last executing test programs: 5.712725866s ago: executing program 3 (id=10): socket$packet(0x11, 0x2, 0x300) (async) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x9, 0x0, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f00005f5000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYRESOCT=r1], 0x70}}, 0x4048000) syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000009b7e8405e048302009901e40201030227000100000000090400fb015cc7aa00090509"], 0x0) 5.476313388s ago: executing program 1 (id=12): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = inotify_init1(0x800) inotify_add_watch(r0, &(0x7f0000000240)='./file0\x00', 0xc0) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8c) r2 = openat$incfs(r1, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) ioctl$TIOCL_GETKMSGREDIRECT(r2, 0xc058671e, &(0x7f00000000c0)) (fail_nth: 33) 5.076665373s ago: executing program 1 (id=14): r0 = socket$inet(0x2, 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00') r2 = openat$cgroup_ro(r1, &(0x7f00000002c0)='net_prio.prioidx\x00', 0x0, 0x0) clock_gettime(0x766293fdc5a3d1bd, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x88840, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000fce000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x4d, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r5, 0x4080aebf, &(0x7f0000003680)=@vmx={0x3, 0x0, 0x2080, {0x0, 0x0, {0x3}, 0x0, 0x1}, {"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008bc584c800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001f6f38740000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a4900"}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x1c1) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r8 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r8, &(0x7f0000000140)=[{&(0x7f0000000340)="5800000014001923fc834b80040d8c560a067f020000000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd001a0010000100080c1000000a000000000000", 0x58}], 0x1) r9 = dup(r7) r10 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/wake_unlock', 0x0, 0x180) read$FUSE(r10, &(0x7f0000002080)={0x2020}, 0x1edc) setsockopt$packet_int(r10, 0x107, 0x8, &(0x7f0000000080)=0x400, 0x4) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0}, &(0x7f00000003c0)=0xc) mount$9p_fd(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000640), 0x4000, &(0x7f0000000440)=ANY=[@ANYBLOB="747276c0325b6e733d66642c72667d6e6f3d", @ANYRESHEX=r6, @ANYBLOB=',wfdno=', @ANYRESHEX=r9, @ANYBLOB=',access=', @ANYRESDEC=r11, @ANYBLOB="2c64040385d56bf34c0100000000ed690040", @ANYRESHEX=r11, @ANYBLOB=',\x00']) r12 = socket$netlink(0x10, 0x3, 0x0) r13 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) ioctl$sock_SIOCGIFINDEX_80211(r12, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_BEACON(r2, &(0x7f0000005700)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x88401000}, 0xc, &(0x7f0000002040)={&(0x7f00000012c0)=ANY=[@ANYBLOB="f80c0000", @ANYRES16=0x0, @ANYBLOB="02002cbd7000fddbdf250e00000008000300", @ANYRES32=r14, @ANYBLOB="0c009900090000001c0000008c000f000286040f082066436769e850638f43e7e939034ec3c0e8839327c5c0fbc22b79747bec6f5b36d08bccacdd7bf3e91a38712574a6f59bab88cd53f370fbf26950948579528e20f48a4f29e60a2d5b19100199ab048ab3546568453e4d3c196cc9db915d7e34a8c4f1ec3f451d3eb4a8850a71b60b01564fdfde26744fea81a3fdf63d268d9ba8ff0c49017f00760605022400b5d3849c080a000802110000000c000000120000ffffffffffff010000001a0000ffffffffffff01000000340040ffffffffffff00020000080211000001020000ffffffffffff050000003c0040ffffffffffffff0700600df07b90ae9b65004008021100000048620000ffffffffffff2c00000802110000010100000025000008021100000005000000340040080211000000060000000802110000000300822b400001050000000802110000010000000008021100000009000000090000000101ffffffffffff02000000dd709654ef30cf8e0aaeae767220322a380fe6f8b17ce62fdefe0950035d01a395e729c13e801706f474fafb37ca90d69dd14f4cec4f6f6265284269876b4c046823716ecaaebb42dd7f5b9fe2021614d12cf2405753b856eab83b554667dccbe6870b1cafc591132db4805ae36d77131b71000000de000e00803c2c00ffffffffffff0802110000005050505050505904060000000000000007000000030164060209003c0400010080710700ffff00ff06097606d60726000200dd96306010d29f373e4b7fdfe7656599fa0d94b521d27b839496d2c1b2e6c461ecaa7988a0272429601ed2ffdd400ec69cbbd5d3c985aa9a78369121a0d9546ed9b0abd6b9a17ed454d3bf32e24e59b9cc0620523f90315a8e61eab0e0affab43940c8e957b201fd9e5ac76b243d37605b72bc1b98020808f4b706242942ff3be75d9f102c006a89d74817bdadb8deee571946582d3c0a5300000e007f006804040001000102020300005a012a00843b0e1300080211000000090000000c004008021100000104000000080211000001010000ffffffffffff010000000a0000080211000001000000800700400802110000000100000008021100000140004008021100000106000000080211000000300040080211000001010100000802110000013f0040080211000000b0390000080211000000250040080211000000020000000802110000002a000008021100000107000000000040ffffffffffff02000000ffffffffffff42000008021100000005000000320000ffffffffffff030000000b0040ffffffffffff8bb50000ffffffffffff030040ffffffffffff0300000008021100000136004008021100000101040000ffffffffffff350000080211000000ffffff7f01004008021100000108000000080211000001360000ffffffffffff000000002000bd06ffffffffffff710700ffffff000f2100060101010101010000f8000e80f40003009d5bc9a7c1dc8672043b359379b30baf1b955ce07861c2584230eb7909020294742ca699a0130ed94ecf3476f0c8ccea7cab1e3f564fad8251ab8069f87980d63859ac0c9365572387e273e32d056326dcc9ec0e59e8402b2914e06154c35ef2ee9aed6d43056af0db0c6d03dfe73a4dfa1c84f7d677cbab4a4bdc4b37154956b1a0c21c694075164e1ec8e16fbff450306b329f8493b10c8ad52fc5e0a38672be1b08cd4530f1df9133d281a2268594605b1d038dc6a7434caf052eaa5c0c39612de29f78ace062d3c14669d77aba328ef5218ac1499ac1328ac5207574810ccd18c1b4c956aa9d281f51f0529c628c0201800076061205400000000602290005ce9b47ad440d5c8d988b58bfefde210c01c2114beceaceda9cd0f9be452f6015c6ea7b1c31215f3530173ef4700f0a65426d2eba3e54efffe0eabc208679fde8a4c67c2ae85042485e362aae8a55a563b2ba50fd29769ce8148cb36d6db2511a3945d124e26b1b2d9fa84e84f35e893516568b93f207d9715e85dce4525dc317babdf4f672ecffa950212443026e27090a93c3bdcaa2fe4268c329ff184f760ad4e9cba612fc8795fe021259192498a6f57256eec68c6f85946456cb31b4a0c0ccb1077c5f3b82b27da7066446183376060a043a00f4ff2503012807720603030303030310015f0301b501059282028b1800008f008000680401004800dd2e00fedbc041e7f668a3f15244dcd363d1472b69b43c00898473193f68d39138d2adc301fe9d8af1528edbe59c03d78c10bf0376200c3d973b450342e3d2c558c67506010002001e0003010d82364408040300000008021100000009000000ffffffffffff04000000030000000200ffffffffffff0600000001080211000001020000000008000e800400010017060e0080a81b0008021100000008021100000108021100000093000c008fc1060000000000000008000010000601010101010101043618ec1b040640030100050006020a007107010000000200217606ff810a000d00dd634c85e5fc339247b888adefa6d738c4522adf951a495270260ec27ec1354560620c83e65cd57e5b50221165f5dd7d8d809993ec3abc8cae7be42cde3d2b05d3233995d43a7e3d7b0c7ef11208fb81311a138977582b6c553b0647185a11124c0b71d5e4ddbf9b652cca01c77b8a5d64e0c8f772c22c8dd0d3cc8f47a0b0746e4a6ad543ced78d0e2371090536e3274967a2f72cc34cf8eca7305b61cfe8a86c5dd31cb0d6d2c027b1ac68dfebe1f8963571d00be626d6cd56e3e7c76630fe167d116248a68a79dad1f2f8a97c897a36c51cf7e010199d474ea332e83ee6387a9cce2b3211e6e175a6c0d3a0836ee65c300bf0ea8d39599d2bc122c380d2c5d409f26e6739efab9d132a663c0eb7f43b1ecfe9f3b977226688bef9527c9c074cbde127e7e6dd51674da287e770086f9597cc0c0481ca52dacf1986f1ef68e52e128f7a653759055f70352d927b38337190d3f42b47ff9c8c9e34e67682795b0f6e0618c1d41bdc3715ffb6b40fd8b6be05904a9e0885cb2fddbb1b5039ba6b335667d1882f0d6cf608909b160b7702f6f211e3c50db607f075872ce65f7dba185640c024b9fde7b311c003db8e19942973916c63c4fb9db22b53af21744b469eaa3b8234714c3c98d7c20032807c188bea2a31bf319c4ebf030e5dbe55eb416108fd2f9872159ab4c31f1092420dbc8d6316fcd0f49c8b40cfe235495c2dc388b41636d71c23458954c189c4a3133552fb6ef0c133c3b020a217b549ec8a6e1d886457014ea68c3365a43c2e462a32ebaf29f797eedd6d36d2b131efcdebee2c20c570ebe1eb63bf896c18016c8c539661f15b583858ca923c7ef82484b9568d06867300874a7b440b1e3ad4a33ba5884f6a31fb2a9fb5d734fc1472e53aa56166c9f958a7dd94aed46ca8d0d34d586d13f3800413394a3434966e39450cd730704f5ed1dd71f971085d017306327081ac165fc045000d23d34fe6ffef788f34ff07c9f1c69e7aa6de0d8555143e106c6710054518ccdf777374a1cae6edcfb902bece550e58c439f28508bd8e398ecc4927841946f6159307b8fe9fe0d93d3ae8bdf8a548f420bbc42ee0919f94939a3c0ca573062c50ddefda2024979aa2f8699c04b6