last executing test programs: 6.075646992s ago: executing program 0 (id=49): setsockopt$MRT6_ADD_MIF(0xffffffffffffffff, 0x29, 0xca, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x1}, 0xc) 6.075348652s ago: executing program 0 (id=50): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb0, 0x1f9a, 0xa2b9, 0x6, 0x9, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffff9, 0x101bd, 0x4000000d, 0x0, 0x0, 0x6, 0x4, 0x100002, 0x2, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x2, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x200, 0x9, 0xf9a2, 0xa9, 0xff, 0xff, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x5, 0xfff, 0x1, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000086f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x3, 0x200b398, 0x8001, 0x1, 0x6, 0x1c, 0x7, 0x1, 0xfffffffe, 0x2fc4, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff4, 0x4, 0x46, 0x5, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x200, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x1000, 0x31, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0x9, 0x9, 0xc, 0x2, 0x69, 0x80000001, 0x2000005, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2800004, 0x3, 0x10, 0x5, 0x9, 0x405, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xfff, 0x4, 0x7f, 0x9, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x27, 0xf7cc, 0xd502, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x400000c, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x81, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x6, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x8, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0x10dab, 0xfffffffd, 0x8, 0x13fff, 0xffff, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000740)={0x0, &(0x7f0000000480)=[@wr_drn={0x68, 0x20, {0x6, 0x8}}, @nested_set_state_pages={0x140, 0x28, {0x2, 0x32, @gpa=0x8080000}}, @set_irq_handler={0xc8, 0x20, {0x2a, 0x2}}, @nested_set_state_pages={0x140, 0x28, {0x3, 0x36, @unmapped=0xdddd0000}}, @nested_vmlaunch={0x12f, 0x18, 0x3}], 0xa8}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f00000003c0)={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x7, 0x1, 0x2, 0x4, 0x4, 0x8}, 0x20) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000280)={[0x8, 0x4, 0x7, 0x7, 0x5, 0x80000000, 0x1, 0x8001, 0xc646, 0x1, 0x8, 0x3, 0x4, 0x0, 0x8, 0x8000000000000], 0x3000, 0xa400}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) dup(r4) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000100), 0x2) r5 = memfd_create(&(0x7f0000000140)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xcda\x9b\x11X\x0e\xa1\xcf\x1a\x98S7\xc9\x00'/47, 0x2) ftruncate(r5, 0xffff) r6 = add_key$keyring(&(0x7f0000000340), &(0x7f0000000380)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000400), &(0x7f0000000440)={'syz', 0x3}, 0x0, 0x0, r6) add_key$fscrypt_v1(&(0x7f0000000540), &(0x7f0000000580)={'fscrypt:', @auto=[0x30, 0x30, 0x36, 0x30, 0x30, 0x30, 0x30, 0x30, 0x38, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x6]}, &(0x7f00000005c0)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r6) add_key$fscrypt_v1(&(0x7f0000000640), &(0x7f0000000680)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x65, 0x30, 0x30, 0x33, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x32]}, &(0x7f00000006c0)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r6) add_key$fscrypt_v1(&(0x7f0000000780), &(0x7f00000007c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x65, 0x38, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x33]}, &(0x7f0000000880)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x1b}, 0x48, r6) add_key$fscrypt_v1(&(0x7f0000000900), &(0x7f0000000940)={'fscrypt:', @auto=[0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x65, 0x30, 0x62, 0x30, 0x30, 0x30, 0x30, 0x34]}, &(0x7f0000000980)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r6) add_key$fscrypt_v1(&(0x7f0000000a00), &(0x7f0000000a40)={'fscrypt:', @desc4}, &(0x7f0000000a80)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r6) add_key$fscrypt_v1(&(0x7f0000000b00), &(0x7f0000000b40)={'fscrypt:', @auto=[0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x36]}, &(0x7f0000000b80)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r6) add_key$fscrypt_v1(&(0x7f0000000c00), &(0x7f0000000c40)={'fscrypt:', @desc1}, &(0x7f0000001140)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccdd2233445566778899aabbccddeeff00000000000000000000000000000000007300", 0x28}, 0x48, r6) add_key$fscrypt_v1(&(0x7f00000011c0), &(0x7f0000001200)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x38, 0x30, 0x30, 0x30, 0x37, 0x30, 0x33, 0x30, 0x63, 0x30, 0x30, 0x30, 0x38]}, &(0x7f0000001240)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r6) add_key$fscrypt_v1(&(0x7f00000012c0), &(0x7f0000001300)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x66, 0x30, 0x30, 0x30, 0x30, 0x30, 0x63, 0x30, 0x30, 0x30, 0x39]}, &(0x7f0000001340)={0x0, "00112233448ee9f20599aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x43}, 0x48, r6) add_key$fscrypt_v1(&(0x7f00000013c0), &(0x7f0000001400)={'fscrypt:', @auto=[0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x61, 0x39, 0x30, 0x30, 0x64, 0x30, 0x30, 0x30, 0x30, 0x61]}, &(0x7f0000001440)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r6) add_key$fscrypt_v1(&(0x7f00000014c0), &(0x7f0000001500)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x62]}, &(0x7f0000001540)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r6) 6.00077605s ago: executing program 0 (id=51): socket$inet6(0xa, 0x1, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000cc0)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000000c0)={0x2, 0x4e23, @loopback}, 0x10) writev(r0, &(0x7f0000000d40)=[{&(0x7f0000000d80)="396cf87d08c5a180ab47bb5bf073f86e645bdcec1582ceaa94028bed754c6a0a9ee51723aba90ee33675431670f9548c745b3da48b83d07d7eccc4eb90a1e0e95fa8b02a190ec6899154b7410e1d84c954", 0x51}], 0x1) r1 = memfd_secret(0x0) syz_usb_connect$uac3(0x5, 0xb4, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000408c0d01024000010700000000000000030101e010080b0002010130070904000000010130000a2401103e00070000000d240704030c0000000c00000014240203000003040200000009008b00d701950013240301020303040405000400ff0705002e7b73d70100000102300009040101010102300009050109200040d4840a252500000000010400090402000001023000090402010101023000090582091002fa0b020a2525000000800901"], 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_udp(0xa, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20004845, &(0x7f00000001c0)={0xa, 0x4e20, 0x6, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x23}}}, 0x1c) syz_usb_connect$uac3(0x2, 0xff, &(0x7f0000000640)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x10, 0x582, 0x582, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xed, 0x3, 0x1, 0x26, 0x30, 0xa, {0x8, 0xb, 0x2, 0x1, 0x1, 0x21, 0x30, 0x6}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xb, 0x58, 0x6}, [@selector_unit={0x7, 0x24, 0xc, 0x5, 0x2, "bc40"}, @feature_unit={0xd, 0x24, 0x7, 0x3, 0x6, [0xe, 0xa]}, @multiply_unit={0xb, 0x24, 0xd, 0x6, 0x5, 0x3, 0xf3b9}, @source_unit={0xc, 0x24, 0xb, 0xa, 0x0, 0x1, 0x0, 0x4}, @processing_unit={0x1d, 0x24, 0x9, 0x2, 0x3, [0x3, 0x1, 0x0, 0x0, 0x0, 0x1]}, @cluster_info_segment={0x6, 0x20, 0x7, 0xa7, 0x5}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x4, 0x55}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x4, 0x8001, 0x26, 0x5}]}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x9, 0x3, 0xf0, {0xa, 0x25, 0x25, 0x7ee, 0x2, 0xb}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0x1}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x3, 0x7}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x3f4, 0x52da, 0xfc, 0x14}, @format_type_ii_discrete={0xb, 0x24, 0x2, 0x2, 0x3, 0x8, 0x6, "105d"}]}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x1, 0x4, 0x1d, {0xa, 0x25, 0x25, 0x0, 0x0, 0x2}}}}}}}}]}}, &(0x7f0000000bc0)={0xa, &(0x7f0000000740)={0xa, 0x6, 0x310, 0xfb, 0x6, 0x3, 0xff}, 0x4b, &(0x7f0000000780)={0x5, 0xf, 0x4b, 0x5, [@ext_cap={0x7, 0x10, 0x2, 0x8, 0x1, 0x6, 0x1}, @ssp_cap={0x14, 0x10, 0xa, 0xfd, 0x2, 0x8, 0xff0f, 0x401, [0x0, 0xc0c0]}, @ss_container_id={0x14, 0x10, 0x4, 0x7a, "576ec2205ea7a8632436e3c8af722c91"}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x0, "23ca31e3703248bfe64f60893c3079da"}]}, 0x8, [{0x76, &(0x7f0000000c40)=ANY=[@ANYBLOB="760349fce77acd2bdb836942c432b2000060df6d456ea4e569b1f5f8e0f9cbe6fa1ed75de0348e13653778d74b7ec4ef87d1dec9929eefdef4689b92131a0bb4da64aef0ca97442b92f8e1c8f11d13aa039a8c81e6453612b92bc0dca7ecb1eb7a2d9f03e0fb7001d364846899103edf2bccff0af01ce770ecf93cc1"]}, {0xd8, &(0x7f0000000880)=@string={0xd8, 0x3, "0c03ab888ff76a18b1b5b3d470b709363441d5c5b84cc4c1489a654e3cb4ae09d01b45ab44664887dfb9a01399f0c90b314f854068a72964273321cec4ec3e4dece91f72873cac9d6cae3928cd93edb3997e14e624266e77426644b6ad52bd817b7f1164221502da81fc2713b3907e9204dfdb9fcb278ec502ea20dc0c0340bcc143bc3fa2f45d21c2ee0d82d8c799321821d53a6a142a27d82cb5cea3d154c83ffa1edf8222fe11cd3e5f40d7d556881054968c67946dfaab772058a2a8b4658eb49ee473941869c88b8003f3a217c77565192bc48a"}}, {0x4, &(0x7f0000000980)=@lang_id={0x4, 0x3, 0x2c09}}, {0x4, &(0x7f00000009c0)=@lang_id={0x4, 0x3, 0x301c}}, {0x4, &(0x7f0000000a00)=@lang_id={0x4, 0x3, 0x424}}, {0xc9, &(0x7f0000000a40)=@string={0xc9, 0x3, "46e9944a81b1ebc9501b86b2fcc2d743e57757c2d6a442d0435dd8c463cf58b599d91242c611d84853c3acf89ed004de07b8189212030da43f425db2ccddefceb08b8e28e4b62a6ed55de7c9462092d8a94a3c206342281ab7ff8e95bd7654e78287271a47499e1a573bcaebd08c98a5d6f4a11b6a29a0f988c0384d52a96581c7270698bf5cfb03da4f00da7bf3c3d45ef13731a0680721860cade04c3da8b9c342651f0126837c67ab0f04361e82bc0bece23631722bfc08d7019a83a054624e567f8f5fbde8"}}, {0x1c, &(0x7f0000000b40)=@string={0x1c, 0x3, "1c46ff93256bc91f4d7db40be7068859e68154a6ddd74f17eb0a"}}, {0x4, &(0x7f0000000b80)=@lang_id={0x4, 0x3, 0x418}}]}) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x0) getsockopt$inet6_buf(r2, 0x29, 0x3d, 0x0, &(0x7f0000000200)=0x37) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000240)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000002c0)=@new_dev={0x1, 0xa71, 0x0, 0x0, 