last executing test programs: 5.621538299s ago: executing program 3 (id=267): r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000180)=ANY=[@ANYBLOB="1c0000005a00010d00000e800000000004000080080004"], 0x1c}], 0x1}, 0x0) 5.555023401s ago: executing program 3 (id=269): r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket$netlink(0x10, 0x3, 0x8000000004) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x5) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000100)="58000000140019234083feff040d8c560a060f0200ff0000000000000020ffff00000000000064009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd000000100001000a0c100000000200ffffffff", 0x58}], 0x1) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r4) mount$9p_tcp(0x0, 0x0, 0x0, 0x82, 0x0) r5 = socket$netlink(0x10, 0x3, 0x4) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0x22, &(0x7f0000001680)=0x1, 0x4) shutdown(r6, 0x1) bind$inet6(r6, &(0x7f0000000240)={0xa, 0x4e20, 0x9, @loopback, 0x5}, 0x1c) sendmmsg$inet6(r6, &(0x7f0000000140)=[{{&(0x7f0000000100)={0xa, 0x4e20, 0x2, @empty, 0xfffffffe}, 0x1c, &(0x7f0000000b40)=[{&(0x7f0000000340)="fb2972cc620acff160693cc3b2ccd6e864fd7c0e2524ef653a27e741b11c82663921fce44e4289439699ce9d079e193955cc460fc069ce8021b6764b", 0x3c}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x2008c058) connect$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x1, @empty, 0x6}, 0x1c) socket$nl_xfrm(0x10, 0x3, 0x6) splice(r3, 0x0, r4, &(0x7f00000002c0)=0x87ffffd, 0x10, 0x0) r7 = dup2(r0, r0) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$TIPC_NL_PEER_REMOVE(r5, &(0x7f0000000600)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="18010000", @ANYRES16=r8, @ANYBLOB="020028bd7000ffd9df2514000000040005800c0009800800010007000000040007807c0004800900010073797a30000000003c000780080001000a0000000800030006000000080001000600000008000300060000000800020020000000080001000c00000008000300fbffffff0900010073797a310000000024000780080003000d000000080004005b030000080002000000f87f0800020006000000740005800700010069620000070001006962000054000280080003000200000008000200f8080000080002000900000008000400050000000800040000000000080003000200000008000200008000000800020001000010080004000d00000008000400040000000c0002800800030007000000a1d408b9ebbc9b3b53d5563103add3b50ead665d7fe419a6e94a47c0087dea5ef2c2d3287c74a11a47ac0eb2aebaad345de3bf410a50210d881c2df740f6a53a83ea2c24824403c3fa53cc1156be8a6d07ae836bfad2005c7e12b5005d78f5c2b05bd073de2c5de88ab48adf3552f55284afb081c2452e1e6bc85ac53f2708b11d7b97b3bd70e31733f88b13c0d4d7c36e8a652a927adfeb865baf7c99da6f143d4317bfae01c2f4c11f76d2b353a74c3ee88807e27d51c1c21e1659017379bc7039f1fc9dc4c65e800bc7a1f8c5382cc029f18111bc8d15051668a76980c34f84cb31fae574b144e5f1212062598316da89b88d"], 0x118}}, 0x2004) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r9 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/uprobe_events\x00', 0x401, 0x0) write(r9, &(0x7f0000000180)='p:s/p ./file0:0\f-', 0x11) mmap(&(0x7f0000196000/0x1000)=nil, 0x1000, 0x1, 0x840000000000a132, 0xffffffffffffffff, 0x1000) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r7) syz_usb_connect(0x3, 0x48, &(0x7f0000000400)=ANY=[@ANYBLOB="12010102c2448b088405080002010102030109023600020802000309042b110339eea0040905e516400020041009050f101000090404090504020800030007090423070009376c0a"], &(0x7f0000000140)={0xfffffffffffffee5, 0x0, 0x0, 0x0, 0x37, [{0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00031e21f0e8ff23e2beda84d44400fa80b5c2a8442bd5d30d9729b7520e41f4d0b13611fd2683d3053f463dd032b57102561f3318c22ef84a6a91433da666f22cf03fd952c2122ca816bef0c9251aea05b3500be47133c863ecf904d3666134ad87acb806d43ab2cb7b0876545a7ba796557f570e693a16874a3f36287ba0c9d12ce6d6a9b0839fd042d0be84339d86ea5d04f637ed92b309e13b55"]}, {0x0, &(0x7f0000000080)=@string={0x0, 0x3, "dbe2001a08e00bedf87f7cfe3b7ffd39672e4d84a2270bdc69cbad79f31762fd91eea6571eaadb9b30e30ce9a5895700bc8cbe06b0d35de4b97972dda8a50491d803abba859dc4a42f1c336ffbbb9a6d00eec8fd31bff4"}}, {0x0, &(0x7f0000000100)=@lang_id={0x0, 0x3, 0x447}}]}) ioctl$NILFS_IOCTL_RESIZE(r7, 0x40086e8b, &(0x7f0000000280)=0x1) 4.311561704s ago: executing program 0 (id=283): open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x109040, 0x0) socket(0x1e, 0x80005, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/stat\x00', 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) socket$xdp(0x2c, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) openat(0xffffffffffffffff, 0x0, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket(0x10, 0x3, 0x0) socket$nl_audit(0x10, 0x3, 0x9) syz_usb_connect$uac1(0x5, 0xdc, &(0x7f0000000400)=ANY=[], 0x0) 4.259904836s ago: executing program 3 (id=284): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/lru_gen\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x9) write$uinput_user_dev(r1, 0x0, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in=@private=0xa010101, @in=@remote, 0x0, 0x400, 0x1000, 0x0, 0x2, 0x20, 0x10, 0x84}, {0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0x1, 0x4000000000000}}}, 0xb8}}, 0x0) preadv(r0, &(0x7f0000000580)=[{&(0x7f00000000c0)=""/172, 0xac}, {&(0x7f00000001c0)=""/78, 0x4e}, {&(0x7f0000000240)=""/108, 0x6c}, {&(0x7f00000002c0)=""/100, 0x64}, {&(0x7f0000000340)=""/194, 0xc2}, {&(0x7f00000004c0)=""/5, 0x5}], 0x6, 0x7, 0x100) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.cpu/cpuset.cpus\x00', 0x2, 0x85) syz_usb_connect(0x3, 0x4f, &(0x7f0000000040)=ANY=[@ANYBLOB="1201010213df6220f30c7a8119eb010203010902"], &(0x7f0000000100)={0x0, 0x0, 0x80, &(0x7f0000000000)=ANY=[@ANYBLOB="050f020010030000000610400a14070000000000"]}) ioctl$KVM_GET_LAPIC(0xffffffffffffffff, 0x8400ae8e, &(0x7f0000000600)) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000380)={0x2, 0x4e22, @multicast1}, 0x10) r4 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000000180)=0x20800001, 0x4) setsockopt$inet6_int(r4, 0x29, 0x4e, &(0x7f0000000000)=0x1, 0x4) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x8000}, 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) setsockopt$sock_int(r3, 0x1, 0x800000000f, &(0x7f0000000080)=0x7, 0x4) listen(r3, 0x0) write$tcp_mem(r2, &(0x7f0000000300), 0x48) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x2500, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB="650100001b"], 0x188}, 0x1, 0x300}, 0x0) syz_usb_connect(0x5, 0x57, &(0x7f0000000240)=ANY=[], 0x0) 3.091368657s ago: executing program 2 (id=292): socket$vsock_stream(0x28, 0x1, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, 0x0, 0x4008000) socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x8042) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_usb_connect$uac2(0x3, 0x8b, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000300000020532b2300400001020301090279000301fb4004080b02010103200109040000000101200009240108000c1900e508240a00040b060308240a0901030602090401000001022000090401010101022000090501090002080706082501800f070000090402000001022000090402010101022000090582", @ANYRESOCT=r0], &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0}) mremap(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r1 = syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f0000000080)) ioctl$PAGEMAP_SCAN(r1, 0xc0606610, &(0x7f0000000680)={0x60, 0x0, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x8, &(0x7f0000000940)=[{}, {0xfffffffffffffff9, 0x9, 0x5}], 0x2, 0x1, 0x0, 0x0, 0x0, 0x42}) r2 = open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0) fcntl$setlease(r2, 0x400, 0x0) syz_usb_connect$uac2(0x3, 0x7b, &(0x7f0000000100)=ANY=[@ANYBLOB="12011001000000084e150e5040000102030109026900030180e009080b0101010a2000090400000001012000092401020007090008000000000001022000090401010101022000090501090002050409082501810009020009040200000102200009040201010102200009058209ff0305041008250183000a020048c8846887292af0f8db9a72bbc7ceefef2249807dd5a30df9566bf98cbd735470189bf946710dd7fe01dac25f80b9a48f5ad7df7d5d4a0210930227c75c52638c614668ba9a"], 0x0) 1.895595149s ago: executing program 2 (id=295): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) fsetxattr$trusted_overlay_opaque(r1, 0x0, 0x0, 0x0, 0x3) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x4) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x300, 0x2000, &(0x7f0000000000/0x2000)=nil}) 1.891480509s ago: executing program 2 (id=298): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x2081, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000440)={0x1, 0x0, [{0x3, 0x1, 0x0, 0x0, @msi={0x0, 0x71, 0x3, 0x60ea}}]}) r2 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r3, 0x40345410, &(0x7f00000083c0)={{0x0, 0x3, 0xd, 0x3}}) close(0x3) syz_usb_disconnect(r2) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000014c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@empty, 0x0, 0x3, 0x0, 0x0, 0xa, 0x0, 0x20, 0x8}, {0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, {0x0, 0x0, 0x0, 0x2dd}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0xb8}}, 0x0) syz_usb_connect$rtl8150(0x4, 0x62, &(0x7f0000000340)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x5b05b05b05b0235, [{{0x9, 0x2, 0x2d}}]}}, 0x0) ioctl$EVIOCRMFF(r2, 0x4004550d, 0x0) 1.291499216s ago: executing program 0 (id=309): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000200)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0x56a, 0x13, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x40, "", [{{0x9, 0x4, 0x0, 0x0, 0xfe, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x1, 0xfa, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x3, 0x81, 0x2}}}}}]}}]}}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4000000015000b0000000000000000000a0000000400000014000100ff010000000000000000000000000001140002"], 0x40}}, 0x0) setsockopt$inet_mreq(r1, 0x0, 0x24, &(0x7f0000000000)={@loopback, @empty}, 0x8) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_connect$uac2(0x6, 0x9b, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010002000000ff3e1315084000010203010902890003014ee0e4080b0200010720080904000000010120000924010c002e09000109040100000102200009040101010102200009050109400006080208250102030406000904020000010220000904020101010220000d24020107030d00ed1e10034a0900000181800508030a24020207000200090a090582090800080706082501800c0e0700"], &(0x7f0000000400)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x201, 0x4, 0x27, 0x7, 0x58}, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="050f2400030a1003000e00090640000a10030002000a06fefc0b10010c08000471ff7f08"], 0x3, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x5c71}}, {0x63, &(0x7f0000000280)=@string={0x63, 0x3, "0d2946f91c3be488fcf987ff69a4c065f3c5e322971e00f11e5faf625d078ad190d1050432f0d57c1b86525775985a3855bdb3f7532e2b99c10af27d99403f4fc6e0d3a1050b54add2cf3237adfd992b6111369ae0f8f8b4c2f2c2e4632ef38598"}}, {0xb6, &(0x7f0000000440)=ANY=[@ANYBLOB="b60334cdfe1dadfe14cf8fcf200e60c4d840484cdfb0ddd49559d622e765cdc23cf9e54427d069e62b78121bf81ecff26f79c96f6732790df22ea06eea605fecc2e110e2ac9fe9695e9fa15b26bf12d75ac227fbb8879db52d7c2d51a60adc963438a654aedf03dcb2dd3e90118d30a36de7ffed6ec822a721964ea7bd1f955604d0fac9150c45e9b6a6b9930a5ed6f6cfe4db42689fb13ce009abc249f2caa63792a825a0123e17494cc39b824db41f2c787d5283b0033cd0788ce17a69111350bedf914cebb73b655b8fe8610011f2f70bd8050c88a8c985bb241c8b743ba038da496663db0020918945de5b24c13021341a88b91dc98ea8224a9a315466c2f47cd130d4c241e9c49c39b1d9302bc36a552086f2a2e5657cef9b8d22b6d6678dbea1fa5eaa5fb1eb5e139daa354614c1c88c5765b46c05ba0154f1f295f69636efa4d6000bb9e69dc5e322aa3aef4f7a308299cf6e70aa9898fcc402"]}]}) setuid(0xee01) clock_adjtime(0x0, &(0x7f0000000000)={0x10001, 0x4, 0xb0000000000, 0x3, 0x0, 0x0, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x3b9ac9ff, 0x0, 0x81, 0xffffffffffffffff, 0x8000000000000001, 0x5a6c101, 0x3, 0x1, 0x0, 0x0, 0x0, 0x0, 0x800000000, 0x1ff, 0x4}) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)=ANY=[@ANYBLOB="002228090000280483efb96d664770b8783be09042a85420ac1ed63417fcc495e77a9b2507b71ea9e43d359c479c37f525cde38bf79140773667a400000025433990b4c773686d1d31b28454f838171051028d60167826bd2c83c995c8c683660b9a4f278351b2df7d1f87f3aee8521e70a25968e090dd197acf89ed14f10890c1f39050e1c09c31bed488dc740af5e5cc239fcd5bc709e4"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000200)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0x56a, 0x13, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x40, "", [{{0x9, 0x4, 0x0, 0x0, 0xfe, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x1, 0xfa, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x3, 0x81, 0x2}}}}}]}}]}}, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) (async) socket$netlink(0x10, 0x3, 0x0) (async) sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4000000015000b0000000000000000000a0000000400000014000100ff010000000000000000000000000001140002"], 0x40}}, 0x0) (async) setsockopt$inet_mreq(r1, 0x0, 0x24, &(0x7f0000000000)={@loopback, @empty}, 0x8) (async) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) syz_usb_connect$uac2(0x6, 0x9b, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010002000000ff3e1315084000010203010902890003014ee0e4080b0200010720080904000000010120000924010c002e09000109040100000102200009040101010102200009050109400006080208250102030406000904020000010220000904020101010220000d24020107030d00ed1e10034a0900000181800508030a24020207000200090a090582090800080706082501800c0e0700"], &(0x7f0000000400)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x201, 0x4, 0x27, 0x7, 0x58}, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="050f2400030a1003000e00090640000a10030002000a06fefc0b10010c08000471ff7f08"], 0x3, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x5c71}}, {0x63, &(0x7f0000000280)=@string={0x63, 0x3, "0d2946f91c3be488fcf987ff69a4c065f3c5e322971e00f11e5faf625d078ad190d1050432f0d57c1b86525775985a3855bdb3f7532e2b99c10af27d99403f4fc6e0d3a1050b54add2cf3237adfd992b6111369ae0f8f8b4c2f2c2e4632ef38598"}}, {0xb6, &(0x7f0000000440)=ANY=[@ANYBLOB="b60334cdfe1dadfe14cf8fcf200e60c4d840484cdfb0ddd49559d622e765cdc23cf9e54427d069e62b78121bf81ecff26f79c96f6732790df22ea06eea605fecc2e110e2ac9fe9695e9fa15b26bf12d75ac227fbb8879db52d7c2d51a60adc963438a654aedf03dcb2dd3e90118d30a36de7ffed6ec822a721964ea7bd1f955604d0fac9150c45e9b6a6b9930a5ed6f6cfe4db42689fb13ce009abc249f2caa63792a825a0123e17494cc39b824db41f2c787d5283b0033cd0788ce17a69111350bedf914cebb73b655b8fe8610011f2f70bd8050c88a8c985bb241c8b743ba038da496663db0020918945de5b24c13021341a88b91dc98ea8224a9a315466c2f47cd130d4c241e9c49c39b1d9302bc36a552086f2a2e5657cef9b8d22b6d6678dbea1fa5eaa5fb1eb5e139daa354614c1c88c5765b46c05ba0154f1f295f69636efa4d6000bb9e69dc5e322aa3aef4f7a308299cf6e70aa9898fcc402"]}]}) (async) setuid(0xee01) (async) clock_adjtime(0x0, &(0x7f0000000000)={0x10001, 0x4, 0xb0000000000, 0x3, 0x0, 0x0, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x3b9ac9ff, 0x0, 0x81, 0xffffffffffffffff, 0x8000000000000001, 0x5a6c101, 0x3, 0x1, 0x0, 0x0, 0x0, 0x0, 0x800000000, 0x1ff, 0x4}) (async) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)=ANY=[@ANYBLOB="002228090000280483efb96d664770b8783be09042a85420ac1ed63417fcc495e77a9b2507b71ea9e43d359c479c37f525cde38bf79140773667a400000025433990b4c773686d1d31b28454f838171051028d60167826bd2c83c995c8c683660b9a4f278351b2df7d1f87f3aee8521e70a25968e090dd197acf89ed14f10890c1f39050e1c09c31bed488dc740af5e5cc239fcd5bc709e4"], 0x0, 0x0, 0x0, 0x0}, 0x0) (async) 1.240017507s ago: executing program 3 (id=310): r0 = syz_open_dev$evdev(&(0x7f0000000380), 0x2, 0x0) ioctl$EVIOCGKEYCODE(r0, 0x80084504, &(0x7f00000003c0)=""/194) r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ioctl$FS_IOC_RESVSP(r2, 0x40305828, &(0x7f0000000040)={0x0, 0x2, 0x0, 0x2}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x4f, 0x0, 0x0) syz_open_procfs(0x0, 0x0) syz_open_procfs(0x0, 0x0) 1.232044538s ago: executing program 3 (id=311): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="f8000000160001000000000000000000fe8000000000000004000000000000aaff0100000000000000000000000000010000000000000000000000000000000012a81a135b2b06189bd17529ce6f49063dfea2af2486e9b1c34f20e57cf162d4", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe880000000000000000000000000001000000006c000000ffffffff00000000000000000000000002000000000000000900000000000000000000000000000000000000000000000800000000000000000000000000000003000000000000000800000000000000000000000000000000000000000000000000000000040000090000000000000000000000010000000000000000000000000000000a00"/176], 0xf8}, 0x1, 0x0, 0x0, 0xc1}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_BEACON(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010028bd7000fcdbdf000e000494050099000100000028000000"], 0x20}, 0x1, 0x0, 0x0, 0x24048090}, 0x1296a976fdc1452f) r3 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) ioctl$ASHMEM_GET_PIN_STATUS(r3, 0x7709, 0x0) socket$tipc(0x1e, 0x2, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4}, 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r5) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r5) r7 = socket$packet(0x11, 0x2, 