last executing test programs: 19.687550864s ago: executing program 0 (id=42): socket$inet6_tcp(0xa, 0x1, 0x0) (async) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r0) (async) r1 = dup(r0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000017c0)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r2, 0x25, &(0x7f0000001800)={0x0, 0x0, 0x9, 0x17}) recvmmsg(r2, &(0x7f0000002400)=[{{&(0x7f0000001840)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private2}}}, 0x80, &(0x7f0000001d40)=[{&(0x7f00000018c0)=""/241, 0xf1}, {&(0x7f00000019c0)=""/75, 0x4b}, {&(0x7f0000001a40)=""/225, 0xe1}, {&(0x7f0000001b40)=""/198, 0xc6}, {&(0x7f0000001c40)=""/98, 0x62}, {&(0x7f0000001cc0)=""/124, 0x7c}], 0x6, &(0x7f0000001dc0)=""/201, 0xc9}, 0x7f}, {{&(0x7f0000001ec0)=@nfc, 0x80, &(0x7f0000002280)=[{&(0x7f0000001f40)=""/235, 0xeb}, {&(0x7f0000002040)=""/48, 0x30}, {&(0x7f0000002080)=""/150, 0x96}, {&(0x7f0000002140)=""/173, 0xad}, {&(0x7f0000002200)=""/77, 0x4d}], 0x5, &(0x7f0000002300)=""/239, 0xef}, 0x6}], 0x2, 0x40000041, 0x0) sendmsg$NFNL_MSG_ACCT_GET_CTRZERO(r2, &(0x7f0000002680)={&(0x7f0000002540)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000002640)={&(0x7f0000002580)=ANY=[@ANYBLOB="840000000207010800000000000000000a00000108000540000000030c00024000000000000000010c000240000000000000c64d0c00034000000000000000050ca56653a300064000000000000000020900010073797a310000611b933ee7f5e86700000000250008000540000000020c00064000000000000003ff0c00024000000000"], 0x84}, 0x1, 0x0, 0x0, 0x10}, 0x4010) (async) sendmsg$NFNL_MSG_ACCT_GET_CTRZERO(r2, &(0x7f0000002680)={&(0x7f0000002540)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000002640)={&(0x7f0000002580)=ANY=[@ANYBLOB="840000000207010800000000000000000a00000108000540000000030c00024000000000000000010c000240000000000000c64d0c00034000000000000000050ca56653a300064000000000000000020900010073797a310000611b933ee7f5e86700000000250008000540000000020c00064000000000000003ff0c00024000000000"], 0x84}, 0x1, 0x0, 0x0, 0x10}, 0x4010) setns(0xc9, 0x40000000) r3 = socket(0x840000000002, 0x3, 0x100) sendmmsg$inet(r3, &(0x7f0000000340)=[{{&(0x7f00000003c0)={0x2, 0x4e20, @rand_addr=0x44010100}, 0x10, 0x0}}, {{&(0x7f0000000400)={0x2, 0x4e20, @private=0xa010100}, 0x10, 0x0, 0x0, &(0x7f0000000440)=[@ip_retopts={{0x1, 0x0, 0x7, {[@rr={0x7, 0x52, 0x1f, [@empty, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2]}]}}}], 0x18}}], 0x2, 0x0) (async) sendmmsg$inet(r3, &(0x7f0000000340)=[{{&(0x7f00000003c0)={0x2, 0x4e20, @rand_addr=0x44010100}, 0x10, 0x0}}, {{&(0x7f0000000400)={0x2, 0x4e20, @private=0xa010100}, 0x10, 0x0, 0x0, &(0x7f0000000440)=[@ip_retopts={{0x1, 0x0, 0x7, {[@rr={0x7, 0x52, 0x1f, [@empty, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2]}]}}}], 0x18}}], 0x2, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000002500), 0x881, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) (async) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f00000027c0)={0x1, 0x0, [{0xc0011022, 0x0, 0x1b2}]}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000000)={'xfrm0\x00', @remote}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000001700), 0x0, 0x0) (async) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001700), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CAP_DISABLE_QUIRKS2(r8, 0x4068aea3, &(0x7f0000001740)={0xd5, 0x0, 0xaa0}) (async) ioctl$KVM_CAP_DISABLE_QUIRKS2(r8, 0x4068aea3, &(0x7f0000001740)={0xd5, 0x0, 0xaa0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000002800)={'batadv0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000028c0)={'ip6_vti0\x00', &(0x7f0000002840)={'syztnl1\x00', r9, 0x29, 0x2, 0x4, 0x1, 0x5b8d391f9787083a, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @mcast2, 0x40, 0x1, 0x7f, 0x30}}) open(&(0x7f0000000180)='./file0\x00', 0x48141, 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracefs\x00', 0x1ff) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./tracefs\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0xae44, 0x9) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x400302, 0x49) (async) r10 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x400302, 0x49) mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x3000000) (async) mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x3000000) writev(r10, &(0x7f0000000140)=[{&(0x7f00000001c0)="659fe987f755c4f98d7d8610798815df461dc6064a59ea42a00f", 0x1a}], 0x1) r11 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r11, &(0x7f0000002480)={0x0, 0x0, &(0x7f00000024c0)={&(0x7f00000026c0)=ANY=[@ANYBLOB="280000001400010004000000fedbdf25020000000400000008000280bf74a7df08000300", @ANYRES32=r11, @ANYBLOB="9626509b9dc83428f0d8d56d179facf39be3642d43031b69667840a7c1ddb5166f5efba5ac61290c003b98e3f8709ec53a75a27b3d66db8c3e35dfe035a926112030deac90b073cc7981deec0e1009182468a3129f19c24cb5fc341f449b3f994129b6dfc964e11e8fa3b076990548bd964d87e8299abae3dc5c4b2f682972d3f279c1d32c58f394eaea360ff5b5f6872dfa20da75c3280410972cc2c5d22df592a89575"], 0x28}, 0x1, 0x0, 0x0, 0x20000804}, 0x4800) 19.486773855s ago: executing program 0 (id=43): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0xf132, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000440000/0x4000)=nil, 0x4000, 0x1000000) r0 = socket$packet(0x11, 0x2, 0x300) getsockopt$packet_int(r0, 0x107, 0x9, 0x0, &(0x7f00000008c0)) socket$inet6(0xa, 0x6, 0xfffffffe) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000100), 0x40001, 0x0) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) write$uinput_user_dev(r4, &(0x7f0000000200)={'syz1\x00', {0xde3, 0x401, 0x5, 0x40}, 0x42, [0x0, 0x2, 0xed0, 0x5, 0x200, 0x9, 0x4c, 0x658, 0x5, 0x8, 0x0, 0x6, 0xb, 0x70000, 0x81, 0xd9, 0x3, 0x6, 0x6, 0x9, 0xfffffff8, 0x4, 0x1, 0x4, 0x0, 0x80000001, 0x6, 0x7, 0x4, 0x400, 0x80000000, 0x6, 0x3, 0x6, 0x1, 0xd, 0x8, 0x9, 0x1ff, 0x80, 0x56, 0x4, 0x4, 0xdea, 0x1, 0x6, 0x200, 0x0, 0x1, 0x6, 0x4, 0x6, 0x6, 0x6, 0x1, 0x460, 0x7, 0x8, 0x5, 0x401, 0x800, 0x4, 0x81a, 0xf], [0x7, 0xfffffffc, 0x9, 0x9, 0x9, 0x40c, 0x6, 0x3, 0xe, 0xf04, 0x7, 0x8, 0xbf, 0xfffffffd, 0x0, 0x80000001, 0x9, 0x8, 0x3, 0xf0f, 0x7d6a, 0x8, 0xf8a, 0xda, 0x1, 0x8, 0xfff, 0x2, 0xe6, 0x7f, 0x5, 0x5, 0x1, 0x9, 0x7ff, 0x9, 0x0, 0x200, 0x6, 0x8, 0xb, 0x9, 0x4, 0x70, 0x3, 0xfe21, 0xd1, 0x9, 0x7, 0x2, 0x7, 0xffff, 0x1, 0x3, 0x2, 0x3, 0xd, 0xdc67, 0x2, 0x7, 0x81, 0xc, 0x8, 0x1], [0x8, 0x1ff, 0x81, 0x4, 0x9, 0xff, 0xff, 0x4, 0xb, 0x3ff, 0x6, 0x2, 0x9, 0x67, 0xfffffffc, 0x9, 0xe, 0xd0, 0x80, 0xae, 0x1, 0xfffffff7, 0x2, 0x1, 0x3, 0x100, 0x8, 0x2, 0x1, 0x8000, 0x2, 0x2, 0xb, 0xffffffff, 0x81, 0x37, 0x9, 0xd387, 0x7, 0xfffffff5, 0xffff, 0x0, 0x6, 0x4, 0x7fff, 0xc8e, 0xc, 0x0, 0x5, 0x1, 0xfffffffa, 0x4, 0x7da4, 0xd4, 0x8, 0xe000000, 0x0, 0x80, 0x8001, 0xffffffff, 0xa8d, 0x7fff, 0x8, 0xd], [0x1, 0x0, 0x5, 0x6, 0x5, 0x101, 0x37d, 0x1eb, 0x40, 0x8, 0x1, 0x80000000, 0x6, 0x4, 0xfff, 0x4, 0x2, 0x4, 0x8, 0x36e0, 0xfff, 0x7, 0x0, 0x6, 0xff, 0x0, 0x101, 0xd, 0x6ef, 0x8000, 0x7f, 0x34, 0x8, 0x3, 0x7, 0x1, 0x9, 0x4, 0x8, 0x12000000, 0x4, 0x8, 0x80000000, 0x625f, 0x0, 0xfffffffa, 0xfffffeff, 0x1, 0x0, 0x3, 0x8, 0x32, 0x38c7, 0x40, 0x3, 0x10000, 0xce90, 0x8, 0x4, 0x7, 0x2, 0x3e, 0x3, 0x1770]}, 0x45c) ioctl$OCFS2_IOC_UNRESVSP(0xffffffffffffffff, 0x40305829, &(0x7f0000000140)={0x0, 0x1, 0x5, 0x8, 0x800, 0x2}) r5 = dup(r3) ioctl$PTP_EXTTS_REQUEST2(r5, 0x40603d10, &(0x7f0000000180)={0x1, 0x9}) mkdirat$cgroup(r2, &(0x7f0000000080)='syz0\x00', 0x1ff) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, 0x0, 0x0) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f00000007c0), r1) socket$nl_generic(0x10, 0x3, 0x10) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a00), 0x40, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = eventfd2(0x19, 0x40001) ioctl$KVM_HYPERV_EVENTFD(r8, 0x4018aebd, &(0x7f0000000a40)={0x400002, r9}) ioctl$KVM_HYPERV_EVENTFD(r8, 0x4018aebd, &(0x7f0000000a80)={0x400002, 0xffffffffffffffff, 0x1}) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000900), 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r7, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000009c0)={0x14, r10, 0x1, 0x70bd2c, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4000001}, 0x24004050) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r1, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, r6, 0x800, 0x70bd28, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000000}]}, 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x4004) r11 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) writev(r11, &(0x7f0000000680)=[{&(0x7f00000006c0)="fb", 0xffffff5c}, {&(0x7f0000000700)="1902eb02d5e5f29e59e1a7caec33eb76d2430da474d87e367f6598d026438b65eda8341073b6752abdcee080c8e1e876b25227c37d7dd79886ce33f13e857c8eda1cecf6ac36c03dbf54e3cb5136da5a33fee76fb3113f8b6700e9e5fc006b8eed665fed48738d59395ad07438c3610ae3976aac75caf2facafa21c25be3c2", 0x7f}], 0x2) openat$cgroup_type(r2, &(0x7f0000000040), 0x2, 0x0) 19.486256625s ago: executing program 0 (id=44): r0 = socket$netlink(0x10, 0x3, 0xf) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000080)={0x60, 0x0, 0x1, 0x101, 0x0, 0x0, {0x0, 0x0, 0x9}, [@CTA_HELP={0x0, 0x5, 0x0, 0x1, {0x0, 0x1, 'snmp_trap\x00'}}, @CTA_SEQ_ADJ_REPLY={0x44, 0x10, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x10001}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x200}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0xd0}, @CTA_SEQADJ_OFFSET_BEFORE={0x60, 0x2, 0x1, 0x0, 0x9}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x9}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0xe}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x5}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x100e}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x4044}, 0x4044040) 19.477937706s ago: executing program 0 (id=45): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x89b1, &(0x7f0000000240)={'vlan1\x00', @random="00009e0c1100"}) (async) recvmsg$unix(r1, &(0x7f0000001a40)={&(0x7f0000000300), 0x6e, &(0x7f00000018c0)=[{&(0x7f0000000400)=""/174, 0xae}, {&(0x7f00000004c0)=""/98, 0x62}, {&(0x7f0000000540)=""/31, 0x1f}, {&(0x7f0000000580)=""/196, 0xc4}, {&(0x7f0000000680)=""/199, 0xc7}, {&(0x7f0000000780)=""/4096, 0x1000}, {&(0x7f0000001780)=""/50, 0x32}, {&(0x7f00000017c0)=""/228, 0xe4}], 0x8, &(0x7f0000001940)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xf0}, 0x2) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x9) (async) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) (async, rerun: 64) chroot(&(0x7f00000000c0)='./file0\x00') (async, rerun: 64) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000380)=@filename='none\x00', &(0x7f0000001a80)='./sys\x00', &(0x7f0000001ac0)='sysfs\x00', 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000001b00)='./sys/bus/pnp/devices/00:00/resources\x00', 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000001b40)={[{0x2d, 'blkio'}, {0x2b, 'perf_event'}, {0x2b, 'net'}]}, 0x18) (async) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1d000, 0x0) (async) pivot_root(&(0x7f0000000140)='./file0/../file0/../file0\x00', &(0x7f00000001c0)='./file0/../file0/../file0\x00') (async, rerun: 32) landlock_create_ruleset(&(0x7f00000003c0)={0xc0d8, 0x1, 0x1}, 0x18, 0x0) (async, rerun: 32) r3 = openat$sndtimer(0xffffffffffffff9c, 0x0, 0x20380) ioctl$int_in(r3, 0x40049409, 0x0) pivot_root(0x0, &(0x7f00000002c0)='./file0/../file0/../file0\x00') 18.635230102s ago: executing program 0 (id=52): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f00009f9000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000100)={0x0, &(0x7f0000000140)=[@wrmsr={0x65, 0x20, {0x40000000, 0x3}}, @wrmsr={0x65, 0x20, {0x40000001, 0x3b}}], 0x40}) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000280)={0x1, 0x0, [{0x40000001, 0x4, 0x2, 0x31237648, 0x6, 0x0, 0x80}]}) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000001c0)={[0x3, 0xa8, 0x1000f, 0x80000000009, 0x20000cea, 0x4, 0x9, 0x10, 0x73, 0x8000008000000000, 0x79, 0x1, 0x2, 0x8000000000000c, 0x698, 0xffffffff], 0x0, 0x104}) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) 18.533092712s ago: executing program 0 (id=53): ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='3', 0x4e) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mount$binderfs(0x0, &(0x7f0000000040)='./binderfs\x00', &(0x7f0000000140), 0x4800, &(0x7f00000001c0)={[{@max={'max', 0x3d, 0x5}}, {@stats}]}) 18.532076543s ago: executing program 32 (id=53): ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='3', 0x4e) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mount$binderfs(0x0, &(0x7f0000000040)='./binderfs\x00', &(0x7f0000000140), 0x4800, &(0x7f00000001c0)={[{@max={'max', 0x3d, 0x5}}, {@stats}]}) 10.709028344s ago: executing program 4 (id=99): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000004c0)='cpuacct.usage_sys\x00', 0x275a, 0x0) syz_vhost_vsock_setup(0x1, &(0x7f0000fdf000/0x21000)=nil) socket$nl_sock_diag(0x10, 0x3, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./file0\x00', 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000540)={0xffffffffffffffff}) pipe2$9p(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) mount$9p_fd(0x0, &(0x7f00000005c0)='./file0\x00', &(0x7f0000000600), 0x0, &(0x7f0000000640)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_9p2000}]}}) write$P9_RVERSION(r2, &(0x7f00000006c0)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r1, @ANYRESHEX=r2], 0x15) socket(0x10, 0x3, 0x0) r3 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x20) mount(0x0, &(0x7f0000000280)='./proc\x00', &(0x7f0000000340)='proc\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r4, &(0x7f0000000400)='7', 0x1) openat$dm_control(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) openat$binfmt(0xffffffffffffff9c, r3, 0x42, 0x1ff) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000180)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) write(0xffffffffffffffff, &(0x7f0000000140)='p', 0x1) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r6, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r5, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=[@cred={{0x1c}}, @rights={{0x10}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x70}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) syz_ublk_setup_io_uring(0x1ca6, &(0x7f0000000140)={0x0, 0xcfab, 0xab73f6bc085e106a, 0x0, 0x118}, &(0x7f00000003c0), &(0x7f00000002c0), &(0x7f0000000440)) socket$inet6_tcp(0xa, 0x1, 0x0) 9.889132917s ago: executing program 4 (id=101): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', 0x0, 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) fcntl$setlease(r0, 0x400, 0x0) 9.884722538s ago: executing program 4 (id=102): socket$packet(0x11, 0x3, 0x300) (async) syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000700)=ANY=[@ANYBLOB="12010000090000402505a8a440000102030109021b00010100000009040000020701010009050102"], 0x0) (async, rerun: 32) signalfd(0xffffffffffffffff, 0x0, 0x0) (rerun: 32) syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12011001000000205e04f9000000000000010902240001000000200904000d02030005000921feff060122020009055d03ff"], 0x0) (async) syz_usb_connect$uac2(0x0, 0x9a, &(0x7f0000000000)=ANY=[@ANYBLOB="12010102000000200c201810540001020301090288000301018008080b0001010c200609040000000101200009240503000428000408240a05004000020c24030207030503", @ANYRES16=0x0, @ANYRESHEX], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0}) (async, rerun: 64) r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) (rerun: 64) setsockopt(r0, 0x858, 0x8000, 0x0, 0x0) (async) syz_usb_connect$printer(0x1, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x9, 0x10, 0x66, "", [{{0x9, 0x4, 0x0, 0x7, 0x2, 0x7, 0x1, 0x3, 0x7, "", {{{0x9, 0x5, 0x1, 0x2, 0x10, 0x3, 0x6, 0x8e}}}}}]}}]}}, &(0x7f0000000600)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x250, 0xa9, 0xeb, 0x1, 0x8, 0x81}, 0x171, &(0x7f0000000200)=ANY=[@ANYBLOB="050f710305db100a7eb3e0fad43db8e85392d1bdfe90533bc9f996626e85daa27bcb8ca6aa97f952df7a059df01fffade12be0c2accb3a65e7172d5e6c45afe1ae3051c4cf5acec79faaaf1af83ed39a7b57ba5c9a8cacb2f026551187318c02e4dd9cb114e3d6b8210f70a80aecee28a684b7b3733620c081f129ec45c092952e504f660303e219823f03913bf732d7bb6e97cc0de0e841faa735ea9f2ac51343170232be3c3d8d11698c95ba0ffe2af449c68c61f21154b25e2ce0101d37e859911759972fb90c6943cd7d5ef364d4dd511565678cf4dd2cdb2b92422b4a3332199c9bc2287db05594c90710021096ff005e100b9229bbe790acfb0500000000000000d9e1a9dcfac5bfe94866b5fa052eb79cc9083acdc3e244db32e711a1c07571e51a2f3349a29fd807a9c406d885286cf719f713faa6b563e9840d014bec26740b00d80e3453c5b23fc72def580c100a0420000000000f040020100a77e50000000f0f05000f0000000000000000"], 0x8, [{0x80, &(0x7f0000000140)=@string={0x80, 0x3, "74c07c68eb394d46970ca618550d7bbd0d6830557613a1ef8c4300ae18446b208fc7468bc30d0df35b1d17733f4073d77bc6d2e9353ab3c99feff6f97b95033fb240dc46a993e3d6c24fc5bd1ddf15d82ca705f0b6b0f55eaed9b273ae0803800349a6d5db9863a9bea9a8ee7f191b9564bac0dcca450a403f5f004f4586"}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x1c0a}}, {0x3f, &(0x7f0000000740)=@string={0x3f, 0x3, "31b32be4acfec417ceb160e26dfdf65a4a9e3a7457ee1c6b0264300c8afcd9962807f11c0a5daf03105aed4e1e3d6a682857733a33351535e9f665cad3"}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x3c01}}, {0xec, &(0x7f0000000780)=@string={0xec, 0x3, "22452f1783ec7ade56d3021cada908014ab8191cbdd77366fd13ec91b1867d23c2987fd1a1de31716ffe29c40b3b12d9c2e15932db8a069a672daa9af1caed6b18d8700845b31c3f2b1d1ba1ba412d8593de590b4d714693cb726d2f0970a34fe595584d6ff84d82b692d1200e3e84450e9cf0819cc58938c1d4c14075aef0ab8f6a49f60d34737d9b79e2034be52d4bc7800cc3c0e2f98433db49a23ba64c63f859449b3760bf6541cd1ac7957a3a1b33c0c2bfcd49053fb970f46b141b22f8846e11896d4bfa88fcbb458dcca0d2a2b728adaddd5b39d2f0a9b389b967589196916e615cac763bacd3"}}, {0x4, &(0x7f0000000540)=@lang_id={0x4, 0x3, 0x447}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x427}}, {0x4, &(0x7f00000005c0)=@lang_id={0x4, 0x3, 0x1404}}]}) (async) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000380)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x5ac, 0x246, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x5, 0xe0, 0x2, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x1, 0x2, 0x3, {0x9, 0x21, 0x5, 0x6, 0x1, {0x22, 0x539}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x5, 0x9, 0x5}}}}}]}}]}}, &(0x7f00000006c0)={0xa, &(0x7f0000000440)={0xa, 0x6, 0x310, 0x4, 0x6, 0x9, 0x8, 0x10}, 0x5, &(0x7f0000000480)={0x5, 0xf, 0x5}, 0x1, [{0x23, &(0x7f0000000680)=@string={0x23, 0x3, "275adba873fbd627b41b6a623f8b37c39948db442a2f4744b0780328e2d4b2ec62"}}]}) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x6) ioctl$KVM_SET_TSS_ADDR(r1, 0xae47, 0x0) (async, rerun: 64) syz_usb_connect$uac3(0x5, 0xa3, &(0x7f0000000880)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x10, 0x86a, 0x1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x91, 0x3, 0x1, 0x5, 0x80, 0x0, {0x8, 0xb, 0x0, 0x1, 0x1, 0x21, 0x30, 0x6}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xe, 0x10, 0x2}, [@cluster_info_segment={0x6, 0x20, 0x7, 0x96, 0xb3}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0x7d, 0x7, 0x2, {0xa, 0x25, 0x25, 0x9, 0x5, 0x6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_continuous={0xd, 0x24, 0x2, 0x1, 0x5, 0x4, 0x6, 0x1, "86fc", 'lCx'}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x4, 0x8}, @format_type_ii_discrete={0xa, 0x24, 0x2, 0x2, 0x2, 0x1, 0x0, "eb"}]}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x0, 0x6, 0x3, {0xa, 0x25, 0x25, 0x7, 0x3a, 0x7}}}}}}}}]}}, &(0x7f0000001040)={0xa, &(0x7f0000000940)={0xa, 0x6, 0x200, 0x97, 0x8, 0x12, 0xff, 0x68}, 0x24, &(0x7f0000000980)={0x5, 0xf, 0x24, 0x4, [@wireless={0xb, 0x10, 0x1, 0xc, 0x94, 0xf, 0x63, 0x100, 0x8}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x2, 0x5}, @ptm_cap={0x3}, @ext_cap={0x7, 0x10, 0x2, 0xc6a0d2c9c52b3518, 0x4, 0x4, 0x401}]}, 0x9, [{0x70, &(0x7f00000009c0)=@string={0x70, 0x3, "920c991f317d5288f507277d09b0e56cbaf49dc74cd06eb5a71e4e9afb2ac24283907fdb3a50cc9cd31ed8d610cf58d967cb22f912e09a647939b7a2d74170a4602fb1c829f8ce55c54ec62ca19665728d3c3814e50d083bc14a42a2f2a27f2f29d312c96fd056a37d9b949ebb4e"}}, {0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0xc07}}, {0x83, &(0x7f0000000a80)=@string={0x83, 0x3, "3950dfbe5f435a67c6845b425e4683ea2ad50b574f01ee39833e1d402ef1d9310d70411c9815f871deca17ab61c735dc2c1d748cb19635070ecbf97abe6ddcaa320f826d86000c29579406cdaf69cc50529d6baa49dc7b1b68503b7b281613770f6d78813bb3d3f1aea03acd3379bac817fb35f40bb6fdc04349d364f3e49b020f"}}, {0xbb, &(0x7f0000000b40)=@string={0xbb, 0x3, "d8761cd27a6cf6e8bda6905454912ce7589b6903df2de33c47e9fda4fd70127b9d40834f95580a33904f763575baa2ac8eb0b4feb9b30f3650308a73f173d9482df849336b987a9e11a92ff1de0325d16091d5572dd0f9d3b9bf6be41015fb64c85ecd0be5c1023656e77c14fbf535fc4ba3c8fb89d32a4a42a0c9a5c990670b65df188aa7e209a355fe67f4532444a4d151eec2f696b9ca89fba684d8a6576f0f1ddec5fc41e596efacdab2910ab9f0c8fbfcc9555fb3eee1"}}, {0xd4, &(0x7f0000000c00)=@string={0xd4, 