0x7, 0x10, 0x2, 0x7, 0x6, 0x0, 0x1}]}}, &(0x7f0000000480)={0x20, 0x29, 0xf, {0xf, 0x29, 0x2, 0x5, 0x5, 0x4, "74196d5b", "57ccc140"}}, &(0x7f00000004c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x4, 0x18, 0x0, 0x0, 0x3, 0x0, 0x7}}}, &(0x7f0000000980)={0x84, &(0x7f0000000540)={0x20, 0x31, 0x1b, "a94f8b0dd66eaff44b8f6f4effc7874abba867fae8bf48d0863de0"}, &(0x7f0000000580)={0x0, 0xa, 0x1}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x1, 0x1}}, &(0x7f0000000640)={0x20, 0x0, 0x8, {0x1e0, 0x20, [0xf0ff]}}, &(0x7f0000000680)={0x40, 0x7, 0x2, 0x7f}, &(0x7f00000006c0)={0x40, 0x9, 0x1, 0x6}, &(0x7f0000000700)={0x40, 0xb, 0x2, "dcea"}, &(0x7f0000000740)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000780)={0x40, 0x13, 0x6}, &(0x7f0000000800)={0x40, 0x17, 0x6, @broadcast}, &(0x7f0000000840)={0x40, 0x19, 0x2, '=/'}, &(0x7f0000000880)={0x40, 0x1a, 0x2, 0x3}, &(0x7f00000008c0)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000900)={0x40, 0x1e, 0x1, 0x4}, &(0x7f0000000940)={0x40, 0x21, 0x1, 0x5}}) (async) syz_usb_control_io$hid(r0, 0x0, 0x0) 2.986645758s ago: executing program 2 (id=652): r0 = socket(0x1e, 0x1, 0x0) connect$tipc(r0, &(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}}}, 0x10) write$binfmt_misc(r0, &(0x7f0000000340), 0x2000011a) r1 = socket$unix(0x1, 0x2, 0x0) recvmmsg$unix(r1, &(0x7f0000005bc0)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000000c0)=""/167, 0xa7}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f0000000040)={0x0, @aes256, 0x0, @desc3}) 2.180357985s ago: executing program 2 (id=653): r0 = syz_ublk_setup_io_uring(0x1643, &(0x7f0000000040)={0x0, 0x5272, 0x0, 0x3, 0x4000015b}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x631a, 0x40000, 0x1, 0x3b9, 0x0, r6}, &(0x7f0000000580)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xd9d3, 0x100, 0x1000000, 0x35c, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x80, 0x0, 0x310, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf9d9, 0x400, 0x5, 0x3, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x20000, 0x1, 0x0, 0xfffffffd}}], 0x1, &(0x7f0000001000)={0x2e, 0x40, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x3, 0xbcc, 0x0, 0x0}}, 0x0) r7 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=0x0, &(0x7f00000002c0)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r7, r8, r9, r10, &(0x7f0000000200)={0x2e, 0xc, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x1, 0x104, 0x0, 0x0, 0x1000, 0xffffffff, 0xffffffffffffffff}}}, &(0x7f0000000300)) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r11 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r12 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r12, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r13 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="14000000000000000000fffc"], 0x14}, 0x1, 0x0, 0x0, 0x4010}, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r13, 0x8983, &(0x7f00000002c0)={0x0, 'syzkaller0\x00', {0x1}, 0xb5}) socket$netlink(0x10, 0x3, 0x0) preadv(r12, &(0x7f0000000480)=[{&(0x7f0000000140)=""/20, 0x14}], 0x2f, 0x0, 0x10000) r14 = socket$unix(0x1, 0x1, 0x0) r15 = socket$unix(0x1, 0x1, 0x0) ioctl$UFFDIO_WRITEPROTECT(r6, 0xc018aa06, &(0x7f0000000400)={{&(0x7f0000003000/0x2000)=nil, 0x2000}, 0x5}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r16, &(0x7f0000000380)=@abs={0x0, 0x0, 0xce22}, 0x6e) listen(r15, 0x2) sendmmsg(r14, &(0x7f0000000340), 0x0, 0x4000) connect$unix(r14, &(0x7f0000fce000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) sendmmsg$unix(r14, &(0x7f0000004780)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="f0", 0x1}], 0x1, &(0x7f0000000000)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32=r14], 0x18}}], 0x1, 0x0) accept(r15, 0x0, 0x0) shutdown(r11, 0x0) r17 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE_wg(r17, 0x1, 0x19, &(0x7f00000003c0)='wg1\x00', 0x4) 2.136358325s ago: executing program 2 (id=654): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CCA_MODE(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r1, 0x1, 0x70bd29, 0x25dfdbfa, {}, [@NL802154_ATTR_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x2000000, 0x40}, 0x24008000) 2.070080977s ago: executing program 2 (id=655): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) syz_clone3(&(0x7f00000006c0)={0x42000000, 0x0, 0x0, 0x0, {0x3c}, 0x0, 0x0, 0x0, &(0x7f0000000680)=[0x0], 0x1}, 0x58) (async) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000000c0)={0x6, &(0x7f0000000080)=[{0xaa, 0x10, 0x8, 0x3}, {0x400, 0x3, 0x90, 0x7fff}, {0x0, 0xa, 0x6, 0x7f}, {0x200, 0xf8, 0xf, 0x5}, {0x7, 0x1, 0xa, 0x9}, {0x7, 0xb, 0x3, 0x4}]}) (async) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) (async) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) ioctl$KVM_CHECK_EXTENSION(r3, 0xae03, 0x64) (async) recvmmsg(r2, &(0x7f00000032c0)=[{{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x101}, {{0x0, 0x0, &(0x7f0000002700)=[{&(0x7f00000009c0)=""/6, 0x6}, {&(0x7f0000000a40)=""/219, 0xdb}], 0x2}, 0x1}, {{0x0, 0x14, 0x0, 0x0, &(0x7f00000028c0)=""/132, 0x84}, 0x3}, {{0x0, 0x0, &(0x7f0000004440)=[{&(0x7f0000002980)=""/39, 0x27}, {&(0x7f00000029c0)=""/129, 0x81}, {&(0x7f0000002a80)=""/227, 0xe3}, {&(0x7f00000002c0)=""/121, 0x79}, {&(0x7f0000000580)=""/111, 0x6f}, {&(0x7f0000000b40)=""/250, 0xfa}, {&(0x7f0000000c80)=""/139, 0x8b}], 0x7, &(0x7f0000002bc0)=""/79, 0x4f}, 0xd1}, {{&(0x7f0000002c40)=@isdn, 0x80, 0x0}, 0x6}], 0x6, 0x2000, 0x0) (async) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="640000001900010000000000fbdbdf251d01090050001280"], 0x64}, 0x1, 0x0, 0x0, 0x5}, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, 0x0, 0x80c0) (async) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000000280)={0xffffffffffffffff, &(0x7f0000000180)='\xdf$()*\'\x00', 0x8040, &(0x7f00000001c0)={@align=0x9, {0x8000, 0x86c, 0x9e6, 0x8}}, 0x7f, &(0x7f0000000200), &(0x7f0000000240)=0x8}) sendmsg$NL80211_CMD_NEW_STATION(r5, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x38, 0x0, 0x200, 0x70bd29, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_STA_SUPPORTED_RATES={0x4}, @NL80211_ATTR_STA_SUPPORT_P2P_PS={0x5}, @NL80211_ATTR_STA_PLINK_ACTION={0x5, 0x19, 0x2}, @NL80211_ATTR_PEER_AID={0x6, 0xb5, 0x191}]}, 0x38}, 0x1, 0x0, 0x0, 0x801}, 0x4018800) (async) keyctl$session_to_parent(0x12) (async) write$char_usb(0xffffffffffffffff, &(0x7f0000000440)="d56132ee8ed62e86f5c20250ab20d1eb9918b632e2c70c0ee25c48de1e6898d166875cf2cdc3c8aef508235039762e0d129b49a1bc6b4e1950297d7081d57d4d643e40ad86e6bc730a330a9baff0636aa23620a6e84ebe8b80b9006c6500a91e2415d794ddf5e8b05e9d6a271c5511a4a661c5107603886a070c0ee0ea541e862f1418a7f41a3d62f2e741a90028f839fc0c26caab99b48249b2ddbfa5136b006b7e823448df0f4ec65a8d48ba81a1f5f1de6ca8150297d14c94e674eabc63b995ab3928b28e417c6e09d65612c2423212a9ebfba2ac9b233ae9bd33be4df736e45b5128530fe9e206ab1baac233181246516b7c715c1a19cee2418b08cd21ab261c609ea4c5c69589354fc25f6b1f4f0426af88de83a649366a5f03c16496a9c05e45e9e4a1680d52f2774a5cd8261bcf28166a0d0a174a7b2d8818312c2fed7ff310a11b6ad36742964959b0f584592872d99648df08e09f836554bc5f0389063ef27a87b29f81fc05f3621d0772d2ebce9ade96f89eba734c32abb81125f9bcac18f2ba426c4ad4ddbd2fe62a36ceb1290ef3638775531b9179c7af52370bf9de49c5bf0dd12d4aefd8c8ea235afde48572e2886461c17bc1b7e21ca2f4f2b1f0ba5740b8154a0a27d371e3b98c94ee0c5550381b3958c1f23155c9e93a93491d94061d9afff438f6bb7b953b092ba315aa176bb8ed07a7111a1ffa5421b2f0c2a591f4ef34e929c416f858b369b16198f0e28a246f30a028ab2cccfa30c2577f0801ecf5aa09b79e82a16c0c69e926f6f0405fa02dc89b3ede9d0f385651f2a5f3cf081f895fe84f39828c2fa7fb89c94a741e01d8560fc48296deff3e5abb5a61686d7665fea3a2d410758d4b9ca2bc70d44194c082de45e312cbb6d8d85a48c067a25fa693c2969c6b22e71f3794054ed55e095bbc73514e3f0564789b0cf1d695da20fa7f87252d29b713bdd9421a8532147e9952e64b5c3ec894417e13bc1a50d87014c05fe5e8d3382d469b547601315ac9221c561808bec50140bca907b3496b757e2b3f039b317dc122379f6fe73fa0d21c49a716b6608f013b74a9254af3f67b06b4623559d4a09c4a12915d6bbb938cc0817d103801b4bc6dff5c9bc0a271cca1de3a777fbeef0f2c426b437babae8819e5f274d241ef64424d44771e435048823473b7e8a1d1284b9da25e21642b2238584229da4250aedbce18e967ee39e496618b5f86e102fd4f42806ae240ec13bf9c6803a595750c360bfbe7a55575aaa1127455903febf2d1a80171b2ce72b9a921c14baecd9851d49f2aa5a6693f31709e53bdabfe3489bea10ee6881f75e3019a03ec7ae988bb9cc31834940de4b3009658daae7a453a662c4dad9bb048762a880c9190a0e45d2702486d69bc73c713f7fa1348eee9fccff2e5b7fa16d1e1c999bdb9ca4b84b4cd1c16e935a74c7200673880dea184e9ff20fa1c08d257583d817519177677958ffb034cb4ac73a8d6cba951811bbb41515b0bb2ebf9beaa2463d06ccc49a72aa27660ff499845ad7c51dbadf0687df88fe563ee8f8afc3d502a458ed6e3f6f3da3b5f47ef1654600b621c592233f6b9603d6708ccf113a915378a368c53db32c0a7c2896bcf36971c773beba411a1def55d01eb2705f6a3723d5153f3a0784243c44ef440baedfb199170facd3bfd3f4d5e687519c56b17878062d55489fe73e379fb704ef595dbe1a53cd7fdef77d3583f808909d6a1a436dedc3bed79301e13c1740d153d0fee0aed1ea9fcb2870495bc079642c7c5cf84864849524d536297dce3bc4dd537cb6150beeae2825e418e10369b1b4925e6c5e6b295bea635c56812dc146ce0436c189c675ded50a4bd30e471047d0f7595c52ce3b110461dfbfdfa62befc566e3cd664666c9d4a0aca6142e5483fe96b61f62467920e7f69b86d390baee1850502f1b25f9f63778040056c99cb0282a214e18972545ad7ef63b8bdd828ab3dbdb4874faf0af57c6208752bea3d3419584f7c0fec0e2c9475e42c39d51f2e774d78d7e6f43af5c5c8c3dfe62270596cdd26545bbb4b3d1de9d90d6648d06353a9027912dfe9b756874eb664e3deb03a09557749a8e26d72fbadde532626de7f8142b7ab346d7bd86b01c7143226db87f7b910cb38cc7694045ba3c061ae0081f8356dd844f44787d71103a5c26cdbc2b83866643d38d46a3dfb05a645cba800fd267c1dc1", 0x629) keyctl$session_to_parent(0x12) (async) syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000") 728.234774ms ago: executing program 3 (id=656): ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000180)={'ip6tnl0\x00', &(0x7f0000000100)={'ip6tnl0\x00', 0x0, 0x2f, 0xf8, 0x27, 0x1, 0x12, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8000, 0x7889, 0x9}}) r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'xfrm0\x00', 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff}) write(r2, &(0x7f0000000040), 0xffffff4a) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000240)={0x1f}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r3, &(0x7f0000000180)='`', 0x500, 0x0, &(0x7f0000000240)={0x2f, 0x0, r1, 0x1, 0x0, 0x6, @local}, 0x14) 137.807797ms ago: executing program 5 (id=657): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) preadv(r0, &(0x7f0000003200)=[{0x0}, {&(0x7f0000000400)=""/224, 0xe0}, {0x0}, {&(0x7f0000002f80)=""/196, 0xc4}, {&(0x7f0000003080)}, {&(0x7f00000030c0)=""/21, 0x15}], 0x6, 0x192, 0x8) r1 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x26, &(0x7f0000000440)={@private=0xa010100, @loopback, @multicast1}, 0xc) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, 0x0) 82.640688ms ago: executing program 5 (id=658): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x121400, 0x0) ioctl$TCGETS(r0, 0x5401, &(0x7f0000000d00)) ioctl$PPPIOCUNBRIDGECHAN(0xffffffffffffffff, 0x7434) 82.441858ms ago: executing program 5 (id=659): write(0xffffffffffffffff, &(0x7f0000000040)="1c0000001a009b", 0x7) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000001c0)={0x0, 0x0, 0x0, &(0x7f0000000380)=""/70, 0x0, 0x4}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, 0x0, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000003980)) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r0, 0x4008af04, &(0x7f0000000040)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000700)={0x0, 0x1, 0x0, 0x0, 0x0, 0x10000}) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x80, 0x0) ioctl$PPPIOCSACTIVE(r1, 0x40107446, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x21, 0x0, 0x4a9f}]}) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000300)=0xfffffffc) ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f0000000080)=0xc03) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000180)=[{&(0x7f00000001c0)="580000001500add427323b472545b4560a117fffffff81000e220e227f000008925aa80013007b00090080007f000001e809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000180)='gre0\x00', 0x10) 60.686599ms ago: executing program 5 (id=660): r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000980)=[{{0x0, 0x0, 0x0, 0x2000}, 0xd47}, {{0x0, 0x0, 0x0}, 0xe}, {{0x0, 0x0, &(0x7f0000000f00)=[{&(0x7f0000001180)=""/4059, 0xfdb}, {&(0x7f0000000ac0)=""/171, 0xab}, {&(0x7f0000000180)=""/290, 0x122}, {&(0x7f00000004c0)=""/179, 0xb3}, {&(0x7f0000000e00)=""/216, 0xd8}, {&(0x7f0000000100)=""/101, 0x65}, {&(0x7f0000000d00)=""/229, 0xe5}, {&(0x7f0000000780)=""/112, 0x70}, {&(0x7f0000000600)=""/90, 0x5a}, {&(0x7f0000000340)=""/21, 0x15}], 0xa}, 0x120e}], 0x3, 0x40000062, 0x0) 47.886239ms ago: executing program 4 (id=661): setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) socketpair(0x5, 0x6, 0x6, &(0x7f0000000100)={0xffffffffffffffff}) (async) clock_gettime(0x0, &(0x7f00000054c0)={0x0, 0x0}) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r4, 0xaf01, 0x0) r5 = eventfd2(0x1, 0x1) ioctl$VHOST_SET_VRING_KICK(r4, 0x4008af20, &(0x7f0000000000)={0x1, r5}) ioctl$VHOST_SET_VRING_KICK(r4, 0x4008af20, &(0x7f0000000040)={0x1}) (async) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000006c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r6, 0x40345410, &(0x7f0000000000)={{0xffffffffffffffff, 0x2, 0x9, 0x3, 0x1000}}) recvmmsg(r1, &(0x7f00000052c0)=[{{&(0x7f0000000140)=@ieee802154={0x24, @short}, 0x80, &(0x7f00000003c0)=[{&(0x7f00000001c0)=""/238, 0xee}, {&(0x7f00000002c0)=""/34, 0x22}, {&(0x7f0000000300)=""/153, 0x99}, {&(0x7f0000000880)=""/250, 0xfa}], 0x4}, 0xc}, {{0x0, 0x0, &(0x7f0000000b80)=[{&(0x7f00000009c0)=""/167, 0xa7}, {&(0x7f0000000a80)=""/59, 0x3b}, {&(0x7f0000000ac0)=""/148, 0x94}], 0x3, &(0x7f0000000bc0)=""/59, 0x3b}}, {{&(0x7f0000000c00)=@nfc_llcp, 0x80, &(0x7f0000000d40)=[{&(0x7f0000000c80)=""/178, 0xb2}], 0x1, &(0x7f0000000d80)=""/160, 0xa0}, 0xe9a0}, {{&(0x7f0000000e40)=@in6={0xa, 0x0, 0x0, @local}, 0x80, &(0x7f0000001280)=[{&(0x7f0000000ec0)=""/248, 0xf8}, {&(0x7f0000000fc0)=""/27, 0x1b}, {&(0x7f0000001000)=""/192, 0xc0}, {&(0x7f00000010c0)=""/42, 0x2a}, {&(0x7f0000001100)=""/50, 0x32}, {&(0x7f0000001140)=""/54, 0x36}, {&(0x7f0000001180)=""/156, 0x9c}, {&(0x7f0000001240)=""/50, 0x32}], 0x8}, 0x3}, {{&(0x7f0000001300)=@nl, 0x80, &(0x7f0000001640)=[{&(0x7f0000001380)=""/50, 0x32}, {&(0x7f00000013c0)=""/104, 0x68}, {&(0x7f0000001440)=""/210, 0xd2}, {&(0x7f0000001540)=""/247, 0xf7}], 0x4}, 0x8}, {{0x0, 0x0, &(0x7f0000002a00)=[{&(0x7f0000001680)=""/4096, 0x1000}, {&(0x7f0000002680)=""/226, 0xe2}, {&(0x7f0000002780)=""/174, 0xae}, {&(0x7f0000002840)=""/145, 0x91}, {&(0x7f0000002900)=""/236, 0xec}], 0x5, &(0x7f0000002a80)=""/172, 0xac}}, {{&(0x7f0000002b40)=@hci, 0x80, &(0x7f0000002c00)=[{&(0x7f0000002bc0)=""/63, 0x3f}], 0x1, &(0x7f0000002c40)=""/180, 0xb4}, 0x6}, {{&(0x7f0000002d00)=@generic, 0x80, &(0x7f0000004200)=[{&(0x7f0000002d80)=""/158, 0x9e}, {&(0x7f0000002e40)=""/113, 0x71}, {&(0x7f0000002ec0)=""/4096, 0x1000}, {&(0x7f0000003ec0)=""/224, 0xe0}, {&(0x7f0000003fc0)=""/158, 0x9e}, {&(0x7f0000004080)=""/63, 0x3f}, {&(0x7f00000040c0)=""/7, 0x7}, {&(0x7f0000004100)=""/30, 0x1e}, {&(0x7f0000004140)=""/180, 0xb4}], 0x9, &(0x7f00000042c0)=""/4096, 0x1000}, 0xfffff541}], 0x8, 0x142, &(0x7f0000005500)={r2, r3+10000000}) (async) r7 = dup3(0xffffffffffffffff, r0, 0x0) connect$unix(r7, &(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e) (async) socket$netlink(0x10, 0x3, 0x0) (async) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) (async) r8 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(r8, 0x0, 0x50, 0x0, &(0x7f0000000240)) (async, rerun: 32) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0xffff30c3, 0x3, 0xf, 0x8, 0x80, 0x2, 0x3, 0x7f, 0x20000006, 0x20000000, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0x0, 0x5, 0x4, 0x0, 0xa, 0x3c1b, 0x1, 0x24, 0x800000d, 0x1, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x3, 0xc, 0x0, 0x8071, 0x7, 0x6, 0xffffffff, 0x7, 0x5, 0x3e, 0x8, 0x6, 0x6, 0x0, 0x5, 0x4, 0x8, 0x3ff, 0x80, 0xfffffff9, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012d, 0x8004, 0x5, 0xfffffff3, 0x129432e2, 0xc8, 0xf9, 0xe, 0x2ff, 0x1, 0x9, 0xfffffffc, 0x4, 0x10001, 0x0, 0x3, 0x2f, 0xe, 0x6, 0x68, 0xea4, 0x0, 0x3, 0x7, 0x7fef, 0x6, 0x400, 0x10401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0x1000d, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x4, 0xf, 0xffff8001, 0x47, 0x31f3, 0x1, 0xfe000000, 0xfffe, 0x202, 0x4, 0x9, 0x3, 0x7, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x4, 0x42, 0x3], [0x5, 0x408, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x2, 0x5, 0x8, 0x4, 0x5, 0x5, 0x4, 0x1ef, 0x2, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0xc, 0x2, 0x2, 0x3, 0x20000008, 0x4004, 0xffffff11, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x3, 0xa9, 0x5, 0x6, 0xac8, 0xbf, 0x4002, 0x3, 0x7ff, 0x12b, 0x4, 0x40000001, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x1, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0x9, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10000, 0x9, 0x7fff, 0xffff, 0xa620, 0x1, 0x78b, 0x8, 0x2, 0x14c, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x1, 0x0, 0x1, 0xfff, 0x5, 0x5060, 0x0, 0x100, 0x9602, 0xb, 0x80000000, 0x8, 0x6, 0x1, 0x5, 0x5, 0x8, 0x30b1d693, 0xa1f, 0xf44, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xa3a9, 0xd7, 0x200, 0xffff343e, 0xfff]}, 0x45c) (async, rerun: 32) r9 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x2000001, 0x13, r9, 0x1e67e000) r10 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r10, r11, r12, r13, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) (async) r16 = socket$inet6_tcp(0xa, 0x1, 0x0) r17 = dup(r16) syz_ublk_setup_queues(r17, r15, &(0x7f0000000180)={0x0, 0x0, 0x1, 0x1, 0x123, 0x0, r17}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x100, 0x1000000, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffc, 0x2, 0x0, 0x146, 0x0, r10}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8000, 0x1, 0xdf}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, r14, '\x00', {0xfff9, 0x7, 0x0, 0x0}}, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0x3c, &(0x7f0000000340)={0x1, 0x4}, 0x8) mremap(&(0x7f0000150000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000b7b000/0x1000)=nil) (async) read$FUSE(r7, &(0x7f0000005540)={0x2020}, 0x2020) 2.33142ms ago: executing program 5 (id=662): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) ioctl$SNDRV_TIMER_IOCTL_START(0xffffffffffffffff, 0x54a0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup(r0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x40241, 0x0) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MIF(r3, 0x29, 0xc8, 0x0, 0xc000000) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r2, &(0x7f00000000c0)=ANY=[@ANYBLOB="083c86dd0001112004600000a60c6eec00be11443cfffe8000000000000000000000000000aaff02"], 0xfdef) 0s ago: executing program 4 (id=663): r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000012c0)='./cgroup.net/syz0\x00', 0x200002, 0x0) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000001400)={0xffffffffffffffff, &(0x7f0000001300)='(%\x00', 0x880c0, &(0x7f0000001340)={@_ha_fsid={[0x3, 0x7fffffff]}, {0x126, 0xe, 0x3, 0x1}}, 0x8, &(0x7f0000001380), &(0x7f00000013c0)=0x1}) r3 = fspick(0xffffffffffffff9c, &(0x7f0000001440)='./file0\x00', 0x1) r4 = ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000080)=[{0x6, 0x4, 0x0, 0x7fff0000}]}) close_range(r6, 0xffffffffffffffff, 0x0) r7 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001480)='/proc/schedstat\x00', 0x0, 0x0) r8 = openat$full(0xffffffffffffff9c, &(0x7f00000014c0), 