last executing test programs: 29.4926524s ago: executing program 2 (id=567): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x140) mount$overlay(0x8c, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000480)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@nfs_export_on}]}) 29.47768566s ago: executing program 2 (id=568): r0 = socket(0xa, 0x3, 0x3a) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = userfaultfd(0x80001) setns(0xc9, 0x0) r3 = socket$netlink(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000940)=ANY=[@ANYBLOB="140000001000010300000ae6f72087a003"], 0x3c}}, 0x0) (async) sendmsg$NFT_BATCH(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000940)=ANY=[@ANYBLOB="140000001000010300000ae6f72087a003"], 0x3c}}, 0x0) syz_usb_connect$midi(0x5, 0x40, &(0x7f0000001b00)=ANY=[@ANYBLOB="120110030000002030144b4740000102030109022e00010118100409040000020103000609058e0b20000fd702052501012709058c0200066df780052501013a"], &(0x7f0000001b40)={0xa, &(0x7f0000001b80)={0xa, 0x6, 0x200, 0x9, 0x9, 0xe, 0x40, 0x40}, 0x8, &(0x7f0000001bc0)=ANY=[@ANYBLOB="050f08000103100b3d797dda9cb253ede8d06a432fac1e81be175e2c74d61a346d06d7cde9adea62b4f973ec0efc64fb72c3dafe092a81f9fc6dcd98c0e8013ac69765a4c4a48e641cdf954190a5f32346775e90aa8572db8140209476acc2784069260c352d0d7a54eabfa351812878a691ae4601000000cee491859a1857ba2d54ea6de5090c6a1ab1034f2de74a33a10a6e7459c82f87820545527fded64b567edb8a8ab5b6a78c257c21ab9589169d019cb76f789a31606263b9da99e65d0e17e686df3f58c83b06c45f2eb26f6cfa6ce40a9917354a3890ea0f0f8bbb845897a6e0659f4463284d0ba94671a907dfeb332c737efa86a75e4716991dc31969d8213ca4f0518741473361c42f93f34ab785008103843169c43f"], 0x60}) recvmmsg(r3, &(0x7f0000000980)=[{{0x0, 0x0, &(0x7f0000001d00)=[{&(0x7f0000000a00)=""/229, 0xe5}, {&(0x7f0000000b00)=""/4096, 0x1000}], 0x2}, 0x8}], 0x1, 0x40000103, 0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x20}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_CONTINUE(r2, 0xc020aa07, &(0x7f0000000240)={{&(0x7f0000243000/0x2000)=nil, 0x2000}, 0x2}) (async) ioctl$UFFDIO_CONTINUE(r2, 0xc020aa07, &(0x7f0000000240)={{&(0x7f0000243000/0x2000)=nil, 0x2000}, 0x2}) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000002140)) (async) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000002140)=0x0) getpgid(0x0) (async) r5 = getpgid(0x0) kcmp(r4, r5, 0x3, r1, r2) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r1, 0x89f0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) (async) fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001d80), 0xffffffffffffffff) sendmsg$NL80211_CMD_RELOAD_REGDB(r6, &(0x7f0000001dc0)={0x0, 0x0, &(0x7f0000001e00)={&(0x7f0000001e40)={0x14, r7, 0x421, 0x70bd2f, 0x25dfdbfe}, 0x14}}, 0x400d4) sendmsg$NL80211_CMD_DEL_STATION(r0, &(0x7f0000002100)={&(0x7f0000001d40)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000020c0)={&(0x7f0000001e80)={0x228, r7, 0x402, 0x70bd27, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x7, 0x3e}}}}, [@NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES={0xb4, 0xbe, "c9b5cfe44367a7d9244b81588de791161378dd7d3b176bd0c4f1082a8a712bb0aa27d6ea417db9e025ec77b9e480fbcaf5b58bb590b09fb092ecda98c1ecb9a4eef56ec03d03c96883c76ea105ea2548629b9e57daf454aa1fc96173999a61f8de57810aab59699a42662bfc2d50be26ea90d1dc58fc1fbe4944f907f4f12798db303724577d057c2c4899773b3b98a84574f4bcc99bc210330e59ccd709679462696c4eb1502fa8e6e49ab429c59b24"}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_WME={0x24, 0x81, [@NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x7f}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x6}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0xc}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0xc}]}, @NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES={0x2f, 