0x300) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000ec0)=ANY=[@ANYBLOB="5c030000160000022cbd7000fedbdf256401010200000000000000000000000000000000000000000000ffffe00000014e2000064e2467b60a00c03005000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac1414aa000000000000000000000000000004d42b000000640101009865ea9f43afd386c1fb5c77ab8b5c260000000000000000000000000300000000000000f9ffffffffffffff0000ffffffffffff07000000000000001000000000000000050000000000000009000000000000000800000000000000f0ffffff00000000fffbfffffffffffffeffffffffffffffffffffff0000000005000000800000000100000028bd7000033500000200010508000000000000000f000100f8ffffff50001100ac1e0001000000000000000000000000fc010000000000000000000000000001ac1e0001000000000000000000000000fe88000000000000000000000000010133030000053500000200020084010500ff010000000000000000000000000001000004d23300000000000000ac1414aa0000000000000000000000000335000002030a000900000003000000ffffffff00000000000000000000ffff00000000000004d53c0000000a000000000000000000000000000000000000000000000001010500070000000400000056000000ffffffff000000000000000000000000000004d3ff0000000a000000fc0200003ffca4dfee7b000000000000000000000000033500000702090011020000040000000200000000000000000000000000000000000000000004d36c00000002000000ac1414bb0000000000000000000000000235000004018500b9000000010000000f000000e0000002000000000000000000000000000004d23c0000000200000000000000000000000000ffffac1414aa0435000001000300070000000000000004000000ff010000000000000000000000000001000004d36c0000000a000000ac1e01010000000000000000000000000335000000010a0000040000800000000600000008001d0000000000490003006c7a6a6800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000b20000000c0015005c073500090000000800160010000000080018000700000014000d00fc0100000000000000000000000000000a00100000000000000000008279c177e5bbe65a392dcfd369425dad79e2e9633686b9172e7a157cd1bb6b8d0542d6d2ada7688b173e40aca267277577"], 0x35c}, 0x1, 0x0, 0x0, 0x4000804}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r7, 0x8933, &(0x7f0000000240)={'batadv_slave_1\x00', 0x0}) setsockopt$packet_add_memb(r7, 0x107, 0x1, &(0x7f0000000040)={r9, 0x1, 0x6, @multicast}, 0x10) setsockopt$packet_drop_memb(r7, 0x107, 0x2, &(0x7f0000000080)={r9, 0x1, 0x6, @multicast}, 0x10) sendmsg$NL802154_CMD_GET_WPAN_PHY(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x14, r6, 0x1, 0x70bd25, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4004080}, 0xc0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'wpan4\x00'}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000130000/0xd000)=nil, 0xd000, 0x66) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x19) syz_clone3(&(0x7f0000000740)={0x84000000, 0x0, 0x0, 0x0, {0x25}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f00000002c0)={'wpan1\x00'}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'wpan1\x00'}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000580)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) 1.11450153s ago: executing program 3 (id=312): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000409412201300000000000109022400010000000b090400010c0300000009210c00bdd22228000905810320040381fe"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000b00)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB="400e2e"], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305839, &(0x7f0000000280)={0x0, 0x2, 0xefff, 0xfe64}) (async) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305839, &(0x7f0000000280)={0x0, 0x2, 0xefff, 0xfe64}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040), 0x20002, 0x0) (async) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040), 0x20002, 0x0) close(r1) (async) close(r1) write$vga_arbiter(r1, &(0x7f0000000080), 0xf) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_FLAG_CMD(r2, 0x8983, &(0x7f0000000000)={0x7, 'vlan0\x00', {0x7}, 0x5}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) syz_usb_connect$uac2(0x0, 0xda, &(0x7f00000000c0)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x10, 0x1235, 0x8002, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xc8, 0x3, 0x1, 0x7, 0x10, 0x7, {0x8, 0xb, 0x2, 0x2, 0x1, 0x6, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x10, 0x6, 0x9, 0x3}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_continuous={0x9, 0x24, 0x2, 0x1, 0x4, 0x4, 0x89, 0x8, "19"}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x4, 0x1}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x86, 0x4, 0x1, 0xc7}, @format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x47, 0x2, 0x6, 0x23, "d8a4a8"}, @as_header={0x10, 0x24, 0x1, 0xc5, 0x0, 0x3, 0x1001, 0x51, 0x0, 0xf7}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x23, 0x9, 0x74, {0x8, 0x25, 0x1, 0x2, 0x30, 0x2, 0x9}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_discrete={0xc, 0x24, 0x2, 0x1, 0xb, 0x3, 0x85, 0x5, "edc7adef"}, @format_type_i_discrete={0x11, 0x24, 0x2, 0x1, 0x9, 0x4, 0xe, 0x4, "baed1224fb97b9d715"}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x3, 0xb0}, @format_type_ii_discrete={0xa, 0x24, 0x2, 0x2, 0x5, 0x74, 0x7, "80"}]}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x9, 0x8, 0x6, {0x8, 0x25, 0x1, 0x180, 0x0, 0x3}}}}}}}}]}}, &(0x7f0000000240)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x250, 0x2, 0x8, 0x7, 0x10, 0x8}, 0x34, &(0x7f0000000200)={0x5, 0xf, 0x34, 0x3, [@ext_cap={0x7, 0x10, 0x2, 0x8, 0x8, 0xa, 0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x0, "33d2ea4d09da45ce10e31419a01f52b5"}, @ss_container_id={0x14, 0x10, 0x4, 0xff, "08e5e7fdef9ac9093844c0a083cbdfe1"}]}}) 1.1143202s ago: executing program 2 (id=313): r0 = syz_open_dev$usbfs(&(0x7f0000000700), 0x2000000000000, 0x141002) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x501, 0x0) ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0xbd) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0xc0185500, &(0x7f0000000040)={0x82, 0x0, "aa2fe1a243fcd9abf29cc3391c06b86f68e7f73d4f0bff9669a8e82040ccb44d75131fb06cade553a6bdc314438ce0af11c38cd724980b087a7a16f9295be0a69db51576e7a06ef6bcabc67b52ba82e73504fa842ec2f0c06bf006f3e5bcdd5057997bf171c60d96a538b02ee9f4b573457498ca09cb417b1fbe6dc3b0c27ab0693ac57aff136748f7740dfc33f3a902b670f8933aec28869e637c18379d6d0b4d844b732cb1932733dfcec2f69f8b6df76ba84e1f001ad29105230471f466b6f9d7d2b05a57fe16e7363e5ecebc2c74539ca55c7ce3a175061adedd20532a9de97379f4dd5baeeae835946311e6e4e2361355c54b3bd500"}) ioctl$HIDIOCGUCODE(r0, 0xc018480d, &(0x7f0000000000)={0x3, 0x100, 0x8, 0x6, 0x3, 0xadc}) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x8000, 0x700, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x3, 0x14, 0x67, 0x0, 0x0, 0x29, 0x0, @empty, @empty}}}}) r3 = syz_io_uring_setup(0x1b66, &(0x7f0000000180)={0x0, 0xc218, 0x8, 0x2, 0x30c}, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)) mmap$IORING_OFF_SQES(0x0, 0x4, 0x8, 0xec1c2cf2d880ee31, r3, 0x10000000) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x83, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r4, 0x4018aee2, &(0x7f0000000080)) ioctl$sock_ipv6_tunnel_SIOCADDPRL(0xffffffffffffffff, 0x89f5, &(0x7f0000000340)={'sit0\x00', &(0x7f0000000300)={@dev={0xac, 0x14, 0x14, 0xe}, 0x1, 0x0, 0x30, 0x0, [{@loopback}, {@loopback}, {@dev}]}}) 1.11111868s ago: executing program 2 (id=314): io_setup(0x3ff, &(0x7f0000000500)=0x0) r1 = inotify_init() io_submit(r0, 0x1, &(0x7f0000000940)=[&(0x7f0000000280)={0x0, 0x0, 0x8, 0x1, 0x106, r1, 0x0, 0x0, 0x1, 0x0, 0x500}]) 1.056000312s ago: executing program 2 (id=315): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = add_key$fscrypt_v1(&(0x7f0000002280), &(0x7f00000022c0)={'fscrypt:', @desc2}, &(0x7f0000002300)={0x0, "2a4cea898139e0e0c019a74d3ea26dd02e4c241b97774cc682857eed746418339edb88181d7a65049884e401847aef386af7be95cb8e40e633ea34c59d08c962", 0x27}, 0x48, 0xffffffffffffffff) keyctl$KEYCTL_MOVE(0x1e, r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) keyctl$instantiate(0xc, r1, &(0x7f0000000600)=@encrypted_load={'load ', 'ecryptfs', 0x20, 'user:', '#\xe1}{\x1f\x1c\xb7\xb08\x98n\xa4|fF%},^/}', 0x20, 0x3dd2a914, 0x20, [0x61, 0x31, 0x66, 0x63, 0x65, 0x66]}, 0x45, r1) r2 = add_key$fscrypt_v1(&(0x7f0000000000), &(0x7f0000000100)={'fscrypt:', @desc4}, &(0x7f00000001c0)={0x0, "1d2289fa5e8988691237b7c0fc0984dc41c80eb75d768573e7d2a7c9098a42f2f735f1335602be0c57d5dbd47e5ed3f51a1f7f3e32d0d872588dff59969dd2d0", 0x2f}, 0x48, r1) keyctl$instantiate(0xc, r2, 0x0, 0x0, r1) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x100, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000040)={0x1, 0x0, 0x2000, 0x2000, &(0x7f0000fa3000/0x2000)=nil}) ioctl$KVM_CREATE_DEVICE(r4, 0xc018aec0, &(0x7f00000000c0)={0x6, 0xffffffffffffffff, 0x1}) r5 = socket$netlink(0x10, 0x3, 0x0) writev(r5, &(0x7f0000000280)=[{&(0x7f0000000080)="580000001400add4050000000000000002117fffffff81004e230e227f000001925aa80020007b00090080007f000001e809000000ffff0100f5c71002000000ffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1) connect$inet6(r0, &(0x7f0000000240)={0xa, 0xe23, 0xfffffffc, @private0, 0x4}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) socket$netlink(0x10, 0x3, 0x8000000004) syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000751c0110e60f00979ad1010203010902240001000000000904"], 0x0) syz_usb_connect$hid(0x6, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x10, 0x3fc, 0x5d8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x6c, 0x80, 0x2, "", [{{0x9, 0x4, 0x0, 0x3, 0x2, 0x3, 0x1, 0x1, 0x7, {0x9, 0x21, 0x0, 0x9b, 0x1, {0x22, 0x316}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x4, 0x0, 0xa}}}}}]}}]}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_group_source_req(r0, 0x29, 0x2b, &(0x7f0000000340)={0x81, {{0xa, 0x4e24, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}, 0x4}}, {{0xa, 0x4e20, 0x1, @remote, 0x5}}}, 0x108) ioctl$int_in(r7, 0x5452, &(0x7f0000000040)=0x8001) r8 = getpgid(0x0) fcntl$setownex(r7, 0xf, &(0x7f0000000140)={0x2, r8}) fcntl$setsig(r7, 0xa, 0x1c) sendmmsg$unix(r6, &(0x7f0000006c40)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000300)="11", 0x1}], 0x1}}], 0x1, 0x40015) keyctl$setperm(0x5, r1, 0x88) r9 = openat$binfmt_register(0xffffff9c, &(0x7f0000000000), 0x1, 0x0) ptrace$ARCH_SET_CPUID(0x1e, r8, 0x1, 0x1012) write$binfmt_register(r9, &(0x7f0000000040)={0x3a, 'syz2', 0x3a, 'M', 0x3a, 0x5, 0x3a, '{&:@[', 0x3a, '', 0x3a, './file0'}, 0x2c) writev(r4, &(0x7f0000000180), 0x0) 710.667031ms ago: executing program 1 (id=322): r0 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x400, @loopback, 0x7}, 0x1c) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) sendto$packet(r1, &(0x7f00000002c0), 0x0, 0x4, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) listen(r0, 0xb) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x22, &(0x7f0000001680)=0x1, 0x4) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, 0x0) sendmsg$can_raw(r4, 0x0, 0x40) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r5, 0x11b, 0x3, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(r5, 0x0, 0x0) sendmmsg$inet6(r3, &(0x7f0000004440)=[{{&(0x7f0000000100)={0xa, 0x4e20, 0x2, @empty, 0xfffffffe}, 0x1c, &(0x7f0000000b40)=[{&(0x7f0000000a40)="fb", 0x1}], 0x1, 0x0, 0x91ff}}, {{0x0, 0x0, 0x0}}], 0x2, 0x20080058) 644.518223ms ago: executing program 1 (id=323): r0 = openat$selinux_policy(0xffffff9c, &(0x7f0000000600), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x700000b, 0x12, r0, 0x0) r1 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f00000001c0)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000000)='./bus\x00') r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='io.stat\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r2, 0xc0189436, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x5f, 0x3}) (fail_nth: 1) 644.333603ms ago: executing program 1 (id=324): r0 = openat$selinux_policy(0xffffff9c, &(0x7f0000000600), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x700000b, 0x12, r0, 0x0) r1 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f00000001c0)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000000)='./bus\x00') r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='io.stat\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r2, 0xc0189436, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x5f, 0x3}) 620.871063ms ago: executing program 1 (id=325): openat$selinux_policy(0xffffff9c, &(0x7f0000000600), 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)=0x20) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) mmap(&(0x7f0000434000/0x3000)=nil, 0x3000, 0x200000b, 0xb8aebacda21ed599, r1, 0x0) r2 = socket$inet6(0xa, 0x80000, 0x103) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, &(0x7f00000001c0)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, r4, 0x2, 0x0, 0x2, 0x1, {0xa, 0x4e24, 0x4, @empty, 0x1f}}}, 0x3a) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x2081, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) creat(&(0x7f00000001c0)='./bus\x00', 0x77) r7 = open(&(0x7f0000000100)='./bus\x00', 0x0, 0x10) finit_module(r7, 0x0, 0x1) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000000)='./bus\x00') r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010025bd7000fedbdf2501000000000000000b00"], 0x28}, 0x1, 0x0, 0x0, 0x24040086}, 0x40) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='io.stat\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r10, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000580)="93", 0x1}], 0x1}, 0x4011) 578.052135ms ago: executing program 1 (id=326): r0 = open(&(0x7f0000000040)='./cgroup.cpu/cpuset.cpus\x00', 0x1a1342, 0x0) write$cgroup_pid(r0, &(0x7f0000000d40), 0x12) syz_usb_connect$uac2(0x0, 0x7b, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x499, 0x1059, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0xb, 0x0, 0x40, {0x8, 0xb, 0x0, 0x1, 0x1, 0x4, 0x20, 0x81}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5, 0xff, 0x9, 0xc}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x5, 0x5, 0x9, {0x8, 0x25, 0x1, 0x80, 0xc, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0xd, 0x3, 0x40, {0x8, 0x25, 0x1, 0x83, 0x5f, 0x4, 0xb6}}}}}}}}]}}, 0x0) 247.831554ms ago: executing program 0 (id=327): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000280)='./binderfs/binder0\x00', 0x2, 0x0) dup3(r1, r0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r2 = gettid() syz_open_procfs(r2, 0x0) syz_clone3(&(0x7f00000002c0)={0x100000000, 0x0, 0x0, 0x0, {0x2e}, 0x0, 0x0, 0x0, &(0x7f0000000580)=[0xffffffffffffffff], 0x1}, 0x58) syz_open_procfs(0x0, 0x0) 246.064504ms ago: executing program 0 (id=328): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000100)='cgroup.stat\x00', 0x275a, 0x0) preadv(r1, &(0x7f0000000500)=[{0x0}, {&(0x7f0000000680)=""/180, 0x120}], 0x2, 0x6, 0x7) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0xa82, 0x0) write$cgroup_int(r2, &(0x7f0000000040)=0x920, 0x12) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0x0) syncfs(r0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/mdstat\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_udp_encap(r4, 0x11, 0x64, &(0x7f00000002c0)=0x2, 0x4) preadv(r3, &(0x7f0000000700)=[{&(0x7f0000000100)=""/224, 0xe0}, {&(0x7f0000000200)=""/55, 0x37}, {&(0x7f0000000240)=""/20, 0x14}, {&(0x7f0000000280)=""/227, 0xe3}, {&(0x7f0000000380)=""/214, 0xd6}, {&(0x7f0000000480)=""/28, 0x1c}, {&(0x7f00000004c0)=""/91, 0x5b}, {&(0x7f0000000540)=""/198, 0xc6}, {&(0x7f0000000640)=""/137, 0x89}], 0x9, 0x40, 0x116d) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCETHTOOL(r5, 0x89f0, &(0x7f0000000880)={'bridge0\x00', &(0x7f00000008c0)=@ethtool_eeprom={0x43, 0x8, 0x1, 0xf2, "f87d13c96528a1ff0896cc5d73948625fe0de91a56b6f28d5e17b02d88054fdd9aae726232ad24f3bacee6f9601ba0a7470153b7ba88f95ba295e5bbf50b821607936146f6852bd9a0989bd743e47d823f191c459165539628b8e1b5bb8f7a2ecd49aff8ff43c06bd11ae609010ce7dc2b8530abb6fcf5007a4c3e6b75e4d799955c6c1499b0279a6646ef857b8845a43c535753ecc1f8341755bc3c05787ac793072de4ddd2956224ca5193367d3f7089473fff0d96aefcfa248ec5e50412d91cc0c9d73692b195ff67638b12f5ea3ed5da33038dc7e40a43a89c273cdf3a3ada2e0624d597523416c19cd4ef1a432c4e8e"}}) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000f00)=@nat={'nat\x00', 0x19, 0x0, 0xc0, [0x200000000e42, 0x0, 0x2, 0x5, 0x200000000e9b], 0x0, 0x0, &(0x7f00000001c0)=ANY=[]}, 0x78) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="440000001400010000000000000000000a0000000400000014000100ff01000000000000000000000000000115000680bf74a7dffd"], 0x44}}, 0x0) 172.755656ms ago: executing program 0 (id=329): socket$nl_xfrm(0x10, 0x3, 0x6) openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x20) openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x1000, 0x40002, 0x1e5}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_ublk_add_dev(0xffffffffffffffff, r1, r2, r3, &(0x7f00000002c0)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0xf6c4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@new_dev={0x3, 0xf14, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x164}}}, &(0x7f0000000280)=0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="37031c00", 0x4, 0x4000800, 0x0, 0x0) syz_ublk_setup_queues(r0, r5, &(0x7f0000000200)={0x0, 0x906, 0x7000000, 0x2, 0xb5}, &(0x7f0000000480)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4485, 0x10, 0x0, 0x319, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7682, 0x8000, 0x4, 0x2000008, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffffff, 0x20, 0x1, 0x902c4, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3a0b, 0x4, 0x2, 0x1040021d, 0x0, r0}}], 0x4, &(0x7f0000001540)={0x2e, 0x4, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x6}, 0x0, r4, '\x00', {0x0, 0x48b, 0x0, 0x0}}, 0x0) 167.993186ms ago: executing program 0 (id=330): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) chdir(&(0x7f0000000540)='./cgroup\x00') fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x14e174135c0b87af) (fail_nth: 9) 0s ago: executing program 1 (id=331): r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x24020000) umount2(&(0x7f0000000000)='./file0\x00', 0x7) kernel console output (not intermixed with test programs): [ 6.688451][ T36] audit: type=1400 audit(1786032973.040:58): avc: denied { read } for pid=203 