0x400, 0x0) r9 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f00000005c0)={'ip6gretap0\x00', 0x0}) bind$packet(r9, &(0x7f0000000180)={0x11, 0x3, r10, 0x1, 0x1, 0x6, @broadcast}, 0x14) setsockopt$packet_int(r9, 0x107, 0xf, &(0x7f0000000000)=0xe9, 0x4) sendmsg$netlink(r9, &(0x7f0000002ac0)={0x0, 0x0, &(0x7f0000005a40)=[{&(0x7f0000006140)={0x500, 0x42, 0x4, 0x70bd26, 0x25dfdbfb, "", [@typed={0xc, 0x2a, 0x0, 0x0, @u64=0x4}, @nested={0x19, 0xa9, 0x0, 0x1, [@nested={0x4, 0xdb}, @nested={0x4, 0x9}, @nested={0x4, 0xc2}, @generic="c1ef3a274a", @nested={0x4, 0xd4}]}, @typed={0x11, 0x4, 0x0, 0x0, @binary="00245a6393ba555529869d682a"}, @nested={0x3dd, 0x1b, 0x0, 0x1, [@generic="d810fc1010cb14afe4d217f138c0a07d6f426e1a9b94efe19b92d76a31c2c57dc0954deee9369ce8d63d97f04fa873cf821d54862b0b4f806d703ab70ea59e6153101a79f35d9d34df7c6376c74190047d3c2be00cba44ae3720426e01b9172feb9105da1916ec4ba777037c1aff012942406bbc8fd2aefba3ca01e33f5b8a99ce5f251930569869e3d7ab349efbca05228a75672afb44dc22ee765fd7884d90dab0491bd303dba4f188ff941947a36c5cfb365207d524fc4527ef9e38e2dc962b9cdca88318f464ee3ce1", @generic="35fc6fc604141fc3e8e7b17c4b4763df5253dd71e406a0bce802e409a22ce9f3a0e565c414a12ecb45daf9ad01090bf10a4b509ca724b982333a229b9de9e7fecbda0cef99f392a73c6ab073d785e573f5e937c58351b00087023a9d70fa57", @typed={0x8, 0xdd, 0x0, 0x0, @pid=0xffffffffffffffff}, @nested={0x4, 0x8}, @nested={0x4, 0xc8}, @generic="2bac3c431b2a3f75b37a03a0d9262b77b3edc6f7d267b6e523b49643ae687c8a98fcf65bd7438f7753a43abf8221425fd72d8eccd1ed3231fa2fe5b1e78e009f281df015e1ba6c1d57c840f7da6491c50dd14ca6603e5cf5e07798413d0553dc521ff2908386bbba86b195c712609d08b902b8701f5db6dd71abd56bec26467728895f9fae1a52e791c340ca5a92f65d2a6774d97d0ffc32366049a79d93b1cd952be4d2d652d0a3cb922bc5bb28d75b07e97865067a3ce17dd36be93980c7e307a262e6921e1c9107eb303d8a8ad19bfb2ac13d97e3411abc456e2e5086951a1ba8d69bd8f6d44f38919e34e0cbca1112463ebdd1f9f48d0c2090ce149135fa75", @generic="92eaf57d13358de05e289562399fe563cb579cc016d1d6b8f283a3cd7004accdb6dcbd548a46c944e81ceb4cbab25e985a104869e53b6cfd96a876b243b867b5a5ce59517e19eb006cd94070c5def49815a35ef4bb2cf35cf96e7dccf01fe208ab2457cd199164f1766769adf4921ee54d29110def2efaa7ffc6c7e87b92f143360ef764e4e8b408cff652201cd2c4f178495860916adc61814714", @generic="7e83cf0dc8443efd2a92c6613b955fb480d29192701e5a32eba99638d2f52e6d6116b1fee8ae7a4458a35fac73692884d2925af04d8a02c063d01c0c4dc6cf", @generic="b0267bdbf60d58725c63907287fa98a0104984267f95bd6504a84d81a46306fe22499284dadbddf2657b92d4c5313ef33dc1b53a580ce28fe96919a0ad893b8d8785d9cffa396d73a2da816ea87df345c04884fabf3bbaa0cacd8fe036f278e1ea0a11cf6c1fd8ddf7eef9fb83df26f7468f27398935f2772da4d86e152f4591bda59791fb1a4f3a84b213a868c0c5aefbebffb9c44688481c23a4adc91fd29399c72db1e7155a725bec8cbebbe348d667eba53a134d643fa1ccecaef75f623b", @nested={0x4, 0x17}]}, @nested={0xd1, 0x14e, 0x0, 0x1, [@nested={0x4, 0x133}, @typed={0xc, 0xbd, 0x0, 0x0, @u64=0x7}, @generic="809734f67f9e03ecaf408c190c86149c635e6c8ad5c5bde52c6241325bfb952dde9f1cb327bd2269e424ff15eac79423b2cc1dafac46e13271f932e3f520e5547ea6701e2a37baab2139276ba3c73076398ab6fad3a399679190deef6e17f8ec8c4059a4df640c4044791d07fee0683bd9f8ff0ff91d1676500e21b886e308a4bc586a7b2ccec475627bb9e13c0d3a6f1616519fc206110dfa9211e85a66ae63d1d342bd278084ac148d7c8bb9408a008d8b7065086f5f5f27b82da4e2"]}]}, 0x500}], 0x1, 0x0, 0x0, 0x4008010}, 0x20040851) r11 = openat$zero(0xffffffffffffff9c, &(0x7f0000009b80), 0x149202, 0x0) ioctl$FICLONE(r11, 0x40049409, r11) sendmsg$netlink(r0, &(0x7f0000001580)={&(0x7f0000000000)=@kern={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001280)=[{&(0x7f0000000140)={0x107c, 0x2f, 0x400, 0x70bd27, 0x25dfdbff, "", [@typed={0x6a, 0x12d, 0x0, 0x0, @binary="8d78f8af19d6d54fd2da1341a4f4153ab991de3b4d68314b4a5f2c947b0f308a504be99ce8c6ab81bcb1b6f47bc906a6f29bdc212e9ebcf56312f97e3326985b32aaf4b0154a6908191e575183873bc0a347134a012bf6f3cfa0ef1f6f5acebf4b430ad98bb2"}, @generic="2930f6b4e8d7403a35f5a0fe0f36e5a57127b1afd4c0c1555749c539af02d8eb6ee5fb3af9e2272728e089e965b530398029849051325b0364484a9dbf6bde0a5edc3286d7f351e487466a3feb5a6b690062c3542acb0d6df9022288b55d3a7ee38a3a46b070612a2d167068f59ecfef50b2ce75b2b8d2711f80fca64d12d0d40996598ac1f4d0bbe272284247015e89a8ef963e098f8f77718ed6083d4944e7ebf50ee26747357f136dcb3a9eedcc895337ff41920fe21c87dab1ba03928a20d95fc63932956fdfb378448d7c672cad3412130b4e34feffdda70704ab268b26065015f65fb51148902d38919c84e27e8684fa3f509f3a6708423605656a821e696bc4eaf7cd6a08dec8c5d016e9443adb9f00c8e8cd616bdc1b0455a024ee090e73a854a5eb39ebcb59a3f861eaacbea02068917857a1af5fefc8cf523fdb4748b2b520bfd65df65d0ac02551211ea5b4bf3f3a92ec3af975c17e1e4c7d0d862d48db3426e5ff89eb02ff610e00b692dd4ddc742b967469eb5ca551282728cf185f4a94cbd3fa4b183ecc46c98b3fee1dc31746b5531145e34e9bf04f9b409ca38227f1e03b92238f9226272d56a3bc85ba2db2c3bb6ae07a49207f9a6a8f206e2ba8deef0e7b4a1acc898353aa23415c09a0926a78a22c03cb628d8c81794d1a1f15a6bd04c3775af9a442ed06cca91143b7a36f58642a1e657c0a6bafc687739cbfb3d02eda87d03a8d806591fefe2e9af51436e16953cf8a4a8281cdddc004e146f264c4ee8f0a9911686899a22130a7cedbff999b4f363561bc16b93b3045dce00bd98ca1a3da56e39870425e4ba217720164cab0e8a9156fef52aea947d6aa742712d22670ef16bf8d5532227faedef7b0f4e83a57d2b13baf64e7eb2478d988d65653be9c4974460b065861a8f99cef9bc727d65f9363dc8cb1a8969eca504aee3a0738988c4e8d864bba0441fe66d652bceda88b25b21bdb8568d58746c000dd2324e598f7ebb2151d6a59e0d33da05b96c27f9aca1672d795237f2dd8b69361863b33849f2c0da98eeb0a223cb05d1f364d7b34053101e18c31edb89e20261feba4d87897ea9f1bf7373919bf73dd52c3b24b616182f49113efb1d75df5d428a9a5c11dcb1318c6e9ad7a12d217ed942763c3cc37119dbc8ef4c0a972459d2e9010e12c7d6ec7fe40f937c2b4401b30aa13f3a9e5105c4802f261c8b6660169cecfd28eb16fe586d896e984e7d6735cf4733d038bf36c60b1433c31f256339c9b2ed406b075a99d9a10a58c45e06a002df7021d8c1244994ae2a0a95aaebdaf72241d346954882dadd04d4a5d0a8adcdb7400ad590a6cd90458413189da9afd37bb76948e251429dc3bfbb3d523342b73978dd0f49d3cdb3d4639713f1dd16c2e910d98d9965d3c63d5129cf1f0fc49b5988117d33a1d5c44cf88aea563a23d5ac8700bc72b582f3830ee7372cbd3e9da558552c2b8693a858758a8456751cd603efc652deb05483b37310ee1fe873ea04cd2c4e82da0a54763fa9431e7bdaa98ebda1ec5db548ac25a9dd1ed29e90d87f53a0091f97832ae0780ab5f74f3ec5f859ac4e47391c2da01f18f62ac7b374b3822a219fbf16753b657ed662dc9d820e303489c9d5bd4fa54646cd8c0313235377d0a3c1232bf56d540eb6826eb438ccf9adc746faab4dba92d42c1ccb02179220dc749d943dadc561724f5d2319dae01e4efc41997c10c26d7ef10808b8ee671124945c9d57811c860738c5df98a7e3134d7453aa843339eee320d2fb8999305f0a1fbb6230fe4f973ddec3cdf3650ed310d6560c16817491187147bb65e2b035496bde207de980eb7343373a9f60ec0ed7c3d75ce87a5de672be5e6c3e88fdfd9c77ca0c39b6cba6509c574600e79d4d171f0f6d62f90528537458f07f3f7141fdf4fc7bde0bcb0133cf21448d4b25f6dd2ea31156f6ae8203f1e3dc6b79eaae7fc47d904a5b18cd94f8536d425dd0c56edb532c1db15cec9290553c2f03ce4b03b593959eac8bafed7b276eec2421663fb78031172b98e98f52b8456965780797fecd0b8ada73c71e3a8c2367ef14cb1be362f601c71c6dbfffa692e2611ec0470e3307949054858c946431c26bcba78c3bfee676f89b754a654f75e2782814fc0e98ad3f225d34849e1cbde2bbdb1395af584e4d0df3243d1e77718baab509b8b17d13ac5c0587b9a61af79ed1aa297e2bbd10ce31993c18c58689f1d8e9c91e11a7a500bcddf50a749b752f1799c78b35dd9dc26707f5756fac1be15a7fbeba4ac0d531bff18002a9be7cd62bc681fe70ba8f7f511aa248508c5fd232937b2308a546b9bf7c29065a7700a26f69b1015e84d2140dce39bba4d0c757571afd03e1b56d7083e1062fa11c2fe5bdc16027617adc31c44668beb009b8375b87d17f4f5f035bf7a3a39f8691f70b61cf2455df27d9293ae98ccd48f23fa81b714eecbba2896b3d3c8b3422dc3414f0a1534a10d3e05739e69b4308a7875525d3ac4b5d5f1aebd45caa2bdcc403aeaf61c5dc32f943eae9c5215091691ec584ecb798333395ec027f65639a31915c7bc8f405fa5af9346ec98478b1bec3d5f5f2decdcac904a1dab7a074eea51f21e4fc273d61cc2bd83a9bb115ed60150e6f76a3d736981e8c120e45c4493d9f80e02d80851056d766a6510a015a65146f86510fedcc912868f03c8df57f9b2bc0ce317b4efa559db117a5eee754b6a589906cf628cb5abe88efb42ed602ead1bef4a4221c135f186685bc448a88a18b6f66ffbf6513dd48e80cc57a27dff496f35d5254f01250a60a0a79a79573530d70f6003ef8c36f722442087e7510a6448d78e0d01a4fd7c03ab829df2b895efb47d33ba518dda6629cd2d9c4166a6783ab869c1353db8e664674bddbfce4223d7926b6f9c4994e841e6eb0d35becc4c10dea4008ab0b29355d08603f550a2d24026b3c1ff23901ef9988f44618ecf3813fa19d7f0abcb1300d3d400205b454878759f9f835d60efb5e257f205f329b52d0e9831c432f74d51c8f464b543bcab93a45f9d632022403336c2e0ab01c41f3e609bfdf3baaed5f6a022c55537c098d04ba874f9ce6af664a9f0ca06372d9e5cd2357e83c06692d2590d5298e722edc2c2ea36e7cecf880d86815befe38f577b725e8fe201f934c99f2af0ddab43fd6c996c8756da5591a55762380021c83f56cdab7018d7d95837ff28bb41345e80d9ba875f4c1dfad48441bce498047b944b90943530683b9e826d33b988410229eef23580b52b2deea6dea184d629eeb2d9f384b1cd8fc6267bef7fb7e1c5e2c7cec7f293cb44d8494729993a452314e4214a3ce8620d62959297024374eb06448a7035de8cc69d79d0459e77bded9c80336f92fc62b3f29f9e51356dfb1b85160e7cda12b4f86b560e79bf4a9d595dd1734f33a0fd08cfb5871fcf0a6bc6ee017f9e8d87d99f4bf9f3a21a29133f89b2b61f0d1c4b1591277a0e650228dc397d85533d72f2ed414f53f33e69972bc11bfbc49af287ed3b45f2739621709535d550e0835d6bac1480c3cd680a48d65eff094fb02177fb3331a220b651ae4c8c21d95c9d0efdcd83c2e63241151c70e2796f23fda920810e813ddf05048d221c318abb8c8a876e3dc91e4fc5d637888b715fc4188481db358e8e4e791bdc0b59c5c23af6733d0387e96a9b776609ec292b9f5cd4f437c8c1dbf4c9c68cf3db12c96255058d763c738b63c03443aa1b6440fdf3326b1b45ac02e01c235d46ff1073129edf2e46f79b3386895e6a2bc86895f4b27c64c2668bc127947db49b402b9df8271133c38d27c84e166431983bfe01fc98757e33a5b34bcdc8a23b855887022856bf917aac04460ad1006af55192678c1e8401a4ea3b93174757f4ad53d754bf5b62fe12aa2e6f7cb453422334b57436ebdd77171a820a20e692bd42086f2e4ab2c4a9efe1f297da93eabc88dbebe8f30edb20ce6360561cf385dafd3e5da43c5a59e577ef091c07be3bf5e81d7998a4e94a6f8c81a207694940a3827a85f80bcc4b6f5ed76cdbe6f1867a3da54bb0926dab0e4b175bbee89357b89b676c03e526bc2011329d451cb1ae5e906e6f5e5af68a36f6b1dbf6f99779bc84ac4453333274e796493453e082a1f98734b2ea66974facbe0d1d1723054140300d8f365de74647a99aafd3eac0cfc2d7b0244de8350f73402523ba60505ad81c9e7f897231760244d11e84906b40602821d9ba71ba5222446c4ba2973f3efc857b67a0e3663038f91040490dd692f44d0a254aa4f3fb5f07e260b58e4bbfbf0811363412c473b717621475ad3a0fa6fdcbbb254d58ce0fbe80096ca63f951399c259713b3181cd0d10b3b3495a5c1d06be5a5969d74ce1d2b335fc8f9ddfac8a1ef3c9782846b61ba00166d4d1548879e0798f48bbedc26a92080ffb9d4234c6c9c6240d2f7ca8dcceda41f129a873297de1dc27e3cfdca220b3da2522b53b81ada0fa19e68112a4337bfa46be6eb045101ea4174cb6f6c3ccd7c2a1599d7e04e1f975255c0b8daf45f688b39a6c4b2c5a382e9331db7d0f6a75a49cb14cc29eea7986a2edc286b0b4b1867a949304f381df7c7ca49c9248f1d3ffa0b4c986603994eb5950e89819e0a0d22cf6aa6ac4ed105c535fcbf29f85d168de8a8b2e3479a81e71b527beec2eabaeccf27c57fa071333cd8842a75ccaade13e4f7695ff85cde37b0ce949bbc3c7133da7aa8b642b29e58fc03226b748a4cbfba04e0a70dd1319b4cbd55f8b0022b2b1e3e003e1409229b5569f5ed19eab214c678f9691e90ec4420c65dda45d2ae3a2e659cb0fb2b1ba33e8504a0c3c25f6347704a6b186221e3680c847ccac3dba9861179e58fa4545e364560d93473ae5448662f02aca08297063bb15cd30a7bdb428d4da2350918be3d06b56a50b04df1b0a5308b3995d1e544f52edafacb092554a10dd310d49d47d2d23b8388babaa1df45118b138d513aff18c32db7c44b38141ad50ba1324fb82a9fca7a536f7c4d86e37da7753246d4399a6748d4f58bc28ad4d63de59c69053812868e40fe80bfe26cb99f67a908664448b86787b4f3e4d7eaf9fb6d8403f9dce2f2eb507665f537ca32f06cccb0c4cc0f92c36f892b1a18e959c149628b70daf2bdd42ebb6b1fe70a2e8141774a5ed280eb6c0e514585c5c0d8d624d0e5c1c101b245eadc9d02338f9f38d6823edebb4b65e5bbff06e5091940a640be08bf583619bfa02a8cc58780da2bc4bc4be6e2a1a71ae95ad0eb7980fdcd0a45a50e55d2626a8d63fa35af65c9aa4e9749ebb5f7847257f4df509c47e7d8695768401242cf50e6386d6b50b86918ad20763bafe3fc7ebb486f1698ba59628d0dced5f66e750ffb23fe60d1fc0b232b38849588d37acec9cbfab5f45b96434b082b89f1f17b6df02f4f46e7570eb4e58df697d1607d91c959663a0912bbf1bd5f70d2b01d6d3774b7aeff216040fd94bc49a908667480e56d99255fde6671d16291e6b17b299b20860703c2dbcca15bcb59a6d346e170bed9982a47bc79cf0284a412e30cf6b816ec752a8d3f20d1330318a69065ad6e825c10777cdc35e1fb64eb3ad1edb6ea7ff8bec0f9f9b05e778259457cbe3ed9c1db459b0387beee24f7579140d88ec105ab7fa76472fa0c5df689c5c4b3bcb83d2bae289b4c26c4d55a3a7870baa85844a76826c0d6a3003a8b3ac05c96cf8a14b1d1f37cda9df8ccf17ebc7110cd30e2699ca77cb7ccf6130fa4d511b7bb580a670f30ee2fae302c3"]}, 0x107c}, {&(0x7f00000011c0)={0x10, 0x3d, 0x2, 0x70bd2b, 0x25dfdbfe}, 0x10}, {&(0x7f0000001200)={0x80, 0x2d, 0x800, 0x70bd25, 0x25dfdbfd, "", [@nested={0x6f, 0x98, 0x0, 0x1, [@nested={0x4, 0x130}, @nested={0x4, 0x11a}, @nested={0x4, 0xf2}, @nested={0x4, 0xee}, @nested={0x4, 0x5d}, @generic="6fce5998340fde4e8415831bfdc92beac39a73a74a116639b02d7aa43bb09b102f324482a825d852ceb2c95221900657f462a122c448d124b3145784d491eed43c85ad787099794ca3dd1a83a84fd570438f5c", @nested={0x4, 0x32}]}]}, 0x80}], 0x3, &(0x7f0000001500)=[@rights={{0x30, 0x1, 0x1, [r1, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r3, r4, r5]}}, @rights={{0x2c, 0x1, 0x1, [r6, 0xffffffffffffffff, r7, r8, 0xffffffffffffffff, r9, r11]}}], 0x60, 0x20000000}, 0x4) r12 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0), 0x20001, 0x0) ioctl$RTC_WKALM_RD(r12, 0x80287010, &(0x7f0000000100)) kernel console output (not intermixed with test programs): : unknown main item tag 0x0 [ 85.260728][ T1519] 0 [ 85.265973][ T9] greenasia 0003:0E8F:0012.0006: unknown main item tag 0x0 [ 85.271005][ T1519] 0 [ 85.276269][ T9] greenasia 0003:0E8F:0012.0006: unknown main item tag 0x0 [ 85.282741][ T1519] 0 [ 85.288484][ T9] greenasia 0003:0E8F:0012.0006: unknown main item tag 0x0 [ 85.295195][ T1519] [ 85.299655][ T9] greenasia 0003:0E8F:0012.0006: unknown main item tag 0x0 [ 85.304089][ T1519] DMA32: [ 85.311072][ T9] greenasia 0003:0E8F:0012.0006: unknown main item tag 0x0 [ 85.316100][ T1519] 5*4kB [ 85.321006][ T310] usb 6-1: device descriptor read/64, error -71 [ 85.326717][ T1519] (M) [ 85.332904][ T9] greenasia 0003:0E8F:0012.0006: unknown main item tag 0x0 [ 85.339079][ T1519] 4*8kB [ 85.345170][ T9] greenasia 0003:0E8F:0012.0006: unknown main item tag 0x0 [ 85.348854][ T1519] (M) [ 85.353642][ T9] greenasia 0003:0E8F:0012.0006: unknown main item tag 0x0 [ 85.358961][ T1519] 4*16kB [ 85.363723][ T9] greenasia 0003:0E8F:0012.0006: unknown main item tag 0x0 [ 85.368641][ T1519] (M) [ 85.373465][ T9] greenasia 0003:0E8F:0012.0006: unknown main item tag 0x0 [ 85.378661][ T1519] 5*32kB [ 85.389264][ T9] greenasia 0003:0E8F:0012.0006: unknown main item tag 0x0 [ 85.395462][ T484] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 85.410076][ T9] greenasia 0003:0E8F:0012.0006: unknown main item tag 0x0 [ 85.415072][ T1519] (M) [ 85.420206][ T9] greenasia 0003:0E8F:0012.0006: unknown main item tag 0x0 [ 85.428800][ T1519] 3*64kB [ 85.432428][ T9] greenasia 0003:0E8F:0012.0006: unknown main item tag 0x0 [ 85.455051][ T1519] (M) [ 85.466655][ T9] greenasia 0003:0E8F:0012.0006: unknown main item tag 0x0 [ 85.473059][ T1519] 5*128kB [ 85.481747][ T9] greenasia 0003:0E8F:0012.0006: unknown main item tag 0x0 [ 85.492005][ T1519] (M) [ 85.504420][ T9] greenasia 0003:0E8F:0012.0006: hidraw0: USB HID v0.01 Device [HID 0e8f:0012] on usb-dummy_hcd.4-1/input0 [ 85.512352][ T1519] 5*256kB (M) [ 85.531073][ T9] greenasia 0003:0E8F:0012.0006: no inputs found [ 85.618155][ T484] usb 3-1: Using ep0 maxpacket: 16 [ 85.624602][ T310] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 85.669950][ T1519] 5*512kB [ 85.710909][ T9] usb 5-1: USB disconnect, device number 25 [ 85.716047][ T1519] (M) [ 85.818266][ T310] usb 6-1: device descriptor read/64, error -71 [ 85.821635][ T1519] 4*1024kB [ 85.950802][ T1530] netlink: 'syz.4.422': attribute type 3 has an invalid length. [ 85.957571][ T484] usb 3-1: config 0 has an invalid interface number: 34 but max is 0 [ 85.962981][ T1519] (UM) [ 85.967284][ T484] usb 3-1: config 0 has no interface number 0 [ 85.975234][ T1530] netlink: 944 bytes leftover after parsing attributes in process `syz.4.422'. [ 85.981704][ T484] usb 3-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 85.989457][ T1519] 4*2048kB [ 85.993105][ T484] usb 3-1: config 0 interface 34 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 85.995602][ T1519] (M) 718*4096kB [ 86.005601][ T484] usb 3-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 86.009130][ T1519] (M) [ 86.038122][ T484] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 86.040924][ T36] audit: type=1400 audit(1784729534.550:314): avc: denied { read } for pid=1529 comm="syz.4.422" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 86.065238][ T484] usb 3-1: Product: syz [ 86.069753][ T310] usb 6-1: device descriptor read/64, error -71 [ 86.073940][ T484] usb 3-1: Manufacturer: syz [ 86.119419][ T1519] = 2958164kB [ 86.137491][ T484] usb 3-1: SerialNumber: syz [ 86.145936][ T1519] Normal: 197*4kB (UME) 94*8kB (UME) 73*16kB (UME) 240*32kB (UME) 268*64kB (UME) 87*128kB (UME) 42*256kB (UM) 14*512kB (UME) 9*1024kB (UM) 11*2048kB (ME) 730*4096kB (UM) = 3078420kB [ 86.158653][ T484] usb 3-1: config 0 descriptor?? [ 86.165651][ T1519] 35690 total pagecache pages [ 86.171955][ T1527] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 86.178140][ T1519] 1 pages in swap cache [ 86.188397][ T484] asix 3-1:0.34: probe with driver asix failed with error -22 [ 86.190420][ T1519] Free swap = 124692kB [ 86.202738][ T310] usb usb6-port1: attempt power cycle [ 86.210077][ T1519] Total swap = 124996kB [ 86.214374][ T1519] 2097051 pages RAM [ 86.218246][ T1519] 0 pages HighMem/MovableOnly [ 86.222986][ T1519] 352235 pages reserved [ 86.227238][ T1519] 0 pages cma reserved [ 86.233733][ T1519] Memory allocations: [ 86.237769][ T1519] 0 B 0 init/main.c:1477 func:do_initcalls [ 86.245301][ T1519] 0 B 0 init/do_mounts.c:186 func:mount_root_generic [ 86.254016][ T1519] 0 B 0 init/do_mounts.c:158 func:do_mount_root [ 86.262348][ T1519] 0 B 0 init/do_mounts.c:352 func:mount_nodev_root [ 86.270483][ T1519] 0 B 0 init/do_mounts_rd.c:241 func:rd_load_image [ 86.278823][ T1519] 0 B 0 init/do_mounts_rd.c:72 func:identify_ramdisk_image [ 86.287663][ T1519] 0 B 0 init/initramfs.c:507 func:unpack_to_rootfs [ 86.295732][ T1519] 0 B 0 init/initramfs.c:508 func:unpack_to_rootfs [ 86.303736][ T1519] 0 B 0 init/initramfs.c:509 func:unpack_to_rootfs [ 86.311742][ T1519] 0 B 0 init/initramfs.c:101 func:find_link [ 86.368095][ T46] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 86.519371][ T46] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 86.529573][ T46] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 86.539549][ T46] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 86.548878][ T46] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 86.557418][ T46] usb 5-1: SerialNumber: syz [ 86.558172][ T310] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 86.589169][ T310] usb 6-1: device descriptor read/8, error -71 [ 86.598184][ T9] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 86.719170][ T310] usb 6-1: device descriptor read/8, error -71 [ 86.728200][ T9] usb 4-1: device descriptor read/64, error -71 [ 86.772482][ T46] usb 5-1: 0:2 : does not exist [ 86.779543][ T46] usb 5-1: USB disconnect, device number 26 [ 86.792138][ T338] udevd[338]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 86.958143][ T310] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 86.968214][ T9] usb 4-1: device descriptor read/64, error -71 [ 86.979365][ T310] usb 6-1: device descriptor read/8, error -71 [ 87.048542][ T1538] /dev/rnullb0: Can't open blockdev [ 87.083235][ T1542] Unsupported ieee802154 address type: 0 [ 87.089228][ T36] audit: type=1400 audit(1784729535.620:315): avc: denied { ioctl } for pid=1541 comm="syz.5.427" path="socket:[15227]" dev="sockfs" ino=15227 ioctlcmd=0x6e8d scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 87.128501][ T310] usb 6-1: device descriptor read/8, error -71 [ 