descriptor read/64, error 18 12:51:47 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x1000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:51:47 executing program 5: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x81, 0xe5, 0xa5, 0x40, 0xfe6, 0x9800, 0x5d6c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xd, 0x3, 0xfa}}]}}]}}, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2245.634004][T28562] usb 2-1: device descriptor read/64, error 18 [ 2245.764026][T28562] usb usb2-port1: attempt power cycle [ 2246.473838][T28562] usb 2-1: new high-speed USB device number 11 using dummy_hcd 12:51:48 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x81, 0xe5, 0xa5, 0x40, 0xfe6, 0x9800, 0x5d6c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xd, 0x3, 0xfa}}]}}]}}, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:51:48 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:51:48 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:51:48 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x2000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:51:48 executing program 5: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x81, 0xe5, 0xa5, 0x40, 0xfe6, 0x9800, 0x5d6c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xd, 0x3, 0xfa}}]}}]}}, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2246.633738][T28562] usb 2-1: device descriptor read/8, error -71 12:51:48 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x3000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:51:48 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2246.844724][T28562] usb 2-1: device descriptor read/8, error -71 [ 2246.913707][T10441] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 2246.921391][T10330] usb 4-1: new high-speed USB device number 113 using dummy_hcd 12:51:48 executing program 1: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010400090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe0000018bf31733df199e90905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) r1 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x2200, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) ioctl$BTRFS_IOC_TREE_SEARCH_V2(0xffffffffffffffff, 0xc0709411, &(0x7f0000000200)={{0x0, 0x101, 0x400, 0x8, 0x200, 0x3f, 0x7, 0x776, 0x7, 0x7, 0x1, 0xd4cf, 0x1ff, 0xff, 0x7}, 0x10, [0x0, 0x0]}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f00000019c0)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000059640)={0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}, {}, {}, {}, {}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}], 0x0, "784934ff0e8c19"}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000800)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f00000019c0)={0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000059640)={0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r5}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r6}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r5}, {}, {}, {}, {}, {}, {}, {}, {r2}, {}, {}, {}, {}, {0x0, r9}, {}, {}, {}, {}, {}, {0x0, r8}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r10}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r7}], 0x6, "784934ff0e8c19"}) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, &(0x7f0000000280)={r9, 0x0, "4b1726387700c4d71e6f388ffef599d14b317408f386b1a7b9849443ac2eee1bd6133aa07b00ec6dd56aef54a67ef826b4afd18545033d78dca9194196f74a36648b10b197c9309581cd459a34a85814c5dc2a958b463b8f340210c55b515ef6316a7bddf470a7c9a9e1245e0e6c48c491cf4fbc70c8fd068d6ea8e5c963f74afaf8bec8c36fd2b656fb8b601e67d821fee230588215b2335c1970d921056546fe5483f0dc46c20005d343718cc06907be98e96b0c13a7e5312859e06c4bca2c46d447bd6b21bf23256283d616ea95d7aad3a4aedf62110e8800874966f49c723dc9794819f970f911db02c64f6863097fe9d289bc2bc777be4e1a5fb143efdb", "095139f2c8014e467cb51cda882b5f1fd804a648046a0faa79becadabd04489da042451c246125570a7cbb5cfca63e0b68eade1a6bea7eef2ace4704e58d136ccf52db376c42be8a7a7fc9f8ec8d3bc7280d89200956f4078cd05f756251a934e371cc067b91285509075caaa6b72c7000448c832963b98420480331baeda9e13d9e09430454614c6f7762f9cbd26c28eafe723f1659efe0e3c1301a6e8fd092a268058756f2abe85c39a3b4694dd89ac88944c3294c3e93d2cb961d03928231185f22429e12516ea9397c02d4f02d8a0755c747dc5253eb795af7b7c95bab985b6b2633abc5a948b6442dff54ad329e06d1918c9bf52343e3a95feabc49f8faad709aa1668a311d687ba88a0b14277cf546c66069aafb7532eccf45fc55c45b3362c67bc1fedd248647f187c0cbb9182da7eb0ee48be4ab7105bdb44a972e8aec7b9b805e3483bc9c23fcba3d700a8c5c09834915d6c879ee06f4a04403b3733e28d2613f798e8405826a30c194c5b227692273bf00256c0137f67781baf2ccec0131fa5993520d2b9e412ae569be2e2641dc811fae6da3e267c1995e57e21dbfb42f08c0e49f8a148b1944df4ab9651ee8a495bb58027043ad989ae6d3c8b58e39310e6c0b719da13e135aafd2e13ea1e15d29cf0cbb37370d30c6fccdaff64e77287e9ed8ddb409e13319b6ac8b031a711e598fc536826abcaa74fda831227b4c9491926f3895d0a31267a954326406c01880d38ee3118ab446d5d0df5ce5e81606e985cc2ed28b1c82a7efd0fa723b9674d403c285278a7ae464c48a4502312718e420bf8daafbd969c7343469b7461742123ead4fe26ddf12d8fb352d14de95fb4c4b631d452f0be07ccca4238c78e471d6cb4e230742cf5c28350a3165f56c8647d5e45830e8bd94f21dc0c65bb6cb1b9ce4d7837cdb72a326b7f9d68d81027948c3dd38e822ac5fae26991e0a2b49d4385eb5eb2c5b73017c96897e9cd6eaef1f26e4ae0b77a0583f521243c9fa1bbc5a71258f91e6a570cd4759b31fdcaa24617d31582baf9a06fc9968f59af4c0b63fd78eb8c07539fca1a8863f2d6b20f8754c3bad92bc0e7113c1d642faabbf0fbeded1030a6166c115f92b864ac32903b79325fc8c4b06b61ac6fd6a633aaf5ee33cd8b7a82c82d34b029a6856de61c91f9aac0a3c6cb8793812f6284cd4c2b4b3d9440371545bc425102c2e1628e1b9a99c6fcbb75d166a1dec22b1235aa4f565f747d84f31ff50ddd290ff56ee3f5f33d4a972a94f34571df4ee225f0de07b6bd2b990c935a671df8a4c4ab3d7524b7ad168941f9fd82de197c2863297054c8e1f8c5726ef174ca3b1da0d5d33fdab13b1ed39f0aec5a4c3105b3ca606f95daf204c51b0436e17d9fa45de2fca2b1616eec333bb3027cf55370688da60b82c430febd53b92713465547b86b54e23c977237718cd4c8f7ddbeb61ec5d160fb5b4cd4eabf14055a957e68a8bd133dcce7cc9506ea54974c071e8db69272b2153d3c34e5d34997ccdb2e875f3b8da632dfcbb1a8cc08a609c8af88e9e83c7fdbb59e4d02f74f8162c77e14419a3986854462211d9d31466c26e7a429035d741618c387f81566ca3eb3afd49079a39618e7b322519636cb3a640adcd033bed621363f55ad1fd2434981ba739f1538726c49b2a5f648ca39e6da513f40490cb1a648928204a02ffb2b02816c4d664c7925197f13dd18732d0941947d4668642a5d37761d5f47cc00bedd9cd42c131128c403394787c3a6dd861359ac1a095fae5c8fbee71400f2dd44e874f0d9409ddd901ef2148d3f7e7f21f5bff7386b1ff235c272c0ea373414e0b14656afec347052fdc997c5a23919995fc692a5385ecef3740a159e2544ab94208ca9cfa46d25082d1051c790ccfa079671bdd0fe87991a2058a74db02fa8601441137bb09a4bf7207949263ec836a29ee4d233ec463a7273218251c3a3ad67cbc9a008d545fdaf8f4b2350ccc5d22beb13868ad42499844ca54eacd46e63fffa8db1623e29db682ae1000963db59e6dab12cf86c5153bd99ee02ed0b8e868c37ed1420b2c7284c301f8f3d8a71969d09d4ac8e83108bdf848deca8d028682ad66a9472b55c5a2d8a821d47f44b01728e1c8efa2cf128ef812ec2441b2e0dfb7eb81e47477e8456099638291e0e75ab5e549d53f2b0e2967217b796fc20f3496d1350dd0b9aeaa370e1466ff5239e5111c6fa11004bca5b54f28ea2c9d91a873904148591db103062503d514127c1a0e7a0e52765bfefe9392bcda570c7e0306cde2a1925e0c4208c67ca24127927862eda6fd94d219597340553f83a4422cc11078d9f471a13224f08286ca65affa4764980328b875b2adbc430f69a6482ad5a6272c2188a57694ffe4e0aa58a682c9f736799aeadf590f677e40748f53e2154eef2b731e2e6981fcafb902e51faad63ec16277e26ed411fb817a49444b05a3cee65162229296392a6ef82ef9b62cc35b34ad8318b8d905cd02f2d1a3784833cf1bb94229f5d729227251b1e5504e85cbe085753f914ccf88baad8590929783cbaa203907bd60c1585e4d00a192a34ddea59b94125e822299e309e2bf5d26bfdf5e31d32391fcd849c7a5249a76f3dd0d51e2de530379fef49744e442e6cba25e87a25b543400eeb5db90d23fff9d5f054069529281686935d5201683769e8cc757a4c0dcd848350cbcb062143dd7282b3acc5ee161d972c54a64db151ef2031200934afb08f883b2d9bd1c3947c291f08436149a19487b1e73bfe3a4dfa7c7da2ff2833ea95260a3f9e22cf8f97dd063712df0d7c6569c9922ccf43cbc9b67703e4eb6d7bc67c9c3318d46a6660ab7dc369394abbad6618d143b3e1438b5d59e71578f20ce3a8716cd992f8742e6f4459fa17f5764ce750951430a994d14cc570debb2e7c4554ec77b92559ef96235cd94925141c5b6a89f22eb5086244009f726d1f15ab4372b436d624d92d7860787ce0000e5b1890fc56e0957047a2ddf5ff1c55ac699641362772824cc9d9bb0ec33c7cd6a7d9b226a2e4a52e173956f94121023013db9767e9cd4734f6988bafb6968a97d828d975ef7e94df4bdb067697394e910e567fe769b5f7758302d6c116477ee49f99c8b408d31c99a3d4d8f7492179420dc220ef8c1b5e7751d41956dd8c4c59c971d92b6e37d866e24bb8e493c669e920aea471f20ed31a33704ff007466072b896a230cd39a348fd13bb1de08571b39224ed6456ebf94e59702ad0c180c416f79dea20656422983695834e37113bfaec1e5cb25c35329294423528db984cd20bbd651cf41c5d7a1a39d311b1ff6b4e4d8fee1169851e406b3e89c3da4a9e9a933ba042d363f06c6db0a5523411029f5bddbac81171feea853fff9bfe46605ec1368eccd0ffcb9b76320675a0c6ccf8bca3ff480b72fece584c0741430a72382845f525a877f94d0762867192c3c8b3b795ad65f031b84c4e79bbdb84c51e8ed89e45b96ba7fa15e23d28bf4b4c0cb2249e85266d05f70c8389c53cfdee5a916884658e319d8385d14a909ec1299a09de5cd294f664591c3464ce6c8159b48006b7cb09184fc024f953a160093be6110240d1dfdc9efd47b51632c35151cf135819e6d4a045164738c5fdddcff9c4aebc1da819be9823a22013abba61061ea86055d7fedf1b78fe6c5ac9391dc6f5c8a87849a825d886b3eab5a7967afb3a26ebb398bf652d6651dbc88860d9534cab8e4bbd0d2c765c649accf50f5c4c1688dc432e5fdc521b93cbd1f5606aa974eca4161306860659bb21a99eefced5eae944173df176c07b511268eb79ae62101d7b9afa3c0bcd5116b577eb035192d223cc5892044695b20fef1c7faae7ea61781519c46d3bedf4b3ffad4bebebc812a49be6b5281b12340e35ea73066e001e6e6d0ffc4f4b78c28a2e5cea47254bc16232b7d2c2138b43a4f73adb6595dffab2d686af24bf0fb55337d024b7b7782075badaf4daa2e938911c9e0d7be4caa3cce5790972fffebc781b421cdb6a0c438e108549164196ff15fde8f83f70caff4f5704c7ca0da235bc6eac4ac08f7e39be5f5ab916d1d91183d795c3981bfcbedc4bd917ff9b5e6bbfd2069949f1ad6a3449686c22615f0e930a1e1b2c10884702a738f58a850ee4bfd5f0fad0f8b78b709a09331722e37063e504bb50ef2a143879323897768510e69f9c2cb5c43cfcb3492bedcd900c39ced75aca1f2464323df17720a3764580374fdeb86df1584932aea3e6a56cf7797af60622ecb2b8b0cf488b2ec0ab09d08c4a4d2bc610d03836a4623594c734c5d9ecb4de8d1afe0f7907d02dd303dbc7822ea306602ab45ec3412c400adcb9259780508f6003b43a55143ff151d099f5cc2ad1cb0b5a3f6c1c514af73b0073849db2abe0edf4f41621eaf32a3f8aaaa3337abc458989255b05f7120de009ddd73f00001c540c658f4bff312a95b5df10d69a0a6924e9eb1006e632adb834b1a5a485cfd46943b64c2651f1821aba95013ea6b5c87c323f30a7588f37d4a60e0d410aaf3a1897fe7033f8e3a158efb9a75b299cab264c29510fec11f19dc4dce6ecaf180d061900e88aff06290a43fc60d49bdc5a166b4afd1e712fc6fd0581e94c19353f13176634ed48c1aa7cabb6a2ab1484e5e1c2ad9204e6767c9581266ae2f525c6ca2830edb3c19e9e3162185b7b41c7b8202ffd11cbd1a9e47468c5dba6ae9e5dfe5a9c2c73ed15897bf8d17d1534cc4c7b381658d63bc9680c6404983bb69de8290b78adc91c5d8a42b3d2fdb2faacf30639c66648d9bdc53dcade5faa6e5621eb5973d8318c9646ccffcf210f0f34c7c3dc3cdb4a16e40bdd8eee603d64a7864dff8db7f58fffa5adb6f139c0f6a2ab4e7587446cbbab07d3a1b9baff17aee54947317e87bc20494586dbba6bfd557fb986d1bcdf8eb1fa8332013d7ef0fd34c7230af5ace8f4018cec309cb8f34861fea3834521e35b288a69428f7ae2a7087aaea24d945776aa5c0bea31bf4d141637daa2e6def68bd8dd501c2a97bfcfd5d51be6d61b471f1de31aa20cfa8f11eb8b0714e436dfbf6c3e3dabe732c61bd6ec94522b0342f24d5ab9f8fd2b75670c4f4693cedb17c3cae663624c732b67b90f23e8e5a1515a9a13164490e278d25408f943af523b41e2418779bcda67c92a1e04393f7e28f780c90982607e4d74c65c9fa847295dcca113861566b16f9e94cb780681ff8a1845ec6774ba9b1f2fb2e08d5b9a1940872ab6113b8eec7cd79090429ba92f5fd5da928e54fd25bb5d287e7e92377599ca0053135e0aba6c09a97c2f162dbc00b957a05252d7c7895a121ea23311ebdf96ac364e91d52288d7a1a5b4efa9a7137575e32f6a713620ab133aa9df59a61"}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:51:48 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x4000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:51:48 executing program 5: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x81, 0xe5, 0xa5, 0x40, 0xfe6, 0x9800, 0x5d6c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xd, 0x3, 0xfa}}]}}]}}, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2247.163665][T10441] usb 1-1: Using ep0 maxpacket: 8 [ 2247.163702][T10330] usb 4-1: Using ep0 maxpacket: 8 12:51:48 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="0001"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2247.293105][T10330] warn_alloc: 1 callbacks suppressed [ 2247.293118][T10330] kworker/0:0: page allocation failure: order:4, mode:0x40cc0(GFP_KERNEL|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0 [ 2247.356009][T10330] CPU: 0 PID: 10330 Comm: kworker/0:0 Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2247.365911][T10330] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2247.375970][T10330] Workqueue: usb_hub_wq hub_event [ 2247.381009][T10330] Call Trace: [ 2247.384287][T10330] dump_stack+0x1b0/0x21e [ 2247.388610][T10330] ? devkmsg_release+0x11c/0x11c [ 2247.393537][T10330] ? show_regs_print_info+0x12/0x12 [ 2247.398720][T10330] warn_alloc+0x1ee/0x340 [ 2247.403035][T10330] ? zone_watermark_ok_safe+0x420/0x420 [ 2247.408657][T10330] __alloc_pages_slowpath+0x1c98/0x1cb0 [ 2247.414192][T10330] ? process_one_work+0x777/0xf90 [ 2247.419211][T10330] ? get_page_from_freelist+0x7c0/0x7c0 [ 2247.424750][T10330] ? __zone_watermark_ok+0x91/0x280 [ 2247.429938][T10330] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2247.435298][T10330] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2247.440827][T10330] ? usb_anchor_empty+0x40/0x40 [ 2247.445660][T10330] ? setup_fault_attr+0x2b0/0x2b0 [ 2247.450667][T10330] ? wait_for_common+0x486/0x570 [ 2247.455587][T10330] kmalloc_order_trace+0x2a/0xf0 [ 2247.460517][T10330] __kmalloc+0x268/0x2c0 [ 2247.464748][T10330] usb_get_configuration+0x326/0x4920 [ 2247.470103][T10330] ? _raw_spin_lock_irqsave+0xda/0x1c0 [ 2247.475547][T10330] ? slab_free_freelist_hook+0xd0/0x150 [ 2247.481075][T10330] ? trace_rpm_return_int_rcuidle+0x23/0x1d0 [ 2247.487036][T10330] ? rpm_resume+0xa29/0x19b0 [ 2247.491633][T10330] ? usb_destroy_configuration+0x580/0x580 [ 2247.497422][T10330] ? _raw_spin_lock_irq+0xa2/0x180 [ 2247.502512][T10330] ? _raw_spin_lock_irqsave+0x1c0/0x1c0 [ 2247.508041][T10330] ? pm_runtime_forbid+0xa7/0xf0 [ 2247.512964][T10330] usb_new_device+0x155/0x1710 [ 2247.517716][T10330] ? hub_port_init+0x1e9e/0x30e0 [ 2247.522639][T10330] ? _raw_spin_lock_irq+0xa2/0x180 [ 2247.527732][T10330] ? usb_disconnect+0x880/0x880 [ 2247.532568][T10330] hub_event+0x2a5b/0x4d50 [ 2247.536971][T10330] ? led_work+0x530/0x530 [ 2247.541281][T10330] ? pm_schedule_suspend+0x1d0/0x1d0 [ 2247.546548][T10330] ? _raw_spin_lock+0x170/0x170 [ 2247.551383][T10330] ? mutex_lock+0xa6/0x110 [ 2247.555781][T10330] ? _raw_spin_lock_irq+0xa2/0x180 [ 2247.560875][T10330] ? read_word_at_a_time+0xe/0x20 [ 2247.565884][T10330] ? strscpy+0xa6/0x260 [ 2247.570029][T10330] process_one_work+0x777/0xf90 [ 2247.574862][T10330] worker_thread+0xa8f/0x1430 [ 2247.579526][T10330] kthread+0x317/0x340 [ 2247.583580][T10330] ? process_one_work+0xf90/0xf90 [ 2247.588593][T10330] ? kthread_destroy_worker+0x270/0x270 [ 2247.594125][T10330] ret_from_fork+0x1f/0x30 [ 2247.615580][T10441] usb 1-1: out of memory [ 2247.625671][T10441] usb 1-1: can't read configurations, error -12 [ 2247.634090][T10330] Mem-Info: [ 2247.637286][T10330] active_anon:1406438 inactive_anon:4736 isolated_anon:0 [ 2247.637286][T10330] active_file:274 inactive_file:263 isolated_file:0 [ 2247.637286][T10330] unevictable:0 dirty:13 writeback:0 unstable:0 [ 2247.637286][T10330] slab_reclaimable:9537 slab_unreclaimable:97506 [ 2247.637286][T10330] mapped:55549 shmem:4831 pagetables:30305 bounce:0 [ 2247.637286][T10330] free:14343 free_pcp:1034 free_cma:0 [ 2247.675271][T28562] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 2247.683248][T10330] Node 0 active_anon:5625804kB inactive_anon:18944kB active_file:1960kB inactive_file:2568kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:223624kB dirty:72kB writeback:0kB shmem:19324kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2247.707635][T10330] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2247.740678][T10330] lowmem_reserve[]: 0 2912 6416 6416 [ 2247.746441][T10330] DMA32 free:21208kB min:4644kB low:7624kB high:10604kB active_anon:2899720kB inactive_anon:8220kB active_file:580kB inactive_file:300kB unevictable:0kB writepending:0kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1376kB pagetables:744kB bounce:0kB free_pcp:1852kB local_pcp:548kB free_cma:0kB [ 2247.776083][T10330] lowmem_reserve[]: 0 0 3504 3504 [ 2247.781123][T10330] Normal free:16696kB min:9688kB low:13276kB high:16864kB active_anon:2725700kB inactive_anon:10724kB active_file:1792kB inactive_file:2068kB unevictable:0kB writepending:52kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:34656kB pagetables:120564kB bounce:0kB free_pcp:1340kB local_pcp:848kB free_cma:0kB [ 2247.811262][T28562] usb 2-1: Using ep0 maxpacket: 8 [ 2247.811341][T10441] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 2247.824948][T10330] lowmem_reserve[]: 0 0 0 0 [ 2247.829518][T10330] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2247.843160][T10330] DMA32: 325*4kB (UME) 313*8kB (UMEH) 235*16kB (UMEH) 49*32kB (UMEH) 37*64kB (UMEH) 13*128kB (UEH) 9*256kB (UH) 6*512kB (UM) 3*1024kB (M) 0*2048kB 0*4096kB = 21612kB [ 2247.860110][T10330] Normal: 140*4kB (MEH) 579*8kB (UMEH) 668*16kB (UEH) 7*32kB (H) 7*64kB (H) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 16552kB [ 2247.874741][T10330] 6045 total pagecache pages [ 2247.879527][T10330] 0 pages in swap cache [ 2247.883946][T10330] Swap cache stats: add 0, delete 0, find 0/0 [ 2247.890364][T10330] Free swap = 0kB [ 2247.894468][T10330] Total swap = 0kB [ 2247.898468][T10330] 1965979 pages RAM [ 2247.902664][T10330] 0 pages HighMem/MovableOnly [ 2247.908268][T10330] 318041 pages reserved [ 2247.923706][T10330] 0 pages cma reserved [ 2247.928623][T10330] usb 4-1: out of memory [ 2247.939291][T10330] usb 4-1: can't read configurations, error -12 [ 2247.981479][ T339] syz-fuzzer invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 2247.993345][T28562] usb 2-1: out of memory [ 2247.997596][T28562] usb 2-1: can't read configurations, error -12 [ 2248.009895][ T339] CPU: 0 PID: 339 Comm: syz-fuzzer Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2248.019519][ T339] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2248.029554][ T339] Call Trace: [ 2248.032826][ T339] dump_stack+0x1b0/0x21e [ 2248.037129][ T339] ? devkmsg_release+0x11c/0x11c [ 2248.042036][ T339] ? ___ratelimit+0x3bf/0x560 [ 2248.046684][ T339] ? show_regs_print_info+0x12/0x12 [ 2248.051852][ T339] ? _raw_spin_lock+0xa1/0x170 [ 2248.056587][ T339] ? radix_tree_cpu_dead+0x160/0x160 [ 2248.061845][ T339] dump_header+0xdb/0x700 [ 2248.066148][ T339] oom_kill_process+0xd3/0x280 [ 2248.070889][ T339] out_of_memory+0x5b6/0x890 [ 2248.075450][ T339] ? unregister_oom_notifier+0x20/0x20 [ 2248.080902][ T339] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2248.086418][ T339] ? get_page_from_freelist+0x7c0/0x7c0 [ 2248.091933][ T339] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2248.097274][ T339] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2248.102787][ T339] pagecache_get_page+0x522/0x8a0 [ 2248.107777][ T339] filemap_fault+0x1435/0x1990 [ 2248.112518][ T339] ? __down_read+0xf1/0x210 [ 2248.116998][ T339] ? generic_file_read_iter+0x20a0/0x20a0 [ 2248.122683][ T339] ? mm_trace_rss_stat+0x41/0x1a0 [ 2248.127675][ T339] ext4_filemap_fault+0x7b/0x90 [ 2248.132493][ T339] handle_mm_fault+0x291e/0x4140 [ 2248.137409][ T339] ? finish_fault+0x230/0x230 [ 2248.142053][ T339] ? __ia32_sys_sigaltstack+0x60/0x60 [ 2248.147408][ T339] ? down_read_trylock+0x17a/0x1d0 [ 2248.152489][ T339] ? __se_sys_futex+0x31d/0x440 [ 2248.157307][ T339] ? vmacache_find+0x205/0x4b0 [ 2248.162043][ T339] do_user_addr_fault+0x48a/0x9f0 [ 2248.167036][ T339] page_fault+0x2f/0x40 [ 2248.171170][ T339] RIP: 0033:0x4c0f00 [ 2248.175130][ T339] Code: Bad RIP value. [ 2248.179163][ T339] RSP: 002b:000000c014041130 EFLAGS: 00010246 [ 2248.185205][ T339] RAX: 0000000000000000 RBX: 00000000000006dd RCX: 0000000000000000 [ 2248.193145][ T339] RDX: 000000000000088b RSI: 000000c001004400 RDI: 000000c01410a040 [ 2248.201084][ T339] RBP: 000000c0140412e8 R08: 000000c0000c42c0 R09: 0000000000000001 [ 2248.209034][ T339] R10: 0000000000000002 R11: 000000c010d38000 R12: 0000000000001980 [ 2248.219923][ T339] R13: 0000000000000043 R14: 0000000000000200 R15: 0000000000000200 [ 2248.229737][T28562] usb usb2-port1: unable to enumerate USB device [ 2248.253370][ T339] Mem-Info: [ 2248.256722][ T339] active_anon:1406542 inactive_anon:4736 isolated_anon:0 [ 2248.256722][ T339] active_file:505 inactive_file:398 isolated_file:66 [ 2248.256722][ T339] unevictable:0 dirty:25 writeback:0 unstable:0 [ 2248.256722][ T339] slab_reclaimable:9537 slab_unreclaimable:97676 [ 2248.256722][ T339] mapped:56102 shmem:4831 pagetables:30336 bounce:0 [ 2248.256722][ T339] free:13261 free_pcp:1301 free_cma:0 [ 2248.295757][ T339] Node 0 active_anon:5626228kB inactive_anon:18940kB active_file:2076kB inactive_file:1580kB unevictable:0kB isolated(anon):0kB isolated(file):264kB mapped:224240kB dirty:136kB writeback:24kB shmem:19324kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2248.303341][T10441] usb 1-1: Using ep0 maxpacket: 8 [ 2248.320774][ T339] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2248.325359][T10330] usb 4-1: new high-speed USB device number 114 using dummy_hcd [ 2248.368036][ T339] lowmem_reserve[]: 0 2912 6416 6416 [ 2248.403363][ T339] DMA32 free:22248kB min:4644kB low:7624kB high:10604kB active_anon:2900104kB inactive_anon:8220kB active_file:924kB inactive_file:900kB unevictable:0kB writepending:72kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1376kB pagetables:828kB bounce:0kB free_pcp:1464kB local_pcp:216kB free_cma:0kB [ 2248.476352][ T339] lowmem_reserve[]: 0 0 3504 3504 [ 2248.481578][ T339] Normal free:20092kB min:5592kB low:9180kB high:12768kB active_anon:2726124kB inactive_anon:10720kB active_file:440kB inactive_file:612kB unevictable:0kB writepending:92kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:34624kB pagetables:120636kB bounce:0kB free_pcp:1960kB local_pcp:1272kB free_cma:0kB [ 2248.511716][ T339] lowmem_reserve[]: 0 0 0 0 [ 2248.516286][ T339] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2248.529560][ T339] DMA32: 331*4kB (UME) 353*8kB (UMEH) 268*16kB (UMEH) 64*32kB (UMEH) 47*64kB (UMEH) 18*128kB (UMEH) 10*256kB (UMH) 3*512kB (U) 2*1024kB (M) 0*2048kB 0*4096kB = 21940kB [ 2248.546348][ T339] Normal: 748*4kB (UMEH) 661*8kB (UMEH) 669*16kB (UMEH) 17*32kB (UMEH) 7*64kB (H) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 19976kB [ 2248.566153][ T339] 5259 total pagecache pages [ 2248.570746][ T339] 0 pages in swap cache [ 2248.574924][T10330] usb 4-1: Using ep0 maxpacket: 8 [ 2248.579986][ T339] Swap cache stats: add 0, delete 0, find 0/0 [ 2248.586197][ T339] Free swap = 0kB [ 2248.590020][ T339] Total swap = 0kB [ 2248.596070][ T339] 1965979 pages RAM [ 2248.600064][ T339] 0 pages HighMem/MovableOnly [ 2248.604827][T10441] usb 1-1: config index 0 descriptor too short (expected 65316, got 36) [ 2248.613280][ T339] 318041 pages reserved [ 2248.617420][ T339] 0 pages cma reserved [ 2248.621908][T10441] usb 1-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2248.630821][ T339] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.0,pid=6500,uid=0 [ 2248.645127][T10441] usb 1-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2248.679938][ T339] Out of memory: Killed process 6500 (syz-executor.0) total-vm:85484kB, anon-rss:16580kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:160kB oom_score_adj:1000 [ 2248.696525][T10441] usb 1-1: config 5 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 [ 2248.707654][T10441] usb 1-1: config 5 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2248.718293][T10330] usb 4-1: config index 0 descriptor too short (expected 65316, got 36) [ 2248.727887][T10330] usb 4-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2248.736592][T10441] usb 1-1: config 5 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 65 [ 2248.746424][T10330] usb 4-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2248.755643][T10441] usb 1-1: config 5 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 2248.768887][T10330] usb 4-1: config 5 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 12:51:50 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="0002"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2248.780005][T10330] usb 4-1: config 5 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2248.790124][T10330] usb 4-1: config 5 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 65 [ 2248.801230][T10330] usb 4-1: config 5 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 2248.883157][T10441] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2248.893515][T10441] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2248.901586][T10441] usb 1-1: SerialNumber: syz [ 2248.923117][T11333] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2248.930047][T11333] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2248.953450][T10441] hub 1-1:5.0: bad descriptor, ignoring hub [ 2248.959471][T10330] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2248.968697][T10441] hub: probe of 1-1:5.0 failed with error -5 [ 2248.977953][T10330] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2248.987175][T10330] usb 4-1: SerialNumber: syz [ 2249.013067][T11331] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2249.048356][T11331] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2249.063410][T10330] hub 4-1:5.0: bad descriptor, ignoring hub [ 2249.069401][T10330] hub: probe of 4-1:5.0 failed with error -5 [ 2249.159100][T11333] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2249.168905][T11333] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2249.193031][T10441] usblp: can't set desired altsetting 0 on interface 0 [ 2249.223578][T10441] usb 1-1: USB disconnect, device number 17 [ 2249.266505][T11331] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2249.292996][T10330] usblp: can't set desired altsetting 0 on interface 0 [ 2249.324059][T10330] usb 4-1: USB disconnect, device number 114 12:51:51 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x81, 0xe5, 0xa5, 0x40, 0xfe6, 0x9800, 0x5d6c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xd, 0x3, 0xfa}}]}}]}}, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:51:51 executing program 5: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:51:51 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x5000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:51:51 executing program 3: syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:51:51 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:51:51 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="0001"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:51:51 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x6000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2249.965063][T16300] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 2250.062790][T10330] usb 4-1: new high-speed USB device number 115 using dummy_hcd 12:51:51 executing program 1: ioctl$FS_IOC_GET_ENCRYPTION_NONCE(0xffffffffffffffff, 0x8010661b, &(0x7f0000000000)) r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082500749809e00000090582024100"/36], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) setsockopt$inet6_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x29, 0x2d, &(0x7f0000000140)={0x4, {{0xa, 0xe20, 0x5, @remote, 0x1}}}, 0x88) syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$VT_ACTIVATE(0xffffffffffffffff, 0x5606, 0x583e) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r1, 0x407, 0x0) write(r1, &(0x7f00000007c0)="30eb2297b18c0a2ada6f46f8341ce63ccdab668e820dabde", 0x41395563) ioctl$PIO_CMAP(r1, 0x4b71, &(0x7f0000000040)={0x20, 0x4, 0x3, 0x400, 0x6f, 0x2800000}) 12:51:51 executing program 5: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2250.212753][T16300] usb 1-1: Using ep0 maxpacket: 8 [ 2250.332685][T10330] usb 4-1: device descriptor read/64, error 18 [ 2250.372714][T16300] usb 1-1: config index 0 descriptor too short (expected 65316, got 36) [ 2250.381199][T16300] usb 1-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2250.411314][T16300] usb 1-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2250.437060][T16300] usb 1-1: config 5 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 [ 2250.448260][T16300] usb 1-1: config 5 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2250.460708][T16300] usb 1-1: config 5 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 65 [ 2250.470760][T16300] usb 1-1: config 5 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 12:51:52 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x6200000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2250.591421][T16300] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2250.601383][T16300] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2250.610386][T16300] usb 1-1: SerialNumber: syz [ 2250.742557][T10330] usb 4-1: device descriptor read/64, error 18 [ 2250.792526][T10441] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 2250.834036][ T133] systemd-journal invoked oom-killer: gfp_mask=0x40cc0(GFP_KERNEL|__GFP_COMP), order=1, oom_score_adj=0 [ 2250.853894][ T133] CPU: 0 PID: 133 Comm: systemd-journal Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2250.863981][ T133] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2250.874024][ T133] Call Trace: [ 2250.877303][ T133] dump_stack+0x1b0/0x21e [ 2250.881604][ T133] ? devkmsg_release+0x11c/0x11c [ 2250.886510][ T133] ? ___ratelimit+0x3bf/0x560 [ 2250.891156][ T133] ? show_regs_print_info+0x12/0x12 [ 2250.896326][ T133] ? _raw_spin_lock+0xa1/0x170 [ 2250.901073][ T133] ? radix_tree_cpu_dead+0x160/0x160 [ 2250.906327][ T133] dump_header+0xdb/0x700 [ 2250.910629][ T133] oom_kill_process+0xd3/0x280 [ 2250.915360][ T133] out_of_memory+0x5b6/0x890 [ 2250.919918][ T133] ? unregister_oom_notifier+0x20/0x20 [ 2250.925346][ T133] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2250.930877][ T133] ? get_page_from_freelist+0x7c0/0x7c0 [ 2250.936391][ T133] ? __zone_watermark_ok+0x91/0x280 [ 2250.941561][ T133] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2250.946903][ T133] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2250.952418][ T133] ? __secure_computing+0x250/0x250 [ 2250.957602][ T133] alloc_slab_page+0x3a/0x390 [ 2250.962246][ T133] new_slab+0x408/0x450 [ 2250.966371][ T133] ___slab_alloc+0x2e0/0x450 [ 2250.970943][ T133] ? filename_create+0xd3/0x6f0 [ 2250.975761][ T133] ? getname_flags+0xb8/0x610 [ 2250.980418][ T133] ? getname_flags+0xb8/0x610 [ 2250.985189][ T133] kmem_cache_alloc+0x230/0x250 [ 2250.990009][ T133] ? __secure_computing+0x1b6/0x250 [ 2250.995174][ T133] getname_flags+0xb8/0x610 [ 2250.999745][ T133] do_sys_open+0x2fc/0x620 [ 2251.004129][ T133] ? file_open_root+0x440/0x440 [ 2251.008947][ T133] do_syscall_64+0xcb/0x150 [ 2251.013422][ T133] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2251.019281][ T133] RIP: 0033:0x7fa0c80ff840 [ 2251.023668][ T133] Code: 73 01 c3 48 8b 0d 68 77 20 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 89 bb 20 00 00 75 10 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 1e f6 ff ff 48 89 04 24 [ 2251.043239][ T133] RSP: 002b:00007fff5426e188 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 2251.051617][ T133] RAX: ffffffffffffffda RBX: 00007fff5426e490 RCX: 00007fa0c80ff840 [ 2251.059561][ T133] RDX: 00000000000001a0 RSI: 0000000000080042 RDI: 000055e5076f0610 [ 2251.067515][ T133] RBP: 000000000000000d R08: 00000000000001e0 R09: 00000000ffffffff [ 2251.075459][ T133] R10: 0000000000000069 R11: 0000000000000246 R12: 00000000ffffffff [ 2251.083403][ T133] R13: 000055e5076e3060 R14: 00007fff5426e450 R15: 000055e5076f0960 [ 2251.110562][ T133] Mem-Info: [ 2251.114204][ T133] active_anon:1407162 inactive_anon:4735 isolated_anon:0 [ 2251.114204][ T133] active_file:170 inactive_file:399 isolated_file:45 [ 2251.114204][ T133] unevictable:0 dirty:49 writeback:0 unstable:0 [ 2251.114204][ T133] slab_reclaimable:9517 slab_unreclaimable:97844 [ 2251.114204][ T133] mapped:55573 shmem:4831 pagetables:30392 bounce:0 [ 2251.114204][ T133] free:13958 free_pcp:65 free_cma:0 [ 2251.167343][ T133] Node 0 active_anon:5628648kB inactive_anon:18940kB active_file:580kB inactive_file:1592kB unevictable:0kB isolated(anon):0kB isolated(file):52kB mapped:222292kB dirty:0kB writeback:0kB shmem:19324kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2251.196654][ T133] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2251.232437][ T133] lowmem_reserve[]: 0 2912 6416 6416 [ 2251.249646][ T133] DMA32 free:18448kB min:4644kB low:7624kB high:10604kB active_anon:2899000kB inactive_anon:8224kB active_file:604kB inactive_file:2384kB unevictable:0kB writepending:132kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1472kB pagetables:1148kB bounce:0kB free_pcp:764kB local_pcp:252kB free_cma:0kB [ 2251.279123][T10441] usb 2-1: Using ep0 maxpacket: 8 [ 2251.284185][T10330] usb 4-1: new high-speed USB device number 116 using dummy_hcd [ 2251.293956][ T133] lowmem_reserve[]: 0 0 3504 3504 [ 2251.299291][ T133] Normal free:18256kB min:24744kB low:28332kB high:31920kB active_anon:2729316kB inactive_anon:10716kB active_file:864kB inactive_file:600kB unevictable:0kB writepending:4kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:34560kB pagetables:120604kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2251.329365][ T133] lowmem_reserve[]: 0 0 0 0 [ 2251.334304][ T133] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2251.348029][ T133] DMA32: 217*4kB (UE) 283*8kB (UMEH) 239*16kB (UMEH) 38*32kB (UEH) 35*64kB (UEH) 12*128kB (MEH) 4*256kB (UMH) 4*512kB (UM) 1*1024kB (M) 1*2048kB (M) 0*4096kB = 18092kB [ 2251.365982][ T133] Normal: 437*4kB (UMEH) 614*8kB (UMEH) 670*16kB (UEH) 36*32kB (UMEH) 7*64kB (H) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 18980kB [ 2251.380819][ T133] 5870 total pagecache pages [ 2251.385763][ T133] 0 pages in swap cache [ 2251.390035][ T133] Swap cache stats: add 0, delete 0, find 0/0 [ 2251.404729][ T133] Free swap = 0kB [ 2251.408810][ T133] Total swap = 0kB [ 2251.419021][ T133] 1965979 pages RAM [ 2251.423328][ T133] 0 pages HighMem/MovableOnly [ 2251.428332][ T133] 318041 pages reserved [ 2251.432809][ T133] 0 pages cma reserved [ 2251.437163][ T133] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.3,pid=32329,uid=0 [ 2251.455911][ T133] Out of memory: Killed process 32329 (syz-executor.3) total-vm:85484kB, anon-rss:16576kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:164kB oom_score_adj:1000 12:51:53 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:51:53 executing program 5: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2251.622366][T11386] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2251.629440][T11386] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2251.643602][T16300] hub 1-1:5.0: bad descriptor, ignoring hub [ 2251.649998][T16300] hub: probe of 1-1:5.0 failed with error -5 12:51:53 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00 ']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2251.682498][T10441] usb 2-1: config index 0 descriptor too short (expected 65, got 36) [ 2251.691637][T10441] usb 2-1: invalid descriptor for config index 0: type = 0x2, length = 130 [ 2251.702359][T10441] usb 2-1: can't read configurations, error -22 [ 2251.852289][T10330] usb 4-1: device descriptor read/64, error 18 [ 2251.872269][T10441] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 2251.933273][T11386] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2251.943747][T11386] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2251.953045][T16300] usblp: can't set desired altsetting 0 on interface 0 [ 2251.982802][T16300] usb 1-1: USB disconnect, device number 18 [ 2252.142149][T10441] usb 2-1: Using ep0 maxpacket: 8 [ 2252.252158][T10330] usb 4-1: device descriptor read/64, error 18 [ 2252.272160][T10441] usb 2-1: config index 0 descriptor too short (expected 65, got 36) [ 2252.280400][T10441] usb 2-1: invalid descriptor for config index 0: type = 0x2, length = 130 [ 2252.289617][T10441] usb 2-1: can't read configurations, error -22 [ 2252.296259][T10441] usb usb2-port1: attempt power cycle [ 2252.372135][T10330] usb usb4-port1: attempt power cycle 12:51:54 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x7000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:51:54 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2252.653560][ T144] systemd-udevd invoked oom-killer: gfp_mask=0x40cc0(GFP_KERNEL|__GFP_COMP), order=1, oom_score_adj=-1000 [ 2252.682231][ T144] CPU: 0 PID: 144 Comm: systemd-udevd Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2252.692130][ T144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2252.702172][ T144] Call Trace: [ 2252.705453][ T144] dump_stack+0x1b0/0x21e [ 2252.709765][ T144] ? devkmsg_release+0x11c/0x11c [ 2252.714686][ T144] ? ___ratelimit+0x3bf/0x560 [ 2252.719421][ T144] ? show_regs_print_info+0x12/0x12 [ 2252.724597][ T144] ? _raw_spin_lock+0xa1/0x170 [ 2252.729417][ T144] ? radix_tree_cpu_dead+0x160/0x160 [ 2252.734686][ T144] dump_header+0xdb/0x700 [ 2252.738999][ T144] oom_kill_process+0xd3/0x280 [ 2252.743752][ T144] out_of_memory+0x5b6/0x890 [ 2252.748315][ T144] ? unregister_oom_notifier+0x20/0x20 [ 2252.753742][ T144] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2252.759256][ T144] ? get_page_from_freelist+0x7c0/0x7c0 [ 2252.764772][ T144] ? __zone_watermark_ok+0x91/0x280 [ 2252.769940][ T144] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2252.775281][ T144] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2252.780800][ T144] ? __secure_computing+0x250/0x250 [ 2252.785968][ T144] alloc_slab_page+0x3a/0x390 [ 2252.790615][ T144] new_slab+0x408/0x450 [ 2252.794741][ T144] ___slab_alloc+0x2e0/0x450 [ 2252.799298][ T144] ? _raw_spin_lock+0x170/0x170 [ 2252.804121][ T144] ? getname_flags+0xb8/0x610 [ 2252.808765][ T144] ? getname_flags+0xb8/0x610 [ 2252.813408][ T144] kmem_cache_alloc+0x230/0x250 [ 2252.818227][ T144] ? __secure_computing+0x1b6/0x250 [ 2252.823399][ T144] getname_flags+0xb8/0x610 [ 2252.827889][ T144] do_sys_open+0x2fc/0x620 [ 2252.832274][ T144] ? file_open_root+0x440/0x440 [ 2252.837095][ T144] do_syscall_64+0xcb/0x150 [ 2252.841567][ T144] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2252.847428][ T144] RIP: 0033:0x7f335dcbb840 [ 2252.851814][ T144] Code: 73 01 c3 48 8b 0d 68 77 20 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 89 bb 20 00 00 75 10 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 1e f6 ff ff 48 89 04 24 [ 2252.871385][ T144] RSP: 002b:00007ffca55b7468 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 2252.879769][ T144] RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007f335dcbb840 [ 2252.887710][ T144] RDX: 00000000000001a4 RSI: 0000000000080141 RDI: 000055cd61e7a369 [ 2252.895662][ T144] RBP: 000055cd61e7a369 R08: 0000000020000000 R09: 0000000000000008 [ 2252.903605][ T144] R10: eb51d6ef2af87784 R11: 0000000000000246 R12: 000055cd635b2a60 [ 2252.911548][ T144] R13: 00000000fffffffe R14: 0000000000000000 R15: 0000000000000001 [ 2252.943958][ T144] Mem-Info: [ 2252.957650][ T144] active_anon:1408023 inactive_anon:4735 isolated_anon:0 [ 2252.957650][ T144] active_file:373 inactive_file:419 isolated_file:45 [ 2252.957650][ T144] unevictable:0 dirty:0 writeback:0 unstable:0 [ 2252.957650][ T144] slab_reclaimable:9512 slab_unreclaimable:97736 [ 2252.957650][ T144] mapped:55960 shmem:4831 pagetables:30430 bounce:0 [ 2252.957650][ T144] free:12831 free_pcp:84 free_cma:0 [ 2252.995606][ T144] Node 0 active_anon:5632092kB inactive_anon:18940kB active_file:1492kB inactive_file:1676kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:223740kB dirty:0kB writeback:0kB shmem:19324kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2253.019788][ T144] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2253.075677][ T144] lowmem_reserve[]: 0 2912 6416 6416 [ 2253.095655][ T144] DMA32 free:17196kB min:4644kB low:7624kB high:10604kB active_anon:2903988kB inactive_anon:8216kB active_file:516kB inactive_file:84kB unevictable:0kB writepending:36kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1440kB pagetables:1052kB bounce:0kB free_pcp:152kB local_pcp:96kB free_cma:0kB [ 2253.136775][ T144] lowmem_reserve[]: 0 0 3504 3504 [ 2253.142275][ T144] Normal free:17688kB min:5592kB low:9180kB high:12768kB active_anon:2728668kB inactive_anon:10724kB active_file:1112kB inactive_file:1364kB unevictable:0kB writepending:216kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:34592kB pagetables:120668kB bounce:0kB free_pcp:620kB local_pcp:308kB free_cma:0kB [ 2253.172576][ T144] lowmem_reserve[]: 0 0 0 0 [ 2253.177507][ T144] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2253.191555][ T144] DMA32: 305*4kB (UME) 283*8kB (UMEH) 240*16kB (UMEH) 48*32kB (UMEH) 37*64kB (UEH) 11*128kB (EH) 3*256kB (UMH) 3*512kB (U) 1*1024kB (M) 1*2048kB (M) 0*4096kB = 18012kB [ 2253.211840][T10441] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 2253.234784][ T144] Normal: 233*4kB (UH) 546*8kB (UEH) 668*16kB (UEH) 10*32kB (UH) 7*64kB (H) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 16756kB [ 2253.256000][ T144] 5647 total pagecache pages [ 2253.260635][ T144] 0 pages in swap cache [ 2253.265015][ T144] Swap cache stats: add 0, delete 0, find 0/0 [ 2253.271098][ T144] Free swap = 0kB [ 2253.274844][ T144] Total swap = 0kB [ 2253.278573][ T144] 1965979 pages RAM [ 2253.282398][ T144] 0 pages HighMem/MovableOnly [ 2253.287223][ T144] 318041 pages reserved [ 2253.291367][ T144] 0 pages cma reserved [ 2253.295467][ T144] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.3,pid=32273,uid=0 [ 2253.309935][ T144] Out of memory: Killed process 32273 (syz-executor.3) total-vm:85484kB, anon-rss:16576kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:164kB oom_score_adj:1000 [ 2253.321867][T10441] usb 2-1: Using ep0 maxpacket: 8 12:51:55 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:51:55 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x8000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:51:55 executing program 3: syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:51:55 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:51:55 executing program 1: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x12e390, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:51:55 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2253.442198][T10441] usb 2-1: config index 0 descriptor too short (expected 65, got 36) [ 2253.450318][T10441] usb 2-1: invalid descriptor for config index 0: type = 0x2, length = 130 [ 2253.461141][T10441] usb 2-1: can't read configurations, error -22 12:51:55 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="0003"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:51:55 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2253.741898][T16300] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 2253.811756][T10330] usb 4-1: new high-speed USB device number 117 using dummy_hcd [ 2253.861651][T10441] usb 2-1: new high-speed USB device number 16 using dummy_hcd 12:51:55 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x8800000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2253.961690][T10441] usb 2-1: Using ep0 maxpacket: 8 [ 2253.991657][T16300] usb 1-1: Using ep0 maxpacket: 8 [ 2253.991681][T10330] usb 4-1: device descriptor read/8, error -61 [ 2254.381583][T10330] usb 4-1: device descriptor read/8, error -61 [ 2254.561545][T16300] usb 1-1: config index 0 descriptor too short (expected 65316, got 36) [ 2254.569968][T16300] usb 1-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2254.578722][T16300] usb 1-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2254.587862][T16300] usb 1-1: config 5 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 [ 2254.598857][T16300] usb 1-1: config 5 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2254.609063][T16300] usb 1-1: config 5 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 65 [ 2254.621066][T16300] usb 1-1: config 5 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 12:51:56 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x9000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:51:56 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:51:56 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2254.661500][T10330] usb 4-1: new high-speed USB device number 118 using dummy_hcd [ 2254.670367][T10441] usb 2-1: config index 0 descriptor too short (expected 65316, got 36) [ 2254.679618][T10441] usb 2-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2254.690249][T10441] usb 2-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2254.699600][T10441] usb 2-1: config 5 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 [ 2254.710753][T10441] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2254.713141][T16300] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2254.720882][T10441] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 65 [ 2254.732227][T16300] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2254.740874][T10441] usb 2-1: config 5 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 2254.755780][T16300] usb 1-1: SerialNumber: syz [ 2254.781468][T11462] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2254.788534][T11462] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2254.801952][T16300] hub 1-1:5.0: bad descriptor, ignoring hub [ 2254.808263][T16300] hub: probe of 1-1:5.0 failed with error -5 [ 2254.881510][T11505] systemd-udevd invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 2254.896718][T11505] CPU: 1 PID: 11505 Comm: systemd-udevd Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2254.906782][T11505] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2254.916824][T11505] Call Trace: [ 2254.920108][T11505] dump_stack+0x1b0/0x21e [ 2254.924424][T11505] ? devkmsg_release+0x11c/0x11c [ 2254.929351][T11505] ? ___ratelimit+0x3bf/0x560 [ 2254.934013][T11505] ? show_regs_print_info+0x12/0x12 [ 2254.939202][T11505] ? _raw_spin_lock+0xa1/0x170 [ 2254.943949][T11505] ? radix_tree_cpu_dead+0x160/0x160 [ 2254.949221][T11505] dump_header+0xdb/0x700 [ 2254.953542][T11505] oom_kill_process+0xd3/0x280 [ 2254.958298][T11505] out_of_memory+0x5b6/0x890 [ 2254.962874][T11505] ? unregister_oom_notifier+0x20/0x20 [ 2254.968319][T11505] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2254.973877][T11505] ? get_page_from_freelist+0x7c0/0x7c0 [ 2254.979412][T11505] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2254.984769][T11505] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2254.990309][T11505] ? cpumask_any_but+0xab/0xc0 [ 2254.995058][T11505] ? stack_trace_snprint+0x150/0x150 [ 2255.000353][T11505] ? sync_mm_rss+0x21a/0x360 [ 2255.004928][T11505] wp_page_copy+0x1d4/0x15a0 [ 2255.009507][T11505] ? kmem_cache_free+0xac/0x5c0 [ 2255.014367][T11505] ? __kasan_slab_free+0x1e2/0x220 [ 2255.019476][T11505] ? slab_free_freelist_hook+0xd0/0x150 [ 2255.024998][T11505] ? kmem_cache_free+0xac/0x5c0 [ 2255.029840][T11505] ? __do_munmap+0xe42/0x11f0 [ 2255.034489][T11505] ? add_mm_rss_vec+0x270/0x270 [ 2255.039318][T11505] do_wp_page+0x657/0x14b0 [ 2255.043707][T11505] ? _raw_spin_lock+0xa1/0x170 [ 2255.048444][T11505] ? do_swap_page+0x1510/0x1510 [ 2255.053282][T11505] ? __perf_event_task_sched_out+0x1127/0x1250 [ 2255.059409][T11505] handle_mm_fault+0xf6c/0x4140 [ 2255.064415][T11505] ? finish_fault+0x230/0x230 [ 2255.069065][T11505] ? down_read_trylock+0x17a/0x1d0 [ 2255.074235][T11505] ? vmacache_update+0x9f/0xf0 [ 2255.078980][T11505] do_user_addr_fault+0x48a/0x9f0 [ 2255.083977][T11505] page_fault+0x2f/0x40 [ 2255.088104][T11505] RIP: 0033:0x7f335d983958 [ 2255.092495][T11505] Code: 48 89 50 18 48 89 42 10 0f 87 4c 05 00 00 4d 01 fd 48 8b 45 68 48 8d 55 58 48 3b 50 18 0f 85 da 06 00 00 49 81 fd ff 03 00 00 <48> 89 43 10 48 89 53 18 76 10 48 c7 43 20 00 00 00 00 48 c7 43 28 [ 2255.112070][T11505] RSP: 002b:00007ffca55b6d30 EFLAGS: 00010212 [ 2255.118105][T11505] RAX: 000055cd635b2b20 RBX: 000055cd63661860 RCX: 0000000000000b40 [ 2255.126078][T11505] RDX: 00007f335dca5b58 RSI: 0000000000000000 RDI: 00007f335dca5b00 [ 2255.134111][T11505] RBP: 00007f335dca5b00 R08: 000055cd63662880 R09: 0000000000000000 [ 2255.142055][T11505] R10: 00000000ffffffff R11: 0000000000000206 R12: 0000000000000000 [ 2255.150023][T11505] R13: 00000000000011c0 R14: 000055cd63662880 R15: 00000000000001a0 [ 2255.241548][T10330] usb 4-1: device descriptor read/8, error -61 [ 2255.259859][T10441] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2255.269127][T10441] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2255.291278][T10441] usb 2-1: SerialNumber: syz [ 2255.311306][T11469] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2255.318108][T11469] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2255.351694][T10441] hub 2-1:5.0: bad descriptor, ignoring hub [ 2255.357644][T10441] hub: probe of 2-1:5.0 failed with error -5 [ 2255.395314][T11505] Mem-Info: [ 2255.398495][T11505] active_anon:1404711 inactive_anon:4736 isolated_anon:0 [ 2255.398495][T11505] active_file:261 inactive_file:647 isolated_file:0 [ 2255.398495][T11505] unevictable:0 dirty:0 writeback:0 unstable:0 [ 2255.398495][T11505] slab_reclaimable:9515 slab_unreclaimable:97704 [ 2255.398495][T11505] mapped:55798 shmem:4833 pagetables:30519 bounce:0 [ 2255.398495][T11505] free:16110 free_pcp:200 free_cma:0 [ 2255.437354][T11505] Node 0 active_anon:5618844kB inactive_anon:18944kB active_file:1444kB inactive_file:4284kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:224692kB dirty:92kB writeback:0kB shmem:19332kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2255.462183][T11505] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2255.500320][T11505] lowmem_reserve[]: 0 2912 6416 6416 [ 2255.521952][T11505] DMA32 free:20644kB min:4644kB low:7624kB high:10604kB active_anon:2904420kB inactive_anon:8212kB active_file:4kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1312kB pagetables:956kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2255.552078][T10330] usb 4-1: device descriptor read/8, error -61 [ 2255.568751][T11469] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2255.581212][T11469] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2255.611681][T11462] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2255.622187][T11505] lowmem_reserve[]: 0 0 3504 3504 [ 2255.627423][T11505] Normal free:21964kB min:20648kB low:24236kB high:27824kB active_anon:2716864kB inactive_anon:10732kB active_file:3524kB inactive_file:4468kB unevictable:0kB writepending:192kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:34880kB pagetables:121120kB bounce:0kB free_pcp:428kB local_pcp:0kB free_cma:0kB [ 2255.661564][T16300] usblp: can't set desired altsetting 0 on interface 0 [ 2255.671483][T10330] usb usb4-port1: unable to enumerate USB device [ 2255.701897][T16300] usb 1-1: USB disconnect, device number 19 [ 2255.751832][T11505] lowmem_reserve[]: 0 0 0 0 [ 2255.757182][T11505] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2255.795545][T11505] DMA32: 336*4kB (UME) 361*8kB (UMEH) 266*16kB (UMEH) 108*32kB (UMEH) 50*64kB (UMEH) 18*128kB (UMEH) 4*256kB (UMH) 3*512kB (U) 1*1024kB (M) 0*2048kB 0*4096kB = 21032kB [ 2255.814370][T11505] Normal: 557*4kB (UMEH) 762*8kB (UMEH) 713*16kB (UMEH) 83*32kB (UMH) 35*64kB (UMH) 5*128kB (UM) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 25268kB [ 2255.830109][T11505] 5880 total pagecache pages [ 2255.835247][T11505] 0 pages in swap cache [ 2255.839831][T11505] Swap cache stats: add 0, delete 0, find 0/0 [ 2255.846280][T11505] Free swap = 0kB [ 2255.850073][T11505] Total swap = 0kB [ 2255.850492][T11469] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2255.853815][T11505] 1965979 pages RAM [ 2255.865320][T11505] 0 pages HighMem/MovableOnly [ 2255.870335][T11505] 318041 pages reserved [ 2255.874556][T11505] 0 pages cma reserved [ 2255.878617][T11505] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.0,pid=32190,uid=0 [ 2255.892862][T11505] Out of memory: Killed process 32190 (syz-executor.0) total-vm:85484kB, anon-rss:16580kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:160kB oom_score_adj:1000 [ 2255.903601][T10441] usblp 2-1:5.0: usblp0: USB Bidirectional printer dev 16 if 0 alt 0 proto 3 vid 0x0525 pid 0xA4A8 [ 2255.951676][T10441] usb 2-1: USB disconnect, device number 16 [ 2255.958224][T10441] usblp0: removed 12:51:58 executing program 3: syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:51:58 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xc000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:51:58 executing program 5: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x81, 0xe5, 0xa5, 0x40, 0xfe6, 0x9800, 0x5d6c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xd, 0x3, 0xfa}}]}}]}}, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:51:58 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2256.655056][T16300] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 2256.910819][T16300] usb 2-1: Using ep0 maxpacket: 8 [ 2256.920891][T10441] usb 4-1: new high-speed USB device number 119 using dummy_hcd [ 2257.051004][T16300] usb 2-1: config index 0 descriptor too short (expected 65316, got 36) [ 2257.059716][T16300] usb 2-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2257.069190][T16300] usb 2-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2257.078827][T16300] usb 2-1: config 5 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 [ 2257.091338][T16300] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2257.101803][T16300] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 65 [ 2257.112062][T16300] usb 2-1: config 5 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 12:51:58 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xd000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:51:58 executing program 0: syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:51:58 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="0010"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:51:58 executing program 5: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x81, 0xe5, 0xa5, 0x40, 0xfe6, 0x9800, 0x5d6c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xd, 0x3, 0xfa}}]}}]}}, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:51:58 executing program 1: r0 = syz_usb_connect$printer(0x4, 0x36, &(0x7f0000000000)=ANY=[@ANYRESHEX], 0x0) syz_usb_control_io(r0, 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0x11) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2257.200732][T10441] usb 4-1: device descriptor read/64, error 18 [ 2257.200755][T16300] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2257.216625][T16300] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2257.240758][T16300] usb 2-1: can't set config #5, error -71 [ 2257.249978][T16300] usb 2-1: USB disconnect, device number 17 12:51:59 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:51:59 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xf000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2257.450732][T26029] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 2257.610607][T10441] usb 4-1: device descriptor read/64, error 18 12:51:59 executing program 5: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x81, 0xe5, 0xa5, 0x40, 0xfe6, 0x9800, 0x5d6c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xd, 0x3, 0xfa}}]}}]}}, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2257.750666][T26029] usb 1-1: device descriptor read/64, error 18 [ 2257.844738][T30413] syz-executor.4 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=0 [ 2257.866443][T30413] CPU: 1 PID: 30413 Comm: syz-executor.4 Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2257.876597][T30413] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2257.880522][T10441] usb 4-1: new high-speed USB device number 120 using dummy_hcd [ 2257.886636][T30413] Call Trace: [ 2257.886651][T30413] dump_stack+0x1b0/0x21e [ 2257.886665][T30413] ? devkmsg_release+0x11c/0x11c [ 2257.907345][T30413] ? ___ratelimit+0x3bf/0x560 [ 2257.912009][T30413] ? show_regs_print_info+0x12/0x12 [ 2257.917314][T30413] ? _raw_spin_lock+0xa1/0x170 [ 2257.922061][T30413] ? radix_tree_cpu_dead+0x160/0x160 [ 2257.927330][T30413] dump_header+0xdb/0x700 [ 2257.931646][T30413] oom_kill_process+0xd3/0x280 [ 2257.936535][T30413] out_of_memory+0x5b6/0x890 [ 2257.941110][T30413] ? unregister_oom_notifier+0x20/0x20 [ 2257.946552][T30413] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2257.952084][T30413] ? get_page_from_freelist+0x7c0/0x7c0 [ 2257.957613][T30413] ? __zone_watermark_ok+0x91/0x280 [ 2257.962797][T30413] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2257.968153][T30413] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2257.973709][T30413] ? lockref_get+0x1c2/0x2b0 [ 2257.978320][T30413] ? blk_crypto_keyslot_evict+0x160/0x160 [ 2257.984189][T30413] ? should_fail+0x18e/0x860 [ 2257.988753][T30413] ? __rcu_read_lock+0x50/0x50 [ 2257.993502][T30413] ? setup_fault_attr+0x2b0/0x2b0 [ 2257.998497][T30413] ? find_inode_fast+0x3e7/0x4a0 [ 2258.003403][T30413] __get_free_pages+0xa/0x30 [ 2258.007969][T30413] inode_doinit_with_dentry+0x950/0x10e0 [ 2258.013584][T30413] ? __wake_up_bit+0x170/0x170 [ 2258.018316][T30413] ? sb_finish_set_opts+0x7e0/0x7e0 [ 2258.023493][T30413] ? current_time+0x1aa/0x2e0 [ 2258.028141][T30413] ? atime_needs_update+0x570/0x570 [ 2258.033307][T30413] security_d_instantiate+0x90/0xf0 [ 2258.038562][T30413] d_splice_alias+0x71/0x590 [ 2258.043124][T30413] kernfs_iop_lookup+0x17a/0x1f0 [ 2258.048117][T30413] __lookup_slow+0x2f2/0x470 [ 2258.052679][T30413] ? lookup_one_len+0x2a0/0x2a0 [ 2258.057512][T30413] path_mountpoint+0x28f/0x740 [ 2258.062245][T30413] ? success_walk_trace+0x410/0x410 [ 2258.067425][T30413] filename_mountpoint+0x220/0x660 [ 2258.072524][T30413] ? user_path_mountpoint_at+0x40/0x40 [ 2258.077950][T30413] ? strncpy_from_user+0x20c/0x370 [ 2258.083047][T30413] ? getname_flags+0x20d/0x610 [ 2258.087780][T30413] ksys_umount+0x159/0x1000 [ 2258.092253][T30413] ? __up_read+0x6f/0x1b0 [ 2258.096551][T30413] ? __down_read+0x210/0x210 [ 2258.101128][T30413] ? namespace_unlock+0x4f0/0x4f0 [ 2258.106123][T30413] ? do_user_addr_fault+0x55c/0x9f0 [ 2258.111446][T30413] __x64_sys_umount+0x56/0x60 [ 2258.116095][T30413] do_syscall_64+0xcb/0x150 [ 2258.120568][T30413] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2258.126431][T30413] RIP: 0033:0x460887 [ 2258.130324][T30413] Code: 64 89 04 25 d0 02 00 00 58 5f ff d0 48 89 c7 e8 2f be ff ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ad 89 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2258.150010][T30413] RSP: 002b:00007ffffdaea678 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 2258.158388][T30413] RAX: ffffffffffffffda RBX: 000000000022750f RCX: 0000000000460887 [ 2258.166347][T30413] RDX: 0000000000403188 RSI: 0000000000000002 RDI: 00007ffffdaea720 [ 2258.174289][T30413] RBP: 0000000000000674 R08: 0000000000000000 R09: 000000000000000c [ 2258.182241][T30413] R10: 0000000000000006 R11: 0000000000000246 R12: 00007ffffdaeb7b0 [ 2258.190184][T30413] R13: 00000000026e9940 R14: 0000000000000000 R15: 00007ffffdaeb7b0 [ 2258.198862][T16300] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 2258.215470][T30413] Mem-Info: [ 2258.218677][T30413] active_anon:1406157 inactive_anon:4735 isolated_anon:0 [ 2258.218677][T30413] active_file:560 inactive_file:582 isolated_file:66 [ 2258.218677][T30413] unevictable:0 dirty:88 writeback:11 unstable:0 [ 2258.218677][T30413] slab_reclaimable:9500 slab_unreclaimable:97491 [ 2258.218677][T30413] mapped:56306 shmem:4831 pagetables:30559 bounce:0 [ 2258.218677][T30413] free:14544 free_pcp:5 free_cma:0 [ 2258.256735][T30413] Node 0 active_anon:5624680kB inactive_anon:18940kB active_file:2240kB inactive_file:2148kB unevictable:0kB isolated(anon):0kB isolated(file):364kB mapped:225124kB dirty:356kB writeback:0kB shmem:19324kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2258.282558][T30413] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2258.309017][T30413] lowmem_reserve[]: 0 2912 6416 6416 [ 2258.314851][T30413] DMA32 free:18592kB min:8740kB low:11720kB high:14700kB active_anon:2908488kB inactive_anon:8212kB active_file:280kB inactive_file:432kB unevictable:0kB writepending:4kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1312kB pagetables:952kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2258.344109][T30413] lowmem_reserve[]: 0 0 3504 3504 [ 2258.349252][T30413] Normal free:24440kB min:24744kB low:28332kB high:31920kB active_anon:2716088kB inactive_anon:10728kB active_file:1624kB inactive_file:1748kB unevictable:0kB writepending:276kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:34848kB pagetables:121056kB bounce:0kB free_pcp:756kB local_pcp:40kB free_cma:0kB [ 2258.380882][T30413] lowmem_reserve[]: 0 0 0 0 [ 2258.385447][T30413] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2258.399590][T30413] DMA32: 377*4kB (UME) 317*8kB (UMEH) 245*16kB (UMEH) 111*32kB (UMEH) 58*64kB (UMEH) 15*128kB (UEH) 5*256kB (UMH) 1*512kB (M) 0*1024kB 0*2048kB 0*4096kB = 18940kB [ 2258.412958][T10441] usb 4-1: device descriptor read/64, error 18 [ 2258.416471][T30413] Normal: 869*4kB (UMH) 744*8kB (UMH) 803*16kB (UMEH) 57*32kB (UMH) 12*64kB (UMH) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 24868kB [ 2258.440418][T30413] 5725 total pagecache pages [ 2258.445277][T30413] 0 pages in swap cache [ 2258.450459][T30413] Swap cache stats: add 0, delete 0, find 0/0 [ 2258.457244][T30413] Free swap = 0kB [ 2258.461213][T30413] Total swap = 0kB [ 2258.464940][T30413] 1965979 pages RAM [ 2258.468831][T30413] 0 pages HighMem/MovableOnly [ 2258.474017][T30413] 318041 pages reserved [ 2258.478642][T30413] 0 pages cma reserved [ 2258.483211][T30413] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.3,pid=26967,uid=0 [ 2258.497757][T30413] Out of memory: Killed process 26967 (syz-executor.3) total-vm:85484kB, anon-rss:16576kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:164kB oom_score_adj:1000 [ 2258.519490][ T23] oom_reaper: reaped process 26967 (syz-executor.3), now anon-rss:0kB, file-rss:34816kB, shmem-rss:0kB [ 2258.540566][T26029] usb 1-1: device descriptor read/64, error 18 [ 2258.546859][T16300] usb 2-1: device descriptor read/64, error 18 [ 2258.820278][T10441] usb 4-1: device descriptor read/64, error 18 [ 2258.830283][T26029] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 2258.940305][T10441] usb usb4-port1: attempt power cycle [ 2258.960280][T16300] usb 2-1: device descriptor read/64, error 18 [ 2259.110187][T26029] usb 1-1: device descriptor read/64, error 18 [ 2259.230182][T16300] usb 2-1: new high-speed USB device number 19 using dummy_hcd 12:52:01 executing program 5: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x12e390, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:01 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:01 executing program 3: syz_usb_connect$printer(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:01 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x10000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2259.510159][T16300] usb 2-1: device descriptor read/64, error 18 [ 2259.516455][T26029] usb 1-1: device descriptor read/64, error 18 12:52:01 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x12000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2259.662759][T26029] usb usb1-port1: attempt power cycle [ 2259.889972][T10441] usb 4-1: new high-speed USB device number 121 using dummy_hcd [ 2259.929953][T16300] usb 2-1: device descriptor read/64, error 18 [ 2260.049999][T16300] usb usb2-port1: attempt power cycle [ 2260.060159][T10441] usb 4-1: device descriptor read/8, error -61 12:52:01 executing program 0: syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:01 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:01 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x20000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:02 executing program 5: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x12e390, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:02 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:02 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x3f000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2260.330025][T10441] usb 4-1: device descriptor read/8, error -61 [ 2260.422759][T11615] syz-executor.4 invoked oom-killer: gfp_mask=0x1100dca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO|0x1000000), order=0, oom_score_adj=1000 [ 2260.436350][T11615] CPU: 1 PID: 11615 Comm: syz-executor.4 Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2260.446487][T11615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2260.456522][T11615] Call Trace: [ 2260.459798][T11615] dump_stack+0x1b0/0x21e [ 2260.464112][T11615] ? devkmsg_release+0x11c/0x11c [ 2260.469030][T11615] ? ___ratelimit+0x3bf/0x560 [ 2260.473691][T11615] ? show_regs_print_info+0x12/0x12 [ 2260.478870][T11615] ? _raw_spin_lock+0xa1/0x170 [ 2260.483618][T11615] ? radix_tree_cpu_dead+0x160/0x160 [ 2260.488894][T11615] dump_header+0xdb/0x700 [ 2260.493207][T11615] oom_kill_process+0xd3/0x280 [ 2260.497954][T11615] out_of_memory+0x5b6/0x890 [ 2260.502528][T11615] ? unregister_oom_notifier+0x20/0x20 [ 2260.507973][T11615] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2260.513507][T11615] ? get_page_from_freelist+0x7c0/0x7c0 [ 2260.519032][T11615] ? stack_trace_save+0x1e0/0x1e0 [ 2260.524041][T11615] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2260.529397][T11615] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2260.534927][T11615] ? mem_cgroup_commit_charge+0x198/0x240 [ 2260.540630][T11615] ? __rcu_read_lock+0x50/0x50 [ 2260.545365][T11615] handle_mm_fault+0x1849/0x4140 [ 2260.550273][T11615] ? finish_fault+0x230/0x230 [ 2260.554921][T11615] ? mark_page_accessed+0x275/0x5b0 [ 2260.560086][T11615] ? _raw_spin_unlock+0x5/0x20 [ 2260.564815][T11615] ? follow_page_mask+0x76a/0x1050 [ 2260.569910][T11615] __get_user_pages+0xca0/0x1420 [ 2260.574815][T11615] ? mempool_free+0x380/0x380 [ 2260.579461][T11615] ? populate_vma_page_range+0xf0/0xf0 [ 2260.584889][T11615] ? gup_pgd_range+0xa0f/0xd70 [ 2260.589623][T11615] ? __init_rwsem+0x120/0x120 [ 2260.594278][T11615] get_user_pages_unlocked+0x179/0x610 [ 2260.599966][T11615] ? get_user_pages_locked+0x4b0/0x4b0 [ 2260.605391][T11615] ? bio_chain_endio+0xf0/0xf0 [ 2260.610121][T11615] ? fscrypt_mergeable_bio+0x20b/0x5e0 [ 2260.615559][T11615] get_user_pages_fast+0x241/0x400 [ 2260.620641][T11615] ? gup_pgd_range+0xd70/0xd70 [ 2260.625370][T11615] ? bio_add_page+0x2f1/0x470 [ 2260.630020][T11615] iov_iter_get_pages+0x299/0xea0 [ 2260.635023][T11615] ? iov_iter_gap_alignment+0x6c0/0x6c0 [ 2260.640537][T11615] __blockdev_direct_IO+0x1010/0x4910 [ 2260.645882][T11615] ? sb_init_dio_done_wq+0x80/0x80 [ 2260.650961][T11615] ? ext4_dio_get_block_overwrite+0x110/0x110 [ 2260.656996][T11615] ? xas_load+0x46f/0x4c0 [ 2260.661307][T11615] ? down_write+0xd8/0x150 [ 2260.665689][T11615] ? up_read+0x10/0x10 [ 2260.669726][T11615] ? __ext4_journal_start_sb+0x3ad/0x420 [ 2260.675327][T11615] ? ext4_dio_get_block_overwrite+0x110/0x110 [ 2260.681368][T11615] ext4_direct_IO+0x1591/0x20f0 [ 2260.686197][T11615] ? ext4_releasepage+0x280/0x280 [ 2260.691188][T11615] ? invalidate_inode_pages2_range+0xc81/0xd50 [ 2260.697309][T11615] ? invalidate_mapping_pages+0x6d0/0x6d0 [ 2260.702995][T11615] ? __writepage+0xc0/0xc0 [ 2260.707376][T11615] ? plist_check_list+0x22b/0x240 [ 2260.712366][T11615] ? wake_up_q+0x84/0xb0 [ 2260.716576][T11615] ? filemap_check_errors+0xcf/0x110 [ 2260.721829][T11615] ? filemap_write_and_wait+0x430/0x430 [ 2260.727359][T11615] ? ktime_get_coarse_real_ts64+0xd9/0xf0 [ 2260.733044][T11615] generic_file_direct_write+0x45b/0x6c0 [ 2260.738645][T11615] ? pagecache_write_end+0xa0/0xa0 [ 2260.743735][T11615] ? file_update_time+0x2cf/0x3d0 [ 2260.748814][T11615] ? file_remove_privs+0x600/0x600 [ 2260.753891][T11615] ? down_write_trylock+0xd8/0x150 [ 2260.758970][T11615] __generic_file_write_iter+0x27a/0x460 [ 2260.764570][T11615] ext4_file_write_iter+0x9d0/0x1250 [ 2260.769910][T11615] ? __kasan_slab_free+0x168/0x220 [ 2260.774985][T11615] ? slab_free_freelist_hook+0xd0/0x150 [ 2260.780495][T11615] ? kmem_cache_free+0xac/0x5c0 [ 2260.785312][T11615] ? ext4_file_read_iter+0x140/0x140 [ 2260.790563][T11615] ? _raw_spin_lock_irqsave+0xda/0x1c0 [ 2260.795988][T11615] ? perf_lock_task_context+0x570/0x570 [ 2260.802120][T11615] ? iov_iter_init+0x83/0x160 [ 2260.806763][T11615] __vfs_write+0x579/0x700 [ 2260.811147][T11615] ? __kernel_write+0x340/0x340 [ 2260.815978][T11615] ? fsnotify+0x13a0/0x1460 [ 2260.820450][T11615] ? avc_policy_seqno+0x17/0x70 [ 2260.825271][T11615] ? security_file_permission+0x128/0x300 [ 2260.830956][T11615] vfs_write+0x217/0x4f0 [ 2260.835168][T11615] ksys_write+0x168/0x2a0 [ 2260.839465][T11615] ? __ia32_sys_read+0x80/0x80 [ 2260.844295][T11615] do_syscall_64+0xcb/0x150 [ 2260.848778][T11615] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2260.854636][T11615] RIP: 0033:0x45de59 [ 2260.858500][T11615] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2260.878070][T11615] RSP: 002b:00007f216c867c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2260.886450][T11615] RAX: ffffffffffffffda RBX: 000000000003aa80 RCX: 000000000045de59 [ 2260.894392][T11615] RDX: 0000000000400c00 RSI: 0000000020000200 RDI: 0000000000000005 [ 2260.902331][T11615] RBP: 000000000118bf60 R08: 0000000000000000 R09: 0000000000000000 [ 2260.911323][T11615] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118bf2c [ 2260.919273][T11615] R13: 00007ffffdaeb53f R14: 00007f216c8689c0 R15: 000000000118bf2c [ 2260.928686][T10441] usb 4-1: new high-speed USB device number 122 using dummy_hcd [ 2261.009671][T26029] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 2261.039439][T11615] Mem-Info: [ 2261.042868][T11615] active_anon:1408191 inactive_anon:4735 isolated_anon:0 [ 2261.042868][T11615] active_file:469 inactive_file:500 isolated_file:0 [ 2261.042868][T11615] unevictable:0 dirty:6 writeback:0 unstable:0 [ 2261.042868][T11615] slab_reclaimable:9500 slab_unreclaimable:97489 [ 2261.042868][T11615] mapped:56157 shmem:4831 pagetables:30503 bounce:0 [ 2261.042868][T11615] free:12733 free_pcp:153 free_cma:0 [ 2261.086565][T11615] Node 0 active_anon:5627064kB inactive_anon:18940kB active_file:2076kB inactive_file:2580kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:225128kB dirty:24kB writeback:0kB shmem:19324kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2261.110999][T11615] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2261.137529][T11615] lowmem_reserve[]: 0 2912 6416 6416 [ 2261.149713][T10441] usb 4-1: device descriptor read/8, error -61 12:52:02 executing program 1: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xff, 0xd0, 0x20, [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x7, 0x1, 0x2, 0xe3, "", {{{0x9, 0x5, 0x1, 0x2, 0x20, 0x7f, 0x81, 0x7f}}, [{{0x9, 0x5, 0x82, 0x2, 0x8, 0x81, 0x6, 0x7f}}]}}}]}}]}}, &(0x7f00000003c0)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x110, 0x5, 0x20, 0x40, 0x10, 0xff}, 0x19, &(0x7f0000000080)={0x5, 0xf, 0x19, 0x1, [@ss_container_id={0x14, 0x10, 0x4, 0x8, "bc58f9c6733b43e70eec54da0b5bebdc"}]}, 0x6, [{0x3e, &(0x7f00000000c0)=@string={0x3e, 0x3, "35a4ff7089ae7e790b5388d7b74bc12fcb76dfd96f09c6335cccd98d3d4a4cd41a655edafd04abe06973f99f39b47c2926f5079720cb9a28dfb8808f"}}, {0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0xa4d4}}, {0x4, &(0x7f0000000180)=@lang_id={0x4}}, {0xe5, &(0x7f0000000280)=@string={0xe5, 0x3, "449b420dc78907d89eae92edaad3e56a8f50117db2dd8734e18e30f831fc2f52aff092d7ff16e214b0bcfdde50d1b90337973f38fc90f10807839d4a7452fe8a514d23a70195a6c4948e81952cd584b29195c165a0e8f8b59f9af4c9ebb044f146982ff9f1f87439a5b734c3b17a1bb2ae498bc5e61b35f523b7716639c73bd33c57cb6fdbe417f07236cfb3c957f180a039972b2525faf1065dea60ab0e03c4f52897da5e631473148c0f5c8d81f000bcfe8a70f475c42c84e1c6138e03f8d23221db509ce5f73422eca95e0e7e7c32bf20178f282662bae8f7dcb190b1c0293fdfe2"}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x2c09}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x2001}}]}) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x81, 0xe5, 0xa5, 0x40, 0xfe6, 0x9800, 0x5d6c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xd, 0x3, 0xfa}}]}}]}}, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2261.155907][T11615] DMA32 free:18976kB min:4644kB low:7624kB high:10604kB active_anon:2909652kB inactive_anon:8212kB active_file:144kB inactive_file:32kB unevictable:0kB writepending:0kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1312kB pagetables:956kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB [ 2261.239594][T11615] lowmem_reserve[]: 0 0 3504 3504 [ 2261.244672][T11615] Normal free:19876kB min:17880kB low:21468kB high:25056kB active_anon:2717116kB inactive_anon:10728kB active_file:2068kB inactive_file:2760kB unevictable:0kB writepending:324kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:34912kB pagetables:121056kB bounce:0kB free_pcp:88kB local_pcp:88kB free_cma:0kB [ 2261.279640][T26029] usb 1-1: device descriptor read/8, error -61 12:52:03 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2261.293696][T11615] lowmem_reserve[]: 0 0 0 0 [ 2261.298269][T11615] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2261.313629][T11615] DMA32: 302*4kB (UME) 288*8kB (UMEH) 243*16kB (UMEH) 135*32kB (UMEH) 58*64kB (UMEH) 16*128kB (UMEH) 5*256kB (UMH) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 18760kB [ 2261.374818][T11615] Normal: 955*4kB (UMH) 570*8kB (UMH) 720*16kB (UMEH) 13*32kB (UMH) 7*64kB (H) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 20764kB [ 2261.404796][T11615] 6222 total pagecache pages [ 2261.409493][T11615] 0 pages in swap cache [ 2261.416233][T11615] Swap cache stats: add 0, delete 0, find 0/0 [ 2261.425468][T11615] Free swap = 0kB [ 2261.429273][T11615] Total swap = 0kB [ 2261.433112][T10441] usb 4-1: device descriptor read/8, error -61 [ 2261.439270][T11615] 1965979 pages RAM [ 2261.443117][T11615] 0 pages HighMem/MovableOnly [ 2261.447784][T11615] 318041 pages reserved [ 2261.455391][T11615] 0 pages cma reserved [ 2261.459987][T11615] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.3,pid=26887,uid=0 [ 2261.474404][T11615] Out of memory: Killed process 26887 (syz-executor.3) total-vm:85484kB, anon-rss:16576kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:164kB oom_score_adj:1000 [ 2261.549665][T10441] usb usb4-port1: unable to enumerate USB device [ 2261.589604][T26029] usb 1-1: device descriptor read/8, error -61 [ 2261.859427][T26029] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 2261.979413][T16300] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 2262.029470][T26029] usb 1-1: device descriptor read/8, error -61 [ 2262.069419][T16300] usb 2-1: Using ep0 maxpacket: 8 [ 2262.189399][T16300] usb 2-1: config index 0 descriptor too short (expected 65316, got 36) [ 2262.197762][T16300] usb 2-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2262.207350][T16300] usb 2-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2262.216780][T16300] usb 2-1: config 5 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 [ 2262.228144][T16300] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2262.238480][T16300] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 65 [ 2262.248922][T16300] usb 2-1: config 5 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 2262.299372][T26029] usb 1-1: device descriptor read/8, error -61 [ 2262.339403][T16300] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2262.348484][T16300] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2262.357173][T16300] usb 2-1: SerialNumber: syz [ 2262.379336][T11626] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2262.386383][T11626] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2262.399759][T16300] hub 2-1:5.0: bad descriptor, ignoring hub [ 2262.405882][T16300] hub: probe of 2-1:5.0 failed with error -5 [ 2262.419546][T26029] usb usb1-port1: unable to enumerate USB device 12:52:04 executing program 3: syz_usb_connect$printer(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:04 executing program 5: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x12e390, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:04 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x40000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:04 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2262.600872][T11626] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2262.608681][T11626] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2262.649927][T11626] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2262.669250][T16300] usblp: can't set desired altsetting 0 on interface 0 [ 2262.710167][T16300] usb 2-1: USB disconnect, device number 20 12:52:04 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x8c000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2262.959140][T26029] usb 4-1: new high-speed USB device number 123 using dummy_hcd 12:52:04 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:04 executing program 0: syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:04 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x8d000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:04 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2263.239105][T26029] usb 4-1: device descriptor read/64, error 18 [ 2263.435910][T11673] syz-executor.5 invoked oom-killer: gfp_mask=0x1100dca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO|0x1000000), order=0, oom_score_adj=0 [ 2263.448888][T11673] CPU: 0 PID: 11673 Comm: syz-executor.5 Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2263.459017][T11673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2263.469063][T11673] Call Trace: [ 2263.472341][T11673] dump_stack+0x1b0/0x21e [ 2263.476662][T11673] ? devkmsg_release+0x11c/0x11c [ 2263.481585][T11673] ? ___ratelimit+0x3bf/0x560 [ 2263.486244][T11673] ? show_regs_print_info+0x12/0x12 [ 2263.491412][T11673] ? _raw_spin_lock+0xa1/0x170 [ 2263.496142][T11673] ? radix_tree_cpu_dead+0x160/0x160 [ 2263.501396][T11673] dump_header+0xdb/0x700 [ 2263.505698][T11673] oom_kill_process+0xd3/0x280 [ 2263.510445][T11673] out_of_memory+0x5b6/0x890 [ 2263.515006][T11673] ? unregister_oom_notifier+0x20/0x20 [ 2263.520434][T11673] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2263.525962][T11673] ? get_page_from_freelist+0x7c0/0x7c0 [ 2263.531487][T11673] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2263.536827][T11673] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2263.542340][T11673] ? pagevec_lru_move_fn+0x193/0x210 [ 2263.547612][T11673] ? __pagevec_release+0x130/0x130 [ 2263.552691][T11673] ? __lru_cache_add+0x1a1/0x1f0 [ 2263.557600][T11673] wp_page_copy+0x1a4/0x15a0 [ 2263.562170][T11673] ? add_mm_rss_vec+0x270/0x270 [ 2263.567003][T11673] ? find_lowest_rq+0x162/0x3f0 [ 2263.571820][T11673] ? vm_normal_page+0x1c9/0x1d0 [ 2263.576640][T11673] do_wp_page+0x48d/0x14b0 [ 