comm="getty" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:getty_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 syzkaller syzkaller login: [ 14.571443][ T36] audit: type=1400 audit(1786032980.930:59): avc: denied { transition } for pid=233 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.574700][ T36] audit: type=1400 audit(1786032980.930:60): avc: denied { noatsecure } for pid=233 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.577457][ T36] audit: type=1400 audit(1786032980.940:61): avc: denied { write } for pid=233 comm="sh" path="pipe:[1593]" dev="pipefs" ino=1593 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 14.580573][ T36] audit: type=1400 audit(1786032980.940:62): avc: denied { rlimitinh } for pid=233 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.583386][ T36] audit: type=1400 audit(1786032980.940:63): avc: denied { siginh } for pid=233 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.224' (ED25519) to the list of known hosts. [ 21.523267][ T36] audit: type=1400 audit(1786032987.890:64): avc: denied { mounton } for pid=287 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.524390][ T287] cgroup: Unknown subsys name 'net' [ 21.545904][ T36] audit: type=1400 audit(1786032987.890:65): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.573407][ T36] audit: type=1400 audit(1786032987.910:66): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.573564][ T287] cgroup: Unknown subsys name 'devices' [ 21.694112][ T287] cgroup: Unknown subsys name 'hugetlb' [ 21.699992][ T287] cgroup: Unknown subsys name 'rlimit' [ 21.812110][ T36] audit: type=1400 audit(1786032988.170:67): avc: denied { setattr } for pid=287 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.835311][ T36] audit: type=1400 audit(1786032988.170:68): avc: denied { mounton } for pid=287 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 21.860016][ T36] audit: type=1400 audit(1786032988.180:69): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.880826][ T289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 21.892200][ T36] audit: type=1400 audit(1786032988.250:70): avc: denied { relabelto } for pid=289 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.917683][ T36] audit: type=1400 audit(1786032988.260:71): avc: denied { write } for pid=289 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.956506][ T36] audit: type=1400 audit(1786032988.320:72): avc: denied { read } for pid=287 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.982077][ T36] audit: type=1400 audit(1786032988.320:73): avc: denied { open } for pid=287 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.982359][ T287] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.777623][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.784706][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.791888][ T294] bridge_slave_0: entered allmulticast mode [ 22.798318][ T294] bridge_slave_0: entered promiscuous mode [ 22.808407][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.815492][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.822563][ T294] bridge_slave_1: entered allmulticast mode [ 22.828836][ T294] bridge_slave_1: entered promiscuous mode [ 22.872032][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.879183][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.886720][ T295] bridge_slave_0: entered allmulticast mode [ 22.893094][ T295] bridge_slave_0: entered promiscuous mode [ 22.899536][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.906851][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.913962][ T295] bridge_slave_1: entered allmulticast mode [ 22.920111][ T295] bridge_slave_1: entered promiscuous mode [ 22.967505][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.974766][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.981889][ T296] bridge_slave_0: entered allmulticast mode [ 22.988205][ T296] bridge_slave_0: entered promiscuous mode [ 23.001269][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.008389][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.015478][ T296] bridge_slave_1: entered allmulticast mode [ 23.021678][ T296] bridge_slave_1: entered promiscuous mode [ 23.048424][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.055496][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.062650][ T297] bridge_slave_0: entered allmulticast mode [ 23.068809][ T297] bridge_slave_0: entered promiscuous mode [ 23.078074][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.085171][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.092220][ T297] bridge_slave_1: entered allmulticast mode [ 23.098449][ T297] bridge_slave_1: entered promiscuous mode [ 23.200569][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.207649][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.214956][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.221972][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.237874][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.244935][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.252193][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.259256][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.269335][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.276399][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.283705][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.290717][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.330091][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.337166][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.344450][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.351468][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.377068][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.384745][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.391944][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.399722][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.407228][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.414909][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.422514][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.429739][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.443973][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.451032][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.467736][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.474843][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.482673][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.489718][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.501917][ T61] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.508981][ T61] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.533595][ T61] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.540653][ T61] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.548341][ T61] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.555404][ T61] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.563926][ T61] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.570946][ T61] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.587763][ T61] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.595026][ T61] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.620210][ T294] veth0_vlan: entered promiscuous mode [ 23.639023][ T296] veth0_vlan: entered promiscuous mode [ 23.652038][ T295] veth0_vlan: entered promiscuous mode [ 23.665288][ T297] veth0_vlan: entered promiscuous mode [ 23.681106][ T295] veth1_macvtap: entered promiscuous mode [ 23.687949][ T294] veth1_macvtap: entered promiscuous mode [ 23.696211][ T296] veth1_macvtap: entered promiscuous mode [ 23.731936][ T297] veth1_macvtap: entered promiscuous mode [ 23.742598][ T294] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 23.798064][ T315] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 23.948179][ T330] fuseblk: Bad value for 'rootmode' [ 24.018487][ T332] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2142054965 (4284109930 ns) > initial count (2850433972 ns). Using initial count to start timer. [ 24.163015][ T339] rust_binder: Write failure EFAULT in pid:9 [ 24.432680][ T320] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 24.660060][ T320] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 24.687177][ T320] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 24.705945][ T320] usb 3-1: New USB device found, idVendor=056a, idProduct=033b, bcdDevice= 0.00 [ 24.719477][ T320] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 24.769945][ T358] rust_binder: Read failure Err(EAGAIN) in pid:14 [ 24.770885][ T360] rust_binder: Write failure EFAULT in pid:17 [ 24.959476][ T368] netlink: 'syz.0.19': attribute type 29 has an invalid length. [ 25.089679][ T375] netlink: 4 bytes leftover after parsing attributes in process `syz.1.22'. [ 25.124044][ T375] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=375 comm=syz.1.22 [ 25.163776][ T375] IPv6: NLM_F_CREATE should be specified when creating new route [ 25.198321][ T375] IPv6: NLM_F_REPLACE set, but no existing node found! [ 25.219736][ T380] binder: Bad value for 'stats' [ 25.226894][ T379] netlink: 28 bytes leftover after parsing attributes in process `syz.3.21'. [ 25.244843][ T341] IPv6: NLM_F_CREATE should be specified when creating new route [ 25.352910][ T320] wacom 0003:056A:033B.0001: Unknown device_type for 'HID 056a:033b'. Assuming pen. [ 25.372132][ T320] wacom 0003:056A:033B.0001: hidraw0: USB HID v1.11 Device [HID 056a:033b] on usb-dummy_hcd.2-1/input0 [ 25.393479][ T320] input: Wacom Intuos S 2 Pen as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/0003:056A:033B.0001/input/input5 [ 25.492451][ T310] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 25.542572][ T9] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 25.611463][ T395] usb 3-1: USB disconnect, device number 2 [ 25.642338][ T310] usb 2-1: Using ep0 maxpacket: 32 [ 25.648573][ T310] usb 2-1: New USB device found, idVendor=056a, idProduct=0045, bcdDevice= 0.00 [ 25.657764][ T310] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.666738][ T310] usb 2-1: config 0 descriptor?? [ 25.692319][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 25.697531][ T390] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 25.706130][ T9] usb 1-1: config 1 has an invalid interface number: 224 but max is 2 [ 25.714379][ T9] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 25.724528][ T9] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 25.734081][ T9] usb 1-1: config 1 has no interface number 0 [ 25.740198][ T9] usb 1-1: too many endpoints for config 1 interface 224 altsetting 255: 255, using maximum allowed: 30 [ 25.751509][ T9] usb 1-1: config 1 interface 224 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 25.765000][ T9] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 25.775936][ T9] usb 1-1: config 1 interface 224 has no altsetting 0 [ 25.785079][ T9] usb 1-1: New USB device found, idVendor=0582, idProduct=0016, bcdDevice= 0.40 [ 25.794203][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.802200][ T9] usb 1-1: Product: syz [ 25.806394][ T9] usb 1-1: Manufacturer: syz [ 25.810996][ T9] usb 1-1: SerialNumber: syz [ 25.819870][ T9] usb 1-1: 1:1 : no or invalid class specific endpoint descriptor [ 25.828108][ T9] usb 1-1: 1:1: invalid format type 0x1001 is detected, processed as PCM [ 25.836843][ T9] usb 1-1: 1:1 : invalid UAC_FORMAT_TYPE desc [ 25.863344][ T390] usb 4-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 25.872605][ T390] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.881760][ T390] usb 4-1: config 0 descriptor?? [ 26.019771][ T389] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 26.028397][ T389] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 26.040544][ T9] usb 1-1: USB disconnect, device number 2 [ 26.083197][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.090295][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.097847][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.104847][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.111744][ T390] usb 4-1: Cannot read MAC address [ 26.116932][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.123949][ T390] MOSCHIP usb-ethernet driver 4-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 26.137062][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.145157][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.152100][ T390] usb 4-1: USB disconnect, device number 2 [ 26.158125][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x2 [ 26.166152][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.173101][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.179964][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.186934][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.193835][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.200682][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.207652][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.214790][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.221666][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.228852][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.235801][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.242968][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.249919][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.256841][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.263728][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.270576][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.277454][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.284453][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.291346][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.298447][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.305361][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.312319][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.319214][ T310] wacom 0003:056A:0045.0002: unknown main item tag 0x0 [ 26.326526][ T310] wacom 0003:056A:0045.0002: Unknown device_type for 'HID 056a:0045'. Assuming pen. [ 26.336806][ T310] wacom 0003:056A:0045.0002: hidraw0: USB HID v9.42 Device [HID 056a:0045] on usb-dummy_hcd.1-1/input0 [ 26.348638][ T310] input: Wacom Intuos2 12x18 Pen as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:056A:0045.0002/input/input8 [ 26.363562][ T310] usb 2-1: USB disconnect, device number 2 [ 26.382378][ T320] usb 3-1: new low-speed USB device number 3 using dummy_hcd [ 26.533556][ T320] usb 3-1: No LPM exit latency info found, disabling LPM. [ 26.541374][ T320] usb 3-1: config 1 interface 0 altsetting 4 endpoint 0x1 is Bulk; changing to Interrupt [ 26.552353][ T320] usb 3-1: config 1 interface 0 altsetting 4 endpoint 0x82 is Bulk; changing to Interrupt [ 26.564311][ T401] capability: warning: `syz.0.27' uses 32-bit capabilities (legacy support in use) [ 26.568104][ T320] usb 3-1: config 1 interface 0 has no altsetting 0 [ 26.583549][ T320] usb 3-1: New USB device found, idVendor=03f0, idProduct=0004, bcdDevice= 0.40 [ 26.592735][ T320] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.600782][ T320] usb 3-1: Product: 蛀皪뺲‿꾮菙ࡅꌣ萾잜톆蓜ꝅ걽笻櫏鮮澗贷ꋫꙣ䞎媭塜蛥袢误렦И쿭Წ먗碱콱࡙ꀫ매徆䒺⻈뢓渲ʿ搖㞍碊쀤లೞ㊤봉䃘玺忁⩴쮟泥㠻담繏饽摑寑谡筭औﰓℏﳿ阪ᙊẾ堼杅⃊䄼뤓蜆ཷꄾ絯ꈝ喃줛蹂轖댡 [ 26.631104][ T320] usb 3-1: Manufacturer: Е [ 26.635717][ T320] usb 3-1: SerialNumber: ꩍ卦혩ꬥꏆ밢疢鞝ᡁꕊ鑅鿱ཝᑱȁ姣鯂࢚䎵쬥ᦉ烮ㅑﻬ뒦쯬팶袉⬽㨏摄㩰ᣒᬓṆ [ 26.651047][ T398] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 26.659704][ T398] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 26.666995][ T36] kauditd_printk_skb: 99 callbacks suppressed [ 26.667011][ T36] audit: type=1400 audit(1786032993.020:173): avc: denied { create } for pid=402 comm="syz.0.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 26.692740][ T36] audit: type=1400 audit(1786032993.020:174): avc: denied { write } for pid=402 comm="syz.0.