last executing test programs: 1m36.207431166s ago: executing program 1 (id=529): openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x6) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r0, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f0000000140)="66baf80cb8044fdc87efed660f388059e0b805000000b91e4200000f01c10f20c035000000200f22c0f20fa20f01cb36263e660f381efc660f7c150c000000b805000000b9210000000f01c1c4e17929d8", 0x51}], 0x1, 0x11, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x40, @remote, 0x1}, 0xfffffffffffffd53) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x7, 0x4, 0x6, 0xfffa}, 0x1d, [0x6, 0xc95a, 0xfffffff3, 0x9, 0x7f, 0x4000002, 0x1, 0x7f, 0x6, 0xfffffff9, 0xfffffff2, 0x5f, 0xa, 0x3, 0xffff2d37, 0x1dd2, 0x6, 0x7, 0x0, 0x80000001, 0x4, 0x7, 0x3, 0x3c5b, 0x1, 0x24, 0xffffffff, 0x100, 0x1f461e2c, 0x1, 0xe661, 0x4, 0x9, 0x3, 0x7fff, 0x4c74, 0x8f01, 0x642, 0x3, 0xa, 0x0, 0x71, 0x7, 0x7, 0x103, 0x0, 0x7, 0x3c, 0x91, 0x6, 0xfffffffd, 0x3, 0x5, 0x4, 0x8, 0x0, 0x82, 0x0, 0x5, 0x6, 0x8, 0x6, 0x1, 0x40], [0x10000007, 0x8, 0x5, 0x8000, 0x0, 0x8, 0x129432e2, 0x40000cb, 0xf6, 0xb, 0xbf, 0x6c9, 0x9, 0xfffffffe, 0x7, 0x0, 0x7, 0x5, 0x2f, 0xe, 0x3, 0x78, 0xea4, 0x73b, 0x4, 0x4000, 0x108000, 0x9, 0x400, 0x1, 0x6, 0xfffffffd, 0xff, 0x1005, 0x7f, 0x5f31, 0x4, 0x0, 0x6, 0x2, 0x9, 0x20000004, 0x100009, 0x6, 0x9, 0x40000006, 0x5, 0x0, 0x0, 0xf, 0xffff, 0x2, 0x7f, 0x9, 0x5, 0x10003, 0x4, 0x1, 0x7, 0xb, 0x9, 0x48c93690, 0x3, 0x102], [0x7, 0x4, 0x0, 0x64e, 0xfffffdfe, 0x7fffffff, 0x40008ce, 0x9, 0x1, 0x1, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x6, 0x5, 0x5, 0x86, 0x3, 0x10000009, 0x3e7, 0xfff, 0x5, 0x2, 0x2, 0xf, 0x8, 0x4, 0x6d01, 0x5, 0x3b, 0x3, 0x1fd, 0x80, 0x3, 0x4, 0x2, 0x0, 0x4ccd, 0x7, 0x53cf697b, 0x7, 0x6, 0x54fe12d6, 0xbf, 0x200, 0x3, 0x400002, 0xfffffff9, 0x0, 0x6, 0x5, 0x0, 0x3, 0xfffffffb, 0x120000, 0x3, 0x6, 0x9, 0x0, 0x3], [0x9, 0xbb2f, 0x3, 0x7, 0x5, 0x938, 0x6, 0x6, 0xfffffffd, 0x5, 0xce7, 0x1ff, 0x6, 0x8af, 0x5, 0x3, 0x101, 0x10000, 0x6, 0x7fff, 0x8ffff, 0xa620, 0x2, 0x8001, 0x6, 0x7, 0x14c, 0x60a7, 0x6, 0x1, 0xffffffff, 0x7ffffffe, 0x4f, 0x8, 0x0, 0x3, 0x3, 0xffff, 0x3, 0x9, 0xfe, 0x9602, 0xa, 0x97f, 0x2000001, 0x6, 0x1, 0x10000, 0x2, 0x8, 0x2b91, 0x4, 0x8, 0x9, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x203, 0xffff3441, 0xfff]}, 0x45c) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001c0021ef00000000000000000700000016fff0000200fc000a0002"], 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x50) 1m36.138678648s ago: executing program 1 (id=531): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) timerfd_create(0x9, 0x800) socket$inet6(0xa, 0x3, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000006a40)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000001fc0)=""/4096, 0x1000}, {&(0x7f0000000b00)=""/113, 0x71}, {&(0x7f0000000300)=""/45, 0x2d}, {&(0x7f0000000000)=""/104, 0x68}, {&(0x7f0000003740)=""/40, 0x28}, {&(0x7f0000000b80)=""/4106, 0x100a}], 0x6}, 0x8}, {{0x0, 0x0, 0x0}}], 0x2, 0x120, 0x0) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_9p2000}]}}) write$P9_RVERSION(r3, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r2, @ANYRESHEX=r3], 0x15) 1m36.038266352s ago: executing program 1 (id=533): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, &(0x7f0000000100)={0x3, r0, 'id1\x00'}) ioctl$USBDEVFS_CONNECTINFO(r1, 0x40085511, &(0x7f0000000180)) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x4c}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000000000/0x800000)=nil, 0x800000}, 0x1}) ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000790000/0x4000)=nil, 0x4000}) mremap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x400000, 0x3, &(0x7f0000c00000/0x400000)=nil) close_range(r0, 0xffffffffffffffff, 0x10000000000000) close(r1) ioctl$PTP_PEROUT_REQUEST2(r1, 0x40383d0c, &(0x7f0000000040)={{0xc, 0x59}, {0xf, 0x96}, 0x3, 0x1}) 1m35.886513547s ago: executing program 1 (id=535): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000300)=[@text32={0x20, 0x0}], 0x1, 0x31, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) clock_settime(0xa, 0x0) r4 = dup(0xffffffffffffffff) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r3, &(0x7f0000000100)={@val={0x8, 0x800}, @val={0x5, 0x0, 0x0, 0x0, 0x14}, @ipv4=@tcp={{0x7, 0x4, 0x2, 0x8, 0x30, 0x67, 0x0, 0xb, 0x6, 0x0, @private=0xa010100, @dev={0xac, 0x14, 0x14, 0x19}, {[@cipso={0x86, 0x6, 0x1}]}}, {{0x4e1d, 0x4e24, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x8, 0x5, 0x0, 0xefff}}}}, 0x3e) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x1}) r5 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) r6 = openat$ttynull(0xffffffffffffff9c, &(0x7f00000019c0), 0x22000, 0x0) r7 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201cc19000000087d1e502d000000000001090224000100000020090400080903000000092104000c01222800090581030004010bfe6cec4af3bbad0d1785fc280b8470587107be94e20c2bdfd0009413b8a975f523916d82c5aebc95c99aa923ead5672a7279e0b1fcc15fe6753113ef7d5f167af04c45639563a4aa"], 0x0) syz_usb_control_io$hid(r7, 0x0, 0x0) r8 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$KVM_CLEAR_DIRTY_LOG(r8, 0xc018aec0, &(0x7f0000003080)={0x103ff, 0x2c0, 0x380, &(0x7f0000002c80)=[0x3ff, 0xe7d7, 0x7, 0x100, 0x8000000000000001, 0x8, 0x8, 0x6, 0x10000, 0x7, 0xffffffff, 0xf7c, 0x2, 0xc41, 0x5, 0x7, 0x10000, 0x7f, 0x196, 0xca, 0x3ff, 0x5, 0x4, 0x9, 0xffff, 0x8, 0x583f, 0x100000000, 0x80000000000, 0x1ff, 0x9, 0x5, 0x4, 0x8000, 0xf5, 0x200, 0x91, 0xc, 0x7ff, 0x3, 0x5, 0xb, 0x5, 0x80, 0x80000000, 0x0, 0x4, 0x7, 0x97a4, 0xffffffffffff2b2d, 0x9, 0x8, 0xeb3, 0x25, 0xfffffffffffffff7, 0x44, 0x9, 0x6, 0x40, 0x1ebb3da8800, 0x2, 0x100000000, 0x1, 0x5, 0x1, 0x3, 0x6, 0x1000000, 0xe5, 0x401, 0x867, 0x10000, 0xfff, 0x7, 0x0, 0xa, 0x2, 0x7fffffffffffffff, 0xb5a8, 0xffff, 0x5, 0x5, 0x2, 0x5, 0x5, 0x0, 0x7fffffffffffffff, 0x9, 0xffffffffffffff9d, 0x0, 0x4, 0x34f, 0x0, 0x38, 0x81, 0x6, 0x5, 0xed81, 0x8, 0xfffffffffffff6c1, 0xfffffffffffffffc, 0x2, 0x3, 0x8, 0x7, 0x1, 0x2, 0x400, 0x5, 0x459, 0x1, 0x4, 0xd, 0x7fffffff, 0x8, 0x7, 0x3, 0x4, 0x2, 0x0, 0x0, 0x5, 0x6, 0x0, 0x7, 0x1ff, 0x8, 0x4a]}) syz_usb_control_io(r7, &(0x7f0000000040)={0x2c, &(0x7f0000000180)={0x20, 0x8, 0x28, {0x28, 0x31, "f70ba381030000000000000000cb4fdca0560f920d54f365c5b1d43ee44fbf6fc93f0808251f"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fdinfo/3\x00') ioctl$BTRFS_IOC_SCRUB(r6, 0xc400941b, &(0x7f0000002440)={0x0, 0x5e, 0x5}) ioctl$BTRFS_IOC_GET_DEV_STATS(r6, 0xc4089434, &(0x7f0000002840)={r10, 0x3, 0x1, [0x50f, 0x768, 0xd6, 0x8, 0x4], [0x6e3, 0x7, 0x4, 0x7, 0x9, 0xc, 0x7fffffff, 0x5, 0x400, 0x8, 0x8001, 0x6, 0x9, 0x6, 0x8000000000000000, 0x800, 0x80, 0x7, 0x5, 0xe, 0x6f9d, 0xff, 0xffffffffffffff91, 0x7, 0x7, 0x40, 0x890, 0x1, 0x0, 0x6, 0x7, 0x8001, 0xf6, 0x0, 0x2, 0xaa62, 0x0, 0x4, 0x7fff, 0xffffffff, 0x9, 0x5, 0x1, 0x9, 0xc, 0xb, 0x2, 0x401, 0x0, 0x2, 0x1, 0x5, 0x6cc, 0x40, 0x336ca9b9, 0x89, 0x4, 0x4, 0xc98f, 0x7, 0x4, 0xfffffffffffffff7, 0xf8, 0x9, 0x2, 0x109, 0x5, 0x1, 0x4, 0x10, 0xfffffffffffffffb, 0x1, 0x5, 0xb5, 0x6, 0xa72, 0x9, 0x7ffc, 0xfffffffffffffffd, 0x4, 0x1, 0x8, 0x4, 0x5, 0x40b8, 0xfffffffffffffe00, 0x200, 0xfffffffffffff0f2, 0x4, 0x9, 0x0, 0x80000001, 0x81, 0x190000000, 0x5, 0x6d65, 0x1, 0x1, 0x81, 0x8, 0x5, 0x4, 0x7, 0xfffffffffffffff8, 0x0, 0x5, 0xa, 0x0, 0x3, 0x8, 0x7, 0xfffffffffffffff7, 0xb4f, 0x5, 0x9, 0x8000000000000000, 0x7669, 0x9, 0x7, 0x7, 0x7]}) read$FUSE(r4, &(0x7f0000000400)={0x2020}, 0x2020) r11 = request_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000100)={'syz', 0x1}, 0x0, r5) keyctl$restrict_keyring(0x3, r11, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r9, 0x8) add_key$user(&(0x7f00000000c0), 0x0, 0x0, 0x0, r11) 1m32.734609058s ago: executing program 1 (id=566): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newsa={0x138, 0x10, 0x1, 0x70bc2c, 0x0, {{@in6=@mcast2, @in=@private=0xa0100fe, 0x0, 0xecdf, 0x4e24, 0x0, 0xa}, {@in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, 0x0, 0x32}, @in6=@empty, {0xfffffffffffffffe, 0x1, 0x3, 0x0, 0x0, 0xfffffffffffffffe, 0x4, 0x6}, {0x1, 0x400800, 0x9, 0x296}, {0x1, 0x9, 0x4}, 0x1000, 0x0, 0xa, 0x4, 0x0, 0x2c}, [@algo_crypt={0x48, 0x2, {{'cbc(des3_ede)\x00'}}}]}, 0x138}, 0x1, 0x11000000}, 0x44050) 1m32.734394948s ago: executing program 1 (id=567): mkdir(&(0x7f0000000200)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) ioctl$TUNSETQUEUE(r2, 0x400454d9, &(0x7f0000000780)={'pim6reg0\x00', 0x400}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) write$cgroup_int(r2, &(0x7f00000000c0)=0xa7, 0x12) (async) write$cgroup_int(r2, &(0x7f00000000c0)=0xa7, 0x12) mount$9p_fd(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f00000002c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@access_user}, {@cache_mmap}], [], 0x6b}}) (async) mount$9p_fd(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f00000002c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@access_user}, {@cache_mmap}], [], 0x6b}}) 1m17.670342776s ago: executing program 32 (id=567): mkdir(&(0x7f0000000200)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) ioctl$TUNSETQUEUE(r2, 0x400454d9, &(0x7f0000000780)={'pim6reg0\x00', 0x400}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) write$cgroup_int(r2, &(0x7f00000000c0)=0xa7, 0x12) (async) write$cgroup_int(r2, &(0x7f00000000c0)=0xa7, 0x12) mount$9p_fd(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f00000002c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@access_user}, {@cache_mmap}], [], 0x6b}}) (async) mount$9p_fd(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f00000002c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@access_user}, {@cache_mmap}], [], 0x6b}}) 32.232164889s ago: executing program 4 (id=1575): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='tracefs\x00', 0x1214040, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2}) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$sock_SIOCADDDLCI(r1, 0x8980, &(0x7f0000000100)={'gre0\x00', 0x9}) (async) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @multicast}) (async) write$tun(r0, &(0x7f0000000080)={@val={0x0, 0xa76b46610d92c08d}, @void, @eth={@multicast, @random="0500", @val={@void}, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x2, 0x7, 0x30, 0x68, 0x4000, 0xa0, 0x1, 0x0, @empty=0x1c, @local}, @time_exceeded={0xb, 0x0, 0x0, 0x0, 0xfe, 0x0, {0x5, 0x4, 0x2, 0x2a, 0x3, 0x268, 0xe8a, 0xff, 0x1, 0x802, @remote, @broadcast}}}}}}}, 0x46) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@userxattr}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) (async) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@xino_auto}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) (async) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) getdents64(r3, &(0x7f0000000580)=""/174, 0xff56) 32.231648359s ago: executing program 4 (id=1576): r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) r1 = fsopen(&(0x7f0000000240)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) fchdir(r2) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x101000, 0x108) lseek(r3, 0x0, 0x0) ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000000)={'team0\x00', {0x2, 0x0, @remote}}) 32.041102076s ago: executing program 4 (id=1583): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket(0xa, 0x3, 0xff) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @mcast1, 0x2}, 0x1c) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000580)=ANY=[@ANYBLOB="54000000010101010000000000000000020000002c00018014000180080001007f000001080002000a0101010c0002800500010001000000060003400004000014001980080001008d0000000a0002"], 0x54}}, 0x0) 31.990006018s ago: executing program 4 (id=1585): r0 = syz_usb_connect$rtl8150(0x5, 0x33, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) syz_usb_control_io(r0, 0x0, 0x0) 31.436788407s ago: executing program 4 (id=1610): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000700)={'syz0\x00', {0x0, 0xe5e4, 0x0, 0x9}, 0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x80000000, 0x0, 0x0, 0x0, 0x8, 0x0, 0x2000001, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x0, 0xfffffffc, 0x4, 0xfffffefe, 0x0, 0xf6, 0x0, 0x0, 0x3, 0x1, 0x9, 0x0, 0x0, 0x80001ff, 0x4, 0x0, 0x1, 0x7fffffff, 0x2, 0x4000000, 0xfffffffd, 0x5, 0x0, 0xfdfffffe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x5, 0xfffffffe, 0xffffffff, 0x7b67], [0x0, 0x0, 0x0, 0x3, 0x3, 0x0, 0xfffffffe, 0x3, 0x0, 0x0, 0x9b05, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0xfffffff8, 0xfffffffc, 0x2, 0x7, 0x5, 0x1, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x4, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x6, 0x0, 0xffffffff, 0xfffffffc, 0x0, 0x0, 0xc33, 0xffffffff, 0x1a0d, 0x39, 0xaecd, 0x10, 0x0, 0x3, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc], [0x1, 0x0, 0x567, 0x4, 0x0, 0x0, 0x0, 0x9, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000005, 0x0, 0x0, 0x0, 0x0, 0x3, 0x10000000, 0x0, 0x101, 0xfffffffe, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0xfffffffd, 0x0, 0x0, 0x4000000d, 0xffffffff, 0x0, 0x9, 0x3, 0x0, 0x14, 0x1, 0x0, 0x400a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x1d, 0x400, 0x0, 0x8, 0x4000002, 0x0, 0x100000], [0x0, 0x1ff, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffe, 0xf7b, 0x0, 0x0, 0x0, 0xaad, 0x10000, 0x80000, 0x0, 0x8, 0x0, 0x3e8, 0xfffffffd, 0x10000001, 0x0, 0x0, 0x5861, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd, 0x0, 0x0, 0x13, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x101, 0xfffffffe, 0x0, 0x5, 0x0, 0x1]}, 0x45c) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000a00)=ANY=[@ANYBLOB="40000000180015ffe0000000ffffffff0a200000000200000f000000240009801c00000008000000140005"], 0x40}], 0x1}, 0xfc00) 31.152710537s ago: executing program 4 (id=1618): r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000007c0), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xffffffffffffff7d, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="ddce0000", @ANYRES16=r0, @ANYBLOB="20002abd7000fbdbdf25150000004b8ac8fd87e1950089a21400098000000200ffff0000080002000700000030004d491319053477fbc4a22ee1db95905077b44a726a37f5ac3d8bb2632680411b69739630eb31f26e8aa42a772a457d9c0ce2f9f124db8f016ff5e2294c2b2e7ba35c9cc52a93185f3ace8bcf75ecec8fd23ed92168fefac0d6c4dd8568b9ba41f1a1f65910ae38cab5aacaa5577471c2cd89e147ee4e72134d7dbda44b0952919edc5352143c734fe4d83259374878163ea83d4dbfb342fdd5c3616adde116f2d71e3a9296"], 0x58}, 0x1, 0x0, 0x0, 0x4004001}, 0x2000c040) syz_usb_connect$uac3(0x5, 0x80, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x763, 0x2003, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x23, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x74, 0x9, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x2, 0xbe1}}}}}}}}]}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x1c1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000500)={'syz_tun\x00', &(0x7f0000000440)=@ethtool_link_settings={0x4d, 0x400, 0xf, 0x80, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x4, [0x0, 0x0, 0x4, 0xffffffbb, 0x0, 0x0, 0x1]}}) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e00f90000000000000005000200fc000000080005"], 0x3c}, 0x1, 0x0, 0x0, 0x4044851}, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000440)={@empty, @private, 0x0}, &(0x7f0000000480)=0xc) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r1, &(0x7f0000000680)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x38, r3, 0x200, 0x70bd2d, 0x25dfdbfe, {}, [@ETHTOOL_A_PRIVFLAGS_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}, @ETHTOOL_A_PRIVFLAGS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'tunl0\x00'}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x4800}, 0x50) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000700), r1) sendmsg$TIPC_NL_SOCK_GET(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000a40)={&(0x7f00000008c0)={0x14c, r5, 0x8, 0x70bd29, 0x25dfdbfb, {}, [@TIPC_NLA_SOCK={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xfffffe01}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x352c}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9930}, @TIPC_NLA_CON_NODE={0x8}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x10001}]}, @TIPC_NLA_LINK={0xec, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x401}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7ff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10001}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4a8f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x16856122}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x14c}, 0x1, 0x0, 0x0, 0xc000}, 0x4008000) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0\x00', 0x0) pipe(&(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r6) splice(r6, 0x0, r7, 0x0, 0xfffd, 0xa) move_mount(r6, &(0x7f0000000280)='./file1\x00', 0xffffffffffffff9c, &(0x7f00000002c0)='./file1/file0\x00', 0x14) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) mount$bpf(0x0, &(0x7f0000000240)='./file0\x00', 0x0, 0x10, 0x0) iopl(0xff) sendmsg$TIPC_NL_NET_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000880)={&(0x7f00000001c0)={0x34, r0, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@TIPC_NLA_NET={0x20, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x6}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x9}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x2}]}]}, 0x34}, 0x1, 0x0, 0x0, 0xc0}, 0x4004) 31.131432458s ago: executing program 33 (id=1618): r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000007c0), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xffffffffffffff7d, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="ddce0000", @ANYRES16=r0, @ANYBLOB="20002abd7000fbdbdf25150000004b8ac8fd87e1950089a21400098000000200ffff0000080002000700000030004d491319053477fbc4a22ee1db95905077b44a726a37f5ac3d8bb2632680411b69739630eb31f26e8aa42a772a457d9c0ce2f9f124db8f016ff5e2294c2b2e7ba35c9cc52a93185f3ace8bcf75ecec8fd23ed92168fefac0d6c4dd8568b9ba41f1a1f65910ae38cab5aacaa5577471c2cd89e147ee4e72134d7dbda44b0952919edc5352143c734fe4d83259374878163ea83d4dbfb342fdd5c3616adde116f2d71e3a9296"], 0x58}, 0x1, 0x0, 0x0, 0x4004001}, 0x2000c040) syz_usb_connect$uac3(0x5, 0x80, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x763, 0x2003, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x23, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x74, 0x9, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x2, 0xbe1}}}}}}}}]}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x1c1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000500)={'syz_tun\x00', &(0x7f0000000440)=@ethtool_link_settings={0x4d, 0x400, 0xf, 0x80, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x4, [0x0, 0x0, 0x4, 0xffffffbb, 0x0, 0x0, 0x1]}}) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e00f90000000000000005000200fc000000080005"], 0x3c}, 0x1, 0x0, 0x0, 0x4044851}, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000440)={@empty, @private, 0x0}, &(0x7f0000000480)=0xc) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r1, &(0x7f0000000680)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x38, r3, 0x200, 0x70bd2d, 0x25dfdbfe, {}, [@ETHTOOL_A_PRIVFLAGS_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}, @ETHTOOL_A_PRIVFLAGS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'tunl0\x00'}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x4800}, 0x50) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000700), r1) sendmsg$TIPC_NL_SOCK_GET(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000a40)={&(0x7f00000008c0)={0x14c, r5, 0x8, 0x70bd29, 0x25dfdbfb, {}, [@TIPC_NLA_SOCK={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xfffffe01}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x352c}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9930}, @TIPC_NLA_CON_NODE={0x8}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x10001}]}, @TIPC_NLA_LINK={0xec, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x401}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7ff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10001}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4a8f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x16856122}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x14c}, 0x1, 0x0, 0x0, 0xc000}, 0x4008000) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0\x00', 0x0) pipe(&(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r6) splice(r6, 0x0, r7, 0x0, 0xfffd, 0xa) move_mount(r6, &(0x7f0000000280)='./file1\x00', 0xffffffffffffff9c, &(0x7f00000002c0)='./file1/file0\x00', 0x14) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) mount$bpf(0x0, &(0x7f0000000240)='./file0\x00', 0x0, 0x10, 0x0) iopl(0xff) sendmsg$TIPC_NL_NET_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000880)={&(0x7f00000001c0)={0x34, r0, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@TIPC_NLA_NET={0x20, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x6}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x9}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x2}]}]}, 0x34}, 0x1, 0x0, 0x0, 0xc0}, 0x4004) 2.798617122s ago: executing program 3 (id=1936): ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, &(0x7f0000000000)={0x60, 0x2, &(0x7f0000165000/0x4000)=nil, &(0x7f000075d000/0x1000)=nil, 0x3800, 0x0, 0x0, 0x8000e5, 0x0, 0x0, 0x0, 0xe4}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0xfffffffffffffffe) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r2, 0xae9a) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x2c000010) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000440)={[0x0, 0xa03, 0x0, 0x7f, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x401, 0x0, 0x7, 0x0, 0x5, 0x8, 0x2, 0xffffffffffffffff], 0x0, 0x200}) ioctl$KVM_RUN(r2, 0xae80, 0x0) getgid() ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0x101, 0xaec4, 0x6, 0x4004, 0x2, 0x4, 0xefffffffffffffff, 0x0, 0xf, 0x2000000, 0x20000, 0x7c, 0xfffffffffffffffd, 0x7, 0x1], 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.728060184s ago: executing program 3 (id=1938): openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) (async) r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) setsockopt(r0, 0x90, 0x1, 0x0, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$NILFS_IOCTL_RESIZE(r1, 0x40086e8b, &(0x7f0000000000)=0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setownex(r2, 0xf, &(0x7f0000000140)) (async) fcntl$setownex(r2, 0xf, &(0x7f0000000140)) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$inet_mtu(r3, 0x0, 0xa, &(0x7f0000000080), &(0x7f0000000180)=0x4) sendmsg$nl_xfrm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=@newsa={0x158, 0x10, 0x413, 0x70bd28, 0x0, {{@in6=@local, @in=@local, 0x0, 0x0, 0x4e24, 0x0, 0x2, 0x20, 0x20}, {@in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4d4, 0x32}, @in=@private=0xa010100, {0x4, 0x7, 0x0, 0x40000000000004, 0xffffffffffffffff, 0x4, 0x7f}, {0x0, 0x7, 0xcc, 0xc}, {0x7}, 0x0, 0x0, 0x2, 0x1, 0x7}, [@algo_aead={0x67, 0x12, {{'rfc4309(ccm(aes))\x00'}, 0xd8, 0x40, "cf89f80ad8f34a74aaf34f59aa45b5c2c7ca916b08bf9cbf9e84d7"}}]}, 0x158}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040084) 2.674548186s ago: executing program 3 (id=1939): ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f00000001c0)={0xffffffffffffffff, 0x2, 0x3, 