2263.581026][T11673] ? _raw_spin_lock+0xa1/0x170 [ 2263.585757][T11673] ? do_swap_page+0x1510/0x1510 [ 2263.590575][T11673] handle_mm_fault+0xf6c/0x4140 [ 2263.595412][T11673] ? finish_fault+0x230/0x230 [ 2263.600057][T11673] ? push_rt_tasks+0x4f8/0x670 [ 2263.604790][T11673] ? down_read_trylock+0x17a/0x1d0 [ 2263.609871][T11673] ? vmacache_find+0x47a/0x4b0 [ 2263.614606][T11673] do_user_addr_fault+0x48a/0x9f0 [ 2263.619600][T11673] page_fault+0x2f/0x40 [ 2263.623726][T11673] RIP: 0010:copy_user_enhanced_fast_string+0xe/0x30 [ 2263.630280][T11673] Code: 89 d1 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 31 c0 0f 1f 00 c3 0f 1f 80 00 00 00 00 0f 1f 00 83 fa 40 0f 82 70 ff ff ff 89 d1 a4 31 c0 0f 1f 00 c3 66 2e 0f 1f 84 00 00 00 00 00 89 d1 f3 a4 [ 2263.649866][T11673] RSP: 0018:ffff888114be7888 EFLAGS: 00010206 [ 2263.655898][T11673] RAX: ffffffff81f57901 RBX: 000000002027a500 RCX: 0000000000000500 [ 2263.663837][T11673] RDX: 0000000000001000 RSI: ffff888194565b00 RDI: 000000002027a000 [ 2263.671776][T11673] RBP: ffff888114be7da8 R08: dffffc0000000000 R09: ffffed10328acc00 [ 2263.679716][T11673] R10: 0000000000000000 R11: 0000000000000000 R12: 00007ffffffff000 [ 2263.687664][T11673] R13: 0000000000001000 R14: ffff888194565000 R15: 0000000020279500 [ 2263.695611][T11673] ? copyout+0x1/0xb0 [ 2263.699562][T11673] copyout+0x8e/0xb0 [ 2263.703427][T11673] copy_page_to_iter+0x393/0xbd0 [ 2263.708339][T11673] pipe_to_user+0xa3/0x130 [ 2263.712724][T11673] __splice_from_pipe+0x2d3/0x870 [ 2263.717715][T11673] ? user_page_pipe_buf_steal+0xc0/0xc0 [ 2263.723240][T11673] do_vmsplice+0x240/0xe70 [ 2263.727627][T11673] ? write_pipe_buf+0x1d0/0x1d0 [ 2263.732446][T11673] ? __rcu_read_lock+0x50/0x50 [ 2263.737175][T11673] ? check_stack_object+0x5a/0x90 [ 2263.742169][T11673] ? _copy_from_user+0xa4/0xe0 [ 2263.746901][T11673] ? rw_copy_check_uvector+0x2b3/0x310 [ 2263.752327][T11673] ? import_iovec+0x171/0x340 [ 2263.756976][T11673] ? dup_iter+0x110/0x110 [ 2263.761272][T11673] ? do_vfs_ioctl+0x756/0x16f0 [ 2263.766014][T11673] __se_sys_vmsplice+0x1cc/0x2c0 [ 2263.770920][T11673] ? __x64_sys_vmsplice+0xa0/0xa0 [ 2263.775912][T11673] ? put_timespec64+0x106/0x150 [ 2263.780741][T11673] ? ktime_get_raw+0x130/0x130 [ 2263.785483][T11673] ? get_timespec64+0x1c0/0x1c0 [ 2263.790302][T11673] ? fget_many+0x20/0x20 [ 2263.794512][T11673] ? __ia32_sys_clock_settime+0x230/0x230 [ 2263.800204][T11673] do_syscall_64+0xcb/0x150 [ 2263.804699][T11673] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2263.810557][T11673] RIP: 0033:0x45de59 [ 2263.814424][T11673] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2263.834007][T11673] RSP: 002b:00007f9ea029dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 2263.842383][T11673] RAX: ffffffffffffffda RBX: 0000000000038340 RCX: 000000000045de59 [ 2263.850325][T11673] RDX: 0000000000000001 RSI: 0000000020000000 RDI: 0000000000000004 [ 2263.858265][T11673] RBP: 000000000118c0b8 R08: 0000000000000000 R09: 0000000000000000 [ 2263.866203][T11673] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118c07c [ 2263.874155][T11673] R13: 00007ffe17bf105f R14: 00007f9ea029e9c0 R15: 000000000118c07c [ 2263.882558][T11673] Mem-Info: [ 2263.885676][T11673] active_anon:1408014 inactive_anon:4735 isolated_anon:0 [ 2263.885676][T11673] active_file:511 inactive_file:512 isolated_file:32 [ 2263.885676][T11673] unevictable:0 dirty:34 writeback:0 unstable:0 [ 2263.885676][T11673] slab_reclaimable:9499 slab_unreclaimable:97667 [ 2263.885676][T11673] mapped:56069 shmem:4831 pagetables:30611 bounce:0 [ 2263.885676][T11673] free:12140 free_pcp:489 free_cma:0 [ 2263.923867][T11673] Node 0 active_anon:5632056kB inactive_anon:18940kB active_file:1932kB inactive_file:1948kB unevictable:0kB isolated(anon):0kB isolated(file):128kB mapped:224176kB dirty:136kB writeback:0kB shmem:19324kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2263.948490][T11673] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2263.974436][T11673] lowmem_reserve[]: 0 2912 6416 6416 [ 2263.974651][T16300] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 2263.979754][T11673] DMA32 free:18100kB min:8740kB low:11720kB high:14700kB active_anon:2912044kB inactive_anon:8212kB active_file:164kB inactive_file:32kB unevictable:0kB writepending:0kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1312kB pagetables:956kB bounce:0kB free_pcp:124kB local_pcp:124kB free_cma:0kB [ 2263.979757][T11673] lowmem_reserve[]: 0 0 3504 3504 [ 2263.979782][T11673] Normal free:14556kB min:24744kB low:28332kB high:31920kB active_anon:2719028kB inactive_anon:10728kB active_file:2468kB inactive_file:1724kB unevictable:0kB writepending:336kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35168kB pagetables:121488kB bounce:0kB free_pcp:2044kB local_pcp:936kB free_cma:0kB [ 2263.979783][T11673] lowmem_reserve[]: 0 0 0 0 [ 2263.979790][T11673] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2263.979822][T11673] DMA32: 288*4kB (UME) 276*8kB (UMEH) 231*16kB (UMEH) 138*32kB (UMEH) 55*64kB (UMEH) 21*128kB (UMEH) 2*256kB (MH) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 18192kB [ 2263.979859][T11673] Normal: 284*4kB (UMH) 206*8kB (UMH) 691*16kB (UMEH) 4*32kB (MH) 10*64kB (MH) 1*128kB (M) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 14736kB [ 2263.979894][T11673] 5828 total pagecache pages [ 2263.979898][T11673] 0 pages in swap cache [ 2263.979902][T11673] Swap cache stats: add 0, delete 0, find 0/0 [ 2263.979904][T11673] Free swap = 0kB [ 2263.979907][T11673] Total swap = 0kB [ 2263.979910][T11673] 1965979 pages RAM [ 2263.979912][T11673] 0 pages HighMem/MovableOnly [ 2263.979914][T11673] 318041 pages reserved [ 2263.979916][T11673] 0 pages cma reserved [ 2263.979922][T11673] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.3,pid=24259,uid=0 [ 2263.979959][T11673] Out of memory: Killed process 24259 (syz-executor.3) total-vm:85484kB, anon-rss:16576kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:164kB oom_score_adj:1000 [ 2264.118478][ T23] oom_reaper: reaped process 24259 (syz-executor.3), now anon-rss:0kB, file-rss:34816kB, shmem-rss:0kB [ 2264.328749][T26029] usb 4-1: device descriptor read/64, error 18 12:52:06 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2264.438778][ T9634] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 2264.468984][T16300] usb 2-1: Using ep0 maxpacket: 8 12:52:06 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x8e000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:06 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2264.588786][T16300] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 2264.596581][T16300] usb 2-1: can't read configurations, error -71 [ 2264.603729][T26029] usb 4-1: new high-speed USB device number 124 using dummy_hcd [ 2264.862995][ T9634] usb 1-1: device descriptor read/64, error 18 [ 2265.298480][ T9634] usb 1-1: device descriptor read/64, error 18 [ 2265.304785][T26029] usb 4-1: device descriptor read/64, error 18 [ 2265.568416][ T9634] usb 1-1: new high-speed USB device number 25 using dummy_hcd 12:52:07 executing program 1: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224a1b2dd63187bc803a83a9b18cce7ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000e, 0x11, 0xffffffffffffffff, 0x1337d000) r1 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) fsetxattr$security_capability(r1, &(0x7f0000000000)='security.capability\x00', &(0x7f0000000040)=@v1={0x1000000, [{0x8411, 0x9}]}, 0xc, 0x2) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2265.708443][T26029] usb 4-1: device descriptor read/64, error 18 12:52:07 executing program 3: syz_usb_connect$printer(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:07 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x8f000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:07 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:07 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2265.828639][T26029] usb usb4-port1: attempt power cycle [ 2265.838449][ T9634] usb 1-1: device descriptor read/64, error 18 [ 2266.043366][T11703] syz-executor.4 invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=1000 [ 2266.087105][T11703] CPU: 0 PID: 11703 Comm: syz-executor.4 Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2266.097291][T11703] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2266.107329][T11703] Call Trace: [ 2266.110606][T11703] dump_stack+0x1b0/0x21e [ 2266.114903][T11703] ? devkmsg_release+0x11c/0x11c [ 2266.119818][T11703] ? ___ratelimit+0x3bf/0x560 [ 2266.124462][T11703] ? show_regs_print_info+0x12/0x12 [ 2266.129634][T11703] ? _raw_spin_lock+0xa1/0x170 [ 2266.134381][T11703] ? radix_tree_cpu_dead+0x160/0x160 [ 2266.139639][T11703] dump_header+0xdb/0x700 [ 2266.143935][T11703] oom_kill_process+0xd3/0x280 [ 2266.148665][T11703] out_of_memory+0x5b6/0x890 [ 2266.153223][T11703] ? unregister_oom_notifier+0x20/0x20 [ 2266.158651][T11703] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2266.164164][T11703] ? get_page_from_freelist+0x7c0/0x7c0 [ 2266.169699][T11703] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2266.175038][T11703] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2266.180550][T11703] pagecache_get_page+0x522/0x8a0 [ 2266.185545][T11703] filemap_fault+0x1435/0x1990 [ 2266.190287][T11703] ? __down_read+0xf1/0x210 [ 2266.194757][T11703] ? generic_file_read_iter+0x20a0/0x20a0 [ 2266.200446][T11703] ext4_filemap_fault+0x7b/0x90 [ 2266.205265][T11703] handle_mm_fault+0x291e/0x4140 [ 2266.210169][T11703] ? finish_fault+0x230/0x230 [ 2266.214814][T11703] ? down_read_trylock+0x17a/0x1d0 [ 2266.219892][T11703] ? _raw_spin_trylock_bh+0x190/0x190 [ 2266.225230][T11703] ? vmacache_find+0x205/0x4b0 [ 2266.229961][T11703] do_user_addr_fault+0x48a/0x9f0 [ 2266.234969][T11703] page_fault+0x2f/0x40 [ 2266.239102][T11703] RIP: 0033:0x402500 [ 2266.242979][T11703] Code: Bad RIP value. [ 2266.247025][T11703] RSP: 002b:00007ffffdaeb768 EFLAGS: 00010246 [ 2266.253064][T11703] RAX: ffffffffffffffff RBX: 000000000000001e RCX: 00000000004177b1 [ 2266.261018][T11703] RDX: fffffffffffffff7 RSI: 0000000000000081 RDI: 0000000000000000 [ 2266.268960][T11703] RBP: 0000000000000000 R08: 0000000001190d48 R09: 0000000000000000 [ 2266.276904][T11703] R10: 00007ffffdaeb680 R11: 0000000000000000 R12: 0000000000000001 [ 2266.284846][T11703] R13: 00007ffffdaeb7a0 R14: 0000000000000000 R15: 00007ffffdaeb7b0 [ 2266.373311][T11703] Mem-Info: [ 2266.376730][T11703] active_anon:1407248 inactive_anon:4735 isolated_anon:0 [ 2266.376730][T11703] active_file:512 inactive_file:508 isolated_file:78 [ 2266.376730][T11703] unevictable:0 dirty:52 writeback:6 unstable:0 [ 2266.376730][T11703] slab_reclaimable:9499 slab_unreclaimable:97695 [ 2266.376730][T11703] mapped:56319 shmem:4831 pagetables:30612 bounce:0 [ 2266.376730][T11703] free:13189 free_pcp:40 free_cma:0 [ 2266.449573][T11703] Node 0 active_anon:5628992kB inactive_anon:18940kB active_file:1432kB inactive_file:1756kB unevictable:0kB isolated(anon):0kB isolated(file):184kB mapped:224076kB dirty:208kB writeback:24kB shmem:19324kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2266.497576][T11703] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2266.548234][T11703] lowmem_reserve[]: 0 2912 6416 6416 [ 2266.553822][T11703] DMA32 free:18352kB min:8740kB low:11720kB high:14700kB active_anon:2913232kB inactive_anon:8212kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1312kB pagetables:968kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2266.582721][T11703] lowmem_reserve[]: 0 0 3504 3504 [ 2266.588232][T11703] Normal free:18776kB min:24744kB low:28332kB high:31920kB active_anon:2717776kB inactive_anon:10728kB active_file:1116kB inactive_file:1044kB unevictable:0kB writepending:232kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35200kB pagetables:121480kB bounce:0kB free_pcp:856kB local_pcp:284kB free_cma:0kB [ 2266.619472][T16300] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 2266.636103][T11703] lowmem_reserve[]: 0 0 0 0 [ 2266.640952][T11703] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2266.654524][T11703] DMA32: 292*4kB (UME) 282*8kB (UMEH) 237*16kB (UMEH) 146*32kB (UMEH) 57*64kB (UMEH) 18*128kB (UEH) 2*256kB (MH) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 18352kB [ 2266.670654][T11703] Normal: 544*4kB (UMH) 509*8kB (UMH) 796*16kB (UMEH) 25*32kB (UMH) 9*64kB (UMH) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 20360kB [ 2266.685288][T11703] 5142 total pagecache pages [ 2266.690000][T11703] 0 pages in swap cache [ 2266.694165][T11703] Swap cache stats: add 0, delete 0, find 0/0 [ 2266.700290][T11703] Free swap = 0kB [ 2266.703993][T11703] Total swap = 0kB [ 2266.707967][T11703] 1965979 pages RAM [ 2266.711857][T11703] 0 pages HighMem/MovableOnly [ 2266.716525][T11703] 318041 pages reserved [ 2266.720686][T11703] 0 pages cma reserved [ 2266.724733][T11703] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.3,pid=23661,uid=0 [ 2266.740612][T11703] Out of memory: Killed process 23661 (syz-executor.3) total-vm:85484kB, anon-rss:16576kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:164kB oom_score_adj:1000 [ 2266.758567][ T23] oom_reaper: reaped process 23661 (syz-executor.3), now anon-rss:0kB, file-rss:34816kB, shmem-rss:0kB [ 2266.828109][T26029] usb 4-1: new high-speed USB device number 125 using dummy_hcd [ 2267.068038][T26029] usb 4-1: device descriptor read/8, error -61 12:52:08 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x90000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:08 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="0001"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:08 executing program 0: syz_usb_connect$printer(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:08 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2267.217964][T16300] usb 2-1: Using ep0 maxpacket: 8 [ 2267.487959][T26029] usb 4-1: device descriptor read/8, error -61 [ 2267.488256][T16300] usb 2-1: config index 0 descriptor too short (expected 41252, got 36) [ 2267.519874][ T349] syz-fuzzer invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 2267.560784][T16300] usb 2-1: config 221 has too many interfaces: 178, using maximum allowed: 32 [ 2267.569820][T16300] usb 2-1: config 221 has an invalid descriptor of length 200, skipping remainder of the config [ 2267.580290][T16300] usb 2-1: config 221 has 0 interfaces, different from the descriptor's value: 178 [ 2267.665605][ T9634] usb 1-1: device descriptor read/64, error -71 [ 2267.665984][ T349] CPU: 0 PID: 349 Comm: syz-fuzzer Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2267.681519][ T349] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2267.691575][ T349] Call Trace: [ 2267.694860][ T349] dump_stack+0x1b0/0x21e [ 2267.699176][ T349] ? devkmsg_release+0x11c/0x11c [ 2267.704094][ T349] ? ___ratelimit+0x3bf/0x560 [ 2267.708751][ T349] ? show_regs_print_info+0x12/0x12 [ 2267.713932][ T349] ? _raw_spin_lock+0xa1/0x170 [ 2267.718679][ T349] ? radix_tree_cpu_dead+0x160/0x160 [ 2267.723953][ T349] dump_header+0xdb/0x700 [ 2267.728265][ T349] oom_kill_process+0xd3/0x280 [ 2267.733013][ T349] out_of_memory+0x5b6/0x890 [ 2267.737573][ T349] ? unregister_oom_notifier+0x20/0x20 [ 2267.743000][ T349] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2267.748517][ T349] ? get_page_from_freelist+0x7c0/0x7c0 [ 2267.754031][ T349] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2267.759374][ T349] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2267.764885][ T349] pagecache_get_page+0x522/0x8a0 [ 2267.769883][ T349] filemap_fault+0x1435/0x1990 [ 2267.774615][ T349] ? __down_read+0xf1/0x210 [ 2267.779084][ T349] ? generic_file_read_iter+0x20a0/0x20a0 [ 2267.784781][ T349] ext4_filemap_fault+0x7b/0x90 [ 2267.789598][ T349] handle_mm_fault+0x291e/0x4140 [ 2267.794504][ T349] ? finish_fault+0x230/0x230 [ 2267.799152][ T349] ? ep_destroy_wakeup_source+0x70/0x70 [ 2267.804664][ T349] ? down_read_trylock+0x17a/0x1d0 [ 2267.809751][ T349] ? __se_sys_futex+0x31d/0x440 [ 2267.814567][ T349] ? vmacache_find+0x47a/0x4b0 [ 2267.819299][ T349] do_user_addr_fault+0x48a/0x9f0 [ 2267.824383][ T349] page_fault+0x2f/0x40 [ 2267.828506][ T349] RIP: 0033:0x455d0a [ 2267.832372][ T349] Code: 89 04 24 e8 88 50 fb ff 48 8b 44 24 28 48 89 04 24 48 8b 44 24 38 48 89 44 24 08 48 8b 44 24 20 48 89 44 24 10 48 8b 54 24 30 <48> 8b 02 ff d0 48 8b 44 24 40 48 89 04 24 e8 b3 4e fb ff 48 8b 6c [ 2267.852395][ T349] RSP: 002b:000000c0003f1d70 EFLAGS: 00010202 [ 2267.858439][ T349] RAX: 0000000000000000 RBX: 000000c0000621e8 RCX: 0000000000000000 [ 2267.866377][ T349] RDX: 0000000000a87860 RSI: 000002104d443c9e RDI: 000000c00d5d3608 [ 2267.874317][ T349] RBP: 000000c0003f1db8 R08: 0000000000000001 R09: 0000000000000005 [ 2267.882269][ T349] R10: 00000210280bca09 R11: 0000000000000001 R12: 00000210280bca09 [ 2267.890207][ T349] R13: 0000000000000001 R14: 00000210280bca09 R15: 0000000000000200 [ 2267.903250][T16300] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 12:52:09 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xb2a20200, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:09 executing program 5: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xff, 0xd0, 0x20, [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x7, 0x1, 0x2, 0xe3, "", {{{0x9, 0x5, 0x1, 0x2, 0x20, 0x7f, 0x81, 0x7f}}, [{{0x9, 0x5, 0x82, 0x2, 0x8, 0x81, 0x6, 0x7f}}]}}}]}}]}}, &(0x7f00000003c0)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x110, 0x5, 0x20, 0x40, 0x10, 0xff}, 0x19, &(0x7f0000000080)={0x5, 0xf, 0x19, 0x1, [@ss_container_id={0x14, 0x10, 0x4, 0x8, "bc58f9c6733b43e70eec54da0b5bebdc"}]}, 0x6, [{0x3e, &(0x7f00000000c0)=@string={0x3e, 0x3, "35a4ff7089ae7e790b5388d7b74bc12fcb76dfd96f09c6335cccd98d3d4a4cd41a655edafd04abe06973f99f39b47c2926f5079720cb9a28dfb8808f"}}, {0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0xa4d4}}, {0x4, &(0x7f0000000180)=@lang_id={0x4}}, {0xe5, &(0x7f0000000280)=@string={0xe5, 0x3, "449b420dc78907d89eae92edaad3e56a8f50117db2dd8734e18e30f831fc2f52aff092d7ff16e214b0bcfdde50d1b90337973f38fc90f10807839d4a7452fe8a514d23a70195a6c4948e81952cd584b29195c165a0e8f8b59f9af4c9ebb044f146982ff9f1f87439a5b734c3b17a1bb2ae498bc5e61b35f523b7716639c73bd33c57cb6fdbe417f07236cfb3c957f180a039972b2525faf1065dea60ab0e03c4f52897da5e631473148c0f5c8d81f000bcfe8a70f475c42c84e1c6138e03f8d23221db509ce5f73422eca95e0e7e7c32bf20178f282662bae8f7dcb190b1c0293fdfe2"}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x2c09}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x2001}}]}) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x81, 0xe5, 0xa5, 0x40, 0xfe6, 0x9800, 0x5d6c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xd, 0x3, 0xfa}}]}}]}}, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2267.913659][ T9634] usb usb1-port1: attempt power cycle [ 2267.922044][T16300] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2267.933578][T16300] usb 2-1: SerialNumber: syz [ 2267.968067][T26029] usb 4-1: new high-speed USB device number 126 using dummy_hcd [ 2267.977074][ T349] Mem-Info: [ 2267.982561][ T349] active_anon:1398131 inactive_anon:4735 isolated_anon:0 [ 2267.982561][ T349] active_file:976 inactive_file:2045 isolated_file:17 [ 2267.982561][ T349] unevictable:0 dirty:18 writeback:0 unstable:0 [ 2267.982561][ T349] slab_reclaimable:9499 slab_unreclaimable:97872 [ 2267.982561][ T349] mapped:57619 shmem:4831 pagetables:30572 bounce:0 [ 2267.982561][ T349] free:19922 free_pcp:465 free_cma:0 [ 2268.021185][ T349] Node 0 active_anon:5592624kB inactive_anon:18940kB active_file:4204kB inactive_file:8380kB unevictable:0kB isolated(anon):0kB isolated(file):68kB mapped:230776kB dirty:72kB writeback:0kB shmem:19324kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no 12:52:09 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="0001"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2268.047312][ T349] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2268.074322][ T349] lowmem_reserve[]: 0 2912 6416 6416 [ 2268.087082][ T349] DMA32 free:19736kB min:4644kB low:7624kB high:10604kB active_anon:2910980kB inactive_anon:8212kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1312kB pagetables:960kB bounce:0kB free_pcp:1268kB local_pcp:1264kB free_cma:0kB [ 2268.116516][ T349] lowmem_reserve[]: 0 0 3504 3504 [ 2268.121915][ T349] Normal free:39272kB min:5592kB low:9180kB high:12768kB active_anon:2685812kB inactive_anon:10728kB active_file:3880kB inactive_file:8600kB unevictable:0kB writepending:272kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35072kB pagetables:121328kB bounce:0kB free_pcp:916kB local_pcp:668kB free_cma:0kB [ 2268.152573][ T349] lowmem_reserve[]: 0 0 0 0 [ 2268.157131][ T349] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2268.170805][ T349] DMA32: 312*4kB (UME) 304*8kB (UMEH) 243*16kB (UMEH) 164*32kB (UMEH) 65*64kB (UMEH) 21*128kB (UMEH) 2*256kB (MH) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 20176kB [ 2268.187171][ T349] Normal: 136*4kB (EH) 172*8kB (UMH) 919*16kB (UMEH) 197*32kB (UMEH) 136*64kB (MH) 52*128kB (M) 1*256kB (M) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 38544kB [ 2268.205666][ T349] 8176 total pagecache pages [ 2268.221547][ T349] 0 pages in swap cache [ 2268.225746][ T349] Swap cache stats: add 0, delete 0, find 0/0 [ 2268.234443][ T349] Free swap = 0kB [ 2268.238748][T26029] usb 4-1: device descriptor read/8, error -61 [ 2268.250878][T11701] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2268.289170][ T349] Total swap = 0kB [ 2268.292975][ T349] 1965979 pages RAM [ 2268.296803][ T349] 0 pages HighMem/MovableOnly [ 2268.310898][ T349] 318041 pages reserved [ 2268.315068][ T349] 0 pages cma reserved [ 2268.319803][ T349] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.3,pid=23564,uid=0 [ 2268.334423][ T349] Out of memory: Killed process 23564 (syz-executor.3) total-vm:85484kB, anon-rss:16576kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:164kB oom_score_adj:1000 [ 2268.358931][ T23] oom_reaper: reaped process 23564 (syz-executor.3), now anon-rss:0kB, file-rss:34816kB, shmem-rss:0kB [ 2268.360246][T16300] usb 2-1: USB disconnect, device number 23 [ 2268.577682][T26029] usb 4-1: device descriptor read/8, error -61 [ 2268.647586][ T9634] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 2268.697649][T26029] usb usb4-port1: unable to enumerate USB device 12:52:10 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:10 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="0003"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:10 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xb3a20200, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2268.827616][ T9634] usb 1-1: device descriptor read/8, error -61 [ 2269.097505][ T9634] usb 1-1: device descriptor read/8, error -61 [ 2269.147477][T26029] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 2269.267415][T10330] usb 4-1: new high-speed USB device number 127 using dummy_hcd [ 2269.377415][ T9634] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 2269.407400][T26029] usb 2-1: Using ep0 maxpacket: 8 [ 2269.527425][T26029] usb 2-1: config index 0 descriptor too short (expected 41252, got 36) [ 2269.535822][T26029] usb 2-1: config 221 has too many interfaces: 178, using maximum allowed: 32 [ 2269.544947][T26029] usb 2-1: config 221 has an invalid descriptor of length 200, skipping remainder of the config [ 2269.547324][T10330] usb 4-1: device descriptor read/64, error 18 [ 2269.555518][ T9634] usb 1-1: device descriptor read/8, error -61 [ 2269.567684][T26029] usb 2-1: config 221 has 0 interfaces, different from the descriptor's value: 178 12:52:11 executing program 5: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xff, 0xd0, 0x20, [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x7, 0x1, 0x2, 0xe3, "", {{{0x9, 0x5, 0x1, 0x2, 0x20, 0x7f, 0x81, 0x7f}}, [{{0x9, 0x5, 0x82, 0x2, 0x8, 0x81, 0x6, 0x7f}}]}}}]}}]}}, &(0x7f00000003c0)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x110, 0x5, 0x20, 0x40, 0x10, 0xff}, 0x19, &(0x7f0000000080)={0x5, 0xf, 0x19, 0x1, [@ss_container_id={0x14, 0x10, 0x4, 0x8, "bc58f9c6733b43e70eec54da0b5bebdc"}]}, 0x6, [{0x3e, &(0x7f00000000c0)=@string={0x3e, 0x3, "35a4ff7089ae7e790b5388d7b74bc12fcb76dfd96f09c6335cccd98d3d4a4cd41a655edafd04abe06973f99f39b47c2926f5079720cb9a28dfb8808f"}}, {0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0xa4d4}}, {0x4, &(0x7f0000000180)=@lang_id={0x4}}, {0xe5, &(0x7f0000000280)=@string={0xe5, 0x3, "449b420dc78907d89eae92edaad3e56a8f50117db2dd8734e18e30f831fc2f52aff092d7ff16e214b0bcfdde50d1b90337973f38fc90f10807839d4a7452fe8a514d23a70195a6c4948e81952cd584b29195c165a0e8f8b59f9af4c9ebb044f146982ff9f1f87439a5b734c3b17a1bb2ae498bc5e61b35f523b7716639c73bd33c57cb6fdbe417f07236cfb3c957f180a039972b2525faf1065dea60ab0e03c4f52897da5e631473148c0f5c8d81f000bcfe8a70f475c42c84e1c6138e03f8d23221db509ce5f73422eca95e0e7e7c32bf20178f282662bae8f7dcb190b1c0293fdfe2"}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x2c09}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x2001}}]}) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x81, 0xe5, 0xa5, 0x40, 0xfe6, 0x9800, 0x5d6c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xd, 0x3, 0xfa}}]}}]}}, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:11 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xe0ffffff, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:11 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2269.657374][T26029] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2269.666451][T26029] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2269.674458][T26029] usb 2-1: SerialNumber: syz [ 2269.697360][T26029] usb 2-1: can't set config #221, error -71 12:52:11 executing program 1: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r1, 0x407, 0x0) write(r1, &(0x7f00000007c0)="30eb2297b18c0a2ada6f46f8341ce63ccdab668e820dabde", 0x41395563) ioctl$KDSETLED(r1, 0x4b32, 0x80) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2269.704116][T26029] usb 2-1: USB disconnect, device number 24 [ 2269.837397][ T9634] usb 1-1: device descriptor read/8, error -61 [ 2269.987378][ T9634] usb usb1-port1: unable to enumerate USB device [ 2269.997383][T10330] usb 4-1: device descriptor read/64, error 18 [ 2270.127209][T26029] usb 2-1: new high-speed USB device number 25 using dummy_hcd 12:52:11 executing program 0: syz_usb_connect$printer(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:11 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:11 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xe4ffffff, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:11 executing program 5: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xff, 0xd0, 0x20, [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x7, 0x1, 0x2, 0xe3, "", {{{0x9, 0x5, 0x1, 0x2, 0x20, 0x7f, 0x81, 0x7f}}, [{{0x9, 0x5, 0x82, 0x2, 0x8, 0x81, 0x6, 0x7f}}]}}}]}}]}}, &(0x7f00000003c0)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x110, 0x5, 0x20, 0x40, 0x10, 0xff}, 0x19, &(0x7f0000000080)={0x5, 0xf, 0x19, 0x1, [@ss_container_id={0x14, 0x10, 0x4, 0x8, "bc58f9c6733b43e70eec54da0b5bebdc"}]}, 0x6, [{0x3e, &(0x7f00000000c0)=@string={0x3e, 0x3, "35a4ff7089ae7e790b5388d7b74bc12fcb76dfd96f09c6335cccd98d3d4a4cd41a655edafd04abe06973f99f39b47c2926f5079720cb9a28dfb8808f"}}, {0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0xa4d4}}, {0x4, &(0x7f0000000180)=@lang_id={0x4}}, {0xe5, &(0x7f0000000280)=@string={0xe5, 0x3, "449b420dc78907d89eae92edaad3e56a8f50117db2dd8734e18e30f831fc2f52aff092d7ff16e214b0bcfdde50d1b90337973f38fc90f10807839d4a7452fe8a514d23a70195a6c4948e81952cd584b29195c165a0e8f8b59f9af4c9ebb044f146982ff9f1f87439a5b734c3b17a1bb2ae498bc5e61b35f523b7716639c73bd33c57cb6fdbe417f07236cfb3c957f180a039972b2525faf1065dea60ab0e03c4f52897da5e631473148c0f5c8d81f000bcfe8a70f475c42c84e1c6138e03f8d23221db509ce5f73422eca95e0e7e7c32bf20178f282662bae8f7dcb190b1c0293fdfe2"}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x2c09}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x2001}}]}) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x81, 0xe5, 0xa5, 0x40, 0xfe6, 0x9800, 0x5d6c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xd, 0x3, 0xfa}}]}}]}}, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2270.267161][T10330] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 2270.387111][T26029] usb 2-1: Using ep0 maxpacket: 8 12:52:12 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00@']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2270.537103][T10330] usb 4-1: device descriptor read/64, error 18 [ 2270.597148][T26029] usb 2-1: config index 0 descriptor too short (expected 65316, got 36) [ 2270.606751][T26029] usb 2-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2270.649932][T26029] usb 2-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2270.661160][T26029] usb 2-1: config 5 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 [ 2270.673058][T26029] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2270.684224][T26029] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 65 [ 2270.695110][T26029] usb 2-1: config 5 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 2270.717544][T10441] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 2270.787093][T26029] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2270.796352][T26029] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2270.805803][T26029] usb 2-1: SerialNumber: syz [ 2270.827052][T11787] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2270.834082][T11787] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2270.847369][T26029] hub 2-1:5.0: bad descriptor, ignoring hub [ 2270.853303][T26029] hub: probe of 2-1:5.0 failed with error -5 [ 2270.966950][T10330] usb 4-1: device descriptor read/64, error 18 [ 2271.046956][T10441] usb 1-1: device descriptor read/64, error 18 [ 2271.060751][T11787] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2271.068081][T11787] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2271.096991][T10330] usb usb4-port1: attempt power cycle [ 2271.324166][T11825] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2271.446852][T10441] usb 1-1: device descriptor read/64, error 18 [ 2271.716745][T10441] usb 1-1: new high-speed USB device number 29 using dummy_hcd 12:52:13 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:13 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xefffffff, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:13 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="00ff"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:13 executing program 5: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224a1b2dd63187bc803a83a9b18cce7ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000e, 0x11, 0xffffffffffffffff, 0x1337d000) r1 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) fsetxattr$security_capability(r1, &(0x7f0000000000)='security.capability\x00', &(0x7f0000000040)=@v1={0x1000000, [{0x8411, 0x9}]}, 0xc, 0x2) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2271.806725][T10330] usb 4-1: new high-speed USB device number 3 using dummy_hcd 12:52:13 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="00ff"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:13 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xf4ffffff, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2272.006744][T10441] usb 1-1: device descriptor read/64, error 18 [ 2272.096654][ T144] systemd-udevd invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=3, oom_score_adj=-1000 [ 2272.122277][ T144] CPU: 0 PID: 144 Comm: systemd-udevd Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2272.132168][ T144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2272.142201][ T144] Call Trace: [ 2272.145466][ T144] dump_stack+0x1b0/0x21e [ 2272.149769][ T144] ? devkmsg_release+0x11c/0x11c [ 2272.154678][ T144] ? ___ratelimit+0x3bf/0x560 [ 2272.159347][ T144] ? show_regs_print_info+0x12/0x12 [ 2272.164529][ T144] ? _raw_spin_lock+0xa1/0x170 [ 2272.169262][ T144] ? radix_tree_cpu_dead+0x160/0x160 [ 2272.174517][ T144] dump_header+0xdb/0x700 [ 2272.178816][ T144] oom_kill_process+0xd3/0x280 [ 2272.183563][ T144] out_of_memory+0x5b6/0x890 [ 2272.188122][ T144] ? unregister_oom_notifier+0x20/0x20 [ 2272.193667][ T144] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2272.199193][ T144] ? get_page_from_freelist+0x7c0/0x7c0 [ 2272.204715][ T144] ? __zone_watermark_ok+0x91/0x280 [ 2272.209902][ T144] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2272.215278][ T144] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2272.220795][ T144] ? copy_process+0x5c9/0x52f0 [ 2272.225526][ T144] ? copy_process+0x5c9/0x52f0 [ 2272.230258][ T144] ? kmem_cache_alloc+0x1d5/0x250 [ 2272.235250][ T144] copy_process+0x612/0x52f0 [ 2272.239811][ T144] ? _raw_spin_lock_irqsave+0xda/0x1c0 [ 2272.245239][ T144] ? sock_setsockopt+0x1d93/0x2c30 [ 2272.250333][ T144] ? fork_idle+0x290/0x290 [ 2272.254727][ T144] _do_fork+0x180/0x8f0 [ 2272.258854][ T144] ? dup_mm+0x300/0x300 [ 2272.262979][ T144] ? __secure_computing+0x1b6/0x250 [ 2272.268146][ T144] ? syscall_trace_enter+0x683/0xa70 [ 2272.273398][ T144] __x64_sys_clone+0x246/0x2b0 [ 2272.278130][ T144] ? __ia32_sys_vfork+0x110/0x110 [ 2272.283123][ T144] ? __fpregs_load_activate+0x2d3/0x390 [ 2272.288638][ T144] do_syscall_64+0xcb/0x150 [ 2272.293120][ T144] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2272.298980][ T144] RIP: 0033:0x7f335d9c438b [ 2272.303369][ T144] Code: db 45 85 f6 0f 85 95 01 00 00 64 4c 8b 04 25 10 00 00 00 31 d2 4d 8d 90 d0 02 00 00 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 de 00 00 00 85 c0 41 89 c5 0f 85 e5 00 00 [ 2272.322941][ T144] RSP: 002b:00007ffca55b6db0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 2272.331319][ T144] RAX: ffffffffffffffda RBX: 00007ffca55b6db0 RCX: 00007f335d9c438b [ 2272.339263][ T144] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 2272.347305][ T144] RBP: 00007ffca55b6e00 R08: 00007f335eb748c0 R09: 0000000000000210 [ 2272.355259][ T144] R10: 00007f335eb74b90 R11: 0000000000000246 R12: 0000000000000000 [ 2272.363215][ T144] R13: 0000000000000020 R14: 0000000000000000 R15: 0000000000000000 [ 2272.372402][T10330] usb 4-1: device not accepting address 3, error -71 [ 2272.486766][ T144] Mem-Info: [ 2272.490087][ T144] active_anon:1405468 inactive_anon:4735 isolated_anon:0 [ 2272.490087][ T144] active_file:349 inactive_file:360 isolated_file:16 [ 2272.490087][ T144] unevictable:0 dirty:9 writeback:0 unstable:0 [ 2272.490087][ T144] slab_reclaimable:9509 slab_unreclaimable:97857 [ 2272.490087][ T144] mapped:55937 shmem:4833 pagetables:30663 bounce:0 [ 2272.490087][ T144] free:14911 free_pcp:249 free_cma:0 [ 2272.528220][ T144] Node 0 active_anon:5621872kB inactive_anon:18940kB active_file:1396kB inactive_file:1440kB unevictable:0kB isolated(anon):0kB isolated(file):64kB mapped:223748kB dirty:36kB writeback:0kB shmem:19332kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2272.553080][ T144] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2272.580012][ T144] lowmem_reserve[]: 0 2912 6416 6416 [ 2272.585797][ T144] DMA32 free:19796kB min:4644kB low:7624kB high:10604kB active_anon:2913184kB inactive_anon:8212kB active_file:72kB inactive_file:88kB unevictable:0kB writepending:0kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1312kB pagetables:964kB bounce:0kB free_pcp:576kB local_pcp:428kB free_cma:0kB [ 2272.639512][ T144] lowmem_reserve[]: 0 0 3504 3504 [ 2272.656901][T10441] usb 1-1: device descriptor read/64, error 18 [ 2272.656964][ T144] Normal free:23944kB min:24744kB low:28332kB high:31920kB active_anon:2708688kB inactive_anon:10728kB active_file:1212kB inactive_file:1708kB unevictable:0kB writepending:436kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35040kB pagetables:121688kB bounce:0kB free_pcp:1936kB local_pcp:1112kB free_cma:0kB [ 2272.721633][ T144] lowmem_reserve[]: 0 0 0 0 [ 2272.746519][T10330] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 2272.756164][ T144] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2272.757497][T26029] usblp 2-1:5.0: usblp0: USB Bidirectional printer dev 25 if 0 alt 0 proto 3 vid 0x0525 pid 0xA4A8 [ 2272.770003][ T144] DMA32: 273*4kB (UME) 279*8kB (UMEH) 232*16kB (UME) 167*32kB (UMEH) 61*64kB (UMEH) 22*128kB (UMEH) 2*256kB (MH) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 19612kB [ 2272.796937][T10441] usb usb1-port1: attempt power cycle [ 2272.803790][ T144] Normal: 1375*4kB (UMH) 526*8kB (UMH) 767*16kB (UMH) 63*32kB (UMEH) 19*64kB (UMH) 13*128kB (M) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 26876kB [ 2272.819619][ T144] 5348 total pagecache pages [ 2272.824341][ T144] 0 pages in swap cache [ 2272.828566][ T144] Swap cache stats: add 0, delete 0, find 0/0 [ 2272.834607][ T144] Free swap = 0kB [ 2272.837045][T26029] usb 2-1: USB disconnect, device number 25 [ 2272.838596][ T144] Total swap = 0kB [ 2272.845250][T26029] usblp0: removed [ 2272.855691][ T144] 1965979 pages RAM [ 2272.860067][ T144] 0 pages HighMem/MovableOnly [ 2272.865700][ T144] 318041 pages reserved [ 2272.870797][ T144] 0 pages cma reserved [ 2272.877291][ T144] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.3,pid=22659,uid=0 [ 2272.892173][ T144] Out of memory: Killed process 22659 (syz-executor.3) total-vm:85484kB, anon-rss:16576kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:164kB oom_score_adj:1000 [ 2272.916590][ T23] oom_reaper: reaped process 22659 (syz-executor.3), now anon-rss:0kB, file-rss:34816kB, shmem-rss:0kB 12:52:14 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xf000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2272.946486][T10330] usb 4-1: device descriptor read/8, error -61 12:52:14 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xfbffffff, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:14 executing program 1: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0xffffffffdd6bcede, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) ioctl$ASHMEM_SET_PROT_MASK(0xffffffffffffffff, 0x40087705, &(0x7f0000000000)={0x33, 0x400}) openat(0xffffffffffffffff, &(0x7f00000002c0)='./file0\x00', 0x0, 0x0) clone(0x41be, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) ptrace(0x10, r1) write$FUSE_STATFS(0xffffffffffffffff, &(0x7f0000000040)={0x60, 0x0, 0x0, {{0x10001, 0x9, 0x3, 0x3, 0x0, 0x4, 0x5, 0xfffffffa}}}, 0x60) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) r3 = syz_mount_image$ext4(&(0x7f0000000dc0)='ext2\x00', &(0x7f0000000e00)='./file0\x00', 0x8001, 0x3, &(0x7f0000000f80)=[{&(0x7f0000000e40)="e06d764b79d0a51a709ecbe54b6da24822f27502578aa693bdfce4211bbc626dbecafee38ee4c83e67aa1caed4a65f16a8af9e156276d19e1be6af8f3b09576269c9cce58219148e08064735a850b9b60cd0ffd0c2627312232985f82330f21a16469e5eb06afc66801f41697008b793bf234480", 0x74, 0x7}, {&(0x7f0000000ec0)="c0b1e5bb9bd58b6f3fa058b568844a1d5d7324e823c5cd9c6e82c66128005c5368f2c4eaa8a7cd136a0aa8c1a815bb5337ee1836c981dc93bf62152948ef9aef899815ae", 0x44, 0x100}, {&(0x7f0000000f40)="c28547fff76ca76c41d98f2d14982d1ae21a856d0750299ffe470b7e2f6ed68a5e12b626aa", 0x25, 0x4}], 0x300000, &(0x7f0000001240)=ANY=[@ANYBLOB="6a6f75726e616c5f706174683dd8ebee6403a165f16e6f67727069642c6f6c64616c6c6f632c7573726a71756f7461262e2f66696c65302c686173682c007dcacc50a58c57154bd668845c305690cffdbae05d3eb043452ae570d83771eebd4eaf0983a1e56232f4de4222e7bd00d863c44e7f63fd282931e361de6c2def4f54e45af62036ed3c1c551f184d018e8aa3383c87c59c152cd0689dd8704ae073e66bbca2aaa665"]) arch_prctl$ARCH_GET_FS(0x1003, &(0x7f0000001200)) write$binfmt_elf64(r3, &(0x7f0000001080)={{0x7f, 0x45, 0x4c, 0x46, 0xe0, 0x5, 0x7, 0x1f, 0x1, 0x2, 0x3, 0x2f, 0x293, 0x40, 0x1, 0x1, 0x1, 0x38, 0x2, 0xffc0, 0x2, 0x7fff}, [{0x5, 0x0, 0x100000000, 0x5, 0x4, 0x5, 0xffffffffffffff00, 0x8}], "ae1fd6ee7610b75c7193cfc6befb50d5c9f5a238b23efe640c259eb5e77442ff8d4547dfa9c62f6ec76936298e8bc40339d382d9e700fe6235d7443d8d39df40c3a573c1ad994381f808062c8f16be889e708c131cf8ccaf5b3ca4e1fc6b281cbaf35383baad4aa08232a9a9648f28e347913b63e9df97149c14d8d635694525f5b1376614bc038c7248dfe660e2144fd1c763654d892db204736f8431feb6685e1a143200e7c7f2a211e9b8a1b6e7f671fc85149b5356a246aba91bcc0e73b3e0a35ba7ac3ba066bbdbae1f565c697c7f5c27192b9cd86592664d282f926c616efef8b8659f387e29474e8aca428870c1f7234e589c"}, 0x16e) futex$FUTEX_WAIT_MULTIPLE(&(0x7f0000000b00)=[{&(0x7f00000000c0)=0x2, 0x1}, {&(0x7f0000000140)=0x1}, {&(0x7f0000000180)=0x1, 0x2}, {&(0x7f00000001c0), 0x1}, {&(0x7f0000000280)=0x1, 0x2}, {&(0x7f00000002c0)=0x1}, {&(0x7f0000000300)=0x1, 0x2}, {&(0x7f0000000340)=0x1, 0x2}, {&(0x7f0000000380), 0x2}, {&(0x7f00000003c0), 0x2}, {&(0x7f0000000400)=0x2}, {&(0x7f0000000480)}, {&(0x7f00000004c0)=0x2, 0x2}, {&(0x7f0000000500)=0x2, 0x1}, {&(0x7f0000000540)}, {&(0x7f0000000580)=0x2}, {&(0x7f00000005c0), 0x2}, {&(0x7f0000000600)=0x2, 0x1}, {&(0x7f0000000640)}, {&(0x7f0000000680)=0x2, 0x1}, {&(0x7f00000006c0)=0x1, 0x1}, {&(0x7f0000000700), 0x2}, {&(0x7f0000000740)=0x1, 0x1}, {&(0x7f0000000780)=0x1, 0x1}, {&(0x7f00000007c0)=0x1, 0x1}, {&(0x7f0000000800)=0x2}, {&(0x7f0000000840)}, {&(0x7f0000000880)=0x1, 0x2}, {&(0x7f00000008c0), 0x1}, {&(0x7f0000000900), 0x1}, {&(0x7f0000000940), 0x2}, {&(0x7f0000000980)=0x2, 0x2}, {&(0x7f00000009c0), 0x1}, {&(0x7f0000000a00)=0x2, 0x2}, {&(0x7f0000000a40)=0x8}, {&(0x7f0000000a80), 0x2}, {&(0x7f0000000ac0)=0x2}], 0xd, 0x25, &(0x7f0000000d80), 0x0, 0x0) 12:52:14 executing program 0: syz_usb_connect$printer(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:14 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:14 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2273.216475][T10330] usb 4-1: device descriptor read/8, error -61 [ 2273.336372][T10330] usb usb4-port1: unable to enumerate USB device [ 2273.536272][T10330] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 2273.587582][ T336] syz-fuzzer invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 2273.629198][ T336] CPU: 0 PID: 336 Comm: syz-fuzzer Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2273.638837][ T336] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2273.648865][ T336] Call Trace: [ 2273.652133][ T336] dump_stack+0x1b0/0x21e [ 2273.656435][ T336] ? devkmsg_release+0x11c/0x11c [ 2273.661354][ T336] ? ___ratelimit+0x3bf/0x560 [ 2273.665999][ T336] ? show_regs_print_info+0x12/0x12 [ 2273.671292][ T336] ? _raw_spin_lock+0xa1/0x170 [ 2273.676043][ T336] ? radix_tree_cpu_dead+0x160/0x160 [ 2273.681305][ T336] dump_header+0xdb/0x700 [ 2273.685610][ T336] oom_kill_process+0xd3/0x280 [ 2273.690364][ T336] out_of_memory+0x5b6/0x890 [ 2273.694925][ T336] ? unregister_oom_notifier+0x20/0x20 [ 2273.700357][ T336] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2273.705874][ T336] ? get_page_from_freelist+0x7c0/0x7c0 [ 2273.711392][ T336] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2273.716734][ T336] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2273.722247][ T336] pagecache_get_page+0x522/0x8a0 [ 2273.727253][ T336] filemap_fault+0x1435/0x1990 [ 2273.731987][ T336] ? __down_read+0xf1/0x210 [ 2273.736458][ T336] ? generic_file_read_iter+0x20a0/0x20a0 [ 2273.742144][ T336] ? lapic_next_event+0x5b/0x70 [ 2273.746963][ T336] ext4_filemap_fault+0x7b/0x90 [ 2273.751782][ T336] handle_mm_fault+0x291e/0x4140 [ 2273.756689][ T336] ? finish_fault+0x230/0x230 [ 2273.761334][ T336] ? _copy_from_user+0xa4/0xe0 [ 2273.766081][ T336] ? down_read_trylock+0x17a/0x1d0 [ 2273.771167][ T336] ? __se_sys_futex+0x31d/0x440 [ 2273.776001][ T336] ? vmacache_find+0x205/0x4b0 [ 2273.780740][ T336] do_user_addr_fault+0x48a/0x9f0 [ 2273.785738][ T336] page_fault+0x2f/0x40 [ 2273.789865][ T336] RIP: 0033:0x469093 [ 2273.793742][ T336] Code: Bad RIP value. [ 2273.797788][ T336] RSP: 002b:000000c00004de80 EFLAGS: 00010202 [ 2273.803820][ T336] RAX: ffffffffffffff92 RBX: 000000000ed53375 RCX: 0000000000469093 [ 2273.811759][ T336] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 0000000001a749d8 [ 2273.819702][ T336] RBP: 000000c00004dec8 R08: 0000000000000000 R09: 0000000000000000 [ 2273.827640][ T336] R10: 000000c00004deb8 R11: 0000000000000202 R12: 0000000000439470 [ 2273.835580][ T336] R13: 0000000000000000 R14: 0000000000aff774 R15: 0000000000000000 [ 2273.848654][ T336] Mem-Info: [ 2273.866767][ T336] active_anon:1405335 inactive_anon:4736 isolated_anon:0 [ 2273.866767][ T336] active_file:198 inactive_file:547 isolated_file:0 [ 2273.866767][ T336] unevictable:0 dirty:39 writeback:0 unstable:0 [ 2273.866767][ T336] slab_reclaimable:9511 slab_unreclaimable:98007 [ 2273.866767][ T336] mapped:55749 shmem:4832 pagetables:30715 bounce:0 [ 2273.866767][ T336] free:15052 free_pcp:194 free_cma:0 [ 2273.916267][T10441] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 2273.917801][ T336] Node 0 active_anon:5622040kB inactive_anon:18944kB active_file:892kB inactive_file:2488kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:223396kB dirty:56kB writeback:0kB shmem:19328kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2273.953987][ T336] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2273.980508][ T336] lowmem_reserve[]: 0 2912 6416 6416 [ 2273.985817][ T336] DMA32 free:20508kB min:4644kB low:7624kB high:10604kB active_anon:2913184kB inactive_anon:8212kB active_file:200kB inactive_file:40kB unevictable:0kB writepending:36kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1312kB pagetables:964kB bounce:0kB free_pcp:12kB local_pcp:0kB free_cma:0kB [ 2274.014538][ T336] lowmem_reserve[]: 0 0 3504 3504 [ 2274.040222][ T336] Normal free:30788kB min:5592kB low:9180kB high:12768kB active_anon:2699536kB inactive_anon:10732kB active_file:1252kB inactive_file:2264kB unevictable:0kB writepending:320kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:34976kB pagetables:121836kB bounce:0kB free_pcp:2296kB local_pcp:960kB free_cma:0kB [ 2274.076047][ T336] lowmem_reserve[]: 0 0 0 0 [ 2274.081495][ T336] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2274.095249][ T336] DMA32: 290*4kB (UME) 282*8kB (UMEH) 239*16kB (UME) 172*32kB (UMEH) 67*64kB (UMEH) 22*128kB (UMEH) 3*256kB (UMH) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 20616kB [ 2274.111695][ T336] Normal: 1151*4kB (UMEH) 384*8kB (UMEH) 717*16kB (UMEH) 71*32kB (UMEH) 51*64kB (MH) 32*128kB (M) 10*256kB (M) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 31340kB [ 2274.127745][ T336] 5993 total pagecache pages [ 2274.132697][ T336] 0 pages in swap cache [ 2274.136165][T10441] usb 1-1: device descriptor read/8, error -61 [ 2274.137258][ T336] Swap cache stats: add 0, delete 0, find 0/0 [ 2274.149223][ T336] Free swap = 0kB [ 2274.153052][ T336] Total swap = 0kB [ 2274.156882][ T336] 1965979 pages RAM [ 2274.160781][ T336] 0 pages HighMem/MovableOnly [ 2274.165657][ T336] 318041 pages reserved [ 2274.169941][ T336] 0 pages cma reserved [ 2274.174098][ T336] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.3,pid=20828,uid=0 [ 2274.188524][ T336] Out of memory: Killed process 20828 (syz-executor.3) total-vm:85484kB, anon-rss:16576kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:164kB oom_score_adj:1000 [ 2274.286061][T10330] usb 2-1: Using ep0 maxpacket: 8 [ 2274.406100][T10441] usb 1-1: device descriptor read/8, error -61 [ 2274.412346][T10330] usb 2-1: config index 0 descriptor too short (expected 65316, got 36) [ 2274.421327][T10330] usb 2-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2274.430369][T10330] usb 2-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2274.439736][T10330] usb 2-1: config 5 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 [ 2274.451117][T10330] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2274.461343][T10330] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 65 [ 2274.471443][T10330] usb 2-1: config 5 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 2274.556074][T10330] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2274.565129][T10330] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2274.573769][T10330] usb 2-1: SerialNumber: syz [ 2274.596016][T11866] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2274.603380][T11866] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2274.616412][T10330] hub 2-1:5.0: bad descriptor, ignoring hub [ 2274.622336][T10330] hub: probe of 2-1:5.0 failed with error -5 [ 2274.675972][T10441] usb 1-1: new high-speed USB device number 31 using dummy_hcd 12:52:16 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:16 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:16 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:16 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xfeffffff, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2274.818225][T11866] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2274.825330][T11866] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2274.846541][T10441] usb 1-1: device descriptor read/8, error -61 12:52:16 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:16 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:16 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xff010000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2275.204735][T11914] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2275.265887][T10441] usb 1-1: device descriptor read/8, error -61 [ 2275.568161][T11922] fuse: Bad value for 'fd' [ 2275.610655][T28562] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 2275.626897][T10441] usb usb1-port1: unable to enumerate USB device [ 2276.205577][T28562] usb 4-1: device descriptor read/64, error 18 [ 2276.266592][T10330] usblp 2-1:5.0: usblp0: USB Bidirectional printer dev 26 if 0 alt 0 proto 3 vid 0x0525 pid 0xA4A8 [ 2276.305882][T10330] usb 2-1: USB disconnect, device number 26 [ 2276.312590][T10330] usblp0: removed 12:52:18 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xff030000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:18 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="0004"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:18 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:18 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:18 executing program 1: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2276.730579][T28562] usb 4-1: device descriptor read/64, error 18 [ 2276.748416][ T133] systemd-journal invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 2276.777264][ T133] CPU: 1 PID: 133 Comm: systemd-journal Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2276.787331][ T133] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2276.797383][ T133] Call Trace: [ 2276.800646][ T133] dump_stack+0x1b0/0x21e [ 2276.804958][ T133] ? devkmsg_release+0x11c/0x11c [ 2276.809861][ T133] ? ___ratelimit+0x3bf/0x560 [ 2276.814505][ T133] ? show_regs_print_info+0x12/0x12 [ 2276.819683][ T133] ? _raw_spin_lock+0xa1/0x170 [ 2276.824414][ T133] ? radix_tree_cpu_dead+0x160/0x160 [ 2276.829667][ T133] dump_header+0xdb/0x700 [ 2276.833967][ T133] oom_kill_process+0xd3/0x280 [ 2276.838699][ T133] out_of_memory+0x5b6/0x890 [ 2276.843260][ T133] ? unregister_oom_notifier+0x20/0x20 [ 2276.848694][ T133] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2276.854210][ T133] ? get_page_from_freelist+0x7c0/0x7c0 [ 2276.859726][ T133] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2276.865066][ T133] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2276.870582][ T133] pagecache_get_page+0x522/0x8a0 [ 2276.875574][ T133] filemap_fault+0x1435/0x1990 [ 2276.880318][ T133] ? __down_read+0xf1/0x210 [ 2276.884789][ T133] ? generic_file_read_iter+0x20a0/0x20a0 [ 2276.890488][ T133] ? ___preempt_schedule+0x16/0x20 [ 2276.895569][ T133] ext4_filemap_fault+0x7b/0x90 [ 2276.900390][ T133] handle_mm_fault+0x291e/0x4140 [ 2276.905297][ T133] ? finish_fault+0x230/0x230 [ 2276.909944][ T133] ? ep_destroy_wakeup_source+0x70/0x70 [ 2276.915465][ T133] ? down_read_trylock+0x17a/0x1d0 [ 2276.920546][ T133] ? vmacache_find+0x47a/0x4b0 [ 2276.925283][ T133] do_user_addr_fault+0x48a/0x9f0 [ 2276.930279][ T133] page_fault+0x2f/0x40 [ 2276.934416][ T133] RIP: 0033:0x7fa0c881421d [ 2276.938813][ T133] Code: Bad RIP value. [ 2276.942848][ T133] RSP: 002b:00007fff542710c0 EFLAGS: 00010207 [ 2276.948894][ T133] RAX: 0000000000000001 RBX: 000055e5076e5200 RCX: 00007fa0c7e392e3 [ 2276.956836][ T133] RDX: 0000000000000013 RSI: 00007fff542710c0 RDI: 0000000000000008 [ 2276.964779][ T133] RBP: 00007fff542712b0 R08: 00007fff543a2080 R09: 00007fff543a20a8 [ 2276.972719][ T133] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fff542710c0 [ 2276.980677][ T133] R13: 0000000000000001 R14: ffffffffffffffff R15: 0005b1a100652da7 [ 2277.004332][ T133] Mem-Info: [ 2277.008902][ T133] active_anon:1403347 inactive_anon:4735 isolated_anon:0 [ 2277.008902][ T133] active_file:459 inactive_file:583 isolated_file:52 [ 2277.008902][ T133] unevictable:0 dirty:25 writeback:1 unstable:0 [ 2277.008902][ T133] slab_reclaimable:9515 slab_unreclaimable:97824 [ 2277.008902][ T133] mapped:56128 shmem:4831 pagetables:30663 bounce:0 [ 2277.008902][ T133] free:16042 free_pcp:788 free_cma:0 [ 2277.051937][ T133] Node 0 active_anon:5600488kB inactive_anon:18940kB active_file:2036kB inactive_file:2532kB unevictable:0kB isolated(anon):0kB isolated(file):320kB mapped:224712kB dirty:100kB writeback:4kB shmem:19324kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2277.077242][T10441] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 2277.082089][ T133] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2277.111454][ T133] lowmem_reserve[]: 0 2912 6416 6416 [ 2277.117362][ T133] DMA32 free:17860kB min:4644kB low:7624kB high:10604kB active_anon:2913968kB inactive_anon:8212kB active_file:12kB inactive_file:4kB unevictable:0kB writepending:4kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1312kB pagetables:964kB bounce:0kB free_pcp:2872kB local_pcp:1444kB free_cma:0kB [ 2277.155555][T28562] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 2277.164299][ T133] lowmem_reserve[]: 0 0 3504 3504 [ 2277.170443][ T133] Normal free:43052kB min:5592kB low:9180kB high:12768kB active_anon:2683504kB inactive_anon:10728kB active_file:2484kB inactive_file:5632kB unevictable:0kB writepending:300kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:34944kB pagetables:121688kB bounce:0kB free_pcp:1984kB local_pcp:1456kB free_cma:0kB [ 2277.201117][ T133] lowmem_reserve[]: 0 0 0 0 [ 2277.205778][ T133] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2277.219238][ T133] DMA32: 223*4kB (UME) 238*8kB (UMH) 198*16kB (UM) 159*32kB (UMH) 63*64kB (UMH) 23*128kB (UMH) 1*256kB (H) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 18284kB [ 2277.234600][T10330] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 2277.235419][ T133] Normal: 2868*4kB (UMEH) 477*8kB (UMEH) 767*16kB (UMEH) 100*32kB (UMEH) 69*64kB (UMEH) 38*128kB (M) 7*256kB (M) 1*512kB (M) 0*1024kB 0*2048kB 0*4096kB = 42344kB [ 2277.258450][ T133] 7192 total pagecache pages [ 2277.263026][ T133] 0 pages in swap cache [ 2277.267189][ T133] Swap cache stats: add 0, delete 0, find 0/0 [ 2277.273229][ T133] Free swap = 0kB [ 2277.276946][ T133] Total swap = 0kB [ 2277.280643][ T133] 1965979 pages RAM [ 2277.284419][ T133] 0 pages HighMem/MovableOnly [ 2277.289116][ T133] 318041 pages reserved [ 2277.293249][ T133] 0 pages cma reserved [ 2277.297319][ T133] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.0,pid=28097,uid=0 [ 2277.311472][ T133] Out of memory: Killed process 28097 (syz-executor.0) total-vm:85484kB, anon-rss:16580kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:160kB oom_score_adj:1000 [ 2277.405231][T10441] usb 1-1: device descriptor read/64, error 18 [ 2277.455290][T28562] usb 4-1: device descriptor read/64, error 18 [ 2277.485224][T10330] usb 2-1: Using ep0 maxpacket: 8 [ 2277.615365][T10330] usb 2-1: config index 0 descriptor too short (expected 65316, got 36) [ 2277.623854][T10330] usb 2-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2277.632549][T10330] usb 2-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2277.641672][T10330] usb 2-1: config 5 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 [ 2277.652698][T10330] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2277.662869][T10330] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 65 [ 2277.672712][T10330] usb 2-1: config 5 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 2277.765213][T10330] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2277.774292][T10330] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2277.782428][T10330] usb 2-1: SerialNumber: syz [ 2277.805224][T11942] raw-gadget gadget: fail, usb_ep_enable returned -22 12:52:19 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:19 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="0004"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:19 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:19 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xff0b4000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2277.805229][T10441] usb 1-1: device descriptor read/64, error 18 [ 2277.818315][T11942] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2277.846358][T10330] hub 2-1:5.0: bad descriptor, ignoring hub [ 2277.852373][T10330] hub: probe of 2-1:5.0 failed with error -5 [ 2277.860991][T28562] usb 4-1: device descriptor read/64, error 18 12:52:19 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="0004"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:19 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xff0f0000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:19 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2278.062680][T28562] usb usb4-port1: attempt power cycle [ 2278.064056][T11942] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2278.082885][T11942] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2278.135057][T10441] usb 1-1: new high-speed USB device number 33 using dummy_hcd 12:52:20 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2278.339739][T11942] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2278.366972][T10330] usblp 2-1:5.0: usblp0: USB Bidirectional printer dev 27 if 0 alt 0 proto 3 vid 0x0525 pid 0xA4A8 [ 2278.405531][T10330] usb 2-1: USB disconnect, device number 27 [ 2278.412089][T10330] usblp0: removed [ 2278.474985][T10441] usb 1-1: device descriptor read/64, error 18 [ 2278.774867][T28562] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 2278.864955][T10441] usb 1-1: device descriptor read/64, error 18 [ 2278.944879][T28562] usb 4-1: device descriptor read/8, error -61 [ 2278.994891][T10441] usb usb1-port1: attempt power cycle [ 2279.114799][T26029] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 2279.214806][T28562] usb 4-1: device descriptor read/8, error -61 [ 2279.364695][T26029] usb 2-1: Using ep0 maxpacket: 8 12:52:21 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:21 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xff030000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:21 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xff1f0000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2279.484684][T28562] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 2279.504748][T26029] usb 2-1: config index 0 descriptor too short (expected 65316, got 36) [ 2279.513169][T26029] usb 2-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2279.521974][T26029] usb 2-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2279.531088][T26029] usb 2-1: config 5 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 [ 2279.542123][T26029] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2279.552073][T26029] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 65 [ 2279.561896][T26029] usb 2-1: config 5 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 12:52:21 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2279.654696][T28562] usb 4-1: device descriptor read/8, error -61 [ 2279.694681][T26029] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2279.703756][T26029] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2279.724653][T26029] usb 2-1: can't set config #5, error -71 [ 2279.731083][T26029] usb 2-1: USB disconnect, device number 28 [ 2279.934621][T10441] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 2279.954654][T28562] usb 4-1: device descriptor read/8, error -61 [ 2280.084636][T28562] usb usb4-port1: unable to enumerate USB device [ 2280.104578][T10441] usb 1-1: device descriptor read/8, error -61 [ 2280.384505][T10441] usb 1-1: device descriptor read/8, error -61 [ 2280.654458][T10441] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 2280.824390][T10441] usb 1-1: device descriptor read/8, error -61 12:52:22 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:22 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xffefffff, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:22 executing program 5: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0xffffffffdd6bcede, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) ioctl$ASHMEM_SET_PROT_MASK(0xffffffffffffffff, 0x40087705, &(0x7f0000000000)={0x33, 0x400}) openat(0xffffffffffffffff, &(0x7f00000002c0)='./file0\x00', 0x0, 0x0) clone(0x41be, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) ptrace(0x10, r1) write$FUSE_STATFS(0xffffffffffffffff, &(0x7f0000000040)={0x60, 0x0, 0x0, {{0x10001, 0x9, 0x3, 0x3, 0x0, 0x4, 0x5, 0xfffffffa}}}, 0x60) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) r3 = syz_mount_image$ext4(&(0x7f0000000dc0)='ext2\x00', &(0x7f0000000e00)='./file0\x00', 0x8001, 0x3, &(0x7f0000000f80)=[{&(0x7f0000000e40)="e06d764b79d0a51a709ecbe54b6da24822f27502578aa693bdfce4211bbc626dbecafee38ee4c83e67aa1caed4a65f16a8af9e156276d19e1be6af8f3b09576269c9cce58219148e08064735a850b9b60cd0ffd0c2627312232985f82330f21a16469e5eb06afc66801f41697008b793bf234480", 0x74, 0x7}, {&(0x7f0000000ec0)="c0b1e5bb9bd58b6f3fa058b568844a1d5d7324e823c5cd9c6e82c66128005c5368f2c4eaa8a7cd136a0aa8c1a815bb5337ee1836c981dc93bf62152948ef9aef899815ae", 0x44, 0x100}, {&(0x7f0000000f40)="c28547fff76ca76c41d98f2d14982d1ae21a856d0750299ffe470b7e2f6ed68a5e12b626aa", 0x25, 0x4}], 0x300000, &(0x7f0000001240)=ANY=[@ANYBLOB="6a6f75726e616c5f706174683dd8ebee6403a165f16e6f67727069642c6f6c64616c6c6f632c7573726a71756f7461262e2f66696c65302c686173682c007dcacc50a58c57154bd668845c305690cffdbae05d3eb043452ae570d83771eebd4eaf0983a1e56232f4de4222e7bd00d863c44e7f63fd282931e361de6c2def4f54e45af62036ed3c1c551f184d018e8aa3383c87c59c152cd0689dd8704ae073e66bbca2aaa665"]) arch_prctl$ARCH_GET_FS(0x1003, &(0x7f0000001200)) write$binfmt_elf64(r3, &(0x7f0000001080)={{0x7f, 0x45, 0x4c, 0x46, 0xe0, 0x5, 0x7, 0x1f, 0x1, 0x2, 0x3, 0x2f, 0x293, 0x40, 0x1, 0x1, 0x1, 0x38, 0x2, 0xffc0, 0x2, 0x7fff}, [{0x5, 0x0, 0x100000000, 0x5, 0x4, 0x5, 0xffffffffffffff00, 0x8}], "ae1fd6ee7610b75c7193cfc6befb50d5c9f5a238b23efe640c259eb5e77442ff8d4547dfa9c62f6ec76936298e8bc40339d382d9e700fe6235d7443d8d39df40c3a573c1ad994381f808062c8f16be889e708c131cf8ccaf5b3ca4e1fc6b281cbaf35383baad4aa08232a9a9648f28e347913b63e9df97149c14d8d635694525f5b1376614bc038c7248dfe660e2144fd1c763654d892db204736f8431feb6685e1a143200e7c7f2a211e9b8a1b6e7f671fc85149b5356a246aba91bcc0e73b3e0a35ba7ac3ba066bbdbae1f565c697c7f5c27192b9cd86592664d282f926c616efef8b8659f387e29474e8aca428870c1f7234e589c"}, 0x16e) futex$FUTEX_WAIT_MULTIPLE(&(0x7f0000000b00)=[{&(0x7f00000000c0)=0x2, 0x1}, {&(0x7f0000000140)=0x1}, {&(0x7f0000000180)=0x1, 0x2}, {&(0x7f00000001c0), 0x1}, {&(0x7f0000000280)=0x1, 0x2}, {&(0x7f00000002c0)=0x1}, {&(0x7f0000000300)=0x1, 0x2}, {&(0x7f0000000340)=0x1, 0x2}, {&(0x7f0000000380), 0x2}, {&(0x7f00000003c0), 0x2}, {&(0x7f0000000400)=0x2}, {&(0x7f0000000480)}, {&(0x7f00000004c0)=0x2, 0x2}, {&(0x7f0000000500)=0x2, 0x1}, {&(0x7f0000000540)}, {&(0x7f0000000580)=0x2}, {&(0x7f00000005c0), 0x2}, {&(0x7f0000000600)=0x2, 0x1}, {&(0x7f0000000640)}, {&(0x7f0000000680)=0x2, 0x1}, {&(0x7f00000006c0)=0x1, 0x1}, {&(0x7f0000000700), 0x2}, {&(0x7f0000000740)=0x1, 0x1}, {&(0x7f0000000780)=0x1, 0x1}, {&(0x7f00000007c0)=0x1, 0x1}, {&(0x7f0000000800)=0x2}, {&(0x7f0000000840)}, {&(0x7f0000000880)=0x1, 0x2}, {&(0x7f00000008c0), 0x1}, {&(0x7f0000000900), 0x1}, {&(0x7f0000000940), 0x2}, {&(0x7f0000000980)=0x2, 0x2}, {&(0x7f00000009c0), 0x1}, {&(0x7f0000000a00)=0x2, 0x2}, {&(0x7f0000000a40)=0x8}, {&(0x7f0000000a80), 0x2}, {&(0x7f0000000ac0)=0x2}], 0xd, 0x25, &(0x7f0000000d80), 0x0, 0x0) 12:52:22 executing program 1: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:22 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2281.094533][T10441] usb 1-1: device descriptor read/8, error -61 12:52:22 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xfff1ffff, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:22 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2281.214344][T10441] usb usb1-port1: unable to enumerate USB device [ 2281.264245][T10330] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 2281.374289][T28562] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 2281.423787][ T337] syz-fuzzer invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 2281.449352][ T337] CPU: 1 PID: 337 Comm: syz-fuzzer Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2281.458990][ T337] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2281.469019][ T337] Call Trace: [ 2281.472285][ T337] dump_stack+0x1b0/0x21e [ 2281.476593][ T337] ? devkmsg_release+0x11c/0x11c [ 2281.481497][ T337] ? ___ratelimit+0x3bf/0x560 [ 2281.486140][ T337] ? show_regs_print_info+0x12/0x12 [ 2281.491313][ T337] ? _raw_spin_lock+0xa1/0x170 [ 2281.496044][ T337] ? radix_tree_cpu_dead+0x160/0x160 [ 2281.501296][ T337] dump_header+0xdb/0x700 [ 2281.505594][ T337] oom_kill_process+0xd3/0x280 [ 2281.510325][ T337] out_of_memory+0x5b6/0x890 [ 2281.514884][ T337] ? unregister_oom_notifier+0x20/0x20 [ 2281.520319][ T337] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2281.525846][ T337] ? get_page_from_freelist+0x7c0/0x7c0 [ 2281.531371][ T337] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2281.536713][ T337] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2281.542227][ T337] pagecache_get_page+0x522/0x8a0 [ 2281.547219][ T337] filemap_fault+0x1435/0x1990 [ 2281.551955][ T337] ? __down_read+0xf1/0x210 [ 2281.556426][ T337] ? generic_file_read_iter+0x20a0/0x20a0 [ 2281.562114][ T337] ? iov_iter_init+0x83/0x160 [ 2281.566761][ T337] ext4_filemap_fault+0x7b/0x90 [ 2281.571590][ T337] handle_mm_fault+0x291e/0x4140 [ 2281.576499][ T337] ? finish_fault+0x230/0x230 [ 2281.581140][ T337] ? __fsnotify_parent+0x300/0x300 [ 2281.586219][ T337] ? down_read_trylock+0x17a/0x1d0 [ 2281.591296][ T337] ? __se_sys_futex+0x31d/0x440 [ 2281.596116][ T337] ? vmacache_find+0x205/0x4b0 [ 2281.600858][ T337] do_user_addr_fault+0x48a/0x9f0 [ 2281.605852][ T337] page_fault+0x2f/0x40 [ 2281.609975][ T337] RIP: 0033:0x425780 [ 2281.613848][ T337] Code: Bad RIP value. [ 2281.617882][ T337] RSP: 002b:000000c0001453b0 EFLAGS: 00010283 [ 2281.623915][ T337] RAX: 0000000000000040 RBX: 000000000000000a RCX: 0000000000000001 [ 2281.631865][ T337] RDX: 0000000001a8c9a0 RSI: 00000000000003c5 RDI: 0000000000000038 [ 2281.639816][ T337] RBP: 000000c0001453e8 R08: 00000000008ee340 R09: 0000000000203000 [ 2281.647755][ T337] R10: 000000000000000a R11: 0000000000000000 R12: 0000000000000040 [ 2281.655695][ T337] R13: 0000000000000040 R14: 0000000000aff3e2 R15: 0000000000000000 [ 2281.683965][ T337] Mem-Info: [ 2281.697811][ T337] active_anon:1405687 inactive_anon:4735 isolated_anon:0 [ 2281.697811][ T337] active_file:354 inactive_file:357 isolated_file:1 [ 2281.697811][ T337] unevictable:0 dirty:5 writeback:0 unstable:0 [ 2281.697811][ T337] slab_reclaimable:9515 slab_unreclaimable:97731 [ 2281.697811][ T337] mapped:55967 shmem:4831 pagetables:30772 bounce:0 [ 2281.697811][ T337] free:14842 free_pcp:20 free_cma:0 [ 2281.735579][T10330] usb 2-1: Using ep0 maxpacket: 8 [ 2281.754728][ T337] Node 0 active_anon:5622748kB inactive_anon:18940kB active_file:1300kB inactive_file:1080kB unevictable:0kB isolated(anon):0kB isolated(file):132kB mapped:223568kB dirty:20kB writeback:0kB shmem:19324kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2281.780963][ T337] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2281.820979][ T337] lowmem_reserve[]: 0 2912 6416 6416 [ 2281.850202][ T337] DMA32 free:20764kB min:8740kB low:11720kB high:14700kB active_anon:2916724kB inactive_anon:8212kB active_file:8kB inactive_file:4kB unevictable:0kB writepending:4kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1312kB pagetables:972kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2281.887679][ T337] lowmem_reserve[]: 0 0 3504 3504 [ 2281.893028][ T337] Normal free:24212kB min:24744kB low:28332kB high:31920kB active_anon:2705760kB inactive_anon:10728kB active_file:1128kB inactive_file:1244kB unevictable:0kB writepending:0kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35360kB pagetables:122116kB bounce:0kB free_pcp:64kB local_pcp:0kB free_cma:0kB [ 2281.930784][T28562] usb 4-1: device descriptor read/64, error 18 [ 2281.937299][ T337] lowmem_reserve[]: 0 0 0 0 [ 2281.946184][ T337] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2281.974925][ T337] DMA32: 221*4kB (UME) 232*8kB (UMH) 197*16kB (UM) 202*32kB (UMH) 67*64kB (UMH) 27*128kB (UMH) 4*256kB (UMH) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 21124kB [ 2281.997854][ T337] Normal: 1811*4kB (UMH) 149*8kB (UMEH) 621*16kB (UMEH) 31*32kB (UMEH) 25*64kB (MEH) 17*128kB (UM) 5*256kB (UM) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 24420kB [ 2282.025509][ T337] 5087 total pagecache pages [ 2282.030811][ T337] 0 pages in swap cache [ 2282.035832][ T337] Swap cache stats: add 0, delete 0, find 0/0 [ 2282.042023][ T337] Free swap = 0kB [ 2282.045740][ T337] Total swap = 0kB [ 2282.049435][ T337] 1965979 pages RAM [ 2282.053431][ T337] 0 pages HighMem/MovableOnly [ 2282.058420][ T337] 318041 pages reserved [ 2282.062745][ T337] 0 pages cma reserved [ 2282.067223][ T337] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.0,pid=26184,uid=0 [ 2282.081791][ T337] Out of memory: Killed process 26184 (syz-executor.0) total-vm:85484kB, anon-rss:16580kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:160kB oom_score_adj:1000 [ 2282.094076][T10330] usb 2-1: config index 0 descriptor too short (expected 65316, got 36) [ 2282.106884][T10330] usb 2-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2282.134045][T10330] usb 2-1: config 5 has 1 interface, different from the descriptor's value: 255 12:52:23 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xffffefff, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2282.143103][T10330] usb 2-1: config 5 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 [ 2282.159043][T10330] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2282.183977][T10330] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 65 [ 2282.203977][T10330] usb 2-1: config 5 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 2282.314036][T10330] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2282.323142][T10330] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2282.332138][T10330] usb 2-1: SerialNumber: syz [ 2282.343985][T28562] usb 4-1: device descriptor read/64, error 18 [ 2282.354453][T12047] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2282.364698][T12047] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2282.374708][T10330] hub 2-1:5.0: bad descriptor, ignoring hub [ 2282.380841][T10330] hub: probe of 2-1:5.0 failed with error -5 12:52:24 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:24 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:24 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xfffff1ff, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:24 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2282.584671][T12047] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2282.623894][T28562] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 2282.642275][T12047] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2282.858251][T12047] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2282.884640][T10330] usblp 2-1:5.0: usblp0: USB Bidirectional printer dev 29 if 0 alt 0 proto 3 vid 0x0525 pid 0xA4A8 [ 2282.913786][T28562] usb 4-1: device descriptor read/64, error 18 [ 2282.923893][T10441] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 2282.932151][T10330] usb 2-1: USB disconnect, device number 29 [ 2282.938926][T10330] usblp0: removed [ 2283.203721][T10441] usb 1-1: device descriptor read/64, error 18 [ 2283.303691][T28562] usb 4-1: device descriptor read/64, error 18 [ 2283.423754][T28562] usb usb4-port1: attempt power cycle [ 2283.603622][T10441] usb 1-1: device descriptor read/64, error 18 [ 2283.643608][T10330] usb 2-1: new high-speed USB device number 30 using dummy_hcd 12:52:25 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:25 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xffffff7f, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2283.873531][T10441] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 2283.883647][T10330] usb 2-1: Using ep0 maxpacket: 8 12:52:25 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2284.023570][T10330] usb 2-1: config index 0 descriptor too short (expected 65316, got 36) [ 2284.031941][T10330] usb 2-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2284.053504][T10330] usb 2-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2284.061853][T12104] syz-executor.4 invoked oom-killer: gfp_mask=0x1100dca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO|0x1000000), order=0, oom_score_adj=1000 [ 2284.062560][T10330] usb 2-1: config 5 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 [ 2284.109336][T12104] CPU: 1 PID: 12104 Comm: syz-executor.4 Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2284.119492][T12104] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2284.129532][T12104] Call Trace: [ 2284.132809][T12104] dump_stack+0x1b0/0x21e [ 2284.137137][T12104] ? devkmsg_release+0x11c/0x11c [ 2284.142054][T12104] ? ___ratelimit+0x3bf/0x560 [ 2284.146712][T12104] ? show_regs_print_info+0x12/0x12 [ 2284.151889][T12104] ? _raw_spin_lock+0xa1/0x170 [ 2284.156623][T12104] ? radix_tree_cpu_dead+0x160/0x160 [ 2284.161876][T12104] dump_header+0xdb/0x700 [ 2284.166186][T12104] oom_kill_process+0xd3/0x280 [ 2284.170918][T12104] out_of_memory+0x5b6/0x890 [ 2284.175496][T12104] ? unregister_oom_notifier+0x20/0x20 [ 2284.180925][T12104] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2284.186442][T12104] ? get_page_from_freelist+0x7c0/0x7c0 [ 2284.191957][T12104] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2284.197318][T12104] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2284.202831][T12104] handle_mm_fault+0x1849/0x4140 [ 2284.207737][T12104] ? finish_fault+0x230/0x230 [ 2284.212397][T12104] ? up_write+0xa1/0x190 [ 2284.216609][T12104] ? down_read_trylock+0x17a/0x1d0 [ 2284.221688][T12104] ? vmacache_update+0x9f/0xf0 [ 2284.226424][T12104] do_user_addr_fault+0x48a/0x9f0 [ 2284.231430][T12104] page_fault+0x2f/0x40 [ 2284.235562][T12104] RIP: 0033:0x41527f [ 2284.239444][T12104] Code: 0f 84 c8 02 00 00 48 83 bd 78 ff ff ff 00 0f 84 f9 04 00 00 48 8b 95 68 ff ff ff 44 89 95 38 ff ff ff 4c 8d ac 10 00 f7 ff ff <49> 89 85 90 06 00 00 49 8d 85 10 03 00 00 49 89 95 98 06 00 00 41 [ 2284.259028][T12104] RSP: 002b:00007ffffdaeb4d0 EFLAGS: 00010206 [ 2284.265067][T12104] RAX: 00007f216c827000 RBX: 0000000000020000 RCX: 000000000045deaa [ 2284.273028][T12104] RDX: 0000000000021000 RSI: 0000000000021000 RDI: 0000000000000000 [ 2284.280969][T12104] RBP: 00007ffffdaeb5b0 R08: ffffffffffffffff R09: 0000000000000000 [ 2284.288909][T12104] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffffdaeb6a0 [ 2284.296849][T12104] R13: 00007f216c847700 R14: 0000000000000003 R15: 000000000118bfd4 [ 2284.304824][T10441] usb 1-1: device descriptor read/64, error 18 [ 2284.317160][T10330] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2284.318178][T12104] Mem-Info: [ 2284.327162][T10330] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 65 [ 2284.335472][T12104] active_anon:1405946 inactive_anon:4735 isolated_anon:0 [ 2284.335472][T12104] active_file:709 inactive_file:730 isolated_file:38 [ 2284.335472][T12104] unevictable:0 dirty:74 writeback:0 unstable:0 [ 2284.335472][T12104] slab_reclaimable:9517 slab_unreclaimable:97713 [ 2284.335472][T12104] mapped:56541 shmem:4831 pagetables:30771 bounce:0 [ 2284.335472][T12104] free:13247 free_pcp:865 free_cma:0 [ 2284.340603][T10330] usb 2-1: config 5 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 2284.391444][T12104] Node 0 active_anon:5623736kB inactive_anon:18940kB active_file:2316kB inactive_file:2236kB unevictable:0kB isolated(anon):0kB isolated(file):308kB mapped:225532kB dirty:324kB writeback:0kB shmem:19324kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2284.433441][T10330] usb 2-1: string descriptor 0 read error: -71 [ 2284.437778][T12104] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2284.439630][T10330] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2284.465934][T12104] lowmem_reserve[]: 0 2912 6416 6416 [ 2284.480175][T12104] DMA32 free:21704kB min:8740kB low:11720kB high:14700kB active_anon:2917520kB inactive_anon:8212kB active_file:4kB inactive_file:300kB unevictable:0kB writepending:8kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1312kB pagetables:976kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2284.528037][T12104] lowmem_reserve[]: 0 0 3504 3504 [ 2284.533586][T10330] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2284.541737][T12104] Normal free:20248kB min:24744kB low:28332kB high:31920kB active_anon:2706216kB inactive_anon:10728kB active_file:2244kB inactive_file:1816kB unevictable:0kB writepending:316kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35072kB pagetables:121988kB bounce:0kB free_pcp:172kB local_pcp:172kB free_cma:0kB [ 2284.584825][T12104] lowmem_reserve[]: 0 0 0 0 [ 2284.589481][T12104] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2284.620314][T12104] DMA32: 223*4kB (UME) 226*8kB (UMH) 197*16kB (UM) 218*32kB (UMH) 67*64kB (UMH) 28*128kB (UMH) 5*256kB (UMH) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 21980kB [ 2284.650776][T12104] Normal: 1864*4kB (UMEH) 339*8kB (UMH) 623*16kB (UMEH) 43*32kB (UMEH) 14*64kB (MEH) 1*128kB (M) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 22536kB [ 2284.670090][T12104] 5317 total pagecache pages [ 2284.675152][T12104] 0 pages in swap cache [ 2284.679539][T12104] Swap cache stats: add 0, delete 0, find 0/0 [ 2284.685849][T12104] Free swap = 0kB [ 2284.689755][T12104] Total swap = 0kB [ 2284.693905][T12104] 1965979 pages RAM [ 2284.697823][T12104] 0 pages HighMem/MovableOnly [ 2284.702652][T12104] 318041 pages reserved [ 2284.706967][T12104] 0 pages cma reserved [ 2284.711126][T12104] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.0,pid=24586,uid=0 [ 2284.725969][T12104] Out of memory: Killed process 24586 (syz-executor.0) total-vm:85484kB, anon-rss:16580kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:160kB oom_score_adj:1000 [ 2284.753333][T10441] usb 1-1: device descriptor read/64, error 18 12:52:26 executing program 1: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000101090224ffff050074980904000012070103000905010200ffe0000009058202410000000000000000000000480caae8db0e1efd82e522a1134571195262"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:26 