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 26.744569][ T36] audit: type=1400 audit(1786032993.110:175): avc: denied { create } for pid=407 comm="syz.0.30" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 26.764331][ T36] audit: type=1400 audit(1786032993.110:176): avc: denied { setopt } for pid=407 comm="syz.0.30" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 26.783799][ T36] audit: type=1400 audit(1786032993.110:177): avc: denied { write } for pid=407 comm="syz.0.30" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 26.802955][ T36] audit: type=1400 audit(1786032993.110:178): avc: denied { connect } for pid=407 comm="syz.0.30" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 26.822422][ T36] audit: type=1400 audit(1786032993.130:179): avc: denied { ioctl } for pid=412 comm="syz.0.31" path="socket:[3874]" dev="sockfs" ino=3874 ioctlcmd=0x7453 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 26.852870][ T36] audit: type=1400 audit(1786032993.220:180): avc: denied { ioctl } for pid=414 comm="syz.1.32" path="socket:[3940]" dev="sockfs" ino=3940 ioctlcmd=0x48c8 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 26.877710][ T36] audit: type=1400 audit(1786032993.220:181): avc: denied { block_suspend } for pid=414 comm="syz.1.32" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 26.904065][ T320] usb 3-1: USB disconnect, device number 3 [ 26.919209][ T418] netlink: 44 bytes leftover after parsing attributes in process `syz.1.32'. [ 26.928121][ T418] netlink: 43 bytes leftover after parsing attributes in process `syz.1.32'. [ 26.932306][ T9] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 26.937002][ T418] netlink: 'syz.1.32': attribute type 6 has an invalid length. [ 26.952092][ T418] netlink: 'syz.1.32': attribute type 5 has an invalid length. [ 26.959743][ T418] netlink: 43 bytes leftover after parsing attributes in process `syz.1.32'. [ 27.112431][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 27.118762][ T9] usb 4-1: too many endpoints for config 0 interface 0 altsetting 16: 250, using maximum allowed: 30 [ 27.129676][ T9] usb 4-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 250 [ 27.132320][ T67] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 27.143183][ T9] usb 4-1: config 0 interface 0 has no altsetting 0 [ 27.157301][ T9] usb 4-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 27.166434][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.175148][ T9] usb 4-1: config 0 descriptor?? [ 27.292301][ T67] usb 1-1: Using ep0 maxpacket: 16 [ 27.298642][ T67] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 27.309485][ T67] usb 1-1: New USB device found, idVendor=1b3d, idProduct=0196, bcdDevice= 0.04 [ 27.318579][ T67] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 27.326618][ T67] usb 1-1: SerialNumber: syz [ 27.331950][ T67] usb 1-1: config 0 descriptor?? [ 27.337972][ T67] hub 1-1:0.0: bad descriptor, ignoring hub [ 27.343932][ T67] hub 1-1:0.0: probe with driver hub failed with error -5 [ 27.351274][ T67] ftdi_sio 1-1:0.0: FTDI USB Serial Device converter detected [ 27.359553][ T67] usb 1-1: Detected SIO [ 27.364306][ T67] usb 1-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 27.425569][ T36] audit: type=1400 audit(1786032993.790:182): avc: denied { read } for pid=422 comm="syz.2.35" path="socket:[3953]" dev="sockfs" ino=3953 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 27.503453][ T426] FAULT_INJECTION: forcing a failure. [ 27.503453][ T426] name failslab, interval 1, probability 0, space 0, times 1 [ 27.516433][ T426] CPU: 1 UID: 0 PID: 426 Comm: syz.2.36 Not tainted syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 27.516466][ T426] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 27.516487][ T426] Call Trace: [ 27.516493][ T426] [ 27.516501][ T426] __dump_stack+0x21/0x30 [ 27.516533][ T426] dump_stack_lvl+0x140/0x1c0 [ 27.516557][ T426] ? __cfi_dump_stack_lvl+0x10/0x10 [ 27.516582][ T426] dump_stack+0x19/0x20 [ 27.516606][ T426] should_fail_ex+0x3c2/0x510 [ 27.516626][ T426] should_failslab+0xac/0x100 [ 27.516648][ T426] __kmalloc_node_track_caller_noprof+0x65/0x4f0 [ 27.516668][ T426] ? _RNvXsj_NtCsbuTvttuFvbr_6kernel3strNtB5_7CStringINtNtCsjYlAz7NZ3Sw_4core7convert7TryFromRNtB5_4CStrE8try_from+0x8a/0x900 [ 27.516707][ T426] krealloc_noprof+0x8d/0x130 [ 27.516727][ T426] _RNvXsj_NtCsbuTvttuFvbr_6kernel3strNtB5_7CStringINtNtCsjYlAz7NZ3Sw_4core7convert7TryFromRNtB5_4CStrE8try_from+0x8a/0x900 [ 27.516764][ T426] rust_binder_new_context+0xbf/0x680 [ 27.516793][ T426] ? kasan_save_alloc_info+0x3a/0x50 [ 27.516818][ T426] ? __cfi_rust_binder_new_context+0x10/0x10 [ 27.516841][ T426] ? __kasan_kmalloc+0x96/0xb0 [ 27.516862][ T426] ? __kmalloc_cache_noprof+0x23c/0x470 [ 27.516881][ T426] ? binderfs_binder_device_create+0x15f/0xaf0 [ 27.516899][ T426] binderfs_binder_device_create+0x19a/0xaf0 [ 27.516922][ T426] binder_ctl_ioctl+0x187/0x230 [ 27.516940][ T426] ? __cfi_binder_ctl_ioctl+0x10/0x10 [ 27.516961][ T426] ? bpf_lsm_file_ioctl+0xd/0x20 [ 27.516983][ T426] ? security_file_ioctl+0x3e/0x110 [ 27.517011][ T426] ? __cfi_binder_ctl_ioctl+0x10/0x10 [ 27.517027][ T426] __se_sys_ioctl+0x135/0x1b0 [ 27.517047][ T426] __x64_sys_ioctl+0x7f/0xa0 [ 27.517067][ T426] x64_sys_call+0x1878/0x2ee0 [ 27.517085][ T426] do_syscall_64+0x57/0xf0 [ 27.517106][ T426] ? clear_bhb_loop+0x50/0xa0 [ 27.517128][ T426] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 27.517141][ T426] RIP: 0033:0x7f668639e0d9 [ 27.517151][ T426] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 27.517160][ T426] RSP: 002b:00007f6687226028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 27.517176][ T426] RAX: ffffffffffffffda RBX: 00007f6686625fa0 RCX: 00007f668639e0d9 [ 27.517184][ T426] RDX: 0000200000000040 RSI: 00000000c1086201 RDI: 0000000000000003 [ 27.517194][ T426] RBP: 00007f6687226090 R08: 0000000000000000 R09: 0000000000000000 [ 27.517206][ T426] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 27.517218][ T426] R13: 00007f6686626038 R14: 00007f6686625fa0 R15: 00007fff0dea9db8 [ 27.517234][ T426] [ 27.800308][ T417] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 27.809026][ T417] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 27.947599][ T439] netlink: 'syz.1.39': attribute type 4 has an invalid length. [ 27.955327][ T439] netlink: 8 bytes leftover after parsing attributes in process `syz.1.39'. [ 27.982454][ T390] usb 1-1: USB disconnect, device number 3 [ 27.998821][ T390] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 28.003016][ T439] SELinux: failed to load policy [ 28.012552][ T390] ftdi_sio 1-1:0.0: device disconnected [ 28.033828][ T441] 9pnet_virtio: no channels available for device /dev/rnullb0 [ 28.050185][ T441] netlink: 'syz.1.40': attribute type 32 has an invalid length. [ 28.300553][ T453] netlink: 'syz.1.45': attribute type 4 has an invalid length. [ 28.310360][ T453] netlink: 'syz.1.45': attribute type 4 has an invalid length. [ 28.399992][ T464] bridge_slave_0: default FDB implementation only supports local addresses [ 28.563761][ T67] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 28.596922][ T480] rust_binder: 479:480 got transaction to invalid handle 1 [ 28.604362][ T480] rust_binder: 479:480 transaction call to 0:0 failed ENOENT, code 0 size 0-0 [ 28.613928][ T310] rust_binder: 479: undelivered TRANSACTION_ERROR: 29201 [ 28.624798][ T390] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 28.702330][ T67] usb 2-1: device descriptor read/64, error -71 [ 28.783351][ T390] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 28.797685][ T390] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 28.807125][ T390] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 28.815285][ T390] usb 3-1: SerialNumber: syz [ 28.816562][ T487] netlink: 'syz.0.60': attribute type 29 has an invalid length. [ 28.829591][ T487] rust_binder: 486:487 no such ref 0 [ 28.962289][ T67] usb 2-1: device descriptor read/64, error -71 [ 29.202319][ T67] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 29.342666][ T67] usb 2-1: device descriptor read/64, error -71 [ 29.424461][ T390] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -71 [ 29.435234][ T390] usb 3-1: USB disconnect, device number 4 [ 29.582291][ T67] usb 2-1: device descriptor read/64, error -71 [ 29.692430][ T67] usb usb2-port1: attempt power cycle [ 29.733663][ T9] usbhid 4-1:0.0: can't add hid device: -71 [ 29.739645][ T9] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 29.749738][ T9] usb 4-1: USB disconnect, device number 3 [ 29.892358][ T469] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 30.032366][ T67] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 30.043467][ T469] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 30.053300][ T469] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 30.064252][ T67] usb 2-1: device descriptor read/8, error -71 [ 30.070610][ T469] usb 1-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 30.079703][ T469] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.087740][ T469] usb 1-1: Product: syz [ 30.091891][ T469] usb 1-1: Manufacturer: syz [ 30.092313][ T9] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 30.096522][ T469] usb 1-1: SerialNumber: syz [ 30.109473][ T469] usb 1-1: config 0 descriptor?? [ 30.114856][ T489] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 30.122127][ T489] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 30.203299][ T67] usb 2-1: device descriptor read/8, error -71 [ 30.253398][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 30.264383][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 30.274169][ T9] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 30.287089][ T9] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 30.296223][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.304866][ T9] usb 4-1: config 0 descriptor?? [ 30.331417][ T489] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 30.338697][ T489] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 30.452314][ T67] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 30.473570][ T67] usb 2-1: device descriptor read/8, error -71 [ 30.613337][ T67] usb 2-1: device descriptor read/8, error -71 [ 30.716591][ T9] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 30.724420][ T9] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 30.731851][ T9] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 30.732430][ T67] usb usb2-port1: unable to enumerate USB device [ 30.739608][ T9] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 30.754430][ T9] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 30.757060][ T489] 9pnet_fd: Insufficient options for proto=fd [ 30.761877][ T9] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 30.771962][ T469] Error reading MAC address [ 30.775826][ T9] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 30.785638][ T469] usb 1-1: USB disconnect, device number 4 [ 30.788640][ T9] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 30.800469][ T9] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 30.808168][ T9] plantronics 0003:047F:FFFF.0003: No inputs registered, leaving [ 30.817048][ T9] plantronics 0003:047F:FFFF.0003: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 30.983059][ T491] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=491 comm=syz.3.62 [ 30.996721][ T9] usb 4-1: USB disconnect, device number 4 [ 31.542298][ T9] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 31.574301][ T469] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 31.584475][ T469] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 31.592005][ T469] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 31.599541][ T469] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 31.606971][ T469] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 31.614676][ T469] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 31.622088][ T469] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 31.629823][ T469] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 31.637758][ T469] hid-generic 0000:0000:0000.0004: hidraw0: HID v0.10 Device [syz0] on syz1 [ 31.653257][ T533] fido_id[533]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 31.702357][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 31.708593][ T9] usb 1-1: config 248 has an invalid interface number: 115 but max is 2 [ 31.717039][ T9] usb 1-1: config 248 has an invalid interface number: 241 but max is 2 [ 31.725512][ T9] usb 1-1: config 248 has an invalid descriptor of length 0, skipping remainder of the config [ 31.736600][ T310] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 31.744119][ T9] usb 1-1: config 248 has 2 interfaces, different from the descriptor's value: 3 [ 31.759357][ T9] usb 1-1: config 248 has no interface number 0 [ 31.768473][ T9] usb 1-1: config 248 has no interface number 1 [ 31.772497][ T67] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 31.775380][ T9] usb 1-1: config 248 interface 115 altsetting 128 endpoint 0xB has invalid maxpacket 1023, setting to 64 [ 31.793517][ T9] usb 1-1: config 248 interface 115 altsetting 128 bulk endpoint 0x2 has invalid maxpacket 1023 [ 31.803988][ T9] usb 1-1: config 248 interface 241 altsetting 1 has a duplicate endpoint with address 0x3, skipping [ 31.814874][ T9] usb 1-1: config 248 interface 241 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 11 [ 31.828457][ T9] usb 1-1: config 248 interface 115 has no altsetting 0 [ 31.836841][ T9] usb 1-1: config 248 interface 241 has no altsetting 0 [ 31.845430][ T9] usb 1-1: New USB device found, idVendor=4971, idProduct=8017, bcdDevice=5f.a1 [ 31.854524][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 31.862575][ T9] usb 1-1: Product: syz [ 31.866719][ T9] usb 1-1: Manufacturer: syz [ 31.871302][ T9] usb 1-1: SerialNumber: syz [ 31.876861][ T520] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 31.902334][ T310] usb 2-1: Using ep0 maxpacket: 32 [ 31.908816][ T310] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 31.916426][ T310] usb 2-1: can't read configurations, error -61 [ 31.932366][ T67] usb 4-1: Using ep0 maxpacket: 8 [ 31.938626][ T67] usb 4-1: config 248 has an invalid interface number: 115 but max is 2 [ 31.947101][ T67] usb 4-1: config 248 has an invalid interface number: 241 but max is 2 [ 31.955652][ T67] usb 4-1: config 248 has an invalid descriptor of length 0, skipping remainder of the config [ 31.965976][ T67] usb 4-1: config 248 has 2 interfaces, different from the descriptor's value: 3 [ 31.975293][ T67] usb 4-1: config 248 has no interface number 0 [ 31.981556][ T67] usb 4-1: config 248 has no interface number 1 [ 31.987861][ T67] usb 4-1: config 248 interface 115 altsetting 128 endpoint 0xB has invalid maxpacket 1023, setting to 64 [ 31.999191][ T67] usb 4-1: config 248 interface 115 altsetting 128 bulk endpoint 0x2 has invalid maxpacket 1023 [ 32.009650][ T67] usb 4-1: config 248 interface 241 altsetting 1 has a duplicate endpoint with address 0x3, skipping [ 32.020556][ T67] usb 4-1: config 248 interface 241 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 11 [ 32.033922][ T469] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 32.041469][ T67] usb 4-1: config 248 interface 115 has no altsetting 0 [ 32.048506][ T67] usb 4-1: config 248 interface 241 has no altsetting 0 [ 32.057178][ T67] usb 4-1: New USB device found, idVendor=4971, idProduct=8017, bcdDevice=5f.a1 [ 32.062414][ T310] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 32.066317][ T67] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.081718][ T67] usb 4-1: Product: syz [ 32.085218][ T520] FAULT_INJECTION: forcing a failure. [ 32.085218][ T520] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 32.085902][ T67] usb 4-1: Manufacturer: syz [ 32.099302][ T520] CPU: 0 UID: 0 PID: 520 Comm: syz.0.68 Not tainted syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 32.099333][ T520] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 32.099344][ T520] Call Trace: [ 32.099350][ T520] [ 32.099357][ T520] __dump_stack+0x21/0x30 [ 32.099386][ T520] dump_stack_lvl+0x140/0x1c0 [ 32.099408][ T520] ? __cfi_dump_stack_lvl+0x10/0x10 [ 32.099432][ T520] ? check_stack_object+0x138/0x150 [ 32.099451][ T520] dump_stack+0x19/0x20 [ 32.099472][ T520] should_fail_ex+0x3c2/0x510 [ 32.099491][ T520] should_fail+0xf/0x20 [ 32.099507][ T520] should_fail_usercopy+0x1e/0x30 [ 32.099527][ T520] _copy_to_user+0x24/0xa0 [ 32.099549][ T520] simple_read_from_buffer+0xed/0x160 [ 32.099573][ T520] proc_fail_nth_read+0x1aa/0x220 [ 32.099597][ T520] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 32.099621][ T520] ? bpf_lsm_file_permission+0xd/0x20 [ 32.099643][ T520] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 32.099667][ T520] vfs_read+0x288/0xc70 [ 32.099683][ T520] ? l2cap_sock_bind+0x75f/0x8d0 [ 32.099705][ T520] ? __cfi_vfs_read+0x10/0x10 [ 32.099722][ T520] ? __kasan_check_write+0x18/0x20 [ 32.099739][ T520] ? mutex_lock+0x97/0x1d0 [ 32.099761][ T520] ? __cfi_mutex_lock+0x10/0x10 [ 32.099786][ T520] ksys_read+0x145/0x260 [ 32.099803][ T520] ? __cfi_ksys_read+0x10/0x10 [ 32.099821][ T520] ? __kasan_check_read+0x15/0x20 [ 32.099838][ T520] __x64_sys_read+0x7f/0x90 [ 32.099855][ T520] x64_sys_call+0x2638/0x2ee0 [ 32.099871][ T520] do_syscall_64+0x57/0xf0 [ 32.099890][ T520] ? clear_bhb_loop+0x50/0xa0 [ 32.099913][ T520] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 32.099934][ T520] RIP: 0033:0x7f769c75e90e [ 32.099951][ T520] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 32.099965][ T520] RSP: 002b:00007f769d742fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 32.099984][ T520] RAX: ffffffffffffffda RBX: 00007f769d7436c0 RCX: 00007f769c75e90e [ 32.099998][ T520] RDX: 000000000000000f RSI: 00007f769d7430a0 RDI: 0000000000000005 [ 32.100009][ T520] RBP: 00007f769d743090 R08: 0000000000000000 R09: 0000000000000000 [ 32.100021][ T520] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 32.100032][ T520] R13: 00007f769ca26038 R14: 00007f769ca25fa0 R15: 00007ffeb77eab68 [ 32.100047][ T520] [ 32.108862][ T9] usb-storage 1-1:248.115: USB Mass Storage device detected [ 32.116998][ T67] usb 4-1: SerialNumber: syz [ 32.135250][ T544] process 'syz.0.77' launched './file0' with NULL argv: empty string added [ 32.137873][ T36] kauditd_printk_skb: 30 callbacks suppressed [ 32.137889][ T36] audit: type=1400 audit(1786032998.490:213): avc: denied { execute } for pid=543 comm="syz.0.77" name="file0" dev="tmpfs" ino=171 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 32.141131][ T9] usb-storage 1-1:248.115: Quirks match for vid 4971 pid 8017: 4000000 [ 32.146921][ T525] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 32.407345][ T544] Invalid argument reading file caps for ./file0 [ 32.414000][ T36] audit: type=1400 audit(1786032998.770:214): avc: denied { execute_no_trans } for pid=543 comm="syz.0.77" path="/29/file0" dev="tmpfs" ino=171 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 32.440040][ T469] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 32.442296][ T310] usb 2-1: Using ep0 maxpacket: 32 [ 32.454619][ T469] usb 3-1: config 1 interface 0 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 32.457161][ T310] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 32.465688][ T469] usb 