0x6}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r0, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000004c0)=[@textreal={0x8, &(0x7f0000000440)="baf80c66b872c28a8866efbafc0cb04dee0f01c9660fc7370fc7a939d164263e14008121000066b9640300000f32f00fc14626baf80c66b8b40bb68b66efbafc0c66ed3e0f01de", 0x47}], 0x1, 0x1a, &(0x7f0000000500)=[@cr0={0x0, 0x10000}], 0x1) prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x37, [0xfffffff8, 0x8, 0x5, 0x9, 0x8, 0x155f, 0x6, 0x4, 0x25cd, 0x1, 0xb4, 0xa, 0xa2b9, 0x6, 0x7, 0xe4, 0x6, 0xfc000000, 0x3, 0xbbf, 0x4a732f64, 0x1, 0x8, 0xd, 0x0, 0x12a3, 0x6, 0x1, 0x2, 0x6, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x8, 0x0, 0x91, 0x4, 0x4, 0x16, 0x8, 0x5, 0x401, 0xfffffff5, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x9, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0xc66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x7, 0x5, 0x2, 0x809, 0x4, 0xa7, 0x1000, 0x0, 0x200b398, 0x400080, 0x1, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x400, 0x6, 0xc7c, 0x4, 0x0, 0xfffffff8, 0x401, 0x46, 0xf1, 0x4, 0xab00060, 0x5, 0x6, 0x2, 0x1, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x1, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x95, 0x7fffffff, 0x4, 0xfffffff9, 0x1, 0x1000, 0xfffff801, 0x5], [0x2, 0xfffffffe, 0xffff, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x8d3, 0x9, 0x8, 0x3fc, 0x2, 0x400, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x8000003, 0x4e, 0x9, 0x3, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x3e55, 0x4005, 0xd3, 0x8, 0x97f7, 0x3, 0xd, 0x7, 0x601, 0x101, 0xdd80, 0x60a0, 0x7f, 0x9d26, 0x10000, 0x1, 0x2, 0x8922, 0x6, 0x8000, 0xf45, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbfc, 0x8, 0x5, 0x7f, 0x55, 0x40, 0xff, 0x1005, 0x1, 0x7, 0x1e, 0x9, 0x81, 0x3, 0x9d82, 0xd, 0xfffffff7, 0x8, 0x140f2, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0xffffffff, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x1, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x6, 0x8, 0x14000, 0x1, 0x9]}, 0x45c) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x20, 0x0, 0xb, {0x0, 0x19}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f0000000400)='M', 0x1}], 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x4, 0x5, 0x4, 0x8], 0x25000, 0x304}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x6e0, 0xec000000, 0xcd}]}) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x2, 0x0, 0x4}}, 0x2e) 2.595322259s ago: executing program 3 (id=1941): r0 = socket$inet6(0xa, 0x3, 0x88) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000980)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x3f, 0x0}, @in=@local, 0xee24, 0x0, 0x4e24, 0x3, 0x2, 0x0, 0x0, 0x5c}, {0x0, 0x200000004, 0x40000000007, 0x20000a0de, 0x100000000, 0x0, 0x200000003, 0x9}, {0x5}, 0x5, 0x0, 0x1, 0x0, 0x6, 0x2}, {{@in=@remote, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x3502, 0x3, 0x8, 0x0, 0x4, 0xef, 0xc5e}}, 0xe8) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000280)={0xa, 0x4e22, 0xd, @loopback, 0x6}, 0x1c) connect$inet6(r1, &(0x7f0000000140)={0xa, 0x4e22, 0x23, @loopback, 0x1f}, 0x1c) (async) setsockopt$inet6_int(r1, 0x29, 0x8, &(0x7f0000000100)=0x80000001, 0x4) (async) r2 = dup(r1) sendmmsg$inet(r2, &(0x7f000000d4c0)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000380)="be", 0x1}], 0x1}}], 0x1, 0x91) (async, rerun: 32) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x5c}, 0x1, 0x0, 0x0, 0x40}, 0x44895) (rerun: 32) r3 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000380)={'macvlan0\x00', &(0x7f0000000040)=@ethtool_test={0x1a, 0x4}}) syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), r2) (async) connect$inet6(r0, &(0x7f0000000000)={0xa, 0xfffd, 0x3, @empty, 0x7}, 0x1c) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000000000104c05d50300000000000109022400010000000009040000020300000009210000000122050009058103"], 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io(r4, &(0x7f0000000040)={0x2c, &(0x7f0000000000)=ANY=[@ANYBLOB="00210000400000003c1e00"], 0x0, 0x0, 0x0, 0x0}, 0x0) 2.502205452s ago: executing program 3 (id=1943): syz_usb_connect$uac2(0x0, 0x7b, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201008300000020532b240040000102030109026900030104007f080b0100010a20020904000000010120000924010700060900b209040100000102200009040101010102200009050109000206998008250101181e000009040200000102200009040201", @ANYRES64], &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, &(0x7f0000000080)="f30f09b800228ed00f20e06635080000000f22e00f21a1f30fc7b400000f20c06635100000000f22c0646664660f380817f2660f35bad104527c000000650fc7af95de8ec0", 0x45}], 0x1, 0x3, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = openat$selinux_user(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$selinux_user(r4, &(0x7f0000000100)=ANY=[@ANYBLOB="73797374656d5f753a6f358ffe50745f723a7661725f6c6f636b5f743a73302075"], 0x2d) sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001f"], 0xb8}}, 0x20040000) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.98004748s ago: executing program 5 (id=1947): syz_usb_connect(0x2, 0x2d, &(0x7f0000000640)={{0x12, 0x1, 0x200, 0xfe, 0x46, 0x83, 0x8, 0x199e, 0x8002, 0xbb31, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x3, 0x4, 0xb0, 0x1, "", [{{0x9, 0x4, 0xe6, 0x4, 0x1, 0xe, 0x1, 0x0, 0x3, [], [{{0x9, 0x5, 0xd, 0x2, 0x8, 0xfd, 0x80, 0x2a}}]}}]}}]}}, &(0x7f0000000ec0)={0x0, 0x0, 0x0, 0x0}) openat2$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)={0x609c3, 0x148, 0x12}, 0x18) mount$cgroup(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0x10002, &(0x7f00000000c0)={[{@none}, {@nofavordynmods}]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) recvmsg$unix(r0, &(0x7f00000018c0)={&(0x7f0000000180)=@abs, 0x6e, &(0x7f0000001700)=[{&(0x7f0000000200)=""/203, 0xcb}, {&(0x7f0000000300)=""/107, 0x6b}, {&(0x7f0000000380)=""/138, 0x8a}, {&(0x7f0000000440)=""/128, 0x80}, {&(0x7f00000004c0)=""/242, 0xf2}, {&(0x7f00000005c0)=""/23, 0x17}, {&(0x7f0000000600)=""/4096, 0x1000}, {&(0x7f0000001600)=""/131, 0x83}, {&(0x7f00000016c0)=""/10, 0xa}], 0x9, &(0x7f00000017c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xd0}, 0x40000041) ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f0000001940)={[0x57, 0xfffffffffffffffe, 0x200, 0x3, 0x2, 0x3, 0xf, 0x400, 0x3c0d, 0x6, 0x6a9b, 0xfff, 0x7fffffffffffffff, 0x8000000000000000, 0x5, 0x7f], 0x100000, 0x2000}) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000001900)={'wlan1\x00'}) 1.43500378s ago: executing program 5 (id=1955): r0 = openat$random(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0x400000b1, 0x0, 0x7}]}) syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 1.198666758s ago: executing program 3 (id=1957): r0 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x56a, 0x301, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xcbff92d53f0298fe, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x6, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x9, 0x9, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x0, 0xb, 0xfe}}}}}]}}]}}, 0x0) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f00000001c0), 0x1, 0x0) write$tcp_congestion(r1, 0x0, 0xffffff93) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x1b10c1, 0x0) ioctl$TCGETS(r2, 0x5401, &(0x7f0000000d00)) syz_usb_control_io$hid(r0, 0x0, 0x0) r3 = syz_usb_connect$cdc_ncm(0x5, 0x6e, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c0002010070080904000001020d00000524060001052400e80d0d240f0100000000000000000206241a0000080905810308000000000904010000020d000009040114"], 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) syz_usb_control_io(r3, &(0x7f0000000140)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB="4008280000000623f70ba381030000000000000000cb4fdca0560fb30d54f39814c806db99910965c5b1d43e0050"], 0x0, 0x0, 0x0, 0x0}, 0x0) 1.085202082s ago: executing program 0 (id=1958): ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f00000001c0)={0xffffffffffffffff, 0x2, 0x3, 0x6}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r0, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000004c0)=[@textreal={0x8, &(0x7f0000000440)="baf80c66b872c28a8866efbafc0cb04dee0f01c9660fc7370fc7a939d164263e14008121000066b9640300000f32f00fc14626baf80c66b8b40bb68b66efbafc0c66ed3e0f01de", 0x47}], 0x1, 0x1a, &(0x7f0000000500)=[@cr0={0x0, 0x10000}], 0x1) prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x37, [0xfffffff8, 0x8, 0x5, 0x9, 0x8, 0x155f, 0x6, 0x4, 0x25cd, 0x1, 0xb4, 0xa, 0xa2b9, 0x6, 0x7, 0xe4, 0x6, 0xfc000000, 0x3, 0xbbf, 0x4a732f64, 0x1, 0x8, 0xd, 0x0, 0x12a3, 0x6, 0x1, 0x2, 0x6, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x8, 0x0, 0x91, 0x4, 0x4, 0x16, 0x8, 0x5, 0x401, 0xfffffff5, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x9, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0xc66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x7, 0x5, 0x2, 0x809, 0x4, 0xa7, 0x1000, 0x0, 0x200b398, 0x400080, 0x1, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x400, 0x6, 0xc7c, 0x4, 0x0, 0xfffffff8, 0x401, 0x46, 0xf1, 0x4, 0xab00060, 0x5, 0x6, 0x2, 0x1, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x1, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x95, 0x7fffffff, 0x4, 0xfffffff9, 0x1, 0x1000, 0xfffff801, 0x5], [0x2, 0xfffffffe, 0xffff, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x8d3, 0x9, 0x8, 0x3fc, 0x2, 0x400, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x8000003, 0x4e, 0x9, 0x3, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x3e55, 0x4005, 0xd3, 0x8, 0x97f7, 0x3, 0xd, 0x7, 0x601, 0x101, 0xdd80, 0x60a0, 0x7f, 0x9d26, 0x10000, 0x1, 0x2, 0x8922, 0x6, 0x8000, 0xf45, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbfc, 0x8, 0x5, 0x7f, 0x55, 0x40, 0xff, 0x1005, 0x1, 0x7, 0x1e, 0x9, 0x81, 0x3, 0x9d82, 0xd, 0xfffffff7, 0x8, 0x140f2, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0xffffffff, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x1, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x6, 0x8, 0x14000, 0x1, 0x9]}, 0x45c) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x20, 0x0, 0xb, {0x0, 0x19}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f0000000400)='M', 0x1}], 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x4, 0x5, 0x4, 0x8], 0x25000, 0x304}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x6e0, 0xec000000, 0xcd}]}) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x2, 0x0, 0x4}}, 0x2e) 1.075531882s ago: executing program 0 (id=1959): r0 = syz_usb_connect$midi(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0xd8c, 0x102, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x1, 0x5, 0x60, 0x1, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x3, 0x20, 0x2}}}}}]}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_control_io$sierra_net(r0, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x74, @string={0x74, 0x3, "799b456a293b3465dab0fe0b003c95f4aa12cf45641c8a1f63d4dafef6d79542d97f320327022526472aa73fe5e2a9f159e5b3361fb6a1787fe1e803c003e997d5c6ac79037c1590623301b4eb1ff0fe010e911a1017ab40bd3eb85dae1d724df7a39f06b74f1a464bde5290cf0000000000"}}}, 0x0) syz_usb_control_io$uac1(r0, &(0x7f0000000200)={0x14, 0x0, &(0x7f0000000500)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44f}}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x1b, &(0x7f0000000240)={@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x1b, &(0x7f00000000c0)={@remote={0xfe, 0x80, '\x00', 0xffffffffffffffff}}, 0x20) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000200)={@dev}, 0x14) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r3, 0x29, 0x1b, &(0x7f0000000080)={@remote}, 0x14) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r4, 0xffffffffffffffff, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) 818.693171ms ago: executing program 5 (id=1960): ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'wlan1\x00', &(0x7f00000000c0)=@ethtool_gfeatures}) r0 = syz_open_dev$usbmon(&(0x7f0000000380), 0x0, 0x60040) ioctl$MON_IOCX_GETX(r0, 0x4018920a, &(0x7f0000000040)={&(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @iso}, 0x0}) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket(0x2, 0x2, 0x0) setsockopt$inet_int(r2, 0x0, 0xb, &(0x7f00000000c0)=0x1002, 0x4) sendto$inet(r2, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x2, 0x4e20}, 0x10) recvmsg(r2, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x12160) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000080)={'ip6_vti0\x00', 0x0}) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) setresuid(0xee01, r3, 0x0) setfsuid(r3) 805.696952ms ago: executing program 5 (id=1961): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x1000000000, 0x5, 0x41, 0x2000000, 0x0, 0x2004cb, 0x0, 0xa1d, 0x8, 0x5, 0x0, 0x3, 0x2], 0x10000, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000b40)={0x0, &(0x7f0000000480)=[@nested_create_vm={0x12d, 0x18, 0x3}, @out_dx={0x6a, 0x28, {0x4b87, 0x4, 0xffffffffffffffff}}, @enable_nested={0x12c, 0x18}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x1, @save_area=0x46a, 0x1000, 0x6, 0x5}}, @cpuid={0x64, 0x18, {0x5, 0x9}}, @nested_vmlaunch={0x12f, 0x18}, @set_irq_handler={0xc8, 0x20, {0x33, 0x1}}, @wr_crn={0x67, 0x20, {0x0, 0x55}}, @nested_amd_set_intercept={0x181, 0x30, {0x0, 0xd6, 0x5}}, @nested_load_syzos={0x136, 0x90, {0x0, 0x38, [@rdmsr={0x66, 0x18, {0xbb0}}, @in_dx={0x69, 0x20, {0xf12c}}, @nested_amd_invlpga={0x17d, 0x20, {0x4, 0xb33f}}, @nested_amd_vmsave={0x183, 0x18}]}}, @nested_amd_inject_event={0x180, 0x38, {0x3, 0x87, 0x5, 0x1}}, @nested_amd_vmsave={0x183, 0x18}, @wr_crn={0x67, 0x20, {0x2, 0xfffffffffffffc01}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x1, @guest_nat=0x6806, 0xb, 0x63bd, 0x3}}, @nested_amd_vmsave={0x183, 0x18, 0x3}, @out_dx={0x6a, 0x28, {0x55e0, 0x2, 0x8001}}, @nested_amd_clgi={0x17f, 0x10}, @nested_amd_vmsave={0x183, 0x18, 0x3}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x3, @guest16=0x808, 0x80000000000000, 0x3, 0x9432}}, @nested_amd_vmload={0x182, 0x18}, @nested_amd_inject_event={0x180, 0x38, {0x0, 0xe5, 0x6, 0x7}}, @nested_vmresume={0x130, 0x18, 0x3}, @out_dx={0x6a, 0x28, {0x409a, 0x0, 0x5}}, @nested_vmresume={0x130, 0x18, 0x1}, @nested_amd_set_intercept={0x181, 0x30, {0x2, 0xba, 0x3800000000, 0x1}}, @cpuid={0x64, 0x18, {0x3, 0x1}}, @uexit={0x0, 0x18, 0x9}, @nested_amd_vmsave={0x183, 0x18, 0x1}, @code={0xa, 0x54, {"f30f1eff2e0f01c22636420f01c566baf80cb804aaa585ef66bafc0cb8f0ffffffefcf47c0acb0040000002666baa100ec66b81f018ee026660f3881914fec0000f26f"}}, @nested_load_syzos={0x136, 0x1ea, {0x2, 0x9, [@wr_crn={0x67, 0x20, {0x8}}, @nested_load_syzos={0x136, 0x20, {0x3}}, @out_dx={0x6a, 0x28, {0xf78c, 0x5, 0xbaeb}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x2, @save_area=0x45d, 0x495f, 0x8, 0x5}}, @code={0xa, 0x83, {"66baf80cb800ff7880ef66bafc0cb88000c0feef66ba2100b800800000ef440f01f23e660f65112ef30f0131470f001e67660f383ac2c744240045000000c7442402043468efc7442406000000000f011c24c7442400d370e7acc74424029d460000c7442406000000000f011424f2440f0e"}}, @code={0xa, 0x57, {"440f20c0350a000000440f22c0f3410fbc9b0080000026e300440f300f20d835200000000f22d866baa000b8baffffffef410f3266b8e2000f00d8360fb7a60b0000000f01c4"}}, @nested_create_vm={0x12d, 0x18, 0x3}, @nested_amd_inject_event={0x180, 0x38, {0x0, 0x6c, 0x2, 0x9, 0x1}}]}}, @nested_amd_inject_event={0x180, 0x38, {0x1, 0x6d, 0x6, 0x4, 0x2}}], 0x69e}) ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f0000000240)={{0x2000, 0x0, 0x0, 0x7, 0x8, 0x0, 0x0, 0x3, 0x20, 0x8, 0x6}, {0xffff1000, 0x3000, 0xc, 0x0, 0x2, 0x0, 0x0, 0x0, 0x7, 0xff}, {0x2000, 0x8080000, 0xb, 0x4, 0x7, 0xc4, 0x0, 0x0, 0x9, 0x3, 0x0, 0xfc}, {0x0, 0xd000, 0x18592cbc7c573fc6, 0x9, 0x1, 0x0, 0x9, 0x0, 0x8, 0x0, 0x4, 0x2}, {0x80a0000, 0x6000, 0xe, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3c, 0x0, 0xb9}, {0x100000, 0x3e000, 0x0, 0x78, 0x80, 0x1, 0x2, 0x0, 0x0, 0xff, 0x1}, {0x0, 0xeeee0000, 0x9, 0x4, 0x1, 0x0, 0xa9, 0x20, 0x0, 0xff, 0xa}, {0x2, 0x6000, 0xc, 0x0, 0x0, 0x7, 0x8, 0x40, 0x26, 0x0, 0x0, 0x2}, {0xffffffff, 0x8cc}, {0xdddd1000}, 0xddf8ffdb, 0x0, 0x0, 0x200084, 0xc, 0xf801, 0x0, [0x80000001, 0x0, 0xffffffffffffffff, 0x1]}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000000)=@x86={0x81, 0xa, 0x9, 0x0, 0x5, 0x8, 0x3, 0x7, 0x0, 0x8, 0x25, 0x8b, 0x0, 0x2, 0x7, 0x1, 0x8, 0x4, 0x8a, '\x00', 0x8e, 0x100000001}) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='.\x00', &(0x7f00000028c0), 0x4001, &(0x7f00000000c0)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x4000}}) write$FUSE_NOTIFY_STORE(r4, &(0x7f0000000180)=ANY=[@ANYBLOB="280000000400000000000000000000000100000000000000000079000000b278f6"], 0x28) ioctl$KVM_RUN(r2, 0xae80, 0x0) 684.328496ms ago: executing program 5 (id=1964): r0 = socket$inet6(0xa, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000002100), 0x280449c, &(0x7f0000002140)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}}) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$RTC_ALM_SET(r2, 0x40247007, &(0x7f0000000040)={0x32, 0x14, 0x14, 0xb, 0xb, 0x3, 0x4, 0x14f, 0x1}) read$FUSE(r1, &(0x7f00000093c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000004200)={0x50, 0x0, r3, {0x7, 0x1f, 0x0, 0x2022012, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x3}}, 0x50) syz_fuse_handle_req(r1, &(0x7f0000006380)="000000000000000000000000000000000000000000000000000000000000000090c400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000542d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ea8286a2fba5234400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b60dd7710000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000633956a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007d6ab715107fa1820000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f6ffffffffffffff0000000000000e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e1ffffff00000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000286071480000000000b13bc1e6d970884f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000048636662867d08f50000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f3ffffffffffffff00", 0x2000, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)={0x20, 0x0, 0x80000000000000, {0x0, 0x1d}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x40) bind$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @initdev={0xfe, 0x88, '\x00', 0x7f, 0x0}}, 0x1c) r5 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r5, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) r6 = syz_open_dev$usbfs(&(0x7f0000000040), 0x400000001ff, 0x101301) r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_X86_SET_MSR_FILTER(r8, 0x4188aec6, &(0x7f0000000a40)={0x0, [{0x2, 0x8, 0x4, &(0x7f00000004c0)="01"}, {0x2, 0x0, 0x2, 0x0}, {0x2, 0x0, 0x6, 0x0}, {0x2, 0x0, 0x912b, 0x0}, {0x1, 0x0, 0x3cb3, 0x0}, {0x3, 0x0, 0x3fe, 0x0}, {0x1, 0x0, 0x2, 0x0}, {0x3, 0x0, 0xfffffffe, 0x0}, {0x2, 0x0, 0xb, 0x0}, {0x1, 0x0, 0x3, 0x0}, {0x0, 0x0, 0x9, 0x0}, {0x3, 0x0, 0xa, 0x0}, {0x1, 0x0, 0x0, 0x0}, {0x1, 0x0, 0x7fffffff, 0x0}, {0x1, 0x0, 0x2, 0x0}, {0x1, 0x0, 0x8001, 0x0}]}) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r9, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) syz_clone3(&(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x2}, 0xa0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) ioctl$USBDEVFS_SUBMITURB(r6, 0x8038550a, &(0x7f0000000280)=@urb_type_control={0x2, {}, 0xff, 0x40, &(0x7f0000001240)={0x0, 0x1, 0x2, 0xfffd}, 0x8, 0x0, 0x1, 0x0, 0x0, 0x1fffe, 0x0}) sendmsg$netlink(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)=ANY=[@ANYBLOB="2400000022000106"], 0x24}], 0x1}, 0x0) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0xc12, 0x30, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x3, "", [{{0x9, 0x4, 0x0, 0x0, 0x9, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0xa, 0x3, 0x1, {0x22, 0x29}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x2, 0x3, 0x4}}}}}]}}]}}, 0x0) ioctl$PTP_EXTTS_REQUEST2(r4, 0x40806685, &(0x7f0000000000)={0x7, 0x9}) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4a20, 0x0, @local}, 0x2e) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x4, @mcast2, 0x4}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x2a, &(0x7f0000000000), 0x4) recvmmsg(r0, &(0x7f0000001640)=[{{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}, 0x81}], 0x2, 0x10000, 0x0) 684.034526ms ago: executing program 2 (id=1965): setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, 0x0, 0x0) r0 = userfaultfd(0x80801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x100}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1}) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa08, &(0x7f0000000000)={{&(0x7f0000ffd000/0x2000)=nil, 0x2000}, 0x1}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000100)={0x2, 0x3, 0xffffe000, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_RUN(r3, 0xae80, 0x0) socket(0x8, 0x5, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, 0x0, 0x0) (async) userfaultfd(0x80801) (async) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x100}) (async) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1}) (async) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa08, &(0x7f0000000000)={{&(0x7f0000ffd000/0x2000)=nil, 0x2000}, 0x1}) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) (async) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000100)={0x2, 0x3, 0xffffe000, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) (async) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) socket(0x8, 0x5, 0x0) (async) 639.488258ms ago: executing program 2 (id=1966): syz_usb_connect$midi(0x5, 0x93, &(0x7f0000000040)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x2a39, 0x3fd3, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x81, 0x1, 0x1, 0x81, 0x80, 0xba, "", {{{0x9, 0x4, 0x0, 0x0, 0x6, 0x1, 0x3, 0x20, 0x4, [@ms_header={0x7, 0x24, 0x1, 0x200, 0x7}], [{{0x9, 0x5, 0xc, 0x8, 0x200, 0x5, 0x0, 0xef, {0xb, 0x25, 0x1, 0x7, "0c60c1c2b5eca2"}}}, {{0x9, 0x5, 0x9, 0x2, 0x10, 0x0, 0x6, 0x7, {0x6, 0x25, 0x1, 0x2, "eeff"}}}, {{0x9, 0x5, 0x1, 0x0, 0x20, 0x7, 0x3, 0x9, {0xa, 0x25, 0x1, 0x6, "5d98a8dc4f5f"}}}, {{0x9, 0x5, 0xc, 0x0, 0x40, 0xa1, 0x4, 0x7, {0xc, 0x25, 0x1, 0x8, "777b8221b8d58352"}}}, {{0x9, 0x5, 0x8, 0x4, 0x400, 0x40, 0x0, 0xfc, {0x4}}}, {{0x9, 0x5, 0x1, 0x0, 0x3ff, 0x81, 0x8, 0x4, {0x7, 0x25, 0x1, 0x3, '0\x00<'}}}]}}}}}]}}, 0x0) 553.16737ms ago: executing program 0 (id=1967): ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f00000001c0)={0xffffffffffffffff, 0x2, 0x3, 0x6}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r0, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000004c0)=[@textreal={0x8, &(0x7f0000000440)="baf80c66b872c28a8866efbafc0cb04dee0f01c9660fc7370fc7a939d164263e14008121000066b9640300000f32f00fc14626baf80c66b8b40bb68b66efbafc0c66ed3e0f01de", 0x47}], 0x1, 0x1a, &(0x7f0000000500)=[@cr0={0x0, 0x10000}], 0x1) prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x37, [0xfffffff8, 0x8, 0x5, 0x9, 0x8, 0x155f, 0x6, 0x4, 0x25cd, 0x1, 0xb4, 0xa, 0xa2b9, 0x6, 0x7, 0xe4, 0x6, 0xfc000000, 0x3, 0xbbf, 0x4a732f64, 0x1, 0x8, 0xd, 0x0, 0x12a3, 0x6, 0x1, 0x2, 0x6, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x8, 0x0, 0x91, 0x4, 0x4, 0x16, 0x8, 0x5, 0x401, 0xfffffff5, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x9, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0xc66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x7, 0x5, 0x2, 0x809, 0x4, 0xa7, 0x1000, 0x0, 0x200b398, 0x400080, 0x1, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x400, 0x6, 0xc7c, 0x4, 0x0, 0xfffffff8, 0x401, 0x46, 0xf1, 0x4, 0xab00060, 0x5, 0x6, 