executing program 5: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0xffffffffdd6bcede, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) ioctl$ASHMEM_SET_PROT_MASK(0xffffffffffffffff, 0x40087705, &(0x7f0000000000)={0x33, 0x400}) openat(0xffffffffffffffff, &(0x7f00000002c0)='./file0\x00', 0x0, 0x0) clone(0x41be, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) ptrace(0x10, r1) write$FUSE_STATFS(0xffffffffffffffff, &(0x7f0000000040)={0x60, 0x0, 0x0, {{0x10001, 0x9, 0x3, 0x3, 0x0, 0x4, 0x5, 0xfffffffa}}}, 0x60) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) r3 = syz_mount_image$ext4(&(0x7f0000000dc0)='ext2\x00', &(0x7f0000000e00)='./file0\x00', 0x8001, 0x3, &(0x7f0000000f80)=[{&(0x7f0000000e40)="e06d764b79d0a51a709ecbe54b6da24822f27502578aa693bdfce4211bbc626dbecafee38ee4c83e67aa1caed4a65f16a8af9e156276d19e1be6af8f3b09576269c9cce58219148e08064735a850b9b60cd0ffd0c2627312232985f82330f21a16469e5eb06afc66801f41697008b793bf234480", 0x74, 0x7}, {&(0x7f0000000ec0)="c0b1e5bb9bd58b6f3fa058b568844a1d5d7324e823c5cd9c6e82c66128005c5368f2c4eaa8a7cd136a0aa8c1a815bb5337ee1836c981dc93bf62152948ef9aef899815ae", 0x44, 0x100}, {&(0x7f0000000f40)="c28547fff76ca76c41d98f2d14982d1ae21a856d0750299ffe470b7e2f6ed68a5e12b626aa", 0x25, 0x4}], 0x300000, &(0x7f0000001240)=ANY=[@ANYBLOB="6a6f75726e616c5f706174683dd8ebee6403a165f16e6f67727069642c6f6c64616c6c6f632c7573726a71756f7461262e2f66696c65302c686173682c007dcacc50a58c57154bd668845c305690cffdbae05d3eb043452ae570d83771eebd4eaf0983a1e56232f4de4222e7bd00d863c44e7f63fd282931e361de6c2def4f54e45af62036ed3c1c551f184d018e8aa3383c87c59c152cd0689dd8704ae073e66bbca2aaa665"]) arch_prctl$ARCH_GET_FS(0x1003, &(0x7f0000001200)) write$binfmt_elf64(r3, &(0x7f0000001080)={{0x7f, 0x45, 0x4c, 0x46, 0xe0, 0x5, 0x7, 0x1f, 0x1, 0x2, 0x3, 0x2f, 0x293, 0x40, 0x1, 0x1, 0x1, 0x38, 0x2, 0xffc0, 0x2, 0x7fff}, [{0x5, 0x0, 0x100000000, 0x5, 0x4, 0x5, 0xffffffffffffff00, 0x8}], "ae1fd6ee7610b75c7193cfc6befb50d5c9f5a238b23efe640c259eb5e77442ff8d4547dfa9c62f6ec76936298e8bc40339d382d9e700fe6235d7443d8d39df40c3a573c1ad994381f808062c8f16be889e708c131cf8ccaf5b3ca4e1fc6b281cbaf35383baad4aa08232a9a9648f28e347913b63e9df97149c14d8d635694525f5b1376614bc038c7248dfe660e2144fd1c763654d892db204736f8431feb6685e1a143200e7c7f2a211e9b8a1b6e7f671fc85149b5356a246aba91bcc0e73b3e0a35ba7ac3ba066bbdbae1f565c697c7f5c27192b9cd86592664d282f926c616efef8b8659f387e29474e8aca428870c1f7234e589c"}, 0x16e) futex$FUTEX_WAIT_MULTIPLE(&(0x7f0000000b00)=[{&(0x7f00000000c0)=0x2, 0x1}, {&(0x7f0000000140)=0x1}, {&(0x7f0000000180)=0x1, 0x2}, {&(0x7f00000001c0), 0x1}, {&(0x7f0000000280)=0x1, 0x2}, {&(0x7f00000002c0)=0x1}, {&(0x7f0000000300)=0x1, 0x2}, {&(0x7f0000000340)=0x1, 0x2}, {&(0x7f0000000380), 0x2}, {&(0x7f00000003c0), 0x2}, {&(0x7f0000000400)=0x2}, {&(0x7f0000000480)}, {&(0x7f00000004c0)=0x2, 0x2}, {&(0x7f0000000500)=0x2, 0x1}, {&(0x7f0000000540)}, {&(0x7f0000000580)=0x2}, {&(0x7f00000005c0), 0x2}, {&(0x7f0000000600)=0x2, 0x1}, {&(0x7f0000000640)}, {&(0x7f0000000680)=0x2, 0x1}, {&(0x7f00000006c0)=0x1, 0x1}, {&(0x7f0000000700), 0x2}, {&(0x7f0000000740)=0x1, 0x1}, {&(0x7f0000000780)=0x1, 0x1}, {&(0x7f00000007c0)=0x1, 0x1}, {&(0x7f0000000800)=0x2}, {&(0x7f0000000840)}, {&(0x7f0000000880)=0x1, 0x2}, {&(0x7f00000008c0), 0x1}, {&(0x7f0000000900), 0x1}, {&(0x7f0000000940), 0x2}, {&(0x7f0000000980)=0x2, 0x2}, {&(0x7f00000009c0), 0x1}, {&(0x7f0000000a00)=0x2, 0x2}, {&(0x7f0000000a40)=0x8}, {&(0x7f0000000a80), 0x2}, {&(0x7f0000000ac0)=0x2}], 0xd, 0x25, &(0x7f0000000d80), 0x0, 0x0) 12:52:26 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xffffffe0, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2284.873424][T10441] usb usb1-port1: attempt power cycle [ 2284.933333][T10330] usb 2-1: can't set config #5, error -71 [ 2284.945670][T10330] usb 2-1: USB disconnect, device number 30 12:52:26 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:26 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xffffffe4, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2285.203290][T28562] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 2285.313210][T10330] usb 2-1: new high-speed USB device number 31 using dummy_hcd 12:52:27 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:27 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:27 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xffffffef, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2285.483115][T28562] usb 4-1: device descriptor read/64, error 18 [ 2285.583113][T10330] usb 2-1: device descriptor read/64, error 18 12:52:27 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2285.813130][T10441] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 2285.893023][T28562] usb 4-1: device descriptor read/64, error 18 [ 2285.954151][ T336] syz-fuzzer invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 2285.965069][ T336] CPU: 1 PID: 336 Comm: syz-fuzzer Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2285.974679][ T336] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2285.983083][T10441] usb 1-1: device descriptor read/8, error -61 [ 2285.984717][ T336] Call Trace: [ 2285.991126][T10330] usb 2-1: device descriptor read/64, error 18 [ 2285.994375][ T336] dump_stack+0x1b0/0x21e [ 2285.994383][ T336] ? devkmsg_release+0x11c/0x11c [ 2285.994390][ T336] ? ___ratelimit+0x3bf/0x560 [ 2285.994396][ T336] ? show_regs_print_info+0x12/0x12 [ 2285.994401][ T336] ? _raw_spin_lock+0xa1/0x170 [ 2285.994411][ T336] ? radix_tree_cpu_dead+0x160/0x160 [ 2286.029543][ T336] dump_header+0xdb/0x700 [ 2286.033856][ T336] oom_kill_process+0xd3/0x280 [ 2286.038611][ T336] out_of_memory+0x5b6/0x890 [ 2286.043188][ T336] ? unregister_oom_notifier+0x20/0x20 [ 2286.048617][ T336] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2286.054131][ T336] ? get_page_from_freelist+0x7c0/0x7c0 [ 2286.059644][ T336] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2286.064996][ T336] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2286.070508][ T336] pagecache_get_page+0x522/0x8a0 [ 2286.075498][ T336] filemap_fault+0x1435/0x1990 [ 2286.080227][ T336] ? __down_read+0xf1/0x210 [ 2286.084696][ T336] ? generic_file_read_iter+0x20a0/0x20a0 [ 2286.090396][ T336] ext4_filemap_fault+0x7b/0x90 [ 2286.095214][ T336] handle_mm_fault+0x291e/0x4140 [ 2286.100131][ T336] ? finish_fault+0x230/0x230 [ 2286.104775][ T336] ? get_timespec64+0x108/0x1c0 [ 2286.109593][ T336] ? down_read_trylock+0x17a/0x1d0 [ 2286.114684][ T336] ? __x64_sys_nanosleep+0x60/0x60 [ 2286.119762][ T336] ? vmacache_find+0x205/0x4b0 [ 2286.124522][ T336] do_user_addr_fault+0x48a/0x9f0 [ 2286.129513][ T336] page_fault+0x2f/0x40 [ 2286.133633][ T336] RIP: 0033:0x431ab0 [ 2286.137505][ T336] Code: Bad RIP value. [ 2286.141550][ T336] RSP: 002b:000000c00004dec8 EFLAGS: 00010202 [ 2286.147581][ T336] RAX: 0000000000000000 RBX: 000000c000000180 RCX: 0000000000000001 [ 2286.155522][ T336] RDX: 000000c00003f880 RSI: 0000000000000001 RDI: 00000214598e8a24 [ 2286.163473][ T336] RBP: 000000c00004dee0 R08: 000000000068222f R09: 00007ffc3eabd0b8 [ 2286.171423][ T336] R10: 000000000006cd3c R11: 00000000000008ee R12: 0000000000439470 [ 2286.179363][ T336] R13: 0000000000000000 R14: 0000000000aff774 R15: 0000000000000000 [ 2286.194046][ T336] Mem-Info: [ 2286.197191][ T336] active_anon:1407037 inactive_anon:4735 isolated_anon:0 [ 2286.197191][ T336] active_file:429 inactive_file:436 isolated_file:60 [ 2286.197191][ T336] unevictable:0 dirty:11 writeback:0 unstable:0 [ 2286.197191][ T336] slab_reclaimable:9519 slab_unreclaimable:97843 [ 2286.197191][ T336] mapped:56137 shmem:4831 pagetables:30850 bounce:0 [ 2286.197191][ T336] free:13048 free_pcp:3 free_cma:0 [ 2286.234962][ T336] Node 0 active_anon:5628148kB inactive_anon:18940kB active_file:1716kB inactive_file:1744kB unevictable:0kB isolated(anon):0kB isolated(file):240kB mapped:224448kB dirty:44kB writeback:0kB shmem:19324kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2286.259633][ T336] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2286.285884][T28562] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 2286.293733][ T336] lowmem_reserve[]: 0 2912 6416 6416 [ 2286.299230][ T336] DMA32 free:19776kB min:8740kB low:11720kB high:14700kB active_anon:2919596kB inactive_anon:8212kB active_file:596kB inactive_file:228kB unevictable:0kB writepending:0kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1312kB pagetables:972kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2286.331877][ T336] lowmem_reserve[]: 0 0 3504 3504 [ 2286.337090][ T336] Normal free:17044kB min:24744kB low:28332kB high:31920kB active_anon:2708456kB inactive_anon:10728kB active_file:1244kB inactive_file:1036kB unevictable:0kB writepending:32kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35328kB pagetables:122436kB bounce:0kB free_pcp:84kB local_pcp:0kB free_cma:0kB [ 2286.367267][T10330] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 2286.375049][ T336] lowmem_reserve[]: 0 0 0 0 [ 2286.379745][ T336] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2286.393351][ T336] DMA32: 238*4kB (UME) 239*8kB (UMH) 198*16kB (UM) 195*32kB (UMH) 67*64kB (UMH) 24*128kB (UMH) 2*256kB (MH) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 20144kB [ 2286.409080][ T336] Normal: 1530*4kB (UMH) 143*8kB (UMEH) 582*16kB (UMEH) 22*32kB (UMEH) 5*64kB (EH) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 17600kB [ 2286.424102][T10441] usb 1-1: device descriptor read/8, error -61 [ 2286.443473][ T336] 5488 total pagecache pages [ 2286.452544][ T336] 0 pages in swap cache [ 2286.461194][ T336] Swap cache stats: add 0, delete 0, find 0/0 [ 2286.483019][ T336] Free swap = 0kB [ 2286.486949][ T336] Total swap = 0kB [ 2286.490916][ T336] 1965979 pages RAM [ 2286.494950][ T336] 0 pages HighMem/MovableOnly [ 2286.499865][ T336] 318041 pages reserved [ 2286.504305][ T336] 0 pages cma reserved [ 2286.508573][ T336] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.2,pid=712,uid=0 [ 2286.523007][ T336] Out of memory: Killed process 712 (syz-executor.2) total-vm:85484kB, anon-rss:16572kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:164kB oom_score_adj:1000 [ 2286.612908][T28562] usb 4-1: device descriptor read/64, error 18 [ 2286.652834][T10330] usb 2-1: device descriptor read/64, error 18 [ 2286.692814][T10441] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 2286.862806][T10441] usb 1-1: device descriptor read/8, error -61 [ 2287.002743][T28562] usb 4-1: device descriptor read/64, error 18 [ 2287.042726][T10330] usb 2-1: device descriptor read/64, error 18 [ 2287.122834][T28562] usb usb4-port1: attempt power cycle [ 2287.132872][T10441] usb 1-1: device descriptor read/8, error -61 [ 2287.162777][T10330] usb usb2-port1: attempt power cycle [ 2287.252724][T10441] usb usb1-port1: unable to enumerate USB device 12:52:29 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xfffffff4, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:29 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:29 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff0500"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:29 executing program 5: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0xffffffffdd6bcede, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) ioctl$ASHMEM_SET_PROT_MASK(0xffffffffffffffff, 0x40087705, &(0x7f0000000000)={0x33, 0x400}) openat(0xffffffffffffffff, &(0x7f00000002c0)='./file0\x00', 0x0, 0x0) clone(0x41be, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) ptrace(0x10, r1) write$FUSE_STATFS(0xffffffffffffffff, &(0x7f0000000040)={0x60, 0x0, 0x0, {{0x10001, 0x9, 0x3, 0x3, 0x0, 0x4, 0x5, 0xfffffffa}}}, 0x60) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) r3 = syz_mount_image$ext4(&(0x7f0000000dc0)='ext2\x00', &(0x7f0000000e00)='./file0\x00', 0x8001, 0x3, &(0x7f0000000f80)=[{&(0x7f0000000e40)="e06d764b79d0a51a709ecbe54b6da24822f27502578aa693bdfce4211bbc626dbecafee38ee4c83e67aa1caed4a65f16a8af9e156276d19e1be6af8f3b09576269c9cce58219148e08064735a850b9b60cd0ffd0c2627312232985f82330f21a16469e5eb06afc66801f41697008b793bf234480", 0x74, 0x7}, {&(0x7f0000000ec0)="c0b1e5bb9bd58b6f3fa058b568844a1d5d7324e823c5cd9c6e82c66128005c5368f2c4eaa8a7cd136a0aa8c1a815bb5337ee1836c981dc93bf62152948ef9aef899815ae", 0x44, 0x100}, {&(0x7f0000000f40)="c28547fff76ca76c41d98f2d14982d1ae21a856d0750299ffe470b7e2f6ed68a5e12b626aa", 0x25, 0x4}], 0x300000, &(0x7f0000001240)=ANY=[@ANYBLOB="6a6f75726e616c5f706174683dd8ebee6403a165f16e6f67727069642c6f6c64616c6c6f632c7573726a71756f7461262e2f66696c65302c686173682c007dcacc50a58c57154bd668845c305690cffdbae05d3eb043452ae570d83771eebd4eaf0983a1e56232f4de4222e7bd00d863c44e7f63fd282931e361de6c2def4f54e45af62036ed3c1c551f184d018e8aa3383c87c59c152cd0689dd8704ae073e66bbca2aaa665"]) arch_prctl$ARCH_GET_FS(0x1003, &(0x7f0000001200)) write$binfmt_elf64(r3, &(0x7f0000001080)={{0x7f, 0x45, 0x4c, 0x46, 0xe0, 0x5, 0x7, 0x1f, 0x1, 0x2, 0x3, 0x2f, 0x293, 0x40, 0x1, 0x1, 0x1, 0x38, 0x2, 0xffc0, 0x2, 0x7fff}, [{0x5, 0x0, 0x100000000, 0x5, 0x4, 0x5, 0xffffffffffffff00, 0x8}], "ae1fd6ee7610b75c7193cfc6befb50d5c9f5a238b23efe640c259eb5e77442ff8d4547dfa9c62f6ec76936298e8bc40339d382d9e700fe6235d7443d8d39df40c3a573c1ad994381f808062c8f16be889e708c131cf8ccaf5b3ca4e1fc6b281cbaf35383baad4aa08232a9a9648f28e347913b63e9df97149c14d8d635694525f5b1376614bc038c7248dfe660e2144fd1c763654d892db204736f8431feb6685e1a143200e7c7f2a211e9b8a1b6e7f671fc85149b5356a246aba91bcc0e73b3e0a35ba7ac3ba066bbdbae1f565c697c7f5c27192b9cd86592664d282f926c616efef8b8659f387e29474e8aca428870c1f7234e589c"}, 0x16e) futex$FUTEX_WAIT_MULTIPLE(&(0x7f0000000b00)=[{&(0x7f00000000c0)=0x2, 0x1}, {&(0x7f0000000140)=0x1}, {&(0x7f0000000180)=0x1, 0x2}, {&(0x7f00000001c0), 0x1}, {&(0x7f0000000280)=0x1, 0x2}, {&(0x7f00000002c0)=0x1}, {&(0x7f0000000300)=0x1, 0x2}, {&(0x7f0000000340)=0x1, 0x2}, {&(0x7f0000000380), 0x2}, {&(0x7f00000003c0), 0x2}, {&(0x7f0000000400)=0x2}, {&(0x7f0000000480)}, {&(0x7f00000004c0)=0x2, 0x2}, {&(0x7f0000000500)=0x2, 0x1}, {&(0x7f0000000540)}, {&(0x7f0000000580)=0x2}, {&(0x7f00000005c0), 0x2}, {&(0x7f0000000600)=0x2, 0x1}, {&(0x7f0000000640)}, {&(0x7f0000000680)=0x2, 0x1}, {&(0x7f00000006c0)=0x1, 0x1}, {&(0x7f0000000700), 0x2}, {&(0x7f0000000740)=0x1, 0x1}, {&(0x7f0000000780)=0x1, 0x1}, {&(0x7f00000007c0)=0x1, 0x1}, {&(0x7f0000000800)=0x2}, {&(0x7f0000000840)}, {&(0x7f0000000880)=0x1, 0x2}, {&(0x7f00000008c0), 0x1}, {&(0x7f0000000900), 0x1}, {&(0x7f0000000940), 0x2}, {&(0x7f0000000980)=0x2, 0x2}, {&(0x7f00000009c0), 0x1}, {&(0x7f0000000a00)=0x2, 0x2}, {&(0x7f0000000a40)=0x8}, {&(0x7f0000000a80), 0x2}, {&(0x7f0000000ac0)=0x2}], 0xd, 0x25, &(0x7f0000000d80), 0x0, 0x0) [ 2287.872603][T10330] usb 2-1: new high-speed USB device number 33 using dummy_hcd 12:52:29 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:29 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xfffffffb, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:29 executing program 1: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) fadvise64(0xffffffffffffffff, 0x3, 0x68, 0x4) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f0000000000)) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_SCAN(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, r3, 0x701, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}}, 0x0) fcntl$F_GET_RW_HINT(r1, 0x40b, &(0x7f0000000380)) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_START_AP(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x7c, r6, 0x545f421cd70d6b53, 0x0, 0x0, {{0x5}, {@val={0x8}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x60, 0xe, {@with_ht={{{}, {}, @broadcast, @broadcast, @from_mac=@device_b}}, 0x0, @random, 0x0, @void, @val, @void, @void, @void, @void, @val={0x25, 0x3}, @val={0x2a, 0x1}, @val={0x3c, 0x4}, @val={0x2d, 0x1a}, @val={0x72, 0x6}, @void, @void}}]]}, 0x7c}}, 0x0) sendmsg$NL80211_CMD_DEL_INTERFACE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="200027bd7000fcdbdf2508000000080003006df9f5f3c0a6a16929b22c3c60e367c1619532779456a1649cb11f8f2527050272681959fc2da5361e9db3344c9b05c95098863eb0310a29503ee1370f70e0db", @ANYRES32=r2, @ANYBLOB="0c009900f9ffffff76000000"], 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x21) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2288.043585][T10330] usb 2-1: device descriptor read/8, error -71 [ 2288.252455][T10330] usb 2-1: device descriptor read/8, error -71 [ 2288.282429][T28562] usb 4-1: new high-speed USB device number 14 using dummy_hcd 12:52:30 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xfffffffe, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2288.382455][T28562] usb 4-1: Using ep0 maxpacket: 8 12:52:30 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x10000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:30 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2288.502423][T28562] usb 4-1: config index 0 descriptor too short (expected 65316, got 36) [ 2288.510910][T28562] usb 4-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2288.520951][T28562] usb 4-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 2288.532674][T28562] usb 4-1: config 5 has 0 interfaces, different from the descriptor's value: 255 12:52:30 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2288.612407][T28562] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2288.622566][T28562] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2288.648123][T28562] usb 4-1: SerialNumber: syz [ 2288.742342][T10330] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 2288.842434][T10330] usb 2-1: Using ep0 maxpacket: 8 [ 2288.897930][T12174] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2288.913173][T28562] usb 4-1: USB disconnect, device number 14 12:52:30 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xffffffff000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2288.952222][T10441] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 2288.961054][T10330] warn_alloc: 2 callbacks suppressed [ 2288.961064][T10330] kworker/0:0: page allocation failure: order:4, mode:0x40cc0(GFP_KERNEL|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0 [ 2288.997738][T10330] CPU: 0 PID: 10330 Comm: kworker/0:0 Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2289.007631][T10330] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2289.017711][T10330] Workqueue: usb_hub_wq hub_event [ 2289.022730][T10330] Call Trace: [ 2289.026014][T10330] dump_stack+0x1b0/0x21e [ 2289.030338][T10330] ? devkmsg_release+0x11c/0x11c [ 2289.035271][T10330] ? show_regs_print_info+0x12/0x12 [ 2289.040461][T10330] warn_alloc+0x1ee/0x340 [ 2289.044782][T10330] ? zone_watermark_ok_safe+0x420/0x420 [ 2289.050398][T10330] __alloc_pages_slowpath+0x1c98/0x1cb0 [ 2289.055929][T10330] ? process_one_work+0x777/0xf90 [ 2289.060942][T10330] ? get_page_from_freelist+0x7c0/0x7c0 [ 2289.066465][T10330] ? __zone_watermark_ok+0x91/0x280 [ 2289.071636][T10330] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2289.076980][T10330] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2289.082493][T10330] ? usb_anchor_empty+0x40/0x40 [ 2289.087320][T10330] ? setup_fault_attr+0x2b0/0x2b0 [ 2289.092311][T10330] ? ___slab_alloc+0x297/0x450 [ 2289.097042][T10330] kmalloc_order_trace+0x2a/0xf0 [ 2289.101949][T10330] __kmalloc+0x268/0x2c0 [ 2289.106163][T10330] usb_get_configuration+0x326/0x4920 [ 2289.111510][T10330] ? _raw_spin_lock_irqsave+0xda/0x1c0 [ 2289.116935][T10330] ? slab_free_freelist_hook+0xd0/0x150 [ 2289.122448][T10330] ? trace_rpm_return_int_rcuidle+0x23/0x1d0 [ 2289.128482][T10330] ? rpm_resume+0xa29/0x19b0 [ 2289.133045][T10330] ? usb_destroy_configuration+0x580/0x580 [ 2289.138818][T10330] ? _raw_spin_lock_irq+0xa2/0x180 [ 2289.143895][T10330] ? _raw_spin_lock_irqsave+0x1c0/0x1c0 [ 2289.149416][T10330] ? pm_runtime_forbid+0xa7/0xf0 [ 2289.154331][T10330] usb_new_device+0x155/0x1710 [ 2289.159061][T10330] ? hub_port_init+0x1e9e/0x30e0 [ 2289.163966][T10330] ? _raw_spin_lock_irq+0xa2/0x180 [ 2289.169056][T10330] ? usb_disconnect+0x880/0x880 [ 2289.174048][T10330] hub_event+0x2a5b/0x4d50 [ 2289.178437][T10330] ? led_work+0x530/0x530 [ 2289.182742][T10330] ? pm_schedule_suspend+0x1d0/0x1d0 [ 2289.188008][T10330] ? _raw_spin_lock+0x170/0x170 [ 2289.192845][T10330] ? mutex_lock+0xa6/0x110 [ 2289.197247][T10330] ? _raw_spin_lock_irq+0xa2/0x180 [ 2289.202332][T10330] ? read_word_at_a_time+0xe/0x20 [ 2289.207328][T10330] ? strscpy+0xa6/0x260 [ 2289.211452][T10330] process_one_work+0x777/0xf90 [ 2289.216272][T10330] worker_thread+0xdb6/0x1430 [ 2289.220935][T10330] kthread+0x317/0x340 [ 2289.224972][T10330] ? process_one_work+0xf90/0xf90 [ 2289.229964][T10330] ? kthread_destroy_worker+0x270/0x270 [ 2289.235491][T10330] ret_from_fork+0x1f/0x30 [ 2289.249754][T10330] Mem-Info: [ 2289.253071][T10330] active_anon:1405744 inactive_anon:4735 isolated_anon:0 [ 2289.253071][T10330] active_file:1220 inactive_file:646 isolated_file:23 [ 2289.253071][T10330] unevictable:0 dirty:11 writeback:0 unstable:0 [ 2289.253071][T10330] slab_reclaimable:9518 slab_unreclaimable:97470 [ 2289.253071][T10330] mapped:56957 shmem:4831 pagetables:30970 bounce:0 [ 2289.253071][T10330] free:13002 free_pcp:692 free_cma:0 [ 2289.315569][T10330] Node 0 active_anon:5626276kB inactive_anon:18944kB active_file:4664kB inactive_file:2652kB unevictable:0kB isolated(anon):0kB isolated(file):16kB mapped:227716kB dirty:128kB writeback:0kB shmem:19328kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no 12:52:31 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2289.382129][T10330] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2289.441324][T10330] lowmem_reserve[]: 0 2912 6416 6416 [ 2289.446713][T10330] DMA32 free:19732kB min:4644kB low:7624kB high:10604kB active_anon:2913420kB inactive_anon:8220kB active_file:3404kB inactive_file:3028kB unevictable:0kB writepending:0kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1632kB pagetables:1268kB bounce:0kB free_pcp:1380kB local_pcp:436kB free_cma:0kB [ 2289.502104][T10441] usb 1-1: device descriptor read/64, error 18 [ 2289.522068][T10330] lowmem_reserve[]: 0 0 3504 3504 [ 2289.527231][T10330] Normal free:11488kB min:24744kB low:28332kB high:31920kB active_anon:2714192kB inactive_anon:10724kB active_file:1292kB inactive_file:376kB unevictable:0kB writepending:28kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35360kB pagetables:122560kB bounce:0kB free_pcp:1548kB local_pcp:816kB free_cma:0kB [ 2289.562103][T10330] lowmem_reserve[]: 0 0 0 0 [ 2289.566668][T10330] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2289.580000][T10330] DMA32: 181*4kB (UME) 262*8kB (UMH) 219*16kB (UM) 166*32kB (UMH) 78*64kB (UMH) 30*128kB (UMH) 3*256kB (UH) 1*512kB (M) 0*1024kB 0*2048kB 0*4096kB = 21748kB [ 2289.595935][T10330] Normal: 132*4kB (H) 114*8kB (UEH) 574*16kB (UEH) 20*32kB (UEH) 5*64kB (UEH) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 11584kB [ 2289.610261][T10330] 5683 total pagecache pages [ 2289.614864][T10330] 0 pages in swap cache [ 2289.619008][T10330] Swap cache stats: add 0, delete 0, find 0/0 [ 2289.625140][T10330] Free swap = 0kB [ 2289.628842][T10330] Total swap = 0kB [ 2289.632583][T10330] 1965979 pages RAM [ 2289.636375][T10330] 0 pages HighMem/MovableOnly [ 2289.641320][T10330] 318041 pages reserved [ 2289.645901][T10330] 0 pages cma reserved [ 2289.650032][T10330] usb 2-1: out of memory [ 2289.654306][T10330] usb 2-1: can't read configurations, error -12 [ 2289.664507][T10330] usb usb2-port1: unable to enumerate USB device 12:52:31 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff0500"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2289.892092][T10441] usb 1-1: device descriptor read/64, error 18 [ 2290.164962][T10441] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 2290.183266][ T144] systemd-udevd invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=3, oom_score_adj=-1000 [ 2290.216650][ T144] CPU: 1 PID: 144 Comm: systemd-udevd Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2290.226576][ T144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2290.236619][ T144] Call Trace: [ 2290.239896][ T144] dump_stack+0x1b0/0x21e [ 2290.244199][ T144] ? devkmsg_release+0x11c/0x11c [ 2290.249147][ T144] ? ___ratelimit+0x3bf/0x560 [ 2290.253813][ T144] ? show_regs_print_info+0x12/0x12 [ 2290.259012][ T144] ? _raw_spin_lock+0xa1/0x170 [ 2290.263768][ T144] ? radix_tree_cpu_dead+0x160/0x160 [ 2290.269029][ T144] dump_header+0xdb/0x700 [ 2290.273678][ T144] oom_kill_process+0xd3/0x280 [ 2290.278412][ T144] out_of_memory+0x5b6/0x890 [ 2290.282972][ T144] ? unregister_oom_notifier+0x20/0x20 [ 2290.288422][ T144] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2290.293939][ T144] ? get_page_from_freelist+0x7c0/0x7c0 [ 2290.299465][ T144] ? __zone_watermark_ok+0x91/0x280 [ 2290.304634][ T144] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2290.309989][ T144] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2290.315507][ T144] ? copy_process+0x5c9/0x52f0 [ 2290.320256][ T144] ? kmem_cache_alloc+0x1d5/0x250 [ 2290.325511][ T144] copy_process+0x612/0x52f0 [ 2290.330073][ T144] ? fork_idle+0x290/0x290 [ 2290.334462][ T144] ? _raw_spin_unlock+0x5/0x20 [ 2290.339213][ T144] ? handle_mm_fault+0x916/0x4140 [ 2290.344206][ T144] _do_fork+0x180/0x8f0 [ 2290.348331][ T144] ? finish_fault+0x230/0x230 [ 2290.353858][ T144] ? dup_mm+0x300/0x300 [ 2290.357985][ T144] ? __secure_computing+0x1b6/0x250 [ 2290.363181][ T144] ? syscall_trace_enter+0x683/0xa70 [ 2290.368448][ T144] __x64_sys_clone+0x246/0x2b0 [ 2290.373180][ T144] ? __ia32_sys_vfork+0x110/0x110 [ 2290.378188][ T144] ? do_user_addr_fault+0x55c/0x9f0 [ 2290.383356][ T144] do_syscall_64+0xcb/0x150 [ 2290.387830][ T144] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2290.393712][ T144] RIP: 0033:0x7f335d9c438b [ 2290.398113][ T144] Code: Bad RIP value. [ 2290.402149][ T144] RSP: 002b:00007ffca55b6db0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 2290.410541][ T144] RAX: ffffffffffffffda RBX: 00007ffca55b6db0 RCX: 00007f335d9c438b [ 2290.418625][ T144] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 2290.426664][ T144] RBP: 00007ffca55b6e00 R08: 00007f335eb748c0 R09: 0000000000000210 [ 2290.434608][ T144] R10: 00007f335eb74b90 R11: 0000000000000246 R12: 0000000000000000 [ 2290.442551][ T144] R13: 0000000000000020 R14: 0000000000000000 R15: 0000000000000000 [ 2290.462018][ T144] Mem-Info: [ 2290.465517][ T144] active_anon:1407246 inactive_anon:4736 isolated_anon:0 [ 2290.465517][ T144] active_file:462 inactive_file:435 isolated_file:25 [ 2290.465517][ T144] unevictable:0 dirty:44 writeback:0 unstable:0 [ 2290.465517][ T144] slab_reclaimable:9523 slab_unreclaimable:97445 [ 2290.465517][ T144] mapped:56242 shmem:4832 pagetables:30975 bounce:0 [ 2290.465517][ T144] free:12887 free_pcp:86 free_cma:0 [ 2290.511859][T28562] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 2290.527582][ T144] Node 0 active_anon:5628984kB inactive_anon:18944kB active_file:976kB inactive_file:1168kB unevictable:0kB isolated(anon):0kB isolated(file):128kB mapped:223568kB dirty:176kB writeback:0kB shmem:19328kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2290.553188][ T144] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2290.647751][ T144] lowmem_reserve[]: 0 2912 6416 6416 [ 2290.653180][ T144] DMA32 free:24448kB min:4644kB low:7624kB high:10604kB active_anon:2914296kB inactive_anon:8216kB active_file:560kB inactive_file:888kB unevictable:0kB writepending:8kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1600kB pagetables:1256kB bounce:0kB free_pcp:1396kB local_pcp:1296kB free_cma:0kB 12:52:32 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x800800000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2290.701983][T10441] usb 1-1: device descriptor read/64, error 18 [ 2290.718044][ T144] lowmem_reserve[]: 0 0 3504 3504 [ 2290.730144][ T144] Normal free:14068kB min:9688kB low:13276kB high:16864kB active_anon:2710188kB inactive_anon:10728kB active_file:1220kB inactive_file:1128kB unevictable:0kB writepending:52kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35424kB pagetables:122644kB bounce:0kB free_pcp:1588kB local_pcp:1152kB free_cma:0kB [ 2290.761145][ T144] lowmem_reserve[]: 0 0 0 0 [ 2290.766446][ T144] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2290.781449][ T144] DMA32: 41*4kB (UM) 214*8kB (UMH) 240*16kB (UM) 154*32kB (UMH) 92*64kB (UMH) 32*128kB (UMH) 3*256kB (UH) 1*512kB (M) 0*1024kB 0*2048kB 0*4096kB = 21908kB [ 2290.797847][ T144] Normal: 833*4kB (UMEH) 109*8kB (UMEH) 567*16kB (UMEH) 19*32kB (UEH) 4*64kB (UH) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 14140kB [ 2290.801758][T28562] usb 4-1: Using ep0 maxpacket: 8 [ 2290.812955][ T144] 6448 total pagecache pages [ 2290.822497][ T144] 0 pages in swap cache [ 2290.827803][ T144] Swap cache stats: add 0, delete 0, find 0/0 [ 2290.834488][ T144] Free swap = 0kB [ 2290.839013][ T144] Total swap = 0kB [ 2290.843733][ T144] 1965979 pages RAM [ 2290.848523][ T144] 0 pages HighMem/MovableOnly [ 2290.854877][ T144] 318041 pages reserved [ 2290.859639][ T144] 0 pages cma reserved [ 2290.864303][ T144] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.2,pid=32170,uid=0 [ 2290.879521][ T144] Out of memory: Killed process 32170 (syz-executor.2) total-vm:85484kB, anon-rss:16572kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:164kB oom_score_adj:1000 12:52:32 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:32 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2290.941982][T28562] usb 4-1: config index 0 descriptor too short (expected 65316, got 36) [ 2290.952938][T28562] usb 4-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2290.964852][T28562] usb 4-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 2290.975619][T28562] usb 4-1: config 5 has 0 interfaces, different from the descriptor's value: 255 [ 2291.061817][T28562] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2291.229928][T12245] syz-executor.2 invoked oom-killer: gfp_mask=0x1100dca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO|0x1000000), order=0, oom_score_adj=1000 [ 2291.243170][T12245] CPU: 0 PID: 12245 Comm: syz-executor.2 Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2291.253323][T12245] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2291.263373][T12245] Call Trace: [ 2291.266661][T12245] dump_stack+0x1b0/0x21e [ 2291.270980][T12245] ? devkmsg_release+0x11c/0x11c [ 2291.275934][T12245] ? ___ratelimit+0x3bf/0x560 [ 2291.280600][T12245] ? show_regs_print_info+0x12/0x12 [ 2291.285783][T12245] ? _raw_spin_lock+0xa1/0x170 [ 2291.290533][T12245] ? radix_tree_cpu_dead+0x160/0x160 [ 2291.295806][T12245] dump_header+0xdb/0x700 [ 2291.300121][T12245] oom_kill_process+0xd3/0x280 [ 2291.304884][T12245] out_of_memory+0x5b6/0x890 [ 2291.309462][T12245] ? unregister_oom_notifier+0x20/0x20 [ 2291.314909][T12245] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2291.320469][T12245] ? get_page_from_freelist+0x7c0/0x7c0 [ 2291.326008][T12245] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2291.331373][T12245] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2291.336908][T12245] ? mem_cgroup_commit_charge+0x198/0x240 [ 2291.342649][T12245] ? mem_cgroup_try_charge_delay+0x10/0x10 [ 2291.348450][T12245] ? __lru_cache_add+0x1a1/0x1f0 [ 2291.353378][T12245] wp_page_copy+0x1a4/0x15a0 [ 2291.357962][T12245] ? add_mm_rss_vec+0x270/0x270 [ 2291.362796][T12245] ? find_lowest_rq+0x162/0x3f0 [ 2291.367644][T12245] ? vm_normal_page+0x1c9/0x1d0 [ 2291.372482][T12245] do_wp_page+0x48d/0x14b0 [ 2291.376887][T12245] ? _raw_spin_lock+0xa1/0x170 [ 2291.381638][T12245] ? do_swap_page+0x1510/0x1510 [ 2291.386477][T12245] handle_mm_fault+0xf6c/0x4140 [ 2291.391318][T12245] ? finish_fault+0x230/0x230 [ 2291.395982][T12245] ? switch_mm_irqs_off+0x25d/0x870 [ 2291.401256][T12245] ? trace_event_raw_event_sched_switch+0x480/0x480 [ 2291.407834][T12245] ? down_read_trylock+0x17a/0x1d0 [ 2291.412938][T12245] ? vmacache_find+0x205/0x4b0 [ 2291.417702][T12245] do_user_addr_fault+0x48a/0x9f0 [ 2291.422724][T12245] page_fault+0x2f/0x40 [ 2291.426872][T12245] RIP: 0010:copy_user_enhanced_fast_string+0xe/0x30 [ 2291.433446][T12245] Code: 89 d1 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 31 c0 0f 1f 00 c3 0f 1f 80 00 00 00 00 0f 1f 00 83 fa 40 0f 82 70 ff ff ff 89 d1 a4 31 c0 0f 1f 00 c3 66 2e 0f 1f 84 00 00 00 00 00 89 d1 f3 a4 [ 2291.453126][T12245] RSP: 0018:ffff88801c56f888 EFLAGS: 00010206 [ 2291.459209][T12245] RAX: ffffffff81f57901 RBX: 0000000020882500 RCX: 0000000000000500 [ 2291.467169][T12245] RDX: 0000000000001000 RSI: ffff888168a18b00 RDI: 0000000020882000 [ 2291.475131][T12245] RBP: ffff88801c56fda8 R08: dffffc0000000000 R09: ffffed102d143200 [ 2291.483094][T12245] R10: 0000000000000000 R11: 0000000000000000 R12: 00007ffffffff000 [ 2291.491057][T12245] R13: 0000000000001000 R14: ffff888168a18000 R15: 0000000020881500 [ 2291.499027][T12245] ? copyout+0x1/0xb0 [ 2291.503002][T12245] copyout+0x8e/0xb0 [ 2291.506890][T12245] copy_page_to_iter+0x393/0xbd0 [ 2291.511843][T12245] pipe_to_user+0xa3/0x130 [ 2291.516253][T12245] __splice_from_pipe+0x2d3/0x870 [ 2291.521267][T12245] ? user_page_pipe_buf_steal+0xc0/0xc0 [ 2291.526805][T12245] do_vmsplice+0x240/0xe70 [ 2291.531209][T12245] ? write_pipe_buf+0x1d0/0x1d0 [ 2291.536048][T12245] ? __rcu_read_lock+0x50/0x50 [ 2291.540824][T12245] ? check_stack_object+0x5a/0x90 [ 2291.545850][T12245] ? _copy_from_user+0xa4/0xe0 [ 2291.550633][T12245] ? rw_copy_check_uvector+0x2b3/0x310 [ 2291.556081][T12245] ? import_iovec+0x171/0x340 [ 2291.560743][T12245] ? dup_iter+0x110/0x110 [ 2291.565060][T12245] ? do_vfs_ioctl+0x756/0x16f0 [ 2291.569829][T12245] __se_sys_vmsplice+0x1cc/0x2c0 [ 2291.574750][T12245] ? __x64_sys_vmsplice+0xa0/0xa0 [ 2291.579769][T12245] ? put_timespec64+0x106/0x150 [ 2291.584626][T12245] ? ktime_get_raw+0x130/0x130 [ 2291.589376][T12245] ? get_timespec64+0x1c0/0x1c0 [ 2291.594262][T12245] ? fget_many+0x20/0x20 [ 2291.598486][T12245] ? __ia32_sys_clock_settime+0x230/0x230 [ 2291.604192][T12245] do_syscall_64+0xcb/0x150 [ 2291.608680][T12245] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2291.614553][T12245] RIP: 0033:0x45de59 [ 2291.618777][T12245] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2291.638366][T12245] RSP: 002b:00007f5eae0f7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 2291.646767][T12245] RAX: ffffffffffffffda RBX: 0000000000038340 RCX: 000000000045de59 [ 2291.654728][T12245] RDX: 0000000000000001 RSI: 0000000020000000 RDI: 0000000000000004 [ 2291.662693][T12245] RBP: 000000000118c0b8 R08: 0000000000000000 R09: 0000000000000000 [ 2291.670650][T12245] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118c07c [ 2291.678611][T12245] R13: 00007ffd71432d0f R14: 00007f5eae0f89c0 R15: 000000000118c07c [ 2291.687150][T12245] Mem-Info: [ 2291.690278][T12245] active_anon:1407221 inactive_anon:4736 isolated_anon:16 [ 2291.690278][T12245] active_file:652 inactive_file:663 isolated_file:0 [ 2291.690278][T12245] unevictable:0 dirty:44 writeback:0 unstable:0 [ 2291.690278][T12245] slab_reclaimable:9523 slab_unreclaimable:97576 [ 2291.690278][T12245] mapped:56492 shmem:4832 pagetables:30946 bounce:0 [ 2291.690278][T12245] free:11538 free_pcp:1198 free_cma:0 [ 2291.728235][T12245] Node 0 active_anon:5628884kB inactive_anon:18944kB active_file:2188kB inactive_file:2184kB unevictable:0kB isolated(anon):64kB isolated(file):0kB mapped:225468kB dirty:176kB writeback:0kB shmem:19328kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2291.752647][T12245] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2291.778598][T12245] lowmem_reserve[]: 0 2912 6416 6416 [ 2291.783932][T12245] DMA32 free:18968kB min:8740kB low:11720kB high:14700kB active_anon:2918184kB inactive_anon:8216kB active_file:456kB inactive_file:412kB unevictable:0kB writepending:8kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1696kB pagetables:1140kB bounce:0kB free_pcp:2408kB local_pcp:1032kB free_cma:0kB [ 2291.813426][T12245] lowmem_reserve[]: 0 0 3504 3504 [ 2291.818466][T12245] Normal free:12280kB min:24744kB low:28332kB high:31920kB active_anon:2710660kB inactive_anon:10728kB active_file:1736kB inactive_file:1504kB unevictable:0kB writepending:52kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35264kB pagetables:122644kB bounce:0kB free_pcp:2568kB local_pcp:1128kB free_cma:0kB [ 2291.848590][T12245] lowmem_reserve[]: 0 0 0 0 [ 2291.853101][T12245] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2291.866434][T12245] DMA32: 140*4kB (UM) 214*8kB (UMH) 187*16kB (UM) 120*32kB (UMH) 83*64kB (UMH) 30*128kB (UMH) 3*256kB (MH) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 19024kB [ 2291.881852][T12245] Normal: 499*4kB (UMEH) 101*8kB (UMEH) 545*16kB (UMEH) 24*32kB (UEH) 4*64kB (UH) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 12548kB [ 2291.896535][T12245] 5752 total pagecache pages [ 2291.901121][T12245] 0 pages in swap cache [ 2291.905290][T12245] Swap cache stats: add 0, delete 0, find 0/0 [ 2291.911341][T12245] Free swap = 0kB [ 2291.915069][T12245] Total swap = 0kB [ 2291.918894][T12245] 1965979 pages RAM [ 2291.922708][T12245] 0 pages HighMem/MovableOnly [ 2291.927384][T12245] 318041 pages reserved [ 2291.931539][T12245] 0 pages cma reserved [ 2291.935585][T12245] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.2,pid=32137,uid=0 [ 2291.949697][T12245] Out of memory: Killed process 32137 (syz-executor.2) total-vm:85484kB, anon-rss:16572kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:164kB oom_score_adj:1000 [ 2292.052774][T10441] usb 1-1: device descriptor read/64, error 18 [ 2292.069182][T28562] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2292.077297][T28562] usb 4-1: SerialNumber: syz [ 2292.211609][T10441] usb usb1-port1: attempt power cycle [ 2292.245446][T12248] fuse: Bad value for 'fd' [ 2292.606641][T12250] fuse: Bad value for 'fd' 12:52:34 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2292.726331][T12253] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2292.964407][T12229] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2292.973718][T28562] usb 4-1: USB disconnect, device number 15 [ 2293.081290][T10441] usb 1-1: new high-speed USB device number 42 using dummy_hcd 12:52:34 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x1000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:34 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="00de"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:34 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:34 executing program 1: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x9}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2293.292408][T10441] usb 1-1: device descriptor read/8, error -61 12:52:35 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x2000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:35 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:35 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:35 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff0500"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:35 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x4000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:35 executing program 5: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff0500"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2293.706341][T12292] fuse: Bad value for 'fd' [ 2293.721092][T10441] usb 1-1: device descriptor read/8, error -61 12:52:35 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2293.761079][T10330] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 2293.811048][ T9634] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 2293.991020][T10441] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 2294.010983][T10330] usb 2-1: Using ep0 maxpacket: 8 [ 2294.060958][ T9634] usb 4-1: Using ep0 maxpacket: 8 [ 2294.130997][T10330] usb 2-1: config index 0 descriptor too short (expected 65316, got 36) [ 2294.139425][T10330] usb 2-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2294.149123][T10330] usb 2-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2294.158936][T10330] usb 2-1: config 5 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 [ 2294.170478][T10441] usb 1-1: device descriptor read/8, error -61 [ 2294.176670][T10330] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2294.187266][T10330] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 65 [ 2294.190970][ T9634] usb 4-1: config index 0 descriptor too short (expected 65316, got 36) [ 2294.197897][T10330] usb 2-1: config 5 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 2294.206186][ T9634] usb 4-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2294.227281][ T9634] usb 4-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 2294.237372][ T9634] usb 4-1: config 5 has 0 interfaces, different from the descriptor's value: 255 [ 2294.290986][T10330] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2294.300202][T10330] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2294.308550][T10330] usb 2-1: SerialNumber: syz [ 2294.321008][ T9634] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2294.330066][ T9634] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2294.330938][T12265] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2294.338623][ T9634] usb 4-1: SerialNumber: syz [ 2294.346404][T12265] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2294.371267][T10330] hub 2-1:5.0: bad descriptor, ignoring hub [ 2294.378580][T10330] hub: probe of 2-1:5.0 failed with error -5 [ 2294.460910][T10441] usb 1-1: device descriptor read/8, error -61 [ 2294.580886][T10441] usb usb1-port1: unable to enumerate USB device [ 2294.585576][T12265] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2294.594092][T12288] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2294.594539][T12265] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2294.605142][T10441] usb 4-1: USB disconnect, device number 16 [ 2294.817522][T12265] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2294.832585][T10330] usblp 2-1:5.0: usblp0: USB Bidirectional printer dev 35 if 0 alt 0 proto 3 vid 0x0525 pid 0xA4A8 [ 2294.871354][T10330] usb 2-1: USB disconnect, device number 35 [ 2294.882726][T10330] usblp0: removed [ 2295.590550][T10330] usb 2-1: new high-speed USB device number 36 using dummy_hcd 12:52:37 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff0500"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:37 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:37 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x10000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:37 executing program 5: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff0500"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2295.850477][T10330] usb 2-1: Using ep0 maxpacket: 8 [ 2295.990531][T10330] usb 2-1: config index 0 descriptor too short (expected 65316, got 36) [ 2295.998869][T10330] usb 2-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2296.008160][T10330] usb 2-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2296.017719][T10330] usb 2-1: config 5 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 [ 2296.029188][T10330] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2296.039434][T10330] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 65 [ 2296.049473][T10330] usb 2-1: config 5 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 2296.140504][T10330] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2296.149590][T10330] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2296.170415][T10330] usb 2-1: SerialNumber: syz 12:52:37 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:37 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:37 executing program 5: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff0500"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:37 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x20000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:37 executing program 1: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) r1 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000000)) [ 2296.200441][T10330] usb 2-1: can't set config #5, error -71 [ 2296.213726][T10330] usb 2-1: USB disconnect, device number 36 [ 2296.221280][T10441] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 2296.460376][T10441] usb 1-1: Using ep0 maxpacket: 8 12:52:38 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x80000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2296.580420][T10441] usb 1-1: config index 0 descriptor too short (expected 65316, got 36) [ 2296.588776][T10441] usb 1-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2296.617064][T10441] usb 1-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 2296.630366][ T9634] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 2296.634343][T10441] usb 1-1: config 5 has 0 interfaces, different from the descriptor's value: 255 [ 2296.640855][ T133] systemd-journal invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=0 [ 2296.690626][ T133] CPU: 1 PID: 133 Comm: systemd-journal Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2296.700705][ T133] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2296.710760][ T133] Call Trace: [ 2296.714057][ T133] dump_stack+0x1b0/0x21e [ 2296.718393][ T133] ? devkmsg_release+0x11c/0x11c [ 2296.723330][ T133] ? ___ratelimit+0x3bf/0x560 [ 2296.728092][ T133] ? show_regs_print_info+0x12/0x12 [ 2296.733350][ T133] ? _raw_spin_lock+0xa1/0x170 [ 2296.737271][T10330] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 2296.738241][ T133] ? radix_tree_cpu_dead+0x160/0x160 [ 2296.751046][ T133] dump_header+0xdb/0x700 [ 2296.755373][ T133] oom_kill_process+0xd3/0x280 [ 2296.760132][ T133] out_of_memory+0x5b6/0x890 [ 2296.764728][ T133] ? unregister_oom_notifier+0x20/0x20 [ 2296.770182][ T133] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2296.775728][ T133] ? get_page_from_freelist+0x7c0/0x7c0 [ 2296.781304][ T133] ? __zone_watermark_ok+0x91/0x280 [ 2296.786525][ T133] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2296.791963][ T133] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2296.798002][ T133] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2296.803517][ T133] ? lockref_get+0x1c2/0x2b0 [ 2296.808077][ T133] ? blk_crypto_keyslot_evict+0x160/0x160 [ 2296.813764][ T133] ? should_fail+0x18e/0x860 [ 2296.818333][ T133] ? __rcu_read_lock+0x50/0x50 [ 2296.823081][ T133] ? setup_fault_attr+0x2b0/0x2b0 [ 2296.828074][ T133] ? find_inode_fast+0x3e7/0x4a0 [ 2296.833002][ T133] __get_free_pages+0xa/0x30 [ 2296.837574][ T133] inode_doinit_with_dentry+0x950/0x10e0 [ 2296.843189][ T133] ? __wake_up_bit+0x170/0x170 [ 2296.847922][ T133] ? sb_finish_set_opts+0x7e0/0x7e0 [ 2296.853098][ T133] ? current_time+0x1aa/0x2e0 [ 2296.857744][ T133] ? atime_needs_update+0x570/0x570 [ 2296.862916][ T133] security_d_instantiate+0x90/0xf0 [ 2296.868096][ T133] d_splice_alias+0x71/0x590 [ 2296.872661][ T133] kernfs_iop_lookup+0x17a/0x1f0 [ 2296.877570][ T133] __lookup_slow+0x2f2/0x470 [ 2296.882129][ T133] ? lookup_one_len+0x2a0/0x2a0 [ 2296.886951][ T133] walk_component+0x363/0x830 [ 2296.891597][ T133] ? follow_managed+0x950/0x950 [ 2296.896528][ T133] ? generic_permission+0x13a/0x4a0 [ 2296.901709][ T133] ? security_inode_permission+0xda/0x110 [ 2296.907401][ T133] link_path_walk+0x6eb/0x14e0 [ 2296.912141][ T133] ? path_init+0x887/0x1220 [ 2296.916624][ T133] ? path_init+0x1220/0x1220 [ 2296.921182][ T133] ? path_init+0x962/0x1220 [ 2296.925663][ T133] path_lookupat+0xd4/0xa50 [ 2296.930236][ T133] ? __kasan_kmalloc+0x117/0x1b0 [ 2296.935164][ T133] ? getname_flags+0xb8/0x610 [ 2296.939818][ T133] ? user_path_at_empty+0x28/0x50 [ 2296.944811][ T133] ? do_faccessat+0x2fc/0x7d0 [ 2296.949455][ T133] ? do_syscall_64+0xcb/0x150 [ 2296.954103][ T133] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2296.960138][ T133] ? __kasan_kmalloc+0x117/0x1b0 [ 2296.965047][ T133] ? kmem_cache_alloc+0x1d5/0x250 [ 2296.970041][ T133] ? filename_lookup+0x6c0/0x6c0 [ 2296.974948][ T133] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2296.980987][ T133] ? __secure_computing+0x250/0x250 [ 2296.986156][ T133] ? __schedule+0x8ae/0xe30 [ 2296.990631][ T133] filename_lookup+0x226/0x6c0 [ 2296.995455][ T133] ? hashlen_string+0x120/0x120 [ 2297.000282][ T133] ? strncpy_from_user+0x20c/0x370 [ 2297.005364][ T133] ? getname_flags+0x20d/0x610 [ 2297.010106][ T133] do_faccessat+0x2fc/0x7d0 [ 2297.014600][ T133] ? __ia32_sys_fallocate+0x100/0x100 [ 2297.019953][ T133] do_syscall_64+0xcb/0x150 [ 2297.024427][ T133] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2297.030307][ T133] RIP: 0033:0x7fa0c7e2b9c7 [ 2297.034703][ T133] Code: 83 c4 08 48 3d 01 f0 ff ff 73 01 c3 48 8b 0d c8 d4 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 b8 15 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d a1 d4 2b 00 f7 d8 64 89 01 48 [ 2297.054278][ T133] RSP: 002b:00007fff5426c7f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000015 [ 2297.062659][ T133] RAX: ffffffffffffffda RBX: 00007fff5426c860 RCX: 00007fa0c7e2b9c7 [ 2297.070617][ T133] RDX: 0000000000312d31 RSI: 0000000000000000 RDI: 00007fff5426c800 [ 2297.080395][ T133] RBP: 00007fff5426d900 R08: 000055e5076e63e0 R09: 0000000000000120 [ 2297.088361][ T133] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff5426d920 [ 2297.096310][ T133] R13: 000055e5076f0a08 R14: 0000000000000018 R15: 00007fff5426c800 [ 2297.108103][T10441] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2297.159709][T10441] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2297.170619][T10441] usb 1-1: SerialNumber: syz [ 2297.171431][ T133] Mem-Info: [ 2297.184050][ T133] active_anon:1407923 inactive_anon:4735 isolated_anon:0 [ 2297.184050][ T133] active_file:561 inactive_file:673 isolated_file:32 [ 2297.184050][ T133] unevictable:0 dirty:0 writeback:0 unstable:0 [ 2297.184050][ T133] slab_reclaimable:9529 slab_unreclaimable:97300 [ 2297.184050][ T133] mapped:56510 shmem:4831 pagetables:30823 bounce:0 [ 2297.184050][ T133] free:12039 free_pcp:301 free_cma:0 [ 2297.320111][ T9634] usb 4-1: Using ep0 maxpacket: 8 [ 2297.322065][ T133] Node 0 active_anon:5633464kB inactive_anon:18940kB active_file:1580kB inactive_file:1784kB unevictable:0kB isolated(anon):0kB isolated(file):128kB mapped:224548kB dirty:60kB writeback:0kB shmem:19324kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2297.350329][T10330] usb 2-1: Using ep0 maxpacket: 8 [ 2297.356046][ T133] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2297.390833][ T133] lowmem_reserve[]: 0 2912 6416 6416 [ 2297.396795][ T133] DMA32 free:17680kB min:4644kB low:7624kB high:10604kB active_anon:2919224kB inactive_anon:8224kB active_file:696kB inactive_file:664kB unevictable:0kB writepending:8kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1696kB pagetables:1336kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2297.449474][ T133] lowmem_reserve[]: 0 0 3504 3504 [ 2297.456219][ T133] Normal free:16164kB min:5592kB low:9180kB high:12768kB active_anon:2714240kB inactive_anon:10716kB active_file:860kB inactive_file:728kB unevictable:0kB writepending:52kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35168kB pagetables:122404kB bounce:0kB free_pcp:924kB local_pcp:492kB free_cma:0kB [ 2297.488915][ T133] lowmem_reserve[]: 0 0 0 0 [ 2297.495200][ T133] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2297.510111][ T9634] usb 4-1: config index 0 descriptor too short (expected 65316, got 36) [ 2297.510568][ T133] DMA32: 203*4kB (UM) 219*8kB (UMH) 189*16kB (UM) 23*32kB (UH) 93*64kB (UH) 32*128kB (UH) 3*256kB (UH) 0*512kB 1*1024kB (M) 0*2048kB 0*4096kB = 18164kB [ 2297.521876][ T9634] usb 4-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2297.535597][T10330] usb 2-1: config index 0 descriptor too short (expected 65316, got 36) [ 2297.552294][T10330] usb 2-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2297.564089][ T9634] usb 4-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 2297.579956][ T133] Normal: 237*4kB (UMEH) 128*8kB (UMEH) 529*16kB (UMEH) 109*32kB (UMEH) 4*64kB (UH) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 14180kB [ 2297.595356][T10330] usb 2-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2297.605058][T10330] usb 2-1: config 5 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 [ 2297.636381][ T133] 5561 total pagecache pages [ 2297.650889][ T133] 0 pages in swap cache [ 2297.655388][T10330] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2297.665775][ T133] Swap cache stats: add 0, delete 0, find 0/0 [ 2297.682841][ T9634] usb 4-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2297.700652][T10330] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 65 [ 2297.704521][ T133] Free swap = 0kB [ 2297.710844][T10330] usb 2-1: config 5 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 2297.720884][ T9634] usb 4-1: config 5 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 2297.727997][ T133] Total swap = 0kB [ 2297.744594][ T133] 1965979 pages RAM [ 2297.748746][ T133] 0 pages HighMem/MovableOnly [ 2297.753750][ T133] 318041 pages reserved [ 2297.758231][ T133] 0 pages cma reserved [ 2297.774210][ T9634] usb 4-1: config 5 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 18 [ 2297.778792][ T133] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.2,pid=31814,uid=0 [ 2297.796441][T12354] syz-executor.4 (12354) used greatest stack depth: 18032 bytes left [ 2297.801799][ T133] Out of memory: Killed process 31814 (syz-executor.2) total-vm:85484kB, anon-rss:16572kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:164kB oom_score_adj:1000 [ 2297.831924][T10330] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2297.841680][T10330] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2297.850192][T10330] usb 2-1: SerialNumber: syz [ 2297.892082][T12342] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2297.903625][T12342] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2297.920478][T10330] hub 2-1:5.0: bad descriptor, ignoring hub [ 2297.931066][T10330] hub: probe of 2-1:5.0 failed with error -5 [ 2297.980064][ T9634] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2297.997268][ T9634] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2298.001560][ T133] systemd-journal invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 2298.018438][ T9634] usb 4-1: SerialNumber: syz [ 2298.035357][ T133] CPU: 0 PID: 133 Comm: systemd-journal Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2298.045437][ T133] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2298.055742][ T133] Call Trace: [ 2298.059011][ T133] dump_stack+0x1b0/0x21e [ 2298.063317][ T133] ? devkmsg_release+0x11c/0x11c [ 2298.068226][ T133] ? ___ratelimit+0x3bf/0x560 [ 2298.072893][ T133] ? show_regs_print_info+0x12/0x12 [ 2298.078061][ T133] ? _raw_spin_lock+0xa1/0x170 [ 2298.082800][ T133] ? radix_tree_cpu_dead+0x160/0x160 [ 2298.088861][ T133] dump_header+0xdb/0x700 [ 2298.093173][ T133] oom_kill_process+0xd3/0x280 [ 2298.097910][ T133] out_of_memory+0x5b6/0x890 [ 2298.102474][ T133] ? unregister_oom_notifier+0x20/0x20 [ 2298.107909][ T133] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2298.113443][ T133] ? get_page_from_freelist+0x7c0/0x7c0 [ 2298.118963][ T133] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2298.124312][ T133] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2298.129851][ T133] pagecache_get_page+0x522/0x8a0 [ 2298.134850][ T133] filemap_fault+0x1435/0x1990 [ 2298.139685][ T133] ? __down_read+0xf1/0x210 [ 2298.144163][ T133] ? generic_file_read_iter+0x20a0/0x20a0 [ 2298.149857][ T133] ? mm_trace_rss_stat+0x4b/0x1a0 [ 2298.155007][ T133] ext4_filemap_fault+0x7b/0x90 [ 2298.159840][ T133] handle_mm_fault+0x291e/0x4140 [ 2298.164771][ T133] ? finish_fault+0x230/0x230 [ 2298.169444][ T133] ? slab_free_freelist_hook+0xd0/0x150 [ 2298.174963][ T133] ? down_read_trylock+0x17a/0x1d0 [ 2298.180062][ T133] ? vmacache_find+0x47a/0x4b0 [ 2298.184796][ T133] do_user_addr_fault+0x48a/0x9f0 [ 2298.189815][ T133] page_fault+0x2f/0x40 [ 2298.193970][ T133] RIP: 0033:0x7fa0c7dd0676 [ 2298.198365][ T133] Code: ff ff ff 90 66 0f ef c0 66 0f ef c9 66 0f ef d2 66 0f ef db 48 89 f8 48 89 f9 48 81 e1 ff 0f 00 00 48 81 f9 cf 0f 00 00 77 6a 0f 6f 20 66 0f 74 e0 66 0f d7 d4 85 d2 74 04 0f bc c2 c3 48 83 [ 2298.218595][ T133] RSP: 002b:00007fff5426c7f8 EFLAGS: 00010297 [ 2298.224661][ T133] RAX: 00007fa0c8871941 RBX: 0000000000000010 RCX: 0000000000000941 12:52:39 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x8c030000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2298.232608][ T133] RDX: 0000000000000888 RSI: 0000000000000000 RDI: 00007fa0c8871941 [ 2298.240554][ T133] RBP: 00007fff5426d900 R08: 000055e5076e63e0 R09: 0000000000000120 [ 2298.248514][ T133] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000e [ 2298.256492][ T133] R13: 000055e5076f0a08 R14: 0000000000000018 R15: 00007fff5426c800 [ 2298.278802][T12342] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2298.304759][T12342] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2298.320619][ T9634] hub 4-1:5.0: bad descriptor, ignoring hub [ 2298.334664][ T9634] hub: probe of 4-1:5.0 failed with error -5 12:52:40 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x20000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2298.400295][ T133] Mem-Info: [ 2298.403486][ T133] active_anon:1403739 inactive_anon:4735 isolated_anon:0 [ 2298.403486][ T133] active_file:537 inactive_file:559 isolated_file:21 [ 2298.403486][ T133] unevictable:0 dirty:12 writeback:20 unstable:0 [ 2298.403486][ T133] slab_reclaimable:9544 slab_unreclaimable:97307 [ 2298.403486][ T133] mapped:56340 shmem:4831 pagetables:30873 bounce:0 [ 2298.403486][ T133] free:16571 free_pcp:116 free_cma:0 [ 2298.441985][ T133] Node 0 active_anon:5614956kB inactive_anon:18940kB active_file:2536kB inactive_file:5136kB unevictable:0kB isolated(anon):76kB isolated(file):212kB mapped:227360kB dirty:48kB writeback:80kB shmem:19324kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2298.473429][ T133] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2298.504031][T12329] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2298.510115][T12346] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2298.515186][T10441] usb 1-1: USB disconnect, device number 44 [ 2298.530592][ T133] lowmem_reserve[]: 0 2912 6416 6416 [ 2298.536716][ T133] DMA32 free:23680kB min:4644kB low:7624kB high:10604kB active_anon:2911564kB inactive_anon:8224kB active_file:1260kB inactive_file:1128kB unevictable:0kB writepending:80kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1600kB pagetables:1336kB bounce:0kB free_pcp:396kB local_pcp:120kB free_cma:0kB [ 2298.554689][T12342] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2298.581607][T10330] usblp 2-1:5.0: usblp0: USB Bidirectional printer dev 37 if 0 alt 0 proto 3 vid 0x0525 pid 0xA4A8 [ 2298.583717][ T133] lowmem_reserve[]: 0 0 3504 3504 [ 2298.599489][ T133] Normal free:13148kB min:24744kB low:28332kB high:31920kB active_anon:2710132kB inactive_anon:10716kB active_file:1784kB inactive_file:5528kB unevictable:0kB writepending:48kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35168kB pagetables:122552kB bounce:0kB free_pcp:852kB local_pcp:496kB free_cma:0kB [ 2298.632055][T10330] usb 2-1: USB disconnect, device number 37 [ 2298.635923][ T9634] usb 4-1: USB disconnect, device number 17 [ 2298.646887][T10330] usblp0: removed [ 2298.708022][ T133] lowmem_reserve[]: 0 0 0 0 [ 2298.712642][ T133] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2298.795714][ T133] DMA32: 504*4kB (UM) 247*8kB (UMH) 277*16kB (UME) 63*32kB (UMH) 94*64kB (UH) 33*128kB (UH) 3*256kB (UH) 0*512kB 1*1024kB (E) 0*2048kB 0*4096kB = 22472kB [ 2298.815171][ T133] Normal: 717*4kB (UMH) 189*8kB (UMEH) 526*16kB (UMEH) 170*32kB (UMEH) 51*64kB (UMH) 5*128kB (M) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 22140kB [ 2298.831798][ T133] 6281 total pagecache pages [ 2298.836737][ T133] 0 pages in swap cache [ 2298.841389][ T133] Swap cache stats: add 0, delete 0, find 0/0 [ 2298.847657][ T133] Free swap = 0kB [ 2298.851719][ T133] Total swap = 0kB [ 2298.856117][ T133] 1965979 pages RAM [ 2298.860208][ T133] 0 pages HighMem/MovableOnly [ 2298.865078][ T133] 318041 pages reserved [ 2298.869405][ T133] 0 pages cma reserved [ 2298.873785][ T133] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.2,pid=31514,uid=0 [ 2298.888223][ T133] Out of memory: Killed process 31514 (syz-executor.2) total-vm:85484kB, anon-rss:16572kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:164kB oom_score_adj:1000 12:52:40 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xf0ffffff0f0000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:40 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:40 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:40 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff0500"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:40 executing program 5: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) fadvise64(0xffffffffffffffff, 0x3, 0x68, 0x4) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f0000000000)) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_SCAN(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, r3, 0x701, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}}, 0x0) fcntl$F_GET_RW_HINT(r1, 0x40b, &(0x7f0000000380)) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_START_AP(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x7c, r6, 0x545f421cd70d6b53, 0x0, 0x0, {{0x5}, {@val={0x8}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x60, 0xe, {@with_ht={{{}, {}, @broadcast, @broadcast, @from_mac=@device_b}}, 0x0, @random, 0x0, @void, @val, @void, @void, @void, @void, @val={0x25, 0x3}, @val={0x2a, 0x1}, @val={0x3c, 0x4}, @val={0x2d, 0x1a}, @val={0x72, 0x6}, @void, @void}}]]}, 0x7c}}, 0x0) sendmsg$NL80211_CMD_DEL_INTERFACE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="200027bd7000fcdbdf2508000000080003006df9f5f3c0a6a16929b22c3c60e367c1619532779456a1649cb11f8f2527050272681959fc2da5361e9db3344c9b05c95098863eb0310a29503ee1370f70e0db", @ANYRES32=r2, @ANYBLOB="0c009900f9ffffff76000000"], 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x21) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:41 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x100000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:41 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:41 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x200000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2299.419619][T10441] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 2299.449610][ T9634] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 2299.459752][T10330] usb 2-1: new high-speed USB device number 38 using dummy_hcd 12:52:41 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:41 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x300000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:41 executing program 5: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) fadvise64(0xffffffffffffffff, 0x3, 0x68, 0x4) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f0000000000)) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_SCAN(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, r3, 0x701, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}}, 0x0) fcntl$F_GET_RW_HINT(r1, 0x40b, &(0x7f0000000380)) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_START_AP(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x7c, r6, 0x545f421cd70d6b53, 0x0, 0x0, {{0x5}, {@val={0x8}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x60, 0xe, {@with_ht={{{}, {}, @broadcast, @broadcast, @from_mac=@device_b}}, 0x0, @random, 0x0, @void, @val, @void, @void, @void, @void, @val={0x25, 0x3}, @val={0x2a, 0x1}, @val={0x3c, 0x4}, @val={0x2d, 0x1a}, @val={0x72, 0x6}, @void, @void}}]]}, 0x7c}}, 0x0) sendmsg$NL80211_CMD_DEL_INTERFACE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="200027bd7000fcdbdf2508000000080003006df9f5f3c0a6a16929b22c3c60e367c1619532779456a1649cb11f8f2527050272681959fc2da5361e9db3344c9b05c95098863eb0310a29503ee1370f70e0db", @ANYRES32=r2, @ANYBLOB="0c009900f9ffffff76000000"], 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x21) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2299.669625][T10441] usb 1-1: Using ep0 maxpacket: 8 [ 2299.689585][ T9634] usb 4-1: Using ep0 maxpacket: 8 [ 2299.699572][T10330] usb 2-1: Using ep0 maxpacket: 8 [ 2299.759548][T10330] usb 2-1: device descriptor read/all, error -71 [ 2299.789574][T10441] usb 1-1: config index 0 descriptor too short (expected 65316, got 36) [ 2299.798845][T10441] usb 1-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2299.822015][T10441] usb 1-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 2299.839747][ T9634] usb 4-1: config index 0 descriptor too short (expected 65316, got 36) [ 2299.841901][T10441] usb 1-1: config 5 has 0 interfaces, different from the descriptor's value: 255 [ 2299.848295][ T9634] usb 4-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2299.867018][ T9634] usb 4-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 2299.879037][ T9634] usb 4-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2299.888422][ T9634] usb 4-1: config 5 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 2299.929776][T10441] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2299.946860][T10441] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2299.949566][ T9634] usb 4-1: config 5 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 18 12:52:41 executing program 1: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f00000001c0)={0x4, 0x7, 0x3f, 0x9, 0x7, "a9e1f312800d94fb"}) fstat(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r5, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r7, 0x0) syz_mount_image$fuse(&(0x7f0000000000)='fuse\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x8020, &(0x7f0000000280)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, 0xffffffffffffffff}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@allow_other='allow_other'}, {@blksize={'blksize', 0x3d, 0x800}}, {@default_permissions='default_permissions'}], [{@appraise_type='appraise_type=imasig'}, {@fowner_lt={'fowner<', r5}}, {@euid_gt={'euid>', r7}}, {@pcr={'pcr', 0x3d, 0x11}}, {@obj_role={'obj_role', 0x3d, '\xaa@/-\\'}}, {@audit='audit'}]}}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000180)={0x0, 0x1, 0x6, @broadcast}, 0x10) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2299.980650][T10441] usb 1-1: SerialNumber: syz [ 2300.049552][ T9634] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2300.058712][ T9634] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2300.099418][ T9634] usb 4-1: SerialNumber: syz [ 2300.170204][ T9634] hub 4-1:5.0: bad descriptor, ignoring hub [ 2300.177022][ T9634] hub: probe of 4-1:5.0 failed with error -5 [ 2300.376683][T12383] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2300.377841][T12384] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2300.394889][T28562] usb 1-1: USB disconnect, device number 45 [ 2300.499426][T10441] usb 4-1: USB disconnect, device number 18 [ 2300.649353][T10330] usb 2-1: new high-speed USB device number 39 using dummy_hcd 12:52:42 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff0500"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:42 executing program 5: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) fadvise64(0xffffffffffffffff, 0x3, 0x68, 0x4) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f0000000000)) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_SCAN(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, r3, 0x701, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}}, 0x0) fcntl$F_GET_RW_HINT(r1, 0x40b, &(0x7f0000000380)) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_START_AP(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x7c, r6, 0x545f421cd70d6b53, 0x0, 0x0, {{0x5}, {@val={0x8}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x60, 0xe, {@with_ht={{{}, {}, @broadcast, @broadcast, @from_mac=@device_b}}, 0x0, @random, 0x0, @void, @val, @void, @void, @void, @void, @val={0x25, 0x3}, @val={0x2a, 0x1}, @val={0x3c, 0x4}, @val={0x2d, 0x1a}, @val={0x72, 0x6}, @void, @void}}]]}, 0x7c}}, 0x0) sendmsg$NL80211_CMD_DEL_INTERFACE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="200027bd7000fcdbdf2508000000080003006df9f5f3c0a6a16929b22c3c60e367c1619532779456a1649cb11f8f2527050272681959fc2da5361e9db3344c9b05c95098863eb0310a29503ee1370f70e0db", @ANYRES32=r2, @ANYBLOB="0c009900f9ffffff76000000"], 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x21) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:42 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:42 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:42 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x400000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2300.889232][T10330] usb 2-1: Using ep0 maxpacket: 8 [ 2301.009471][T10330] usb 2-1: config index 0 descriptor too short (expected 65316, got 36) [ 2301.018362][T10330] usb 2-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2301.045361][T10330] usb 2-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2301.066302][T10330] usb 2-1: config 5 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 [ 2301.101923][T10330] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2301.134110][T10330] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 65 [ 2301.156569][T10330] usb 2-1: config 5 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 2301.189144][ T9634] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 2301.349151][T28562] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 2301.619051][T28562] usb 4-1: Using ep0 maxpacket: 8 [ 2301.769196][T10330] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2301.809645][T10330] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2301.848983][T10330] usb 2-1: SerialNumber: syz [ 2301.869056][T12426] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2301.910200][T12426] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2301.948640][T10330] hub 2-1:5.0: bad descriptor, ignoring hub [ 2301.959120][ T9634] usb 1-1: Using ep0 maxpacket: 8 [ 2301.973490][T10330] hub: probe of 2-1:5.0 failed with error -5 [ 2302.089076][ T9634] usb 1-1: config index 0 descriptor too short (expected 65316, got 36) [ 2302.097458][ T9634] usb 1-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2302.118960][ T9634] usb 1-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 2302.129036][T28562] usb 4-1: config index 0 descriptor too short (expected 65316, got 36) [ 2302.136548][ T9634] usb 1-1: config 5 has 0 interfaces, different from the descriptor's value: 255 [ 2302.139111][T28562] usb 4-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2302.153489][T12426] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2302.156622][T28562] usb 4-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 2302.166535][T12426] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2302.173606][T28562] usb 4-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2302.190370][T28562] usb 4-1: config 5 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 2302.219368][T28562] usb 4-1: config 5 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 18 [ 2302.239034][ T9634] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2302.248602][ T9634] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2302.257028][ T9634] usb 1-1: SerialNumber: syz [ 2302.328973][T28562] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2302.348897][T28562] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2302.357094][T28562] usb 4-1: SerialNumber: syz [ 2302.419327][T28562] hub 4-1:5.0: bad descriptor, ignoring hub [ 2302.425839][T28562] hub: probe of 4-1:5.0 failed with error -5 [ 2302.457778][T12456] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 12:52:44 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x500000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:44 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:44 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2302.508184][T12434] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2302.519880][T28562] usb 1-1: USB disconnect, device number 46 [ 2302.621704][ T133] systemd-journal invoked oom-killer: gfp_mask=0x40cc0(GFP_KERNEL|__GFP_COMP), order=1, oom_score_adj=0 [ 2302.635356][T12437] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2302.661431][ T133] CPU: 0 PID: 133 Comm: systemd-journal Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2302.671551][ T133] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2302.681603][ T133] Call Trace: [ 2302.684893][ T133] dump_stack+0x1b0/0x21e [ 2302.689563][ T133] ? devkmsg_release+0x11c/0x11c [ 2302.694515][ T133] ? ___ratelimit+0x3bf/0x560 [ 2302.699188][ T133] ? show_regs_print_info+0x12/0x12 [ 2302.704381][ T133] ? _raw_spin_lock+0xa1/0x170 [ 2302.709700][ T133] ? radix_tree_cpu_dead+0x160/0x160 [ 2302.714981][ T133] dump_header+0xdb/0x700 [ 2302.719306][ T133] oom_kill_process+0xd3/0x280 [ 2302.724082][ T133] out_of_memory+0x5b6/0x890 [ 2302.728672][ T133] ? unregister_oom_notifier+0x20/0x20 [ 2302.731733][T12468] fuse: Bad value for 'fd' [ 2302.734157][ T133] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2302.734172][ T133] ? get_page_from_freelist+0x7c0/0x7c0 [ 2302.749925][ T133] ? __zone_watermark_ok+0x91/0x280 [ 2302.755131][ T133] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2302.760523][ T133] ? __kasan_kmalloc+0x117/0x1b0 [ 2302.765492][ T133] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2302.771034][ T133] ? kmem_cache_alloc+0x1d5/0x250 [ 2302.776063][ T133] ? filename_lookup+0x4e6/0x6c0 [ 2302.781036][ T133] ? kmem_cache_free+0xac/0x5c0 [ 2302.785887][ T133] ? __secure_computing+0x250/0x250 [ 2302.791187][ T133] alloc_slab_page+0x3a/0x390 [ 2302.795865][ T133] new_slab+0x408/0x450 [ 2302.804902][ T133] ? should_fail+0x18e/0x860 [ 2302.810212][ T133] ___slab_alloc+0x2e0/0x450 [ 2302.814828][ T133] ? getname_flags+0xb8/0x610 [ 2302.819500][ T133] ? getname_flags+0xb8/0x610 [ 2302.824172][ T133] kmem_cache_alloc+0x230/0x250 [ 2302.829028][ T133] getname_flags+0xb8/0x610 [ 2302.834155][ T133] ? security_prepare_creds+0x197/0x220 [ 2302.839702][ T133] user_path_at_empty+0x28/0x50 [ 2302.844546][ T133] do_faccessat+0x2fc/0x7d0 [ 2302.849029][ T133] ? __ia32_sys_fallocate+0x100/0x100 [ 2302.854373][ T133] ? do_user_addr_fault+0x55c/0x9f0 [ 2302.859543][ T133] do_syscall_64+0xcb/0x150 [ 2302.864046][ T133] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2302.869908][ T133] RIP: 0033:0x7fa0c7e2b9c7 [ 2302.874297][ T133] Code: 83 c4 08 48 3d 01 f0 ff ff 73 01 c3 48 8b 0d c8 d4 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 b8 15 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d a1 d4 2b 00 f7 d8 64 89 01 48 [ 2302.893888][ T133] RSP: 002b:00007fff5426c7f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000015 [ 2302.902269][ T133] RAX: ffffffffffffffda RBX: 00007fff5426c860 RCX: 00007fa0c7e2b9c7 [ 2302.910213][ T133] RDX: 0000000000312d34 RSI: 0000000000000000 RDI: 00007fff5426c800 [ 2302.918181][ T133] RBP: 00007fff5426d900 R08: 000055e5076e63e0 R09: 0000000000000120 [ 2302.926140][ T133] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff5426d920 [ 2302.934098][ T133] R13: 000055e5076f1b88 R14: 0000000000000018 R15: 00007fff5426c800 [ 2302.949026][ T9634] usb 4-1: USB disconnect, device number 19 [ 2303.036594][ T133] Mem-Info: [ 2303.040015][ T133] active_anon:1406926 inactive_anon:4736 isolated_anon:0 [ 2303.040015][ T133] active_file:792 inactive_file:1233 isolated_file:28 [ 2303.040015][ T133] unevictable:0 dirty:33 writeback:0 unstable:0 [ 2303.040015][ T133] slab_reclaimable:9550 slab_unreclaimable:97205 [ 2303.040015][ T133] mapped:56977 shmem:4832 pagetables:31004 bounce:0 [ 2303.040015][ T133] free:11863 free_pcp:797 free_cma:0 12:52:44 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x600000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:44 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:44 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2303.078802][ T133] Node 0 active_anon:5627704kB inactive_anon:18944kB active_file:3268kB inactive_file:5232kB unevictable:0kB isolated(anon):0kB isolated(file):212kB mapped:228008kB dirty:132kB writeback:0kB shmem:19328kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2303.103864][ T133] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2303.187485][ T133] lowmem_reserve[]: 0 2912 6416 6416 [ 2303.199106][ T133] DMA32 free:22264kB min:4644kB low:7624kB high:10604kB active_anon:2916184kB inactive_anon:8212kB active_file:1560kB inactive_file:2580kB unevictable:0kB writepending:16kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1440kB pagetables:1132kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2303.268665][ T133] lowmem_reserve[]: 0 0 3504 3504 [ 2303.273746][ T133] Normal free:12288kB min:24744kB low:28332kB high:31920kB active_anon:2711164kB inactive_anon:10732kB active_file:944kB inactive_file:1356kB unevictable:0kB writepending:116kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35456kB pagetables:122884kB bounce:0kB free_pcp:1132kB local_pcp:1128kB free_cma:0kB [ 2303.307558][ T133] lowmem_reserve[]: 0 0 0 0 [ 2303.312742][ T133] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2303.332957][ T133] DMA32: 240*4kB (UM) 255*8kB (UMH) 226*16kB (UM) 95*32kB (UMH) 102*64kB (UMH) 37*128kB (UMH) 5*256kB (MH) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 22200kB [ 2303.351096][ T133] Normal: 508*4kB (UMEH) 202*8kB (UMEH) 482*16kB (UMEH) 34*32kB (UMEH) 8*64kB (UMH) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 12960kB [ 2303.428810][ T133] 5694 total pagecache pages [ 2303.434690][ T133] 0 pages in swap cache [ 2303.439175][ T133] Swap cache stats: add 0, delete 0, find 0/0 [ 2303.454911][ T133] Free swap = 0kB [ 2303.459043][ T133] Total swap = 0kB [ 2303.464769][ T133] 1965979 pages RAM [ 2303.468771][ T133] 0 pages HighMem/MovableOnly [ 2303.473479][ T133] 318041 pages reserved [ 2303.477637][ T133] 0 pages cma reserved [ 2303.483137][ T133] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.2,pid=13158,uid=0 [ 2303.500310][ T133] Out of memory: Killed process 13158 (syz-executor.2) total-vm:85484kB, anon-rss:16572kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:164kB oom_score_adj:1000 [ 2303.518090][ T23] oom_reaper: reaped process 13158 (syz-executor.2), now anon-rss:0kB, file-rss:34816kB, shmem-rss:0kB 12:52:45 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:45 executing program 1: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241d08b549f1d22e2b38e4c2fb31e076495f8e7094c8ee54fc0bfa0888230c7149c"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:45 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2303.559228][T10330] usblp 2-1:5.0: usblp0: USB Bidirectional printer dev 39 if 0 alt 0 proto 3 vid 0x0525 pid 0xA4A8 [ 2303.990709][T10330] usb 2-1: reset high-speed USB device number 39 using dummy_hcd 12:52:45 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:45 