3-1: config 1 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 32.473275][ T310] usb 2-1: can't read configurations, error -61 [ 32.487421][ T469] usb 3-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 32.494216][ T9] usb-storage 1-1:248.241: USB Mass Storage device detected [ 32.509217][ T310] usb usb2-port1: attempt power cycle [ 32.511264][ T469] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.519719][ T9] usb-storage 1-1:248.241: Quirks match for vid 4971 pid 8017: 4000000 [ 32.528763][ T469] usb 3-1: Product: syz [ 32.535539][ T469] usb 3-1: Manufacturer: syz [ 32.540154][ T469] usb 3-1: SerialNumber: syz [ 32.546593][ T469] usb-storage 3-1:1.0: USB Mass Storage device detected [ 32.556011][ T469] usb-storage 3-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 32.561670][ T9] usb 1-1: USB disconnect, device number 5 [ 32.564383][ T469] scsi host2: usb-storage 3-1:1.0 [ 32.649338][ T67] usb-storage 4-1:248.115: USB Mass Storage device detected [ 32.657409][ T67] usb-storage 4-1:248.115: Quirks match for vid 4971 pid 8017: 4000000 [ 32.704381][ T67] usb-storage 4-1:248.241: USB Mass Storage device detected [ 32.712560][ T67] usb-storage 4-1:248.241: Quirks match for vid 4971 pid 8017: 4000000 [ 32.756355][ T67] usb 4-1: USB disconnect, device number 5 [ 32.772819][ T469] usb 3-1: USB disconnect, device number 5 [ 32.872361][ T310] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 32.879872][ T9] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 32.902822][ T310] usb 2-1: Using ep0 maxpacket: 32 [ 32.909488][ T310] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 32.917288][ T310] usb 2-1: can't read configurations, error -61 [ 33.032306][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 33.038436][ T9] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 33.047219][ T9] usb 1-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 33.057390][ T9] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 33.066272][ T310] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 33.075280][ T9] usb 1-1: New USB device found, idVendor=17cc, idProduct=4712, bcdDevice= 0.40 [ 33.084352][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.092428][ T9] usb 1-1: Product: syz [ 33.096599][ T9] usb 1-1: Manufacturer: syz [ 33.101237][ T310] usb 2-1: Using ep0 maxpacket: 32 [ 33.106485][ T9] usb 1-1: SerialNumber: syz [ 33.112436][ T310] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 33.120475][ T310] usb 2-1: can't read configurations, error -61 [ 33.126940][ T310] usb usb2-port1: unable to enumerate USB device [ 33.160792][ T563] FAULT_INJECTION: forcing a failure. [ 33.160792][ T563] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 33.173929][ T563] CPU: 0 UID: 0 PID: 563 Comm: syz.3.80 Not tainted syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 33.173960][ T563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 33.173969][ T563] Call Trace: [ 33.173973][ T563] [ 33.173978][ T563] __dump_stack+0x21/0x30 [ 33.173997][ T563] dump_stack_lvl+0x140/0x1c0 [ 33.174011][ T563] ? __cfi_dump_stack_lvl+0x10/0x10 [ 33.174029][ T563] ? check_stack_object+0x10f/0x150 [ 33.174040][ T563] dump_stack+0x19/0x20 [ 33.174053][ T563] should_fail_ex+0x3c2/0x510 [ 33.174065][ T563] should_fail+0xf/0x20 [ 33.174075][ T563] should_fail_usercopy+0x1e/0x30 [ 33.174087][ T563] _copy_from_user+0x20/0xa0 [ 33.174100][ T563] vga_arb_write+0x111/0x1c60 [ 33.174116][ T563] ? __cfi_vga_arb_write+0x10/0x10 [ 33.174131][ T563] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 33.174145][ T563] ? bpf_lsm_file_permission+0xd/0x20 [ 33.174159][ T563] ? __cfi_vga_arb_write+0x10/0x10 [ 33.174173][ T563] vfs_write+0x3c1/0xfd0 [ 33.174183][ T563] ? __cfi_vfs_write+0x10/0x10 [ 33.174193][ T563] ? __fget_files+0x2bc/0x330 [ 33.174225][ T563] ksys_write+0x145/0x260 [ 33.174236][ T563] ? __cfi_ksys_write+0x10/0x10 [ 33.174246][ T563] ? __kasan_check_read+0x15/0x20 [ 33.174256][ T563] __x64_sys_write+0x7f/0x90 [ 33.174267][ T563] x64_sys_call+0x271c/0x2ee0 [ 33.174276][ T563] do_syscall_64+0x57/0xf0 [ 33.174287][ T563] ? clear_bhb_loop+0x50/0xa0 [ 33.174302][ T563] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 33.174315][ T563] RIP: 0033:0x7f7210d9e0d9 [ 33.174325][ T563] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 33.174334][ T563] RSP: 002b:00007f7211c05028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 33.174346][ T563] RAX: ffffffffffffffda RBX: 00007f7211025fa0 RCX: 00007f7210d9e0d9 [ 33.174353][ T563] RDX: 0000000000000015 RSI: 0000200000000040 RDI: 0000000000000003 [ 33.174360][ T563] RBP: 00007f7211c05090 R08: 0000000000000000 R09: 0000000000000000 [ 33.174366][ T563] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 33.174373][ T563] R13: 00007f7211026038 R14: 00007f7211025fa0 R15: 00007ffc950858e8 [ 33.174381][ T563] [ 33.298078][ T570] FAULT_INJECTION: forcing a failure. [ 33.298078][ T570] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 33.300802][ T36] audit: type=1400 audit(1786032999.640:215): avc: denied { setcheckreqprot } for pid=569 comm="syz.2.83" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 33.307383][ T570] CPU: 1 UID: 0 PID: 570 Comm: syz.2.83 Not tainted syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 33.307409][ T570] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 33.307431][ T570] Call Trace: [ 33.307437][ T570] [ 33.307444][ T570] __dump_stack+0x21/0x30 [ 33.307472][ T570] dump_stack_lvl+0x140/0x1c0 [ 33.307495][ T570] ? __cfi_dump_stack_lvl+0x10/0x10 [ 33.307519][ T570] ? check_stack_object+0x81/0x150 [ 33.307537][ T570] ? __virt_addr_valid+0x2a1/0x370 [ 33.307558][ T570] dump_stack+0x19/0x20 [ 33.307584][ T570] should_fail_ex+0x3c2/0x510 [ 33.307604][ T570] should_fail+0xf/0x20 [ 33.307621][ T570] should_fail_usercopy+0x1e/0x30 [ 33.307641][ T570] _copy_from_user+0x20/0xa0 [ 33.307663][ T570] memdup_user_nul+0x7d/0x1a0 [ 33.307679][ T570] ? sel_write_checkreqprot+0x198/0x350 [ 33.307701][ T570] sel_write_checkreqprot+0x1b8/0x350 [ 33.307721][ T570] ? __cfi_sel_write_checkreqprot+0x10/0x10 [ 33.307742][ T570] ? bpf_lsm_file_permission+0xd/0x20 [ 33.307764][ T570] vfs_writev+0x652/0xe90 [ 33.307785][ T570] ? __cfi_sel_write_checkreqprot+0x10/0x10 [ 33.307805][ T570] ? do_writev+0x2e0/0x2e0 [ 33.307826][ T570] ? vfs_write+0xbcf/0xfd0 [ 33.307845][ T570] ? __kasan_check_write+0x18/0x20 [ 33.307862][ T570] ? mutex_lock+0x97/0x1d0 [ 33.307884][ T570] ? __cfi_mutex_lock+0x10/0x10 [ 33.307908][ T570] do_writev+0x151/0x2e0 [ 33.307929][ T570] ? vfs_readv+0xa00/0xa00 [ 33.307950][ T570] ? __kasan_check_read+0x15/0x20 [ 33.307967][ T570] __x64_sys_writev+0x81/0x90 [ 33.307986][ T570] x64_sys_call+0x1fbb/0x2ee0 [ 33.308002][ T570] do_syscall_64+0x57/0xf0 [ 33.308021][ T570] ? clear_bhb_loop+0x50/0xa0 [ 33.308044][ T570] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 33.308066][ T570] RIP: 0033:0x7f668639e0d9 [ 33.308082][ T570] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 33.308096][ T570] RSP: 002b:00007f6687226028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 33.308115][ T570] RAX: ffffffffffffffda RBX: 00007f6686625fa0 RCX: 00007f668639e0d9 [ 33.308134][ T570] RDX: 0000000000000020 RSI: 0000200000000080 RDI: 0000000000000003 [ 33.308147][ T570] RBP: 00007f6687226090 R08: 0000000000000000 R09: 0000000000000000 [ 33.308158][ T570] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 33.308170][ T570] R13: 00007f6686626038 R14: 00007f6686625fa0 R15: 00007fff0dea9db8 [ 33.308184][ T570] [ 33.349377][ T572] FAULT_INJECTION: forcing a failure. [ 33.349377][ T572] name failslab, interval 1, probability 0, space 0, times 0 [ 33.354949][ T36] audit: type=1400 audit(1786032999.700:216): avc: denied { unlink } for pid=571 comm="syz.2.84" name="#1" dev="tmpfs" ino=137 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 33.379456][ T572] CPU: 1 UID: 0 PID: 572 Comm: syz.2.84 Not tainted syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 33.379487][ T572] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 33.379498][ T572] Call Trace: [ 33.379504][ T572] [ 33.379514][ T572] __dump_stack+0x21/0x30 [ 33.379543][ T572] dump_stack_lvl+0x140/0x1c0 [ 33.379566][ T572] ? __cfi_dump_stack_lvl+0x10/0x10 [ 33.379591][ T572] dump_stack+0x19/0x20 [ 33.379612][ T572] should_fail_ex+0x3c2/0x510 [ 33.379632][ T572] should_failslab+0xac/0x100 [ 33.379653][ T572] kmem_cache_alloc_noprof+0x42/0x410 [ 33.379672][ T572] ? security_inode_alloc+0x51/0x230 [ 33.379693][ T572] ? __cfi_make_kgid+0x10/0x10 [ 33.379714][ T572] security_inode_alloc+0x51/0x230 [ 33.379734][ T572] inode_init_always_gfp+0x756/0x9e0 [ 33.379756][ T572] ? __cfi_ovl_alloc_inode+0x10/0x10 [ 33.379777][ T572] alloc_inode+0xc5/0x270 [ 33.379798][ T572] new_inode+0x25/0x1e0 [ 33.379818][ T572] ? mnt_want_write+0x321/0x510 [ 33.379840][ T572] ovl_new_inode+0x28/0x2b0 [ 33.379862][ T572] ovl_create_object+0x163/0x330 [ 33.379885][ T572] ? ovl_get_acl+0x70/0x70 [ 33.379908][ T572] ? make_vfsgid+0x4d/0xa0 [ 33.379923][ T572] ? __cfi_ovl_permission+0x10/0x10 [ 33.379943][ T572] ? selinux_inode_mkdir+0x26/0x30 [ 33.379966][ T572] ovl_mkdir+0x2f/0x40 [ 33.379988][ T572] vfs_mkdir+0x591/0x810 [ 33.380012][ T572] do_mkdirat+0x470/0x530 [ 33.380033][ T572] ? strncpy_from_user+0x14f/0x280 [ 33.380052][ T572] ? __cfi_do_mkdirat+0x10/0x10 [ 33.380075][ T572] ? getname_flags+0x203/0x6b0 [ 33.380094][ T572] __x64_sys_mkdir+0x70/0x80 [ 33.380117][ T572] x64_sys_call+0x26c8/0x2ee0 [ 33.380139][ T572] do_syscall_64+0x57/0xf0 [ 33.380159][ T572] ? clear_bhb_loop+0x50/0xa0 [ 33.380182][ T572] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 33.380204][ T572] RIP: 0033:0x7f668639e0d9 [ 33.380220][ T572] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 33.380234][ T572] RSP: 002b:00007f6687226028 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 33.380253][ T572] RAX: ffffffffffffffda RBX: 00007f6686625fa0 RCX: 00007f668639e0d9 [ 33.380267][ T572] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000200000000140 [ 33.380279][ T572] RBP: 00007f6687226090 R08: 0000000000000000 R09: 0000000000000000 [ 33.380290][ T572] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 33.380301][ T572] R13: 00007f6686626038 R14: 00007f6686625fa0 R15: 00007fff0dea9db8 [ 33.380316][ T572] [ 33.442284][ T469] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 33.451709][ T36] audit: type=1400 audit(1786032999.700:217): avc: denied { mount } for pid=571 comm="syz.2.84" name="/" dev="overlay" ino=132 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 33.613390][ T469] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 33.618213][ T36] audit: type=1400 audit(1786032999.750:218): avc: denied { unmount } for pid=296 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 33.647385][ T469] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 34.051116][ T469] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 34.061305][ T36] audit: type=1400 audit(1786033000.410:219): avc: denied { execute } for pid=574 comm="syz.2.85" name="file0" dev="ramfs" ino=5548 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=file permissive=1 [ 34.069307][ T469] usb 4-1: New USB device found, idVendor=054c, idProduct=09cc, bcdDevice= 0.00 [ 34.091653][ T574] process '/file0' started with executable stack [ 34.094648][ T469] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.102432][ T36] audit: type=1400 audit(1786033000.410:220): avc: denied { execute_no_trans } for pid=574 comm="syz.2.85" path="/file0" dev="ramfs" ino=5548 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=file permissive=1 [ 34.112284][ T469] usb 4-1: config 0 descriptor?? [ 34.145736][ T9] usb 1-1: Audio class v2/v3 interfaces need an interface association [ 34.161424][ T9] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 34.179375][ T9] usb 1-1: USB disconnect, device number 6 [ 34.190252][ T554] udevd[554]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 34.306274][ T584] SELinux: policydb table sizes (0,0) do not match mine (8,7) [ 34.313981][ T584] SELinux: failed to load policy [ 34.357933][ T36] audit: type=1400 audit(1786033000.720:221): avc: denied { create } for pid=587 comm="syz.2.90" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 34.364192][ T469] usbhid 4-1:0.0: can't add hid device: -71 [ 34.389163][ T469] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 34.392975][ T36] audit: type=1400 audit(1786033000.750:222): avc: denied { accept } for pid=587 comm="syz.2.90" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 34.404460][ T469] usb 4-1: USB disconnect, device number 6 [ 34.474068][ T596] FAULT_INJECTION: forcing a failure. [ 34.474068][ T596] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 34.495910][ T596] CPU: 0 UID: 0 PID: 596 Comm: syz.1.93 Not tainted syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 34.495944][ T596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 34.495956][ T596] Call Trace: [ 34.495961][ T596] [ 34.495968][ T596] __dump_stack+0x21/0x30 [ 34.495997][ T596] dump_stack_lvl+0x140/0x1c0 [ 34.496020][ T596] ? __cfi_dump_stack_lvl+0x10/0x10 [ 34.496044][ T596] ? check_stack_object+0x138/0x150 [ 34.496063][ T596] dump_stack+0x19/0x20 [ 34.496084][ T596] should_fail_ex+0x3c2/0x510 [ 34.496104][ T596] should_fail+0xf/0x20 [ 34.496122][ T596] should_fail_usercopy+0x1e/0x30 [ 34.496143][ T596] _copy_to_user+0x24/0xa0 [ 34.496167][ T596] simple_read_from_buffer+0xed/0x160 [ 34.496192][ T596] proc_fail_nth_read+0x1aa/0x220 [ 34.496219][ T596] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 34.496244][ T596] ? bpf_lsm_file_permission+0xd/0x20 [ 34.496269][ T596] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 34.496293][ T596] vfs_read+0x288/0xc70 [ 34.496311][ T596] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 34.496329][ T596] ? __cfi_vfs_read+0x10/0x10 [ 34.496347][ T596] ? __kasan_check_write+0x18/0x20 [ 34.496365][ T596] ? mutex_lock+0x97/0x1d0 [ 34.496389][ T596] ? __cfi_mutex_lock+0x10/0x10 [ 34.496415][ T596] ksys_read+0x145/0x260 [ 34.496433][ T596] ? __cfi_ksys_read+0x10/0x10 [ 34.496452][ T596] ? __kasan_check_read+0x15/0x20 [ 34.496470][ T596] __x64_sys_read+0x7f/0x90 [ 34.496487][ T596] x64_sys_call+0x2638/0x2ee0 [ 34.496502][ T596] do_syscall_64+0x57/0xf0 [ 34.496519][ T596] ? clear_bhb_loop+0x50/0xa0 [ 34.496542][ T596] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 34.496563][ T596] RIP: 0033:0x7ff86bd5e90e [ 34.496579][ T596] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 34.496592][ T596] RSP: 002b:00007ff86a7f6fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 34.496610][ T596] RAX: ffffffffffffffda RBX: 00007ff86a7f76c0 RCX: 00007ff86bd5e90e [ 34.496623][ T596] RDX: 000000000000000f RSI: 00007ff86a7f70a0 RDI: 0000000000000005 [ 34.496632][ T596] RBP: 00007ff86a7f7090 R08: 0000000000000000 R09: 0000000000000000 [ 34.496642][ T596] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 34.496652][ T596] R13: 00007ff86c026038 R14: 00007ff86c025fa0 R15: 00007ffd74034cc8 [ 34.496666][ T596] [ 34.773809][ T600] tipc: Started in network mode [ 34.778848][ T600] tipc: Node identity fa2783e79747, cluster identity 4711 [ 34.789118][ T600] tipc: Enabled bearer , priority 10 [ 34.841627][ T600] tipc: Resetting bearer [ 34.848434][ T600] tipc: Disabling bearer [ 35.022319][ T9] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 35.062323][ T390] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 35.173847][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 35.182597][ T9] usb 1-1: config index 0 descriptor too short (expected 45678, got 110) [ 35.191126][ T9] usb 1-1: config 84 has too many interfaces: 168, using maximum allowed: 32 [ 35.202550][ T9] usb 1-1: config 84 has an invalid descriptor of length 130, skipping remainder of the config [ 35.216165][ T9] usb 1-1: config 84 has 0 interfaces, different from the descriptor's value: 168 [ 35.225475][ T390] usb 2-1: Using ep0 maxpacket: 16 [ 35.231712][ T390] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 35.241973][ T390] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 35.253384][ T390] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 35.262523][ T390] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.270868][ T390] usb 2-1: Product: syz [ 35.275391][ T9] usb 1-1: New USB device found, idVendor=046d, idProduct=0990, bcdDevice= 0.40 [ 35.284679][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.292777][ T390] usb 2-1: Manufacturer: syz [ 35.297390][ T390] usb 2-1: SerialNumber: syz [ 35.302021][ T9] usb 1-1: Product: syz [ 35.306750][ T9] usb 1-1: SerialNumber: syz [ 35.515531][ T390] usb 2-1: 0:2 : does not exist [ 35.527158][ T390] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 35.545905][ T390] usb 2-1: USB disconnect, device number 11 [ 35.560797][ T625] kvm: kvm [624]: vcpu0, guest rIP: 0x912a Unhandled WRMSR(0xc1) = 0x60000000 [ 35.563390][ T554] udevd[554]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 35.570036][ T625] kvm: kvm [624]: vcpu0, guest rIP: 0x912a Unhandled WRMSR(0xc2) = 0x60000000 [ 35.603894][ T625] kvm: kvm [624]: vcpu0, guest rIP: 0x912a Unhandled WRMSR(0x11e) = 0x60000000 [ 35.620104][ T625] kvm: kvm [624]: vcpu0, guest rIP: 0x912a Unhandled WRMSR(0x186) = 0x60000000 [ 35.629236][ T625] kvm: kvm [624]: vcpu0, guest rIP: 0x912a Unhandled WRMSR(0x187) = 0x60000000 [ 35.777202][ T632] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 35.777224][ T632] rust_binder: Read failure Err(EFAULT) in pid:40 [ 35.786628][ T632] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 