0x1000, 0xffffffff, 0xffffffffffffffff, 0x0, 0x38}}}, &(0x7f0000000300)=0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup(r4) syz_ublk_setup_queues(r5, r3, &(0x7f0000000340)={0x0, 0xc5, 0x80, 0x1, 0x35e}, &(0x7f00000003c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc04, 0x42, 0x0, 0x94}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8fcc, 0x8, 0x1, 0x3ad, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x8000, 0x1, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x226d, 0x1, 0x1, 0x26d}}], 0x1, 0x0, 0x0) write(r0, &(0x7f0000000e00)="39270725d93c4ab6cb559938ef75d3d7fd5c06a228a59b717b6934bdefb8b8e2dfca955f26b8cab29bdfdce27e4f9cb112fe41e0a6799578f252519cd4a289985be050d209b4c9617cfb", 0x4a) r6 = syz_open_procfs(0x0, &(0x7f0000000f80)='net/tcp\x00') r7 = syz_open_dev$loop(&(0x7f0000000100), 0x8, 0x0) ioctl$BLKFLSBUF(r7, 0x1261, 0x0) syz_usb_connect(0x0, 0xb3, &(0x7f0000000140)=ANY=[@ANYBLOB="12010002ef020140000000000001000000010902a1000201008032080b00020e6a000009040000000e0100000d240100012700006cdc020901112402010102000000000000000002000009240302010100010009040100000e0200000e240101470085000200000001001b2404"], 0x0) preadv(r6, &(0x7f0000000fc0)=[{&(0x7f0000001000)=""/238, 0xee}], 0x1, 0x81, 0x0) 3.420715337s ago: executing program 2 (id=81): r0 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, 0x0, 0x0) 3.382476541s ago: executing program 2 (id=82): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) listen(r0, 0x5a) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000300)={0x1, &(0x7f0000000340)=[{0x6, 0xfd, 0xc, 0x42}]}, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x24040014, &(0x7f0000000380)={0xa, 0x4e22, 0x40, @empty}, 0x1c) sendmmsg$inet(r1, &(0x7f00000003c0)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000500)="18ba76151dccfcd6ee9850c7bb051d5b287e0ee481259ec25231f6fabbd6303ae25c20", 0x23}], 0x1}}, {{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000640)="abc9d5f5f4737e6f08165d7eff806658e2ebd6fdb549be4af900e93738b57eaf5d6403", 0x23}], 0x1}}], 0x2, 0x48045) 3.381403831s ago: executing program 2 (id=83): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='setgroups\x00') (async, rerun: 32) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) (async, rerun: 32) syz_open_procfs(0x0, &(0x7f0000000100)='fd/3\x00') r1 = openat$selinux_policy(0xffffff9c, &(0x7f0000000300), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r1, 0x0) (async) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$XFS_IOC_BULKSTAT(r0, 0x8040587f, &(0x7f0000001480)={{0x4, 0x4, 0x8000, 0x81}, &(0x7f0000000780)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}) (async) r3 = socket$packet(0x11, 0x3, 0x300) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'ip6tnl0\x00', 0x0}) sendto$packet(r3, &(0x7f0000000700)="145df21f673c81e914564caeb66c1ee3422ae4b7e11a2a5b44c1bd411c2ed9a134f6cf7017eae578c0d2ea117e350000000c4a5394f143134d5d8118d8c47ac3d44effffffffffffa2fd8475aacdb0c74a71fa00bb61ce09cf2998c35ce72f148f53aa1377975e6d029bbde73929e5fcdd00"/128, 0x80, 0x90, &(0x7f0000000080)={0x11, 0x8847, r4, 0x1, 0x6}, 0x14) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_buf(r5, 0x6, 0x1c, 0x0, &(0x7f0000000140)) (async) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000180)='/sys/power/wakeup_count', 0x28201, 0xeb) setsockopt$IP_VS_SO_SET_ZERO(r6, 0x0, 0x48f, &(0x7f00000001c0)={0x3b, @multicast2, 0x4e23, 0x0, 'lc\x00', 0x20, 0x1000, 0x51}, 0x2c) (async, rerun: 64) io_setup(0x9, &(0x7f0000000200)=0x0) (rerun: 64) io_submit(r7, 0x1, &(0x7f0000000240)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x40, r6, &(0x7f00000002c0)='8', 0x1, 0x80, 0x0, 0x3}]) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./tracing\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000380)='./tracing\x00', &(0x7f00000003c0)='tracefs\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./tracing/events/sched/filter\x00', 0x1, 0x40) writev(r8, &(0x7f0000000440)=[{&(0x7f0000000480)="e08eb2b32835", 0x6}], 0x1) (async) socketpair$tipc(0x1e, 0x1, 0x0, 0x0) (async, rerun: 64) r9 = openat$fuse(0xffffffffffffff9c, &(0x7f00000004c0), 0x42, 0x0) (rerun: 64) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000500), 0x2002, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r11, 0xae60) ioctl$XFS_IOC_ERROR_INJECTION(r11, 0x40085874, &(0x7f0000000580)={r9, 0x6}) (async) r12 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0), 0x2, 0x0) ioctl$TUNSETIFF(r12, 0x400454ca, &(0x7f0000000600)={'syzkaller1\x00', 0x5001}) (async) r13 = openat$selinux_policy(0xffffff9c, &(0x7f0000000640), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r13, 0x0) 2.944841246s ago: executing program 0 (id=84): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xc0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000003500)={0x1, &(0x7f0000003540)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r0, 0xffffffffffffffff, 0x200000000000000) openat$dir(0xffffffffffffff9c, &(0x7f0000003580)='./file0\x00', 0x8880, 0x8d) syz_ublk_setup_io_uring(0x20, &(0x7f00000035c0)={0x0, 0x0, 0x1000, 0x40002, 0x1e5}, &(0x7f0000003640), &(0x7f0000003680), &(0x7f00000036c0)=0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, r1, &(0x7f0000003700)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x104, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000003780)=@new_dev={0x1, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f00000037c0)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, 0x0, &(0x7f0000003800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x80000, 0x1000020, 0x33d, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffffff, 0x0, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6a6c, 0x6449, 0x0, 0xfffffffd}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0x40, 0x0, 0x29b}}], 0x1, 0x0, 0x0) 2.944664556s ago: executing program 0 (id=85): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) listen(r0, 0x5a) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000300)={0x1, &(0x7f0000000340)=[{0x6, 0xfd, 0xc, 0x42}]}, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x24040014, &(0x7f0000000380)={0xa, 0x4e22, 0x40, @empty}, 0x1c) sendmmsg$inet(r1, &(0x7f00000003c0)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000500)="18ba76151dccfcd6ee9850c7bb051d5b287e0ee481259ec25231f6fabbd6303ae25c20", 0x23}], 0x1}}, {{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000640)="abc9d5f5f4737e6f08165d7eff806658e2ebd6fdb549be4af900e93738b57eaf5d6403", 0x23}], 0x1}}], 0x2, 0x48045) (fail_nth: 2) 2.677695124s ago: executing program 0 (id=86): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_connect$uac1(0x6, 0x77, &(0x7f00000001c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0xff, 0x644, 0x800f, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x65, 0x3, 0x1, 0x2, 0x10, 0x0, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xf, 0xf}, [@selector_unit={0x5, 0x24, 0x5, 0x5, 0x5}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0xd, 0x80, 0x5, {0x7, 0x25, 0x1, 0xc, 0xb6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x8, 0x3, 0x2, {0x7, 0x25, 0x1, 0xc, 0x5, 0x9}}}}}}}}]}}, 0x0) syz_usb_ep_write(r0, 0x81, 0xb1, &(0x7f0000000040)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cc51117c4a71e26518e804c00058e6c7c0c363027651548bb650d90000000000db6a72932beffbf05bc5f123822168900cb170b2308e360132df72466c90389e39a6a429bf18603d50ab57e269f0167673793c5d1ee760060cd55136fb2a0532c0037291a7647be1e49928698eed52ed272ebc3bdaa3a54a893db5ac9b70a6cc616a2cf190a79363") 2.219382311s ago: executing program 1 (id=92): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f0000000000), 0x651, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000280)='net/if_inet6\x00') r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000b80)=ANY=[@ANYBLOB="cc0000001b000100000000000000000000000000000000000000ffff64010100e000000200"/60, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000e90000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000031b0000000000000000000000000c00080008"], 0xcc}}, 0x0) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000, 0x3, &(0x7f0000718000/0x2000)=nil) ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, 0x0) 2.219226651s ago: executing program 2 (id=93): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) bind$unix(0xffffffffffffffff, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000280)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000300), 0x318, 0x0) recvmmsg(r0, &(0x7f0000000340), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x25, &(0x7f0000000380)=0x2) ioctl$sock_SIOCSPGRP(r1, 0x8902, 0x0) r2 = epoll_create1(0x0) r3 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f0000000400)={0x40000000}) openat(0xffffffffffffff9c, &(0x7f0000000440)='./cgroup.cpu/cgroup.procs\x00', 0x88080, 0x16) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) syz_clone3(&(0x7f00000004c0)={0x23800000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) setpriority(0x1, 0x0, 0x0) mount(0x0, &(0x7f00000005c0)='./trace\x00', 0x0, 0x0, 0x0) 1.391733917s ago: executing program 1 (id=98): prlimit64(0x0, 0xe, &(0x7f00000006c0)={0x8, 0xffffffffffffffff}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000780)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f00000007c0)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000800)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000840)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000008c0), 0x318, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x10106, 0x2, 0x0) r2 = epoll_create1(0x0) r3 = fcntl$dupfd(r2, 0x2, 0xffffffffffffffff) close_range(r3, 0xffffffffffffffff, 0x2) syz_clone3(&(0x7f0000000a00)={0x180801400, &(0x7f0000000a80), 0x0, 0x0, {0x3d}, 0x0, 0x0, 0x0, 0x0}, 0x64) ppoll(&(0x7f0000000ac0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 1.339625392s ago: executing program 2 (id=99): prlimit64(0x0, 0xe, &(0x7f00000004c0)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000500)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000540)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000580)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000600)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000680), 