a9ca1ea12f80b1a766fe997ef5489c49bf1ba38a74a9e2f85e1ec00fd90d94919e49b941988d20d9dcd9ba591e0d16a30d263f5c31ec0a5efabbcf509df96b62be07a1f373344254a34a467ea9d9894544cec1a725869184628d6ff043d96277423dbfa50483077c07b165e7944b3377f71ba0c3d58effe5ddd2d24a4d8564836e77c6afcea2aad5dfcb5cb84efb5d2adbff6ff382b910e10c4a3256c8f397d644b7c232ac06a5057fc32d3c84d3f8abbc8d95f718c7f1886ba6e2f4961d713b215d7b8d7feba3c1d9ffb37e0f75d54683dff1205102c3d5e4794ff003246ccd57b7196eddbac9546baa9eadb896587348cfdc3879262f49d016cfae59e20cddef50ed7103f3ac0fc2cb612a06eac3b9b828dcf61bc213b0232d31f00ae2510dde2b36cd8166705c751a91037599d561807f039dc551a88df210917642539ff8ceb003ff44225d5968ab918360aa8c05d6bcebe0fda360dd08a147cd4f66bcabe80aefed50b97d348b8507de15a40cae14eef094d26ff6a92777d6d3763697368187b8c5411a537b3ec42ea386dd2f16abf6bfd3535b0162e651cfb8d645d86fdd69c725f4b6695cb56451f2924dae79b3d7a491414b66e68d27952cb18d5990fa3ec8eb1549f67e9a62f9aa57bb6f55f3e9c7c4f87bf1494e12509b1def3ff5e84f21c408f5466526654fc46a6cdb7a8b695596c10b58886ab1679f7f35d31a26dd628d8e6540b53727d4dd8eeb5562c58e3ceae07cc8c48a3080144288f3abade4b4a9fba17cad55b50a51d966a0e6e4356d613fad975dd88aa9be8df51c45ade32f65e53c282f1d36ea4880efb2c038de2069baf7fc61152d881653572377eb6b91a5095f768696906a9925d74f737e99d048179bf49b5e1473a743566755877eb5ab4ccf638196e3e91a44be76ddb9a5d09f150e4b8f61270e00"], 0xcf8}, 0x1, 0x0, 0x0, 0x10}, 0x0) setsockopt$bt_BT_SECURITY(r13, 0x112, 0x4, 0x0, 0x0) symlinkat(&(0x7f0000003200)='./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00') r15 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) setsockopt$SO_TIMESTAMP(r15, 0x1, 0x3e, &(0x7f0000000000)=0x4, 0x4) write(r15, &(0x7f00000000c0)="b76516", 0x3) umount2(&(0x7f0000000140)='./file0\x00', 0x1) sendmsg$netlink(r1, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000400)=ANY=[@ANYRESDEC=r8, @ANYRES8=r3, @ANYRESOCT], 0x2c}], 0x1}, 0xcc000) 5.049760773s ago: executing program 1 (id=16): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8) timer_create(0x7, &(0x7f000049efa0)={0x0, 0x14, 0x4, @tid=r1}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f00000000c0)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) timer_create(0x0, &(0x7f0000000140)={0x0, 0x37, 0x486fd4a6d809d7d, @tid=r1}, &(0x7f00000001c0)=0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(r4, 0xffffffffffffffff, &(0x7f0000000200)={{r5, r6+60000000}, {r2, r3+10000000}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x3938700}, {0x0, 0x3938700}}, 0x0) timer_create(0x3, &(0x7f0000000480)={0x0, 0x3b, 0x1, @thr={&(0x7f00000002c0)="33ec707d0ae6c045de98c5e4878d306ba92dfba7cab67a48ae9e27534be8a178aa883f13c205f7a3bee57b7a645a01afd6d71633461184653ae569dcb4447167abb1fc7dde7dcc69fa1414e283ed565412532ff4ab7d31baa91b8e714b83d7c1650ab6b19dc13ccb275105496619dbe785e2e1170dcfbeefdbe4ea2c28614002957aa4250d709d424da68351625187fc2cd0d8feb30a0483bf331581eb2451faf2ef894b2d6727beba0ec85fa42210cd6a7ecc070d00372649578e617756861685da3a", &(0x7f00000003c0)="017588bdebb0d8365f0cbaf51e4fa1b7cb7b0428ebd2c949d6b83b84638df27994120d85808cec2366fe654dfecb92b9012f02fc50b124734c074c1a1e24a3b685909aa0724aa7f35307281eb86d574b499e3cd2067546e81588f8ac0fcb2ba3ce1a7fc86a1ee9cc49c4e355532a6133782ddda893be9f2bbab34caeb427edcfc09d26d5b30c33653f3dd240aa4af075be8df29992a77a8784fbb167b7ea00786c58714c84de5568194444dcdad6ade0bd88a544"}}, &(0x7f00000004c0)=0x0) timer_gettime(r7, &(0x7f0000000500)) rt_sigtimedwait(&(0x7f0000000040)={[0xffffffffffff7ff8]}, 0x0, 0x0, 0x8) sendmsg$netlink(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000180)=ANY=[@ANYBLOB="1400000076001f"], 0x14}], 0x1, 0x0, 0x0, 0x4004000}, 0x4004001) 5.034773793s ago: executing program 2 (id=17): syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000040)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8c) r1 = openat$incfs(r0, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) ioctl$TIOCL_GETKMSGREDIRECT(r1, 0xc058671e, &(0x7f00000000c0)) 4.916702725s ago: executing program 1 (id=18): syz_usb_connect$uac2(0x5, 0xa8, &(0x7f0000000280)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x582, 0x4c, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x96, 0x3, 0x1, 0x5, 0x30, 0x9, {0x8, 0xb, 0x0, 0x1, 0x1, 0x7, 0x20, 0x8c}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x4000, 0x4, 0x1d, 0x7}, [@source_unit={0x8, 0x24, 0xa, 0x0, 0x1, 0xff, 0x23}, @output_terminal={0xc, 0x24, 0x3, 0x2, 0x307, 0x0, 0x4, 0x0, 0x7, 0x81}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x3, 0xb, 0x4, {0x8, 0x25, 0x1, 0x0, 0x0, 0x40, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x4, 0x1ccc, 0x5}, @as_header={0x10, 0x24, 0x1, 0x2, 0x1, 0x0, 0x4, 0x8, 0xb8, 0x3}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x40, 0x6, 0x3, {0x8, 0x25, 0x1, 0x82, 0x3, 0xf3, 0x6}}}}}}}}]}}, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0}) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10) (async) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) (async) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) (async, rerun: 64) r1 = socket$inet6(0x10, 0x2, 0x4) (async, rerun: 64) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f00000003c0)={0x4, 0x8, 0xd, 0xd, 0x4, 0x0, [{0x0, 0xf, 0xc22a, '\x00', 0x800}, {0x7fffffffffffffff, 0x3, 0x6, '\x00', 0xe02}, {0x401, 0x0, 0x80, '\x00', 0x1000}, {0xffff, 0x2, 0x0, '\x00', 0x800}]}) (async) sendmsg$NFQNL_MSG_CONFIG(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000080)={0x14, 0x2, 0x3, 0x5}, 0x14}}, 0x0) (async, rerun: 32) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) (async, rerun: 32) sendmsg$NFQNL_MSG_VERDICT(r2, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x5}, 0x804) (async) sendto$inet6(r1, &(0x7f0000000080)="4c00000012001f15b9409b849ac00a00a5784002000000000000030038c88cc055c5ac27a6c5b068d0bf46d323452536005ad94a461cdbfee9bdb942352359a351d1ec0cffc8792cd8000080", 0x4c, 0x810, 0x0, 0x0) (async, rerun: 64) r4 = socket$netlink(0x10, 0x3, 0x0) (rerun: 64) sendmsg$netlink(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="30100000100001df25450dc4f4da8df6aeffffff18", @ANYRESDEC, @ANYBLOB="10003a"], 0x30}], 0x1, 0x0, 0x0, 0x90}, 0x24040040) 4.486098419s ago: executing program 2 (id=19): syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="12011001000000086a05d10000000000000109022400010000700009040000020300000009210200fb01222800090581031000038108d3156d52dc10c9176952ce438b43128d094da6096a05a5e079d8829e42a0fcc3"], 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0xfe40, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0xe) r2 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r2, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) socket$netlink(0x10, 0x3, 0x0) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x0, 0x1}, 0x10) sendmsg$tipc(r3, &(0x7f0000000040)={&(0x7f0000000600)=@name={0x1e, 0x2, 0x2}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x81}, 0x84) r4 = dup3(r2, r3, 0x0) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000180)={0x42}, 0x10) write$P9_RGETATTR(r4, 0x0, 0x0) setsockopt$TIPC_GROUP_LEAVE(r4, 0x10f, 0x88) madvise(&(0x7f000051e000/0x2000)=nil, 0x2000, 0x17) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r6 = userfaultfd(0x801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$UFFDIO_WRITEPROTECT(r6, 0xc018aa06, &(0x7f0000000140)={{&(0x7f0000cc4000/0x1000)=nil, 0x1000}, 0x1}) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) r7 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x40040, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r7, 0xe7436000) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$UFFDIO_ZEROPAGE(r6, 0xc020aa04, &(0x7f0000000100)={{&(0x7f00008fc000/0x3000)=nil, 0x3000}}) ioctl$USERFAULTFD_IOC_NEW(0xffffffffffffffff, 0xaa00) 4.277767942s ago: executing program 1 (id=20): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$UI_SET_SNDBIT(r0, 0x4004556a, 0x201) r1 = syz_usb_connect$cdc_ncm(0x0, 0x76, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109026400020100e0000904000001020d0000052403000105240000000d240f0103000000000006000006241a00000208241c03000f20000905810300020d00000904010102020d"], 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0), 0x80040, 0x0) ioctl$RTC_SET_TIME(r2, 0x4024700a, &(0x7f0000000100)={0x2f, 0x25, 0x5, 0xb, 0x6, 0xff, 0x0, 0x13a, 