87.153799][ T1547] can0: slcan on ptm0. [ 87.158654][ T36] audit: type=1400 audit(1784729535.690:316): avc: denied { read } for pid=149 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 87.190866][ T36] audit: type=1400 audit(1784729535.700:317): avc: denied { search } for pid=149 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 87.212573][ T9] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 87.220303][ T36] audit: type=1400 audit(1784729535.700:318): avc: denied { read } for pid=149 comm="dhcpcd" name="n15" dev="tmpfs" ino=3105 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 87.246071][ T1546] can0 (unregistered): slcan off ptm0. [ 87.251798][ T310] usb usb6-port1: unable to enumerate USB device [ 87.273327][ T36] audit: type=1400 audit(1784729535.700:319): avc: denied { open } for pid=149 comm="dhcpcd" path="/run/udev/data/n15" dev="tmpfs" ino=3105 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 87.335810][ T36] audit: type=1400 audit(1784729535.700:320): avc: denied { getattr } for pid=149 comm="dhcpcd" path="/run/udev/data/n15" dev="tmpfs" ino=3105 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 87.367688][ T36] audit: type=1400 audit(1784729535.780:321): avc: denied { read } for pid=1550 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=425 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 87.391257][ T9] usb 4-1: device descriptor read/64, error -71 [ 87.532695][ T1569] kvm: pic: non byte write [ 87.628088][ T9] usb 4-1: device descriptor read/64, error -71 [ 87.647443][ T1592] batadv_slave_1: entered promiscuous mode [ 87.654859][ T1591] batadv_slave_1: left promiscuous mode [ 87.738152][ T9] usb usb4-port1: attempt power cycle [ 87.766408][ T1594] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 87.832339][ T1597] netlink: 'syz.4.437': attribute type 13 has an invalid length. [ 87.848053][ T310] usb 6-1: new full-speed USB device number 14 using dummy_hcd [ 88.009981][ T310] usb 6-1: unable to get BOS descriptor or descriptor too short [ 88.018735][ T310] usb 6-1: not running at top speed; connect to a high speed hub [ 88.027691][ T310] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 127, changing to 4 [ 88.038801][ T310] usb 6-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 88.055244][ T310] usb 6-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 88.067486][ T310] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 88.080908][ T9] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 88.089685][ T310] usb 6-1: Product: syz [ 88.094557][ T310] usb 6-1: Manufacturer: syz [ 88.099458][ T310] usb 6-1: SerialNumber: syz [ 88.119131][ T9] usb 4-1: device descriptor read/8, error -71 [ 88.152294][ T484] usb 3-1: USB disconnect, device number 27 [ 88.249011][ T9] usb 4-1: device descriptor read/8, error -71 [ 88.498073][ T9] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 88.519085][ T9] usb 4-1: device descriptor read/8, error -71 [ 88.538039][ T484] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 88.629107][ T1606] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 88.657121][ T9] usb 4-1: device descriptor read/8, error -71 [ 88.689646][ T484] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 88.699915][ T484] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 88.709671][ T484] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 88.719369][ T484] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 88.728477][ T484] usb 3-1: SerialNumber: syz [ 88.748625][ T1609] netlink: 24 bytes leftover after parsing attributes in process `syz.4.442'. [ 88.768272][ T9] usb usb4-port1: unable to enumerate USB device [ 88.936457][ T484] usb 3-1: 0:2 : does not exist [ 88.936969][ T1616] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=35141 sclass=netlink_route_socket pid=1616 comm=syz.4.445 [ 88.957696][ T484] usb 3-1: USB disconnect, device number 28 [ 88.963134][ T1616] input: syz1 as /devices/virtual/input/input9 [ 88.977648][ T348] udevd[348]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 89.005291][ T1617] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 89.018556][ T36] kauditd_printk_skb: 15 callbacks suppressed [ 89.018571][ T36] audit: type=1400 audit(1784729537.530:337): avc: denied { read } for pid=95 comm="acpid" name="event3" dev="devtmpfs" ino=703 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 89.036992][ T1617] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 89.060775][ T36] audit: type=1400 audit(1784729537.530:338): avc: denied { open } for pid=95 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=703 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 89.248029][ T46] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 89.409918][ T46] usb 5-1: config 1 interface 0 altsetting 7 bulk endpoint 0x82 has invalid maxpacket 16 [ 89.419848][ T46] usb 5-1: config 1 interface 0 altsetting 7 bulk endpoint 0x3 has invalid maxpacket 16 [ 89.429672][ T46] usb 5-1: config 1 interface 0 altsetting 7 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 89.442777][ T46] usb 5-1: config 1 interface 0 has no altsetting 0 [ 89.451042][ T46] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 89.460205][ T46] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.468610][ T46] usb 5-1: Product: syz [ 89.473097][ T46] usb 5-1: SerialNumber: syz [ 89.479656][ T1618] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 89.492345][ T1618] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 89.704411][ T46] usb 5-1: bad CDC descriptors [ 89.712791][ T46] usb 5-1: USB disconnect, device number 27 [ 89.748029][ T9] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 89.778023][ T398] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 89.898011][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 89.904459][ T9] usb 3-1: config 0 has an invalid interface number: 34 but max is 0 [ 89.913782][ T9] usb 3-1: config 0 has no interface number 0 [ 89.920123][ T9] usb 3-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 89.930352][ T9] usb 3-1: config 0 interface 34 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 89.940583][ T9] usb 3-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 89.951878][ T398] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 89.964652][ T398] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 89.975103][ T398] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 89.984425][ T9] usb 3-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 89.993579][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 90.002187][ T398] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 90.010289][ T9] usb 3-1: Product: syz [ 90.014742][ T9] usb 3-1: Manufacturer: syz [ 90.020026][ T9] usb 3-1: SerialNumber: syz [ 90.024935][ T398] usb 4-1: config 0 descriptor?? [ 90.031210][ T9] usb 3-1: config 0 descriptor?? [ 90.036533][ T1623] raw-gadget.4 gadget.2: fail, usb_ep_enable returned -22 [ 90.046081][ T9] asix 3-1:0.34: probe with driver asix failed with error -22 [ 90.274159][ T36] audit: type=1400 audit(1784729538.800:339): avc: denied { ioctl } for pid=1626 comm="syz.4.449" path="socket:[17506]" dev="sockfs" ino=17506 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 90.508031][ T9] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 90.541154][ T310] usb 6-1: Audio class v2/v3 interfaces need an interface association [ 90.551933][ T310] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 90.564770][ T310] usb 6-1: USB disconnect, device number 14 [ 90.591227][ T36] audit: type=1326 audit(1784729539.120:340): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1628 comm="syz.5.450" exe="/root/ci2-android-6-12-rust/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7ff80519de99 code=0x0 [ 90.607261][ T1619] udevd[1619]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 90.658052][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 90.679138][ T9] usb 5-1: unable to get BOS descriptor or descriptor too short [ 90.687630][ T9] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 53, changing to 7 [ 90.719615][ T9] usb 5-1: New USB device found, idVendor=0e41, idProduct=4249, bcdDevice= 0.40 [ 90.732002][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 90.740147][ T9] usb 5-1: Product: syz [ 90.744408][ T9] usb 5-1: Manufacturer: syz [ 90.749194][ T9] usb 5-1: SerialNumber: syz [ 90.961993][ T9] usb 5-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 90.969450][ T9] usb 5-1: unit 5 not found! [ 90.980347][ T9] usb 5-1: USB disconnect, device number 28 [ 90.991743][ T1619] udevd[1619]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 91.276464][ T398] uclogic 0003:256C:006D.0007: failed retrieving Huion firmware version: -71 [ 91.285507][ T398] uclogic 0003:256C:006D.0007: failed probing parameters: -71 [ 91.293187][ T398] uclogic 0003:256C:006D.0007: probe with driver uclogic failed with error -71 [ 91.303858][ T398] usb 4-1: USB disconnect, device number 33 [ 91.489504][ T36] audit: type=1400 audit(1784729540.010:341): avc: denied { connect } for pid=1637 comm="syz.5.452" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 91.521766][ T1640] overlayfs: invalid redirect (./bus) [ 91.718068][ T398] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 91.818230][ T46] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 91.848029][ T398] usb 6-1: device descriptor read/64, error -71 [ 91.958076][ T46] usb 5-1: device descriptor read/64, error -71 [ 92.058087][ T310] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 92.088096][ T398] usb 6-1: device descriptor read/64, error -71 [ 92.198082][ T46] usb 5-1: device descriptor read/64, error -71 [ 92.209438][ T310] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 92.220155][ T310] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 92.231314][ T310] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 92.241465][ T310] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 92.250366][ T310] usb 4-1: SerialNumber: syz [ 92.338025][ T398] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 92.438048][ T46] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 92.458691][ T310] usb 4-1: 0:2 : does not exist [ 92.466427][ T310] usb 4-1: USB disconnect, device number 34 [ 92.477010][ T1619] udevd[1619]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 92.493112][ T398] usb 6-1: device descriptor read/64, error -71 [ 92.515182][ T9] usb 3-1: USB disconnect, device number 29 [ 92.568098][ T46] usb 5-1: device descriptor read/64, error -71 [ 92.585081][ T36] audit: type=1400 audit(1784729541.110:342): avc: denied { lock } for pid=1651 comm="syz.2.457" path="socket:[16823]" dev="sockfs" ino=16823 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 92.738055][ T398] usb 6-1: device descriptor read/64, error -71 [ 92.808052][ T46] usb 5-1: device descriptor read/64, error -71 [ 92.848161][ T398] usb usb6-port1: attempt power cycle [ 92.918158][ T46] usb usb5-port1: attempt power cycle [ 93.188047][ T398] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 93.209209][ T398] usb 6-1: device descriptor read/8, error -71 [ 93.218068][ T9] usb 4-1: new full-speed USB device number 35 using dummy_hcd [ 93.258059][ T46] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 93.279557][ T46] usb 5-1: device descriptor read/8, error -71 [ 93.339346][ T398] usb 6-1: device descriptor read/8, error -71 [ 93.369460][ T9] usb 4-1: config 0 has an invalid interface number: 41 but max is 0 [ 93.377577][ T9] usb 4-1: config 0 has no interface number 0 [ 93.383856][ T9] usb 4-1: config 0 interface 41 has no altsetting 0 [ 93.392686][ T9] usb 4-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 93.401846][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.409888][ T9] usb 4-1: Product: syz [ 93.414085][ T9] usb 4-1: Manufacturer: syz [ 93.418767][ T9] usb 4-1: SerialNumber: syz [ 93.420891][ T46] usb 5-1: device descriptor read/8, error -71 [ 93.428498][ T9] usb 4-1: config 0 descriptor?? [ 93.578081][ T398] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 93.599425][ T398] usb 6-1: device descriptor read/8, error -71 [ 93.668057][ T46] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 93.689138][ T46] usb 5-1: device descriptor read/8, error -71 [ 93.729580][ T398] usb 6-1: device descriptor read/8, error -71 [ 93.819251][ T46] usb 5-1: device descriptor read/8, error -71 [ 93.838113][ T398] usb usb6-port1: unable to enumerate USB device [ 93.928817][ T46] usb usb5-port1: unable to enumerate USB device [ 93.945993][ T1662] SELinux: policydb magic number 0x5 does not match expected magic number 0xf97cff8c [ 93.955839][ T1662] SELinux: failed to load policy [ 94.036871][ T9] CoreChips 4-1:0.41: probe with driver CoreChips failed with error -32 [ 94.503762][ T1671] tmpfs: Unknown parameter 'nXswap' [ 94.578226][ T1676] FAULT_INJECTION: forcing a failure. [ 94.578226][ T1676] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 94.608317][ T1676] CPU: 0 UID: 0 PID: 1676 Comm: syz.2.464 Not tainted syzkaller #0 e661c05697932dc72467e0ff9a1babb7f2c48647 [ 94.608353][ T1676] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 94.608368][ T1676] Call Trace: [ 94.608375][ T1676] [ 94.608384][ T1676] __dump_stack+0x21/0x30 [ 94.608421][ T1676] dump_stack_lvl+0x140/0x1c0 [ 94.608454][ T1676] ? __cfi_dump_stack_lvl+0x10/0x10 [ 94.608487][ T1676] ? check_stack_object+0x138/0x150 [ 94.608511][ T1676] dump_stack+0x19/0x20 [ 94.608541][ T1676] should_fail_ex+0x3c2/0x510 [ 94.608567][ T1676] should_fail+0xf/0x20 [ 94.608590][ T1676] should_fail_usercopy+0x1e/0x30 [ 94.608617][ T1676] _copy_to_user+0x24/0xa0 [ 94.608648][ T1676] simple_read_from_buffer+0xed/0x160 [ 94.608681][ T1676] proc_fail_nth_read+0x1aa/0x220 [ 94.608715][ T1676] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 94.608748][ T1676] ? bpf_lsm_file_permission+0xd/0x20 [ 94.608778][ T1676] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 94.608810][ T1676] vfs_read+0x28b/0xc70 [ 94.608834][ T1676] ? __cfi_vfs_read+0x10/0x10 [ 94.608856][ T1676] ? __kasan_check_write+0x18/0x20 [ 94.608880][ T1676] ? mutex_lock+0x97/0x1d0 [ 94.608910][ T1676] ? __cfi_mutex_lock+0x10/0x10 [ 94.608943][ T1676] ksys_read+0x145/0x260 [ 94.608967][ T1676] ? __cfi_ksys_read+0x10/0x10 [ 94.608990][ T1676] ? __kasan_check_read+0x15/0x20 [ 94.609013][ T1676] __x64_sys_read+0x7f/0x90 [ 94.609036][ T1676] x64_sys_call+0x2638/0x2ee0 [ 94.609056][ T1676] do_syscall_64+0x57/0xf0 [ 94.609081][ T1676] ? clear_bhb_loop+0x50/0xa0 [ 94.609112][ T1676] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 94.609140][ T1676] RIP: 0033:0x7fcba635e6ce [ 94.609167][ T1676] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 94.609187][ T1676] RSP: 002b:00007fcba7335fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 94.609213][ T1676] RAX: ffffffffffffffda RBX: 00007fcba73366c0 RCX: 00007fcba635e6ce [ 94.609231][ T1676] RDX: 000000000000000f RSI: 00007fcba73360a0 RDI: 0000000000000003 [ 94.609246][ T1676] RBP: 00007fcba7336090 R08: 0000000000000000 R09: 0000000000000000 [ 94.609260][ T1676] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 94.609275][ T1676] R13: 00007fcba6626038 R14: 00007fcba6625fa0 R15: 00007ffe23497648 [ 94.609295][ T1676] [ 95.118012][ T398] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 95.158043][ T46] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 95.278025][ T398] usb 3-1: Using ep0 maxpacket: 16 [ 95.284384][ T398] usb 3-1: config 0 has an invalid interface number: 34 but max is 0 [ 95.292596][ T398] usb 3-1: config 0 has no interface number 0 [ 95.298106][ T46] usb 5-1: device descriptor read/64, error -71 [ 95.299126][ T398] usb 3-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 95.315529][ T398] usb 3-1: config 0 interface 34 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 95.325452][ T398] usb 3-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 95.336981][ T398] usb 3-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 95.346092][ T398] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.354140][ T398] usb 3-1: Product: syz [ 95.358351][ T398] usb 3-1: Manufacturer: syz [ 95.363018][ T398] usb 3-1: SerialNumber: syz [ 95.368549][ T398] usb 3-1: config 0 descriptor?? [ 95.373849][ T1680] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 95.381840][ T398] asix 3-1:0.34: probe with driver asix failed with error -22 [ 95.389446][ T9] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 95.538064][ T46] usb 5-1: device descriptor read/64, error -71 [ 95.558032][ T9] usb 6-1: Using ep0 maxpacket: 8 [ 95.565327][ T9] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 95.575643][ T9] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 95.584571][ T9] usb 6-1: too many endpoints for config 1 interface 0 altsetting 9: 36, using maximum allowed: 30 [ 95.595859][ T9] usb 6-1: config 1 interface 0 altsetting 9 has 0 endpoint descriptors, different from the interface descriptor's value: 36 [ 95.609114][ T9] usb 6-1: config 1 interface 0 has no altsetting 0 [ 95.617262][ T9] usb 6-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 95.626665][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.635460][ T9] usb 6-1: Product: syz [ 95.640159][ T9] usb 6-1: Manufacturer: syz [ 95.645131][ T9] usb 6-1: SerialNumber: syz [ 95.788035][ T46] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 95.853778][ T9] usb 6-1: USB disconnect, device number 19 [ 95.918057][ T46] usb 5-1: device descriptor read/64, error -71 [ 96.048833][ T9] usb 4-1: USB disconnect, device number 35 [ 96.158076][ T46] usb 5-1: device descriptor read/64, error -71 [ 96.268203][ T46] usb usb5-port1: attempt power cycle [ 96.375916][ T1694] netlink: 132 bytes leftover after parsing attributes in process `syz.5.471'. [ 96.398096][ T9] usb 4-1: new full-speed USB device number 36 using dummy_hcd [ 96.569247][ T9] usb 4-1: config 0 has an invalid interface number: 231 but max is 0 [ 96.577910][ T9] usb 4-1: config 0 has no interface number 0 [ 96.584253][ T9] usb 4-1: config 0 interface 231 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 96.597019][ T9] usb 4-1: New USB device found, idVendor=067b, idProduct=27a1, bcdDevice=b0.9b [ 96.606215][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 96.614450][ T9] usb 4-1: Product: syz [ 96.618154][ T46] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 96.618894][ T9] usb 4-1: Manufacturer: syz [ 96.631201][ T9] usb 4-1: SerialNumber: syz [ 96.637420][ T9] usb 4-1: config 0 descriptor?? [ 96.643075][ T1691] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 96.652833][ T46] usb 5-1: device descriptor read/8, error -71 [ 96.659954][ T9] plusb 4-1:0.231 usb0: register 'plusb' at usb-dummy_hcd.3-1, Prolific PL-2301/PL-2302/PL-25A1/PL-27A1, 56:e9:37:7d:37:07 [ 96.738031][ T31] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 96.789180][ T46] usb 5-1: device descriptor read/8, error -71 [ 96.855479][ T780] usb 4-1: USB disconnect, device number 36 [ 96.863855][ T780] plusb 4-1:0.231 usb0: unregister 'plusb' usb-dummy_hcd.3-1, Prolific PL-2301/PL-2302/PL-25A1/PL-27A1 [ 96.878053][ T31] usb 6-1: device descriptor read/64, error -71 [ 97.028032][ T46] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 97.049194][ T46] usb 5-1: device descriptor read/8, error -71 [ 97.118050][ T31] usb 6-1: device descriptor read/64, error -71 [ 97.179472][ T46] usb 5-1: device descriptor read/8, error -71 [ 97.288207][ T46] usb usb5-port1: unable to enumerate USB device [ 97.358086][ T31] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 97.488116][ T31] usb 6-1: device descriptor read/64, error -71 [ 97.728000][ T31] usb 6-1: device descriptor read/64, error -71 [ 97.838198][ T31] usb usb6-port1: attempt power cycle [ 97.892329][ T398] usb 3-1: USB disconnect, device number 30 [ 97.902650][ T9] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 97.920485][ T1762] option changes via remount are deprecated (pid=1761 comm=syz.2.480) [ 97.929372][ T1762] cgroup: option or name mismatch, new: 0x0 "none", old: 0x0 "" [ 98.097814][ T1769] FAULT_INJECTION: forcing a failure. [ 98.097814][ T1769] name failslab, interval 1, probability 0, space 0, times 0 [ 98.111189][ T1769] CPU: 0 UID: 0 PID: 1769 Comm: syz.4.482 Not tainted syzkaller #0 e661c05697932dc72467e0ff9a1babb7f2c48647 [ 98.111226][ T1769] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 98.111241][ T1769] Call Trace: [ 98.111257][ T1769] [ 98.111263][ T1769] __dump_stack+0x21/0x30 [ 98.111290][ T1769] dump_stack_lvl+0x140/0x1c0 [ 98.111313][ T1769] ? __cfi_dump_stack_lvl+0x10/0x10 [ 98.111335][ T1769] ? genl_family_rcv_msg_doit+0x2a4/0x360 [ 98.111357][ T1769] dump_stack+0x19/0x20 [ 98.111379][ T1769] should_fail_ex+0x3c2/0x510 [ 98.111397][ T1769] should_failslab+0xac/0x100 [ 98.111417][ T1769] kmem_cache_alloc_node_noprof+0x45/0x420 [ 98.111435][ T1769] ? __alloc_skb+0x10c/0x360 [ 98.111458][ T1769] __alloc_skb+0x10c/0x360 [ 98.111479][ T1769] netlink_ack+0x155/0xa50 [ 98.111493][ T1769] ? __cfi_genl_rcv_msg+0x10/0x10 [ 98.111514][ T1769] netlink_rcv_skb+0x2cb/0x4e0 [ 98.111528][ T1769] ? __cfi_genl_rcv_msg+0x10/0x10 [ 98.111547][ T1769] ? __cfi_netlink_rcv_skb+0x10/0x10 [ 98.111564][ T1769] ? down_read+0x7f/0xe0 [ 98.111610][ T1769] ? __cfi_down_read+0x10/0x10 [ 98.111657][ T1769] genl_rcv+0x2c/0x40 [ 98.111675][ T1769] netlink_unicast+0x8bc/0xa70 [ 98.111700][ T1769] netlink_sendmsg+0x7d1/0xad0 [ 98.111717][ T1769] ? __cfi_netlink_sendmsg+0x10/0x10 [ 98.111733][ T1769] ? bpf_lsm_socket_sendmsg+0xd/0x20 [ 98.111756][ T1769] ? security_socket_sendmsg+0x3d/0x100 [ 98.111779][ T1769] ____sys_sendmsg+0x99e/0xa00 [ 98.111796][ T1769] ? __import_iovec+0x5b9/0x7d0 [ 98.111820][ T1769] ? __sys_sendmsg_sock+0x50/0x50 [ 98.111837][ T1769] ? import_iovec+0x80/0xb0 [ 98.111860][ T1769] ___sys_sendmsg+0x2a6/0x370 [ 98.111876][ T1769] ? __sys_sendmsg+0x2a0/0x2a0 [ 98.111892][ T1769] ? proc_fail_nth_write+0x184/0x220 [ 98.111916][ T1769] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 98.111944][ T1769] ? __fget_files+0x2bc/0x330 [ 98.111965][ T1769] __x64_sys_sendmsg+0x206/0x2e0 [ 98.111980][ T1769] ? fput+0x1a4/0x230 [ 98.112001][ T1769] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 98.112017][ T1769] ? ksys_write+0x1f3/0x260 [ 98.112035][ T1769] ? __kasan_check_read+0x15/0x20 [ 98.112052][ T1769] x64_sys_call+0x2a4c/0x2ee0 [ 98.112066][ T1769] do_syscall_64+0x57/0xf0 [ 98.112084][ T1769] ? clear_bhb_loop+0x50/0xa0 [ 98.112105][ T1769] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 98.112125][ T1769] RIP: 0033:0x7f9bbf39de99 [ 98.112139][ T1769] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 98.112153][ T1769] RSP: 002b:00007f9bbdde3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 98.112171][ T1769] RAX: ffffffffffffffda RBX: 00007f9bbf625fa0 RCX: 00007f9bbf39de99 [ 98.112183][ T1769] RDX: 0000000020020004 RSI: 0000200000000140 RDI: 0000000000000004 [ 98.112194][ T1769] RBP: 00007f9bbdde3090 R08: 0000000000000000 R09: 0000000000000000 [ 98.112204][ T1769] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 98.112214][ T1769] R13: 00007f9bbf626038 R14: 00007f9bbf625fa0 R15: 00007ffcf1d99508 [ 98.112227][ T1769] [ 98.268285][ T31] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 98.471593][ T31] usb 6-1: device descriptor read/8, error -71 [ 98.523625][ T1779] syzkaller1: entered promiscuous mode [ 98.529706][ T1779] syzkaller1: entered allmulticast mode [ 98.560974][ T1781] rust_binder: Failed to allocate buffer. len:136, is_oneway:true [ 98.592969][ T36] audit: type=1400 audit(1784729547.120:343): avc: denied { ioctl } for pid=1783 comm="syz.2.488" path="socket:[18219]" dev="sockfs" ino=18219 ioctlcmd=0xf509 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 98.635975][ T31] usb 6-1: device descriptor read/8, error -71 [ 98.878078][ T31] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 98.899545][ T31] usb 6-1: device descriptor read/8, error -71 [ 99.029178][ T31] usb 6-1: device descriptor read/8, error -71 [ 99.048053][ T398] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 99.088061][ T9] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 99.138133][ T31] usb usb6-port1: unable to enumerate USB device [ 99.199178][ T398] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 99.210348][ T398] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 99.220755][ T398] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 99.237149][ T398] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 99.249754][ T398] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 99.259559][ T398] usb 3-1: config 0 descriptor?? [ 99.269039][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 99.280166][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xB has an invalid bInterval 36, changing to 7 [ 99.292213][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xB has invalid maxpacket 18095, setting to 1024 [ 99.305567][ T9] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 99.315081][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 99.323234][ T9] usb 5-1: Product: syz [ 99.327444][ T9] usb 5-1: Manufacturer: syz [ 99.332188][ T9] usb 5-1: SerialNumber: syz [ 99.337706][ T9] usb 5-1: config 0 descriptor?? [ 99.344280][ T9] usb 5-1: 0:0 : invalid sync pipe. bmAttributes 39, bLength 9, bSynchAddress 24 [ 99.470204][ T398] plantronics 0003:047F:FFFF.0008: No inputs registered, leaving [ 99.484689][ T398] plantronics 0003:047F:FFFF.0008: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 99.521999][ T398] usb 3-1: USB disconnect, device number 31 [ 99.559312][ T9] usb 5-1: USB disconnect, device number 38 [ 99.594681][ T348] udevd[348]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 99.618072][ T1810] netlink: 88 bytes leftover after parsing attributes in process `syz.3.497'. [ 99.634489][ T36] audit: type=1400 audit(1784729548.160:344): avc: denied { getopt } for pid=1808 comm="syz.3.497" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 99.664378][ T1810] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 99.677077][ T1810] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 99.686515][ T36] audit: type=1400 audit(1784729548.200:345): avc: denied { append } for pid=1812 comm="syz.2.498" name="event2" dev="devtmpfs" ino=208 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 99.711571][ T36] audit: type=1400 audit(1784729548.240:346): avc: denied { cmd } for pid=1812 comm="syz.2.498" path="/newroot/dev/ublk-control" dev="devtmpfs" ino=82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=io_uring permissive=1 [ 99.736836][ T36] audit: type=1400 audit(1784729548.240:347): avc: denied { map } for pid=1812 comm="syz.2.498" path="/dev/ublkc0" dev="devtmpfs" ino=739 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 99.908056][ T31] usb 4-1: new low-speed USB device number 37 using dummy_hcd [ 100.038145][ T31] usb 4-1: device descriptor read/64, error -71 [ 100.109341][ T1837] overlayfs: failed to resolve './file0redirect_dir=follow': -2 [ 100.198218][ T9] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 100.278050][ T31] usb 4-1: device descriptor read/64, error -71 [ 100.338066][ T9] usb 3-1: device descriptor read/64, error -71 [ 100.458053][ T780] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 100.518015][ T31] usb 4-1: new low-speed USB device number 38 using dummy_hcd [ 100.578080][ T9] usb 3-1: device descriptor read/64, error -71 [ 100.618049][ T780] usb 5-1: Using ep0 maxpacket: 32 [ 100.625809][ T780] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 100.637954][ T780] usb 5-1: config 0 has no interfaces? [ 100.644386][ T780] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 100.653842][ T31] usb 4-1: device descriptor read/64, error -71 [ 100.661561][ T780] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 100.671947][ T780] usb 5-1: config 0 descriptor?? [ 100.748090][ T398] usb 6-1: new full-speed USB device number 24 using dummy_hcd [ 100.818714][ T9] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 100.882855][ T405] usb 5-1: USB disconnect, device number 39 [ 100.908112][ T31] usb 4-1: device descriptor read/64, error -71 [ 100.910109][ T398] usb 6-1: unable to get BOS descriptor or descriptor too short [ 100.922885][ T398] usb 6-1: not running at top speed; connect to a high speed hub [ 100.933143][ T398] usb 6-1: config 0 has an invalid interface number: 88 but max is 0 [ 100.942700][ T398] usb 6-1: config 0 has no interface number 0 [ 100.949807][ T398] usb 6-1: config 0 interface 88 altsetting 8 endpoint 0x86 has invalid maxpacket 10680, setting to 64 [ 100.962360][ T398] usb 6-1: config 0 interface 88 has no altsetting 0 [ 100.969257][ T9] usb 3-1: device descriptor read/64, error -71 [ 100.978499][ T398] usb 6-1: string descriptor 0 read error: -22 [ 100.984958][ T398] usb 6-1: New USB device found, idVendor=0460, idProduct=0004, bcdDevice=96.31 [ 100.995029][ T398] usb 6-1: New USB device strings: Mfr=1, Product=84, SerialNumber=3 [ 101.004283][ T398] usb 6-1: config 0 descriptor?? [ 101.010481][ T1849] raw-gadget.4 gadget.5: fail, usb_ep_enable returned -22 [ 101.018910][ T31] usb usb4-port1: attempt power cycle [ 101.025847][ T398] input: USB Acecad Flair Tablet 0460:0004 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.88/input/input10 [ 101.038894][ T36] audit: type=1400 audit(1784729549.570:348): avc: denied { ioctl } for pid=95 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=745 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 101.218129][ T9] usb 3-1: device descriptor read/64, error -71 [ 101.228580][ T780] usb 6-1: USB disconnect, device number 24 [ 101.328202][ T9] usb usb3-port1: attempt power cycle [ 101.358162][ T31] usb 4-1: new low-speed USB device number 39 using dummy_hcd [ 101.379237][ T31] usb 4-1: device descriptor read/8, error -71 [ 101.423951][ T1855] FAULT_INJECTION: forcing a failure. [ 101.423951][ T1855] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 101.437837][ T1855] CPU: 0 UID: 0 PID: 1855 Comm: syz.4.513 Not tainted syzkaller #0 e661c05697932dc72467e0ff9a1babb7f2c48647 [ 101.437871][ T1855] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 101.437884][ T1855] Call Trace: [ 101.437891][ T1855] [ 101.437899][ T1855] __dump_stack+0x21/0x30 [ 101.437937][ T1855] dump_stack_lvl+0x140/0x1c0 [ 101.437967][ T1855] ? __cfi_dump_stack_lvl+0x10/0x10 [ 101.438023][ T1855] ? check_stack_object+0x138/0x150 [ 101.438046][ T1855] dump_stack+0x19/0x20 [ 101.438073][ T1855] should_fail_ex+0x3c2/0x510 [ 101.438096][ T1855] should_fail+0xf/0x20 [ 101.438116][ T1855] should_fail_usercopy+0x1e/0x30 [ 101.438140][ T1855] _copy_to_user+0x24/0xa0 [ 101.438168][ T1855] simple_read_from_buffer+0xed/0x160 [ 101.438196][ T1855] proc_fail_nth_read+0x1aa/0x220 [ 101.438226][ T1855] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 101.438256][ T1855] ? bpf_lsm_file_permission+0xd/0x20 [ 101.438283][ T1855] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 101.438311][ T1855] vfs_read+0x28b/0xc70 [ 101.438332][ T1855] ? __cfi_vfs_read+0x10/0x10 [ 101.438351][ T1855] ? __kasan_check_write+0x18/0x20 [ 101.438371][ T1855] ? mutex_lock+0x97/0x1d0 [ 101.438398][ T1855] ? __cfi_mutex_lock+0x10/0x10 [ 101.438427][ T1855] ksys_read+0x145/0x260 [ 101.438446][ T1855] ? __cfi_ksys_read+0x10/0x10 [ 101.438466][ T1855] ? __kasan_check_write+0x18/0x20 [ 101.438485][ T1855] ? fput+0x1a4/0x230 [ 101.438511][ T1855] ? __kasan_check_read+0x15/0x20 [ 101.438531][ T1855] __x64_sys_read+0x7f/0x90 [ 101.438552][ T1855] x64_sys_call+0x2638/0x2ee0 [ 101.438570][ T1855] do_syscall_64+0x57/0xf0 [ 101.438593][ T1855] ? clear_bhb_loop+0x50/0xa0 [ 101.438620][ T1855] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 101.438646][ T1855] RIP: 0033:0x7f9bbf35e6ce [ 101.438663][ T1855] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 101.438682][ T1855] RSP: 002b:00007f9bbdde2fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 101.438706][ T1855] RAX: ffffffffffffffda RBX: 00007f9bbdde36c0 RCX: 00007f9bbf35e6ce [ 101.438722][ T1855] RDX: 000000000000000f RSI: 00007f9bbdde30a0 RDI: 0000000000000004 [ 101.438736][ T1855] RBP: 00007f9bbdde3090 R08: 0000000000000000 R09: 0000000000000000 [ 101.438750][ T1855] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 101.438763][ T1855] R13: 00007f9bbf626038 R14: 00007f9bbf625fa0 R15: 00007ffcf1d99508 [ 101.438780][ T1855] [ 101.609698][ T31] usb 4-1: device descriptor read/8, error -71 [ 101.678271][ T9] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 101.740729][ T9] usb 3-1: device descriptor read/8, error -71 [ 101.782740][ T1862] netlink: 'syz.5.516': attribute type 5 has an invalid length. [ 101.869142][ T9] usb 3-1: device descriptor read/8, error -71 [ 101.901502][ T1883] fuseblk: Bad value for 'fd' [ 101.918019][ T31] usb 4-1: new low-speed USB device number 40 using dummy_hcd [ 101.949243][ T31] usb 4-1: device descriptor read/8, error -71 [ 102.068093][ T46] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 102.079254][ T31] usb 4-1: device descriptor read/8, error -71 [ 102.108106][ T9] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 102.129363][ T9] usb 3-1: device descriptor read/8, error -71 [ 102.158033][ T398] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 102.188172][ T31] usb usb4-port1: unable to enumerate USB device [ 102.218049][ T46] usb 6-1: Using ep0 maxpacket: 16 [ 102.225741][ T46] usb 6-1: config 0 interface 0 has no altsetting 0 [ 102.232693][ T46] usb 6-1: New USB device found, idVendor=0419, idProduct=0600, bcdDevice= 0.00 [ 102.243624][ T46] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.253542][ T46] usb 6-1: config 0 descriptor?? [ 102.260413][ T9] usb 3-1: device descriptor read/8, error -71 [ 102.308012][ T398] usb 5-1: Using ep0 maxpacket: 16 [ 102.314876][ T398] usb 5-1: config 0 has an invalid interface number: 34 but max is 0 [ 102.323185][ T398] usb 5-1: config 0 has no interface number 0 [ 102.329365][ T398] usb 5-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 102.339430][ T398] usb 5-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 102.350908][ T398] usb 5-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 102.360142][ T398] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 102.368311][ T398] usb 5-1: Product: syz [ 102.372690][ T398] usb 5-1: Manufacturer: syz [ 102.377322][ T398] usb 5-1: SerialNumber: syz [ 102.382029][ T9] usb usb3-port1: unable to enumerate USB device [ 102.389897][ T398] usb 5-1: config 0 descriptor?? [ 102.395467][ T1885] raw-gadget.4 gadget.4: fail, usb_ep_enable returned -22 [ 102.403185][ T1885] raw-gadget.4 gadget.4: fail, usb_ep_enable returned -22 [ 102.612351][ T1885] raw-gadget.4 gadget.4: fail, usb_ep_enable returned -22 [ 102.620029][ T1885] raw-gadget.4 gadget.4: fail, usb_ep_enable returned -22 [ 102.668411][ T46] usbhid 6-1:0.0: can't add hid device: -71 [ 102.680036][ T46] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 102.694479][ T46] usb 6-1: USB disconnect, device number 25 [ 102.828276][ T398] asix 5-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 102.839694][ T1893] futex_wake_op: syz.3.527 tries to shift op by 32; fix this program [ 102.840139][ T398] asix 5-1:0.34: probe with driver asix failed with error -32 [ 103.185171][ T1910] virtio-fs: tag not found [ 103.212809][ T1910] syzkaller1: entered promiscuous mode [ 103.218854][ T1910] syzkaller1: entered allmulticast mode [ 103.358016][ T46] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 103.490555][ T1925] FAULT_INJECTION: forcing a failure. [ 103.490555][ T1925] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 103.505619][ T1925] CPU: 1 UID: 0 PID: 1925 Comm: syz.5.534 Not tainted syzkaller #0 e661c05697932dc72467e0ff9a1babb7f2c48647 [ 103.505663][ T1925] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 103.505679][ T1925] Call Trace: [ 103.505687][ T1925] [ 103.505696][ T1925] __dump_stack+0x21/0x30 [ 103.505734][ T1925] dump_stack_lvl+0x140/0x1c0 [ 103.505767][ T1925] ? __cfi_dump_stack_lvl+0x10/0x10 [ 103.505801][ T1925] dump_stack+0x19/0x20 [ 103.505832][ T1925] should_fail_ex+0x3c2/0x510 [ 103.505859][ T1925] should_fail_alloc_page+0xec/0x110 [ 103.505888][ T1925] __alloc_pages_noprof+0x1c0/0x7e0 [ 103.505917][ T1925] ? kernel_text_address+0xa9/0xe0 [ 103.505959][ T1925] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 103.505993][ T1925] ? unwind_get_return_address+0x51/0x90 [ 103.506023][ T1925] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 103.506054][ T1925] get_free_pages_noprof+0x14/0x40 [ 103.506087][ T1925] kasan_populate_vmalloc_pte+0x4c/0x170 [ 103.506113][ T1925] __apply_to_page_range+0x7c2/0xd00 [ 103.506142][ T1925] ? __cfi_kasan_populate_vmalloc_pte+0x10/0x10 [ 103.506167][ T1925] ? __x64_sys_ioctl+0x7f/0xa0 [ 103.506195][ T1925] ? apply_to_page_range+0x60/0x60 [ 103.506232][ T1925] ? __cfi_kasan_populate_vmalloc_pte+0x10/0x10 [ 103.506257][ T1925] apply_to_page_range+0x3f/0x60 [ 103.506283][ T1925] kasan_populate_vmalloc+0x64/0x80 [ 103.506307][ T1925] alloc_vmap_area+0x1e8e/0x26f0 [ 103.506344][ T1925] ? kasan_save_alloc_info+0x3a/0x50 [ 103.506379][ T1925] ? vm_map_ram+0xdd0/0xdd0 [ 103.506411][ T1925] ? __kmalloc_cache_node_noprof+0x225/0x430 [ 103.506436][ T1925] ? __get_vm_area_node+0x150/0x390 [ 103.506469][ T1925] ? __kasan_slab_alloc+0x73/0x90 [ 103.506498][ T1925] __get_vm_area_node+0x1f8/0x390 [ 103.506532][ T1925] __vmalloc_node_range_noprof+0x340/0x1300 [ 103.506567][ T1925] ? copy_process+0x57c/0x3350 [ 103.506601][ T1925] ? __cfi___vmalloc_node_range_noprof+0x10/0x10 [ 103.506637][ T1925] ? kasan_save_alloc_info+0x3a/0x50 [ 103.506672][ T1925] ? __kasan_slab_alloc+0x73/0x90 [ 103.506699][ T1925] ? arch_dup_task_struct+0x5b/0xe0 [ 103.506735][ T1925] ? __asan_memcpy+0x5a/0x80 [ 103.506758][ T1925] dup_task_struct+0x5d6/0xd80 [ 103.506786][ T1925] ? copy_process+0x57c/0x3350 [ 103.506815][ T1925] ? _raw_spin_lock_irq+0x93/0x120 [ 103.506841][ T1925] ? copy_process+0x3350/0x3350 [ 103.506869][ T1925] ? __kasan_check_write+0x18/0x20 [ 103.506893][ T1925] copy_process+0x57c/0x3350 [ 103.506925][ T1925] ? kasan_save_alloc_info+0x3a/0x50 [ 103.506958][ T1925] ? __cfi_copy_process+0x10/0x10 [ 103.506986][ T1925] ? __kmalloc_cache_noprof+0x23c/0x470 [ 103.507012][ T1925] ? __kasan_check_write+0x18/0x20 [ 103.507033][ T1925] ? __cfi_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 103.507062][ T1925] vhost_task_create+0x1f7/0x3f0 [ 103.507087][ T1925] ? __cfi_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 103.507116][ T1925] ? __cfi_vhost_task_create+0x10/0x10 [ 103.507142][ T1925] ? __cfi_vhost_task_fn+0x10/0x10 [ 103.507166][ T1925] ? __kasan_check_write+0x18/0x20 [ 103.507188][ T1925] ? mutex_lock+0x97/0x1d0 [ 103.507226][ T1925] ? __cfi_mutex_lock+0x10/0x10 [ 103.507255][ T1925] ? kernel_text_address+0xa9/0xe0 [ 103.507289][ T1925] kvm_mmu_post_init_vm+0x161/0x300 [ 103.507323][ T1925] kvm_arch_vcpu_ioctl_run+0xf3/0x1bc0 [ 103.507355][ T1925] ? _parse_integer_limit+0x195/0x1e0 [ 103.507379][ T1925] ? __cfi_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 103.507411][ T1925] ? kstrtoull+0x13b/0x1e0 [ 103.507432][ T1925] ? kstrtouint+0x78/0xf0 [ 103.507454][ T1925] ? ioctl_has_perm+0x1bc/0x500 [ 103.507475][ T1925] ? __asan_memcpy+0x5a/0x80 [ 103.507497][ T1925] ? ioctl_has_perm+0x408/0x500 [ 103.507518][ T1925] ? has_cap_mac_admin+0xd0/0xd0 [ 103.507539][ T1925] ? __kasan_check_write+0x18/0x20 [ 103.507561][ T1925] ? mutex_lock_killable+0x97/0x1d0 [ 103.507593][ T1925] ? __cfi_mutex_lock_killable+0x10/0x10 [ 103.507623][ T1925] ? proc_fail_nth_write+0x184/0x220 [ 103.507658][ T1925] kvm_vcpu_ioctl+0xa43/0x1000 [ 103.507682][ T1925] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 103.507705][ T1925] ? __cfi_vfs_write+0x10/0x10 [ 103.507731][ T1925] ? __kasan_check_write+0x18/0x20 [ 103.507754][ T1925] ? mutex_unlock+0x90/0x240 [ 103.507786][ T1925] ? __cfi_mutex_unlock+0x10/0x10 [ 103.507822][ T1925] ? bpf_lsm_file_ioctl+0xd/0x20 [ 103.507853][ T1925] ? security_file_ioctl+0x3e/0x110 [ 103.507890][ T1925] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 103.507912][ T1925] __se_sys_ioctl+0x132/0x1b0 [ 103.507941][ T1925] __x64_sys_ioctl+0x7f/0xa0 [ 103.507982][ T1925] x64_sys_call+0x1878/0x2ee0 [ 103.508004][ T1925] do_syscall_64+0x57/0xf0 [ 103.508026][ T1925] ? clear_bhb_loop+0x50/0xa0 [ 103.508063][ T1925] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 103.508092][ T1925] RIP: 0033:0x7ff80519de99 [ 103.508113][ T1925] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.508135][ T1925] RSP: 002b:00007ff806094028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 103.508161][ T1925] RAX: ffffffffffffffda RBX: 00007ff805425fa0 RCX: 00007ff80519de99 [ 103.508180][ T1925] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 103.508196][ T1925] RBP: 00007ff806094090 R08: 0000000000000000 R09: 0000000000000000 [ 103.508220][ T1925] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 103.508236][ T1925] R13: 00007ff805426038 R14: 00007ff805425fa0 R15: 00007fffd2d43008 [ 103.508259][ T1925] [ 104.046288][ T1925] syz.5.534: vmalloc error: size 32768, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz5,mems_allowed=0 [ 104.064274][ T1925] CPU: 0 UID: 0 PID: 1925 Comm: syz.5.534 Not tainted syzkaller #0 e661c05697932dc72467e0ff9a1babb7f2c48647 [ 104.064310][ T1925] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 104.064327][ T1925] Call Trace: [ 104.064335][ T1925] [ 104.064345][ T1925] __dump_stack+0x21/0x30 [ 104.064383][ T1925] dump_stack_lvl+0x140/0x1c0 [ 104.064416][ T1925] ? __cfi_dump_stack_lvl+0x10/0x10 [ 104.064450][ T1925] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 104.064479][ T1925] dump_stack+0x19/0x20 [ 104.064510][ T1925] warn_alloc+0x1e7/0x2c0 [ 104.064544][ T1925] ? __cfi_warn_alloc+0x10/0x10 [ 104.064576][ T1925] ? __get_vm_area_node+0x211/0x390 [ 104.064610][ T1925] ? __get_vm_area_node+0x211/0x390 [ 104.064645][ T1925] __vmalloc_node_range_noprof+0x365/0x1300 [ 104.064696][ T1925] ? __cfi___vmalloc_node_range_noprof+0x10/0x10 [ 104.064731][ T1925] ? kasan_save_alloc_info+0x3a/0x50 [ 104.064766][ T1925] ? __kasan_slab_alloc+0x73/0x90 [ 104.064794][ T1925] ? arch_dup_task_struct+0x5b/0xe0 [ 104.064829][ T1925] ? __asan_memcpy+0x5a/0x80 [ 104.064853][ T1925] dup_task_struct+0x5d6/0xd80 [ 104.064882][ T1925] ? copy_process+0x57c/0x3350 [ 104.064911][ T1925] ? _raw_spin_lock_irq+0x93/0x120 [ 104.064937][ T1925] ? copy_process+0x3350/0x3350 [ 104.064966][ T1925] ? __kasan_check_write+0x18/0x20 [ 104.064991][ T1925] copy_process+0x57c/0x3350 [ 104.065024][ T1925] ? kasan_save_alloc_info+0x3a/0x50 [ 104.065058][ T1925] ? __cfi_copy_process+0x10/0x10 [ 104.065087][ T1925] ? __kmalloc_cache_noprof+0x23c/0x470 [ 104.065113][ T1925] ? __kasan_check_write+0x18/0x20 [ 104.065136][ T1925] ? __cfi_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 104.065165][ T1925] vhost_task_create+0x1f7/0x3f0 [ 104.065191][ T1925] ? __cfi_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 104.065220][ T1925] ? __cfi_vhost_task_create+0x10/0x10 [ 104.065247][ T1925] ? __cfi_vhost_task_fn+0x10/0x10 [ 104.065271][ T1925] ? __kasan_check_write+0x18/0x20 [ 104.065293][ T1925] ? mutex_lock+0x97/0x1d0 [ 104.065324][ T1925] ? __cfi_mutex_lock+0x10/0x10 [ 104.065354][ T1925] ? kernel_text_address+0xa9/0xe0 [ 104.065403][ T1925] kvm_mmu_post_init_vm+0x161/0x300 [ 104.065438][ T1925] kvm_arch_vcpu_ioctl_run+0xf3/0x1bc0 [ 104.065471][ T1925] ? _parse_integer_limit+0x195/0x1e0 [ 104.065503][ T1925] ? __cfi_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 104.065536][ T1925] ? kstrtoull+0x13b/0x1e0 [ 104.065559][ T1925] ? kstrtouint+0x78/0xf0 [ 104.065583][ T1925] ? ioctl_has_perm+0x1bc/0x500 [ 104.065605][ T1925] ? __asan_memcpy+0x5a/0x80 [ 104.065628][ T1925] ? ioctl_has_perm+0x408/0x500 [ 104.065651][ T1925] ? has_cap_mac_admin+0xd0/0xd0 [ 104.065679][ T1925] ? __kasan_check_write+0x18/0x20 [ 104.065705][ T1925] ? mutex_lock_killable+0x97/0x1d0 [ 104.065728][ T1925] ? __cfi_mutex_lock_killable+0x10/0x10 [ 104.065751][ T1925] ? proc_fail_nth_write+0x184/0x220 [ 104.065777][ T1925] kvm_vcpu_ioctl+0xa43/0x1000 [ 104.065795][ T1925] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 104.065811][ T1925] ? __cfi_vfs_write+0x10/0x10 [ 104.065853][ T1925] ? __kasan_check_write+0x18/0x20 [ 104.065876][ T1925] ? mutex_unlock+0x90/0x240 [ 104.065907][ T1925] ? __cfi_mutex_unlock+0x10/0x10 [ 104.065943][ T1925] ? bpf_lsm_file_ioctl+0xd/0x20 [ 104.065964][ T1925] ? security_file_ioctl+0x3e/0x110 [ 104.065989][ T1925] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 104.066004][ T1925] __se_sys_ioctl+0x132/0x1b0 [ 104.066025][ T1925] __x64_sys_ioctl+0x7f/0xa0 [ 104.066045][ T1925] x64_sys_call+0x1878/0x2ee0 [ 104.066060][ T1925] do_syscall_64+0x57/0xf0 [ 104.066078][ T1925] ? clear_bhb_loop+0x50/0xa0 [ 104.066101][ T1925] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 104.066122][ T1925] RIP: 0033:0x7ff80519de99 [ 104.066136][ T1925] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 104.066151][ T1925] RSP: 002b:00007ff806094028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 104.066170][ T1925] RAX: ffffffffffffffda RBX: 00007ff805425fa0 RCX: 00007ff80519de99 [ 104.066184][ T1925] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 104.066195][ T1925] RBP: 00007ff806094090 R08: 0000000000000000 R09: 0000000000000000 [ 104.066206][ T1925] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 104.066216][ T1925] R13: 00007ff805426038 R14: 00007ff805425fa0 R15: 00007fffd2d43008 [ 104.066231][ T1925] [ 104.066544][ T1925] Mem-Info: [ 104.070373][ T46] usb 3-1: unable to get BOS descriptor or descriptor too short [ 104.079766][ T1925] active_anon:23720 inactive_anon:875 isolated_anon:0 [ 104.079766][ T1925] active_file:17781 inactive_file:2320 isolated_file:0 [ 104.079766][ T1925] unevictable:0 dirty:30 writeback:0 [ 104.079766][ T1925] slab_reclaimable:4855 slab_unreclaimable:73107 [ 104.079766][ T1925] mapped:25307 shmem:15632 pagetables:1071 [ 104.079766][ T1925] sec_pagetables:0 bounce:0 [ 104.079766][ T1925] kernel_misc_reclaimable:0 [ 104.079766][ T1925] free:1505623 free_pcp:2489 free_cma:0 [ 104.092417][ T46] usb 3-1: New USB device found, idVendor=2a39, idProduct=3fa0, bcdDevice= 0.40 [ 104.097338][ T1925] Node 0 active_anon:94880kB inactive_anon:3500kB active_file:71124kB inactive_file:9280kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:101228kB dirty:120kB writeback:0kB shmem:62528kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:6660kB pagetables:4284kB sec_pagetables:0kB all_unreclaimable? no [ 104.109442][ T46] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 104.114102][ T1925] DMA32 free:2958164kB boost:0kB min:19080kB low:23848kB high:28616kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3145324kB managed:2963400kB mlocked:0kB bounce:0kB free_pcp:5236kB local_pcp:5236kB free_cma:0kB [ 104.116237][ T46] usb 3-1: Product: syz [ 104.155381][ T1925] lowmem_reserve[]: [ 104.157647][ T46] usb 3-1: Manufacturer: syz [ 104.183352][ T1925] 0 [ 104.187722][ T46] usb 3-1: SerialNumber: syz [ 104.209453][ T1925] 3921 [ 104.611037][ T46] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 104.628208][ T1925] 3921 [ 104.651222][ T31] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 104.655601][ T1925] [ 104.665826][ T46] usb 3-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 104.669463][ T1925] Normal free:3061960kB boost:0kB min:25972kB low:32464kB high:38956kB reserved_highatomic:0KB free_highatomic:0KB active_anon:94824kB inactive_anon:3504kB active_file:71124kB inactive_file:9280kB unevictable:0kB writepending:124kB present:5242880kB managed:4015864kB mlocked:0kB bounce:0kB free_pcp:6680kB local_pcp:1856kB free_cma:0kB [ 104.696506][ T46] usb 3-1: USB disconnect, device number 36 [ 104.705465][ T1925] lowmem_reserve[]: 0 0 0 [ 104.751757][ T1925] DMA32: 5*4kB (M) 4*8kB (M) 4*16kB (M) 5*32kB (M) 3*64kB (M) 5*128kB (M) 5*256kB (M) 5*512kB (M) 4*1024kB (UM) 4*2048kB (M) 718*4096kB (M) = 2958164kB [ 104.772536][ T1925] Normal: 1136*4kB (U) 349*8kB (UM) 140*16kB (UE) 72*32kB (UE) 61*64kB (UME) 46*128kB (UME) 44*256kB (UM) 19*512kB (UME) 8*1024kB (UM) 10*2048kB (ME) 730*4096kB (UM) = 3061416kB [ 104.788827][ T1619] udevd[1619]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 104.806433][ T1925] 36606 total pagecache pages [ 104.812926][ T1925] 877 pages in swap cache [ 104.817365][ T1925] Free swap = 121356kB [ 104.822284][ T1925] Total swap = 124996kB [ 104.826981][ T1925] 2097051 pages RAM [ 104.830894][ T1925] 0 pages HighMem/MovableOnly [ 104.835895][ T1925] 352235 pages reserved [ 104.840144][ T1925] 0 pages cma reserved [ 104.845686][ T31] usb 4-1: unable to get BOS descriptor or descriptor too short [ 104.849444][ T1925] Memory allocations: [ 104.853724][ T31] usb 4-1: too many configurations: 173, using maximum allowed: 8 [ 104.857659][ T1925] 0 B 0 init/main.c:1477 func:do_initcalls [ 104.872585][ T1925] 0 B 0 init/do_mounts.c:186 func:mount_root_generic [ 104.879445][ T31] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 104.881649][ T1925] 0 B 0 init/do_mounts.c:158 func:do_mount_root [ 104.899103][ T1925] 0 B 0 init/do_mounts.c:352 func:mount_nodev_root [ 104.907168][ T1925] 0 B 0 init/do_mounts_rd.c:241 func:rd_load_image [ 104.915530][ T1925] 0 B 0 init/do_mounts_rd.c:72 func:identify_ramdisk_image [ 104.916742][ T31] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 104.925922][ T1925] 0 B 0 init/initramfs.c:507 func:unpack_to_rootfs [ 104.944905][ T1925] 0 B 0 init/initramfs.c:508 func:unpack_to_rootfs [ 104.954293][ T1925] 0 B 0 init/initramfs.c:509 func:unpack_to_rootfs [ 104.964404][ T31] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 104.974522][ T1925] 0 B 0 init/initramfs.c:101 func:find_link [ 104.980328][ T46] usb 5-1: USB disconnect, device number 40 [ 105.017356][ T31] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 105.033699][ T31] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 105.045944][ T31] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 105.058276][ T31] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 105.071034][ T31] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 105.082973][ T31] usb 4-1: New USB device found, idVendor=09e8, idProduct=c703, bcdDevice=b3.01 [ 105.092535][ T31] usb 4-1: New USB device strings: Mfr=239, Product=52, SerialNumber=226 [ 105.101114][ T31] usb 4-1: Product: syz [ 105.105479][ T31] usb 4-1: Manufacturer: syz [ 105.110262][ T31] usb 4-1: SerialNumber: syz [ 105.245186][ T36] audit: type=1400 audit(1784729553.770:349): avc: denied { read } for pid=1943 comm="syz.2.539" path="socket:[20157]" dev="sockfs" ino=20157 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 105.328374][ T31] usb 4-1: USB disconnect, device number 41 [ 105.368039][ T9] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 105.518004][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 105.528760][ T9] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 105.547990][ T9] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 105.557101][ T9] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 105.566228][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.578246][ T9] usb 6-1: config 0 descriptor?? [ 105.786500][ T31] usb 6-1: USB disconnect, device number 26 [ 106.198015][ T9] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 106.358433][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 106.365648][ T9] usb 5-1: config 0 has an invalid interface number: 34 but max is 0 [ 106.373881][ T9] usb 5-1: config 0 has no interface number 0 [ 106.380456][ T9] usb 5-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 106.390756][ T9] usb 5-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 106.419235][ T9] usb 5-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 106.448027][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.456454][ T9] usb 5-1: Product: syz [ 106.477981][ T9] usb 5-1: Manufacturer: syz [ 106.482656][ T9] usb 5-1: SerialNumber: syz [ 106.494718][ T9] usb 5-1: config 0 descriptor?? [ 106.508360][ T1974] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 106.531088][ T1974] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 106.727700][ T1981] SELinux: failed to load policy [ 106.754292][ T1974] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 106.771231][ T1974] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 107.002242][ T9] asix 5-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 107.019159][ T9] asix 5-1:0.34: probe with driver asix failed with error -32 [ 108.198005][ T9] usb 6-1: new low-speed USB device number 27 using dummy_hcd [ 108.370186][ T9] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 108.379114][ T36] audit: type=1326 audit(1784729556.900:350): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2013 comm="syz.3.557" exe="/root/ci2-android-6-12-rust/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5036b9de99 code=0x0 [ 108.389339][ T9] usb 6-1: config 1 interface 0 altsetting 15 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 108.422430][ T9] usb 6-1: config 1 interface 0 has no altsetting 0 [ 108.431061][ T9] usb 6-1: string descriptor 0 read error: -22 [ 108.437271][ T9] usb 6-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 108.446446][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 108.659559][ T9] usb 6-1: USB disconnect, device number 27 [ 108.841206][ T36] audit: type=1400 audit(1784729557.370:351): avc: denied { connect } for pid=2018 comm="syz.2.558" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 108.862494][ T36] audit: type=1400 audit(1784729557.370:352): avc: denied { write } for pid=2018 comm="syz.2.558" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 108.974951][ T9] usb 5-1: USB disconnect, device number 41 [ 109.118044][ T46] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 109.268075][ T46] usb 6-1: Using ep0 maxpacket: 8 [ 109.274504][ T46] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 109.284785][ T46] usb 6-1: config 1 interface 0 altsetting 15 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 109.297876][ T46] usb 6-1: config 1 interface 0 has no altsetting 0 [ 109.306683][ T46] usb 6-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 109.308257][ T398] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 109.316303][ T46] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 109.331753][ T46] usb 6-1: Product: syz [ 109.335949][ T46] usb 6-1: Manufacturer: syz [ 109.340872][ T46] usb 6-1: SerialNumber: syz [ 109.469538][ T398] usb 3-1: unable to get BOS descriptor or descriptor too short [ 109.478131][ T398] usb 3-1: config 1 interface 2 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 109.494465][ T398] usb 3-1: string descriptor 0 read error: -22 [ 109.501041][ T398] usb 3-1: New USB device found, idVendor=200c, idProduct=100b, bcdDevice= 0.40 [ 109.510499][ T398] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 109.518826][ T405] usb 4-1: new full-speed USB device number 42 using dummy_hcd [ 109.550459][ T46] usb 6-1: USB disconnect, device number 28 [ 109.649033][ T9] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 109.658019][ T405] usb 4-1: device descriptor read/64, error -71 [ 109.778114][ T9] usb 5-1: device descriptor read/64, error -71 [ 109.898081][ T405] usb 4-1: device descriptor read/64, error -71 [ 110.028044][ T9] usb 5-1: device descriptor read/64, error -71 [ 110.131756][ T398] usb 3-1: 1:1: cannot get freq at ep 0x1 [ 110.138104][ T405] usb 4-1: new full-speed USB device number 43 using dummy_hcd [ 110.160539][ T398] usb 3-1: USB disconnect, device number 37 [ 110.268066][ T9] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 110.288089][ T405] usb 4-1: device descriptor read/64, error -71 [ 110.368048][ T46] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 110.398111][ T9] usb 5-1: device descriptor read/64, error -71 [ 110.518095][ T46] usb 6-1: Using ep0 maxpacket: 16 [ 110.524325][ T46] usb 6-1: config 0 has an invalid interface number: 34 but max is 0 [ 110.528389][ T405] usb 4-1: device descriptor read/64, error -71 [ 110.533304][ T46] usb 6-1: config 0 has no interface number 0 [ 110.544966][ T46] usb 6-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 110.555070][ T46] usb 6-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 110.566653][ T46] usb 6-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 110.575897][ T46] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 110.584077][ T46] usb 6-1: Product: syz [ 110.588290][ T46] usb 6-1: Manufacturer: syz [ 110.592902][ T46] usb 6-1: SerialNumber: syz [ 110.598449][ T46] usb 6-1: config 0 descriptor?? [ 110.603894][ T2048] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 110.611573][ T2048] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 110.648064][ T9] usb 5-1: device descriptor read/64, error -71 [ 110.654582][ T405] usb usb4-port1: attempt power cycle [ 110.768204][ T9] usb usb5-port1: attempt power cycle [ 110.820452][ T2048] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 110.827692][ T2048] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 110.829627][ T36] audit: type=1400 audit(1784729559.360:353): avc: denied { accept } for pid=2049 comm="syz.2.569" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 110.855696][ T36] audit: type=1400 audit(1784729559.360:354): avc: denied { map } for pid=2049 comm="syz.2.569" path="socket:[20661]" dev="sockfs" ino=20661 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 110.878787][ T36] audit: type=1400 audit(1784729559.360:355): avc: denied { read } for pid=2049 comm="syz.2.569" path="socket:[20661]" dev="sockfs" ino=20661 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 110.998092][ T405] usb 4-1: new full-speed USB device number 44 using dummy_hcd [ 111.019148][ T405] usb 4-1: device descriptor read/8, error -71 [ 111.056132][ T46] asix 6-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 111.066986][ T46] asix 6-1:0.34: probe with driver asix failed with error -32 [ 111.118054][ T9] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 111.139238][ T9] usb 5-1: device descriptor read/8, error -71 [ 111.149156][ T405] usb 4-1: device descriptor read/8, error -71 [ 111.269312][ T9] usb 5-1: device descriptor read/8, error -71 [ 111.388031][ T405] usb 4-1: new full-speed USB device number 45 using dummy_hcd [ 111.409226][ T405] usb 4-1: device descriptor read/8, error -71 [ 111.508085][ T9] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 111.529485][ T9] usb 5-1: device descriptor read/8, error -71 [ 111.540628][ T405] usb 4-1: device descriptor read/8, error -71 [ 111.658349][ T405] usb usb4-port1: unable to enumerate USB device [ 111.665877][ T9] usb 5-1: device descriptor read/8, error -71 [ 111.778144][ T9] usb usb5-port1: unable to enumerate USB device [ 112.221475][ T36] audit: type=1400 audit(1784729560.750:356): avc: denied { getopt } for pid=2062 comm="syz.4.572" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 112.298890][ T2065] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 112.451672][ T2071] /dev/rnullb0: Can't open blockdev [ 112.627994][ T405] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 112.767989][ T405] usb 5-1: device descriptor read/64, error -71 [ 112.818138][ T46] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 112.969794][ T46] usb 3-1: unable to get BOS descriptor or descriptor too short [ 112.971333][ T2088] netlink: 'syz.3.582': attribute type 4 has an invalid length. [ 112.978205][ T46] usb 3-1: too many configurations: 173, using maximum allowed: 8 [ 112.998719][ T46] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 113.009993][ T46] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 113.024745][ T46] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 113.028139][ T405] usb 5-1: device descriptor read/64, error -71 [ 113.035263][ T46] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 113.054814][ T46] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 113.064977][ T46] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 113.079373][ T46] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 113.089631][ T46] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 113.103292][ T46] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 113.113534][ T46] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 113.127847][ T46] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 113.146626][ T46] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 113.159796][ T780] usb 6-1: USB disconnect, device number 29 [ 113.167596][ T46] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 113.178515][ T46] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 113.194524][ T46] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 113.204971][ T46] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 113.219838][ T46] usb 3-1: New USB device found, idVendor=09e8, idProduct=c703, bcdDevice=b3.01 [ 113.229011][ T46] usb 3-1: New USB device strings: Mfr=239, Product=52, SerialNumber=226 [ 113.237485][ T46] usb 3-1: Product: syz [ 113.241743][ T46] usb 3-1: Manufacturer: syz [ 113.246380][ T46] usb 3-1: SerialNumber: syz [ 113.248159][ T9] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 113.288037][ T405] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 113.364048][ T2096] syz.5.586: attempt to access beyond end of device [ 113.364048][ T2096] loop5: rw=0, sector=0, nr_sectors = 1 limit=0 [ 113.378011][ T2096] exFAT-fs (loop5): unable to read boot sector [ 113.384295][ T2096] exFAT-fs (loop5): failed to read boot sector [ 113.388379][ T9] usb 4-1: device descriptor read/64, error -71 [ 113.394584][ T2096] exFAT-fs (loop5): failed to recognize exfat type [ 113.418085][ T405] usb 5-1: device descriptor read/64, error -71 [ 113.471355][ T46] usb 3-1: MIDIStreaming interface descriptor not found [ 113.483726][ T46] usb 3-1: USB disconnect, device number 38 [ 113.628049][ T9] usb 4-1: device descriptor read/64, error -71 [ 113.668103][ T405] usb 5-1: device descriptor read/64, error -71 [ 113.768225][ T398] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 113.778137][ T405] usb usb5-port1: attempt power cycle [ 113.868065][ T9] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 113.919506][ T398] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 113.929817][ T398] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 18 [ 113.943772][ T398] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 113.953011][ T398] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 113.961567][ T398] usb 6-1: SerialNumber: syz [ 113.969731][ T398] usb 6-1: bad CDC descriptors [ 113.993103][ T36] audit: type=1400 audit(1784729562.520:357): avc: denied { write } for pid=2100 comm="syz.2.588" name="pfkey" dev="proc" ino=4026532541 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 114.020907][ T9] usb 4-1: device descriptor read/64, error -71 [ 114.118020][ T405] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 114.170794][ T405] usb 5-1: device descriptor read/8, error -71 [ 114.176388][ T2099] netlink: 8 bytes leftover after parsing attributes in process `syz.5.587'. [ 114.191215][ T31] usb 6-1: USB disconnect, device number 30 [ 114.268072][ T9] usb 4-1: device descriptor read/64, error -71 [ 114.309631][ T405] usb 5-1: device descriptor read/8, error -71 [ 114.378217][ T9] usb usb4-port1: attempt power cycle [ 114.408009][ T46] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 114.558058][ T46] usb 3-1: Using ep0 maxpacket: 8 [ 114.565058][ T46] usb 3-1: unable to get BOS descriptor or descriptor too short [ 114.577933][ T46] usb 3-1: string descriptor 0 read error: -22 [ 114.578043][ T405] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 114.585663][ T46] usb 3-1: New USB device found, idVendor=17cc, idProduct=4712, bcdDevice= 0.40 [ 114.604411][ T46] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 114.615837][ T46] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 114.619646][ T405] usb 5-1: device descriptor read/8, error -71 [ 114.718677][ T9] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 114.740500][ T9] usb 4-1: device descriptor read/8, error -71 [ 114.759184][ T405] usb 5-1: device descriptor read/8, error -71 [ 114.815629][ T46] usb 3-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 114.829578][ T1619] udevd[1619]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 114.833277][ T46] usb 3-1: USB disconnect, device number 39 [ 114.868153][ T405] usb usb5-port1: unable to enumerate USB device [ 114.875780][ T9] usb 4-1: device descriptor read/8, error -71 [ 114.988064][ T398] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 115.118012][ T9] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 115.138242][ T398] usb 6-1: Using ep0 maxpacket: 16 [ 115.144752][ T398] usb 6-1: config 0 has an invalid interface number: 34 but max is 0 [ 115.153044][ T9] usb 4-1: device descriptor read/8, error -71 [ 115.159318][ T398] usb 6-1: config 0 has no interface number 0 [ 115.165411][ T398] usb 6-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 115.175507][ T398] usb 6-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 115.187215][ T398] usb 6-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 115.196921][ T398] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 115.205060][ T398] usb 6-1: Product: syz [ 115.209300][ T398] usb 6-1: Manufacturer: syz [ 115.213928][ T398] usb 6-1: SerialNumber: syz [ 115.219287][ T398] usb 6-1: config 0 descriptor?? [ 115.224587][ T2109] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 115.232180][ T2109] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 115.299349][ T9] usb 4-1: device descriptor read/8, error -71 [ 115.373336][ T2115] FAULT_INJECTION: forcing a failure. [ 115.373336][ T2115] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 115.387347][ T2115] CPU: 0 UID: 0 PID: 2115 Comm: syz.2.594 Not tainted syzkaller #0 e661c05697932dc72467e0ff9a1babb7f2c48647 [ 115.387384][ T2115] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 115.387398][ T2115] Call Trace: [ 115.387406][ T2115] [ 115.387416][ T2115] __dump_stack+0x21/0x30 [ 115.387454][ T2115] dump_stack_lvl+0x140/0x1c0 [ 115.387485][ T2115] ? __cfi_dump_stack_lvl+0x10/0x10 [ 115.387515][ T2115] ? check_stack_object+0x138/0x150 [ 115.387539][ T2115] dump_stack+0x19/0x20 [ 115.387568][ T2115] should_fail_ex+0x3c2/0x510 [ 115.387594][ T2115] should_fail+0xf/0x20 [ 115.387616][ T2115] should_fail_usercopy+0x1e/0x30 [ 115.387641][ T2115] _copy_to_user+0x24/0xa0 [ 115.387679][ T2115] simple_read_from_buffer+0xed/0x160 [ 115.387711][ T2115] proc_fail_nth_read+0x1aa/0x220 [ 115.387745][ T2115] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 115.387779][ T2115] ? bpf_lsm_file_permission+0xd/0x20 [ 115.387809][ T2115] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 115.387842][ T2115] vfs_read+0x28b/0xc70 [ 115.387868][ T2115] ? __cfi_vfs_read+0x10/0x10 [ 115.387890][ T2115] ? __kasan_check_write+0x18/0x20 [ 115.387914][ T2115] ? mutex_lock+0x97/0x1d0 [ 115.387945][ T2115] ? __cfi_mutex_lock+0x10/0x10 [ 115.387978][ T2115] ksys_read+0x145/0x260 [ 115.388001][ T2115] ? __fget_files+0x2bc/0x330 [ 115.388052][ T2115] ? __cfi_ksys_read+0x10/0x10 [ 115.388077][ T2115] ? __kasan_check_write+0x18/0x20 [ 115.388101][ T2115] ? __kasan_check_read+0x15/0x20 [ 115.388125][ T2115] __x64_sys_read+0x7f/0x90 [ 115.388149][ T2115] x64_sys_call+0x2638/0x2ee0 [ 115.388172][ T2115] do_syscall_64+0x57/0xf0 [ 115.388198][ T2115] ? clear_bhb_loop+0x50/0xa0 [ 115.388229][ T2115] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 115.388259][ T2115] RIP: 0033:0x7fcba635e6ce [ 115.388280][ T2115] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 115.388302][ T2115] RSP: 002b:00007fcba7335fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 115.388329][ T2115] RAX: ffffffffffffffda RBX: 00007fcba73366c0 RCX: 00007fcba635e6ce [ 115.388349][ T2115] RDX: 000000000000000f RSI: 00007fcba73360a0 RDI: 0000000000000003 [ 115.388365][ T2115] RBP: 00007fcba7336090 R08: 0000000000000000 R09: 0000000000000000 [ 115.388381][ T2115] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 115.388396][ T2115] R13: 00007fcba6626038 R14: 00007fcba6625fa0 R15: 00007ffe23497648 [ 115.388417][ T2115] [ 115.443414][ T2109] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 115.446409][ T9] usb usb4-port1: unable to enumerate USB device [ 115.458187][ T2109] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 115.707960][ T36] audit: type=1400 audit(1784729564.230:358): avc: denied { name_bind } for pid=2128 comm="syz.4.599" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 115.729500][ T36] audit: type=1400 audit(1784729564.240:359): avc: denied { node_bind } for pid=2128 comm="syz.4.599" saddr=fc01:: src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 115.757654][ T36] audit: type=1400 audit(1784729564.240:360): avc: denied { read } for pid=2128 comm="syz.4.599" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 115.784901][ T36] audit: type=1400 audit(1784729564.260:361): avc: denied { setattr } for pid=2125 comm="syz.2.597" name="/" dev="incremental-fs" ino=899 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 115.812610][ T398] asix 6-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 115.823420][ T398] asix 6-1:0.34: probe with driver asix failed with error -32 [ 115.997030][ T2146] FAULT_INJECTION: forcing a failure. [ 115.997030][ T2146] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 116.011437][ T2146] CPU: 0 UID: 0 PID: 2146 Comm: syz.3.607 Not tainted syzkaller #0 e661c05697932dc72467e0ff9a1babb7f2c48647 [ 116.011478][ T2146] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 116.011494][ T2146] Call Trace: [ 116.011503][ T2146] [ 116.011513][ T2146] __dump_stack+0x21/0x30 [ 116.011551][ T2146] dump_stack_lvl+0x140/0x1c0 [ 116.011585][ T2146] ? __cfi_dump_stack_lvl+0x10/0x10 [ 116.011627][ T2146] ? check_stack_object+0x138/0x150 [ 116.011653][ T2146] dump_stack+0x19/0x20 [ 116.011684][ T2146] should_fail_ex+0x3c2/0x510 [ 116.011713][ T2146] should_fail+0xf/0x20 [ 116.011737][ T2146] should_fail_usercopy+0x1e/0x30 [ 116.011766][ T2146] _copy_to_user+0x24/0xa0 [ 116.011798][ T2146] simple_read_from_buffer+0xed/0x160 [ 116.011833][ T2146] proc_fail_nth_read+0x1aa/0x220 [ 116.011869][ T2146] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 116.011902][ T2146] ? l2cap_sock_setsockopt+0x144e/0x1d00 [ 116.011934][ T2146] ? bpf_lsm_file_permission+0xd/0x20 [ 116.011965][ T2146] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 116.012000][ T2146] vfs_read+0x28b/0xc70 [ 116.012024][ T2146] ? __cfi_l2cap_sock_setsockopt+0x10/0x10 [ 116.012055][ T2146] ? __cfi_vfs_read+0x10/0x10 [ 116.012078][ T2146] ? __kasan_check_write+0x18/0x20 [ 116.012102][ T2146] ? mutex_lock+0x97/0x1d0 [ 116.012134][ T2146] ? __cfi_mutex_lock+0x10/0x10 [ 116.012169][ T2146] ksys_read+0x145/0x260 [ 116.012193][ T2146] ? __fget_files+0x2bc/0x330 [ 116.012221][ T2146] ? __cfi_ksys_read+0x10/0x10 [ 116.012244][ T2146] ? __kasan_check_write+0x18/0x20 [ 116.012268][ T2146] ? __kasan_check_read+0x15/0x20 [ 116.012291][ T2146] __x64_sys_read+0x7f/0x90 [ 116.012315][ T2146] x64_sys_call+0x2638/0x2ee0 [ 116.012337][ T2146] do_syscall_64+0x57/0xf0 [ 116.012364][ T2146] ? clear_bhb_loop+0x50/0xa0 [ 116.012396][ T2146] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 116.012427][ T2146] RIP: 0033:0x7f5036b5e6ce [ 116.012448][ T2146] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 116.012469][ T2146] RSP: 002b:00007f5037a1bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 116.012494][ T2146] RAX: ffffffffffffffda RBX: 00007f5037a1c6c0 RCX: 00007f5036b5e6ce [ 116.012514][ T2146] RDX: 000000000000000f RSI: 00007f5037a1c0a0 RDI: 0000000000000003 [ 116.012530][ T2146] RBP: 00007f5037a1c090 R08: 0000000000000000 R09: 0000000000000000 [ 116.012546][ T2146] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 116.012561][ T2146] R13: 00007f5036e26038 R14: 00007f5036e25fa0 R15: 00007fffc2376068 [ 116.012582][ T2146] [ 116.071147][ T2150] netlink: 24 bytes leftover after parsing attributes in process `syz.2.608'. [ 116.293343][ T2151] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 116.302810][ T2151] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 116.362519][ T36] audit: type=1400 audit(1784729564.890:362): avc: denied { setopt } for pid=2157 comm="syz.3.610" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 116.363024][ T2158] netlink: 180 bytes leftover after parsing attributes in process `syz.3.610'. [ 116.518020][ T398] usb 3-1: new full-speed USB device number 40 using dummy_hcd [ 116.669382][ T398] usb 3-1: config 0 has an invalid interface number: 231 but max is 0 [ 116.677731][ T398] usb 3-1: config 0 has no interface number 0 [ 116.689420][ T398] usb 3-1: config 0 interface 231 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 116.709504][ T398] usb 3-1: New USB device found, idVendor=067b, idProduct=27a1, bcdDevice=b0.9b [ 116.720470][ T398] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 116.729099][ T398] usb 3-1: Product: syz [ 116.733535][ T398] usb 3-1: Manufacturer: syz [ 116.738552][ T398] usb 3-1: SerialNumber: syz [ 116.743880][ T398] usb 3-1: config 0 descriptor?? [ 116.749315][ T2149] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 116.758132][ T780] usb 4-1: new full-speed USB device number 50 using dummy_hcd [ 116.761225][ T398] plusb 3-1:0.231 usb0: register 'plusb' at usb-dummy_hcd.2-1, Prolific PL-2301/PL-2302/PL-25A1/PL-27A1, a2:87:02:3b:fa:94 [ 116.909291][ T780] usb 4-1: config 0 has an invalid interface number: 2 but max is 0 [ 116.917411][ T780] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 116.927996][ T780] usb 4-1: config 0 has no interface number 0 [ 116.934161][ T780] usb 4-1: config 0 interface 2 has no altsetting 0 [ 116.942907][ T780] usb 4-1: New USB device found, idVendor=086a, idProduct=0003, bcdDevice=f0.3f [ 116.952247][ T780] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 116.960429][ T46] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 116.968124][ T780] usb 4-1: Product: syz [ 116.972327][ T780] usb 4-1: Manufacturer: syz [ 116.977046][ T780] usb 4-1: SerialNumber: syz [ 116.982839][ T780] usb 4-1: config 0 descriptor?? [ 117.129718][ T46] usb 5-1: unable to get BOS descriptor or descriptor too short [ 117.137544][ T46] usb 5-1: too many configurations: 173, using maximum allowed: 8 [ 117.146225][ T46] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 117.156591][ T46] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 117.170295][ T46] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 117.180608][ T46] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 117.195195][ T46] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 117.207485][ T46] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 117.225557][ T780] snd-usb-audio 4-1:0.2: probe with driver snd-usb-audio failed with error -2 [ 117.241057][ T46] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 117.253421][ T46] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 117.264122][ T1619] udevd[1619]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.2/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 117.268071][ T46] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 117.293400][ T46] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 117.309953][ T46] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 117.323893][ T46] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 117.338713][ T46] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 117.349705][ T46] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 117.363419][ T46] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 117.373794][ T46] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 117.388200][ T46] usb 5-1: New USB device found, idVendor=09e8, idProduct=c703, bcdDevice=b3.01 [ 117.397378][ T46] usb 5-1: New USB device strings: Mfr=239, Product=52, SerialNumber=226 [ 117.405974][ T46] usb 5-1: Product: syz [ 117.410230][ T46] usb 5-1: Manufacturer: syz [ 117.414902][ T46] usb 5-1: SerialNumber: syz [ 117.458918][ T780] usb 3-1: USB disconnect, device number 40 [ 117.465720][ T780] plusb 3-1:0.231 usb0: unregister 'plusb' usb-dummy_hcd.2-1, Prolific PL-2301/PL-2302/PL-25A1/PL-27A1 [ 117.470620][ T2162] netlink: 20 bytes leftover after parsing attributes in process `syz.3.611'. [ 117.499855][ T2162] team_slave_1: entered promiscuous mode [ 117.507616][ T2162] team_slave_1: entered allmulticast mode [ 117.600246][ T31] usb 4-1: USB disconnect, device number 50 [ 117.627394][ T46] usb 5-1: MIDIStreaming interface descriptor not found [ 117.642222][ T46] usb 5-1: USB disconnect, device number 50 [ 117.662888][ T1817] udevd[1817]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 117.751833][ T398] usb 6-1: USB disconnect, device number 31 [ 117.816588][ T2206] netlink: 'syz.5.614': attribute type 4 has an invalid length. [ 117.848016][ T780] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 117.999635][ T780] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 118.010234][ T780] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 65535, setting to 64 [ 118.023507][ T780] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 118.033147][ T780] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 118.041395][ T780] usb 3-1: Product: syz [ 118.046113][ T780] usb 3-1: Manufacturer: syz [ 118.050957][ T780] usb 3-1: SerialNumber: syz [ 118.057656][ T780] cdc_mbim 3-1:1.0: skipping garbage [ 118.063164][ T780] usb 3-1: selecting invalid altsetting 1 [ 118.464465][ T780] cdc_mbim 3-1:1.0: failed GET_NTB_PARAMETERS [ 118.470884][ T2186] cgroup2: Unknown parameter 'me¢' [ 118.476349][ T36] audit: type=1400 audit(1784729567.000:363): avc: denied { mounton } for pid=2185 comm="syz.2.613" path="/syzcgroup/unified/syz2" dev="securityfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=dir permissive=1 [ 118.501624][ T780] cdc_mbim 3-1:1.0: bind() failure [ 118.509726][ T780] usb 3-1: USB disconnect, device number 41 [ 118.678106][ T46] usb 4-1: new low-speed USB device number 51 using dummy_hcd [ 118.798038][ T9] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 118.839328][ T46] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 8, setting to 0 [ 118.849970][ T46] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 4 [ 118.861187][ T46] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 118.873193][ T46] usb 4-1: string descriptor 0 read error: -22 [ 118.879497][ T46] usb 4-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 118.889009][ T46] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 118.902169][ T46] usb 4-1: BAAD HEADSET ADAPTER c_chmask mismatch [ 118.912471][ T46] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 118.920380][ T1619] udevd[1619]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 118.958063][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 118.963933][ T398] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 118.975187][ T9] usb 5-1: config 0 has an invalid interface number: 34 but max is 0 [ 118.983975][ T9] usb 5-1: config 0 has no interface number 0 [ 118.991168][ T9] usb 5-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 119.003885][ T9] usb 5-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 119.023057][ T9] usb 5-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 119.038467][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 119.046707][ T9] usb 5-1: Product: syz [ 119.051064][ T9] usb 5-1: Manufacturer: syz [ 119.055693][ T9] usb 5-1: SerialNumber: syz [ 119.061110][ T9] usb 5-1: config 0 descriptor?? [ 119.066395][ T2244] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 119.073797][ T2244] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 119.106275][ T2240] netlink: 4 bytes leftover after parsing attributes in process `syz.3.621'. [ 119.116483][ T31] usb 4-1: USB disconnect, device number 51 [ 119.124371][ T398] usb 6-1: unable to get BOS descriptor or descriptor too short [ 119.132835][ T398] usb 6-1: too many configurations: 173, using maximum allowed: 8 [ 119.141539][ T398] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 119.151773][ T398] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 119.165825][ T398] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 119.176387][ T398] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 119.191713][ T398] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 119.202457][ T398] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 119.218246][ T398] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 119.231539][ T398] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 119.249285][ T398] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 119.262488][ T398] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 119.277067][ T398] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 119.287544][ T398] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 119.288076][ T46] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 119.303395][ T398] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 119.317349][ T2244] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 119.320741][ T398] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 119.328961][ T2244] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 119.351052][ T398] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 119.362610][ T398] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 119.379148][ T398] usb 6-1: New USB device found, idVendor=09e8, idProduct=c703, bcdDevice=b3.01 [ 119.388417][ T398] usb 6-1: New USB device strings: Mfr=239, Product=52, SerialNumber=226 [ 119.397059][ T398] usb 6-1: Product: syz [ 119.401466][ T398] usb 6-1: Manufacturer: syz [ 119.406185][ T398] usb 6-1: SerialNumber: syz [ 119.459229][ T46] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 119.469235][ T46] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 119.480895][ T46] usb 3-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 119.490032][ T46] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 119.498265][ T46] usb 3-1: Product: syz [ 119.502844][ T46] usb 3-1: Manufacturer: syz [ 119.507866][ T46] usb 3-1: SerialNumber: syz [ 119.514746][ T46] usb 3-1: config 0 descriptor?? [ 119.520606][ T2252] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 119.530052][ T2252] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 119.551844][ T9] asix 5-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 119.562786][ T9] asix 5-1:0.34: probe with driver asix failed with error -61 [ 119.617266][ T398] usb 6-1: MIDIStreaming interface descriptor not found [ 119.629926][ T398] usb 6-1: USB disconnect, device number 32 [ 119.643262][ T1817] udevd[1817]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 119.677325][ T36] audit: type=1400 audit(1784729568.200:364): avc: denied { listen } for pid=2255 comm="syz.3.628" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 119.739187][ T2252] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 119.772508][ T46] dm9601 3-1:0.0: probe with driver dm9601 failed with error -71 [ 119.796587][ T46] usb 3-1: USB disconnect, device number 42 [ 119.810121][ T2264] netlink: 26148 bytes leftover after parsing attributes in process `syz.2.630'. [ 119.824897][ T2264] netlink: 8 bytes leftover after parsing attributes in process `syz.2.630'. [ 119.835279][ T2265] netlink: 26148 bytes leftover after parsing attributes in process `syz.2.630'. [ 119.844738][ T2265] netlink: 8 bytes leftover after parsing attributes in process `syz.2.630'. [ 120.135230][ T2269] netlink: 288 bytes leftover after parsing attributes in process `syz.5.631'. [ 120.291377][ T2271] FAULT_INJECTION: forcing a failure. [ 120.291377][ T2271] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 120.305652][ T2271] CPU: 1 UID: 0 PID: 2271 Comm: syz.5.632 Not tainted syzkaller #0 e661c05697932dc72467e0ff9a1babb7f2c48647 [ 120.305680][ T2271] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 120.305691][ T2271] Call Trace: [ 120.305699][ T2271] [ 120.305706][ T2271] __dump_stack+0x21/0x30 [ 120.305735][ T2271] dump_stack_lvl+0x140/0x1c0 [ 120.305758][ T2271] ? __cfi_dump_stack_lvl+0x10/0x10 [ 120.305783][ T2271] dump_stack+0x19/0x20 [ 120.305805][ T2271] should_fail_ex+0x3c2/0x510 [ 120.305825][ T2271] should_fail_alloc_page+0xec/0x110 [ 120.305847][ T2271] __alloc_pages_noprof+0x1c0/0x7e0 [ 120.305871][ T2271] ? kernel_text_address+0xa9/0xe0 [ 120.305901][ T2271] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 120.305926][ T2271] ? unwind_get_return_address+0x51/0x90 [ 120.305948][ T2271] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 120.305971][ T2271] get_free_pages_noprof+0x14/0x40 [ 120.305995][ T2271] kasan_populate_vmalloc_pte+0x4c/0x170 [ 120.306013][ T2271] __apply_to_page_range+0x7c2/0xd00 [ 120.306034][ T2271] ? __cfi_kasan_populate_vmalloc_pte+0x10/0x10 [ 120.306052][ T2271] ? __x64_sys_ioctl+0x7f/0xa0 [ 120.306072][ T2271] ? apply_to_page_range+0x60/0x60 [ 120.306094][ T2271] ? __cfi_kasan_populate_vmalloc_pte+0x10/0x10 [ 120.306111][ T2271] apply_to_page_range+0x3f/0x60 [ 120.306130][ T2271] kasan_populate_vmalloc+0x64/0x80 [ 120.306147][ T2271] alloc_vmap_area+0x1e8e/0x26f0 [ 120.306173][ T2271] ? kasan_save_alloc_info+0x3a/0x50 [ 120.306199][ T2271] ? vm_map_ram+0xdd0/0xdd0 [ 120.306222][ T2271] ? __kmalloc_cache_node_noprof+0x225/0x430 [ 120.306240][ T2271] ? __get_vm_area_node+0x150/0x390 [ 120.306264][ T2271] __get_vm_area_node+0x1f8/0x390 [ 120.306288][ T2271] __vmalloc_node_range_noprof+0x340/0x1300 [ 120.306314][ T2271] ? copy_process+0x57c/0x3350 [ 120.306339][ T2271] ? __cfi___vmalloc_node_range_noprof+0x10/0x10 [ 120.306365][ T2271] ? kasan_save_alloc_info+0x3a/0x50 [ 120.306389][ T2271] ? __kasan_slab_alloc+0x73/0x90 [ 120.306410][ T2271] ? arch_dup_task_struct+0x5b/0xe0 [ 120.306435][ T2271] ? __asan_memcpy+0x5a/0x80 [ 120.306452][ T2271] dup_task_struct+0x5d6/0xd80 [ 120.306472][ T2271] ? copy_process+0x57c/0x3350 [ 120.306493][ T2271] ? _raw_spin_lock_irq+0x93/0x120 [ 120.306536][ T2271] ? copy_process+0x3350/0x3350 [ 120.306563][ T2271] ? __kasan_check_write+0x18/0x20 [ 120.306598][ T2271] copy_process+0x57c/0x3350 [ 120.306622][ T2271] ? kasan_save_alloc_info+0x3a/0x50 [ 120.306647][ T2271] ? __cfi_copy_process+0x10/0x10 [ 120.306670][ T2271] ? __kmalloc_cache_noprof+0x23c/0x470 [ 120.306710][ T2271] ? __kasan_check_write+0x18/0x20 [ 120.306733][ T2271] ? __cfi_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 120.306762][ T2271] vhost_task_create+0x1f7/0x3f0 [ 120.306780][ T2271] ? __cfi_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 120.306800][ T2271] ? __cfi_vhost_task_create+0x10/0x10 [ 120.306819][ T2271] ? __cfi_vhost_task_fn+0x10/0x10 [ 120.306836][ T2271] ? __kasan_check_write+0x18/0x20 [ 120.306854][ T2271] ? mutex_lock+0x97/0x1d0 [ 120.306877][ T2271] ? __cfi_mutex_lock+0x10/0x10 [ 120.306920][ T2271] ? kernel_text_address+0xa9/0xe0 [ 120.306953][ T2271] kvm_mmu_post_init_vm+0x161/0x300 [ 120.306988][ T2271] kvm_arch_vcpu_ioctl_run+0xf3/0x1bc0 [ 120.307011][ T2271] ? _parse_integer_limit+0x195/0x1e0 [ 120.307029][ T2271] ? __cfi_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 120.307052][ T2271] ? kstrtoull+0x13b/0x1e0 [ 120.307068][ T2271] ? kstrtouint+0x78/0xf0 [ 120.307084][ T2271] ? ioctl_has_perm+0x1bc/0x500 [ 120.307102][ T2271] ? __asan_memcpy+0x5a/0x80 [ 120.307118][ T2271] ? ioctl_has_perm+0x408/0x500 [ 120.307133][ T2271] ? has_cap_mac_admin+0xd0/0xd0 [ 120.307148][ T2271] ? __kasan_check_write+0x18/0x20 [ 120.307164][ T2271] ? mutex_lock_killable+0x97/0x1d0 [ 120.307188][ T2271] ? __cfi_mutex_lock_killable+0x10/0x10 [ 120.307217][ T2271] ? proc_fail_nth_write+0x184/0x220 [ 120.307243][ T2271] kvm_vcpu_ioctl+0xa43/0x1000 [ 120.307259][ T2271] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 120.307275][ T2271] ? __cfi_vfs_write+0x10/0x10 [ 120.307292][ T2271] ? __kasan_check_write+0x18/0x20 [ 120.307308][ T2271] ? mutex_unlock+0x90/0x240 [ 120.307330][ T2271] ? __cfi_mutex_unlock+0x10/0x10 [ 120.307356][ T2271] ? bpf_lsm_file_ioctl+0xd/0x20 [ 120.307377][ T2271] ? security_file_ioctl+0x3e/0x110 [ 120.307402][ T2271] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 120.307417][ T2271] __se_sys_ioctl+0x132/0x1b0 [ 120.307438][ T2271] __x64_sys_ioctl+0x7f/0xa0 [ 120.307457][ T2271] x64_sys_call+0x1878/0x2ee0 [ 120.307472][ T2271] do_syscall_64+0x57/0xf0 [ 120.307490][ T2271] ? clear_bhb_loop+0x50/0xa0 [ 120.307512][ T2271] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 120.307547][ T2271] RIP: 0033:0x7ff80519de99 [ 120.307562][ T2271] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 120.307577][ T2271] RSP: 002b:00007ff806094028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 120.307600][ T2271] RAX: ffffffffffffffda RBX: 00007ff805425fa0 RCX: 00007ff80519de99 [ 120.307613][ T2271] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 120.307623][ T2271] RBP: 00007ff806094090 R08: 0000000000000000 R09: 0000000000000000 [ 120.307634][ T2271] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 120.307644][ T2271] R13: 00007ff805426038 R14: 00007ff805425fa0 R15: 00007fffd2d43008 [ 120.307659][ T2271] [ 120.307684][ T2271] syz.5.632: vmalloc error: size 32768, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz5,mems_allowed=0 [ 120.876840][ T2271] CPU: 1 UID: 0 PID: 2271 Comm: syz.5.632 Not tainted syzkaller #0 e661c05697932dc72467e0ff9a1babb7f2c48647 [ 120.876884][ T2271] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 120.876899][ T2271] Call Trace: [ 120.876908][ T2271] [ 120.876919][ T2271] __dump_stack+0x21/0x30 [ 120.876961][ T2271] dump_stack_lvl+0x140/0x1c0 [ 120.876997][ T2271] ? __cfi_dump_stack_lvl+0x10/0x10 [ 120.877035][ T2271] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 120.877068][ T2271] dump_stack+0x19/0x20 [ 120.877102][ T2271] warn_alloc+0x1e7/0x2c0 [ 120.877141][ T2271] ? __cfi_warn_alloc+0x10/0x10 [ 120.877187][ T2271] ? __get_vm_area_node+0x211/0x390 [ 120.877228][ T2271] ? __get_vm_area_node+0x211/0x390 [ 120.877268][ T2271] __vmalloc_node_range_noprof+0x365/0x1300 [ 120.877317][ T2271] ? __cfi___vmalloc_node_range_noprof+0x10/0x10 [ 120.877360][ T2271] ? kasan_save_alloc_info+0x3a/0x50 [ 120.877398][ T2271] ? __kasan_slab_alloc+0x73/0x90 [ 120.877428][ T2271] ? arch_dup_task_struct+0x5b/0xe0 [ 120.877467][ T2271] ? __asan_memcpy+0x5a/0x80 [ 120.877495][ T2271] dup_task_struct+0x5d6/0xd80 [ 120.877528][ T2271] ? copy_process+0x57c/0x3350 [ 120.877559][ T2271] ? _raw_spin_lock_irq+0x93/0x120 [ 120.877587][ T2271] ? copy_process+0x3350/0x3350 [ 120.877618][ T2271] ? __kasan_check_write+0x18/0x20 [ 120.877644][ T2271] copy_process+0x57c/0x3350 [ 120.877678][ T2271] ? kasan_save_alloc_info+0x3a/0x50 [ 120.877717][ T2271] ? __cfi_copy_process+0x10/0x10 [ 120.877750][ T2271] ? __kmalloc_cache_noprof+0x23c/0x470 [ 120.877777][ T2271] ? __kasan_check_write+0x18/0x20 [ 120.877803][ T2271] ? __cfi_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 120.877833][ T2271] vhost_task_create+0x1f7/0x3f0 [ 120.877861][ T2271] ? __cfi_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 120.877894][ T2271] ? __cfi_vhost_task_create+0x10/0x10 [ 120.877929][ T2271] ? __cfi_vhost_task_fn+0x10/0x10 [ 120.877956][ T2271] ? __kasan_check_write+0x18/0x20 [ 120.877980][ T2271] ? mutex_lock+0x97/0x1d0 [ 120.878014][ T2271] ? __cfi_mutex_lock+0x10/0x10 [ 120.878047][ T2271] ? kernel_text_address+0xa9/0xe0 [ 120.878086][ T2271] kvm_mmu_post_init_vm+0x161/0x300 [ 120.878125][ T2271] kvm_arch_vcpu_ioctl_run+0xf3/0x1bc0 [ 120.878162][ T2271] ? _parse_integer_limit+0x195/0x1e0 [ 120.878203][ T2271] ? __cfi_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 120.878238][ T2271] ? kstrtoull+0x13b/0x1e0 [ 120.878265][ T2271] ? kstrtouint+0x78/0xf0 [ 120.878289][ T2271] ? ioctl_has_perm+0x1bc/0x500 [ 120.878314][ T2271] ? __asan_memcpy+0x5a/0x80 [ 120.878340][ T2271] ? ioctl_has_perm+0x408/0x500 [ 120.878366][ T2271] ? has_cap_mac_admin+0xd0/0xd0 [ 120.878392][ T2271] ? __kasan_check_write+0x18/0x20 [ 120.878419][ T2271] ? mutex_lock_killable+0x97/0x1d0 [ 120.878456][ T2271] ? __cfi_mutex_lock_killable+0x10/0x10 [ 120.878493][ T2271] ? proc_fail_nth_write+0x184/0x220 [ 120.878534][ T2271] kvm_vcpu_ioctl+0xa43/0x1000 [ 120.878562][ T2271] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 120.878588][ T2271] ? __cfi_vfs_write+0x10/0x10 [ 120.878616][ T2271] ? __kasan_check_write+0x18/0x20 [ 120.878641][ T2271] ? mutex_unlock+0x90/0x240 [ 120.878676][ T2271] ? __cfi_mutex_unlock+0x10/0x10 [ 120.878716][ T2271] ? bpf_lsm_file_ioctl+0xd/0x20 [ 120.878750][ T2271] ? security_file_ioctl+0x3e/0x110 [ 120.878790][ T2271] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 120.878815][ T2271] __se_sys_ioctl+0x132/0x1b0 [ 120.878848][ T2271] __x64_sys_ioctl+0x7f/0xa0 [ 120.878880][ T2271] x64_sys_call+0x1878/0x2ee0 [ 120.878905][ T2271] do_syscall_64+0x57/0xf0 [ 120.878933][ T2271] ? clear_bhb_loop+0x50/0xa0 [ 120.878969][ T2271] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 120.879010][ T2271] RIP: 0033:0x7ff80519de99 [ 120.879035][ T2271] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 120.879077][ T2271] RSP: 002b:00007ff806094028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 120.879104][ T2271] RAX: ffffffffffffffda RBX: 00007ff805425fa0 RCX: 00007ff80519de99 [ 120.879123][ T2271] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 120.879140][ T2271] RBP: 00007ff806094090 R08: 0000000000000000 R09: 0000000000000000 [ 120.879157][ T2271] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 120.879183][ T2271] R13: 00007ff805426038 R14: 00007ff805425fa0 R15: 00007fffd2d43008 [ 120.879207][ T2271] [ 121.322949][ T2271] Mem-Info: [ 121.326128][ T2271] active_anon:29562 inactive_anon:876 isolated_anon:0 [ 121.326128][ T2271] active_file:18724 inactive_file:2326 isolated_file:0 [ 121.326128][ T2271] unevictable:0 dirty:68 writeback:0 [ 121.326128][ T2271] slab_reclaimable:5029 slab_unreclaimable:71228 [ 121.326128][ T2271] mapped:29238 shmem:19729 pagetables:1181 [ 121.326128][ T2271] sec_pagetables:0 bounce:0 [ 121.326128][ T2271] kernel_misc_reclaimable:0 [ 121.326128][ T2271] free:1500036 free_pcp:3279 free_cma:0 [ 121.380104][ T2286] SELinux: Context ϧ is not valid (left unmapped). [ 121.396121][ T2271] Node 0 active_anon:118312kB inactive_anon:3504kB active_file:74896kB inactive_file:9304kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:121048kB dirty:296kB writeback:0kB shmem:78916kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:6728kB pagetables:4236kB sec_pagetables:0kB all_unreclaimable? no [ 121.428974][ T2271] DMA32 free:2958164kB boost:0kB min:19080kB low:23848kB high:28616kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3145324kB managed:2963400kB mlocked:0kB bounce:0kB free_pcp:5236kB local_pcp:5236kB free_cma:0kB [ 121.459666][ T2271] lowmem_reserve[]: 0 3921 3921 [ 121.464757][ T2291] netlink: 'syz.2.638': attribute type 5 has an invalid length. [ 121.464757][ T2271] Normal free:3048092kB boost:0kB min:25972kB low:32464kB high:38956kB reserved_highatomic:0KB free_highatomic:0KB active_anon:118412kB inactive_anon:3504kB active_file:74896kB inactive_file:9304kB unevictable:0kB writepending:296kB present:5242880kB managed:4015864kB mlocked:0kB bounce:0kB free_pcp:2152kB local_pcp:1772kB free_cma:0kB [ 121.472578][ T2291] netlink: 45 bytes leftover after parsing attributes in process `syz.2.638'. [ 121.505347][ T2271] lowmem_reserve[]: 0 0 0 [ 121.541117][ T2271] DMA32: 5*4kB (M) 4*8kB (M) 4*16kB (M) 5*32kB (M) 3*64kB (M) 5*128kB (M) 5*256kB (M) 5*512kB (M) 4*1024kB (UM) 4*2048kB (M) 718*4096kB (M) = 2958164kB [ 121.557710][ T2271] Normal: 168*4kB (UE) 570*8kB (UME) 12*16kB (ME) 23*32kB (UE) 193*64kB (UE) 50*128kB (UE) 36*256kB (UME) 15*512kB (UME) 10*1024kB (UME) 15*2048kB (UM) 723*4096kB (UME) = 3044176kB [ 121.558692][ T2297] SELinux: Context system_u:object_r:hald_keymap_exec_t:s0 is not valid (left unmapped). [ 121.576886][ T2271] 41652 total pagecache pages [ 121.601867][ T36] audit: type=1400 audit(1784729570.120:365): avc: denied { relabelto } for pid=2296 comm="syz.2.640" name="file0" dev="tmpfs" ino=982 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=fifo_file permissive=1 trawcon="system_u:object_r:hald_keymap_exec_t:s0" [ 121.639319][ T2295] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 121.642425][ T780] usb 5-1: USB disconnect, device number 51 [ 121.653841][ T2271] 877 pages in swap cache [ 121.657526][ T36] audit: type=1400 audit(1784729570.120:366): avc: denied { associate } for pid=2296 comm="syz.2.640" name="file0" dev="tmpfs" ino=982 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:hald_keymap_exec_t:s0" [ 121.663209][ T2271] Free swap = 121148kB [ 121.686576][ T36] audit: type=1400 audit(1784729570.130:367): avc: denied { unlink } for pid=295 comm="syz-executor" name="file0" dev="tmpfs" ino=982 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=fifo_file permissive=1 trawcon="system_u:object_r:hald_keymap_exec_t:s0" [ 121.716915][ T2295] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 121.728553][ T2271] Total swap = 124996kB [ 121.738022][ T2271] 2097051 pages RAM [ 121.741861][ T2271] 0 pages HighMem/MovableOnly [ 121.746569][ T2271] 352235 pages reserved [ 121.750795][ T2271] 0 pages cma reserved [ 121.758040][ T2271] Memory allocations: [ 121.762201][ T2271] 0 B 0 init/main.c:1477 func:do_initcalls [ 121.771242][ T2271] 0 B 0 init/do_mounts.c:186 func:mount_root_generic [ 121.779420][ T2271] 0 B 0 init/do_mounts.c:158 func:do_mount_root [ 121.787102][ T2271] 0 B 0 init/do_mounts.c:352 func:mount_nodev_root [ 121.795103][ T2271] 0 B 0 init/do_mounts_rd.c:241 func:rd_load_image [ 121.806272][ T2271] 0 B 0 init/do_mounts_rd.c:72 func:identify_ramdisk_image [ 121.815454][ T2271] 0 B 0 init/initramfs.c:507 func:unpack_to_rootfs [ 121.823604][ T2271] 0 B 0 