0x651, 0x0) recvmmsg(r1, &(0x7f00000006c0), 0x4000087, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000780), 0x41, 0x0) 172.738573ms ago: executing program 3 (id=102): syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f00000026c0)=[@code={0xa, 0x70, {"b805000000b9000000000f01d96467f3250000000066b811010f00d866b80e010f00d0460f0848b804000000000000000f23d00f21f8350000000c0f23f84281bc0800a00000907c0000c4e221936457e565650f1c860000c0fec401557623"}}], 0x70}) r0 = openat$kvm(0xffffff9c, &(0x7f0000000540), 0x8000, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x77, 0x2, 0x2, 0x4002004c4, 0x1004, 0x8000000000000004, 0xc595, 0x0, 0x5, 0xffffffffffffffff, 0x2000000000000000, 0x5, 0x8d], 0xeeee8000, 0x2010d3}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101000, 0x0) openat$kvm(0x0, &(0x7f00000001c0), 0x0, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000180)={0x1, 0x0, [{0xc0011029, 0x0, 0x8}]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x3, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 172.622553ms ago: executing program 1 (id=103): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040)) ioctl$INCFS_IOC_GET_FILLED_BLOCKS(r0, 0x80286722, &(0x7f0000000100)={0x0, 0x0, 0x5, 0xb}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x3, 0x1000000000, 0x0, 0x200000000000043, 0x2000004, 0x0, 0x2004cb, 0x0, 0xa7f, 0x68ff, 0x0, 0x8000000009, 0x803, 0x26c00, 0x9, 0x2], 0xffff1000, 0x102280}) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f00000001c0)={{0x3000, 0x1, 0x8, 0x8, 0x3, 0xe6, 0x40, 0x0, 0x0, 0x81, 0x7f}, {0x1, 0x3000, 0x3, 0x0, 0x0, 0x5, 0x75, 0x6, 0x36, 0xe, 0x2, 0x7}, {0x54000, 0x5000, 0xe, 0x5, 0x3, 0x7, 0x0, 0x9, 0x1, 0xa4, 0x5, 0x5}, {0x1, 0xeeee0000, 0x4, 0x7, 0x2, 0x7e, 0xb, 0xff, 0x8, 0x7, 0xe}, {0xf000, 0x4, 0xf, 0x3, 0x16, 0x87, 0xab, 0x8, 0x9, 0x9, 0xf8, 0x97}, {0xeeef9fff, 0x0, 0xe, 0x9f, 0xb1, 0x8, 0x7, 0xa0, 0x82, 0x2f, 0x1, 0x7}, {0x3000, 0x70000, 0xe, 0x5, 0x7, 0x5, 0x7, 0x43, 0x8, 0x81, 0x42, 0x70}, {0xdddd0000, 0xa000, 0xa, 0x5, 0xcd, 0x7, 0x9, 0x9, 0x2, 0xc, 0xb0, 0x91}, {0xeeee0000, 0x2}, {0x8000000, 0x7}, 0x1, 0x0, 0x3000, 0x2024, 0x100000000000002, 0x0, 0x100000, [0x6800000000000000, 0x4, 0x3, 0x8]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 170.221823ms ago: executing program 2 (id=104): syz_usb_connect$rtl8150(0x3, 0x3f, &(0x7f0000000040)={{0x12, 0x1, 0x110, 0xff, 0xff, 0x0, 0x40, 0xbda, 0x8150, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x5, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x7f, 0x3, 0xff, 0x11, 0x1, 0x5, "", {{0x9, 0x5, 0x81, 0x2, 0x40, 0x6, 0x9, 0x4}, {0x9, 0x5, 0x2, 0x2, 0x20, 0x2, 0x57, 0x6e}, {0x9, 0x5, 0x83, 0x3, 0x240, 0x3, 0x82, 0x8}}}}}}]}}, 0x0) 129.539187ms ago: executing program 3 (id=105): r0 = socket(0x10, 0x803, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) getsockname$packet(r0, 0x0, &(0x7f00000000c0)) 118.318138ms ago: executing program 3 (id=106): mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000480)='./sys\x00', &(0x7f00000004c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/disk\x00', 0x1, 0x0) close(r0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0) ioctl$TIOCGPGRP(r0, 0x540f, 0x0) 67.568703ms ago: executing program 1 (id=107): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000001240), 0x101102, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xa098) ioctl$ASHMEM_SET_PROT_MASK(r0, 0x40087705, 0x0) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x8, 0x11, r0, 0x697e3000) 57.931154ms ago: executing program 1 (id=108): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r3, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f00000003c0)="0f1eff0f01df640f38020666b815010f00d8b9a3020000b80eb20000ba000000000f300f01cbb8d00000000f23d80f21f835800000c00f23f8f3f30f902966baf80cb8d0fc7284ef66bafc0cb0f4ee0f78d6", 0x52}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 57.404014ms ago: executing program 3 (id=109): mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000002c0)='./debug\x00', &(0x7f00000003c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/bluetooth/rfcomm\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000440)={0x2020}, 0x2020) 41.056766ms ago: executing program 3 (id=110): r0 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKPBSZGET(r0, 0x127b, 0x0) 25.265248ms ago: executing program 3 (id=111): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000280)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f00000002c0)=[@text64={0x40, 0x0}], 0x0, 0x0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a9c000000050a010400000000000000000a0000020a000700726f7574650000000c00024000000000000000050900030073797a30000000000c000240000000000000000308000540000000033c0004800800024055e742af14000300627269646765300000000000000000001400030070696d36726567300000000000000000080002406c833e2308000540fffffffd0c00024000000000000000042c010000180a03000000000000000000020000080900010073797a3100000000b8000380080001400000000018000380140001006d616373656330000000000000000000080002400000008118000380140001007465616d5f736c6176655f310000000054000380140001007465616d300000000000000000000000140001006e657470636930000000000000000000140001007465616d30000000000000000000000014000100697036746e6c300000000000000000001800038014000100626f6e645f736c6176655f300000000008000140000000000c00054000000000000000010c00054000000000000000013000038008000140000000000800024000000ed2080002400000005508000240ffffff8f0800014000000000040003800900010073797a310000000078000000060a0102000000000000000002000005610007405a98f5825bccf259a987b003a710d1a2883ccb3dcfbc167572e7f92f99584382f760dfe0b20456dda5b3d482bae64d91807ed0db8b701956fa10a1a31818d274d60151716cf87073a4269922941a7f2f51d003324ac580792eb43ce4ee000000803300000e0a010300000000000000000a00000464330380e8040080cf0006409694a0933beb97d8cb5fb4527141dce943b74c180af9844ee1c447a206cef4f5be729db93ca41dfe4eb06ad24839664319b1edba698afed079fa0d816aaaa5d3d602125f53f4a1e1cb7aa33e804fccbfb9fb23264dccbfd8044dbfb0b82000aff45db06cf143a20c89b7d25647f8dbcb14dc6e6d3bd427deaa6655ed44dd3b6ee59cb5cb40e2fd7a09c5299cfec951b042d60827a65383626cc5d9b7b1284d4e99921523753954526140ff8e6fdef5675e498356e68c4b0852a24a28dd5ec18698a8308512bae7ad70b9da000c000540000000000000000250010a80eb0001006cee02b2e2ecc5f736b8bfe71a6578b8c18e595ab38b17bbe95e8aaaefafe44c758c8e49a9a339610502a51927a6669a42ea435340a6c1f8d68a626bbbf85a46ffb590307a3bdba1c40667b98bde980527a5650cbb6bb96149c5e2d26ff96e668e27f38aed7f9d39cb894b2b5bcda77eb18ede143b7be24d7cdbce72044fe4193e937b07cb7f37b331b39487e3ca3e8e69d46f7f15c71b53878cbc904f73ab3773f6776eb8484e969e685cb205c781170c20409e2e6faf679504c170231a6de81b7b6c104564497949a3932cfb10c8cfff05220c0f873072e5412af4f02bc53db39d6ce41be12c00180002800900020073797a310000000008000180ffffffff20000280080003400000000108000180000000040900020073797a3100000000100002800900020073797a3100000000180002800900020073797a320000000008000180ffffffff0c000440000000000000000f0900090073797a32000000005c0007800b000100736f636b657400004c00028008000140a1310ce40800030000000033080002400000000808000140000000030800014000000002080002400000000f0800014000000003080002400000000808000140000000000c00044000000000000000070c00044000000000000000072c020180040002803c0002800900020073797a30000000000900020073797a320000000008000180fffffffb08000180ffffffff08000340000000010800018000000000200002800900020073797a3200000000080003400000000108000340000000033c00028008000180fffffffb08000180fffffffe08000180fffffffc0900020073797a320000000008000340000000010900020073797a31000000003c00028008000180fffffffd0900020073797a300000000008000340000000010900020073797a300000000008000180ffffffff0800034000000001d70001002e9f98aa03ed1bafeaa026248f5625e4c2c101ad3986f94484d0f7e9ae9972fd18b44d656ca573364a3926a301934b54c1fad47e869260cb008f587ffeea89fcaaf321b7fd3ee47112ab02f4b9235b9d46366fd6394df89f1a991cc0bf2920b933aa29df7112fb1a3181478eed028a0f13841dcad1995b4f173e262fe49aacd2d331654758baf38c9e448377c4c006e1ba9896a7189cede8bc1e753e8e540b354cd96ea198ce2438e94c577eb8f87790c4576082ec65d441ba8a97502d5da3f1d35539da849e915936d5f4dc2f19927933877400400002800800034000000002080003400000000308000180000000030900020073797a3200000000080003400000000108000340000000020800034000000004380000000900020073797a310000000008000340000000030900020073797a32000000000900020073797a30000000000800034000000003c40200800c0004400000000000000003f00101804800028008000340000000010900020073797a310000000008000180fffffffc08000180ffffffff08000180fffffffb0900020073797a30000000000900020073797a300000000053000100e4d91b480aa00c0e84e294332949236954f6316cb31af202117adf1bd0b1ed2165ddcf01fe65c92f18cd60513d896df8b64f558102ad649cac659fa018ac30b2f1bc48b96a31e0132b95226f220a91005c00028008000340000000020900020073797a31000000000900020073797a30000000000900020073797a320000000008000180fffffffb08000180fffffffd08000180fffffffb08000340000000020900020073797a320000000019000100cb59d585179a786aa882d9a15d27d7bd5806e9173c000000d8000100499c205e79de797089f4382319b84941ed72f9ec65e1dfb2bdc9e861dfec4f7aeb34558c96b517ab15d255c693b3deb1b8a8fc6d9eb3a967d877758a430bdb54b2c1274a632b724e69e698f5a2276281522e035a87eae98eb7ca9ba823aabbdc31022e069b7594f4db4a456befd02eaeda80aa1d2d421e4c12bdba5752ca8d28f88867f6be8ce2e3f1d31e65633bfcec91c9ed79cf3870cb0e09b7f3051da3852720287337cf187ac8d932a26d5cad3397e87a99d936b6376fd3ec14627cf2bc164d7296f7b20527d042acc0b0a63e80000b800c00018007000100637400000c000180080001006f736600100001800c0001007061796c6f616400200001800b00010064796e7365740000100002800c0006400000000000001000140001800e000100627974656f7264657200000010000180090001006861736800000000100001800b0001006f626a7265660000440007800b00010064796e7365740000340002800900010073797a30000000000900010073797a3100000000100007800b0001006c6f6f6b7570000008000940000000019c00008084000b801c0001800b0001006e756d67656e00000c0002800800014000000016200001800d00010073796e70726f7879000000000c0002800600014000020000240001800c0001007061796c6f6164001400028008000640000000010800074000000001100001800b0001007470726f78790000100001800b000100736f636b657400000c0007800700010063740000080003400000000114000080100001800c0002800800034000000002f0030080400202808d000100a16fbef11d3aca3167ce7763341197f57c9f79c9afbee24b403c4b06228568606f5b71be4a08c908135db122f8ce011ca41a0c2d029b558263f5b5505934a206866b5b30ad17dbe289f1bc81e0b2a8b742e0d1286993bd9055b17bdb779886b71492ac29e2b9cc9859f582e31b88fb67806655e071e4b230d51c47125c22513e834663a9cb51d8b786000000dc0001004339acabed7082a60732d792af9b21d0e2e8ff94d4d057e7f4419d00bea77b13232670625fcc0c3e6eed28013c65a42e6d489ca831cab235f1ed0f3a4e6fcbf6a0770fd42d19f5d4b8715cd63d7d8adddcd24eac55a22a77ca2eb04ffe228d1669fdac7308d4269b862400fb82fa330013ca739cf81a78430fd7aa385409e5a3aa1c0765eda91daa966211ba488ab2b53eefb727e433ae9cd3f683e9d46f935ee7b95f2fb6d2be8d7d686a54ea24076d0bbb199e3f960d715798f9c0b4f0b823013398d5e9a67f808d912c0659aeeaeb17071e40fcd6a008cf0001006e5f5f4e317f8d1a2d74236064b18d73cb40399f64cccfd77a692f769d81439149f07358c781829848f8ebc14b4e8219d9d7699a77e1e91f6a2240d6f87dd56fbe8184dd59395134cafe340f4d401430cbf09e23532020c899b6e767969e8b980100124f9f38f6b0fa4e831b08471f7e8e59e76e337d28ce84b2185645adb2a270a3aec2cc08f323a5a89420cf2a88f3f8a1c8100626b6ba1a1b3b20"], 