0x1}) socket$netlink(0x10, 0x3, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x2, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f00000030c0), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_GET(r4, &(0x7f0000003280)={0x0, 0x0, &(0x7f0000003240)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010028bd7000fddbdf2508000000100004800900010073797a300000000087cb0d3daf0b86a107594125d722e6f30febf145b9352ab58812146de117"], 0x24}, 0x1, 0x0, 0x0, 0x4000001}, 0x20000010) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder1\x00', 0x2, 0x0) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x11, r6, 0x200000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0xc, 0x0, &(0x7f0000000600)=[@free_buffer], 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, 0x0) 3.836125717s ago: executing program 0 (id=21): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0xc00, 0x0) ioctl$TIOCSIG(r0, 0x40045436, 0x1f) r1 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000200)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x44f, 0xb304, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0xfe, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x1, 0xfc, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x420, 0x3, 0x81, 0x2}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000b80)={0x2c, &(0x7f0000000940)=ANY=[@ANYBLOB="200c0201000002046d725dcb0ef23eaec3eb85"], 0x0, 0x0, 0x0, 0x0}, 0x0) 2.672796639s ago: executing program 1 (id=22): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x200}) readv(r0, &(0x7f00000006c0)=[{&(0x7f0000000000)=""/236, 0xec}], 0x1) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000400)={&(0x7f000092b000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x1000}) syz_usb_connect$uac3(0x1, 0x97, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0x644, 0x800e, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x85, 0x3, 0x1, 0xff, 0xc0, 0xc, {0x8, 0xb, 0x1, 0x2, 0x1, 0x1, 0x30, 0x7}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x3ff}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@as_header={0x17, 0x24, 0x1, 0x3, 0x4, 0x7fff, 0x4, 0x7, 0x1, 0xfc00, 0x9}]}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x40, 0xd0, 0x4, {0xa, 0x25, 0x25, 0x7fff, 0x1, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0xfa, 0xff, 0x2, {0xa, 0x25, 0x25, 0x4, 0x5, 0x7b}}}}}}}}]}}, 0x0) 2.67260409s ago: executing program 3 (id=23): sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x24042801, &(0x7f0000000c80)={0x11, 0x8, 0x0, 0x1, 0x9, 0x6, @broadcast}, 0x14) r0 = socket(0x10, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000000c0)={'ip6tnl0\x00', 0x0}) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) writev(r1, &(0x7f00000025c0)=[{&(0x7f0000000240)='4', 0x1}, {0x0, 0x900}], 0x2) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{}, {0x77359400}}, &(0x7f0000000200)) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x1ff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x48010}, 0x851) r3 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$DCCPDIAG_GETSOCK(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000003d00)={&(0x7f0000003d80)={0x4c, 0x14, 0x403, 0x70bd2c, 0x25dfdbff, {0x1e, 0xda, 0x5, 0x7, {0x4e21, 0x4e22, [0x1000, 0x5, 0x2000000, 0x6], [0x2182, 0xfffffff4, 0x3ff, 0x128f], 0x0, [0xfffffffb, 0x7f]}, 0x8, 0x200}}, 0x4c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) write$char_usb(r4, &(0x7f0000000040)="e2", 0x2250) 2.65975676s ago: executing program 3 (id=24): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0x541b, &(0x7f0000000000)={0xffffffffffffffff, 0x8e59, 0x0, 0x20000003}) close_range(r2, r0, 0x0) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x143802, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) syz_open_procfs(0x0, 0x0) (async) r3 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000200), 0x81, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) (async) syz_io_uring_setup(0x4175, &(0x7f0000000180)={0x0, 0x136f, 0x10000, 0x2, 0x2d0}, 0x0, 0x0, 0x0) syz_io_uring_setup(0x110, &(0x7f0000000400)={0x0, 0xd386, 0x0, 0x3, 0x7f}, 0x0, 0x0, 0x0) r4 = syz_open_dev$evdev(&(0x7f0000000100), 0x2, 0x862b01) ioctl$EVIOCSFF(r4, 0x40304580, &(0x7f00000003c0)={0x56, 0x0, 0xac, {0xffff, 0x1}, {0x4d, 0x2}, @cond=[{0x8, 0x5388, 0xc, 0x800, 0xf535, 0x7}, {0x0, 0x805, 0x1, 0x7, 0x60d8, 0x1}]}) (async) write$char_usb(r4, &(0x7f0000000040)="e2", 0x2250) ioctl$EVIOCGKEY(r4, 0x80404518, &(0x7f0000001300)=""/115) (async) ioctl$BLKZEROOUT(r3, 0x127f, &(0x7f0000000040)={0x0, 0x2008000}) (async) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f0000000200), 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) (async) write$FUSE_DIRENTPLUS(r5, &(0x7f00000001c0)=ANY=[@ANYBLOB="10000000", @ANYRES64=r5], 0x10) 2.62281781s ago: executing program 3 (id=25): syz_usb_connect$midi(0x5, 0x40, &(0x7f0000000280)=ANY=[@ANYBLOB="1201100300000020670a115040000102030109022e00010113f90309040000020103000609058e0b20000fd70205250101270905090200026df780052501013a"], &(0x7f0000000000)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x200, 0x9, 0x9, 0xe, 0x40, 0x40}, 0x8, &(0x7f00000000c0)=ANY=[@ANYBLOB="050f0800010310"]}) 2.141882296s ago: executing program 0 (id=26): r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x4ee97ffd, 0x8e00) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000000)={0x43, 0x3}, 0x10) ppoll(&(0x7f00000000c0)=[{r1, 0x100}], 0x1, &(0x7f0000000140), 0x0, 0x0) ioctl$EVIOCSMASK(r0, 0x40104593, &(0x7f0000000080)={0x11, 0x0, 0x0}) ioctl$EVIOCGMASK(r0, 0x80104592, &(0x7f0000000000)={0x11, 0x0, 0x0}) 2.141698596s ago: executing program 0 (id=27): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x2200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_TDX_CAPABILITIES(r1, 0xc008aeba, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/2000, {0x1, 0x0, [{}]}}}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, &(0x7f0000000140)="d8df7e23b3b9ce0f0d73aa00b807000000ba000000000f301b8154fea900b9b60a000080321100c4e28ddc8dcd000000c182fd3f0020c8220000b801000000b9a6080000b9800000c035000800000f30ba000000000f300f3085c79d5351bf16d09bd09be16dc301012202", 0x6b}], 0x1, 0x5c, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x33, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.016706677s ago: executing program 0 (id=28): syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000040)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8c) r1 = openat$incfs(r0, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) ioctl$TIOCL_GETKMSGREDIRECT(r1, 0xc058671e, &(0x7f00000000c0)) 1.491591733s ago: executing program 0 (id=29): r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000ec0)={0x18, 0x0, 0x1, 0x70bd25, 0x25dfdbff, {}, [@HEADER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x24000000}, 0x24000000) bind$inet6(r1, &(0x7f0000000280)={0xa, 0x4e22, 0xd, @loopback, 0x6}, 0x1c) connect$inet6(r1, &(0x7f0000000140)={0xa, 0x4e22, 0x23, @loopback, 0x23}, 0x1c) setsockopt$inet6_int(r1, 0x29, 0xb, &(0x7f0000000100)=0x80000002, 0x4) sendto$inet(r0, &(0x7f0000000900)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9025a01c95d4a068ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) recvfrom$inet(r0, 0x0, 0x0, 0xc9100120, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xb0a54e68b1cd2fdb, 0x103) syz_usb_connect(0x0, 0x3f, &(0x7f00000002c0)=ANY=[@ANYBLOB="12010000d0918108ac051582588f0000000109022d00010000000009040000030b08000009058d67c8002a000009050502000000000009058b6e", @ANYRESOCT], 0x0) shutdown(r1, 0x2) 1.404730113s ago: executing program 2 (id=30): openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x60303, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000100)={[{0x101, 0x3ffc, 0x4, 0x6, 0x0, 0x8, 0x3, 0xa, 0x7c, 0x4, 0xe2, 0x5, 0x80204}, {0x804, 0x5, 0x1, 0x45, 0xb, 0x15, 0x4, 0x3, 0x0, 0xfe, 0x6, 0x80, 0x20c}, {0x800001, 0x2, 0x6, 0x5, 0x6, 0x7, 0x9, 0x50, 0xfd, 0x6, 0x4, 0x7e}], 0xffbfffff}) r1 = syz_clone(0x1c2ac000, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) prlimit64(r1, 0xf, &(0x7f0000000140)={0x3c}, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8002, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20000, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x2, 0x2, 0x0, 0x4002004c4, 0x1004, 0x8000000000000000, 