0x2, 0x1, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x1, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x95, 0x7fffffff, 0x4, 0xfffffff9, 0x1, 0x1000, 0xfffff801, 0x5], [0x2, 0xfffffffe, 0xffff, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x8d3, 0x9, 0x8, 0x3fc, 0x2, 0x400, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x8000003, 0x4e, 0x9, 0x3, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x3e55, 0x4005, 0xd3, 0x8, 0x97f7, 0x3, 0xd, 0x7, 0x601, 0x101, 0xdd80, 0x60a0, 0x7f, 0x9d26, 0x10000, 0x1, 0x2, 0x8922, 0x6, 0x8000, 0xf45, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbfc, 0x8, 0x5, 0x7f, 0x55, 0x40, 0xff, 0x1005, 0x1, 0x7, 0x1e, 0x9, 0x81, 0x3, 0x9d82, 0xd, 0xfffffff7, 0x8, 0x140f2, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0xffffffff, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x1, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x6, 0x8, 0x14000, 0x1, 0x9]}, 0x45c) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x20, 0x0, 0xb, {0x0, 0x19}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f0000000400)='M', 0x1}], 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x4, 0x5, 0x4, 0x8], 0x25000, 0x304}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x6e0, 0xec000000, 0xcd}]}) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x2, 0x0, 0x4}}, 0x2e) 502.525722ms ago: executing program 0 (id=1968): r0 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) write$binfmt_aout(r0, &(0x7f0000000000)={{0xcc, 0x2, 0x3, 0x300, 0x1c7, 0x8, 0x1c, 0x7be}, "b997c35e220fe8e055d41e98e27ed010c4a4d8a861f67f1749b6ebb7e088e7b6f911324314c8ac7c6ae85df4d119750b0044171d2b03795f08842bf26e7c001fa2ad169ad89350ed3875fc88da3882a2bee9a13f174365ee53f3782994af2f984042db55a8dbcabb1076959eff6e693e79a7a326a99c13e408d8f466a81423763267b4121a2d819f2a642e436b9f2eb6743525acd05d4a7ba75b4a55e2f8f4b3dd57246dbd1420e99ef0923f7a01ec1591b437790840", ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}, 0x7d6) (async) r1 = pidfd_getfd(0xffffffffffffffff, r0, 0x0) write$binfmt_script(r1, &(0x7f0000000800)={'#! ', './file0', [{}], 0xa, "819af38c08179025fc8e79b98603d31a433bb07f81ab35be042822740252733e95e002eead702cfab81101fcf9bf7634f8c0079bf87ce8580478905c322d10731beabd66bb466d8c209bcec25f83acb3c6d8bb7a98ff4471e8ef087fe77655a47b9b11ea3682200391f3e459a81bf00f7621e68fdaaef0947091a412f60af9a4abdd300baa08fbc990ffef7aa9d622c5dc3bde6a708d2794569b15f1173d5211bfc39976101e20c57b300a8ba20c325a6b929723b8fcb67e129db88b68831c0cde103491a6fb8eb92334f85df9286ad6913759b3f3aa862e5b088920f41da338b6d33e721ca4c2933cad49e0c541d97de1d7db19262fc31f6e"}, 0x105) (async) getpeername$unix(r1, &(0x7f0000000940)=@abs, &(0x7f00000009c0)=0x6e) openat$fuse(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) (async) r2 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000a40)='ns/uts\x00') close(r2) (async) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) (async) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000b00)={0x0, 0x0}, &(0x7f0000000b40)=0xc) lsetxattr$security_capability(&(0x7f0000000a80)='./file0\x00', &(0x7f0000000ac0), &(0x7f0000000b80)=@v3={0x3000000, [{0x5, 0x5000}, {0x558a, 0x9d67}], r4}, 0x18, 0x2) r5 = memfd_create(&(0x7f0000000bc0)='#! ', 0x1) (async) listxattr(&(0x7f0000000c00)='./file0\x00', &(0x7f0000000c40)=""/174, 0xae) (async) recvmsg$inet_nvme(r1, &(0x7f0000002280)={&(0x7f0000000d00)=@pppoe={0x18, 0x0, {0x0, @random}}, 0x80, &(0x7f0000002140)=[{&(0x7f0000000d80)=""/204, 0xcc}, {&(0x7f0000000e80)=""/56, 0x38}, {&(0x7f0000000ec0)=""/249, 0xf9}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000001fc0)=""/27, 0x1b}, {&(0x7f0000002000)=""/38, 0x26}, {&(0x7f0000002040)=""/199, 0xc7}], 0x7, &(0x7f00000021c0)=""/157, 0x9d}, 0x5bcc27a821a0176b) mremap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000ffb000/0x4000)=nil) (async) r6 = add_key$keyring(&(0x7f0000002380), &(0x7f00000023c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffff8) add_key(&(0x7f00000022c0)='id_legacy\x00', &(0x7f0000002300)={'syz', 0x1}, &(0x7f0000002340)="49b9775b624b3bc2e87b5e4fbbcb08e38cebc90a", 0x14, r6) (async) mount$tmpfs(0x0, &(0x7f0000002400)='./file0\x00', &(0x7f0000002440), 0x140a0, &(0x7f0000002480)={[{@huge_never}, {@mode={'mode', 0x3d, 0x8}}, {@grpquota_inode_hardlimit}], [{@obj_role={'obj_role', 0x3d, 'ns/uts\x00'}}, {@appraise_type}, {@smackfshat={'smackfshat', 0x3d, 'id_legacy\x00'}}, {@fowner_lt}]}) ioctl$SNDRV_TIMER_IOCTL_CREATE(r2, 0xc02054a5, &(0x7f0000002540)={0x3353, r5, 'id1\x00'}) (async) r8 = syz_open_procfs$userns(r3, &(0x7f0000002600)) mount_setattr(r7, &(0x7f00000025c0)='./file0\x00', 0x9100, &(0x7f0000002640)={0x10007c, 0x8d, 0x0, {r8}}, 0x20) r9 = ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000002680)={0x1, 0x81}) ioctl$XFS_IOC_OPEN_BY_HANDLE(r0, 0xc038586b, &(0x7f00000027c0)={r9, &(0x7f00000026c0)='ns/user\x00', 0x85002, &(0x7f0000002700)={@_ha_fsid={[0x8, 0xb5]}, {0x6, 0x5, 0xc007, 0xffffffffffff281e}}, 0x5, &(0x7f0000002740), &(0x7f0000002780)=0xf}) preadv(r8, &(0x7f0000003c40)=[{&(0x7f0000002800)=""/161, 0xa1}, {&(0x7f00000028c0)=""/230, 0xe6}, {&(0x7f00000029c0)=""/140, 0x8c}, {&(0x7f0000002a80)=""/4096, 0x1000}, {&(0x7f0000003a80)=""/246, 0xf6}, {&(0x7f0000003b80)=""/182, 0xb6}], 0x6, 0xfff, 0xfffffeff) (async) r10 = syz_socket_connect_nvme_tcp() recvfrom$inet_nvme(r10, &(0x7f0000003cc0)=""/4096, 0x1000, 0x40000040, &(0x7f0000004cc0)=@in6={0xa, 0x4e23, 0x81, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x5}, 0x80) execve(&(0x7f0000004d40)='./file0\x00', &(0x7f0000004d80), &(0x7f0000004e40)={[&(0x7f0000004dc0)='#! ', &(0x7f0000004e00)='\x00']}) (async) ioctl$sock_SIOCGIFCONF(r10, 0x8912, &(0x7f0000004f40)=@buf={0x9b, &(0x7f0000004e80)="90687c94fe25d4a0bda110a20353958310486c2c9dc4dea9ecba44b7a2bbaa30e74d4f42afb581d731d6b632be5fecb59577621c43e7dc15fe3f5d4a7832a0711bb7ffea61fc32f54ef3fb07dd8a14451e8e108c58b1223fd8e8552f1f606017f6270c7c02c44fc56fd7d7bf966a2394f1e4f638018437ff967b3e456e9ea0e529c9500c81b622535f0511d9fba826e17437cfb87213189782e179"}) (async) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000004f80), 0x3) (async) setsockopt$inet_tcp_int(r7, 0x6, 0x3, &(0x7f0000004fc0)=0x3, 0x4) 502.284772ms ago: executing program 0 (id=1969): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000180)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) sendto$packet(r0, 0x0, 0x0, 0x44005, &(0x7f0000000000), 0x14) (async, rerun: 32) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x2, 0x2002) (rerun: 32) readv(r1, &(0x7f0000001480)=[{&(0x7f00000000c0)=""/13, 0xd}], 0x1) (async) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x9, 0xffffffff, 0x4e, 0x567}, 0x13) sendmsg$nl_generic(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="2c0000001600011c00000000fbdbdf250a0000001800ca80140006"], 0x2c}}, 0x40) syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000280)=ANY=[@ANYRES16=r0, @ANYRESDEC, @ANYRES16=0x0, @ANYRES32=r2, @ANYRESDEC=0x0, @ANYRESDEC], &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0}) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpu.stat\x00', 0x0, 0x0) getsockname$inet(r3, &(0x7f0000000080)={0x2, 0x0, @multicast1}, &(0x7f00000000c0)=0x10) 103.981296ms ago: executing program 2 (id=1970): socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x30000010}) (async) ioctl$KDGKBMODE(0xffffffffffffffff, 0x4b44, &(0x7f0000000080)) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000000c0)='team_slave_0\x00', 0x10) ioctl$BTRFS_IOC_WAIT_SYNC(r0, 0x40089416, 0x0) (async) socketpair(0x26, 0x4, 0x10, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r4 = getpgid(0x0) getresgid(&(0x7f0000000580), &(0x7f00000005c0)=0x0, &(0x7f0000000600)) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x200200, 0x0) (async) r7 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000680), 0x802, 0x0) r8 = fcntl$getown(r1, 0x9) (async) r9 = getuid() (async) statx(0xffffffffffffff9c, &(0x7f00000006c0)='./file0\x00', 0x4000, 0x80, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000800)={{{@in6=@remote, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000900)=0xe8) (async) r12 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000940), 0x88201, 0x0) (async) read$FUSE(0xffffffffffffffff, &(0x7f0000000980)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) newfstatat(0xffffffffffffff9c, &(0x7f00000029c0)='./file0\x00', &(0x7f0000002a00)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x4000) (async) read$FUSE(0xffffffffffffffff, &(0x7f0000002a80)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000004ac0)={0x0, 0x0}) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000004b40)=0x0) r18 = getegid() (async) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000004b80)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) (async) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000004c00)={{{@in6=@ipv4={""/10, ""/2, @loopback}, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@initdev}}, &(0x7f0000004d00)=0xe8) (async) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000004d40)={0x0, 0x0, 0x0}, &(0x7f0000004d80)=0xc) sendmmsg$unix(r3, &(0x7f0000005440)=[{{&(0x7f0000000140)=@abs={0x1, 0x0, 0x4e24}, 0x6e, &(0x7f0000000240)=[{&(0x7f00000001c0)="2107d58bde3805a683b5137e616ce9c5c00e2e0f42e443a8065ce67d9399b8eab3d5210d7ce5a0c58de902b8332a7069fdb47335bba9b1a2106875cea5f42e07c0cb654b592b9948222b3a2d7c4952efa3cc86e4", 0x54}], 0x1, &(0x7f0000000280)=[@rights={{0x14, 0x1, 0x1, [r1]}}, @rights={{0x18, 0x1, 0x1, [r1, r1]}}], 0x30, 0x811}}, {{&(0x7f00000002c0)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000340)="f793c60b43b4ff6d148eb2a6764754360afcd7ef7c558bfec0b793167ec0ff6a11ef74a240e1536b149013df00cbd5d81b4f257f26943ee731fb366bde3aa644a9017b38c25c", 0x46}, {&(0x7f00000003c0)="dfa9cf05f2295014756392430c70b0e60816a55529f1c5a147adf68b36d9aeadf2730b3902c0b44d0041faff9d98f5203342e83a3b85a5fa229136a975ef8ba77ebe0725378be225b0ce2c0ec10366f39fd3b656207339b8110b", 0x5a}, {&(0x7f0000000440)="4ca75876e2ce46327e2f5846a8d9337ac2f5c8cebcaebee9b80794316b7a977dc8c953e887dc7607c3d0fdb0a00bf5a5ec", 0x31}, {&(0x7f0000000480)="309fe2acb4ff8ddc61f71ebbb7ac8c4a899efa4a479e970dd6ca39f45a6b2e3aefd8a6b2f3be92ec274e5b689d6978bd74888eeccdc871f34a92d52c28ed7cbae1672b6b0f8b1a5b2b14375364f8d26d5b57f3bb3195261041b15e011d99611100281dbf1c644ca20df80e7486c4bfb28a7029c1643c2a26ca223a0b4ca92d920aa667f18ed0e41e7bc0325b1d1b1dfd999bebd79025bbfacd570a257443c911c09e1370316bae", 0xa7}], 0x4, &(0x7f0000004dc0)=[@cred={{0x1c, 0x1, 0x2, {r4, 0x0, r5}}}, @rights={{0x18, 0x1, 0x1, [r6, r7]}}, @cred={{0x1c, 0x1, 0x2, {r8, r9, r10}}}, @rights={{0x1c, 0x1, 0x1, [r0, r1, r0]}}, @cred={{0x1c, 0x1, 0x2, {0x0, r11}}}, @rights={{0x2c, 0x1, 0x1, [r0, r0, r1, 0xffffffffffffffff, r1, r1, r12]}}, @cred={{0x1c, 0x1, 0x2, {r13, r14, r15}}}, @cred={{0x1c, 0x1, 0x2, {r16, r17, r18}}}, @cred={{0x1c, 0x1, 0x2, {r19, r20, r21}}}], 0x128, 0x24000801}}, {{&(0x7f0000004f00)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f00000053c0)=[{&(0x7f0000004f80)="e93fae027f8d0192737bd78ee087ef7f703d6adb70194e05aef999f85fc3ce806864d291122f201da520e2d7b7b8da3e05016478d3d97f0941067dec195814446f7c7015b0899d56a8868c65c7bb6c8cbd06bcce9c03c25f1b6f793b06286ca67eb14cd86e7da517e6dcd1fe70e977bbfed6a25647b0174ee4d57bb20f67fdf13809bac673084482d590d2794f1a83073bff27f51b194764ecfd4742f4f8d0444b7ab62c4b2e0807d48d8069b156e2fb0f57f7f29ad4050e80864e96eec8ccd043f7b2c480bf0d1177bcb56794f4833f8a910773d4fe77a79084c1378881c37afb9837cd6c358706f3948dd22af08823fa8960b4ce4c04c7c56b147e12", 0xfd}, {&(0x7f0000005080)="ea2c16148d283aaaebd7ea034a2ab383f8d052d5741991c895c80c77443df59b7ff9d0405037f4c5563cd31c1ba9a211be78fec5392d6708392743572b85aa1ef7f51e3e678ab0bd82c551b7d46ccb6467cb7d3f0f1dc58d4c11b64528386aa690a5d702664a9048c05cbd31b3956084d1b64e992a45ef46ca644ee0ff7b74b52aaedabf27930865c33cbc684dbb59b197fad2bc8753a8073e3ea7eddae6329dc21af3fa19988802de9a270eb77bbacae5989eaa3368c99d393bf09315335f5d333764b8304205e6cba1a98f458498392192ad468073a8d11a7f198458c6025a7a03f23e530e7f6564b81c8df39579d83855770a7e804ee3f13636a202", 0xfd}, {&(0x7f0000005180)="818b123491bf0d6eb10eb8cf52d49a04ebeff94bb175df9223284514644faaf7e13e1246a6b4b887b9e832127a8ddd71b830686c2b6b53f92d6e6cf64d347eb72ea9358b2ced81a1b109f7660e7a523af9a6056f5a3f7cc37f9f43be83f36ab5a315cefdcd10af390923a097cd17b8dae3fb80471bb54f3f425a541df58116c8e9a44760c84b639566ac3b0699d9b979b68e26ae98a79c496c4028d6c062ffc92e0810834625aa508ecba36fa84673efa37fe990fddbf8a47257d52d372321387c31", 0xc2}, {&(0x7f0000005280)="d880af7a0a3a607d8cef5d33d68eac694891e9bb4754b8f64276d043db58214ec5f67d61ecf969", 0x27}, {&(0x7f00000052c0)="3d59a1f90e579a736c63abfb1086c3dac553ee81c23986872271729fe7f8e4c30e19787dad0896ce8ef400a4a6981fa4defc9eb47a0bbe87564fd890da08e88f3588e8b2e7441e5c490c7a1fba933d08d809f0fed5a2b371478ebb4096e6d65778408e5e03d730b5470cc6870932a1783c6610ba929795ea679b6aa38de936776285f6ea42165fd84401159ae5d4c3b337d3b33bd17e107ba67c157770c69793d441e86a818e2f549cbcaa03678b43f7b06ed5cd8e3949641f0ebdf8fd428cc66694ac481fa00bb2f6614411cc", 0xcd}], 0x5, 0x0, 0x0, 0x4000004}}], 0x3, 0x40000) (async) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r7, 0xc0385868, &(0x7f0000005600)={r0, &(0x7f0000005500)='\x00', 0x10000, &(0x7f0000005540)={@align=0x80000001, {0x7fff, 0x7eb0, 0xe2, 0xb38}}, 0x9, &(0x7f0000005580)={@_ha_fsid}, &(0x7f00000055c0)=0x9}) ioctl$KVM_PRE_FAULT_MEMORY(r22, 0xc040aed5, &(0x7f0000005640)={0x2}) (async) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000005680)={'wlan1\x00'}) (async) open(&(0x7f00000056c0)='./file0\x00', 0xeb67a00d7a34b957, 0x1ca) openat2$dir(0xffffffffffffff9c, &(0x7f0000005700)='./file0\x00', &(0x7f0000005740)={0x2, 0x186, 0x28}, 0x18) 70.365197ms ago: executing program 2 (id=1971): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newsa={0x138, 0x10, 0x1, 0x70bc2c, 0x0, {{@in6=@mcast2, @in=@private=0xa0100fe, 0x0, 0xecdf, 0x4e24, 0x0, 0xa}, {@in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, 0x0, 0x32}, @in6=@empty, {0xfffffffffffffffe, 0x1, 0x3, 0x0, 0x0, 0xfffffffffffffffe, 0x4, 0x6}, {0x1, 0x400800, 0x9, 0x296}, {0x1, 0x9, 0x4}, 0x1000, 0x0, 0xa, 0x4, 0x0, 0x2c}, [@algo_crypt={0x48, 0x2, {{'cbc(des3_ede)\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x19000000}, 0x44050) 1.76547ms ago: executing program 5 (id=1972): r0 = socket(0x840000000002, 0x3, 0xff) sendmsg$inet(r0, &(0x7f0000000900)={&(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10, &(0x7f00000007c0)=[{&(0x7f0000000940)="974501048cc5595c4a9b8f52ac8e5c0000000000", 0x14}], 0x1, &(0x7f00000008c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x39}, @remote}}}], 0x20}, 0x400c894) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r3, 0x4008ae93, 0x0) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16, @ANYBLOB="090d2000000000f0ff0007000000080003", @ANYRES32, @ANYBLOB="0800051d000000001400060076"], 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x31, 0xffffffffffffffff, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r4, &(0x7f0000000100)={@val={0x8, 0x800}, @val={0x5, 0x0, 0x0, 0x0, 0x14}, @ipv4=@tcp={{0x7, 0x4, 0x2, 0x8, 0x30, 0x67, 0x0, 0xb, 0x6, 0x0, @private=0xa010100, @dev={0xac, 0x14, 0x14, 0x19}, {[@cipso={0x86, 0x6, 0x1}]}}, {{0x4e1d, 0x4e24, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x8, 0x5, 0x0, 0xefff}}}}, 0x3e) r7 = syz_open_procfs(0x0, &(0x7f0000000000)='attr\x00') getdents64(r7, &(0x7f0000002f40)=""/4098, 0x1002) r8 = socket$igmp6(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r8, 0x29, 0x24, 0x0, 0x0) syz_usb_connect$uac1(0x0, 0xaa, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902980003010000000904e10000010100000a2401000000020102132406040006030000000000000000000000000924030000010000ff0924050000f8431cfd0924030604030204001b240404020904", @ANYBLOB='\n'], 0x0) 698.73µs ago: executing program 2 (id=1973): symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000000)='./bus\x00', &(0x7f00000005c0), 0x8040, &(0x7f0000000600)={[{@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0xa0) getdents(r0, &(0x7f0000000080)=""/143, 0x8f) 177.87µs ago: executing program 2 (id=1974): unshare(0x60000600) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000440)={'tunl0\x00', &(0x7f0000000480)={'syztnl0\x00', 0x0, 0x700, 0x8, 0x4000006, 0x8, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x67, 0x0, 0x9, 0x4, 0x0, @multicast1, @empty}}}}) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000600)=[{{0x0, 0x0, 0x0}, 0x9}, {{0x0, 0x0, 0x0}, 0x800007}, {{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000001180)=""/4059, 0xfdb}, {&(0x7f0000002e40)=""/200, 0xc8}, {&(0x7f0000000980)=""/265, 0x109}, {&(0x7f0000000780)=""/173, 0xad}, {&(0x7f0000000300)=""/226, 0xe2}, {&(0x7f0000000b40)=""/116, 0x74}, {&(0x7f0000000bc0)=""/239, 0xef}, {&(0x7f0000000240)=""/111, 0x6f}, {&(0x7f00000004c0)=""/98, 0x62}, {&(0x7f0000000000)=""/25, 0x19}], 0xa}, 0x120a}], 0x3, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x15) ioctl$XFS_IOC_FSBULKSTAT(r2, 0xc0205865, &(0x7f00000002c0)={&(0x7f0000000040)=0x8000000000000000, 0x5, &(0x7f0000000080)=[{}], &(0x7f0000000140)}) 0s ago: executing program 0 (id=1975): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000500), 0x101800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x1fb, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = syz_usb_connect$hid(0x5, 0x3f, &(0x7f0000000180)=ANY=[@ANYRESDEC=r2], 0x0) readlink(&(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)=""/164, 0xa4) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io(r3, &(0x7f0000000000)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="400e230000000b2100f12de5"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac1(0xffffffffffffffff, &(0x7f0000000300)={0x14, &(0x7f00000001c0)={0x20, 0xf, 0xe5, {0xe5, 0x23, "8cd5875576154f235163896dddd3d17c2807d7a6f3d4502943578d78a2ee5cb5bff718c1bdc0a65fe3b2cb0594eea2355ab64ea97bb742f8261c62c4aa7b6bfbf271163e55872d362b43731b54bec27e69586dbf45643bc10b7e16f3e56e598f6d5535b28a3ba4a2f0a53b5bf1e53f0bee5d8fd4f5d8eaff0292b06dd410960936f395c6bcbd2cdda891bd460c2a9a4245f27e82380da1e922065e3f5fec09d31fda40474f4c8db79213d28602a6e4ec1aa7fe26c27e51fae254a20de714e65710c4b39416656812c95294b87731bc6eb7e471b8a464a0f38e3f89c3b9860a2374904a"}}, &(0x7f00000002c0)={0x0, 0x3, 0x27, @string={0x27, 0x3, "ebf7c649b6432f27fb0197848228d2d941a73f4bb80881b4578e1f5cdc3f921da5f6e36b64"}}}, &(0x7f0000000600)={0x44, &(0x7f0000000340)={0x20, 0x14, 0x7e, "c2682b1dca0862bfcd242506bd883eab25737ed7c72536eb44c914e3d6a37edc9922cb138f5b70468352791cf5d87d468769fce12d7714c7757d1033a1b0a093d747e3e5c802fab81f8a740ffab4843dd5ce26a6309aa2a217556ee9eb8034213554fcccc0f6e1eb68fbe505d0f4d824d339d89f611f4afc801e73130d3b"}, &(0x7f0000000400)={0x0, 0xa, 0x1, 0x81}, &(0x7f0000000440)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000480)=ANY=[@ANYBLOB="203c276afc35"], &(0x7f00000004c0)={0x20, 0x82, 0x2, "66f7"}, &(0x7f0000000540)={0x20, 0x83, 0x1, ']'}, &(0x7f0000000580)={0x20, 0x84, 0x1, 'J'}, &(0x7f00000005c0)={0x20, 0x85, 0x3, "9e5f3e"}}) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) sendmsg$sock(0xffffffffffffffff, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f00000024c0)={0x73622a85, 0xa}) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r6 = dup3(r5, r4, 0x0) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) r8 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r8, 0x107, 0x17, &(0x7f0000001140)=0x401, 0x4) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r7, 0x0) ioctl$TIOCGPGRP(r6, 0x540f, &(0x7f0000002440)=0x0) sched_setscheduler(r9, 0x0, &(0x7f0000002480)=0x5) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f0000001000)={0x73622a85, 0x10b, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000002500)={0x1c, 0x0, &(0x7f0000000100)=[@release, @increfs_done={0x40106308, 0x1}], 0x0, 0x0, 0x0}) syz_usb_connect$uac2(0x6, 0x23, 0x0, 0x0) getsockopt(0xffffffffffffffff, 0x8, 0x7, 0x0, 0x0) syz_clone(0x80001000, 0x0, 0x0, &(0x7f0000000000), 0x0, 0x0) r10 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fdinfo/3\x00') read$FUSE(r10, &(0x7f0000000400)={0x2020}, 0x1f8c) unshare(0xc040400) kernel console output (not intermixed with test programs): IP: 0033:0x7f689859ce59 [ 120.718486][ T3292] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 120.718568][ T3292] RSP: 002b:00007f6899523028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 120.718589][ T3292] RAX: ffffffffffffffda RBX: 00007f6898815fa0 RCX: 00007f689859ce59 [ 120.718598][ T3292] RDX: 00000000000005ac RSI: 00002000000000c0 RDI: 0000000000000003 [ 120.718605][ T3292] RBP: 00007f6899523090 R08: 0000000000000000 R09: 0000000000000000 [ 120.718612][ T3292] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 120.718619][ T3292] R13: 00007f6898816038 R14: 00007f6898815fa0 R15: 00007ffdb28104e8 [ 120.718629][ T3292] [ 121.010893][ T942] input: syz as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.88/input/input26 [ 121.026110][ T942] usb 1-1: USB disconnect, device number 43 [ 121.094749][ T3297] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1026'. [ 121.272917][ T667] usb 5-1: new low-speed USB device number 6 using dummy_hcd [ 121.423950][ T667] usb 5-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 121.435053][ T667] usb 5-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 121.445853][ T667] usb 5-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 12 [ 121.458809][ T667] usb 5-1: config 0 interface 0 has no altsetting 0 [ 121.465634][ T667] usb 5-1: New USB device found, idVendor=056a, idProduct=0027, bcdDevice= 0.00 [ 121.474875][ T667] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 121.493106][ T667] usb 5-1: config 0 descriptor?? [ 121.499066][ T3305] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 121.508440][ T3294] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 121.515697][ T3305] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 121.534720][ T3305] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 121.548069][ T3305] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 121.576608][ T3307] overlayfs: disabling nfs_export due to verity=on [ 121.583224][ T3307] overlayfs: missing 'lowerdir' [ 121.897423][ T36] audit: type=1326 audit(1778888432.859:23541): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3324 comm="syz.3.1035" exe="/root/ci2-android-6-12-rust/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe8d6d9ce59 code=0x0 [ 121.934472][ T667] wacom 0003:056A:0027.000F: unknown main item tag 0x3 [ 121.941391][ T667] wacom 0003:056A:0027.000F: unknown main item tag 0x0 [ 121.948748][ T667] wacom 0003:056A:0027.000F: unknown main item tag 0x0 [ 121.949928][ T3326] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 121.955687][ T667] wacom 0003:056A:0027.000F: unknown main item tag 0x0 [ 121.964245][ T3326] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 121.971705][ T667] wacom 0003:056A:0027.000F: unknown main item tag 0x0 [ 121.985793][ T667] wacom 0003:056A:0027.000F: unknown main item tag 0x0 [ 121.992660][ T667] wacom 0003:056A:0027.000F: unknown main item tag 0x0 [ 121.999591][ T667] wacom 0003:056A:0027.000F: unknown main item tag 0x0 [ 122.006850][ T667] wacom 0003:056A:0027.000F: Unknown device_type for 'HID 056a:0027'. Assuming pen. [ 122.017199][ T667] wacom 0003:056A:0027.000F: hidraw0: USB HID v0.04 Device [HID 056a:0027] on usb-dummy_hcd.4-1/input0 [ 122.038399][ T667] input: Wacom Intuos5 touch M Pen as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:056A:0027.000F/input/input27 [ 122.053819][ T3330] FAULT_INJECTION: forcing a failure. [ 122.053819][ T3330] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 122.067163][ T3330] CPU: 0 UID: 0 PID: 3330 Comm: syz.0.1036 Not tainted syzkaller #0 c85af0946947830cbbda05564cc921f578791c52 [ 122.067195][ T3330] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 122.067207][ T3330] Call Trace: [ 122.067212][ T3330] [ 122.067220][ T3330] __dump_stack+0x21/0x30 [ 122.067250][ T3330] dump_stack_lvl+0x140/0x1c0 [ 122.067336][ T3330] ? __cfi_dump_stack_lvl+0x10/0x10 [ 122.067351][ T3330] dump_stack+0x19/0x20 [ 122.067365][ T3330] should_fail_ex+0x3d7/0x530 [ 122.067377][ T3330] should_fail_alloc_page+0xec/0x110 [ 122.067391][ T3330] __alloc_pages_noprof+0x1c0/0x7e0 [ 122.067406][ T3330] ? __asan_memcpy+0x5a/0x80 [ 122.067416][ T3330] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 122.067431][ T3330] ? __asan_memset+0x39/0x50 [ 122.067441][ T3330] ? nla_put+0xf3/0x150 [ 122.067454][ T3330] ? rtnl_fill_link_af+0x3fa/0x470 [ 122.067468][ T3330] __folio_alloc_noprof+0x14/0x80 [ 122.067482][ T3330] folio_prealloc+0x46/0x220 [ 122.067495][ T3330] do_pte_missing+0x169c/0x4410 [ 122.067510][ T3330] ? pte_marker_clear+0x1b0/0x1b0 [ 122.067524][ T3330] ? __pte_offset_map+0x1b0/0x230 [ 122.067539][ T3330] ? pte_offset_map_rw_nolock+0xba/0x110 [ 122.067554][ T3330] handle_mm_fault+0x11b8/0x1bf0 [ 122.067568][ T3330] ? __cfi_handle_mm_fault+0x10/0x10 [ 122.067580][ T3330] ? find_vma+0xd3/0x120 [ 122.067591][ T3330] ? lock_mm_and_find_vma+0xb8/0x390 [ 122.067603][ T3330] do_user_addr_fault+0x4c9/0x11e0 [ 122.067615][ T3330] exc_page_fault+0x58/0xc0 [ 122.067630][ T3330] asm_exc_page_fault+0x2b/0x30 [ 122.067641][ T3330] RIP: 0010:rep_movs_alternative+0x4a/0xa0 [ 122.067658][ T3330] Code: 75 f1 e9 d9 6a 03 00 66 0f 1f 84 00 00 00 00 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 73 e8 eb c9 a4 c3 cc cc cc cc 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 122.067670][ T3330] RSP: 0018:ffffc90000e7f4b8 EFLAGS: 00050202 [ 122.067682][ T3330] RAX: ffffffff82ae2c01 RBX: ffff8881220d4000 RCX: 0000000000000b1c [ 122.067691][ T3330] RDX: 0000000000000000 RSI: ffff8881220d4000 RDI: 0000200000001fc0 [ 122.067699][ T3330] RBP: ffffc90000e7f610 R08: ffff8881220d4b1b R09: 1ffff1102441a963 [ 122.067707][ T3330] R10: dffffc0000000000 R11: ffffed102441a964 R12: 0000200000001fc0 [ 122.067715][ T3330] R13: 0000000000000000 R14: 0000000000000b1c R15: ffffc90000e7fd48 [ 122.067723][ T3330] ? _copy_to_iter+0x331/0x1510 [ 122.067736][ T3330] ? _copy_to_iter+0x441/0x1510 [ 122.067748][ T3330] ? __cfi__copy_to_iter+0x10/0x10 [ 122.067759][ T3330] ? __check_object_size+0x527/0x830 [ 122.067771][ T3330] ? __cfi___check_object_size+0x10/0x10 [ 122.067781][ T3330] ? __skb_try_recv_datagram+0x3de/0x4e0 [ 122.067797][ T3330] __skb_datagram_iter+0x103/0x930 [ 122.067811][ T3330] ? __cfi_simple_copy_to_iter+0x10/0x10 [ 122.067825][ T3330] skb_copy_datagram_iter+0x44/0x160 [ 122.067839][ T3330] netlink_recvmsg+0x2d4/0xe60 [ 122.067850][ T3330] ? __cfi_netlink_recvmsg+0x10/0x10 [ 122.067860][ T3330] ? __cfi_selinux_file_open+0x10/0x10 [ 122.067872][ T3330] ? bpf_lsm_socket_recvmsg+0xd/0x20 [ 122.067885][ T3330] ? security_socket_recvmsg+0x44/0x130 [ 122.067899][ T3330] ? __cfi_netlink_recvmsg+0x10/0x10 [ 122.067908][ T3330] sock_recvmsg+0x189/0x1e0 [ 122.067944][ T3330] ____sys_recvmsg+0x1e7/0x4a0 [ 122.067955][ T3330] ? __sys_recvmsg_sock+0x60/0x60 [ 122.067966][ T3330] ? import_iovec+0x80/0xb0 [ 122.067979][ T3330] ___sys_recvmsg+0x216/0x590 [ 122.067989][ T3330] ? __sys_recvmsg+0x290/0x290 [ 122.067999][ T3330] ? __cfi_kstrtouint_from_user+0x10/0x10 [ 122.068015][ T3330] ? selinux_file_permission+0x318/0xb60 [ 122.068031][ T3330] ? __fget_files+0x2c5/0x340 [ 122.068044][ T3330] do_recvmmsg+0x380/0x830 [ 122.068055][ T3330] ? __sys_recvmmsg+0x2a0/0x2a0 [ 122.068065][ T3330] ? __cfi_vfs_write+0x10/0x10 [ 122.068077][ T3330] ? fput+0x1a4/0x240 [ 122.068090][ T3330] __x64_sys_recvmmsg+0x199/0x250 [ 122.068101][ T3330] ? __cfi___x64_sys_recvmmsg+0x10/0x10 [ 122.068111][ T3330] ? __kasan_check_read+0x15/0x20 [ 122.068122][ T3330] x64_sys_call+0x292c/0x2ee0 [ 122.068132][ T3330] do_syscall_64+0x57/0xf0 [ 122.068142][ T3330] ? clear_bhb_loop+0x50/0xa0 [ 122.068154][ T3330] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 122.068166][ T3330] RIP: 0033:0x7f299d59ce59 [ 122.068176][ T3330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 122.068190][ T3330] RSP: 002b:00007f299bff7028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 122.068202][ T3330] RAX: ffffffffffffffda RBX: 00007f299d815fa0 RCX: 00007f299d59ce59 [ 122.068211][ T3330] RDX: 0000000000000001 RSI: 0000200000006a40 RDI: 0000000000000003 [ 122.068222][ T3330] RBP: 00007f299bff7090 R08: 0000000000000000 R09: 0000000000000000 [ 122.068232][ T3330] R10: 0000000000000020 R11: 0000000000000246 R12: 0000000000000001 [ 122.068242][ T3330] R13: 00007f299d816038 R14: 00007f299d815fa0 R15: 00007fff31b22f18 [ 122.068321][ T3330] [ 122.146946][ T3294] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 122.199109][ T3344] FAULT_INJECTION: forcing a failure. [ 122.199109][ T3344] name failslab, interval 1, probability 0, space 0, times 0 [ 122.203398][ T3294] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 122.209348][ T3344] CPU: 0 UID: 0 PID: 3344 Comm: syz.0.1043 Not tainted syzkaller #0 c85af0946947830cbbda05564cc921f578791c52 [ 122.209377][ T3344] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 122.209391][ T3344] Call Trace: [ 122.209397][ T3344] [ 122.209403][ T3344] __dump_stack+0x21/0x30 [ 122.209435][ T3344] dump_stack_lvl+0x140/0x1c0 [ 122.209459][ T3344] ? __cfi_dump_stack_lvl+0x10/0x10 [ 122.209485][ T3344] ? ip6_route_output_flags+0x315/0x480 [ 122.209511][ T3344] dump_stack+0x19/0x20 [ 122.209534][ T3344] should_fail_ex+0x3d7/0x530 [ 122.209552][ T3344] should_failslab+0xac/0x100 [ 122.209575][ T3344] __kmalloc_cache_noprof+0x41/0x470 [ 122.209594][ T3344] ? __cfi__raw_spin_lock_bh+0x10/0x10 [ 122.209612][ T3344] ? ip6_setup_cork+0x1c9/0x13f0 [ 122.209635][ T3344] ip6_setup_cork+0x1c9/0x13f0 [ 122.209738][ T3344] ? __cfi_lock_sock_nested+0x10/0x10 [ 122.209759][ T3344] ip6_append_data+0x21c/0x380 [ 122.209781][ T3344] ? __cfi_raw6_getfrag+0x10/0x10 [ 122.209805][ T3344] rawv6_sendmsg+0x13db/0x19c0 [ 122.209828][ T3344] ? __cfi_rawv6_sendmsg+0x10/0x10 [ 122.209850][ T3344] ? unwind_get_return_address+0x51/0x90 [ 122.209875][ T3344] ? selinux_socket_sendmsg+0x281/0x380 [ 122.209899][ T3344] ? avc_has_perm+0x155/0x240 [ 122.209920][ T3344] ? inet_send_prepare+0x64/0x4e0 [ 122.209940][ T3344] ? __cfi_rawv6_sendmsg+0x10/0x10 [ 122.209962][ T3344] inet_sendmsg+0x116/0x120 [ 122.209982][ T3344] ? __cfi_inet_sendmsg+0x10/0x10 [ 122.210001][ T3344] sock_write_iter+0x3c2/0x490 [ 122.210020][ T3344] ? __cfi_sock_write_iter+0x10/0x10 [ 122.210041][ T3344] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 122.210067][ T3344] vfs_write+0x761/0xf90 [ 122.210087][ T3344] ? __cfi_vfs_write+0x10/0x10 [ 122.210107][ T3344] ksys_write+0x145/0x260 [ 122.210125][ T3344] ? __cfi_ksys_write+0x10/0x10 [ 122.210144][ T3344] ? __kasan_check_read+0x15/0x20 [ 122.210162][ T3344] __x64_sys_write+0x7f/0x90 [ 122.210180][ T3344] x64_sys_call+0x271c/0x2ee0 [ 122.210198][ T3344] do_syscall_64+0x57/0xf0 [ 122.210216][ T3344] ? clear_bhb_loop+0x50/0xa0 [ 122.210237][ T3344] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 122.210258][ T3344] RIP: 0033:0x7f299d59ce59 [ 122.210274][ T3344] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 122.210291][ T3344] RSP: 002b:00007f299bff7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 122.210315][ T3344] RAX: ffffffffffffffda RBX: 00007f299d815fa0 RCX: 00007f299d59ce59 [ 122.210330][ T3344] RDX: 00000000000005ac RSI: 00002000000000c0 RDI: 0000000000000003 [ 122.210343][ T3344] RBP: 00007f299bff7090 R08: 0000000000000000 R09: 0000000000000000 [ 122.210355][ T3344] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 122.210366][ T3344] R13: 00007f299d816038 R14: 00007f299d815fa0 R15: 00007fff31b22f18 [ 122.210382][ T3344] [ 122.227156][ T3346] overlayfs: failed to create directory ./file0/work (errno: 22); mounting read-only [ 122.233736][ T942] usb 5-1: USB disconnect, device number 6 [ 122.793393][ T3356] input: syz1 as /devices/virtual/input/input30 [ 122.977184][ T3364] netlink: 84 bytes leftover after parsing attributes in process `syz.0.1050'. [ 122.978923][ T3361] netlink: 'syz.4.1049': attribute type 1 has an invalid length. [ 123.303819][ T3378] FAULT_INJECTION: forcing a failure. [ 123.303819][ T3378] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 123.317147][ T3378] CPU: 0 UID: 0 PID: 3378 Comm: syz.4.1055 Not tainted syzkaller #0 c85af0946947830cbbda05564cc921f578791c52 [ 123.317179][ T3378] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 123.317190][ T3378] Call Trace: [ 123.317196][ T3378] [ 123.317203][ T3378] __dump_stack+0x21/0x30 [ 123.317231][ T3378] dump_stack_lvl+0x140/0x1c0 [ 123.317255][ T3378] ? __cfi_dump_stack_lvl+0x10/0x10 [ 123.317334][ T3378] ? __alloc_pages_noprof+0x7e0/0x7e0 [ 123.317359][ T3378] dump_stack+0x19/0x20 [ 123.317381][ T3378] should_fail_ex+0x3d7/0x530 [ 123.317398][ T3378] should_fail_alloc_page+0xec/0x110 [ 123.317419][ T3378] __alloc_pages_noprof+0x1c0/0x7e0 [ 123.317442][ T3378] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 123.317467][ T3378] ? folio_add_lru+0x116/0x400 [ 123.317489][ T3378] ? __cfi_folio_add_lru+0x10/0x10 [ 123.317508][ T3378] ? __kasan_check_read+0x15/0x20 [ 123.317526][ T3378] __folio_alloc_noprof+0x14/0x80 [ 123.317548][ T3378] folio_prealloc+0x46/0x220 [ 123.317568][ T3378] do_pte_missing+0x169c/0x4410 [ 123.317591][ T3378] ? cgroup_rstat_updated+0x141/0x810 [ 123.317612][ T3378] ? pte_marker_clear+0x1b0/0x1b0 [ 123.317632][ T3378] ? __cfi_cgroup_rstat_updated+0x10/0x10 [ 123.317652][ T3378] ? __pte_offset_map+0x1b0/0x230 [ 123.317675][ T3378] ? pte_offset_map_rw_nolock+0xba/0x110 [ 123.317701][ T3378] handle_mm_fault+0x11b8/0x1bf0 [ 123.317722][ T3378] ? __cfi_handle_mm_fault+0x10/0x10 [ 123.317742][ T3378] ? find_vma+0xd3/0x120 [ 123.317767][ T3378] ? lock_mm_and_find_vma+0xb8/0x390 [ 123.317787][ T3378] do_user_addr_fault+0x4c9/0x11e0 [ 123.317813][ T3378] exc_page_fault+0x58/0xc0 [ 123.317839][ T3378] asm_exc_page_fault+0x2b/0x30 [ 123.317858][ T3378] RIP: 0010:rep_movs_alternative+0x4a/0xa0 [ 123.317883][ T3378] Code: 75 f1 e9 d9 6a 03 00 66 0f 1f 84 00 00 00 00 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 73 e8 eb c9 a4 c3 cc cc cc cc 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 123.317898][ T3378] RSP: 0018:ffffc9000b79f4b8 EFLAGS: 00050202 [ 123.317915][ T3378] RAX: ffffffff82ae2c01 RBX: ffff8881190b0000 RCX: 0000000000000b68 [ 123.317929][ T3378] RDX: 0000000000000000 RSI: ffff8881190b0040 RDI: 0000200000002000 [ 123.317942][ T3378] RBP: ffffc9000b79f610 R08: ffff8881190b0ba7 R09: 1ffff11023216174 [ 123.317955][ T3378] R10: dffffc0000000000 R11: ffffed1023216175 R12: 0000200000001fc0 [ 123.317968][ T3378] R13: 0000000000000000 R14: 0000000000000ba8 R15: ffffc9000b79fd48 [ 123.317981][ T3378] ? _copy_to_iter+0x331/0x1510 [ 123.318000][ T3378] ? _copy_to_iter+0x441/0x1510 [ 123.318019][ T3378] ? __cfi__copy_to_iter+0x10/0x10 [ 123.318036][ T3378] ? __check_object_size+0x527/0x830 [ 123.318054][ T3378] ? __cfi___check_object_size+0x10/0x10 [ 123.318070][ T3378] ? __skb_try_recv_datagram+0x3de/0x4e0 [ 123.318094][ T3378] __skb_datagram_iter+0x103/0x930 [ 123.318117][ T3378] ? __cfi_simple_copy_to_iter+0x10/0x10 [ 123.318140][ T3378] skb_copy_datagram_iter+0x44/0x160 [ 123.318163][ T3378] netlink_recvmsg+0x2d4/0xe60 [ 123.318179][ T3378] ? __cfi_netlink_recvmsg+0x10/0x10 [ 123.318195][ T3378] ? __cfi_selinux_file_open+0x10/0x10 [ 123.318213][ T3378] ? bpf_lsm_socket_recvmsg+0xd/0x20 [ 123.318232][ T3378] ? security_socket_recvmsg+0x44/0x130 [ 123.318252][ T3378] ? __cfi_netlink_recvmsg+0x10/0x10 [ 123.318291][ T3378] sock_recvmsg+0x189/0x1e0 [ 123.318311][ T3378] ____sys_recvmsg+0x1e7/0x4a0 [ 123.318327][ T3378] ? __sys_recvmsg_sock+0x60/0x60 [ 123.318345][ T3378] ? import_iovec+0x80/0xb0 [ 123.318365][ T3378] ___sys_recvmsg+0x216/0x590 [ 123.318381][ T3378] ? __sys_recvmsg+0x290/0x290 [ 123.318397][ T3378] ? __cfi_kstrtouint_from_user+0x10/0x10 [ 123.318422][ T3378] ? selinux_file_permission+0x318/0xb60 [ 123.318447][ T3378] ? __fget_files+0x2c5/0x340 [ 123.318468][ T3378] do_recvmmsg+0x380/0x830 [ 123.318485][ T3378] ? __sys_recvmmsg+0x2a0/0x2a0 [ 123.318500][ T3378] ? __cfi_vfs_write+0x10/0x10 [ 123.318519][ T3378] ? fput+0x1a4/0x240 [ 123.318541][ T3378] __x64_sys_recvmmsg+0x199/0x250 [ 123.318557][ T3378] ? __cfi___x64_sys_recvmmsg+0x10/0x10 [ 123.318573][ T3378] ? __kasan_check_read+0x15/0x20 [ 123.318590][ T3378] x64_sys_call+0x292c/0x2ee0 [ 123.318606][ T3378] do_syscall_64+0x57/0xf0 [ 123.318622][ T3378] ? clear_bhb_loop+0x50/0xa0 [ 123.318641][ T3378] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 123.318659][ T3378] RIP: 0033:0x7f689859ce59 [ 123.318673][ T3378] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 123.318688][ T3378] RSP: 002b:00007f6899523028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 123.318705][ T3378] RAX: ffffffffffffffda RBX: 00007f6898815fa0 RCX: 00007f689859ce59 [ 123.318718][ T3378] RDX: 0000000000000001 RSI: 0000200000006a40 RDI: 0000000000000003 [ 123.318730][ T3378] RBP: 00007f6899523090 R08: 0000000000000000 R09: 0000000000000000 [ 123.318741][ T3378] R10: 0000000000000020 R11: 0000000000000246 R12: 0000000000000001 [ 123.318751][ T3378] R13: 00007f6898816038 R14: 00007f6898815fa0 R15: 00007ffdb28104e8 [ 123.318772][ T3378] [ 123.883659][ T3385] netlink: 3 bytes leftover after parsing attributes in process `syz.4.1057'. [ 124.053035][ T3385] 9pnet_fd: Insufficient options for proto=fd [ 124.062731][ T3385] SELinux: Context system_u:object_r:framebuf_device_t:s0 is not valid (left unmapped). [ 124.074329][ T36] audit: type=1400 audit(1778888436.046:23542): avc: denied { relabelto } for pid=3384 comm="syz.4.1057" name="file1" dev="overlay" ino=334 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="system_u:object_r:framebuf_device_t:s0" [ 124.102542][ T36] audit: type=1400 audit(1778888436.046:23543): avc: denied { associate } for pid=3384 comm="syz.4.1057" name="#340" dev="tmpfs" ino=340 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:framebuf_device_t:s0" [ 124.163002][ T3390] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1059'. [ 124.236472][ T3400] FAULT_INJECTION: forcing a failure. [ 124.236472][ T3400] name failslab, interval 1, probability 0, space 0, times 0 [ 124.249310][ T3400] CPU: 1 UID: 0 PID: 3400 Comm: syz.4.1063 Not tainted syzkaller #0 c85af0946947830cbbda05564cc921f578791c52 [ 124.249350][ T3400] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 124.249361][ T3400] Call Trace: [ 124.249365][ T3400] [ 124.249371][ T3400] __dump_stack+0x21/0x30 [ 124.249392][ T3400] dump_stack_lvl+0x140/0x1c0 [ 124.249407][ T3400] ? __cfi_dump_stack_lvl+0x10/0x10 [ 124.249422][ T3400] dump_stack+0x19/0x20 [ 124.249436][ T3400] should_fail_ex+0x3d7/0x530 [ 124.249454][ T3400] should_failslab+0xac/0x100 [ 124.249535][ T3400] __kmalloc_node_track_caller_noprof+0x68/0x4f0 [ 124.249549][ T3400] ? ip6_setup_cork+0x696/0x13f0 [ 124.249563][ T3400] ? __kmalloc_cache_noprof+0x23c/0x470 [ 124.249574][ T3400] ? __cfi__raw_spin_lock_bh+0x10/0x10 [ 124.249586][ T3400] kmemdup_noprof+0x31/0x80 [ 124.249601][ T3400] ip6_setup_cork+0x696/0x13f0 [ 124.249614][ T3400] ip6_append_data+0x21c/0x380 [ 124.249626][ T3400] ? __cfi_raw6_getfrag+0x10/0x10 [ 124.249640][ T3400] rawv6_sendmsg+0x13db/0x19c0 [ 124.249654][ T3400] ? __cfi_rawv6_sendmsg+0x10/0x10 [ 124.249667][ T3400] ? unwind_get_return_address+0x51/0x90 [ 124.249683][ T3400] ? selinux_socket_sendmsg+0x281/0x380 [ 124.249721][ T3400] ? avc_has_perm+0x155/0x240 [ 124.249733][ T3400] ? inet_send_prepare+0x64/0x4e0 [ 124.249745][ T3400] ? __cfi_rawv6_sendmsg+0x10/0x10 [ 124.249758][ T3400] inet_sendmsg+0x116/0x120 [ 124.249769][ T3400] ? __cfi_inet_sendmsg+0x10/0x10 [ 124.249780][ T3400] sock_write_iter+0x3c2/0x490 [ 124.249792][ T3400] ? __cfi_sock_write_iter+0x10/0x10 [ 124.249804][ T3400] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 124.249820][ T3400] vfs_write+0x761/0xf90 [ 124.249832][ T3400] ? __cfi_vfs_write+0x10/0x10 [ 124.249844][ T3400] ksys_write+0x145/0x260 [ 124.249854][ T3400] ? __cfi_ksys_write+0x10/0x10 [ 124.249865][ T3400] ? __kasan_check_read+0x15/0x20 [ 124.249875][ T3400] __x64_sys_write+0x7f/0x90 [ 124.249886][ T3400] x64_sys_call+0x271c/0x2ee0 [ 124.249896][ T3400] do_syscall_64+0x57/0xf0 [ 124.249906][ T3400] ? clear_bhb_loop+0x50/0xa0 [ 124.249920][ T3400] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 124.249934][ T3400] RIP: 0033:0x7f689859ce59 [ 124.249945][ T3400] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 124.249954][ T3400] RSP: 002b:00007f6899523028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 124.249969][ T3400] RAX: ffffffffffffffda RBX: 00007f6898815fa0 RCX: 00007f689859ce59 [ 124.249978][ T3400] RDX: 00000000000005ac RSI: 00002000000000c0 RDI: 0000000000000003 [ 124.249985][ T3400] RBP: 00007f6899523090 R08: 0000000000000000 R09: 0000000000000000 [ 124.249992][ T3400] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 124.249999][ T3400] R13: 00007f6898816038 R14: 00007f6898815fa0 R15: 00007ffdb28104e8 [ 124.250008][ T3400] [ 124.512914][ T357] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 124.575685][ T3413] rust_binder: 3409:3413 transaction to 0 failed: ENOENT [ 124.700881][ T357] usb 1-1: New USB device found, idVendor=1235, idProduct=8004, bcdDevice= 0.40 [ 124.717175][ T357] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 124.726404][ T357] usb 1-1: Product: syz [ 124.730598][ T357] usb 1-1: Manufacturer: syz [ 124.735251][ T357] usb 1-1: SerialNumber: syz [ 124.810166][ T36] audit: type=1400 audit(1778888436.776:23544): avc: denied { execheap } for pid=3428 comm="syz.4.1074" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 124.978998][ T3453] FAULT_INJECTION: forcing a failure. [ 124.978998][ T3453] name failslab, interval 1, probability 0, space 0, times 0 [ 124.992027][ T3453] CPU: 0 UID: 0 PID: 3453 Comm: syz.3.1084 Not tainted syzkaller #0 c85af0946947830cbbda05564cc921f578791c52 [ 124.992064][ T3453] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 124.992076][ T3453] Call Trace: [ 124.992081][ T3453] [ 124.992088][ T3453] __dump_stack+0x21/0x30 [ 124.992119][ T3453] dump_stack_lvl+0x140/0x1c0 [ 124.992145][ T3453] ? __cfi_dump_stack_lvl+0x10/0x10 [ 124.992171][ T3453] ? stack_depot_save_flags+0x38/0x800 [ 124.992191][ T3453] dump_stack+0x19/0x20 [ 124.992214][ T3453] should_fail_ex+0x3d7/0x530 [ 124.992232][ T3453] should_failslab+0xac/0x100 [ 124.992253][ T3453] kmem_cache_alloc_node_noprof+0x45/0x420 [ 124.992273][ T3453] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 124.992294][ T3453] ? __alloc_skb+0x108/0x370 [ 124.992316][ T3453] __alloc_skb+0x108/0x370 [ 124.992338][ T3453] __ip6_append_data+0x2b2f/0x3d40 [ 124.992363][ T3453] ? __kasan_kmalloc+0x96/0xb0 [ 124.992384][ T3453] ? __cfi_raw6_getfrag+0x10/0x10 [ 124.992407][ T3453] ? kmemdup_noprof+0x5b/0x80 [ 124.992434][ T3453] ? ip6_setup_cork+0x13f0/0x13f0 [ 124.992454][ T3453] ? ip6_append_data+0x25e/0x380 [ 124.992473][ T3453] ip6_append_data+0x1b1/0x380 [ 124.992492][ T3453] ? __cfi_raw6_getfrag+0x10/0x10 [ 124.992514][ T3453] rawv6_sendmsg+0x13db/0x19c0 [ 124.992535][ T3453] ? __cfi_rawv6_sendmsg+0x10/0x10 [ 124.992557][ T3453] ? unwind_get_return_address+0x51/0x90 [ 124.992584][ T3453] ? selinux_socket_sendmsg+0x281/0x380 [ 124.992610][ T3453] ? avc_has_perm+0x155/0x240 [ 124.992632][ T3453] ? inet_send_prepare+0x64/0x4e0 [ 124.992653][ T3453] ? __cfi_rawv6_sendmsg+0x10/0x10 [ 124.992677][ T3453] inet_sendmsg+0x116/0x120 [ 124.992696][ T3453] ? __cfi_inet_sendmsg+0x10/0x10 [ 124.992725][ T3453] sock_write_iter+0x3c2/0x490 [ 124.992745][ T3453] ? __cfi_sock_write_iter+0x10/0x10 [ 124.992766][ T3453] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 124.992794][ T3453] vfs_write+0x761/0xf90 [ 124.992813][ T3453] ? __cfi_vfs_write+0x10/0x10 [ 124.992831][ T3453] ksys_write+0x145/0x260 [ 124.992857][ T3453] ? __cfi_ksys_write+0x10/0x10 [ 124.992874][ T3453] ? __kasan_check_read+0x15/0x20 [ 124.992893][ T3453] __x64_sys_write+0x7f/0x90 [ 124.992913][ T3453] x64_sys_call+0x271c/0x2ee0 [ 124.992932][ T3453] do_syscall_64+0x57/0xf0 [ 124.992951][ T3453] ? clear_bhb_loop+0x50/0xa0 [ 124.992971][ T3453] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 124.993060][ T3453] RIP: 0033:0x7fe8d6d9ce59 [ 124.993078][ T3453] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 124.993094][ T3453] RSP: 002b:00007fe8d7caa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 124.993116][ T3453] RAX: ffffffffffffffda RBX: 00007fe8d7015fa0 RCX: 00007fe8d6d9ce59 [ 124.993131][ T3453] RDX: 00000000000005ac RSI: 00002000000000c0 RDI: 0000000000000003 [ 124.993145][ T3453] RBP: 00007fe8d7caa090 R08: 0000000000000000 R09: 0000000000000000 [ 124.993158][ T3453] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 124.993170][ T3453] R13: 00007fe8d7016038 R14: 00007fe8d7015fa0 R15: 00007ffcf0e12418 [ 124.993187][ T3453] [ 125.331241][ T36] audit: type=1326 audit(1778888437.296:23545): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3466 comm="syz.3.1089" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8d6d9ce59 code=0x7ffc0000 [ 125.365042][ T3467] tipc: Started in network mode [ 125.366681][ T36] audit: type=1326 audit(1778888437.296:23546): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3466 comm="syz.3.1089" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8d6d9ce59 code=0x7ffc0000 [ 125.369962][ T3467] tipc: Node identity 2007ff, cluster identity 4711 [ 125.397438][ T36] audit: type=1326 audit(1778888437.296:23547): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3466 comm="syz.3.1089" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=27 compat=0 ip=0x7fe8d6d9ce59 code=0x7ffc0000 [ 125.402142][ T3467] tipc: Node number set to 2099199 [ 125.433107][ T36] audit: type=1326 audit(1778888437.296:23548): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3466 comm="syz.3.1089" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8d6d9ce59 code=0x7ffc0000 [ 125.458520][ T36] audit: type=1326 audit(1778888437.296:23549): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3466 comm="syz.3.1089" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8d6d9ce59 code=0x7ffc0000 [ 125.484117][ T36] audit: type=1326 audit(1778888437.296:23550): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3466 comm="syz.3.1089" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fe8d6d9ce59 code=0x7ffc0000 [ 125.537081][ T3475] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 125.546893][ T3475] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 125.556499][ T3475] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 125.565130][ T3475] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 125.950997][ T3484] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 125.959746][ T3484] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 126.238408][ T3509] binder: Bad value for 'max' [ 126.371958][ T3523] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 126.393062][ T3523] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 126.412961][ T3523] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 126.431784][ T3523] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 127.004927][ T36] kauditd_printk_skb: 45 callbacks suppressed [ 127.004945][ T36] audit: type=1400 audit(1778888438.976:23596): avc: denied { append } for pid=3532 comm="syz.4.1113" name=".pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 127.097183][ T36] audit: type=1400 audit(1778888439.006:23597): avc: denied { append } for pid=3531 comm="syz.3.1114" name="loop6" dev="devtmpfs" ino=55 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 127.182643][ T357] usb 1-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 127.190219][ T357] usb 1-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 127.217575][ T357] usb 1-1: USB disconnect, device number 44 [ 127.239138][ T615] udevd[615]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 127.355934][ T3544] FAULT_INJECTION: forcing a failure. [ 127.355934][ T3544] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 127.369334][ T3544] CPU: 1 UID: 0 PID: 3544 Comm: syz.0.1117 Not tainted syzkaller #0 c85af0946947830cbbda05564cc921f578791c52 [ 127.369364][ T3544] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 127.369375][ T3544] Call Trace: [ 127.369381][ T3544] [ 127.369388][ T3544] __dump_stack+0x21/0x30 [ 127.369417][ T3544] dump_stack_lvl+0x140/0x1c0 [ 127.369439][ T3544] ? __cfi_dump_stack_lvl+0x10/0x10 [ 127.369461][ T3544] ? check_stack_object+0x12b/0x150 [ 127.369486][ T3544] dump_stack+0x19/0x20 [ 127.369506][ T3544] should_fail_ex+0x3d7/0x530 [ 127.369587][ T3544] should_fail+0xf/0x20 [ 127.369601][ T3544] should_fail_usercopy+0x1e/0x30 [ 127.369617][ T3544] _copy_to_user+0x24/0xa0 [ 127.369636][ T3544] simple_read_from_buffer+0xed/0x160 [ 127.369658][ T3544] proc_fail_nth_read+0x1aa/0x220 [ 127.369681][ T3544] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 127.369702][ T3544] ? __kasan_check_write+0x18/0x20 [ 127.369720][ T3544] ? bpf_lsm_file_permission+0xd/0x20 [ 127.369741][ T3544] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 127.369762][ T3544] vfs_read+0x289/0xcb0 [ 127.369779][ T3544] ? __sys_recvmmsg+0x2a0/0x2a0 [ 127.369795][ T3544] ? __cfi_vfs_read+0x10/0x10 [ 127.369810][ T3544] ? __kasan_check_write+0x18/0x20 [ 127.369825][ T3544] ? mutex_lock+0x97/0x1d0 [ 127.369845][ T3544] ? __cfi_mutex_lock+0x10/0x10 [ 127.369863][ T3544] ? __fget_files+0x2c5/0x340 [ 127.369882][ T3544] ksys_read+0x145/0x260 [ 127.369898][ T3544] ? __cfi_ksys_read+0x10/0x10 [ 127.369912][ T3544] ? __x64_sys_recvmmsg+0x199/0x250 [ 127.369928][ T3544] ? __kasan_check_read+0x15/0x20 [ 127.369944][ T3544] __x64_sys_read+0x7f/0x90 [ 127.369960][ T3544] x64_sys_call+0x2638/0x2ee0 [ 127.369975][ T3544] do_syscall_64+0x57/0xf0 [ 127.369991][ T3544] ? clear_bhb_loop+0x50/0xa0 [ 127.370010][ T3544] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 127.370028][ T3544] RIP: 0033:0x7f299d55d68e [ 127.370043][ T3544] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 127.370058][ T3544] RSP: 002b:00007f299bff6fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 127.370077][ T3544] RAX: ffffffffffffffda RBX: 00007f299bff76c0 RCX: 00007f299d55d68e [ 127.370089][ T3544] RDX: 000000000000000f RSI: 00007f299bff70a0 RDI: 0000000000000004 [ 127.370100][ T3544] RBP: 00007f299bff7090 R08: 0000000000000000 R09: 0000000000000000 [ 127.370112][ T3544] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 127.370122][ T3544] R13: 00007f299d816038 R14: 00007f299d815fa0 R15: 00007fff31b22f18 [ 127.370137][ T3544] [ 127.791274][ T36] audit: type=1400 audit(1778888439.756:23598): avc: denied { relabelfrom } for pid=3553 comm="syz.3.1122" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 127.856102][ T36] audit: type=1400 audit(1778888439.756:23599): avc: denied { relabelto } for pid=3553 comm="syz.3.1122" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 127.976481][ T3569] FAULT_INJECTION: forcing a failure. [ 127.976481][ T3569] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 128.000399][ T3569] CPU: 0 UID: 0 PID: 3569 Comm: syz.4.1126 Not tainted syzkaller #0 c85af0946947830cbbda05564cc921f578791c52 [ 128.000439][ T3569] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 128.000451][ T3569] Call Trace: [ 128.000456][ T3569] [ 128.000464][ T3569] __dump_stack+0x21/0x30 [ 128.000493][ T3569] dump_stack_lvl+0x140/0x1c0 [ 128.000583][ T3569] ? __cfi_dump_stack_lvl+0x10/0x10 [ 128.000607][ T3569] ? check_stack_object+0x81/0x150 [ 128.000624][ T3569] ? __virt_addr_valid+0x2a6/0x380 [ 128.000754][ T3569] dump_stack+0x19/0x20 [ 128.000775][ T3569] should_fail_ex+0x3d7/0x530 [ 128.000791][ T3569] should_fail+0xf/0x20 [ 128.000805][ T3569] should_fail_usercopy+0x1e/0x30 [ 128.000821][ T3569] _copy_from_user+0x20/0xa0 [ 128.000840][ T3569] csum_and_copy_from_iter_full+0x1f0/0x1c70 [ 128.000866][ T3569] ? __cfi_csum_and_copy_from_iter_full+0x10/0x10 [ 128.000888][ T3569] ? kasan_save_alloc_info+0x40/0x50 [ 128.000917][ T3569] ip_generic_getfrag+0x155/0x2c0 [ 128.000941][ T3569] ? __cfi_ip_generic_getfrag+0x10/0x10 [ 128.000963][ T3569] ? raw6_getfrag+0x18a/0x390 [ 128.000983][ T3569] ? csum_partial+0x278/0x300 [ 128.001003][ T3569] ? __asan_memcpy+0x5a/0x80 [ 128.001019][ T3569] raw6_getfrag+0x25c/0x390 [ 128.001040][ T3569] __ip6_append_data+0x2fa9/0x3d40 [ 128.001063][ T3569] ? __kasan_kmalloc+0x96/0xb0 [ 128.001082][ T3569] ? __cfi_raw6_getfrag+0x10/0x10 [ 128.001102][ T3569] ? kmemdup_noprof+0x5b/0x80 [ 128.001126][ T3569] ? ip6_setup_cork+0x13f0/0x13f0 [ 128.001145][ T3569] ? ip6_append_data+0x25e/0x380 [ 128.001164][ T3569] ip6_append_data+0x1b1/0x380 [ 128.001183][ T3569] ? __cfi_raw6_getfrag+0x10/0x10 [ 128.001203][ T3569] rawv6_sendmsg+0x13db/0x19c0 [ 128.001225][ T3569] ? __cfi_rawv6_sendmsg+0x10/0x10 [ 128.001243][ T3569] ? unwind_get_return_address+0x51/0x90 [ 128.001266][ T3569] ? selinux_socket_sendmsg+0x281/0x380 [ 128.001288][ T3569] ? avc_has_perm+0x155/0x240 [ 128.001307][ T3569] ? inet_send_prepare+0x64/0x4e0 [ 128.001324][ T3569] ? __cfi_rawv6_sendmsg+0x10/0x10 [ 128.001343][ T3569] inet_sendmsg+0x116/0x120 [ 128.001359][ T3569] ? __cfi_inet_sendmsg+0x10/0x10 [ 128.001376][ T3569] sock_write_iter+0x3c2/0x490 [ 128.001394][ T3569] ? __cfi_sock_write_iter+0x10/0x10 [ 128.001411][ T3569] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 128.001444][ T3569] vfs_write+0x761/0xf90 [ 128.001461][ T3569] ? __cfi_vfs_write+0x10/0x10 [ 128.001480][ T3569] ksys_write+0x145/0x260 [ 128.001495][ T3569] ? __cfi_ksys_write+0x10/0x10 [ 128.001512][ T3569] ? __kasan_check_read+0x15/0x20 [ 128.001528][ T3569] __x64_sys_write+0x7f/0x90 [ 128.001544][ T3569] x64_sys_call+0x271c/0x2ee0 [ 128.001560][ T3569] do_syscall_64+0x57/0xf0 [ 128.001576][ T3569] ? clear_bhb_loop+0x50/0xa0 [ 128.001596][ T3569] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 128.001614][ T3569] RIP: 0033:0x7f689859ce59 [ 128.001630][ T3569] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 128.001645][ T3569] RSP: 002b:00007f6899523028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 128.001680][ T3569] RAX: ffffffffffffffda RBX: 00007f6898815fa0 RCX: 00007f689859ce59 [ 128.001693][ T3569] RDX: 00000000000005ac RSI: 00002000000000c0 RDI: 0000000000000003 [ 128.001705][ T3569] RBP: 00007f6899523090 R08: 0000000000000000 R09: 0000000000000000 [ 128.001716][ T3569] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 128.001726][ T3569] R13: 00007f6898816038 R14: 00007f6898815fa0 R15: 00007ffdb28104e8 [ 128.001740][ T3569] [ 128.146491][ T3572] ªªªªªª: renamed from vlan0 (while UP) [ 128.448226][ T3579] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1129'. [ 128.492524][ T3583] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 128.521551][ T36] audit: type=1326 audit(1778888440.486:23600): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3553 comm="syz.3.1122" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8d6d9ce59 code=0x7fc00000 [ 128.548974][ T36] audit: type=1326 audit(1778888440.486:23601): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3553 comm="syz.3.1122" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe8d6d9ce59 code=0x7fc00000 [ 128.586093][ T36] audit: type=1326 audit(1778888440.486:23602): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3553 comm="syz.3.1122" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8d6d9ce59 code=0x7fc00000 [ 128.612070][ T36] audit: type=1326 audit(1778888440.486:23603): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3553 comm="syz.3.1122" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8d6d9ce59 code=0x7fc00000 [ 128.637991][ T36] audit: type=1326 audit(1778888440.486:23604): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3553 comm="syz.3.1122" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8d6d9ce59 code=0x7fc00000 [ 128.664142][ T36] audit: type=1326 audit(1778888440.486:23605): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3553 comm="syz.3.1122" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe8d6d9ce59 code=0x7fc00000 [ 128.957692][ T3612] FAULT_INJECTION: forcing a failure. [ 128.957692][ T3612] name failslab, interval 1, probability 0, space 0, times 0 [ 128.974831][ T3612] CPU: 1 UID: 0 PID: 3612 Comm: syz.3.1144 Not tainted syzkaller #0 c85af0946947830cbbda05564cc921f578791c52 [ 128.974863][ T3612] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 128.974876][ T3612] Call Trace: [ 128.974882][ T3612] [ 128.974889][ T3612] __dump_stack+0x21/0x30 [ 128.974920][ T3612] dump_stack_lvl+0x140/0x1c0 [ 128.974945][ T3612] ? __cfi_dump_stack_lvl+0x10/0x10 [ 128.974973][ T3612] dump_stack+0x19/0x20 [ 128.974993][ T3612] should_fail_ex+0x3d7/0x530 [ 128.975010][ T3612] should_failslab+0xac/0x100 [ 128.975031][ T3612] kmem_cache_alloc_noprof+0x42/0x410 [ 128.975050][ T3612] ? skb_clone+0x229/0x460 [ 128.975074][ T3612] ? __kasan_check_read+0x15/0x20 [ 128.975092][ T3612] skb_clone+0x229/0x460 [ 128.975112][ T3612] ip6_finish_output2+0x1256/0x19c0 [ 128.975133][ T3612] ? ip6t_do_table+0x130c/0x14d0 [ 128.975156][ T3612] ? __cfi_ip6_finish_output2+0x10/0x10 [ 128.975175][ T3612] ? __cfi_ip6table_mangle_hook+0x10/0x10 [ 128.975191][ T3612] ip6_finish_output+0x54f/0xb10 [ 128.975210][ T3612] ip6_output+0x1fe/0x420 [ 128.975227][ T3612] ? __cfi_ip6_output+0x10/0x10 [ 128.975244][ T3612] ? __cfi_ip6_finish_output+0x10/0x10 [ 128.975262][ T3612] ? __cfi_ip6t_do_table+0x10/0x10 [ 128.975286][ T3612] ? __cfi_ip6_output+0x10/0x10 [ 128.975304][ T3612] ip6_local_out+0x213/0x440 [ 128.975333][ T3612] ? __cfi_ip6_local_out+0x10/0x10 [ 128.975353][ T3612] ? __cfi_dst_output+0x10/0x10 [ 128.975372][ T3612] ? __asan_memcpy+0x5a/0x80 [ 128.975388][ T3612] ? skb_store_bits+0x5ea/0x880 [ 128.975405][ T3612] ip6_push_pending_frames+0x181/0x2e0 [ 128.975497][ T3612] rawv6_push_pending_frames+0x6ee/0x8e0 [ 128.975520][ T3612] ? ip6_append_data+0x25e/0x380 [ 128.975542][ T3612] ? raw6_getfrag+0x390/0x390 [ 128.975564][ T3612] ? rawv6_sendmsg+0xc8f/0x19c0 [ 128.975587][ T3612] rawv6_sendmsg+0x14a4/0x19c0 [ 128.975611][ T3612] ? __cfi_rawv6_sendmsg+0x10/0x10 [ 128.975634][ T3612] ? unwind_get_return_address+0x51/0x90 [ 128.975661][ T3612] ? selinux_socket_sendmsg+0x281/0x380 [ 128.975686][ T3612] ? avc_has_perm+0x155/0x240 [ 128.975708][ T3612] ? inet_send_prepare+0x64/0x4e0 [ 128.975728][ T3612] ? __cfi_rawv6_sendmsg+0x10/0x10 [ 128.975748][ T3612] inet_sendmsg+0x116/0x120 [ 128.975768][ T3612] ? __cfi_inet_sendmsg+0x10/0x10 [ 128.975789][ T3612] sock_write_iter+0x3c2/0x490 [ 128.975810][ T3612] ? __cfi_sock_write_iter+0x10/0x10 [ 128.975832][ T3612] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 128.975857][ T3612] vfs_write+0x761/0xf90 [ 128.975874][ T3612] ? __cfi_vfs_write+0x10/0x10 [ 128.975893][ T3612] ksys_write+0x145/0x260 [ 128.975907][ T3612] ? __cfi_ksys_write+0x10/0x10 [ 128.975923][ T3612] ? __kasan_check_read+0x15/0x20 [ 128.975937][ T3612] __x64_sys_write+0x7f/0x90 [ 128.975952][ T3612] x64_sys_call+0x271c/0x2ee0 [ 128.975967][ T3612] do_syscall_64+0x57/0xf0 [ 128.975983][ T3612] ? clear_bhb_loop+0x50/0xa0 [ 128.976001][ T3612] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 128.976017][ T3612] RIP: 0033:0x7fe8d6d9ce59 [ 128.976032][ T3612] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 128.976046][ T3612] RSP: 002b:00007fe8d7caa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 128.976064][ T3612] RAX: ffffffffffffffda RBX: 00007fe8d7015fa0 RCX: 00007fe8d6d9ce59 [ 128.976077][ T3612] RDX: 00000000000005ac RSI: 00002000000000c0 RDI: 0000000000000003 [ 128.976087][ T3612] RBP: 00007fe8d7caa090 R08: 0000000000000000 R09: 0000000000000000 [ 128.976097][ T3612] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 128.976107][ T3612] R13: 00007fe8d7016038 R14: 00007fe8d7015fa0 R15: 00007ffcf0e12418 [ 128.976121][ T3612] [ 129.344691][ T3620] incfs: Error accessing: ./file0. [ 129.350648][ T3620] incfs: mount failed -20 [ 129.371295][ T3625] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1147'. [ 129.404349][ T3629] fuse: Unknown parameter 'group' [ 129.414454][ T3629] kernel profiling enabled (shift: 63) [ 129.420369][ T3629] profiling shift: 63 too large [ 129.477706][ T3645] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 129.486556][ T3645] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 129.503111][ T3645] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1155'. [ 129.619728][ T3654] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 129.628332][ T3654] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 129.637049][ T3655] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 129.646110][ T3655] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 129.654932][ T3654] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 129.663568][ T3654] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 129.818240][ T3664] FAULT_INJECTION: forcing a failure. [ 129.818240][ T3664] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 129.831531][ T3664] CPU: 0 UID: 0 PID: 3664 Comm: syz.4.1163 Not tainted syzkaller #0 c85af0946947830cbbda05564cc921f578791c52 [ 129.831558][ T3664] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 129.831566][ T3664] Call Trace: [ 129.831571][ T3664] [ 129.831576][ T3664] __dump_stack+0x21/0x30 [ 129.831597][ T3664] dump_stack_lvl+0x140/0x1c0 [ 129.831612][ T3664] ? __cfi_dump_stack_lvl+0x10/0x10 [ 129.831627][ T3664] ? check_stack_object+0x12b/0x150 [ 129.831640][ T3664] dump_stack+0x19/0x20 [ 129.831653][ T3664] should_fail_ex+0x3d7/0x530 [ 129.831664][ T3664] should_fail+0xf/0x20 [ 129.831673][ T3664] should_fail_usercopy+0x1e/0x30 [ 129.831684][ T3664] _copy_to_user+0x24/0xa0 [ 129.831696][ T3664] simple_read_from_buffer+0xed/0x160 [ 129.831711][ T3664] proc_fail_nth_read+0x1aa/0x220 [ 129.831726][ T3664] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 129.831741][ T3664] ? bpf_lsm_file_permission+0xd/0x20 [ 129.831756][ T3664] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 129.831769][ T3664] vfs_read+0x289/0xcb0 [ 129.831780][ T3664] ? __cfi_vfs_read+0x10/0x10 [ 129.831790][ T3664] ? __kasan_check_write+0x18/0x20 [ 129.831802][ T3664] ? mutex_lock+0x97/0x1d0 [ 129.831815][ T3664] ? __cfi_mutex_lock+0x10/0x10 [ 129.831828][ T3664] ? __fget_files+0x2c5/0x340 [ 129.831841][ T3664] ksys_read+0x145/0x260 [ 129.831851][ T3664] ? __cfi_ksys_read+0x10/0x10 [ 129.831862][ T3664] ? __kasan_check_read+0x15/0x20 [ 129.831872][ T3664] __x64_sys_read+0x7f/0x90 [ 129.831883][ T3664] x64_sys_call+0x2638/0x2ee0 [ 129.831893][ T3664] do_syscall_64+0x57/0xf0 [ 129.831904][ T3664] ? clear_bhb_loop+0x50/0xa0 [ 129.831917][ T3664] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 129.831929][ T3664] RIP: 0033:0x7f689855d68e [ 129.831940][ T3664] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 129.831980][ T3664] RSP: 002b:00007f6899522fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 129.831995][ T3664] RAX: ffffffffffffffda RBX: 00007f68995236c0 RCX: 00007f689855d68e [ 129.832003][ T3664] RDX: 000000000000000f RSI: 00007f68995230a0 RDI: 0000000000000005 [ 129.832011][ T3664] RBP: 00007f6899523090 R08: 0000000000000000 R09: 0000000000000000 [ 129.832018][ T3664] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 129.832025][ T3664] R13: 00007f6898816038 R14: 00007f6898815fa0 R15: 00007ffdb28104e8 [ 129.832035][ T3664] [ 129.873531][ T3654] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 129.911447][ T3667] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1164'. [ 129.913366][ T3654] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 129.935844][ T3669] syz_tun: entered promiscuous mode [ 130.103368][ T3676] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 130.104796][ T312] usb 1-1: new low-speed USB device number 45 using dummy_hcd [ 130.113490][ T3677] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 130.121185][ T3676] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 130.131972][ T3668] syz_tun: left promiscuous mode [ 130.136484][ T3677] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 130.159224][ T3679] syz.3.1169 (3679) used obsolete PPPIOCDETACH ioctl [ 130.187005][ T3679] pim6reg1: entered promiscuous mode [ 130.192565][ T3679] pim6reg1: entered allmulticast mode [ 130.242930][ T312] usb 1-1: device descriptor read/64, error -71 [ 130.482977][ T312] usb 1-1: device descriptor read/64, error -71 [ 130.656799][ T942] usb 5-1: new full-speed USB device number 7 using dummy_hcd [ 130.704374][ T3726] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 130.713572][ T3726] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 130.724849][ T312] usb 1-1: new low-speed USB device number 46 using dummy_hcd [ 130.815481][ T942] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 167, changing to 4 [ 130.829764][ T942] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 128, changing to 4 [ 130.842463][ T942] usb 5-1: New USB device found, idVendor=0e41, idProduct=4246, bcdDevice= 0.40 [ 130.851691][ T942] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 130.859758][ T942] usb 5-1: Product: syz [ 130.862920][ T312] usb 1-1: device descriptor read/64, error -71 [ 130.864085][ T942] usb 5-1: Manufacturer: syz [ 130.875002][ T942] usb 5-1: SerialNumber: syz [ 131.028698][ T3742] fuse: Bad value for 'group_id' [ 131.033813][ T3742] fuse: Bad value for 'group_id' [ 131.040618][ T3742] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 131.049226][ T3742] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 131.087190][ T3697] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1177'. [ 131.102796][ T942] usb 5-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 131.102867][ T312] usb 1-1: device descriptor read/64, error -71 [ 131.109873][ T942] usb 5-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 131.122862][ T942] usb 5-1: unit 158 not found! [ 131.133380][ T942] usb 5-1: USB disconnect, device number 7 [ 131.235230][ T312] usb usb1-port1: attempt power cycle [ 131.341078][ T3751] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 131.349599][ T3751] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 131.358816][ T3751] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=3751 comm=syz.2.1200 [ 131.566767][ T3754] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1201'. [ 131.583010][ T312] usb 1-1: new low-speed USB device number 47 using dummy_hcd [ 131.585727][ T3757] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 131.599135][ T3757] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 131.604125][ T312] usb 1-1: device descriptor read/8, error -71 [ 131.714982][ T3763] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1205'. [ 131.753966][ T312] usb 1-1: device descriptor read/8, error -71 [ 131.992869][ T312] usb 1-1: new low-speed USB device number 48 using dummy_hcd [ 132.014415][ T312] usb 1-1: device descriptor read/8, error -71 [ 132.154218][ T312] usb 1-1: device descriptor read/8, error -71 [ 132.168440][ T3787] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 132.179190][ T3787] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 132.272948][ T312] usb usb1-port1: unable to enumerate USB device [ 132.758957][ T3800] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1218'. [ 132.792731][ T36] kauditd_printk_skb: 66 callbacks suppressed [ 132.792749][ T36] audit: type=1400 audit(1778888444.756:23672): avc: denied { accept } for pid=3804 comm="syz.0.1220" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 132.844172][ T3810] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 132.873040][ T3810] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 132.901962][ T3810] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 132.921633][ T3810] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 132.933206][ T3810] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 132.943243][ T3810] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 133.167594][ T3832] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 133.176917][ T3832] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 133.192916][ T357] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 133.342869][ T357] usb 5-1: Using ep0 maxpacket: 16 [ 133.349532][ T357] usb 5-1: unable to get BOS descriptor or descriptor too short [ 133.357911][ T357] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 133.370277][ T357] usb 5-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 133.379360][ T357] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 133.387374][ T357] usb 5-1: Product: syz [ 133.391531][ T357] usb 5-1: Manufacturer: syz [ 133.396141][ T357] usb 5-1: SerialNumber: syz [ 133.482730][ T3838] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 133.491435][ T3838] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 133.603205][ T357] usb 5-1: Audio class v2/v3 interfaces need an interface association [ 133.611446][ T357] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 133.670510][ T3844] netlink: 'syz.0.1238': attribute type 63 has an invalid length. [ 133.678462][ T3844] netlink: 5 bytes leftover after parsing attributes in process `syz.0.1238'. [ 133.687415][ T3844] gretap0: entered allmulticast mode [ 133.708590][ T3844] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 133.863177][ T3852] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 133.871791][ T3852] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 133.962961][ T942] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 134.003765][ T357] usb 5-1: 2:1 : bogus bTerminalLink 6 [ 134.081792][ T3852] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 134.091613][ T3852] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 134.104035][ T3852] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 134.113758][ T942] usb 1-1: Using ep0 maxpacket: 16 [ 134.115001][ T3852] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 134.118942][ T3860] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 134.136308][ T3860] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 134.144174][ T942] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 129, using maximum allowed: 30 [ 134.160892][ T942] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 134.173504][ T942] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 134.183725][ T942] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 129 [ 134.197198][ T942] usb 