0x35e8}, 0x1, 0x0, 0x0, 0x11}, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) pivot_root(&(0x7f0000000000)='./mysys/bus/pci/devices/0000:00:05.0/resource0\x00', &(0x7f0000000200)='./mysys\x00') 0s ago: executing program 1 (id=112): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000440)='./tracing\x00', &(0x7f0000000480)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./tracing/events/sched/filter\x00', 0x1, 0x0) write$binfmt_format(r0, &(0x7f0000000500)='0\x00', 0x2) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.160' (ED25519) to the list of known hosts. [ 30.556204][ T36] audit: type=1400 audit(1793386783.490:64): avc: denied { mounton } for pid=287 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 30.560322][ T287] cgroup: Unknown subsys name 'net' [ 30.578934][ T36] audit: type=1400 audit(1793386783.490:65): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 30.606314][ T36] audit: type=1400 audit(1793386783.520:66): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 30.606866][ T287] cgroup: Unknown subsys name 'devices' [ 30.729584][ T287] cgroup: Unknown subsys name 'hugetlb' [ 30.735240][ T287] cgroup: Unknown subsys name 'rlimit' [ 30.832004][ T36] audit: type=1400 audit(1793386783.770:67): avc: denied { setattr } for pid=287 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 30.855222][ T36] audit: type=1400 audit(1793386783.770:68): avc: denied { mounton } for pid=287 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 30.880031][ T36] audit: type=1400 audit(1793386783.770:69): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 30.905606][ T289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 30.914470][ T36] audit: type=1400 audit(1793386783.850:70): avc: denied { relabelto } for pid=289 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.940007][ T36] audit: type=1400 audit(1793386783.850:71): avc: denied { write } for pid=289 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.965719][ T287] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 30.966123][ T36] audit: type=1400 audit(1793386783.900:72): avc: denied { read } for pid=287 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 31.000108][ T36] audit: type=1400 audit(1793386783.900:73): avc: denied { open } for pid=287 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 31.848374][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.855471][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.862669][ T294] bridge_slave_0: entered allmulticast mode [ 31.868998][ T294] bridge_slave_0: entered promiscuous mode [ 31.883109][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.890317][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.897493][ T294] bridge_slave_1: entered allmulticast mode [ 31.903894][ T294] bridge_slave_1: entered promiscuous mode [ 31.941234][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.948442][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.955542][ T297] bridge_slave_0: entered allmulticast mode [ 31.962082][ T297] bridge_slave_0: entered promiscuous mode [ 31.969985][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.977306][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.984400][ T297] bridge_slave_1: entered allmulticast mode [ 31.990799][ T297] bridge_slave_1: entered promiscuous mode [ 32.033676][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.040846][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.048003][ T295] bridge_slave_0: entered allmulticast mode [ 32.054299][ T295] bridge_slave_0: entered promiscuous mode [ 32.062843][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.069941][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.077279][ T295] bridge_slave_1: entered allmulticast mode [ 32.083648][ T295] bridge_slave_1: entered promiscuous mode [ 32.117722][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.124887][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.132047][ T296] bridge_slave_0: entered allmulticast mode [ 32.138343][ T296] bridge_slave_0: entered promiscuous mode [ 32.160055][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.167197][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.174307][ T296] bridge_slave_1: entered allmulticast mode [ 32.180745][ T296] bridge_slave_1: entered promiscuous mode [ 32.283387][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.290536][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.302867][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.309995][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.317343][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.324391][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.358386][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.365515][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.372880][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.379985][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.426840][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.433961][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.441291][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.448378][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.472070][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.479562][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.488714][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.496130][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.506643][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.513831][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.528566][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.535699][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.550909][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.558043][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.626011][ T294] veth0_vlan: entered promiscuous mode [ 32.635159][ T295] veth0_vlan: entered promiscuous mode [ 32.647535][ T297] veth0_vlan: entered promiscuous mode [ 32.654794][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.661896][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.677606][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.684760][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.701834][ T295] veth1_macvtap: entered promiscuous mode [ 32.715096][ T294] veth1_macvtap: entered promiscuous mode [ 32.729716][ T297] veth1_macvtap: entered promiscuous mode [ 32.788776][ T296] veth0_vlan: entered promiscuous mode [ 32.791773][ T297] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 32.812360][ T296] veth1_macvtap: entered promiscuous mode [ 32.858358][ T318] capability: warning: `syz.0.1' uses deprecated v2 capabilities in a way that may be insecure [ 32.881160][ T321] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 33.106572][ T334] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=3344 sclass=netlink_xfrm_socket pid=334 comm=syz.2.8 [ 33.120383][ T335] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=3344 sclass=netlink_xfrm_socket pid=335 comm=syz.2.8 [ 33.437131][ T9] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 33.607107][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 33.615949][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 33.627004][ T9] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 33.642143][ T9] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 33.651602][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.661000][ T9] usb 4-1: Product: syz [ 33.665647][ T9] usb 4-1: Manufacturer: syz [ 33.670546][ T9] usb 4-1: SerialNumber: syz [ 33.717972][ T369] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.726649][ T369] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.740025][ T371] netlink: 276 bytes leftover after parsing attributes in process `syz.1.18'. [ 33.767437][ T371] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 33.957177][ T31] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 34.030773][ T9] usb 4-1: 0:2 : does not exist [ 34.042907][ T9] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 34.061373][ T9] usb 4-1: USB disconnect, device number 2 [ 34.108617][ T31] usb 1-1: unable to get BOS descriptor or descriptor too short [ 34.117754][ T31] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0xE has invalid maxpacket 64 [ 34.129836][ T31] usb 1-1: New USB device found, idVendor=15ca, idProduct=0101, bcdDevice= 0.40 [ 34.139041][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.147155][ T31] usb 1-1: Product: syz [ 34.151397][ T31] usb 1-1: Manufacturer: syz [ 34.156023][ T31] usb 1-1: SerialNumber: syz [ 34.161800][ T368] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 34.248173][ T386] FAULT_INJECTION: forcing a failure. [ 34.248173][ T386] name failslab, interval 1, probability 0, space 0, times 0 [ 34.261259][ T386] CPU: 0 UID: 0 PID: 386 Comm: syz.1.23 Not tainted syzkaller #0 04b5f10b80d13b0533bf6aaa302b886c75cf6d37 [ 34.261297][ T386] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 34.261320][ T386] Call Trace: [ 34.261327][ T386] [ 34.261335][ T386] __dump_stack+0x21/0x30 [ 34.261372][ T386] dump_stack_lvl+0x140/0x1c0 [ 34.261401][ T386] ? __cfi_dump_stack_lvl+0x10/0x10 [ 34.261432][ T386] ? __lruvec_stat_mod_folio+0x13f/0x1a0 [ 34.261455][ T386] dump_stack+0x19/0x20 [ 34.261481][ T386] should_fail_ex+0x3c2/0x510 [ 34.261501][ T386] should_failslab+0xac/0x100 [ 34.261520][ T386] kmem_cache_alloc_noprof+0x42/0x410 [ 34.261550][ T386] ? __pte_alloc+0x1ae/0x440 [ 34.261575][ T386] ? __anon_vma_prepare+0xa5/0x590 [ 34.261602][ T386] __anon_vma_prepare+0xa5/0x590 [ 34.261628][ T386] do_pte_missing+0x2bbf/0x4440 [ 34.261648][ T386] ? __kasan_check_write+0x18/0x20 [ 34.261673][ T386] ? _raw_spin_lock+0x92/0x120 [ 34.261696][ T386] ? __cfi__raw_spin_lock+0x10/0x10 [ 34.261718][ T386] ? pte_marker_clear+0x1b0/0x1b0 [ 34.261736][ T386] ? __pmd_alloc+0x5a6/0x9a0 [ 34.261754][ T386] ? __cfi___pmd_alloc+0x10/0x10 [ 34.261771][ T386] ? is_bpf_text_address+0x17b/0x1a0 [ 34.261795][ T386] handle_mm_fault+0x1189/0x1ba0 [ 34.261818][ T386] ? __cfi_handle_mm_fault+0x10/0x10 [ 34.261835][ T386] ? __kasan_check_write+0x18/0x20 [ 34.261871][ T386] ? path_openat+0x1127/0x35a0 [ 34.261891][ T386] ? do_filp_open+0x1f2/0x440 [ 34.261911][ T386] ? do_sys_openat2+0x134/0x1d0 [ 34.261933][ T386] ? lock_mm_and_find_vma+0xb8/0x390 [ 34.261954][ T386] do_user_addr_fault+0x4ee/0x1230 [ 34.261977][ T386] exc_page_fault+0x58/0xc0 [ 34.262004][ T386] asm_exc_page_fault+0x2b/0x30 [ 34.262032][ T386] RIP: 0010:__put_user_4+0x11/0x30 [ 34.262054][ T386] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 89 cb 48 c1 fb 3f 48 09 d9 0f 01 cb <89> 01 31 c9 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 [ 34.262070][ T386] RSP: 0018:ffffc9000cc57740 EFLAGS: 00050202 [ 34.262096][ T386] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000200000000040 [ 34.262110][ T386] RDX: 0000000000000000 RSI: 0000000000000201 RDI: ffffffff851590b0 [ 34.262123][ T386] RBP: ffffc9000cc57770 R08: 0000000000000003 R09: 0000000000000004 [ 34.262135][ T386] R10: dffffc0000000000 R11: fffff5200198aed8 R12: ffff8881155fe0bc [ 34.262150][ T386] R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881155fe0a8 [ 34.262165][ T386] ? packet_ioctl+0x300/0x350 [ 34.262185][ T386] ? packet_ioctl+0x30b/0x350 [ 34.262202][ T386] sock_do_ioctl+0x115/0x330 [ 34.262226][ T386] ? sock_show_fdinfo+0xd0/0xd0 [ 34.262247][ T386] sock_ioctl+0x568/0x7e0 [ 34.262264][ T386] ? __cfi_sock_ioctl+0x10/0x10 [ 34.262282][ T386] ? is_bpf_text_address+0x17b/0x1a0 [ 34.262303][ T386] ? kernel_text_address+0xa9/0xe0 [ 34.262331][ T386] ? __kernel_text_address+0x11/0x40 [ 34.262359][ T386] ? __cfi_sock_ioctl+0x10/0x10 [ 34.262378][ T386] do_vfs_ioctl+0xf85/0x2010 [ 34.262396][ T386] ? arch_stack_walk+0x10a/0x170 [ 34.262417][ T386] ? __ia32_compat_sys_ioctl+0x980/0x980 [ 34.262436][ T386] ? _parse_integer_limit+0x195/0x1e0 [ 34.262465][ T386] ? _parse_integer+0x2e/0x40 [ 34.262494][ T386] ? kstrtoull+0x13b/0x1e0 [ 34.262522][ T386] ? kstrtouint+0x78/0xf0 [ 34.262549][ T386] ? avc_has_perm_noaudit+0x26b/0x360 [ 34.262569][ T386] ? __asan_memcpy+0x5a/0x80 [ 34.262593][ T386] ? avc_has_perm_noaudit+0x289/0x360 [ 34.262613][ T386] ? avc_has_perm+0x155/0x240 [ 34.262634][ T386] ? __cfi_avc_has_perm+0x10/0x10 [ 34.262653][ T386] ? proc_fail_nth_write+0x184/0x220 [ 34.262676][ T386] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 34.262699][ T386] ? selinux_file_ioctl+0xecd/0x1480 [ 34.262725][ T386] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 34.262751][ T386] ? __cfi_vfs_write+0x10/0x10 [ 34.262780][ T386] ? __kasan_check_write+0x18/0x20 [ 34.262805][ T386] ? mutex_unlock+0x90/0x240 [ 34.262829][ T386] ? __cfi_mutex_unlock+0x10/0x10 [ 34.262861][ T386] ? __fget_files+0x2bc/0x330 [ 34.262880][ T386] ? bpf_lsm_file_ioctl+0xd/0x20 [ 34.262903][ T386] ? security_file_ioctl+0x3e/0x110 [ 34.262929][ T386] __se_sys_ioctl+0x97/0x1b0 [ 34.262948][ T386] __x64_sys_ioctl+0x7f/0xa0 [ 34.262966][ T386] x64_sys_call+0x1878/0x2ee0 [ 34.262986][ T386] do_syscall_64+0x57/0xf0 [ 34.263005][ T386] ? clear_bhb_loop+0x50/0xa0 [ 34.263035][ T386] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 34.263060][ T386] RIP: 0033:0x7f9aa079f559 [ 34.263082][ T386] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.263098][ T386] RSP: 002b:00007f9aa16d7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 34.263117][ T386] RAX: ffffffffffffffda RBX: 00007f9aa0a25fa0 RCX: 00007f9aa079f559 [ 34.263132][ T386] RDX: 0000200000000040 RSI: 000000000000541b RDI: 0000000000000003 [ 34.263145][ T386] RBP: 00007f9aa16d7090 R08: 0000000000000000 R09: 0000000000000000 [ 34.263158][ T386] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 34.263171][ T386] R13: 00007f9aa0a26038 R14: 00007f9aa0a25fa0 R15: 00007ffd4812a508 [ 34.263188][ T386] [ 34.795585][ T31] usb 1-1: MIDIStreaming interface descriptor not found [ 34.817824][ T31] usb 1-1: USB disconnect, device number 2 [ 34.858296][ T372] udevd[372]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 34.925150][ T402] SELinux: Context is not valid (left unmapped). [ 35.037026][ T413] input: syz1 as /devices/virtual/input/input4 [ 35.067116][ T9] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 35.092408][ T419] netlink: 168 bytes leftover after parsing attributes in process `syz.3.38'. [ 35.218651][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 35.226691][ T9] usb 2-1: not running at top speed; connect to a high speed hub [ 35.235241][ T9] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 4 [ 35.249167][ T9] usb 2-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 35.258494][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.266531][ T9] usb 2-1: Product: syz [ 35.270786][ T9] usb 2-1: Manufacturer: syz [ 35.276717][ T9] usb 2-1: SerialNumber: syz [ 35.289512][ T428] overlayfs: missing 'lowerdir' [ 35.485101][ T9] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 35.692471][ T9] usb 2-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 35.701103][ T9] usb 2-1: found format II with max.bitrate = 4, frame size=7372 [ 35.787147][ T31] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 35.947588][ T31] usb 1-1: no configurations [ 35.952289][ T31] usb 1-1: can't read configurations, error -22 [ 36.057214][ T396] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 36.087227][ T31] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 36.094042][ T9] usb 2-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 36.103512][ T9] usb 2-1: found format II with max.bitrate = 4, frame size=7372 [ 36.237148][ T396] usb 3-1: Using ep0 maxpacket: 32 [ 36.237815][ T31] usb 1-1: no configurations [ 36.244274][ T396] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 36.247268][ T31] usb 1-1: can't read configurations, error -22 [ 36.258230][ T396] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 36.265228][ T31] usb usb1-port1: attempt power cycle [ 36.274809][ T396] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 36.288903][ T396] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.297007][ T9] usb 2-1: parse_audio_format_rates_v2v3(): unable to retrieve number of sample rates (clock 0) [ 36.308306][ T396] usb 3-1: config 0 descriptor?? [ 36.318950][ T9] usb 2-1: USB disconnect, device number 2 [ 36.334687][ T343] udevd[343]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 36.617227][ T31] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 36.638065][ T31] usb 1-1: no configurations [ 36.642753][ T31] usb 1-1: can't read configurations, error -22 [ 36.721304][ T396] savu 0003:1E7D:2D5A.0001: hiddev96,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.2-1/input0 [ 36.777197][ T31] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 36.797996][ T31] usb 1-1: no configurations [ 36.802720][ T31] usb 1-1: can't read configurations, error -22 [ 36.809313][ T31] usb usb1-port1: unable to enumerate USB device [ 36.818860][ T36] kauditd_printk_skb: 97 callbacks suppressed [ 36.818876][ T36] audit: type=1400 audit(1793386789.760:169): avc: denied { unmount } for pid=294 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 36.852242][ T461] ======================================================= [ 36.852242][ T461] WARNING: The mand mount option has been deprecated and [ 36.852242][ T461] and is ignored by this kernel. Remove the mand [ 36.852242][ T461] option from the mount to silence this warning. [ 36.852242][ T461] ======================================================= [ 36.940997][ T469] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 36.978303][ T458] usb 3-1: USB disconnect, device number 2 [ 37.024364][ T36] audit: type=1400 audit(1793386789.960:170): avc: denied { read } for pid=473 comm="syz.1.59" dev="nsfs" ino=4026532308 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 37.045964][ T36] audit: type=1400 audit(1793386789.960:171): avc: denied { open } for pid=473 comm="syz.1.59" path="net:[4026532308]" dev="nsfs" ino=4026532308 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 37.077251][ T476] netlink: 48 bytes leftover after parsing attributes in process `syz.1.60'. [ 37.086935][ T36] audit: type=1400 audit(1793386790.020:172): avc: denied { mounton } for pid=475 comm="syz.1.60" path="/14/file0" dev="tmpfs" ino=96 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 37.197787][ T36] audit: type=1400 audit(1793386790.140:173): avc: denied { create } for pid=475 comm="syz.1.60" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 37.209927][ T477] process 'syz.1.60' launched './file0' with NULL argv: empty string added [ 37.217345][ T36] audit: type=1400 audit(1793386790.150:174): avc: denied { getopt } for pid=475 comm="syz.1.60" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 37.246845][ T36] audit: type=1400 audit(1793386790.180:175): avc: denied { unmount } for pid=294 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 37.317255][ T55] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 37.508231][ T36] audit: type=1400 audit(1793386790.450:176): avc: denied { bind } for pid=492 comm="syz.1.66" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 37.532840][ T36] audit: type=1400 audit(1793386790.470:177): avc: denied { mounton } for pid=492 comm="syz.1.66" path="/18/file0" dev="tmpfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 