0x3, "66dabbf3b99bb98e9ceeb020557cf02a4f0ac3459f6ca784d18ed0e179b0693abd39bd7d925b1b34fa15884d596c9f4cad92ca088f1fe6ce414ce60af29e6e11b81e59b49e9c0fbbd28b8c3d3a82c9e3f100daa0db18e02b10998e7eb600cb406394c6ee6f8c9a5fafecea58b608a4056fa7432eaa75b17e05d2f461ec56a68b29686bc5880dc467c51952e9f92bc06fdb779ba5edf633ad5a288ca071d122e4bb46646c2af588ab2382c9c1e6e9edc1fb671ebcfb9457b630b8dd7535161025b7777fdb23a435d99fc61e60799fb598e941"}}, {0xc3, &(0x7f0000000d00)=@string={0xc3, 0x3, "887d6e1d8fb509cc9595e9040102b7ecee640e90d7c1d3266f0cc9fc4c55f3aa0a4a20573aef7da43389e8199c0dc63825b6566c7dc2541a811d14c52026191953b32967e971353b4f6ea9728acafbaf05ca5479fab78508b83cab7341bcaf9c4a26d44795be9a893861a503a9d3a6cb489677281228672b1fa8ee2568809817ce28af36bf4dbdf04fe3fe293235e1e68f94dceae01c22aa151ddeaf2f3eaa07c275c364fac52f8ae0b84398f1cee542e4f7c09a0b5c214ab2412729af0f5b72b7"}}, {0x81, &(0x7f0000000e00)=@string={0x81, 0x3, "d9cadc7fb4edb8786762299617cf1cf4c5634fcc13e2ce700a226ce86a6bc666e459003c98a8a20c90ec62eac00754ababd1b2d2462833dadc574510f0f6a9d46a138fe1163abc646da917268f174d80930df167f57ada583087e6c21ecefcbbd2e821d4d527ca583bb4ad41a008d44eea72da2fd48ce297979a6270f8f735"}}, {0x53, &(0x7f0000000ec0)=@string={0x53, 0x3, "82f3deabcefc23f70828cfdec45a7ff33ffb604dc09168d053501f7f902b5f284bc85106b9f082e0168022474fa443282aa1007229067e3778a5de715c4f91fa63e1df043926b3bcd9cf8c3c3de83f5aa7"}}, {0x100, &(0x7f0000000f40)=@string={0x100, 0x3, "b71e65bd6391855c674edb5c418a59df02d7fd11bd67657c3772834b2811b5b38431ddca8daaca3303d09bdbc84b1e164543d89f56e47ebcbcdd5955c9d0589272c32495851dc005c7e39302515a0a69d258d2c322cf0ae9c9a780c75217be0ff235de21f3aa5136fb1b3e0bb0419e431d5e62d9f0d495d9ee067cbb27b3981a0340b32f881ea378c938cb62a5cfe1dbab688be0b5e5a993e489f391235eaff2e5651e153dea5e102951afb0af87cd7139298f5970d5d823cec300b3f5ef48567a911598ddd9ab59ef69f740fe173aaff677612b11f3a600382924981e44b1c43ba338506f9fec832e2c42c6afc7ab4ebcd5a3f567338bde6ca6c08408f9"}}]}) (rerun: 64) 8.48942s ago: executing program 4 (id=107): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') r0 = open(&(0x7f0000000040)='./bus\x00', 0x4ca7e, 0x10) fallocate(r0, 0x0, 0x0, 0x7) read$FUSE(r0, &(0x7f0000001640)={0x2020}, 0x2020) 8.469062783s ago: executing program 4 (id=108): socket$inet6(0xa, 0x2, 0x3a) (async) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) (async) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x60}, 0x80) (async) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) socketpair$unix(0x1, 0x0, 0x0, 0x0) (async, rerun: 64) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) (async) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) (async) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_LBT_MODE(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="04"], 0x14}}, 0x0) (async) syz_genetlink_get_family_id$nfc(&(0x7f00000002c0), r5) (async) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000340), r5) (async, rerun: 64) r6 = syz_genetlink_get_family_id$nbd(&(0x7f0000000400), 0xffffffffffffffff) (async, rerun: 64) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff}) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$gtp(&(0x7f0000000640), r4) sendmsg$GTP_CMD_NEWPDP(r8, &(0x7f0000000740)={&(0x7f0000000600), 0xc, &(0x7f0000000700)={&(0x7f0000000780)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010025bd7000fedbdf2500000000080009000100000005000d000500000008000500ac1414aa08000200000000000c000300040000000000000008000700", @ANYRES32=r4, @ANYBLOB='\b\x00\a\x00', @ANYRES32=r4, @ANYBLOB="05000d00220000001f2e3514fa88a720e9d99d602556"], 0x58}, 0x1, 0x0, 0x0, 0x10}, 0x4000) (async) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000005c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000580)={&(0x7f00000004c0)={0x8c, r6, 0x8, 0x70bd2a, 0x25dfdbff, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7f}, @NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r4}}]}, @NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r7}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x120}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x4}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r4}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r4}}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x800}, 0x20000004) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$sock_inet6_SIOCSIFDSTADDR(r10, 0x8918, &(0x7f0000000080)={@mcast2, 0x29}) futex(0x0, 0x85, 0x0, 0x0, 0x0, 0xa0090199) (async) syz_ublk_setup_queues(r4, r2, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x2f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfa2, 0x40040, 0x1000002, 0x1a2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x81}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x20, 0x40000001, 0x4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x1, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 8.30097509s ago: executing program 4 (id=109): r0 = socket(0x28, 0x5, 0x0) (async) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000380)={0x1, &(0x7f0000000400)=[{0x6, 0x10, 0x0, 0x7fff7ffc}]}) close_range(r1, 0xffffffffffffffff, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000180)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) (async) ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f00000000c0)={0x2, 'lo\x00', {0x6}, 0x7f}) write(0xffffffffffffffff, &(0x7f0000000140)='p', 0x1) (async) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r4, &(0x7f0000000200)={0x0, 0xfffffff5, &(0x7f0000000240)=[{&(0x7f0000000340)="a2", 0xfffffdef}], 0x1}, 0x0) (async) recvmsg(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000005c0)=""/207, 0xcf}], 0x1}, 0x4000a163) (async) socket$nl_generic(0x10, 0x3, 0x10) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@any_dev={0x2, 0x465, 0x0, 0x0, 0x1000, 0x1c9e959d, 0x0, 0x0, 0x106}}}, &(0x7f0000000300)=0x0) syz_ublk_setup_io_uring(0x477c, &(0x7f0000000140)={0x0, 0x4fab, 0x20000, 0x0, 0x118}, &(0x7f0000000280), &(0x7f00000002c0), &(0x7f00000003c0)) (async) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) r8 = socket(0x10, 0x3, 0x0) r9 = socket$packet(0x11, 0x3, 0x300) (async) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000980)={'gre0\x00', 0x0}) sendto$packet(r9, &(0x7f00000009c0)="330320000a00140000007ef52f555f2a0c09000000000000", 0x18, 0x40008c1, &(0x7f0000000a00)={0x11, 0x0, r10, 0x1, 0x62, 0x6, @broadcast}, 0x14) (async) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r11, 0x8933, &(0x7f0000000a40)={'batadv_slave_0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r11, 0x890b, &(0x7f0000000d00)={@mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @dev={0xfe, 0x80, '\x00', 0x25}, 0x1, 0x6, 0x0, 0x100, 0x4, 0x540000, r12}) (async) r13 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCADDRT(r13, 0x890b, &(0x7f0000000d80)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x0, 0x6, 0x0, 0x100, 0x6, 0x180107, r12}) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r2, &(0x7f0000000f00)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000700)=ANY=[@ANYBLOB="c8000000", @ANYRES16=0x0, @ANYBLOB="000428bd7000ffdbdf2506000000040001800c0001800800030003000000180001801400020076657468300000000000000000000000640001801400020076657468305f6d61637674617000000008000100", @ANYRES32=0x0, @ANYBLOB="14000200776c616e30000000000000008a6f4e32f5f45b000000001400020000feff000000000000f9000000", @ANYRES32=r10, @ANYBLOB="14000200626f6e645f736c6176655f300000000028000180140002006361696630000000000000000000000008000100", @ANYRES32=r12, @ANYBLOB="0800030002000000"], 0xc8}, 0x1, 0x0, 0x0, 0x40045}, 0x20000041) (async) r14 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20842, 0x0) writev(r14, &(0x7f0000000040)=[{&(0x7f0000000080)="e1", 0x5603d}], 0x1) (async) syz_ublk_setup_queues(r14, r5, &(0x7f00000004c0)={0x0, 0xe62c, 0x10, 0x40001, 0x80}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe706, 0x1000, 0x3, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9b45, 0x80, 0x4, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93e9, 0x200, 0x4003bfff, 0x99, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x230}}], 0x1, 0x0, 0x0) 4.88100911s ago: executing program 2 (id=127): mkdir(&(0x7f0000000100)='./file0\x00', 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) fstat(r1, &(0x7f0000001800)) mkdirat(0xffffffffffffff9c, &(0x7f0000001900)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001940)='./dev\x00', &(0x7f0000001980)='devtmpfs\x00', 0x4010, 0x0) r2 = syz_usb_connect(0x0, 0x39, &(0x7f00000019c0)=ANY=[@ANYBLOB="12010002000000407b0603230001000000010902270001010080320904000003ff000000070581024000000705020240000007058303"], 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io$uac3(r2, 0x0, &(0x7f0000001a00)={0x44, &(0x7f0000001a80)=ANY=[@ANYBLOB="00163b000000dc7fe57d97c1267f368d46b7d5cc378d42fd2cabfa410a7d7ce300c795ab88b284e3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_buf(r3, 0x6, 0x23, &(0x7f0000001b00)=""/24, &(0x7f0000001b40)=0x18) r4 = socket(0x2, 0x2, 0x0) utime(&(0x7f0000001b80)='./proc/thread-self/fail-nth\x00', &(0x7f0000001bc0)={0xb, 0x2002a}) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r4, 0x8983, &(0x7f0000001c00)={0x1, 'vlan1\x00', {}, 0x5832}) r5 = socket$xdp(0x2c, 0x3, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_buf(r6, 0x0, 0x8008000000010, &(0x7f0000001c40)="17000000020001000003d68c5ee17688a2003308020300ecff3f0200000300000a000000009afc5ad9485bbb6a880000d6c8db0000dba67e060180000a1100f10607bdff59100ac45761407a681f009cee4a5acb3da400001fb700674f19b44e09f9315033bf79ac2dff060115003901000000000000ea000000000000000009ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e00000000000000000", 0xb6) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f0000001d00)={0x0, 0x200000, 0x1000}, 0x20) ioctl$EXT4_IOC_MOVE_EXT(r4, 0xc028660f, &(0x7f0000001d40)={0x0, r5, 0x5, 0x100000000, 0x3}) syz_open_procfs(0x0, &(0x7f0000001d80)='comm\x00') setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001dc0)='./proc\x00', 0x1bf) mount(0x0, &(0x7f0000001e00)='./proc\x00', &(0x7f0000001e40)='proc\x00', 0x4000, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r7, 0x0, 0x60, &(0x7f0000001e80)={'filter\x00', 0x7, 0x4, 0x3e8, 0x0, 0x0, 0x0, 0x300, 0x300, 0x300, 0x4, 0x0, {[{{@uncond, 0xc0, 0x108}, @unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00', 0x1, 0x2, {0x8}}}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, 0xffffff00, 0xffffff00, 0x0, 0xb, {@empty, {[0x0, 0xff, 0xff, 0x0, 0xff, 0xff]}}, {@mac=@remote, {[0xff, 0x0, 0xff, 0xff, 0x0, 0xff]}}, 0x2, 0x4, 0x9, 0x6, 0x9, 0xf, 'macsec0\x00', 'ipvlan0\x00', {0xff}, {}, 0x0, 0x240}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffd}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @private=0xa010102, @multicast2, 0x4, 0x1}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x438) ioctl$DM_DEV_SET_GEOMETRY(0xffffffffffffffff, 0xc138fd0f, &(0x7f00000022c0)={0x4, 0x0, 0x0, 0x190, 0x138, 0x0, 0x0, 0x400, 0x0, 0x0, @by_dev, {0x24d, 0x20, 0x79, 0x20, 0x200000000002b, 0x20, 0x263}}) r8 = openat(0xffffffffffffff9c, &(0x7f0000002480)='./proc/thread-self/fail-nth\x00', 0x202, 0x150) write(r8, &(0x7f00000024c0)='27', 0x2) r9 = socket$inet6(0xa, 0x2, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(r9, 0x29, 0x41, &(0x7f0000000140)=ANY=[@ANYBLOB="6d616e676c650000000000000000000000000000000000000000000000000000f8040000000000001d00000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c416fc9941e0c2eb67d37d6625ba7ba3490865b26ffa64e584d2cc6afbb4109056d62536f1947cc5ccffe5ed3102ef8d3ee899744b1ae35a53a13c91e7911f94b867755765d2940e573b35c44d79cc34a4d4e504125ed76344b07623ffb95cc94f560bcef2f43d2653526eeedfdbb2e974c87a"], &(0x7f0000002a40)=0x520) 2.766923446s ago: executing program 1 (id=140): r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x2a8}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f00000004c0)={0x2e, 0x64, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x4, 0xf7f, 0x0, 0x0, 0x1000, 0x6, 0x0, 0x0, 0x20}}}, &(0x7f0000000300)=0x0) syz_usb_connect$midi(0x3, 0x3d, &(0x7f0000000000)=ANY=[@ANYBLOB="12015002000000404406478040000102030109022b0001010410040904000001010320000624020140a3090507024000000b060a25"], &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0}) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x2, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x20, 0x1000000, 0x10000002, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xbe24, 0x0, 0x0, 0x391, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x40, 0x0, 0x35c, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x1000, 0x3, 0xffffffff}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, r4, '\x00', {0x1, 0x5, 0x0, 0x0}}, 0x0) setsockopt$inet_group_source_req(r7, 0x0, 0x2c, &(0x7f0000000340)={0x3, {{0x2, 0x4e22, @broadcast}}, {{0x2, 0x4e32, @local}}}, 0x108) 1.867802858s ago: executing program 2 (id=141): r0 = open(&(0x7f0000000100)='./file0\x00', 0x149040, 0x40) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r1, 0x0, 0x2) fcntl$setlease(r0, 0x400, 0x0) truncate(&(0x7f0000000140)='./file0\x00', 0x4) fcntl$setlease(r0, 0x400, 0x2) 1.765026289s ago: executing program 2 (id=142): r0 = openat$kvm(0x0, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x401) r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0) ioctl$TCSETSF2(r2, 0x402c542d, &(0x7f0000000040)={0x7, 0xb, 0x0, 0x7, 0x2, "bf36ed4aedde8ab8bf400bb6f93fd49da2e896", 0x79, 0x7fff00}) r3 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$x86(r3, &(0x7f0000000240)={0x0, &(0x7f0000000280)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @host16=0xc0a, 0x3}}, @nested_vmlaunch={0x12f, 0x18}], 0x80}) syz_usb_connect$uac3(0x3, 0x110, &(0x7f0000000080)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0xe41, 0x4642, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xfe, 0x3, 0x1, 0x9, 0x50, 0x0, {0x8, 0xb, 0x1, 0x2, 0x1, 0x24, 0x30, 0x2}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x6, 0x28, 0x6}, [@power_domain={0xc, 0x24, 0x10, 0x32, 0x16, 0x100, 0x6, "eb6dec"}, @selector_unit={0x7, 0x24, 0xc, 0x3, 0x2, "57a6"}, @multiply_unit={0xb, 0x24, 0xd, 0x5, 0x81, 0x5, 0x59a}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0xff, 0x3, 0xf, 0x7, "97b4", "ea"}, @format_type_i_continuous={0xd, 0x24, 0x2, 0x1, 0x0, 0x2, 0x1, 0x4, "798df0", "aa1c"}, @format_type_i_discrete={0xb, 0x24, 0x2, 0x1, 0x5, 0x1, 0x6, 0x10, "dd4976"}, @format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x5, 0x4, 0x3, 0x7}, @format_type_i_discrete={0x11, 0x24, 0x2, 0x1, 0x10, 0x3, 0x3, 0x5, "4535c618503fc20202"}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x8, 0x7, 0x5, 0x0, 0x6}]}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x8, 0x6, 0x3e, {0xa, 0x25, 0x25, 0x4, 0x8, 0x1}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0x29}, @format_type_ii_discrete={0xa, 0x24, 0x2, 0x2, 0x4, 0xf90e, 0xb, 'T'}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0xb, 0x3, 0x3, 0x0, 0x1}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x1, 0x6, 0x3, 0x3, 0x6}, @format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x8, 0x2, 0x0, 0x8, "c73dd4"}]}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x5c, 0xc6, 0x8, {0xa, 0x25, 0x25, 0x2, 0x3, 0x2}}}}}}}}]}}, &(0x7f00000003c0)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x300, 0x0, 0x4, 0x2, 0x20}, 0x4c, &(0x7f0000000300)={0x5, 0xf, 0x4c, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x4, 0x2, 0xc0, 0x9}, @ext_cap={0x7, 0x10, 0x2, 0x0, 0x1, 0xc, 0x3}, @ext_cap={0x7, 0x10, 0x2, 0x1c, 0x9, 0x6, 0x4}, @ss_container_id={0x14, 0x10, 0x4, 0x6b, "33e215fc356b841c60644296e4eb0f34"}, @ext_cap={0x4, 0x10, 0x2, 0x12, 0x6, 0x2, 0x8}, @ss_container_id={0x14, 0x10, 0x4, 0xcb, "633f624b229c0f80e4ad74748804eac2"}]}, 0x1, [{0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x1c0a}}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 1.467500459s ago: executing program 1 (id=143): r0 = dup(0xffffffffffffffff) sendmsg$NFT_BATCH(r0, &(0x7f0000000440)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000040)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_DELRULE={0x344, 0x8, 0xa, 0x3, 0x0, 0x0, {0x5, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x4}, @NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x3}, @NFTA_RULE_EXPRESSIONS={0x2d0, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @exthdr={{0xb}, @void}}, {0x10, 0x1, 0x0, 0x1, @range={{0xa}, @void}}, {0x14, 0x1, 0x0, 0x1, @synproxy={{0xd}, @void}}, {0x54, 0x1, 0x0, 0x1, @range={{0xa}, @val={0x44, 0x2, 0x0, 0x1, [@NFTA_RANGE_OP={0x8}, @NFTA_RANGE_OP={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RANGE_OP={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RANGE_SREG={0x8, 0x1, 0x1, 0x0, 0xf}, @NFTA_RANGE_SREG={0x8, 0x1, 0x1, 0x0, 0x16}, @NFTA_RANGE_OP={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RANGE_OP={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RANGE_SREG={0x8, 0x1, 0x1, 0x0, 0xe}]}}}, {0x224, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x210, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DATA={0xbc, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x14, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}, @NFTA_DATA_VERDICT={0x40, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VALUE={0x4b, 0x1, "32542c58ab95c626eedeed4cd4dbf5c9d982799c59d2bcdd3a17baf5d811031c5ab8cd7360fdf1c6b01f3d2402c9f4c66504d317ef6bae33830a53342084724f18773aaef470fd"}]}, @NFTA_IMMEDIATE_DATA={0x64, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x60, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CODE={0x8}]}]}, @NFTA_IMMEDIATE_DATA={0xd4, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0xcd, 0x1, "3bcd3d5cafe4b4dcb2af4440ecc24e583113b54e4b7d3f45dabf0a61a6ace0b295121a1a84906d36cbadb86d64dfcc775d4d727255a4c9693fda5454248a450b31857a4143d5d4152ca1203b958f4b53887c7768d7f09a22a6b123a71838e4950ba6f4e4f7357c717e5f82cc9f85ea4d98bcc4720bb4417fb2956252c4fbc88bfd15c2872d95bf7070ad1acb946fadab0766157a91c07879aaf8362c657d1e0ccaae6528d82ad7bb44441249d3c5a924aac9efd6795cad1408fa11e121f7ac1d9e1cdf605240ef513c"}]}, @NFTA_IMMEDIATE_DREG={0x8, 0x1, 0x1, 0x0, 0x11}, @NFTA_IMMEDIATE_DREG={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_IMMEDIATE_DREG={0x8, 0x1, 0x1, 0x0, 0x4}]}}}, {0x20, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_NAT_FAMILY={0x8, 0x2, 0x1, 0x0, 0xa}, @NFTA_NAT_FAMILY={0x8, 0x2, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_COMPAT={0x1c, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x1d}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x2e}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0xdada}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x1}, @NFTA_RULE_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x2}]}, @NFT_MSG_DELSET={0x1c, 0xb, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0xa}, [@NFTA_SET_POLICY={0x8}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x388}, 0x1, 0x0, 0x0, 0x20000080}, 0x40000) ioctl$AUTOFS_IOC_PROTOVER(r0, 0x80049363, &(0x7f0000000480)) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)=@getspdinfo={0x14, 0x25, 0x800, 0x70bd29, 0x25dfdbfe, 0x5, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000041}, 0x80d4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000600)={'batadv_slave_1\x00', 0x0}) sendmsg$BATADV_CMD_TP_METER(r0, &(0x7f00000006c0)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000640)={0x3c, 0x0, 0xf45dff3d10c8c250, 0x70bd2c, 0x25dfdbff, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r1}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x4}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x80000001}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x40) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f00000008c0)={{r0, &(0x7f0000000700)='\x00', 0x8c0, &(0x7f0000000740)={@_ha_fsid={[0x7d, 0x5]}, {0x3, 0x1, 0x5, 0x5cdf}}, 0x0, &(0x7f0000000780), &(0x7f00000007c0)=0x2}, {[0x2, 0x0, 0x2, 0x2f]}, 0x3, 0x85, &(0x7f0000000800)=""/133}) ioctl$sock_SIOCSIFVLAN_SET_VLAN_FLAG_CMD(r0, 0x8983, &(0x7f0000000940)={0x7, 'veth0_vlan\x00', {0x8}, 0x5}) ioctl$BTRFS_IOC_INO_PATHS(0xffffffffffffffff, 0xc0389423, &(0x7f00000009c0)={0xbbe, 0x40, [0x76a, 0x100, 0x2, 0x4], &(0x7f0000000980)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) sendto(r0, &(0x7f0000000a00)="09fc532fc29f4e4171cbcc1fb172790182bef9dd3adf18e880c0a2621c28e9ac6392b0fd02adda729b421fa960bf8f7b0fdb2786455d5b51cb2c00934ebb1cbef292c58b7312fa3895416e0c7c1c0f7caad4981496fcd5dd0a164dadc3be691159288ecde79915637cbe780e1b26002350cca89355e4c758d2d366b96578103276dfd8c21690a7a78fc7bec8c82664c5afa15bf6c71d81164d93397ef292efa5770fda3b5dca7ab18199bf50c7e8eb3af5dddd6356f938bdab5228d94df74101227e1a07df5e705faf3c47b2fb9764ef6f3343f6412f709613c9b0b47a70b721a4d0fa", 