1-1: New USB device found, idVendor=0458, idProduct=5013, bcdDevice= 0.00 [ 134.209084][ T942] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 134.214513][ T357] usb 5-1: USB disconnect, device number 8 [ 134.220661][ T942] usb 1-1: config 0 descriptor?? [ 134.675027][ T36] audit: type=1400 audit(1778888446.646:23673): avc: denied { bind } for pid=3843 comm="syz.0.1238" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 134.702253][ T942] usbhid 1-1:0.0: can't add hid device: -71 [ 134.709250][ T942] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 134.721273][ T942] usb 1-1: USB disconnect, device number 49 [ 134.804867][ T36] audit: type=1326 audit(1778888446.776:23674): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3876 comm="syz.4.1248" exe="/root/ci2-android-6-12-rust/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f689859ce59 code=0x0 [ 134.942560][ T3880] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1249'. [ 134.960726][ T36] audit: type=1400 audit(1778888446.926:23675): avc: denied { create } for pid=3881 comm="syz.3.1250" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 134.982092][ T36] audit: type=1400 audit(1778888446.936:23676): avc: denied { sys_admin } for pid=3881 comm="syz.3.1250" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 135.006935][ T36] audit: type=1326 audit(1778888446.976:23677): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3881 comm="syz.3.1250" exe="/root/ci2-android-6-12-rust/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe8d6d9ce59 code=0x0 [ 135.093007][ T3889] usb usb8: check_ctrlrecip: process 3889 (syz.3.1253) requesting ep 01 but needs 81 [ 135.102705][ T3889] usb usb8: usbfs: process 3889 (syz.3.1253) did not claim interface 0 before use [ 135.316966][ T3898] netlink: 277 bytes leftover after parsing attributes in process `syz.2.1256'. [ 135.388918][ T3906] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 135.397685][ T3906] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 135.851713][ T3919] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 135.915275][ T3924] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 135.923998][ T3924] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 135.932413][ T3923] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 135.941733][ T3923] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 135.952878][ T3926] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1266'. [ 136.031471][ T36] audit: type=1400 audit(1778888447.996:23678): avc: denied { create } for pid=3929 comm="syz.3.1268" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 136.291590][ T36] audit: type=1400 audit(1778888448.256:23679): avc: denied { mounton } for pid=3950 comm="syz.0.1277" path="/313/file0" dev="tmpfs" ino=1675 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 136.504535][ T3965] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 136.514831][ T3965] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 136.647639][ T36] audit: type=1400 audit(1778888448.616:23680): avc: denied { append } for pid=3967 comm="syz.4.1284" name="001" dev="devtmpfs" ino=117 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 136.782902][ T9] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 136.932865][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 136.943262][ T9] usb 1-1: config 0 has an invalid interface number: 151 but max is 0 [ 136.951554][ T9] usb 1-1: config 0 has no interface number 0 [ 136.961299][ T9] usb 1-1: config 0 interface 151 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 136.973230][ T9] usb 1-1: New USB device found, idVendor=0499, idProduct=6bb7, bcdDevice=68.2f [ 136.982562][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 136.991126][ T9] usb 1-1: Product: syz [ 136.995951][ T9] usb 1-1: Manufacturer: syz [ 137.000803][ T9] usb 1-1: SerialNumber: syz [ 137.006391][ T9] usb 1-1: config 0 descriptor?? [ 137.115101][ T3996] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 137.123675][ T3996] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 137.213488][ T3966] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 137.222113][ T3966] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 137.632967][ T311] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 137.647491][ T4003] overlayfs: failed to resolve './cgroup': -2 [ 137.668236][ T4006] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1301'. [ 137.742278][ T4016] fuse: Bad value for 'fd' [ 137.792880][ T311] usb 5-1: Using ep0 maxpacket: 16 [ 137.802884][ T311] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 137.813432][ T311] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 137.823962][ T311] usb 5-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 137.834248][ T311] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 137.842321][ T311] usb 5-1: Product: syz [ 137.846576][ T311] usb 5-1: Manufacturer: syz [ 137.851222][ T311] usb 5-1: SerialNumber: syz [ 137.859265][ T311] usb 5-1: config 0 descriptor?? [ 138.075624][ T4000] syzkaller1: entered promiscuous mode [ 138.081266][ T4000] syzkaller1: entered allmulticast mode [ 138.486261][ T4045] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 138.494860][ T4045] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 138.503895][ T4045] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 138.512441][ T4045] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 138.523412][ T4045] cgroup: Need name or subsystem set [ 138.529288][ T4045] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 138.537843][ T4045] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 138.617657][ T4049] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1317'. [ 138.640400][ T4051] Falling back ldisc for ttyS3. [ 138.707651][ T4057] fuse: Unknown parameter '00000ÌØè“Q™e}0100°00' [ 138.952469][ T4083] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1331'. [ 138.967245][ T36] audit: type=1400 audit(1778888450.936:23681): avc: denied { ioctl } for pid=4086 comm="syz.3.1333" path="socket:[44258]" dev="sockfs" ino=44258 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 138.998419][ T4083] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 139.007216][ T4083] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 139.059030][ T4093] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1334'. [ 139.089424][ T4098] rust_binder: Failed to allocate buffer. len:24, is_oneway:false [ 139.091080][ T4097] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 139.095988][ T4099] rust_binder: Failed to allocate buffer. len:4120, is_oneway:true [ 139.421607][ T9] usb 1-1: USB disconnect, device number 50 [ 139.432766][ T615] udevd[615]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.151/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 139.453605][ T4104] netlink: 'syz.0.1338': attribute type 5 has an invalid length. [ 139.461369][ T4104] netlink: 45 bytes leftover after parsing attributes in process `syz.0.1338'. [ 139.506843][ T36] audit: type=1400 audit(1778888451.476:23682): avc: denied { ioctl } for pid=4105 comm="syz.3.1339" path="socket:[42839]" dev="sockfs" ino=42839 ioctlcmd=0x583b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 139.647410][ T36] audit: type=1400 audit(1778888451.616:23683): avc: denied { accept } for pid=4121 comm="syz.4.1345" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 139.745325][ T4132] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1349'. [ 139.843968][ T36] audit: type=1400 audit(1778888451.816:23684): avc: denied { getopt } for pid=4150 comm="syz.0.1356" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 140.005414][ T4165] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1362'. [ 140.023174][ T4167] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 140.031815][ T4167] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 140.097990][ T36] audit: type=1401 audit(1778888452.057:23685): op=fscreate invalid_context=CFA7AE [ 140.155841][ T4182] 9pnet_fd: Insufficient options for proto=fd [ 140.212898][ T9] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 140.275142][ T4189] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 140.284112][ T4189] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 140.362862][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 140.369008][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 140.380095][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 140.392941][ T9] usb 1-1: New USB device found, idVendor=046d, idProduct=c082, bcdDevice= 0.00 [ 140.402004][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 140.410653][ T9] usb 1-1: rejected 1 configuration due to insufficient available bus power [ 140.419570][ T9] usb 1-1: no configuration chosen from 1 choice [ 140.796612][ T4205] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 140.810495][ T4205] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 141.001774][ T4223] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 141.002209][ T4224] netlink: 'syz.4.1385': attribute type 12 has an invalid length. [ 141.010594][ T4223] overlayfs: option "uuid=on" requires an upper fs, falling back to uuid=null. [ 141.027340][ T4223] overlayfs: missing 'lowerdir' [ 141.184207][ T4244] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 141.192733][ T4244] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 141.202344][ T4244] 9pnet_fd: Insufficient options for proto=fd [ 141.433685][ T4250] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 141.442269][ T4250] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 141.450890][ T4249] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 141.459542][ T4249] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 142.019217][ T4296] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 142.027838][ T4296] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 142.046441][ T36] audit: type=1400 audit(1778888454.007:23686): avc: denied { accept } for pid=4295 comm="syz.2.1419" path="socket:[46109]" dev="sockfs" ino=46109 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 142.320408][ T4316] fuse: Bad value for 'fd' [ 142.326795][ T36] audit: type=1400 audit(1778888454.297:23687): avc: denied { execute } for pid=4315 comm="syz.4.1428" name="file0" dev="tmpfs" ino=812 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 142.450719][ T36] audit: type=1400 audit(1778888454.407:23688): avc: denied { create } for pid=4334 comm="syz.3.1434" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 142.531422][ T4335] netlink: 'syz.3.1434': attribute type 4 has an invalid length. [ 142.616658][ T36] audit: type=1400 audit(1778888454.577:23689): avc: denied { map } for pid=4340 comm="syz.2.1437" path="socket:[46364]" dev="sockfs" ino=46364 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 142.643003][ T36] audit: type=1400 audit(1778888454.577:23690): avc: denied { accept } for pid=4340 comm="syz.2.1437" path="socket:[46364]" dev="sockfs" ino=46364 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 142.989418][ T9] usb 1-1: USB disconnect, device number 51 [ 143.392895][ T9] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 143.558053][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 143.565399][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 143.574309][ T9] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 186, changing to 7 [ 143.588012][ T9] usb 1-1: New USB device found, idVendor=17cc, idProduct=1010, bcdDevice= 0.40 [ 143.597496][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 143.607454][ T9] usb 1-1: Product: syz [ 143.619486][ T9] usb 1-1: Manufacturer: syz [ 143.626078][ T9] usb 1-1: SerialNumber: syz [ 143.713964][ T4380] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1454'. [ 143.978067][ T4412] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 144.010955][ T9] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 144.022873][ T9] snd-usb-audio 1-1:1.1: probe with driver snd-usb-audio failed with error -71 [ 144.032780][ T9] snd-usb-audio 1-1:1.2: probe with driver snd-usb-audio failed with error -71 [ 144.045563][ T9] usb 1-1: USB disconnect, device number 52 [ 144.228313][ T4445] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 144.239079][ T4445] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 144.332763][ T4453] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 144.341345][ T4453] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 144.433356][ T36] kauditd_printk_skb: 1 callbacks suppressed [ 144.433374][ T36] audit: type=1400 audit(1778888456.397:23692): avc: denied { ioctl } for pid=4459 comm="syz.3.1488" path="socket:[46726]" dev="sockfs" ino=46726 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 144.486517][ T36] audit: type=1400 audit(1778888456.447:23693): avc: denied { setopt } for pid=4465 comm="syz.3.1491" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 145.004567][ T4480] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 145.013915][ T4480] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 145.448295][ T36] audit: type=1400 audit(1778888457.407:23694): avc: denied { nlmsg_read } for pid=4493 comm="syz.3.1503" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 145.494397][ T4500] fuse: Unknown parameter 'ro0000000000000000100000' [ 146.464324][ T4540] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 146.473550][ T4540] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 147.350272][ T4583] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 147.359892][ T4583] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 147.368859][ T4583] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 147.378180][ T4583] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 147.387490][ T4583] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 147.396563][ T4583] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 147.404771][ T4583] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 147.413391][ T4583] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 147.423262][ T4583] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 147.431787][ T4583] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 147.440377][ T4583] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 147.448902][ T4583] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 147.606599][ T36] audit: type=1326 audit(1778888459.567:23695): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4600 comm="syz.0.1545" exe="/root/ci2-android-6-12-rust/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f299d59ce59 code=0x0 [ 147.615434][ T4604] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 147.640893][ T4604] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 147.971486][ T4606] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 147.980144][ T4607] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 147.980872][ T4606] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 147.988849][ T4607] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 148.166662][ T4613] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1550'. [ 148.183582][ T4615] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 148.192084][ T4615] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 148.200533][ T4615] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1551'. [ 148.592124][ T4636] netlink: 'syz.4.1559': attribute type 28 has an invalid length. [ 148.822875][ T36] audit: type=1400 audit(1778888460.777:23696): avc: denied { map } for pid=4657 comm="syz.4.1568" path="/dev/input/event1" dev="devtmpfs" ino=193 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 148.857947][ T4663] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 148.867249][ T4663] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 148.943651][ T4665] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=64 sclass=netlink_xfrm_socket pid=4665 comm=syz.2.1570 [ 148.956759][ T4665] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 148.965562][ T4665] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 149.087108][ T36] audit: type=1326 audit(1778888461.047:23697): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4666 comm="syz.3.1571" exe="/root/ci2-android-6-12-rust/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe8d6d9ce59 code=0x0 [ 149.388128][ T4672] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 149.389107][ T4672] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 149.396210][ T4672] rust_binder: 4671:4672 transaction to 0 failed: ENOENT [ 149.503376][ T36] audit: type=1400 audit(1778888461.467:23698): avc: denied { mount } for pid=4676 comm="syz.4.1575" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 149.505532][ T4677] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 149.510731][ T36] audit: type=1400 audit(1778888461.467:23699): avc: denied { mounton } for pid=4676 comm="syz.4.1575" path="/196/file0" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 149.563659][ T36] audit: type=1400 audit(1778888461.467:23700): avc: denied { read } for pid=4676 comm="syz.4.1575" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 149.580021][ T4685] usb usb8: usbfs: process 4685 (syz.2.1579) did not claim interface 1 before use [ 149.585855][ T36] audit: type=1400 audit(1778888461.467:23701): avc: denied { open } for pid=4676 comm="syz.4.1575" path="/196/file0" dev="overlay" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 149.621746][ T36] audit: type=1400 audit(1778888461.577:23702): avc: denied { unmount } for pid=2557 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 149.649379][ T36] audit: type=1400 audit(1778888461.587:23703): avc: denied { ioctl } for pid=4690 comm="syz.4.1576" path="socket:[48851]" dev="sockfs" ino=48851 ioctlcmd=0x8915 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 149.731971][ T4694] overlay: ./file0/file1 is not a directory [ 149.770218][ T36] audit: type=1400 audit(1778888461.727:23704): avc: denied { name_bind } for pid=4696 comm="syz.4.1583" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 149.797461][ T36] audit: type=1400 audit(1778888461.727:23705): avc: denied { node_bind } for pid=4696 comm="syz.4.1583" saddr=ff01::1 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 149.815797][ T4703] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 149.828473][ T4705] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 149.835429][ T4703] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 149.846918][ T4705] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 149.875842][ T36] audit: type=1400 audit(1778888461.837:23706): avc: denied { setopt } for pid=4712 comm="syz.0.1591" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 149.935402][ T4726] veth1: entered allmulticast mode [ 149.942893][ T4726] veth1: left allmulticast mode [ 149.964874][ T36] audit: type=1400 audit(1778888461.927:23707): avc: denied { bind } for pid=4731 comm="syz.0.1599" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 150.008655][ T4745] overlayfs: disabling nfs_export due to verity=require [ 150.015922][ T4745] overlayfs: failed to clone upperpath [ 150.132981][ T4760] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=39 sclass=netlink_route_socket pid=4760 comm=syz.0.1608 [ 150.145540][ T4760] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1608'. [ 150.214807][ T4764] netlink: 'syz.0.1609': attribute type 16 has an invalid length. [ 150.222751][ T4764] netlink: 'syz.0.1609': attribute type 3 has an invalid length. [ 150.230568][ T4764] netlink: 'syz.0.1609': attribute type 2 has an invalid length. [ 150.238458][ T4764] netlink: 'syz.0.1609': attribute type 1 has an invalid length. [ 150.246219][ T4764] netlink: 64022 bytes leftover after parsing attributes in process `syz.0.1609'. [ 150.566947][ T1631] bridge_slave_1: left allmulticast mode [ 150.567655][ T4776] netlink: 484 bytes leftover after parsing attributes in process `syz.3.1615'. [ 150.572679][ T1631] bridge_slave_1: left promiscuous mode [ 150.587361][ T1631] bridge0: port 2(bridge_slave_1) entered disabled state [ 150.635371][ T9] usb 5-1: USB disconnect, device number 9 [ 150.717319][ T1631] veth1_macvtap: left promiscuous mode [ 150.723176][ T1631] veth0_vlan: left promiscuous mode [ 150.790372][ T4794] bridge0: port 1(bridge_slave_0) entered blocking state [ 150.797467][ T4794] bridge0: port 1(bridge_slave_0) entered disabled state [ 150.805985][ T4794] bridge_slave_0: entered allmulticast mode [ 150.812532][ T4794] bridge_slave_0: entered promiscuous mode [ 150.821058][ T4794] bridge0: port 2(bridge_slave_1) entered blocking state [ 150.828354][ T4794] bridge0: port 2(bridge_slave_1) entered disabled state [ 150.835541][ T4794] bridge_slave_1: entered allmulticast mode [ 150.841764][ T4794] bridge_slave_1: entered promiscuous mode [ 150.881283][ T4794] bridge0: port 2(bridge_slave_1) entered blocking state [ 150.888378][ T4794] bridge0: port 2(bridge_slave_1) entered forwarding state [ 150.895754][ T4794] bridge0: port 1(bridge_slave_0) entered blocking state [ 150.902794][ T4794] bridge0: port 1(bridge_slave_0) entered forwarding state [ 150.923274][ T1655] bridge0: port 1(bridge_slave_0) entered disabled state [ 150.930673][ T1655] bridge0: port 2(bridge_slave_1) entered disabled state [ 150.940496][ T1665] bridge0: port 1(bridge_slave_0) entered blocking state [ 150.947592][ T1665] bridge0: port 1(bridge_slave_0) entered forwarding state [ 150.956692][ T1655] bridge0: port 2(bridge_slave_1) entered blocking state [ 150.963771][ T1655] bridge0: port 2(bridge_slave_1) entered forwarding state [ 150.989928][ T4794] veth0_vlan: entered promiscuous mode [ 151.004064][ T4794] veth1_macvtap: entered promiscuous mode [ 151.282954][ T311] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 151.425897][ T4823] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 151.434347][ T311] usb 6-1: Using ep0 maxpacket: 16 [ 151.435184][ T4823] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 151.441458][ T311] usb 6-1: unable to get BOS descriptor or descriptor too short [ 151.455870][ T311] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 228, changing to 7 [ 151.468768][ T311] usb 6-1: New USB device found, idVendor=0499, idProduct=103c, bcdDevice= 0.40 [ 151.477887][ T311] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 151.485918][ T311] usb 6-1: Product: syz [ 151.490088][ T311] usb 6-1: Manufacturer: syz [ 151.494730][ T311] usb 6-1: SerialNumber: syz [ 151.705390][ T311] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 151.715533][ T311] snd-usb-audio 6-1:1.1: probe with driver snd-usb-audio failed with error -2 [ 151.726928][ T311] snd-usb-audio 6-1:1.2: probe with driver snd-usb-audio failed with error -2 [ 151.737266][ T311] usb 6-1: USB disconnect, device number 2 [ 151.746733][ T615] udevd[615]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.2/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 152.482875][ T311] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 152.643316][ T311] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 152.654014][ T311] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 152.664984][ T311] usb 6-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 152.674373][ T311] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=67 [ 152.682513][ T311] usb 6-1: SerialNumber: syz [ 152.891127][ T311] usb 6-1: 0:2 : does not exist [ 152.906384][ T311] usb 6-1: USB disconnect, device number 3 [ 152.920944][ T4865] tipc: Failed to remove unknown binding: 66,1,1/2099199:3865645111/3865645113 [ 153.271388][ T4879] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 153.280920][ T4879] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 153.642876][ T358] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 153.792857][ T358] usb 6-1: Using ep0 maxpacket: 8 [ 153.799181][ T358] usb 6-1: config 0 has an invalid interface number: 31 but max is 0 [ 153.807642][ T358] usb 6-1: config 0 has no interface number 0 [ 153.815552][ T358] usb 6-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 153.824838][ T358] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 153.832914][ T358] usb 6-1: Product: syz [ 153.837080][ T358] usb 6-1: Manufacturer: syz [ 153.841656][ T358] usb 6-1: SerialNumber: syz [ 153.846916][ T358] usb 6-1: config 0 descriptor?? [ 153.887163][ T4897] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 154.869538][ T4914] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=4914 comm=syz.2.1661 [ 154.897824][ T4917] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 154.906476][ T4917] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 155.458086][ T4926] random: crng reseeded on system resumption [ 155.731837][ T4943] overlayfs: failed to clone upperpath [ 156.015917][ T36] kauditd_printk_skb: 1 callbacks suppressed [ 156.015936][ T36] audit: type=1400 audit(2000000005.620:23709): avc: denied { read } for pid=4982 comm="syz.0.1678" lport=4 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 156.326906][ T4985] netlink: 4096 bytes leftover after parsing attributes in process `syz.3.1679'. [ 156.416222][ T4926] Unrecognized hibernate image header format! [ 156.425309][ T4926] PM: hibernation: Image mismatch: architecture specific data [ 156.427445][ T358] usb 6-1: USB disconnect, device number 4 [ 156.453817][ T4989] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 156.462495][ T4989] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 156.507263][ T4989] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 156.515875][ T4989] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 156.742913][ T358] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 156.894480][ T358] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 156.904632][ T358] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 156.915741][ T358] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 156.925620][ T358] usb 6-1: New USB device found, idVendor=056a, idProduct=0010, bcdDevice= 0.00 [ 156.934700][ T358] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 156.943371][ T358] usb 6-1: config 0 descriptor?? [ 157.354992][ T358] wacom 0003:056A:0010.0010: Unknown device_type for 'HID 056a:0010'. Assuming pen. [ 157.373162][ T358] wacom 0003:056A:0010.0010: hidraw0: USB HID v0.00 Device [HID 056a:0010] on usb-dummy_hcd.5-1/input0 [ 157.401104][ T358] input: Wacom Graphire Pen as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:056A:0010.0010/input/input32 [ 157.462281][ T5025] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 157.471165][ T5025] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 157.481671][ T5025] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 157.491698][ T5025] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 157.494108][ T5026] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 157.507983][ T5026] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 157.554897][ T36] audit: type=1400 audit(2000000007.160:23710): avc: denied { accept } for pid=4986 comm="syz.5.1680" path="socket:[51382]" dev="sockfs" ino=51382 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 157.578849][ T312] usb 6-1: USB disconnect, device number 5 [ 157.949057][ T5032] overlayfs: failed to clone upperpath [ 157.953722][ T5030] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1696'. [ 158.024432][ T5038] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 158.033464][ T5038] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 158.053011][ T5038] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=5038 comm=syz.2.1699 [ 158.070011][ T5038] kvm: emulating exchange as write [ 158.092965][ T5050] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 158.101596][ T5050] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 158.322906][ T45] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 158.452873][ T45] usb 6-1: device descriptor read/64, error -71 [ 158.496421][ T5054] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=5054 comm=syz.0.1704 [ 158.692894][ T45] usb 6-1: device descriptor read/64, error -71 [ 158.932888][ T45] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 158.955084][ T36] audit: type=1400 audit(2000000008.560:23711): avc: denied { create } for pid=5076 comm="syz.2.1713" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_nflog_socket permissive=1 [ 158.975600][ T36] audit: type=1400 audit(2000000008.560:23712): avc: denied { write } for pid=5076 comm="syz.2.1713" path="socket:[51189]" dev="sockfs" ino=51189 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_nflog_socket permissive=1 [ 159.072871][ T45] usb 6-1: device descriptor read/64, error -71 [ 159.312904][ T45] usb 6-1: device descriptor read/64, error -71 [ 159.422976][ T45] usb usb6-port1: attempt power cycle [ 159.609709][ T5100] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1721'. [ 159.619798][ T5100] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check. [ 159.656392][ T5113] overlayfs: failed to clone upperpath [ 159.691865][ T5116] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=91 sclass=netlink_route_socket pid=5116 comm=syz.2.1725 [ 159.718165][ T5116] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 159.728536][ T5116] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 159.772918][ T45] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 159.790061][ T5117] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 159.793951][ T45] usb 6-1: device descriptor read/8, error -71 [ 159.798786][ T5117] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 159.924615][ T45] usb 6-1: device descriptor read/8, error -71 [ 160.162927][ T45] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 160.183845][ T45] usb 6-1: device descriptor read/8, error -71 [ 160.317060][ T5119] bridge0: port 1(bridge_slave_0) entered blocking state [ 160.324320][ T5119] bridge0: port 1(bridge_slave_0) entered disabled state [ 160.331572][ T5119] bridge_slave_0: entered allmulticast mode [ 160.338238][ T5119] bridge_slave_0: entered promiscuous mode [ 160.345013][ T5119] bridge0: port 2(bridge_slave_1) entered blocking state [ 160.352188][ T5119] bridge0: port 2(bridge_slave_1) entered disabled state [ 160.359458][ T5119] bridge_slave_1: entered allmulticast mode [ 160.365876][ T45] usb 6-1: device descriptor read/8, error -71 [ 160.366078][ T5119] bridge_slave_1: entered promiscuous mode [ 160.428351][ T5119] bridge0: port 2(bridge_slave_1) entered blocking state [ 160.435428][ T5119] bridge0: port 2(bridge_slave_1) entered forwarding state [ 160.442709][ T5119] bridge0: port 1(bridge_slave_0) entered blocking state [ 160.449772][ T5119] bridge0: port 1(bridge_slave_0) entered forwarding state [ 160.459108][ T312] usb 4-1: USB disconnect, device number 5 [ 160.469240][ T1654] bridge_slave_1: left allmulticast mode [ 160.475484][ T1654] bridge_slave_1: left promiscuous mode [ 160.481390][ T1654] bridge0: port 2(bridge_slave_1) entered disabled state [ 160.488735][ T45] usb usb6-port1: unable to enumerate USB device [ 160.599463][ T1631] bridge0: port 1(bridge_slave_0) entered disabled state [ 160.606916][ T1631] bridge0: port 2(bridge_slave_1) entered disabled state [ 160.616781][ T1655] bridge0: port 1(bridge_slave_0) entered blocking state [ 160.623895][ T1655] bridge0: port 1(bridge_slave_0) entered forwarding state [ 160.633318][ T1631] bridge0: port 2(bridge_slave_1) entered blocking state [ 160.640411][ T1631] bridge0: port 2(bridge_slave_1) entered forwarding state [ 160.650233][ T1654] tipc: Left network mode [ 160.657707][ T1654] veth1_macvtap: left promiscuous mode [ 160.663614][ T1654] veth0_vlan: left promiscuous mode [ 160.712789][ T5119] veth0_vlan: entered promiscuous mode [ 160.724164][ T5119] veth1_macvtap: entered promiscuous mode [ 160.992870][ T311] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 161.142919][ T311] usb 4-1: Using ep0 maxpacket: 32 [ 161.177766][ T311] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 161.200727][ T311] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 161.226953][ T311] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 161.246787][ T311] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 161.270174][ T311] usb 4-1: config 0 descriptor?? [ 161.282139][ T311] hub 4-1:0.0: USB hub found [ 161.486702][ T311] hub 4-1:0.0: 1 port detected [ 161.492875][ T45] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 161.528790][ T311] hub 4-1:0.0: hub_hub_status failed (err = -71) [ 161.546988][ T311] hub 4-1:0.0: config failed, can't get hub status (err -71) [ 161.573546][ T311] usbhid 4-1:0.0: can't add hid device: -71 [ 161.620902][ T311] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 161.674921][ T45] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 37, changing to 7 [ 161.690368][ T45] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 116, changing to 7 [ 161.704126][ T45] usb 6-1: New USB device found, idVendor=0763, idProduct=2030, bcdDevice= 0.40 [ 161.715072][ T45] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 161.723285][ T45] usb 6-1: Product: syz [ 161.727516][ T45] usb 6-1: Manufacturer: syz [ 161.732162][ T45] usb 6-1: SerialNumber: syz [ 161.804677][ T311] usb 4-1: reset high-speed USB device number 6 using dummy_hcd [ 161.812925][ T311] usb 4-1: device reset changed ep0 maxpacket size! [ 161.819756][ T311] usb 4-1: USB disconnect, device number 6 [ 161.945437][ T5153] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 161.955246][ T5153] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 161.965097][ T5153] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 161.974586][ T5153] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 161.986233][ T45] usb 6-1: Can't get UAC3 power state for id 10 [ 161.993709][ T45] usb 6-1: 2:0: failed to get current value for ch 0 (-71) [ 162.003601][ T45] usb 6-1: 2:0: cannot get min/max values for control 2 (id 2) [ 162.025626][ T45] usb 6-1: USB disconnect, device number 10 [ 162.043315][ T545] udevd[545]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 162.122962][ T311] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 162.275599][ T311] usb 4-1: New USB device found, idVendor=0582, idProduct=009a, bcdDevice= 0.40 [ 162.284868][ T311] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 162.292922][ T311] usb 4-1: Product: syz [ 162.297177][ T311] usb 4-1: Manufacturer: syz [ 162.301773][ T311] usb 4-1: SerialNumber: syz [ 162.516980][ T311] usb 4-1: MIDIStreaming interface descriptor not found [ 162.527546][ T311] usb 4-1: USB disconnect, device number 7 [ 162.782876][ T357] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 162.796141][ T5212] lo: entered promiscuous mode [ 162.801820][ T5211] lo: left promiscuous mode [ 162.830469][ T5216] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 162.839066][ T5216] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 162.934290][ T357] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 162.945238][ T357] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 162.955002][ T357] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 162.967902][ T357] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 162.976958][ T357] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 162.988261][ T357] usb 6-1: config 0 descriptor?? [ 162.992049][ T5219] mmap: syz.0.1759 (5219): VmData 29339648 exceed data ulimit 68. Update limits or use boot option ignore_rlimit_data. [ 162.996335][ T36] audit: type=1400 audit(2000000012.590:23713): avc: denied { create } for pid=5218 comm="syz.0.1759" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 163.210637][ T5241] netlink: 'syz.3.1768': attribute type 27 has an invalid length. [ 163.260619][ T5243] netlink: 'syz.3.1769': attribute type 12 has an invalid length. [ 163.430378][ T5253] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 163.430722][ T357] plantronics 0003:047F:FFFF.0011: unknown main item tag 0x4 [ 163.439714][ T5253] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 163.447596][ T357] plantronics 0003:047F:FFFF.0011: No inputs registered, leaving [ 163.457675][ T5253] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=1281 sclass=netlink_audit_socket pid=5253 comm=syz.2.1771 [ 163.469754][ T357] plantronics 0003:047F:FFFF.0011: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 163.693391][ T5202] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 163.701964][ T5202] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 163.712084][ T357] usb 6-1: USB disconnect, device number 11 [ 164.049601][ T5258] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 164.058545][ T5258] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 164.233647][ T36] audit: type=1400 audit(2000000013.840:23714): avc: denied { create } for pid=5259 comm="syz.5.1773" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 164.254689][ T5261] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1773'. [ 164.265506][ T36] audit: type=1400 audit(2000000013.860:23715): avc: denied { write } for pid=5259 comm="syz.5.1773" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 164.286311][ T36] audit: type=1400 audit(2000000013.860:23716): avc: denied { nlmsg_write } for pid=5259 comm="syz.5.1773" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 164.307246][ T36] audit: type=1400 audit(2000000013.860:23717): avc: denied { accept } for pid=5265 comm="syz.3.1776" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 164.582920][ T312] usb 6-1: new full-speed USB device number 12 using dummy_hcd [ 164.602860][ T357] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 164.744282][ T312] usb 6-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 164.755420][ T312] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1056, setting to 64 [ 164.766657][ T312] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 164.781429][ T312] usb 6-1: New USB device found, idVendor=044f, idProduct=b304, bcdDevice= 0.00 [ 164.790821][ T357] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 164.802092][ T312] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 164.809078][ T5290] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 164.810338][ T357] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 164.820256][ T5290] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 164.829431][ T312] usb 6-1: config 0 descriptor?? [ 164.841628][ T5272] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 164.849525][ T357] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 164.859968][ T357] usb 4-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 164.868486][ T357] usb 4-1: Manufacturer: syz [ 164.874604][ T357] usb 4-1: config 0 descriptor?? [ 165.262294][ T312] thrustmaster 0003:044F:B304.0012: unknown main item tag 0x0 [ 165.270014][ T312] thrustmaster 0003:044F:B304.0012: unknown main item tag 0x7 [ 165.277554][ T312] thrustmaster 0003:044F:B304.0012: report_id 0 is invalid [ 165.284856][ T312] thrustmaster 0003:044F:B304.0012: item 0 1 1 8 parsing failed [ 165.292691][ T312] thrustmaster 0003:044F:B304.0012: parse failed [ 165.301057][ T312] thrustmaster 0003:044F:B304.0012: probe with driver thrustmaster failed with error -22 [ 165.466765][ T312] usb 6-1: USB disconnect, device number 12 [ 165.597683][ T36] audit: type=1400 audit(2000000015.200:23718): avc: denied { write } for pid=5296 comm="syz.2.1788" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 165.638098][ T5301] Unsupported ieee802154 address type: 0 [ 165.718733][ T5304] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'filter' [ 165.819866][ T36] audit: type=1400 audit(2000000015.420:23719): avc: denied { execmem } for pid=5316 comm="syz.2.1795" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 165.888170][ T357] input: syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:256C:006D.0013/input/input37 [ 165.899875][ T357] uclogic 0003:256C:006D.0013: input,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.3-1/input0 [ 166.051102][ T5322] overlay: Unknown parameter 'userxattr\redirect_dir' [ 166.090761][ T5274] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 166.100147][ T5274] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 166.109078][ T667] usb 4-1: USB disconnect, device number 8 [ 166.362876][ T357] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 166.522935][ T357] usb 6-1: Using ep0 maxpacket: 32 [ 166.529300][ T357] usb 6-1: config 0 has an invalid interface number: 188 but max is 0 [ 166.537535][ T357] usb 6-1: config 0 has no interface number 0 [ 166.543640][ T357] usb 6-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 166.555048][ T357] usb 6-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 166.564255][ T357] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 166.572231][ T357] usb 6-1: Product: syz [ 166.576913][ T357] usb 6-1: Manufacturer: syz [ 166.581505][ T357] usb 6-1: SerialNumber: syz [ 166.587119][ T357] usb 6-1: config 0 descriptor?? [ 166.592343][ T5328] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 166.648120][ T5336] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 166.656872][ T5336] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 166.802742][ T5328] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 166.811854][ T5328] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 166.822974][ T36] audit: type=1400 audit(2000000016.420:23720): avc: denied { write } for pid=5335 comm="syz.2.1802" dev="fuse" ino=5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 166.844956][ T5328] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 167.054582][ T357] asix 6-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 167.065011][ T357] asix 6-1:0.188: probe with driver asix failed with error -71 [ 167.073869][ T357] usb 6-1: USB disconnect, device number 13 [ 167.122892][ T45] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 167.284924][ T45] usb 4-1: config 9 has an invalid interface number: 235 but max is 0 [ 167.293348][ T45] usb 4-1: config 9 has no interface number 0 [ 167.299430][ T45] usb 4-1: config 9 interface 235 has no altsetting 0 [ 167.307622][ T45] usb 4-1: New USB device found, idVendor=0c52, idProduct=2872, bcdDevice=c6.b8 [ 167.316733][ T45] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 167.324844][ T45] usb 4-1: Product: syz [ 167.329020][ T45] usb 4-1: Manufacturer: syz [ 167.333668][ T45] usb 4-1: SerialNumber: syz [ 167.543700][ T45] ftdi_sio 4-1:9.235: FTDI USB Serial Device converter detected [ 167.551713][ T45] ftdi_sio ttyUSB0: unknown device type: 0xc6b8 [ 167.559261][ T45] usb 4-1: USB disconnect, device number 9 [ 167.565748][ T45] ftdi_sio 4-1:9.235: device disconnected [ 167.721154][ T36] audit: type=1400 audit(2000000017.320:23721): avc: denied { setattr } for pid=5372 comm="syz.5.1815" name="ptmx" dev="devtmpfs" ino=24 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ptmx_t tclass=chr_file permissive=1 [ 168.022876][ T357] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 168.055783][ T5380] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 168.061855][ T5380] syzkaller1: linktype set to 805 [ 168.173284][ T357] usb 6-1: Using ep0 maxpacket: 16 [ 168.179516][ T357] usb 6-1: config index 0 descriptor too short (expected 51443, got 18) [ 168.189405][ T357] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 168.198510][ T357] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 168.206543][ T357] usb 6-1: Product: syz [ 168.210718][ T357] usb 6-1: Manufacturer: syz [ 168.215330][ T357] usb 6-1: SerialNumber: syz [ 168.222201][ T357] r8152-cfgselector 6-1: Unknown version 0x0000 [ 168.228490][ T357] r8152-cfgselector 6-1: config 0 descriptor?? [ 168.302856][ T667] usb 4-1: new full-speed USB device number 10 using dummy_hcd [ 168.454525][ T667] usb 4-1: unable to get BOS descriptor or descriptor too short [ 168.462721][ T667] usb 4-1: not running at top speed; connect to a high speed hub [ 168.471465][ T667] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 37, changing to 4 [ 168.482530][ T667] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 116, changing to 4 [ 168.496115][ T667] usb 4-1: string descriptor 0 read error: -22 [ 168.502335][ T667] usb 4-1: New USB device found, idVendor=0763, idProduct=2030, bcdDevice= 0.40 [ 168.511485][ T667] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 168.638996][ T357] r8152-cfgselector 6-1: USB disconnect, device number 14 [ 168.923244][ T667] usb 4-1: USB disconnect, device number 10 [ 169.185226][ T5388] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 169.476897][ T5409] FAULT_INJECTION: forcing a failure. [ 169.476897][ T5409] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 169.490048][ T5409] CPU: 1 UID: 0 PID: 5409 Comm: syz.3.1828 Not tainted syzkaller #0 c85af0946947830cbbda05564cc921f578791c52 [ 169.490083][ T5409] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 169.490093][ T5409] Call Trace: [ 169.490107][ T5409] [ 169.490113][ T5409] __dump_stack+0x21/0x30 [ 169.490137][ T5409] dump_stack_lvl+0x140/0x1c0 [ 169.490152][ T5409] ? __cfi_dump_stack_lvl+0x10/0x10 [ 169.490167][ T5409] ? check_stack_object+0x12b/0x150 [ 169.490180][ T5409] dump_stack+0x19/0x20 [ 169.490194][ T5409] should_fail_ex+0x3d7/0x530 [ 169.490205][ T5409] should_fail+0xf/0x20 [ 169.490214][ T5409] should_fail_usercopy+0x1e/0x30 [ 169.490225][ T5409] _copy_to_user+0x24/0xa0 [ 169.490239][ T5409] simple_read_from_buffer+0xed/0x160 [ 169.490253][ T5409] proc_fail_nth_read+0x1aa/0x220 [ 169.490269][ T5409] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 169.490284][ T5409] ? bpf_lsm_file_permission+0xd/0x20 [ 169.490299][ T5409] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 169.490314][ T5409] vfs_read+0x289/0xcb0 [ 169.490324][ T5409] ? avc_has_perm_noaudit+0x26c/0x360 [ 169.490339][ T5409] ? __cfi_vfs_read+0x10/0x10 [ 169.490349][ T5409] ? __kasan_check_write+0x18/0x20 [ 169.490361][ T5409] ? mutex_lock+0x97/0x1d0 [ 169.490374][ T5409] ? __cfi_mutex_lock+0x10/0x10 [ 169.490386][ T5409] ? __fget_files+0x2c5/0x340 [ 169.490400][ T5409] ksys_read+0x145/0x260 [ 169.490411][ T5409] ? __cfi_ksys_read+0x10/0x10 [ 169.490422][ T5409] ? __kasan_check_read+0x15/0x20 [ 169.490432][ T5409] __x64_sys_read+0x7f/0x90 [ 169.490443][ T5409] x64_sys_call+0x2638/0x2ee0 [ 169.490454][ T5409] do_syscall_64+0x57/0xf0 [ 169.490465][ T5409] ? clear_bhb_loop+0x50/0xa0 [ 169.490479][ T5409] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 169.490492][ T5409] RIP: 0033:0x7ffaa175d68e [ 169.490506][ T5409] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 169.490518][ T5409] RSP: 002b:00007ffaa269efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 169.490532][ T5409] RAX: ffffffffffffffda RBX: 00007ffaa269f6c0 RCX: 00007ffaa175d68e [ 169.490548][ T5409] RDX: 000000000000000f RSI: 00007ffaa269f0a0 RDI: 0000000000000003 [ 169.490556][ T5409] RBP: 00007ffaa269f090 R08: 0000000000000000 R09: 