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x620000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2304.038449][T16300] usb 1-1: new high-speed USB device number 47 using dummy_hcd 12:52:45 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2304.138826][T26029] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 2304.238417][T10330] usb 2-1: Using ep0 maxpacket: 8 [ 2304.308386][T16300] usb 1-1: Using ep0 maxpacket: 8 [ 2304.318473][T10330] usb 2-1: device firmware changed [ 2304.324326][T10330] usb 2-1: USB disconnect, device number 39 [ 2304.398501][T26029] usb 4-1: Using ep0 maxpacket: 8 [ 2304.438459][T16300] usb 1-1: config index 0 descriptor too short (expected 65316, got 36) 12:52:46 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x700000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2304.447349][T16300] usb 1-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2304.497194][T16300] usb 1-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 2304.508117][T16300] usb 1-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2304.519416][T16300] usb 1-1: config 5 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 2304.531151][T26029] usb 4-1: config index 0 descriptor too short (expected 65316, got 36) 12:52:46 executing program 5: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f00000001c0)={0x4, 0x7, 0x3f, 0x9, 0x7, "a9e1f312800d94fb"}) fstat(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r5, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r7, 0x0) syz_mount_image$fuse(&(0x7f0000000000)='fuse\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x8020, &(0x7f0000000280)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, 0xffffffffffffffff}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@allow_other='allow_other'}, {@blksize={'blksize', 0x3d, 0x800}}, {@default_permissions='default_permissions'}], [{@appraise_type='appraise_type=imasig'}, {@fowner_lt={'fowner<', r5}}, {@euid_gt={'euid>', r7}}, {@pcr={'pcr', 0x3d, 0x11}}, {@obj_role={'obj_role', 0x3d, '\xaa@/-\\'}}, {@audit='audit'}]}}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000180)={0x0, 0x1, 0x6, @broadcast}, 0x10) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2304.539862][T16300] usb 1-1: config 5 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 18 [ 2304.542268][T10330] usblp0: removed [ 2304.553827][T26029] usb 4-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2304.565570][T26029] usb 4-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 2304.576060][T26029] usb 4-1: config 5 has 0 interfaces, different from the descriptor's value: 255 [ 2304.648534][T16300] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2304.658467][T16300] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2304.667542][T16300] usb 1-1: SerialNumber: syz [ 2304.678370][T26029] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2304.697753][T26029] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2304.716692][T26029] usb 4-1: SerialNumber: syz [ 2304.828835][T16300] hub 1-1:5.0: bad descriptor, ignoring hub [ 2304.836520][T16300] hub: probe of 1-1:5.0 failed with error -5 [ 2304.918240][T10330] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 2305.082645][T12494] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2305.082649][T12489] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2305.119568][T28562] usb 4-1: USB disconnect, device number 20 [ 2305.158238][T10330] usb 2-1: Using ep0 maxpacket: 8 12:52:46 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x800000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2305.218641][T16300] usb 1-1: USB disconnect, device number 47 [ 2305.287365][T10330] kworker/0:0: page allocation failure: order:4, mode:0x40cc0(GFP_KERNEL|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0 [ 2305.331771][T10330] CPU: 0 PID: 10330 Comm: kworker/0:0 Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2305.341863][T10330] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2305.351922][T10330] Workqueue: usb_hub_wq hub_event [ 2305.356938][T10330] Call Trace: [ 2305.360228][T10330] dump_stack+0x1b0/0x21e [ 2305.364554][T10330] ? devkmsg_release+0x11c/0x11c [ 2305.369501][T10330] ? show_regs_print_info+0x12/0x12 [ 2305.374738][T10330] warn_alloc+0x1ee/0x340 [ 2305.379066][T10330] ? zone_watermark_ok_safe+0x420/0x420 [ 2305.384610][T10330] __alloc_pages_slowpath+0x1c98/0x1cb0 [ 2305.390150][T10330] ? process_one_work+0x777/0xf90 [ 2305.395634][T10330] ? get_page_from_freelist+0x7c0/0x7c0 [ 2305.401179][T10330] ? __zone_watermark_ok+0x91/0x280 [ 2305.407001][T10330] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2305.412492][T10330] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2305.418211][T10330] ? usb_anchor_empty+0x40/0x40 [ 2305.423508][T10330] ? setup_fault_attr+0x2b0/0x2b0 [ 2305.428553][T10330] ? ___slab_alloc+0x297/0x450 [ 2305.433409][T10330] kmalloc_order_trace+0x2a/0xf0 [ 2305.438351][T10330] __kmalloc+0x268/0x2c0 [ 2305.442591][T10330] usb_get_configuration+0x326/0x4920 [ 2305.447983][T10330] ? _raw_spin_lock_irqsave+0xda/0x1c0 [ 2305.453440][T10330] ? slab_free_freelist_hook+0xd0/0x150 [ 2305.459070][T10330] ? trace_rpm_return_int_rcuidle+0x23/0x1d0 [ 2305.465052][T10330] ? rpm_resume+0xa29/0x19b0 [ 2305.469644][T10330] ? usb_destroy_configuration+0x580/0x580 [ 2305.475444][T10330] ? _raw_spin_lock_irq+0xa2/0x180 [ 2305.480551][T10330] ? _raw_spin_lock_irqsave+0x1c0/0x1c0 [ 2305.486103][T10330] ? pm_runtime_forbid+0xa7/0xf0 [ 2305.491046][T10330] usb_new_device+0x155/0x1710 [ 2305.495983][T10330] ? hub_port_init+0x1e9e/0x30e0 [ 2305.501125][T10330] ? _raw_spin_lock_irq+0xa2/0x180 [ 2305.506388][T10330] ? usb_disconnect+0x880/0x880 [ 2305.511273][T10330] hub_event+0x2a5b/0x4d50 [ 2305.515693][T10330] ? led_work+0x530/0x530 [ 2305.520021][T10330] ? pm_schedule_suspend+0x1d0/0x1d0 [ 2305.525301][T10330] ? _raw_spin_lock+0x170/0x170 [ 2305.530148][T10330] ? mutex_lock+0xa6/0x110 [ 2305.534559][T10330] ? _raw_spin_lock_irq+0xa2/0x180 [ 2305.539671][T10330] ? read_word_at_a_time+0xe/0x20 [ 2305.544702][T10330] ? strscpy+0xa6/0x260 [ 2305.548868][T10330] process_one_work+0x777/0xf90 [ 2305.553727][T10330] worker_thread+0xdb6/0x1430 [ 2305.558428][T10330] kthread+0x317/0x340 [ 2305.562507][T10330] ? process_one_work+0xf90/0xf90 [ 2305.567535][T10330] ? kthread_destroy_worker+0x270/0x270 [ 2305.573124][T10330] ret_from_fork+0x1f/0x30 [ 2305.579709][T10330] Mem-Info: [ 2305.583297][T10330] active_anon:1405381 inactive_anon:4736 isolated_anon:0 [ 2305.583297][T10330] active_file:706 inactive_file:637 isolated_file:10 [ 2305.583297][T10330] unevictable:0 dirty:25 writeback:0 unstable:0 [ 2305.583297][T10330] slab_reclaimable:9550 slab_unreclaimable:97121 [ 2305.583297][T10330] mapped:56463 shmem:4833 pagetables:31033 bounce:0 [ 2305.583297][T10330] free:14310 free_pcp:516 free_cma:0 12:52:47 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:47 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2305.626518][T10330] Node 0 active_anon:5621424kB inactive_anon:18944kB active_file:3224kB inactive_file:5348kB unevictable:0kB isolated(anon):0kB isolated(file):40kB mapped:227952kB dirty:100kB writeback:0kB shmem:19332kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2305.651929][T10330] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2305.679172][T10330] lowmem_reserve[]: 0 2912 6416 6416 [ 2305.685510][T10330] DMA32 free:24888kB min:4644kB low:7624kB high:10604kB active_anon:2909740kB inactive_anon:8216kB active_file:1216kB inactive_file:1924kB unevictable:0kB writepending:40kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1664kB pagetables:1156kB bounce:0kB free_pcp:488kB local_pcp:52kB free_cma:0kB [ 2305.720840][T10330] lowmem_reserve[]: 0 0 3504 3504 [ 2305.727018][T10330] Normal free:12144kB min:5592kB low:9180kB high:12768kB active_anon:2711584kB inactive_anon:10728kB active_file:1608kB inactive_file:4488kB unevictable:0kB writepending:60kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35168kB pagetables:122976kB bounce:0kB free_pcp:480kB local_pcp:144kB free_cma:0kB [ 2305.757812][T10330] lowmem_reserve[]: 0 0 0 0 [ 2305.764043][T10330] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB 12:52:47 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2305.779446][T10330] DMA32: 217*4kB (UM) 290*8kB (UMH) 318*16kB (UM) 43*32kB (UMH) 89*64kB (UMH) 51*128kB (UMH) 4*256kB (UMH) 0*512kB 0*1024kB 1*2048kB (M) 0*4096kB = 24948kB [ 2305.796689][T10330] Normal: 281*4kB (UMEH) 151*8kB (UMEH) 457*16kB (UMEH) 43*32kB (UEH) 10*64kB (UH) 2*128kB (U) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 11916kB [ 2305.813555][T10330] 7216 total pagecache pages [ 2305.818512][T10330] 0 pages in swap cache [ 2305.822782][T10330] Swap cache stats: add 0, delete 0, find 0/0 [ 2305.831528][T10330] Free swap = 0kB [ 2305.836981][T10330] Total swap = 0kB [ 2305.840993][T10330] 1965979 pages RAM [ 2305.844936][T10330] 0 pages HighMem/MovableOnly [ 2305.849887][T10330] 318041 pages reserved [ 2305.854209][T10330] 0 pages cma reserved [ 2305.858455][T10330] usb 2-1: out of memory [ 2305.862822][T10330] usb 2-1: can't read configurations, error -12 [ 2305.957992][T16300] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 2306.018052][T10330] usb 2-1: new high-speed USB device number 41 using dummy_hcd 12:52:47 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x900000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2306.178002][T26029] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 2306.217958][T16300] usb 1-1: Using ep0 maxpacket: 8 [ 2306.239885][ T144] systemd-udevd invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=3, oom_score_adj=-1000 [ 2306.263154][ T144] CPU: 1 PID: 144 Comm: systemd-udevd Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2306.273107][ T144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2306.277928][T10330] usb 2-1: Using ep0 maxpacket: 8 [ 2306.283698][ T144] Call Trace: [ 2306.292027][ T144] dump_stack+0x1b0/0x21e [ 2306.296443][ T144] ? devkmsg_release+0x11c/0x11c [ 2306.301381][ T144] ? ___ratelimit+0x3bf/0x560 [ 2306.306052][ T144] ? show_regs_print_info+0x12/0x12 [ 2306.311254][ T144] ? _raw_spin_lock+0xa1/0x170 [ 2306.316110][ T144] ? radix_tree_cpu_dead+0x160/0x160 [ 2306.321828][ T144] dump_header+0xdb/0x700 [ 2306.326254][ T144] oom_kill_process+0xd3/0x280 [ 2306.331016][ T144] out_of_memory+0x5b6/0x890 [ 2306.335604][ T144] ? unregister_oom_notifier+0x20/0x20 [ 2306.341061][ T144] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2306.346791][ T144] ? get_page_from_freelist+0x7c0/0x7c0 [ 2306.352379][ T144] ? __zone_watermark_ok+0x91/0x280 [ 2306.357625][ T144] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2306.363002][ T144] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2306.368762][ T144] ? copy_process+0x5c9/0x52f0 [ 2306.373627][ T144] ? kmem_cache_alloc+0x1d5/0x250 [ 2306.378844][ T144] copy_process+0x612/0x52f0 [ 2306.383459][ T144] ? _raw_spin_lock_irqsave+0xda/0x1c0 [ 2306.388919][ T144] ? sock_setsockopt+0x1d93/0x2c30 [ 2306.394114][ T144] ? fork_idle+0x290/0x290 [ 2306.398529][ T144] _do_fork+0x180/0x8f0 [ 2306.402682][ T144] ? dup_mm+0x300/0x300 [ 2306.406845][ T144] ? __secure_computing+0x1b6/0x250 [ 2306.412044][ T144] ? syscall_trace_enter+0x683/0xa70 [ 2306.417456][ T144] __x64_sys_clone+0x246/0x2b0 [ 2306.422220][ T144] ? __ia32_sys_vfork+0x110/0x110 [ 2306.427253][ T144] do_syscall_64+0xcb/0x150 [ 2306.431741][ T144] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2306.437616][ T144] RIP: 0033:0x7f335d9c438b [ 2306.442035][ T144] Code: db 45 85 f6 0f 85 95 01 00 00 64 4c 8b 04 25 10 00 00 00 31 d2 4d 8d 90 d0 02 00 00 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 de 00 00 00 85 c0 41 89 c5 0f 85 e5 00 00 [ 2306.461622][ T144] RSP: 002b:00007ffca55b6db0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 2306.470093][ T144] RAX: ffffffffffffffda RBX: 00007ffca55b6db0 RCX: 00007f335d9c438b [ 2306.478148][ T144] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 2306.486092][ T144] RBP: 00007ffca55b6e00 R08: 00007f335eb748c0 R09: 0000000000000210 [ 2306.494051][ T144] R10: 00007f335eb74b90 R11: 0000000000000246 R12: 0000000000000000 [ 2306.501996][ T144] R13: 0000000000000020 R14: 0000000000000000 R15: 0000000000000000 [ 2306.545561][ T144] Mem-Info: [ 2306.568562][ T144] active_anon:1408465 inactive_anon:4735 isolated_anon:0 [ 2306.568562][ T144] active_file:382 inactive_file:383 isolated_file:64 [ 2306.568562][ T144] unevictable:0 dirty:15 writeback:0 unstable:0 [ 2306.568562][ T144] slab_reclaimable:9550 slab_unreclaimable:97238 [ 2306.568562][ T144] mapped:56178 shmem:4831 pagetables:31040 bounce:0 [ 2306.568562][ T144] free:11355 free_pcp:672 free_cma:0 [ 2306.616341][ T144] Node 0 active_anon:5633860kB inactive_anon:18940kB active_file:976kB inactive_file:1432kB unevictable:0kB isolated(anon):0kB isolated(file):348kB mapped:224312kB dirty:60kB writeback:0kB shmem:19324kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2306.665678][ T144] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2306.694148][T26029] usb 4-1: Using ep0 maxpacket: 8 [ 2306.700705][ T144] lowmem_reserve[]: 0 2912 6416 6416 [ 2306.706616][ T144] DMA32 free:18388kB min:4644kB low:7624kB high:10604kB active_anon:2919056kB inactive_anon:8220kB active_file:344kB inactive_file:340kB unevictable:0kB writepending:16kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1536kB pagetables:1156kB bounce:0kB free_pcp:732kB local_pcp:508kB free_cma:0kB [ 2306.737320][T10330] usb 2-1: out of memory [ 2306.738625][ T144] lowmem_reserve[]: 0 0 3504 3504 [ 2306.741828][T10330] usb 2-1: can't read configurations, error -12 [ 2306.741942][T10330] usb usb2-port1: attempt power cycle [ 2306.747477][ T144] Normal free:14028kB min:24744kB low:28332kB high:31920kB active_anon:2714536kB inactive_anon:10720kB active_file:728kB inactive_file:1104kB unevictable:0kB writepending:36kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35296kB pagetables:123004kB bounce:0kB free_pcp:52kB local_pcp:44kB free_cma:0kB [ 2306.791370][ T144] lowmem_reserve[]: 0 0 0 0 [ 2306.796502][ T144] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2306.810364][ T144] DMA32: 92*4kB (U) 127*8kB (UH) 177*16kB (U) 14*32kB (UH) 82*64kB (UMH) 40*128kB (UMH) 4*256kB (UMH) 0*512kB 0*1024kB 1*2048kB (M) 0*4096kB = 18104kB [ 2306.826621][ T144] Normal: 811*4kB (UMEH) 233*8kB (UMEH) 472*16kB (UMEH) 42*32kB (UMEH) 8*64kB (UH) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 14516kB [ 2306.842368][ T144] 5567 total pagecache pages [ 2306.847138][ T144] 0 pages in swap cache [ 2306.851673][ T144] Swap cache stats: add 0, delete 0, find 0/0 [ 2306.857855][ T144] Free swap = 0kB [ 2306.861567][ T144] Total swap = 0kB [ 2306.865274][ T144] 1965979 pages RAM [ 2306.869203][ T144] 0 pages HighMem/MovableOnly [ 2306.873983][ T144] 318041 pages reserved [ 2306.878265][ T144] 0 pages cma reserved [ 2306.882324][ T144] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.2,pid=12899,uid=0 [ 2306.896634][ T144] Out of memory: Killed process 12899 (syz-executor.2) total-vm:85484kB, anon-rss:16572kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:164kB oom_score_adj:1000 [ 2306.917277][ T23] oom_reaper: reaped process 12899 (syz-executor.2), now anon-rss:0kB, file-rss:34816kB, shmem-rss:0kB [ 2306.987866][T16300] usb 1-1: config index 0 descriptor too short (expected 65316, got 36) [ 2306.997194][T16300] usb 1-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2307.007728][T16300] usb 1-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 2307.017932][T26029] usb 4-1: config index 0 descriptor too short (expected 65316, got 36) [ 2307.026342][T26029] usb 4-1: config 5 has too many interfaces: 255, using maximum allowed: 32 12:52:48 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2307.077748][T16300] usb 1-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2307.087055][T16300] usb 1-1: config 5 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 2307.106580][T26029] usb 4-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config 12:52:48 executing program 1: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) socket$tipc(0x1e, 0x2, 0x0) r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYRESDEC=r1, @ANYRESDEC=r2, @ANYRESDEC=r1, @ANYRESOCT=r3, @ANYRESHEX=r0], 0x0) [ 2307.122426][T16300] usb 1-1: config 5 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 18 [ 2307.136164][T26029] usb 4-1: config 5 has 0 interfaces, different from the descriptor's value: 255 [ 2307.217859][T26029] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2307.227815][T16300] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2307.237527][T16300] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2307.245869][T16300] usb 1-1: SerialNumber: syz [ 2307.251197][T26029] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2307.259650][T26029] usb 4-1: SerialNumber: syz 12:52:49 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xc00000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2307.302228][T16300] hub 1-1:5.0: bad descriptor, ignoring hub [ 2307.319706][T16300] hub: probe of 1-1:5.0 failed with error -5 12:52:49 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2307.497604][T10330] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 2307.512209][T12543] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2307.528113][T28562] usb 4-1: USB disconnect, device number 21 [ 2307.597727][T10330] usb 2-1: Using ep0 maxpacket: 8 [ 2307.737746][T10330] usb 2-1: out of memory 12:52:49 executing program 5: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f00000001c0)={0x4, 0x7, 0x3f, 0x9, 0x7, "a9e1f312800d94fb"}) fstat(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r5, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r7, 0x0) syz_mount_image$fuse(&(0x7f0000000000)='fuse\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x8020, &(0x7f0000000280)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, 0xffffffffffffffff}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@allow_other='allow_other'}, {@blksize={'blksize', 0x3d, 0x800}}, {@default_permissions='default_permissions'}], [{@appraise_type='appraise_type=imasig'}, {@fowner_lt={'fowner<', r5}}, {@euid_gt={'euid>', r7}}, {@pcr={'pcr', 0x3d, 0x11}}, {@obj_role={'obj_role', 0x3d, '\xaa@/-\\'}}, {@audit='audit'}]}}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000180)={0x0, 0x1, 0x6, @broadcast}, 0x10) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2307.758373][T10330] usb 2-1: can't read configurations, error -12 [ 2307.937535][T10330] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 2308.015782][T12539] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2308.030807][T10330] usb 2-1: Using ep0 maxpacket: 8 12:52:49 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a40700"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:49 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xd00000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2308.469547][T10441] usb 1-1: USB disconnect, device number 48 [ 2308.507727][T10330] usb 2-1: config index 0 descriptor too short (expected 65316, got 36) [ 2308.527918][T10330] usb 2-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2308.547677][T10330] usb 2-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2308.568712][T10330] usb 2-1: config 5 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 [ 2308.583787][T10330] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2308.617367][T28562] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 2308.643311][T10330] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 65 [ 2308.665102][T10330] usb 2-1: config 5 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 12:52:50 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2308.767458][T10330] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2308.780829][T10330] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2308.789443][T10330] usb 2-1: SerialNumber: syz [ 2308.809846][T12562] raw-gadget gadget: fail, usb_ep_enable returned -22 12:52:50 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xf00000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2308.816795][T12562] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2308.849953][T10330] hub 2-1:5.0: bad descriptor, ignoring hub [ 2308.857073][T10330] hub: probe of 2-1:5.0 failed with error -5 12:52:50 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2308.897278][T28562] usb 4-1: Using ep0 maxpacket: 8 [ 2308.937374][T28562] usb 4-1: no configurations [ 2308.942024][T28562] usb 4-1: can't read configurations, error -22 [ 2309.137264][T28562] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 2309.147270][T10441] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 2309.157420][T12605] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2309.327466][T30413] syz-executor.4 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=0 [ 2309.344536][T30413] CPU: 1 PID: 30413 Comm: syz-executor.4 Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2309.354810][T30413] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2309.365254][T30413] Call Trace: [ 2309.369243][T30413] dump_stack+0x1b0/0x21e [ 2309.373709][T30413] ? devkmsg_release+0x11c/0x11c [ 2309.378732][T30413] ? ___ratelimit+0x3bf/0x560 [ 2309.383410][T30413] ? show_regs_print_info+0x12/0x12 [ 2309.388583][T30413] ? _raw_spin_lock+0xa1/0x170 [ 2309.393624][T30413] ? radix_tree_cpu_dead+0x160/0x160 [ 2309.398892][T30413] dump_header+0xdb/0x700 [ 2309.403501][T30413] oom_kill_process+0xd3/0x280 [ 2309.408272][T30413] out_of_memory+0x5b6/0x890 [ 2309.412835][T30413] ? unregister_oom_notifier+0x20/0x20 [ 2309.418308][T30413] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2309.423861][T30413] ? get_page_from_freelist+0x7c0/0x7c0 [ 2309.429383][T30413] ? __zone_watermark_ok+0x91/0x280 [ 2309.434559][T30413] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2309.439930][T30413] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2309.445448][T30413] ? lockref_get+0x1c2/0x2b0 [ 2309.450250][T30413] ? blk_crypto_keyslot_evict+0x160/0x160 [ 2309.456956][T30413] ? should_fail+0x18e/0x860 [ 2309.461658][T30413] ? __rcu_read_lock+0x50/0x50 [ 2309.466391][T30413] ? setup_fault_attr+0x2b0/0x2b0 [ 2309.471394][T30413] ? find_inode_fast+0x3e7/0x4a0 [ 2309.476302][T30413] __get_free_pages+0xa/0x30 [ 2309.482516][T30413] inode_doinit_with_dentry+0x950/0x10e0 [ 2309.489388][T30413] ? __wake_up_bit+0x170/0x170 [ 2309.494600][T30413] ? sb_finish_set_opts+0x7e0/0x7e0 [ 2309.499803][T30413] ? current_time+0x1aa/0x2e0 [ 2309.504632][T30413] ? atime_needs_update+0x570/0x570 [ 2309.509858][T30413] security_d_instantiate+0x90/0xf0 [ 2309.515133][T30413] d_splice_alias+0x71/0x590 [ 2309.519709][T30413] kernfs_iop_lookup+0x17a/0x1f0 [ 2309.524648][T30413] __lookup_slow+0x2f2/0x470 [ 2309.529210][T30413] ? lookup_one_len+0x2a0/0x2a0 [ 2309.534048][T30413] path_mountpoint+0x28f/0x740 [ 2309.540195][T30413] ? success_walk_trace+0x410/0x410 [ 2309.545548][T30413] ? __perf_event_task_sched_in+0x4ed/0x550 [ 2309.551428][T30413] filename_mountpoint+0x220/0x660 [ 2309.556552][T30413] ? user_path_mountpoint_at+0x40/0x40 [ 2309.561997][T30413] ? strncpy_from_user+0x20c/0x370 [ 2309.567098][T30413] ? getname_flags+0x20d/0x610 [ 2309.572148][T30413] ksys_umount+0x159/0x1000 [ 2309.576647][T30413] ? preempt_schedule_irq+0xc7/0x110 [ 2309.582262][T30413] ? preempt_schedule_notrace+0x110/0x110 [ 2309.588202][T30413] ? namespace_unlock+0x4f0/0x4f0 [ 2309.593390][T30413] ? retint_kernel+0x1b/0x1b [ 2309.598154][T30413] ? do_syscall_64+0x80/0x150 [ 2309.603013][T30413] __x64_sys_umount+0x56/0x60 [ 2309.607687][T30413] do_syscall_64+0xcb/0x150 [ 2309.612184][T30413] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2309.618053][T30413] RIP: 0033:0x460887 [ 2309.621921][T30413] Code: 64 89 04 25 d0 02 00 00 58 5f ff d0 48 89 c7 e8 2f be ff ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ad 89 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2309.641604][T30413] RSP: 002b:00007ffffdaea678 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 2309.650246][T30413] RAX: ffffffffffffffda RBX: 0000000000233d63 RCX: 0000000000460887 [ 2309.661256][T30413] RDX: 0000000000403188 RSI: 0000000000000002 RDI: 00007ffffdaea720 [ 2309.669640][T30413] RBP: 0000000000000728 R08: 0000000000000000 R09: 000000000000000c [ 2309.677748][T30413] R10: 0000000000000006 R11: 0000000000000246 R12: 00007ffffdaeb7b0 [ 2309.685796][T30413] R13: 00000000026e9940 R14: 0000000000000000 R15: 00007ffffdaeb7b0 [ 2309.704071][T30413] Mem-Info: [ 2309.707618][T30413] active_anon:1407271 inactive_anon:4736 isolated_anon:0 [ 2309.707618][T30413] active_file:497 inactive_file:407 isolated_file:32 [ 2309.707618][T30413] unevictable:0 dirty:27 writeback:0 unstable:0 [ 2309.707618][T30413] slab_reclaimable:9547 slab_unreclaimable:97377 [ 2309.707618][T30413] mapped:56170 shmem:4833 pagetables:31042 bounce:0 [ 2309.707618][T30413] free:12757 free_pcp:171 free_cma:0 [ 2309.746123][T30413] Node 0 active_anon:5629084kB inactive_anon:18944kB active_file:2088kB inactive_file:1700kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:224780kB dirty:108kB writeback:0kB shmem:19332kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2309.747994][T28562] usb 4-1: Using ep0 maxpacket: 8 [ 2309.772158][T30413] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2309.775674][T10441] usb 1-1: Using ep0 maxpacket: 8 [ 2309.807591][T30413] lowmem_reserve[]: 0 2912 6416 6416 [ 2309.813269][T30413] DMA32 free:17828kB min:4644kB low:7624kB high:10604kB active_anon:2915524kB inactive_anon:8228kB active_file:1200kB inactive_file:1180kB unevictable:0kB writepending:84kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1728kB pagetables:1196kB bounce:0kB free_pcp:756kB local_pcp:0kB free_cma:0kB [ 2309.843327][T30413] lowmem_reserve[]: 0 0 3504 3504 [ 2309.847316][T28562] usb 4-1: no configurations [ 2309.849208][T30413] Normal free:14928kB min:5592kB low:9180kB high:12768kB active_anon:2713560kB inactive_anon:10716kB active_file:1024kB inactive_file:1924kB unevictable:0kB writepending:24kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35264kB pagetables:122972kB bounce:0kB free_pcp:492kB local_pcp:148kB free_cma:0kB [ 2309.854250][T28562] usb 4-1: can't read configurations, error -22 [ 2309.883802][T30413] lowmem_reserve[]: 0 0 0 0 [ 2309.890651][T28562] usb usb4-port1: attempt power cycle [ 2309.894997][T30413] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2309.913507][T30413] DMA32: 164*4kB (UM) 126*8kB (UMH) 178*16kB (UM) 7*32kB (UMH) 47*64kB (UH) 53*128kB (UMH) 5*256kB (UMH) 1*512kB (M) 0*1024kB 1*2048kB (M) 0*4096kB = 18368kB [ 2309.930031][T30413] Normal: 329*4kB (UEH) 131*8kB (UEH) 486*16kB (UMEH) 76*32kB (UMEH) 34*64kB (UMH) 1*128kB (M) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 14876kB [ 2309.945820][T30413] 6481 total pagecache pages [ 2309.950802][T30413] 0 pages in swap cache [ 2309.955078][T30413] Swap cache stats: add 0, delete 0, find 0/0 [ 2309.957046][T10441] usb 1-1: config index 0 descriptor too short (expected 65316, got 36) [ 2309.961293][T30413] Free swap = 0kB [ 2309.970161][T10441] usb 1-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2309.974021][T30413] Total swap = 0kB [ 2309.982691][T10441] usb 1-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 2309.986419][T30413] 1965979 pages RAM [ 2309.997558][T10441] usb 1-1: config 5 has 0 interfaces, different from the descriptor's value: 255 [ 2310.000364][T30413] 0 pages HighMem/MovableOnly [ 2310.014286][T30413] 318041 pages reserved [ 2310.019005][T30413] 0 pages cma reserved 12:52:51 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x1000000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:51 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="00ff"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2310.023515][T30413] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.2,pid=9822,uid=0 [ 2310.037895][T30413] Out of memory: Killed process 9822 (syz-executor.2) total-vm:85484kB, anon-rss:16572kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:164kB oom_score_adj:1000 [ 2310.097089][T10441] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2310.106167][T10441] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2310.116841][T10441] usb 1-1: SerialNumber: syz 12:52:51 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x1200000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:51 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:52 executing program 1: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$MON_IOCQ_RING_SIZE(r1, 0x9205) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2310.276967][T10330] usblp: can't set desired altsetting 0 on interface 0 [ 2310.327732][T10330] usb 2-1: USB disconnect, device number 43 [ 2310.363065][T12595] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2310.377382][T26029] usb 1-1: USB disconnect, device number 49 12:52:52 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x2000000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2310.616861][T28562] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 2310.706899][T28562] usb 4-1: Using ep0 maxpacket: 8 [ 2310.746924][T28562] usb 4-1: no configurations [ 2310.752017][T28562] usb 4-1: can't read configurations, error -22 [ 2310.836833][T10330] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 2310.906891][T28562] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 2311.016828][T28562] usb 4-1: Using ep0 maxpacket: 8 12:52:52 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a40700"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:52 executing program 5: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f00000001c0)={0x4, 0x7, 0x3f, 0x9, 0x7, "a9e1f312800d94fb"}) fstat(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r5, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r7, 0x0) syz_mount_image$fuse(&(0x7f0000000000)='fuse\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x8020, &(0x7f0000000280)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, 0xffffffffffffffff}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@allow_other='allow_other'}, {@blksize={'blksize', 0x3d, 0x800}}, {@default_permissions='default_permissions'}], [{@appraise_type='appraise_type=imasig'}, {@fowner_lt={'fowner<', r5}}, {@euid_gt={'euid>', r7}}, {@pcr={'pcr', 0x3d, 0x11}}, {@obj_role={'obj_role', 0x3d, '\xaa@/-\\'}}, {@audit='audit'}]}}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000180)={0x0, 0x1, 0x6, @broadcast}, 0x10) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:52 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:52 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:52 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x3f00000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2311.056852][T28562] usb 4-1: no configurations [ 2311.061691][T28562] usb 4-1: can't read configurations, error -22 [ 2311.073333][T28562] usb usb4-port1: unable to enumerate USB device [ 2311.080688][T10330] usb 2-1: Using ep0 maxpacket: 8 [ 2311.316763][T10330] usb 2-1: config index 0 descriptor too short (expected 65316, got 36) [ 2311.325440][T10330] usb 2-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2311.335962][T10330] usb 2-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2311.349917][T10330] usb 2-1: config 5 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 [ 2311.364668][T10330] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2311.375938][T10330] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 65 [ 2311.386395][T10330] usb 2-1: config 5 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 2311.486748][T10330] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2311.500362][T10330] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2311.520404][T10330] usb 2-1: SerialNumber: syz [ 2311.539780][T12647] syz-executor.4 invoked oom-killer: gfp_mask=0x40cc0(GFP_KERNEL|__GFP_COMP), order=1, oom_score_adj=1000 [ 2311.568748][T12647] CPU: 1 PID: 12647 Comm: syz-executor.4 Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2311.579348][T12647] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2311.589403][T12647] Call Trace: [ 2311.592692][T12647] dump_stack+0x1b0/0x21e [ 2311.597015][T12647] ? devkmsg_release+0x11c/0x11c [ 2311.601931][T12647] ? ___ratelimit+0x3bf/0x560 [ 2311.606578][T12647] ? show_regs_print_info+0x12/0x12 [ 2311.611835][T12647] ? _raw_spin_lock+0xa1/0x170 [ 2311.616590][T12647] ? radix_tree_cpu_dead+0x160/0x160 [ 2311.621846][T12647] dump_header+0xdb/0x700 [ 2311.626147][T12647] oom_kill_process+0xd3/0x280 [ 2311.632452][T12647] out_of_memory+0x5b6/0x890 [ 2311.637455][T12647] ? unregister_oom_notifier+0x20/0x20 [ 2311.642919][T12647] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2311.648437][T12647] ? get_page_from_freelist+0x7c0/0x7c0 [ 2311.653951][T12647] ? file_update_time+0x2cf/0x3d0 [ 2311.658961][T12647] ? __zone_watermark_ok+0x91/0x280 [ 2311.664130][T12647] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2311.669470][T12647] ? __kasan_slab_free+0x168/0x220 [ 2311.674552][T12647] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2311.680067][T12647] ? __fget+0x37c/0x3c0 [ 2311.684191][T12647] ? perf_lock_task_context+0x570/0x570 [ 2311.689707][T12647] alloc_slab_page+0x3a/0x390 [ 2311.694353][T12647] ? fget_many+0x20/0x20 [ 2311.698566][T12647] ? memset+0x1f/0x40 [ 2311.702517][T12647] new_slab+0x408/0x450 [ 2311.706642][T12647] ? __kernel_write+0x340/0x340 [ 2311.711459][T12647] ? getname_flags+0xb8/0x610 [ 2311.716117][T12647] ___slab_alloc+0x2e0/0x450 [ 2311.720676][T12647] ? __se_sys_vmsplice+0x15a/0x2c0 [ 2311.725754][T12647] ? getname_flags+0xb8/0x610 [ 2311.730401][T12647] ? getname_flags+0xb8/0x610 [ 2311.735054][T12647] kmem_cache_alloc+0x230/0x250 [ 2311.739875][T12647] getname_flags+0xb8/0x610 [ 2311.744435][T12647] do_sys_open+0x2fc/0x620 [ 2311.748820][T12647] ? file_open_root+0x440/0x440 [ 2311.753639][T12647] ? __x64_sys_clock_gettime+0x1c5/0x220 [ 2311.759340][T12647] do_syscall_64+0xcb/0x150 [ 2311.763815][T12647] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2311.769672][T12647] RIP: 0033:0x45de59 [ 2311.773538][T12647] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2311.795368][T12647] RSP: 002b:00007f216c867c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 2311.803754][T12647] RAX: ffffffffffffffda RBX: 00000000000228c0 RCX: 000000000045de59 [ 2311.811698][T12647] RDX: 00000000000026e1 RSI: 00000000200000c0 RDI: ffffffffffffff9c [ 2311.819727][T12647] RBP: 000000000118bf68 R08: 0000000000000000 R09: 0000000000000000 [ 2311.827674][T12647] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118bf2c [ 2311.835615][T12647] R13: 00007ffffdaeb53f R14: 00007f216c8689c0 R15: 000000000118bf2c [ 2311.844307][T26029] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 2311.916692][T28562] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 2311.970699][T12647] Mem-Info: [ 2311.974051][T12647] active_anon:1407749 inactive_anon:4735 isolated_anon:0 [ 2311.974051][T12647] active_file:284 inactive_file:267 isolated_file:32 [ 2311.974051][T12647] unevictable:0 dirty:27 writeback:0 unstable:0 [ 2311.974051][T12647] slab_reclaimable:9546 slab_unreclaimable:97169 [ 2311.974051][T12647] mapped:55975 shmem:4831 pagetables:31011 bounce:0 [ 2311.974051][T12647] free:12349 free_pcp:600 free_cma:0 [ 2312.015782][T12647] Node 0 active_anon:5630996kB inactive_anon:18940kB active_file:1000kB inactive_file:952kB unevictable:0kB isolated(anon):0kB isolated(file):128kB mapped:223800kB dirty:108kB writeback:0kB shmem:19324kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2312.040678][T12647] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2312.068383][T12647] lowmem_reserve[]: 0 2912 6416 6416 [ 2312.074080][T12647] DMA32 free:19696kB min:4644kB low:7624kB high:10604kB active_anon:2912096kB inactive_anon:8224kB active_file:712kB inactive_file:1268kB unevictable:0kB writepending:64kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1632kB pagetables:1304kB bounce:0kB free_pcp:1952kB local_pcp:1036kB free_cma:0kB [ 2312.106388][T12647] lowmem_reserve[]: 0 0 3504 3504 [ 2312.112694][T12647] Normal free:13796kB min:5592kB low:9180kB high:12768kB active_anon:2718532kB inactive_anon:10716kB active_file:636kB inactive_file:712kB unevictable:0kB writepending:44kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35232kB pagetables:122740kB bounce:0kB free_pcp:476kB local_pcp:288kB free_cma:0kB [ 2312.151054][T12647] lowmem_reserve[]: 0 0 0 0 [ 2312.156295][T12647] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2312.171021][T12647] DMA32: 74*4kB (UM) 96*8kB (UMH) 178*16kB (UM) 5*32kB (UMH) 32*64kB (UMH) 72*128kB (UMH) 5*256kB (UMH) 2*512kB (M) 0*1024kB 1*2048kB (M) 0*4096kB = 19688kB [ 2312.187997][T12647] Normal: 183*4kB (UH) 180*8kB (UH) 441*16kB (UEH) 61*32kB (UEH) 34*64kB (UH) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 13356kB [ 2312.196520][T26029] usb 4-1: Using ep0 maxpacket: 8 [ 2312.203698][T28562] usb 1-1: Using ep0 maxpacket: 8 [ 2312.213761][T12647] 5797 total pagecache pages [ 2312.232086][T12647] 0 pages in swap cache [ 2312.242070][T12647] Swap cache stats: add 0, delete 0, find 0/0 [ 2312.256487][T12647] Free swap = 0kB [ 2312.256546][T26029] usb 4-1: no configurations [ 2312.264016][T12647] Total swap = 0kB [ 2312.264968][T26029] usb 4-1: can't read configurations, error -22 [ 2312.274577][T12647] 1965979 pages RAM [ 2312.283295][T12647] 0 pages HighMem/MovableOnly [ 2312.292715][T12647] 318041 pages reserved [ 2312.301567][T12647] 0 pages cma reserved [ 2312.310276][T12647] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.2,pid=9713,uid=0 [ 2312.357288][T12647] Out of memory: Killed process 9713 (syz-executor.2) total-vm:85484kB, anon-rss:16572kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:164kB oom_score_adj:1000 [ 2312.436491][T26029] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 2312.446517][T28562] usb 1-1: config index 0 descriptor too short (expected 65316, got 36) [ 2312.458342][T28562] usb 1-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2312.486745][T28562] usb 1-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 2312.539043][T28562] usb 1-1: config 5 has 0 interfaces, different from the descriptor's value: 255 12:52:54 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="00ff"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:54 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x4000000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2312.586471][T12626] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2312.593867][T12626] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2312.606936][T10330] hub 2-1:5.0: bad descriptor, ignoring hub [ 2312.613341][T10330] hub: probe of 2-1:5.0 failed with error -5 [ 2312.646428][T28562] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2312.656047][T28562] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2312.665529][T28562] usb 1-1: SerialNumber: syz [ 2312.676347][T26029] usb 4-1: Using ep0 maxpacket: 8 [ 2312.736450][T26029] usb 4-1: no configurations [ 2312.741285][T26029] usb 4-1: can't read configurations, error -22 [ 2312.748497][T26029] usb usb4-port1: attempt power cycle 12:52:54 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="0011"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:54 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x8c00000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2312.825476][T12626] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2312.833035][T12626] raw-gadget gadget: fail, usb_ep_enable returned -22 12:52:54 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="00ff"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2312.973393][T12650] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2312.984754][T16300] usb 1-1: USB disconnect, device number 50 [ 2313.058333][T12626] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2313.078492][T10330] usblp 2-1:5.0: usblp0: USB Bidirectional printer dev 44 if 0 alt 0 proto 3 vid 0x0525 pid 0xA4A8 [ 2313.127498][T10330] usb 2-1: USB disconnect, device number 44 [ 2313.139393][T10330] usblp0: removed [ 2313.466175][T26029] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 2313.556217][T26029] usb 4-1: Using ep0 maxpacket: 8 [ 2313.596248][T26029] usb 4-1: no configurations [ 2313.601340][T26029] usb 4-1: can't read configurations, error -22 [ 2313.766115][T26029] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 2313.846092][T16300] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 2313.866190][T26029] usb 4-1: Using ep0 maxpacket: 8 [ 2313.906143][T26029] usb 4-1: no configurations [ 2313.910846][T26029] usb 4-1: can't read configurations, error -22 [ 2313.917404][T26029] usb usb4-port1: unable to enumerate USB device [ 2314.096046][T16300] usb 2-1: Using ep0 maxpacket: 8 [ 2314.216096][T16300] usb 2-1: config index 0 descriptor too short (expected 65316, got 36) [ 2314.224674][T16300] usb 2-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2314.234061][T16300] usb 2-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2314.243769][T16300] usb 2-1: config 5 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 [ 2314.255169][T16300] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2314.265464][T16300] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 65 [ 2314.275799][T16300] usb 2-1: config 5 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 12:52:56 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a40700"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:56 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:56 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x8d00000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:56 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="00ff"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:56 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a40700"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2314.366052][T16300] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2314.375707][T16300] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2314.385961][T16300] usb 2-1: SerialNumber: syz [ 2314.415998][T16300] usb 2-1: can't set config #5, error -71 [ 2314.424303][T16300] usb 2-1: USB disconnect, device number 45 12:52:56 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="00ff"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:56 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x8e00000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2314.745863][T28562] usb 1-1: new high-speed USB device number 51 using dummy_hcd 12:52:56 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xda6, 0x4) writev(r0, &(0x7f0000000780)=[{&(0x7f0000000100)="dff548771d77ce8786aca76dda6fb054ab8ea73799d7293eda90ba41a2db81fab55b5415692300a8e64bca2f60e1717f85f06a6bbca90f392b04f34940db7ffccc33ed6ea82296de9683c9e360cd1c477304bd8f9bd74d44a4c7d1c7e625a86cd54b72c5745f475a772b84977a6b05381dbe6259bc510f0f70c3e9946a78c7b5a19e97447799d930f9623b", 0x8b}, {&(0x7f00000001c0)="96431fb1cb119741590ad657dc5e5ce3e5fe9f1f639e6a18bc7b6c1d0b424eb306f34cf2429c62c0fdefbae36740a7169721af852826d7f14b6cae8af86507ff78a1dda991aea5952f43e7e0146a3c035f0113d617240e8940c60cdf3400193bbe3a0c0b1eae5799db27b4ee9c13475210defa4dac9d784e0c89135b82b321f8e43d7a5db9ab1bfd319f472a94", 0x8d}, {&(0x7f0000001340)="f15c93cb35c215fe339d1e9060c5b23e77cb58a87329a00288504db389cc6e395885fa906ac30eeae99fa388c31b5717e641e1586a90961b5f99b26c939d944f6cb1cf6817b7e51402a8459f9db642e97d3c05db56250a665d3ff188eb47e5b036d508aa5a5796fb8806b6a41487e0bfc3df087c18269bd7d2f477104c5d5db497ceaf3e1b11a5d63a2b7035dc69fa701f3b46fe701880800a7d38dccd4b3e8014aa15c96968359533ce2c5ffdd5f0d3297018bd7c025150940cdead92eb1e6bc6ba45eecf067b32425b6000b2f376ef9172426ae7fa97e5a84ef4dc540bbf5dd458ffcb75724135bd32fa04db6d6a75aedda7ab6e8501fc94e209dc3b2525ae24c954255d3247ca9c1b9525ce68179a52a87333aa2b0a8c1baa6ba6160c6d2018e67bac5402d0d89c5f798b8d1a87b0dc3306f546c61724530d9f4b6f0ee68677c7b261de5afa02d708a8ec979791de8f4831cc354ba453bc253e2435207f25494a594d4e5be39902358d362cb318ad965b7e7480a5ca5b6fe74e101c400c77392ee4419ad788f494230487811046f21f0f9665dfbaa9e94ed305a02e3fa47039e67dde19f89c8f1741aad752cdfe458ddf54e8fc10ff79b5", 0x1b9}], 0x3) sendto$inet(r0, &(0x7f00000012c0)="1a268a927f1f6588b967481241ba78600453f65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27) r1 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYRESDEC=r0], 0x0) syz_usb_control_io(r1, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3aa99, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3, 0x10000}, 0x20, 0x0, 0x9, 0x7, 0x8000, 0x1000}, r2, 0xfffffffffffffffb, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:56 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2314.825887][T26029] usb 4-1: new high-speed USB device number 30 using dummy_hcd 12:52:56 executing program 1: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff05007498090400e6969af21146bf01813e3cd396b912070903000905010200ffe0000009058202410c02c80ba3e2ee7e8acb210e2c16"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f0000000040)={0x0, 0x3, 0xfffffffffffffffb, 0x1}) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x7ff, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x1, @perf_bp={&(0x7f0000000100), 0x6}, 0x49, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2315.055835][T28562] usb 1-1: Using ep0 maxpacket: 8 [ 2315.066322][T26029] usb 4-1: Using ep0 maxpacket: 8 [ 2315.095859][T28562] usb 1-1: no configurations [ 2315.101024][T28562] usb 1-1: can't read configurations, error -22 [ 2315.105877][T26029] usb 4-1: no configurations [ 2315.111864][T26029] usb 4-1: can't read configurations, error -22 12:52:56 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:56 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x8f00000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2315.265759][T28562] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 2315.276672][T26029] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 2315.535798][T10330] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 2315.560693][ T223] in:imklog invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 2315.572544][ T223] CPU: 0 PID: 223 Comm: in:imklog Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2315.582103][ T223] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2315.592136][ T223] Call Trace: [ 2315.595407][ T223] dump_stack+0x1b0/0x21e [ 2315.599707][ T223] ? devkmsg_release+0x11c/0x11c [ 2315.604627][ T223] ? ___ratelimit+0x3bf/0x560 [ 2315.609276][ T223] ? show_regs_print_info+0x12/0x12 [ 2315.614456][ T223] ? _raw_spin_lock+0xa1/0x170 [ 2315.619194][ T223] ? radix_tree_cpu_dead+0x160/0x160 [ 2315.624452][ T223] dump_header+0xdb/0x700 [ 2315.628768][ T223] oom_kill_process+0xd3/0x280 [ 2315.633507][ T223] out_of_memory+0x5b6/0x890 [ 2315.638073][ T223] ? unregister_oom_notifier+0x20/0x20 [ 2315.643523][ T223] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2315.649050][ T223] ? get_page_from_freelist+0x7c0/0x7c0 [ 2315.654593][ T223] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2315.659955][ T223] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2315.665473][ T223] pagecache_get_page+0x522/0x8a0 [ 2315.670477][ T223] filemap_fault+0x1435/0x1990 [ 2315.675215][ T223] ? __down_read+0xf1/0x210 [ 2315.679691][ T223] ? generic_file_read_iter+0x20a0/0x20a0 [ 2315.685383][ T223] ? __perf_event_task_sched_out+0x1127/0x1250 [ 2315.691526][ T223] ext4_filemap_fault+0x7b/0x90 [ 2315.696352][ T223] handle_mm_fault+0x291e/0x4140 [ 2315.701263][ T223] ? finish_fault+0x230/0x230 [ 2315.705933][ T223] ? __fsnotify_parent+0x300/0x300 [ 2315.711064][ T223] ? down_read_trylock+0x17a/0x1d0 [ 2315.716164][ T223] ? vmacache_find+0x205/0x4b0 [ 2315.720901][ T223] do_user_addr_fault+0x48a/0x9f0 [ 2315.725915][ T223] page_fault+0x2f/0x40 [ 2315.730059][ T223] RIP: 0033:0x7f899662673f [ 2315.734459][ T223] Code: Bad RIP value. [ 2315.738495][ T223] RSP: 002b:00007f8995bd5590 EFLAGS: 00010207 [ 2315.744536][ T223] RAX: 0000000000000057 RBX: 0000000000000000 RCX: 00007f899823922d [ 2315.752509][ T223] RDX: 0000000000000057 RSI: 00007f8995bd5da0 RDI: 0000000000000000 [ 2315.760465][ T223] RBP: 000055b4093509d0 R08: 0000000000000000 R09: 0000000004000001 [ 2315.768411][ T223] R10: 0000000000000001 R11: 0000000000000000 R12: 00007f8995bd5da0 [ 2315.776474][ T223] R13: 0000000000001fa0 R14: 0000000000001f9f R15: 00007f8995bd5df7 [ 2315.794754][T26029] usb 4-1: Using ep0 maxpacket: 8 [ 2315.795617][T28562] usb 1-1: Using ep0 maxpacket: 8 [ 2315.805020][ T223] Mem-Info: [ 2315.808200][ T223] active_anon:1407427 inactive_anon:4735 isolated_anon:0 [ 2315.808200][ T223] active_file:288 inactive_file:277 isolated_file:64 [ 2315.808200][ T223] unevictable:0 dirty:61 writeback:25 unstable:0 [ 2315.808200][ T223] slab_reclaimable:9544 slab_unreclaimable:97166 [ 2315.808200][ T223] mapped:55986 shmem:4831 pagetables:31118 bounce:0 [ 2315.808200][ T223] free:12917 free_pcp:56 free_cma:0 [ 2315.847045][ T223] Node 0 active_anon:5629708kB inactive_anon:18940kB active_file:1052kB inactive_file:1100kB unevictable:0kB isolated(anon):0kB isolated(file):216kB mapped:223844kB dirty:244kB writeback:100kB shmem:19324kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2315.872150][ T223] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2315.898509][ T223] lowmem_reserve[]: 0 2912 6416 6416 [ 2315.903830][ T223] DMA32 free:18148kB min:4644kB low:7624kB high:10604kB active_anon:2910840kB inactive_anon:8224kB active_file:708kB inactive_file:972kB unevictable:0kB writepending:184kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1728kB pagetables:1300kB bounce:0kB free_pcp:144kB local_pcp:0kB free_cma:0kB [ 2315.977993][ T223] lowmem_reserve[]: 0 0 3504 3504 [ 2315.984618][ T223] Normal free:17928kB min:24744kB low:28332kB high:31920kB active_anon:2719252kB inactive_anon:10716kB active_file:480kB inactive_file:428kB unevictable:0kB writepending:60kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35392kB pagetables:123172kB bounce:0kB free_pcp:68kB local_pcp:0kB free_cma:0kB [ 2316.055181][ T223] lowmem_reserve[]: 0 0 0 0 [ 2316.065966][ T223] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2316.096131][ T223] DMA32: 132*4kB (M) 91*8kB (UMH) 187*16kB (UM) 5*32kB (UMH) 12*64kB (MH) 64*128kB (UMH) 8*256kB (UMH) 2*512kB (M) 0*1024kB 1*2048kB (M) 0*4096kB = 18488kB [ 2316.117095][ T223] Normal: 639*4kB (UMEH) 254*8kB (UMH) 475*16kB (UMEH) 112*32kB (UMEH) 43*64kB (UMH) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 18524kB [ 2316.132647][ T223] 5056 total pagecache pages [ 2316.137394][ T223] 0 pages in swap cache [ 2316.141542][ T223] Swap cache stats: add 0, delete 0, find 0/0 [ 2316.147701][ T223] Free swap = 0kB [ 2316.151409][ T223] Total swap = 0kB [ 2316.155404][ T223] 1965979 pages RAM [ 2316.159237][ T223] 0 pages HighMem/MovableOnly [ 2316.163973][ T223] 318041 pages reserved [ 2316.186832][ T223] 0 pages cma reserved [ 2316.191385][ T223] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.2,pid=4393,uid=0 [ 2316.202201][T12757] fuse: Bad value for 'fd' [ 2316.261445][T28562] usb 1-1: no configurations [ 2316.266709][T28562] usb 1-1: can't read configurations, error -22 [ 2316.273250][ T223] Out of memory: Killed process 4393 (syz-executor.2) total-vm:85484kB, anon-rss:16572kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:164kB oom_score_adj:1000 [ 2316.289988][T28562] usb usb1-port1: attempt power cycle [ 2316.296363][ T23] oom_reaper: reaped process 4393 (syz-executor.2), now anon-rss:0kB, file-rss:34816kB, shmem-rss:0kB [ 2316.495521][T26029] usb 4-1: no configurations [ 2316.500321][T26029] usb 4-1: can't read configurations, error -22 [ 2316.506771][T26029] usb usb4-port1: attempt power cycle [ 2316.825426][T10330] usb 2-1: Using ep0 maxpacket: 8 [ 2316.955405][T10330] usb 2-1: config index 0 descriptor too short (expected 65316, got 36) [ 2316.964128][T10330] usb 2-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2316.973233][T10330] usb 2-1: config 5 has an invalid descriptor of length 191, skipping remainder of the config [ 2316.983529][T10330] usb 2-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2316.992592][T10330] usb 2-1: too many endpoints for config 5 interface 0 altsetting 230: 150, using maximum allowed: 30 [ 2317.003567][T10330] usb 2-1: config 5 interface 0 altsetting 230 has 0 endpoint descriptors, different from the interface descriptor's value: 150 [ 2317.016792][T28562] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 2317.024384][T10330] usb 2-1: config 5 interface 0 has no altsetting 0 [ 2317.105393][T28562] usb 1-1: Using ep0 maxpacket: 8 [ 2317.110584][T10330] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2317.120085][T10330] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2317.128311][T10330] usb 2-1: SerialNumber: syz [ 2317.155446][T28562] usb 1-1: no configurations [ 2317.160307][T28562] usb 1-1: can't read configurations, error -22 [ 2317.215314][T26029] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 2317.305395][T26029] usb 4-1: Using ep0 maxpacket: 8 [ 2317.325273][T28562] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 2317.345324][T26029] usb 4-1: no configurations [ 2317.350177][T26029] usb 4-1: can't read configurations, error -22 12:52:59 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x9000000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:59 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="00ff"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:59 executing program 5: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$MON_IOCQ_RING_SIZE(r1, 0x9205) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:59 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a40700000001010902"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:52:59 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a40700"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2317.382150][T12742] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2317.415880][T10330] hub 2-1:5.0: bad descriptor, ignoring hub [ 2317.421834][T10330] hub: probe of 2-1:5.0 failed with error -5 [ 2317.465273][T28562] usb 1-1: device descriptor read/8, error -71 [ 2317.471945][T10330] usb 2-1: USB disconnect, device number 46 12:52:59 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xb2a2020000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:52:59 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="00ff"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2317.705240][T28562] usb 1-1: device descriptor read/8, error -71 [ 2317.725193][T26029] usb 4-1: new high-speed USB device number 33 using dummy_hcd 12:52:59 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:52:59 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xb3a2020000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2317.815177][T26029] usb 4-1: Using ep0 maxpacket: 8 [ 2317.825262][T28562] usb usb1-port1: unable to enumerate USB device [ 2317.955236][T26029] usb 4-1: config 0 has no interfaces? [ 2318.055220][T26029] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2318.067898][T26029] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2318.085070][T26029] usb 4-1: SerialNumber: syz [ 2318.096572][T26029] usb 4-1: config 0 descriptor?? [ 2318.165077][ T9634] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 2318.185053][T28562] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 2318.338043][T12776] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2318.348482][T10330] usb 4-1: USB disconnect, device number 33 [ 2318.405047][ T9634] usb 2-1: Using ep0 maxpacket: 8 [ 2318.444987][T28562] usb 1-1: Using ep0 maxpacket: 8 [ 2318.485106][T28562] usb 1-1: no configurations [ 2318.489955][T28562] usb 1-1: can't read configurations, error -22 [ 2318.525050][ T9634] usb 2-1: config index 0 descriptor too short (expected 65316, got 36) [ 2318.533533][ T9634] usb 2-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2318.554956][ T9634] usb 2-1: config 5 has an invalid descriptor of length 191, skipping remainder of the config [ 2318.565793][ T9634] usb 2-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2318.574842][ T9634] usb 2-1: too many endpoints for config 5 interface 0 altsetting 230: 150, using maximum allowed: 30 [ 2318.587135][ T9634] usb 2-1: config 5 interface 0 altsetting 230 has 0 endpoint descriptors, different from the interface descriptor's value: 150 [ 2318.601024][ T9634] usb 2-1: config 5 interface 0 has no altsetting 0 [ 2318.654940][T28562] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 2318.685055][ T9634] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2318.694291][ T9634] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 12:53:00 executing program 5: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$MON_IOCQ_RING_SIZE(r1, 0x9205) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:00 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:53:00 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xe0ffffffffffffff, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2318.702967][ T9634] usb 2-1: SerialNumber: syz [ 2318.725023][ T9634] usb 2-1: can't set config #5, error -71 [ 2318.731717][ T9634] usb 2-1: USB disconnect, device number 47 12:53:00 executing program 1: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="1201000009090224ffff050074980904000012070103fd0805010200ffe00000090582024100"/50], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2318.888464][T12823] syz-executor.4 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=3, oom_score_adj=1000 [ 2318.914900][T28562] usb 1-1: Using ep0 maxpacket: 8 [ 2318.920218][T12823] CPU: 0 PID: 12823 Comm: syz-executor.4 Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2318.930383][T12823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2318.940424][T12823] Call Trace: [ 2318.943712][T12823] dump_stack+0x1b0/0x21e [ 2318.948046][T12823] ? devkmsg_release+0x11c/0x11c [ 2318.952974][T12823] ? ___ratelimit+0x3bf/0x560 [ 2318.957646][T12823] ? show_regs_print_info+0x12/0x12 [ 2318.962834][T12823] ? _raw_spin_lock+0xa1/0x170 [ 2318.967591][T12823] ? radix_tree_cpu_dead+0x160/0x160 [ 2318.972866][T12823] dump_header+0xdb/0x700 [ 2318.977188][T12823] oom_kill_process+0xd3/0x280 [ 2318.981945][T12823] out_of_memory+0x5b6/0x890 [ 2318.986530][T12823] ? unregister_oom_notifier+0x20/0x20 [ 2318.991973][T12823] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2318.997501][T12823] ? get_page_from_freelist+0x7c0/0x7c0 [ 2319.003017][T12823] ? __zone_watermark_ok+0x91/0x280 [ 2319.008187][T12823] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2319.013717][T12823] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2319.019234][T12823] ? copy_process+0x5c9/0x52f0 [ 2319.023987][T12823] ? kmem_cache_alloc+0x1d5/0x250 [ 2319.029003][T12823] copy_process+0x612/0x52f0 [ 2319.033580][T12823] ? __memcg_kmem_charge_memcg+0x130/0x130 [ 2319.039359][T12823] ? get_mem_cgroup_from_mm+0x27b/0x2c0 [ 2319.044961][T12823] ? mem_cgroup_commit_charge+0x198/0x240 [ 2319.050669][T12823] ? mem_cgroup_try_charge_delay+0x10/0x10 [ 2319.056731][T12823] ? __mod_node_page_state+0x99/0xb0 [ 2319.062074][T12823] ? fork_idle+0x290/0x290 [ 2319.066463][T12823] ? __lru_cache_add+0x1a1/0x1f0 [ 2319.071579][T12823] ? _raw_spin_unlock+0x5/0x20 [ 2319.076351][T12823] ? handle_mm_fault+0x916/0x4140 [ 2319.081348][T12823] _do_fork+0x180/0x8f0 [ 2319.085475][T12823] ? finish_fault+0x230/0x230 [ 2319.090123][T12823] ? up_write+0xa1/0x190 [ 2319.094345][T12823] ? dup_mm+0x300/0x300 [ 2319.098471][T12823] __x64_sys_clone+0x246/0x2b0 [ 2319.103216][T12823] ? __ia32_sys_vfork+0x110/0x110 [ 2319.108211][T12823] ? do_user_addr_fault+0x55c/0x9f0 [ 2319.113376][T12823] do_syscall_64+0xcb/0x150 [ 2319.117849][T12823] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2319.123713][T12823] RIP: 0033:0x460829 [ 2319.127578][T12823] Code: ff 48 85 f6 0f 84 37 8a fb ff 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 0f 8c 0e 8a fb ff 74 01 c3 31 ed 48 f7 c7 00 00 01 00 75 [ 2319.147151][T12823] RSP: 002b:00007ffffdaeb488 EFLAGS: 00000202 ORIG_RAX: 0000000000000038 [ 2319.155539][T12823] RAX: ffffffffffffffda RBX: 00007f216c847700 RCX: 0000000000460829 [ 2319.163504][T12823] RDX: 00007f216c8479d0 RSI: 00007f216c846db0 RDI: 00000000003d0f00 [ 2319.171461][T12823] RBP: 00007ffffdaeb6a0 R08: 00007f216c847700 R09: 00007f216c847700 [ 2319.179419][T12823] R10: 00007f216c8479d0 R11: 0000000000000202 R12: 0000000000000000 [ 2319.187362][T12823] R13: 00007ffffdaeb53f R14: 00007f216c8479c0 R15: 000000000118bfd4 [ 2319.214875][T28562] usb 1-1: no configurations [ 2319.226712][T28562] usb 1-1: can't read configurations, error -22 [ 2319.247648][T28562] usb usb1-port1: attempt power cycle [ 2319.268456][T12823] Mem-Info: [ 2319.271791][T12823] active_anon:1406991 inactive_anon:4736 isolated_anon:0 [ 2319.271791][T12823] active_file:560 inactive_file:544 isolated_file:43 [ 2319.271791][T12823] unevictable:0 dirty:15 writeback:3 unstable:0 [ 2319.271791][T12823] slab_reclaimable:9543 slab_unreclaimable:97132 [ 2319.271791][T12823] mapped:56546 shmem:4832 pagetables:31111 bounce:0 [ 2319.271791][T12823] free:13047 free_pcp:0 free_cma:0 [ 2319.338316][T12823] Node 0 active_anon:5628040kB inactive_anon:18940kB active_file:1912kB inactive_file:2016kB unevictable:0kB isolated(anon):0kB isolated(file):128kB mapped:225624kB dirty:84kB writeback:24kB shmem:19324kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2319.365445][T12823] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2319.437173][T12823] lowmem_reserve[]: 0 2912 6416 6416 [ 2319.472594][T12823] DMA32 free:19228kB min:4644kB low:7624kB high:10604kB active_anon:2909480kB inactive_anon:8220kB active_file:1136kB inactive_file:1276kB unevictable:0kB writepending:80kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1792kB pagetables:1216kB bounce:0kB free_pcp:416kB local_pcp:272kB free_cma:0kB [ 2319.524606][T12823] lowmem_reserve[]: 0 0 3504 3504 [ 2319.529854][T12823] Normal free:18352kB min:24744kB low:28332kB high:31920kB active_anon:2719064kB inactive_anon:10720kB active_file:1048kB inactive_file:260kB unevictable:0kB writepending:28kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35232kB pagetables:123268kB bounce:0kB free_pcp:488kB local_pcp:200kB free_cma:0kB [ 2319.560963][T12823] lowmem_reserve[]: 0 0 0 0 [ 2319.565644][T12823] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2319.579646][T12823] DMA32: 1*4kB (U) 29*8kB (UMH) 170*16kB (U) 1*32kB (U) 10*64kB (MH) 15*128kB (UMH) 26*256kB (MH) 3*512kB (M) 1*1024kB (M) 1*2048kB (M) 0*4096kB = 16812kB [ 2319.599864][T12823] Normal: 694*4kB (UMEH) 255*8kB (UMEH) 475*16kB (UMEH) 115*32kB (UMEH) 39*64kB (UMH) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 18592kB [ 2319.615301][T12823] 5293 total pagecache pages [ 2319.620116][T12823] 0 pages in swap cache [ 2319.624527][T12823] Swap cache stats: add 0, delete 0, find 0/0 [ 2319.631102][T12823] Free swap = 0kB [ 2319.663066][T12823] Total swap = 0kB [ 2319.667374][T12823] 1965979 pages RAM [ 2319.671529][T12823] 0 pages HighMem/MovableOnly [ 2319.676828][T12823] 318041 pages reserved [ 2319.681349][T12823] 0 pages cma reserved [ 2319.685982][T12823] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.2,pid=4371,uid=0 [ 2319.701277][T12823] Out of memory: Killed process 4371 (syz-executor.2) total-vm:85484kB, anon-rss:16572kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:164kB oom_score_adj:1000 [ 2319.722036][ T23] oom_reaper: reaped process 4371 (syz-executor.2), now anon-rss:0kB, file-rss:34816kB, shmem-rss:0kB 12:53:01 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a40700000001010902"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:01 executing program 5: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$MON_IOCQ_RING_SIZE(r1, 0x9205) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:01 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xe4ffffff00000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2319.994714][T28562] usb 1-1: new high-speed USB device number 57 using dummy_hcd [ 2320.044703][ T9634] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 2320.094695][T28562] usb 1-1: Using ep0 maxpacket: 8 [ 2320.144723][T28562] usb 1-1: no configurations [ 2320.149583][T28562] usb 1-1: can't read configurations, error -22 [ 2320.194586][T26029] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 2320.304572][T28562] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 2320.314575][ T9634] usb 2-1: device descriptor read/64, error 18 12:53:02 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a40700"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:02 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xefffffffffffffff, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2320.404602][T28562] usb 1-1: Using ep0 maxpacket: 8 12:53:02 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:53:02 executing program 5: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff05007498090400e6969af21146bf01813e3cd396b912070903000905010200ffe0000009058202410c02c80ba3e2ee7e8acb210e2c16"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f0000000040)={0x0, 0x3, 0xfffffffffffffffb, 0x1}) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x7ff, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x1, @perf_bp={&(0x7f0000000100), 0x6}, 0x49, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2320.444512][T26029] usb 4-1: Using ep0 maxpacket: 8 [ 2320.484615][T28562] usb 1-1: device descriptor read/all, error -71 [ 2320.491803][T28562] usb usb1-port1: unable to enumerate USB device 12:53:02 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="00f9"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2320.564932][T26029] usb 4-1: config 0 has no interfaces? 12:53:02 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xf4ffffff00000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2320.664603][T26029] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2320.673734][T26029] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2320.682336][T26029] usb 4-1: SerialNumber: syz [ 2320.688344][T26029] usb 4-1: config 0 descriptor?? 12:53:02 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="007f"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2320.724716][ T9634] usb 2-1: device descriptor read/64, error 18 12:53:02 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xfbffffff00000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2320.844446][T28562] usb 1-1: new high-speed USB device number 59 using dummy_hcd [ 2320.931745][T12836] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2320.951835][T10330] usb 4-1: USB disconnect, device number 34 [ 2321.004510][ T9634] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 2321.084396][T28562] usb 1-1: Using ep0 maxpacket: 8 [ 2321.124475][T28562] usb 1-1: no configurations [ 2321.129111][T28562] usb 1-1: can't read configurations, error -22 [ 2321.274349][ T9634] usb 2-1: device descriptor read/64, error 18 [ 2321.294341][T28562] usb 1-1: new high-speed USB device number 60 using dummy_hcd [ 2321.554260][T28562] usb 1-1: Using ep0 maxpacket: 8 [ 2321.594365][T28562] usb 1-1: no configurations [ 2321.599113][T28562] usb 1-1: can't read configurations, error -22 [ 2321.606100][T28562] usb usb1-port1: attempt power cycle [ 2321.664280][ T9634] usb 2-1: device descriptor read/64, error 18 [ 2321.784266][ T9634] usb usb2-port1: attempt power cycle [ 2322.324090][T28562] usb 1-1: new high-speed USB device number 61 using dummy_hcd [ 2322.414147][T28562] usb 1-1: Using ep0 maxpacket: 8 [ 2322.454090][T28562] usb 1-1: no configurations [ 2322.458905][T28562] usb 1-1: can't read configurations, error -22 [ 2322.494033][ T9634] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 2322.584055][ T9634] usb 2-1: Invalid ep0 maxpacket: 36 [ 2322.624001][T28562] usb 1-1: new high-speed USB device number 62 using dummy_hcd 12:53:04 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xfeffffff00000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:04 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a40700000001010902"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:04 executing program 5: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff05007498090400e6969af21146bf01813e3cd396b912070903000905010200ffe0000009058202410c02c80ba3e2ee7e8acb210e2c16"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f0000000040)={0x0, 0x3, 0xfffffffffffffffb, 0x1}) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x7ff, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x1, @perf_bp={&(0x7f0000000100), 0x6}, 0x49, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:04 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="008c"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2322.724024][T28562] usb 1-1: Using ep0 maxpacket: 8 [ 2322.734438][ T9634] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 2322.764466][T28562] usb 1-1: no configurations [ 2322.771552][T28562] usb 1-1: can't read configurations, error -22 [ 2322.787163][T28562] usb usb1-port1: unable to enumerate USB device [ 2323.054086][T26029] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 2323.233865][ T9634] usb 2-1: device not accepting address 51, error -71 [ 2323.241047][ T9634] usb usb2-port1: unable to enumerate USB device [ 2323.293850][T26029] usb 4-1: Using ep0 maxpacket: 8 12:53:05 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a40700000001010902"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:05 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="0097"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:53:05 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xff01000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:05 executing program 5: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff05007498090400e6969af21146bf01813e3cd396b912070903000905010200ffe0000009058202410c02c80ba3e2ee7e8acb210e2c16"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f0000000040)={0x0, 0x3, 0xfffffffffffffffb, 0x1}) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x7ff, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x1, @perf_bp={&(0x7f0000000100), 0x6}, 0x49, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:05 executing program 1: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="120100000900000825b7247bddc78dcff8c405a8a4070000000101090224ffff050074980904000012070103000905010200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) ioctl$HIDIOCGUSAGES(0xffffffffffffffff, 0xd01c4813, &(0x7f0000000480)={{0x3, 0x100, 0xf80, 0x0, 0x30, 0x5}, 0x9a, [0x8, 0x17, 0x3, 0x9, 0x3, 0x305, 0x3, 0x4, 0xfffffffe, 0x0, 0x6, 0x3c, 0x8, 0x8, 0x101, 0x40, 0x10001000, 0x200, 0x80, 0x5, 0x3, 0x2, 0xfffffffb, 0x401, 0x80000001, 0x8, 0x5, 0x2, 0xbd7, 0x7264, 0x6, 0xffffffe0, 0x2, 0xffffffff, 0x4, 0xc8a, 0x81, 0x5, 0x7f, 0x68, 0x200, 0x4, 0x7, 0x5, 0x1, 0x0, 0x3, 0x5196, 0x2, 0x8001, 0x9e, 0x9, 0x4, 0x4, 0x0, 0x7, 0x15, 0xa551, 0x100, 0x4, 0x0, 0x6, 0x10000, 0x7ff, 0x3, 0x10000, 0x8, 0xfffffffc, 0xa, 0x3, 0x0, 0x6, 0x5, 0x1000, 0x12af, 0x7, 0x3, 0x81, 0x7, 0x9, 0x0, 0x10, 0x7, 0x7fff, 0x66e, 0x9, 0x4, 0xce, 0x0, 0x7fff, 0x2, 0x3ff, 0x56a6b915, 0x4, 0xffffffff, 0x0, 0x10000, 0x9, 0x71, 0xfffff800, 0x3, 0x6, 0x8, 0x7, 0x7f, 0x2, 0x7, 0xff, 0x6, 0x381dc17a, 0x10001, 0x7, 0x0, 0xffffffff, 0xbfc, 0x100, 0x0, 0x401, 0x0, 0xb4, 0x9, 0x8000, 0x20, 0x1, 0x4, 0xb4, 0x2, 0x40, 0x80, 0x8, 0x1, 0x8001, 0x9, 0x1, 0x3, 0x401, 0x3f, 0x6, 0xb44a, 0x81, 0x1, 0x5, 0x2, 0x1, 0xf2bd, 0x3, 0x101, 0x81, 0x2, 0x2, 0xffffffff, 0x6, 0x5, 0xf94d, 0x1, 0xff, 0x6, 0x0, 0x100, 0x8, 0x80000000, 0x61d4, 0x1, 0xfff, 0x2, 0x8001, 0x10, 0x3, 0x8001, 0xfffffffd, 0x785, 0x0, 0x10001, 0xffff034f, 0xe7, 0x5, 0x4, 0x400, 0x6, 0x0, 0x9, 0x8, 0xa5db, 0x401, 0xfffffffb, 0x2, 0x8, 0x81, 0x7f, 0x6, 0x5, 0x7c24, 0x100, 0x9, 0x8001, 0x7fffffff, 0x4, 0x6, 0x6, 0x8000, 0x0, 0x20, 0x2, 0x6, 0x0, 0x6, 0xb1, 0x6, 0x4, 0x0, 0x6, 0x80000001, 0x0, 0x6, 0x3f, 0x80000000, 0x1, 0x9, 0x1, 0x10000, 0x8, 0x8001, 0x1, 0x3, 0x7a1d, 0x200, 0x5a, 0x1, 0x800, 0x4c, 0x2, 0x0, 0xcd6f, 0x7fffffff, 0x5, 0x0, 0x4, 0xffffffff, 0x20, 0x1, 0x8, 0xc923, 0x3000, 0x3, 0x81, 0x5, 0xfffffffd, 0x92, 0x40, 0x2, 0x8, 0x9, 0x1f, 0x0, 0x9, 0x0, 0x9, 0x8001, 0x59, 0x3, 0x7ff, 0x8001, 0x7fffffff, 0x30, 0x3a1d, 0x4, 0x200, 0x0, 0x7, 0x7, 0xf28, 0x80000001, 0x3, 0x7ff, 0x17, 0x1, 0xfffffffd, 0x2075, 0x8, 0xc8, 0x40, 0x5, 0x10fd6dfb, 0x9, 0xb, 0x971, 0xfffffffc, 0xffff, 0x9, 0x2, 0x4, 0x87, 0xe432, 0x71b6, 0x4000, 0x80000001, 0x0, 0x2, 0x8000, 0x3ff, 0x9, 0x5, 0xffffffc0, 0x7, 0x3, 0x6, 0x8, 0x2, 0x7f, 0x3, 0x100, 0x20, 0x6, 0x9, 0x3, 0x1, 0x101, 0x2, 0x5, 0x1c00, 0x2, 0x7, 0x2, 0x52a, 0x400, 0x8000000, 0xffffffff, 0x4, 0x2df, 0x4, 0x8001, 0x1000, 0x7fffffff, 0x400, 0x1f, 0x401, 0x7e0, 0x10000, 0x6, 0x7, 0x0, 0x80, 0xffffffff, 0x400, 0xf538, 0x3, 0x3, 0x7, 0x4, 0x0, 0x875, 0x1, 0x2, 0x6, 0x1ff, 0xa62, 0x7, 0x1, 0x7, 0x4, 0x66, 0x1c000, 0x1, 0xd0f, 0x1ff, 0x0, 0x4, 0x2346, 0x20, 0x101, 0x8, 0x0, 0x0, 0x6, 0x1, 0x40, 0x80000001, 0x1, 0x6, 0xfec, 0xa995, 0x6, 0x0, 0xcc16, 0x40, 0x7, 0x3, 0xffffff01, 0x8, 0x7, 0x7, 0x3, 0x2, 0xd2, 0xcbd4, 0x7, 0x7b2, 0xb24, 0x39e2, 0xff, 0x2f, 0x8, 0x7, 0xff, 0xfffffffd, 0x8, 0x65, 0x3, 0xa3, 0x1, 0x3, 0x8, 0x8, 0xe000, 0x9, 0x1, 0x101, 0x0, 0x3f, 0xb2f, 0x8, 0x8ad, 0x2, 0x8, 0x3, 0x2, 0x3, 0x6, 0x9, 0x2, 0x2, 0x5, 0x3, 0x5, 0x6, 0x2, 0x7, 0xfffffffd, 0x49, 0xc97b, 0x0, 0x7, 0x0, 0x80000001, 0x10000, 0x75529c56, 0x4, 0x85, 0x200, 0x9, 0x4, 0x8000, 0x1, 0x80, 0xffffff41, 0x5, 0x1000, 0xc2a, 0x1f, 0x5, 0x2, 0x0, 0x8, 0x7, 0x8, 0x3, 0x2d23, 0x4, 0x7fff, 0x7, 0x7d, 0x4, 0x80000001, 0x3, 0x1, 0xfff, 0x8, 0x5, 0x7, 0x539, 0x4, 0x3, 0x5, 0xcb, 0x800, 0x3, 0x7, 0x1, 0x3f, 0xb77, 0x7, 0x3, 0x8, 0x0, 0x4, 0x7f, 0x400, 0x57622af7, 0xffffffff, 0x5, 0x8, 0x9, 0x6, 0x1, 0x8, 0x3, 0x7ff, 0x7f, 0x10001, 0x7ff, 0x346, 0x6, 0x7, 0x3ff, 0x1, 0x4, 0xffffffff, 0x564, 0x5, 0x80000001, 0x3, 0x400, 0xf3e9, 0x1000, 0x4, 0x40000, 0x4, 0xff, 0x9, 0x5, 0x0, 0x3ff, 0x5, 0x401, 0x6, 0x2, 0x8, 0x322, 0x0, 0x1f, 0x3, 0xffff, 0x1ff, 0x2, 0x9, 0x1000, 0x0, 0xd, 0x7fffffff, 0x0, 0x8f7, 0x627, 0x7a2, 0x9784d87f, 0x20, 0x800, 0x7, 0xd8, 0x5, 0x0, 0x4, 0x4, 0x1, 0x7fffffff, 0x6e2, 0x4, 0x0, 0x5, 0xf817, 0x1000, 0x1ff, 0x3, 0x8, 0xffffff77, 0x81, 0x6, 0x36a7, 0x800, 0x6, 0x6, 0x3f, 0xf352, 0xffffffff, 0x5, 0x8, 0x3, 0x8, 0x1, 0x7fffffff, 0x7, 0x6, 0x1, 0x8, 0xfffff992, 0x2, 0x5, 0x2, 0xc00000, 0x0, 0x7, 0x5, 0x80000001, 0x2, 0x6, 0x8000, 0x7fff, 0xffff, 0x8001, 0x6c1840df, 0xfffffffb, 0x6, 0x4, 0x8, 0x0, 0xfff, 0x9, 0x7ff, 0xda8, 0x2, 0x0, 0x5, 0x4, 0x5, 0x5, 0x0, 0x3e, 0x4c6, 0xfffffffb, 0x400, 0x117, 0x6, 0x1000, 0x3, 0x2, 0x9, 0x3, 0xffff7bdc, 0x6, 0x2, 0x8001, 0x0, 0x1, 0x3, 0x20, 0x1ff, 0x0, 0x5, 0x4, 0x2, 0x1, 0x0, 0xec9b, 0x3, 0x20, 0x10000, 0x9, 0x3, 0x7d5, 0x3, 0x101, 0x1, 0xb, 0x9b, 0x8, 0x1, 0x1000, 0x80000001, 0x80, 0x5, 0xffffffff, 0x8001, 0xb4, 0xffff, 0x1, 0x1, 0x6, 0x7, 0x20, 0xfffffffd, 0x3, 0x1f, 0x5, 0x0, 0x20, 0x8, 0xff, 0x6, 0xfc, 0x9, 0xffff, 0x400, 0x4a83, 0x8001, 0xbbfbdbf4, 0xfffffdfd, 0x3, 0xc716, 0x5, 0x3, 0x3, 0xfffffffe, 0x99, 0x0, 0xc0000000, 0x7fffffff, 0xffffffff, 0x1, 0xa1, 0x6000, 0x5, 0xfffffc01, 0x40, 0x7f7d, 0x9, 0x7ff, 0xfffffbff, 0x7, 0xffff, 0x9, 0x800, 0x4d, 0x7, 0x54, 0xfff, 0x7fff, 0x800, 0x4, 0x7, 0xcac, 0x4, 0x1, 0x4, 0x10000, 0x80000000, 0x9, 0x7f, 0xec, 0x1, 0x6bee, 0x7fff, 0x7, 0x87b, 0x7ff, 0x1188e8a4, 0x5, 0x8000, 0x9, 0x20, 0xffff, 0x5, 0xd62, 0x18, 0x1, 0x1, 0xfffffff8, 0x7, 0xd0ef, 0x0, 0x4, 0x5, 0x20, 0x2, 0x81, 0xfffffffa, 0x6, 0x9, 0x7fff, 0x80000000, 0x40000000, 0x4, 0x4, 0xffff, 0x8, 0xccea, 0x6, 0x5, 0x3, 0x2b5, 0x1, 0x4cba, 0x6, 0x4, 0x0, 0x23fe, 0x4, 0x8, 0x4, 0xfb4b, 0x7fff, 0x3, 0x3, 0xd4, 0x2, 0xb3, 0x2, 0x1327, 0x10000, 0x3, 0x6, 0x6, 0x6, 0x100, 0x40, 0x100, 0x401, 0x3, 0x1, 0xb5, 0x4, 0x4, 0x6, 0x7, 0x9, 0x2, 0x1, 0x2, 0x1, 0x0, 0x6, 0x0, 0xb9, 0x3ff, 0xf216, 0x0, 0x0, 0x9, 0x4c9, 0x1, 0x4, 0x4, 0x3, 0x1, 0x3, 0x2, 0x5, 0x7, 0xd4c, 0x3, 0x38c, 0x9, 0x40, 0x2, 0x664f, 0x10000, 0x100, 0x4, 0x5, 0x10001, 0x6, 0x1ec1, 0x10000, 0x50854c97, 0x8, 0x42, 0x1ff, 0x86, 0xffff, 0x1, 0x7, 0xffff, 0x8, 0x7, 0x5, 0x2, 0xdc, 0xffffffff, 0x81, 0x10c4f5ec, 0x7, 0x8, 0xfe, 0x2a, 0x3, 0x81, 0x6, 0x1, 0x100, 0x5, 0x2, 0x7, 0x1f, 0x0, 0xed, 0x2, 0x401, 0x355, 0x5, 0xfffffffc, 0x7, 0x8d, 0x3, 0xfffffff9, 0x80000000, 0x6, 0x0, 0x5, 0x4, 0x2, 0xaad8, 0x7d, 0x0, 0x1000, 0xfffff9de, 0x7c, 0x2, 0x7fffffff, 0xfff, 0x8, 0x9, 0x4, 0x8, 0x1, 0x2, 0x2, 0x0, 0x5, 0x0, 0x5, 0xffff, 0x7, 0x2, 0x1, 0x30, 0x2e, 0x2, 0x89, 0x400, 0x5, 0x6, 0x80000000, 0x0, 0x0, 0x3, 0xffffffff, 0x8, 0x8, 0x1, 0x6, 0x2, 0x5, 0xeea2, 0x7, 0x5, 0x2, 0x3, 0x101, 0x1000, 0x0, 0x80, 0x7, 0xff3, 0xfffffaf3, 0x8, 0x7, 0x0, 0x4, 0x3, 0x927, 0x10000, 0x2, 0xfff, 0x5, 0x3f, 0x3, 0xb33d, 0x8, 0x80000000, 0x6a, 0x4, 0x1, 0x100, 0x5, 0x6, 0xa8e1, 0x7, 0x94be, 0x4, 0x1f39, 0xffff, 0x9, 0x9, 0x1, 0x5, 0x5, 0xff, 0xc2e, 0x8, 0x3, 0x8c9, 0x20000000, 0x7, 0x80, 0x7, 0x80, 0x1048, 0x8, 0x8000, 0x8000, 0x6, 0x101, 0x10000, 0x3, 0x32c, 0xa77, 0x8001, 0x4, 0x80000000, 0x7f, 0xa32d, 0x101, 0x7bc, 0x7, 0x7ff, 0x64d8, 0xdd, 0x2, 0x200, 0x0, 0x8, 0x10000, 0xe, 0x79, 0x10, 0x1]}) r1 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f00000007c0)="30eb2297b18c0a2ada6f46f8341ce63ccdab668e820dabde", 0x41395563) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) write$input_event(r2, &(0x7f0000000040)={{r3, r4/1000+60000}, 0x17, 0x400, 0x8}, 0x18) r5 = openat$cgroup_netprio_ifpriomap(r2, &(0x7f0000000080)='net_prio.ifpriomap\x00', 0x2, 0x0) ioctl$F2FS_IOC_SET_PIN_FILE(r5, 0x4004f50d, &(0x7f00000000c0)) fcntl$setlease(r1, 0x400, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2323.413884][T26029] usb 4-1: config 0 has no interfaces? [ 2323.493980][T26029] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2323.507716][T26029] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2323.550216][T26029] usb 4-1: SerialNumber: syz [ 2323.574375][T26029] usb 4-1: config 0 descriptor?? [ 2323.592854][ T144] systemd-udevd invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=3, oom_score_adj=-1000 [ 2323.622406][ T144] CPU: 1 PID: 144 Comm: systemd-udevd Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2323.632311][ T144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2323.642447][ T144] Call Trace: [ 2323.645735][ T144] dump_stack+0x1b0/0x21e [ 2323.650089][ T144] ? devkmsg_release+0x11c/0x11c [ 2323.655023][ T144] ? ___ratelimit+0x3bf/0x560 [ 2323.659693][ T144] ? show_regs_print_info+0x12/0x12 [ 2323.664882][ T144] ? _raw_spin_lock+0xa1/0x170 [ 2323.669618][ T144] ? radix_tree_cpu_dead+0x160/0x160 [ 2323.674876][ T144] dump_header+0xdb/0x700 [ 2323.679177][ T144] oom_kill_process+0xd3/0x280 [ 2323.683909][ T144] out_of_memory+0x5b6/0x890 [ 2323.688481][ T144] ? unregister_oom_notifier+0x20/0x20 [ 2323.693912][ T144] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2323.699449][ T144] ? get_page_from_freelist+0x7c0/0x7c0 [ 2323.704968][ T144] ? __zone_watermark_ok+0x91/0x280 [ 2323.710139][ T144] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2323.715482][ T144] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2323.721000][ T144] ? copy_process+0x5c9/0x52f0 [ 2323.725731][ T144] ? copy_process+0x5c9/0x52f0 [ 2323.730465][ T144] ? kmem_cache_alloc+0x1d5/0x250 [ 2323.735460][ T144] copy_process+0x612/0x52f0 [ 2323.740023][ T144] ? _raw_spin_lock_irqsave+0xda/0x1c0 [ 2323.745456][ T144] ? sock_setsockopt+0x1d93/0x2c30 [ 2323.750539][ T144] ? fork_idle+0x290/0x290 [ 2323.754930][ T144] _do_fork+0x180/0x8f0 [ 2323.759056][ T144] ? dup_mm+0x300/0x300 [ 2323.763181][ T144] ? __secure_computing+0x1b6/0x250 [ 2323.768352][ T144] ? syscall_trace_enter+0x683/0xa70 [ 2323.773604][ T144] __x64_sys_clone+0x246/0x2b0 [ 2323.778365][ T144] ? __ia32_sys_vfork+0x110/0x110 [ 2323.783371][ T144] do_syscall_64+0xcb/0x150 [ 2323.787867][ T144] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2323.793736][ T144] RIP: 0033:0x7f335d9c438b [ 2323.798129][ T144] Code: db 45 85 f6 0f 85 95 01 00 00 64 4c 8b 04 25 10 00 00 00 31 d2 4d 8d 90 d0 02 00 00 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 de 00 00 00 85 c0 41 89 c5 0f 85 e5 00 00 [ 2323.817720][ T144] RSP: 002b:00007ffca55b6db0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 2323.826103][ T144] RAX: ffffffffffffffda RBX: 00007ffca55b6db0 RCX: 00007f335d9c438b [ 2323.834047][ T144] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 2323.841992][ T144] RBP: 00007ffca55b6e00 R08: 00007f335eb748c0 R09: 0000000000000210 [ 2323.849936][ T144] R10: 00007f335eb74b90 R11: 0000000000000246 R12: 0000000000000000 [ 2323.857889][ T144] R13: 0000000000000020 R14: 0000000000000000 R15: 0000000000000000 [ 2323.992042][ T144] Mem-Info: [ 2323.995448][ T144] active_anon:1405001 inactive_anon:4735 isolated_anon:0 [ 2323.995448][ T144] active_file:343 inactive_file:321 isolated_file:43 [ 2323.995448][ T144] unevictable:0 dirty:17 writeback:0 unstable:0 [ 2323.995448][ T144] slab_reclaimable:9564 slab_unreclaimable:96951 [ 2323.995448][ T144] mapped:55996 shmem:4831 pagetables:31127 bounce:0 [ 2323.995448][ T144] free:15526 free_pcp:45 free_cma:0 [ 2324.033596][T28562] usb 1-1: new high-speed USB device number 63 using dummy_hcd [ 2324.041939][ T144] Node 0 active_anon:5620004kB inactive_anon:18940kB active_file:1372kB inactive_file:1144kB unevictable:0kB isolated(anon):0kB isolated(file):148kB mapped:223984kB dirty:68kB writeback:0kB shmem:19324kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2324.067274][ T144] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2324.093670][ T144] lowmem_reserve[]: 0 2912 6416 6416 [ 2324.099471][ T144] DMA32 free:25456kB min:8740kB low:11720kB high:14700kB active_anon:2901960kB inactive_anon:8220kB active_file:1148kB inactive_file:556kB unevictable:0kB writepending:88kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1632kB pagetables:1216kB bounce:0kB free_pcp:128kB local_pcp:4kB free_cma:0kB [ 2324.142206][ T144] lowmem_reserve[]: 0 0 3504 3504 [ 2324.149047][ T144] Normal free:19592kB min:5592kB low:9180kB high:12768kB active_anon:2717952kB inactive_anon:10720kB active_file:728kB inactive_file:1556kB unevictable:0kB writepending:280kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35296kB pagetables:123292kB bounce:0kB free_pcp:864kB local_pcp:504kB free_cma:0kB [ 2324.154957][T12886] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2324.179546][ T144] lowmem_reserve[]: 0 0 0 0 [ 2324.191326][ T144] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2324.205426][ T144] DMA32: 388*4kB (UM) 196*8kB (UMEH) 265*16kB (UM) 33*32kB (MEH) 23*64kB (MEH) 10*128kB (MH) 39*256kB (MH) 6*512kB (ME) 2*1024kB (ME) 0*2048kB 0*4096kB = 26272kB [ 2324.214544][ T9634] usb 4-1: USB disconnect, device number 35 [ 2324.222306][ T144] Normal: 363*4kB (UMEH) 272*8kB (UMH) 477*16kB (UMH) 102*32kB (UMEH) 52*64kB (UMH) 1*128kB (M) 1*256kB (M) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 18236kB [ 2324.243463][ T144] 5815 total pagecache pages [ 2324.248221][ T144] 0 pages in swap cache [ 2324.252409][ T144] Swap cache stats: add 0, delete 0, find 0/0 [ 2324.264098][ T144] Free swap = 0kB [ 2324.267826][ T144] Total swap = 0kB [ 2324.271612][ T144] 1965979 pages RAM [ 2324.275473][ T144] 0 pages HighMem/MovableOnly [ 2324.280139][ T144] 318041 pages reserved [ 2324.284352][ T144] 0 pages cma reserved [ 2324.288406][ T144] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.1,pid=11090,uid=0 [ 2324.302711][ T144] Out of memory: Killed process 11090 (syz-executor.1) total-vm:85484kB, anon-rss:16568kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:168kB oom_score_adj:1000 [ 2324.320311][ T23] oom_reaper: reaped process 11090 (syz-executor.1), now anon-rss:0kB, file-rss:34816kB, shmem-rss:0kB 12:53:06 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xff03000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:06 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x9000000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2324.343733][T28562] usb 1-1: Using ep0 maxpacket: 8 12:53:06 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xff0b400000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:06 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="00f0"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2324.473654][T28562] usb 1-1: config 0 has no interfaces? [ 2324.473685][T26029] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 2324.563687][T28562] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2324.572853][T28562] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2324.581065][T28562] usb 1-1: SerialNumber: syz [ 2324.586601][T28562] usb 1-1: config 0 descriptor?? 