0xe3, 0x4000, 0x0, 0x0) ioctl$FIGETBSZ(r2, 0x2, &(0x7f0000000b00)) sendmsg$NL80211_CMD_UPDATE_FT_IES(r0, &(0x7f0000000c40)={&(0x7f0000000b40), 0xc, &(0x7f0000000c00)={&(0x7f0000000b80)={0x74, 0x0, 0x100, 0x70bd29, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x5db5840e, 0x1f}}}}, [@NL80211_ATTR_IE={0x54, 0x2a, [@sec_chan_ofs={0x3e, 0x1, 0x3}, @dsss={0x3, 0x1, 0x84}, @erp={0x2a, 0x1, {0x0, 0x1}}, @measure_req={0x26, 0x45, {0xfb, 0x6, 0xb, "78724df0ffe8bd250fc018aa02017451baef15c21798bdded82de90a371916ce8028acdd167cd839142110d8025fc07e4d38621443f278d40da031fab64d241bbfa7"}}]}]}, 0x74}, 0x1, 0x0, 0x0, 0x20000004}, 0x20008080) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000c80)={'geneve1\x00', 0x1000}) mount(&(0x7f0000000cc0)=@sg0, &(0x7f0000000d00)='./file0\x00', &(0x7f0000000d40)='nilfs2\x00', 0x200140b, 0x0) ioctl$VT_RELDISP(0xffffffffffffffff, 0x5605) r3 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000d80), 0x400, 0x0) ioctl$DM_DEV_CREATE(r2, 0xc138fd03, &(0x7f0000000dc0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28400, 0x0, 0x0, {0x0, {'syz', 0x0, '3\x00'}, @uuid={'CRP-syz', 0x0, '1\x00'}}}) ioctl$DM_TABLE_LOAD(r3, 0xc138fd09, &(0x7f0000000f00)={0x4, 0x0, 0x0, 0x308, 0x138, 0x1, 0x0, 0x1400, 0x0, 0x0, @by_dev={r4}, [@multipath={0x0, 0x2000, 0x0, 0x1d0, 'multipath\x00', {'2 pg_init_delay_msecs 10', 0x20, '0', 0x20, 0x4, 0x20, 0x1, [{0x20, 'round-robin 0', 0x20, 0x2, 0x20, '0', [{0x20, @rnull={'/dev/syzrnull', 0x0}}, {0x20, @ram_num={'1:', 0x1}, ' 1'}]}, {0x20, 'historical-service-time 0', 0x20, 0x2, 0x20, '2', [{0x20, @rnull={'/dev/syzrnull', 0x0}, ' 1000 100'}, {0x20, @ram={'/dev/ram', 0x0}, ' 1000'}]}, {0x20, 'service-time 0', 0x20, 0x3, 0x20, '1', [{0x20, @rnull={'/dev/syzrnull', 0x0}, ' 1'}, {0x20, @ram={'/dev/ram', 0x1}, ' 1000 100'}, {0x20, @rnull={'/dev/syzrnull', 0x0}, ' 1000 100'}]}, {0x20, 'historical-service-time 0', 0x20, 0x2, 0x20, '1', [{0x20, @rnull={'/dev/syzrnull', 0x0}}, {0x20, @ram_num={'1:', 0x1}, ' 1'}]}]}}]}) ioctl$BLKREPORTZONE(r2, 0xc0101282, &(0x7f0000001240)={0x3, 0x3, 0x0, [{0x6, 0x8, 0x3, 0x2, 0x3, 0x6, 0x81, '\x00', 0x2}, {0x8, 0x3391, 0x2b6d95f5, 0x4, 0x9, 0x72, 0x6}, {0x8, 0x137, 0x8, 0x3, 0x5, 0x0, 0x9, '\x00', 0x7}]}) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001340), r2) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000001380), 0x0, 0x0) ioctl$DM_DEV_WAIT(0xffffffffffffffff, 0xc138fd08, &(0x7f00000013c0)={0x4, 0x0, 0x0, 0x1d0, 0x138, 0x0, 0x0, 0x1810, 0x3bb, 0x0, @by_dev={r4}, "756fdbbfc4fec5284806f5524d636241a912f110d801b4f7c7e5da15e238f17a8e4132ff463443b1659af05b877a7d0acf0a53c03fdfe23990922bdbb26df16c12fa03faa0548c716a1e5376b406dba87dfaf19bc3ee10f46d3a0e6c3d397a0c6fe99718a10491d569847d2da50b6e30ee0742413d49bbd7b2735104741e940378851c64cc57b4dc97e736733a24011f53d5a42b6b"}) r7 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000015c0), 0x1, 0x0) fcntl$setflags(r3, 0x2, 0x1) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001640), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_SURVEY(r8, &(0x7f0000001700)={&(0x7f0000001600)={0x10, 0x0, 0x0, 0xa00100}, 0xc, &(0x7f00000016c0)={&(0x7f0000001680)={0x14, r9, 0x200, 0x70bd26, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", ""]}, 0x14}}, 0xc0) ioctl$OCFS2_IOC_GROUP_EXTEND(r6, 0x40046f01, &(0x7f0000001740)) mount_setattr(r0, &(0x7f0000001780)='./file0\x00', 0x900, &(0x7f00000017c0)={0x1, 0x0, 0x1a0000, {r7}}, 0x20) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r8, &(0x7f0000001900)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000018c0)={&(0x7f0000001840)={0x48, r5, 0x300, 0x70bd2b, 0x25dfdbfe, {}, [@ETHTOOL_A_LINKINFO_HEADER={0x4}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x3}, @ETHTOOL_A_LINKINFO_HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg2\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x4800}, 0x48044) 1.390397047s ago: executing program 1 (id=144): syz_open_procfs(0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000780)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000007c0)='./proc\x00', &(0x7f0000000800)='proc\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f00000007c0)='./proc\x00', &(0x7f0000000800)='proc\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) (async) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./proc/thread-self/fail-nth\x00', &(0x7f0000000480), 0x6000) r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$ARPT_SO_GET_ENTRIES(r0, 0x0, 0x61, 0x0, &(0x7f0000000400)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x20042, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r2, 0x4068aea3, &(0x7f0000000300)={0x79, 0x0, 0x18}) (async) ioctl$KVM_CAP_SPLIT_IRQCHIP(r2, 0x4068aea3, &(0x7f0000000300)={0x79, 0x0, 0x18}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_CAP_HYPERV_SYNIC(r3, 0x4068aea3, &(0x7f0000000380)) (async) ioctl$KVM_CAP_HYPERV_SYNIC(r3, 0x4068aea3, &(0x7f0000000380)) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000640)={0x2, 0x0, [{0x400000b0, 0x0, 0x10001}, {0x400000b1, 0x0, 0x10000005}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000840)='./proc/thread-self/fail-nth\x00', 0xc8002, 0xe8) (async) openat(0xffffffffffffff9c, &(0x7f0000000840)='./proc/thread-self/fail-nth\x00', 0xc8002, 0xe8) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r4, 0x0, 0x2a, &(0x7f0000000000)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) (async) setsockopt$inet_MCAST_JOIN_GROUP(r4, 0x0, 0x2a, &(0x7f0000000000)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r4, 0x0, 0x30, &(0x7f00000000c0)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000002"], 0x110) setsockopt$inet_group_source_req(r4, 0x0, 0x2c, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}, {{0x2, 0x4e20, @empty}}}, 0x108) setsockopt$inet_group_source_req(r4, 0x0, 0x2c, &(0x7f0000000500)={0x4002, {{0x2, 0x5e24, @multicast2}}, {{0x2, 0x4e22, @private=0xa010102}}}, 0x108) inotify_init1(0x0) (async) r5 = inotify_init1(0x0) inotify_add_watch(r5, &(0x7f0000000680)='.\x00', 0xaa) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000006c0)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000006c0)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) gettid() (async) r7 = gettid() wait4(0x0, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f0000000700)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000000740)) timer_settime(0x0, 0x0, &(0x7f00000008c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) (async) timer_settime(0x0, 0x0, &(0x7f00000008c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x7fffffe, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) dup3(r5, r6, 0x0) 1.324994244s ago: executing program 3 (id=146): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000180)={'syztnl0\x00', &(0x7f0000000100)={'ip6tnl0\x00', 0x0, 0x4, 0x3, 0x6, 0x8, 0x12, @private0={0xfc, 0x0, '\x00', 0x1}, @loopback, 0xc0, 0x8, 0x8001, 0x7f}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000200)={'gre0\x00', &(0x7f00000001c0)={'sit0\x00', 0x0, 0x8000, 0x700, 0x8001, 0x5b63, {{0x6, 0x4, 0x0, 0x6, 0x18, 0x68, 0x0, 0x40, 0x29, 0x0, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@end]}}}}}) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wg0\x00', 0x0}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000280)={0x0, @local, @initdev}, &(0x7f00000002c0)=0xc) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000400)={'sit0\x00', &(0x7f0000000300)={'sit0\x00', 0x0, 0x7800, 0x1, 0xd, 0x6, {{0x2a, 0x4, 0x3, 0x7, 0xa8, 0x65, 0x0, 0x0, 0x29, 0x0, @loopback, @multicast2, {[@rr={0x7, 0x7, 0x3f, [@remote]}, @end, @ssrr={0x89, 0x2b, 0x89, [@loopback, @empty, @remote, @private=0xa010100, @local, @private=0xa010100, @multicast1, @remote, @dev={0xac, 0x14, 0x14, 0x9}, @multicast2]}, @lsrr={0x83, 0x17, 0x82, [@empty, @remote, @empty, @rand_addr=0x64010101, @rand_addr=0x64010100]}, @timestamp_addr={0x44, 0xc, 0xa4, 0x1, 0x4, [{@local, 0x9}]}, @lsrr={0x83, 0x13, 0xfb, [@local, @local, @rand_addr=0x64010101, @broadcast]}, @noop, @lsrr={0x83, 0x1b, 0x28, [@loopback, @rand_addr=0x64010102, @dev={0xac, 0x14, 0x14, 0x2e}, @rand_addr=0x64010101, @multicast2, @multicast1]}, @timestamp_prespec={0x44, 0xc, 0xf7, 0x3, 0x2, [{@multicast1, 0xafd00000}]}]}}}}}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_GET(r0, &(0x7f0000000980)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000940)={&(0x7f0000000480)={0x4bc, r1, 0x800, 0x70bd25, 0x25dfdbfe, {}, [{{0x8, 0x1, r2}, {0x84, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}]}}, {{0x8}, {0x218, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x74}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r3}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x100}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r4}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x8}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x2, 0x8, 0x7e, 0x8000000}]}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}]}}, {{0x8, 0x1, r5}, {0x1a8, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r6}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r7}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x1a}}}, {0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x8001}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}]}}, {{0x8, 0x1, r9}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}]}}]}, 0x4bc}, 0x1, 0x0, 0x0, 0x1}, 0x4000080) unlinkat$binderfs_device(0xffffffffffffff9c, &(0x7f00000009c0)='./binderfs/custom1\x00') r10 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000a00)) recvfrom(r10, &(0x7f0000000a40)=""/4096, 0x1000, 0x40000000, 0x0, 0x0) r11 = accept$packet(r10, &(0x7f0000001a40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000001a80)=0x14) sendto$packet(r11, &(0x7f0000001ac0)="aea977a3eddcc709bf8617d4557b489dfe91b2fcabfff3457d89230f9d2fe7de2c4e14dbf719cd416695438931c29227f163fef4ae5e645356", 0x39, 0x200000c0, &(0x7f0000001b00)={0x11, 0xc, r3, 0x1, 0x2, 0x6, @local}, 0x14) r12 = syz_open_dev$tty1(0xc, 0x4, 0x1) r13 = ioctl$TIOCGPTPEER(r12, 0x5441, 0x169b) ioctl$TIOCL_SETSEL(r13, 0x541c, &(0x7f0000001b40)={0x2, {0x2, 0x7f, 0x3ff, 0xfff, 0x5, 0x1}}) r14 = accept4$nfc_llcp(r10, &(0x7f0000001b80), &(0x7f0000001c00)=0x60, 0x0) ioctl$SIOCGSTAMPNS(r14, 0x8907, &(0x7f0000001c40)) r15 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001cc0), r0) sendmsg$TIPC_NL_BEARER_ADD(r0, &(0x7f0000001d80)={&(0x7f0000001c80)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000001d40)={&(0x7f0000001d00)={0x28, r15, 0x200, 0x70bd27, 0x25dfdbff, {}, [@TIPC_NLA_MON={0x14, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xffffc36a}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x2400c0d0}, 0x4000801) ioctl$sock_inet_tcp_SIOCINQ(r10, 0x541b, &(0x7f0000001dc0)) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f0000001e00)={0x2, 0x101, 0x1}) ioctl$GIO_CMAP(r13, 0x4b70, &(0x7f0000001e40)) r16 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000001e80), 0x660c42, 0x0) ioctl$PTP_PEROUT_REQUEST2(r16, 0x40383d0c, &(0x7f0000001ec0)={{0x6, 0xfffffffb}, {0x7, 0x745c388}, 0x3, 0x1}) ioctl$ifreq_SIOCGIFINDEX_vcan(r14, 0x8933, &(0x7f0000001f00)={'vcan0\x00'}) sendmsg$NL80211_CMD_STOP_NAN(r10, &(0x7f0000002080)={&(0x7f0000001f40)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000002040)={&(0x7f0000002000)={0x28, 0x0, 0x7574dbab9b4c307f, 0x70bd26, 0x25dfdbfb, {{}, {@val={0x8}, @val={0xc, 0x99, {0x4, 0x1}}}}, ["", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x10) 1.321636744s ago: executing program 3 (id=147): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) fcntl$setlease(r0, 0x400, 0x0) 1.318074215s ago: executing program 3 (id=148): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') r0 = open(&(0x7f0000000040)='./bus\x00', 0x4ca7e, 0x10) fallocate(r0, 0x0, 0x0, 0x7) read$FUSE(r0, &(0x7f0000001640)={0x2020}, 0x2020) 1.245129562s ago: executing program 3 (id=149): getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x6bf1c2d5adba8d32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000080)={'netpci0\x00', 0xde3b71a2e5451db5}) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x480400, 0x0) write$tun(r3, &(0x7f0000000100)=ANY=[], 0x1e6) memfd_create(&(0x7f0000000140)='-& {-\xaa]{\x00\\Hp\xac\x99\xcc\xb08\xfb\xc0\xcd\x0f\xec{{\x84w\xcc\xea\x91\xd9>R\xda^a5\xf6[g_\x99w\xda\xab\xe6\xa3\xc2\xfe\x05\xaeeq\x7f\xd1\xfcX\xd0O\xb9\xeb&\xed\xd2\x1a!\xbd?\x1a4\xa1\a\xce\xb5\xcb\xfdl\x97\xb92!z\xb1\xe3\x1f\x9b\ryp\xc0r\xea\xe5\xba\x9c`\xdf\x04\x13t\xe3{\xd2\xeb\xf3\xbe\x9e\x1a@\x9avo\xea\r\x00\x00\x00\xd2', 0x2) 1.179028549s ago: executing program 1 (id=150): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f00000001c0)='cgroup.max.descendants\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000200)=ANY=[@ANYBLOB='-', @ANYRESHEX=r1], 0x27) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r2, 0x40104d04, &(0x7f0000000140)="4ba6") setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xc, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180), 0x200002, 0x0) (async) openat$cgroup_int(r0, &(0x7f00000001c0)='cgroup.max.descendants\x00', 0x2, 0x0) (async) write$cgroup_subtree(r1, &(0x7f0000000200)=ANY=[@ANYBLOB='-', @ANYRESHEX=r1], 0x27) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) (async) ioctl(r2, 0x40104d04, &(0x7f0000000140)="4ba6") (async) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xc, 0x0, 0x0) (async) 977.27049ms ago: executing program 1 (id=151): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_GET_MSRS_cpu(r3, 0xc008ae88, &(0x7f0000000040)={0x1, 0x0, [{0x40000023, 0x0, 0x1}]}) write$uinput_user_dev(r0, &(0x7f00000005c0)={'syz0\x00', {}, 0x0, [0x80000000, 0x3, 0x3fc, 0x7, 0xfffffffd, 0x0, 0x4000004, 0x5, 0x0, 0x0, 0x0, 0x3, 0x9, 0x0, 0x0, 0x0, 0x0, 0x401, 0x9, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x4, 0x0, 0x0, 0x40, 0x0, 0xf5b1, 0xffffffff, 0x10000000, 0x9, 0x20000000, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffe, 0x0, 0x0, 0x1, 0x7], [0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xedc0, 0x2000002, 0x5ee, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa0000000, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x9, 0x2, 0x0, 0xfffffff8, 0x2, 0x0, 0x5, 0x400, 0x0, 0x0, 0x90000, 0x40000, 0x7, 0xc0800000, 0x0, 0x10000, 0x0, 0xe1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x81, 0x0, 0x40, 0x0, 0xffffffff, 0x0, 0x0, 0x4771, 0x4, 0x0, 0x3], [0x0, 0x7f, 0x0, 0x0, 0x3, 0x0, 0x0, 0xfffffffc, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff65, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x2, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x6, 0x0, 0x0, 0x2, 0x0, 0x200000, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0xfffffffc, 0x4], [0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xfffffffe, 0x8, 0x0, 0x0, 0x0, 0x3, 0xfffffffc, 0x4, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x22, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x10, 0x5, 0xfffffffd, 0x0, 0x0, 0x0, 0x8001, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8ec5, 0x0, 0x8000000, 0x4, 0x0, 0x0, 0x0, 0xffffe]}, 0x45c) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, &(0x7f0000000080)) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) mmap$KVM_DIRTY_RING(&(0x7f0000ffb000/0x4000)=nil, 0x11000, 0x0, 0x10010, r4, 0x40000) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000080)=[@text16={0x10, 0x0}], 0x1, 0x4c, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCSPGRP(r5, 0x8902, &(0x7f00000000c0)) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, 0x0, 0x0) prctl$PR_MCE_KILL(0x35, 0x0, 0x8) prctl$PR_MCE_KILL(0x35, 0x0, 0x10) r6 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000100)={0x0, &(0x7f0000000140)=[@rdmsr={0x66, 0x18, {0x398}}], 0x18}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000180)={[0x800000001, 0xef, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffffff, 0x80, 0x1, 0x3168f216, 0x5, 0x3, 0x5, 0x3], 0x1ff8, 0x8144}) mmap$KVM_DIRTY_RING(&(0x7f0000ff2000/0x2000)=nil, 0x20000, 0x1000000, 0x12, r6, 0x40000) ioctl$UI_DEV_CREATE(r0, 0x5501) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x33ed0000) write$uinput_user_dev(r0, &(0x7f00000012c0)={'syz0\x00', {0xf, 0x7, 0x6, 0x8}, 0x46, [0x6, 0x3, 0x8, 0x7, 0x3, 0x8, 0x5, 0x2, 0x1ff, 0x704e, 0x5, 0x2, 0x1, 0x4, 0x7fffffff, 0xc, 0x280, 0x7, 0x4, 0xbf6, 0x6, 0xfff, 0x0, 0x80000005, 0x2, 0x4ebe, 0x3, 0x2, 0x3, 0xfff, 0x9, 0x2, 0x8, 0x5, 0x9, 0x0, 0x1, 0x400, 0x0, 0x8, 0x6, 0x1, 0x3, 0x2, 0x3, 0x80, 0x4, 0x40, 0xe, 0xffff, 0x3ca5, 0x81, 0xfffff68e, 0x6, 0x2, 0x10, 0x8001, 0x3, 0x9, 0x4, 0x6, 0xfffffffe, 0xe, 0x3ff], [0x103, 0x3817a07c, 0xfffffffd, 0x2d, 0xd7, 0x2, 0x435f58e4, 0x4, 0x1b9e, 0x0, 0x1, 0x1, 0x4, 0x7, 0x4, 0x80, 0x0, 0x8, 0x4, 0x3, 0x10, 0x1, 0x77, 0x100, 0x0, 0x7f, 0x6, 0x6, 0x0, 0x7f, 0x49, 0x4, 0x9, 0x80000000, 0xd, 0x64, 0x2, 0xe2, 0x0, 0x3, 0x9, 0x6, 0x2, 0x5, 0x0, 0x1b, 0xaea0, 0xb, 0x9d, 0xefcc, 0x2, 0x81, 0x6, 0x4, 0x2, 0x2, 0x0, 0x7f, 0x10, 0xff, 0x2, 0x31d, 0xe, 0x7], [0x8000, 0x1, 0x0, 0xb, 0x10001, 0x5, 0x6c5e, 0xc01, 0x7, 0xb44, 0x1000, 0xc5d3dd53, 0x9, 0x4, 0x3a, 0x3, 0x80000000, 0x5, 0xa5ff, 0x1, 0x9, 0x0, 0x1, 0x80, 0x0, 0x1, 0xfffff564, 0x4, 0x9, 0x5, 0x5, 0x2, 0x3, 0x8, 0x5, 0xd, 0x6, 0x3ff, 0x3, 0x2, 0x1a, 0x5a, 0x7, 0x400, 0x380000, 0x1, 0x9, 0x3, 0x4, 0xa, 0xfffffffd, 0x5, 0xfffffff7, 0x4, 0x0, 0x1, 0xffffff00, 0x6, 0x2, 0xde2, 0x6, 0x7, 0xb7a, 0x4], [0x3ff, 0x4, 0x1, 0x5, 0x7ff, 0xfffffffa, 0x3, 0xfb, 0x2, 0x0, 0x7, 0x8, 0x7, 0x8, 0xf, 0x6, 0x5, 0x329d, 0x49, 0x78079c2a, 0x0, 0x3, 0x5, 0x600, 0x7, 0xbfd2, 0x3, 0x4, 0xffffff7f, 0x0, 0xe, 0x9, 0x6, 0xfffffff2, 0xf, 0x10001, 0xb, 0x2, 0x9, 0x5, 0x8, 0xd195, 0x5, 0xba, 0x10000, 0x8, 0x689a, 0xffff, 0x9, 0x6, 0x51, 0x4, 0xa, 0x9, 0xd9, 0x5, 0x9, 0x2, 0xd, 0x800005, 0x7, 0x2, 0xff, 0x4]}, 0x45c) 681.73832ms ago: executing program 3 (id=152): capset(&(0x7f0000000340)={0x20080522}, &(0x7f00000003c0)={0x200000, 0x200000, 0x7}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/sda\x00', 0x101042, 0x5) keyctl$set_reqkey_keyring(0xe, 0x4) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='task\x00') lseek(r1, 0x100040000c, 0x2) ioctl$FIBMAP(r0, 0x5393, &(0x7f0000000040)=0x2b) 664.935562ms ago: executing program 3 (id=153): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="1201000000000040c41090ea80000000000109022400010000000009040000010300000009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000280)={0x2c, &(0x7f00000002c0)=ANY=[@ANYBLOB="ad5a97"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="200103"], 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) readv(0xffffffffffffffff, &(0x7f0000001080)=[{&(0x7f00000010c0)=""/35, 0x23}], 0x1) syz_usb_control_io(r0, &(0x7f0000000980)={0x2c, &(0x7f00000006c0)={0x20, 0x23, 0xa8, {0xa8, 0x11, "8be2deaf2748596ab96c7d5b63fa6aaf065f4ad2b9634df3f85968bef22b5c819f990ba663408161ebdbb11517340c2bfed63df978c835a3d7e9900cb36f069a0ec025ece07ac51005936348c3d2483a1625fe6a6a146ba34efff1300936da95d23cd44c48d8d640df0b16a0c6ffba0f5d0d1e28e6db0e17fec0a0c11112b0d6f4121340c2cde2c188a144ba15f1a65f09ef5cfeeb703ba38ab3be65c30541969809813e2cb2"}}, &(0x7f0000000780)={0x0, 0x3, 0xd5, @string={0xd5, 0x3, "f398a7f50c7c87102ab1ba921303049991e946db5354fc11fe27dd182dda3ab45e867fd585a7768eec4205bda5da3e989bee6e31e2d93fe34803a27ea4e3e94acf00c7be06e91ff8d5a34b7f0ed1edc4f2ed20e7faff9b3b4df372e39f125fac5d68b358dcd7b3c345245cdf632df1e77087c8a8a7b352600d45181141fde1a049098b9d2dd0a0412994db3dfa886268de5dead74ebe5d397635059dadc037d7e97f984a721ab499478ac54627a36d69ba75e6b959fc1c87a40aff7298c22e221bb4ffb3757e1fc75c8ba0d77107deedce1522"}}, &(0x7f0000000880)={0x0, 0xf, 0x52, {0x5, 0xf, 0x52, 0x5, [@ext_cap={0x7, 0x10, 0x2, 0x14, 0x0, 0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x93, "19dab0a400438af2334f830bccd9bfb1"}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x6, 0xe2, 0x4, 0xd9a}, @ssp_cap={0x14, 0x10, 0xa, 0x4c, 0x2, 0x8, 0xf, 0x0, [0xc0, 0x1b0]}, @ss_container_id={0x14, 0x10, 0x4, 0xc, "dbc635d9736054d9045ef3e41e5435eb"}]}}, &(0x7f0000000900)={0x20, 0x29, 0xf, {0xf, 0x29, 0x6, 0x60, 0x1, 0x14, "546eb50f", "7b4f02d5"}}, &(0x7f0000000940)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x9, 0x2, 0x4, 0x8, 0xb, 0x7000, 0xff}}}, &(0x7f0000000e80)={0x84, &(0x7f00000009c0)={0x8c72b0c193794dd7, 0x8, 0xc6, "4db9f30403214eb9775177123bca260add6432b339069a040102e6e2c165f180b7197f22dacb2c1e0cef8445c510a49189e36458bae662acfb851115120575d245fe83551fb6094979d8832c4cfa774c6ae6cadbc996080cead9809b69b6f97cf8274d19a1c88f2665e700dc8f2a6ab588c5746ca6d980e568b552eecde0b5555bebc461bfcde824ff0e379cc660d3be9175581f204eb4a9d5165c1ac23782102504d5ee2bed5bad702ee4d4fa40f86cc315f6d4076ced32c1ee06571133b45855164a4fc994"}, &(0x7f0000000ac0)={0x0, 