0xc595, 0x0, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0xb6, 0x8d], 0xeeee8000, 0x2010d3}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1.389267344s ago: executing program 3 (id=31): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000002540)={0x73622a85, 0x1114, 0x2}) userfaultfd(0x801) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r1 = dup3(0xffffffffffffffff, r0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(r2, 0x6, &(0x7f0000002000)={0x1}) fcntl$lock(r2, 0x26, &(0x7f0000000180)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000580)={0x4, 0x0, &(0x7f0000000480)=[@register_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x20, 0x0, &(0x7f0000000000)=[@request_death, @clear_death], 0x0, 0x0, 0x0}) 1.364282154s ago: executing program 2 (id=32): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2, 0x0, @empty, 0x3}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) shutdown(r0, 0x2) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000380)={@in6={{0xa, 0x4e23, 0xf37, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, 0x8000}}, 0x0, 0x0, 0x1a, 0x0, "bb353738cb473fc7c9f1cf53b6a7b4e24740bd4c0b42a21d7214bff16d2ccd00"}, 0xd8) syz_io_uring_setup(0x6960, &(0x7f0000000040)={0x0, 0x8e1, 0x80, 0x0, 0x150}, &(0x7f00000000c0), 0x0, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x14) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, 0x0, 0x180) socket$netlink(0x10, 0x3, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0xdafbe5d6891b6e4) socket(0x11, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='freezer.self_freezing\x00', 0x275a, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000000)="8ee8c9b8ee088ed8660f3801b2d6352ed9ff660f3882040f01cf0fc72d2626652e0f01ca0fc7386635002000000f22e0", 0xffffffffffffff8b}], 0x1, 0x50, 0x0, 0x0) write$binfmt_script(r3, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0xa0011, r3, 0x0) preadv(r3, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) pipe(&(0x7f0000000240)) ioctl$KVM_RUN(r4, 0xae80, 0x0) 1.184484676s ago: executing program 2 (id=33): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r0) sendmsg$TIPC_NL_LINK_GET(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)={0x18, r1, 0x1, 0x70bd29, 0x25dfdbff, {}, [@TIPC_NLA_LINK={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x48000}, 0x4) io_destroy(0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x400000, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNSETQUEUE(r2, 0x400454d9, &(0x7f00000000c0)={'veth0_to_batadv\x00', 0x400}) ioctl$TUNGETIFF(r2, 0x800454d2, &(0x7f0000000100)) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x9, &(0x7f0000006680)) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x10c}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000000000/0x400000)=nil, 0x400000}, 0x1}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) madvise(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000100), 0x0, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@index_on}]}) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x4, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}, {@verity_require}], [], 0x2c}) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0/file1\x00', 0x40, 0xa) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_usb_connect(0x2, 0x64, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000cb8be7406d04230807000102030109025200010000000009044000000e01"], 0x0) mkdir(&(0x7f00000003c0)='./file0\x00', 0x21) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000040), 0x82, 0x0) 539.949163ms ago: executing program 3 (id=34): write(0xffffffffffffffff, &(0x7f0000000000)='$\x00', 0x2) r0 = socket(0x10, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000400)={'ip6gre0\x00', 0x0, 0x0, 0x0, 0x1, 0x0, 0xd, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, 0xa8, 0x0, 0xfffffffc, 0x8}}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000040)={0x1}) munmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000004200)=ANY=[@ANYBLOB="12010000e2793f10d10501200002000000010902120001000000000904"], 0x0) syz_usb_control_io$hid(r2, 0x0, &(0x7f0000000340)={0x2c, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write$ath9k_ep1(r2, 0x82, 0x1c4, 0x0) syz_usb_control_io$uac1(r2, &(0x7f0000000140)={0x14, &(0x7f0000000040)={0x0, 0x10, 0xac, {0xac, 0x31, "bbc791f0fbcd8135c5b4e05d7ec99482c7b6e0000f8b2daa07594ed5529cb44fdfc1df0556c400c0a74687ee4a653a7f406bd2d70e80fa03f40a0173948e241372f27e7ffa079b234a7728c0614e18e9e9d9f34b215f85f641a4fc4410a7f48cbd5924ccf8f9e827aa38558cc21a40124a1490cff5e1f0cc8b026b4a31cf70a5026c76257efe18ee85426d617430ff65cb31adea0a60513a4191d168f20f7f1319ee0b4d2266e6f168e9"}}, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x411}}}, &(0x7f0000000540)={0x44, &(0x7f0000000180)={0x20, 0x7, 0xf3, "07071110fdfd236b1300c1fc3bf4cad1ea62532af93593e2edb1eb9e4a34b053eae0cac7099d221a5e13af764d42d4f1e17dfedce6f5d910d65989833cb7ba2bc442ba5df4800e15366dd315cd00617b72c9febc9305aa74897b18801759604b5a300fab0a15f4a0b58546f673fdfcdb9473035eb32893802d0660847a3acba805941335926f208f0f034f34f49960a6c548e11abcd347d9289693a24ba4d52800ef5d107283be37934544c80d875da587c586f35c2365a81e8050e420ed345e8c8df0e0b1074c705cd37dce70034366f69f14df7f9dc4cfd161463e4edab26a54658a5326608561e4e406a2ebc332f3271542"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x4}, &(0x7f0000000300)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000380)={0x20, 0x81, 0x1, "95"}, &(0x7f00000003c0)={0x20, 0x82, 0x2, "e8b8"}, &(0x7f0000000480)={0x20, 0x83, 0x3, "835d32"}, &(0x7f00000004c0)={0x20, 0x84, 0x1, 'h'}, &(0x7f0000000500)={0x20, 0x85, 0x3, '0]='}}) 216.668427ms ago: executing program 0 (id=35): r0 = socket$netlink(0x10, 0x3, 0xa) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f0000000000), 0x10) sendmsg$can_bcm(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x5, 0x0, 0x0, {0x0, 0x2710}, {}, {}, 0x2, @can={{}, 0x0, 0x0, 0x0, 0x0, "3fd31340e92c4bb8"}}, 0x48}, 0x300}, 0x0) sendmsg$can_bcm(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000005900)=ANY=[@ANYBLOB='\a'], 0x48}, 0x300, 0x0, 0x0, 0x20000060}, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000008c0)={0x28, 0x14, 0x1, 0x4, 0x25dfdbfe, {0xa}, [@nested={0x14, 0x8, 0x0, 0x1, [@nested={0x10, 0x142, 0x0, 0x1, [@typed={0xc, 0x29, 0x0, 0x0, @u64=0x3fd}]}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000804}, 0x4800) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000400)=ANY=[@ANYRES8, @ANYRES8], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000040)={0x2c, &(0x7f0000000580)=ANY=[@ANYBLOB="00007f00000009009197d09647190890"], 0x0, 0x0, 0x0, 0x0}, 0x0) 0s ago: executing program 2 (id=36): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x2200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_TDX_CAPABILITIES(r1, 0xc008aeba, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/2000, {0x1, 0x0, [{}]}}}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, &(0x7f0000000140)="d8df7e23b3b9ce0f0d73aa00b807000000ba000000000f301b8154fea900b9b60a000080321100c4e28ddc8dcd000000c182fd3f0020c8220000b801000000b9a6080000b9800000c035000800000f30ba000000000f300f3085c79d5351bf16d09bd09be16dc301012202", 0x6b}], 0x1, 0x5c, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x33, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.205' (ED25519) to the list of known hosts. [ 30.383219][ T36] audit: type=1400 audit(1777978815.420:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 30.386769][ T286] cgroup: Unknown subsys name 'net' [ 30.407157][ T36] audit: type=1400 audit(1777978815.430:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 30.433332][ T36] audit: type=1400 audit(1777978815.450:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 30.433992][ T286] cgroup: Unknown subsys name 'devices' [ 30.616390][ T286] cgroup: Unknown subsys name 'hugetlb' [ 30.622058][ T286] cgroup: Unknown subsys name 'rlimit' [ 30.717652][ T36] audit: type=1400 audit(1777978815.760:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 30.740872][ T36] audit: type=1400 audit(1777978815.760:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 30.765858][ T36] audit: type=1400 audit(1777978815.760:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 30.800972][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 