12:53:06 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0x9000000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:06 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xff0f000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:06 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="00f6"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2324.723505][T26029] usb 2-1: Using ep0 maxpacket: 8 [ 2324.763575][T26029] usb 2-1: too many configurations: 196, using maximum allowed: 8 [ 2324.883863][T26029] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 2324.891653][T26029] usb 2-1: can't read configurations, error -61 [ 2324.942722][T12902] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2324.951937][ T9634] usb 1-1: USB disconnect, device number 63 [ 2325.053452][T26029] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 2325.293405][T26029] usb 2-1: Using ep0 maxpacket: 8 [ 2325.333473][T26029] usb 2-1: too many configurations: 196, using maximum allowed: 8 12:53:07 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a40700000001010902"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2325.453414][T26029] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 2325.461611][T26029] usb 2-1: can't read configurations, error -61 [ 2325.469130][T26029] usb usb2-port1: attempt power cycle [ 2325.743302][ T9634] usb 1-1: new high-speed USB device number 64 using dummy_hcd [ 2325.983226][ T9634] usb 1-1: Using ep0 maxpacket: 8 [ 2326.113273][ T9634] usb 1-1: config 0 has no interfaces? [ 2326.193181][T26029] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 2326.203236][ T9634] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2326.212485][ T9634] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2326.220711][ T9634] usb 1-1: SerialNumber: syz [ 2326.226099][ T9634] usb 1-1: config 0 descriptor?? [ 2326.283242][T26029] usb 2-1: Using ep0 maxpacket: 8 [ 2326.323214][T26029] usb 2-1: too many configurations: 196, using maximum allowed: 8 [ 2326.443186][T26029] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 2326.451026][T26029] usb 2-1: can't read configurations, error -61 [ 2326.464111][T12950] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2326.472427][T28562] usb 1-1: USB disconnect, device number 64 12:53:08 executing program 1: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe0000009058202416b7d68d6ca8c868c91e49afa896eba7bee3a60644742e1e20fc2045fa823341e62065d8a04315959b56440127598480676d5773e235842944e87dafaf41788eb80c23e825932c59198a83b082b055b117d93dabaea679c5dc2401d5dab362f9ddb6390096dabb89986b90fb496efe10c1890294adda643c437e5daeb0e7ed00c3547313828f5d7c83bd53b0dfa6ed675"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:08 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:08 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="0097"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:53:08 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xff1f000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:08 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="00fd"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2326.603466][T26029] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 2326.863048][T10330] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 2327.075850][ T329] sshd invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 2327.086157][T26029] usb 2-1: device not accepting address 55, error -71 [ 2327.105759][ T329] CPU: 1 PID: 329 Comm: sshd Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2327.114937][ T329] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2327.124992][ T329] Call Trace: [ 2327.128273][ T329] dump_stack+0x1b0/0x21e [ 2327.132589][ T329] ? devkmsg_release+0x11c/0x11c [ 2327.137583][ T329] ? ___ratelimit+0x3bf/0x560 [ 2327.142230][ T329] ? show_regs_print_info+0x12/0x12 [ 2327.148720][ T329] ? _raw_spin_lock+0xa1/0x170 [ 2327.153465][ T329] ? radix_tree_cpu_dead+0x160/0x160 [ 2327.158720][ T329] dump_header+0xdb/0x700 [ 2327.163107][ T329] oom_kill_process+0xd3/0x280 [ 2327.167858][ T329] out_of_memory+0x5b6/0x890 [ 2327.172432][ T329] ? unregister_oom_notifier+0x20/0x20 [ 2327.177983][ T329] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2327.183533][ T329] ? get_page_from_freelist+0x7c0/0x7c0 [ 2327.189049][ T329] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2327.194418][ T329] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2327.199962][ T329] pagecache_get_page+0x522/0x8a0 [ 2327.204966][ T329] filemap_fault+0x1435/0x1990 [ 2327.209704][ T329] ? __down_read+0xf1/0x210 [ 2327.214198][ T329] ? generic_file_read_iter+0x20a0/0x20a0 [ 2327.219893][ T329] ext4_filemap_fault+0x7b/0x90 [ 2327.225011][ T329] handle_mm_fault+0x291e/0x4140 [ 2327.229925][ T329] ? finish_fault+0x230/0x230 [ 2327.234573][ T329] ? ktime_get_ts64+0x2c3/0x350 [ 2327.239395][ T329] ? __fsnotify_parent+0x300/0x300 [ 2327.244735][ T329] ? timespec64_add_safe+0x1b7/0x210 [ 2327.249993][ T329] ? down_read_trylock+0x17a/0x1d0 [ 2327.255074][ T329] ? vmacache_find+0x205/0x4b0 [ 2327.259810][ T329] do_user_addr_fault+0x48a/0x9f0 [ 2327.264808][ T329] page_fault+0x2f/0x40 [ 2327.268935][ T329] RIP: 0033:0x563991a80e0b [ 2327.273334][ T329] Code: Bad RIP value. [ 2327.277370][ T329] RSP: 002b:00007ffcf00d0600 EFLAGS: 00010207 [ 2327.283419][ T329] RAX: 0000000000000001 RBX: 00005639920c13f0 RCX: 00007f524a3415e3 [ 2327.291373][ T329] RDX: 00005639920c1060 RSI: 00005639920c13f0 RDI: 000000000000000c [ 2327.299321][ T329] RBP: 0000563991d2aa88 R08: 00007ffcf00d0680 R09: 0000000000006000 [ 2327.307265][ T329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2327.315212][ T329] R13: 00007ffcf00d065f R14: 0000563991ae5be7 R15: 0000000000000003 [ 2327.331470][T26029] usb usb2-port1: unable to enumerate USB device [ 2327.360821][ T329] Mem-Info: [ 2327.380037][ T329] active_anon:1404418 inactive_anon:4735 isolated_anon:0 [ 2327.380037][ T329] active_file:365 inactive_file:505 isolated_file:54 [ 2327.380037][ T329] unevictable:0 dirty:37 writeback:0 unstable:0 [ 2327.380037][ T329] slab_reclaimable:9576 slab_unreclaimable:97086 [ 2327.380037][ T329] mapped:56067 shmem:4831 pagetables:31180 bounce:0 [ 2327.380037][ T329] free:15356 free_pcp:651 free_cma:0 [ 2327.418924][ T329] Node 0 active_anon:5617672kB inactive_anon:18940kB active_file:1280kB inactive_file:2120kB unevictable:0kB isolated(anon):0kB isolated(file):88kB mapped:224268kB dirty:148kB writeback:0kB shmem:19324kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2327.455620][ T329] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2327.492930][T10330] usb 4-1: Using ep0 maxpacket: 8 [ 2327.497531][ T329] lowmem_reserve[]: 0 2912 6416 6416 [ 2327.518429][ T329] DMA32 free:21552kB min:4644kB low:7624kB high:10604kB active_anon:2905472kB inactive_anon:8216kB active_file:212kB inactive_file:776kB unevictable:0kB writepending:20kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1824kB pagetables:1356kB bounce:0kB free_pcp:1072kB local_pcp:696kB free_cma:0kB [ 2327.550288][ T329] lowmem_reserve[]: 0 0 3504 3504 [ 2327.555536][ T329] Normal free:31304kB min:5592kB low:9180kB high:12768kB active_anon:2702896kB inactive_anon:10724kB active_file:732kB inactive_file:2640kB unevictable:0kB writepending:136kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35168kB pagetables:123364kB bounce:0kB free_pcp:2156kB local_pcp:860kB free_cma:0kB [ 2327.585464][ T329] lowmem_reserve[]: 0 0 0 0 [ 2327.591586][ T329] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2327.605249][ T329] DMA32: 237*4kB (M) 142*8kB (UMH) 264*16kB (UM) 50*32kB (UMH) 44*64kB (MH) 29*128kB (MH) 27*256kB (MH) 6*512kB (UM) 2*1024kB (UM) 0*2048kB 0*4096kB = 26468kB [ 2327.623628][ T329] Normal: 321*4kB (UMEH) 599*8kB (UMEH) 668*16kB (UMEH) 104*32kB (UMEH) 74*64kB (UMH) 4*128kB (M) 2*256kB (M) 2*512kB (M) 1*1024kB (M) 0*2048kB 0*4096kB = 27900kB [ 2327.640292][ T329] 7224 total pagecache pages [ 2327.645219][ T329] 0 pages in swap cache [ 2327.649643][ T329] Swap cache stats: add 0, delete 0, find 0/0 [ 2327.657521][ T329] Free swap = 0kB [ 2327.663017][T10330] usb 4-1: config index 0 descriptor too short (expected 65316, got 36) [ 2327.672576][T10330] usb 4-1: config 0 has too many interfaces: 255, using maximum allowed: 32 [ 2327.681810][ T329] Total swap = 0kB [ 2327.685738][ T329] 1965979 pages RAM [ 2327.689703][ T329] 0 pages HighMem/MovableOnly [ 2327.694974][T10330] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2327.707183][ T329] 318041 pages reserved [ 2327.711410][ T329] 0 pages cma reserved [ 2327.716033][T10330] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 255 [ 2327.812797][ T329] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.0,pid=27123,uid=0 [ 2327.853717][ T329] Out of memory: Killed process 27123 (syz-executor.0) total-vm:85616kB, anon-rss:16476kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:160kB oom_score_adj:1000 [ 2327.893112][T26029] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 2327.908417][T12995] fuse: Bad value for 'fd' 12:53:08 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xffefffff00000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:09 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="00fe"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:53:09 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="0097"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:53:09 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a40700000001010902"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:09 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2327.962939][T10330] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2327.977535][T10330] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2327.987892][T10330] usb 4-1: SerialNumber: syz 12:53:09 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="0097"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:53:09 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xfff1ffff00000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2328.008559][T10330] usb 4-1: config 0 descriptor?? [ 2328.122764][ T9634] usb 1-1: new high-speed USB device number 65 using dummy_hcd [ 2328.272815][T26029] usb 2-1: Using ep0 maxpacket: 8 [ 2328.312131][T12958] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2328.321822][T16300] usb 4-1: USB disconnect, device number 36 [ 2328.392739][T26029] usb 2-1: config index 0 descriptor too short (expected 65316, got 36) [ 2328.401241][T26029] usb 2-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2328.410342][T26029] usb 2-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2328.419543][T26029] usb 2-1: config 5 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 [ 2328.430776][T26029] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2328.441556][T26029] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 833 [ 2328.451739][T26029] usb 2-1: config 5 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 2328.464762][ T9634] usb 1-1: Using ep0 maxpacket: 8 [ 2328.542814][T26029] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2328.552022][T26029] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2328.560284][T26029] usb 2-1: SerialNumber: syz [ 2328.582692][T12967] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2328.582721][ T9634] usb 1-1: config 0 has no interfaces? [ 2328.590329][T12967] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2328.623048][T26029] hub 2-1:5.0: bad descriptor, ignoring hub [ 2328.629058][T26029] hub: probe of 2-1:5.0 failed with error -5 [ 2328.672669][ T9634] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2328.684292][ T9634] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2328.693294][ T9634] usb 1-1: SerialNumber: syz [ 2328.698613][ T9634] usb 1-1: config 0 descriptor?? [ 2328.876490][T12967] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2328.883842][T12967] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2328.945593][T12987] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2328.954866][T28562] usb 1-1: USB disconnect, device number 65 [ 2329.094137][T12967] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2329.104527][T26029] usblp 2-1:5.0: usblp0: USB Bidirectional printer dev 56 if 0 alt 0 proto 3 vid 0x0525 pid 0xA4A8 [ 2329.152849][T26029] usb 2-1: USB disconnect, device number 56 [ 2329.159725][T26029] usblp0: removed [ 2329.872436][T28562] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 2330.112322][T28562] usb 2-1: Using ep0 maxpacket: 8 [ 2330.242294][T28562] usb 2-1: config index 0 descriptor too short (expected 65316, got 36) [ 2330.250782][T28562] usb 2-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2330.260718][T28562] usb 2-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2330.273637][T28562] usb 2-1: config 5 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 [ 2330.285301][T28562] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2330.295779][T28562] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 833 [ 2330.306561][T28562] usb 2-1: config 5 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 12:53:12 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:53:12 executing program 5: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a40700000001010902"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:12 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xffffff7f00000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:12 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:12 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:12 executing program 1: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff0500d5e61900d3e884dd85fadf7498090400001207010300090501"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2330.392314][T28562] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2330.401601][T28562] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2330.412079][T28562] usb 2-1: SerialNumber: syz [ 2330.442955][T28562] usb 2-1: can't set config #5, error -71 [ 2330.450023][T28562] usb 2-1: USB disconnect, device number 57 12:53:12 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xffffffff00000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:12 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2330.712175][T10330] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 2330.712181][T26029] usb 1-1: new high-speed USB device number 66 using dummy_hcd 12:53:12 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:53:12 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xffffffffffffffe0, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2330.822101][T28562] usb 2-1: new high-speed USB device number 58 using dummy_hcd 12:53:12 executing program 5: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a40700000001010902"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:12 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xffffffffffffffef, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2330.952132][T26029] usb 1-1: Using ep0 maxpacket: 8 [ 2330.972072][T10330] usb 4-1: Using ep0 maxpacket: 8 12:53:12 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2331.072062][T28562] usb 2-1: Using ep0 maxpacket: 8 [ 2331.082179][T26029] usb 1-1: config index 0 descriptor too short (expected 65316, got 36) [ 2331.090851][T26029] usb 1-1: config 0 has too many interfaces: 255, using maximum allowed: 32 [ 2331.099944][T26029] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2331.110466][T26029] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 255 12:53:12 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xffffffffffffffff, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2331.112120][T10330] usb 4-1: config index 0 descriptor too short (expected 65316, got 36) [ 2331.128466][T10330] usb 4-1: config 0 has too many interfaces: 255, using maximum allowed: 32 [ 2331.139049][T10330] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2331.153174][T10330] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 255 [ 2331.192908][T26029] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2331.204005][T26029] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2331.212825][T26029] usb 1-1: SerialNumber: syz [ 2331.222222][T28562] usb 2-1: config index 0 descriptor too short (expected 65316, got 36) [ 2331.223275][T26029] usb 1-1: config 0 descriptor?? 12:53:12 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2331.236639][T28562] usb 2-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2331.251129][T28562] usb 2-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 2331.263505][T28562] usb 2-1: config 5 has 0 interfaces, different from the descriptor's value: 255 [ 2331.273443][T10330] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2331.282716][T10330] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2331.290773][T10330] usb 4-1: SerialNumber: syz [ 2331.297022][T10330] usb 4-1: config 0 descriptor?? [ 2331.362270][T28562] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2331.372148][T28562] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2331.380655][T28562] usb 2-1: SerialNumber: syz [ 2331.474462][T13047] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2331.484567][T26029] usb 1-1: USB disconnect, device number 66 [ 2331.543900][T13044] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2331.551786][ T9634] usb 4-1: USB disconnect, device number 37 12:53:13 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:13 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2332.009559][T13111] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2332.331777][ T9634] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 2332.571712][ T9634] usb 4-1: Using ep0 maxpacket: 8 [ 2332.691750][ T9634] usb 4-1: config index 0 descriptor too short (expected 65316, got 36) [ 2332.700128][ T9634] usb 4-1: config 0 has too many interfaces: 255, using maximum allowed: 32 [ 2332.709480][ T9634] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2332.720051][ T9634] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 255 [ 2332.801731][ T9634] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2332.810854][ T9634] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2332.819437][ T9634] usb 4-1: SerialNumber: syz [ 2332.824964][ T9634] usb 4-1: config 0 descriptor?? [ 2333.062637][T13115] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2333.070548][ T9634] usb 4-1: USB disconnect, device number 38 12:53:15 executing program 5: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a40700000001010902"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:15 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x6) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:15 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:15 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2333.433717][T28562] usb 2-1: USB disconnect, device number 58 12:53:15 executing program 1: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) write$P9_RCLUNK(0xffffffffffffffff, &(0x7f0000000000)={0x7, 0x79, 0x2}, 0x7) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:15 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x3fe00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:15 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff0500"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:15 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:53:15 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x7fe00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2333.711504][T10330] usb 1-1: new high-speed USB device number 67 using dummy_hcd 12:53:15 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0xbfe00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:15 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2333.845563][ T9634] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 2333.891418][T28562] usb 2-1: new high-speed USB device number 59 using dummy_hcd 12:53:15 executing program 5: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2333.971392][T10330] usb 1-1: Using ep0 maxpacket: 8 12:53:15 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:53:15 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0xffe00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2334.091434][T10330] usb 1-1: config index 0 descriptor too short (expected 65316, got 36) [ 2334.099873][T10330] usb 1-1: config 0 has too many interfaces: 255, using maximum allowed: 32 [ 2334.109026][T10330] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2334.119584][T10330] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 255 [ 2334.121345][ T9634] usb 4-1: Using ep0 maxpacket: 8 [ 2334.131359][T28562] usb 2-1: Using ep0 maxpacket: 8 [ 2334.201462][T10330] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2334.213040][T10330] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2334.221169][T10330] usb 1-1: SerialNumber: syz [ 2334.228310][T10330] usb 1-1: config 0 descriptor?? [ 2334.251422][T28562] usb 2-1: config index 0 descriptor too short (expected 65316, got 36) [ 2334.259921][T28562] usb 2-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2334.269695][T28562] usb 2-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2334.271389][ T9634] usb 4-1: config index 0 descriptor too short (expected 65316, got 36) [ 2334.280156][T28562] usb 2-1: config 5 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 [ 2334.288596][ T9634] usb 4-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2334.298303][T28562] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2334.308059][ T9634] usb 4-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 2334.316699][T28562] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 65 [ 2334.327823][ T9634] usb 4-1: config 5 has 0 interfaces, different from the descriptor's value: 255 [ 2334.336627][T28562] usb 2-1: config 5 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 2334.421368][ T9634] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2334.430449][ T9634] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2334.438719][ T9634] usb 4-1: SerialNumber: syz [ 2334.441337][T28562] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2334.461451][T28562] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2334.470190][T28562] usb 2-1: SerialNumber: syz [ 2334.480375][T13131] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2334.489479][ T9634] usb 1-1: USB disconnect, device number 67 [ 2334.501365][T13137] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2334.508166][T13137] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2334.521665][T28562] hub 2-1:5.0: bad descriptor, ignoring hub [ 2334.527641][T28562] hub: probe of 2-1:5.0 failed with error -5 [ 2334.690181][T13144] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2334.700656][T10330] usb 4-1: USB disconnect, device number 39 [ 2334.721683][T13137] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2334.728613][T13137] raw-gadget gadget: fail, usb_ep_enable returned -22 12:53:16 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:16 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x100000) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2334.941986][T13137] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2334.962222][T28562] usblp 2-1:5.0: usblp0: USB Bidirectional printer dev 59 if 0 alt 0 proto 3 vid 0x0525 pid 0xA4A8 [ 2335.003072][T28562] usb 2-1: USB disconnect, device number 59 [ 2335.009779][T28562] usblp0: removed [ 2335.261093][T10330] usb 1-1: new high-speed USB device number 68 using dummy_hcd [ 2335.511047][T10330] usb 1-1: Using ep0 maxpacket: 8 [ 2335.631090][T10330] usb 1-1: config index 0 descriptor too short (expected 65316, got 36) [ 2335.639550][T10330] usb 1-1: config 0 has too many interfaces: 255, using maximum allowed: 32 [ 2335.648894][T10330] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2335.659542][T10330] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 255 [ 2335.730991][ T9634] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 2335.741573][T10330] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2335.750662][T10330] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2335.759473][T10330] usb 1-1: SerialNumber: syz [ 2335.765190][T10330] usb 1-1: config 0 descriptor?? [ 2335.980939][ T9634] usb 2-1: Using ep0 maxpacket: 8 [ 2336.002219][T13200] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2336.010147][T10330] usb 1-1: USB disconnect, device number 68 [ 2336.100965][ T9634] usb 2-1: config index 0 descriptor too short (expected 65316, got 36) [ 2336.109322][ T9634] usb 2-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2336.118232][ T9634] usb 2-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2336.127411][ T9634] usb 2-1: config 5 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 [ 2336.138373][ T9634] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2336.148295][ T9634] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 65 [ 2336.158239][ T9634] usb 2-1: config 5 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 2336.270934][ T9634] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2336.280076][ T9634] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2336.288579][ T9634] usb 2-1: SerialNumber: syz [ 2336.310946][T13137] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2336.317746][T13137] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2336.331247][ T9634] hub 2-1:5.0: bad descriptor, ignoring hub [ 2336.337423][ T9634] hub: probe of 2-1:5.0 failed with error -5 12:53:18 executing program 5: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:18 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:53:18 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x13fe00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:18 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff0500"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:18 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff0500"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2336.514029][ T9634] usblp: can't set desired altsetting 0 on interface 0 [ 2336.551194][ T9634] usb 2-1: USB disconnect, device number 60 12:53:18 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x400000) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:18 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2336.790863][T10330] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 2336.800807][T26029] usb 1-1: new high-speed USB device number 69 using dummy_hcd 12:53:18 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:53:18 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x400002) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:18 executing program 5: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:18 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x400c02) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2337.040698][T10330] usb 4-1: Using ep0 maxpacket: 8 [ 2337.040702][T26029] usb 1-1: Using ep0 maxpacket: 8 [ 2337.160732][T26029] usb 1-1: config index 0 descriptor too short (expected 65316, got 36) [ 2337.169562][T26029] usb 1-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2337.179834][T26029] usb 1-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 2337.190712][T10330] usb 4-1: config index 0 descriptor too short (expected 65316, got 36) [ 2337.190725][T26029] usb 1-1: config 5 has 0 interfaces, different from the descriptor's value: 255 12:53:19 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x400c03) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2337.199036][T10330] usb 4-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2337.199045][T10330] usb 4-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 2337.199053][T10330] usb 4-1: config 5 has 0 interfaces, different from the descriptor's value: 255 12:53:19 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2337.280693][T10330] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2337.289783][T10330] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2337.310633][T10330] usb 4-1: SerialNumber: syz [ 2337.321139][T26029] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2337.330896][T26029] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2337.339407][T26029] usb 1-1: SerialNumber: syz 12:53:19 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x400c04) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:19 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2337.551672][T13216] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2337.590183][T13215] syz-executor.3 invoked oom-killer: gfp_mask=0x40cc0(GFP_KERNEL|__GFP_COMP), order=1, oom_score_adj=1000 [ 2337.601604][T13215] CPU: 1 PID: 13215 Comm: syz-executor.3 Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2337.611735][T13215] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2337.621775][T13215] Call Trace: [ 2337.625054][T13215] dump_stack+0x1b0/0x21e [ 2337.629375][T13215] ? devkmsg_release+0x11c/0x11c [ 2337.634293][T13215] ? ___ratelimit+0x3bf/0x560 [ 2337.638959][T13215] ? show_regs_print_info+0x12/0x12 [ 2337.644136][T13215] ? _raw_spin_lock+0xa1/0x170 [ 2337.648885][T13215] ? radix_tree_cpu_dead+0x160/0x160 [ 2337.654151][T13215] dump_header+0xdb/0x700 [ 2337.658473][T13215] oom_kill_process+0xd3/0x280 [ 2337.663216][T13215] out_of_memory+0x5b6/0x890 [ 2337.667788][T13215] ? unregister_oom_notifier+0x20/0x20 [ 2337.673229][T13215] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2337.678757][T13215] ? get_page_from_freelist+0x7c0/0x7c0 [ 2337.684283][T13215] ? __zone_watermark_ok+0x91/0x280 [ 2337.689459][T13215] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2337.694800][T13215] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2337.700312][T13215] ? __set_page_dirty_buffers+0x24f/0x2e0 [ 2337.705997][T13215] ? block_page_mkwrite+0x226/0x250 [ 2337.711173][T13215] ? ext4_da_release_space+0x430/0x430 [ 2337.716598][T13215] ? __sb_end_write+0xa4/0xf0 [ 2337.721255][T13215] alloc_slab_page+0x3a/0x390 [ 2337.725897][T13215] new_slab+0x408/0x450 [ 2337.730018][T13215] ? should_fail+0x18e/0x860 [ 2337.734586][T13215] ___slab_alloc+0x2e0/0x450 [ 2337.739142][T13215] ? kobject_uevent_env+0x266/0x1100 [ 2337.744393][T13215] ? kobject_uevent_env+0x266/0x1100 [ 2337.749645][T13215] kmem_cache_alloc_trace+0x24c/0x270 [ 2337.754985][T13215] ? memset+0x1f/0x40 [ 2337.758949][T13215] ? dev_uevent_filter+0xb0/0xb0 [ 2337.763864][T13215] kobject_uevent_env+0x266/0x1100 [ 2337.768941][T13215] ? mutex_lock+0xa6/0x110 [ 2337.773325][T13215] usb_gadget_unregister_driver+0x108/0x680 [ 2337.779192][T13215] raw_release+0xf1/0x1e0 [ 2337.783493][T13215] ? raw_open+0x380/0x380 [ 2337.787794][T13215] __fput+0x27d/0x6c0 [ 2337.791745][T13215] task_work_run+0x176/0x1a0 [ 2337.796302][T13215] prepare_exit_to_usermode+0x286/0x2e0 [ 2337.801816][T13215] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2337.807679][T13215] RIP: 0033:0x4177b1 [ 2337.811544][T13215] Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 a4 1a 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 2337.831114][T13215] RSP: 002b:00007ffc8cfe12c0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 2337.839489][T13215] RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00000000004177b1 [ 2337.847444][T13215] RDX: 0000000000000000 RSI: 00000000000017b0 RDI: 0000000000000003 [ 2337.855383][T13215] RBP: 0000000000000001 R08: 00000000369eb7b0 R09: 00000000369eb7b4 [ 2337.863334][T13215] R10: 00007ffc8cfe13a0 R11: 0000000000000293 R12: ffffffffffffffff [ 2337.871273][T13215] R13: 000000000023ad37 R14: 00000000000003e8 R15: 000000000118bf2c [ 2337.886501][T13215] Mem-Info: [ 2337.889818][T13215] active_anon:1406738 inactive_anon:4735 isolated_anon:0 [ 2337.889818][T13215] active_file:389 inactive_file:361 isolated_file:81 [ 2337.889818][T13215] unevictable:0 dirty:46 writeback:0 unstable:0 [ 2337.889818][T13215] slab_reclaimable:9563 slab_unreclaimable:97080 [ 2337.889818][T13215] mapped:56265 shmem:4831 pagetables:31435 bounce:0 [ 2337.889818][T13215] free:13273 free_pcp:0 free_cma:0 [ 2337.959238][T13215] Node 0 active_anon:5626952kB inactive_anon:18940kB active_file:1184kB inactive_file:1204kB unevictable:0kB isolated(anon):0kB isolated(file):128kB mapped:224360kB dirty:184kB writeback:0kB shmem:19324kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2337.984794][T13215] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2338.014412][T13215] lowmem_reserve[]: 0 2912 6416 6416 [ 2338.020161][T13215] DMA32 free:18976kB min:4644kB low:7624kB high:10604kB active_anon:2910868kB inactive_anon:8212kB active_file:408kB inactive_file:16kB unevictable:0kB writepending:76kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1696kB pagetables:1256kB bounce:0kB free_pcp:352kB local_pcp:320kB free_cma:0kB [ 2338.050386][T13215] lowmem_reserve[]: 0 0 3504 3504 [ 2338.055803][T13215] Normal free:18716kB min:24744kB low:28332kB high:31920kB active_anon:2715192kB inactive_anon:10728kB active_file:1092kB inactive_file:1300kB unevictable:0kB writepending:0kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35424kB pagetables:124484kB bounce:0kB free_pcp:668kB local_pcp:68kB free_cma:0kB [ 2338.086319][T13215] lowmem_reserve[]: 0 0 0 0 [ 2338.091503][T13215] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2338.106243][T13215] DMA32: 25*4kB (UM) 55*8kB (UMH) 170*16kB (UM) 28*32kB (UH) 18*64kB (UMH) 12*128kB (UMH) 30*256kB (UMH) 6*512kB (UM) 1*1024kB (M) 0*2048kB 0*4096kB = 18620kB [ 2338.122610][T13215] Normal: 1886*4kB (UME) 280*8kB (UM) 461*16kB (UME) 58*32kB (UME) 4*64kB (M) 1*128kB (M) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 19400kB [ 2338.137689][T13215] 5324 total pagecache pages [ 2338.142687][T13215] 0 pages in swap cache [ 2338.147497][T13215] Swap cache stats: add 0, delete 0, find 0/0 [ 2338.153827][T13215] Free swap = 0kB [ 2338.157774][T13215] Total swap = 0kB [ 2338.161727][T13215] 1965979 pages RAM [ 2338.166010][T13215] 0 pages HighMem/MovableOnly [ 2338.170919][T13215] 318041 pages reserved [ 2338.175288][T13215] 0 pages cma reserved [ 2338.179501][T13215] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.2,pid=799,uid=0 [ 2338.214670][T13215] Out of memory: Killed process 799 (syz-executor.2) total-vm:85484kB, anon-rss:16360kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:164kB oom_score_adj:1000 [ 2338.235764][T10330] usb 4-1: USB disconnect, device number 40 [ 2338.407503][T13221] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2338.419120][T26029] usb 1-1: USB disconnect, device number 69 [ 2339.115384][ T349] syz-fuzzer invoked oom-killer: gfp_mask=0x1100dca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO|0x1000000), order=0, oom_score_adj=0 [ 2339.128119][ T349] CPU: 0 PID: 349 Comm: syz-fuzzer Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2339.137721][ T349] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2339.147744][ T349] Call Trace: [ 2339.151009][ T349] dump_stack+0x1b0/0x21e [ 2339.155310][ T349] ? devkmsg_release+0x11c/0x11c [ 2339.160214][ T349] ? ___ratelimit+0x3bf/0x560 [ 2339.164873][ T349] ? show_regs_print_info+0x12/0x12 [ 2339.170039][ T349] ? _raw_spin_lock+0xa1/0x170 [ 2339.174771][ T349] ? radix_tree_cpu_dead+0x160/0x160 [ 2339.180033][ T349] dump_header+0xdb/0x700 [ 2339.184333][ T349] oom_kill_process+0xd3/0x280 [ 2339.189066][ T349] out_of_memory+0x5b6/0x890 [ 2339.193627][ T349] ? unregister_oom_notifier+0x20/0x20 [ 2339.199053][ T349] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2339.204568][ T349] ? get_page_from_freelist+0x7c0/0x7c0 [ 2339.210083][ T349] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2339.215434][ T349] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2339.220948][ T349] ? mem_cgroup_commit_charge+0x198/0x240 [ 2339.226634][ T349] ? __rcu_read_lock+0x50/0x50 [ 2339.231377][ T349] handle_mm_fault+0x1849/0x4140 [ 2339.236284][ T349] ? finish_fault+0x230/0x230 [ 2339.240941][ T349] ? __ia32_sys_sigaltstack+0x60/0x60 [ 2339.246282][ T349] ? down_read_trylock+0x17a/0x1d0 [ 2339.251362][ T349] ? vmacache_find+0x47a/0x4b0 [ 2339.256096][ T349] do_user_addr_fault+0x48a/0x9f0 [ 2339.261446][ T349] page_fault+0x2f/0x40 [ 2339.265571][ T349] RIP: 0033:0x467f53 [ 2339.269435][ T349] Code: 00 48 81 eb 00 01 00 00 48 81 c7 00 01 00 00 48 81 fb 00 01 00 00 73 82 e9 07 ff ff ff c5 fd ef c0 48 81 fb 00 00 00 02 73 46 fe 7f 07 c5 fe 7f 47 20 c5 fe 7f 47 40 c5 fe 7f 47 60 48 81 eb [ 2339.289007][ T349] RSP: 002b:000000c00ff787b0 EFLAGS: 00010202 [ 2339.295041][ T349] RAX: 0000000000000000 RBX: 0000000000001000 RCX: 000000c0172b4000 [ 2339.302981][ T349] RDX: 00007f99270fc9a0 RSI: 0000000000000004 RDI: 000000c0172b5000 [ 2339.310921][ T349] RBP: 000000c00ff787f8 R08: 000000c0172b4000 R09: 0000000000000001 [ 2339.318859][ T349] R10: 00007f99270fc9a0 R11: 000000000000195a R12: 0000000000000000 [ 2339.326799][ T349] R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000001 [ 2339.335573][ T349] Mem-Info: [ 2339.338719][ T349] active_anon:1409141 inactive_anon:4735 isolated_anon:0 [ 2339.338719][ T349] active_file:340 inactive_file:458 isolated_file:38 [ 2339.338719][ T349] unevictable:0 dirty:0 writeback:0 unstable:0 [ 2339.338719][ T349] slab_reclaimable:9554 slab_unreclaimable:96921 [ 2339.338719][ T349] mapped:56282 shmem:4831 pagetables:31317 bounce:0 [ 2339.338719][ T349] free:11143 free_pcp:175 free_cma:0 [ 2339.376543][ T349] Node 0 active_anon:5636564kB inactive_anon:18940kB active_file:1540kB inactive_file:1744kB unevictable:0kB isolated(anon):0kB isolated(file):28kB mapped:225072kB dirty:0kB writeback:0kB shmem:19324kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2339.401142][ T349] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2339.427443][ T349] lowmem_reserve[]: 0 2912 6416 6416 [ 2339.433031][ T349] DMA32 free:18672kB min:4644kB low:7624kB high:10604kB active_anon:2911868kB inactive_anon:8220kB active_file:56kB inactive_file:172kB unevictable:0kB writepending:0kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1664kB pagetables:1260kB bounce:0kB free_pcp:224kB local_pcp:0kB free_cma:0kB [ 2339.462217][ T349] lowmem_reserve[]: 0 0 3504 3504 [ 2339.467258][ T349] Normal free:8880kB min:24744kB low:28332kB high:31920kB active_anon:2724696kB inactive_anon:10720kB active_file:1484kB inactive_file:2076kB unevictable:0kB writepending:0kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35328kB pagetables:124008kB bounce:0kB free_pcp:456kB local_pcp:180kB free_cma:0kB [ 2339.499539][ T349] lowmem_reserve[]: 0 0 0 0 [ 2339.504091][ T349] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2339.517610][ T349] DMA32: 183*4kB (UM) 61*8kB (UMH) 174*16kB (UM) 28*32kB (UMH) 20*64kB (UH) 11*128kB (UH) 26*256kB (UMH) 6*512kB (UM) 1*1024kB (M) 0*2048kB 0*4096kB = 18340kB [ 2339.533553][ T349] Normal: 529*4kB (UME) 89*8kB (UME) 401*16kB (UME) 44*32kB (UE) 1*64kB (U) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 10716kB [ 2339.547564][ T349] 5758 total pagecache pages [ 2339.552154][ T349] 0 pages in swap cache [ 2339.556312][ T349] Swap cache stats: add 0, delete 0, find 0/0 [ 2339.562395][ T349] Free swap = 0kB [ 2339.566092][ T349] Total swap = 0kB [ 2339.569783][ T349] 1965979 pages RAM [ 2339.573607][ T349] 0 pages HighMem/MovableOnly [ 2339.578272][ T349] 318041 pages reserved [ 2339.582433][ T349] 0 pages cma reserved [ 2339.586525][ T349] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.0,pid=18794,uid=0 [ 2339.600774][ T349] Out of memory: Killed process 18794 (syz-executor.0) total-vm:85484kB, anon-rss:16328kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:160kB oom_score_adj:1000 [ 2339.618549][ T23] oom_reaper: reaped process 18794 (syz-executor.0), now anon-rss:0kB, file-rss:34816kB, shmem-rss:0kB 12:53:21 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x400c05) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:21 executing program 5: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:21 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff0500"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:21 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff0500"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:21 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2340.070013][T10330] usb 1-1: new high-speed USB device number 70 using dummy_hcd [ 2340.499979][T28562] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 2340.739969][T28562] usb 4-1: Using ep0 maxpacket: 8 [ 2340.859905][T28562] usb 4-1: config index 0 descriptor too short (expected 65316, got 36) [ 2340.868260][T28562] usb 4-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2340.889876][T28562] usb 4-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 2340.909865][T28562] usb 4-1: config 5 has 0 interfaces, different from the descriptor's value: 255 [ 2340.939826][T10330] usb 1-1: Using ep0 maxpacket: 8 [ 2340.989877][T28562] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2341.002509][T28562] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2341.026887][T28562] usb 4-1: SerialNumber: syz [ 2341.036245][T10330] warn_alloc: 2 callbacks suppressed [ 2341.036258][T10330] kworker/0:0: page allocation failure: order:4, mode:0x40cc0(GFP_KERNEL|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0 [ 2341.060934][T10330] CPU: 0 PID: 10330 Comm: kworker/0:0 Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2341.070839][T10330] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2341.080987][T10330] Workqueue: usb_hub_wq hub_event [ 2341.086000][T10330] Call Trace: [ 2341.089287][T10330] dump_stack+0x1b0/0x21e [ 2341.093617][T10330] ? devkmsg_release+0x11c/0x11c [ 2341.098546][T10330] ? show_regs_print_info+0x12/0x12 [ 2341.103743][T10330] warn_alloc+0x1ee/0x340 [ 2341.108095][T10330] ? zone_watermark_ok_safe+0x420/0x420 [ 2341.113899][T10330] __alloc_pages_slowpath+0x1c98/0x1cb0 [ 2341.119435][T10330] ? process_one_work+0x777/0xf90 [ 2341.124458][T10330] ? get_page_from_freelist+0x7c0/0x7c0 [ 2341.129998][T10330] ? __zone_watermark_ok+0x91/0x280 [ 2341.135197][T10330] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2341.140572][T10330] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2341.146111][T10330] ? usb_anchor_empty+0x40/0x40 [ 2341.150961][T10330] ? setup_fault_attr+0x2b0/0x2b0 [ 2341.155978][T10330] ? ___slab_alloc+0x9b/0x450 [ 2341.160642][T10330] kmalloc_order_trace+0x2a/0xf0 [ 2341.165569][T10330] __kmalloc+0x268/0x2c0 [ 2341.169799][T10330] usb_get_configuration+0x326/0x4920 [ 2341.175243][T10330] ? _raw_spin_lock_irqsave+0xda/0x1c0 [ 2341.180687][T10330] ? slab_free_freelist_hook+0xd0/0x150 [ 2341.186221][T10330] ? trace_rpm_return_int_rcuidle+0x23/0x1d0 [ 2341.192188][T10330] ? rpm_resume+0xa29/0x19b0 [ 2341.196767][T10330] ? usb_destroy_configuration+0x580/0x580 [ 2341.202567][T10330] ? _raw_spin_lock_irq+0xa2/0x180 [ 2341.207667][T10330] ? _raw_spin_lock_irqsave+0x1c0/0x1c0 [ 2341.213207][T10330] ? pm_runtime_forbid+0xa7/0xf0 [ 2341.218151][T10330] usb_new_device+0x155/0x1710 [ 2341.222908][T10330] ? hub_port_init+0x1e9e/0x30e0 [ 2341.227838][T10330] ? _raw_spin_lock_irq+0xa2/0x180 [ 2341.232938][T10330] ? usb_disconnect+0x880/0x880 [ 2341.237784][T10330] hub_event+0x2a5b/0x4d50 [ 2341.242197][T10330] ? led_work+0x530/0x530 [ 2341.246518][T10330] ? pm_schedule_suspend+0x1d0/0x1d0 [ 2341.251795][T10330] ? _raw_spin_lock+0x170/0x170 [ 2341.256636][T10330] ? mutex_lock+0xa6/0x110 [ 2341.261039][T10330] ? _raw_spin_lock_irq+0xa2/0x180 [ 2341.266146][T10330] ? read_word_at_a_time+0xe/0x20 [ 2341.271164][T10330] ? strscpy+0xa6/0x260 [ 2341.275313][T10330] process_one_work+0x777/0xf90 [ 2341.280156][T10330] worker_thread+0xa8f/0x1430 [ 2341.284827][T10330] kthread+0x317/0x340 [ 2341.288896][T10330] ? process_one_work+0xf90/0xf90 [ 2341.293910][T10330] ? kthread_destroy_worker+0x270/0x270 [ 2341.299444][T10330] ret_from_fork+0x1f/0x30 [ 2341.309988][T10330] Mem-Info: [ 2341.313131][T10330] active_anon:1408784 inactive_anon:4736 isolated_anon:0 [ 2341.313131][T10330] active_file:25 inactive_file:239 isolated_file:20 [ 2341.313131][T10330] unevictable:0 dirty:16 writeback:0 unstable:0 [ 2341.313131][T10330] slab_reclaimable:9553 slab_unreclaimable:97100 [ 2341.313131][T10330] mapped:55740 shmem:4832 pagetables:31462 bounce:0 [ 2341.313131][T10330] free:11658 free_pcp:106 free_cma:0 [ 2341.351394][T10330] Node 0 active_anon:5635236kB inactive_anon:18944kB active_file:1596kB inactive_file:1348kB unevictable:0kB isolated(anon):0kB isolated(file):128kB mapped:225260kB dirty:64kB writeback:0kB shmem:19328kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2341.376370][T10330] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2341.402697][T10330] lowmem_reserve[]: 0 2912 6416 6416 [ 2341.408317][T10330] DMA32 free:18404kB min:4644kB low:7624kB high:10604kB active_anon:2914600kB inactive_anon:8216kB active_file:24kB inactive_file:32kB unevictable:0kB writepending:0kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1696kB pagetables:1264kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB [ 2341.437174][T10330] lowmem_reserve[]: 0 0 3504 3504 [ 2341.442675][T10330] Normal free:11260kB min:5592kB low:9180kB high:12768kB active_anon:2720536kB inactive_anon:10728kB active_file:376kB inactive_file:0kB unevictable:0kB writepending:0kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35616kB pagetables:124584kB bounce:0kB free_pcp:952kB local_pcp:276kB free_cma:0kB [ 2341.472309][T10330] lowmem_reserve[]: 0 0 0 0 [ 2341.477065][T10330] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2341.490415][T10330] DMA32: 203*4kB (UM) 89*8kB (UMH) 178*16kB (UM) 96*32kB (UMH) 26*64kB (UMH) 12*128kB (UMH) 17*256kB (UMH) 6*512kB (UM) 1*1024kB (M) 0*2048kB 0*4096kB = 19092kB [ 2341.506655][T10330] Normal: 5*4kB (E) 32*8kB (UME) 436*16kB (UME) 44*32kB (UME) 2*64kB (M) 1*128kB (U) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 8916kB [ 2341.539685][T10330] 4951 total pagecache pages [ 2341.544470][T10330] 0 pages in swap cache [ 2341.548623][T10330] Swap cache stats: add 0, delete 0, find 0/0 [ 2341.570131][T10330] Free swap = 0kB [ 2341.574337][T10330] Total swap = 0kB [ 2341.578561][T10330] 1965979 pages RAM [ 2341.589699][T10330] 0 pages HighMem/MovableOnly [ 2341.594475][T10330] 318041 pages reserved [ 2341.598614][T10330] 0 pages cma reserved [ 2341.619679][T10330] usb 1-1: out of memory [ 2341.623946][T10330] usb 1-1: can't read configurations, error -12 [ 2341.641242][ T133] systemd-journal invoked oom-killer: gfp_mask=0x40cc0(GFP_KERNEL|__GFP_COMP), order=1, oom_score_adj=0 [ 2341.664073][ T133] CPU: 1 PID: 133 Comm: systemd-journal Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2341.674147][ T133] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2341.684206][ T133] Call Trace: [ 2341.687499][ T133] dump_stack+0x1b0/0x21e [ 2341.691822][ T133] ? devkmsg_release+0x11c/0x11c [ 2341.699097][ T133] ? ___ratelimit+0x3bf/0x560 [ 2341.703770][ T133] ? show_regs_print_info+0x12/0x12 [ 2341.708990][ T133] ? _raw_spin_lock+0xa1/0x170 [ 2341.713753][ T133] ? radix_tree_cpu_dead+0x160/0x160 [ 2341.719033][ T133] dump_header+0xdb/0x700 [ 2341.723363][ T133] oom_kill_process+0xd3/0x280 [ 2341.728298][ T133] out_of_memory+0x5b6/0x890 [ 2341.732893][ T133] ? unregister_oom_notifier+0x20/0x20 [ 2341.738351][ T133] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2341.743895][ T133] ? get_page_from_freelist+0x7c0/0x7c0 [ 2341.749529][ T133] ? __zone_watermark_ok+0x91/0x280 [ 2341.754724][ T133] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2341.760095][ T133] ? __kasan_kmalloc+0x117/0x1b0 [ 2341.765055][ T133] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2341.771203][ T133] ? kmem_cache_alloc+0x1d5/0x250 [ 2341.776232][ T133] ? is_mmconf_reserved+0x420/0x420 [ 2341.781431][ T133] alloc_slab_page+0x3a/0x390 [ 2341.786103][ T133] new_slab+0x408/0x450 [ 2341.789653][T10330] usb 1-1: new high-speed USB device number 71 using dummy_hcd [ 2341.790274][ T133] ? preempt_schedule_notrace+0x110/0x110 [ 2341.803493][ T133] ? should_fail+0x18e/0x860 [ 2341.808078][ T133] ___slab_alloc+0x2e0/0x450 [ 2341.812667][ T133] ? getname_flags+0xb8/0x610 [ 2341.817352][ T133] ? getname_flags+0xb8/0x610 [ 2341.822024][ T133] kmem_cache_alloc+0x230/0x250 [ 2341.826873][ T133] getname_flags+0xb8/0x610 [ 2341.831398][ T133] ? security_prepare_creds+0x197/0x220 [ 2341.836939][ T133] user_path_at_empty+0x28/0x50 [ 2341.841787][ T133] do_faccessat+0x2fc/0x7d0 [ 2341.846288][ T133] ? __ia32_sys_fallocate+0x100/0x100 [ 2341.851764][ T133] do_syscall_64+0xcb/0x150 [ 2341.856263][ T133] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2341.862148][ T133] RIP: 0033:0x7fa0c7e2b9c7 [ 2341.866566][ T133] Code: Bad RIP value. [ 2341.870625][ T133] RSP: 002b:00007fff5426e4d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000015 [ 2341.879023][ T133] RAX: ffffffffffffffda RBX: 00007fff542713f0 RCX: 00007fa0c7e2b9c7 [ 2341.887000][ T133] RDX: 00007fa0c889ca00 RSI: 0000000000000000 RDI: 000055e5070659a3 [ 2341.894964][ T133] RBP: 00007fff5426e510 R08: 0000000000000000 R09: 0000000000000000 [ 2341.902927][ T133] R10: 0000000000000069 R11: 0000000000000246 R12: 0000000000000000 [ 2341.910891][ T133] R13: 0000000000000000 R14: 00007fff542713f0 R15: 00007fff5426ea00 [ 2341.938553][T13295] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2341.949075][T26029] usb 4-1: USB disconnect, device number 41 [ 2341.957172][ T133] Mem-Info: [ 2341.960688][ T133] active_anon:1408748 inactive_anon:4736 isolated_anon:0 [ 2341.960688][ T133] active_file:139 inactive_file:703 isolated_file:32 [ 2341.960688][ T133] unevictable:0 dirty:0 writeback:1 unstable:0 [ 2341.960688][ T133] slab_reclaimable:9553 slab_unreclaimable:96981 [ 2341.960688][ T133] mapped:56116 shmem:4832 pagetables:31452 bounce:0 [ 2341.960688][ T133] free:11393 free_pcp:189 free_cma:0 [ 2342.011679][ T133] Node 0 active_anon:5634892kB inactive_anon:18944kB active_file:956kB inactive_file:2876kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:224864kB dirty:0kB writeback:4kB shmem:19328kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2342.040231][ T133] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2342.068933][ T133] lowmem_reserve[]: 0 2912 6416 6416 [ 2342.075533][ T133] DMA32 free:18772kB min:4644kB low:7624kB high:10604kB active_anon:2914600kB inactive_anon:8216kB active_file:0kB inactive_file:40kB unevictable:0kB writepending:0kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1696kB pagetables:1264kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2342.105045][ T133] lowmem_reserve[]: 0 0 3504 3504 [ 2342.110968][ T133] Normal free:10268kB min:9688kB low:13276kB high:16864kB active_anon:2720592kB inactive_anon:10728kB active_file:1264kB inactive_file:1516kB unevictable:0kB writepending:0kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35456kB pagetables:124544kB bounce:0kB free_pcp:412kB local_pcp:236kB free_cma:0kB [ 2342.142380][ T133] lowmem_reserve[]: 0 0 0 0 [ 2342.147904][ T133] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2342.149570][T10330] usb 1-1: Using ep0 maxpacket: 8 [ 2342.162173][ T133] DMA32: 184*4kB (UM) 93*8kB (UMH) 183*16kB (UM) 107*32kB (UMH) 28*64kB (UMH) 12*128kB (UMH) 17*256kB (UMH) 6*512kB (UM) 1*1024kB (M) 0*2048kB 0*4096kB = 19608kB [ 2342.209607][ T133] Normal: 70*4kB (U) 46*8kB (UE) 385*16kB (UE) 20*32kB (UE) 1*64kB (U) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 7512kB [ 2342.237980][ T133] 6354 total pagecache pages [ 2342.242776][ T133] 0 pages in swap cache [ 2342.246923][ T133] Swap cache stats: add 0, delete 0, find 0/0 [ 2342.262789][ T133] Free swap = 0kB [ 2342.270128][ T133] Total swap = 0kB [ 2342.278682][ T133] 1965979 pages RAM [ 2342.286923][ T133] 0 pages HighMem/MovableOnly [ 2342.297004][ T133] 318041 pages reserved [ 2342.307084][ T133] 0 pages cma reserved [ 2342.316040][ T133] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.0,pid=6792,uid=0 [ 2342.346423][ T133] Out of memory: Killed process 6792 (syz-executor.0) total-vm:85484kB, anon-rss:16300kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:160kB oom_score_adj:1000 12:53:24 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:53:24 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x400c06) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:24 executing program 5: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2342.429596][T10330] usb 1-1: config index 0 descriptor too short (expected 65316, got 36) [ 2342.437985][T10330] usb 1-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2342.446920][T10330] usb 1-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 2342.457034][T10330] usb 1-1: config 5 has 0 interfaces, different from the descriptor's value: 255 12:53:24 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff05"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2342.539558][T10330] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2342.548609][T10330] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2342.579458][T10330] usb 1-1: SerialNumber: syz 12:53:24 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff0500"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2342.794614][ T9634] usb 1-1: USB disconnect, device number 71 [ 2342.929434][T26029] usb 4-1: new high-speed USB device number 42 using dummy_hcd 12:53:24 executing program 5: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2343.179326][T26029] usb 4-1: Using ep0 maxpacket: 8 [ 2343.430184][T26029] usb 4-1: config index 0 descriptor too short (expected 65316, got 36) [ 2343.469151][T26029] usb 4-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2343.498029][T26029] usb 4-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 2343.539077][T26029] usb 4-1: config 5 has 0 interfaces, different from the descriptor's value: 255 12:53:25 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x400c07) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2343.639342][T26029] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2343.659272][T26029] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2343.701849][T26029] usb 4-1: SerialNumber: syz 12:53:25 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200)=0xff03000000000000, 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2343.889168][ T9634] usb 1-1: new high-speed USB device number 72 using dummy_hcd [ 2344.159129][ T9634] usb 1-1: Using ep0 maxpacket: 8 12:53:25 executing program 5: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2344.247948][T13310] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2344.268614][T10330] usb 4-1: USB disconnect, device number 42 [ 2344.279655][ T9634] usb 1-1: config index 0 descriptor too short (expected 65316, got 36) 12:53:26 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x400c08) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2344.299458][ T9634] usb 1-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2344.336972][ T9634] usb 1-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 2344.388561][ T9634] usb 1-1: config 5 has 0 interfaces, different from the descriptor's value: 255 12:53:26 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2344.499123][ T9634] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2344.512716][ T9634] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2344.521897][ T9634] usb 1-1: SerialNumber: syz 12:53:26 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:26 executing program 5: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2344.928492][T13319] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2344.948452][T10330] usb 1-1: USB disconnect, device number 72 12:53:26 executing program 1: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f00000007c0)="30eb2297b18c0a2ada6f46f8341ce63ccdab668e820dabde", 0x41395563) ioctl$PPPIOCGIDLE(r2, 0x8010743f, &(0x7f00000001c0)) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000040)={0x98, 0x0, 0x8, 0x70bd28, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xf59}, @IPVS_CMD_ATTR_DEST={0x48, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x2}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x3}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x1}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x3c}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e22}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x3}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@empty}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}, @IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e21}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x7fffffff}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7ff80000}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80000000}]}, 0x98}, 0x1, 0x0, 0x0, 0x4}, 0x810) r3 = bpf$ITER_CREATE(0x21, &(0x7f0000000280)={r1}, 0x8) sendmsg$AUDIT_LIST_RULES(r3, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x10, 0x3f5, 0x200, 0x70bd28, 0x25dfdbff, "", ["", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x800}, 0x40800) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, r5, 0x3}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8, 0x1, 'sit\x00'}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8, 0x1, r4}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @multicast1}]}}}]}, 0x40}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000500)={'batadv_slave_1\x00', 0x0}) sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000540)={&(0x7f0000000800)={0x50c, 0x0, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [{{0x8}, {0x1b0, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x5}, {0x8}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x5}, {0x8, 0x4, 0x5}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x5}, {0x8, 0x4, 0x4}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x5}, {0x8, 0x4, 0x2}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x5}, {0x8, 0x4, 0x8}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}]}}, {{0x8}, {0xbc, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x5}, {0x8, 0x4, 0x3ec}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x5}, {0x8, 0x4, 0x6}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x5}, {0x8, 0x4, 0x4}}, {0x8}}}]}}, {{0x8, 0x1, r5}, {0x274, 0x2, 0x0, 0x1, [{0x54, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x5}, {0x24, 0x4, [{0x0, 0x29, 0x4, 0x5}, {0x4, 0xa4, 0x7}, {0x4, 0x1f, 0x20, 0x2}, {0x3ff, 0x1, 0x1f, 0x9d8}]}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x5}, {0x8, 0x4, 0xfffffbff}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x5}, {0x8, 0x4, 0xfffffffa}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x5}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r6}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}, {0x7c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x5}, {0x4c, 0x4, [{0x7fff, 0x1, 0x69, 0x9d}, {0x7fff, 0x5, 0x8, 0x1}, {0x4, 0x7f, 0x4, 0x7fff}, {0xcb8, 0x6, 0x9, 0x20}, {0x5a5, 0xff, 0x1, 0x7ff}, {0x6, 0x1f, 0x1, 0x7}, {0x7ff, 0x1, 0x0, 0x169}, {0x7ff, 0x3, 0x7, 0x101}, {0x800, 0x2, 0x7, 0xb47a}]}}}, {0x34, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x5}, {0x4}}}]}}]}, 0x50c}, 0x1, 0x0, 0x0, 0x24040094}, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0x8, 0xffffffffffffffff, 0x9) ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE(r2, 0xf504, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2345.448954][ T9634] usb 4-1: new high-speed USB device number 43 using dummy_hcd 12:53:27 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2345.708763][ T9634] usb 4-1: Using ep0 maxpacket: 8 [ 2345.992741][ T9634] usb 4-1: out of memory [ 2345.997794][ T9634] usb 4-1: can't read configurations, error -12 [ 2346.148692][ T9634] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 2346.458641][ T9634] usb 4-1: Using ep0 maxpacket: 8 [ 2346.628669][T26029] usb 2-1: new high-speed USB device number 61 using dummy_hcd [ 2346.718612][ T9634] usb 4-1: config index 0 descriptor too short (expected 65316, got 36) [ 2346.727854][ T9634] usb 4-1: config 0 has too many interfaces: 255, using maximum allowed: 32 [ 2346.738284][ T9634] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2346.749694][ T9634] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 255 [ 2346.848619][ T9634] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2346.859202][ T9634] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2346.869065][ T9634] usb 4-1: SerialNumber: syz [ 2346.874908][ T9634] usb 4-1: config 0 descriptor?? [ 2346.888620][T26029] usb 2-1: Using ep0 maxpacket: 8 [ 2346.985095][T26029] usb 2-1: out of memory [ 2346.995230][T26029] usb 2-1: can't read configurations, error -12 [ 2347.028472][T16300] usb 1-1: new high-speed USB device number 73 using dummy_hcd [ 2347.158493][T26029] usb 2-1: new high-speed USB device number 62 using dummy_hcd [ 2347.288423][T16300] usb 1-1: Using ep0 maxpacket: 8 [ 2347.514409][T13340] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2347.588473][T26029] usb 2-1: Using ep0 maxpacket: 8 [ 2347.691624][T16300] usb 1-1: out of memory [ 2347.695901][T16300] usb 1-1: can't read configurations, error -12 [ 2347.868310][T16300] usb 1-1: new high-speed USB device number 74 using dummy_hcd [ 2348.057651][T26029] usb 2-1: out of memory [ 2348.069626][T26029] usb 2-1: can't read configurations, error -12 [ 2348.089873][T26029] usb usb2-port1: attempt power cycle [ 2348.118249][T16300] usb 1-1: Using ep0 maxpacket: 8 [ 2348.613324][ T9634] usb 4-1: USB disconnect, device number 44 [ 2349.495668][T13349] systemd-udevd invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 2349.506711][T13349] CPU: 0 PID: 13349 Comm: systemd-udevd Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2349.516790][T13349] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2349.526940][T13349] Call Trace: [ 2349.530232][T13349] dump_stack+0x1b0/0x21e [ 2349.534560][T13349] ? devkmsg_release+0x11c/0x11c [ 2349.539496][T13349] ? ___ratelimit+0x3bf/0x560 [ 2349.544171][T13349] ? show_regs_print_info+0x12/0x12 [ 2349.549361][T13349] ? _raw_spin_lock+0xa1/0x170 [ 2349.554124][T13349] ? radix_tree_cpu_dead+0x160/0x160 [ 2349.559404][T13349] dump_header+0xdb/0x700 [ 2349.563734][T13349] oom_kill_process+0xd3/0x280 [ 2349.568493][T13349] out_of_memory+0x5b6/0x890 [ 2349.573088][T13349] ? unregister_oom_notifier+0x20/0x20 [ 2349.578550][T13349] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2349.584108][T13349] ? get_page_from_freelist+0x7c0/0x7c0 [ 2349.589659][T13349] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2349.595059][T13349] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2349.600609][T13349] pagecache_get_page+0x522/0x8a0 [ 2349.606072][T13349] filemap_fault+0x1435/0x1990 [ 2349.610930][T13349] ? __down_read+0xf1/0x210 [ 2349.615430][T13349] ? generic_file_read_iter+0x20a0/0x20a0 [ 2349.621169][T13349] ? ___preempt_schedule+0x16/0x20 [ 2349.626280][T13349] ext4_filemap_fault+0x7b/0x90 [ 2349.631129][T13349] handle_mm_fault+0x291e/0x4140 [ 2349.637719][T13349] ? finish_fault+0x230/0x230 [ 2349.642508][T13349] ? down_read_trylock+0x17a/0x1d0 [ 2349.647615][T13349] ? retint_kernel+0x1b/0x1b [ 2349.652230][T13349] ? vmacache_find+0x205/0x4b0 [ 2349.656992][T13349] do_user_addr_fault+0x48a/0x9f0 [ 2349.662023][T13349] page_fault+0x2f/0x40 [ 2349.666173][T13349] RIP: 0033:0x7f335d92b930 [ 2349.670592][T13349] Code: Bad RIP value. [ 2349.674674][T13349] RSP: 002b:00007ffca55b2708 EFLAGS: 00010202 [ 2349.680727][T13349] RAX: 0000000000000007 RBX: 0000000000000008 RCX: 0000000000000da8 [ 2349.688690][T13349] RDX: 0000000000002080 RSI: 000055cd61e9ed20 RDI: 0000000000000008 [ 2349.696661][T13349] RBP: 000055cd61e7ada8 R08: 000055cd6366571b R09: 0000000000000020 [ 2349.706187][T13349] R10: 0000000000000000 R11: 000055cd636656a0 R12: 000055cd61e7ada8 [ 2349.714161][T13349] R13: 0000000000000000 R14: 000055cd63670cc0 R15: 000055cd6367b380 [ 2349.722951][T13349] Mem-Info: [ 2349.726115][T13349] active_anon:1409904 inactive_anon:4736 isolated_anon:0 [ 2349.726115][T13349] active_file:71 inactive_file:90 isolated_file:37 [ 2349.726115][T13349] unevictable:0 dirty:0 writeback:0 unstable:0 [ 2349.726115][T13349] slab_reclaimable:9556 slab_unreclaimable:97513 [ 2349.726115][T13349] mapped:55750 shmem:4832 pagetables:31451 bounce:0 [ 2349.726115][T13349] free:9895 free_pcp:357 free_cma:0 [ 2349.735950][T16300] usb 1-1: device descriptor read/all, error -71 [ 2349.764871][T13349] Node 0 active_anon:5639616kB inactive_anon:18944kB active_file:284kB inactive_file:360kB unevictable:0kB isolated(anon):0kB isolated(file):20kB mapped:222800kB dirty:0kB writeback:0kB shmem:19328kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2349.792182][T16300] usb usb1-port1: attempt power cycle [ 2349.796136][T13349] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2349.827339][T13349] lowmem_reserve[]: 0 2912 6416 6416 [ 2349.832629][T13349] DMA32 free:17396kB min:4644kB low:7624kB high:10604kB active_anon:2914252kB inactive_anon:8216kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1888kB pagetables:1500kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2349.861371][T13349] lowmem_reserve[]: 0 0 3504 3504 [ 2349.866424][T13349] Normal free:7772kB min:5592kB low:9180kB high:12768kB active_anon:2725316kB inactive_anon:10728kB active_file:116kB inactive_file:240kB unevictable:0kB writepending:0kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35456kB pagetables:124304kB bounce:0kB free_pcp:404kB local_pcp:0kB free_cma:0kB [ 2349.895693][T13349] lowmem_reserve[]: 0 0 0 0 [ 2349.900222][T13349] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2349.930690][T13349] DMA32: 52*4kB (UM) 24*8kB (UH) 106*16kB (UME) 68*32kB (UME) 31*64kB (UEH) 19*128kB (UMEH) 21*256kB (UMEH) 5*512kB (UM) 1*1024kB (E) 0*2048kB 0*4096kB = 17648kB [ 2349.947324][T13349] Normal: 101*4kB (UM) 29*8kB (UM) 282*16kB (UM) 57*32kB (UME) 1*64kB (U) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 7036kB [ 2349.961744][T13349] 4987 total pagecache pages [ 2349.966305][T13349] 0 pages in swap cache [ 2349.970493][T13349] Swap cache stats: add 0, delete 0, find 0/0 [ 2349.976577][T13349] Free swap = 0kB [ 2349.980682][T13349] Total swap = 0kB [ 2349.984789][T13349] 1965979 pages RAM [ 2349.988990][T13349] 0 pages HighMem/MovableOnly [ 2349.994064][T13349] 318041 pages reserved [ 2349.998681][T13349] 0 pages cma reserved [ 2350.002982][T13349] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.5,pid=21415,uid=0 [ 2350.026354][T13349] Out of memory: Killed process 21415 (syz-executor.5) total-vm:85748kB, anon-rss:16596kB, file-rss:34496kB, shmem-rss:0kB, UID:0 pgtables:152kB oom_score_adj:1000 12:53:31 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:31 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x400c09) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:32 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ff"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:32 executing program 1: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="16010000090000082505a8a4070000000101090224ffff050074980928dc000000000019e208079d7e9376000905010200ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:32 executing program 5: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:32 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:53:32 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x400c0c) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:32 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x400c0d) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:32 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2350.587734][T28562] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 2350.595804][T10330] usb 2-1: new high-speed USB device number 64 using dummy_hcd [ 2350.609845][T16300] usb 1-1: new high-speed USB device number 75 using dummy_hcd [ 2350.697759][T16300] usb 1-1: Using ep0 maxpacket: 8 [ 2350.837700][T28562] usb 4-1: Using ep0 maxpacket: 8 12:53:32 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x400c0f) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2350.867671][T10330] usb 2-1: Using ep0 maxpacket: 8 [ 2351.061694][T16300] warn_alloc: 4 callbacks suppressed [ 2351.061705][T16300] kworker/1:1: page allocation failure: order:4, mode:0x40cc0(GFP_KERNEL|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0 [ 2351.097616][T16300] CPU: 1 PID: 16300 Comm: kworker/1:1 Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2351.108177][T16300] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2351.118243][T16300] Workqueue: usb_hub_wq hub_event [ 2351.123255][T16300] Call Trace: [ 2351.126572][T16300] dump_stack+0x1b0/0x21e [ 2351.130903][T16300] ? devkmsg_release+0x11c/0x11c [ 2351.135835][T16300] ? show_regs_print_info+0x12/0x12 [ 2351.141032][T16300] warn_alloc+0x1ee/0x340 [ 2351.145357][T16300] ? zone_watermark_ok_safe+0x420/0x420 [ 2351.150928][T16300] __alloc_pages_slowpath+0x1c98/0x1cb0 [ 2351.156466][T16300] ? process_one_work+0x777/0xf90 [ 2351.161489][T16300] ? get_page_from_freelist+0x7c0/0x7c0 [ 2351.167028][T16300] ? switch_mm+0xe0/0xe0 [ 2351.171698][T16300] ? __zone_watermark_ok+0x91/0x280 [ 2351.176918][T16300] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2351.182285][T16300] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2351.187829][T16300] ? preempt_schedule_notrace+0x110/0x110 [ 2351.193547][T16300] ? usb_anchor_empty+0x40/0x40 [ 2351.198394][T16300] ? wait_for_common+0x486/0x570 [ 2351.203581][T16300] kmalloc_order_trace+0x2a/0xf0 [ 2351.208527][T16300] __kmalloc+0x268/0x2c0 [ 2351.212762][T16300] usb_get_configuration+0x326/0x4920 [ 2351.218129][T16300] ? _raw_spin_lock_irqsave+0xda/0x1c0 [ 2351.223586][T16300] ? slab_free_freelist_hook+0xd0/0x150 [ 2351.229128][T16300] ? trace_rpm_return_int_rcuidle+0x23/0x1d0 [ 2351.235206][T16300] ? rpm_resume+0xa29/0x19b0 [ 2351.239796][T16300] ? usb_destroy_configuration+0x580/0x580 [ 2351.245600][T16300] ? _raw_spin_lock_irq+0xa2/0x180 [ 2351.250712][T16300] ? _raw_spin_lock_irqsave+0x1c0/0x1c0 [ 2351.256366][T16300] ? pm_runtime_forbid+0xa7/0xf0 [ 2351.261302][T16300] usb_new_device+0x155/0x1710 [ 2351.266063][T16300] ? hub_port_init+0x1e9e/0x30e0 [ 2351.270998][T16300] ? _raw_spin_lock_irq+0xa2/0x180 [ 2351.276107][T16300] ? usb_disconnect+0x880/0x880 [ 2351.280955][T16300] hub_event+0x2a5b/0x4d50 [ 2351.285371][T16300] ? led_work+0x530/0x530 [ 2351.289716][T16300] ? _raw_spin_unlock_irq+0x5/0x20 [ 2351.294820][T16300] ? wake_up_new_task+0x2f1/0xa90 [ 2351.299841][T16300] ? read_word_at_a_time+0xe/0x20 [ 2351.304861][T16300] ? strscpy+0xa6/0x260 [ 2351.309043][T16300] process_one_work+0x777/0xf90 [ 2351.314013][T16300] worker_thread+0xa8f/0x1430 [ 2351.318690][T16300] kthread+0x317/0x340 [ 2351.322753][T16300] ? process_one_work+0xf90/0xf90 [ 2351.327771][T16300] ? kthread_destroy_worker+0x270/0x270 [ 2351.333401][T16300] ret_from_fork+0x1f/0x30 [ 2351.352148][T16300] Mem-Info: [ 2351.360166][T16300] active_anon:1409102 inactive_anon:4735 isolated_anon:0 [ 2351.360166][T16300] active_file:107 inactive_file:266 isolated_file:64 [ 2351.360166][T16300] unevictable:0 dirty:0 writeback:0 unstable:0 [ 2351.360166][T16300] slab_reclaimable:9567 slab_unreclaimable:97379 [ 2351.360166][T16300] mapped:55780 shmem:4831 pagetables:31431 bounce:0 [ 2351.360166][T16300] free:10776 free_pcp:308 free_cma:0 [ 2351.398195][T16300] Node 0 active_anon:5636408kB inactive_anon:18940kB active_file:828kB inactive_file:628kB unevictable:0kB isolated(anon):0kB isolated(file):100kB mapped:223220kB dirty:0kB writeback:0kB shmem:19324kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2351.422365][T16300] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2351.448328][T16300] lowmem_reserve[]: 0 2912 6416 6416 [ 2351.453642][T16300] DMA32 free:17988kB min:4644kB low:7624kB high:10604kB active_anon:2914216kB inactive_anon:8212kB active_file:40kB inactive_file:60kB unevictable:0kB writepending:12kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1728kB pagetables:1392kB bounce:0kB free_pcp:240kB local_pcp:24kB free_cma:0kB [ 2351.490595][T16300] lowmem_reserve[]: 0 0 3504 3504 [ 2351.495669][T16300] Normal free:9716kB min:5592kB low:9180kB high:12768kB active_anon:2722124kB inactive_anon:10728kB active_file:828kB inactive_file:556kB unevictable:0kB writepending:312kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35520kB pagetables:124332kB bounce:0kB free_pcp:1532kB local_pcp:96kB free_cma:0kB [ 2351.525311][T16300] lowmem_reserve[]: 0 0 0 0 [ 2351.529845][T16300] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2351.543195][T16300] DMA32: 142*4kB (UME) 36*8kB (UMEH) 108*16kB (UM) 89*32kB (UMEH) 32*64kB (UEH) 14*128kB (UMEH) 21*256kB (UMEH) 5*512kB (UM) 1*1024kB (E) 0*2048kB 0*4096kB = 18232kB [ 2351.559757][T16300] Normal: 432*4kB (UME) 178*8kB (UM) 261*16kB (UME) 70*32kB (UMEH) 3*64kB (M) 1*128kB (U) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 9888kB [ 2351.574203][T16300] 4945 total pagecache pages [ 2351.579001][T16300] 0 pages in swap cache [ 2351.583156][T16300] Swap cache stats: add 0, delete 0, find 0/0 [ 2351.589229][T16300] Free swap = 0kB [ 2351.592935][T16300] Total swap = 0kB [ 2351.596813][T16300] 1965979 pages RAM [ 2351.610271][T16300] 0 pages HighMem/MovableOnly [ 2351.614989][T16300] 318041 pages reserved [ 2351.620162][T16300] 0 pages cma reserved [ 2351.624253][T16300] usb 1-1: out of memory [ 2351.628522][T16300] usb 1-1: can't read configurations, error -12 [ 2351.657510][T28562] usb 4-1: config index 0 descriptor too short (expected 65316, got 36) [ 2351.665865][T28562] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2351.697459][T28562] usb 4-1: config 0 has no interfaces? [ 2351.748921][ T362] syz-executor.2 invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 2351.777447][T16300] usb 