0xa, 0x1}, &(0x7f0000000b00)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000b40)={0x20, 0x0, 0x4, {0x3, 0x1}}, &(0x7f0000000b80)={0x20, 0x0, 0x8, {0x100, 0x10, [0xf]}}, &(0x7f0000000bc0)={0x40, 0x7, 0x2, 0x8}, &(0x7f0000000c00)={0x40, 0x9, 0x1, 0x6}, &(0x7f0000000c40)={0x40, 0xb, 0x2, "4b83"}, &(0x7f0000000c80)={0x40, 0xf, 0x2, 0x1}, &(0x7f0000000cc0)={0x40, 0x13, 0x6}, &(0x7f0000000d00)={0x40, 0x17, 0x6, @multicast}, &(0x7f0000000d40)={0x40, 0x19, 0x2, "9425"}, &(0x7f0000000d80)={0x40, 0x1a, 0x2, 0xb6}, &(0x7f0000000dc0)={0x40, 0x1c, 0x1, 0x5b}, &(0x7f0000000e00)={0x40, 0x1e, 0x1, 0x5}, &(0x7f0000000e40)={0x40, 0x21, 0x1, 0x9}}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000200)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) 524.033966ms ago: executing program 1 (id=154): syz_usb_connect$uac3(0x0, 0x8c, &(0x7f0000000080)=ANY=[@ANYBLOB="12011001000000408205250040000102030109027a0003017fa006080b0002012030230904000000010130000a24011016000a0000000c240b80007f00000008a3000904010000010230000904010101010230000905010960002503020a2525010400f70405000904020000010230000904020101010230000905820900027309c00a2525ffffff7fffdd0b"], 0x0) (async) syz_usb_connect$uac3(0x0, 0x8c, &(0x7f0000000080)=ANY=[@ANYBLOB="12011001000000408205250040000102030109027a0003017fa006080b0002012030230904000000010130000a24011016000a0000000c240b80007f00000008a3000904010000010230000904010101010230000905010960002503020a2525010400f70405000904020000010230000904020101010230000905820900027309c00a2525ffffff7fffdd0b"], 0x0) syz_usb_connect(0x0, 0x42b, &(0x7f0000000140)={{0x12, 0x1, 0x201, 0xf, 0x49, 0xa, 0x28, 0xafa, 0x3e8, 0x95be, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x419, 0x4, 0x5, 0x7, 0x0, 0xdd, "", [{{0x9, 0x4, 0x84, 0x2, 0x6, 0x3a, 0x45, 0x0, 0x8, [@cdc_ecm={{0x5}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0xfffffff7, 0x7da4, 0x10, 0xfe}}], [{{0x9, 0x5, 0x9, 0x1, 0x40, 0x81, 0x9, 0x2}}, {{0x9, 0x5, 0x1, 0xd1cfe3f8507dc263, 0x3ff, 0x1, 0x6, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x7, 0x9}]}}, {{0x9, 0x5, 0xe, 0x3, 0x3ff, 0x81, 0x5, 0xa9, [@generic={0x5b, 0x30, "5ee564e54acc78f1ffdadf23c7ceb9ea51b3173ab03eb674fc19fd7e0224d38b8e172d455e66d40b8a374286670281edcd9d130e6eb31ed972f9a47f2bedd0d8b83d54fa9dd18a4aaec581a9d9fe5bda0bac0e9a2a405d37dc"}]}}, {{0x9, 0x5, 0x9, 0x0, 0x200, 0x7, 0x1, 0x6, [@generic={0x57, 0x8, "6b049f1cc68662ebcbd1cffe35b95ed0851ae2519b2d1d0a9c375a359f06e98080d67902aec1f5a11664de51ec7ce5992178b5cb771f73a1e10f7cd1826ab0c2fab63700973d7c13bea57897f499803f0af25736c1"}, @generic={0x29, 0xc, "68d8e491f1eb3410de6e69b368f47c70e137f0c5cf9169fab6519326009890beae1e5c331fc9bc"}]}}, {{0x9, 0x5, 0x5, 0xc, 0x8, 0x2, 0x7, 0xb, [@generic={0x7b, 0x11, "9a6a9dee45ece11859368bc783e03560afb2d0fb38d8bc5afe300d364b3bd29d2fa717d0903ae0bd1d03c5683f2a2a7102405533dfaf94b062c4570426b3372b25078fa00b3074c1c1f0081886548b2e1e13e8181b75b0f9d30d058a2379a2301b2c3bf80556f10de09e173bf94fa36cd6faf6dcd915bfe99b"}, @uac_iso={0x7, 0x25, 0x1, 0x8, 0x3, 0x4}]}}, {{0x9, 0x5, 0x5, 0x0, 0x400, 0xe, 0x1, 0x33}}]}}, {{0x9, 0x4, 0x78, 0x0, 0x2, 0xc3, 0x2b, 0x6e, 0x5, [@uac_as={[@format_type_ii_discrete={0xa, 0x24, 0x2, 0x2, 0x4, 0x7, 0xd, '='}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x8, 0xff, 0x7, 0x8a}, @format_type_ii_discrete={0xf, 0x24, 0x2, 0x2, 0x5b2, 0x6, 0x8, "40d49f9607fa"}]}, @generic={0xb0, 0x9, "23bc76d8f7628aebf35cf49706ed120d6b37b9b168edfdacce4de9f1dc0574d4eb99b4211728d677b6f9bac5d10e0c611a72e815d5acf68852e1764938c7be880fd6e78a22acd0ae6e90858b25bd1005ea425fb8cd57802d8ebe3ff32ceb12e3a25b64724eec2600e73c5974080c11473f43299bef16dfc8ebb260ca050cd207e1c1d098c86623c4846a455c6e1011c0d4a4e6b8e66651ef0affea3d40b88f1c545f3edf7a72436d2b267a9398bb"}], [{{0x9, 0x5, 0xa, 0x3, 0x8, 0x4, 0x7, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x5, 0x1}, @generic={0xa, 0x0, "2f1354fccaf58e5e"}]}}, {{0x9, 0x5, 0x80, 0x8, 0x0, 0x4, 0xe, 0x8, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x1, 0x8001}, @uac_iso={0x7, 0x25, 0x1, 0x4, 0x9, 0xaeaa}]}}]}}, {{0x9, 0x4, 0xe4, 0x8, 0x7, 0x30, 0x1, 0xf5, 0x6, [@hid_hid={0x9, 0x21, 0xa, 0x7, 0x1, {0x22, 0x30e}}], [{{0x9, 0x5, 0x7, 0x3, 0x20, 0x6, 0x1, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x91, 0x9}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0x1b, 0x6}]}}, {{0x9, 0x5, 0xe, 0x0, 0x8, 0x10, 0x0, 0x4a}}, {{0x9, 0x5, 0x8, 0x0, 0x40, 0xf2, 0xd, 0x69, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x4, 0x200}]}}, {{0x9, 0x5, 0x8, 0xc, 0x10, 0x3, 0x7, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x8, 0x5}]}}, {{0x9, 0x5, 0xb, 0x4, 0x10, 0x6, 0x78, 0x81}}, {{0x9, 0x5, 0x6, 0x10, 0x0, 0x5, 0x8b, 0x4, [@generic={0x72, 0x0, "fe549e8a179b336a89b1469643c8682916fc5028d1adb82345410347b28545f7337476d0adfcde7dca57b89a3f084f5906483bfb6607e570b6260deae10c0c47764388819f5f7ab9dd1b9fcda4f9215ffc30a622b2497e5c38b08fc8b84619f2ac39b048256965abd4e8069227327f45"}]}}, {{0x9, 0x5, 0xf, 0x3, 0x0, 0x8, 0x0, 0xff, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0x0, 0xfff9}, @uac_iso={0x7, 0x25, 0x1, 0x8, 0x7, 0xc67}]}}]}}, {{0x9, 0x4, 0xf7, 0x4, 0x0, 0xff, 0x4, 0x61, 0x4, [@uac_control={{0xa, 0x24, 0x1, 0x600, 0x16}, [@input_terminal={0xc, 0x24, 0x2, 0x1, 0x405, 0x6, 0x1, 0x0, 0x3, 0x2}]}, @uac_control={{0xa, 0x24, 0x1, 0x5, 0x3d}, [@input_terminal={0xc, 0x24, 0x2, 0x2, 0x403, 0x4, 0xfd, 0x182, 0x0, 0x8}, @output_terminal={0x9, 0x24, 0x3, 0x4, 0x303, 0x5, 0x4, 0x3}, @extension_unit={0x8, 0x24, 0x8, 0x4, 0x5, 0x4, '_'}, @processing_unit={0xd, 0x24, 0x7, 0x6, 0x0, 0x5, "afa5086ffff1"}, @output_terminal={0x9, 0x24, 0x3, 0x1, 0x404, 0x2, 0x6, 0x3}]}]}}]}}]}}, &(0x7f0000000a80)={0xa, &(0x7f0000000580)={0xa, 0x6, 0x110, 0x3, 0x1, 0xff, 0x48}, 0x47, &(0x7f00000005c0)={0x5, 0xf, 0x47, 0x3, [@ssp_cap={0x18, 0x10, 0xa, 0x1, 0x3, 0x7, 0x0, 0x2, [0x30, 0x0, 0x0]}, @ssp_cap={0x20, 0x10, 0xa, 0x9, 0x5, 0x0, 0xf0f, 0x9, [0x30, 0x3fc0, 0xffc0, 0x0, 0xff0000]}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x3, 0x7f, 0x2, 0xffe}]}, 0xa, [{0x4, &(0x7f0000000640)=@lang_id={0x4, 0x3, 0x2c01}}, {0x4, &(0x7f0000000680)=@lang_id={0x4, 0x3, 0xc1a}}, {0x4, &(0x7f00000006c0)=@lang_id={0x4, 0x3, 0x445}}, {0x4, &(0x7f0000000740)=@lang_id={0x4, 0x3, 0x44a}}, {0xc8, &(0x7f0000000780)=@string={0xc8, 0x3, "95132c3d1b1f44d428bfe9846f73ddb62a665685ad0e4582084bb128040dc8727e35f652ebabc541ac972378a6447221d494a06798c2bbbb3e8d6d1429ecb0a50790965b17b826b5cb56737e96608858a3ff3d2b9ca0961df6a5cf4bd82e45e5ac28b82bfaea881814f164d496ee4745a30485c3fb42e838e3fe2cfd8db8045dd78d8ec84c55d115fb27ca1bfab6ac98d40aeaf5e5b93f75510298c1dec29948866fbef72537d488fe7cb31210d3ea2ac2cbd9bf24bbc328f73ecd006b38fce5dba2e87cd094"}}, {0xf7, &(0x7f0000000880)=@string={0xf7, 0x3, "27ab25184a9c680ee25724afca41cb79902714af688b5d5ed69ae648587b8d02763520dc895e6703dc4af0420642cb1d2f0c315160c9f243efc7485613cfd87f3889d9e788c97a3eb7a3b43b3c4b5eece8f45c9dd17af04684bcf69a9ebb4cb2add93bb9d62fb98d4a71da01e65135a816380fe0864dbcb0b9b64aed38b29d464f9333c790e3c60010707fdbf0e3eafbd46c003b095619ac83616886c40f534f648d5288ff9a912015d3f0a252070896548985cbe209fd22490778351955584a0bea03b8e26aece0230ebd616d79ab06d5a28a2f7aee9335586cbe5cc185faa3a964fc08b2f33d81a5ccf3c1ccf29b75424529be1d"}}, {0x3d, &(0x7f0000000980)=@string={0x3d, 0x3, "300750f3a57e2f085e53f7188fd3e326ae67f56a5549647b627694b4e14221653b1995d6f87df02659e9b8e54f05147ec54d568772e7ae7157ae85"}}, {0x4, &(0x7f00000009c0)=@lang_id={0x4, 0x3, 0x413}}, {0x4, &(0x7f0000000a00)=@lang_id={0x4, 0x3, 0x430}}, {0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0x2801}}]}) 41.005005ms ago: executing program 2 (id=155): r0 = socket(0x11, 0x3, 0x0) setsockopt(r0, 0x107, 0xf, &(0x7f0000000b00)="00008634", 0x4) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)={0x198, r4, 0x1, 0x70bd28, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_STRINGSETS={0x180, 0x2, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}]}, {0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}]}, {0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}]}, {0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0xa}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}]}, {0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}]}, {0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}]}, {0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x9}, @ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}]}]}, @ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x198}, 0x1, 0x0, 0x0, 0x881}, 0x24004000) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000040)={@private0, 0x7e, r2}) r5 = socket$inet6_udp(0xa, 0x2, 0x0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r7 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r7, &(0x7f0000000100)={0x2, 0x4e22, @empty}, 0x10) listen(r7, 0x2400000) mount$9p_tcp(&(0x7f0000000140), &(0x7f0000000180)='.\x00', &(0x7f00000001c0), 0x8010, &(0x7f0000000200)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000404e22']) close_range(r6, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000b40)={'bridge0\x00', 0x0}) sendmsg(r0, &(0x7f0000000b80)={&(0x7f0000000bc0)=@xdp={0x2c, 0x8, r8, 0x6}, 0x80, &(0x7f0000000c40)=[{&(0x7f0000000c80)="000302000b00000000002d3922ff65b4355e953d23d254f0", 0x18}, {&(0x7f0000000cc0)="60a75dc565ef116aa412580445034943beea59cdd8a174caf38d7adc18f6b256e8be00", 0x23}, {&(0x7f0000000d00)="f861eab0bb1a8d0d1154d54ece", 0xd}], 0x3}, 0x40011) 12.351808ms ago: executing program 2 (id=156): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prlimit64(0x0, 0xe, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./trace\x00', &(0x7f0000000380)='tracefs\x00', 0x0, 0x0) r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) getsockopt$bt_rfcomm_RFCOMM_LM(r0, 0x12, 0x3, &(0x7f0000000000), &(0x7f0000000040)=0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./trace/events/dwc3/dwc3_ctrl_req/inject\x00', 0x2, 0x0) write(r1, 0x0, 0x0) 0s ago: executing program 2 (id=157): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.57' (ED25519) to the list of known hosts. [ 21.483854][ T36] audit: type=1400 audit(1794600974.939:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.506841][ T36] audit: type=1400 audit(1794600974.969:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.507835][ T286] cgroup: Unknown subsys name 'net' [ 21.534627][ T36] audit: type=1400 audit(1794600974.989:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.534759][ T286] cgroup: Unknown subsys name 'devices' [ 21.641392][ T286] cgroup: Unknown subsys name 'hugetlb' [ 21.647008][ T286] cgroup: Unknown subsys name 'rlimit' [ 21.799468][ T36] audit: type=1400 audit(1794600975.259:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.822676][ T36] audit: type=1400 audit(1794600975.259:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 21.836280][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 21.847536][ T36] audit: type=1400 audit(1794600975.259:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.879042][ T36] audit: type=1400 audit(1794600975.319:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.880099][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.904430][ T36] audit: type=1400 audit(1794600975.319:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.938682][ T36] audit: type=1400 audit(1794600975.329:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.964468][ T36] audit: type=1400 audit(1794600975.329:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.294725][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.302113][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.309256][ T294] bridge_slave_0: entered allmulticast mode [ 23.315513][ T294] bridge_slave_0: entered promiscuous mode [ 23.324657][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.331719][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.338770][ T294] bridge_slave_1: entered allmulticast mode [ 23.345103][ T294] bridge_slave_1: entered promiscuous mode [ 23.392618][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.399714][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.406768][ T293] bridge_slave_0: entered allmulticast mode [ 23.413108][ T293] bridge_slave_0: entered promiscuous mode [ 23.419515][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.426540][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.433741][ T293] bridge_slave_1: entered allmulticast mode [ 23.439943][ T293] bridge_slave_1: entered promiscuous mode [ 23.445925][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.453008][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.460096][ T295] bridge_slave_0: entered allmulticast mode [ 23.466212][ T295] bridge_slave_0: entered promiscuous mode [ 23.482617][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.489686][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.496858][ T295] bridge_slave_1: entered allmulticast mode [ 23.503105][ T295] bridge_slave_1: entered promiscuous mode [ 23.554559][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.561717][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.568763][ T296] bridge_slave_0: entered allmulticast mode [ 23.575077][ T296] bridge_slave_0: entered promiscuous mode [ 23.581517][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.588545][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.595654][ T296] bridge_slave_1: entered allmulticast mode [ 23.601825][ T296] bridge_slave_1: entered promiscuous mode [ 23.691710][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.698751][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.706062][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.713175][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.721664][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.728713][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.735998][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.743021][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.754848][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.761893][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.769132][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.776174][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.814664][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.821965][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.829150][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.836489][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.843847][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.851150][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.871483][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.878530][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.886129][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.893159][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.913541][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.920588][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.937371][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.944432][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.967078][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.974166][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.982070][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.989122][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.996759][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.003806][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.011937][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.018968][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.046668][ T294] veth0_vlan: entered promiscuous mode [ 24.076725][ T295] veth0_vlan: entered promiscuous mode [ 24.082952][ T293] veth0_vlan: entered promiscuous mode [ 24.093728][ T294] veth1_macvtap: entered promiscuous mode [ 24.106954][ T296] veth0_vlan: entered promiscuous mode [ 24.120828][ T295] veth1_macvtap: entered promiscuous mode [ 24.144846][ T296] veth1_macvtap: entered promiscuous mode [ 24.153588][ T293] veth1_macvtap: entered promiscuous mode [ 24.176372][ T294] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 24.217899][ T315] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 24.220656][ T312] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 24.281518][ T324] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3'. [ 24.387528][ T334] overlayfs: missing 'lowerdir' [ 24.394040][ T334] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6'. [ 24.394447][ T335] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=3835797286 (7671594572 ns) > initial count (4918772610 ns). Using initial count to start timer. [ 24.499268][ T10] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 24.559316][ T64] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 24.677280][ T10] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 24.687030][ T10] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 24.696907][ T10] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 24.710302][ T331] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 24.719099][ T10] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 24.728178][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 24.736266][ T10] usb 4-1: Product: syz [ 24.740671][ T10] usb 4-1: Manufacturer: syz [ 24.745412][ T10] usb 4-1: SerialNumber: syz [ 24.750244][ T64] usb 1-1: not running at top speed; connect to a high speed hub [ 24.758625][ T64] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 24.770230][ T64] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 24.780627][ T10] hub 4-1:1.0: bad descriptor, ignoring hub [ 24.786536][ T10] hub 4-1:1.0: probe with driver hub failed with error -5 [ 24.794123][ T64] usb 1-1: New USB device found, idVendor=0424, idProduct=5534, bcdDevice= 1.00 [ 24.803230][ T338] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 24.810953][ T64] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 24.822224][ T64] hub 1-1:1.0: USB hub found [ 24.889367][ T331] usb 2-1: Using ep0 maxpacket: 32 [ 24.895835][ T331] usb 2-1: unable to get BOS descriptor or descriptor too short [ 24.904246][ T331] usb 2-1: config 178 has an invalid interface number: 183 but max is 0 [ 24.912637][ T331] usb 2-1: config 178 contains an unexpected descriptor of type 0x2, skipping [ 24.921506][ T331] usb 2-1: config 178 has no interface number 0 [ 24.927760][ T331] usb 2-1: config 178 interface 183 altsetting 0 bulk endpoint 0xC has invalid maxpacket 1023 [ 24.939962][ T331] usb 2-1: New USB device found, idVendor=0582, idProduct=b7a6, bcdDevice=10.27 [ 24.949032][ T331] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 24.957237][ T331] usb 2-1: Product: syz [ 24.961579][ T331] usb 2-1: Manufacturer: syz [ 24.966176][ T331] usb 2-1: SerialNumber: syz [ 24.971764][ T337] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 24.980544][ T338] usb 3-1: unable to get BOS descriptor or descriptor too short [ 24.988941][ T10] usblp 4-1:1.0: usblp0: USB Unidirectional printer dev 2 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 25.000149][ T338] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 25.012771][ T338] usb 3-1: New USB device found, idVendor=200c, idProduct=100b, bcdDevice= 0.40 [ 25.023034][ T338] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.031554][ T338] usb 3-1: Product: syz [ 25.035805][ T338] usb 3-1: Manufacturer: syz [ 25.040735][ T338] usb 3-1: SerialNumber: syz [ 25.063341][ T64] hub 1-1:1.0: config failed, can't read hub descriptor (err -22) [ 25.100020][ T64] usb 1-1: USB disconnect, device number 2 [ 25.186433][ T331] usb 2-1: USB disconnect, device number 2 [ 25.195792][ T330] udevd[330]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:178.183/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 25.250213][ T310] usb 4-1: USB disconnect, device number 2 [ 25.253496][ T340] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 25.261595][ T310] usblp0: removed [ 25.268612][ T340] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 25.522244][ T338] usb 3-1: 1:1: cannot set freq 48000 to ep 0x1 [ 25.532097][ T338] usb 3-1: USB disconnect, device number 2 [ 25.570298][ T322] udevd[322]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 25.989374][ T331] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 26.009266][ T310] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 26.059667][ T338] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 26.140825][ T331] usb 2-1: unable to get BOS descriptor or descriptor too short [ 26.149176][ T331] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 64 [ 26.160304][ T331] usb 2-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 0.40 [ 26.160359][ T310] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 26.169461][ T331] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.180431][ T310] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 26.188945][ T331] usb 2-1: Product: syz [ 26.202386][ T331] usb 2-1: Manufacturer: syz [ 26.205298][ T310] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 26.207328][ T331] usb 2-1: SerialNumber: syz [ 26.221232][ T310] usb 1-1: New USB device found, idVendor=15c2, idProduct=2204, bcdDevice= 0.00 [ 26.230673][ T338] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 26.233641][ T310] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.245168][ T353] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 26.256921][ T310] usb 1-1: config 0 descriptor?? [ 26.259804][ T338] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 26.276819][ T338] usb 4-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 26.286218][ T338] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.295018][ T338] usb 4-1: config 0 descriptor?? [ 26.468072][ T310] usbhid 1-1:0.0: can't add hid device: -71 [ 26.477528][ T310] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 26.498736][ T36] kauditd_printk_skb: 65 callbacks suppressed [ 26.498753][ T36] audit: type=1400 audit(1794600979.949:139): avc: denied { read write } for pid=352 comm="syz.1.10" name="fuse" dev="devtmpfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 26.501239][ T310] usb 1-1: USB disconnect, device number 3 [ 26.510036][ T331] usb 2-1: MIDIStreaming interface descriptor not found [ 26.528468][ T36] audit: type=1400 audit(1794600979.949:140): avc: denied { open } for pid=352 comm="syz.1.10" path="/dev/fuse" dev="devtmpfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 26.563055][ T331] usb 2-1: USB disconnect, device number 3 [ 26.739950][ T369] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 26.750318][ T369] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 26.770723][ T36] audit: type=1400 audit(1794600980.229:141): avc: denied { mmap_zero } for pid=368 comm="syz.3.15" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 26.794145][ T369] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 26.809409][ T369] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 26.820645][ T338] usbhid 4-1:0.0: can't add hid device: -71 [ 26.826612][ T338] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 26.845456][ T338] usb 4-1: USB disconnect, device number 3 [ 26.980465][ T36] audit: type=1400 audit(1794600980.439:142): avc: denied { create } for pid=382 comm="syz.0.19" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 27.032977][ T385] FAULT_INJECTION: forcing a failure. [ 27.032977][ T385] name failslab, interval 1, probability 0, space 0, times 1 [ 27.045752][ T385] CPU: 1 UID: 0 PID: 385 Comm: syz.1.20 Not tainted syzkaller #0 5676c8b0feefcba4e903dddff460827408f065be [ 27.045784][ T385] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 27.045805][ T385] Call Trace: [ 27.045812][ T385] [ 27.045820][ T385] __dump_stack+0x21/0x30 [ 27.045846][ T385] dump_stack_lvl+0x140/0x1c0 [ 27.045865][ T385] ? __cfi_dump_stack_lvl+0x10/0x10 [ 27.045885][ T385] dump_stack+0x19/0x20 [ 27.045901][ T385] should_fail_ex+0x3c2/0x510 [ 27.045919][ T385] should_failslab+0xac/0x100 [ 27.045944][ T385] kmem_cache_alloc_lru_noprof+0x44/0x410 [ 27.045974][ T385] ? __d_alloc+0x42/0x8c0 [ 27.046002][ T385] ? __kasan_check_write+0x18/0x20 [ 27.046028][ T385] __d_alloc+0x42/0x8c0 [ 27.046053][ T385] d_alloc_parallel+0xe4/0x1370 [ 27.046070][ T385] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 27.046092][ T385] ? __wake_up+0x169/0x190 [ 27.046119][ T385] ? __d_add+0x636/0xac0 [ 27.046137][ T385] ? __cfi_d_alloc_parallel+0x10/0x10 [ 27.046164][ T385] ? avc_has_perm_noaudit+0x26b/0x360 [ 27.046187][ T385] ? __kasan_check_write+0x18/0x20 [ 27.046212][ T385] ? rwsem_read_trylock+0x275/0x5a0 [ 27.046236][ T385] __lookup_slow+0x150/0x420 [ 27.046257][ T385] ? lookup_one_len+0x300/0x300 [ 27.046277][ T385] ? down_read+0x7f/0xe0 [ 27.046301][ T385] ? __cfi_down_read+0x10/0x10 [ 27.046332][ T385] lookup_slow+0x57/0x80 [ 27.046351][ T385] walk_component+0x308/0x450 [ 27.046380][ T385] link_path_walk+0x723/0xeb0 [ 27.046410][ T385] path_openat+0x298/0x35a0 [ 27.046435][ T385] ? kasan_save_alloc_info+0x3a/0x50 [ 27.046460][ T385] ? __kasan_slab_alloc+0x73/0x90 [ 27.046481][ T385] ? getname+0x1b/0x30 [ 27.046498][ T385] ? x64_sys_call+0xe69/0x2ee0 [ 27.046526][ T385] ? do_syscall_64+0x57/0xf0 [ 27.046548][ T385] ? do_filp_open+0x440/0x440 [ 27.046572][ T385] do_filp_open+0x1f2/0x440 [ 27.046596][ T385] ? __cfi_do_filp_open+0x10/0x10 [ 27.046620][ T385] ? __cfi_kfree_link+0x10/0x10 [ 27.046645][ T385] ? alloc_fd+0x4c1/0x570 [ 27.046664][ T385] do_sys_openat2+0x134/0x1d0 [ 27.046688][ T385] ? do_sys_open+0x100/0x100 [ 27.046713][ T385] __x64_sys_openat+0x13a/0x170 [ 27.046736][ T385] x64_sys_call+0xe69/0x2ee0 [ 27.046756][ T385] do_syscall_64+0x57/0xf0 [ 27.046778][ T385] ? clear_bhb_loop+0x50/0xa0 [ 27.046803][ T385] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 27.046828][ T385] RIP: 0033:0x7f175d169d0e [ 27.046852][ T385] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 27.046868][ T385] RSP: 002b:00007f175e067ec8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 27.046894][ T385] RAX: ffffffffffffffda RBX: 00007f175e0686c0 RCX: 00007f175d169d0e [ 27.046909][ T385] RDX: 0000000000000002 RSI: 00007f175e067f90 RDI: ffffffffffffff9c [ 27.046923][ T385] RBP: 00007f175d23804e R08: 0000000000000000 R09: 0000000000000000 [ 27.046937][ T385] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 27.046949][ T385] R13: 00007f175d426038 R14: 00007f175d425fa0 R15: 00007fff73343448 [ 27.046966][ T385] [ 27.479250][ T313] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 27.486819][ T310] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 27.629298][ T45] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 27.639291][ T310] usb 1-1: Using ep0 maxpacket: 32 [ 27.644472][ T313] usb 2-1: Using ep0 maxpacket: 8 [ 27.650746][ T313] usb 2-1: config 0 has an invalid interface number: 200 but max is 0 [ 27.659061][ T313] usb 2-1: config 0 has no interface number 0 [ 27.665297][ T310] usb 1-1: unable to get BOS descriptor or descriptor too short [ 27.673009][ T313] usb 2-1: config 0 interface 200 altsetting 2 endpoint 0x4 has invalid wMaxPacketSize 0 [ 27.682939][ T313] usb 2-1: config 0 interface 200 has no altsetting 0 [ 27.690299][ T310] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 27.700570][ T310] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 27.709949][ T313] usb 2-1: New USB device found, idVendor=0b57, idProduct=d428, bcdDevice=48.b9 [ 27.719000][ T313] usb 2-1: New USB device strings: Mfr=102, Product=2, SerialNumber=3 [ 27.727214][ T313] usb 2-1: Product: syz [ 27.731452][ T313] usb 2-1: Manufacturer: syz [ 27.736055][ T313] usb 2-1: SerialNumber: syz [ 27.741050][ T310] usb 1-1: New USB device found, idVendor=200c, idProduct=1018, bcdDevice= 0.40 [ 27.750256][ T310] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.758419][ T313] usb 2-1: config 0 descriptor?? [ 27.763490][ T310] usb 1-1: Product: syz [ 27.767675][ T310] usb 1-1: Manufacturer: syz [ 27.772448][ T310] usb 1-1: SerialNumber: syz [ 27.790283][ T45] usb 4-1: config 7 descriptor has 1 excess byte, ignoring [ 27.797523][ T45] usb 4-1: config 7 has 1 interface, different from the descriptor's value: 2 [ 27.807744][ T45] usb 4-1: New USB device found, idVendor=19d2, idProduct=1275, bcdDevice= 7.84 [ 27.816844][ T45] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.825118][ T45] usb 4-1: Product: syz [ 27.829316][ T45] usb 4-1: Manufacturer: syz [ 27.833909][ T45] usb 4-1: SerialNumber: syz [ 27.840967][ T45] rndis_host 4-1:7.0: skipping garbage [ 27.846476][ T45] usb 4-1: bad CDC descriptors [ 27.974346][ T313] usbhid 2-1:0.200: couldn't find an input interrupt endpoint [ 27.982309][ T36] audit: type=1400 audit(1794600981.439:143): avc: denied { read } for pid=382 comm="syz.0.19" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 28.003323][ T313] usb 2-1: USB disconnect, device number 4 [ 28.033952][ T393] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 28.042557][ T393] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 28.045515][ T45] usb 4-1: USB disconnect, device number 4 [ 28.051602][ T393] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 28.065934][ T393] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 28.077601][ T36] audit: type=1400 audit(1794600981.529:144): avc: denied { create } for pid=382 comm="syz.0.19" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 28.091604][ T393] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 28.096732][ T36] audit: type=1400 audit(1794600981.549:145): avc: denied { create } for pid=382 comm="syz.0.19" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 28.106671][ T393] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 28.124953][ T36] audit: type=1400 audit(1794600981.549:146): avc: denied { ioctl } for pid=382 comm="syz.0.19" path="socket:[4354]" dev="sockfs" ino=4354 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 28.157126][ T36] audit: type=1400 audit(1794600981.549:147): avc: denied { connect } for pid=382 comm="syz.0.19" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 28.400828][ T36] audit: type=1400 audit(1794600981.859:148): avc: denied { write } for pid=394 comm="syz.2.23" name="icmp" dev="proc" ino=4026532513 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 28.514217][ T409] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 28.888528][ T421] process 'syz.1.30' launched './file0' with NULL argv: empty string added [ 29.249277][ T338] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 29.319251][ T45] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 29.400291][ T338] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 29.411303][ T338] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 29.421608][ T338] usb 3-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 29.430775][ T338] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.439793][ T338] usb 3-1: config 0 descriptor?? [ 29.480256][ T45] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 29.490014][ T45] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xB has an invalid bInterval 36, changing to 7 [ 29.502225][ T45] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xB has invalid maxpacket 18095, setting to 1024 [ 29.514718][ T45] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 29.523834][ T45] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.531918][ T45] usb 4-1: Product: syz [ 29.536114][ T45] usb 4-1: Manufacturer: syz [ 29.540782][ T45] usb 4-1: SerialNumber: syz [ 29.546115][ T45] usb 4-1: config 0 descriptor?? [ 29.552310][ T45] usb 4-1: 0:0 : invalid sync pipe. bmAttributes 39, bLength 9, bSynchAddress 24 [ 29.755378][ T45] usb 4-1: USB disconnect, device number 5 [ 29.766106][ T322] udevd[322]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 29.847575][ T338] cp2112 0003:10C4:EA90.0001: unknown main item tag 0x0 [ 29.855924][ T338] cp2112 0003:10C4:EA90.0001: unknown main item tag 0x0 [ 29.863299][ T338] cp2112 0003:10C4:EA90.0001: unknown main item tag 0x0 [ 29.870275][ T338] cp2112 0003:10C4:EA90.0001: unknown main item tag 0x0 [ 29.877217][ T338] cp2112 0003:10C4:EA90.0001: unknown main item tag 0x0 [ 29.884182][ T338] cp2112 0003:10C4:EA90.0001: unknown main item tag 0x0 [ 29.891236][ T338] cp2112 0003:10C4:EA90.0001: unknown main item tag 0x0 [ 29.901781][ T338] cp2112 0003:10C4:EA90.0001: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.2-1/input0 [ 29.994708][ T310] usb 1-1: 3:0: failed to get current value for ch 0 (-71) [ 30.004200][ T310] usb 1-1: 3:0: cannot get min/max values for control 2 (id 3) [ 30.013325][ T310] usb 1-1: 3:0: cannot get min/max values for control 3 (id 3) [ 30.021813][ T310] usb 1-1: 3:0: cannot get min/max values for control 3 (id 3) [ 30.030106][ T310] usb 1-1: 3:0: cannot get min/max values for control 5 (id 3) [ 30.038450][ T310] usb 1-1: 3:0: failed to get current value for ch 1 (-71) [ 30.046976][ T338] cp2112 0003:10C4:EA90.0001: error requesting version [ 30.048112][ T310] usb 1-1: 3:0: failed to get current value for ch 2 (-71) [ 30.055249][ T338] cp2112 0003:10C4:EA90.0001: probe with driver cp2112 failed with error -5 [ 30.064146][ T310] usb 1-1: 3:0: failed to get current value for ch 0 (-71) [ 30.079295][ T310] usb 1-1: 3:0: failed to get current value for ch 1 (-71) [ 30.086625][ T389] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 30.094750][ T310] usb 1-1: 3:0: failed to get current value for ch 0 (-71) [ 30.102553][ T310] usb 1-1: 3:0: cannot get min/max values for control 11 (id 3) [ 30.111083][ T310] usb 1-1: 3:0: cannot get min/max values for control 11 (id 3) [ 30.121871][ T310] usb 1-1: USB disconnect, device number 4 [ 30.132457][ T318] udevd[318]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 30.249268][ T389] usb 2-1: Using ep0 maxpacket: 16 [ 30.255543][ T389] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 30.266720][ T389] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 30.276580][ T389] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 30.289915][ T389] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 30.299147][ T389] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.307952][ T389] usb 2-1: config 0 descriptor?? [ 30.406755][ T449] netlink: 'syz.3.39': attribute type 4 has an invalid length. [ 30.428211][ T451] FAULT_INJECTION: forcing a failure. [ 30.428211][ T451] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 30.441679][ T451] CPU: 0 UID: 0 PID: 451 Comm: syz.3.40 Not tainted syzkaller #0 5676c8b0feefcba4e903dddff460827408f065be [ 30.441700][ T451] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 30.441708][ T451] Call Trace: [ 30.441711][ T451] [ 30.441717][ T451] __dump_stack+0x21/0x30 [ 30.441743][ T451] dump_stack_lvl+0x140/0x1c0 [ 30.441762][ T451] ? __cfi_dump_stack_lvl+0x10/0x10 [ 30.441781][ T451] dump_stack+0x19/0x20 [ 30.441798][ T451] should_fail_ex+0x3c2/0x510 [ 30.441814][ T451] should_fail+0xf/0x20 [ 30.441823][ T451] should_fail_usercopy+0x1e/0x30 [ 30.441834][ T451] _copy_to_iter+0x1a6/0x1520 [ 30.441846][ T451] ? __cfi__copy_to_iter+0x10/0x10 [ 30.441856][ T451] ? __check_object_size+0x54c/0x870 [ 30.441879][ T451] ? __cfi___check_object_size+0x10/0x10 [ 30.441905][ T451] ? btf_vmlinux_read+0x2d/0x40 [ 30.441924][ T451] ? __kasan_check_write+0x18/0x20 [ 30.441949][ T451] kernfs_fop_read_iter+0x39b/0x570 [ 30.441964][ T451] vfs_read+0x60e/0xc70 [ 30.441979][ T451] ? __cfi_vfs_read+0x10/0x10 [ 30.441994][ T451] ? __cfi_mutex_lock+0x10/0x10 [ 30.442009][ T451] ksys_read+0x145/0x260 [ 30.442024][ T451] ? __cfi_ksys_read+0x10/0x10 [ 30.442042][ T451] ? __kasan_check_read+0x15/0x20 [ 30.442067][ T451] __x64_sys_read+0x7f/0x90 [ 30.442084][ T451] x64_sys_call+0x2638/0x2ee0 [ 30.442101][ T451] do_syscall_64+0x57/0xf0 [ 30.442112][ T451] ? clear_bhb_loop+0x50/0xa0 [ 30.442126][ T451] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 30.442140][ T451] RIP: 0033:0x7f5d08f69d0e [ 30.442149][ T451] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 30.442161][ T451] RSP: 002b:00007f5d09ed2f48 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 30.442182][ T451] RAX: ffffffffffffffda RBX: 00007f5d09ed36c0 RCX: 00007f5d08f69d0e [ 30.442195][ T451] RDX: 00000000009ff000 RSI: 00007f5d093545a0 RDI: 0000000000000005 [ 30.442208][ T451] RBP: 00007f5d093535a0 R08: 0000000000000000 R09: 0000000000000000 [ 30.442220][ T451] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000a00000 [ 30.442231][ T451] R13: 0000000000001000 R14: 00007f5d09225fa0 R15: 00007ffc5cb9a218 [ 30.442244][ T451] [ 30.720870][ T389] input: HID 045e:07da as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:045E:07DA.0002/input/input5 [ 30.733295][ T389] microsoft 0003:045E:07DA.0002: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.1-1/input0 [ 30.799279][ T338] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 30.932011][ T455] netlink: 'syz.0.41': attribute type 12 has an invalid length. [ 30.950281][ T338] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 30.962274][ T458] xfrm0: entered allmulticast mode [ 30.962662][ T338] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 30.977533][ T338] usb 4-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 30.986669][ T338] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.998171][ T338] usb 4-1: config 0 descriptor?? [ 31.157062][ T469] ======================================================= [ 31.157062][ T469] WARNING: The mand mount option has been deprecated and [ 31.157062][ T469] and is ignored by this kernel. Remove the mand [ 31.157062][ T469] option from the mount to silence this warning. [ 31.157062][ T469] ======================================================= [ 31.159512][ T470] rtc_cmos 00:00: in use; can't configure [ 31.405914][ T338] playstation 0003:054C:0DF2.0003: unknown main item tag 0x0 [ 31.413368][ T338] playstation 0003:054C:0DF2.0003: unknown main item tag 0x0 [ 31.420830][ T338] playstation 0003:054C:0DF2.0003: unknown main item tag 0x0 [ 31.426382][ T389] usb 2-1: USB disconnect, device number 5 [ 31.428318][ T338] playstation 0003:054C:0DF2.0003: unknown main item tag 0x0 [ 31.452178][ T338] playstation 0003:054C:0DF2.0003: unknown main item tag 0x0 [ 31.462392][ T338] playstation 0003:054C:0DF2.0003: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.3-1/input0 [ 31.518356][ T479] mmap: syz.1.47 (479) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 31.532470][ T479] FAULT_INJECTION: forcing a failure. [ 31.532470][ T479] name fail_futex, interval 1, probability 0, space 0, times 1 [ 31.545368][ T479] CPU: 0 UID: 0 PID: 479 Comm: syz.1.47 Not tainted syzkaller #0 5676c8b0feefcba4e903dddff460827408f065be [ 31.545394][ T479] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 31.545404][ T479] Call Trace: [ 31.545410][ T479] [ 31.545419][ T479] __dump_stack+0x21/0x30 [ 31.545442][ T479] dump_stack_lvl+0x140/0x1c0 [ 31.545462][ T479] ? __cfi_dump_stack_lvl+0x10/0x10 [ 31.545478][ T479] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 31.545501][ T479] dump_stack+0x19/0x20 [ 31.545519][ T479] should_fail_ex+0x3c2/0x510 [ 31.545539][ T479] should_fail+0xf/0x20 [ 31.545556][ T479] get_futex_key+0x178/0x940 [ 31.545578][ T479] ? __cfi_get_futex_key+0x10/0x10 [ 31.545596][ T479] ? kmem_cache_free+0x1bd/0x4f0 [ 31.545625][ T479] ? user_path_at+0x4c/0x60 [ 31.545646][ T479] ? path_listxattr+0xad/0x1d0 [ 31.545664][ T479] ? __x64_sys_llistxattr+0x81/0x90 [ 31.545692][ T479] futex_wake+0x150/0x950 [ 31.545715][ T479] ? __cfi_futex_wake+0x10/0x10 [ 31.545739][ T479] do_futex+0x37d/0x510 [ 31.545758][ T479] ? __kasan_slab_free+0x6a/0x80 [ 31.545786][ T479] ? __cfi_do_futex+0x10/0x10 [ 31.545807][ T479] __se_sys_futex+0x13c/0x320 [ 31.545821][ T479] ? user_path_at+0x4c/0x60 [ 31.545833][ T479] ? __x64_sys_futex+0x110/0x110 [ 31.545844][ T479] ? getxattr+0x250/0x250 [ 31.545855][ T479] __x64_sys_futex+0xe9/0x110 [ 31.545867][ T479] x64_sys_call+0x227f/0x2ee0 [ 31.545879][ T479] do_syscall_64+0x57/0xf0 [ 31.545890][ T479] ? clear_bhb_loop+0x50/0xa0 [ 31.545903][ T479] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 31.545916][ T479] RIP: 0033:0x7f175d1a94d9 [ 31.545927][ T479] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 31.545939][ T479] RSP: 002b:00007f175e0680e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 31.545951][ T479] RAX: ffffffffffffffda RBX: 00007f175d425fa8 RCX: 00007f175d1a94d9 [ 31.545959][ T479] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f175d425fac [ 31.545966][ T479] RBP: 00007f175d425fa0 R08: 4000000000000000 R09: 0000000000000000 [ 31.545974][ T479] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 31.545981][ T479] R13: 00007f175d426038 R14: 00007fff73343360 R15: 00007fff73343448 [ 31.545989][ T479] [ 31.803239][ T36] kauditd_printk_skb: 44 callbacks suppressed [ 31.803257][ T36] audit: type=1400 audit(1794600985.259:193): avc: denied { ioctl } for pid=481 comm="syz.1.48" path="/dev/binderfs/binder0" dev="binder" ino=4 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 31.834604][ T36] audit: type=1400 audit(1794600985.259:194): avc: denied { set_context_mgr } for pid=481 comm="syz.1.48" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 31.854314][ T36] audit: type=1400 audit(1794600985.259:195): avc: denied { map } for pid=481 comm="syz.1.48" path="/dev/binderfs/binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 31.939484][ T36] audit: type=1400 audit(1794600985.399:196): avc: denied { create } for pid=486 comm="syz.1.50" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 31.958691][ T36] audit: type=1400 audit(1794600985.399:197): avc: denied { write } for pid=486 comm="syz.1.50" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 32.059852][ T13] bridge_slave_1: left allmulticast mode [ 32.065565][ T13] bridge_slave_1: left promiscuous mode [ 32.071364][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.090734][ T13] bridge_slave_0: left allmulticast mode [ 32.096485][ T13] bridge_slave_0: left promiscuous mode [ 32.102796][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.171507][ T36] audit: type=1400 audit(1794600985.629:198): avc: denied { create } for pid=497 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 32.194796][ T338] playstation 0003:054C:0DF2.0003: Invalid gyro calibration data for axis (3), disabling calibration. [ 32.210541][ T310] usb 3-1: USB disconnect, device number 3 [ 32.213297][ T338] playstation 0003:054C:0DF2.0003: Invalid gyro calibration data for axis (4), disabling calibration. [ 32.227820][ T338] playstation 0003:054C:0DF2.0003: Invalid gyro calibration data for axis (5), disabling calibration. [ 32.233711][ T36] audit: type=1400 audit(1794600985.689:199): avc: denied { create } for pid=499 comm="syz.2.56" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 32.240463][ T338] playstation 0003:054C:0DF2.0003: Invalid accelerometer calibration data for axis (0), disabling calibration. [ 32.272317][ T338] playstation 0003:054C:0DF2.0003: Invalid accelerometer calibration data for axis (1), disabling calibration. [ 32.275279][ T497] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.285120][ T338] playstation 0003:054C:0DF2.0003: Invalid accelerometer calibration data for axis (2), disabling calibration. [ 32.291618][ T338] input: HID 054c:0df2 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:054C:0DF2.0003/input/input7 [ 32.292541][ T36] audit: type=1400 audit(1794600985.719:200): avc: denied { write } for pid=499 comm="syz.2.56" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 32.314150][ T338] input: HID 054c:0df2 Motion Sensors as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:054C:0DF2.0003/input/input8 [ 32.315397][ T497] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.337135][ T504] 9pnet_virtio: no channels available for device ./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 32.348540][ T497] bridge_slave_0: entered allmulticast mode [ 32.356727][ T338] input: HID 054c:0df2 Touchpad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:054C:0DF2.0003/input/input9 [ 32.446361][ T389] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 32.478674][ T338] playstation 0003:054C:0DF2.0003: Registered DualSense controller hw_version=0x00000000 fw_version=0x00000000 [ 32.488891][ T497] bridge_slave_0: entered promiscuous mode [ 32.498200][ T13] veth1_macvtap: left promiscuous mode [ 32.503812][ T13] veth0_vlan: left promiscuous mode [ 32.505984][ T338] usb 4-1: USB disconnect, device number 6 [ 32.527885][ T36] audit: type=1400 audit(1794600985.979:201): avc: denied { execstack } for pid=499 comm="syz.2.56" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 32.577025][ T504] @0: renamed from bond_slave_1 [ 32.584759][ T497] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.592352][ T497] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.603705][ T497] bridge_slave_1: entered allmulticast mode [ 32.609369][ T36] audit: type=1400 audit(1794600986.069:202): avc: denied { mounton } for pid=505 comm="syz.2.57" path="/dev/binderfs" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 32.610039][ T497] bridge_slave_1: entered promiscuous mode [ 32.645817][ T389] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 32.656667][ T389] usb 2-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 32.670431][ T389] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.680231][ T389] usb 2-1: Found UVC 1.00 device (046d:0825) [ 32.709068][ T497] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.716165][ T497] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.723486][ T497] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.730534][ T497] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.756696][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.766388][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.778563][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.785638][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.793934][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.800983][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.828785][ T497] veth0_vlan: entered promiscuous mode [ 32.841498][ T497] veth1_macvtap: entered promiscuous mode [ 32.917058][ T12] Bluetooth: hci0: Frame reassembly failed (-84) [ 33.013252][ T522] device-mapper: verity: sha512 using shash "sha512-avx2" [ 33.020680][ T522] device-mapper: table: 252:0: verity: Invalid salt (-EINVAL) [ 33.028200][ T522] device-mapper: ioctl: error adding target to table [ 33.080440][ T389] usb 2-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 33.091307][ T496] netlink: 24 bytes leftover after parsing attributes in process `syz.1.55'. [ 33.102778][ T389] uvcvideo 2-1:1.1: Failed to query (129) UVC probe control : 3 (exp. 26). [ 33.111461][ T389] uvcvideo 2-1:1.1: Failed to initialize the device (-5). [ 33.306332][ T389] usb 2-1: USB disconnect, device number 6 [ 33.419336][ T64] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 33.582107][ T64] usb 4-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 33.591331][ T64] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.599369][ T64] usb 4-1: Product: syz [ 33.603555][ T64] usb 4-1: Manufacturer: syz [ 33.608181][ T64] usb 4-1: SerialNumber: syz [ 34.029252][ T331] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 34.180295][ T331] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 34.191266][ T331] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 34.201079][ T331] usb 5-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 34.210164][ T331] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.222030][ T331] usb 5-1: config 0 descriptor?? [ 34.243602][ T64] rtl8150 4-1:1.0: couldn't reset the device [ 34.249807][ T64] rtl8150 4-1:1.0: probe with driver rtl8150 failed with error -5 [ 34.259342][ T64] usb 4-1: USB disconnect, device number 7 [ 34.629480][ T331] cp2112 0003:10C4:EA90.0004: unknown main item tag 0x0 [ 34.636484][ T331] cp2112 0003:10C4:EA90.0004: unknown main item tag 0x0 [ 34.643845][ T331] cp2112 0003:10C4:EA90.0004: unknown main item tag 0x0 [ 34.650918][ T331] cp2112 0003:10C4:EA90.0004: unknown main item tag 0x0 [ 34.657887][ T331] cp2112 0003:10C4:EA90.0004: unknown main item tag 0x0 [ 34.664928][ T331] cp2112 0003:10C4:EA90.0004: unknown main item tag 0x0 [ 34.671913][ T331] cp2112 0003:10C4:EA90.0004: unknown main item tag 0x0 [ 34.679789][ T331] cp2112 0003:10C4:EA90.0004: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.4-1/input0 [ 34.705013][ T543] skbuff: bad partial csum: csum=65506/2 headroom=144 headlen=65526 [ 34.739465][ T551] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 34.749552][ T551] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 34.828937][ T331] cp2112 0003:10C4:EA90.0004: Part Number: 0x00 Device Version: 0x00 [ 34.949248][ T53] Bluetooth: hci0: command 0x1003 tx timeout [ 34.949257][ T515] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 34.949330][ T10] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 34.969278][ T310] usb 4-1: new full-speed USB device number 8 using dummy_hcd [ 34.976909][ T60] Bluetooth: hci0: Frame reassembly failed (-84) [ 35.037455][ T331] cp2112 0003:10C4:EA90.0004: error requesting SMBus config [ 35.045554][ T331] cp2112 0003:10C4:EA90.0004: probe with driver cp2112 failed with error -32 [ 35.120319][ T10] usb 2-1: config 1 has an invalid interface number: 188 but max is 0 [ 35.128574][ T10] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 35.138778][ T10] usb 2-1: config 1 has no interface number 0 [ 35.140313][ T310] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x57, changing to 0x7 [ 35.144887][ T10] usb 2-1: config 1 interface 188 altsetting 209 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 35.156426][ T310] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 35.169768][ T10] usb 2-1: config 1 interface 188 has no altsetting 0 [ 35.180885][ T310] usb 4-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=33.f9 [ 35.187881][ T10] usb 2-1: New USB device found, idVendor=2040, idProduct=7210, bcdDevice=5b.6b [ 35.195208][ T310] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.204537][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.212288][ T310] usb 4-1: Product: syz [ 35.220603][ T10] usb 2-1: Product: syz [ 35.224406][ T310] usb 4-1: Manufacturer: syz [ 35.228544][ T10] usb 2-1: Manufacturer: syz [ 35.233306][ T310] usb 4-1: SerialNumber: syz [ 35.237780][ T10] usb 2-1: SerialNumber: syz [ 35.245825][ T310] usb 4-1: config 0 descriptor?? [ 35.453086][ T64] usb 4-1: USB disconnect, device number 8 [ 35.654242][ T10] usb 2-1: unknown interface protocol 0xc1, assuming v1 [ 35.661375][ T10] usb 2-1: 188:0 : does not exist [ 35.674479][ T10] usb 2-1: USB disconnect, device number 7 [ 35.913848][ T514] Bluetooth: hci0: Opcode 0x1003 failed: -4 [ 36.007074][ T557] FAULT_INJECTION: forcing a failure. [ 36.007074][ T557] name fail_futex, interval 1, probability 0, space 0, times 0 [ 36.020007][ T557] CPU: 0 UID: 0 PID: 557 Comm: syz.2.71 Not tainted syzkaller #0 5676c8b0feefcba4e903dddff460827408f065be [ 36.020038][ T557] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 36.020049][ T557] Call Trace: [ 36.020055][ T557] [ 36.020061][ T557] __dump_stack+0x21/0x30 [ 36.020085][ T557] dump_stack_lvl+0x140/0x1c0 [ 36.020102][ T557] ? __cfi_dump_stack_lvl+0x10/0x10 [ 36.020119][ T557] dump_stack+0x19/0x20 [ 36.020133][ T557] should_fail_ex+0x3c2/0x510 [ 36.020151][ T557] should_fail+0xf/0x20 [ 36.020164][ T557] get_futex_key+0x178/0x940 [ 36.020182][ T557] ? __cfi_get_futex_key+0x10/0x10 [ 36.020200][ T557] futex_wake+0x150/0x950 [ 36.020218][ T557] ? __kasan_slab_free+0x6a/0x80 [ 36.020239][ T557] ? __cfi_futex_wake+0x10/0x10 [ 36.020261][ T557] ? probes_write+0x38/0x50 [ 36.020279][ T557] ? vfs_write+0xbd2/0xfd0 [ 36.020294][ T557] do_futex+0x37d/0x510 [ 36.020312][ T557] ? __cfi_do_futex+0x10/0x10 [ 36.020328][ T557] ? mutex_unlock+0x90/0x240 [ 36.020350][ T557] __se_sys_futex+0x13c/0x320 [ 36.020367][ T557] ? fput+0x1a4/0x230 [ 36.020385][ T557] ? __x64_sys_futex+0x110/0x110 [ 36.020403][ T557] ? __cfi_ksys_write+0x10/0x10 [ 36.020418][ T557] __x64_sys_futex+0xe9/0x110 [ 36.020436][ T557] x64_sys_call+0x227f/0x2ee0 [ 36.020485][ T557] do_syscall_64+0x57/0xf0 [ 36.020503][ T557] ? clear_bhb_loop+0x50/0xa0 [ 36.020527][ T557] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 36.020555][ T557] RIP: 0033:0x7fd4f39a94d9 [ 36.020569][ T557] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 36.020584][ T557] RSP: 002b:00007fd4f485c0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 36.020607][ T557] RAX: ffffffffffffffda RBX: 00007fd4f3c25fa8 RCX: 00007fd4f39a94d9 [ 36.020621][ T557] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fd4f3c25fac [ 36.020632][ T557] RBP: 00007fd4f3c25fa0 R08: 4000000000000000 R09: 0000000000000000 [ 36.020644][ T557] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 36.020654][ T557] R13: 00007fd4f3c26038 R14: 00007ffe61025ea0 R15: 00007ffe61025f88 [ 36.020668][ T557] [ 36.261864][ T561] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 36.689250][ T310] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 36.709249][ T313] usb 4-1: new full-speed USB device number 9 using dummy_hcd [ 36.804162][ T389] usb 5-1: USB disconnect, device number 2 [ 36.849281][ T313] usb 4-1: device descriptor read/64, error -71 [ 36.859957][ T310] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 36.873041][ T310] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 1.00 [ 36.878553][ T573] kvm: pic: non byte read [ 36.882409][ T310] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.894964][ T310] usb 2-1: Product: syz [ 36.899127][ T310] usb 2-1: Manufacturer: syz [ 36.903891][ T310] usb 2-1: SerialNumber: syz [ 36.927958][ T310] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 36.934071][ T310] cdc_wdm 2-1:1.0: Unknown control protocol [ 36.992460][ T576] netlink: 'syz.4.78': attribute type 9 has an invalid length. [ 37.018031][ T578] Zero length message leads to an empty skb [ 37.099250][ T313] usb 4-1: device descriptor read/64, error -71 [ 37.128600][ T36] kauditd_printk_skb: 27 callbacks suppressed [ 37.128617][ T36] audit: type=1400 audit(1794600990.579:230): avc: denied { read write } for pid=568 comm="syz.1.75" name="cdc-wdm0" dev="devtmpfs" ino=526 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 37.159257][ T569] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 37.176630][ T569] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 37.189946][ T36] audit: type=1400 audit(1794600990.609:231): avc: denied { open } for pid=568 comm="syz.1.75" path="/dev/cdc-wdm0" dev="devtmpfs" ino=526 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 37.189969][ T569] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 37.222272][ T569] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 37.241199][ T310] usb 2-1: USB disconnect, device number 8 [ 37.279273][ T10] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 37.365358][ T36] audit: type=1400 audit(1794600990.819:232): avc: denied { write } for pid=586 comm="syz.2.82" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 37.366895][ T587] netlink: 64 bytes leftover after parsing attributes in process `syz.2.82'. [ 37.388078][ T313] usb 4-1: new full-speed USB device number 10 using dummy_hcd [ 37.402085][ T36] audit: type=1400 audit(1794600990.819:233): avc: denied { create } for pid=586 comm="syz.2.82" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 37.421201][ T36] audit: type=1400 audit(1794600990.819:234): avc: denied { setopt } for pid=586 comm="syz.2.82" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 37.440289][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 37.440626][ T36] audit: type=1400 audit(1794600990.819:235): avc: denied { block_suspend } for pid=586 comm="syz.2.82" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 37.446657][ T10] usb 5-1: config 0 has an invalid interface number: 20 but max is 0 [ 37.474950][ T10] usb 5-1: config 0 has no interface number 0 [ 37.481051][ T10] usb 5-1: config 0 interface 20 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 37.491134][ T10] usb 5-1: config 0 interface 20 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 37.500960][ T10] usb 5-1: config 0 interface 20 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 37.512189][ T10] usb 5-1: New USB device found, idVendor=04e6, idProduct=000b, bcdDevice= 1.00 [ 37.521269][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.529285][ T10] usb 5-1: Product: syz [ 37.533434][ T10] usb 5-1: Manufacturer: syz [ 37.538022][ T10] usb 5-1: SerialNumber: syz [ 37.543163][ T10] usb 5-1: config 0 descriptor?? [ 37.548582][ T581] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 37.589256][ T313] usb 4-1: device descriptor read/64, error -71 [ 37.639249][ T331] usb 3-1: new full-speed USB device number 4 using dummy_hcd [ 37.757670][ T10] usb-storage 5-1:0.20: USB Mass Storage device detected [ 37.765571][ T10] usb-storage 5-1:0.20: Quirks match for vid 04e6 pid 000b: 4 [ 37.773559][ T10] scsi host1: usb-storage 5-1:0.20 [ 37.782835][ T10] usb 5-1: USB disconnect, device number 3 [ 37.791706][ T331] usb 3-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 37.804173][ T331] usb 3-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 37.817388][ T331] usb 3-1: config 0 interface 0 has no altsetting 0 [ 37.824298][ T331] usb 3-1: New USB device found, idVendor=05ac, idProduct=0251, bcdDevice= 0.00 [ 37.829281][ T313] usb 4-1: device descriptor read/64, error -71 [ 37.833574][ T331] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 37.852779][ T331] usb 3-1: config 0 descriptor?? [ 37.859322][ T592] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 37.949340][ T313] usb usb4-port1: attempt power cycle [ 38.109250][ T310] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 38.260252][ T310] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 38.271173][ T310] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 38.286747][ T310] usb 2-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 38.294900][ T605] SELinux: Context system_u:object is not valid (left unmapped). [ 38.296368][ T313] usb 4-1: new full-speed USB device number 11 using dummy_hcd [ 38.311861][ T36] audit: type=1400 audit(1794600991.759:236): avc: denied { relabelto } for pid=604 comm="syz.4.87" name="cgroup.procs" dev="cgroup" ino=265 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="system_u:object" [ 38.332734][ T331] apple 0003:05AC:0251.0005: ignoring exceeding usage max [ 38.337481][ T310] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 38.356645][ T36] audit: type=1400 audit(1794600991.759:237): avc: denied { associate } for pid=604 comm="syz.4.87" name="cgroup.procs" dev="cgroup" ino=265 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 srawcon="system_u:object" [ 38.370050][ T331] apple 0003:05AC:0251.0005: hidraw0: USB HID v0.00 Device [HID 05ac:0251] on usb-dummy_hcd.2-1/input0 [ 38.383335][ T310] usb 2-1: config 0 descriptor?? [ 38.411509][ T607] kvm: kvm [606]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0x11e) = 0x0 [ 38.424185][ T313] usb 4-1: device descriptor read/8, error -71 [ 38.552789][ T389] usb 3-1: USB disconnect, device number 4 [ 38.560937][ T313] usb 4-1: device descriptor read/8, error -71 [ 38.799262][ T313] usb 4-1: new full-speed USB device number 12 using dummy_hcd [ 38.820196][ T313] usb 4-1: device descriptor read/8, error -71 [ 38.827238][ T310] cp2112 0003:10C4:EA90.0006: unknown main item tag 0x0 [ 38.834251][ T310] cp2112 0003:10C4:EA90.0006: unknown main item tag 0x0 [ 38.841248][ T310] cp2112 0003:10C4:EA90.0006: unknown main item tag 0x0 [ 38.848192][ T310] cp2112 0003:10C4:EA90.0006: unknown main item tag 0x0 [ 38.855174][ T310] cp2112 0003:10C4:EA90.0006: unknown main item tag 0x0 [ 38.862163][ T310] cp2112 0003:10C4:EA90.0006: unknown main item tag 0x0 [ 38.869090][ T310] cp2112 0003:10C4:EA90.0006: unknown main item tag 0x0 [ 38.876680][ T310] cp2112 0003:10C4:EA90.0006: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.1-1/input0 [ 38.919262][ T331] usb 5-1: new full-speed USB device number 4 using dummy_hcd [ 38.950254][ T313] usb 4-1: device descriptor read/8, error -71 [ 39.026887][ T310] cp2112 0003:10C4:EA90.0006: Part Number: 0x00 Device Version: 0x00 [ 39.059337][ T313] usb usb4-port1: unable to enumerate USB device [ 39.068391][ T621] netlink: 'syz.2.92': attribute type 5 has an invalid length. [ 39.080601][ T331] usb 5-1: unable to get BOS descriptor or descriptor too short [ 39.088661][ T331] usb 5-1: not running at top speed; connect to a high speed hub [ 39.097090][ T331] usb 5-1: config 1 has an invalid interface number: 99 but max is 0 [ 39.105381][ T331] usb 5-1: config 1 has no interface number 0 [ 39.111482][ T331] usb 5-1: config 1 interface 99 has no altsetting 0 [ 39.119762][ T331] usb 5-1: New USB device found, idVendor=0403, idProduct=da70, bcdDevice=7f.3f [ 39.128809][ T331] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.136844][ T331] usb 5-1: Product: syz [ 39.141040][ T331] usb 5-1: Manufacturer: ꇞ㤑캰䗆ⓣ᫶惧￳⅞코쎼㸭ᓟᠡ􉘞쾄㆔䶄嶱ㅋ돞ㅃ咏珢 [ 39.151988][ T331] usb 5-1: SerialNumber: syz [ 39.227202][ T310] cp2112 0003:10C4:EA90.0006: error requesting SMBus config [ 39.235143][ T310] cp2112 0003:10C4:EA90.0006: probe with driver cp2112 failed with error -32 [ 39.358549][ T36] audit: type=1400 audit(1794600992.809:238): avc: denied { accept } for pid=617 comm="syz.4.91" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 39.379371][ T331] usb 5-1: NDI device with a latency value of 1 [ 39.385792][ T331] ftdi_sio 5-1:1.99: FTDI USB Serial Device converter detected [ 39.393693][ T331] ftdi_sio ttyUSB0: unknown device type: 0x7f3f [ 39.402162][ T331] usb 5-1: USB disconnect, device number 4 [ 39.408258][ T331] ftdi_sio 5-1:1.99: device disconnected [ 39.478008][ T36] audit: type=1400 audit(1794600992.929:239): avc: denied { read write } for pid=622 comm="syz.3.93" name="uhid" dev="devtmpfs" ino=199 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 39.479439][ T10] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 39.525723][ T10] hid-generic 0000:0000:0000.0007: hidraw0: HID v0.00 Device [syz1] on syz0 [ 39.563758][ T623] netlink: 'syz.3.93': attribute type 29 has an invalid length. [ 39.571422][ T623] netlink: 52058 bytes leftover after parsing attributes in process `syz.3.93'. [ 39.616909][ T628] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=46394 sclass=netlink_xfrm_socket pid=628 comm=syz.2.94 [ 39.832404][ T628] capability: warning: `syz.2.94' uses deprecated v2 capabilities in a way that may be insecure [ 39.869511][ T642] ./dev/sda1: Can't lookup blockdev [ 39.936706][ T644] FAULT_INJECTION: forcing a failure. [ 39.936706][ T644] name failslab, interval 1, probability 0, space 0, times 0 [ 39.949605][ T644] CPU: 0 UID: 0 PID: 644 Comm: syz.4.99 Not tainted syzkaller #0 5676c8b0feefcba4e903dddff460827408f065be [ 39.949624][ T644] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 39.949634][ T644] Call Trace: [ 39.949638][ T644] [ 39.949642][ T644] __dump_stack+0x21/0x30 [ 39.949657][ T644] dump_stack_lvl+0x140/0x1c0 [ 39.949667][ T644] ? __cfi_dump_stack_lvl+0x10/0x10 [ 39.949678][ T644] dump_stack+0x19/0x20 [ 39.949687][ T644] should_fail_ex+0x3c2/0x510 [ 39.949699][ T644] should_failslab+0xac/0x100 [ 39.949711][ T644] __kmalloc_cache_noprof+0x41/0x470 [ 39.949726][ T644] ? __kasan_check_write+0x18/0x20 [ 39.949740][ T644] ? dm_open+0x85/0x1e0 [ 39.949754][ T644] ? mutex_lock+0x97/0x1d0 [ 39.949766][ T644] ? __cfi_mutex_lock+0x10/0x10 [ 39.949779][ T644] ? __cfi_dm_open+0x10/0x10 [ 39.949792][ T644] dm_open+0x85/0x1e0 [ 39.949805][ T644] ? misc_open+0x2d1/0x370 [ 39.949819][ T644] ? __cfi_dm_open+0x10/0x10 [ 39.949832][ T644] misc_open+0x2ef/0x370 [ 39.949845][ T644] chrdev_open+0x4e8/0x610 [ 39.949855][ T644] ? __cfi_chrdev_open+0x10/0x10 [ 39.949865][ T644] ? bpf_lsm_file_open+0xd/0x20 [ 39.949877][ T644] ? __cfi_chrdev_open+0x10/0x10 [ 39.949886][ T644] do_dentry_open+0x97f/0x1510 [ 39.949899][ T644] vfs_open+0x86/0x240 [ 39.949911][ T644] ? __cfi_vfs_open+0x10/0x10 [ 39.949923][ T644] ? may_open+0x352/0x430 [ 39.949934][ T644] path_openat+0x2c49/0x35a0 [ 39.949947][ T644] ? kasan_save_alloc_info+0x3a/0x50 [ 39.949961][ T644] ? getname+0x1b/0x30 [ 39.949970][ T644] ? x64_sys_call+0xe69/0x2ee0 [ 39.949982][ T644] ? do_syscall_64+0x57/0xf0 [ 39.949993][ T644] ? do_filp_open+0x440/0x440 [ 39.950005][ T644] do_filp_open+0x1f2/0x440 [ 39.950017][ T644] ? __cfi_do_filp_open+0x10/0x10 [ 39.950031][ T644] ? alloc_fd+0x4c1/0x570 [ 39.950041][ T644] do_sys_openat2+0x134/0x1d0 [ 39.950054][ T644] ? fput+0x1a4/0x230 [ 39.950065][ T644] ? do_sys_open+0x100/0x100 [ 39.950077][ T644] ? __cfi_ksys_write+0x10/0x10 [ 39.950087][ T644] __x64_sys_openat+0x13a/0x170 [ 39.950099][ T644] x64_sys_call+0xe69/0x2ee0 [ 39.950110][ T644] do_syscall_64+0x57/0xf0 [ 39.950120][ T644] ? clear_bhb_loop+0x50/0xa0 [ 39.950152][ T644] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 39.950177][ T644] RIP: 0033:0x7fc29a5a94d9 [ 39.950202][ T644] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 39.950218][ T644] RSP: 002b:00007fc29b3f4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 39.950235][ T644] RAX: ffffffffffffffda RBX: 00007fc29a825fa0 RCX: 00007fc29a5a94d9 [ 39.950243][ T644] RDX: 0000000000000000 RSI: 0000200000000480 RDI: ffffffffffffff9c [ 39.950251][ T644] RBP: 00007fc29a63804e R08: 0000000000000000 R09: 0000000000000000 [ 39.950258][ T644] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 39.950265][ T644] R13: 00007fc29a826038 R14: 00007fc29a825fa0 R15: 00007fffe6d9ab08 [ 39.950275][ T644] [ 40.309276][ T331] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 40.460321][ T331] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 40.472640][ T331] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 1.00 [ 40.481723][ T331] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.489747][ T331] usb 3-1: Product: syz [ 40.493903][ T331] usb 3-1: Manufacturer: syz [ 40.498481][ T331] usb 3-1: SerialNumber: syz [ 40.505275][ T331] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 40.511202][ T331] cdc_wdm 3-1:1.0: Unknown control protocol [ 40.672057][ T652] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 40.681873][ T652] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 40.688143][ T654] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 40.698573][ T655] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 40.707031][ T654] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 40.709361][ T655] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 40.849258][ T389] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 40.882218][ T331] usb 2-1: USB disconnect, device number 9 [ 40.909274][ T310] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 40.916056][ T660] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=46394 sclass=netlink_xfrm_socket pid=660 comm=syz.1.104 [ 41.025526][ T389] usb 4-1: Using ep0 maxpacket: 32 [ 41.032759][ T389] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 41.043990][ T389] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 41.055034][ T389] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 41.064329][ T389] usb 4-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 41.072829][ T389] usb 4-1: Product: syz [ 41.077095][ T389] usb 4-1: Manufacturer: syz [ 41.082704][ T310] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 41.095586][ T310] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 41.105791][ T668] FAULT_INJECTION: forcing a failure. [ 41.105791][ T668] name failslab, interval 1, probability 0, space 0, times 0 [ 41.107133][ T389] hub 4-1:4.0: USB hub found [ 41.123371][ T310] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 41.129695][ T668] CPU: 0 UID: 0 PID: 668 Comm: syz.1.106 Not tainted syzkaller #0 5676c8b0feefcba4e903dddff460827408f065be [ 41.129719][ T668] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 41.129730][ T668] Call Trace: [ 41.129736][ T668] [ 41.129742][ T668] __dump_stack+0x21/0x30 [ 41.129764][ T668] dump_stack_lvl+0x140/0x1c0 [ 41.129781][ T668] ? __cfi_dump_stack_lvl+0x10/0x10 [ 41.129798][ T668] ? kasan_save_alloc_info+0x3a/0x50 [ 41.129821][ T668] dump_stack+0x19/0x20 [ 41.129837][ T668] should_fail_ex+0x3c2/0x510 [ 41.129854][ T668] should_failslab+0xac/0x100 [ 41.129872][ T668] __kmalloc_node_noprof+0x69/0x500 [ 41.129897][ T668] ? __vmalloc_node_range_noprof+0x529/0x1300 [ 41.129921][ T668] __vmalloc_node_range_noprof+0x529/0x1300 [ 41.129947][ T668] ? kasan_save_alloc_info+0x3a/0x50 [ 41.129969][ T668] ? __cfi___vmalloc_node_range_noprof+0x10/0x10 [ 41.129992][ T668] ? kvm_set_memory_region+0x2f/0x50 [ 41.130009][ T668] ? kvm_vm_ioctl+0xb01/0xc40 [ 41.130025][ T668] ? __se_sys_ioctl+0x123/0x1b0 [ 41.130043][ T668] ? __x64_sys_ioctl+0x7f/0xa0 [ 41.130060][ T668] ? x64_sys_call+0x1878/0x2ee0 [ 41.130078][ T668] ? do_syscall_64+0x57/0xf0 [ 41.130096][ T668] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 41.130119][ T668] ? __vcalloc_noprof+0x3a/0x50 [ 41.130142][ T668] __vmalloc_noprof+0x104/0x1d0 [ 41.130164][ T668] ? __vcalloc_noprof+0x3a/0x50 [ 41.130187][ T668] ? __cfi___vmalloc_noprof+0x10/0x10 [ 41.130209][ T668] __vcalloc_noprof+0x3a/0x50 [ 41.130232][ T668] kvm_arch_prepare_memory_region+0x738/0xf80 [ 41.130254][ T668] kvm_set_memslot+0x59a/0x13a0 [ 41.130271][ T668] ? __kmalloc_cache_noprof+0x23c/0x470 [ 41.130296][ T668] __kvm_set_memory_region+0x7f7/0xb40 [ 41.130316][ T668] kvm_set_memory_region+0x2f/0x50 [ 41.130334][ T668] kvm_vm_ioctl+0xb01/0xc40 [ 41.130351][ T668] ? __cfi_kvm_vm_ioctl+0x10/0x10 [ 41.130366][ T668] ? cgroup_rstat_updated+0x144/0x800 [ 41.130391][ T668] ? ioctl_has_perm+0x1bc/0x500 [ 41.130407][ T668] ? __asan_memcpy+0x5a/0x80 [ 41.130431][ T668] ? ioctl_has_perm+0x408/0x500 [ 41.130450][ T668] ? selinux_file_ioctl+0x732/0x1480 [ 41.130475][ T668] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 41.130499][ T668] ? hook_file_ioctl+0x1ef/0x590 [ 41.130528][ T668] ? __cfi_handle_mm_fault+0x10/0x10 [ 41.130546][ T668] ? __cfi_hook_file_ioctl+0x10/0x10 [ 41.130569][ T668] ? __fget_files+0x2bc/0x330 [ 41.130588][ T668] ? bpf_lsm_file_ioctl+0xd/0x20 [ 41.130607][ T668] ? security_file_ioctl+0x3e/0x110 [ 41.130631][ T668] ? __cfi_kvm_vm_ioctl+0x10/0x10 [ 41.130647][ T668] __se_sys_ioctl+0x123/0x1b0 [ 41.130665][ T668] __x64_sys_ioctl+0x7f/0xa0 [ 41.130682][ T668] x64_sys_call+0x1878/0x2ee0 [ 41.130701][ T668] do_syscall_64+0x57/0xf0 [ 41.130718][ T668] ? clear_bhb_loop+0x50/0xa0 [ 41.130743][ T668] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 41.130765][ T668] RIP: 0033:0x7f175d1a916b [ 41.130780][ T668] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 41.130794][ T668] RSP: 002b:00007f175e045450 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 41.130813][ T668] RAX: ffffffffffffffda RBX: 0000200000fe8000 RCX: 00007f175d1a916b [ 41.130826][ T668] RDX: 00007f175e045bd0 RSI: 000000004020ae46 RDI: 000000000000000b [ 41.130838][ T668] RBP: 000000000000000b R08: 0000000000000001 R09: 0000000000000058 [ 41.130849][ T668] R10: 000000000000000b R11: 0000000000000246 R12: 00000000fec00000 [ 41.130860][ T668] R13: 00007f175e045bd0 R14: 0000200000fec000 R15: 0000000000000004 [ 41.130874][ T668] [ 41.131996][ T668] syz.1.106: vmalloc error: size 4096, failed to allocated page array size 8, mode:0x400dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null) [ 41.140300][ T310] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 41.163129][ T668] ,cpuset= [ 41.164212][ T310] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 41.173667][ T668] syz1 [ 41.178392][ T310] usb 5-1: Product: syz [ 41.193493][ T668] ,mems_allowed=0 [ 41.197221][ T310] usb 5-1: Manufacturer: syz [ 41.210788][ T668] [ 41.214408][ T310] usb 5-1: SerialNumber: syz [ 41.229116][ T668] CPU: 0 UID: 0 PID: 668 Comm: syz.1.106 Not tainted syzkaller #0 5676c8b0feefcba4e903dddff460827408f065be [ 41.229145][ T668] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 41.229156][ T668] Call Trace: [ 41.229161][ T668] [ 41.229168][ T668] __dump_stack+0x21/0x30 [ 41.229193][ T668] dump_stack_lvl+0x140/0x1c0 [ 41.229209][ T668] ? __cfi_dump_stack_lvl+0x10/0x10 [ 41.229228][ T668] dump_stack+0x19/0x20 [ 41.229243][ T668] warn_alloc+0x1e7/0x2c0 [ 41.229263][ T668] ? __kasan_check_write+0x18/0x20 [ 41.229288][ T668] ? __cfi_warn_alloc+0x10/0x10 [ 41.229308][ T668] ? __kasan_kmalloc+0x28/0xb0 [ 41.229326][ T668] ? __kmalloc_node_noprof+0x252/0x500 [ 41.229351][ T668] ? __vmalloc_node_range_noprof+0x529/0x1300 [ 41.229374][ T668] __vmalloc_node_range_noprof+0x65f/0x1300 [ 41.229401][ T668] ? kasan_save_alloc_info+0x3a/0x50 [ 41.229423][ T668] ? __cfi___vmalloc_node_range_noprof+0x10/0x10 [ 41.229445][ T668] ? kvm_set_memory_region+0x2f/0x50 [ 41.229463][ T668] ? kvm_vm_ioctl+0xb01/0xc40 [ 41.229478][ T668] ? __se_sys_ioctl+0x123/0x1b0 [ 41.229502][ T668] ? __x64_sys_ioctl+0x7f/0xa0 [ 41.229520][ T668] ? x64_sys_call+0x1878/0x2ee0 [ 41.229538][ T668] ? do_syscall_64+0x57/0xf0 [ 41.229556][ T668] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 41.229580][ T668] ? __vcalloc_noprof+0x3a/0x50 [ 41.229604][ T668] __vmalloc_noprof+0x104/0x1d0 [ 41.229626][ T668] ? __vcalloc_noprof+0x3a/0x50 [ 41.229648][ T668] ? __cfi___vmalloc_noprof+0x10/0x10 [ 41.229671][ T668] __vcalloc_noprof+0x3a/0x50 [ 41.229693][ T668] kvm_arch_prepare_memory_region+0x738/0xf80 [ 41.229715][ T668] kvm_set_memslot+0x59a/0x13a0 [ 41.229733][ T668] ? __kmalloc_cache_noprof+0x23c/0x470 [ 41.229758][ T668] __kvm_set_memory_region+0x7f7/0xb40 [ 41.229778][ T668] kvm_set_memory_region+0x2f/0x50 [ 41.229796][ T668] kvm_vm_ioctl+0xb01/0xc40 [ 41.229813][ T668] ? __cfi_kvm_vm_ioctl+0x10/0x10 [ 41.229829][ T668] ? cgroup_rstat_updated+0x144/0x800 [ 41.229853][ T668] ? ioctl_has_perm+0x1bc/0x500 [ 41.229869][ T668] ? __asan_memcpy+0x5a/0x80 [ 41.229893][ T668] ? ioctl_has_perm+0x408/0x500 [ 41.229911][ T668] ? selinux_file_ioctl+0x732/0x1480 [ 41.229936][ T668] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 41.229961][ T668] ? hook_file_ioctl+0x1ef/0x590 [ 41.229983][ T668] ? __cfi_handle_mm_fault+0x10/0x10 [ 41.230001][ T668] ? __cfi_hook_file_ioctl+0x10/0x10 [ 41.230025][ T668] ? __fget_files+0x2bc/0x330 [ 41.230042][ T668] ? bpf_lsm_file_ioctl+0xd/0x20 [ 41.230060][ T668] ? security_file_ioctl+0x3e/0x110 [ 41.230084][ T668] ? __cfi_kvm_vm_ioctl+0x10/0x10 [ 41.230100][ T668] __se_sys_ioctl+0x123/0x1b0 [ 41.230119][ T668] __x64_sys_ioctl+0x7f/0xa0 [ 41.230136][ T668] x64_sys_call+0x1878/0x2ee0 [ 41.230153][ T668] do_syscall_64+0x57/0xf0 [ 41.230170][ T668] ? clear_bhb_loop+0x50/0xa0 [ 41.230193][ T668] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 41.230215][ T668] RIP: 0033:0x7f175d1a916b [ 41.230230][ T668] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 41.230244][ T668] RSP: 002b:00007f175e045450 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 41.230263][ T668] RAX: ffffffffffffffda RBX: 0000200000fe8000 RCX: 00007f175d1a916b [ 41.230277][ T668] RDX: 00007f175e045bd0 RSI: 000000004020ae46 RDI: 000000000000000b [ 41.230288][ T668] RBP: 000000000000000b R08: 0000000000000001 R09: 0000000000000058 [ 41.230299][ T668] R10: 000000000000000b R11: 0000000000000246 R12: 00000000fec00000 [ 41.230311][ T668] R13: 00007f175e045bd0 R14: 0000200000fec000 R15: 0000000000000004 [ 41.230326][ T668] [ 41.234048][ T668] Mem-Info: [ 41.341084][ T310] hub 5-1:1.0: bad descriptor, ignoring hub [ 41.349234][ T668] active_anon:14692 inactive_anon:0 isolated_anon:0 [ 41.349234][ T668] active_file:15927 inactive_file:2310 isolated_file:0 [ 41.349234][ T668] unevictable:0 dirty:22 writeback:0 [ 41.349234][ T668] slab_reclaimable:5142 slab_unreclaimable:70527 [ 41.349234][ T668] mapped:32362 shmem:8290 pagetables:895 [ 41.349234][ T668] sec_pagetables:0 bounce:0 [ 41.349234][ T668] kernel_misc_reclaimable:0 [ 41.349234][ T668] free:1512642 free_pcp:8892 free_cma:0 [ 41.353688][ T310] hub 5-1:1.0: probe with driver hub failed with error -5 [ 41.353771][ T389] hub 4-1:4.0: 2 ports detected [ 41.357283][ T668] Node 0 active_anon:58768kB inactive_anon:0kB active_file:63708kB inactive_file:9240kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:129448kB dirty:88kB writeback:0kB shmem:33160kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:4788kB pagetables:3580kB sec_pagetables:0kB all_unreclaimable? no [ 41.367880][ T668] DMA32 free:2949972kB boost:0kB min:19052kB low:23812kB high:28572kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3145324kB managed:2954996kB mlocked:0kB bounce:0kB free_pcp:5024kB local_pcp:5024kB free_cma:0kB [ 41.546350][ T310] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 5 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 41.549683][ T668] lowmem_reserve[]: [ 41.610588][ T310] usb 5-1: USB disconnect, device number 5 [ 41.614531][ T668] 0 [ 41.622544][ T310] usblp0: removed [ 41.625978][ T668] 3920 3920 [ 41.626000][ T668] Normal free:3089372kB boost:0kB min:26000kB low:32500kB high:39000kB reserved_highatomic:0KB free_highatomic:0KB active_anon:88068kB inactive_anon:0kB active_file:67708kB inactive_file:9240kB unevictable:0kB writepending:88kB present:5242880kB managed:4014840kB mlocked:0kB bounce:0kB free_pcp:8020kB local_pcp:7780kB free_cma:0kB [ 42.097658][ T668] lowmem_reserve[]: 0 0 0 [ 42.102340][ T668] DMA32: 5*4kB (M) 2*8kB (M) 3*16kB (M) 6*32kB (M) 5*64kB (M) 4*128kB (M) 5*256kB (M) 5*512kB (M) 4*1024kB (UM) 4*2048kB (M) 716*4096kB (M) = 2949972kB [ 42.118259][ T668] Normal: 53*4kB (UM) 335*8kB (U) 80*16kB (UME) 2*32kB (ME) 7*64kB (U) 0*128kB 18*256kB (UM) 8*512kB (ME) 3*1024kB (ME) 9*2048kB (UME) 745*4096kB (M) = 3086412kB [ 42.134858][ T668] 34879 total pagecache pages [ 42.140750][ T668] 0 pages in swap cache [ 42.144970][ T668] Free swap = 124780kB [ 42.148348][ T676] ./dev/sda1: Can't lookup blockdev [ 42.149163][ T668] Total swap = 124996kB [ 42.158773][ T668] 2097051 pages RAM [ 42.162773][ T668] 0 pages HighMem/MovableOnly [ 42.167637][ T668] 354592 pages reserved [ 42.172004][ T668] 0 pages cma reserved [ 42.178360][ T668] Memory allocations: [ 42.182660][ T668] 0 B 0 init/main.c:1477 func:do_initcalls [ 42.183311][ T682] futex_wake_op: syz.4.108 tries to shift op by 144; fix this program [ 42.190070][ T668] 0 B 0 init/do_mounts.c:186 func:mount_root_generic [ 42.206043][ T389] usb 4-1: USB disconnect, device number 13 [ 42.218157][ T668] 0 B 0 init/do_mounts.c:158 func:do_mount_root [ 42.230208][ T668] 0 B 0 init/do_mounts.c:352 func:mount_nodev_root [ 42.238130][ T668] 0 B 0 init/do_mounts_rd.c:241 func:rd_load_image [ 42.259224][ T668] 0 B 0 init/do_mounts_rd.c:72 func:identify_ramdisk_image [ 42.267840][ T668] 0 B 0 init/initramfs.c:507 func:unpack_to_rootfs [ 42.275935][ T668] 0 B 0 init/initramfs.c:508 func:unpack_to_rootfs [ 42.283881][ T668] 0 B 0 init/initramfs.c:509 func:unpack_to_rootfs [ 42.292044][ T36] kauditd_printk_skb: 11 callbacks suppressed [ 42.292057][ T36] audit: type=1400 audit(1794600995.749:251): avc: denied { create } for pid=687 comm="syz.4.109" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 42.298496][ T668] 0 B 0 init/initramfs.c:101 func:find_link [ 42.332506][ T36] audit: type=1400 audit(1794600995.789:252): avc: denied { read } for pid=687 comm="syz.4.109" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 42.554501][ T36] audit: type=1400 audit(1794600996.009:253): avc: denied { remount } for pid=693 comm="syz.1.111" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 42.617300][ T389] usb 3-1: USB disconnect, device number 5 [ 42.758737][ T701] kvm_intel: kvm [700]: vcpu0, guest rIP: 0x0 Unhandled WRMSR(0x1d9) = 0x75 [ 42.822413][ T36] audit: type=1400 audit(1794600996.279:254): avc: denied { name_bind } for pid=705 comm="syz.3.115" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 42.929282][ T389] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 43.049244][ T310] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 43.080317][ T389] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 43.091271][ T389] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 43.101797][ T389] usb 3-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 43.110918][ T389] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 43.119579][ T389] usb 3-1: config 0 descriptor?? [ 43.199235][ T310] usb 4-1: Using ep0 maxpacket: 32 [ 43.205444][ T310] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 43.216397][ T310] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 43.226164][ T310] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 43.235210][ T310] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 43.243756][ T310] usb 4-1: config 0 descriptor?? [ 43.249681][ T310] hub 4-1:0.0: USB hub found [ 43.354518][ T712] ./dev/sda1: Can't lookup blockdev [ 43.449513][ T706] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 43.457978][ T706] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 43.466079][ T706] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 43.474573][ T706] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 43.482718][ T706] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 43.491181][ T706] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 43.499275][ T706] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 43.507811][ T706] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 43.515909][ T706] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 43.524422][ T706] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 43.534994][ T389] cp2112 0003:10C4:EA90.0008: unknown main item tag 0x0 [ 43.542599][ T389] cp2112 0003:10C4:EA90.0008: unknown main item tag 0x0 [ 43.549645][ T389] cp2112 0003:10C4:EA90.0008: unknown main item tag 0x0 [ 43.556703][ T389] cp2112 0003:10C4:EA90.0008: unknown main item tag 0x0 [ 43.563722][ T389] cp2112 0003:10C4:EA90.0008: unknown main item tag 0x0 [ 43.570753][ T389] cp2112 0003:10C4:EA90.0008: unknown main item tag 0x0 [ 43.577733][ T389] cp2112 0003:10C4:EA90.0008: unknown main item tag 0x0 [ 43.588541][ T389] cp2112 0003:10C4:EA90.0008: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.2-1/input0 [ 43.631213][ T310] hub 4-1:0.0: config failed, can't read hub descriptor (err -22) [ 43.640328][ T310] usbhid 4-1:0.0: can't add hid device: -71 [ 43.646276][ T310] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 43.670043][ T310] usb 4-1: USB disconnect, device number 14 [ 43.732775][ T389] cp2112 0003:10C4:EA90.0008: Part Number: 0x00 Device Version: 0x00 [ 43.934176][ T389] cp2112 0003:10C4:EA90.0008: error requesting SMBus config [ 43.941894][ T389] cp2112 0003:10C4:EA90.0008: probe with driver cp2112 failed with error -32 [ 44.223120][ T36] audit: type=1400 audit(1794600997.679:255): avc: denied { create } for pid=721 comm="syz.1.120" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 44.243769][ T36] audit: type=1400 