30.810027][ T36] audit: type=1400 audit(1777978815.850:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.835509][ T36] audit: type=1400 audit(1777978815.850:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.855759][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 30.861205][ T36] audit: type=1400 audit(1777978815.890:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.895365][ T36] audit: type=1400 audit(1777978815.890:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 31.712675][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.720228][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.727642][ T294] bridge_slave_0: entered allmulticast mode [ 31.734168][ T294] bridge_slave_0: entered promiscuous mode [ 31.742002][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.749125][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.756346][ T294] bridge_slave_1: entered allmulticast mode [ 31.762612][ T294] bridge_slave_1: entered promiscuous mode [ 31.865791][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.872859][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.880056][ T293] bridge_slave_0: entered allmulticast mode [ 31.886433][ T293] bridge_slave_0: entered promiscuous mode [ 31.893200][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.900518][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.907671][ T295] bridge_slave_0: entered allmulticast mode [ 31.914181][ T295] bridge_slave_0: entered promiscuous mode [ 31.926029][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.933109][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.940213][ T295] bridge_slave_1: entered allmulticast mode [ 31.946589][ T295] bridge_slave_1: entered promiscuous mode [ 31.952642][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.959762][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.966930][ T293] bridge_slave_1: entered allmulticast mode [ 31.973192][ T293] bridge_slave_1: entered promiscuous mode [ 31.979367][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.986447][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.993537][ T296] bridge_slave_0: entered allmulticast mode [ 31.999937][ T296] bridge_slave_0: entered promiscuous mode [ 32.008305][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.015498][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.022594][ T296] bridge_slave_1: entered allmulticast mode [ 32.029041][ T296] bridge_slave_1: entered promiscuous mode [ 32.129424][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.136559][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.143920][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.150977][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.213019][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.220134][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.227478][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.234554][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.246349][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.253438][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.260781][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.267847][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.304239][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.311420][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.318784][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.325856][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.347188][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.355134][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.362793][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.370222][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.377971][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.385648][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.392861][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.400536][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.414717][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.421909][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.440181][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.447298][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.455150][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.462218][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.474577][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.481688][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.505920][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.513009][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.526460][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.533522][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.541254][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.548370][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.564397][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.571463][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.587932][ T295] veth0_vlan: entered promiscuous mode [ 32.604280][ T295] veth1_macvtap: entered promiscuous mode [ 32.640524][ T294] veth0_vlan: entered promiscuous mode [ 32.658022][ T296] veth0_vlan: entered promiscuous mode [ 32.669300][ T293] veth0_vlan: entered promiscuous mode [ 32.689155][ T293] veth1_macvtap: entered promiscuous mode [ 32.699709][ T294] veth1_macvtap: entered promiscuous mode [ 32.712082][ T295] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 32.736537][ T296] veth1_macvtap: entered promiscuous mode [ 32.830719][ T323] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 33.054272][ T311] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 33.064076][ T66] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 33.071630][ T10] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 33.103899][ T321] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 33.203921][ T311] usb 3-1: Using ep0 maxpacket: 16 [ 33.210399][ T311] usb 3-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 2.00 [ 33.219698][ T311] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.229179][ T311] usb 3-1: config 0 descriptor?? [ 33.234409][ T66] usb 2-1: Using ep0 maxpacket: 8 [ 33.237766][ T311] ftdi_sio 3-1:0.0: FTDI USB Serial Device converter detected [ 33.240772][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 33.254934][ T66] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 130, changing to 7 [ 33.266101][ T66] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 255, changing to 7 [ 33.278432][ T10] usb 4-1: config 0 has an invalid descriptor of length 108, skipping remainder of the config [ 33.289482][ T321] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 33.303110][ T66] usb 2-1: New USB device found, idVendor=041e, idProduct=3020, bcdDevice= 0.40 [ 33.312703][ T66] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.321008][ T10] usb 4-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 33.330148][ T321] usb 1-1: New USB device found, idVendor=04b3, idProduct=3108, bcdDevice= 0.00 [ 33.339471][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.347671][ T66] usb 2-1: Product: syz [ 33.351877][ T66] usb 2-1: Manufacturer: syz [ 33.356576][ T321] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.364825][ T10] usb 4-1: Product: syz [ 33.369021][ T10] usb 4-1: Manufacturer: syz [ 33.373643][ T10] usb 4-1: SerialNumber: syz [ 33.378343][ T66] usb 2-1: SerialNumber: syz [ 33.387029][ T321] usb 1-1: config 0 descriptor?? [ 33.392455][ T10] usb 4-1: config 0 descriptor?? [ 33.400236][ T10] usb 4-1: bad CDC descriptors [ 33.405361][ T10] usb 4-1: unsupported MDLM descriptors [ 33.437142][ T311] usb 3-1: Detected FT232A [ 33.442413][ T311] usb 3-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 33.595312][ T66] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 33.602563][ T311] usb 4-1: USB disconnect, device number 2 [ 33.605482][ T66] usb 2-1: 2:1: invalid format type 0x1001 is detected, processed as PCM [ 33.617822][ T66] usb 2-1: 2:1 : sample bitwidth 255 in over sample bytes 2 [ 33.626175][ T66] usb 2-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 33.638329][ T66] usb 2-1: USB disconnect, device number 2 [ 33.644580][ T31] usb 3-1: USB disconnect, device number 2 [ 33.654896][ T31] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 33.664688][ T31] ftdi_sio 3-1:0.0: device disconnected [ 33.675733][ T325] udevd[325]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 33.819878][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 33.827259][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 33.834459][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 33.841779][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 33.848906][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 33.856374][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 33.863355][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 33.870530][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 33.877660][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 33.884824][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 33.891813][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 33.898872][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 33.906060][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 33.913054][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 33.920079][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 33.927258][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 33.934499][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 33.941467][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 33.948667][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 33.955785][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 33.962801][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 33.969854][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 33.976888][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 33.984089][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 33.991075][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 33.998104][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 34.005186][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 34.012342][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 34.019389][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 34.026490][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 34.033484][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 34.040599][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 34.047636][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 34.047962][ T323] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 34.056534][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 34.068740][ T323] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 34.072390][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 34.084920][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 34.091950][ T321] lenovo 0003:04B3:3108.0001: unknown main item tag 0x0 [ 34.105427][ T321] lenovo 0003:04B3:3108.0001: hidraw0: USB HID v0.24 Device [HID 04b3:3108] on usb-dummy_hcd.0-1/input0 [ 34.119060][ T323] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 34.205827][ T323] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 34.217479][ T321] usb 1-1: USB disconnect, device number 2 [ 34.365500][ T344] netlink: 28 bytes leftover after parsing attributes in process `syz.1.9'. [ 34.390329][ T349] capability: warning: `syz.1.11' uses 32-bit capabilities (legacy support in use) [ 34.603581][ T354] FAULT_INJECTION: forcing a failure. [ 34.603581][ T354] name failslab, interval 1, probability 0, space 0, times 1 [ 34.604026][ T66] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 34.617016][ T354] CPU: 1 UID: 0 PID: 354 Comm: syz.1.12 Not tainted syzkaller #0 8e204e40c44961bd6596aa96fc7bf4ad6280e2fe [ 34.617103][ T354] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 34.617145][ T354] Call Trace: [ 34.617165][ T354] [ 34.617188][ T354] __dump_stack+0x21/0x30 [ 34.617304][ T354] dump_stack_lvl+0x140/0x1c0 [ 34.617384][ T354] ? __cfi_dump_stack_lvl+0x10/0x10 [ 34.617469][ T354] dump_stack+0x19/0x20 [ 34.617530][ T354] should_fail_ex+0x3d7/0x530 [ 34.617615][ T354] should_failslab+0xac/0x100 [ 34.617672][ T354] __kmalloc_node_noprof+0x6c/0x4f0 [ 34.617759][ T354] ? __kvmalloc_node_noprof+0x128/0x300 [ 34.617845][ T354] __kvmalloc_node_noprof+0x128/0x300 [ 34.617969][ T354] ? __cfi___kvmalloc_node_noprof+0x10/0x10 [ 34.618078][ T354] simple_xattr_alloc+0x68/0x140 [ 34.618173][ T354] ? _raw_spin_lock+0x92/0x120 [ 34.618251][ T354] simple_xattr_set+0x45/0x300 [ 34.618340][ T354] shmem_xattr_handler_set+0x192/0x2d0 [ 34.618408][ T354] ? __cfi_shmem_xattr_handler_set+0x10/0x10 [ 34.618473][ T354] __vfs_setxattr+0x49f/0x4e0 [ 34.618551][ T354] __vfs_setxattr_noperm+0x12e/0x670 [ 34.618629][ T354] __vfs_setxattr_locked+0x216/0x240 [ 34.618705][ T354] vfs_setxattr+0x16b/0x2f0 [ 34.618775][ T354] ? __cfi_vfs_setxattr+0x10/0x10 [ 34.618843][ T354] ? vfs_create+0x650/0x740 [ 34.618906][ T354] ? __kasan_check_write+0x18/0x20 [ 34.618984][ T354] pending_reads_dispatch_ioctl+0x1b34/0x2080 [ 34.619070][ T354] ? __cfi_pending_reads_dispatch_ioctl+0x10/0x10 [ 34.619147][ T354] ? selinux_file_ioctl+0x732/0x1480 [ 34.619224][ T354] ? vfs_write+0x9a4/0xf90 [ 34.619334][ T354] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 34.619442][ T354] ? __cfi_vfs_write+0x10/0x10 [ 34.619523][ T354] ? __kasan_check_write+0x18/0x20 [ 34.619606][ T354] ? mutex_unlock+0x90/0x240 [ 34.619684][ T354] ? __cfi_mutex_unlock+0x10/0x10 [ 34.619763][ T354] ? __fget_files+0x2c5/0x340 [ 34.619827][ T354] ? __fget_files+0x2c5/0x340 [ 34.619883][ T354] ? bpf_lsm_file_ioctl+0xd/0x20 [ 34.619947][ T354] ? security_file_ioctl+0x3e/0x110 [ 34.620021][ T354] ? __cfi_pending_reads_dispatch_ioctl+0x10/0x10 [ 34.620097][ T354] __se_sys_ioctl+0x132/0x1b0 [ 34.620161][ T354] __x64_sys_ioctl+0x7f/0xa0 [ 34.620216][ T354] x64_sys_call+0x1878/0x2ee0 [ 34.620302][ T354] do_syscall_64+0x57/0xf0 [ 34.620368][ T354] ? clear_bhb_loop+0x50/0xa0 [ 34.620444][ T354] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 34.620523][ T354] RIP: 0033:0x7f546e19cdd9 [ 34.620577][ T354] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.620629][ T354] RSP: 002b:00007f546f059028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 34.620717][ T354] RAX: ffffffffffffffda RBX: 00007f546e415fa0 RCX: 00007f546e19cdd9 [ 34.620777][ T354] RDX: 00002000000000c0 RSI: 00000000c058671e RDI: 0000000000000005 [ 34.620826][ T354] RBP: 00007f546f059090 R08: 0000000000000000 R09: 0000000000000000 [ 34.620869][ T354] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 34.620903][ T354] R13: 00007f546e416038 R14: 00007f546e415fa0 R15: 00007fff38ac4fc8 [ 34.620957][ T354] [ 34.882089][ T356] Zero length message leads to an empty skb [ 35.048984][ T66] usb 4-1: config index 0 descriptor too short (expected 39, got 27) [ 35.058035][ T66] usb 4-1: invalid descriptor for config index 0: type = 0x2, length = 3 [ 35.067119][ T66] usb 4-1: can't read configurations, error -22 [ 35.203926][ T66] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 35.273857][ T10] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 35.353841][ T31] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 35.355595][ T66] usb 4-1: config index 0 descriptor too short (expected 39, got 27) [ 35.369649][ T66] usb 4-1: invalid descriptor for config index 0: type = 0x2, length = 3 [ 35.378238][ T66] usb 4-1: can't read configurations, error -22 [ 35.385013][ T66] usb usb4-port1: attempt power cycle [ 35.423898][ T10] usb 1-1: Using ep0 maxpacket: 8 [ 35.430363][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 35.441567][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 35.451325][ T10] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 35.461199][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12592, setting to 1024 [ 35.472818][ T10] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 35.482880][ T10] usb 1-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 35.492105][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 35.501202][ T10] usb 1-1: config 0 descriptor?? [ 35.506633][ T362] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 35.525434][ T31] usb 2-1: unable to get BOS descriptor or descriptor too short [ 35.534023][ T31] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 35.546587][ T31] usb 2-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 35.555734][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.563772][ T31] usb 2-1: Product: syz [ 35.568045][ T31] usb 2-1: Manufacturer: syz [ 35.572676][ T31] usb 2-1: SerialNumber: syz [ 35.716648][ T10] usb 1-1: USB disconnect, device number 3 [ 35.733929][ T66] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 35.755711][ T66] usb 4-1: config index 0 descriptor too short (expected 39, got 27) [ 35.763998][ T66] usb 4-1: invalid descriptor for config index 0: type = 0x2, length = 3 [ 35.772481][ T66] usb 4-1: can't read configurations, error -22 [ 35.795939][ T31] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 35.810461][ T31] usb 2-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 35.819093][ T31] usb 2-1: found format II with max.bitrate = 4, frame size=7372 [ 35.827146][ T31] usb 2-1: parse_audio_format_rates_v2v3(): unable to retrieve number of sample rates (clock 0) [ 35.841473][ T31] usb 2-1: USB disconnect, device number 3 [ 35.847469][ T46] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 35.862690][ T312] udevd[312]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 35.915121][ T66] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 35.935382][ T66] usb 4-1: config index 0 descriptor too short (expected 39, got 27) [ 35.943542][ T66] usb 4-1: invalid descriptor for config index 0: type = 0x2, length = 3 [ 35.953040][ T66] usb 4-1: can't read configurations, error -22 [ 35.959518][ T66] usb usb4-port1: unable to enumerate USB device [ 36.015156][ T46] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 36.028501][ T46] usb 3-1: New USB device found, idVendor=056a, idProduct=00d1, bcdDevice= 0.00 [ 36.037609][ T46] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.046365][ T46] usb 3-1: config 0 descriptor?? [ 36.143892][ T31] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 36.234595][ T36] kauditd_printk_skb: 70 callbacks suppressed [ 36.234613][ T36] audit: type=1400 audit(1777978821.280:144): avc: denied { unlink } for pid=294 comm="syz-executor" name="file0" dev="tmpfs" ino=28 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 36.272120][ T36] audit: type=1400 audit(1777978821.310:145): avc: denied { create } for pid=370 comm="syz.2.19" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 36.292202][ T36] audit: type=1400 audit(1777978821.320:146): avc: denied { bind } for pid=370 comm="syz.2.19" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 36.311289][ T36] audit: type=1400 audit(1777978821.320:147): avc: denied { setopt } for pid=370 comm="syz.2.19" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 36.316078][ T31] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 36.330878][ T36] audit: type=1400 audit(1777978821.320:148): avc: denied { write } for pid=370 comm="syz.2.19" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 36.342345][ T31] usb 2-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 36.373346][ T31] usb 2-1: config 1 interface 1 has no altsetting 0 [ 36.381605][ T31] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 36.390768][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.399010][ T31] usb 2-1: Product: syz [ 36.403211][ T31] usb 2-1: Manufacturer: syz [ 36.407989][ T31] usb 2-1: SerialNumber: syz [ 36.417067][ T31] cdc_ncm 2-1:1.0: CDC Union missing and no IAD found [ 36.424687][ T31] cdc_ncm 2-1:1.0: bind() failure [ 36.442393][ T36] audit: type=1400 audit(1777978821.480:149): avc: denied { read } for pid=370 comm="syz.2.19" name="rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 36.465192][ T36] audit: type=1400 audit(1777978821.480:150): avc: denied { open } for pid=370 comm="syz.2.19" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 36.488841][ T36] audit: type=1400 audit(1777978821.510:151): avc: denied { map } for pid=370 comm="syz.2.19" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 36.514098][ T36] audit: type=1400 audit(1777978821.510:152): avc: denied { execute } for pid=370 comm="syz.2.19" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 36.524286][ T66] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 36.616552][ T36] audit: type=1400 audit(1777978821.660:153): avc: denied { read } for pid=375 comm="syz.1.20" name="rtc0" dev="devtmpfs" ino=195 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 36.694980][ T66] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 36.706392][ T66] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1056, setting to 64 [ 36.717372][ T66] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 36.730455][ T66] usb 1-1: New USB device found, idVendor=044f, idProduct=b304, bcdDevice= 0.00 [ 36.739587][ T66] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.748740][ T66] usb 1-1: config 0 descriptor?? [ 36.754196][ T378] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 36.847802][ T10] usb 2-1: USB disconnect, device number 4 [ 37.164003][ T66] thrustmaster 0003:044F:B304.0002: unknown main item tag 0x0 [ 37.171632][ T66] thrustmaster 0003:044F:B304.0002: unknown main item tag 0x7 [ 37.179193][ T66] thrustmaster 0003:044F:B304.0002: report_id 0 is invalid [ 37.187040][ T66] thrustmaster 0003:044F:B304.0002: item 0 1 1 8 parsing failed [ 37.194947][ T66] thrustmaster 0003:044F:B304.0002: parse failed [ 37.201371][ T66] thrustmaster 0003:044F:B304.0002: probe with driver thrustmaster failed with error -22 [ 37.365251][ T10] usb 1-1: USB disconnect, device number 4 [ 37.724124][ T9] usb 2-1: new low-speed USB device number 5 using dummy_hcd [ 37.773872][ T66] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 37.873848][ T9] usb 2-1: Invalid ep0 maxpacket: 16 [ 37.923838][ T66] usb 4-1: Using ep0 maxpacket: 32 [ 37.936846][ T66] usb 4-1: New USB device found, idVendor=0a67, idProduct=5011, bcdDevice= 0.40 [ 37.946394][ T66] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.954556][ T66] usb 4-1: Product: syz [ 37.958853][ T66] usb 4-1: Manufacturer: syz [ 37.963486][ T66] usb 4-1: SerialNumber: syz [ 38.003870][ T9] usb 2-1: new low-speed USB device number 6 using dummy_hcd [ 38.153903][ T9] usb 2-1: Invalid ep0 maxpacket: 16 [ 38.159440][ T9] usb usb2-port1: attempt power cycle [ 38.176215][ T66] usb 4-1: MIDIStreaming interface descriptor not found [ 38.187380][ T66] usb 4-1: USB disconnect, device number 7 [ 38.202818][ T320] udevd[320]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 38.504057][ T9] usb 2-1: new low-speed USB device number 7 using dummy_hcd [ 38.524299][ T9] usb 2-1: Invalid ep0 maxpacket: 16 [ 38.622404][ T46] usbhid 3-1:0.0: can't add hid device: -71 [ 38.634888][ T46] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 38.650888][ T46] usb 3-1: USB disconnect, device number 3 [ 38.654791][ T9] usb 2-1: new low-speed USB device number 8 using dummy_hcd [ 38.700862][ T9] usb 2-1: Invalid ep0 maxpacket: 16 [ 38.710384][ T9] usb usb2-port1: unable to enumerate USB device [ 38.883847][ T31] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 39.033863][ T31] usb 1-1: Using ep0 maxpacket: 8 [ 39.040116][ T31] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 39.051456][ T31] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 39.061177][ T31] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 39.070907][ T31] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12592, setting to 1024 [ 39.082072][ T31] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 39.092111][ T31] usb 1-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 39.101188][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.110044][ T31] usb 1-1: config 0 descriptor?? [ 39.114251][ T9] usb 3-1: new full-speed USB device number 4 using dummy_hcd [ 39.115806][ T405] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 39.275206][ T9] usb 3-1: config 0 has an invalid interface number: 64 but max is 0 [ 39.283427][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 39.293627][ T9] usb 3-1: config 0 has no interface number 0 [ 39.301378][ T9] usb 3-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice= 0.07 [ 39.310536][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.318582][ T9] usb 3-1: Product: syz [ 39.322792][ T9] usb 3-1: Manufacturer: syz [ 39.327442][ T9] usb 3-1: SerialNumber: syz [ 39.332905][ T9] usb 3-1: config 0 descriptor?? [ 39.339265][ T66] usb 1-1: USB disconnect, device