0000000000000000 [ 169.490568][ T5409] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 169.490575][ T5409] R13: 00007ffaa1a16038 R14: 00007ffaa1a15fa0 R15: 00007fffade23078 [ 169.490585][ T5409] [ 169.751385][ T36] audit: type=1400 audit(2000000019.339:23722): avc: denied { read } for pid=5412 comm="syz.3.1830" name="loop-control" dev="devtmpfs" ino=48 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 169.851917][ T36] audit: type=1400 audit(2000000019.435:23723): avc: denied { setattr } for pid=5335 comm="syz.2.1802" name="/" dev="fuse" ino=5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 170.476642][ T358] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 170.631714][ T358] usb 6-1: Using ep0 maxpacket: 16 [ 170.645894][ T358] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 170.664566][ T358] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 170.682864][ T358] usb 6-1: Product: syz [ 170.689334][ T358] usb 6-1: Manufacturer: syz [ 170.699448][ T358] usb 6-1: SerialNumber: syz [ 170.713690][ T358] r8152-cfgselector 6-1: Unknown version 0x0000 [ 170.727283][ T358] r8152-cfgselector 6-1: config 0 descriptor?? [ 171.177169][ T357] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 171.246243][ T667] r8152-cfgselector 6-1: USB disconnect, device number 15 [ 171.331692][ T357] usb 4-1: Using ep0 maxpacket: 32 [ 171.338425][ T357] usb 4-1: unable to get BOS descriptor or descriptor too short [ 171.346917][ T357] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 171.357051][ T357] usb 4-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 171.367390][ T357] usb 4-1: New USB device found, idVendor=0499, idProduct=105b, bcdDevice= 0.40 [ 171.376551][ T357] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 171.384571][ T357] usb 4-1: Product: syz [ 171.388737][ T357] usb 4-1: Manufacturer: syz [ 171.393318][ T357] usb 4-1: SerialNumber: syz [ 171.608968][ T357] usb 4-1: USB disconnect, device number 11 [ 172.031181][ T358] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 172.168567][ T5454] netlink: 'syz.3.1843': attribute type 27 has an invalid length. [ 172.196845][ T358] usb 6-1: too many endpoints for config 1 interface 0 altsetting 13: 255, using maximum allowed: 30 [ 172.209755][ T358] usb 6-1: config 1 interface 0 altsetting 13 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 172.224173][ T358] usb 6-1: config 1 interface 0 has no altsetting 0 [ 172.237361][ T358] usb 6-1: string descriptor 0 read error: -22 [ 172.246109][ T358] usb 6-1: New USB device found, idVendor=28bd, idProduct=0074, bcdDevice= 0.40 [ 172.259134][ T358] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 172.342991][ T5459] syzkaller1: entered promiscuous mode [ 172.348527][ T5459] syzkaller1: entered allmulticast mode [ 172.687271][ T5440] can: request_module (can-proto-0) failed. [ 172.756491][ T358] uclogic 0003:28BD:0074.0014: interface is invalid, ignoring [ 172.894161][ T311] usb 4-1: new full-speed USB device number 12 using dummy_hcd [ 173.008152][ T36] audit: type=1400 audit(2000000022.505:23724): avc: denied { create } for pid=5497 comm="syz.2.1858" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dccp_socket permissive=1 [ 173.016499][ T5498] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 173.028917][ T311] usb 4-1: device descriptor read/64, error -71 [ 173.036905][ T5498] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 173.284241][ T311] usb 4-1: device descriptor read/64, error -71 [ 173.451635][ T667] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=65380 sclass=netlink_xfrm_socket pid=667 comm=kworker/0:6 [ 173.517361][ T36] audit: type=1400 audit(2000000022.993:23725): avc: denied { map } for pid=5503 comm="syz.5.1861" path="socket:[55847]" dev="sockfs" ino=55847 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 173.541642][ T36] audit: type=1400 audit(2000000022.993:23726): avc: denied { read } for pid=5503 comm="syz.5.1861" path="socket:[55847]" dev="sockfs" ino=55847 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 173.541742][ T311] usb 4-1: new full-speed USB device number 13 using dummy_hcd [ 173.609232][ T36] audit: type=1400 audit(2000000023.080:23727): avc: denied { create } for pid=5510 comm="syz.2.1864" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 173.609976][ T5512] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 173.637989][ T5512] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 173.704760][ T311] usb 4-1: device descriptor read/64, error -71 [ 173.725226][ T36] audit: type=1400 audit(2000000023.197:23728): avc: denied { read } for pid=5519 comm="syz.5.1868" path="socket:[55953]" dev="sockfs" ino=55953 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 173.766461][ T5524] netlink: 'syz.5.1869': attribute type 46 has an invalid length. [ 173.774448][ T5525] netlink: 'syz.5.1869': attribute type 46 has an invalid length. [ 173.782617][ T5524] 9pnet_fd: Insufficient options for proto=fd [ 173.860551][ T5529] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 173.869851][ T5529] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 173.878474][ T5529] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1871'. [ 173.921187][ T5529] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 173.929950][ T5529] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 173.950675][ T311] usb 4-1: device descriptor read/64, error -71 [ 174.063698][ T311] usb usb4-port1: attempt power cycle [ 174.411832][ T311] usb 4-1: new full-speed USB device number 14 using dummy_hcd [ 174.433397][ T311] usb 4-1: device descriptor read/8, error -71 [ 174.566496][ T311] usb 4-1: device descriptor read/8, error -71 [ 174.811046][ T311] usb 4-1: new full-speed USB device number 15 using dummy_hcd [ 174.832713][ T311] usb 4-1: device descriptor read/8, error -71 [ 174.965959][ T311] usb 4-1: device descriptor read/8, error -71 [ 175.077938][ T311] usb usb4-port1: unable to enumerate USB device [ 175.341065][ T5580] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 175.349698][ T5580] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 175.483662][ T5583] usb usb8: usbfs: process 5583 (syz.5.1890) did not claim interface 0 before use [ 175.495131][ T5583] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 175.503906][ T5583] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 175.513092][ T5583] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 175.521663][ T5583] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 175.530103][ T5583] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 175.538660][ T5583] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 175.647859][ T36] audit: type=1400 audit(2000000025.073:23729): avc: denied { watch } for pid=5593 comm="syz.0.1895" path="/440/file0" dev="tmpfs" ino=2364 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 175.648514][ T5594] fuse: Unknown parameter 'F\òqñ× d' [ 175.828218][ T36] audit: type=1400 audit(2000000025.259:23730): avc: denied { watch } for pid=5608 comm="syz.3.1900" path="/44/file0" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 176.099441][ T357] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 176.232311][ T357] usb 4-1: device descriptor read/64, error -71 [ 176.379677][ T5644] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4294967295 (34359738360 ns) > initial count (1024 ns). Using initial count to start timer. [ 176.399920][ T5644] kvm: pic: non byte write [ 176.477473][ T357] usb 4-1: device descriptor read/64, error -71 [ 176.515799][ T5650] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 176.524439][ T5650] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 176.722499][ T357] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 176.846343][ T36] audit: type=1326 audit(2000000026.248:23731): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5619 comm="syz.2.1905" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4bb8d9ce59 code=0x7fc00000 [ 176.871859][ T357] usb 4-1: device descriptor read/64, error -71 [ 176.871867][ T36] audit: type=1326 audit(2000000026.257:23732): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5619 comm="syz.2.1905" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f4bb8d9ce59 code=0x7fc00000 [ 176.871897][ T36] audit: type=1326 audit(2000000026.257:23733): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5619 comm="syz.2.1905" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4bb8d9ce59 code=0x7fc00000 [ 176.929369][ T36] audit: type=1326 audit(2000000026.257:23734): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5619 comm="syz.2.1905" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4bb8d9ce59 code=0x7fc00000 [ 176.954951][ T36] audit: type=1326 audit(2000000026.257:23735): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5619 comm="syz.2.1905" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4bb8d9ce59 code=0x7fc00000 [ 176.980588][ T36] audit: type=1326 audit(2000000026.257:23736): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5619 comm="syz.2.1905" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4bb8d9ce59 code=0x7fc00000 [ 177.006568][ T36] audit: type=1326 audit(2000000026.257:23737): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5619 comm="syz.2.1905" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4bb8d9ce59 code=0x7fc00000 [ 177.032525][ T36] audit: type=1326 audit(2000000026.257:23738): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5619 comm="syz.2.1905" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4bb8d9ce59 code=0x7fc00000 [ 177.120432][ T357] usb 4-1: device descriptor read/64, error -71 [ 177.159964][ T5657] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 177.168573][ T5657] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 177.169988][ T5660] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 177.184913][ T5660] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 177.232746][ T357] usb usb4-port1: attempt power cycle [ 177.579565][ T357] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 177.601116][ T357] usb 4-1: device descriptor read/8, error -71 [ 177.697388][ T5663] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1919'. [ 177.706346][ T5663] bridge_slave_1: left allmulticast mode [ 177.712029][ T5663] bridge_slave_1: left promiscuous mode [ 177.717917][ T5663] bridge0: port 2(bridge_slave_1) entered disabled state [ 177.725795][ T5665] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 177.734544][ T5665] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 177.734818][ T357] usb 4-1: device descriptor read/8, error -71 [ 177.786887][ T5665] netlink: 'syz.5.1920': attribute type 1 has an invalid length. [ 177.975356][ T5678] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 177.983921][ T5678] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 177.997470][ T357] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 178.018914][ T357] usb 4-1: device descriptor read/8, error -71 [ 178.045157][ T5678] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 178.053782][ T5678] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 178.151605][ T357] usb 4-1: device descriptor read/8, error -71 [ 178.201141][ T5686] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 178.209826][ T5686] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 178.226487][ T5691] rust_binder: 5690:5691 transaction to 0 failed: ENOENT [ 178.243464][ T5695] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 178.259094][ T5695] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 178.267224][ T357] usb usb4-port1: unable to enumerate USB device [ 178.396296][ T5701] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 178.404905][ T5701] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 178.831431][ T5705] /dev/loop0: Can't lookup blockdev [ 178.837414][ T5705] tc_dump_action: action bad kind [ 178.885924][ T5707] ip6gretap0: entered promiscuous mode [ 178.891494][ T5707] ip6gretap0: entered allmulticast mode [ 179.009940][ T5720] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 179.019264][ T5720] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 179.258056][ T5737] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 179.280205][ T5737] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 179.535679][ T942] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 179.553126][ T5747] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 179.561702][ T5747] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 179.687607][ T942] usb 4-1: Using ep0 maxpacket: 32 [ 179.694385][ T942] usb 4-1: unable to get BOS descriptor or descriptor too short [ 179.703011][ T942] usb 4-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 179.713348][ T942] usb 4-1: too many endpoints for config 1 interface 2 altsetting 1: 255, using maximum allowed: 30 [ 179.724147][ T942] usb 4-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 179.738586][ T942] usb 4-1: New USB device found, idVendor=2b53, idProduct=0024, bcdDevice= 0.40 [ 179.747655][ T942] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 179.755721][ T942] usb 4-1: Product: syz [ 179.759939][ T942] usb 4-1: Manufacturer: syz [ 179.764539][ T942] usb 4-1: SerialNumber: syz [ 179.819960][ T5750] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 179.828646][ T5750] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 179.839140][ T5750] cgroup: Need name or subsystem set [ 179.981737][ T5741] netlink: 120 bytes leftover after parsing attributes in process `syz.3.1943'. [ 180.038589][ T942] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 180.048833][ T942] snd-usb-audio 4-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 180.061124][ T942] snd-usb-audio 4-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 180.073978][ T942] usb 4-1: USB disconnect, device number 20 [ 180.076785][ T544] udevd[544]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.2/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 180.225550][ T5761] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 180.234575][ T5761] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 180.372280][ T5773] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 180.381688][ T5773] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 180.440568][ T5777] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 180.449006][ T5778] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 180.449844][ T5777] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 180.458363][ T5778] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 180.795644][ T312] usb 4-1: new low-speed USB device number 21 using dummy_hcd [ 180.940306][ T36] kauditd_printk_skb: 69 callbacks suppressed [ 180.940320][ T36] audit: type=1400 audit(2000000030.275:23808): avc: denied { ioctl } for pid=5785 comm="syz.5.1960" path="/dev/usbmon0" dev="devtmpfs" ino=87 ioctlcmd=0x920a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 180.976052][ T312] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 180.987386][ T312] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 8 [ 180.998546][ T312] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 6 [ 181.011518][ T312] usb 4-1: New USB device found, idVendor=056a, idProduct=0301, bcdDevice= 0.00 [ 181.020602][ T312] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 181.029357][ T312] usb 4-1: config 0 descriptor?? [ 181.034593][ T5780] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 181.088472][ T36] audit: type=1400 audit(2000000030.412:23809): avc: denied { create } for pid=5796 comm="syz.2.1965" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 181.158953][ T5804] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 181.167630][ T5804] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 181.190922][ T5802] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 181.199504][ T5802] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 181.450410][ T5780] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 181.459059][ T5780] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 181.468644][ T312] usbhid 4-1:0.0: can't add hid device: -71 [ 181.474752][ T312] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 181.483529][ T312] usb 4-1: USB disconnect, device number 21 [ 181.694352][ T36] audit: type=1400 audit(2000000031.013:23810): avc: denied { ioctl } for pid=5815 comm="syz.2.1970" path="/dev/uhid" dev="devtmpfs" ino=199 ioctlcmd=0x5868 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 181.750017][ T296] ------------[ cut here ]------------ [ 181.755562][ T296] WARNING: CPU: 0 PID: 296 at fs/overlayfs/util.c:602 ovl_dir_modified+0x15a/0x190 [ 181.765188][ T296] Modules linked in: [ 181.769095][ T296] CPU: 0 UID: 0 PID: 296 Comm: syz-executor Not tainted syzkaller #0 c85af0946947830cbbda05564cc921f578791c52 [ 181.780947][ T296] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 181.791212][ T296] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 181.797135][ T296] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 0e 5d 97 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 e6 d6 3e ff <0f> 0b e9 3e ff ff ff e8 da d6 3e ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 181.816831][ T296] RSP: 0018:ffffc9000b67fb48 EFLAGS: 00010293 [ 181.821964][ T5828] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 181.823094][ T296] RAX: ffffffff8248ecba RBX: 0000000000000000 RCX: ffff888103348000 [ 181.831754][ T5828] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 181.839262][ T296] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 181.855047][ T296] RBP: ffffc9000b67fb70 R08: ffff8881135aefdf R09: 1ffff110226b5dfb [ 181.863832][ T296] R10: dffffc0000000000 R11: ffffed10226b5dfc R12: 0000000000000000 [ 181.871830][ T296] R13: dffffc0000000000 R14: ffff8881135aef40 R15: ffff888135e90dd0 [ 181.879925][ T296] FS: 00005555856ca500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 181.888943][ T296] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 181.895685][ T296] CR2: 00005555856e5918 CR3: 00000001037d2000 CR4: 00000000003526b0 [ 181.903725][ T296] Call Trace: [ 181.907004][ T296] [ 181.909925][ T296] ovl_do_remove+0x81b/0xda0 [ 181.914546][ T296] ? ovl_set_redirect+0x780/0x780 [ 181.919579][ T296] ? down_write+0xee/0x2b0 [ 181.924043][ T296] ? __cfi_down_write+0x10/0x10 [ 181.928906][ T296] ovl_rmdir+0x1e/0x30 [ 181.933003][ T296] vfs_rmdir+0x3e3/0x560 [ 181.937253][ T296] incfs_kill_sb+0x109/0x230 [ 181.941836][ T296] deactivate_locked_super+0xd5/0x2a0 [ 181.947227][ T296] deactivate_super+0xb8/0xe0 [ 181.951918][ T296] cleanup_mnt+0x406/0x4a0 [ 181.956378][ T296] __cleanup_mnt+0x1d/0x40 [ 181.960798][ T296] task_work_run+0x1e5/0x260 [ 181.965413][ T296] ? __cfi_task_work_run+0x10/0x10 [ 181.970541][ T296] ? __x64_sys_umount+0x12e/0x180 [ 181.975613][ T296] ? __cfi___x64_sys_umount+0x10/0x10 [ 181.981004][ T296] ? __kasan_check_read+0x15/0x20 [ 181.986076][ T296] resume_user_mode_work+0x35/0x50 [ 181.991237][ T296] syscall_exit_to_user_mode+0x63/0xb0 [ 181.996809][ T296] do_syscall_64+0x63/0xf0 [ 182.001232][ T296] ? clear_bhb_loop+0x50/0xa0 [ 182.005940][ T296] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 182.011841][ T296] RIP: 0033:0x7f4bb8d9e097 [ 182.016284][ T296] Code: a2 c7 05 5c 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 182.035933][ T296] RSP: 002b:00007ffcfbbb7ee8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 182.044356][ T296] RAX: 0000000000000000 RBX: 00007f4bb8e321ca RCX: 00007f4bb8d9e097 [ 182.052352][ T296] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffcfbbb7fa0 [ 182.060353][ T296] RBP: 00007ffcfbbb7fa0 R08: 00007ffcfbbb8fa0 R09: 00000000ffffffff [ 182.068387][ T296] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcfbbb9030 [ 182.076402][ T296] R13: 00007f4bb8e321ca R14: 000000000002c4bf R15: 00007ffcfbbb9070 [ 182.084477][ T296] [ 182.087529][ T296] ---[ end trace 0000000000000000 ]--- [ 182.093494][ T296] ------------[ cut here ]------------ [ 182.099038][ T296] WARNING: CPU: 1 PID: 296 at fs/overlayfs/util.c:602 ovl_dir_modified+0x15a/0x190 [ 182.108424][ T296] Modules linked in: [ 182.112337][ T296] CPU: 1 UID: 0 PID: 296 Comm: syz-executor Tainted: G W syzkaller #0 c85af0946947830cbbda05564cc921f578791c52 [ 182.125476][ T296] Tainted: [W]=WARN [ 182.129303][ T296] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 182.139512][ T296] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 182.145164][ T296] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 0e 5d 97 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 e6 d6 3e ff <0f> 0b e9 3e ff ff ff e8 da d6 3e ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 182.164822][ T296] RSP: 0018:ffffc9000b67fb48 EFLAGS: 00010293 [ 182.170928][ T296] RAX: ffffffff8248ecba RBX: 0000000000000000 RCX: ffff888103348000 [ 182.178924][ T296] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 182.186929][ T296] RBP: ffffc9000b67fb70 R08: ffff8881135aefdf R09: 1ffff110226b5dfb [ 182.194919][ T296] R10: dffffc0000000000 R11: ffffed10226b5dfc R12: 0000000000000000 [ 182.202931][ T296] R13: dffffc0000000000 R14: ffff8881135aef40 R15: ffff888135e90dd0 [ 182.210946][ T296] FS: 00005555856ca500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 182.220201][ T296] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 182.226796][ T296] CR2: 00007f299d5ea540 CR3: 00000001037d2000 CR4: 00000000003526b0 [ 182.234927][ T296] Call Trace: [ 182.238242][ T296] [ 182.241186][ T296] ovl_do_remove+0x81b/0xda0 [ 182.245785][ T296] ? ovl_set_redirect+0x780/0x780 [ 182.250837][ T296] ? down_write+0xee/0x2b0 [ 182.255275][ T296] ? __cfi_down_write+0x10/0x10 [ 182.260169][ T296] ovl_rmdir+0x1e/0x30 [ 182.264245][ T296] vfs_rmdir+0x3e3/0x560 [ 182.268512][ T296] incfs_kill_sb+0x1a0/0x230 [ 182.273105][ T296] deactivate_locked_super+0xd5/0x2a0 [ 182.278506][ T296] deactivate_super+0xb8/0xe0 [ 182.283187][ T296] cleanup_mnt+0x406/0x4a0 [ 182.287594][ T296] __cleanup_mnt+0x1d/0x40 [ 182.292033][ T296] task_work_run+0x1e5/0x260 [ 182.297246][ T296] ? __cfi_task_work_run+0x10/0x10 [ 182.302508][ T296] ? __x64_sys_umount+0x12e/0x180 [ 182.307547][ T296] ? __cfi___x64_sys_umount+0x10/0x10 [ 182.312976][ T296] ? __kasan_check_read+0x15/0x20 [ 182.318010][ T296] resume_user_mode_work+0x35/0x50 [ 182.323145][ T296] syscall_exit_to_user_mode+0x63/0xb0 [ 182.328689][ T296] do_syscall_64+0x63/0xf0 [ 182.333111][ T296] ? clear_bhb_loop+0x50/0xa0 [ 182.337785][ T296] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 182.343705][ T296] RIP: 0033:0x7f4bb8d9e097 [ 182.348131][ T296] Code: a2 c7 05 5c 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 182.367766][ T296] RSP: 002b:00007ffcfbbb7ee8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 182.376209][ T296] RAX: 0000000000000000 RBX: 00007f4bb8e321ca RCX: 00007f4bb8d9e097 [ 182.384746][ T296] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffcfbbb7fa0 [ 182.392755][ T296] RBP: 00007ffcfbbb7fa0 R08: 00007ffcfbbb8fa0 R09: 00000000ffffffff [ 182.400763][ T296] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcfbbb9030 [ 182.408740][ T296] R13: 00007f4bb8e321ca R14: 000000000002c4bf R15: 00007ffcfbbb9070 [ 182.416749][ T296] [ 182.419773][ T296] ---[ end trace 0000000000000000 ]--- [ 182.447585][ T36] audit: type=1400 audit(2000000031.752:23811): avc: denied { create } for pid=5829 comm="syz.2.1974" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1