init/initramfs.c:508 func:unpack_to_rootfs [ 121.844645][ T2271] 0 B 0 init/initramfs.c:509 func:unpack_to_rootfs [ 121.852703][ T2271] 0 B 0 init/initramfs.c:101 func:find_link [ 121.898046][ T310] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 122.048022][ T310] usb 4-1: Using ep0 maxpacket: 32 [ 122.053697][ T36] audit: type=1400 audit(1784729570.580:368): avc: denied { ioctl } for pid=2317 comm="syz.4.649" path="socket:[22760]" dev="sockfs" ino=22760 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 122.087300][ T310] usb 4-1: config 0 has an invalid interface number: 16 but max is 0 [ 122.096567][ T310] usb 4-1: config 0 has no interface number 0 [ 122.105092][ T310] usb 4-1: config 0 interface 16 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 122.128125][ T310] usb 4-1: config 0 interface 16 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 122.143149][ T310] usb 4-1: config 0 interface 16 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 122.165800][ T310] usb 4-1: New USB device found, idVendor=046d, idProduct=c70e, bcdDevice= 0.00 [ 122.177110][ T310] usb 4-1: New USB device strings: Mfr=20, Product=0, SerialNumber=0 [ 122.187438][ T310] usb 4-1: Manufacturer: syz [ 122.196499][ T310] usb 4-1: config 0 descriptor?? [ 122.343594][ T479] tipc: Subscription rejected, illegal request [ 122.368013][ T780] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 122.405713][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.414113][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.422492][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.430774][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.438983][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.447143][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.455579][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.463842][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.468169][ T46] usb 5-1: new low-speed USB device number 52 using dummy_hcd [ 122.472151][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.487700][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.495870][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.504041][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.512357][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.520836][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.528141][ T780] usb 6-1: Using ep0 maxpacket: 16 [ 122.529055][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.536120][ T780] usb 6-1: config 0 has an invalid interface number: 34 but max is 0 [ 122.542212][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.551392][ T780] usb 6-1: config 0 has no interface number 0 [ 122.559899][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.565808][ T780] usb 6-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 122.574116][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.585827][ T780] usb 6-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 122.592313][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.604917][ T780] usb 6-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 122.611364][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.622481][ T46] usb 5-1: device descriptor read/64, error -71 [ 122.632919][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.640646][ T780] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 122.650829][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.659846][ T2295] capability: warning: `syz.3.639' uses 32-bit capabilities (legacy support in use) [ 122.674236][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.678684][ T780] usb 6-1: Product: syz [ 122.692041][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.696332][ T780] usb 6-1: Manufacturer: syz [ 122.706833][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.716390][ T780] usb 6-1: SerialNumber: syz [ 122.725607][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.741478][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.742093][ T780] usb 6-1: config 0 descriptor?? [ 122.750374][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.765123][ T2321] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 122.774286][ T2321] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 122.782588][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.791338][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.801570][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.810800][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.819743][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.828171][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.837265][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.845876][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.854104][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.862313][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.870481][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.878840][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.886973][ T310] logitech-djreceiver 0003:046D:C70E.0009: unknown main item tag 0x0 [ 122.896116][ T310] logitech-djreceiver 0003:046D:C70E.0009: hidraw0: USB HID v0.77 Device [syz] on usb-dummy_hcd.3-1/input16 [ 122.898202][ T46] usb 5-1: device descriptor read/64, error -71 [ 122.984019][ T2321] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 122.991358][ T2321] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 123.110803][ T36] audit: type=1400 audit(1784729571.640:369): avc: denied { shutdown } for pid=2331 comm="syz.2.653" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 123.148039][ T46] usb 5-1: new low-speed USB device number 53 using dummy_hcd [ 123.199172][ T780] asix 6-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 123.210994][ T780] asix 6-1:0.34: probe with driver asix failed with error -61 [ 123.278030][ T46] usb 5-1: device descriptor read/64, error -71 [ 123.408026][ T310] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 123.538265][ T46] usb 5-1: device descriptor read/64, error -71 [ 123.559737][ T310] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 123.571012][ T310] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 123.580936][ T310] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 123.590732][ T310] usb 3-1: config 0 descriptor?? [ 123.648124][ T46] usb usb5-port1: attempt power cycle [ 123.798043][ T310] usbhid 3-1:0.0: can't add hid device: -71 [ 123.804185][ T310] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 123.813375][ T310] usb 3-1: USB disconnect, device number 43 [ 123.988034][ T46] usb 5-1: new low-speed USB device number 54 using dummy_hcd [ 124.015969][ T46] usb 5-1: device descriptor read/8, error -71 [ 124.149265][ T46] usb 5-1: device descriptor read/8, error -71 [ 124.238045][ T780] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 124.388124][ T46] usb 5-1: new low-speed USB device number 55 using dummy_hcd [ 124.397071][ T780] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 124.408430][ T780] usb 3-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 124.418220][ T780] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 124.427405][ T46] usb 5-1: device descriptor read/8, error -71 [ 124.434564][ T780] usb 3-1: config 0 descriptor?? [ 124.536671][ T484] usb 4-1: USB disconnect, device number 52 [ 124.579295][ T46] usb 5-1: device descriptor read/8, error -71 [ 124.688118][ T46] usb usb5-port1: unable to enumerate USB device [ 125.130660][ T398] usb 6-1: USB disconnect, device number 33 [ 125.241349][ T36] audit: type=1400 audit(1784729573.770:370): avc: denied { create } for pid=2358 comm="syz.4.661" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=appletalk_socket permissive=1 [ 125.266772][ T780] aiptek 3-1:0.0: Aiptek using 400 ms programming speed [ 125.281934][ T780] input: Aiptek as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input11 [ 125.309999][ C1] ------------[ cut here ]------------ [ 125.315526][ C1] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31 [ 125.324255][ C1] index 46335 is out of range for type 'const int[34]' [ 125.331142][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 e661c05697932dc72467e0ff9a1babb7f2c48647 [ 125.331168][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 125.331180][ C1] Call Trace: [ 125.331186][ C1] [ 125.331194][ C1] __dump_stack+0x21/0x30 [ 125.331223][ C1] dump_stack_lvl+0x140/0x1c0 [ 125.331248][ C1] ? __cfi_dump_stack_lvl+0x10/0x10 [ 125.331273][ C1] ? common_startup_64+0x13b/0x157 [ 125.331301][ C1] dump_stack+0x19/0x20 [ 125.331324][ C1] ubsan_epilogue+0xe/0x40 [ 125.331340][ C1] __ubsan_handle_out_of_bounds+0xe8/0xf0 [ 125.331366][ C1] aiptek_irq+0x208d/0x2a00 [ 125.331390][ C1] ? _raw_spin_unlock+0x45/0x60 [ 125.331410][ C1] ? kcov_remote_start+0x1d2/0x3c0 [ 125.331429][ C1] __usb_hcd_giveback_urb+0x371/0x530 [ 125.331457][ C1] usb_hcd_giveback_urb+0x12b/0x400 [ 125.331484][ C1] dummy_timer+0xa3f/0x4900 [ 125.331508][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 125.331525][ C1] ? timerqueue_del+0xd7/0x130 [ 125.331542][ C1] ? __hrtimer_run_queues+0x2bd/0x8e0 [ 125.331568][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 125.331584][ C1] __hrtimer_run_queues+0x3ab/0x8e0 [ 125.331617][ C1] ? hrtimer_interrupt+0xf30/0xf30 [ 125.331643][ C1] ? read_tsc+0xd/0x20 [ 125.331666][ C1] ? ktime_get_update_offsets_now+0x3c0/0x3e0 [ 125.331688][ C1] hrtimer_run_softirq+0x159/0x560 [ 125.331705][ C1] ? irqtime_account_irq+0x51/0x1c0 [ 125.331731][ C1] handle_softirqs+0x1aa/0x620 [ 125.331750][ C1] __irq_exit_rcu+0x47/0xb0 [ 125.331767][ C1] irq_exit_rcu+0xd/0x30 [ 125.331782][ C1] sysvec_apic_timer_interrupt+0x82/0x90 [ 125.331815][ C1] [ 125.331821][ C1] [ 125.331828][ C1] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 125.331852][ C1] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 125.331880][ C1] Code: cc cc cc cc cc cc cc b8 59 52 41 5c 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 23 c9 43 00 55 48 89 e5 fb f4 <5d> c3 cc cc cc cc cc cc cc cc cc cc cc b8 00 00 00 00 90 90 90 90 [ 125.331895][ C1] RSP: 0018:ffffc900001a7e00 EFLAGS: 000002c2 [ 125.331912][ C1] RAX: ffff8881f6f00000 RBX: ffff888103668000 RCX: ffffffff85a394fd [ 125.331926][ C1] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 00000000001edcec [ 125.331938][ C1] RBP: ffffc900001a7e00 R08: ffff8881f6f395eb R09: 1ffff1103ede72bd [ 125.331952][ C1] R10: dffffc0000000000 R11: ffffed103ede72be R12: 0000000000000000 [ 125.331965][ C1] R13: 1ffff110206cd000 R14: dffffc0000000000 R15: ffffffff87ecb4e8 [ 125.331980][ C1] ? ct_kernel_exit+0x7d/0xb0 [ 125.331996][ C1] default_idle+0x17/0x30 [ 125.332012][ C1] arch_cpu_idle+0xd/0x20 [ 125.332028][ C1] default_idle_call+0x3e/0x80 [ 125.332044][ C1] do_idle+0x2fc/0x570 [ 125.332063][ C1] ? idle_inject_timer_fn+0x80/0x80 [ 125.332084][ C1] ? do_idle+0x549/0x570 [ 125.332102][ C1] cpu_startup_entry+0x47/0x60 [ 125.332124][ C1] start_secondary+0x12e/0x140 [ 125.332148][ C1] common_startup_64+0x13b/0x157 [ 125.332174][ C1] [ 125.332180][ C1] ---[ end trace ]--- [ 125.630971][ C1] ================================================================== [ 125.639859][ C1] BUG: KASAN: global-out-of-bounds in aiptek_irq+0x20ab/0x2a00 [ 125.647692][ C1] Read of size 4 at addr ffffffff867318bc by task swapper/1/0 [ 125.655268][ C1] [ 125.657609][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 e661c05697932dc72467e0ff9a1babb7f2c48647 [ 125.657636][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 125.657648][ C1] Call Trace: [ 125.657656][ C1] [ 125.657664][ C1] __dump_stack+0x21/0x30 [ 125.657692][ C1] dump_stack_lvl+0x140/0x1c0 [ 125.657717][ C1] ? __cfi_dump_stack_lvl+0x10/0x10 [ 125.657743][ C1] ? __cfi__printk+0x10/0x10 [ 125.657766][ C1] print_address_description+0x71/0x210 [ 125.657792][ C1] print_report+0x4a/0x70 [ 125.657815][ C1] kasan_report+0x162/0x1a0 [ 125.657839][ C1] ? aiptek_irq+0x20ab/0x2a00 [ 125.657863][ C1] ? aiptek_irq+0x20ab/0x2a00 [ 125.657887][ C1] __asan_report_load4_noabort+0x18/0x20 [ 125.657904][ C1] aiptek_irq+0x20ab/0x2a00 [ 125.657942][ C1] ? _raw_spin_unlock+0x45/0x60 [ 125.657970][ C1] ? kcov_remote_start+0x1d2/0x3c0 [ 125.657998][ C1] __usb_hcd_giveback_urb+0x371/0x530 [ 125.658033][ C1] usb_hcd_giveback_urb+0x12b/0x400 [ 125.658060][ C1] dummy_timer+0xa3f/0x4900 [ 125.658084][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 125.658101][ C1] ? timerqueue_del+0xd7/0x130 [ 125.658117][ C1] ? __hrtimer_run_queues+0x2bd/0x8e0 [ 125.658154][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 125.658170][ C1] __hrtimer_run_queues+0x3ab/0x8e0 [ 125.658198][ C1] ? hrtimer_interrupt+0xf30/0xf30 [ 125.658223][ C1] ? read_tsc+0xd/0x20 [ 125.658247][ C1] ? ktime_get_update_offsets_now+0x3c0/0x3e0 [ 125.658270][ C1] hrtimer_run_softirq+0x159/0x560 [ 125.658287][ C1] ? irqtime_account_irq+0x51/0x1c0 [ 125.658312][ C1] handle_softirqs+0x1aa/0x620 [ 125.658332][ C1] __irq_exit_rcu+0x47/0xb0 [ 125.658348][ C1] irq_exit_rcu+0xd/0x30 [ 125.658364][ C1] sysvec_apic_timer_interrupt+0x82/0x90 [ 125.658391][ C1] [ 125.658397][ C1] [ 125.658403][ C1] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 125.658428][ C1] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 125.658471][ C1] Code: cc cc cc cc cc cc cc b8 59 52 41 5c 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 23 c9 43 00 55 48 89 e5 fb f4 <5d> c3 cc cc cc cc cc cc cc cc cc cc cc b8 00 00 00 00 90 90 90 90 [ 125.658496][ C1] RSP: 0018:ffffc900001a7e00 EFLAGS: 000002c2 [ 125.658519][ C1] RAX: ffff8881f6f00000 RBX: ffff888103668000 RCX: ffffffff85a394fd [ 125.658534][ C1] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 00000000001edcec [ 125.658556][ C1] RBP: ffffc900001a7e00 R08: ffff8881f6f395eb R09: 1ffff1103ede72bd [ 125.658578][ C1] R10: dffffc0000000000 R11: ffffed103ede72be R12: 0000000000000000 [ 125.658599][ C1] R13: 1ffff110206cd000 R14: dffffc0000000000 R15: ffffffff87ecb4e8 [ 125.658621][ C1] ? ct_kernel_exit+0x7d/0xb0 [ 125.658641][ C1] default_idle+0x17/0x30 [ 125.658658][ C1] arch_cpu_idle+0xd/0x20 [ 125.658674][ C1] default_idle_call+0x3e/0x80 [ 125.658690][ C1] do_idle+0x2fc/0x570 [ 125.658709][ C1] ? idle_inject_timer_fn+0x80/0x80 [ 125.658731][ C1] ? do_idle+0x549/0x570 [ 125.658750][ C1] cpu_startup_entry+0x47/0x60 [ 125.658769][ C1] start_secondary+0x12e/0x140 [ 125.658794][ C1] common_startup_64+0x13b/0x157 [ 125.658822][ C1] [ 125.658828][ C1] [ 125.971648][ C1] The buggy address belongs to the variable: [ 125.977654][ C1] .str.39+0x3c/0x40 [ 125.981580][ C1] [ 125.983926][ C1] The buggy address belongs to the physical page: [ 125.990456][ C1] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6731 [ 125.999309][ C1] flags: 0x4000(reserved|zone=0) [ 126.004275][ C1] raw: 0000000000004000 ffffea000019cc48 ffffea000019cc48 0000000000000000 [ 126.012877][ C1] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 126.021472][ C1] page dumped because: kasan: bad access detected [ 126.028013][ C1] page_owner info is not present (never set?) [ 126.034103][ C1] [ 126.036431][ C1] Memory state around the buggy address: [ 126.042065][ C1] ffffffff86731780: 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 [ 126.050247][ C1] ffffffff86731800: 00 00 03 f9 f9 f9 f9 f9 00 00 03 f9 f9 f9 f9 f9 [ 126.058668][ C1] >ffffffff86731880: 00 00 02 f9 f9 f9 f9 f9 00 00 03 f9 f9 f9 f9 f9 [ 126.066768][ C1] ^ [ 126.072694][ C1] ffffffff86731900: 00 00 00 00 00 00 f9 f9 00 00 00 00 00 07 f9 f9 [ 126.080861][ C1] ffffffff86731980: 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 [ 126.089031][ C1] ================================================================== [ 126.097478][ C1] Disabling lock debugging due to kernel taint [ 126.103849][ C1] ------------[ cut here ]------------ [ 126.110010][ C1] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30 [ 126.120347][ C1] index 46336 is out of range for type 'const int[34]' [ 126.127292][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G B syzkaller #0 e661c05697932dc72467e0ff9a1babb7f2c48647 [ 126.127350][ C1] Tainted: [B]=BAD_PAGE [ 126.127360][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 126.127380][ C1] Call Trace: [ 126.127387][ C1] [ 126.127396][ C1] __dump_stack+0x21/0x30 [ 126.127425][ C1] dump_stack_lvl+0x140/0x1c0 [ 126.127449][ C1] ? __cfi_dump_stack_lvl+0x10/0x10 [ 126.127474][ C1] ? input_event_dispose+0x2f5/0x6d0 [ 126.127503][ C1] dump_stack+0x19/0x20 [ 126.127526][ C1] ubsan_epilogue+0xe/0x40 [ 126.127541][ C1] __ubsan_handle_out_of_bounds+0xe8/0xf0 [ 126.127567][ C1] aiptek_irq+0x1f3c/0x2a00 [ 126.127592][ C1] ? kcov_remote_start+0x1d2/0x3c0 [ 126.127612][ C1] __usb_hcd_giveback_urb+0x371/0x530 [ 126.127653][ C1] usb_hcd_giveback_urb+0x12b/0x400 [ 126.127680][ C1] dummy_timer+0xa3f/0x4900 [ 126.127704][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 126.127721][ C1] ? timerqueue_del+0xd7/0x130 [ 126.127738][ C1] ? __hrtimer_run_queues+0x2bd/0x8e0 [ 126.127765][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 126.127781][ C1] __hrtimer_run_queues+0x3ab/0x8e0 [ 126.127809][ C1] ? hrtimer_interrupt+0xf30/0xf30 [ 126.127835][ C1] ? read_tsc+0xd/0x20 [ 126.127858][ C1] ? ktime_get_update_offsets_now+0x3c0/0x3e0 [ 126.127881][ C1] hrtimer_run_softirq+0x159/0x560 [ 126.127898][ C1] ? irqtime_account_irq+0x51/0x1c0 [ 126.127936][ C1] handle_softirqs+0x1aa/0x620 [ 126.127963][ C1] __irq_exit_rcu+0x47/0xb0 [ 126.127989][ C1] irq_exit_rcu+0xd/0x30 [ 126.128005][ C1] sysvec_apic_timer_interrupt+0x82/0x90 [ 126.128032][ C1] [ 126.128038][ C1] [ 126.128044][ C1] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 126.128068][ C1] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 126.128097][ C1] Code: cc cc cc cc cc cc cc b8 59 52 41 5c 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 23 c9 43 00 55 48 89 e5 fb f4 <5d> c3 cc cc cc cc cc cc cc cc cc cc cc b8 00 00 00 00 90 90 90 90 [ 126.128113][ C1] RSP: 0018:ffffc900001a7e00 EFLAGS: 000002c2 [ 126.128131][ C1] RAX: ffff8881f6f00000 RBX: ffff888103668000 RCX: ffffffff85a394fd [ 126.128146][ C1] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 00000000001edcec [ 126.128157][ C1] RBP: ffffc900001a7e00 R08: ffff8881f6f395eb R09: 1ffff1103ede72bd [ 126.128171][ C1] R10: dffffc0000000000 R11: ffffed103ede72be R12: 0000000000000000 [ 126.128184][ C1] R13: 1ffff110206cd000 R14: dffffc0000000000 R15: ffffffff87ecb4e8 [ 126.128199][ C1] ? ct_kernel_exit+0x7d/0xb0 [ 126.128215][ C1] default_idle+0x17/0x30 [ 126.128231][ C1] arch_cpu_idle+0xd/0x20 [ 126.128247][ C1] default_idle_call+0x3e/0x80 [ 126.128263][ C1] do_idle+0x2fc/0x570 [ 126.128282][ C1] ? idle_inject_timer_fn+0x80/0x80 [ 126.128303][ C1] ? do_idle+0x549/0x570 [ 126.128322][ C1] cpu_startup_entry+0x47/0x60 [ 126.128341][ C1] start_secondary+0x12e/0x140 [ 126.128365][ C1] common_startup_64+0x13b/0x157 [ 126.128392][ C1] [ 126.128410][ C1] ---[ end trace ]--- [ 126.447955][ T36] audit: type=1400 audit(1784729574.970:371): avc: denied { read } for pid=92 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 126.472920][ T36] audit: type=1400 audit(1784729574.970:372): avc: denied { search } for pid=92 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 126.494519][ T36] audit: type=1400 audit(1784729574.970:373): avc: denied { write } for pid=92 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 126.516023][ T36] audit: type=1400 audit(1784729574.970:374): avc: denied { add_name } for pid=92 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 126.729591][ T780] usb 3-1: USB disconnect, device number 44 [ 126.735584][ C1] aiptek 3-1:0.0: aiptek_irq - usb_submit_urb failed with result -19