number 5 [ 39.549525][ T9] usb 3-1: USB disconnect, device number 4 [ 39.773874][ T66] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 39.923834][ T66] usb 4-1: Using ep0 maxpacket: 16 [ 39.930400][ T66] usb 4-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 2.00 [ 39.939618][ T66] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.948352][ T66] usb 4-1: config 0 descriptor?? [ 39.956625][ T66] ftdi_sio 4-1:0.0: FTDI USB Serial Device converter detected [ 40.072016][ T293] ------------[ cut here ]------------ [ 40.077582][ T293] WARNING: CPU: 0 PID: 293 at fs/overlayfs/util.c:602 ovl_dir_modified+0x15a/0x190 [ 40.086939][ T293] Modules linked in: [ 40.090876][ T293] CPU: 0 UID: 0 PID: 293 Comm: syz-executor Not tainted syzkaller #0 8e204e40c44961bd6596aa96fc7bf4ad6280e2fe [ 40.102568][ T293] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 40.112697][ T293] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 40.113978][ T31] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 40.118404][ T293] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 ee 5f 97 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d e9 bc c4 5b 03 cc e8 b6 ee 3e ff <0f> 0b e9 3e ff ff ff e8 aa ee 3e ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 40.145703][ T293] RSP: 0018:ffffc9000116fb48 EFLAGS: 00010293 [ 40.151832][ T293] RAX: ffffffff8248cdea RBX: 0000000000000000 RCX: ffff88812e653900 [ 40.159872][ T293] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 40.167913][ T293] RBP: ffffc9000116fb70 R08: ffff888121cce15f R09: 1ffff11024399c2b [ 40.175993][ T293] R10: dffffc0000000000 R11: ffffed1024399c2c R12: 0000000000000000 [ 40.184033][ T293] R13: dffffc0000000000 R14: ffff888121cce0c0 R15: ffff888110523550 [ 40.192018][ T293] FS: 0000555594b65500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 40.201084][ T293] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 40.207807][ T293] CR2: 0000555594b90998 CR3: 000000012bf86000 CR4: 00000000003526b0 [ 40.215868][ T293] Call Trace: [ 40.219166][ T293] [ 40.222102][ T293] ovl_do_remove+0x81b/0xda0 [ 40.226775][ T293] ? ovl_set_redirect+0x780/0x780 [ 40.231836][ T293] ? down_write+0xee/0x2b0 [ 40.236320][ T293] ? __cfi_down_write+0x10/0x10 [ 40.241203][ T293] ovl_rmdir+0x1e/0x30 [ 40.245343][ T293] vfs_rmdir+0x3e0/0x560 [ 40.249614][ T293] incfs_kill_sb+0x109/0x230 [ 40.254282][ T293] deactivate_locked_super+0xd8/0x2a0 [ 40.259706][ T293] deactivate_super+0xb8/0xe0 [ 40.264035][ T31] usb 1-1: device descriptor read/64, error -71 [ 40.264491][ T293] cleanup_mnt+0x406/0x4a0 [ 40.275132][ T293] __cleanup_mnt+0x1d/0x40 [ 40.279605][ T293] task_work_run+0x1e5/0x260 [ 40.284282][ T293] ? __cfi_task_work_run+0x10/0x10 [ 40.289445][ T293] ? __x64_sys_umount+0x12e/0x180 [ 40.294538][ T293] ? __cfi___x64_sys_umount+0x10/0x10 [ 40.299957][ T293] ? __kasan_check_read+0x15/0x20 [ 40.305039][ T293] resume_user_mode_work+0x35/0x50 [ 40.310194][ T293] syscall_exit_to_user_mode+0x63/0xb0 [ 40.315706][ T293] do_syscall_64+0x63/0xf0 [ 40.320183][ T293] ? clear_bhb_loop+0x50/0xa0 [ 40.324940][ T293] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 40.330898][ T293] RIP: 0033:0x7fadaed9e017 [ 40.335380][ T293] Code: a2 c7 05 dc 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 40.355061][ T293] RSP: 002b:00007fffb66bdb88 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 40.363504][ T293] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fadaed9e017 [ 40.371541][ T293] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffb66bdc40 [ 40.379597][ T293] RBP: 00007fffb66bdc40 R08: 00007fffb66bec40 R09: 00000000ffffffff [ 40.387654][ T293] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffb66becd0 [ 40.395694][ T293] R13: 00007fadaee32120 R14: 0000000000009b3f R15: 00007fffb66bed10 [ 40.403716][ T293] [ 40.406817][ T293] ---[ end trace 0000000000000000 ]--- [ 40.413382][ T66] usb 4-1: Detected FT232A [ 40.414040][ T293] ------------[ cut here ]------------ [ 40.420903][ T66] usb 4-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 40.423325][ T293] WARNING: CPU: 1 PID: 293 at fs/overlayfs/util.c:602 ovl_dir_modified+0x15a/0x190 [ 40.440657][ T293] Modules linked in: [ 40.444652][ T293] CPU: 1 UID: 0 PID: 293 Comm: syz-executor Tainted: G W syzkaller #0 8e204e40c44961bd6596aa96fc7bf4ad6280e2fe [ 40.457905][ T293] Tainted: [W]=WARN [ 40.461739][ T293] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 40.471861][ T293] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 40.477615][ T293] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 ee 5f 97 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d e9 bc c4 5b 03 cc e8 b6 ee 3e ff <0f> 0b e9 3e ff ff ff e8 aa ee 3e ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 40.497280][ T293] RSP: 0018:ffffc9000116fb48 EFLAGS: 00010293 [ 40.503393][ T293] RAX: ffffffff8248cdea RBX: 0000000000000000 RCX: ffff88812e653900 [ 40.511454][ T293] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 40.519536][ T293] RBP: ffffc9000116fb70 R08: ffff888121cce15f R09: 1ffff11024399c2b [ 40.527577][ T293] R10: dffffc0000000000 R11: ffffed1024399c2c R12: 0000000000000000 [ 40.535608][ T293] R13: dffffc0000000000 R14: ffff888121cce0c0 R15: ffff888110523550 [ 40.543628][ T293] FS: 0000555594b65500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 40.552640][ T293] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 40.559302][ T293] CR2: 00007f546e3eb078 CR3: 000000012bf86000 CR4: 00000000003526b0 [ 40.567361][ T293] Call Trace: [ 40.570674][ T293] [ 40.573957][ T293] ovl_do_remove+0x81b/0xda0 [ 40.578589][ T293] ? ovl_set_redirect+0x780/0x780 [ 40.583633][ T293] ? down_write+0xee/0x2b0 [ 40.588117][ T293] ? __cfi_down_write+0x10/0x10 [ 40.592995][ T293] ovl_rmdir+0x1e/0x30 [ 40.597123][ T293] vfs_rmdir+0x3e0/0x560 [ 40.601402][ T293] incfs_kill_sb+0x1a0/0x230 [ 40.606107][ T293] deactivate_locked_super+0xd8/0x2a0 [ 40.611518][ T293] deactivate_super+0xb8/0xe0 [ 40.616260][ T293] cleanup_mnt+0x406/0x4a0 [ 40.620709][ T293] __cleanup_mnt+0x1d/0x40 [ 40.625179][ T293] task_work_run+0x1e5/0x260 [ 40.629816][ T293] ? __cfi_task_work_run+0x10/0x10 [ 40.635001][ T293] ? __x64_sys_umount+0x12e/0x180 [ 40.640079][ T293] ? __cfi___x64_sys_umount+0x10/0x10 [ 40.645570][ T293] ? __kasan_check_read+0x15/0x20 [ 40.650649][ T293] resume_user_mode_work+0x35/0x50 [ 40.655837][ T293] syscall_exit_to_user_mode+0x63/0xb0 [ 40.661339][ T293] do_syscall_64+0x63/0xf0 [ 40.665821][ T293] ? clear_bhb_loop+0x50/0xa0 [ 40.670573][ T293] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 40.676571][ T293] RIP: 0033:0x7fadaed9e017 [ 40.681044][ T293] Code: a2 c7 05 dc 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 40.700794][ T293] RSP: 002b:00007fffb66bdb88 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 40.709316][ T293] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fadaed9e017 [ 40.717389][ T293] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffb66bdc40 [ 40.725426][ T293] RBP: 00007fffb66bdc40 R08: 00007fffb66bec40 R09: 00000000ffffffff [ 40.733469][ T293] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffb66becd0 [ 40.741512][ T293] R13: 00007fadaee32120 R14: 0000000000009b3f R15: 00007fffb66bed10 [ 40.749647][ T293] [ 40.752695][ T293] ---[ end trace 0000000000000000 ]--- [ 40.816053][ T31] usb 1-1: device descriptor read/64, error -71 [ 41.053854][ T31] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 41.183855][ T31] usb 1-1: device descriptor read/64, error -71 [ 41.423871][ T31] usb 1-1: device descriptor read/64, error -71 [ 41.533994][ T31] usb usb1-port1: attempt power cycle [ 41.873871][ T31] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 41.894972][ T31] usb 1-1: device descriptor read/8, error -71 [ 42.025252][ T31] usb 1-1: device descriptor read/8, error -71 [ 42.264037][ T31] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 42.285043][ T31] usb 1-1: device descriptor read/8, error -71 [ 42.415240][ T31] usb 1-1: device descriptor read/8, error -71 [ 42.523963][ T31] usb usb1-port1: unable to enumerate USB device [ 42.549144][ T31] usb 4-1: USB disconnect, device number 8 [ 42.566213][ T31] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 42.575793][ T31] ftdi_sio 4-1:0.0: device disconnected