35.793153][ T632] rust_binder: Read failure Err(EFAULT) in pid:40 [ 35.801709][ T632] rust_binder: validate_parent_fixup: new_min_offset=216, sg_entry.length=0 [ 35.808214][ T632] rust_binder: 631:632 error while translating object: EINVAL [ 35.824638][ T632] rust_binder: Failure in copy_transaction_data: EINVAL [ 35.824664][ T632] rust_binder: 631:632 transaction call to 631:0 failed EINVAL, code 0 size 112-24 [ 36.002410][ T469] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 36.153370][ T469] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 36.163531][ T469] usb 3-1: config 1 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 36.176448][ T469] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 36.185514][ T469] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.195439][ T469] cdc_acm 3-1:1.0: probe with driver cdc_acm failed with error -22 [ 36.382290][ T31] usb 2-1: new full-speed USB device number 12 using dummy_hcd [ 36.396116][ T630] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 36.404838][ T630] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 36.413417][ T469] usb 3-1: string descriptor 0 read error: -71 [ 36.420836][ T469] usb 3-1: USB disconnect, device number 6 [ 36.533379][ T31] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 36.543720][ T31] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 36.552640][ T31] usb 2-1: config 1 has no interface number 0 [ 36.558788][ T31] usb 2-1: config 1 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 36.573105][ T31] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 36.582357][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.590771][ T31] usb 2-1: Product: syz [ 36.595341][ T31] usb 2-1: Manufacturer: syz [ 36.599959][ T31] usb 2-1: SerialNumber: syz [ 36.606041][ T31] cdc_ncm 2-1:1.1: NCM or ECM functional descriptors missing [ 36.613776][ T31] cdc_ncm 2-1:1.1: bind() failure [ 36.633360][ T390] rust_binder: 631: undelivered TRANSACTION_ERROR: 29201 [ 36.807583][ T31] usb 2-1: USB disconnect, device number 12 [ 37.182320][ T67] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 37.316301][ T36] kauditd_printk_skb: 30 callbacks suppressed [ 37.316326][ T36] audit: type=1400 audit(1786033003.680:253): avc: denied { unmount } for pid=294 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 37.342927][ T36] audit: type=1400 audit(1786033003.690:254): avc: denied { ioctl } for pid=654 comm="syz.1.112" path="/dev/fuse" dev="devtmpfs" ino=23 ioctlcmd=0x6e85 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 37.368295][ T67] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 37.379957][ T67] usb 3-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 37.391290][ T67] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.399352][ T67] usb 3-1: Product: syz [ 37.403644][ T67] usb 3-1: Manufacturer: syz [ 37.409388][ T67] usb 3-1: SerialNumber: syz [ 37.418174][ T67] usb 3-1: config 0 descriptor?? [ 37.424461][ T67] dm9601 3-1:0.0: probe with driver dm9601 failed with error -22 [ 37.625919][ T31] usb 3-1: USB disconnect, device number 7 [ 37.647053][ T674] FAULT_INJECTION: forcing a failure. [ 37.647053][ T674] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 37.660158][ T674] CPU: 0 UID: 0 PID: 674 Comm: syz.1.119 Not tainted syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 37.660189][ T674] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 37.660196][ T674] Call Trace: [ 37.660200][ T674] [ 37.660205][ T674] __dump_stack+0x21/0x30 [ 37.660225][ T674] dump_stack_lvl+0x140/0x1c0 [ 37.660239][ T674] ? __cfi_dump_stack_lvl+0x10/0x10 [ 37.660253][ T674] ? check_stack_object+0x138/0x150 [ 37.660264][ T674] dump_stack+0x19/0x20 [ 37.660280][ T674] should_fail_ex+0x3c2/0x510 [ 37.660291][ T674] should_fail+0xf/0x20 [ 37.660301][ T674] should_fail_usercopy+0x1e/0x30 [ 37.660313][ T674] _copy_to_user+0x24/0xa0 [ 37.660326][ T674] simple_read_from_buffer+0xed/0x160 [ 37.660340][ T674] proc_fail_nth_read+0x1aa/0x220 [ 37.660355][ T674] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 37.660368][ T674] ? bpf_lsm_file_permission+0xd/0x20 [ 37.660382][ T674] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 37.660395][ T674] vfs_read+0x288/0xc70 [ 37.660405][ T674] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 37.660416][ T674] ? __cfi_vfs_read+0x10/0x10 [ 37.660425][ T674] ? __kasan_check_write+0x18/0x20 [ 37.660435][ T674] ? mutex_lock+0x97/0x1d0 [ 37.660449][ T674] ? __cfi_mutex_lock+0x10/0x10 [ 37.660463][ T674] ksys_read+0x145/0x260 [ 37.660473][ T674] ? __cfi_ksys_read+0x10/0x10 [ 37.660483][ T674] ? __kasan_check_read+0x15/0x20 [ 37.660493][ T674] __x64_sys_read+0x7f/0x90 [ 37.660502][ T674] x64_sys_call+0x2638/0x2ee0 [ 37.660512][ T674] do_syscall_64+0x57/0xf0 [ 37.660523][ T674] ? clear_bhb_loop+0x50/0xa0 [ 37.660536][ T674] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 37.660549][ T674] RIP: 0033:0x7ff86bd5e90e [ 37.660562][ T674] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 37.660570][ T674] RSP: 002b:00007ff86a7f6fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 37.660582][ T674] RAX: ffffffffffffffda RBX: 00007ff86a7f76c0 RCX: 00007ff86bd5e90e [ 37.660590][ T674] RDX: 000000000000000f RSI: 00007ff86a7f70a0 RDI: 0000000000000005 [ 37.660596][ T674] RBP: 00007ff86a7f7090 R08: 0000000000000000 R09: 0000000000000000 [ 37.660603][ T674] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 37.660609][ T674] R13: 00007ff86c026038 R14: 00007ff86c025fa0 R15: 00007ffd74034cc8 [ 37.660617][ T674] [ 37.742315][ T67] usb 4-1: new low-speed USB device number 7 using dummy_hcd [ 37.798115][ T9] usb 1-1: USB disconnect, device number 7 [ 37.942359][ T67] usb 4-1: device descriptor read/64, error -71 [ 37.956707][ T680] ======================================================= [ 37.956707][ T680] WARNING: The mand mount option has been deprecated and [ 37.956707][ T680] and is ignored by this kernel. Remove the mand [ 37.956707][ T680] option from the mount to silence this warning. [ 37.956707][ T680] ======================================================= [ 37.956907][ T679] netlink: 'syz.1.121': attribute type 16 has an invalid length. [ 38.002145][ T36] audit: type=1400 audit(1786033004.360:255): avc: denied { unmount } for pid=678 comm="syz.1.121" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 38.182355][ T67] usb 4-1: device descriptor read/64, error -71 [ 38.422335][ T67] usb 4-1: new low-speed USB device number 8 using dummy_hcd [ 38.492338][ T31] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 38.552305][ T67] usb 4-1: device descriptor read/64, error -71 [ 38.643577][ T31] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 38.653901][ T31] usb 3-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 38.669228][ T31] usb 3-1: New USB device found, idVendor=249c, idProduct=9001, bcdDevice= 0.40 [ 38.678342][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.686383][ T31] usb 3-1: Product: syz [ 38.690543][ T31] usb 3-1: Manufacturer: syz [ 38.695141][ T31] usb 3-1: SerialNumber: syz [ 38.792319][ T67] usb 4-1: device descriptor read/64, error -71 [ 38.874049][ T36] audit: type=1400 audit(1786033005.240:256): avc: denied { bind } for pid=704 comm="syz.1.130" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 38.893277][ T36] audit: type=1400 audit(1786033005.240:257): avc: denied { name_bind } for pid=704 comm="syz.1.130" src=28196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 38.902295][ T469] usb 1-1: new full-speed USB device number 8 using dummy_hcd [ 38.921506][ T67] usb usb4-port1: attempt power cycle [ 38.922102][ T36] audit: type=1400 audit(1786033005.240:258): avc: denied { node_bind } for pid=704 comm="syz.1.130" src=28196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 38.948507][ T36] audit: type=1400 audit(1786033005.240:259): avc: denied { bind } for pid=704 comm="syz.1.130" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 38.967804][ T36] audit: type=1400 audit(1786033005.250:260): avc: denied { sqpoll } for pid=704 comm="syz.1.130" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 39.046376][ T31] usb 3-1: USB disconnect, device number 8 [ 39.093454][ T469] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 39.106385][ T469] usb 1-1: New USB device found, idVendor=11c2, idProduct=2208, bcdDevice= 0.00 [ 39.115435][ T469] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.124010][ T469] usb 1-1: config 0 descriptor?? [ 39.262317][ T67] usb 4-1: new low-speed USB device number 9 using dummy_hcd [ 39.283217][ T67] usb 4-1: device descriptor read/8, error -71 [ 39.413334][ T67] usb 4-1: device descriptor read/8, error -71 [ 39.652350][ T67] usb 4-1: new low-speed USB device number 10 using dummy_hcd [ 39.673245][ T67] usb 4-1: device descriptor read/8, error -71 [ 39.732381][ T469] usbhid 1-1:0.0: can't add hid device: -71 [ 39.738360][ T469] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 39.747753][ T469] usb 1-1: USB disconnect, device number 8 [ 39.792298][ T9] usb 3-1: new full-speed USB device number 9 using dummy_hcd [ 39.803497][ T67] usb 4-1: device descriptor read/8, error -71 [ 39.912522][ T67] usb usb4-port1: unable to enumerate USB device [ 39.922396][ T9] usb 3-1: device descriptor read/64, error -71 [ 39.989071][ T728] futex_wake_op: syz.1.141 tries to shift op by 144; fix this program [ 39.997822][ T728] Dead loop on virtual device ip6_vti0, fix it urgently! [ 40.162332][ T9] usb 3-1: device descriptor read/64, error -71 [ 40.402351][ T9] usb 3-1: new full-speed USB device number 10 using dummy_hcd [ 40.482319][ T310] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 40.514034][ T36] audit: type=1400 audit(1786033006.880:261): avc: denied { create } for pid=731 comm="syz.3.143" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 40.533923][ T9] usb 3-1: device descriptor read/64, error -71 [ 40.576744][ T745] bridge: RTM_NEWNEIGH with invalid state 0x1 [ 40.632314][ T310] usb 1-1: Using ep0 maxpacket: 16 [ 40.644518][ T310] usb 1-1: New USB device found, idVendor=0d8c, idProduct=0102, bcdDevice= 0.40 [ 40.654084][ T36] audit: type=1400 audit(1786033007.020:262): avc: denied { map } for pid=754 comm="syz.1.152" path="socket:[10698]" dev="sockfs" ino=10698 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 40.656386][ T310] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.690337][ T310] usb 1-1: Product: syz [ 40.695987][ T310] usb 1-1: Manufacturer: syz [ 40.700606][ T310] usb 1-1: SerialNumber: syz [ 40.706162][ T46] Bluetooth: hci0: Frame reassembly failed (-84) [ 40.822302][ T9] usb 3-1: device descriptor read/64, error -71 [ 40.932376][ T390] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 40.940064][ T9] usb usb3-port1: attempt power cycle [ 41.072309][ T390] usb 4-1: device descriptor read/64, error -71 [ 41.282341][ T9] usb 3-1: new full-speed USB device number 11 using dummy_hcd [ 41.303274][ T9] usb 3-1: device descriptor read/8, error -71 [ 41.312396][ T390] usb 4-1: device descriptor read/64, error -71 [ 41.433210][ T9] usb 3-1: device descriptor read/8, error -71 [ 41.519584][ T310] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 41.531437][ T310] usb 1-1: USB disconnect, device number 9 [ 41.562342][ T390] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 41.672343][ T9] usb 3-1: new full-speed USB device number 12 using dummy_hcd [ 41.692329][ T390] usb 4-1: device descriptor read/64, error -71 [ 41.699537][ T9] usb 3-1: device descriptor read/8, error -71 [ 41.833418][ T9] usb 3-1: device descriptor read/8, error -71 [ 41.932307][ T390] usb 4-1: device descriptor read/64, error -71 [ 41.942494][ T9] usb usb3-port1: unable to enumerate USB device [ 42.044572][ T390] usb usb4-port1: attempt power cycle [ 42.312344][ T9] usb 1-1: new full-speed USB device number 10 using dummy_hcd [ 42.382330][ T390] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 42.403290][ T390] usb 4-1: device descriptor read/8, error -71 [ 42.432746][ T36] kauditd_printk_skb: 11 callbacks suppressed [ 42.432762][ T36] audit: type=1400 audit(1786033008.800:274): avc: denied { create } for pid=788 comm="syz.1.164" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 42.442303][ T9] usb 1-1: device descriptor read/64, error -71 [ 42.533311][ T390] usb 4-1: device descriptor read/8, error -71 [ 42.702344][ T9] usb 1-1: device descriptor read/64, error -71 [ 42.772319][ T390] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 42.782356][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 42.782575][ T758] Bluetooth: hci0: command 0x1003 tx timeout [ 42.795502][ T390] usb 4-1: device descriptor read/8, error -71 [ 42.923406][ T390] usb 4-1: device descriptor read/8, error -71 [ 42.942315][ T9] usb 1-1: new full-speed USB device number 11 using dummy_hcd [ 42.962361][ T10] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 42.977137][ T794] netlink: 'syz.1.166': attribute type 10 has an invalid length. [ 42.984954][ T795] netlink: 'syz.1.166': attribute type 10 has an invalid length. [ 43.022362][ T799] capability: warning: `syz.1.168' uses deprecated v2 capabilities in a way that may be insecure [ 43.034263][ T36] audit: type=1400 audit(1786033009.400:275): avc: denied { lock } for pid=798 comm="syz.1.168" path="socket:[10752]" dev="sockfs" ino=10752 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 43.034747][ T390] usb usb4-port1: unable to enumerate USB device [ 43.070060][ T36] audit: type=1400 audit(1786033009.430:276): avc: denied { read } for pid=800 comm="syz.1.169" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 43.090182][ T9] usb 1-1: device descriptor read/64, error -71 [ 43.097930][ T36] audit: type=1400 audit(1786033009.460:277): avc: denied { create } for pid=802 comm="syz.1.170" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 43.117646][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 43.118485][ T36] audit: type=1400 audit(1786033009.480:278): avc: denied { sys_admin } for pid=802 comm="syz.1.170" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 43.125409][ T10] usb 3-1: New USB device found, idVendor=0d8c, idProduct=0102, bcdDevice= 0.40 [ 43.155615][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 43.164032][ T10] usb 3-1: Product: syz [ 43.168432][ T10] usb 3-1: Manufacturer: syz [ 43.173347][ T10] usb 3-1: SerialNumber: syz [ 43.293395][ T36] audit: type=1400 audit(1786033009.660:279): avc: denied { read } for pid=807 comm="syz.1.171" name="file2" dev="tmpfs" ino=385 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 43.294089][ T808] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=808 comm=syz.1.171 [ 43.315470][ T36] audit: type=1400 audit(1786033009.660:280): avc: denied { open } for pid=807 comm="syz.1.171" path="/65/file2" dev="tmpfs" ino=385 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 43.332969][ T808] netlink: 'syz.1.171': attribute type 5 has an invalid length. [ 43.350156][ T9] usb 1-1: device descriptor read/64, error -71 [ 43.357961][ T808] netlink: 3657 bytes leftover after parsing attributes in process `syz.1.171'. [ 43.380198][ T791] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 43.390651][ T791] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 43.399616][ T36] audit: type=1400 audit(1786033009.770:281): avc: denied { write } for pid=790 comm="syz.2.165" name="ptype" dev="proc" ino=4026532319 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 43.423569][ T791] 9pnet_virtio: no channels available for device /dev/rnullb0 [ 43.482300][ T9] usb usb1-port1: attempt power cycle [ 43.639893][ T814] rust_binder: 813:814 no such ref 0 [ 43.640128][ T36] audit: type=1400 audit(1786033010.000:282): avc: denied { search } for pid=813 comm="syz.3.173" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 43.645347][ T814] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 43.667797][ T36] audit: type=1400 audit(1786033010.000:283): avc: denied { read } for pid=813 comm="syz.3.173" name="trace_pipe" dev="tracefs" ino=72 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 43.671382][ T814] rust_binder: Read failure Err(EFAULT) in pid:66 [ 43.822306][ T9] usb 1-1: new full-speed USB device number 12 using dummy_hcd [ 43.868465][ T9] usb 1-1: device descriptor read/8, error -71 [ 43.936460][ T819] netlink: 228 bytes leftover after parsing attributes in process `syz.1.175'. [ 43.961715][ T821] Zero length message leads to an empty skb [ 44.003378][ T9] usb 1-1: device descriptor read/8, error -71 [ 44.042293][ T31] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 44.192286][ T31] usb 4-1: Using ep0 maxpacket: 16 [ 44.198560][ T31] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 44.208861][ T31] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 44.219274][ T31] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 44.228392][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 44.236430][ T31] usb 4-1: Product: syz [ 44.240593][ T31] usb 4-1: Manufacturer: syz [ 44.245229][ T31] usb 4-1: SerialNumber: syz [ 44.252438][ T9] usb 1-1: new full-speed USB device number 13 using dummy_hcd [ 44.273326][ T9] usb 1-1: device descriptor read/8, error -71 [ 44.403331][ T9] usb 1-1: device descriptor read/8, error -71 [ 44.453648][ T31] usb 4-1: 0:2 : does not exist [ 44.460632][ T31] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 44.478799][ T31] usb 4-1: USB disconnect, device number 15 [ 44.522496][ T9] usb usb1-port1: unable to enumerate USB device [ 44.550235][ T825] netlink: 16 bytes leftover after parsing attributes in process `syz.1.178'. [ 