1-1: new high-speed USB device number 76 using dummy_hcd [ 2351.779121][ T362] CPU: 0 PID: 362 Comm: syz-executor.2 Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2351.794978][ T362] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2351.805193][ T362] Call Trace: [ 2351.808481][ T362] dump_stack+0x1b0/0x21e [ 2351.812806][ T362] ? devkmsg_release+0x11c/0x11c [ 2351.817733][ T362] ? ___ratelimit+0x3bf/0x560 [ 2351.822399][ T362] ? show_regs_print_info+0x12/0x12 [ 2351.827586][ T362] ? _raw_spin_lock+0xa1/0x170 [ 2351.832343][ T362] ? radix_tree_cpu_dead+0x160/0x160 [ 2351.837624][ T362] dump_header+0xdb/0x700 [ 2351.842049][ T362] oom_kill_process+0xd3/0x280 [ 2351.846802][ T362] out_of_memory+0x5b6/0x890 [ 2351.851391][ T362] ? unregister_oom_notifier+0x20/0x20 [ 2351.856844][ T362] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2351.862388][ T362] ? get_page_from_freelist+0x7c0/0x7c0 [ 2351.867928][ T362] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2351.873291][ T362] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2351.878826][ T362] ? file_remove_privs+0x600/0x600 [ 2351.883926][ T362] wp_page_copy+0x1d4/0x15a0 [ 2351.888507][ T362] ? add_mm_rss_vec+0x270/0x270 [ 2351.893346][ T362] do_wp_page+0x657/0x14b0 [ 2351.897756][ T362] ? _raw_spin_lock+0xa1/0x170 [ 2351.902509][ T362] ? do_swap_page+0x1510/0x1510 [ 2351.907350][ T362] ? iov_iter_init+0x83/0x160 [ 2351.912023][ T362] handle_mm_fault+0xf6c/0x4140 [ 2351.916865][ T362] ? finish_fault+0x230/0x230 [ 2351.921533][ T362] ? __fsnotify_parent+0x300/0x300 [ 2351.926639][ T362] ? down_read_trylock+0x17a/0x1d0 [ 2351.931751][ T362] ? vmacache_find+0x205/0x4b0 [ 2351.936506][ T362] do_user_addr_fault+0x48a/0x9f0 [ 2351.941517][ T362] page_fault+0x2f/0x40 [ 2351.945659][ T362] RIP: 0033:0x4032d5 [ 2351.949577][ T362] Code: b4 24 a0 00 00 00 bf 2f 29 4c 00 31 c0 e8 93 fd ff ff 0f 1f 00 4c 89 e6 bf ba 28 4c 00 e8 a3 ea ff ff be 02 00 00 00 4c 89 e7 a6 d5 05 00 85 c0 74 e2 e9 84 fe ff ff 0f 1f 44 00 00 48 8d b4 [ 2351.969167][ T362] RSP: 002b:00007ffd71431e50 EFLAGS: 00010246 [ 2351.975247][ T362] RAX: 0000000000000000 RBX: 000000000023e155 RCX: 00000000004176d0 [ 2351.983206][ T362] RDX: 000000000000000c RSI: 0000000000000002 RDI: 00007ffd71432f80 [ 2351.991167][ T362] RBP: 0000000000003e7f R08: 0000000000000001 R09: 000000000238a940 [ 2351.999128][ T362] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd71432f80 [ 2352.007092][ T362] R13: 00007ffd71432f70 R14: 0000000000000000 R15: 00007ffd71432f80 [ 2352.016152][T28562] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2352.030432][T28562] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2352.038465][T28562] usb 4-1: SerialNumber: syz [ 2352.043487][ T362] Mem-Info: [ 2352.046824][T28562] usb 4-1: config 0 descriptor?? [ 2352.051804][ T362] active_anon:1409092 inactive_anon:4735 isolated_anon:0 [ 2352.051804][ T362] active_file:18 inactive_file:262 isolated_file:32 [ 2352.051804][ T362] unevictable:0 dirty:3 writeback:0 unstable:0 [ 2352.051804][ T362] slab_reclaimable:9568 slab_unreclaimable:97367 [ 2352.051804][ T362] mapped:55763 shmem:4831 pagetables:31439 bounce:0 [ 2352.051804][ T362] free:10978 free_pcp:290 free_cma:0 [ 2352.089939][ T362] Node 0 active_anon:5636368kB inactive_anon:18940kB active_file:328kB inactive_file:308kB unevictable:0kB isolated(anon):0kB isolated(file):128kB mapped:222952kB dirty:12kB writeback:0kB shmem:19324kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2352.114828][ T362] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2352.117427][T16300] usb 1-1: Using ep0 maxpacket: 8 [ 2352.141274][ T362] lowmem_reserve[]: 0 2912 6416 6416 [ 2352.151962][ T362] DMA32 free:18256kB min:4644kB low:7624kB high:10604kB active_anon:2914216kB inactive_anon:8212kB active_file:8kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1728kB pagetables:1400kB bounce:0kB free_pcp:248kB local_pcp:0kB free_cma:0kB [ 2352.181839][ T362] lowmem_reserve[]: 0 0 3504 3504 [ 2352.186886][ T362] Normal free:11056kB min:9688kB low:13276kB high:16864kB active_anon:2722152kB inactive_anon:10728kB active_file:392kB inactive_file:368kB unevictable:0kB writepending:0kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35520kB pagetables:124356kB bounce:0kB free_pcp:320kB local_pcp:248kB free_cma:0kB [ 2352.217430][ T362] lowmem_reserve[]: 0 0 0 0 [ 2352.222247][ T362] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2352.235966][ T362] DMA32: 199*4kB (UME) 37*8kB (UMEH) 108*16kB (UM) 89*32kB (UMEH) 32*64kB (UEH) 14*128kB (UMEH) 21*256kB (UMEH) 5*512kB (UM) 1*1024kB (E) 0*2048kB 0*4096kB = 18468kB [ 2352.252851][ T362] Normal: 322*4kB (M) 235*8kB (UME) 291*16kB (UME) 73*32kB (UMEH) 1*64kB (M) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 10224kB [ 2352.267189][ T362] 4912 total pagecache pages [ 2352.271887][T10330] usb 2-1: config index 0 descriptor too short (expected 65316, got 36) [ 2352.280227][T10330] usb 2-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2352.288908][T10330] usb 2-1: config 5 has an invalid descriptor of length 226, skipping remainder of the config [ 2352.299571][T10330] usb 2-1: config 5 has 0 interfaces, different from the descriptor's value: 255 [ 2352.308815][ T362] 0 pages in swap cache [ 2352.312980][ T362] Swap cache stats: add 0, delete 0, find 0/0 [ 2352.317394][T16300] usb 1-1: config index 0 descriptor too short (expected 65316, got 36) [ 2352.319062][ T362] Free swap = 0kB [ 2352.327686][T16300] usb 1-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2352.340291][T16300] usb 1-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 2352.350794][T16300] usb 1-1: config 5 has 0 interfaces, different from the descriptor's value: 255 [ 2352.367328][ T362] Total swap = 0kB [ 2352.371289][ T362] 1965979 pages RAM [ 2352.375283][ T362] 0 pages HighMem/MovableOnly [ 2352.380269][ T362] 318041 pages reserved [ 2352.384821][ T362] 0 pages cma reserved [ 2352.387378][T10330] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2352.389536][ T362] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.3,pid=3808,uid=0 [ 2352.412856][T10330] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2352.417838][ T362] Out of memory: Killed process 3808 (syz-executor.3) total-vm:85748kB, anon-rss:16588kB, file-rss:34496kB, shmem-rss:0kB, UID:0 pgtables:156kB oom_score_adj:1000 [ 2352.437309][T10330] usb 2-1: SerialNumber: syz [ 2352.447500][T16300] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2352.460225][T16300] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2352.468698][T16300] usb 1-1: SerialNumber: syz [ 2352.480076][T13365] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2352.489065][T28562] usb 4-1: USB disconnect, device number 45 12:53:33 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:53:34 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="0003"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2353.116590][T13403] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2353.415628][T13411] fuse: Bad value for 'fd' [ 2353.447911][T13358] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2353.474649][T28562] usb 1-1: USB disconnect, device number 76 12:53:35 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:35 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="0003"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:53:35 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:53:35 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:35 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x400c10) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2354.135151][T10330] usb 2-1: USB disconnect, device number 64 [ 2354.328926][T13423] systemd-udevd invoked oom-killer: gfp_mask=0x40cc0(GFP_KERNEL|__GFP_COMP), order=1, oom_score_adj=0 [ 2354.385075][T13423] CPU: 0 PID: 13423 Comm: systemd-udevd Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2354.395965][T13423] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2354.405998][T13423] Call Trace: [ 2354.409271][T13423] dump_stack+0x1b0/0x21e [ 2354.413588][T13423] ? devkmsg_release+0x11c/0x11c [ 2354.418495][T13423] ? ___ratelimit+0x3bf/0x560 [ 2354.423228][T13423] ? show_regs_print_info+0x12/0x12 [ 2354.428394][T13423] ? _raw_spin_lock+0xa1/0x170 [ 2354.433132][T13423] ? radix_tree_cpu_dead+0x160/0x160 [ 2354.438602][T13423] dump_header+0xdb/0x700 [ 2354.443011][T13423] oom_kill_process+0xd3/0x280 [ 2354.447927][T13423] out_of_memory+0x5b6/0x890 [ 2354.452493][T13423] ? unregister_oom_notifier+0x20/0x20 [ 2354.458037][T13423] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2354.463560][T13423] ? get_page_from_freelist+0x7c0/0x7c0 [ 2354.469079][T13423] ? __zone_watermark_ok+0x91/0x280 [ 2354.474249][T13423] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2354.479971][T13423] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2354.485489][T13423] ? __secure_computing+0x250/0x250 [ 2354.490687][T13423] ? locks_remove_file+0x397/0x10e0 [ 2354.495875][T13423] alloc_slab_page+0x3a/0x390 [ 2354.500532][T13423] new_slab+0x408/0x450 [ 2354.504665][T13423] ? getname_flags+0xb8/0x610 [ 2354.509319][T13423] ___slab_alloc+0x2e0/0x450 [ 2354.513880][T13423] ? finish_fault+0x230/0x230 [ 2354.518537][T13423] ? getname_flags+0xb8/0x610 [ 2354.523192][T13423] ? getname_flags+0xb8/0x610 [ 2354.527837][T13423] kmem_cache_alloc+0x230/0x250 [ 2354.532658][T13423] ? __secure_computing+0x1b6/0x250 [ 2354.537826][T13423] getname_flags+0xb8/0x610 [ 2354.542299][T13423] do_sys_open+0x2fc/0x620 [ 2354.546690][T13423] ? file_open_root+0x440/0x440 [ 2354.551512][T13423] ? do_user_addr_fault+0x55c/0x9f0 [ 2354.556677][T13423] do_syscall_64+0xcb/0x150 [ 2354.561151][T13423] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2354.567014][T13423] RIP: 0033:0x7f335d9e76f0 [ 2354.571399][T13423] Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 83 3d 19 30 2c 00 00 75 10 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 fe 9d 01 00 48 89 04 24 [ 2354.591073][T13423] RSP: 002b:00007ffca55b6bb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 2354.599477][T13423] RAX: ffffffffffffffda RBX: 000055cd63662890 RCX: 00007f335d9e76f0 [ 2354.607427][T13423] RDX: 00000000000001b6 RSI: 0000000000080000 RDI: 00007ffca55b6d60 [ 2354.615378][T13423] RBP: 0000000000000008 R08: 0000000000000008 R09: 0000000000000001 [ 2354.623319][T13423] R10: 0000000000080000 R11: 0000000000000246 R12: 000055cd61e7a68a [ 2354.631263][T13423] R13: 0000000000000001 R14: 0000000000000003 R15: 00007ffca55b6dc0 [ 2354.639690][T28562] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 2354.695019][T13423] Mem-Info: [ 2354.698601][T13423] active_anon:1406848 inactive_anon:4735 isolated_anon:0 [ 2354.698601][T13423] active_file:290 inactive_file:595 isolated_file:70 [ 2354.698601][T13423] unevictable:0 dirty:19 writeback:1 unstable:0 [ 2354.698601][T13423] slab_reclaimable:9577 slab_unreclaimable:97768 [ 2354.698601][T13423] mapped:56217 shmem:4832 pagetables:31460 bounce:0 [ 2354.698601][T13423] free:11848 free_pcp:540 free_cma:0 [ 2354.737093][T13423] Node 0 active_anon:5627392kB inactive_anon:18940kB active_file:1160kB inactive_file:2360kB unevictable:0kB isolated(anon):0kB isolated(file):152kB mapped:224868kB dirty:76kB writeback:4kB shmem:19328kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2354.762611][T13423] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2354.789442][T13423] lowmem_reserve[]: 0 2912 6416 6416 [ 2354.795133][T13423] DMA32 free:18224kB min:4644kB low:7624kB high:10604kB active_anon:2914220kB inactive_anon:8212kB active_file:4kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1728kB pagetables:1400kB bounce:0kB free_pcp:516kB local_pcp:516kB free_cma:0kB [ 2354.836301][T13423] lowmem_reserve[]: 0 0 3504 3504 [ 2354.842852][T13423] Normal free:14200kB min:5592kB low:9180kB high:12768kB active_anon:2713132kB inactive_anon:10728kB active_file:1064kB inactive_file:2604kB unevictable:0kB writepending:180kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35552kB pagetables:124440kB bounce:0kB free_pcp:384kB local_pcp:336kB free_cma:0kB [ 2354.881402][T13423] lowmem_reserve[]: 0 0 0 0 12:53:36 executing program 1: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r1, 0x407, 0x0) write(r1, &(0x7f00000007c0)="30eb2297b18c0a2ada6f46f8341ce63ccdab668e820dabde", 0x41395563) ioctl$TIOCGLCKTRMIOS(r1, 0x5456, &(0x7f0000000000)={0x7, 0x9, 0x9, 0x7f, 0xb, "f91b6c6fbf7e0702eb4e3c23ee8e666b9e9b0c"}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000003, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:36 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="0003"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:53:36 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="00ff"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2354.891922][T13423] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2354.908393][T13423] DMA32: 210*4kB (UME) 51*8kB (UMEH) 109*16kB (UM) 96*32kB (UMEH) 34*64kB (UMEH) 14*128kB (UMEH) 21*256kB (UMEH) 5*512kB (UM) 1*1024kB (E) 0*2048kB 0*4096kB = 18992kB [ 2354.928621][T13423] Normal: 4*4kB (ME) 2*8kB (ME) 226*16kB (UME) 50*32kB (UMEH) 18*64kB (ME) 6*128kB (M) 3*256kB (M) 1*512kB (M) 0*1024kB 0*2048kB 0*4096kB = 8448kB [ 2354.946750][T28562] usb 4-1: Using ep0 maxpacket: 8 [ 2354.997613][T13423] 6832 total pagecache pages [ 2355.002421][T13423] 0 pages in swap cache [ 2355.027703][T13423] Swap cache stats: add 0, delete 0, find 0/0 [ 2355.046720][T13423] Free swap = 0kB [ 2355.050456][T13423] Total swap = 0kB [ 2355.054159][T13423] 1965979 pages RAM [ 2355.076715][T13423] 0 pages HighMem/MovableOnly [ 2355.081480][T13423] 318041 pages reserved [ 2355.085708][T13423] 0 pages cma reserved [ 2355.091783][T13423] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.3,pid=23368,uid=0 [ 2355.096815][T28562] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2355.107360][T13423] Out of memory: Killed process 23368 (syz-executor.3) total-vm:85484kB, anon-rss:16576kB, file-rss:34496kB, shmem-rss:0kB, UID:0 pgtables:156kB oom_score_adj:1000 [ 2355.135824][T28562] usb 4-1: config 0 has no interfaces? [ 2355.176827][T16300] usb 1-1: new high-speed USB device number 77 using dummy_hcd [ 2355.246775][T28562] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2355.256491][T28562] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2355.266303][T28562] usb 4-1: SerialNumber: syz [ 2355.274560][T28562] usb 4-1: config 0 descriptor?? [ 2355.455621][T30413] syz-executor.4 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=0 [ 2355.630966][T30413] CPU: 0 PID: 30413 Comm: syz-executor.4 Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2355.641127][T30413] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2355.651158][T30413] Call Trace: [ 2355.654441][T30413] dump_stack+0x1b0/0x21e [ 2355.658742][T30413] ? devkmsg_release+0x11c/0x11c [ 2355.663658][T30413] ? ___ratelimit+0x3bf/0x560 [ 2355.668301][T30413] ? show_regs_print_info+0x12/0x12 [ 2355.673465][T30413] ? _raw_spin_lock+0xa1/0x170 [ 2355.678207][T30413] ? radix_tree_cpu_dead+0x160/0x160 [ 2355.683459][T30413] dump_header+0xdb/0x700 [ 2355.687769][T30413] oom_kill_process+0xd3/0x280 [ 2355.692499][T30413] out_of_memory+0x5b6/0x890 [ 2355.697071][T30413] ? unregister_oom_notifier+0x20/0x20 [ 2355.702498][T30413] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2355.708017][T30413] ? get_page_from_freelist+0x7c0/0x7c0 [ 2355.713530][T30413] ? __kernel_text_address+0x93/0x110 [ 2355.718869][T30413] ? __zone_watermark_ok+0x91/0x280 [ 2355.724036][T30413] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2355.729377][T30413] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2355.734890][T30413] ? __kasan_kmalloc+0x117/0x1b0 [ 2355.739806][T30413] ? kmem_cache_alloc+0x1d5/0x250 [ 2355.744796][T30413] ? _raw_spin_lock+0xa1/0x170 [ 2355.749526][T30413] pte_alloc_one+0x1b/0xb0 [ 2355.753908][T30413] __pte_alloc+0x1d/0x1d0 [ 2355.758206][T30413] copy_page_range+0x1432/0x16f0 [ 2355.763113][T30413] ? print_bad_pte+0x530/0x530 [ 2355.767844][T30413] ? init_admin_reserve+0xc0/0xc0 [ 2355.772832][T30413] ? vma_gap_callbacks_rotate+0x203/0x210 [ 2355.778522][T30413] dup_mmap+0x873/0xc10 [ 2355.782645][T30413] ? __delayed_free_task+0x20/0x20 [ 2355.787724][T30413] ? mm_init+0x5c6/0x720 [ 2355.792126][T30413] dup_mm+0x98/0x300 [ 2355.795988][T30413] copy_process+0x20df/0x52f0 [ 2355.800651][T30413] ? do_swap_page+0x1510/0x1510 [ 2355.805466][T30413] ? fork_idle+0x290/0x290 [ 2355.809849][T30413] ? handle_mm_fault+0x916/0x4140 [ 2355.814849][T30413] _do_fork+0x180/0x8f0 [ 2355.819012][T30413] ? finish_fault+0x230/0x230 [ 2355.823657][T30413] ? __fsnotify_parent+0x300/0x300 [ 2355.828734][T30413] ? dup_mm+0x300/0x300 [ 2355.832856][T30413] ? _copy_to_user+0x8e/0xb0 [ 2355.837412][T30413] ? put_timespec64+0x106/0x150 [ 2355.842229][T30413] ? ktime_get_raw+0x130/0x130 [ 2355.846970][T30413] __x64_sys_clone+0x246/0x2b0 [ 2355.851702][T30413] ? __ia32_sys_vfork+0x110/0x110 [ 2355.856700][T30413] ? do_user_addr_fault+0x55c/0x9f0 [ 2355.861883][T30413] do_syscall_64+0xcb/0x150 [ 2355.866352][T30413] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2355.872220][T30413] RIP: 0033:0x45c42a [ 2355.876097][T30413] Code: Bad RIP value. [ 2355.880142][T30413] RSP: 002b:00007ffffdaeb720 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 2355.888565][T30413] RAX: ffffffffffffffda RBX: 00007ffffdaeb720 RCX: 000000000045c42a [ 2355.896510][T30413] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 2355.904450][T30413] RBP: 00007ffffdaeb760 R08: 0000000000000001 R09: 00000000026e8940 [ 2355.912391][T30413] R10: 00000000026e8c10 R11: 0000000000000246 R12: 0000000000000001 [ 2355.920417][T30413] R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffffdaeb7b0 [ 2355.928458][T26029] usb 2-1: new high-speed USB device number 65 using dummy_hcd [ 2355.943858][T30413] Mem-Info: [ 2355.947013][T30413] active_anon:1407766 inactive_anon:4735 isolated_anon:0 [ 2355.947013][T30413] active_file:14 inactive_file:53 isolated_file:27 [ 2355.947013][T30413] unevictable:0 dirty:29 writeback:0 unstable:0 [ 2355.947013][T30413] slab_reclaimable:9577 slab_unreclaimable:97930 [ 2355.947013][T30413] mapped:55645 shmem:4831 pagetables:31437 bounce:0 [ 2355.947013][T30413] free:11817 free_pcp:50 free_cma:0 [ 2355.976550][T16300] usb 1-1: Using ep0 maxpacket: 8 [ 2355.985055][T30413] Node 0 active_anon:5631064kB inactive_anon:18940kB active_file:56kB inactive_file:512kB unevictable:0kB isolated(anon):0kB isolated(file):108kB mapped:222680kB dirty:116kB writeback:0kB shmem:19324kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2356.013971][T30413] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2356.039937][T30413] lowmem_reserve[]: 0 2912 6416 6416 [ 2356.045260][T30413] DMA32 free:17736kB min:4644kB low:7624kB high:10604kB active_anon:2915720kB inactive_anon:8212kB active_file:4kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1728kB pagetables:1404kB bounce:0kB free_pcp:4kB local_pcp:4kB free_cma:0kB [ 2356.130165][T30413] lowmem_reserve[]: 0 0 3504 3504 [ 2356.135279][T30413] Normal free:7036kB min:9688kB low:13276kB high:16864kB active_anon:2719828kB inactive_anon:10728kB active_file:540kB inactive_file:640kB unevictable:0kB writepending:0kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35840kB pagetables:124444kB bounce:0kB free_pcp:924kB local_pcp:500kB free_cma:0kB [ 2356.164859][T30413] lowmem_reserve[]: 0 0 0 0 [ 2356.169451][T30413] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2356.182814][T30413] DMA32: 40*4kB (UME) 54*8kB (UMEH) 107*16kB (UM) 110*32kB (UMEH) 36*64kB (UMEH) 12*128kB (UEH) 14*256kB (UMEH) 5*512kB (UM) 1*1024kB (E) 0*2048kB 0*4096kB = 16832kB [ 2356.208360][T30413] Normal: 63*4kB (UE) 17*8kB (UME) 233*16kB (UME) 11*32kB (MEH) 8*64kB (ME) 3*128kB (MH) 3*256kB (MH) 3*512kB (MH) 0*1024kB 0*2048kB 0*4096kB = 7668kB [ 2356.233190][T30413] 5051 total pagecache pages [ 2356.246255][T30413] 0 pages in swap cache [ 2356.246546][T26029] usb 2-1: Using ep0 maxpacket: 8 [ 2356.266500][T30413] Swap cache stats: add 0, delete 0, find 0/0 [ 2356.272579][T30413] Free swap = 0kB [ 2356.276370][T30413] Total swap = 0kB [ 2356.296474][T30413] 1965979 pages RAM [ 2356.300296][T30413] 0 pages HighMem/MovableOnly [ 2356.304949][T30413] 318041 pages reserved [ 2356.316712][T30413] 0 pages cma reserved [ 2356.320921][T30413] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.2,pid=12975,uid=0 [ 2356.335693][T30413] Out of memory: Killed process 12975 (syz-executor.2) total-vm:85484kB, anon-rss:16244kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:164kB oom_score_adj:1000 12:53:37 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x400c12) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2356.516994][T16300] usb 1-1: config index 0 descriptor too short (expected 65316, got 36) [ 2356.525524][T16300] usb 1-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2356.536786][T26029] usb 2-1: config index 0 descriptor too short (expected 65316, got 36) [ 2356.545234][T26029] usb 2-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2356.562380][T13417] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2356.573031][T16300] usb 1-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 2356.576763][T28562] usb 4-1: USB disconnect, device number 46 [ 2356.583314][T26029] usb 2-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2356.636174][T16300] usb 1-1: config 5 has 0 interfaces, different from the descriptor's value: 255 [ 2356.647170][T26029] usb 2-1: config 5 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 [ 2356.660621][T26029] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2356.671997][T26029] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 65 [ 2356.683365][T26029] usb 2-1: config 5 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 2356.736780][T16300] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2356.757237][T16300] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2356.775238][T16300] usb 1-1: SerialNumber: syz [ 2356.786446][T26029] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2356.797160][T26029] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2356.806390][T26029] usb 2-1: SerialNumber: syz [ 2356.836426][T13442] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2356.843458][T13442] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2356.866893][T26029] hub 2-1:5.0: bad descriptor, ignoring hub [ 2356.872850][T26029] hub: probe of 2-1:5.0 failed with error -5 12:53:38 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x400c8c) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:38 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:53:38 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2357.053065][T13437] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2357.063317][T28248] usb 1-1: USB disconnect, device number 77 [ 2357.073566][T13442] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2357.085194][T13442] raw-gadget gadget: fail, usb_ep_enable returned -22 12:53:38 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="00ff"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2357.782229][T10330] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 2358.350668][ T358] syz-executor.0 invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 2358.361767][ T358] CPU: 1 PID: 358 Comm: syz-executor.0 Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2358.371719][ T358] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2358.381746][ T358] Call Trace: [ 2358.385010][ T358] dump_stack+0x1b0/0x21e [ 2358.389306][ T358] ? devkmsg_release+0x11c/0x11c [ 2358.394215][ T358] ? ___ratelimit+0x3bf/0x560 [ 2358.398865][ T358] ? show_regs_print_info+0x12/0x12 [ 2358.404045][ T358] ? _raw_spin_lock+0xa1/0x170 [ 2358.408912][ T358] ? radix_tree_cpu_dead+0x160/0x160 [ 2358.414184][ T358] dump_header+0xdb/0x700 [ 2358.418505][ T358] oom_kill_process+0xd3/0x280 [ 2358.423262][ T358] out_of_memory+0x5b6/0x890 [ 2358.427821][ T358] ? unregister_oom_notifier+0x20/0x20 [ 2358.433609][ T358] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2358.439138][ T358] ? get_page_from_freelist+0x7c0/0x7c0 [ 2358.444663][ T358] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2358.450021][ T358] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2358.455552][ T358] pagecache_get_page+0x522/0x8a0 [ 2358.460565][ T358] filemap_fault+0x1435/0x1990 [ 2358.465321][ T358] ? __down_read+0xf1/0x210 [ 2358.469812][ T358] ? generic_file_read_iter+0x20a0/0x20a0 [ 2358.475514][ T358] ext4_filemap_fault+0x7b/0x90 [ 2358.480438][ T358] handle_mm_fault+0x291e/0x4140 [ 2358.485345][ T358] ? finish_fault+0x230/0x230 [ 2358.489992][ T358] ? get_timespec64+0x108/0x1c0 [ 2358.494840][ T358] ? down_read_trylock+0x17a/0x1d0 [ 2358.499942][ T358] ? __x64_sys_nanosleep+0x60/0x60 [ 2358.505028][ T358] ? vmacache_find+0x205/0x4b0 [ 2358.509781][ T358] do_user_addr_fault+0x48a/0x9f0 [ 2358.514780][ T358] page_fault+0x2f/0x40 [ 2358.518919][ T358] RIP: 0033:0x45c300 [ 2358.522903][ T358] Code: Bad RIP value. [ 2358.527128][ T358] RSP: 002b:00007fff64bdd128 EFLAGS: 00010246 [ 2358.533160][ T358] RAX: 0000000000000000 RBX: 000000000023fa70 RCX: 000000000045c300 [ 2358.541130][ T358] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007fff64bdd130 [ 2358.549348][ T358] RBP: 0000000000004167 R08: 0000000000000001 R09: 000000000259b940 [ 2358.557392][ T358] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 2358.565356][ T358] R13: 00007fff64bdd180 R14: 000000000023f0cd R15: 00007fff64bdd190 [ 2358.581018][ T358] Mem-Info: [ 2358.584284][ T358] active_anon:1410138 inactive_anon:4736 isolated_anon:0 [ 2358.584284][ T358] active_file:35 inactive_file:28 isolated_file:0 [ 2358.584284][ T358] unevictable:0 dirty:1 writeback:1 unstable:0 [ 2358.584284][ T358] slab_reclaimable:9583 slab_unreclaimable:97699 [ 2358.584284][ T358] mapped:55640 shmem:4833 pagetables:31447 bounce:0 [ 2358.584284][ T358] free:9915 free_pcp:209 free_cma:0 [ 2358.621958][ T358] Node 0 active_anon:5640552kB inactive_anon:18944kB active_file:140kB inactive_file:312kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:222660kB dirty:4kB writeback:4kB shmem:19332kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2358.646339][ T358] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2358.672313][ T358] lowmem_reserve[]: 0 2912 6416 6416 [ 2358.677615][ T358] DMA32 free:16948kB min:4644kB low:7624kB high:10604kB active_anon:2914468kB inactive_anon:8220kB active_file:36kB inactive_file:76kB unevictable:0kB writepending:4kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:2112kB pagetables:1756kB bounce:0kB free_pcp:496kB local_pcp:496kB free_cma:0kB [ 2358.706704][ T358] lowmem_reserve[]: 0 0 3504 3504 [ 2358.711874][ T358] Normal free:6304kB min:24744kB low:28332kB high:31920kB active_anon:2724796kB inactive_anon:10724kB active_file:104kB inactive_file:140kB unevictable:0kB writepending:4kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35392kB pagetables:124032kB bounce:0kB free_pcp:612kB local_pcp:92kB free_cma:0kB [ 2358.741408][ T358] lowmem_reserve[]: 0 0 0 0 [ 2358.746151][ T358] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2358.759474][ T358] DMA32: 0*4kB 33*8kB (UMEH) 97*16kB (U) 29*32kB (UME) 52*64kB (UEH) 19*128kB (UMEH) 16*256kB (UMEH) 6*512kB (UM) 1*1024kB (E) 0*2048kB 0*4096kB = 16696kB [ 2358.775230][ T358] Normal: 116*4kB (UH) 39*8kB (U) 226*16kB (UE) 54*32kB (UEH) 2*64kB (UE) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 6248kB [ 2358.789013][ T358] 4922 total pagecache pages [ 2358.793593][ T358] 0 pages in swap cache [ 2358.797755][ T358] Swap cache stats: add 0, delete 0, find 0/0 [ 2358.803902][ T358] Free swap = 0kB [ 2358.807634][ T358] Total swap = 0kB [ 2358.811339][ T358] 1965979 pages RAM [ 2358.815125][ T358] 0 pages HighMem/MovableOnly [ 2358.819800][ T358] 318041 pages reserved [ 2358.823941][ T358] 0 pages cma reserved [ 2358.828114][ T358] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.0,pid=3765,uid=0 [ 2358.842127][ T358] Out of memory: Killed process 3765 (syz-executor.0) total-vm:85484kB, anon-rss:16208kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:160kB oom_score_adj:1000 12:53:40 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:40 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x400c8d) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2358.966962][T13487] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2359.118699][T13481] fuse: Bad value for 'fd' 12:53:40 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2359.185851][T10330] usb 4-1: Using ep0 maxpacket: 8 12:53:40 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="00ff"]) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2359.315994][T10330] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2359.331004][T10330] usb 4-1: config 0 has no interfaces? [ 2359.425898][T10330] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2359.435263][T10330] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2359.446009][T10330] usb 4-1: SerialNumber: syz [ 2359.453563][T10330] usb 4-1: config 0 descriptor?? [ 2359.515797][T28562] usb 1-1: new high-speed USB device number 78 using dummy_hcd 12:53:41 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:53:41 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2359.638816][T26029] usblp 2-1:5.0: usblp0: USB Bidirectional printer dev 65 if 0 alt 0 proto 3 vid 0x0525 pid 0xA4A8 12:53:41 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x400c8e) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:41 executing program 1: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) r1 = syz_mount_image$fuse(&(0x7f0000000000)='fuse\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x2000}, 0x2c, {'user_id', 0x3d, 0xee00}, 0x2c, {'group_id', 0x3d, 0xee00}, 0x2c, {[{@allow_other='allow_other'}], [{@euid_lt={'euid<'}}, {@subj_role={'subj_role', 0x3d, '{'}}, {@rootcontext={'rootcontext', 0x3d, 'sysadm_u'}}]}}) fsetxattr$trusted_overlay_opaque(r1, &(0x7f0000000080)='trusted.overlay.opaque\x00', &(0x7f00000000c0)='y\x00', 0x2, 0x3) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2359.686512][T26029] usb 2-1: USB disconnect, device number 65 [ 2359.707817][T13474] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2359.726986][T26029] usblp0: removed [ 2359.749162][ T9634] usb 4-1: USB disconnect, device number 47 [ 2359.755729][T28562] usb 1-1: Using ep0 maxpacket: 8 [ 2359.875769][T28562] usb 1-1: config index 0 descriptor too short (expected 65316, got 36) 12:53:41 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x400c8f) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:41 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2359.961534][T13533] fuse: Bad value for 'fd' [ 2359.967082][T28562] usb 1-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2359.979272][T28562] usb 1-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 2359.989761][T28562] usb 1-1: config 5 has 0 interfaces, different from the descriptor's value: 255 [ 2360.086054][T28562] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2360.108260][T28562] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2360.134627][T28562] usb 1-1: SerialNumber: syz [ 2360.215643][T26029] usb 2-1: new high-speed USB device number 66 using dummy_hcd 12:53:42 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:53:42 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2360.450604][T13498] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2360.475718][T26029] usb 2-1: Using ep0 maxpacket: 8 [ 2360.481762][ T9634] usb 1-1: USB disconnect, device number 78 [ 2360.595731][T26029] usb 2-1: config index 0 descriptor too short (expected 65316, got 36) [ 2360.604648][T26029] usb 2-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2360.626636][T26029] usb 2-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2360.636170][T26029] usb 2-1: config 5 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 [ 2360.647435][T26029] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2360.657636][T26029] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 65 [ 2360.667839][T26029] usb 2-1: config 5 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 2360.755607][T26029] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2360.765177][T26029] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2360.774015][T26029] usb 2-1: SerialNumber: syz [ 2360.796163][T13520] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2360.809007][T13520] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2360.835592][T28248] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 2360.916138][ T144] systemd-udevd invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=-1000 [ 2360.928281][T26029] hub 2-1:5.0: bad descriptor, ignoring hub [ 2360.934518][T26029] hub: probe of 2-1:5.0 failed with error -5 [ 2360.955755][ T144] CPU: 1 PID: 144 Comm: systemd-udevd Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2360.965653][ T144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2360.975718][ T144] Call Trace: [ 2360.979000][ T144] dump_stack+0x1b0/0x21e [ 2360.983314][ T144] ? devkmsg_release+0x11c/0x11c [ 2360.988234][ T144] ? ___ratelimit+0x3bf/0x560 [ 2360.995502][ T144] ? show_regs_print_info+0x12/0x12 [ 2361.000683][ T144] ? _raw_spin_lock+0xa1/0x170 [ 2361.005430][ T144] ? radix_tree_cpu_dead+0x160/0x160 [ 2361.010727][ T144] dump_header+0xdb/0x700 [ 2361.015076][ T144] oom_kill_process+0xd3/0x280 [ 2361.019850][ T144] out_of_memory+0x5b6/0x890 [ 2361.024426][ T144] ? unregister_oom_notifier+0x20/0x20 [ 2361.029870][ T144] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2361.035429][ T144] ? netlink_recvmsg+0x600/0x1120 [ 2361.040445][ T144] ? get_page_from_freelist+0x7c0/0x7c0 [ 2361.046257][ T144] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2361.051619][ T144] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2361.057246][ T144] ? trace_event_raw_event_rcu_utilization+0x170/0x170 [ 2361.064065][ T144] wp_page_copy+0x1d4/0x15a0 [ 2361.068629][ T144] ? netlink_sendmsg+0xd40/0xd40 [ 2361.073540][ T144] ? __perf_event_task_sched_out+0x1127/0x1250 [ 2361.079665][ T144] ? add_mm_rss_vec+0x270/0x270 [ 2361.084488][ T144] do_wp_page+0x657/0x14b0 [ 2361.088888][ T144] ? _raw_spin_lock+0xa1/0x170 [ 2361.093624][ T144] ? do_swap_page+0x1510/0x1510 [ 2361.098447][ T144] ? __perf_event_task_sched_out+0x1127/0x1250 [ 2361.104572][ T144] handle_mm_fault+0xf6c/0x4140 [ 2361.109398][ T144] ? finish_fault+0x230/0x230 [ 2361.114046][ T144] ? down_read_trylock+0x17a/0x1d0 [ 2361.119571][ T144] ? vmacache_find+0x205/0x4b0 [ 2361.124307][ T144] do_user_addr_fault+0x48a/0x9f0 [ 2361.129335][ T144] page_fault+0x2f/0x40 [ 2361.133463][ T144] RIP: 0033:0x7f335d984cbb [ 2361.137852][ T144] Code: fb dc ff ff 90 66 2e 0f 1f 84 00 00 00 00 00 41 57 41 56 41 55 41 54 55 53 48 83 ec 68 48 83 fe bf 0f 87 84 07 00 00 48 89 f0 <48> 89 74 24 10 49 89 ff 48 83 c0 17 49 89 c1 49 83 e1 f0 48 83 f8 [ 2361.157514][ T144] RSP: 002b:00007ffca55b4fb0 EFLAGS: 00010213 [ 2361.163563][ T144] RAX: 0000000000000080 RBX: 00007f335dca5b00 RCX: 0000000000000049 [ 2361.171970][ T144] RDX: 0000000000000014 RSI: 0000000000000080 RDI: 00007f335dca5b00 [ 2361.180001][ T144] RBP: 0000000000000080 R08: 9503b8a13638601f R09: 0000000000000018 [ 2361.188205][ T144] R10: 0000000000000000 R11: 0000000000000000 R12: 00007ffca55b5120 [ 2361.196757][ T144] R13: 0000000000000080 R14: 000055cd61e9e9a0 R15: 0000000000000019 [ 2361.211475][ T144] Mem-Info: [ 2361.216247][ T144] active_anon:1408531 inactive_anon:4736 isolated_anon:0 [ 2361.216247][ T144] active_file:497 inactive_file:541 isolated_file:82 [ 2361.216247][ T144] unevictable:0 dirty:19 writeback:0 unstable:0 [ 2361.216247][ T144] slab_reclaimable:9575 slab_unreclaimable:97211 [ 2361.216247][ T144] mapped:56631 shmem:4833 pagetables:31518 bounce:0 [ 2361.216247][ T144] free:10857 free_pcp:182 free_cma:0 [ 2361.280088][ T144] Node 0 active_anon:5634136kB inactive_anon:18940kB active_file:1412kB inactive_file:1764kB unevictable:0kB isolated(anon):0kB isolated(file):28kB mapped:225312kB dirty:32kB writeback:0kB shmem:19324kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2361.305185][ T144] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2361.331382][ T144] lowmem_reserve[]: 0 2912 6416 6416 [ 2361.336804][ T144] DMA32 free:18848kB min:4644kB low:7624kB high:10604kB active_anon:2908516kB inactive_anon:8216kB active_file:1328kB inactive_file:1696kB unevictable:0kB writepending:12kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1856kB pagetables:1852kB bounce:0kB free_pcp:1020kB local_pcp:0kB free_cma:0kB [ 2361.369753][ T144] lowmem_reserve[]: 0 0 3504 3504 [ 2361.374891][ T144] Normal free:9976kB min:17880kB low:21468kB high:25056kB active_anon:2725620kB inactive_anon:10724kB active_file:296kB inactive_file:100kB unevictable:0kB writepending:20kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35392kB pagetables:124012kB bounce:0kB free_pcp:44kB local_pcp:0kB free_cma:0kB [ 2361.405533][ T144] lowmem_reserve[]: 0 0 0 0 [ 2361.410535][ T144] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2361.424204][ T144] DMA32: 185*4kB (UME) 114*8kB (UMH) 88*16kB (UMEH) 4*32kB (UH) 54*64kB (UMEH) 28*128kB (UMEH) 19*256kB (UMEH) 7*512kB (UM) 1*1024kB (E) 0*2048kB 0*4096kB = 19700kB [ 2361.440807][T28248] usb 4-1: Using ep0 maxpacket: 8 [ 2361.446157][ T144] Normal: 360*4kB (UMEH) 100*8kB (UM) 242*16kB (UMEH) 114*32kB (UME) 6*64kB (UME) 1*128kB (M) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 10272kB [ 2361.461303][ T144] 5371 total pagecache pages [ 2361.466182][ T144] 0 pages in swap cache [ 2361.470457][ T144] Swap cache stats: add 0, delete 0, find 0/0 [ 2361.476672][ T144] Free swap = 0kB [ 2361.480439][ T144] Total swap = 0kB [ 2361.484217][ T144] 1965979 pages RAM [ 2361.492919][ T144] 0 pages HighMem/MovableOnly [ 2361.497771][ T144] 318041 pages reserved [ 2361.501980][ T144] 0 pages cma reserved [ 2361.506526][ T144] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.0,pid=26212,uid=0 [ 2361.521009][ T144] Out of memory: Killed process 26212 (syz-executor.0) total-vm:85484kB, anon-rss:16200kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:160kB oom_score_adj:1000 [ 2361.585440][T28248] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2361.595651][T28248] usb 4-1: config 0 has no interfaces? [ 2361.650904][T13520] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2361.658075][T13520] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2361.675431][T28248] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2361.684515][T28248] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2361.693376][T28248] usb 4-1: SerialNumber: syz 12:53:43 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:43 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x400c90) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:43 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2361.699160][T28248] usb 4-1: config 0 descriptor?? 12:53:43 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2362.014496][T13520] fuse: Bad value for 'fd' [ 2362.034415][ T133] systemd-journal invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 2362.064736][ T133] CPU: 1 PID: 133 Comm: systemd-journal Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2362.074907][ T133] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2362.084972][ T133] Call Trace: [ 2362.088256][ T133] dump_stack+0x1b0/0x21e [ 2362.092593][ T133] ? devkmsg_release+0x11c/0x11c [ 2362.097505][ T133] ? ___ratelimit+0x3bf/0x560 [ 2362.102154][ T133] ? show_regs_print_info+0x12/0x12 [ 2362.107326][ T133] ? _raw_spin_lock+0xa1/0x170 [ 2362.112171][ T133] ? radix_tree_cpu_dead+0x160/0x160 [ 2362.117428][ T133] dump_header+0xdb/0x700 [ 2362.121731][ T133] oom_kill_process+0xd3/0x280 [ 2362.126642][ T133] out_of_memory+0x5b6/0x890 [ 2362.131208][ T133] ? unregister_oom_notifier+0x20/0x20 [ 2362.136641][ T133] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2362.142161][ T133] ? get_page_from_freelist+0x7c0/0x7c0 [ 2362.147699][ T133] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2362.153043][ T133] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2362.158574][ T133] pagecache_get_page+0x522/0x8a0 [ 2362.163570][ T133] ? is_mmconf_reserved+0x420/0x420 [ 2362.169175][ T133] filemap_fault+0x1435/0x1990 [ 2362.173914][ T133] ? __down_read+0xf1/0x210 [ 2362.178388][ T133] ? generic_file_read_iter+0x20a0/0x20a0 [ 2362.184078][ T133] ? xas_find+0x11f/0x6f0 [ 2362.188391][ T133] ? xas_find+0x347/0x6f0 [ 2362.192781][ T133] ext4_filemap_fault+0x7b/0x90 [ 2362.197613][ T133] handle_mm_fault+0x291e/0x4140 [ 2362.202522][ T133] ? finish_fault+0x230/0x230 [ 2362.207171][ T133] ? ep_destroy_wakeup_source+0x70/0x70 [ 2362.212789][ T133] ? down_read_trylock+0x17a/0x1d0 [ 2362.217873][ T133] ? vmacache_find+0x47a/0x4b0 [ 2362.222706][ T133] do_user_addr_fault+0x48a/0x9f0 [ 2362.228659][ T133] page_fault+0x2f/0x40 [ 2362.232805][ T133] RIP: 0033:0x7fa0c881421d [ 2362.238160][ T133] Code: Bad RIP value. [ 2362.242209][ T133] RSP: 002b:00007fff542710c0 EFLAGS: 00010207 [ 2362.248283][ T133] RAX: 0000000000000001 RBX: 000055e5076e5200 RCX: 00007fa0c7e392e3 [ 2362.256230][ T133] RDX: 0000000000000013 RSI: 00007fff542710c0 RDI: 0000000000000008 [ 2362.264215][ T133] RBP: 00007fff542712b0 R08: 00007fff543a2080 R09: 00007fff543a20a8 [ 2362.272365][ T133] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fff542710c0 [ 2362.280316][ T133] R13: 0000000000000001 R14: ffffffffffffffff R15: 0005b1a1057ca409 [ 2362.411884][T16300] usb 1-1: new high-speed USB device number 79 using dummy_hcd [ 2362.435210][ T133] Mem-Info: [ 2362.438396][ T133] active_anon:1407569 inactive_anon:4735 isolated_anon:0 [ 2362.438396][ T133] active_file:30 inactive_file:12 isolated_file:30 [ 2362.438396][ T133] unevictable:0 dirty:33 writeback:13 unstable:0 [ 2362.438396][ T133] slab_reclaimable:9576 slab_unreclaimable:97466 [ 2362.438396][ T133] mapped:55660 shmem:4831 pagetables:31454 bounce:0 [ 2362.438396][ T133] free:12160 free_pcp:460 free_cma:0 [ 2362.476902][ T133] Node 0 active_anon:5630288kB inactive_anon:18948kB active_file:84kB inactive_file:96kB unevictable:0kB isolated(anon):0kB isolated(file):116kB mapped:222628kB dirty:88kB writeback:32kB shmem:19336kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2362.501192][ T133] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2362.528729][ T133] lowmem_reserve[]: 0 2912 6416 6416 [ 2362.534476][ T133] DMA32 free:17844kB min:4644kB low:7624kB high:10604kB active_anon:2913204kB inactive_anon:8216kB active_file:16kB inactive_file:16kB unevictable:0kB writepending:8kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:1856kB pagetables:1776kB bounce:0kB free_pcp:288kB local_pcp:152kB free_cma:0kB [ 2362.579600][ T133] lowmem_reserve[]: 0 0 3504 3504 [ 2362.585225][ T133] Normal free:5992kB min:5592kB low:9180kB high:12768kB active_anon:2725652kB inactive_anon:10732kB active_file:60kB inactive_file:1004kB unevictable:0kB writepending:36kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35744kB pagetables:124212kB bounce:0kB free_pcp:836kB local_pcp:452kB free_cma:0kB [ 2362.665883][ T133] lowmem_reserve[]: 0 0 0 0 [ 2362.674548][ T133] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2362.689384][ T133] DMA32: 126*4kB (UME) 31*8kB (UMH) 93*16kB (UMEH) 10*32kB (UMH) 49*64kB (UMEH) 25*128kB (UMEH) 19*256kB (UMEH) 7*512kB (UM) 1*1024kB (E) 0*2048kB 0*4096kB = 18368kB [ 2362.755425][ T133] Normal: 412*4kB (UM) 711*8kB (UM) 319*16kB (UME) 38*32kB (UME) 3*64kB (UE) 1*128kB (M) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 13976kB [ 2362.770092][ T133] 5183 total pagecache pages [ 2362.774849][ T133] 0 pages in swap cache [ 2362.779290][ T133] Swap cache stats: add 0, delete 0, find 0/0 [ 2362.791899][ T133] Free swap = 0kB [ 2362.795678][ T133] Total swap = 0kB [ 2362.799384][ T133] 1965979 pages RAM [ 2362.803429][ T133] 0 pages HighMem/MovableOnly [ 2362.808204][ T133] 318041 pages reserved [ 2362.812338][ T133] 0 pages cma reserved [ 2362.816408][ T133] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.0,pid=9537,uid=0 [ 2362.830434][ T133] Out of memory: Killed process 9537 (syz-executor.0) total-vm:85484kB, anon-rss:16180kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:160kB oom_score_adj:1000 [ 2362.955189][T13551] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2362.963131][T28562] usb 4-1: USB disconnect, device number 48 [ 2362.997168][T13520] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2363.025741][T26029] usblp 2-1:5.0: usblp0: USB Bidirectional printer dev 66 if 0 alt 0 proto 3 vid 0x0525 pid 0xA4A8 [ 2363.097034][T26029] usb 2-1: USB disconnect, device number 66 [ 2363.103707][T26029] usblp0: removed 12:53:44 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x400ce0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:44 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:53:44 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2363.224986][T16300] usb 1-1: Using ep0 maxpacket: 8 12:53:45 executing program 1: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) pipe(&(0x7f0000000200)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fsetxattr$security_evm(r1, &(0x7f0000000040)='security.evm\x00', &(0x7f0000000140)=@v2={0x5, 0x1, 0x5, 0x5, 0x96, "653e8f7e7ae78258e72ab44d153782a828f48542990e45e1ddd46d43c2347bc24ac3109a99b459cb0fc2dc8b52e18331f3e85a2cca8c68e39595e5ea0321ee764ddbcdf4019c4d086e57dbf053cb4a88e2dd5b718698884f284a2903432ced3756b2f724c1330574437a790eb328bf629e4813afcedef0adc5089c6ce8a6716ded99ad66950a95623ae33faee2fdde963ec5e91d34d2"}, 0x9f, 0x0) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) r2 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3bed0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x5}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x3000003, 0x4010, r2, 0x8c0aa000) chdir(&(0x7f0000000080)='./file0\x00') write(r3, &(0x7f00000007c0)="30eb2297b18c0a2ada6f46f8341ce63ccdab668e820dabde", 0x41395563) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYRES16=r3], 0x0) [ 2363.469880][T13606] fuse: Bad value for 'fd' [ 2363.532015][T16300] usb 1-1: config index 0 descriptor too short (expected 65316, got 36) [ 2363.600365][T13605] syz-executor.2 invoked oom-killer: gfp_mask=0x1100dca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO|0x1000000), order=0, oom_score_adj=1000 [ 2363.613726][T13605] CPU: 0 PID: 13605 Comm: syz-executor.2 Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2363.623942][T13605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2363.633988][T13605] Call Trace: [ 2363.637259][T13605] dump_stack+0x1b0/0x21e [ 2363.642255][T13605] ? devkmsg_release+0x11c/0x11c [ 2363.647179][T13605] ? ___ratelimit+0x3bf/0x560 [ 2363.651825][T13605] ? show_regs_print_info+0x12/0x12 [ 2363.656990][T13605] ? _raw_spin_lock+0xa1/0x170 [ 2363.661731][T13605] ? radix_tree_cpu_dead+0x160/0x160 [ 2363.667073][T13605] dump_header+0xdb/0x700 [ 2363.671498][T13605] oom_kill_process+0xd3/0x280 [ 2363.676247][T13605] out_of_memory+0x5b6/0x890 [ 2363.680812][T13605] ? unregister_oom_notifier+0x20/0x20 [ 2363.686264][T13605] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2363.692335][T13605] ? get_page_from_freelist+0x7c0/0x7c0 [ 2363.697877][T13605] ? flush_tlb_func_common+0x45/0x580 [ 2363.703228][T13605] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2363.708576][T13605] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2363.714094][T13605] ? mem_cgroup_commit_charge+0x198/0x240 [ 2363.719800][T13605] ? mem_cgroup_try_charge_delay+0x10/0x10 [ 2363.725594][T13605] ? __lru_cache_add+0x1a1/0x1f0 [ 2363.730503][T13605] wp_page_copy+0x1a4/0x15a0 [ 2363.735066][T13605] ? add_mm_rss_vec+0x270/0x270 [ 2363.739898][T13605] ? vm_normal_page+0x1ab/0x1d0 [ 2363.744743][T13605] ? vm_normal_page+0x1c9/0x1d0 [ 2363.749566][T13605] do_wp_page+0x48d/0x14b0 [ 2363.753979][T13605] ? _raw_spin_lock+0xa1/0x170 [ 2363.758722][T13605] ? do_swap_page+0x1510/0x1510 [ 2363.763561][T13605] handle_mm_fault+0xf6c/0x4140 [ 2363.769004][T13605] ? finish_fault+0x230/0x230 [ 2363.773651][T13605] ? plist_del+0x3c6/0x3e0 [ 2363.778051][T13605] ? trace_event_raw_event_sched_switch+0x480/0x480 [ 2363.784695][T13605] ? down_read_trylock+0x17a/0x1d0 [ 2363.789788][T13605] ? vmacache_find+0x2d2/0x4b0 [ 2363.794521][T13605] do_user_addr_fault+0x48a/0x9f0 [ 2363.799516][T13605] page_fault+0x2f/0x40 [ 2363.803661][T13605] RIP: 0010:copy_user_enhanced_fast_string+0xe/0x30 [ 2363.810219][T13605] Code: 89 d1 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 31 c0 0f 1f 00 c3 0f 1f 80 00 00 00 00 0f 1f 00 83 fa 40 0f 82 70 ff ff ff 89 d1 a4 31 c0 0f 1f 00 c3 66 2e 0f 1f 84 00 00 00 00 00 89 d1 f3 a4 [ 2363.829879][T13605] RSP: 0018:ffff888192f67888 EFLAGS: 00010206 [ 2363.836434][T13605] RAX: ffffffff81f57901 RBX: 00000000207db500 RCX: 0000000000000500 [ 2363.844389][T13605] RDX: 0000000000001000 RSI: ffff8880066e6b00 RDI: 00000000207db000 [ 2363.852345][T13605] RBP: ffff888192f67da8 R08: dffffc0000000000 R09: ffffed1000cdce00 [ 2363.860301][T13605] R10: 0000000000000000 R11: 0000000000000000 R12: 00007ffffffff000 [ 2363.868259][T13605] R13: 0000000000001000 R14: ffff8880066e6000 R15: 00000000207da500 [ 2363.876208][T13605] ? copyout+0x1/0xb0 [ 2363.880248][T13605] copyout+0x8e/0xb0 [ 2363.884129][T13605] copy_page_to_iter+0x393/0xbd0 [ 2363.889038][T13605] pipe_to_user+0xa3/0x130 [ 2363.893426][T13605] __splice_from_pipe+0x2d3/0x870 [ 2363.898768][T13605] ? user_page_pipe_buf_steal+0xc0/0xc0 [ 2363.904296][T13605] do_vmsplice+0x240/0xe70 [ 2363.908697][T13605] ? write_pipe_buf+0x1d0/0x1d0 [ 2363.913516][T13605] ? __rcu_read_lock+0x50/0x50 [ 2363.918263][T13605] ? check_stack_object+0x5a/0x90 [ 2363.923255][T13605] ? _copy_from_user+0xa4/0xe0 [ 2363.927989][T13605] ? rw_copy_check_uvector+0x2b3/0x310 [ 2363.933432][T13605] ? import_iovec+0x171/0x340 [ 2363.938183][T13605] ? dup_iter+0x110/0x110 [ 2363.942481][T13605] ? do_vfs_ioctl+0x756/0x16f0 [ 2363.947215][T13605] __se_sys_vmsplice+0x1cc/0x2c0 [ 2363.952223][T13605] ? __x64_sys_vmsplice+0xa0/0xa0 [ 2363.957252][T13605] ? put_timespec64+0x106/0x150 [ 2363.962076][T13605] ? ktime_get_raw+0x130/0x130 [ 2363.966813][T13605] ? get_timespec64+0x1c0/0x1c0 [ 2363.971740][T13605] ? fget_many+0x20/0x20 [ 2363.975961][T13605] ? __ia32_sys_clock_settime+0x230/0x230 [ 2363.981666][T13605] do_syscall_64+0xcb/0x150 [ 2363.986142][T13605] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2363.992018][T13605] RIP: 0033:0x45de59 [ 2363.995899][T13605] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2364.015475][T13605] RSP: 002b:00007f5eae0f7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 2364.024376][T13605] RAX: ffffffffffffffda RBX: 0000000000038340 RCX: 000000000045de59 [ 2364.032321][T13605] RDX: 0000000000000001 RSI: 0000000020000000 RDI: 0000000000000004 [ 2364.040264][T13605] RBP: 000000000118c0b8 R08: 0000000000000000 R09: 0000000000000000 [ 2364.048225][T13605] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118c07c [ 2364.056168][T13605] R13: 00007ffd71432d0f R14: 00007f5eae0f89c0 R15: 000000000118c07c [ 2364.064532][T13605] Mem-Info: [ 2364.067795][T13605] active_anon:1408491 inactive_anon:4735 isolated_anon:0 [ 2364.067795][T13605] active_file:321 inactive_file:283 isolated_file:25 [ 2364.067795][T13605] unevictable:0 dirty:18 writeback:0 unstable:0 [ 2364.067795][T13605] slab_reclaimable:9579 slab_unreclaimable:97233 [ 2364.067795][T13605] mapped:56243 shmem:4831 pagetables:31516 bounce:0 [ 2364.067795][T13605] free:10078 free_pcp:1216 free_cma:0 [ 2364.105745][T13605] Node 0 active_anon:5633964kB inactive_anon:18940kB active_file:1164kB inactive_file:1132kB unevictable:0kB isolated(anon):0kB isolated(file):100kB mapped:224972kB dirty:72kB writeback:0kB shmem:19324kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2364.130250][T13605] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2364.156304][T13605] lowmem_reserve[]: 0 2912 6416 6416 [ 2364.161620][T13605] DMA32 free:17040kB min:4644kB low:7624kB high:10604kB active_anon:2910772kB inactive_anon:8216kB active_file:900kB inactive_file:268kB unevictable:0kB writepending:80kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:2176kB pagetables:2008kB bounce:0kB free_pcp:2232kB local_pcp:1232kB free_cma:0kB [ 2364.191096][T13605] lowmem_reserve[]: 0 0 3504 3504 [ 2364.196244][T13605] Normal free:7872kB min:24744kB low:28332kB high:31920kB active_anon:2722404kB inactive_anon:10724kB active_file:928kB inactive_file:908kB unevictable:0kB writepending:192kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35392kB pagetables:124056kB bounce:0kB free_pcp:2704kB local_pcp:1388kB free_cma:0kB [ 2364.226276][T13605] lowmem_reserve[]: 0 0 0 0 [ 2364.230773][T13605] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2364.244092][T13605] DMA32: 41*4kB (UE) 30*8kB (UMH) 73*16kB (UMEH) 3*32kB (U) 45*64kB (UEH) 14*128kB (UMEH) 24*256kB (UMEH) 7*512kB (UM) 1*1024kB (E) 0*2048kB 0*4096kB = 17092kB [ 2364.260246][T13605] Normal: 446*4kB (UME) 145*8kB (UM) 209*16kB (UME) 58*32kB (UME) 6*64kB (UME) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 8528kB [ 2364.275370][T13605] 5399 total pagecache pages [ 2364.279948][T13605] 0 pages in swap cache [ 2364.284105][T13605] Swap cache stats: add 0, delete 0, find 0/0 [ 2364.290263][T13605] Free swap = 0kB [ 2364.293963][T13605] Total swap = 0kB [ 2364.297715][T13605] 1965979 pages RAM [ 2364.301592][T13605] 0 pages HighMem/MovableOnly [ 2364.306354][T13605] 318041 pages reserved [ 2364.310488][T13605] 0 pages cma reserved [ 2364.314537][T13605] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.2,pid=10474,uid=0 [ 2364.328718][T13605] Out of memory: Killed process 10474 (syz-executor.2) total-vm:85484kB, anon-rss:16004kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:164kB oom_score_adj:1000 [ 2364.359160][T16300] usb 1-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2364.369130][T16300] usb 1-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 2364.381071][T16300] usb 1-1: config 5 has 0 interfaces, different from the descriptor's value: 255 12:53:46 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:53:46 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x400cef) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:46 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ff"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:46 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2364.474805][T16300] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2364.484385][T16300] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2364.492579][T16300] usb 1-1: SerialNumber: syz [ 2364.671260][T26029] usb 2-1: new high-speed USB device number 67 using dummy_hcd [ 2364.691415][T13627] fuse: Bad value for 'fd' 12:53:46 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:46 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x400f00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:46 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:53:46 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2364.732811][T10330] usb 1-1: USB disconnect, device number 79 [ 2364.824686][T28562] usb 4-1: new high-speed USB device number 49 using dummy_hcd 12:53:46 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x401f00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:46 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2365.014655][T26029] usb 2-1: Using ep0 maxpacket: 8 12:53:46 executing program 5: ioctl$EXT4_IOC_PRECACHE_EXTENTS(0xffffffffffffffff, 0x6612) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYRESHEX=r0], 0x28}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_io_uring_complete(0x0) sendmsg$IPVS_CMD_GET_CONFIG(r3, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x68, 0x0, 0x400, 0x870bd26, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}, @IPVS_CMD_ATTR_DEST={0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_DAEMON={0x34, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr=' \x01\x00'}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ip6gre0\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x20000000}]}]}, 0x68}}, 0x0) r4 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) [ 2365.134681][T26029] usb 2-1: config index 0 descriptor too short (expected 65316, got 36) [ 2365.148981][T26029] usb 2-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2365.164274][T26029] usb 2-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2365.174473][T26029] usb 2-1: config 5 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 [ 2365.179626][T28562] usb 4-1: Using ep0 maxpacket: 8 [ 2365.186384][T26029] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2365.201086][T26029] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 65 [ 2365.211074][T26029] usb 2-1: config 5 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 2365.224617][T10330] usb 1-1: new high-speed USB device number 80 using dummy_hcd [ 2365.294681][T26029] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2365.306597][T26029] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2365.315310][T26029] usb 2-1: SerialNumber: syz [ 2365.324682][T28562] usb 4-1: config index 0 descriptor too short (expected 65316, got 36) [ 2365.333898][T28562] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2365.334629][T13601] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2365.344449][T28562] usb 4-1: config 0 has no interfaces? [ 2365.352908][T13601] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2365.375105][T26029] hub 2-1:5.0: bad descriptor, ignoring hub [ 2365.381329][T26029] hub: probe of 2-1:5.0 failed with error -5 [ 2365.434666][T28562] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2365.444258][T28562] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2365.452465][T28562] usb 4-1: SerialNumber: syz [ 2365.457807][T28562] usb 4-1: config 0 descriptor?? [ 2365.494628][T10330] usb 1-1: Using ep0 maxpacket: 8 [ 2365.579502][T13601] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2365.587036][T13601] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2365.614624][T10330] usb 1-1: config index 0 descriptor too short (expected 65316, got 36) [ 2365.623378][T10330] usb 1-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2365.632602][T10330] usb 1-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 2365.642955][T10330] usb 1-1: config 5 has 0 interfaces, different from the descriptor's value: 255 [ 2365.697018][T13616] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2365.706206][T28562] usb 4-1: USB disconnect, device number 49 [ 2365.724561][T10330] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2365.734492][T10330] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2365.742607][T10330] usb 1-1: SerialNumber: syz [ 2365.899506][T13675] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2365.987591][T13638] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2365.996773][T28562] usb 1-1: USB disconnect, device number 80 12:53:48 executing program 1: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) socket$inet6(0xa, 0x3, 0x9c) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x4, 0x70, 0x7e, 0x0, 0x81, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x6, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) socket$inet6(0xa, 0x1, 0x2) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:48 executing program 5: mmap(&(0x7f0000a2f000/0x1000)=nil, 0x1000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0xac728000) r0 = open(&(0x7f0000000180)='./bus\x00', 0x1e3542, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800006, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000300)='./bus\x00', 0x0) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000040)) ftruncate(r1, 0x2008001) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) connect$inet6(0xffffffffffffffff, &(0x7f0000004540)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) process_vm_readv(0x0, &(0x7f0000003780)=[{0x0}], 0x1, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) 12:53:48 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x403f00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:48 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:53:48 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ff"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:48 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) [ 2366.927296][T26029] usblp 2-1:5.0: usblp0: USB Bidirectional printer dev 67 if 0 alt 0 proto 3 vid 0x0525 pid 0xA4A8 12:53:48 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) r2 = fcntl$dupfd(r1, 0x0, 0xffffffffffffffff) fchmod(r2, 0x100) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000000040)='./bus\x00', 0x0) mount$overlay(0x400002, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f0000000540)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}, {@workdir={'workdir', 0x3d, './file0'}}, {@metacopy_off='metacopy=off'}]}) 12:53:48 executing program 5: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp\x00', 0x80000101005, 0x0) r1 = dup2(r0, r0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000440)=""/256) r2 = socket$inet6(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r0, 0x0, r2) ioctl$PPPIOCSMAXCID(r3, 0x40047451, &(0x7f00000001c0)) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000140)=0x5c5064) pwritev(r1, &(0x7f0000000640)=[{&(0x7f00000003c0)="0021490000008000020000061fffffff00000000eeff", 0x16}], 0x1, 0x0, 0x0) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) 12:53:48 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x404000) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:48 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2367.040091][T13706] overlayfs: upperdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 2367.056342][T13706] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. 12:53:48 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x0, 0x0, 0x0, 0x8}, 0x0) socket$inet6(0xa, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003200), 0x0, 0x2022, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r3 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x1, 0x3ff, 0x3}, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCSBRK(r1, 0x5427) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r3, 0x0, 0x0}, 0x20) r4 = perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x0, 0x5}, 0x800, 0x0, 0x0, 0x0, 0x0, 0x800, 0x4000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) readv(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000002f00)=ANY=[@ANYBLOB="922af06b436af5e58fff696bcac80393957d1b449d9d3e2490f64c33523899aa44fd7b9403302f150471b51eebc7a1d06fa1e7b727d3edd87ac661fe51a157edf6b3ee4903cc4257d012e447b79005b266b5642901fd26f9b301bf7754865207b0f538e6fbff71994097813d790d40f635fed9af8ffb5b7dfe8b1c5e8c78f494addd0d4dc32794501569f0f1e6d6ff3cccff2fa75b7971367f3b1ae5a275170299ca63dbebd94db19926a06fb8f3c3deb48d5d090d8177c7d66d84d0b29db788befcdbf990fa8961fd2408b1f6d646615ac6e95cd92a66f9b3b80e54817abe1fe0c8c706096d7c0f056e0701525c13cb96264e9d1fd8949695262ccd2c36e65e96e882068e68ab761e8e19b325ce09e5c4e258c2d32f9358743de213d29da8ad414c18c3be0df9597365d5dc973c4ce99b42b841aa6f12ac72d5ee8c3513d7d3df434bfc44ecf7aa2feaf21f64f6806a118314e27005c84701b1b5d6b673f27eb7c7a0e3d7e65f18e013dc7399112c2d9c8d71ccf612", @ANYRES16=0x0, @ANYBLOB="01002dbd7000fddbdf2501000000140002007767320000000000000000000000000008000500000000000800070007000000080005000000000008000100", @ANYRESHEX=r4, @ANYRES32], 0x508}, 0x1, 0x0, 0x0, 0x4040815}, 0x20040810) clone(0x50000103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000140)='./file1\x00', 0xfffffffe, 0x3, &(0x7f0000000680)=[{&(0x7f0000000180)="44ed84a9e88d5fc7070051f5dcbbcf4cb83a28b1f0aea0432900000000", 0x1d, 0x49}, {&(0x7f0000000440)="9068a8caa0503c345b7d705f476612f653eab917eb74dff6989de4284c89bfb80c0c69149f8a79282f76c39fbe6b52f3f14c0d3a1cde6b8fdca295df0624634dee9bb069d323ad35cb3957fd2863a21bfab5c012d1e999f81f3a1cb9e06c4d91c916258a6dc406955349dab068fb74c98dc05f7384206465ee50cf1a6ffb2b89ebcd55fd111d712deb05cac224c872a115c114e28ba8617650a1837d4d3acdcbdb972ed11b531031a348bdec17291ff9c2241158079c415b42a1ff27ebe1d9c657e2d9186019c285463b4f8e96017d374e6e019ce020a2d1", 0xd8, 0xca}, {&(0x7f0000001f00)="6e76efaebe66d3a9be1f0464d9303a940fbc52b84cf44e540fe33a2dc5202d28ae841fe8aa060f488e25b32518f34664095d3c777e5e89f78311c174b05703dd29e9f5e4eaa48751110f1aa787a4a45a81236bad69ee551409c37438e50bc1ace50febefa93b749d5d1a5db673a934ff8b523928d0ffa7c6c5c2b8fa4c6b5312d1fb216d98d3f5d249a0166c987ba11343d5456a368c0c9ec1c6eab6d603751be9d42a09ab6f0184c6e565af9527f9b521b4b494f9a077bc53b041e0b2e225c6e4cafaa76d00244a7f34dbf28b1de19e783fdb13686cd4f0b041175f7cfffb90ff71faf34a548305b2b3ab9ac0d066fcf335642b38eda2c89238937a8eacac21408e6693618ab45564cd0db9ea63ad5c4a452c62a13d1d9b4aa1f6ebc4f1104e71825564e47a90dcc6dcda4d524c93645857760f7f17c6997526d68e05796b9512a1791307787915c75d75dd1a925ec567aea65e919aafa496ff94c39015036b745375608a25bda1cd43ec252894ac05d598bb184f62ce3ed385a7349d4c3a9da855f38964045b243625091f0d43bf3dcbe9e6964d8e6b92b672eda02b5187ad7c5874cfe35ebb826260845508caf5c12924f008743b4ba41aa6eb8a13e31694668a87d8412f6bb01350d9a582cdddda86f69ce440661f5e673814483f1ce7f7c303ada019fdbf1dcb61aa12d4458cbcf072f61b58af43d4d5cc22a7c54abb3352f146829d65d8a893545c5cec30c16d3523190ef4d7db55d8e21b4887b53f458b1b608073d2e0655936b9200abdb4355fc98af2a63fbd32dbedc7bb2719a4763d71b890d2055e02e903bdd70b3cc7da96ae8199b5d8c864b37b7f9289c627cd3b575d65c465446dc39a636df4cbaa1227c70bc254d879cd850870b14655bc5a89f580661e5faa5c6386abc028e4b044fae4cd72e7eefcde36f799ba761020e927c1cdd03ad4e07da2d0197544cfab09d1e705debd3873c545d7986a61ca76dbd115139943e9d8a9bf775c5f3447e2a2e69fb257d7e9f53173cc4b2511d6dfaed5a86434b7353869ff7da4adc3e1302bcd086de32d259c80e3b51780164a6176901a7ca28a59340ab93b7cb8cebeffdde70785402214212c59d5350f3f11f6a53830ca870e19215a89b4d5a6666854b884672ec9ec47c290a77096351f054eb3a65abcd44729456fe58788888c8d1598aca29cf17d74cef03b7d7d4c84b75d0868fd42e2246a2e2d32c13569f63723721268b9ffa2e1018e0fba86285e04191b957d2bef3ce5b43fa95f55c3fed9ba15b2ff04007ee5f920833a15b0399479c2e573f7d4ea6004c33cacd4b44dd5d58898cd1f5f6bea78767c3694aa8a473b205d47478f037bda400832fcc1fe0dcf4b738d2d63fc1127ac2f67abfaab6ee48bf8da28175c320e2c567deb5869d014ab97bc3eb1c323c8eedbec1ed0fe4b8fac8341d85141e8a7fee1680b204b0c0b8a9a8023f0ddd6fe4eb0a5c58f9be55265676fdfc7708ec5357c327ab7dc1cec7d9cd5140aed2e7789939efc14c34d6018bb310847c6ac648df251836a7babc13e269d7514848afd1a3b082e4dd247c0678af2243a57561d614597da6a7c4625932b810b36baffbf06104d09bc1f357cae8d73e82cd282465ac5c8da90e5123979e5206fd12ff9178f2d701b7cdca250f8866a8fd605dce8e223411120ed006f1071660dadadb3c5b73fbb3e5e7b74a211dff533e3c5af573c11e0a38875355a62e869099c677d485f4879e34317bb685840f4f34cc3a76e8b32da27d4de5cb2de6fc54c100658114424f03761698ab93b6c658c7985a3a06abff56162a0aa55619388209689b4aeedd67ad26ceac1e7dd9fae1a66dab580bdc50c05f9d77e8739051ac6b7b165bf3902c7588b8ebccbc126010acb3f26977706384bc0f6f3782d202815356c632d48430ad19ab4dc215158a23f006eb894b755b8c0fc0cd224a76e0f33474f798276367aa6197c72ec5ec3f5091a4fdc5a49bae5f3702473ed0116bc3cd5749413edca5bfdfa9533c6e0d3a2f5b6fb7469fd16b6f9a709f13afc9b235c0d4bd3cd235fa18d96d84b08d70db3493118dbe0f778752534959ee6b47a99f4d5c5c63e66f69708028d8e51efe0145945811cbdf1bf9e3de21cd1d11a5745f47132bcc7f1c5478b6069581e9752679a37710a1c4df0f8a584373f1251098cc5f863fe1a1da1549feca9dbcab2a8db18241164f5b71fd33bd17ab90d5b6bcd1116780261af257106b168bc097f142e3222e9bf9216b7ee20c15ba267637d65b2cdee081573642508490b859ffb6ff97a561e14620eb04e2a1da6c067bcd27c931cd76d06445d1b475ce25f388c164ed7a3d614afffa8b132833668f08833d700f648c765ede7b7fab7bd858ba8331e030281d922063f4ec679a55772ed7e48b77941f98fa5054504cbefca59c4efc05db364683512bb390b09dcfdde335919e90331d7e2f04582314469114c742763c6c6580b20032ed128ee15c708360f4fe5883f99aceb62da1a19846dca5785e71cfa4e1a9eea33d7687860d86890fe5f1548ea36c25c092e5720f9d950f2473c708aa7bb3b2cfd44dd1521043eb21cb17780a159c33d300316528de3124e4f5f1ad4bde78d94894c45e50d1a9b7945613e397bfb03b607ee50894b15ded4c80ade38718f72d469c687a9f361e633848f8f030bcc01388883bb14de8e9e066aece36dd2572bcc5163151fdb69993da7dd058809964eb1c6003cc03f0229168a3da3401ce03f6c263277f0aa36b2acd148537066ae21661011e87b55c7a9cb8fbe492631d5b1e45dc642109e1372c8d42307ac2de6df6c8c6253877cc85ba229623439df8c219dd639f256b75713633063383a5b6cf9eb5f2ccbbd22dba7dbd80406e1fda896c2a15c81240bbf69657be2f468cd1b3efe8cc06d40c469af764347912d23ca2e3ad12e63ecbee08dca8c3c123551e52231c306466aa472f31fc675f7f99c5e4b83dc6ee532245efd699443d14c9184d953dc14acaf3d2cb1ede1df98af449748f4afac7387c85e67e7608e0242378cac142909b23184be148e0e9db4a0680083210bc45535ceece90ad47c025b6f3406503d58147ddbe4e9ad6bd900ef489bad059fe7c19862a765a77b3c0b91483254a3912e7c83764a3222a64b9e7284c8bdd2b43a2e8e3cbd837b4723da2093381a0e00a522246fd6a08917acc6dec1dce6871dbee58af06d518f7929597d0144790955d0f0b0dc430046813466ba137e72393a26a6711594c826248f7e47da8c4d9c08a52770ee65845825d89558d1022df93898ca4a3ea29d09902d4bc20506bb73bc0372ccfe0b54b42e52036a4172e85002ecf45b31aca9036eacfd37934849ae5df6876aa0eeb68351b03d1f672f6f0c2b448d0d87a6bcb04df72882e506f3512206cc6d601950ae24d018aafe72b8aa58061ed435c3713040861d55fa2c3eb4242116e318e03a3869ee51c043fdc8909c833d2297775e2e0eaa137cea4c51b4f4ef700dad407b2eb15a757c20bb06bd6918d76fe45d7db7b2354faa3e86004556704e0c1ddbc4ee672a90ad77bf046c7215c4fd8d081447661c35cf740f8dac88597f258c1984dbcc1d69765d40b0a03bcdc19ae68ff0d28ed5a4cc6835e5824a22a2fc38be5f58e46db5af1d8c71ab624ab5c684612d597b2d85c33fb06fba5b8c2047139945c66cc4672b4e27a492adaf5a2a24116e8518668d5fd63b5d487dceaa1737d9878108758efbdf290beb0adf1b92290953316545180b3ba62efbcd98855176371c00f7de244c4d1441c57f86f28b4dede4ddea3605698f20a47cb09f70c24729e237a5377fbab445af1a2209543a411649ce7c3a3be2441c50a5a549327b4f4965400ea6595713334000606876396b1428dbbcb49dac09cdcf2fc61c4a5c2df8ec8b5466d6b7aac1a70c09aca51cf906e5986a6a8600e17e0f41c58692a0e276b68021670b7d6b21152d944af1e1ccf2c1ff18d7aeb2a8b1e442ceb85038e519b1961d2d472995250799bc78b1deb9bc39a67bbf8d49e8389a7150846e259c24ea4405420b469f25388c79411610b56528bef0c541686fc830f9629d5f366e2458f0b97f20a1dd4974976e233fbfab0000ab1186bd68882dc6139032500af8ae62780afb9ee90e69a0669498e3c3f41440ac2d42a12a520988fdc8f252f196a2a21230eda147dc7871a668a5fba26ef12c51e4a36e1202fef40d11a973f428f8999b7fb95aa312b4287bea3257b9210cf9b23736293f5d078463062cd5d753bcc24cabd55e9b1ec1772836e5f17f209e282c1171bcd0e4e975cb2d208fbefd333e4e87bb2ac9fdaa0eacc402a9291841a5c42a34e3f6c9bcd6091c05589e224721735a8e54cf6daf6f4d5aa627359562d063cc6dd885af966b5d090b85ceba7daaa1d00c6c0508eca50d861582fb2eb06c50613a1280562cd2c1e5f866a3293940f5dc5a3c9ea920696cc6243845c55ef6e6c55d4b89d6c2ccbeba101f777e0a58e419c736dbf4fad8285d46f8d56b2508dea68fbede9a7d23fcf2b4e0f65d39daad71946ef051f69b35ad231c77020527bb79bd4c78823ac0ee7512bc337cf67334c7739e4e3c0ee9feed2c3c9dfe7c2affe198c5954940b0f5146f84cdf03e0cf0915c8276539ecd04e9f9b823c43799ad83b13feebcc23e28c8a6a738a802d6ce64912b7016930398d5825ad1d44702ba89c39d6fe54e4fb3f5f67ef9737d81b36b838bf72909bd3671933ec3b34a23de27f83b5e9d3ddf3669a503552e82ee24caa225834757a27509af287ed49f15140b560c4e83182e6a9419b66472e4308db86cb87da26b5a660bd6da3395ea3959cd8a0ce4508d623724165d1d5f77f514140c87e1afdd5c89366cefd834b7b0d3a3a6111e148f6b29adcc6c94fa556a0d21b1d55d04d2099d3d09c4955b86f8cb73b2fcddb981effed20c598a9b5bf5e03a995f2ac1f6d22f12b4d268337ca284bb84db267c022279303d37344c60f434fa7f81d4feeaa7448df83379e231eb3a333386d580dc9c95f63cea4ec5674aca9b24f81b662d69a6cec3491629d554bb71d3a32e6f0aa01441497683c96ee28274e466af230dca3ae64cb0a0066c30b9ea94c3e9fead6dc463476a927f7697cfb386945a1f1465151b5b2423f357af00968672096cbd23d095996e25b213ee9dd035200af992c4f26d3d43cea517a95bc29b63813a7875766b6475fc7ab65e94e8225a7a93c0dabdde4b4cf2802fdac182ec9237771a3b6694bc3aa956de5981df10ac190bb99df23e2fc89a4566a6cc4833322b8ad693ef96a4aceece9c7cd426af51a6fe22eeb6230b521fe99241ba3e862335ed8db48c40322c50728c61bb4cf15fd021552b80c02913a25a543f9bc3b95e1c5122e69af86eef91b3bdde5ccea123d8cb1b1149b813b3ed53ec23c388e89d7a55271cdfb98bf7c50d9c0a1b2e1022e03c58088d417ee674fff36dc31a397ab0f0d403dfaa6b1aa0de135dc2156c0b1788ccb256be1b6a2fc919231a81f374501d5e3d2dbbc393cd26ca251391c2f6889d7055f852f06a426cb5cd78606ea405594945bae9eb37b64c27cb14de4d928c8bf8afe70aaa2728479e94858c2380f7b772f64462e1a17a756e54a463a870d98e1a904516bd3b0f496cf364d8ec5f30323923310cf4943a7f76f45e3900b1d597e43d9fc570d742d908f6495f3293a233615a12cd8029b196dea756c7c567d2134a17ebf82f0b6008235f05625d1074608c7ed84c2cbe0df8c56260", 0x1000, 0xfffffffffffffffe}], 0x0, &(0x7f00000004c0)=ANY=[]) [ 2367.124275][T26029] usb 2-1: reset high-speed USB device number 67 using dummy_hcd [ 2367.194276][T10330] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 2367.203705][T28562] usb 1-1: new high-speed USB device number 81 using dummy_hcd 12:53:49 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x8800000) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2367.374137][T26029] usb 2-1: Using ep0 maxpacket: 8 [ 2367.444124][T10330] usb 4-1: Using ep0 maxpacket: 8 [ 2367.449805][T28562] usb 1-1: Using ep0 maxpacket: 8 [ 2367.456530][T13730] syz-executor.4 invoked oom-killer: gfp_mask=0x1100dca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO|0x1000000), order=0, oom_score_adj=1000 [ 2367.471249][T13730] CPU: 1 PID: 13730 Comm: syz-executor.4 Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2367.482100][T13730] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2367.492495][T13730] Call Trace: [ 2367.496038][T13730] dump_stack+0x1b0/0x21e [ 2367.500446][T13730] ? devkmsg_release+0x11c/0x11c [ 2367.505885][T13730] ? ___ratelimit+0x3bf/0x560 [ 2367.510549][T13730] ? show_regs_print_info+0x12/0x12 [ 2367.515729][T13730] ? _raw_spin_lock+0xa1/0x170 [ 2367.520563][T13730] ? radix_tree_cpu_dead+0x160/0x160 [ 2367.526015][T13730] dump_header+0xdb/0x700 [ 2367.530521][T13730] oom_kill_process+0xd3/0x280 [ 2367.535454][T13730] out_of_memory+0x5b6/0x890 [ 2367.540202][T13730] ? unregister_oom_notifier+0x20/0x20 [ 2367.546031][T13730] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2367.551777][T13730] ? get_page_from_freelist+0x7c0/0x7c0 [ 2367.557522][T13730] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2367.563059][T13730] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2367.568713][T13730] ? mem_cgroup_commit_charge+0x198/0x240 [ 2367.574416][T13730] ? __rcu_read_lock+0x50/0x50 [ 2367.579350][T13730] ? __mod_node_page_state+0x99/0xb0 [ 2367.584736][T13730] handle_mm_fault+0x1849/0x4140 [ 2367.589754][T13730] ? finish_fault+0x230/0x230 [ 2367.594464][T13730] ? mark_page_accessed+0x275/0x5b0 [ 2367.599819][T13730] ? _raw_spin_unlock+0x5/0x20 [ 2367.604655][T13730] ? follow_page_mask+0x76a/0x1050 [ 2367.609746][T13730] __get_user_pages+0xca0/0x1420 [ 2367.614666][T13730] ? mempool_free+0x380/0x380 [ 2367.619330][T13730] ? populate_vma_page_range+0xf0/0xf0 [ 2367.624817][T13730] ? gup_pgd_range+0xa0f/0xd70 [ 2367.629564][T13730] ? __init_rwsem+0x120/0x120 [ 2367.634222][T13730] get_user_pages_unlocked+0x179/0x610 [ 2367.640013][T13730] ? get_user_pages_locked+0x4b0/0x4b0 [ 2367.645479][T13730] ? bio_chain_endio+0xf0/0xf0 [ 2367.650224][T13730] ? fscrypt_mergeable_bio+0x20b/0x5e0 [ 2367.655683][T13730] get_user_pages_fast+0x241/0x400 [ 2367.661036][T13730] ? gup_pgd_range+0xd70/0xd70 [ 2367.665831][T13730] ? bio_add_page+0x2f1/0x470 [ 2367.670491][T13730] iov_iter_get_pages+0x299/0xea0 [ 2367.675807][T13730] ? iov_iter_gap_alignment+0x6c0/0x6c0 [ 2367.681414][T13730] __blockdev_direct_IO+0x1010/0x4910 [ 2367.688032][T13730] ? sb_init_dio_done_wq+0x80/0x80 [ 2367.693127][T13730] ? ext4_dio_get_block_overwrite+0x110/0x110 [ 2367.699176][T13730] ? xas_load+0x46f/0x4c0 [ 2367.703492][T13730] ? down_write+0xd8/0x150 [ 2367.708065][T13730] ? up_read+0x10/0x10 [ 2367.712118][T13730] ? __ext4_journal_start_sb+0x3ad/0x420 [ 2367.717912][T13730] ? ext4_dio_get_block_overwrite+0x110/0x110 [ 2367.724099][T13730] ext4_direct_IO+0x1591/0x20f0 [ 2367.729022][T13730] ? ext4_releasepage+0x280/0x280 [ 2367.734161][T13730] ? invalidate_inode_pages2_range+0xc81/0xd50 [ 2367.740296][T13730] ? invalidate_mapping_pages+0x6d0/0x6d0 [ 2367.745996][T13730] ? __writepage+0xc0/0xc0 [ 2367.750437][T13730] ? do_futex+0x3c60/0x3c60 [ 2367.754964][T13730] ? filemap_check_errors+0xcf/0x110 [ 2367.760273][T13730] ? filemap_write_and_wait+0x430/0x430 [ 2367.765888][T13730] ? ktime_get_coarse_real_ts64+0xd9/0xf0 [ 2367.771646][T13730] generic_file_direct_write+0x45b/0x6c0 [ 2367.777396][T13730] ? pagecache_write_end+0xa0/0xa0 [ 2367.782487][T13730] ? file_update_time+0x2cf/0x3d0 [ 2367.787493][T13730] ? file_remove_privs+0x600/0x600 [ 2367.792630][T13730] ? down_write_trylock+0xd8/0x150 [ 2367.797744][T13730] __generic_file_write_iter+0x27a/0x460 [ 2367.803470][T13730] ext4_file_write_iter+0x9d0/0x1250 [ 2367.808737][T13730] ? __kasan_slab_free+0x168/0x220 [ 2367.813872][T13730] ? slab_free_freelist_hook+0xd0/0x150 [ 2367.819399][T13730] ? kmem_cache_free+0xac/0x5c0 [ 2367.824323][T13730] ? ext4_file_read_iter+0x140/0x140 [ 2367.829590][T13730] ? _raw_spin_lock_irqsave+0xda/0x1c0 [ 2367.835032][T13730] ? perf_lock_task_context+0x570/0x570 [ 2367.840607][T13730] ? iov_iter_init+0x83/0x160 [ 2367.845266][T13730] __vfs_write+0x579/0x700 [ 2367.849757][T13730] ? __kernel_write+0x340/0x340 [ 2367.854591][T13730] ? fsnotify+0x13a0/0x1460 [ 2367.859297][T13730] ? avc_policy_seqno+0x17/0x70 [ 2367.864257][T13730] ? security_file_permission+0x128/0x300 [ 2367.870085][T13730] vfs_write+0x217/0x4f0 [ 2367.874392][T13730] ksys_write+0x168/0x2a0 [ 2367.878804][T13730] ? __ia32_sys_read+0x80/0x80 [ 2367.883765][T13730] do_syscall_64+0xcb/0x150 [ 2367.888253][T13730] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2367.894128][T13730] RIP: 0033:0x45de59 [ 2367.898048][T13730] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2367.917895][T13730] RSP: 002b:00007f216c867c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2367.926420][T13730] RAX: ffffffffffffffda RBX: 000000000003aa80 RCX: 000000000045de59 [ 2367.934513][T13730] RDX: 0000000008800000 RSI: 0000000020000200 RDI: 0000000000000005 [ 2367.942559][T13730] RBP: 000000000118bf60 R08: 0000000000000000 R09: 0000000000000000 [ 2367.950647][T13730] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118bf2c [ 2367.958695][T13730] R13: 00007ffffdaeb53f R14: 00007f216c8689c0 R15: 000000000118bf2c [ 2367.976907][T13730] Mem-Info: [ 2367.983582][T13730] active_anon:1407021 inactive_anon:4737 isolated_anon:0 [ 2367.983582][T13730] active_file:795 inactive_file:882 isolated_file:0 [ 2367.983582][T13730] unevictable:0 dirty:8 writeback:1 unstable:0 [ 2367.983582][T13730] slab_reclaimable:9573 slab_unreclaimable:97141 [ 2367.983582][T13730] mapped:56839 shmem:4835 pagetables:31523 bounce:0 [ 2367.983582][T13730] free:11565 free_pcp:538 free_cma:0 [ 2368.044206][T13690] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2368.051661][T13690] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2368.078378][T10330] kworker/0:0: page allocation failure: order:4, mode:0x40cc0(GFP_KERNEL|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0 [ 2368.107270][T10330] CPU: 0 PID: 10330 Comm: kworker/0:0 Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2368.117272][T10330] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2368.123112][T13730] Node 0 active_anon:5628084kB inactive_anon:18948kB active_file:1732kB inactive_file:1772kB unevictable:0kB isolated(anon):0kB isolated(file):176kB mapped:226156kB dirty:132kB writeback:4kB shmem:19340kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2368.127491][T10330] Workqueue: usb_hub_wq hub_event [ 2368.127496][T10330] Call Trace: [ 2368.127509][T10330] dump_stack+0x1b0/0x21e [ 2368.127521][T10330] ? devkmsg_release+0x11c/0x11c [ 2368.172331][T10330] ? show_regs_print_info+0x12/0x12 [ 2368.177527][T10330] warn_alloc+0x1ee/0x340 [ 2368.181855][T10330] ? zone_watermark_ok_safe+0x420/0x420 [ 2368.187399][T10330] __alloc_pages_slowpath+0x1c98/0x1cb0 [ 2368.188689][T13730] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2368.193027][T10330] ? process_one_work+0x777/0xf90 [ 2368.193041][T10330] ? get_page_from_freelist+0x7c0/0x7c0 [ 2368.229556][T10330] ? __zone_watermark_ok+0x91/0x280 [ 2368.234752][T10330] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2368.240305][T10330] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2368.245863][T10330] ? usb_anchor_empty+0x40/0x40 [ 2368.250709][T10330] ? setup_fault_attr+0x2b0/0x2b0 [ 2368.252807][T13730] lowmem_reserve[]: 0 2912 6416 6416 [ 2368.255726][T10330] ? wait_for_common+0x486/0x570 [ 2368.255734][T10330] kmalloc_order_trace+0x2a/0xf0 [ 2368.255744][T10330] __kmalloc+0x268/0x2c0 [ 2368.255753][T10330] usb_get_configuration+0x326/0x4920 [ 2368.255764][T10330] ? _raw_spin_lock_irqsave+0xda/0x1c0 [ 2368.264414][T13730] DMA32 free:20000kB min:4644kB low:7624kB high:10604kB active_anon:2905236kB inactive_anon:8212kB active_file:772kB inactive_file:1192kB unevictable:0kB writepending:28kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:2336kB pagetables:2000kB bounce:0kB free_pcp:2116kB local_pcp:1360kB free_cma:0kB [ 2368.266073][T10330] ? slab_free_freelist_hook+0xd0/0x150 [ 2368.266087][T10330] ? trace_rpm_return_int_rcuidle+0x23/0x1d0 [ 2368.273233][T13730] lowmem_reserve[]: 0 0 3504 3504 [ 2368.275236][T10330] ? rpm_resume+0xa29/0x19b0 [ 2368.275253][T10330] ? usb_destroy_configuration+0x580/0x580 [ 2368.275264][T10330] ? _raw_spin_lock_irq+0xa2/0x180 [ 2368.282945][T13730] Normal free:11824kB min:17880kB low:21468kB high:25056kB active_anon:2722496kB inactive_anon:10736kB active_file:980kB inactive_file:532kB unevictable:0kB writepending:8kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35264kB pagetables:124092kB bounce:0kB free_pcp:1500kB local_pcp:176kB free_cma:0kB [ 2368.286071][T10330] ? _raw_spin_lock_irqsave+0x1c0/0x1c0 [ 2368.286081][T10330] ? pm_runtime_forbid+0xa7/0xf0 [ 2368.286093][T10330] usb_new_device+0x155/0x1710 [ 2368.351805][T13730] lowmem_reserve[]: 0 0 0 0 [ 2368.377957][T10330] ? hub_port_init+0x1e9e/0x30e0 [ 2368.377966][T10330] ? _raw_spin_lock_irq+0xa2/0x180 [ 2368.377972][T10330] ? usb_disconnect+0x880/0x880 [ 2368.377979][T10330] hub_event+0x2a5b/0x4d50 [ 2368.377990][T10330] ? led_work+0x530/0x530 [ 2368.377998][T10330] ? gc_worker+0xf10/0x1000 [ 2368.378003][T10330] ? _raw_spin_lock+0x170/0x170 [ 2368.378010][T10330] ? _raw_spin_lock_irq+0xa2/0x180 [ 2368.378017][T10330] ? read_word_at_a_time+0xe/0x20 [ 2368.378024][T10330] ? strscpy+0xa6/0x260 [ 2368.378032][T10330] process_one_work+0x777/0xf90 [ 2368.378041][T10330] worker_thread+0xa8f/0x1430 [ 2368.378050][T10330] kthread+0x317/0x340 [ 2368.378056][T10330] ? process_one_work+0xf90/0xf90 [ 2368.378063][T10330] ? kthread_destroy_worker+0x270/0x270 [ 2368.378070][T10330] ret_from_fork+0x1f/0x30 [ 2368.389467][T28562] usb 1-1: out of memory [ 2368.479918][T13730] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2368.494254][T13730] DMA32: 294*4kB (UME) 88*8kB (UMH) 48*16kB (UMEH) 20*32kB (UMH) 10*64kB (UEH) 16*128kB (UMEH) 9*256kB (UMEH) 6*512kB (UM) 3*1024kB (ME) 1*2048kB (M) 1*4096kB (M) = 20568kB [ 2368.512278][T13730] Normal: 796*4kB (UME) 130*8kB (UME) 274*16kB (UMEH) 96*32kB (UMEH) 8*64kB (UME) 1*128kB (M) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 12320kB [ 2368.527538][T13730] 5395 total pagecache pages [ 2368.532367][T13730] 0 pages in swap cache [ 2368.537160][T28562] usb 1-1: can't read configurations, error -12 [ 2368.545034][T13730] Swap cache stats: add 0, delete 0, find 0/0 [ 2368.558244][T13730] Free swap = 0kB [ 2368.565786][T13730] Total swap = 0kB [ 2368.569795][T13730] 1965979 pages RAM [ 2368.574134][T13730] 0 pages HighMem/MovableOnly [ 2368.578943][T13730] 318041 pages reserved [ 2368.583244][T13730] 0 pages cma reserved [ 2368.587619][T13730] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.3,pid=24074,uid=0 [ 2368.602224][T13730] Out of memory: Killed process 24074 (syz-executor.3) total-vm:85484kB, anon-rss:15988kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:164kB oom_score_adj:1000 [ 2368.621053][ T23] oom_reaper: reaped process 24074 (syz-executor.3), now anon-rss:0kB, file-rss:34816kB, shmem-rss:0kB [ 2368.645273][T10330] Mem-Info: [ 2368.648444][T10330] active_anon:1405505 inactive_anon:4737 isolated_anon:0 [ 2368.648444][T10330] active_file:248 inactive_file:249 isolated_file:17 [ 2368.648444][T10330] unevictable:0 dirty:35 writeback:0 unstable:0 [ 2368.648444][T10330] slab_reclaimable:9573 slab_unreclaimable:97141 [ 2368.648444][T10330] mapped:56045 shmem:4835 pagetables:31526 bounce:0 [ 2368.648444][T10330] free:13836 free_pcp:886 free_cma:0 [ 2368.703863][T28562] usb 1-1: new high-speed USB device number 82 using dummy_hcd [ 2368.720479][ T133] systemd-journal invoked oom-killer: gfp_mask=0x40cc0(GFP_KERNEL|__GFP_COMP), order=1, oom_score_adj=0 [ 2368.731690][T10330] Node 0 active_anon:5622020kB inactive_anon:18948kB active_file:1292kB inactive_file:1540kB unevictable:0kB isolated(anon):0kB isolated(file):196kB mapped:224680kB dirty:40kB writeback:0kB shmem:19340kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2368.756446][ T133] CPU: 0 PID: 133 Comm: systemd-journal Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2368.766511][ T133] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2368.776559][ T133] Call Trace: [ 2368.779844][ T133] dump_stack+0x1b0/0x21e [ 2368.784280][ T133] ? devkmsg_release+0x11c/0x11c [ 2368.789234][ T133] ? ___ratelimit+0x3bf/0x560 [ 2368.793990][ T133] ? show_regs_print_info+0x12/0x12 [ 2368.799288][ T133] ? _raw_spin_lock+0xa1/0x170 [ 2368.804174][ T133] ? radix_tree_cpu_dead+0x160/0x160 [ 2368.809462][ T133] dump_header+0xdb/0x700 [ 2368.813954][ T133] oom_kill_process+0xd3/0x280 [ 2368.818715][ T133] out_of_memory+0x5b6/0x890 [ 2368.823316][ T133] ? unregister_oom_notifier+0x20/0x20 [ 2368.828888][ T133] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2368.834560][ T133] ? get_page_from_freelist+0x7c0/0x7c0 [ 2368.840243][ T133] ? __zone_watermark_ok+0x91/0x280 [ 2368.845434][ T133] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2368.850854][ T133] ? do_syscall_64+0xcb/0x150 [ 2368.855538][ T133] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2368.861080][ T133] ? filename_lookup+0x4e6/0x6c0 [ 2368.866096][ T133] ? __secure_computing+0x250/0x250 [ 2368.871285][ T133] alloc_slab_page+0x3a/0x390 [ 2368.873987][T13736] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2368.875961][ T133] new_slab+0x408/0x450 [ 2368.887650][ T133] ___slab_alloc+0x2e0/0x450 [ 2368.892362][ T133] ? slab_free_freelist_hook+0xd0/0x150 [ 2368.897912][ T133] ? getname_flags+0xb8/0x610 [ 2368.902730][ T133] ? getname_flags+0xb8/0x610 [ 2368.907673][ T133] kmem_cache_alloc+0x230/0x250 [ 2368.912666][ T133] ? __secure_computing+0x1b6/0x250 [ 2368.917863][ T133] getname_flags+0xb8/0x610 [ 2368.922363][ T133] do_mkdirat+0x8f/0x320 [ 2368.926591][ T133] ? vfs_mkdir+0x5f0/0x5f0 [ 2368.931152][ T133] do_syscall_64+0xcb/0x150 [ 2368.935639][ T133] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2368.941657][ T133] RIP: 0033:0x7fa0c7e2b687 [ 2368.946189][ T133] Code: 00 b8 ff ff ff ff c3 0f 1f 40 00 48 8b 05 09 d8 2b 00 64 c7 00 5f 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e1 d7 2b 00 f7 d8 64 89 01 48 [ 2368.965951][ T133] RSP: 002b:00007fff5426e4d8 EFLAGS: 00000293 ORIG_RAX: 0000000000000053 [ 2368.974579][ T133] RAX: ffffffffffffffda RBX: 00007fff542713f0 RCX: 00007fa0c7e2b687 [ 2368.982596][ T133] RDX: 00007fa0c889ca00 RSI: 00000000000001ed RDI: 000055e5076e68c0 [ 2368.990552][ T133] RBP: 00007fff5426e510 R08: 0000000000000000 R09: 0000000000000000 [ 2368.998947][ T133] R10: 0000000000000069 R11: 0000000000000293 R12: 0000000000000000 [ 2369.007172][ T133] R13: 0000000000000000 R14: 00007fff542713f0 R15: 00007fff5426ea00 [ 2369.016396][T10330] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2369.042680][T10330] lowmem_reserve[]: 0 2912 6416 6416 [ 2369.048190][T10330] DMA32 free:21072kB min:4644kB low:7624kB high:10604kB active_anon:2905320kB inactive_anon:8212kB active_file:224kB inactive_file:468kB unevictable:0kB writepending:24kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:2336kB pagetables:2012kB bounce:0kB free_pcp:2596kB local_pcp:1252kB free_cma:0kB [ 2369.056140][ T133] Mem-Info: [ 2369.081097][T10330] lowmem_reserve[]: 0 0 3504 3504 [ 2369.086179][ T133] active_anon:1405530 inactive_anon:4737 isolated_anon:0 [ 2369.086179][ T133] active_file:663 inactive_file:358 isolated_file:15 [ 2369.086179][ T133] unevictable:0 dirty:10 writeback:0 unstable:0 [ 2369.086179][ T133] slab_reclaimable:9573 slab_unreclaimable:97068 [ 2369.086179][ T133] mapped:56070 shmem:4835 pagetables:31487 bounce:0 [ 2369.086179][ T133] free:13376 free_pcp:820 free_cma:0 [ 2369.086895][T10330] Normal free:16764kB min:5592kB low:9180kB high:12768kB active_anon:2716512kB inactive_anon:10736kB active_file:2612kB inactive_file:1208kB unevictable:0kB writepending:16kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35328kB pagetables:123936kB bounce:0kB free_pcp:620kB local_pcp:256kB free_cma:0kB [ 2369.156198][T10330] lowmem_reserve[]: 0 0 0 0 [ 2369.160887][T10330] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2369.163743][ C1] usblp0: nonzero read bulk status received: -71 [ 2369.174583][T10330] DMA32: 313*4kB (UME) 94*8kB (UMH) 57*16kB (UMEH) 25*32kB (UMH) 9*64kB (UEH) 19*128kB (UMEH) 9*256kB (UMEH) 6*512kB (UM) 3*1024kB (ME) 1*2048kB (M) 1*4096kB (M) = 21316kB [ 2369.181014][ T133] Node 0 active_anon:5622120kB inactive_anon:18948kB active_file:2652kB inactive_file:1432kB unevictable:0kB isolated(anon):0kB isolated(file):60kB mapped:224280kB dirty:40kB writeback:0kB shmem:19340kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2369.198172][T28562] usb 1-1: Using ep0 maxpacket: 8 [ 2369.223138][ T133] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2369.228494][T10330] Normal: 161*4kB (UME) 51*8kB (UE) 212*16kB (UEH) 83*32kB (UMEH) 58*64kB (UME) 43*128kB (M) 0*256kB 1*512kB (M) 0*1024kB 0*2048kB 0*4096kB = 16828kB [ 2369.254415][ T133] lowmem_reserve[]: 0 2912 6416 6416 [ 2369.269622][T10330] 5897 total pagecache pages [ 2369.275023][ T133] DMA32 free:21252kB min:4644kB low:7624kB high:10604kB active_anon:2905332kB inactive_anon:8212kB active_file:64kB inactive_file:172kB unevictable:0kB writepending:0kB present:3129332kB managed:2986920kB mlocked:0kB kernel_stack:2304kB pagetables:1992kB bounce:0kB free_pcp:2660kB local_pcp:1344kB free_cma:0kB [ 2369.279618][T10330] 0 pages in swap cache [ 2369.313366][T10330] Swap cache stats: add 0, delete 0, find 0/0 [ 2369.319853][T10330] Free swap = 0kB [ 2369.319885][ T133] lowmem_reserve[]: 0 0 3504 3504 [ 2369.324045][T10330] Total swap = 0kB [ 2369.329557][ T133] Normal free:16764kB min:5592kB low:9180kB high:12768kB active_anon:2716432kB inactive_anon:10736kB active_file:2672kB inactive_file:1272kB unevictable:0kB writepending:36kB present:4718592kB managed:3588928kB mlocked:0kB kernel_stack:35360kB pagetables:123956kB bounce:0kB free_pcp:596kB local_pcp:340kB free_cma:0kB [ 2369.332837][T10330] 1965979 pages RAM [ 2369.332839][T10330] 0 pages HighMem/MovableOnly [ 2369.332842][T10330] 318041 pages reserved [ 2369.332844][T10330] 0 pages cma reserved [ 2369.332862][T10330] usb 4-1: out of memory [ 2369.332870][T10330] usb 4-1: can't read configurations, error -12 [ 2369.391919][ T133] lowmem_reserve[]: 0 0 0 0 [ 2369.396620][ T133] DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB [ 2369.403821][T28562] usb 1-1: config index 0 descriptor too short (expected 65316, got 36) [ 2369.410445][ T133] DMA32: 524*4kB (UME) 127*8kB (UMH) 62*16kB (UMEH) 25*32kB (UMH) 11*64kB (UMEH) 19*128kB (UMEH) 9*256kB (UMEH) 6*512kB (UM) 3*1024kB (ME) 1*2048kB (M) 1*4096kB (M) = 22632kB [ 2369.419065][T28562] usb 1-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2369.436627][ T133] Normal: 192*4kB (UE) 52*8kB (UME) 212*16kB (UEH) 81*32kB (UMEH) 55*64kB (UME) 43*128kB (M) 0*256kB 1*512kB (M) 0*1024kB 0*2048kB 0*4096kB = 16704kB [ 2369.457358][T28562] usb 1-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 2369.470513][T28562] usb 1-1: config 5 has 0 interfaces, different from the descriptor's value: 255 [ 2369.478333][ T133] 6269 total pagecache pages [ 2369.483735][T10330] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 2369.485138][ T133] 0 pages in swap cache [ 2369.497670][ T133] Swap cache stats: add 0, delete 0, find 0/0 [ 2369.505235][ T133] Free swap = 0kB [ 2369.509036][ T133] Total swap = 0kB [ 2369.516265][ T133] 1965979 pages RAM [ 2369.520273][ T133] 0 pages HighMem/MovableOnly [ 2369.525249][ T133] 318041 pages reserved [ 2369.529480][ T133] 0 pages cma reserved [ 2369.533599][ T133] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/,task=syz-executor.0,pid=19800,uid=0 [ 2369.548095][ T133] Out of memory: Killed process 19800 (syz-executor.0) total-vm:85484kB, anon-rss:15980kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:160kB oom_score_adj:1000 [ 2369.553880][T28562] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2369.574506][T28562] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2369.583296][T28562] usb 1-1: SerialNumber: syz [ 2369.723641][T10330] usb 4-1: Using ep0 maxpacket: 8 [ 2369.829903][T26029] usb 1-1: USB disconnect, device number 82 [ 2369.844088][T10330] usb 4-1: config index 0 descriptor too short (expected 65316, got 36) [ 2369.852842][T10330] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2369.864172][T10330] usb 4-1: config 0 has no interfaces? [ 2369.943686][T10330] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2369.953374][T10330] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2369.962609][T10330] usb 4-1: config 0 descriptor?? [ 2369.983682][T10330] usb 4-1: can't set config #0, error -71 [ 2369.993291][T10330] usb 4-1: USB disconnect, device number 51 12:53:51 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x20400e00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:51 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:53:51 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ff"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:51 executing program 5: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x0, 0x0, 0x0, 0x8}, 0x0) socket$inet6(0xa, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003200), 0x0, 0x2022, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r3 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x1, 0x3ff, 0x3}, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCSBRK(r1, 0x5427) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r3, 0x0, 0x0}, 0x20) r4 = perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x0, 0x5}, 0x800, 0x0, 0x0, 0x0, 0x0, 0x800, 0x4000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) readv(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000002f00)=ANY=[@ANYBLOB="922af06b436af5e58fff696bcac80393957d1b449d9d3e2490f64c33523899aa44fd7b9403302f150471b51eebc7a1d06fa1e7b727d3edd87ac661fe51a157edf6b3ee4903cc4257d012e447b79005b266b5642901fd26f9b301bf7754865207b0f538e6fbff71994097813d790d40f635fed9af8ffb5b7dfe8b1c5e8c78f494addd0d4dc32794501569f0f1e6d6ff3cccff2fa75b7971367f3b1ae5a275170299ca63dbebd94db19926a06fb8f3c3deb48d5d090d8177c7d66d84d0b29db788befcdbf990fa8961fd2408b1f6d646615ac6e95cd92a66f9b3b80e54817abe1fe0c8c706096d7c0f056e0701525c13cb96264e9d1fd8949695262ccd2c36e65e96e882068e68ab761e8e19b325ce09e5c4e258c2d32f9358743de213d29da8ad414c18c3be0df9597365d5dc973c4ce99b42b841aa6f12ac72d5ee8c3513d7d3df434bfc44ecf7aa2feaf21f64f6806a118314e27005c84701b1b5d6b673f27eb7c7a0e3d7e65f18e013dc7399112c2d9c8d71ccf612", @ANYRES16=0x0, @ANYBLOB="01002dbd7000fddbdf2501000000140002007767320000000000000000000000000008000500000000000800070007000000080005000000000008000100", @ANYRESHEX=r4, @ANYRES32], 0x508}, 0x1, 0x0, 0x0, 0x4040815}, 0x20040810) clone(0x50000103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000140)='./file1\x00', 0xfffffffe, 0x3, &(0x7f0000000680)=[{&(0x7f0000000180)="44ed84a9e88d5fc7070051f5dcbbcf4cb83a28b1f0aea0432900000000", 0x1d, 0x49}, {&(0x7f0000000440)="9068a8caa0503c345b7d705f476612f653eab917eb74dff6989de4284c89bfb80c0c69149f8a79282f76c39fbe6b52f3f14c0d3a1cde6b8fdca295df0624634dee9bb069d323ad35cb3957fd2863a21bfab5c012d1e999f81f3a1cb9e06c4d91c916258a6dc406955349dab068fb74c98dc05f7384206465ee50cf1a6ffb2b89ebcd55fd111d712deb05cac224c872a115c114e28ba8617650a1837d4d3acdcbdb972ed11b531031a348bdec17291ff9c2241158079c415b42a1ff27ebe1d9c657e2d9186019c285463b4f8e96017d374e6e019ce020a2d1", 0xd8, 0xca}, {&(0x7f0000001f00)="6e76efaebe66d3a9be1f0464d9303a940fbc52b84cf44e540fe33a2dc5202d28ae841fe8aa060f488e25b32518f34664095d3c777e5e89f78311c174b05703dd29e9f5e4eaa48751110f1aa787a4a45a81236bad69ee551409c37438e50bc1ace50febefa93b749d5d1a5db673a934ff8b523928d0ffa7c6c5c2b8fa4c6b5312d1fb216d98d3f5d249a0166c987ba11343d5456a368c0c9ec1c6eab6d603751be9d42a09ab6f0184c6e565af9527f9b521b4b494f9a077bc53b041e0b2e225c6e4cafaa76d00244a7f34dbf28b1de19e783fdb13686cd4f0b041175f7cfffb90ff71faf34a548305b2b3ab9ac0d066fcf335642b38eda2c89238937a8eacac21408e6693618ab45564cd0db9ea63ad5c4a452c62a13d1d9b4aa1f6ebc4f1104e71825564e47a90dcc6dcda4d524c93645857760f7f17c6997526d68e05796b9512a1791307787915c75d75dd1a925ec567aea65e919aafa496ff94c39015036b745375608a25bda1cd43ec252894ac05d598bb184f62ce3ed385a7349d4c3a9da855f38964045b243625091f0d43bf3dcbe9e6964d8e6b92b672eda02b5187ad7c5874cfe35ebb826260845508caf5c12924f008743b4ba41aa6eb8a13e31694668a87d8412f6bb01350d9a582cdddda86f69ce440661f5e673814483f1ce7f7c303ada019fdbf1dcb61aa12d4458cbcf072f61b58af43d4d5cc22a7c54abb3352f146829d65d8a893545c5cec30c16d3523190ef4d7db55d8e21b4887b53f458b1b608073d2e0655936b9200abdb4355fc98af2a63fbd32dbedc7bb2719a4763d71b890d2055e02e903bdd70b3cc7da96ae8199b5d8c864b37b7f9289c627cd3b575d65c465446dc39a636df4cbaa1227c70bc254d879cd850870b14655bc5a89f580661e5faa5c6386abc028e4b044fae4cd72e7eefcde36f799ba761020e927c1cdd03ad4e07da2d0197544cfab09d1e705debd3873c545d7986a61ca76dbd115139943e9d8a9bf775c5f3447e2a2e69fb257d7e9f53173cc4b2511d6dfaed5a86434b7353869ff7da4adc3e1302bcd086de32d259c80e3b51780164a6176901a7ca28a59340ab93b7cb8cebeffdde70785402214212c59d5350f3f11f6a53830ca870e19215a89b4d5a6666854b884672ec9ec47c290a77096351f054eb3a65abcd44729456fe58788888c8d1598aca29cf17d74cef03b7d7d4c84b75d0868fd42e2246a2e2d32c13569f63723721268b9ffa2e1018e0fba86285e04191b957d2bef3ce5b43fa95f55c3fed9ba15b2ff04007ee5f920833a15b0399479c2e573f7d4ea6004c33cacd4b44dd5d58898cd1f5f6bea78767c3694aa8a473b205d47478f037bda400832fcc1fe0dcf4b738d2d63fc1127ac2f67abfaab6ee48bf8da28175c320e2c567deb5869d014ab97bc3eb1c323c8eedbec1ed0fe4b8fac8341d85141e8a7fee1680b204b0c0b8a9a8023f0ddd6fe4eb0a5c58f9be55265676fdfc7708ec5357c327ab7dc1cec7d9cd5140aed2e7789939efc14c34d6018bb310847c6ac648df251836a7babc13e269d7514848afd1a3b082e4dd247c0678af2243a57561d614597da6a7c4625932b810b36baffbf06104d09bc1f357cae8d73e82cd282465ac5c8da90e5123979e5206fd12ff9178f2d701b7cdca250f8866a8fd605dce8e223411120ed006f1071660dadadb3c5b73fbb3e5e7b74a211dff533e3c5af573c11e0a38875355a62e869099c677d485f4879e34317bb685840f4f34cc3a76e8b32da27d4de5cb2de6fc54c100658114424f03761698ab93b6c658c7985a3a06abff56162a0aa55619388209689b4aeedd67ad26ceac1e7dd9fae1a66dab580bdc50c05f9d77e8739051ac6b7b165bf3902c7588b8ebccbc126010acb3f26977706384bc0f6f3782d202815356c632d48430ad19ab4dc215158a23f006eb894b755b8c0fc0cd224a76e0f33474f798276367aa6197c72ec5ec3f5091a4fdc5a49bae5f3702473ed0116bc3cd5749413edca5bfdfa9533c6e0d3a2f5b6fb7469fd16b6f9a709f13afc9b235c0d4bd3cd235fa18d96d84b08d70db3493118dbe0f778752534959ee6b47a99f4d5c5c63e66f69708028d8e51efe0145945811cbdf1bf9e3de21cd1d11a5745f47132bcc7f1c5478b6069581e9752679a37710a1c4df0f8a584373f1251098cc5f863fe1a1da1549feca9dbcab2a8db18241164f5b71fd33bd17ab90d5b6bcd1116780261af257106b168bc097f142e3222e9bf9216b7ee20c15ba267637d65b2cdee081573642508490b859ffb6ff97a561e14620eb04e2a1da6c067bcd27c931cd76d06445d1b475ce25f388c164ed7a3d614afffa8b132833668f08833d700f648c765ede7b7fab7bd858ba8331e030281d922063f4ec679a55772ed7e48b77941f98fa5054504cbefca59c4efc05db364683512bb390b09dcfdde335919e90331d7e2f04582314469114c742763c6c6580b20032ed128ee15c708360f4fe5883f99aceb62da1a19846dca5785e71cfa4e1a9eea33d7687860d86890fe5f1548ea36c25c092e5720f9d950f2473c708aa7bb3b2cfd44dd1521043eb21cb17780a159c33d300316528de3124e4f5f1ad4bde78d94894c45e50d1a9b7945613e397bfb03b607ee50894b15ded4c80ade38718f72d469c687a9f361e633848f8f030bcc01388883bb14de8e9e066aece36dd2572bcc5163151fdb69993da7dd058809964eb1c6003cc03f0229168a3da3401ce03f6c263277f0aa36b2acd148537066ae21661011e87b55c7a9cb8fbe492631d5b1e45dc642109e1372c8d42307ac2de6df6c8c6253877cc85ba229623439df8c219dd639f256b75713633063383a5b6cf9eb5f2ccbbd22dba7dbd80406e1fda896c2a15c81240bbf69657be2f468cd1b3efe8cc06d40c469af764347912d23ca2e3ad12e63ecbee08dca8c3c123551e52231c306466aa472f31fc675f7f99c5e4b83dc6ee532245efd699443d14c9184d953dc14acaf3d2cb1ede1df98af449748f4afac7387c85e67e7608e0242378cac142909b23184be148e0e9db4a0680083210bc45535ceece90ad47c025b6f3406503d58147ddbe4e9ad6bd900ef489bad059fe7c19862a765a77b3c0b91483254a3912e7c83764a3222a64b9e7284c8bdd2b43a2e8e3cbd837b4723da2093381a0e00a522246fd6a08917acc6dec1dce6871dbee58af06d518f7929597d0144790955d0f0b0dc430046813466ba137e72393a26a6711594c826248f7e47da8c4d9c08a52770ee65845825d89558d1022df93898ca4a3ea29d09902d4bc20506bb73bc0372ccfe0b54b42e52036a4172e85002ecf45b31aca9036eacfd37934849ae5df6876aa0eeb68351b03d1f672f6f0c2b448d0d87a6bcb04df72882e506f3512206cc6d601950ae24d018aafe72b8aa58061ed435c3713040861d55fa2c3eb4242116e318e03a3869ee51c043fdc8909c833d2297775e2e0eaa137cea4c51b4f4ef700dad407b2eb15a757c20bb06bd6918d76fe45d7db7b2354faa3e86004556704e0c1ddbc4ee672a90ad77bf046c7215c4fd8d081447661c35cf740f8dac88597f258c1984dbcc1d69765d40b0a03bcdc19ae68ff0d28ed5a4cc6835e5824a22a2fc38be5f58e46db5af1d8c71ab624ab5c684612d597b2d85c33fb06fba5b8c2047139945c66cc4672b4e27a492adaf5a2a24116e8518668d5fd63b5d487dceaa1737d9878108758efbdf290beb0adf1b92290953316545180b3ba62efbcd98855176371c00f7de244c4d1441c57f86f28b4dede4ddea3605698f20a47cb09f70c24729e237a5377fbab445af1a2209543a411649ce7c3a3be2441c50a5a549327b4f4965400ea6595713334000606876396b1428dbbcb49dac09cdcf2fc61c4a5c2df8ec8b5466d6b7aac1a70c09aca51cf906e5986a6a8600e17e0f41c58692a0e276b68021670b7d6b21152d944af1e1ccf2c1ff18d7aeb2a8b1e442ceb85038e519b1961d2d472995250799bc78b1deb9bc39a67bbf8d49e8389a7150846e259c24ea4405420b469f25388c79411610b56528bef0c541686fc830f9629d5f366e2458f0b97f20a1dd4974976e233fbfab0000ab1186bd68882dc6139032500af8ae62780afb9ee90e69a0669498e3c3f41440ac2d42a12a520988fdc8f252f196a2a21230eda147dc7871a668a5fba26ef12c51e4a36e1202fef40d11a973f428f8999b7fb95aa312b4287bea3257b9210cf9b23736293f5d078463062cd5d753bcc24cabd55e9b1ec1772836e5f17f209e282c1171bcd0e4e975cb2d208fbefd333e4e87bb2ac9fdaa0eacc402a9291841a5c42a34e3f6c9bcd6091c05589e224721735a8e54cf6daf6f4d5aa627359562d063cc6dd885af966b5d090b85ceba7daaa1d00c6c0508eca50d861582fb2eb06c50613a1280562cd2c1e5f866a3293940f5dc5a3c9ea920696cc6243845c55ef6e6c55d4b89d6c2ccbeba101f777e0a58e419c736dbf4fad8285d46f8d56b2508dea68fbede9a7d23fcf2b4e0f65d39daad71946ef051f69b35ad231c77020527bb79bd4c78823ac0ee7512bc337cf67334c7739e4e3c0ee9feed2c3c9dfe7c2affe198c5954940b0f5146f84cdf03e0cf0915c8276539ecd04e9f9b823c43799ad83b13feebcc23e28c8a6a738a802d6ce64912b7016930398d5825ad1d44702ba89c39d6fe54e4fb3f5f67ef9737d81b36b838bf72909bd3671933ec3b34a23de27f83b5e9d3ddf3669a503552e82ee24caa225834757a27509af287ed49f15140b560c4e83182e6a9419b66472e4308db86cb87da26b5a660bd6da3395ea3959cd8a0ce4508d623724165d1d5f77f514140c87e1afdd5c89366cefd834b7b0d3a3a6111e148f6b29adcc6c94fa556a0d21b1d55d04d2099d3d09c4955b86f8cb73b2fcddb981effed20c598a9b5bf5e03a995f2ac1f6d22f12b4d268337ca284bb84db267c022279303d37344c60f434fa7f81d4feeaa7448df83379e231eb3a333386d580dc9c95f63cea4ec5674aca9b24f81b662d69a6cec3491629d554bb71d3a32e6f0aa01441497683c96ee28274e466af230dca3ae64cb0a0066c30b9ea94c3e9fead6dc463476a927f7697cfb386945a1f1465151b5b2423f357af00968672096cbd23d095996e25b213ee9dd035200af992c4f26d3d43cea517a95bc29b63813a7875766b6475fc7ab65e94e8225a7a93c0dabdde4b4cf2802fdac182ec9237771a3b6694bc3aa956de5981df10ac190bb99df23e2fc89a4566a6cc4833322b8ad693ef96a4aceece9c7cd426af51a6fe22eeb6230b521fe99241ba3e862335ed8db48c40322c50728c61bb4cf15fd021552b80c02913a25a543f9bc3b95e1c5122e69af86eef91b3bdde5ccea123d8cb1b1149b813b3ed53ec23c388e89d7a55271cdfb98bf7c50d9c0a1b2e1022e03c58088d417ee674fff36dc31a397ab0f0d403dfaa6b1aa0de135dc2156c0b1788ccb256be1b6a2fc919231a81f374501d5e3d2dbbc393cd26ca251391c2f6889d7055f852f06a426cb5cd78606ea405594945bae9eb37b64c27cb14de4d928c8bf8afe70aaa2728479e94858c2380f7b772f64462e1a17a756e54a463a870d98e1a904516bd3b0f496cf364d8ec5f30323923310cf4943a7f76f45e3900b1d597e43d9fc570d742d908f6495f3293a233615a12cd8029b196dea756c7c567d2134a17ebf82f0b6008235f05625d1074608c7ed84c2cbe0df8c56260", 0x1000, 0xfffffffffffffffe}], 0x0, &(0x7f00000004c0)=ANY=[]) 12:53:51 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x10000, 0x200000) setsockopt$IP_VS_SO_SET_EDIT(r0, 0x0, 0x483, &(0x7f0000000040)={0x32, @remote, 0x4e24, 0x2, 'wlc\x00', 0x34, 0x6, 0x14}, 0x2c) r1 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2370.183708][T10441] usb 2-1: USB disconnect, device number 67 [ 2370.191174][T10441] usblp0: removed 12:53:52 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x7ffff000) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:52 executing program 0: r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_usb_connect$printer(0x2, 0x36, &(0x7f0000000000)=ANY=[], 0x0) ioctl$CHAR_RAW_ALIGNOFF(0xffffffffffffffff, 0x127a, &(0x7f0000000000)) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) 12:53:52 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2370.543499][T10330] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 2370.554050][T10441] usb 2-1: new high-speed USB device number 68 using dummy_hcd 12:53:52 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0xffffffff000) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:52 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2370.713490][T28562] usb 1-1: new full-speed USB device number 83 using dummy_hcd [ 2370.783429][T10330] usb 4-1: Using ep0 maxpacket: 8 [ 2370.793551][T10441] usb 2-1: Using ep0 maxpacket: 8 [ 2370.913517][T10441] usb 2-1: config index 0 descriptor too short (expected 65316, got 36) [ 2370.922139][T10441] usb 2-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2370.931610][T10330] usb 4-1: config index 0 descriptor too short (expected 65316, got 36) [ 2370.940069][T10441] usb 2-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2370.949695][T10330] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2370.960311][T10441] usb 2-1: config 5 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 [ 2370.971833][T10330] usb 4-1: config 0 has no interfaces? [ 2370.977740][T10441] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2370.988022][T28562] usb 1-1: device descriptor read/64, error 18 [ 2370.994291][T10441] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 65 [ 2371.004791][T10441] usb 2-1: config 5 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 2371.053481][T10330] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2371.062757][T10330] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2371.071336][T10330] usb 4-1: SerialNumber: syz [ 2371.076915][T10330] usb 4-1: config 0 descriptor?? [ 2371.093498][T10441] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 12:53:52 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x7fffffffffffffff) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:52 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2371.102602][T10441] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2371.111092][T10441] usb 2-1: SerialNumber: syz [ 2371.133384][T13756] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2371.140246][T13756] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2371.153755][T10441] hub 2-1:5.0: bad descriptor, ignoring hub [ 2371.159749][T10441] hub: probe of 2-1:5.0 failed with error -5 12:53:53 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x12, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2371.353729][T13756] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2371.363078][T13756] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2371.377053][T13755] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2371.389210][T26029] usb 4-1: USB disconnect, device number 52 [ 2371.393300][T28562] usb 1-1: device descriptor read/64, error 18 12:53:53 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x400c00) write$FUSE_NOTIFY_RETRIEVE(r1, &(0x7f0000000000)={0x30, 0x5, 0x0, {0x0, 0x5, 0xfff, 0x2d}}, 0x30) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2371.604510][T13756] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 2371.625341][T10441] usblp 2-1:5.0: usblp0: USB Bidirectional printer dev 68 if 0 alt 0 proto 3 vid 0x0525 pid 0xA4A8 [ 2371.673632][T28562] usb 1-1: new full-speed USB device number 84 using dummy_hcd [ 2371.681448][T10441] usb 2-1: USB disconnect, device number 68 [ 2371.690604][T10441] usblp0: removed 12:53:53 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:53:53 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x400c00) bpf$BPF_RAW_TRACEPOINT_OPEN_UNNAMED(0x11, &(0x7f0000000000)={0x0, r0}, 0x10) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 2371.943195][T28562] usb 1-1: device descriptor read/64, error 18 [ 2372.333104][T28562] usb 1-1: device descriptor read/64, error 18 [ 2372.403091][T26029] usb 2-1: new high-speed USB device number 69 using dummy_hcd [ 2372.453172][T28562] usb usb1-port1: attempt power cycle [ 2372.653065][T26029] usb 2-1: Using ep0 maxpacket: 8 [ 2372.773072][T26029] usb 2-1: config index 0 descriptor too short (expected 65316, got 36) [ 2372.781465][T26029] usb 2-1: config 5 has too many interfaces: 255, using maximum allowed: 32 [ 2372.790914][T26029] usb 2-1: config 5 has 1 interface, different from the descriptor's value: 255 [ 2372.800363][T26029] usb 2-1: config 5 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 [ 2372.811685][T26029] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2372.822008][T26029] usb 2-1: config 5 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 65 [ 2372.832234][T26029] usb 2-1: config 5 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 2372.923049][T26029] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.07 [ 2372.932557][T26029] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2372.941273][T26029] usb 2-1: SerialNumber: syz [ 2372.963055][T13838] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2372.969885][T13838] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 2372.983508][T26029] hub 2-1:5.0: bad descriptor, ignoring hub [ 2372.989513][T26029] hub: probe of 2-1:5.0 failed with error -5 12:53:54 executing program 1: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYRESDEC=0x0], 0x0) syz_usb_control_io(r0, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x80001d00c053) clock_gettime(0x1, &(0x7f0000000000)) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:54 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2373.184556][T28562] usb 1-1: new full-speed USB device number 85 using dummy_hcd [ 2373.193728][T26029] usblp: can't set desired altsetting 0 on interface 0 [ 2373.223299][T26029] usb 2-1: USB disconnect, device number 69 [ 2373.353049][T28562] usb 1-1: device descriptor read/8, error -61 12:53:55 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100)={0x0}, &(0x7f0000000180)=0xc) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x8000}, r1, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) getsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000040)=""/33, &(0x7f0000000080)=0x21) write$cgroup_int(r2, &(0x7f0000000200), 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000001c0)={0x0, 0x2, 0xfffffffffffffffb, 0x8}) write$cgroup_netprio_ifpriomap(r2, &(0x7f0000000000)={'veth1_to_batadv', 0x32, 0x33}, 0x12) 12:53:55 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) 12:53:55 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ff"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:53:55 executing program 5: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0xa) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) lseek(r0, 0x800002, 0x0) r1 = fsmount(r0, 0x1, 0x71) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000100)='nbd\x00') sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0), 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB="63933c1279e6ccbbe369294c436f20633b5c3b8c6de110d6c95627000000", @ANYRES16=r2, @ANYBLOB="20002cbd700000000000050000000c0003000100000000000000"], 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x2000c000) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r0, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000340)={&(0x7f0000000780)={0x128c, 0x0, 0x800, 0x70bd27, 0x25dfdbfe, {}, [@TIPC_NLA_PUBL={0x4c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7fff}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x1}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x401}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x2}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xb8ff}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x5}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x8}]}, @TIPC_NLA_MEDIA={0x14, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_SOCK={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8fe}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_NODE={0x1118, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x41, 0x4, {'gcm(aes)\x00', 0x19, "2a13be26267dd26da76bf8524a20a51cd4631d89bd812d6424"}}, @TIPC_NLA_NODE_KEY={0x42, 0x4, {'gcm(aes)\x00', 0x1a, "ac58f08b6dffe0ea3099ed01177592aa900d027b399bc4c778f8"}}, @TIPC_NLA_NODE_ID={0x1004, 0x3, "251374dc4f969b9e7564b02f22655e7f0ee85fa5101d177b05be810fbff15754e6cd647dba1872ee2a178e1d320cd4fefc6c3bc5a34be7514a8f47b686be8a4525203ed4d1dc5df6efbe3cbd49ea6ce2e989ad21e91c775361cb10d1e3b023d4b41753f1f67aca5373172ebd31c29338eb94444e5917d5c550cec6af990e649c7a85f6d571199bbf09b8c457ff914d89ac05a2894f4225abf82ec7ed13da20a9dad5a2533474da2565b32eeb1f2d2d29079a1d1ca6d068b84fcb25e82cbbb01512303eff12520ca8b4120406ad101b3d2c671bd13cfd75e96fea152fafd3fa37d5643aba659b572ba08b11af8ff6c145c772ff107d910dc9638b64969998d86a1c18b7fec913752ee160cf85f54095523bab7a2d4adcf803cdb5e1a2d11844d95d98d86e816e501a81685bc17b32141b4f21e9c8dbd76b6f817bb646c8479dc61c27b079f516de2463c38513716a27b391698f0d2cc189baa749c9b5218546a86f576bbdf7b3739edc3dada9fd21270b1fe1782a85510b353f950296a0c9915721f7b76e9dbaa71d816a9b82119ab492165f1155b631e958b84dbf43bce63023178af4927337cbb272974388dd98a91d2832e2d0730ef76ecabf3811cde47065c8cc80430ca46604c3e2e418fb5f10b93828837f2e918fbe814f2601991eb1b7930f13744908b68d3906ea6f8b629a4b1bb402e50e13c93d365299212190e6fb13c5d9956b63aeb87ba7a49390d901e47e6fb599c6817281175de248ba6f6aa91062d1f8ffb88364fc20ff0147eeeca7f7e755599be593a2cfe84bcf0d166cc1743fad56c7bcc29b086f7ccebc5af22dd31fa2ea14b9dd571d7706498eb68c4cc60645dea3c85ffe1e5778ec1b7f055590cefc7bda0f2f785c5d4d6d9a54750ed9845e3243f73f354ccdb334a274c78ec35dbc5ab9850cf1acc92122409ce0d9b25434e3321427d816f50b092e29c919adc4abdeafea8a2c7e82682638016c5d347b23d84b3d626b86f87c69d3601d5cfa0c1ad95ae16ab6d389917e2760fb8a3e2ffdf599c951987745a62592e7a85dbc359962b76fb4afbc01f4fe49ac0b7521bd073659e9392ff0653db94f4eb9ed9631e27f66d31cfd84a18fd04e40ef1314bc6ec7ebd32a27931b638f59d5ac97102c340ef674a2f34e114faed54226c10c31a1bbf4f310342ee197dac6cf5b343373502be8d48525266d06166694c50f468a1e6cfd8ae8bfb8ecfcfb892408c8f841338fba9bcb2db300fa4a04605963ed683c7eea2b29b0e1b81fc9a0af70c530c34d390aae67c1b103147c7c3f3be4b574d6b27098aa70b532dd938d674f7143426160a4bbcecf21e0ab2c8e74d138701881a3922289676a2c2b6647600c8c3eada6a92a5772a201888e1d3265b73f53b17bb89402ffeb216e0ba318dbf311ea5084b32682210ae63789630cc20bbfe8b1c70d9a82212646ff89d296f3c933a7038e7a45515703ee29760b9dbfb481ba1674ee24ccd7dfe068ba8b305ef9273c983c9c597b92ab76b91cfdae0a8d40a723a17d16ad02dbfa3880da10708e41750e17b0cebe304787c702b96badcb6ff90d09bb8e978d01cdcb0096f06778437efb24e5ee700b001c9b34b76bf4cd192aca3a32473effc74db2024239f108504a42c2d8637ecef9992c872cdf0c70e504de1a14f5cc4a6f312ed1d0d76e6d0e04585eeb6b4ef0c7e7bb7b6b4919b416788821052804b9ed279accc7ac93ca61066d945cb2c19be6c4b799c6babd6fe6119ddfeaa16a8cbf70b4bd3192faf37b9c100c353da1f4abb542904c3ff8b5a6661e33b6c74e5b3700f140b78cd5dbb884949077f825afa0a9af26c2d30351feafcbdcd9b7a7bdddfb6b92496bbb1baf8ed4f0cfd08e82ab6871e6e1ec2ce938563a8dd566aa1409f11ddfaee457684a75408658ecca5cbeddee37ca861be5afff7c45719a07ed21adc5815208259b61a0db8d6f8eaa9511a25c9c4fd7df7b8dffecc210b819979f1b7f2b8d8c178cdd455ed830a7e9324ed89d60d7845fb21482ebfdb7cb74b3fddb31074efc3b41a458550903e97bf271dd374537649c7db49922c55c75540ea8b3e4b7058f51e1ac58ac18dca1f4326ced22e4d02705f6b8ca42eb7e87dc727c9ee4803a762b829fa95ed6e999082b3ec384303971cddea9f073c27ccde811a9de92d51db48f6af8e8c87fd871951e7c18ab1ecf2c5e0d4cd106372399818c19ccd4156e22e0908fab557406302a4abe668a88c5ae23fa6f60098d85d1cf7aa4197415ffbddf3ed388daeeb45887b5fa407a81ec71ef1750fc3d4d21da0ef1a2bd67c0cdbd504f8db38df78ac3f10bdb4a23d01e11bca7557715c9b13b6689757a5ce8ccaed006b7263c891c8b4ac40e58387dd9981a583301e6dcefdea9c52c875978714712a02822999ccc75fcbc3ac4deea73fbc7aa3ab16210979a777dbf3cddce359fdddffbafbe07b4cc80542a43e89b22fa5c6a0c7793df601aa1bc801fef641dc12f5641fa8d1b4efd55d50ba926106046e610877dc373ccb6e3785d6c945507a8dfdce3024e5e2ecbbeaff96559fd1f3768a6e38109cea8dc2a834616e473cb63f6c014b96562e9e5346851d1669bd02b91c6a12c8b401670bdeaba7323bc1abfa29e977f6c3ecb26c57b2fe7a9c055f77385a4f1bc91b503b3bfb5eb81310ec14da79be48cb446468aae9a51e42993d10e4ffe588f67af3280cf0647dc6d3cda2d6c352a68e49a3fbe11f2e7603ed4f897095df2b311efc69f54b52c38e761300064cd73883ec8b93a68a31abe24ff8d2dc19fa5670a36d4621d69004630f29896284a163ed19f423088201cd92ca5141a6bdfe872cec0cd631f70aa6e76283a863ab06b4fc4864a4df0941d80c6e87d7443d82cf844e6c3b052b03db1740c9b888b69dc87c65d48a8545594b1ccbaa326937505c7aad482d96763dd1c5e8c701915ff8f9ae56f9c0f977068fbb59ad05aae8a57a5e4eac557b1073552a011fbae3170000374d91f9cfcad3fa35d2de89e4c8e0b41e90cb3376f59c1bdc775e5626c6e6c7194024b222fd76009515e6ccf9978a11cb04dc8d3a37a6f67524c74619efa54cd9597d97c3f3591cfa11b5fd59ccc3fb7edb66aba632b66fd5ffbb4366a9238e06869777b9a952fad2558504751610ac1a919d6abdd250adb8ce24fdcba752d9cf2ce28df3e688cd16541af40eba05fe0f00d06cba5027d05a6da761bd2911b728e5a0b917278a827480e4292b93b97473ea230107977ee95f10efb1d9c6672c9c5bae27feb178e272470d446c23ccbed1e61d4c568913363e76b98832243330d7c7755d704aa4c793e58e8db258c926efa0011588fb65fcd1877ca279ba91872f3e1409b635a2e46b2e7f80c35af3474d02bbc98f9684194ab060cc4814edd6a6fb5ca6231d5b2bedcfedd8b45ed773a19702dce6846bbd4d5b5552ce353de04059582302575e10a377dde3a03cb8594e30555c437b2594dea61befe6d1b397d83137ce5e94ad42752576f39db5c4ec9966b1c3631851661bbe6a5f8e336eebf08f0a385452f0a336f5df19edb1304944b244ef7e68544f90d3f6f1b751609447a2fcc18bd8d63bbd99e728078c4452d6155f960479eb19088790fa7602dc4d60ff8dd98b3943512947f3bbdbd42cd7dff9a1cffe8eb5ebf1abd06fd91d87b9d8d61925de5856a6008fb8603630bb602ce49da7547ae19c2a179df228c90dc57f4454d01edac3626b595eb0d00c8a25c58b791934ba00ca2534e6f83761236fbd118d411ed8e1a0e4e4f2ca03a8616883ef28e31c60ef1114b4d17f38bd4875daab680c53fd141716ea50f03b73af8c2eecaec33385bc7811c332c0fab03cffa6e02a251717656b67bd3ff0a8d785d238a364beb3eab089c9c37badba748cde2cce28d4c0e928f68c027b63f7185529e0cd0c44700b5965c7fe3bf909930e0992c25a18e2d7855e6156d140ce8b5cdf6fae4ea2f43248ac3b78dd5dc12b0a5ae97d8d193f5764bd6e9d9c060086aef6defe6a3babebd6fc1f4e45cf632eadec04b277a5b6775bcc300c9fef29ef1b86baa932d3860638a103b7e1758957f7d455cdadb4deef0d562d1e40b985e23d71afa2555c778db412835b1b38874729168163a367caadac73012289431bf4200555da6de3ca321f10179e7d34fe36e9492ff94ca92dc1288306a34293d7f1e43825ebc0f0f7c9f9e5ae839cdabadcfaceca32e664f8e66a27a68144062bedf779f252b9a9bbab30a01bd879780586be3cdd855997cc0f16ae49b7ac3ffc81f83e753f9b1f692ca66641d15549a924f8957338f00eabce1c0ced95d1ec25b1fc5c49f81e9d84186c64048d36b81272132500a76c9d379184bdd1a26c7b139617a3b19b40f02190cd807bd8ed1a397f729f75e936be9e9c8f1df1fe5823709367e2ae59a1e61e0ac6fc90270e57308a735339b76abeac5c41e63afadff901ddbadde9a563a22eba0815edbe08c6bc622f9e713d7bd095baeeed6a8706e71ca42ef9002333a1f68089ae1ee1925250a3bdf8eb6ef04c3c10d81fafdffeb365a997062dbda091240f6d42aa94957b6ce5b7538c7abbdfdbcb3c554f0d347cd73502c05a335c1b2f09a08f6c9d798b674f5da49b8fa3c882ad5c15951e928d1076ef321bf67865f8bb203b532b36d4ed4507d2e9dd3bff0c8d43bd40a2c190bd48a1278221fc238458462dc01066dc9c62b1933c741d35b4e973d411347ddf9fa8545bd875662087f82b4e814d5016ff90644461ea7001e94a974992f74ce4328e99536c722da6b9e802471c2de751c68e9d0aa5086284bd935938436167ccd28d69e2f1785a5ef0f5087d6f1858a1141c28944b76cea2f9937766a379b4195d6b590e9cdb6917bc7cb70e2ba0467a05ba9023bb87d8ea29524cb9aabec0cc316c3a68a22e32765274b1ebd79155881b6d7dfcc3cb627f7021658a60fb5e2b5d9a5766f5d1d7336d9fddbfa05a45cbb4005b8433fdab16c8db7cb1b1e5e0958f8754a37f09637dfaa1bd63b4124380c3f9b01f3b689f9637113e36ee95bf0ed6c18d2dbeaade33b8f662e230ed8d8c6da8176b6a6886f509ee8ffcaf141682ca83ecb3f5e61dd8d0e5999fac9aac73664dd521d1220d223fae9664f63d8d5ca8f7ded9740cf9e93e9fb0e91ae830e6092b241c8c5c80d974c5f4efecfe0a1d13b2dad6f2c3a5f6ad29f75db58a298a4ef5b27a8a6e1591f075b2da2fdb936c373bbfea3f8c76f033b713f34f9093fd88c00acef7c39a07b43b8aa8fc83d3c70d7dad4e7d5d7de6f4f04eece0b9060146b4cf64100ceceec2945afce6a78a5765c63b67a2376d81397847534869b21a8d8d38d89461a27cee4c7d4846b741526fd2f96bb767afa19752799b93543841393d8030026f45af8ed2b15d43b2c5b93a6b0feddcdbf9b3a5a463e8db74011be49e2509a87a7aa9fee55bb1ff755a54b17068619eb683a5feba7dec8a189f8dd21838783399bea0762d0b3eae3f17ccfa557ff128499805ed6fe9f9803d027a91b0cab8b6bffc0666824d018bec78ee3eaa52a64e88801531baf3b4f043caa67fd546174b1ff95ae010fe18823359b92293418aefe08ead8a1bb434277ff2930c9b7011d4bf9e604adb00b6ea9c74c68c22137741257a43efb682a6d6e3e59a45aa785256efd22b8a5e38825e5875d89ea097c0ec6a6bddd3db01ca153f48ae639e6a86ee60da6714b0eeeadd0c831f75d69bc5a40d896ee9a55aa8e88d21570d0ff6a4e39051d8f3e41c145a641079bd739"}, @TIPC_NLA_NODE_ID={0x85, 0x3, "440ce88fe993ad116a857d3b94f4b79e51b3ec4d439af6eb64c051aeb8fade839dca4fc1c35310e551cf49c6f49dd5c717b6c3fc26abe1f0526cbb781a707b9423390bf40f1cfdbc6aa64ab59c7efcf271b96c88f4f3be93c2ede795384f3a4fcd9748def0968e6864605bd1ec57d99f3b1b792d916c6953a6c894c0d68e8da408"}]}, @TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x6}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x5}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x59d6}]}, @TIPC_NLA_MEDIA={0x38, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7ff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x20}]}]}, @TIPC_NLA_MEDIA={0x98, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xcad}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x400}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfc4}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}]}]}]}, 0x128c}, 0x1, 0x0, 0x0, 0x20040002}, 0x4001) sendmsg$NBD_CMD_STATUS(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x2c, r2, 0x2, 0x70bd28, 0x25dfdbfc, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x2}, @NBD_ATTR_SOCKETS={0xc, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}]}]}, 0x2c}}, 0x4000c00) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0x8a) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = socket(0x1e, 0x4, 0x0) connect$tipc(r4, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x1}}, 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x0, 0x0) sendfile(r3, r5, 0x0, 0x200fc0) pipe(&(0x7f0000000200)={0xffffffffffffffff}) vmsplice(r6, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r6, 0x40082102, &(0x7f0000000080)) 12:53:55 executing program 0: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x81, 0xe5, 0xa5, 0x40, 0xfe6, 0x9800, 0x5d6c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xd, 0x3, 0xfa}}]}}]}}, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x6, "e32f9f436342"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000000)=@ready={0x0, 0x0, 0x8, "a07f86ae", {0x1, 0x2, 0x7, 0x7}}) [ 2373.562895][T28562] usb 1-1: device descriptor read/8, error -71 [ 2373.632928][T26029] usb 2-1: new high-speed USB device number 70 using dummy_hcd 12:53:55 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) time(&(0x7f0000000000)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x6) write$cgroup_int(r1, &(0x7f0000000200), 0x400c00) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:53:55 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) lremovexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)=ANY=[]) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xe000000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) statx(r2, &(0x7f0000000180)='./file0\x00', 0x800, 0x400, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0x8, 0x2}, {0x0, 0x7fff}]}, 0x18, 0x2) [ 2373.797910][T13867] tipc: Failed do clone local mcast rcv buffer [ 2373.823360][T13867] ================================================================== [ 2373.831449][T13867] BUG: KASAN: use-after-free in tipc_mcast_xmit+0x1026/0x16c0 [ 2373.838881][T13867] Read of size 8 at addr ffff88802287ca00 by task syz-executor.5/13867 [ 2373.847082][T13867] [ 2373.849388][T13867] CPU: 1 PID: 13867 Comm: syz-executor.5 Not tainted 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2373.859499][T13867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2373.869522][T13867] Call Trace: [ 2373.872808][T13867] dump_stack+0x1b0/0x21e [ 2373.877123][T13867] ? show_regs_print_info+0x12/0x12 [ 2373.882377][T13867] ? printk+0xc0/0x104 [ 2373.886413][T13867] ? printk+0xc0/0x104 [ 2373.890451][T13867] print_address_description+0x96/0x5d0 [ 2373.895965][T13867] ? devkmsg_release+0x11c/0x11c [ 2373.900871][T13867] ? skb_clone+0x1f4/0x370 [ 2373.905253][T13867] ? kfree_skb+0x1b6/0x220 [ 2373.909637][T13867] ? tipc_msg_reassemble+0x3e2/0x590 [ 2373.914888][T13867] __kasan_report+0x14b/0x1c0 [ 2373.919533][T13867] ? tipc_mcast_xmit+0x1026/0x16c0 [ 2373.924611][T13867] kasan_report+0x27/0x50 [ 2373.928908][T13867] tipc_mcast_xmit+0x1026/0x16c0 [ 2373.933815][T13867] ? tipc_bcast_dec_bearer_dst_cnt+0x240/0x240 [ 2373.939936][T13867] ? __check_object_size+0x2e5/0x3b0 [ 2373.945189][T13867] tipc_sendmcast+0xc00/0xeb0 [ 2373.949845][T13867] ? tipc_send_group_unicast+0x7d0/0x7d0 [ 2373.955445][T13867] ? apic_timer_interrupt+0xa/0x20 [ 2373.960523][T13867] ? wait_woken+0x250/0x250 [ 2373.965004][T13867] ? __tipc_sendmsg+0x44d/0x2d30 [ 2373.969910][T13867] ? __sanitizer_cov_trace_switch+0x60/0xf0 [ 2373.975770][T13867] __tipc_sendmsg+0x120d/0x2d30 [ 2373.980597][T13867] ? local_bh_enable+0x20/0x20 [ 2373.985329][T13867] ? _raw_spin_lock_bh+0xa4/0x180 [ 2373.990320][T13867] ? _local_bh_enable+0x30/0x30 [ 2373.995136][T13867] ? selinux_socket_sendmsg+0x10b/0x320 [ 2374.000649][T13867] ? lock_sock_nested+0x25a/0x320 [ 2374.005653][T13867] ? _local_bh_enable+0x30/0x30 [ 2374.012821][T13867] ? tipc_recvmsg+0x17c0/0x17c0 [ 2374.017637][T13867] tipc_sendmsg+0x51/0x70 [ 2374.021936][T13867] kernel_sendmsg+0xe2/0x120 [ 2374.026494][T13867] sock_no_sendpage+0x13f/0x1b0 [ 2374.031313][T13867] ? __receive_sock+0xb0/0xb0 [ 2374.035958][T13867] ? apic_timer_interrupt+0xa/0x20 [ 2374.041049][T13867] ? __receive_sock+0xb0/0xb0 [ 2374.045695][T13867] sock_sendpage+0xd0/0x120 [ 2374.050168][T13867] pipe_to_sendpage+0x23b/0x300 [ 2374.054988][T13867] ? sock_fasync+0xf0/0xf0 [ 2374.059381][T13867] ? generic_splice_sendpage+0x200/0x200 [ 2374.065017][T13867] ? page_cache_pipe_buf_confirm+0x113/0x210 [ 2374.070965][T13867] __splice_from_pipe+0x2d3/0x870 [ 2374.075956][T13867] ? generic_splice_sendpage+0x200/0x200 [ 2374.081555][T13867] generic_splice_sendpage+0x172/0x200 [ 2374.086980][T13867] ? iter_file_splice_write+0xf20/0xf20 [ 2374.092493][T13867] ? iter_file_splice_write+0xf20/0xf20 [ 2374.098004][T13867] splice_direct_to_actor+0x496/0xb00 [ 2374.103343][T13867] ? do_splice_direct+0x3d0/0x3d0 [ 2374.108335][T13867] ? pipe_to_sendpage+0x300/0x300 [ 2374.113329][T13867] ? security_file_permission+0x128/0x300 [ 2374.119013][T13867] do_splice_direct+0x279/0x3d0 [ 2374.123832][T13867] ? splice_direct_to_actor+0xb00/0xb00 [ 2374.129349][T13867] ? security_file_permission+0x128/0x300 [ 2374.135034][T13867] do_sendfile+0x89d/0x1110 [ 2374.139505][T13867] ? compat_writev+0x390/0x390 [ 2374.144241][T13867] ? put_timespec64+0x106/0x150 [ 2374.149056][T13867] ? ktime_get_raw+0x130/0x130 [ 2374.153788][T13867] ? get_timespec64+0x1c0/0x1c0 [ 2374.158605][T13867] ? __se_sys_futex+0x31d/0x440 [ 2374.163425][T13867] __x64_sys_sendfile64+0x1ae/0x220 [ 2374.168680][T13867] ? __ia32_sys_sendfile+0x240/0x240 [ 2374.173937][T13867] ? do_syscall_64+0x10c/0x150 [ 2374.178669][T13867] do_syscall_64+0xcb/0x150 [ 2374.183141][T13867] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2374.189000][T13867] RIP: 0033:0x45de59 [ 2374.192889][T13867] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2374.212469][T13867] RSP: 002b:00007f9ea02dfc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 2374.220860][T13867] RAX: ffffffffffffffda RBX: 0000000000027ec0 RCX: 000000000045de59 [ 2374.228813][T13867] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 [ 2374.236762][T13867] RBP: 000000000118bf68 R08: 0000000000000000 R09: 0000000000000000 [ 2374.244707][T13867] R10: 0000000000200fc0 R11: 0000000000000246 R12: 000000000118bf2c [ 2374.252651][T13867] R13: 00007ffe17bf105f R14: 00007f9ea02e09c0 R15: 000000000118bf2c [ 2374.260597][T13867] [ 2374.262895][T13867] Allocated by task 13867: [ 2374.267290][T13867] __kasan_kmalloc+0x117/0x1b0 [ 2374.272024][T13867] kmem_cache_alloc+0x1d5/0x250 [ 2374.276841][T13867] __alloc_skb+0x88/0x4d0 [ 2374.281150][T13867] tipc_msg_build+0x74a/0x1b20 [ 2374.285967][T13867] tipc_sendmcast+0x92a/0xeb0 [ 2374.290610][T13867] __tipc_sendmsg+0x120d/0x2d30 [ 2374.295424][T13867] tipc_sendmsg+0x51/0x70 [ 2374.299721][T13867] kernel_sendmsg+0xe2/0x120 [ 2374.304276][T13867] sock_no_sendpage+0x13f/0x1b0 [ 2374.309092][T13867] sock_sendpage+0xd0/0x120 [ 2374.313562][T13867] pipe_to_sendpage+0x23b/0x300 [ 2374.318381][T13867] __splice_from_pipe+0x2d3/0x870 [ 2374.323403][T13867] generic_splice_sendpage+0x172/0x200 [ 2374.328827][T13867] splice_direct_to_actor+0x496/0xb00 [ 2374.334164][T13867] do_splice_direct+0x279/0x3d0 [ 2374.338993][T13867] do_sendfile+0x89d/0x1110 [ 2374.343464][T13867] __x64_sys_sendfile64+0x1ae/0x220 [ 2374.348642][T13867] do_syscall_64+0xcb/0x150 [ 2374.353461][T13867] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2374.359414][T13867] [ 2374.361746][T13867] Freed by task 13867: [ 2374.365795][T13867] __kasan_slab_free+0x168/0x220 [ 2374.370706][T13867] slab_free_freelist_hook+0xd0/0x150 [ 2374.376053][T13867] kmem_cache_free+0xac/0x5c0 [ 2374.380697][T13867] tipc_buf_append+0x2d1/0xad0 [ 2374.385430][T13867] tipc_msg_reassemble+0x331/0x590 [ 2374.390625][T13867] tipc_mcast_xmit+0x223/0x16c0 [ 2374.395445][T13867] tipc_sendmcast+0xc00/0xeb0 [ 2374.400089][T13867] __tipc_sendmsg+0x120d/0x2d30 [ 2374.404906][T13867] tipc_sendmsg+0x51/0x70 [ 2374.409201][T13867] kernel_sendmsg+0xe2/0x120 [ 2374.413758][T13867] sock_no_sendpage+0x13f/0x1b0 [ 2374.418577][T13867] sock_sendpage+0xd0/0x120 [ 2374.423046][T13867] pipe_to_sendpage+0x23b/0x300 [ 2374.427863][T13867] __splice_from_pipe+0x2d3/0x870 [ 2374.432854][T13867] generic_splice_sendpage+0x172/0x200 [ 2374.438278][T13867] splice_direct_to_actor+0x496/0xb00 [ 2374.443617][T13867] do_splice_direct+0x279/0x3d0 [ 2374.448433][T13867] do_sendfile+0x89d/0x1110 [ 2374.452907][T13867] __x64_sys_sendfile64+0x1ae/0x220 [ 2374.458295][T13867] do_syscall_64+0xcb/0x150 [ 2374.462764][T13867] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2374.468621][T13867] [ 2374.470920][T13867] The buggy address belongs to the object at ffff88802287ca00 [ 2374.470920][T13867] which belongs to the cache skbuff_fclone_cache of size 488 [ 2374.485634][T13867] The buggy address is located 0 bytes inside of [ 2374.485634][T13867] 488-byte region [ffff88802287ca00, ffff88802287cbe8) [ 2374.499228][T13867] The buggy address belongs to the page: [ 2374.504828][T13867] page:ffffea00008a1f00 refcount:1 mapcount:0 mapping:ffff8881daa93680 index:0x0 [ 2374.513901][T13867] flags: 0x4000000000000200(slab) [ 2374.518897][T13867] raw: 4000000000000200 dead000000000100 dead000000000122 ffff8881daa93680 [ 2374.527449][T13867] raw: 0000000000000000 0000000000060006 00000001ffffffff 0000000000000000 [ 2374.535996][T13867] page dumped because: kasan: bad access detected [ 2374.542371][T13867] [ 2374.544667][T13867] Memory state around the buggy address: [ 2374.550263][T13867] ffff88802287c900: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc [ 2374.558290][T13867] ffff88802287c980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 2374.566319][T13867] >ffff88802287ca00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2374.574345][T13867] ^ [ 2374.578380][T13867] ffff88802287ca80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2374.586518][T13867] ffff88802287cb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2374.594543][T13867] ================================================================== [ 2374.602567][T13867] Disabling lock debugging due to kernel taint [ 2374.659104][T13867] ================================================================== [ 2374.667203][T13867] BUG: KASAN: double-free or invalid-free in kmem_cache_free+0xac/0x5c0 [ 2374.675504][T13867] [ 2374.677820][T13867] CPU: 0 PID: 13867 Comm: syz-executor.5 Tainted: G B 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2374.689325][T13867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2374.699349][T13867] Call Trace: [ 2374.702612][T13867] dump_stack+0x1b0/0x21e [ 2374.706909][T13867] ? __perf_event_task_sched_in+0x4ed/0x550 [ 2374.712772][T13867] ? show_regs_print_info+0x12/0x12 [ 2374.717941][T13867] ? printk+0xc0/0x104 [ 2374.721978][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2374.726796][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2374.731615][T13867] print_address_description+0x96/0x5d0 [ 2374.737144][T13867] ? devkmsg_release+0x11c/0x11c [ 2374.742048][T13867] ? finish_task_switch+0x235/0x4c0 [ 2374.747215][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2374.752031][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2374.756859][T13867] kasan_report_invalid_free+0x54/0xc0 [ 2374.762285][T13867] __kasan_slab_free+0x102/0x220 [ 2374.767192][T13867] ? cmp_ex_search+0x6d/0x90 [ 2374.771761][T13867] ? __start___ex_table+0x717c/0xa620 [ 2374.777100][T13867] ? bsearch+0x9b/0xc0 [ 2374.781135][T13867] ? search_extable+0xf0/0xf0 [ 2374.785789][T13867] ? csum_partial_copy_generic+0x1fd0/0x3f00 [ 2374.791733][T13867] ? __stop_notes+0xc/0xc [ 2374.796031][T13867] ? search_extable+0xaf/0xf0 [ 2374.800688][T13867] ? __rcu_read_lock+0x50/0x50 [ 2374.805417][T13867] ? trim_init_extable+0x3e0/0x3e0 [ 2374.810506][T13867] ? csum_partial_copy_generic+0x1fd0/0x3f00 [ 2374.816451][T13867] ? __start___ex_table+0x717c/0xa620 [ 2374.821790][T13867] ? __start___ex_table+0x717c/0xa620 [ 2374.827141][T13867] ? kasan_report+0x27/0x50 [ 2374.831622][T13867] ? ex_handler_refcount+0x130/0x170 [ 2374.836872][T13867] ? ex_handler_fault+0xa0/0xa0 [ 2374.841690][T13867] ? __start___ex_table+0x7184/0xa620 [ 2374.847028][T13867] ? fixup_exception+0x92/0xd0 [ 2374.851757][T13867] ? do_trap+0x148/0x340 [ 2374.856067][T13867] ? notify_die+0x1e1/0x2a0 [ 2374.860537][T13867] ? csum_partial_copy_generic+0x1fd0/0x3f00 [ 2374.866485][T13867] ? csum_partial_copy_generic+0x1fd0/0x3f00 [ 2374.872433][T13867] slab_free_freelist_hook+0xd0/0x150 [ 2374.877773][T13867] ? tipc_mcast_xmit+0x10a8/0x16c0 [ 2374.882864][T13867] kmem_cache_free+0xac/0x5c0 [ 2374.887518][T13867] ? kasan_report+0x27/0x50 [ 2374.892076][T13867] tipc_mcast_xmit+0x10a8/0x16c0 [ 2374.896982][T13867] ? tipc_bcast_dec_bearer_dst_cnt+0x240/0x240 [ 2374.903102][T13867] ? __check_object_size+0x2e5/0x3b0 [ 2374.908355][T13867] tipc_sendmcast+0xc00/0xeb0 [ 2374.913013][T13867] ? tipc_send_group_unicast+0x7d0/0x7d0 [ 2374.918611][T13867] ? apic_timer_interrupt+0xa/0x20 [ 2374.923692][T13867] ? wait_woken+0x250/0x250 [ 2374.928163][T13867] ? __tipc_sendmsg+0x44d/0x2d30 [ 2374.933069][T13867] ? __sanitizer_cov_trace_switch+0x60/0xf0 [ 2374.938929][T13867] __tipc_sendmsg+0x120d/0x2d30 [ 2374.943747][T13867] ? local_bh_enable+0x20/0x20 [ 2374.948476][T13867] ? _raw_spin_lock_bh+0xa4/0x180 [ 2374.953478][T13867] ? _local_bh_enable+0x30/0x30 [ 2374.958473][T13867] ? selinux_socket_sendmsg+0x10b/0x320 [ 2374.963989][T13867] ? lock_sock_nested+0x25a/0x320 [ 2374.968979][T13867] ? _local_bh_enable+0x30/0x30 [ 2374.973807][T13867] ? tipc_recvmsg+0x17c0/0x17c0 [ 2374.978623][T13867] tipc_sendmsg+0x51/0x70 [ 2374.982921][T13867] kernel_sendmsg+0xe2/0x120 [ 2374.987476][T13867] sock_no_sendpage+0x13f/0x1b0 [ 2374.992294][T13867] ? __receive_sock+0xb0/0xb0 [ 2374.996950][T13867] ? apic_timer_interrupt+0xa/0x20 [ 2375.002038][T13867] ? __receive_sock+0xb0/0xb0 [ 2375.006683][T13867] sock_sendpage+0xd0/0x120 [ 2375.011157][T13867] pipe_to_sendpage+0x23b/0x300 [ 2375.015974][T13867] ? sock_fasync+0xf0/0xf0 [ 2375.020355][T13867] ? generic_splice_sendpage+0x200/0x200 [ 2375.025954][T13867] ? page_cache_pipe_buf_confirm+0x113/0x210 [ 2375.032005][T13867] __splice_from_pipe+0x2d3/0x870 [ 2375.036998][T13867] ? generic_splice_sendpage+0x200/0x200 [ 2375.042611][T13867] generic_splice_sendpage+0x172/0x200 [ 2375.048036][T13867] ? iter_file_splice_write+0xf20/0xf20 [ 2375.053559][T13867] ? iter_file_splice_write+0xf20/0xf20 [ 2375.059072][T13867] splice_direct_to_actor+0x496/0xb00 [ 2375.064415][T13867] ? do_splice_direct+0x3d0/0x3d0 [ 2375.069406][T13867] ? pipe_to_sendpage+0x300/0x300 [ 2375.074399][T13867] ? security_file_permission+0x128/0x300 [ 2375.080084][T13867] do_splice_direct+0x279/0x3d0 [ 2375.084900][T13867] ? splice_direct_to_actor+0xb00/0xb00 [ 2375.090500][T13867] ? security_file_permission+0x128/0x300 [ 2375.096184][T13867] do_sendfile+0x89d/0x1110 [ 2375.100656][T13867] ? compat_writev+0x390/0x390 [ 2375.105387][T13867] ? put_timespec64+0x106/0x150 [ 2375.110205][T13867] ? ktime_get_raw+0x130/0x130 [ 2375.114937][T13867] ? get_timespec64+0x1c0/0x1c0 [ 2375.119755][T13867] ? __se_sys_futex+0x31d/0x440 [ 2375.124589][T13867] __x64_sys_sendfile64+0x1ae/0x220 [ 2375.129754][T13867] ? __ia32_sys_sendfile+0x240/0x240 [ 2375.135006][T13867] ? do_syscall_64+0x10c/0x150 [ 2375.139736][T13867] do_syscall_64+0xcb/0x150 [ 2375.144208][T13867] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2375.150068][T13867] RIP: 0033:0x45de59 [ 2375.153945][T13867] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2375.173603][T13867] RSP: 002b:00007f9ea02dfc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 2375.181993][T13867] RAX: ffffffffffffffda RBX: 0000000000027ec0 RCX: 000000000045de59 [ 2375.189931][T13867] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 [ 2375.197873][T13867] RBP: 000000000118bf68 R08: 0000000000000000 R09: 0000000000000000 [ 2375.205814][T13867] R10: 0000000000200fc0 R11: 0000000000000246 R12: 000000000118bf2c [ 2375.213758][T13867] R13: 00007ffe17bf105f R14: 00007f9ea02e09c0 R15: 000000000118bf2c [ 2375.221837][T13867] [ 2375.224143][T13867] Allocated by task 13867: [ 2375.228549][T13867] __kasan_kmalloc+0x117/0x1b0 [ 2375.233318][T13867] kmem_cache_alloc+0x1d5/0x250 [ 2375.238153][T13867] __netdev_alloc_skb+0x1d8/0x710 [ 2375.243250][T13867] __ieee80211_beacon_get+0x628/0x11b0 [ 2375.248676][T13867] ieee80211_beacon_get_tim+0xb7/0x500 [ 2375.254102][T13867] mac80211_hwsim_beacon_tx+0xd4/0x570 [ 2375.259527][T13867] __iterate_interfaces+0x1fc/0x390 [ 2375.264701][T13867] ieee80211_iterate_active_interfaces_atomic+0x2e/0x40 [ 2375.271611][T13867] mac80211_hwsim_beacon+0xa1/0x180 [ 2375.276777][T13867] __run_hrtimer+0x405/0x7a0 [ 2375.281334][T13867] hrtimer_run_softirq+0x320/0x450 [ 2375.286428][T13867] __do_softirq+0x22e/0x569 [ 2375.290906][T13867] [ 2375.293204][T13867] Freed by task 13867: [ 2375.297242][T13867] __kasan_slab_free+0x168/0x220 [ 2375.302147][T13867] slab_free_freelist_hook+0xd0/0x150 [ 2375.307507][T13867] kmem_cache_free+0xac/0x5c0 [ 2375.312149][T13867] mac80211_hwsim_beacon_tx+0x35e/0x570 [ 2375.317664][T13867] __iterate_interfaces+0x1fc/0x390 [ 2375.322829][T13867] ieee80211_iterate_active_interfaces_atomic+0x2e/0x40 [ 2375.329729][T13867] mac80211_hwsim_beacon+0xa1/0x180 [ 2375.334903][T13867] __run_hrtimer+0x405/0x7a0 [ 2375.339460][T13867] hrtimer_run_softirq+0x320/0x450 [ 2375.344540][T13867] __do_softirq+0x22e/0x569 [ 2375.349032][T13867] [ 2375.351331][T13867] The buggy address belongs to the object at ffff888169746c80 [ 2375.351331][T13867] which belongs to the cache skbuff_head_cache of size 240 [ 2375.365956][T13867] The buggy address is located 0 bytes inside of [ 2375.365956][T13867] 240-byte region [ffff888169746c80, ffff888169746d70) [ 2375.379019][T13867] The buggy address belongs to the page: [ 2375.384644][T13867] page:ffffea0005a5d180 refcount:1 mapcount:0 mapping:ffff8881daa92a00 index:0x0 [ 2375.393746][T13867] flags: 0x8000000000000200(slab) [ 2375.398741][T13867] raw: 8000000000000200 ffffea00059f0580 0000000500000002 ffff8881daa92a00 [ 2375.407311][T13867] raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 [ 2375.415863][T13867] page dumped because: kasan: bad access detected [ 2375.422254][T13867] [ 2375.424556][T13867] Memory state around the buggy address: [ 2375.430161][T13867] ffff888169746b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2375.438202][T13867] ffff888169746c00: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc [ 2375.446231][T13867] >ffff888169746c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2375.454265][T13867] ^ [ 2375.458309][T13867] ffff888169746d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc [ 2375.466344][T13867] ffff888169746d80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 2375.474372][T13867] ================================================================== [ 2375.562501][T26029] usb 2-1: device descriptor read/64, error 18 [ 2375.582454][T13867] ================================================================== [ 2375.590540][T13867] BUG: KASAN: double-free or invalid-free in kmem_cache_free+0xac/0x5c0 [ 2375.598835][T13867] [ 2375.601140][T13867] CPU: 1 PID: 13867 Comm: syz-executor.5 Tainted: G B 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2375.612639][T13867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2375.622664][T13867] Call Trace: [ 2375.625928][T13867] dump_stack+0x1b0/0x21e [ 2375.630228][T13867] ? show_regs_print_info+0x12/0x12 [ 2375.635393][T13867] ? printk+0xc0/0x104 [ 2375.639431][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2375.644248][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2375.649066][T13867] print_address_description+0x96/0x5d0 [ 2375.654589][T13867] ? devkmsg_release+0x11c/0x11c [ 2375.659493][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2375.664314][T13867] ? ___preempt_schedule+0x16/0x20 [ 2375.669391][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2375.674209][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2375.679030][T13867] kasan_report_invalid_free+0x54/0xc0 [ 2375.684475][T13867] __kasan_slab_free+0x102/0x220 [ 2375.689382][T13867] ? cmp_ex_search+0x6d/0x90 [ 2375.693939][T13867] ? __start___ex_table+0x717c/0xa620 [ 2375.699277][T13867] ? bsearch+0x9b/0xc0 [ 2375.703313][T13867] ? search_extable+0xf0/0xf0 [ 2375.707956][T13867] ? csum_partial_copy_generic+0x1fd0/0x3f00 [ 2375.713902][T13867] ? __stop_notes+0xc/0xc [ 2375.718210][T13867] ? search_extable+0xaf/0xf0 [ 2375.722857][T13867] ? __rcu_read_lock+0x50/0x50 [ 2375.727586][T13867] ? trim_init_extable+0x3e0/0x3e0 [ 2375.732664][T13867] ? csum_partial_copy_generic+0x1fd0/0x3f00 [ 2375.738608][T13867] ? __start___ex_table+0x717c/0xa620 [ 2375.743948][T13867] ? __start___ex_table+0x717c/0xa620 [ 2375.749284][T13867] ? kasan_report+0x27/0x50 [ 2375.753795][T13867] ? ex_handler_refcount+0x130/0x170 [ 2375.759049][T13867] ? ex_handler_fault+0xa0/0xa0 [ 2375.763868][T13867] ? __start___ex_table+0x7184/0xa620 [ 2375.769206][T13867] ? fixup_exception+0x92/0xd0 [ 2375.773937][T13867] ? do_trap+0x148/0x340 [ 2375.778147][T13867] ? notify_die+0x1e1/0x2a0 [ 2375.782620][T13867] ? csum_partial_copy_generic+0x1fd0/0x3f00 [ 2375.788576][T13867] ? csum_partial_copy_generic+0x1fd0/0x3f00 [ 2375.794523][T13867] slab_free_freelist_hook+0xd0/0x150 [ 2375.799865][T13867] ? tipc_mcast_xmit+0x10a8/0x16c0 [ 2375.804942][T13867] kmem_cache_free+0xac/0x5c0 [ 2375.809585][T13867] ? kasan_report+0x27/0x50 [ 2375.814057][T13867] tipc_mcast_xmit+0x10a8/0x16c0 [ 2375.818962][T13867] ? tipc_bcast_dec_bearer_dst_cnt+0x240/0x240 [ 2375.825093][T13867] ? __check_object_size+0x2e5/0x3b0 [ 2375.830348][T13867] tipc_sendmcast+0xc00/0xeb0 [ 2375.834995][T13867] ? tipc_send_group_unicast+0x7d0/0x7d0 [ 2375.840594][T13867] ? apic_timer_interrupt+0xa/0x20 [ 2375.845686][T13867] ? wait_woken+0x250/0x250 [ 2375.850159][T13867] ? __tipc_sendmsg+0x44d/0x2d30 [ 2375.855064][T13867] ? __sanitizer_cov_trace_switch+0x60/0xf0 [ 2375.860933][T13867] __tipc_sendmsg+0x120d/0x2d30 [ 2375.865768][T13867] ? local_bh_enable+0x20/0x20 [ 2375.870498][T13867] ? _raw_spin_lock_bh+0xa4/0x180 [ 2375.875490][T13867] ? _local_bh_enable+0x30/0x30 [ 2375.880307][T13867] ? selinux_socket_sendmsg+0x10b/0x320 [ 2375.885820][T13867] ? lock_sock_nested+0x25a/0x320 [ 2375.890812][T13867] ? _local_bh_enable+0x30/0x30 [ 2375.895632][T13867] ? tipc_recvmsg+0x17c0/0x17c0 [ 2375.900460][T13867] tipc_sendmsg+0x51/0x70 [ 2375.904768][T13867] kernel_sendmsg+0xe2/0x120 [ 2375.909328][T13867] sock_no_sendpage+0x13f/0x1b0 [ 2375.914147][T13867] ? __receive_sock+0xb0/0xb0 [ 2375.918806][T13867] ? apic_timer_interrupt+0xa/0x20 [ 2375.923885][T13867] ? __receive_sock+0xb0/0xb0 [ 2375.928529][T13867] sock_sendpage+0xd0/0x120 [ 2375.932999][T13867] pipe_to_sendpage+0x23b/0x300 [ 2375.937821][T13867] ? sock_fasync+0xf0/0xf0 [ 2375.942205][T13867] ? generic_splice_sendpage+0x200/0x200 [ 2375.947807][T13867] ? page_cache_pipe_buf_confirm+0x113/0x210 [ 2375.953753][T13867] __splice_from_pipe+0x2d3/0x870 [ 2375.958745][T13867] ? generic_splice_sendpage+0x200/0x200 [ 2375.964345][T13867] generic_splice_sendpage+0x172/0x200 [ 2375.969771][T13867] ? iter_file_splice_write+0xf20/0xf20 [ 2375.975294][T13867] ? iter_file_splice_write+0xf20/0xf20 [ 2375.980805][T13867] splice_direct_to_actor+0x496/0xb00 [ 2375.986143][T13867] ? do_splice_direct+0x3d0/0x3d0 [ 2375.991145][T13867] ? pipe_to_sendpage+0x300/0x300 [ 2375.996137][T13867] ? security_file_permission+0x128/0x300 [ 2376.001822][T13867] do_splice_direct+0x279/0x3d0 [ 2376.006639][T13867] ? splice_direct_to_actor+0xb00/0xb00 [ 2376.012164][T13867] ? security_file_permission+0x128/0x300 [ 2376.017851][T13867] do_sendfile+0x89d/0x1110 [ 2376.022333][T13867] ? compat_writev+0x390/0x390 [ 2376.027063][T13867] ? put_timespec64+0x106/0x150 [ 2376.031878][T13867] ? ktime_get_raw+0x130/0x130 [ 2376.036610][T13867] ? get_timespec64+0x1c0/0x1c0 [ 2376.041430][T13867] ? __se_sys_futex+0x31d/0x440 [ 2376.046248][T13867] __x64_sys_sendfile64+0x1ae/0x220 [ 2376.051415][T13867] ? __ia32_sys_sendfile+0x240/0x240 [ 2376.056668][T13867] ? do_syscall_64+0x10c/0x150 [ 2376.061401][T13867] do_syscall_64+0xcb/0x150 [ 2376.065883][T13867] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2376.071743][T13867] RIP: 0033:0x45de59 [ 2376.075607][T13867] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2376.095188][T13867] RSP: 002b:00007f9ea02dfc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 2376.103563][T13867] RAX: ffffffffffffffda RBX: 0000000000027ec0 RCX: 000000000045de59 [ 2376.111504][T13867] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 [ 2376.119444][T13867] RBP: 000000000118bf68 R08: 0000000000000000 R09: 0000000000000000 [ 2376.127384][T13867] R10: 0000000000200fc0 R11: 0000000000000246 R12: 000000000118bf2c [ 2376.135326][T13867] R13: 00007ffe17bf105f R14: 00007f9ea02e09c0 R15: 000000000118bf2c [ 2376.143265][T13867] [ 2376.145564][T13867] Allocated by task 13867: [ 2376.149950][T13867] __kasan_kmalloc+0x117/0x1b0 [ 2376.154767][T13867] kmem_cache_alloc+0x1d5/0x250 [ 2376.159582][T13867] __netdev_alloc_skb+0x1d8/0x710 [ 2376.164585][T13867] __ieee80211_beacon_get+0x628/0x11b0 [ 2376.170031][T13867] ieee80211_beacon_get_tim+0xb7/0x500 [ 2376.175466][T13867] mac80211_hwsim_beacon_tx+0xd4/0x570 [ 2376.180893][T13867] __iterate_interfaces+0x1fc/0x390 [ 2376.186060][T13867] ieee80211_iterate_active_interfaces_atomic+0x2e/0x40 [ 2376.192961][T13867] mac80211_hwsim_beacon+0xa1/0x180 [ 2376.198253][T13867] __run_hrtimer+0x405/0x7a0 [ 2376.202819][T13867] hrtimer_run_softirq+0x320/0x450 [ 2376.207897][T13867] __do_softirq+0x22e/0x569 [ 2376.212363][T13867] [ 2376.214663][T13867] Freed by task 13867: [ 2376.218701][T13867] __kasan_slab_free+0x168/0x220 [ 2376.223610][T13867] slab_free_freelist_hook+0xd0/0x150 [ 2376.228950][T13867] kmem_cache_free+0xac/0x5c0 [ 2376.233595][T13867] mac80211_hwsim_beacon_tx+0x35e/0x570 [ 2376.239108][T13867] __iterate_interfaces+0x1fc/0x390 [ 2376.244284][T13867] ieee80211_iterate_active_interfaces_atomic+0x2e/0x40 [ 2376.251189][T13867] mac80211_hwsim_beacon+0xa1/0x180 [ 2376.256354][T13867] __run_hrtimer+0x405/0x7a0 [ 2376.260911][T13867] hrtimer_run_softirq+0x320/0x450 [ 2376.266010][T13867] __do_softirq+0x22e/0x569 [ 2376.270483][T13867] [ 2376.272789][T13867] The buggy address belongs to the object at ffff888167c16b40 [ 2376.272789][T13867] which belongs to the cache skbuff_head_cache of size 240 [ 2376.287342][T13867] The buggy address is located 0 bytes inside of [ 2376.287342][T13867] 240-byte region [ffff888167c16b40, ffff888167c16c30) [ 2376.300402][T13867] The buggy address belongs to the page: [ 2376.306003][T13867] page:ffffea00059f0580 refcount:1 mapcount:0 mapping:ffff8881daa92a00 index:0x0 [ 2376.315072][T13867] flags: 0x8000000000000200(slab) [ 2376.320064][T13867] raw: 8000000000000200 0000000000000000 0000000100000001 ffff8881daa92a00 [ 2376.328626][T13867] raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 [ 2376.337175][T13867] page dumped because: kasan: bad access detected [ 2376.343551][T13867] [ 2376.345846][T13867] Memory state around the buggy address: [ 2376.351554][T13867] ffff888167c16a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2376.359708][T13867] ffff888167c16a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc [ 2376.367744][T13867] >ffff888167c16b00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 2376.375791][T13867] ^ [ 2376.383392][T13867] ffff888167c16b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2376.391426][T13867] ffff888167c16c00: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc [ 2376.399455][T13867] ================================================================== [ 2376.439377][T13867] ================================================================== [ 2376.449116][T13867] BUG: KASAN: double-free or invalid-free in kmem_cache_free+0xac/0x5c0 [ 2376.457408][T13867] [ 2376.459714][T13867] CPU: 1 PID: 13867 Comm: syz-executor.5 Tainted: G B 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2376.471228][T13867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2376.481264][T13867] Call Trace: [ 2376.484539][T13867] dump_stack+0x1b0/0x21e [ 2376.488841][T13867] ? show_regs_print_info+0x12/0x12 [ 2376.494008][T13867] ? printk+0xc0/0x104 [ 2376.498048][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2376.502874][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2376.507693][T13867] print_address_description+0x96/0x5d0 [ 2376.513215][T13867] ? devkmsg_release+0x11c/0x11c [ 2376.518118][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2376.522934][T13867] ? ___preempt_schedule+0x16/0x20 [ 2376.528013][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2376.532830][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2376.537646][T13867] kasan_report_invalid_free+0x54/0xc0 [ 2376.543071][T13867] __kasan_slab_free+0x102/0x220 [ 2376.547974][T13867] ? cmp_ex_search+0x6d/0x90 [ 2376.552531][T13867] ? __start___ex_table+0x717c/0xa620 [ 2376.557870][T13867] ? bsearch+0x9b/0xc0 [ 2376.561918][T13867] ? search_extable+0xf0/0xf0 [ 2376.566561][T13867] ? csum_partial_copy_generic+0x1fd0/0x3f00 [ 2376.572518][T13867] ? __stop_notes+0xc/0xc [ 2376.577163][T13867] ? search_extable+0xaf/0xf0 [ 2376.581815][T13867] ? __rcu_read_lock+0x50/0x50 [ 2376.586547][T13867] ? trim_init_extable+0x3e0/0x3e0 [ 2376.591627][T13867] ? csum_partial_copy_generic+0x1fd0/0x3f00 [ 2376.597578][T13867] ? __start___ex_table+0x717c/0xa620 [ 2376.603030][T13867] ? __start___ex_table+0x717c/0xa620 [ 2376.608370][T13867] ? kasan_report+0x27/0x50 [ 2376.612857][T13867] ? ex_handler_refcount+0x130/0x170 [ 2376.618113][T13867] ? ex_handler_fault+0xa0/0xa0 [ 2376.622948][T13867] ? __start___ex_table+0x7184/0xa620 [ 2376.628290][T13867] ? fixup_exception+0x92/0xd0 [ 2376.633110][T13867] ? do_trap+0x148/0x340 [ 2376.637409][T13867] ? notify_die+0x1e1/0x2a0 [ 2376.641883][T13867] ? csum_partial_copy_generic+0x1fd0/0x3f00 [ 2376.647934][T13867] ? csum_partial_copy_generic+0x1fd0/0x3f00 [ 2376.654000][T13867] slab_free_freelist_hook+0xd0/0x150 [ 2376.659431][T13867] ? tipc_mcast_xmit+0x10a8/0x16c0 [ 2376.664510][T13867] kmem_cache_free+0xac/0x5c0 [ 2376.669354][T13867] ? kasan_report+0x27/0x50 [ 2376.674034][T13867] tipc_mcast_xmit+0x10a8/0x16c0 [ 2376.679034][T13867] ? tipc_bcast_dec_bearer_dst_cnt+0x240/0x240 [ 2376.685173][T13867] ? __check_object_size+0x2e5/0x3b0 [ 2376.690459][T13867] tipc_sendmcast+0xc00/0xeb0 [ 2376.695107][T13867] ? tipc_send_group_unicast+0x7d0/0x7d0 [ 2376.700830][T13867] ? apic_timer_interrupt+0xa/0x20 [ 2376.705914][T13867] ? wait_woken+0x250/0x250 [ 2376.710386][T13867] ? __tipc_sendmsg+0x44d/0x2d30 [ 2376.715381][T13867] ? __sanitizer_cov_trace_switch+0x60/0xf0 [ 2376.721330][T13867] __tipc_sendmsg+0x120d/0x2d30 [ 2376.726158][T13867] ? local_bh_enable+0x20/0x20 [ 2376.731602][T13867] ? _raw_spin_lock_bh+0xa4/0x180 [ 2376.736597][T13867] ? _local_bh_enable+0x30/0x30 [ 2376.741420][T13867] ? selinux_socket_sendmsg+0x10b/0x320 [ 2376.746952][T13867] ? lock_sock_nested+0x25a/0x320 [ 2376.751947][T13867] ? _local_bh_enable+0x30/0x30 [ 2376.756781][T13867] ? tipc_recvmsg+0x17c0/0x17c0 [ 2376.761602][T13867] tipc_sendmsg+0x51/0x70 [ 2376.766005][T13867] kernel_sendmsg+0xe2/0x120 [ 2376.770568][T13867] sock_no_sendpage+0x13f/0x1b0 [ 2376.775388][T13867] ? __receive_sock+0xb0/0xb0 [ 2376.780053][T13867] ? apic_timer_interrupt+0xa/0x20 [ 2376.785134][T13867] ? __receive_sock+0xb0/0xb0 [ 2376.789794][T13867] sock_sendpage+0xd0/0x120 [ 2376.794267][T13867] pipe_to_sendpage+0x23b/0x300 [ 2376.799089][T13867] ? sock_fasync+0xf0/0xf0 [ 2376.803500][T13867] ? generic_splice_sendpage+0x200/0x200 [ 2376.809205][T13867] ? page_cache_pipe_buf_confirm+0x113/0x210 [ 2376.815173][T13867] __splice_from_pipe+0x2d3/0x870 [ 2376.820256][T13867] ? generic_splice_sendpage+0x200/0x200 [ 2376.825858][T13867] generic_splice_sendpage+0x172/0x200 [ 2376.831293][T13867] ? iter_file_splice_write+0xf20/0xf20 [ 2376.836820][T13867] ? iter_file_splice_write+0xf20/0xf20 [ 2376.842334][T13867] splice_direct_to_actor+0x496/0xb00 [ 2376.847676][T13867] ? do_splice_direct+0x3d0/0x3d0 [ 2376.852688][T13867] ? pipe_to_sendpage+0x300/0x300 [ 2376.857689][T13867] ? security_file_permission+0x128/0x300 [ 2376.863390][T13867] do_splice_direct+0x279/0x3d0 [ 2376.868234][T13867] ? splice_direct_to_actor+0xb00/0xb00 [ 2376.873762][T13867] ? security_file_permission+0x128/0x300 [ 2376.879478][T13867] do_sendfile+0x89d/0x1110 [ 2376.884300][T13867] ? compat_writev+0x390/0x390 [ 2376.889115][T13867] ? put_timespec64+0x106/0x150 [ 2376.894374][T13867] ? ktime_get_raw+0x130/0x130 [ 2376.899125][T13867] ? get_timespec64+0x1c0/0x1c0 [ 2376.905885][T13867] ? __se_sys_futex+0x31d/0x440 [ 2376.910721][T13867] __x64_sys_sendfile64+0x1ae/0x220 [ 2376.915906][T13867] ? __ia32_sys_sendfile+0x240/0x240 [ 2376.921334][T13867] ? do_syscall_64+0x10c/0x150 [ 2376.926069][T13867] do_syscall_64+0xcb/0x150 [ 2376.930551][T13867] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2376.936429][T13867] RIP: 0033:0x45de59 [ 2376.940434][T13867] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2376.960120][T13867] RSP: 002b:00007f9ea02dfc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 2376.968525][T13867] RAX: ffffffffffffffda RBX: 0000000000027ec0 RCX: 000000000045de59 [ 2376.978737][T13867] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 [ 2376.986684][T13867] RBP: 000000000118bf68 R08: 0000000000000000 R09: 0000000000000000 [ 2376.994628][T13867] R10: 0000000000200fc0 R11: 0000000000000246 R12: 000000000118bf2c [ 2377.002796][T13867] R13: 00007ffe17bf105f R14: 00007f9ea02e09c0 R15: 000000000118bf2c [ 2377.010744][T13867] [ 2377.013046][T13867] Allocated by task 13867: [ 2377.017509][T13867] __kasan_kmalloc+0x117/0x1b0 [ 2377.022245][T13867] kmem_cache_alloc+0x1d5/0x250 [ 2377.027189][T13867] __netdev_alloc_skb+0x1d8/0x710 [ 2377.032201][T13867] __ieee80211_beacon_get+0x628/0x11b0 [ 2377.038165][T13867] ieee80211_beacon_get_tim+0xb7/0x500 [ 2377.043679][T13867] mac80211_hwsim_beacon_tx+0xd4/0x570 [ 2377.049107][T13867] __iterate_interfaces+0x1fc/0x390 [ 2377.054278][T13867] ieee80211_iterate_active_interfaces_atomic+0x2e/0x40 [ 2377.061902][T13867] mac80211_hwsim_beacon+0xa1/0x180 [ 2377.067156][T13867] __run_hrtimer+0x405/0x7a0 [ 2377.071805][T13867] hrtimer_run_softirq+0x320/0x450 [ 2377.076888][T13867] __do_softirq+0x22e/0x569 [ 2377.081356][T13867] [ 2377.083658][T13867] Freed by task 13867: [ 2377.087716][T13867] __kasan_slab_free+0x168/0x220 [ 2377.092627][T13867] slab_free_freelist_hook+0xd0/0x150 [ 2377.097968][T13867] kmem_cache_free+0xac/0x5c0 [ 2377.102640][T13867] mac80211_hwsim_beacon_tx+0x35e/0x570 [ 2377.108255][T13867] __iterate_interfaces+0x1fc/0x390 [ 2377.113423][T13867] ieee80211_iterate_active_interfaces_atomic+0x2e/0x40 [ 2377.120346][T13867] mac80211_hwsim_beacon+0xa1/0x180 [ 2377.125511][T13867] __run_hrtimer+0x405/0x7a0 [ 2377.130071][T13867] hrtimer_run_softirq+0x320/0x450 [ 2377.135182][T13867] __do_softirq+0x22e/0x569 [ 2377.139653][T13867] [ 2377.141956][T13867] The buggy address belongs to the object at ffff8881c4f4eb40 [ 2377.141956][T13867] which belongs to the cache skbuff_head_cache of size 240 [ 2377.156932][T13867] The buggy address is located 0 bytes inside of [ 2377.156932][T13867] 240-byte region [ffff8881c4f4eb40, ffff8881c4f4ec30) [ 2377.170207][T13867] The buggy address belongs to the page: [ 2377.175921][T13867] page:ffffea000713d380 refcount:1 mapcount:0 mapping:ffff8881daa92a00 index:0x0 [ 2377.184997][T13867] flags: 0x8000000000000200(slab) [ 2377.189998][T13867] raw: 8000000000000200 ffffea0005f14100 0000000700000003 ffff8881daa92a00 [ 2377.199786][T13867] raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 [ 2377.208352][T13867] page dumped because: kasan: bad access detected [ 2377.214735][T13867] [ 2377.217054][T13867] Memory state around the buggy address: [ 2377.222656][T13867] ffff8881c4f4ea00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2377.230718][T13867] ffff8881c4f4ea80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc [ 2377.238758][T13867] >ffff8881c4f4eb00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 2377.246809][T13867] ^ [ 2377.252936][T13867] ffff8881c4f4eb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2377.260981][T13867] ffff8881c4f4ec00: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc [ 2377.269009][T13867] ================================================================== [ 2377.285061][T13867] ================================================================== [ 2377.293244][T13867] BUG: KASAN: double-free or invalid-free in kmem_cache_free+0xac/0x5c0 [ 2377.302060][T13867] [ 2377.304399][T13867] CPU: 1 PID: 13867 Comm: syz-executor.5 Tainted: G B 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2377.316338][T13867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2377.327431][T13867] Call Trace: [ 2377.330700][T13867] dump_stack+0x1b0/0x21e [ 2377.335012][T13867] ? show_regs_print_info+0x12/0x12 [ 2377.340182][T13867] ? printk+0xc0/0x104 [ 2377.344225][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2377.349537][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2377.354370][T13867] print_address_description+0x96/0x5d0 [ 2377.359900][T13867] ? devkmsg_release+0x11c/0x11c [ 2377.364814][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2377.369636][T13867] ? ___preempt_schedule+0x16/0x20 [ 2377.374718][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2377.379626][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2377.387932][T13867] kasan_report_invalid_free+0x54/0xc0 [ 2377.393361][T13867] __kasan_slab_free+0x102/0x220 [ 2377.398284][T13867] ? cmp_ex_search+0x6d/0x90 [ 2377.402852][T13867] ? __start___ex_table+0x717c/0xa620 [ 2377.408199][T13867] ? bsearch+0x9b/0xc0 [ 2377.412256][T13867] ? search_extable+0xf0/0xf0 [ 2377.416946][T13867] ? csum_partial_copy_generic+0x1fd0/0x3f00 [ 2377.422897][T13867] ? __stop_notes+0xc/0xc [ 2377.427198][T13867] ? search_extable+0xaf/0xf0 [ 2377.431885][T13867] ? __rcu_read_lock+0x50/0x50 [ 2377.436624][T13867] ? trim_init_extable+0x3e0/0x3e0 [ 2377.441732][T13867] ? csum_partial_copy_generic+0x1fd0/0x3f00 [ 2377.448741][T13867] ? __start___ex_table+0x717c/0xa620 [ 2377.454346][T13867] ? __start___ex_table+0x717c/0xa620 [ 2377.459690][T13867] ? kasan_report+0x27/0x50 [ 2377.464165][T13867] ? ex_handler_refcount+0x130/0x170 [ 2377.469422][T13867] ? ex_handler_fault+0xa0/0xa0 [ 2377.474242][T13867] ? __start___ex_table+0x7184/0xa620 [ 2377.479583][T13867] ? fixup_exception+0x92/0xd0 [ 2377.484331][T13867] ? do_trap+0x148/0x340 [ 2377.488555][T13867] ? notify_die+0x1e1/0x2a0 [ 2377.493030][T13867] ? csum_partial_copy_generic+0x1fd0/0x3f00 [ 2377.498979][T13867] ? csum_partial_copy_generic+0x1fd0/0x3f00 [ 2377.504946][T13867] slab_free_freelist_hook+0xd0/0x150 [ 2377.510291][T13867] ? tipc_mcast_xmit+0x10a8/0x16c0 [ 2377.515434][T13867] kmem_cache_free+0xac/0x5c0 [ 2377.520082][T13867] ? kasan_report+0x27/0x50 [ 2377.524555][T13867] tipc_mcast_xmit+0x10a8/0x16c0 [ 2377.529466][T13867] ? tipc_bcast_dec_bearer_dst_cnt+0x240/0x240 [ 2377.535603][T13867] ? __check_object_size+0x2e5/0x3b0 [ 2377.540884][T13867] tipc_sendmcast+0xc00/0xeb0 [ 2377.545548][T13867] ? tipc_send_group_unicast+0x7d0/0x7d0 [ 2377.551150][T13867] ? apic_timer_interrupt+0xa/0x20 [ 2377.556231][T13867] ? wait_woken+0x250/0x250 [ 2377.560720][T13867] ? __tipc_sendmsg+0x44d/0x2d30 [ 2377.565628][T13867] ? __sanitizer_cov_trace_switch+0x60/0xf0 [ 2377.571491][T13867] __tipc_sendmsg+0x120d/0x2d30 [ 2377.576313][T13867] ? local_bh_enable+0x20/0x20 [ 2377.581063][T13867] ? _raw_spin_lock_bh+0xa4/0x180 [ 2377.586067][T13867] ? _local_bh_enable+0x30/0x30 [ 2377.590902][T13867] ? selinux_socket_sendmsg+0x10b/0x320 [ 2377.596423][T13867] ? lock_sock_nested+0x25a/0x320 [ 2377.601678][T13867] ? _local_bh_enable+0x30/0x30 [ 2377.607479][T13867] ? tipc_recvmsg+0x17c0/0x17c0 [ 2377.612558][T13867] tipc_sendmsg+0x51/0x70 [ 2377.616876][T13867] kernel_sendmsg+0xe2/0x120 [ 2377.621452][T13867] sock_no_sendpage+0x13f/0x1b0 [ 2377.626816][T13867] ? __receive_sock+0xb0/0xb0 [ 2377.631466][T13867] ? apic_timer_interrupt+0xa/0x20 [ 2377.636564][T13867] ? __receive_sock+0xb0/0xb0 [ 2377.641211][T13867] sock_sendpage+0xd0/0x120 [ 2377.645683][T13867] pipe_to_sendpage+0x23b/0x300 [ 2377.650503][T13867] ? sock_fasync+0xf0/0xf0 [ 2377.654891][T13867] ? generic_splice_sendpage+0x200/0x200 [ 2377.660508][T13867] ? page_cache_pipe_buf_confirm+0x113/0x210 [ 2377.666456][T13867] __splice_from_pipe+0x2d3/0x870 [ 2377.671453][T13867] ? generic_splice_sendpage+0x200/0x200 [ 2377.677167][T13867] generic_splice_sendpage+0x172/0x200 [ 2377.682595][T13867] ? iter_file_splice_write+0xf20/0xf20 [ 2377.688137][T13867] ? iter_file_splice_write+0xf20/0xf20 [ 2377.693651][T13867] splice_direct_to_actor+0x496/0xb00 [ 2377.699002][T13867] ? do_splice_direct+0x3d0/0x3d0 [ 2377.704097][T13867] ? pipe_to_sendpage+0x300/0x300 [ 2377.709095][T13867] ? security_file_permission+0x128/0x300 [ 2377.714870][T13867] do_splice_direct+0x279/0x3d0 [ 2377.719692][T13867] ? splice_direct_to_actor+0xb00/0xb00 [ 2377.725208][T13867] ? security_file_permission+0x128/0x300 [ 2377.730913][T13867] do_sendfile+0x89d/0x1110 [ 2377.735388][T13867] ? compat_writev+0x390/0x390 [ 2377.740122][T13867] ? put_timespec64+0x106/0x150 [ 2377.744941][T13867] ? ktime_get_raw+0x130/0x130 [ 2377.749676][T13867] ? get_timespec64+0x1c0/0x1c0 [ 2377.754495][T13867] ? __se_sys_futex+0x31d/0x440 [ 2377.759492][T13867] __x64_sys_sendfile64+0x1ae/0x220 [ 2377.764662][T13867] ? __ia32_sys_sendfile+0x240/0x240 [ 2377.769940][T13867] ? do_syscall_64+0x10c/0x150 [ 2377.774778][T13867] do_syscall_64+0xcb/0x150 [ 2377.779253][T13867] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2377.785131][T13867] RIP: 0033:0x45de59 [ 2377.788998][T13867] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2377.808572][T13867] RSP: 002b:00007f9ea02dfc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 2377.816952][T13867] RAX: ffffffffffffffda RBX: 0000000000027ec0 RCX: 000000000045de59 [ 2377.825606][T13867] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 [ 2377.833562][T13867] RBP: 000000000118bf68 R08: 0000000000000000 R09: 0000000000000000 [ 2377.842284][T13867] R10: 0000000000200fc0 R11: 0000000000000246 R12: 000000000118bf2c [ 2377.850228][T13867] R13: 00007ffe17bf105f R14: 00007f9ea02e09c0 R15: 000000000118bf2c [ 2377.858179][T13867] [ 2377.860480][T13867] Allocated by task 13867: [ 2377.864868][T13867] __kasan_kmalloc+0x117/0x1b0 [ 2377.869601][T13867] kmem_cache_alloc+0x1d5/0x250 [ 2377.874420][T13867] __netdev_alloc_skb+0x1d8/0x710 [ 2377.879415][T13867] __ieee80211_beacon_get+0x628/0x11b0 [ 2377.884846][T13867] ieee80211_beacon_get_tim+0xb7/0x500 [ 2377.890287][T13867] mac80211_hwsim_beacon_tx+0xd4/0x570 [ 2377.895832][T13867] __iterate_interfaces+0x1fc/0x390 [ 2377.901002][T13867] ieee80211_iterate_active_interfaces_atomic+0x2e/0x40 [ 2377.909060][T13867] mac80211_hwsim_beacon+0xa1/0x180 [ 2377.914242][T13867] __run_hrtimer+0x405/0x7a0 [ 2377.918803][T13867] hrtimer_run_softirq+0x320/0x450 [ 2377.923886][T13867] __do_softirq+0x22e/0x569 [ 2377.928495][T13867] [ 2377.930794][T13867] Freed by task 13867: [ 2377.934857][T13867] __kasan_slab_free+0x168/0x220 [ 2377.939764][T13867] slab_free_freelist_hook+0xd0/0x150 [ 2377.945105][T13867] kmem_cache_free+0xac/0x5c0 [ 2377.949764][T13867] mac80211_hwsim_beacon_tx+0x35e/0x570 [ 2377.955293][T13867] __iterate_interfaces+0x1fc/0x390 [ 2377.960463][T13867] ieee80211_iterate_active_interfaces_atomic+0x2e/0x40 [ 2377.967396][T13867] mac80211_hwsim_beacon+0xa1/0x180 [ 2377.972573][T13867] __run_hrtimer+0x405/0x7a0 [ 2377.977146][T13867] hrtimer_run_softirq+0x320/0x450 [ 2377.982225][T13867] __do_softirq+0x22e/0x569 [ 2377.986702][T13867] [ 2377.989003][T13867] The buggy address belongs to the object at ffff88817c5043c0 [ 2377.989003][T13867] which belongs to the cache skbuff_head_cache of size 240 [ 2378.003990][T13867] The buggy address is located 0 bytes inside of [ 2378.003990][T13867] 240-byte region [ffff88817c5043c0, ffff88817c5044b0) [ 2378.017486][T13867] The buggy address belongs to the page: [ 2378.023350][T13867] page:ffffea0005f14100 refcount:1 mapcount:0 mapping:ffff8881daa92a00 index:0x0 [ 2378.032424][T13867] flags: 0x8000000000000200(slab) [ 2378.037448][T13867] raw: 8000000000000200 ffffea0005f22b80 0000000500000002 ffff8881daa92a00 [ 2378.046001][T13867] raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 [ 2378.054557][T13867] page dumped because: kasan: bad access detected [ 2378.060934][T13867] [ 2378.063233][T13867] Memory state around the buggy address: [ 2378.068848][T13867] ffff88817c504280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2378.076879][T13867] ffff88817c504300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc [ 2378.084911][T13867] >ffff88817c504380: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 2378.092940][T13867] ^ [ 2378.099059][T13867] ffff88817c504400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2378.107109][T13867] ffff88817c504480: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc [ 2378.115137][T13867] ================================================================== 12:54:00 executing program 1: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ffff050074980904000012070103000905010200ffe000000905820241"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d3) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x125) pipe(&(0x7f0000000200)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) getsockname$packet(r4, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, r6, 0x3}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8, 0x1, 'sit\x00'}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8, 0x1, r5}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @multicast1}]}}}]}, 0x40}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r2, 0x89fb, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000140)={'sit0\x00', r6, 0x2, 0xff, 0x6, 0xbb, 0xc, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @private0={0xfc, 0x0, [], 0x1}, 0x7, 0x700, 0x8c, 0x80000001}}) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x92000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_DELCHAIN={0x3c, 0x5, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0x4}, [@NFTA_CHAIN_HOOK={0x28, 0x4, 0x0, 0x1, [@NFTA_HOOK_DEV={0x14, 0x3, 'veth1_to_hsr\x00'}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x47001c3e}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x5129fa53}]}]}, @NFT_MSG_NEWCHAIN={0x84, 0x3, 0xa, 0x101, 0x0, 0x0, {0x3, 0x0, 0x8}, [@NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_COUNTERS={0x64, 0x8, 0x0, 0x1, [@NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x401}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x4d8a}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x8}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x10000}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x9}, @NFTA_COUNTER_PACKETS={0xc}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x7}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x4}]}]}, @NFT_MSG_NEWSETELEM={0x2c, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x2}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0xc8, 0x9, 0xa, 0x3, 0x0, 0x0, {0xa, 0x0, 0x3}, [@NFTA_SET_DESC={0x74, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0x70, 0x2, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xec}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x80}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x401}]}, {0x34, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2000000}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}]}, {0x1c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xf93}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xffffffff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x101}]}]}]}, @NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}, @NFTA_SET_EXPR={0x14, 0x11, 0x0, 0x1, @synproxy={{0xd, 0x1, 'synproxy\x00'}, @void}}, @NFTA_SET_HANDLE={0xc, 0x10, 0x1, 0x0, 0x1}, @NFTA_SET_POLICY={0x8}, @NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0xf2}, @NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x4b}]}, @NFT_MSG_DELCHAIN={0x14, 0x5, 0xa, 0x301, 0x0, 0x0, {0x1, 0x0, 0x2}}, @NFT_MSG_NEWSETELEM={0x1580, 0xc, 0xa, 0x401, 0x0, 0x0, {0x5, 0x0, 0x7}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x1550, 0x3, 0x0, 0x1, [{0x153c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_USERDATA={0xb7, 0x6, 0x1, 0x0, "1ee4dd28ef678650af141c240b796da4127b5e3ac8853cce643dfb3d6ee7141e8f84ffd102cb4ba4f76a9711d8ef5c81b39834ca098802158649ef1c0448ceba5385ea8b1c30c27111aa04d81633163a2469bc8f9d8b4d5a0ea1c441dd97fc860be7af397b3f86eedf0ea932f8b0ae06b8b0f8fd0a527998e4af8b1faf9f511ea6bb1e361ae1a718584899e38ca30b46e622c9b790128d9dd3f4acdbdcc9ff98e208eaee97cd13cb51a6039e20fd7ef95b4003"}, @NFTA_SET_ELEM_USERDATA={0x5f, 0x6, 0x1, 0x0, "4b40295ebf96d58279547dd5358e98a83303cbf8152d79e9834ea3d5750d18c17a86aa9b827ee872ee1b3a1731c937aeddeaedaeacb62d3e7a3deef9b73ec03049bc03f1346c4a8fe6cbd20b3982198948a3e9370a238608828e6e"}, @NFTA_SET_ELEM_KEY_END={0x1030, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VALUE={0x1004, 0x1, "7a3f13dd53d27cc69b22b58ea33a2d2871fe71a144ff4985a7cd073a6d3fca1ea2d0f4c25c6c2db28cafdb239671514144df62cac7ea1aedfcbf4b386c272c6ebb9a49f1f58730084a81d3ad01b9059b0d7e8ea18d3fe54cf511ec293cf153e2397fe6f61c27a9fc4115780f5184e0c792d6bbecc26ffcff654e25469322d800903545359cd714f358ec65393520dc885473cc00bd5e3c8c5d254c99c92e0058fd259f29410e3b33e91a442272b2d5a56f18d6fd2b06e7d6595ab2dbec988250c0c4c10cc2fa970122eb5af45e6c77ddd13ea82cb9d81444b8de3c45408fa1c2b394e4aa3a9edaca6635d9516eda821a1d7eb773319aeba52df98d056fe38aefeb0b8956248a539fb3c42593dcfaf6f686485cea616cf0cd81b8d1896758862bfd4fefe37635b3676a85f6f7a2f48f7933bff4ff3cc911402eebeaa3a8d340b57e3f1dd0b2dc09a971fc914d04b7cc24d953ab21e15109e4a17f4cdc3603cf8be5fc9b92ea5cfa38d2df9c085afe63648d3e58fc293362cd65fda5169a9edeef6957179984bef607e71588a1861910b70e3a673de64bdecca450e96f8bafb8c138e0927ba00e7ce3487b5c677b714658a096092bcd4d552256b3d1d535ff4fa99a1bf4b2c62a9fc9de434849a9ff64d3f7c363e10941f3f24226110f3bbe86d228126807ec50ad97be0c5b117bce2749f5b65fdcc06717c44eb5d8afc77cf34394a32853f5b0825d934833a436391b39ccd6f83702dbb79219f1b31f4a1aba263f424c4e1fceb780b34c8addc3e9720f73a03926ed9abcbbe9f8f312d5322e0c7bf48e3ea50ed6195322a0308e374060e1ccfd396422d654e82b36e06667684763ec31fff45d17a407560ef017642c408a569ddf9233e1a206d91a0947241d06358101b46956e5ef7c41203b88ebe022cfcb21de849facf2c7324df4c8b388cb51572b5cc51753284e77feeb29914bc640c68220bb855b71f434a59958ce5380d8878d255376499737cec2225916c7e17f5608b622c32a0518038adc6b8100f5083df9ffb81e354bdea75f472f1846da46f412256529dd0abd0ba625407b26256f95e0a0ebfb9b01de92d84b619c22625c6ba15359dd86dbb74524203db989dbfd8de3bb3299ddda7d73e5118bc2f78c65e86f06273312705ef092ca6d64ab25a3584b73c5c86422f0c34a62ed574c4b8a3267c0d890b40413e027101318262c6b6a2221c4b7c18a180ebf12db5c5dee90c0d7926ce42a985dd9e075489d8f299079391414459b4b27fdd0bdfdd79e50c629813d7e7b9614da67e4c90ec8a15e61ed9cd3ba8d481def588052ac94d7611efd790daecefbf5a89a5434eff81d30c3db596c7cb5be2d51903d0097bb33e0bf3083b658b543af94dde55cc13706303896f08d7518cb121aa0a510f57c380e2f707adf4a96ebd99cc817ebf7e7d97fbbd970b334e10c25861972219686d4c6bc78c1adee411ef1b4b0670e4bb145bd7e511e677ef9a7651fff8fcd20a28c819e616fedfc258c20018f8221cf1195209eceef5c56d4cbd17dba010e9895aea1dc03340bdadd8cb2d8c87211dfe09be1efb3855d705aed474c46845e492f51f20364a224fd7c49db7ccb2d0a2d96839d31dc0ff6612364dde5e7b6a35ebbad03cac9a027afd10085441b0fa6ef2be419455467264c5594ea367b9772004f28822b5e2600f591e131492539e6ba14db3b4e4ffd6e6ac573024bb68b6b981b39a78760bbeca05e58c5076c998524b4c26861c0e4ed0d3ea4c0f0b4186d48a159d6fb5975742c210b924467956dc47e4789665bcd40f79ebf39509ab4407c42ad1a453dfa2b399052005a2cb2caefea07ac4d499e152337d855c076d2c0241292c5138608412ba9febf69a9dbfb4e209795be9761270b31716bc860d7b23916ecdb15b1f4548533df88dc23df428abfba1e37bca4200775de6b45b013d4ae0143f84d9006df3af736a48d7067c217d30a4f80e71fd4beda57c74e61ddb9cc2523e885a1e3362a7493c3cd78b223080ae0515b153d66ef13f3f1488f7efcfd3c776e4bac143fb60059a7ca5e8bab8b277c94ed4d80ebb7b71cfa3f0938144218036bfc25e26953945ed0db2c2bd3092845c921c175d0323baa80c2d729975cc3058892e2fe6268a4537f27d47d2736ea00bac3972d3002743ffbeac4ba41029cdf6687e0687b0ef29368d4a4cfa4399a7370f59faa76e1f7bea391972d4a8623cac6dcd100f7cb66e76d33a5d393f72b42cb5b03137d59f6bb18600ebad177862fc6063977acbef60a0d34df4bce9a1396a7b585642835915966a24e4476c85e857697f96992622567921badbe5e85f4bec24a6bf884d8e25c55a41d3e8764a454a8b1efd41cf94bfb5856d182adcb6146c1b674fe390bf545107dcf864bb8b6acbd54902018437cc6cbb9baa15edd991e6721d10a859aa448a6ee4fbdd5dadd1980f98f727e67019298c66d1366abc5b535480c1b438cb87243b892d08a8eb62b0f93c2e824a133c1ee9cd27d19c240dd4adcfa094bb7fc8e8afbbf477e775f6d2b19ea9823c1e3a6892124ab7455ddd82db6844fd24181f5df1e5f1067c07242fad1b18b4bd439bcc5102a1c51ff488c2c86c0be0d366f27d8214b131b3551013e24d1783f9f6588ff80f57b7e4fbf109522d4796f4a7e305ba8e920c810472ddbe5afb19db98792b39255193461cf0ad3c0350e8dca3b7b2709ee6de37017b9d24852ac232ed7a2c6fe80198ca7fb3913401217e04d6bb6c3b82d84bcc4b83d5b72aac9836dea7d21335d11110a73d5e47af8b1288e21e70b7ccd8e4f5f21926bf828b0457cd049d6175511d4a8e42d9a6718633159bfc8e1faa426e08bceae3ad62b4346b8207b3fbb6ab5d8956f078725d028d8389524097e1ace7b553aaf29f7f13ac04b11a459e8876bd3a5f3f35a799ad550dadedee5925a39ed8c5949d55399eda2679f51d10b4933198f053c63bb4781bd867eb97f9d39c1791504d11e0f852326b289ef4ead9f734905350cc4d651017ab4de6073c43a367d1b2f2697768a508862dee60400778d5a6283b8237b8f269295782b234bc09fa0582c95e6a4c02dd9f3b1a8aeccdc82650fb3e215d65cd0061ae9ef02d4b9529013d6c23f4db8bed6d75879eba204fb1ed05a5ff2e1d7d3fe15c751207078d3da6f90ea6cdde48a134df5b403b83b2b13441ee3dcd7f1ad8927d925edf355dd7578fd8dde893c345d7c54171fb37d51f242d29065afd4654e3bfd30f80f42b66e8f422d5c1846e86b54fe61ddc41f79ac1573a2d1fa0177d46493b793a8a65c46b0bf74ede9eb183d516d76a552a6c0e4b3418e92e16edd795ad9e30963dbd4c2d0bb15cf25a46c23f0476d56511b5284baf24fad1818d0db234113ea0ef41eeaa8726125af6e75c35e5a6882976faf8c5bf35ddd1cc55d910957be056410df4dcca47d8ad407dafacc523d3c4e67119fe9e4581ca763ce63491b8acafadff7b7b710f107e74e9c6f6ca2e970f85038a150246ce414c727095407b321d4c3cd0c66fd3645a293758d86a87ae47589ad35aa7a64aaa2ec71544fc81cbdf1261f9c2bfef12c2f8315db60c99f246e0ce28471b211cef1a01c82c83317d04c373915aa7f2e03107858d339b91f64552154c1e26426a754c96e768c3c0addaa526ed8cda7df9af9aa46f3a4ae6acee8b97a052bde59db064d1c71fc1a4f704979874cb3627c65be24b49599d5199f7418b46a32d7433ba04d7ca4b81551eb702097a8bf691b469f52d91cecc89afc7279c8c4de9cccdac085be4fa13d40fbdcd15d3be5a5c8b0760967c4315b28ca4f972a6f53080839d256c5617986d1db7510e027a3ba0268a2cb8a80ec396a376a6d28fdedc3d5c759e8c9514ecd16adaa2fce53d176bce36f644f89e83b0cb499621d308f1e21b1d5c8260a05b2cbc5a4152a05614061086bcfc66506f776e99a748c2e4f0e13c789ff8a2fc450cc74ddc09df55b33f25e86af77f4da411ebad44855096f0a7210dae4776e9a8ad98fdd29fbc351ccd0048bdfddbc6c403fc318d666b3f7b084b68ca7346ecdca9b5e23c62ff302b8bce2183aaa99c5143902ee9a6cc91e43c72c3a2473f092cace28e12b8743ac5f335b8189b9d1a319f3150aeaccad1b613b154816273eb0a45b42a2cec078835289b6c5d8c210bd18e293a19cb5107d7438aa1e5383c29e14658ba6235afa2a69d82ede3e79b6a9e7dc23f7c8959b19f2671b8173a6adc1ff24782c8858d16f4ee98435ceab27acb74fae1d5abb2a462e53d8a9ccf559e1a64071c479afead50da9f6b9afc3f25c43ee1a2db6b413e9ba5d086c3932108090c170c8912b433e4015fa16266ff6d2adc0c4c41562ee1ac8180625aeb8cbfc8e63f37da254bc07a64f15a34f71fd16156e4f198a5ea63db67773f1fd332c8488fe31ea377292b1e8ddb33aa18294376cef0a6b064aa0a61387ad8335bd73cddde4863a27b016494c46d7a492f7aca9b12f234a36ec6aa8d3078824f0ff450dadf69e6879c29a55fbfc35c08e0acbec1a7244fc1dd4eb56dd2e8f03e24abf2a0c892b0d29e86973fad9f6ced3e81d97b7b3daa45a8d8cd26da4797c5be232cbfbd34d438f7054053539076e5a8f93755bfb96f2f44c366d3c28a909f41e4d65edb22b7f7a96a1cf0fdecae2109126b409708f09efe803f3dd477b4c7e113d792e1f642a0edd58cdec22ffd4f6b91e49eac82cdef18f180714086ee3e077bec3e85b6bf392693365d6ab876a7438a0070842fd559bd2e3db295724ddc95977b0e2db13644390bfe69fbfe242b8623a24fb7198a57666c2a0c5b066b2c4d047e404e0ccca08fba6d498720d5dfa2998b5eb97b9ce8f312020bc5c20bc1c01923783410c4c46f93e3679d7936702ac6c864d710f74cf2cba4bd9b188dcf4fdd7968878960a2c10d6a413bf47caae7c10d3630e77c679f207ac3a26131a41c47be865e095052c9e39ec06c92602352c854bbe10de37103c8cb6404a811e95993f37d19e9d65b26dd089f7f3ed82cc04db65478054c7358b131508b9fd1d65d3303a1a9416b363e9136ccb0b25b9c634bb245551162cbfa9f74a3508a4737ba47b1e6e62f5b436c3ff66f0983e3d8f082475139678c5afbdaf61b8ae555460cd1947487a07760585a7f1841f11d4a1bcb6ba9efd08c919567a7943a72b1c74c8e2cbe66c3a2ad1baa402b6bfc78c22bba2f5a5c8a4e22cf7166fec9f97bc16c6252618df155b234b39c66fd100702d1917a7a6d25a97abec37f4aeecc9909b2f31f4857f5b47e761dea3288ceb2a5f8935438592e49c55cdb7ea2bc1437c872149edb8ea489e778f3c53f212cba612ee6d2c17892acbf296460df48eee16027b3a33425c7857faaa9187b3750b102860855aaa159bba399ec4adb886f6d0cc8c2ee7ee738e7db09efe0deffe88d006836ae8edf4397040f0bc81104488819cf800b6f8a295a59c14ae2c833c76fe020e1ad7190555ea016d303b8e99a2325bdc6d11273e16f35b518cbe3f839066e6878222b7d783f65f08788538006c8fe6de35e4d9022717a67124679c437c22d59312cd94124b2cb9e9c1b90b25a3a704e07f8b5010bc374b605cec1b740a0cf4b7ce2e681635b02e0626621e94afcacaa4cafa83b9379e276ad2d6b3912e81f2d5532d661e24d2ada902a3538e3fb0fba66e3924525dec98fba1505d391e3ea51fd6358572b8d8d098b0f8b013cee7a7a425f16d23d671c430cdbfe587f5f0c36e0288a452d14784b4f66b383c52"}]}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x4}, @NFTA_SET_ELEM_KEY_END={0x204, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0xe1, 0x1, "6092f56539076fb74a39340219ca95816bd0c882f9650f7addc24a3647bdae2244bec6d6daa5e228caef77055a0b974246eb75b76a0857d1f6282f7c1b6f363641b4927b064b7e6f6794783da0f63916c29cb7ce8be7e0727544915dba32c4a1038a35f02fe7c19dbc596f40b6f7c651b1802f89c781f0b950b252496232af28569222c9d66cf4fbc1159a70c86ad90dfe16a8708d3a36d6f7ab822f685086805f68f78b8250f5a1e4167edfada349d5a13a99a148f58c52acb8631a1b616b9e9c1301c9358ae4ae6a8eeff4f53505cb46ee149acedb240a5f20c9b084"}, @NFTA_DATA_VERDICT={0x54, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffff8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VALUE={0x5a, 0x1, "861b3f2ed45074b07d648215836c1d9df1001172a3a61c7eafae254de8fb651d302720f8b6e97d7d5693000ea679a4feb090f03fccd79df4858919de562bc458fb2dcb96cbfb6fca4096e53fb905e028cb858574c8ee"}, @NFTA_DATA_VERDICT={0x1c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VERDICT={0x50, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}]}, @NFTA_SET_ELEM_FLAGS={0x8}, @NFTA_SET_ELEM_KEY={0xb0, 0x1, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x24, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VERDICT={0x2c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8}]}, @NFTA_DATA_VALUE={0x5c, 0x1, "a7b8ef21f89cca4f8b3517d54947a4bb501ae750cfdef41ba63064131cc9156d58462910b73a70fad8ed87b28946dfe8b9b6832283632a70321fd83eb4e9f3ebaeffca99c55bf713966127686e33b6b159accaa327e475c7"}]}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0xf5f2}, @NFTA_SET_ELEM_KEY={0x110, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x62, 0x1, "4145f1f0d7fc4ccc9e82f08dcb99e549245c6763b2f450d1ccf9d7833ba12516323f38210fc6b4f8e7847913485fb8f3ed8d662183f033469b299a0664c67e7278c110f2c7d4e8ddd2bf1366bebb2f005e0140387148987d4bb6fa2af57c"}, @NFTA_DATA_VERDICT={0x44, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}, @NFTA_DATA_VALUE={0x63, 0x1, "9a0e6468c5c89940fff40c7d3105868825dac4c34c9dedf4ed3e8bdfea59113bdfa8676e6cd416e8101baab9e361b2c10f4244c21b70d749041ac278fa72a53015e065d80c20680d65c7e0ca2810946dc1af578d9c2ad8902f907474529a12"}]}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x4}]}, {0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}]}]}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x2}]}], {0x14}}, 0x1770}, 0x1, 0x0, 0x0, 0x40800}, 0x100) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3a290, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 12:54:00 executing program 3: syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000090000082505a8a4070000000101090224ff"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x2, "4fdd"}, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) [ 2378.292068][T13867] ================================================================== [ 2378.300390][T13867] BUG: KASAN: double-free or invalid-free in kmem_cache_free+0xac/0x5c0 [ 2378.309131][T13867] [ 2378.311456][T13867] CPU: 0 PID: 13867 Comm: syz-executor.5 Tainted: G B 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2378.323096][T13867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2378.333143][T13867] Call Trace: [ 2378.337140][T13867] dump_stack+0x1b0/0x21e [ 2378.341460][T13867] ? show_regs_print_info+0x12/0x12 [ 2378.346649][T13867] ? printk+0xc0/0x104 [ 2378.350709][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2378.355632][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2378.360469][T13867] print_address_description+0x96/0x5d0 [ 2378.366000][T13867] ? devkmsg_release+0x11c/0x11c [ 2378.370921][T13867] ? __perf_event_task_sched_out+0x1127/0x1250 [ 2378.377057][T13867] ? __perf_event_task_sched_in+0x4ed/0x550 [ 2378.383315][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2378.388158][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2378.392999][T13867] kasan_report_invalid_free+0x54/0xc0 [ 2378.398447][T13867] __kasan_slab_free+0x102/0x220 [ 2378.403386][T13867] ? trace_event_raw_event_sched_switch+0x480/0x480 [ 2378.409963][T13867] ? _raw_spin_unlock_irq+0x5/0x20 [ 2378.415062][T13867] ? finish_task_switch+0x235/0x4c0 [ 2378.420247][T13867] ? __schedule+0x8ae/0xe30 [ 2378.424735][T13867] ? is_mmconf_reserved+0x420/0x420 [ 2378.429918][T13867] ? fixup_exception+0x92/0xd0 [ 2378.434666][T13867] ? do_trap+0x148/0x340 [ 2378.441929][T13867] ? preempt_schedule_irq+0xc7/0x110 [ 2378.447185][T13867] ? preempt_schedule_notrace+0x110/0x110 [ 2378.452878][T13867] slab_free_freelist_hook+0xd0/0x150 [ 2378.458947][T13867] ? tipc_mcast_xmit+0x10a8/0x16c0 [ 2378.464044][T13867] kmem_cache_free+0xac/0x5c0 [ 2378.468691][T13867] ? kasan_report+0x27/0x50 [ 2378.473165][T13867] tipc_mcast_xmit+0x10a8/0x16c0 [ 2378.478206][T13867] ? tipc_bcast_dec_bearer_dst_cnt+0x240/0x240 [ 2378.484350][T13867] ? __check_object_size+0x2e5/0x3b0 [ 2378.489607][T13867] tipc_sendmcast+0xc00/0xeb0 [ 2378.494252][T13867] ? tipc_send_group_unicast+0x7d0/0x7d0 [ 2378.501287][T13867] ? apic_timer_interrupt+0xa/0x20 [ 2378.506371][T13867] ? wait_woken+0x250/0x250 [ 2378.510847][T13867] ? __tipc_sendmsg+0x44d/0x2d30 [ 2378.515757][T13867] ? __sanitizer_cov_trace_switch+0x60/0xf0 [ 2378.521707][T13867] __tipc_sendmsg+0x120d/0x2d30 [ 2378.526617][T13867] ? local_bh_enable+0x20/0x20 [ 2378.531354][T13867] ? _raw_spin_lock_bh+0xa4/0x180 [ 2378.536547][T13867] ? _local_bh_enable+0x30/0x30 [ 2378.541391][T13867] ? selinux_socket_sendmsg+0x10b/0x320 [ 2378.546919][T13867] ? lock_sock_nested+0x25a/0x320 [ 2378.551930][T13867] ? _local_bh_enable+0x30/0x30 [ 2378.556750][T13867] ? tipc_recvmsg+0x17c0/0x17c0 [ 2378.561569][T13867] tipc_sendmsg+0x51/0x70 [ 2378.565879][T13867] kernel_sendmsg+0xe2/0x120 [ 2378.570454][T13867] sock_no_sendpage+0x13f/0x1b0 [ 2378.575305][T13867] ? __receive_sock+0xb0/0xb0 [ 2378.579953][T13867] ? apic_timer_interrupt+0xa/0x20 [ 2378.585120][T13867] ? __receive_sock+0xb0/0xb0 [ 2378.589777][T13867] sock_sendpage+0xd0/0x120 [ 2378.594265][T13867] pipe_to_sendpage+0x23b/0x300 [ 2378.599171][T13867] ? sock_fasync+0xf0/0xf0 [ 2378.603560][T13867] ? generic_splice_sendpage+0x200/0x200 [ 2378.609274][T13867] ? page_cache_pipe_buf_confirm+0x113/0x210 [ 2378.615231][T13867] __splice_from_pipe+0x2d3/0x870 [ 2378.620339][T13867] ? generic_splice_sendpage+0x200/0x200 [ 2378.626116][T13867] generic_splice_sendpage+0x172/0x200 [ 2378.631558][T13867] ? iter_file_splice_write+0xf20/0xf20 [ 2378.637074][T13867] ? iter_file_splice_write+0xf20/0xf20 [ 2378.642589][T13867] splice_direct_to_actor+0x496/0xb00 [ 2378.648017][T13867] ? do_splice_direct+0x3d0/0x3d0 [ 2378.653010][T13867] ? pipe_to_sendpage+0x300/0x300 [ 2378.658031][T13867] ? security_file_permission+0x128/0x300 [ 2378.663835][T13867] do_splice_direct+0x279/0x3d0 [ 2378.668757][T13867] ? splice_direct_to_actor+0xb00/0xb00 [ 2378.674624][T13867] ? security_file_permission+0x128/0x300 [ 2378.680337][T13867] do_sendfile+0x89d/0x1110 [ 2378.684816][T13867] ? compat_writev+0x390/0x390 [ 2378.689550][T13867] ? put_timespec64+0x106/0x150 [ 2378.694386][T13867] ? ktime_get_raw+0x130/0x130 [ 2378.699153][T13867] ? get_timespec64+0x1c0/0x1c0 [ 2378.703997][T13867] ? __se_sys_futex+0x31d/0x440 [ 2378.708833][T13867] __x64_sys_sendfile64+0x1ae/0x220 [ 2378.714004][T13867] ? __ia32_sys_sendfile+0x240/0x240 [ 2378.719257][T13867] ? do_syscall_64+0x10c/0x150 [ 2378.723990][T13867] do_syscall_64+0xcb/0x150 [ 2378.728462][T13867] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2378.734341][T13867] RIP: 0033:0x45de59 [ 2378.738207][T13867] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2378.758402][T13867] RSP: 002b:00007f9ea02dfc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 2378.766797][T13867] RAX: ffffffffffffffda RBX: 0000000000027ec0 RCX: 000000000045de59 [ 2378.774743][T13867] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 [ 2378.782686][T13867] RBP: 000000000118bf68 R08: 0000000000000000 R09: 0000000000000000 [ 2378.790640][T13867] R10: 0000000000200fc0 R11: 0000000000000246 R12: 000000000118bf2c [ 2378.798588][T13867] R13: 00007ffe17bf105f R14: 00007f9ea02e09c0 R15: 000000000118bf2c [ 2378.806532][T13867] [ 2378.808833][T13867] Allocated by task 13867: [ 2378.813311][T13867] __kasan_kmalloc+0x117/0x1b0 [ 2378.818061][T13867] kmem_cache_alloc+0x1d5/0x250 [ 2378.822890][T13867] __netdev_alloc_skb+0x1d8/0x710 [ 2378.827883][T13867] __ieee80211_beacon_get+0x628/0x11b0 [ 2378.836176][T13867] ieee80211_beacon_get_tim+0xb7/0x500 [ 2378.841603][T13867] mac80211_hwsim_beacon_tx+0xd4/0x570 [ 2378.847044][T13867] __iterate_interfaces+0x1fc/0x390 [ 2378.852558][T13867] ieee80211_iterate_active_interfaces_atomic+0x2e/0x40 [ 2378.859460][T13867] mac80211_hwsim_beacon+0xa1/0x180 [ 2378.864656][T13867] __run_hrtimer+0x405/0x7a0 [ 2378.869302][T13867] hrtimer_run_softirq+0x320/0x450 [ 2378.874396][T13867] __do_softirq+0x22e/0x569 [ 2378.879659][T13867] [ 2378.882141][T13867] Freed by task 13867: [ 2378.886180][T13867] __kasan_slab_free+0x168/0x220 [ 2378.891086][T13867] slab_free_freelist_hook+0xd0/0x150 [ 2378.896438][T13867] kmem_cache_free+0xac/0x5c0 [ 2378.901084][T13867] mac80211_hwsim_beacon_tx+0x35e/0x570 [ 2378.906598][T13867] __iterate_interfaces+0x1fc/0x390 [ 2378.911781][T13867] ieee80211_iterate_active_interfaces_atomic+0x2e/0x40 [ 2378.918689][T13867] mac80211_hwsim_beacon+0xa1/0x180 [ 2378.924059][T13867] __run_hrtimer+0x405/0x7a0 [ 2378.928636][T13867] hrtimer_run_softirq+0x320/0x450 [ 2378.933825][T13867] __do_softirq+0x22e/0x569 [ 2378.938293][T13867] [ 2378.940594][T13867] The buggy address belongs to the object at ffff88817c8ae140 [ 2378.940594][T13867] which belongs to the cache skbuff_head_cache of size 240 [ 2378.955149][T13867] The buggy address is located 0 bytes inside of [ 2378.955149][T13867] 240-byte region [ffff88817c8ae140, ffff88817c8ae230) [ 2378.968332][T13867] The buggy address belongs to the page: [ 2378.973935][T13867] page:ffffea0005f22b80 refcount:1 mapcount:0 mapping:ffff8881daa92a00 index:0x0 [ 2378.983007][T13867] flags: 0x8000000000000200(slab) [ 2378.988004][T13867] raw: 8000000000000200 0000000000000000 0000000400000001 ffff8881daa92a00 [ 2378.997599][T13867] raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 [ 2379.006250][T13867] page dumped because: kasan: bad access detected [ 2379.012629][T13867] [ 2379.014941][T13867] Memory state around the buggy address: [ 2379.020558][T13867] ffff88817c8ae000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2379.028586][T13867] ffff88817c8ae080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc [ 2379.036703][T13867] >ffff88817c8ae100: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 2379.044732][T13867] ^ [ 2379.050853][T13867] ffff88817c8ae180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2379.058882][T13867] ffff88817c8ae200: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc [ 2379.066923][T13867] ================================================================== [ 2379.099044][T13867] ================================================================== [ 2379.107268][T13867] BUG: KASAN: double-free or invalid-free in kmem_cache_free+0xac/0x5c0 [ 2379.115560][T13867] [ 2379.117870][T13867] CPU: 0 PID: 13867 Comm: syz-executor.5 Tainted: G B 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2379.129461][T13867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2379.139500][T13867] Call Trace: [ 2379.142782][T13867] dump_stack+0x1b0/0x21e [ 2379.147093][T13867] ? show_regs_print_info+0x12/0x12 [ 2379.152273][T13867] ? printk+0xc0/0x104 [ 2379.156399][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2379.161217][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2379.166220][T13867] print_address_description+0x96/0x5d0 [ 2379.171823][T13867] ? devkmsg_release+0x11c/0x11c [ 2379.176738][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2379.181570][T13867] ? ___preempt_schedule+0x16/0x20 [ 2379.186654][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2379.191475][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2379.196294][T13867] kasan_report_invalid_free+0x54/0xc0 [ 2379.201721][T13867] __kasan_slab_free+0x102/0x220 [ 2379.206644][T13867] ? trace_event_raw_event_sched_switch+0x480/0x480 [ 2379.213466][T13867] ? _raw_spin_unlock_irq+0x5/0x20 [ 2379.218567][T13867] ? finish_task_switch+0x235/0x4c0 [ 2379.223738][T13867] ? __schedule+0x8ae/0xe30 [ 2379.228223][T13867] ? is_mmconf_reserved+0x420/0x420 [ 2379.233392][T13867] ? fixup_exception+0x92/0xd0 [ 2379.238151][T13867] ? apic_timer_interrupt+0xa/0x20 [ 2379.243320][T13867] ? skb_release_data+0x46f/0x6f0 [ 2379.248575][T13867] slab_free_freelist_hook+0xd0/0x150 [ 2379.253916][T13867] ? tipc_mcast_xmit+0x10a8/0x16c0 [ 2379.258997][T13867] kmem_cache_free+0xac/0x5c0 [ 2379.263652][T13867] ? kasan_report+0x27/0x50 [ 2379.268127][T13867] tipc_mcast_xmit+0x10a8/0x16c0 [ 2379.273056][T13867] ? tipc_bcast_dec_bearer_dst_cnt+0x240/0x240 [ 2379.280307][T13867] ? __check_object_size+0x2e5/0x3b0 [ 2379.285576][T13867] tipc_sendmcast+0xc00/0xeb0 [ 2379.290224][T13867] ? tipc_send_group_unicast+0x7d0/0x7d0 [ 2379.295826][T13867] ? apic_timer_interrupt+0xa/0x20 [ 2379.300910][T13867] ? wait_woken+0x250/0x250 [ 2379.305381][T13867] ? __tipc_sendmsg+0x44d/0x2d30 [ 2379.310289][T13867] ? __sanitizer_cov_trace_switch+0x60/0xf0 [ 2379.316149][T13867] __tipc_sendmsg+0x120d/0x2d30 [ 2379.320970][T13867] ? local_bh_enable+0x20/0x20 [ 2379.325723][T13867] ? _raw_spin_lock_bh+0xa4/0x180 [ 2379.330717][T13867] ? _local_bh_enable+0x30/0x30 [ 2379.335535][T13867] ? selinux_socket_sendmsg+0x10b/0x320 [ 2379.341155][T13867] ? lock_sock_nested+0x25a/0x320 [ 2379.346148][T13867] ? _local_bh_enable+0x30/0x30 [ 2379.350969][T13867] ? tipc_recvmsg+0x17c0/0x17c0 [ 2379.355789][T13867] tipc_sendmsg+0x51/0x70 [ 2379.360107][T13867] kernel_sendmsg+0xe2/0x120 [ 2379.364673][T13867] sock_no_sendpage+0x13f/0x1b0 [ 2379.369517][T13867] ? __receive_sock+0xb0/0xb0 [ 2379.374164][T13867] ? apic_timer_interrupt+0xa/0x20 [ 2379.380098][T13867] ? __receive_sock+0xb0/0xb0 [ 2379.387098][T13867] sock_sendpage+0xd0/0x120 [ 2379.391676][T13867] pipe_to_sendpage+0x23b/0x300 [ 2379.396525][T13867] ? sock_fasync+0xf0/0xf0 [ 2379.400925][T13867] ? generic_splice_sendpage+0x200/0x200 [ 2379.406647][T13867] ? page_cache_pipe_buf_confirm+0x113/0x210 [ 2379.413062][T13867] __splice_from_pipe+0x2d3/0x870 [ 2379.418076][T13867] ? generic_splice_sendpage+0x200/0x200 [ 2379.423682][T13867] generic_splice_sendpage+0x172/0x200 [ 2379.429232][T13867] ? iter_file_splice_write+0xf20/0xf20 [ 2379.434748][T13867] ? iter_file_splice_write+0xf20/0xf20 [ 2379.440285][T13867] splice_direct_to_actor+0x496/0xb00 [ 2379.445636][T13867] ? do_splice_direct+0x3d0/0x3d0 [ 2379.450646][T13867] ? pipe_to_sendpage+0x300/0x300 [ 2379.455643][T13867] ? security_file_permission+0x128/0x300 [ 2379.461330][T13867] do_splice_direct+0x279/0x3d0 [ 2379.466332][T13867] ? splice_direct_to_actor+0xb00/0xb00 [ 2379.471935][T13867] ? security_file_permission+0x128/0x300 [ 2379.477639][T13867] do_sendfile+0x89d/0x1110 [ 2379.482129][T13867] ? compat_writev+0x390/0x390 [ 2379.487067][T13867] ? put_timespec64+0x106/0x150 [ 2379.492940][T13867] ? ktime_get_raw+0x130/0x130 [ 2379.497690][T13867] ? get_timespec64+0x1c0/0x1c0 [ 2379.502527][T13867] ? __se_sys_futex+0x31d/0x440 [ 2379.507538][T13867] __x64_sys_sendfile64+0x1ae/0x220 [ 2379.512726][T13867] ? __ia32_sys_sendfile+0x240/0x240 [ 2379.517989][T13867] ? do_syscall_64+0x10c/0x150 [ 2379.522724][T13867] do_syscall_64+0xcb/0x150 [ 2379.527217][T13867] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2379.533079][T13867] RIP: 0033:0x45de59 [ 2379.536946][T13867] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2379.556517][T13867] RSP: 002b:00007f9ea02dfc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 2379.565852][T13867] RAX: ffffffffffffffda RBX: 0000000000027ec0 RCX: 000000000045de59 [ 2379.573795][T13867] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 [ 2379.581738][T13867] RBP: 000000000118bf68 R08: 0000000000000000 R09: 0000000000000000 [ 2379.589680][T13867] R10: 0000000000200fc0 R11: 0000000000000246 R12: 000000000118bf2c [ 2379.597843][T13867] R13: 00007ffe17bf105f R14: 00007f9ea02e09c0 R15: 000000000118bf2c [ 2379.606442][T13867] [ 2379.608755][T13867] Allocated by task 13867: [ 2379.613166][T13867] __kasan_kmalloc+0x117/0x1b0 [ 2379.618009][T13867] kmem_cache_alloc+0x1d5/0x250 [ 2379.622837][T13867] __netdev_alloc_skb+0x1d8/0x710 [ 2379.628712][T13867] __ieee80211_beacon_get+0x628/0x11b0 [ 2379.634323][T13867] ieee80211_beacon_get_tim+0xb7/0x500 [ 2379.642979][T13867] mac80211_hwsim_beacon_tx+0xd4/0x570 [ 2379.648409][T13867] __iterate_interfaces+0x1fc/0x390 [ 2379.655920][T13867] ieee80211_iterate_active_interfaces_atomic+0x2e/0x40 [ 2379.662924][T13867] mac80211_hwsim_beacon+0xa1/0x180 [ 2379.668091][T13867] __run_hrtimer+0x405/0x7a0 [ 2379.672738][T13867] hrtimer_run_softirq+0x320/0x450 [ 2379.677907][T13867] __do_softirq+0x22e/0x569 [ 2379.682375][T13867] [ 2379.684675][T13867] Freed by task 13867: [ 2379.689669][T13867] __kasan_slab_free+0x168/0x220 [ 2379.694580][T13867] slab_free_freelist_hook+0xd0/0x150 [ 2379.699930][T13867] kmem_cache_free+0xac/0x5c0 [ 2379.704755][T13867] mac80211_hwsim_beacon_tx+0x35e/0x570 [ 2379.710367][T13867] __iterate_interfaces+0x1fc/0x390 [ 2379.715535][T13867] ieee80211_iterate_active_interfaces_atomic+0x2e/0x40 [ 2379.722453][T13867] mac80211_hwsim_beacon+0xa1/0x180 [ 2379.727636][T13867] __run_hrtimer+0x405/0x7a0 [ 2379.735341][T13867] hrtimer_run_softirq+0x320/0x450 [ 2379.740439][T13867] __do_softirq+0x22e/0x569 [ 2379.744909][T13867] [ 2379.747211][T13867] The buggy address belongs to the object at ffff88817c8ae500 [ 2379.747211][T13867] which belongs to the cache skbuff_head_cache of size 240 [ 2379.761757][T13867] The buggy address is located 0 bytes inside of [ 2379.761757][T13867] 240-byte region [ffff88817c8ae500, ffff88817c8ae5f0) [ 2379.774829][T13867] The buggy address belongs to the page: [ 2379.780526][T13867] page:ffffea0005f22b80 refcount:1 mapcount:0 mapping:ffff8881daa92a00 index:0x0 [ 2379.790986][T13867] flags: 0x8000000000000200(slab) [ 2379.795995][T13867] raw: 8000000000000200 0000000000000000 0000000400000001 ffff8881daa92a00 [ 2379.804569][T13867] raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 [ 2379.813926][T13867] page dumped because: kasan: bad access detected [ 2379.821824][T13867] [ 2379.824122][T13867] Memory state around the buggy address: [ 2379.829740][T13867] ffff88817c8ae400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2379.837782][T13867] ffff88817c8ae480: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc [ 2379.845815][T13867] >ffff88817c8ae500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2379.853842][T13867] ^ [ 2379.857890][T13867] ffff88817c8ae580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc [ 2379.865920][T13867] ffff88817c8ae600: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 2379.873949][T13867] ================================================================== [ 2379.899287][T13867] ================================================================== [ 2379.907387][T13867] BUG: KASAN: double-free or invalid-free in kmem_cache_free+0xac/0x5c0 [ 2379.915693][T13867] [ 2379.918024][T13867] CPU: 0 PID: 13867 Comm: syz-executor.5 Tainted: G B 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2379.930331][T13867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2379.940403][T13867] Call Trace: [ 2379.943774][T13867] dump_stack+0x1b0/0x21e [ 2379.948115][T13867] ? show_regs_print_info+0x12/0x12 [ 2379.953400][T13867] ? printk+0xc0/0x104 [ 2379.957603][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2379.962617][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2379.967448][T13867] print_address_description+0x96/0x5d0 [ 2379.972968][T13867] ? devkmsg_release+0x11c/0x11c [ 2379.977881][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2379.982810][T13867] ? ___preempt_schedule+0x16/0x20 [ 2379.987893][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2379.992817][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2379.997744][T13867] kasan_report_invalid_free+0x54/0xc0 [ 2380.003231][T13867] __kasan_slab_free+0x102/0x220 [ 2380.008165][T13867] ? trace_event_raw_event_sched_switch+0x480/0x480 [ 2380.014741][T13867] ? _raw_spin_unlock_irq+0x5/0x20 [ 2380.019916][T13867] ? finish_task_switch+0x235/0x4c0 [ 2380.025089][T13867] ? __schedule+0x8ae/0xe30 [ 2380.029665][T13867] ? is_mmconf_reserved+0x420/0x420 [ 2380.034840][T13867] ? fixup_exception+0x92/0xd0 [ 2380.039590][T13867] ? apic_timer_interrupt+0xa/0x20 [ 2380.044687][T13867] ? skb_release_data+0x46f/0x6f0 [ 2380.049697][T13867] slab_free_freelist_hook+0xd0/0x150 [ 2380.055039][T13867] ? tipc_mcast_xmit+0x10a8/0x16c0 [ 2380.060119][T13867] kmem_cache_free+0xac/0x5c0 [ 2380.064766][T13867] ? kasan_report+0x27/0x50 [ 2380.069254][T13867] tipc_mcast_xmit+0x10a8/0x16c0 [ 2380.074176][T13867] ? tipc_bcast_dec_bearer_dst_cnt+0x240/0x240 [ 2380.080388][T13867] ? __check_object_size+0x2e5/0x3b0 [ 2380.085657][T13867] tipc_sendmcast+0xc00/0xeb0 [ 2380.090479][T13867] ? tipc_send_group_unicast+0x7d0/0x7d0 [ 2380.096089][T13867] ? apic_timer_interrupt+0xa/0x20 [ 2380.101172][T13867] ? wait_woken+0x250/0x250 [ 2380.105645][T13867] ? __tipc_sendmsg+0x44d/0x2d30 [ 2380.110553][T13867] ? __sanitizer_cov_trace_switch+0x60/0xf0 [ 2380.116414][T13867] __tipc_sendmsg+0x120d/0x2d30 [ 2380.121237][T13867] ? local_bh_enable+0x20/0x20 [ 2380.125984][T13867] ? _raw_spin_lock_bh+0xa4/0x180 [ 2380.131081][T13867] ? _local_bh_enable+0x30/0x30 [ 2380.135903][T13867] ? selinux_socket_sendmsg+0x10b/0x320 [ 2380.141956][T13867] ? lock_sock_nested+0x25a/0x320 [ 2380.146954][T13867] ? _local_bh_enable+0x30/0x30 [ 2380.151876][T13867] ? tipc_recvmsg+0x17c0/0x17c0 [ 2380.156710][T13867] tipc_sendmsg+0x51/0x70 [ 2380.161030][T13867] kernel_sendmsg+0xe2/0x120 [ 2380.165608][T13867] sock_no_sendpage+0x13f/0x1b0 [ 2380.170447][T13867] ? __receive_sock+0xb0/0xb0 [ 2380.175107][T13867] ? apic_timer_interrupt+0xa/0x20 [ 2380.180195][T13867] ? __receive_sock+0xb0/0xb0 [ 2380.184844][T13867] sock_sendpage+0xd0/0x120 [ 2380.189407][T13867] pipe_to_sendpage+0x23b/0x300 [ 2380.194232][T13867] ? sock_fasync+0xf0/0xf0 [ 2380.198630][T13867] ? generic_splice_sendpage+0x200/0x200 [ 2380.204236][T13867] ? page_cache_pipe_buf_confirm+0x113/0x210 [ 2380.210186][T13867] __splice_from_pipe+0x2d3/0x870 [ 2380.215186][T13867] ? generic_splice_sendpage+0x200/0x200 [ 2380.220789][T13867] generic_splice_sendpage+0x172/0x200 [ 2380.226219][T13867] ? iter_file_splice_write+0xf20/0xf20 [ 2380.231734][T13867] ? iter_file_splice_write+0xf20/0xf20 [ 2380.237267][T13867] splice_direct_to_actor+0x496/0xb00 [ 2380.242706][T13867] ? do_splice_direct+0x3d0/0x3d0 [ 2380.247726][T13867] ? pipe_to_sendpage+0x300/0x300 [ 2380.252744][T13867] ? security_file_permission+0x128/0x300 [ 2380.258437][T13867] do_splice_direct+0x279/0x3d0 [ 2380.263262][T13867] ? splice_direct_to_actor+0xb00/0xb00 [ 2380.268879][T13867] ? security_file_permission+0x128/0x300 [ 2380.274571][T13867] do_sendfile+0x89d/0x1110 [ 2380.279161][T13867] ? compat_writev+0x390/0x390 [ 2380.285284][T13867] ? put_timespec64+0x106/0x150 [ 2380.290120][T13867] ? ktime_get_raw+0x130/0x130 [ 2380.294854][T13867] ? get_timespec64+0x1c0/0x1c0 [ 2380.299676][T13867] ? __se_sys_futex+0x31d/0x440 [ 2380.304501][T13867] __x64_sys_sendfile64+0x1ae/0x220 [ 2380.309697][T13867] ? __ia32_sys_sendfile+0x240/0x240 [ 2380.314950][T13867] ? do_syscall_64+0x10c/0x150 [ 2380.319682][T13867] do_syscall_64+0xcb/0x150 [ 2380.324181][T13867] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2380.330043][T13867] RIP: 0033:0x45de59 [ 2380.333910][T13867] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2380.353586][T13867] RSP: 002b:00007f9ea02dfc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 2380.361967][T13867] RAX: ffffffffffffffda RBX: 0000000000027ec0 RCX: 000000000045de59 [ 2380.369909][T13867] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 [ 2380.377853][T13867] RBP: 000000000118bf68 R08: 0000000000000000 R09: 0000000000000000 [ 2380.385802][T13867] R10: 0000000000200fc0 R11: 0000000000000246 R12: 000000000118bf2c [ 2380.393744][T13867] R13: 00007ffe17bf105f R14: 00007f9ea02e09c0 R15: 000000000118bf2c [ 2380.401686][T13867] [ 2380.403989][T13867] Allocated by task 13867: [ 2380.408476][T13867] __kasan_kmalloc+0x117/0x1b0 [ 2380.413216][T13867] kmem_cache_alloc+0x1d5/0x250 [ 2380.418041][T13867] __netdev_alloc_skb+0x1d8/0x710 [ 2380.423819][T13867] __ieee80211_beacon_get+0x628/0x11b0 [ 2380.429259][T13867] ieee80211_beacon_get_tim+0xb7/0x500 [ 2380.434703][T13867] mac80211_hwsim_beacon_tx+0xd4/0x570 [ 2380.440409][T13867] __iterate_interfaces+0x1fc/0x390 [ 2380.445591][T13867] ieee80211_iterate_active_interfaces_atomic+0x2e/0x40 [ 2380.453015][T13867] mac80211_hwsim_beacon+0xa1/0x180 [ 2380.458182][T13867] __run_hrtimer+0x405/0x7a0 [ 2380.462931][T13867] hrtimer_run_softirq+0x320/0x450 [ 2380.468015][T13867] __do_softirq+0x22e/0x569 [ 2380.472498][T13867] [ 2380.474797][T13867] Freed by task 13867: [ 2380.478835][T13867] __kasan_slab_free+0x168/0x220 [ 2380.483741][T13867] slab_free_freelist_hook+0xd0/0x150 [ 2380.489096][T13867] kmem_cache_free+0xac/0x5c0 [ 2380.493742][T13867] mac80211_hwsim_beacon_tx+0x35e/0x570 [ 2380.499259][T13867] __iterate_interfaces+0x1fc/0x390 [ 2380.504426][T13867] ieee80211_iterate_active_interfaces_atomic+0x2e/0x40 [ 2380.511328][T13867] mac80211_hwsim_beacon+0xa1/0x180 [ 2380.516494][T13867] __run_hrtimer+0x405/0x7a0 [ 2380.521052][T13867] hrtimer_run_softirq+0x320/0x450 [ 2380.526218][T13867] __do_softirq+0x22e/0x569 [ 2380.530788][T13867] [ 2380.533096][T13867] The buggy address belongs to the object at ffff8881d42e0dc0 [ 2380.533096][T13867] which belongs to the cache skbuff_head_cache of size 240 [ 2380.551481][T13867] The buggy address is located 0 bytes inside of [ 2380.551481][T13867] 240-byte region [ffff8881d42e0dc0, ffff8881d42e0eb0) [ 2380.566814][T13867] The buggy address belongs to the page: [ 2380.572432][T13867] page:ffffea000750b800 refcount:1 mapcount:0 mapping:ffff8881daa92a00 index:0x0 [ 2380.581504][T13867] flags: 0x8000000000000200(slab) [ 2380.586528][T13867] raw: 8000000000000200 dead000000000100 dead000000000122 ffff8881daa92a00 [ 2380.595087][T13867] raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 [ 2380.603636][T13867] page dumped because: kasan: bad access detected [ 2380.610016][T13867] [ 2380.612317][T13867] Memory state around the buggy address: [ 2380.617935][T13867] ffff8881d42e0c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2380.625965][T13867] ffff8881d42e0d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc [ 2380.634147][T13867] >ffff8881d42e0d80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 2380.642176][T13867] ^ [ 2380.648407][T13867] ffff8881d42e0e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2380.656452][T13867] ffff8881d42e0e80: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc [ 2380.664481][T13867] ================================================================== [ 2380.770664][ T339] syz-fuzzer invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 2380.785071][ T339] CPU: 1 PID: 339 Comm: syz-fuzzer Tainted: G B 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2380.796182][ T339] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2380.806212][ T339] Call Trace: [ 2380.809498][ T339] dump_stack+0x1b0/0x21e [ 2380.813811][ T339] ? devkmsg_release+0x11c/0x11c [ 2380.818730][ T339] ? ___ratelimit+0x3bf/0x560 [ 2380.823462][ T339] ? show_regs_print_info+0x12/0x12 [ 2380.828630][ T339] ? _raw_spin_lock+0xa1/0x170 [ 2380.833377][ T339] ? radix_tree_cpu_dead+0x160/0x160 [ 2380.838722][ T339] dump_header+0xdb/0x700 [ 2380.843023][ T339] oom_kill_process+0xd3/0x280 [ 2380.847758][ T339] out_of_memory+0x5b6/0x890 [ 2380.853043][ T339] ? unregister_oom_notifier+0x20/0x20 [ 2380.858474][ T339] __alloc_pages_slowpath+0x17bc/0x1cb0 [ 2380.863992][ T339] ? get_page_from_freelist+0x7c0/0x7c0 [ 2380.869521][ T339] __alloc_pages_nodemask+0x5cb/0x7c0 [ 2380.874879][ T339] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 2380.880396][ T339] pagecache_get_page+0x522/0x8a0 [ 2380.885398][ T339] filemap_fault+0x1435/0x1990 [ 2380.890132][ T339] ? __down_read+0xf1/0x210 [ 2380.894626][ T339] ? generic_file_read_iter+0x20a0/0x20a0 [ 2380.900327][ T339] ext4_filemap_fault+0x7b/0x90 [ 2380.905149][ T339] handle_mm_fault+0x291e/0x4140 [ 2380.910057][ T339] ? finish_fault+0x230/0x230 [ 2380.914703][ T339] ? __ia32_sys_sigaltstack+0x60/0x60 [ 2380.920058][ T339] ? down_read_trylock+0x17a/0x1d0 [ 2380.925140][ T339] ? vmacache_find+0x205/0x4b0 [ 2380.929883][ T339] do_user_addr_fault+0x48a/0x9f0 [ 2380.934877][ T339] page_fault+0x2f/0x40 [ 2380.939016][ T339] RIP: 0033:0x412fd1 [ 2380.942882][ T339] Code: 48 89 6c 24 58 48 8d 6c 24 58 48 8b 44 24 70 48 85 c0 0f 84 c8 03 00 00 0f b6 48 08 f6 c1 04 0f 85 a2 03 00 00 48 8b 4c 24 68 <48> 8b 51 48 8b 58 0c 48 8d 74 24 78 48 89 34 24 48 89 5c 24 08 48 [ 2380.962541][ T339] RSP: 002b:000000c0140459a0 EFLAGS: 00010246 [ 2380.968578][ T339] RAX: 000000c0114f7d10 RBX: 00000000008a1b20 RCX: 00000000008a1b20 [ 2380.976521][ T339] RDX: 000000000094eff3 RSI: 0000000000871340 RDI: 000000c014045c18 [ 2380.984483][ T339] RBP: 000000c0140459f8 R08: 00007f9927247325 R09: 0000000000203004 [ 2380.992872][ T339] R10: 0000000000000002 R11: 0000000000000011 R12: 00000000000000f1 [ 2381.000992][ T339] R13: 0000000000000000 R14: 0000000000aff3e2 R15: 0000000000000000 [ 2381.011678][T13867] ================================================================== [ 2381.019783][T13867] BUG: KASAN: double-free or invalid-free in kmem_cache_free+0xac/0x5c0 [ 2381.028116][T13867] [ 2381.030435][T13867] CPU: 0 PID: 13867 Comm: syz-executor.5 Tainted: G B 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2381.041948][T13867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2381.052016][T13867] Call Trace: [ 2381.055303][T13867] dump_stack+0x1b0/0x21e [ 2381.059620][T13867] ? show_regs_print_info+0x12/0x12 [ 2381.064806][T13867] ? printk+0xc0/0x104 [ 2381.068865][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2381.073733][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2381.078558][T13867] print_address_description+0x96/0x5d0 [ 2381.084337][T13867] ? devkmsg_release+0x11c/0x11c [ 2381.089261][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2381.094293][T13867] ? ___preempt_schedule+0x16/0x20 [ 2381.099419][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2381.104239][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2381.109253][T13867] kasan_report_invalid_free+0x54/0xc0 [ 2381.114683][T13867] __kasan_slab_free+0x102/0x220 [ 2381.119590][T13867] ? trace_event_raw_event_sched_switch+0x480/0x480 [ 2381.126160][T13867] ? _raw_spin_unlock_irq+0x5/0x20 [ 2381.131242][T13867] ? finish_task_switch+0x235/0x4c0 [ 2381.136411][T13867] ? __schedule+0x8ae/0xe30 [ 2381.140885][T13867] ? is_mmconf_reserved+0x420/0x420 [ 2381.146053][T13867] ? fixup_exception+0x92/0xd0 [ 2381.151219][T13867] ? apic_timer_interrupt+0xa/0x20 [ 2381.156318][T13867] ? skb_release_data+0x46f/0x6f0 [ 2381.161315][T13867] slab_free_freelist_hook+0xd0/0x150 [ 2381.166754][T13867] ? tipc_mcast_xmit+0x10a8/0x16c0 [ 2381.171853][T13867] kmem_cache_free+0xac/0x5c0 [ 2381.176673][T13867] ? kasan_report+0x27/0x50 [ 2381.181148][T13867] tipc_mcast_xmit+0x10a8/0x16c0 [ 2381.186578][T13867] ? tipc_bcast_dec_bearer_dst_cnt+0x240/0x240 [ 2381.192702][T13867] ? __check_object_size+0x2e5/0x3b0 [ 2381.197960][T13867] tipc_sendmcast+0xc00/0xeb0 [ 2381.202624][T13867] ? tipc_send_group_unicast+0x7d0/0x7d0 [ 2381.208233][T13867] ? apic_timer_interrupt+0xa/0x20 [ 2381.213314][T13867] ? wait_woken+0x250/0x250 [ 2381.217787][T13867] ? __tipc_sendmsg+0x44d/0x2d30 [ 2381.222695][T13867] ? __sanitizer_cov_trace_switch+0x60/0xf0 [ 2381.228590][T13867] __tipc_sendmsg+0x120d/0x2d30 [ 2381.233421][T13867] ? local_bh_enable+0x20/0x20 [ 2381.238172][T13867] ? _raw_spin_lock_bh+0xa4/0x180 [ 2381.243440][T13867] ? _local_bh_enable+0x30/0x30 [ 2381.248268][T13867] ? selinux_socket_sendmsg+0x10b/0x320 [ 2381.253888][T13867] ? lock_sock_nested+0x25a/0x320 [ 2381.258900][T13867] ? _local_bh_enable+0x30/0x30 [ 2381.263839][T13867] ? tipc_recvmsg+0x17c0/0x17c0 [ 2381.268760][T13867] tipc_sendmsg+0x51/0x70 [ 2381.273077][T13867] kernel_sendmsg+0xe2/0x120 [ 2381.277752][T13867] sock_no_sendpage+0x13f/0x1b0 [ 2381.282572][T13867] ? __receive_sock+0xb0/0xb0 [ 2381.287232][T13867] ? apic_timer_interrupt+0xa/0x20 [ 2381.292834][T13867] ? __receive_sock+0xb0/0xb0 [ 2381.297491][T13867] sock_sendpage+0xd0/0x120 [ 2381.301966][T13867] pipe_to_sendpage+0x23b/0x300 [ 2381.306788][T13867] ? sock_fasync+0xf0/0xf0 [ 2381.311189][T13867] ? generic_splice_sendpage+0x200/0x200 [ 2381.316794][T13867] ? page_cache_pipe_buf_confirm+0x113/0x210 [ 2381.323561][T13867] __splice_from_pipe+0x2d3/0x870 [ 2381.328556][T13867] ? generic_splice_sendpage+0x200/0x200 [ 2381.334970][T13867] generic_splice_sendpage+0x172/0x200 [ 2381.340434][T13867] ? iter_file_splice_write+0xf20/0xf20 [ 2381.345959][T13867] ? iter_file_splice_write+0xf20/0xf20 [ 2381.351568][T13867] splice_direct_to_actor+0x496/0xb00 [ 2381.356924][T13867] ? do_splice_direct+0x3d0/0x3d0 [ 2381.361935][T13867] ? pipe_to_sendpage+0x300/0x300 [ 2381.367104][T13867] ? security_file_permission+0x128/0x300 [ 2381.372955][T13867] do_splice_direct+0x279/0x3d0 [ 2381.377902][T13867] ? splice_direct_to_actor+0xb00/0xb00 [ 2381.383447][T13867] ? security_file_permission+0x128/0x300 [ 2381.389222][T13867] do_sendfile+0x89d/0x1110 [ 2381.393699][T13867] ? compat_writev+0x390/0x390 [ 2381.399061][T13867] ? put_timespec64+0x106/0x150 [ 2381.404086][T13867] ? ktime_get_raw+0x130/0x130 [ 2381.408828][T13867] ? get_timespec64+0x1c0/0x1c0 [ 2381.413660][T13867] ? __se_sys_futex+0x31d/0x440 [ 2381.418831][T13867] __x64_sys_sendfile64+0x1ae/0x220 [ 2381.424090][T13867] ? __ia32_sys_sendfile+0x240/0x240 [ 2381.429484][T13867] ? do_syscall_64+0x10c/0x150 [ 2381.434235][T13867] do_syscall_64+0xcb/0x150 [ 2381.438735][T13867] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2381.444860][T13867] RIP: 0033:0x45de59 [ 2381.448735][T13867] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2381.472918][T13867] RSP: 002b:00007f9ea02dfc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 2381.481414][T13867] RAX: ffffffffffffffda RBX: 0000000000027ec0 RCX: 000000000045de59 [ 2381.489385][T13867] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 [ 2381.497417][T13867] RBP: 000000000118bf68 R08: 0000000000000000 R09: 0000000000000000 [ 2381.505372][T13867] R10: 0000000000200fc0 R11: 0000000000000246 R12: 000000000118bf2c [ 2381.513318][T13867] R13: 00007ffe17bf105f R14: 00007f9ea02e09c0 R15: 000000000118bf2c [ 2381.521280][T13867] [ 2381.523601][T13867] Allocated by task 13867: [ 2381.529367][T13867] __kasan_kmalloc+0x117/0x1b0 [ 2381.534104][T13867] kmem_cache_alloc+0x1d5/0x250 [ 2381.538945][T13867] __netdev_alloc_skb+0x1d8/0x710 [ 2381.543956][T13867] __ieee80211_beacon_get+0x628/0x11b0 [ 2381.549387][T13867] ieee80211_beacon_get_tim+0xb7/0x500 [ 2381.555612][T13867] mac80211_hwsim_beacon_tx+0xd4/0x570 [ 2381.561063][T13867] __iterate_interfaces+0x1fc/0x390 [ 2381.566318][T13867] ieee80211_iterate_active_interfaces_atomic+0x2e/0x40 [ 2381.573237][T13867] mac80211_hwsim_beacon+0xa1/0x180 [ 2381.578418][T13867] __run_hrtimer+0x405/0x7a0 [ 2381.582995][T13867] hrtimer_run_softirq+0x320/0x450 [ 2381.588093][T13867] __do_softirq+0x22e/0x569 [ 2381.592575][T13867] [ 2381.594874][T13867] Freed by task 13867: [ 2381.598912][T13867] __kasan_slab_free+0x168/0x220 [ 2381.603819][T13867] slab_free_freelist_hook+0xd0/0x150 [ 2381.609261][T13867] kmem_cache_free+0xac/0x5c0 [ 2381.613907][T13867] mac80211_hwsim_beacon_tx+0x35e/0x570 [ 2381.619509][T13867] __iterate_interfaces+0x1fc/0x390 [ 2381.624675][T13867] ieee80211_iterate_active_interfaces_atomic+0x2e/0x40 [ 2381.631580][T13867] mac80211_hwsim_beacon+0xa1/0x180 [ 2381.636748][T13867] __run_hrtimer+0x405/0x7a0 [ 2381.641323][T13867] hrtimer_run_softirq+0x320/0x450 [ 2381.646417][T13867] __do_softirq+0x22e/0x569 [ 2381.650899][T13867] [ 2381.653203][T13867] The buggy address belongs to the object at ffff8881d42e0500 [ 2381.653203][T13867] which belongs to the cache skbuff_head_cache of size 240 [ 2381.667852][T13867] The buggy address is located 0 bytes inside of [ 2381.667852][T13867] 240-byte region [ffff8881d42e0500, ffff8881d42e05f0) [ 2381.681711][T13867] The buggy address belongs to the page: [ 2381.687327][T13867] page:ffffea000750b800 refcount:1 mapcount:0 mapping:ffff8881daa92a00 index:0x0 [ 2381.696487][T13867] flags: 0x8000000000000200(slab) [ 2381.701485][T13867] raw: 8000000000000200 dead000000000100 dead000000000122 ffff8881daa92a00 [ 2381.710053][T13867] raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 [ 2381.718614][T13867] page dumped because: kasan: bad access detected [ 2381.724992][T13867] [ 2381.727378][T13867] Memory state around the buggy address: [ 2381.732980][T13867] ffff8881d42e0400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2381.741034][T13867] ffff8881d42e0480: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc [ 2381.749063][T13867] >ffff8881d42e0500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2381.757089][T13867] ^ [ 2381.761142][T13867] ffff8881d42e0580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc [ 2381.769181][T13867] ffff8881d42e0600: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 [ 2381.779049][T13867] ================================================================== [ 2381.939780][T13867] ================================================================== [ 2381.947878][T13867] BUG: KASAN: double-free or invalid-free in kmem_cache_free+0xac/0x5c0 [ 2381.956187][T13867] [ 2381.958510][T13867] CPU: 1 PID: 13867 Comm: syz-executor.5 Tainted: G B 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2381.970200][T13867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2381.980236][T13867] Call Trace: [ 2381.983499][T13867] dump_stack+0x1b0/0x21e [ 2381.987943][T13867] ? show_regs_print_info+0x12/0x12 [ 2381.993132][T13867] ? printk+0xc0/0x104 [ 2381.997171][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2382.001992][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2382.006828][T13867] print_address_description+0x96/0x5d0 [ 2382.012344][T13867] ? devkmsg_release+0x11c/0x11c [ 2382.017272][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2382.022092][T13867] ? ___preempt_schedule+0x16/0x20 [ 2382.027176][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2382.031996][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2382.036815][T13867] kasan_report_invalid_free+0x54/0xc0 [ 2382.042251][T13867] __kasan_slab_free+0x102/0x220 [ 2382.047161][T13867] ? trace_event_raw_event_sched_switch+0x480/0x480 [ 2382.053805][T13867] ? _raw_spin_unlock_irq+0x5/0x20 [ 2382.058886][T13867] ? finish_task_switch+0x235/0x4c0 [ 2382.064069][T13867] ? __schedule+0x8ae/0xe30 [ 2382.068558][T13867] ? apic_timer_interrupt+0xa/0x20 [ 2382.073727][T13867] ? skb_release_data+0x5e8/0x6f0 [ 2382.078722][T13867] ? skb_release_head_state+0x193/0x210 [ 2382.084235][T13867] ? skb_release_data+0x5e8/0x6f0 [ 2382.089229][T13867] ? __kasan_report+0x4d/0x1c0 [ 2382.094049][T13867] ? skb_release_data+0x46f/0x6f0 [ 2382.099479][T13867] slab_free_freelist_hook+0xd0/0x150 [ 2382.105081][T13867] ? tipc_mcast_xmit+0x10a8/0x16c0 [ 2382.110160][T13867] kmem_cache_free+0xac/0x5c0 [ 2382.115157][T13867] ? kasan_report+0x27/0x50 [ 2382.120292][T13867] tipc_mcast_xmit+0x10a8/0x16c0 [ 2382.125213][T13867] ? tipc_bcast_dec_bearer_dst_cnt+0x240/0x240 [ 2382.131346][T13867] ? __check_object_size+0x2e5/0x3b0 [ 2382.136623][T13867] tipc_sendmcast+0xc00/0xeb0 [ 2382.141275][T13867] ? tipc_send_group_unicast+0x7d0/0x7d0 [ 2382.146980][T13867] ? apic_timer_interrupt+0xa/0x20 [ 2382.152077][T13867] ? wait_woken+0x250/0x250 [ 2382.156559][T13867] ? __tipc_sendmsg+0x44d/0x2d30 [ 2382.161467][T13867] ? __sanitizer_cov_trace_switch+0x60/0xf0 [ 2382.167329][T13867] __tipc_sendmsg+0x120d/0x2d30 [ 2382.172163][T13867] ? local_bh_enable+0x20/0x20 [ 2382.176897][T13867] ? _raw_spin_lock_bh+0xa4/0x180 [ 2382.181923][T13867] ? _local_bh_enable+0x30/0x30 [ 2382.186747][T13867] ? selinux_socket_sendmsg+0x10b/0x320 [ 2382.192262][T13867] ? lock_sock_nested+0x25a/0x320 [ 2382.197428][T13867] ? _local_bh_enable+0x30/0x30 [ 2382.203204][T13867] ? tipc_recvmsg+0x17c0/0x17c0 [ 2382.208021][T13867] tipc_sendmsg+0x51/0x70 [ 2382.212334][T13867] kernel_sendmsg+0xe2/0x120 [ 2382.216911][T13867] sock_no_sendpage+0x13f/0x1b0 [ 2382.221751][T13867] ? __receive_sock+0xb0/0xb0 [ 2382.226412][T13867] ? apic_timer_interrupt+0xa/0x20 [ 2382.231779][T13867] ? __receive_sock+0xb0/0xb0 [ 2382.236434][T13867] sock_sendpage+0xd0/0x120 [ 2382.240943][T13867] pipe_to_sendpage+0x23b/0x300 [ 2382.245782][T13867] ? sock_fasync+0xf0/0xf0 [ 2382.250172][T13867] ? generic_splice_sendpage+0x200/0x200 [ 2382.255790][T13867] ? page_cache_pipe_buf_confirm+0x113/0x210 [ 2382.261756][T13867] __splice_from_pipe+0x2d3/0x870 [ 2382.266753][T13867] ? generic_splice_sendpage+0x200/0x200 [ 2382.272354][T13867] generic_splice_sendpage+0x172/0x200 [ 2382.277806][T13867] ? iter_file_splice_write+0xf20/0xf20 [ 2382.283358][T13867] ? iter_file_splice_write+0xf20/0xf20 [ 2382.288988][T13867] splice_direct_to_actor+0x496/0xb00 [ 2382.294347][T13867] ? do_splice_direct+0x3d0/0x3d0 [ 2382.299350][T13867] ? pipe_to_sendpage+0x300/0x300 [ 2382.304370][T13867] ? security_file_permission+0x128/0x300 [ 2382.310058][T13867] do_splice_direct+0x279/0x3d0 [ 2382.314965][T13867] ? splice_direct_to_actor+0xb00/0xb00 [ 2382.320498][T13867] ? security_file_permission+0x128/0x300 [ 2382.326202][T13867] do_sendfile+0x89d/0x1110 [ 2382.330697][T13867] ? compat_writev+0x390/0x390 [ 2382.335440][T13867] ? put_timespec64+0x106/0x150 [ 2382.340348][T13867] ? ktime_get_raw+0x130/0x130 [ 2382.345449][T13867] ? get_timespec64+0x1c0/0x1c0 [ 2382.350283][T13867] ? __se_sys_futex+0x31d/0x440 [ 2382.355105][T13867] __x64_sys_sendfile64+0x1ae/0x220 [ 2382.360296][T13867] ? __ia32_sys_sendfile+0x240/0x240 [ 2382.365551][T13867] ? do_syscall_64+0x10c/0x150 [ 2382.370283][T13867] do_syscall_64+0xcb/0x150 [ 2382.374767][T13867] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2382.380842][T13867] RIP: 0033:0x45de59 [ 2382.384722][T13867] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2382.404855][T13867] RSP: 002b:00007f9ea02dfc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 2382.413349][T13867] RAX: ffffffffffffffda RBX: 0000000000027ec0 RCX: 000000000045de59 [ 2382.421379][T13867] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 [ 2382.429432][T13867] RBP: 000000000118bf68 R08: 0000000000000000 R09: 0000000000000000 [ 2382.437375][T13867] R10: 0000000000200fc0 R11: 0000000000000246 R12: 000000000118bf2c [ 2382.445763][T13867] R13: 00007ffe17bf105f R14: 00007f9ea02e09c0 R15: 000000000118bf2c [ 2382.453717][T13867] [ 2382.456019][T13867] Allocated by task 13867: [ 2382.460504][T13867] __kasan_kmalloc+0x117/0x1b0 [ 2382.465412][T13867] kmem_cache_alloc+0x1d5/0x250 [ 2382.470268][T13867] __netdev_alloc_skb+0x1d8/0x710 [ 2382.475278][T13867] __ieee80211_beacon_get+0x628/0x11b0 [ 2382.480792][T13867] ieee80211_beacon_get_tim+0xb7/0x500 [ 2382.486219][T13867] mac80211_hwsim_beacon_tx+0xd4/0x570 [ 2382.491662][T13867] __iterate_interfaces+0x1fc/0x390 [ 2382.496837][T13867] ieee80211_iterate_active_interfaces_atomic+0x2e/0x40 [ 2382.503747][T13867] mac80211_hwsim_beacon+0xa1/0x180 [ 2382.508928][T13867] __run_hrtimer+0x405/0x7a0 [ 2382.515225][T13867] hrtimer_run_softirq+0x320/0x450 [ 2382.520568][T13867] __do_softirq+0x22e/0x569 [ 2382.525037][T13867] [ 2382.527347][T13867] Freed by task 13867: [ 2382.531397][T13867] __kasan_slab_free+0x168/0x220 [ 2382.536313][T13867] slab_free_freelist_hook+0xd0/0x150 [ 2382.541653][T13867] kmem_cache_free+0xac/0x5c0 [ 2382.546298][T13867] mac80211_hwsim_beacon_tx+0x35e/0x570 [ 2382.551812][T13867] __iterate_interfaces+0x1fc/0x390 [ 2382.556978][T13867] ieee80211_iterate_active_interfaces_atomic+0x2e/0x40 [ 2382.563904][T13867] mac80211_hwsim_beacon+0xa1/0x180 [ 2382.569084][T13867] __run_hrtimer+0x405/0x7a0 [ 2382.573642][T13867] hrtimer_run_softirq+0x320/0x450 [ 2382.578749][T13867] __do_softirq+0x22e/0x569 [ 2382.583215][T13867] [ 2382.585518][T13867] The buggy address belongs to the object at ffff8881d42e0b40 [ 2382.585518][T13867] which belongs to the cache skbuff_head_cache of size 240 [ 2382.600073][T13867] The buggy address is located 0 bytes inside of [ 2382.600073][T13867] 240-byte region [ffff8881d42e0b40, ffff8881d42e0c30) [ 2382.613134][T13867] The buggy address belongs to the page: [ 2382.618738][T13867] page:ffffea000750b800 refcount:1 mapcount:0 mapping:ffff8881daa92a00 index:0x0 [ 2382.627910][T13867] flags: 0x8000000000000200(slab) [ 2382.632906][T13867] raw: 8000000000000200 dead000000000100 dead000000000122 ffff8881daa92a00 [ 2382.641466][T13867] raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 [ 2382.652939][T13867] page dumped because: kasan: bad access detected [ 2382.659506][T13867] [ 2382.661828][T13867] Memory state around the buggy address: [ 2382.667524][T13867] ffff8881d42e0a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2382.675932][T13867] ffff8881d42e0a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc [ 2382.684940][T13867] >ffff8881d42e0b00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 2382.692969][T13867] ^ [ 2382.699099][T13867] ffff8881d42e0b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2382.707244][T13867] ffff8881d42e0c00: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc [ 2382.715285][T13867] ================================================================== [ 2382.729992][T13867] ================================================================== [ 2382.738094][T13867] BUG: KASAN: double-free or invalid-free in kmem_cache_free+0xac/0x5c0 [ 2382.746483][T13867] [ 2382.748802][T13867] CPU: 1 PID: 13867 Comm: syz-executor.5 Tainted: G B 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2382.760575][T13867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2382.770701][T13867] Call Trace: [ 2382.773998][T13867] dump_stack+0x1b0/0x21e [ 2382.778392][T13867] ? show_regs_print_info+0x12/0x12 [ 2382.783583][T13867] ? printk+0xc0/0x104 [ 2382.787623][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2382.792458][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2382.797279][T13867] print_address_description+0x96/0x5d0 [ 2382.802808][T13867] ? devkmsg_release+0x11c/0x11c [ 2382.807715][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2382.812555][T13867] ? ___preempt_schedule+0x16/0x20 [ 2382.817724][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2382.822545][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2382.827384][T13867] kasan_report_invalid_free+0x54/0xc0 [ 2382.832906][T13867] __kasan_slab_free+0x102/0x220 [ 2382.837823][T13867] ? trace_event_raw_event_sched_switch+0x480/0x480 [ 2382.844381][T13867] ? _raw_spin_unlock_irq+0x5/0x20 [ 2382.849467][T13867] ? finish_task_switch+0x235/0x4c0 [ 2382.854634][T13867] ? __schedule+0x8ae/0xe30 [ 2382.859112][T13867] ? apic_timer_interrupt+0xa/0x20 [ 2382.864193][T13867] ? skb_release_data+0x5e8/0x6f0 [ 2382.869189][T13867] ? skb_release_head_state+0x193/0x210 [ 2382.874719][T13867] ? skb_release_data+0x5e8/0x6f0 [ 2382.879725][T13867] ? __kasan_report+0x4d/0x1c0 [ 2382.884458][T13867] ? skb_release_data+0x46f/0x6f0 [ 2382.889453][T13867] slab_free_freelist_hook+0xd0/0x150 [ 2382.894812][T13867] ? tipc_mcast_xmit+0x10a8/0x16c0 [ 2382.899905][T13867] kmem_cache_free+0xac/0x5c0 [ 2382.904553][T13867] ? kasan_report+0x27/0x50 [ 2382.909130][T13867] tipc_mcast_xmit+0x10a8/0x16c0 [ 2382.914325][T13867] ? tipc_bcast_dec_bearer_dst_cnt+0x240/0x240 [ 2382.920449][T13867] ? __check_object_size+0x2e5/0x3b0 [ 2382.927180][T13867] tipc_sendmcast+0xc00/0xeb0 [ 2382.931843][T13867] ? tipc_send_group_unicast+0x7d0/0x7d0 [ 2382.938418][T13867] ? apic_timer_interrupt+0xa/0x20 [ 2382.943602][T13867] ? wait_woken+0x250/0x250 [ 2382.948089][T13867] ? __tipc_sendmsg+0x44d/0x2d30 [ 2382.953086][T13867] ? __sanitizer_cov_trace_switch+0x60/0xf0 [ 2382.959049][T13867] __tipc_sendmsg+0x120d/0x2d30 [ 2382.963871][T13867] ? local_bh_enable+0x20/0x20 [ 2382.968627][T13867] ? _raw_spin_lock_bh+0xa4/0x180 [ 2382.974850][T13867] ? _local_bh_enable+0x30/0x30 [ 2382.981147][T13867] ? selinux_socket_sendmsg+0x10b/0x320 [ 2382.986672][T13867] ? lock_sock_nested+0x25a/0x320 [ 2382.991667][T13867] ? _local_bh_enable+0x30/0x30 [ 2382.996489][T13867] ? tipc_recvmsg+0x17c0/0x17c0 [ 2383.001323][T13867] tipc_sendmsg+0x51/0x70 [ 2383.005640][T13867] kernel_sendmsg+0xe2/0x120 [ 2383.010199][T13867] sock_no_sendpage+0x13f/0x1b0 [ 2383.015129][T13867] ? __receive_sock+0xb0/0xb0 [ 2383.019792][T13867] ? apic_timer_interrupt+0xa/0x20 [ 2383.024872][T13867] ? __receive_sock+0xb0/0xb0 [ 2383.029524][T13867] sock_sendpage+0xd0/0x120 [ 2383.033997][T13867] pipe_to_sendpage+0x23b/0x300 [ 2383.038818][T13867] ? sock_fasync+0xf0/0xf0 [ 2383.043205][T13867] ? generic_splice_sendpage+0x200/0x200 [ 2383.048821][T13867] ? page_cache_pipe_buf_confirm+0x113/0x210 [ 2383.054772][T13867] __splice_from_pipe+0x2d3/0x870 [ 2383.060039][T13867] ? generic_splice_sendpage+0x200/0x200 [ 2383.065726][T13867] generic_splice_sendpage+0x172/0x200 [ 2383.071152][T13867] ? iter_file_splice_write+0xf20/0xf20 [ 2383.076663][T13867] ? iter_file_splice_write+0xf20/0xf20 [ 2383.082191][T13867] splice_direct_to_actor+0x496/0xb00 [ 2383.087529][T13867] ? do_splice_direct+0x3d0/0x3d0 [ 2383.092530][T13867] ? pipe_to_sendpage+0x300/0x300 [ 2383.097521][T13867] ? security_file_permission+0x128/0x300 [ 2383.103208][T13867] do_splice_direct+0x279/0x3d0 [ 2383.108026][T13867] ? splice_direct_to_actor+0xb00/0xb00 [ 2383.113540][T13867] ? security_file_permission+0x128/0x300 [ 2383.119223][T13867] do_sendfile+0x89d/0x1110 [ 2383.123695][T13867] ? compat_writev+0x390/0x390 [ 2383.128610][T13867] ? put_timespec64+0x106/0x150 [ 2383.133429][T13867] ? ktime_get_raw+0x130/0x130 [ 2383.138161][T13867] ? get_timespec64+0x1c0/0x1c0 [ 2383.142978][T13867] ? __se_sys_futex+0x31d/0x440 [ 2383.147796][T13867] __x64_sys_sendfile64+0x1ae/0x220 [ 2383.152961][T13867] ? __ia32_sys_sendfile+0x240/0x240 [ 2383.159081][T13867] ? do_syscall_64+0x10c/0x150 [ 2383.163814][T13867] do_syscall_64+0xcb/0x150 [ 2383.168297][T13867] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2383.174168][T13867] RIP: 0033:0x45de59 [ 2383.178031][T13867] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2383.197602][T13867] RSP: 002b:00007f9ea02dfc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 2383.205977][T13867] RAX: ffffffffffffffda RBX: 0000000000027ec0 RCX: 000000000045de59 [ 2383.213916][T13867] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 [ 2383.221866][T13867] RBP: 000000000118bf68 R08: 0000000000000000 R09: 0000000000000000 [ 2383.229818][T13867] R10: 0000000000200fc0 R11: 0000000000000246 R12: 000000000118bf2c [ 2383.237762][T13867] R13: 00007ffe17bf105f R14: 00007f9ea02e09c0 R15: 000000000118bf2c [ 2383.245710][T13867] [ 2383.248013][T13867] Allocated by task 13867: [ 2383.252405][T13867] __kasan_kmalloc+0x117/0x1b0 [ 2383.257413][T13867] kmem_cache_alloc+0x1d5/0x250 [ 2383.262233][T13867] __netdev_alloc_skb+0x1d8/0x710 [ 2383.267238][T13867] __ieee80211_beacon_get+0x628/0x11b0 [ 2383.272664][T13867] ieee80211_beacon_get_tim+0xb7/0x500 [ 2383.278089][T13867] mac80211_hwsim_beacon_tx+0xd4/0x570 [ 2383.283512][T13867] __iterate_interfaces+0x1fc/0x390 [ 2383.288677][T13867] ieee80211_iterate_active_interfaces_atomic+0x2e/0x40 [ 2383.295576][T13867] mac80211_hwsim_beacon+0xa1/0x180 [ 2383.300750][T13867] __run_hrtimer+0x405/0x7a0 [ 2383.305308][T13867] hrtimer_run_softirq+0x320/0x450 [ 2383.310384][T13867] __do_softirq+0x22e/0x569 [ 2383.314852][T13867] [ 2383.317151][T13867] Freed by task 13867: [ 2383.321186][T13867] __kasan_slab_free+0x168/0x220 [ 2383.326108][T13867] slab_free_freelist_hook+0xd0/0x150 [ 2383.331445][T13867] kmem_cache_free+0xac/0x5c0 [ 2383.336088][T13867] mac80211_hwsim_beacon_tx+0x35e/0x570 [ 2383.341601][T13867] __iterate_interfaces+0x1fc/0x390 [ 2383.346765][T13867] ieee80211_iterate_active_interfaces_atomic+0x2e/0x40 [ 2383.353674][T13867] mac80211_hwsim_beacon+0xa1/0x180 [ 2383.358836][T13867] __run_hrtimer+0x405/0x7a0 [ 2383.363393][T13867] hrtimer_run_softirq+0x320/0x450 [ 2383.368470][T13867] __do_softirq+0x22e/0x569 [ 2383.372943][T13867] [ 2383.375243][T13867] The buggy address belongs to the object at ffff8881d42e08c0 [ 2383.375243][T13867] which belongs to the cache skbuff_head_cache of size 240 [ 2383.389794][T13867] The buggy address is located 0 bytes inside of [ 2383.389794][T13867] 240-byte region [ffff8881d42e08c0, ffff8881d42e09b0) [ 2383.402865][T13867] The buggy address belongs to the page: [ 2383.408472][T13867] page:ffffea000750b800 refcount:1 mapcount:0 mapping:ffff8881daa92a00 index:0x0 [ 2383.417555][T13867] flags: 0x8000000000000200(slab) [ 2383.422553][T13867] raw: 8000000000000200 dead000000000100 dead000000000122 ffff8881daa92a00 [ 2383.431108][T13867] raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 [ 2383.439669][T13867] page dumped because: kasan: bad access detected [ 2383.446056][T13867] [ 2383.448351][T13867] Memory state around the buggy address: [ 2383.453949][T13867] ffff8881d42e0780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2383.461990][T13867] ffff8881d42e0800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc [ 2383.470018][T13867] >ffff8881d42e0880: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 2383.478044][T13867] ^ [ 2383.484163][T13867] ffff8881d42e0900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2383.492200][T13867] ffff8881d42e0980: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc [ 2383.500230][T13867] ================================================================== [ 2383.515285][ T339] Mem-Info: [ 2383.520192][T13867] ================================================================== [ 2383.520306][ T339] active_anon:1407262 inactive_anon:4736 isolated_anon:0 [ 2383.520306][ T339] active_file:106 inactive_file:175 isolated_file:33 [ 2383.520306][ T339] unevictable:0 dirty:4 writeback:0 unstable:0 [ 2383.520306][ T339] slab_reclaimable:9557 slab_unreclaimable:97338 [ 2383.520306][ T339] mapped:55875 shmem:4832 pagetables:31565 bounce:0 [ 2383.520306][ T339] free:12301 free_pcp:554 free_cma:0 [ 2383.528255][T13867] BUG: KASAN: double-free or invalid-free in kmem_cache_free+0xac/0x5c0 [ 2383.528256][T13867] [ 2383.528266][T13867] CPU: 0 PID: 13867 Comm: syz-executor.5 Tainted: G B 5.4.70-syzkaller-00176-g2a31fdaad927 #0 [ 2383.528268][T13867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2383.528271][T13867] Call Trace: [ 2383.528283][T13867] dump_stack+0x1b0/0x21e [ 2383.528291][T13867] ? show_regs_print_info+0x12/0x12 [ 2383.528303][T13867] ? printk+0xc0/0x104 [ 2383.566400][ T339] Node 0 active_anon:5629048kB inactive_anon:18944kB active_file:424kB inactive_file:800kB unevictable:0kB isolated(anon):0kB isolated(file):132kB mapped:223600kB dirty:16kB writeback:0kB shmem:19328kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 2383.574238][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2383.574244][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2383.574251][T13867] print_address_description+0x96/0x5d0 [ 2383.574257][T13867] ? devkmsg_release+0x11c/0x11c [ 2383.574263][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2383.574270][T13867] ? ___preempt_schedule+0x16/0x20 [ 2383.574277][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2383.574283][T13867] ? kmem_cache_free+0xac/0x5c0 [ 2383.574290][T13867] kasan_report_invalid_free+0x54/0xc0 [ 2383.574297][T13867] __kasan_slab_free+0x102/0x220 [ 2383.574307][T13867] ? trace_event_raw_event_sched_switch+0x480/0x480 [ 2383.574321][T13867] ? _raw_spin_unlock_irq+0x5/0x20 [ 2383.574327][T13867] ? finish_task_switch+0x235/0x4c0 [ 2383.574336][T13867] ? __schedule+0x8ae/0xe30 [ 2383.574344][T13867] ? apic_timer_interrupt+0xa/0x20 [ 2383.574353][T13867] ? skb_release_data+0x5e8/0x6f0 [ 2383.574358][T13867] ? skb_release_head_state+0x193/0x210 [ 2383.574368][T13867] ? skb_release_data+0x5e8/0x6f0 [ 2383.576996][ T339] DMA free:15904kB min:24kB low:36kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15904kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2383.588178][T13867] ? __kasan_report+0x4d/0x1c0 [ 2383.588186][T13867] ? skb_release_data+0x46f/0x6f0 [ 2383.588194][T13867] slab_free_freelist_hook+0xd0/0x150 [ 2383.588202][T13867] ? tipc_mcast_xmit+0x10a8/0x16c0 [ 2383.588208][T13867] kmem_cache_free+0xac/0x5c0 [ 2383.588215][T13867] ? kasan_report+0x27/0x50 [ 2383.588223][T13867] tipc_mcast_xmit+0x10a8/0x16c0 [ 2383.588232][T13867] ? tipc_bcast_dec_bearer_dst_cnt+0x240/0x240