37.555709][ T36] audit: type=1400 audit(1793386790.490:178): avc: denied { listen } for pid=496 comm="syz.2.67" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 38.577293][ T545] FAULT_INJECTION: forcing a failure. [ 38.577293][ T545] name failslab, interval 1, probability 0, space 0, times 0 [ 38.590277][ T545] CPU: 0 UID: 0 PID: 545 Comm: syz.0.85 Not tainted syzkaller #0 04b5f10b80d13b0533bf6aaa302b886c75cf6d37 [ 38.590312][ T545] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 38.590361][ T545] Call Trace: [ 38.590368][ T545] [ 38.590377][ T545] __dump_stack+0x21/0x30 [ 38.590415][ T545] dump_stack_lvl+0x140/0x1c0 [ 38.590446][ T545] ? __cfi_dump_stack_lvl+0x10/0x10 [ 38.590479][ T545] dump_stack+0x19/0x20 [ 38.590508][ T545] should_fail_ex+0x3c2/0x510 [ 38.590529][ T545] should_failslab+0xac/0x100 [ 38.590551][ T545] kmem_cache_alloc_node_noprof+0x45/0x420 [ 38.590581][ T545] ? __alloc_skb+0x10c/0x360 [ 38.590606][ T545] __alloc_skb+0x10c/0x360 [ 38.590630][ T545] ? tcp_current_mss+0x539/0x8b0 [ 38.590661][ T545] tcp_stream_alloc_skb+0x43/0x370 [ 38.590693][ T545] tcp_sendmsg_locked+0xcbc/0x4ac0 [ 38.590726][ T545] ? avc_has_perm_noaudit+0x289/0x360 [ 38.590750][ T545] ? __kasan_check_write+0x18/0x20 [ 38.590779][ T545] ? __cfi__raw_spin_lock_bh+0x10/0x10 [ 38.590805][ T545] ? __cfi_tcp_sendmsg_locked+0x10/0x10 [ 38.590839][ T545] ? __cfi_tcp_sendmsg+0x10/0x10 [ 38.590869][ T545] tcp_sendmsg+0x3e/0xd0 [ 38.590899][ T545] ? __cfi_tcp_sendmsg+0x10/0x10 [ 38.590928][ T545] inet6_sendmsg+0xb7/0x120 [ 38.590949][ T545] ____sys_sendmsg+0x5d8/0xa00 [ 38.590979][ T545] ? __import_iovec+0x5b9/0x7d0 [ 38.591007][ T545] ? __sys_sendmsg_sock+0x50/0x50 [ 38.591034][ T545] ? unwind_get_return_address+0x51/0x90 [ 38.591065][ T545] ? import_iovec+0x80/0xb0 [ 38.591092][ T545] ___sys_sendmsg+0x2a6/0x370 [ 38.591125][ T545] ? __sys_sendmsg+0x260/0x260 [ 38.591147][ T545] ? kstrtouint+0x78/0xf0 [ 38.591174][ T545] ? __fget_files+0x2bc/0x330 [ 38.591211][ T545] __sys_sendmmsg+0x292/0x490 [ 38.591242][ T545] ? __cfi___sys_sendmmsg+0x10/0x10 [ 38.591275][ T545] ? __cfi_ksys_write+0x10/0x10 [ 38.591306][ T545] __x64_sys_sendmmsg+0xa4/0xc0 [ 38.591334][ T545] x64_sys_call+0xfec/0x2ee0 [ 38.591350][ T545] do_syscall_64+0x57/0xf0 [ 38.591367][ T545] ? clear_bhb_loop+0x50/0xa0 [ 38.591389][ T545] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 38.591411][ T545] RIP: 0033:0x7fdff759f559 [ 38.591424][ T545] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 38.591437][ T545] RSP: 002b:00007fdff844f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 38.591454][ T545] RAX: ffffffffffffffda RBX: 00007fdff7825fa0 RCX: 00007fdff759f559 [ 38.591466][ T545] RDX: 0000000000000002 RSI: 00002000000003c0 RDI: 0000000000000004 [ 38.591476][ T545] RBP: 00007fdff844f090 R08: 0000000000000000 R09: 0000000000000000 [ 38.591486][ T545] R10: 0000000000048045 R11: 0000000000000246 R12: 0000000000000001 [ 38.591495][ T545] R13: 00007fdff7826038 R14: 00007fdff7825fa0 R15: 00007ffdc36201c8 [ 38.591509][ T545] [ 38.922127][ T553] netlink: 'syz.3.89': attribute type 4 has an invalid length. [ 38.941233][ T553] netlink: 4 bytes leftover after parsing attributes in process `syz.3.89'. [ 38.950917][ T553] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=553 comm=syz.3.89 [ 38.964369][ T553] FAULT_INJECTION: forcing a failure. [ 38.964369][ T553] name failslab, interval 1, probability 0, space 0, times 0 [ 38.977061][ T553] CPU: 0 UID: 0 PID: 553 Comm: syz.3.89 Not tainted syzkaller #0 04b5f10b80d13b0533bf6aaa302b886c75cf6d37 [ 38.977113][ T553] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 38.977141][ T553] Call Trace: [ 38.977147][ T553] [ 38.977153][ T553] __dump_stack+0x21/0x30 [ 38.977188][ T553] dump_stack_lvl+0x140/0x1c0 [ 38.977234][ T553] ? __cfi_dump_stack_lvl+0x10/0x10 [ 38.977265][ T553] dump_stack+0x19/0x20 [ 38.977293][ T553] should_fail_ex+0x3c2/0x510 [ 38.977315][ T553] should_failslab+0xac/0x100 [ 38.977342][ T553] kmem_cache_alloc_noprof+0x42/0x410 [ 38.977376][ T553] ? kmemdup_noprof+0x5b/0x80 [ 38.977395][ T553] ? hashtab_duplicate+0x1a0/0x6c0 [ 38.977420][ T553] ? cond_bools_copy+0x71/0x180 [ 38.977445][ T553] hashtab_duplicate+0x1a0/0x6c0 [ 38.977463][ T553] ? __cfi_cond_bools_destroy+0x10/0x10 [ 38.977486][ T553] ? __cfi_cond_bools_copy+0x10/0x10 [ 38.977510][ T553] cond_policydb_dup+0x129/0xc00 [ 38.977533][ T553] ? kmemdup_noprof+0x5b/0x80 [ 38.977553][ T553] security_set_bools+0xdf/0x630 [ 38.977595][ T553] ? _copy_from_user+0x87/0xa0 [ 38.977628][ T553] ? memdup_user_nul+0xad/0x1a0 [ 38.977655][ T553] ? sel_commit_bools_write+0x137/0x400 [ 38.977671][ T553] sel_commit_bools_write+0x2fa/0x400 [ 38.977686][ T553] ? __cfi_sel_commit_bools_write+0x10/0x10 [ 38.977703][ T553] ? bpf_lsm_file_permission+0xd/0x20 [ 38.977720][ T553] vfs_writev+0x652/0xe90 [ 38.977736][ T553] ? __cfi_sel_commit_bools_write+0x10/0x10 [ 38.977752][ T553] ? do_writev+0x2e0/0x2e0 [ 38.977769][ T553] ? __kasan_check_write+0x18/0x20 [ 38.977790][ T553] ? mutex_lock+0x97/0x1d0 [ 38.977816][ T553] ? __cfi_mutex_lock+0x10/0x10 [ 38.977842][ T553] do_writev+0x151/0x2e0 [ 38.977858][ T553] ? vfs_readv+0xa00/0xa00 [ 38.977873][ T553] ? __kasan_check_write+0x18/0x20 [ 38.977894][ T553] ? fpregs_restore_userregs+0x11c/0x260 [ 38.977916][ T553] __x64_sys_writev+0x81/0x90 [ 38.977940][ T553] x64_sys_call+0x1fbb/0x2ee0 [ 38.977956][ T553] do_syscall_64+0x57/0xf0 [ 38.977972][ T553] ? clear_bhb_loop+0x50/0xa0 [ 38.978009][ T553] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 38.978031][ T553] RIP: 0033:0x7f5cea59f559 [ 38.978045][ T553] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 38.978058][ T553] RSP: 002b:00007f5ceb52e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 38.978076][ T553] RAX: ffffffffffffffda RBX: 00007f5cea825fa0 RCX: 00007f5cea59f559 [ 38.978088][ T553] RDX: 0000000000000001 RSI: 0000200000005100 RDI: 0000000000000007 [ 38.978099][ T553] RBP: 00007f5cea636b20 R08: 0000000000000000 R09: 0000000000000000 [ 38.978109][ T553] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 38.978118][ T553] R13: 00007f5cea826038 R14: 00007f5cea825fa0 R15: 00007ffd12d9fd28 [ 38.978132][ T553] [ 39.027383][ T45] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 39.356018][ T567] netlink: 12 bytes leftover after parsing attributes in process `syz.1.92'. [ 39.458248][ T45] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 39.488488][ T45] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 39.514365][ T45] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.529136][ T45] usb 1-1: config 0 descriptor?? [ 39.745085][ T45] usbhid 1-1:0.0: can't add hid device: -71 [ 39.761958][ T45] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 39.792578][ T45] usb 1-1: USB disconnect, device number 7 [ 40.257149][ T45] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 40.428860][ T45] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 40.472793][ T45] usb 1-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 40.516883][ T45] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 40.660387][ T45] usb 1-1: config 0 descriptor?? [ 41.547439][ T45] aiptek 1-1:0.0: Aiptek using 400 ms programming speed [ 41.559959][ T45] input: Aiptek as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input6 [ 41.579679][ C0] ------------[ cut here ]------------ [ 41.585291][ C0] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31 [ 41.593917][ C0] index 54539 is out of range for type 'const int[34]' [ 41.600770][ C0] CPU: 0 UID: 0 PID: 614 Comm: syz.3.111 Not tainted syzkaller #0 04b5f10b80d13b0533bf6aaa302b886c75cf6d37 [ 41.600795][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 41.600806][ C0] Call Trace: [ 41.600811][ C0] [ 41.600817][ C0] __dump_stack+0x21/0x30 [ 41.600846][ C0] dump_stack_lvl+0x140/0x1c0 [ 41.600871][ C0] ? __cfi_dump_stack_lvl+0x10/0x10 [ 41.600896][ C0] ? x86_emulate_instruction+0xbf7/0x19f0 [ 41.600919][ C0] ? vcpu_run+0x4bf8/0x7810 [ 41.600941][ C0] ? kvm_vcpu_ioctl+0xa43/0x1000 [ 41.600960][ C0] dump_stack+0x19/0x20 [ 41.600983][ C0] ubsan_epilogue+0xe/0x40 [ 41.600999][ C0] __ubsan_handle_out_of_bounds+0xe8/0xf0 [ 41.601021][ C0] aiptek_irq+0x208d/0x2a00 [ 41.601044][ C0] ? _raw_spin_unlock+0x45/0x60 [ 41.601062][ C0] ? kcov_remote_start+0x1d2/0x3c0 [ 41.601085][ C0] __usb_hcd_giveback_urb+0x36e/0x530 [ 41.601110][ C0] usb_hcd_giveback_urb+0x12b/0x400 [ 41.601132][ C0] dummy_timer+0xa3f/0x4900 [ 41.601161][ C0] ? psi_account_irqtime+0x307/0x9a0 [ 41.601180][ C0] ? __cfi_dummy_timer+0x10/0x10 [ 41.601204][ C0] ? timerqueue_del+0xd7/0x130 [ 41.601219][ C0] ? __hrtimer_run_queues+0x2bd/0x8e0 [ 41.601238][ C0] ? __cfi_dummy_timer+0x10/0x10 [ 41.601261][ C0] __hrtimer_run_queues+0x3ab/0x8e0 [ 41.601281][ C0] ? hrtimer_interrupt+0xf30/0xf30 [ 41.601299][ C0] ? read_tsc+0xd/0x20 [ 41.601322][ C0] ? ktime_get_update_offsets_now+0x3c0/0x3e0 [ 41.601348][ C0] hrtimer_run_softirq+0x159/0x560 [ 41.601368][ C0] ? irqtime_account_irq+0x51/0x1c0 [ 41.601393][ C0] handle_softirqs+0x1ad/0x5b0 [ 41.601413][ C0] __irq_exit_rcu+0x47/0xb0 [ 41.601429][ C0] irq_exit_rcu+0xd/0x30 [ 41.601446][ C0] sysvec_apic_timer_interrupt+0x82/0x90 [ 41.601470][ C0] [ 41.601475][ C0] [ 41.601480][ C0] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 41.601504][ C0] RIP: 0010:__sanitizer_cov_trace_const_cmp8+0x5/0x90 [ 41.601529][ C0] Code: 10 48 89 74 11 18 48 89 44 11 20 5d e9 44 19 22 04 cc 0f 1f 00 b8 ee 0e 2e 34 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 <48> 89 e5 48 8b 45 08 65 48 8b 0d fc 93 7b 7e 65 8b 15 fd 93 7b 7e [ 41.601549][ C0] RSP: 0018:ffffc9000e01eaf8 EFLAGS: 00000246 [ 41.601564][ C0] RAX: ffffffff8129b4ec RBX: 0000000000000003 RCX: 0000000000000002 [ 41.601575][ C0] RDX: ffff88811aa0cf00 RSI: 0000000000000000 RDI: 0000000000000000 [ 41.601585][ C0] RBP: ffffc9000e01eba0 R08: ffff88811972c4c7 R09: 1ffff110232e5898 [ 41.601598][ C0] R10: dffffc0000000000 R11: ffffed10232e5899 R12: 0000000000000004 [ 41.601609][ C0] R13: 0000000000000000 R14: 0000000000004027 R15: 0000000000000000 [ 41.601620][ C0] ? paging64_update_accessed_dirty_bits+0x1bc/0x670 [ 41.601642][ C0] ? paging64_update_accessed_dirty_bits+0x1cd/0x670 [ 41.601664][ C0] paging64_walk_addr_generic+0xec7/0x1800 [ 41.601688][ C0] paging64_gva_to_gpa+0x117/0x220 [ 41.601706][ C0] ? __cfi_paging64_gva_to_gpa+0x10/0x10 [ 41.601728][ C0] ? get_descriptor_ptr+0x304/0x480 [ 41.601748][ C0] ? write_segment_descriptor+0x120/0x120 [ 41.601768][ C0] ? __do_insn_fetch_bytes+0x595/0x740 [ 41.601788][ C0] emulator_read_std+0x12f/0x200 [ 41.601804][ C0] __load_segment_descriptor+0x572/0x10b0 [ 41.601827][ C0] ? linearize+0x980/0x980 [ 41.601846][ C0] ? __kasan_check_read+0x15/0x20 [ 41.601868][ C0] ? vmx_read_guest_seg_ar+0x179/0x350 [ 41.601891][ C0] ? __asan_memcpy+0x5a/0x80 [ 41.601912][ C0] em_jmp_far+0x183/0x300 [ 41.601934][ C0] ? vmx_read_guest_seg_ar+0x1c8/0x350 [ 41.601955][ C0] ? __cfi_em_jmp_far+0x10/0x10 [ 41.601977][ C0] ? setup_clusters+0xcb0/0x18c0 [ 41.601996][ C0] ? init_decode_cache+0x7c/0x90 [ 41.602014][ C0] ? __cfi_em_jmp_far+0x10/0x10 [ 41.602036][ C0] x86_emulate_insn+0x908/0x4140 [ 41.602058][ C0] ? kvm_inject_realmode_interrupt+0x2d0/0x2d0 [ 41.602082][ C0] x86_emulate_instruction+0xbf7/0x19f0 [ 41.602106][ C0] kvm_mmu_page_fault+0x341/0x9a0 [ 41.602128][ C0] handle_ept_violation+0x256/0x450 [ 41.602148][ C0] ? vmx_vcpu_run+0x1116/0x1f70 [ 41.602164][ C0] ? __cfi_handle_ept_violation+0x10/0x10 [ 41.602184][ C0] vmx_handle_exit+0x13b5/0x1bf0 [ 41.602199][ C0] ? kvm_deliver_exception_payload+0xd0/0x1e0 [ 41.602224][ C0] ? __cfi_vmx_vcpu_run+0x10/0x10 [ 41.602241][ C0] vcpu_run+0x4bf8/0x7810 [ 41.602275][ C0] ? signal_pending+0xc0/0xc0 [ 41.602298][ C0] ? __kasan_check_write+0x18/0x20 [ 41.602319][ C0] ? xfd_validate_state+0x68/0x140 [ 41.602344][ C0] ? fpu_swap_kvm_fpstate+0x92/0x5e0 [ 41.602364][ C0] ? __kasan_check_write+0x18/0x20 [ 41.602386][ C0] ? fpregs_mark_activate+0x68/0x160 [ 41.602407][ C0] ? fpu_swap_kvm_fpstate+0x44c/0x5e0 [ 41.602427][ C0] ? fpu_swap_kvm_fpstate+0x92/0x5e0 [ 41.602449][ C0] kvm_arch_vcpu_ioctl_run+0x114c/0x1bc0 [ 41.602474][ C0] ? __cfi_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 41.602499][ C0] ? __futex_wait+0x330/0x3d0 [ 41.602519][ C0] ? __cfi___futex_wait+0x10/0x10 [ 41.602546][ C0] ? ioctl_has_perm+0x1bc/0x500 [ 41.602569][ C0] ? __asan_memcpy+0x5a/0x80 [ 41.602592][ C0] ? ioctl_has_perm+0x408/0x500 [ 41.602614][ C0] ? __kasan_check_read+0x15/0x20 [ 41.602637][ C0] ? has_cap_mac_admin+0xd0/0xd0 [ 41.602661][ C0] ? __kasan_check_write+0x18/0x20 [ 41.602682][ C0] ? mutex_lock_killable+0x97/0x1d0 [ 41.602706][ C0] ? __cfi_mutex_lock_killable+0x10/0x10 [ 41.602730][ C0] kvm_vcpu_ioctl+0xa43/0x1000 [ 41.602748][ C0] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 41.602765][ C0] ? do_futex+0x32a/0x510 [ 41.602781][ C0] ? __cfi_do_futex+0x10/0x10 [ 41.602804][ C0] ? __fget_files+0x2bc/0x330 [ 41.602820][ C0] ? bpf_lsm_file_ioctl+0xd/0x20 [ 41.602836][ C0] ? security_file_ioctl+0x3e/0x110 [ 41.602858][ C0] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 41.602874][ C0] __se_sys_ioctl+0x123/0x1b0 [ 41.602890][ C0] __x64_sys_ioctl+0x7f/0xa0 [ 41.602905][ C0] x64_sys_call+0x1878/0x2ee0 [ 41.602922][ C0] do_syscall_64+0x57/0xf0 [ 41.602939][ C0] ? clear_bhb_loop+0x50/0xa0 [ 41.602962][ C0] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 41.602985][ C0] RIP: 0033:0x7f5cea59f559 [ 41.602998][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 41.603011][ C0] RSP: 002b:00007f5ceb52e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 41.603027][ C0] RAX: ffffffffffffffda RBX: 00007f5cea825fa0 RCX: 00007f5cea59f559 [ 41.603039][ C0] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 41.603049][ C0] RBP: 00007f5cea636b20 R08: 0000000000000000 R09: 0000000000000000 [ 41.603059][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 41.603068][ C0] R13: 00007f5cea826038 R14: 00007f5cea825fa0 R15: 00007ffd12d9fd28 [ 41.603082][ C0] [ 41.603088][ C0] ---[ end trace ]--- [ 42.057698][ T45] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 42.058482][ C0] ================================================================== [ 42.249913][ T45] usb 2-1: config 0 has no interfaces? [ 42.255314][ C0] BUG: KASAN: global-out-of-bounds in aiptek_irq+0x20ab/0x2a00 [ 42.264288][ T45] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 42.271286][ C0] Read of size 4 at addr ffffffff8673f58c by task syz.3.111/614 [ 42.271310][ C0] [ 42.271318][ C0] CPU: 0 UID: 0 PID: 614 Comm: syz.3.111 Not tainted syzkaller #0 04b5f10b80d13b0533bf6aaa302b886c75cf6d37 [ 42.271360][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 42.271424][ C0] Call Trace: [ 42.271450][ C0] [ 42.271482][ C0] __dump_stack+0x21/0x30 [ 42.271605][ C0] dump_stack_lvl+0x140/0x1c0 [ 42.271688][ C0] ? __cfi_dump_stack_lvl+0x10/0x10 [ 42.271779][ C0] ? __cfi__printk+0x10/0x10 [ 42.271861][ C0] print_address_description+0x71/0x210 [ 42.271955][ C0] print_report+0x4a/0x70 [ 42.272047][ C0] kasan_report+0x162/0x1a0 [ 42.272108][ C0] ? aiptek_irq+0x20ab/0x2a00 [ 42.272182][ C0] ? aiptek_irq+0x20ab/0x2a00 [ 42.272254][ C0] __asan_report_load4_noabort+0x18/0x20 [ 42.272336][ C0] aiptek_irq+0x20ab/0x2a00 [ 42.272410][ C0] ? _raw_spin_unlock+0x45/0x60 [ 42.272475][ C0] ? kcov_remote_start+0x1d2/0x3c0 [ 42.272557][ C0] __usb_hcd_giveback_urb+0x36e/0x530 [ 42.272647][ C0] usb_hcd_giveback_urb+0x12b/0x400 [ 42.272730][ C0] dummy_timer+0xa3f/0x4900 [ 42.272835][ C0] ? psi_account_irqtime+0x307/0x9a0 [ 42.272943][ C0] ? __cfi_dummy_timer+0x10/0x10 [ 42.273032][ C0] ? timerqueue_del+0xd7/0x130 [ 42.273085][ C0] ? __hrtimer_run_queues+0x2bd/0x8e0 [ 42.273149][ C0] ? __cfi_dummy_timer+0x10/0x10 [ 42.273238][ C0] __hrtimer_run_queues+0x3ab/0x8e0 [ 42.273311][ C0] ? hrtimer_interrupt+0xf30/0xf30 [ 42.273374][ C0] ? read_tsc+0xd/0x20 [ 42.273453][ C0] ? ktime_get_update_offsets_now+0x3c0/0x3e0 [ 42.273548][ C0] hrtimer_run_softirq+0x159/0x560 [ 42.273621][ C0] ? irqtime_account_irq+0x51/0x1c0 [ 42.273713][ C0] handle_softirqs+0x1ad/0x5b0 [ 42.273778][ C0] __irq_exit_rcu+0x47/0xb0 [ 42.273847][ C0] irq_exit_rcu+0xd/0x30 [ 42.273903][ C0] sysvec_apic_timer_interrupt+0x82/0x90 [ 42.273996][ C0] [ 42.274016][ C0] [ 42.274037][ C0] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 42.274122][ C0] RIP: 0010:__sanitizer_cov_trace_const_cmp8+0x5/0x90 [ 42.274240][ C0] Code: 10 48 89 74 11 18 48 89 44 11 20 5d e9 44 19 22 04 cc 0f 1f 00 b8 ee 0e 2e 34 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 <48> 89 e5 48 8b 45 08 65 48 8b 0d fc 93 7b 7e 65 8b 15 fd 93 7b 7e [ 42.274291][ C0] RSP: 0018:ffffc9000e01eaf8 EFLAGS: 00000246 [ 42.274343][ C0] RAX: ffffffff8129b4ec RBX: 0000000000000003 RCX: 0000000000000002 [ 42.274374][ C0] RDX: ffff88811aa0cf00 RSI: 0000000000000000 RDI: 0000000000000000 [ 42.274388][ C0] RBP: ffffc9000e01eba0 R08: ffff88811972c4c7 R09: 1ffff110232e5898 [ 42.274405][ C0] R10: dffffc0000000000 R11: ffffed10232e5899 R12: 0000000000000004 [ 42.274430][ C0] R13: 0000000000000000 R14: 0000000000004027 R15: 0000000000000000 [ 42.274488][ C0] ? paging64_update_accessed_dirty_bits+0x1bc/0x670 [ 42.274592][ C0] ? paging64_update_accessed_dirty_bits+0x1cd/0x670 [ 42.274675][ C0] paging64_walk_addr_generic+0xec7/0x1800 [ 42.274757][ C0] paging64_gva_to_gpa+0x117/0x220 [ 42.274829][ C0] ? __cfi_paging64_gva_to_gpa+0x10/0x10 [ 42.274914][ C0] ? get_descriptor_ptr+0x304/0x480 [ 42.274986][ C0] ? write_segment_descriptor+0x120/0x120 [ 42.275059][ C0] ? __do_insn_fetch_bytes+0x595/0x740 [ 42.275131][ C0] emulator_read_std+0x12f/0x200 [ 42.275193][ C0] __load_segment_descriptor+0x572/0x10b0 [ 42.275275][ C0] ? linearize+0x980/0x980 [ 42.275346][ C0] ? __kasan_check_read+0x15/0x20 [ 42.275426][ C0] ? vmx_read_guest_seg_ar+0x179/0x350 [ 42.275508][ C0] ? __asan_memcpy+0x5a/0x80 [ 42.275590][ C0] em_jmp_far+0x183/0x300 [ 42.275664][ C0] ? vmx_read_guest_seg_ar+0x1c8/0x350 [ 42.275740][ C0] ? __cfi_em_jmp_far+0x10/0x10 [ 42.275820][ C0] ? setup_clusters+0xcb0/0x18c0 [ 42.275871][ C0] ? init_decode_cache+0x7c/0x90 [ 42.275964][ C0] ? __cfi_em_jmp_far+0x10/0x10 [ 42.276059][ C0] x86_emulate_insn+0x908/0x4140 [ 42.276124][ C0] ? kvm_inject_realmode_interrupt+0x2d0/0x2d0 [ 42.276215][ C0] x86_emulate_instruction+0xbf7/0x19f0 [ 42.276300][ C0] kvm_mmu_page_fault+0x341/0x9a0 [ 42.276382][ C0] handle_ept_violation+0x256/0x450 [ 42.276448][ C0] ? vmx_vcpu_run+0x1116/0x1f70 [ 42.276510][ C0] ? __cfi_handle_ept_violation+0x10/0x10 [ 42.276585][ C0] vmx_handle_exit+0x13b5/0x1bf0 [ 42.276638][ C0] ? kvm_deliver_exception_payload+0xd0/0x1e0 [ 42.276728][ C0] ? __cfi_vmx_vcpu_run+0x10/0x10 [ 42.276790][ C0] vcpu_run+0x4bf8/0x7810 [ 42.276917][ C0] ? signal_pending+0xc0/0xc0 [ 42.276999][ C0] ? __kasan_check_write+0x18/0x20 [ 42.277081][ C0] ? xfd_validate_state+0x68/0x140 [ 42.277168][ C0] ? fpu_swap_kvm_fpstate+0x92/0x5e0 [ 42.277240][ C0] ? __kasan_check_write+0x18/0x20 [ 42.277349][ C0] ? fpregs_mark_activate+0x68/0x160 [ 42.277426][ C0] ? fpu_swap_kvm_fpstate+0x44c/0x5e0 [ 42.277506][ C0] ? fpu_swap_kvm_fpstate+0x92/0x5e0 [ 42.277581][ C0] kvm_arch_vcpu_ioctl_run+0x114c/0x1bc0 [ 42.277683][ C0] ? __cfi_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 42.277774][ C0] ? __futex_wait+0x330/0x3d0 [ 42.277846][ C0] ? __cfi___futex_wait+0x10/0x10 [ 42.277926][ C0] ? ioctl_has_perm+0x1bc/0x500 [ 42.278016][ C0] ? __asan_memcpy+0x5a/0x80 [ 42.278092][ C0] ? ioctl_has_perm+0x408/0x500 [ 42.278173][ C0] ? __kasan_check_read+0x15/0x20 [ 42.278248][ C0] ? has_cap_mac_admin+0xd0/0xd0 [ 42.278337][ C0] ? __kasan_check_write+0x18/0x20 [ 42.278400][ C0] ? mutex_lock_killable+0x97/0x1d0 [ 42.278434][ C0] ? __cfi_mutex_lock_killable+0x10/0x10 [ 42.278557][ C0] kvm_vcpu_ioctl+0xa43/0x1000 [ 42.278628][ C0] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 42.278691][ C0] ? do_futex+0x32a/0x510 [ 42.278754][ C0] ? __cfi_do_futex+0x10/0x10 [ 42.278819][ C0] ? __fget_files+0x2bc/0x330 [ 42.278881][ C0] ? bpf_lsm_file_ioctl+0xd/0x20 [ 42.278944][ C0] ? security_file_ioctl+0x3e/0x110 [ 42.279018][ C0] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 42.279090][ C0] __se_sys_ioctl+0x123/0x1b0 [ 42.279145][ C0] __x64_sys_ioctl+0x7f/0xa0 [ 42.279204][ C0] x64_sys_call+0x1878/0x2ee0 [ 42.279258][ C0] do_syscall_64+0x57/0xf0 [ 42.279320][ C0] ? clear_bhb_loop+0x50/0xa0 [ 42.279408][ C0] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 42.279484][ C0] RIP: 0033:0x7f5cea59f559 [ 42.279537][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 42.279582][ C0] RSP: 002b:00007f5ceb52e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 42.279644][ C0] RAX: ffffffffffffffda RBX: 00007f5cea825fa0 RCX: 00007f5cea59f559 [ 42.279688][ C0] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 42.279728][ C0] RBP: 00007f5cea636b20 R08: 0000000000000000 R09: 0000000000000000 [ 42.279761][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 42.279801][ C0] R13: 00007f5cea826038 R14: 00007f5cea825fa0 R15: 00007ffd12d9fd28 [ 42.279852][ C0] [ 42.279874][ C0] [ 42.295115][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 42.299545][ C0] The buggy address belongs to the variable: [ 42.299556][ C0] .str.67+0x2c/0x40 [ 42.299578][ C0] [ 42.299584][ C0] The buggy address belongs to the physical page: [ 42.299611][ C0] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x673f [ 42.320132][ T45] usb 2-1: config 0 descriptor?? [ 42.323898][ C0] flags: 0x4000(reserved|zone=0) [ 42.323960][ C0] raw: 0000000000004000 ffffea000019cfc8 ffffea000019cfc8 0000000000000000 [ 42.539166][ T45] usb 2-1: USB disconnect, device number 3 [ 42.545332][ C0] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 42.545350][ C0] page dumped because: kasan: bad access detected [ 42.545393][ C0] page_owner info is not present (never set?) [ 42.580224][ T36] kauditd_printk_skb: 31 callbacks suppressed [ 42.580276][ T36] audit: type=1400 audit(1793386795.510:208): avc: denied { read } for pid=93 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 42.583698][ C0] [ 42.583707][ C0] Memory state around the buggy address: [ 42.583721][ C0] ffffffff8673f480: 00 00 f9 f9 f9 f9 f9 f9 00 00 00 03 f9 f9 f9 f9 [ 42.583738][ C0] ffffffff8673f500: 00 00 00 00 00 07 f9 f9 f9 f9 f9 f9 00 00 00 02 [ 42.583753][ C0] >ffffffff8673f580: f9 f9 f9 f9 00 00 00 04 f9 f9 f9 f9 00 00 00 03 [ 42.583766][ C0] ^ [ 42.583778][ C0] ffffffff8673f600: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00 [ 42.583794][ C0] ffffffff8673f680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 f9 [ 42.583806][ C0] ================================================================== [ 42.583816][ C0] Disabling lock debugging due to kernel taint [ 42.583835][ C0] ------------[ cut here ]------------ [ 42.583842][ C0] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30 [ 42.583862][ C0] index 54540 is out of range for type 'const int[34]' [ 42.583878][ C0] CPU: 0 UID: 0 PID: 614 Comm: syz.3.111 Tainted: G B syzkaller #0 04b5f10b80d13b0533bf6aaa302b886c75cf6d37 [ 42.583988][ C0] Tainted: [B]=BAD_PAGE [ 42.584016][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 42.584050][ C0] Call Trace: [ 42.584078][ C0] [ 42.584106][ C0] __dump_stack+0x21/0x30 [ 42.584222][ C0] dump_stack_lvl+0x140/0x1c0 [ 42.584338][ C0] ? __cfi_dump_stack_lvl+0x10/0x10 [ 42.584439][ C0] ? input_event_dispose+0x2f5/0x6d0 [ 42.584530][ C0] dump_stack+0x19/0x20 [ 42.584619][ C0] ubsan_epilogue+0xe/0x40 [ 42.584674][ C0] __ubsan_handle_out_of_bounds+0xe8/0xf0 [ 42.584750][ C0] aiptek_irq+0x1f3c/0x2a00 [ 42.584825][ C0] ? kcov_remote_start+0x1d2/0x3c0 [ 42.584908][ C0] __usb_hcd_giveback_urb+0x36e/0x530 [ 42.585072][ C0] usb_hcd_giveback_urb+0x12b/0x400 [ 42.585155][ C0] dummy_timer+0xa3f/0x4900 [ 42.585257][ C0] ? psi_account_irqtime+0x307/0x9a0 [ 42.585330][ C0] ? __cfi_dummy_timer+0x10/0x10 [ 42.585437][ C0] ? timerqueue_del+0xd7/0x130 [ 42.585505][ C0] ? __hrtimer_run_queues+0x2bd/0x8e0 [ 42.585578][ C0] ? __cfi_dummy_timer+0x10/0x10 [ 42.585662][ C0] __hrtimer_run_queues+0x3ab/0x8e0 [ 42.585734][ C0] ? hrtimer_interrupt+0xf30/0xf30 [ 42.585797][ C0] ? read_tsc+0xd/0x20 [ 42.585880][ C0] ? ktime_get_update_offsets_now+0x3c0/0x3e0 [ 42.585975][ C0] hrtimer_run_softirq+0x159/0x560 [ 42.586040][ C0] ? irqtime_account_irq+0x51/0x1c0 [ 42.586133][ C0] handle_softirqs+0x1ad/0x5b0 [ 42.586205][ C0] __irq_exit_rcu+0x47/0xb0 [ 42.586267][ C0] irq_exit_rcu+0xd/0x30 [ 42.586330][ C0] sysvec_apic_timer_interrupt+0x82/0x90 [ 42.586415][ C0] [ 42.586428][ C0] [ 42.586442][ C0] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 42.586535][ C0] RIP: 0010:__sanitizer_cov_trace_const_cmp8+0x5/0x90 [ 42.586621][ C0] Code: 10 48 89 74 11 18 48 89 44 11 20 5d e9 44 19 22 04 cc 0f 1f 00 b8 ee 0e 2e 34 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 <48> 89 e5 48 8b 45 08 65 48 8b 0d fc 93 7b 7e 65 8b 15 fd 93 7b 7e [ 42.586673][ C0] RSP: 0018:ffffc9000e01eaf8 EFLAGS: 00000246 [ 42.586725][ C0] RAX: ffffffff8129b4ec RBX: 0000000000000003 RCX: 0000000000000002 [ 42.586782][ C0] RDX: ffff88811aa0cf00 RSI: 0000000000000000 RDI: 0000000000000000 [ 42.586830][ C0] RBP: ffffc9000e01eba0 R08: ffff88811972c4c7 R09: 1ffff110232e5898 [ 42.586886][ C0] R10: dffffc0000000000 R11: ffffed10232e5899 R12: 0000000000000004 [ 42.586937][ C0] R13: 0000000000000000 R14: 0000000000004027 R15: 0000000000000000 [ 42.586978][ C0] ? paging64_update_accessed_dirty_bits+0x1bc/0x670 [ 42.587061][ C0] ? paging64_update_accessed_dirty_bits+0x1cd/0x670 [ 42.587144][ C0] paging64_walk_addr_generic+0xec7/0x1800 [ 42.587227][ C0] paging64_gva_to_gpa+0x117/0x220 [ 42.587293][ C0] ? __cfi_paging64_gva_to_gpa+0x10/0x10 [ 42.587377][ C0] ? get_descriptor_ptr+0x304/0x480 [ 42.587445][ C0] ? write_segment_descriptor+0x120/0x120 [ 42.587517][ C0] ? __do_insn_fetch_bytes+0x595/0x740 [ 42.587589][ C0] emulator_read_std+0x12f/0x200 [ 42.587652][ C0] __load_segment_descriptor+0x572/0x10b0 [ 42.587735][ C0] ? linearize+0x980/0x980 [ 42.587818][ C0] ? __kasan_check_read+0x15/0x20 [ 42.587901][ C0] ? vmx_read_guest_seg_ar+0x179/0x350 [ 42.587985][ C0] ? __asan_memcpy+0x5a/0x80 [ 42.588060][ C0] em_jmp_far+0x183/0x300 [ 42.588149][ C0] ? vmx_read_guest_seg_ar+0x1c8/0x350 [ 42.588251][ C0] ? __cfi_em_jmp_far+0x10/0x10 [ 42.588339][ C0] ? setup_clusters+0xcb0/0x18c0 [ 42.588413][ C0] ? init_decode_cache+0x7c/0x90 [ 42.588471][ C0] ? __cfi_em_jmp_far+0x10/0x10 [ 42.588545][ C0] x86_emulate_insn+0x908/0x4140 [ 42.588609][ C0] ? kvm_inject_realmode_interrupt+0x2d0/0x2d0 [ 42.588701][ C0] x86_emulate_instruction+0xbf7/0x19f0 [ 42.588786][ C0] kvm_mmu_page_fault+0x341/0x9a0 [ 42.588869][ C0] handle_ept_violation+0x256/0x450 [ 42.588952][ C0] ? vmx_vcpu_run+0x1116/0x1f70 [ 42.589007][ C0] ? __cfi_handle_ept_violation+0x10/0x10 [ 42.589080][ C0] vmx_handle_exit+0x13b5/0x1bf0 [ 42.589133][ C0] ? kvm_deliver_exception_payload+0xd0/0x1e0 [ 42.589225][ C0] ? __cfi_vmx_vcpu_run+0x10/0x10 [ 42.589287][ C0] vcpu_run+0x4bf8/0x7810 [ 42.589403][ C0] ? signal_pending+0xc0/0xc0 [ 42.589480][ C0] ? __kasan_check_write+0x18/0x20 [ 42.589576][ C0] ? xfd_validate_state+0x68/0x140 [ 42.589689][ C0] ? fpu_swap_kvm_fpstate+0x92/0x5e0 [ 42.589763][ C0] ? __kasan_check_write+0x18/0x20 [ 42.589837][ C0] ? fpregs_mark_activate+0x68/0x160 [ 42.589911][ C0] ? fpu_swap_kvm_fpstate+0x44c/0x5e0 [ 42.589995][ C0] ? fpu_swap_kvm_fpstate+0x92/0x5e0 [ 42.590064][ C0] kvm_arch_vcpu_ioctl_run+0x114c/0x1bc0 [ 42.590157][ C0] ? __cfi_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 42.590242][ C0] ? __futex_wait+0x330/0x3d0 [ 42.590314][ C0] ? __cfi___futex_wait+0x10/0x10 [ 42.590386][ C0] ? ioctl_has_perm+0x1bc/0x500 [ 42.590464][ C0] ? __asan_memcpy+0x5a/0x80 [ 42.590540][ C0] ? ioctl_has_perm+0x408/0x500 [ 42.590623][ C0] ? __kasan_check_read+0x15/0x20 [ 42.590706][ C0] ? has_cap_mac_admin+0xd0/0xd0 [ 42.590789][ C0] ? __kasan_check_write+0x18/0x20 [ 42.590863][ C0] ? mutex_lock_killable+0x97/0x1d0 [ 42.590969][ C0] ? __cfi_mutex_lock_killable+0x10/0x10 [ 42.591061][ C0] kvm_vcpu_ioctl+0xa43/0x1000 [ 42.591124][ C0] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 42.591194][ C0] ? do_futex+0x32a/0x510 [ 42.591249][ C0] ? __cfi_do_futex+0x10/0x10 [ 42.591321][ C0] ? __fget_files+0x2bc/0x330 [ 42.591382][ C0] ? bpf_lsm_file_ioctl+0xd/0x20 [ 42.591438][ C0] ? security_file_ioctl+0x3e/0x110 [ 42.591516][ C0] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 42.591598][ C0] __se_sys_ioctl+0x123/0x1b0 [ 42.591690][ C0] __x64_sys_ioctl+0x7f/0xa0 [ 42.591750][ C0] x64_sys_call+0x1878/0x2ee0 [ 42.591807][ C0] do_syscall_64+0x57/0xf0 [ 42.591886][ C0] ? clear_bhb_loop+0x50/0xa0 [ 42.591922][ C0] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 42.591954][ C0] RIP: 0033:0x7f5cea59f559 [ 42.592012][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 42.592076][ C0] RSP: 002b:00007f5ceb52e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 42.592140][ C0] RAX: ffffffffffffffda RBX: 00007f5cea825fa0 RCX: 00007f5cea59f559 [ 42.592234][ C0] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 42.592279][ C0] RBP: 00007f5cea636b20 R08: 0000000000000000 R09: 0000000000000000 [ 42.592336][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 42.592377][ C0] R13: 00007f5cea826038 R14: 00007f5cea825fa0 R15: 00007ffd12d9fd28 [ 42.592419][ C0] [ 42.592440][ C0] ---[ end trace ]--- [ 42.628683][ T31] usb 1-1: USB disconnect, device number 8 [ 42.632965][ C0] aiptek 1-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 42.658278][ T36] audit: type=1400 audit(1793386795.510:209): avc: denied { search } for pid=93 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 43.942362][ T36] audit: type=1400 audit(1793386795.510:210): avc: denied { write } for pid=93 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 43.965603][ T36] audit: type=1400 audit(1793386795.510:211): avc: denied { add_name } for pid=93 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 43.995543][ T36] audit: type=1400 audit(1793386795.510:212): avc: denied { create } for pid=93 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 44.017164][ T36] audit: type=1400 audit(1793386795.510:213): avc: denied { append open } for pid=93 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 44.040344][ T36] audit: type=1400 audit(1793386795.510:214): avc: denied { getattr } for pid=93 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1