audit(1794600997.679:256): avc: denied { read } for pid=721 comm="syz.1.120" name="file0" dev="tmpfs" ino=248 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 44.265774][ T36] audit: type=1400 audit(1794600997.679:257): avc: denied { open } for pid=721 comm="syz.1.120" path="/37/file0" dev="tmpfs" ino=248 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 44.288232][ T36] audit: type=1400 audit(1794600997.679:258): avc: denied { ioctl } for pid=721 comm="syz.1.120" path="/37/file0" dev="tmpfs" ino=248 ioctlcmd=0x125d scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 44.369263][ T389] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 44.520334][ T389] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 44.531263][ T389] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 44.541019][ T389] usb 4-1: New USB device found, idVendor=04d8, idProduct=c002, bcdDevice= 0.00 [ 44.550063][ T389] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 44.729634][ T36] audit: type=1400 audit(1794600998.189:259): avc: denied { unlink } for pid=294 comm="syz-executor" name="file0" dev="tmpfs" ino=248 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 44.960865][ T718] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 44.969468][ T718] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 44.989323][ T313] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 45.081181][ T389] usbhid 4-1:1.0: can't add hid device: -71 [ 45.087130][ T389] usbhid 4-1:1.0: probe with driver usbhid failed with error -71 [ 45.095800][ T389] usb 4-1: USB disconnect, device number 15 [ 45.149620][ T313] usb 2-1: too many configurations: 151, using maximum allowed: 8 [ 45.158229][ T313] usb 2-1: config 0 interface 0 has no altsetting 0 [ 45.165510][ T313] usb 2-1: config 0 interface 0 has no altsetting 0 [ 45.172805][ T313] usb 2-1: config 0 interface 0 has no altsetting 0 [ 45.180532][ T313] usb 2-1: config 0 interface 0 has no altsetting 0 [ 45.187773][ T313] usb 2-1: config 0 interface 0 has no altsetting 0 [ 45.195106][ T313] usb 2-1: config 0 interface 0 has no altsetting 0 [ 45.202393][ T313] usb 2-1: config 0 interface 0 has no altsetting 0 [ 45.209746][ T313] usb 2-1: config 0 interface 0 has no altsetting 0 [ 45.217715][ T313] usb 2-1: New USB device found, idVendor=04d8, idProduct=0082, bcdDevice=ce.b7 [ 45.226876][ T313] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=130 [ 45.235052][ T313] usb 2-1: Product: syz [ 45.239255][ T313] usb 2-1: Manufacturer: syz [ 45.243927][ T313] usb 2-1: SerialNumber: syz [ 45.248971][ T313] usb 2-1: config 0 descriptor?? [ 45.457174][ T331] usb 2-1: USB disconnect, device number 10 [ 45.595307][ T36] audit: type=1400 audit(1794600999.049:260): avc: denied { write } for pid=730 comm="syz.3.122" name="binder0" dev="binder" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 45.634678][ T331] usb 3-1: USB disconnect, device number 6 [ 45.648369][ T737] ./dev/sda1: Can't lookup blockdev [ 45.865820][ T749] syz.3.129 uses obsolete (PF_INET,SOCK_PACKET) [ 46.009288][ T331] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 46.160283][ T331] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 46.170205][ T331] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 46.179969][ T331] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 46.190883][ T331] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 46.200644][ T331] usb 3-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 46.209712][ T331] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 46.218568][ T744] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 46.226147][ T744] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 46.233966][ T331] pl2303 3-1:1.0: pl2303 converter detected [ 46.240781][ T331] usb 3-1: pl2303 converter now attached to ttyUSB0 [ 46.656354][ T758] netlink: 'syz.3.131': attribute type 63 has an invalid length. [ 46.664145][ T758] netlink: 5 bytes leftover after parsing attributes in process `syz.3.131'. [ 46.673096][ T758] gretap0: entered allmulticast mode [ 46.678534][ T758] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 47.172974][ T771] FAULT_INJECTION: forcing a failure. [ 47.172974][ T771] name failslab, interval 1, probability 0, space 0, times 0 [ 47.185749][ T771] CPU: 1 UID: 0 PID: 771 Comm: syz.2.127 Not tainted syzkaller #0 5676c8b0feefcba4e903dddff460827408f065be [ 47.185783][ T771] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 47.185797][ T771] Call Trace: [ 47.185804][ T771] [ 47.185813][ T771] __dump_stack+0x21/0x30 [ 47.185841][ T771] dump_stack_lvl+0x140/0x1c0 [ 47.185861][ T771] ? __cfi_dump_stack_lvl+0x10/0x10 [ 47.185882][ T771] ? _raw_spin_trylock+0xb5/0x140 [ 47.185906][ T771] dump_stack+0x19/0x20 [ 47.185924][ T771] should_fail_ex+0x3c2/0x510 [ 47.185945][ T771] should_failslab+0xac/0x100 [ 47.185968][ T771] __kmalloc_node_noprof+0x69/0x500 [ 47.185999][ T771] ? __kvmalloc_node_noprof+0x128/0x300 [ 47.186029][ T771] __kvmalloc_node_noprof+0x128/0x300 [ 47.186056][ T771] ? __cfi___kvmalloc_node_noprof+0x10/0x10 [ 47.186081][ T771] ? __call_rcu_common+0x53c/0x710 [ 47.186112][ T771] nf_hook_entries_grow+0x284/0x740 [ 47.186140][ T771] ? mutex_lock+0x97/0x1d0 [ 47.186166][ T771] __nf_register_net_hook+0x225/0x820 [ 47.186195][ T771] nf_register_net_hook+0xbf/0x1b0 [ 47.186222][ T771] nf_register_net_hooks+0x4b/0x1c0 [ 47.186249][ T771] ip6t_register_table+0x522/0x7d0 [ 47.186276][ T771] ? ip6t_alloc_initial_table+0x4c8/0x8d0 [ 47.186305][ T771] ? __cfi_ip6t_register_table+0x10/0x10 [ 47.186336][ T771] ip6table_mangle_table_init+0x45/0x70 [ 47.186355][ T771] xt_find_table_lock+0x36c/0x460 [ 47.186384][ T771] do_ip6t_get_ctl+0x632/0x1210 [ 47.186413][ T771] ? __cfi_do_ip6t_get_ctl+0x10/0x10 [ 47.186442][ T771] ? __asan_set_shadow_00+0x12/0x20 [ 47.186467][ T771] ? do_ipv6_getsockopt+0x109c/0x1fd0 [ 47.186496][ T771] ? __cfi_do_ipv6_getsockopt+0x10/0x10 [ 47.186524][ T771] ? schedule+0xc1/0x170 [ 47.186547][ T771] ? futex_unqueue+0x136/0x160 [ 47.186568][ T771] ? avc_has_perm_noaudit+0x26b/0x360 [ 47.186601][ T771] ? __asan_memcpy+0x5a/0x80 [ 47.186630][ T771] ? avc_has_perm_noaudit+0x289/0x360 [ 47.186654][ T771] ? __kasan_check_write+0x18/0x20 [ 47.186683][ T771] ? mutex_unlock+0x90/0x240 [ 47.186708][ T771] ? __cfi_mutex_unlock+0x10/0x10 [ 47.186737][ T771] ? futex_wake+0x627/0x950 [ 47.186763][ T771] nf_getsockopt+0x288/0x2b0 [ 47.186784][ T771] ipv6_getsockopt+0x203/0x2b0 [ 47.186812][ T771] ? __cfi_ipv6_getsockopt+0x10/0x10 [ 47.186841][ T771] udpv6_getsockopt+0x7e/0x90 [ 47.186863][ T771] sock_common_getsockopt+0xaf/0xd0 [ 47.186885][ T771] ? __cfi_sock_common_getsockopt+0x10/0x10 [ 47.186905][ T771] do_sock_getsockopt+0x3a1/0x6c0 [ 47.186933][ T771] ? __cfi_do_sock_getsockopt+0x10/0x10 [ 47.186959][ T771] ? fpu_flush_thread+0x2d0/0x340 [ 47.186985][ T771] ? __fget_files+0x2bc/0x330 [ 47.187008][ T771] __x64_sys_getsockopt+0x1aa/0x250 [ 47.187034][ T771] ? fpu_flush_thread+0x2d0/0x340 [ 47.187059][ T771] ? fpu_flush_thread+0x2d0/0x340 [ 47.187086][ T771] x64_sys_call+0x10db/0x2ee0 [ 47.187108][ T771] do_syscall_64+0x57/0xf0 [ 47.187129][ T771] ? clear_bhb_loop+0x50/0xa0 [ 47.187155][ T771] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 47.187182][ T771] RIP: 0033:0x7fd4f39a94d9 [ 47.187199][ T771] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 47.187216][ T771] RSP: 002b:00007fd4f481a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 47.187239][ T771] RAX: ffffffffffffffda RBX: 00007fd4f3c26180 RCX: 00007fd4f39a94d9 [ 47.187255][ T771] RDX: 0000000000000041 RSI: 0000000000000029 RDI: 000000000000000d [ 47.187268][ T771] RBP: 00007fd4f3a3804e R08: 0000200000002a40 R09: 0000000000000000 [ 47.187284][ T771] R10: 0000200000000140 R11: 0000000000000246 R12: 0000000000000000 [ 47.187297][ T771] R13: 00007fd4f3c26218 R14: 00007fd4f3c26180 R15: 00007ffe61025f88 [ 47.187315][ T771] [ 47.660870][ T776] : renamed from lo [ 47.677720][ T782] ./dev/sda1: Can't lookup blockdev [ 47.780331][ T36] kauditd_printk_skb: 3 callbacks suppressed [ 47.780349][ T36] audit: type=1400 audit(1794601001.239:264): avc: denied { mounton } for pid=791 comm="syz.1.139" path="/44/dev" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=dir permissive=1 [ 47.780480][ T792] 9pnet_fd: p9_fd_create_unix (792): problem connecting socket: ./sys: -111 [ 47.909263][ T331] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 48.060320][ T331] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 48.071277][ T331] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 48.081042][ T331] usb 4-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 48.090191][ T331] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 48.098663][ T331] usb 4-1: config 0 descriptor?? [ 48.103744][ T10] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 48.260592][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 48.268971][ T10] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 64 [ 48.280138][ T10] usb 2-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 0.40 [ 48.289259][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 48.297261][ T10] usb 2-1: Product: syz [ 48.301486][ T10] usb 2-1: Manufacturer: syz [ 48.306082][ T10] usb 2-1: SerialNumber: syz [ 48.311558][ T797] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 48.521236][ T36] audit: type=1400 audit(1794601001.979:265): avc: denied { cmd } for pid=796 comm="iou-wrk-797" path="socket:[8596]" dev="sockfs" ino=8596 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 48.523800][ T331] cp2112 0003:10C4:EA90.0009: unknown main item tag 0x0 [ 48.569242][ T331] cp2112 0003:10C4:EA90.0009: unknown main item tag 0x0 [ 48.576254][ T331] cp2112 0003:10C4:EA90.0009: unknown main item tag 0x0 [ 48.583251][ T331] cp2112 0003:10C4:EA90.0009: unknown main item tag 0x0 [ 48.599238][ T331] cp2112 0003:10C4:EA90.0009: unknown main item tag 0x0 [ 48.606260][ T331] cp2112 0003:10C4:EA90.0009: unknown main item tag 0x0 [ 48.613267][ T331] cp2112 0003:10C4:EA90.0009: unknown main item tag 0x0 [ 48.621308][ T331] cp2112 0003:10C4:EA90.0009: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.3-1/input0 [ 48.651569][ T10] usb 2-1: MIDIStreaming interface descriptor not found [ 48.663549][ T10] usb 2-1: USB disconnect, device number 11 [ 48.673401][ T330] udevd[330]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 48.713781][ T389] usb 3-1: USB disconnect, device number 7 [ 48.722789][ T331] cp2112 0003:10C4:EA90.0009: Part Number: 0x00 Device Version: 0x00 [ 48.731561][ T389] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 48.739605][ T389] pl2303 3-1:1.0: device disconnected [ 48.767440][ T36] audit: type=1400 audit(1794601002.219:266): avc: granted { setsecparam } for pid=808 comm="syz.2.141" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security [ 48.922824][ T331] cp2112 0003:10C4:EA90.0009: error requesting SMBus config [ 48.930577][ T331] cp2112 0003:10C4:EA90.0009: probe with driver cp2112 failed with error -32 [ 49.149319][ T389] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 49.166482][ T36] audit: type=1400 audit(1794601002.619:267): avc: denied { append } for pid=813 comm="syz.1.143" name="control" dev="devtmpfs" ino=198 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 49.191081][ T36] audit: type=1400 audit(1794601002.629:268): avc: denied { read } for pid=813 comm="syz.1.143" name="snapshot" dev="devtmpfs" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 49.213817][ T36] audit: type=1400 audit(1794601002.629:269): avc: denied { open } for pid=813 comm="syz.1.143" path="/dev/snapshot" dev="devtmpfs" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 49.237060][ T36] audit: type=1400 audit(1794601002.679:270): avc: denied { ioctl } for pid=813 comm="syz.1.143" path="/dev/snapshot" dev="devtmpfs" ino=21 ioctlcmd=0x6f01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 49.301112][ T389] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 92, changing to 7 [ 49.318029][ T389] usb 3-1: New USB device found, idVendor=0e41, idProduct=4642, bcdDevice= 0.40 [ 49.318152][ T829] ./dev/sda1: Can't lookup blockdev [ 49.327187][ T389] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 49.340409][ T389] usb 3-1: Product: syz [ 49.344585][ T389] usb 3-1: Manufacturer: syz [ 49.349230][ T389] usb 3-1: SerialNumber: syz [ 49.432471][ T331] usb 4-1: USB disconnect, device number 16 [ 49.458389][ T834] size and base must be multiples of 4 kiB [ 49.459230][ T36] audit: type=1400 audit(1794601002.909:271): avc: denied { read write } for pid=833 comm="syz.1.150" name="mtrr" dev="proc" ino=4026532004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 49.465061][ T834] CPU: 1 UID: 0 PID: 834 Comm: syz.1.150 Not tainted syzkaller #0 5676c8b0feefcba4e903dddff460827408f065be [ 49.465087][ T834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 49.465099][ T834] Call Trace: [ 49.465104][ T834] [ 49.465111][ T834] __dump_stack+0x21/0x30 [ 49.465134][ T834] dump_stack_lvl+0x140/0x1c0 [ 49.465153][ T834] ? __cfi_dump_stack_lvl+0x10/0x10 [ 49.465170][ T834] dump_stack+0x19/0x20 [ 49.465185][ T834] mtrr_del+0xcd/0xf0 [ 49.465207][ T834] mtrr_ioctl+0xbf8/0x1170 [ 49.465230][ T834] ? __cfi_mtrr_ioctl+0x10/0x10 [ 49.465254][ T834] ? __fget_files+0x2bc/0x330 [ 49.465273][ T834] ? __cfi_mtrr_ioctl+0x10/0x10 [ 49.465295][ T834] proc_reg_unlocked_ioctl+0x1f3/0x2f0 [ 49.465321][ T834] ? __cfi_proc_reg_unlocked_ioctl+0x10/0x10 [ 49.465345][ T834] __se_sys_ioctl+0x123/0x1b0 [ 49.465364][ T834] __x64_sys_ioctl+0x7f/0xa0 [ 49.465382][ T834] x64_sys_call+0x1878/0x2ee0 [ 49.465400][ T834] do_syscall_64+0x57/0xf0 [ 49.465419][ T834] ? clear_bhb_loop+0x50/0xa0 [ 49.465478][ T834] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 49.465502][ T834] RIP: 0033:0x7f175d1a94d9 [ 49.465517][ T834] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 49.465533][ T834] RSP: 002b:00007f175e068028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 49.465552][ T834] RAX: ffffffffffffffda RBX: 00007f175d425fa0 RCX: 00007f175d1a94d9 [ 49.465566][ T834] RDX: 0000200000000140 RSI: 0000000040104d04 RDI: 0000000000000003 [ 49.465578][ T834] RBP: 00007f175d23804e R08: 0000000000000000 R09: 0000000000000000 [ 49.465590][ T834] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 49.465601][ T834] R13: 00007f175d426038 R14: 00007f175d425fa0 R15: 00007fff73343448 [ 49.465616][ T834] [ 49.490485][ T841] size and base must be multiples of 4 kiB [ 49.500202][ T36] audit: type=1400 audit(1794601002.909:272): avc: denied { open } for pid=833 comm="syz.1.150" path="/48/proc/mtrr" dev="proc" ino=4026532004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 49.529223][ T841] CPU: 1 UID: 0 PID: 841 Comm: syz.1.150 Not tainted syzkaller #0 5676c8b0feefcba4e903dddff460827408f065be [ 49.529253][ T841] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 49.529265][ T841] Call Trace: [ 49.529273][ T841] [ 49.529281][ T841] __dump_stack+0x21/0x30 [ 49.529304][ T841] dump_stack_lvl+0x140/0x1c0 [ 49.529320][ T841] ? __cfi_dump_stack_lvl+0x10/0x10 [ 49.529336][ T841] ? handle_mm_fault+0x16fe/0x1ba0 [ 49.529357][ T841] dump_stack+0x19/0x20 [ 49.529372][ T841] mtrr_del+0xcd/0xf0 [ 49.529393][ T841] mtrr_ioctl+0xbf8/0x1170 [ 49.529415][ T841] ? __kasan_check_write+0x18/0x20 [ 49.529447][ T841] ? __cfi_mtrr_ioctl+0x10/0x10 [ 49.529468][ T841] ? recalc_sigpending+0x16c/0x1d0 [ 49.529490][ T841] ? _raw_spin_unlock_irq+0x45/0x70 [ 49.529511][ T841] ? __fget_files+0x2bc/0x330 [ 49.529529][ T841] ? __cfi_mtrr_ioctl+0x10/0x10 [ 49.529551][ T841] proc_reg_unlocked_ioctl+0x1f3/0x2f0 [ 49.529577][ T841] ? __cfi_proc_reg_unlocked_ioctl+0x10/0x10 [ 49.529601][ T841] __se_sys_ioctl+0x123/0x1b0 [ 49.529621][ T841] __x64_sys_ioctl+0x7f/0xa0 [ 49.529639][ T841] x64_sys_call+0x1878/0x2ee0 [ 49.529657][ T841] do_syscall_64+0x57/0xf0 [ 49.529674][ T841] ? clear_bhb_loop+0x50/0xa0 [ 49.529698][ T841] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 49.529720][ T841] RIP: 0033:0x7f175d1a94d9 [ 49.529735][ T841] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 49.529750][ T841] RSP: 002b:00007f175df81028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 49.529769][ T841] RAX: ffffffffffffffda RBX: 00007f175d426630 RCX: 00007f175d1a94d9 [ 49.529783][ T841] RDX: 0000200000000140 RSI: 0000000040104d04 RDI: 0000000000000003 [ 49.529794][ T841] RBP: 00007f175d23804e R08: 0000000000000000 R09: 0000000000000000 [ 49.529806][ T841] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 49.529817][ T841] R13: 00007f175d4266c8 R14: 00007f175d426630 R15: 00007fff73343448 [ 49.529833][ T841] [ 49.569152][ T389] usb 3-1: Audio class v2/v3 interfaces need an interface association [ 49.581099][ T36] audit: type=1400 audit(1794601002.909:273): avc: denied { ioctl } for pid=833 comm="syz.1.150" path="/48/proc/mtrr" dev="proc" ino=4026532004 ioctlcmd=0x4d04 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 49.640782][ T389] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 49.955361][ T389] usb 3-1: USB disconnect, device number 8 [ 49.976528][ T318] udevd[318]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 49.999408][ T851] input: syz0 as /devices/virtual/input/input10 [ 50.109743][ T854] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 50.118265][ T854] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 50.126484][ T854] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 50.135360][ T854] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 50.209254][ T331] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 50.349261][ T310] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 50.360281][ T331] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 50.371358][ T331] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 50.381102][ T331] usb 4-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 50.390152][ T331] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 50.398651][ T331] usb 4-1: config 0 descriptor?? [ 50.500313][ T310] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 37, changing to 7 [ 50.511253][ T310] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 115, changing to 7 [ 50.523688][ T310] usb 2-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 50.532765][ T310] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 50.540776][ T310] usb 2-1: Product: syz [ 50.545027][ T310] usb 2-1: Manufacturer: syz [ 50.549677][ T310] usb 2-1: SerialNumber: syz SYZFAIL: SIGBUS pc-offset:0xffffffffffedc109 pc:0x7f8d56f78607 addr:0x7f8d52605000 code=2 (errno 11: Resource temporarily unavailable) [ 50.646527][ T863] ./dev/sda1: Can't lookup blockdev [ 50.831799][ T12] bridge_slave_1: left allmulticast mode [ 50.832010][ T331] usbhid 4-1:0.0: can't add hid device: -71 [ 50.837489][ T12] bridge_slave_1: left promiscuous mode [ 50.849585][ T331] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 50.849886][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.867358][ T12] bridge_slave_0: left allmulticast mode [ 50.876428][ T331] usb 4-1: USB disconnect, device number 17 [ 50.881610][ T12] bridge_slave_0: left promiscuous mode [ 50.887960][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.938942][ T310] usb 2-1: USB disconnect, device number 12 [ 51.021563][ T12] veth1_macvtap: left promiscuous mode [ 51.027058][ T12] veth0_vlan: left promiscuous mode [ 51.260605][ T12] bridge_slave_1: left allmulticast mode [ 51.266269][ T12] bridge_slave_1: left promiscuous mode [ 51.271930][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.279385][ T12] bridge_slave_0: left allmulticast mode [ 51.285009][ T12] bridge_slave_0: left promiscuous mode [ 51.290638][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.298126][ T12] bridge_slave_1: left allmulticast mode [ 51.303833][ T12] bridge_slave_1: left promiscuous mode [ 51.309447][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.316789][ T12] bridge_slave_0: left allmulticast mode [ 51.322523][ T12] bridge_slave_0: left promiscuous mode [ 51.328099][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.471846][ T12] veth1_macvtap: left promiscuous mode [ 51.477343][ T12] veth0_vlan: left promiscuous mode [ 51.482845][ T12] veth1_macvtap: left promiscuous mode [ 51.488320][ T12] veth0_vlan: left promiscuous mode [ 52.000838][ T309] bridge_slave_1: left allmulticast mode [ 52.006491][ T309] bridge_slave_1: left promiscuous mode [ 52.012122][ T309] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.019538][ T309] bridge_slave_0: left allmulticast mode [ 52.025167][ T309] bridge_slave_0: left promiscuous mode [ 52.030881][ T309] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.110830][ T309] veth1_macvtap: left promiscuous mode [ 52.116354][ T309] veth0_vlan: left promiscuous mode