44.633878][ T838] netlink: 148 bytes leftover after parsing attributes in process `syz.1.184'. [ 44.725674][ T10] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 44.738590][ T10] usb 3-1: USB disconnect, device number 13 [ 45.008209][ T847] netlink: 20 bytes leftover after parsing attributes in process `syz.3.188'. [ 45.021233][ T847] netlink: 20 bytes leftover after parsing attributes in process `syz.3.188'. [ 45.322276][ T10] usb 4-1: new full-speed USB device number 16 using dummy_hcd [ 45.473761][ T10] usb 4-1: config 13 has an invalid interface number: 128 but max is 2 [ 45.482072][ T10] usb 4-1: config 13 has an invalid interface number: 215 but max is 2 [ 45.490701][ T10] usb 4-1: config 13 has no interface number 0 [ 45.497146][ T10] usb 4-1: config 13 has no interface number 2 [ 45.503456][ T10] usb 4-1: config 13 interface 1 altsetting 11 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 45.514427][ T10] usb 4-1: config 13 interface 1 altsetting 11 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 45.525432][ T10] usb 4-1: config 13 interface 1 altsetting 11 endpoint 0x9 has invalid maxpacket 1023, setting to 64 [ 45.536414][ T10] usb 4-1: config 13 interface 1 altsetting 11 has an invalid descriptor for endpoint zero, skipping [ 45.547378][ T10] usb 4-1: config 13 interface 1 altsetting 11 has an invalid descriptor for endpoint zero, skipping [ 45.558421][ T10] usb 4-1: config 13 interface 1 altsetting 11 endpoint 0xF has invalid maxpacket 1024, setting to 64 [ 45.569679][ T10] usb 4-1: config 13 interface 1 altsetting 11 has a duplicate endpoint with address 0xF, skipping [ 45.580474][ T10] usb 4-1: config 13 interface 1 altsetting 11 endpoint 0xC has invalid maxpacket 512, setting to 64 [ 45.591550][ T10] usb 4-1: config 13 interface 1 altsetting 11 has a duplicate endpoint with address 0x3, skipping [ 45.602336][ T10] usb 4-1: config 13 interface 128 altsetting 199 endpoint 0x6 has invalid maxpacket 1024, setting to 64 [ 45.613592][ T10] usb 4-1: config 13 interface 128 altsetting 199 has a duplicate endpoint with address 0x2, skipping [ 45.624592][ T10] usb 4-1: config 13 interface 128 altsetting 199 has an endpoint descriptor with address 0x9B, changing to 0x8B [ 45.636506][ T10] usb 4-1: config 13 interface 128 altsetting 199 endpoint 0x8B has an invalid bInterval 221, changing to 4 [ 45.647980][ T10] usb 4-1: config 13 interface 128 altsetting 199 endpoint 0x8B has invalid maxpacket 3939, setting to 1023 [ 45.659545][ T10] usb 4-1: config 13 interface 128 altsetting 199 has a duplicate endpoint with address 0x83, skipping [ 45.670649][ T10] usb 4-1: config 13 interface 128 altsetting 199 endpoint 0xE has invalid maxpacket 1024, setting to 64 [ 45.681892][ T10] usb 4-1: config 13 interface 128 altsetting 199 has a duplicate endpoint with address 0x3, skipping [ 45.692850][ T10] usb 4-1: config 13 interface 128 altsetting 199 has an invalid descriptor for endpoint zero, skipping [ 45.704007][ T10] usb 4-1: config 13 interface 128 altsetting 199 has a duplicate endpoint with address 0xE, skipping [ 45.715041][ T10] usb 4-1: config 13 interface 128 altsetting 199 has a duplicate endpoint with address 0x6, skipping [ 45.726054][ T10] usb 4-1: config 13 interface 128 altsetting 199 has a duplicate endpoint with address 0x2, skipping [ 45.737029][ T10] usb 4-1: config 13 interface 128 altsetting 199 has a duplicate endpoint with address 0x2, skipping [ 45.748087][ T10] usb 4-1: config 13 interface 128 altsetting 199 has a duplicate endpoint with address 0x4, skipping [ 45.759059][ T10] usb 4-1: config 13 interface 128 altsetting 199 has a duplicate endpoint with address 0xB, skipping [ 45.770179][ T10] usb 4-1: config 13 interface 128 altsetting 199 has 15 endpoint descriptors, different from the interface descriptor's value: 14 [ 45.783798][ T10] usb 4-1: config 13 interface 215 altsetting 3 endpoint 0x1 has invalid wMaxPacketSize 0 [ 45.793807][ T10] usb 4-1: config 13 interface 1 has no altsetting 0 [ 45.800487][ T10] usb 4-1: config 13 interface 128 has no altsetting 0 [ 45.807470][ T10] usb 4-1: config 13 interface 215 has no altsetting 0 [ 45.817845][ T10] usb 4-1: New USB device found, idVendor=1286, idProduct=2052, bcdDevice= 8.11 [ 45.827349][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 45.835398][ T10] usb 4-1: Product: ф [ 45.839484][ T10] usb 4-1: Manufacturer: ␊ [ 45.844148][ T10] usb 4-1: SerialNumber: ࠄ [ 45.849779][ T849] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 45.857140][ T849] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 45.984710][ T884] SELinux: policydb magic number 0x70603 does not match expected magic number 0xf97cff8c [ 45.994952][ T884] SELinux: failed to load policy [ 46.062340][ T469] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 46.071354][ T10] usbhid 4-1:13.128: couldn't find an input interrupt endpoint [ 46.083431][ T10] usb 4-1: USB disconnect, device number 16 [ 46.223510][ T469] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 46.234502][ T469] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 46.244272][ T67] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 46.251879][ T469] usb 3-1: New USB device found, idVendor=1e7d, idProduct=30d4, bcdDevice= 0.01 [ 46.261047][ T469] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 46.269792][ T469] usb 3-1: config 0 descriptor?? [ 46.299716][ T891] raw_sendmsg: syz.1.205 forgot to set AF_INET. Fix it! [ 46.412309][ T67] usb 1-1: Using ep0 maxpacket: 16 [ 46.418882][ T67] usb 1-1: unable to get BOS descriptor or descriptor too short [ 46.427356][ T67] usb 1-1: config 1 interface 0 altsetting 9 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 46.440367][ T67] usb 1-1: config 1 interface 0 has no altsetting 0 [ 46.448420][ T67] usb 1-1: New USB device found, idVendor=060b, idProduct=0001, bcdDevice= 0.40 [ 46.457541][ T67] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 46.465563][ T67] usb 1-1: Product: syz [ 46.469739][ T67] usb 1-1: Manufacturer: syz [ 46.474347][ T67] usb 1-1: SerialNumber: syz [ 46.476810][ T880] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 46.487559][ T880] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 46.701645][ T67] usbhid 1-1:1.0: can't add hid device: -71 [ 46.707655][ T67] usbhid 1-1:1.0: probe with driver usbhid failed with error -71 [ 46.717205][ T67] usb 1-1: USB disconnect, device number 14 [ 46.856563][ T469] arvo 0003:1E7D:30D4.0005: unknown main item tag 0x0 [ 46.863551][ T469] arvo 0003:1E7D:30D4.0005: unknown main item tag 0x0 [ 46.870336][ T469] arvo 0003:1E7D:30D4.0005: unknown main item tag 0x0 [ 46.877262][ T469] arvo 0003:1E7D:30D4.0005: unknown main item tag 0x0 [ 46.884077][ T469] arvo 0003:1E7D:30D4.0005: unknown main item tag 0x0 [ 46.890966][ T469] arvo 0003:1E7D:30D4.0005: unknown main item tag 0x0 [ 46.897883][ T469] arvo 0003:1E7D:30D4.0005: collection stack underflow [ 46.905019][ T469] arvo 0003:1E7D:30D4.0005: item 0 0 0 12 parsing failed [ 46.912152][ T469] arvo 0003:1E7D:30D4.0005: parse failed [ 46.917842][ T469] arvo 0003:1E7D:30D4.0005: probe with driver arvo failed with error -22 [ 47.119493][ T907] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 47.142192][ T909] FAULT_INJECTION: forcing a failure. [ 47.142192][ T909] name failslab, interval 1, probability 0, space 0, times 0 [ 47.154865][ T909] CPU: 1 UID: 0 PID: 909 Comm: syz.3.211 Not tainted syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 47.154896][ T909] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 47.154907][ T909] Call Trace: [ 47.154913][ T909] [ 47.154920][ T909] __dump_stack+0x21/0x30 [ 47.154945][ T909] dump_stack_lvl+0x140/0x1c0 [ 47.154959][ T909] ? __cfi_dump_stack_lvl+0x10/0x10 [ 47.154976][ T909] ? ovl_lookup_single+0x8a6/0xb20 [ 47.155000][ T909] dump_stack+0x19/0x20 [ 47.155023][ T909] should_fail_ex+0x3c2/0x510 [ 47.155037][ T909] ? ovl_stack_alloc+0x31/0xb0 [ 47.155050][ T909] should_failslab+0xac/0x100 [ 47.155063][ T909] __kmalloc_noprof+0x69/0x510 [ 47.155073][ T909] ? ovl_lookup_layer+0x355/0x420 [ 47.155086][ T909] ? ovl_stack_alloc+0x31/0xb0 [ 47.155099][ T909] ovl_stack_alloc+0x31/0xb0 [ 47.155112][ T909] ovl_lookup+0x596/0x1d20 [ 47.155126][ T909] ? __cfi_ovl_lookup+0x10/0x10 [ 47.155138][ T909] ? __kasan_check_write+0x18/0x20 [ 47.155148][ T909] ? _raw_spin_lock+0x92/0x120 [ 47.155160][ T909] ? __cfi__raw_spin_lock+0x10/0x10 [ 47.155171][ T909] ? d_alloc+0x174/0x1c0 [ 47.155181][ T909] lookup_one_qstr_excl+0x12c/0x280 [ 47.155193][ T909] do_renameat2+0x3e0/0xc30 [ 47.155202][ T909] ? __virt_addr_valid+0x2a1/0x370 [ 47.155216][ T909] ? __cfi_do_renameat2+0x10/0x10 [ 47.155225][ T909] ? __kasan_check_write+0x18/0x20 [ 47.155235][ T909] ? getname_flags+0x203/0x6b0 [ 47.155246][ T909] __x64_sys_renameat2+0xdc/0x100 [ 47.155255][ T909] x64_sys_call+0x2e18/0x2ee0 [ 47.155265][ T909] do_syscall_64+0x57/0xf0 [ 47.155283][ T909] ? clear_bhb_loop+0x50/0xa0 [ 47.155297][ T909] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 47.155310][ T909] RIP: 0033:0x7f7210d9e0d9 [ 47.155320][ T909] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 47.155329][ T909] RSP: 002b:00007f7211c05028 EFLAGS: 00000246 ORIG_RAX: 000000000000013c [ 47.155342][ T909] RAX: ffffffffffffffda RBX: 00007f7211025fa0 RCX: 00007f7210d9e0d9 [ 47.155349][ T909] RDX: ffffffffffffff9c RSI: 0000200000000780 RDI: ffffffffffffff9c [ 47.155357][ T909] RBP: 00007f7211c05090 R08: 0000000000000000 R09: 0000000000000000 [ 47.155364][ T909] R10: 0000200000000140 R11: 0000000000000246 R12: 0000000000000001 [ 47.155371][ T909] R13: 00007f7211026038 R14: 00007f7211025fa0 R15: 00007ffc950858e8 [ 47.155379][ T909] [ 47.412670][ T914] tipc: Cannot configure node identity twice [ 47.423256][ T914] tipc: New replicast peer: 127.0.0.1 [ 47.429020][ T914] tipc: Enabled bearer , priority 10 [ 47.483634][ T36] kauditd_printk_skb: 11 callbacks suppressed [ 47.483653][ T36] audit: type=1400 audit(1786033013.850:295): avc: denied { write } for pid=918 comm="syz.0.215" name="rtc0" dev="devtmpfs" ino=195 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 47.692307][ T10] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 47.843434][ T10] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 47.853158][ T10] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 47.865235][ T10] usb 4-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01 [ 47.874352][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 47.882396][ T10] usb 4-1: Product: syz [ 47.886555][ T10] usb 4-1: Manufacturer: syz [ 47.891138][ T10] usb 4-1: SerialNumber: syz [ 47.897844][ T10] ums-karma 4-1:1.0: USB Mass Storage device detected [ 47.905425][ T10] ums-karma 4-1:1.0: This device (045a,5210,0101 S 06 P f5) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel syzkaller) [ 47.905425][ T10] Please send a copy of this message to and [ 47.944773][ T10] ums-karma 4-1:1.0: probe with driver ums-karma failed with error -5 [ 48.099413][ T10] usb 4-1: USB disconnect, device number 17 [ 48.140056][ T952] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=952 comm=syz.0.227 [ 48.462307][ T390] usb 1-1: new full-speed USB device number 15 using dummy_hcd [ 48.552320][ T469] tipc: Node number set to 1835041767 [ 48.614823][ T390] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 48.625146][ T390] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 48.635007][ T390] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 48.644434][ T390] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 48.652665][ T390] usb 1-1: SerialNumber: syz [ 48.659391][ T390] usb 1-1: 0:2 : does not exist [ 48.852529][ T469] usb 3-1: USB disconnect, device number 14 [ 48.872337][ T320] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 48.885808][ T957] rust_binder: Write failure EINVAL in pid:136 [ 48.888000][ T957] binder: Bad value for 'max' [ 48.888835][ T36] audit: type=1400 audit(1786033015.250:296): avc: denied { search } for pid=967 comm="syz.2.234" name="/" dev="configfs" ino=2491 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 48.896692][ T968] UDC core: g1: couldn't find an available UDC or it's busy [ 48.899564][ T36] audit: type=1400 audit(1786033015.250:297): avc: denied { write } for pid=967 comm="syz.2.234" name="usb_gadget" dev="configfs" ino=2492 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 48.953208][ T390] usb 1-1: USB disconnect, device number 15 [ 48.954825][ T36] audit: type=1400 audit(1786033015.250:298): avc: denied { add_name } for pid=967 comm="syz.2.234" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 48.983390][ T36] audit: type=1400 audit(1786033015.250:299): avc: denied { create } for pid=967 comm="syz.2.234" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 49.003210][ T36] audit: type=1400 audit(1786033015.260:300): avc: denied { write } for pid=967 comm="syz.2.234" name="id" dev="configfs" ino=22688 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 49.025391][ T36] audit: type=1400 audit(1786033015.260:301): avc: denied { open } for pid=967 comm="syz.2.234" path="/47/config/usb_gadget/g1/functions/midi.usb0/id" dev="configfs" ino=22688 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 49.051834][ T36] audit: type=1400 audit(1786033015.260:302): avc: denied { create } for pid=967 comm="syz.2.234" name="midi.usb0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=lnk_file permissive=1 [ 49.072945][ T320] usb 4-1: Using ep0 maxpacket: 16 [ 49.078137][ T36] audit: type=1400 audit(1786033015.290:303): avc: denied { read } for pid=967 comm="syz.2.234" name="id" dev="configfs" ino=22688 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 49.101609][ T320] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 8 [ 49.112553][ T320] usb 4-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 6.00 [ 49.121693][ T320] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 49.129846][ T320] usb 4-1: Product: syz [ 49.134180][ T320] usb 4-1: Manufacturer: syz [ 49.138800][ T320] usb 4-1: SerialNumber: syz [ 49.143809][ T36] audit: type=1400 audit(1786033015.510:304): avc: denied { unmount } for pid=296 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 49.164471][ T320] usb 4-1: config 0 descriptor?? [ 49.170614][ T320] ftdi_sio 4-1:0.0: FTDI USB Serial Device converter detected [ 49.178684][ T320] usb 4-1: Detected FT232R [ 49.370428][ T320] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 49.578184][ T961] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 49.586762][ T961] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 49.596715][ T320] usb 4-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 49.652348][ T390] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 49.712296][ T469] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 49.782334][ T390] usb 3-1: device descriptor read/64, error -71 [ 49.842352][ T469] usb 1-1: device descriptor read/64, error -71 [ 50.022346][ T390] usb 3-1: device descriptor read/64, error -71 [ 50.082292][ T469] usb 1-1: device descriptor read/64, error -71 [ 50.272329][ T390] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 50.322310][ T469] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 50.402344][ T390] usb 3-1: device descriptor read/64, error -71 [ 50.452332][ T469] usb 1-1: device descriptor read/64, error -71 [ 50.637705][ T1015] 9pnet_fd: Insufficient options for proto=fd [ 50.643951][ T390] usb 3-1: device descriptor read/64, error -71 [ 50.692359][ T469] usb 1-1: device descriptor read/64, error -71 [ 50.752442][ T390] usb usb3-port1: attempt power cycle [ 50.803000][ T469] usb usb1-port1: attempt power cycle [ 51.092327][ T390] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 51.113289][ T390] usb 3-1: device descriptor read/8, error -71 [ 51.142327][ T469] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 51.163449][ T469] usb 1-1: device descriptor read/8, error -71 [ 51.243599][ T390] usb 3-1: device descriptor read/8, error -71 [ 51.293408][ T469] usb 1-1: device descriptor read/8, error -71 [ 51.492289][ T390] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 51.524218][ T390] usb 3-1: device descriptor read/8, error -71 [ 51.532499][ T469] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 51.553527][ T469] usb 1-1: device descriptor read/8, error -71 [ 51.646345][ T9] usb 4-1: USB disconnect, device number 18 [ 51.655698][ T390] usb 3-1: device descriptor read/8, error -71 [ 51.665296][ T9] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 51.676842][ T9] ftdi_sio 4-1:0.0: device disconnected [ 51.693322][ T469] usb 1-1: device descriptor read/8, error -71 [ 51.736768][ T1033] can0: slcan on ptm1. [ 51.762471][ T390] usb usb3-port1: unable to enumerate USB device [ 51.779359][ T1045] syz.1.263 uses obsolete (PF_INET,SOCK_PACKET) [ 51.787322][ T1032] can0 (unregistered): slcan off ptm1. [ 51.803504][ T469] usb usb1-port1: unable to enumerate USB device [ 51.863078][ T1057] bpf: Bad value for 'gid' [ 51.868040][ T1057] rust_binder: 1056:1057 error while translating object: EPERM [ 51.876634][ T1057] rust_binder: Failure in copy_transaction_data: EPERM [ 51.876662][ T1057] rust_binder: 1056:1057 transaction call to 1056:0 failed EPERM, code 0 size 88-24 [ 51.898568][ T320] rust_binder: 1056: undelivered TRANSACTION_ERROR: 29201 [ 51.965310][ T1073] veth1_macvtap: left promiscuous mode [ 51.970813][ T1073] macsec0: entered promiscuous mode [ 51.976449][ T1073] macsec0: entered allmulticast mode [ 51.988726][ T1073] veth1_macvtap: entered promiscuous mode [ 51.992572][ T1076] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=34 sclass=netlink_tcpdiag_socket pid=1076 comm=syz.3.269 [ 51.997896][ T1073] veth1_macvtap: entered allmulticast mode [ 52.022430][ T1073] macsec0: left promiscuous mode [ 52.028988][ T1073] macsec0: left allmulticast mode [ 52.034225][ T1073] veth1_macvtap: left allmulticast mode [ 52.055813][ T1073] netlink: 'syz.1.268': attribute type 11 has an invalid length. [ 52.076925][ T1087] netlink: 'syz.1.270': attribute type 12 has an invalid length. [ 52.252333][ T9] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 52.402303][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 52.408798][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 52.417462][ T9] usb 4-1: config 8 has an invalid interface number: 43 but max is 1 [ 52.425761][ T9] usb 4-1: config 8 has an invalid interface number: 35 but max is 1 [ 52.437742][ T9] usb 4-1: config 8 has no interface number 0 [ 52.443942][ T9] usb 4-1: config 8 has no interface number 1 [ 52.450044][ T9] usb 4-1: config 8 interface 43 altsetting 17 has an endpoint descriptor with address 0xE5, changing to 0x85 [ 52.461975][ T9] usb 4-1: config 8 interface 43 altsetting 17 bulk endpoint 0x85 has invalid maxpacket 64 [ 52.464194][ T1094] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=37 sclass=netlink_tcpdiag_socket pid=1094 comm=syz.2.273 [ 52.472188][ T9] usb 4-1: config 8 interface 43 altsetting 17 bulk endpoint 0x4 has invalid maxpacket 8 [ 52.500430][ T9] usb 4-1: config 8 interface 43 has no altsetting 0 [ 52.521832][ T9] usb 4-1: config 8 interface 35 has no altsetting 0 [ 52.531190][ T9] usb 4-1: string descriptor 0 read error: -22 [ 52.539228][ T9] usb 4-1: New USB device found, idVendor=0584, idProduct=0008, bcdDevice= 1.02 [ 52.549234][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 52.559549][ T1076] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 52.566792][ T1076] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 52.575336][ T9] ums-alauda 4-1:8.43: USB Mass Storage device detected [ 52.584481][ T9] scsi host1: usb-storage 4-1:8.43 [ 52.600880][ T1103] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 52.603447][ T9] hub 4-1:8.35: Invalid hub with more than one config or interface [ 52.632277][ T9] hub 4-1:8.35: probe with driver hub failed with error -22 [ 52.639822][ T9] ums-alauda 4-1:8.35: USB Mass Storage device detected [ 52.781885][ T469] usb 4-1: USB disconnect, device number 19 [ 52.826246][ T1111] fuse: root generation should be zero [ 53.492289][ T9] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 53.552291][ T469] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 53.632284][ T9] usb 1-1: device descriptor read/64, error -71 [ 53.702294][ T469] usb 4-1: device descriptor read/64, error -71 [ 53.872294][ T9] usb 1-1: device descriptor read/64, error -71 [ 53.942305][ T469] usb 4-1: device descriptor read/64, error -71 [ 54.122297][ T9] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 54.167871][ T1150] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 54.182326][ T469] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 54.252358][ T9] usb 1-1: device descriptor read/64, error -71 [ 54.290532][ T1153] mmap: syz.2.289 (1153) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 54.312390][ T469] usb 4-1: device descriptor read/64, error -71 [ 54.502329][ T9] usb 1-1: device descriptor read/64, error -71 [ 54.552326][ T469] usb 4-1: device descriptor read/64, error -71 [ 54.613347][ T9] usb usb1-port1: attempt power cycle [ 54.662852][ T469] usb usb4-port1: attempt power cycle [ 54.672312][ T320] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 54.822314][ T320] usb 3-1: Using ep0 maxpacket: 32 [ 54.829168][ T320] usb 3-1: unable to get BOS descriptor or descriptor too short [ 54.837530][ T320] usb 3-1: config 1 has an invalid descriptor of length 48, skipping remainder of the config [ 54.847856][ T320] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 12336, setting to 64 [ 54.860409][ T320] usb 3-1: New USB device found, idVendor=2b53, idProduct=0023, bcdDevice= 0.40 [ 54.869490][ T320] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 54.877586][ T320] usb 3-1: Product: syz [ 54.881940][ T320] usb 3-1: Manufacturer: syz [ 54.886583][ T320] usb 3-1: SerialNumber: syz [ 54.952307][ T9] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 54.973489][ T9] usb 1-1: device descriptor read/8, error -71 [ 55.002321][ T469] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 55.023319][ T469] usb 4-1: device descriptor read/8, error -71 [ 55.094431][ T1171] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 55.103654][ T1171] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 55.115589][ T9] usb 1-1: device descriptor read/8, error -71 [ 55.127531][ T320] usb 3-1: USB disconnect, device number 19 [ 55.153644][ T469] usb 4-1: device descriptor read/8, error -71 [ 55.372336][ T9] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 55.393459][ T9] usb 1-1: device descriptor read/8, error -71 [ 55.402305][ T469] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 55.423325][ T469] usb 4-1: device descriptor read/8, error -71 [ 55.523477][ T9] usb 1-1: device descriptor read/8, error -71 [ 55.553383][ T469] usb 4-1: device descriptor read/8, error -71 [ 55.644526][ T9] usb usb1-port1: unable to enumerate USB device [ 55.662619][ T469] usb usb4-port1: unable to enumerate USB device [ 55.746759][ T36] kauditd_printk_skb: 23 callbacks suppressed [ 55.746776][ T36] audit: type=1400 audit(1786033022.110:328): avc: denied { setopt } for pid=1189 comm="syz.1.301" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 56.337014][ T1213] batadv_slave_1: entered promiscuous mode [ 56.343136][ T1213] batadv_slave_1: left promiscuous mode [ 56.514853][ T1222] netlink: 64 bytes leftover after parsing attributes in process `syz.2.315'. [ 56.622298][ T9] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 56.665649][ T36] audit: type=1400 audit(1786033023.030:329): avc: denied { setopt } for pid=1225 comm="syz.1.317" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 56.685123][ T36] audit: type=1400 audit(1786033023.040:330): avc: denied { setopt } for pid=1225 comm="syz.1.317" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 56.704704][ T36] audit: type=1400 audit(1786033023.050:331): avc: denied { bind } for pid=1225 comm="syz.1.317" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 56.724281][ T395] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 56.763240][ T1229] can: request_module (can-proto-6) failed. [ 56.802294][ T320] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 56.809891][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 56.816104][ T9] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 56.827180][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 56.840387][ T9] usb 1-1: New USB device found, idVendor=056a, idProduct=0013, bcdDevice= 0.00 [ 56.849826][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 56.858956][ T9] usb 1-1: config 0 descriptor?? [ 56.878940][ T1239] overlayfs: failed to clone upperpath [ 56.885666][ T395] usb 4-1: config 0 interface 0 altsetting 1 endpoint 0x81 has invalid maxpacket 1056, setting to 1024 [ 56.897215][ T395] usb 4-1: config 0 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 12 [ 56.910592][ T395] usb 4-1: config 0 interface 0 has no altsetting 0 [ 56.913215][ T1241] overlayfs: failed to clone upperpath [ 56.917770][ T395] usb 4-1: New USB device found, idVendor=1294, idProduct=1320, bcdDevice= 0.00 [ 56.932014][ T395] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 56.944097][ T395] usb 4-1: config 0 descriptor?? [ 56.948253][ T1243] overlayfs: failed to resolve './file0': -2 [ 56.949386][ T1216] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 56.962257][ T320] usb 3-1: Using ep0 maxpacket: 16 [ 56.963451][ T395] usbhid 4-1:0.0: fixing wrong optional hid class descriptors count [ 56.970641][ T320] usb 3-1: config 0 has an invalid interface number: 32 but max is 0 [ 56.983789][ T320] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 56.993984][ T320] usb 3-1: config 0 has no interface number 0 [ 57.001716][ T320] usb 3-1: New USB device found, idVendor=0fe6, idProduct=9700, bcdDevice=d1.9a [ 57.010881][ T320] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 57.019121][ T320] usb 3-1: Product: syz [ 57.023402][ T320] usb 3-1: Manufacturer: syz [ 57.027993][ T320] usb 3-1: SerialNumber: syz [ 57.037473][ T320] usb 3-1: config 0 descriptor?? [ 57.044450][ T320] sr9700 3-1:0.32: probe with driver sr9700 failed with error -22 [ 57.249566][ T10] usb 3-1: USB disconnect, device number 20 [ 57.278197][ T9] usbhid 1-1:0.0: can't add hid device: -71 [ 57.284328][ T9] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 57.296123][ T9] usb 1-1: USB disconnect, device number 24 [ 57.353836][ T1256] FAULT_INJECTION: forcing a failure. [ 57.353836][ T1256] name failslab, interval 1, probability 0, space 0, times 0 [ 57.366602][ T1256] CPU: 1 UID: 0 PID: 1256 Comm: syz.0.330 Not tainted syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 57.366632][ T1256] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 57.366643][ T1256] Call Trace: [ 57.366649][ T1256] [ 57.366656][ T1256] __dump_stack+0x21/0x30 [ 57.366684][ T1256] dump_stack_lvl+0x140/0x1c0 [ 57.366706][ T1256] ? __cfi_dump_stack_lvl+0x10/0x10 [ 57.366729][ T1256] ? cgroup_bpf_inherit+0x472/0x4c0 [ 57.366757][ T1256] dump_stack+0x19/0x20 [ 57.366780][ T1256] should_fail_ex+0x3c2/0x510 [ 57.366801][ T1256] should_failslab+0xac/0x100 [ 57.366825][ T1256] __kmalloc_cache_noprof+0x41/0x470 [ 57.366844][ T1256] ? cgroup_mkdir+0xbe2/0x1600 [ 57.366866][ T1256] cgroup_mkdir+0xbe2/0x1600 [ 57.366889][ T1256] ? __cfi_cgroup_mkdir+0x10/0x10 [ 57.366909][ T1256] kernfs_iop_mkdir+0x1be/0x2d0 [ 57.366934][ T1256] vfs_mkdir+0x591/0x810 [ 57.366958][ T1256] do_mkdirat+0x240/0x530 [ 57.366979][ T1256] ? __cfi_do_mkdirat+0x10/0x10 [ 57.367000][ T1256] ? __kasan_check_write+0x18/0x20 [ 57.367016][ T1256] ? getname_flags+0x203/0x6b0 [ 57.367034][ T1256] ? __kasan_check_read+0x15/0x20 [ 57.367051][ T1256] __x64_sys_mkdirat+0x8b/0xa0 [ 57.367073][ T1256] x64_sys_call+0x2ba8/0x2ee0 [ 57.367089][ T1256] do_syscall_64+0x57/0xf0 [ 57.367109][ T1256] ? clear_bhb_loop+0x50/0xa0 [ 57.367132][ T1256] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 57.367154][ T1256] RIP: 0033:0x7f769c79e0d9 [ 57.367171][ T1256] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 57.367188][ T1256] RSP: 002b:00007f769d743028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 57.367209][ T1256] RAX: ffffffffffffffda RBX: 00007f769ca25fa0 RCX: 00007f769c79e0d9 [ 57.367225][ T1256] RDX: 14e174135c0b87af RSI: 0000200000000040 RDI: ffffffffffffff9c [ 57.367240][ T1256] RBP: 00007f769d743090 R08: 0000000000000000 R09: 0000000000000000 [ 57.367253][ T1256] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 57.367275][ T1256] R13: 00007f769ca26038 R14: 00007f769ca25fa0 R15: 00007ffeb77eab68 [ 57.367292][ T1256] [ 57.367384][ T1256] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000021: 0000 [#1] PREEMPT SMP KASAN PTI [ 57.369264][ T395] hid-led 0003:1294:1320.0006: unknown main item tag 0x0 [ 57.378850][ T1256] KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f] [ 57.378871][ T1256] CPU: 1 UID: 0 PID: 1256 Comm: syz.0.330 Not tainted syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 57.378893][ T1256] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 57.378904][ T1256] RIP: 0010:cgroup_mkdir+0x122a/0x1600 [ 57.378931][ T1256] Code: eb 05 e8 69 4d 08 00 48 89 df e8 11 9e 00 00 48 81 fb 01 f0 ff ff 0f 83 9a fb ff ff 4c 8d b3 08 01 00 00 4d 89 f4 49 c1 ec 03 <43> 80 3c 2c 00 74 08 4c 89 f7 e8 a7 11 61 00 48 8b bb 08 01 00 00 [ 57.378945][ T1256] RSP: 0018:ffffc9000fa67c88 EFLAGS: 00010206 [ 57.378961][ T1256] RAX: 92aeaf22bad12b00 RBX: 0000000000000000 RCX: ffff8881f6f3acc0 [ 57.389523][ T395] hid-led 0003:1294:1320.0006: unknown main item tag 0x0 [ 57.392339][ T1256] RDX: ffff888106770580 RSI: ffff88812f917000 RDI: ffff888100042000 [ 57.392356][ T1256] RBP: ffffc9000fa67d38 R08: ffffffff81dbe738 R09: ffffffff81e0041f [ 57.392369][ T1256] R10: ffffffff81e02f04 R11: ffffffff81dfff3e R12: 0000000000000021 [ 57.392381][ T1256] R13: dffffc0000000000 R14: 0000000000000108 R15: ffff88812f917010 [ 57.392394][ T1256] FS: 00007f769d7436c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 57.398391][ T36] audit: type=1400 audit(1786033023.760:332): avc: denied { read } for pid=93 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 57.399639][ T1256] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 57.399655][ T1256] CR2: 00007f769c670000 CR3: 0000000116ea4000 CR4: 00000000003526b0 [ 57.404599][ T395] hid-led 0003:1294:1320.0006: unknown main item tag 0x0 [ 57.409524][ T1256] Call Trace: [ 57.409534][ T1256] [ 57.414814][ T36] audit: type=1400 audit(1786033023.760:333): avc: denied { search } for pid=93 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 57.418833][ T1256] ? __cfi_cgroup_mkdir+0x10/0x10 [ 57.424191][ T395] hid-led 0003:1294:1320.0006: unknown main item tag 0x0 [ 57.428131][ T1256] kernfs_iop_mkdir+0x1be/0x2d0 [ 57.433723][ T36] audit: type=1400 audit(1786033023.760:334): avc: denied { write } for pid=93 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 57.438298][ T1256] vfs_mkdir+0x591/0x810 [ 57.443158][ T395] hid-led 0003:1294:1320.0006: unknown main item tag 0x0 [ 57.447857][ T1256] do_mkdirat+0x240/0x530 [ 57.452986][ T36] audit: type=1400 audit(1786033023.760:335): avc: denied { add_name } for pid=93 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 57.456932][ T1256] ? __cfi_do_mkdirat+0x10/0x10 [ 57.461258][ T36] audit: type=1400 audit(1786033023.760:336): avc: denied { create } for pid=93 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 57.466076][ T1256] ? __kasan_check_write+0x18/0x20 [ 57.466100][ T1256] ? getname_flags+0x203/0x6b0 [ 57.466117][ T1256] ? __kasan_check_read+0x15/0x20 [ 57.466133][ T1256] __x64_sys_mkdirat+0x8b/0xa0 [ 57.471965][ T395] hid-led 0003:1294:1320.0006: unknown main item tag 0x0 [ 57.475966][ T1256] x64_sys_call+0x2ba8/0x2ee0 [ 57.475989][ T1256] do_syscall_64+0x57/0xf0 [ 57.476009][ T1256] ? clear_bhb_loop+0x50/0xa0 [ 57.481031][ T395] hid-led 0003:1294:1320.0006: unknown main item tag 0x0 [ 57.485747][ T1256] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 57.485771][ T1256] RIP: 0033:0x7f769c79e0d9 [ 57.485787][ T1256] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 57.490863][ T36] audit: type=1400 audit(1786033023.760:337): avc: denied { append open } for pid=93 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 57.494833][ T1256] RSP: 002b:00007f769d743028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 57.494854][ T1256] RAX: ffffffffffffffda RBX: 00007f769ca25fa0 RCX: 00007f769c79e0d9 [ 57.494867][ T1256] RDX: 14e174135c0b87af RSI: 0000200000000040 RDI: ffffffffffffff9c [ 57.494881][ T1256] RBP: 00007f769d743090 R08: 0000000000000000 R09: 0000000000000000 [ 57.494892][ T1256] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 57.494903][ T1256] R13: 00007f769ca26038 R14: 00007f769ca25fa0 R15: 00007ffeb77eab68 [ 57.494919][ T1256] [ 57.494927][ T1256] Modules linked in: [ 57.500021][ T395] hid-led 0003:1294:1320.0006: unknown main item tag 0x0 [ 57.505447][ T1256] [ 57.505560][ T1256] ---[ end trace 0000000000000000 ]--- [ 57.510064][ T395] hid-led 0003:1294:1320.0006: unknown main item tag 0x0 [ 57.529657][ T1256] RIP: 0010:cgroup_mkdir+0x122a/0x1600 [ 57.543600][ T395] hid-led 0003:1294:1320.0006: unknown main item tag 0x0 [ 57.548421][ T1256] Code: eb 05 e8 69 4d 08 00 48 89 df e8 11 9e 00 00 48 81 fb 01 f0 ff ff 0f 83 9a fb ff ff 4c 8d b3 08 01 00 00 4d 89 f4 49 c1 ec 03 <43> 80 3c 2c 00 74 08 4c 89 f7 e8 a7 11 61 00 48 8b bb 08 01 00 00 [ 57.554395][ T395] hid-led 0003:1294:1320.0006: unknown main item tag 0x0 [ 57.564374][ T1256] RSP: 0018:ffffc9000fa67c88 EFLAGS: 00010206 [ 57.578101][ T395] hid-led 0003:1294:1320.0006: unknown main item tag 0x0 [ 57.581261][ T1256] [ 57.594736][ T395] hid-led 0003:1294:1320.0006: unknown main item tag 0x0 [ 57.603599][ T1256] RAX: 92aeaf22bad12b00 RBX: 0000000000000000 RCX: ffff8881f6f3acc0 [ 57.610029][ T395] hid-led 0003:1294:1320.0006: unknown main item tag 0x0 [ 57.621024][ T1256] RDX: ffff888106770580 RSI: ffff88812f917000 RDI: ffff888100042000 [ 57.631674][ T1216] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 57.637126][ T1256] RBP: ffffc9000fa67d38 R08: ffffffff81dbe738 R09: ffffffff81e0041f [ 57.657223][ T1216] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 57.662737][ T1256] R10: ffffffff81e02f04 R11: ffffffff81dfff3e R12: 0000000000000021 [ 57.670805][ T395] hid-led 0003:1294:1320.0006: unknown main item tag 0x0 [ 57.677525][ T1256] R13: dffffc0000000000 R14: 0000000000000108 R15: ffff88812f917010 [ 57.685973][ T395] hid-led 0003:1294:1320.0006: unknown main item tag 0x0 [ 57.695064][ T1256] FS: 00007f769d7436c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 57.702019][ T395] hid-led 0003:1294:1320.0006: unknown main item tag 0x0 [ 57.709549][ T1256] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 57.718498][ T395] hid-led 0003:1294:1320.0006: unknown main item tag 0x0 [ 57.740167][ T1256] CR2: 00007ff86bfedeb8 CR3: 0000000116ea4000 CR4: 00000000003526b0 [ 57.746935][ T395] hid-led 0003:1294:1320.0006: unknown main item tag 0x0 [ 57.754751][ T1256] Kernel panic - not syncing: Fatal exception [ 57.761902][ T1256] Kernel Offset: disabled