0xbe, "8acd0b5ff5c8ff3a2bf22f3e565c76e0347f49932701fc930250935343b51d85f3067ef84fe6d74bc928ee"}, @NL80211_ATTR_OPMODE_NOTIF={0x5, 0xc2, 0x73}, @NL80211_ATTR_STA_EXT_CAPABILITY={0xeb, 0xac, "e21190d788ace17219dbc0303273ebfc6eb22ee117f97d5a0c1a8ac52d538d9c0e7f96cf41a43020d83948b9b71362012592e133722bc0a544c18af8cef70909f5850edea7aedfdad29279d0cde266c30e43cfc4fffcb3b754b489e287d2a211e1d7aacd9cda22a525cf8a3a34e4184c276d8470c05cee9d652d876bbd6eed204cce525a2d58a14aa2eda732bb797c2182000a9c2f670bf8e6444d30db069cf7548d2d30975655deb2a7b063dda81c9d4f4fe6677c33a8de23f65a4106e58ad7f917040f97e8156e483123bc626dab504ac3ebf3f3661bc865f2c7629f424f325246609d585cbb"}]}, 0x228}, 0x1, 0x0, 0x0, 0x40}, 0x900) readv(r2, &(0x7f0000000840)=[{&(0x7f0000000300)=""/73, 0x49}, {&(0x7f0000000380)=""/136, 0x88}, {&(0x7f0000000440)=""/226, 0xe2}, {&(0x7f0000000540)=""/24, 0x18}, {&(0x7f0000000580)=""/37, 0x25}, {&(0x7f00000005c0)=""/219, 0xdb}, {&(0x7f00000006c0)=""/32, 0x20}, {&(0x7f0000000700)=""/62, 0x3e}, {&(0x7f0000000740)=""/37, 0x25}, {&(0x7f0000000780)=""/157, 0x9d}], 0xa) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r9}, 0x2c, {'wfdno', 0x3d, r8}, 0x2c, {[{@version_9p2000}]}}) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f00000009c0)=0x101002, 0x4) (async) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f00000009c0)=0x101002, 0x4) write$P9_RVERSION(r10, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r9, @ANYRESHEX=r10], 0x15) (async) write$P9_RVERSION(r10, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r9, @ANYRESHEX=r10], 0x15) 26.458800984s ago: executing program 2 (id=587): fcntl$setsig(0xffffffffffffffff, 0xa, 0x18) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000004700)={@loopback, 0x200000, 0x2, 0x0, 0x3, 0xe}, 0x20) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000406c256d0000000200000109022400010000000009040000010300000009210000000122050009058103"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) syz_usb_control_io$hid(r1, &(0x7f00000000c0)={0x24, 0x0, &(0x7f0000004740)=ANY=[@ANYBLOB="0003040000000403010c7671c5fcbb9d9628e48272e24775ea361af23b0c667e3907e81246787625892715c36689c7a04dc5b2eeae30fecb525d39f469cd83e9872941a7c7"], 0x0, 0x0}, 0x0) mmap(&(0x7f0000821000/0x4000)=nil, 0x4000, 0x0, 0x80010, 0xffffffffffffffff, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r2, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000400)='net/tcp\x00') read$FUSE(r3, &(0x7f0000000440)={0x2020}, 0x51) close(r2) read$FUSE(r3, &(0x7f0000002480)={0x2020}, 0x2020) syz_usb_control_io$hid(r1, 0x0, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) io_submit(0x0, 0x1, &(0x7f0000000380)=[&(0x7f00000003c0)={0x0, 0x0, 0x0, 0x7, 0xfffe, 0xffffffffffffffff, 0x0}]) 24.57196092s ago: executing program 2 (id=594): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r2, 0x0) ioctl$KVM_TPR_ACCESS_REPORTING(r2, 0xc028ae92, &(0x7f0000000080)={0x7, 0x8}) ioctl$KVM_RUN(r2, 0xae80, 0x0) mount(0x0, &(0x7f0000000140)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./mnt\x00', 0x1ff) mount(&(0x7f0000000380)=@filename='./dev/sda1\x00', &(0x7f00000003c0)='./mnt\x00', &(0x7f0000000400)='ext4\x00', 0x8410, 0x0) memfd_create(&(0x7f0000000000)='($\x00', 0x4) chdir(&(0x7f0000000440)='./mnt\x00') r3 = openat2$dir(0xffffffffffffff9c, 0x0, &(0x7f00000000c0)={0x20100, 0x110, 0x8}, 0x18) openat(r3, &(0x7f0000000180)='./mnt\x00', 0x80000, 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./file2\x00', 0x18d042, 0x15) pwrite64(r4, 0x0, 0x0, 0xfb2200) mount(0x0, &(0x7f0000000240)='./proc\x00', &(0x7f0000000280)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./proc/sys/vm/compact_memory\x00', 0x1, 0x0) write(r5, &(0x7f0000000500)='1\n', 0x2) 23.959835815s ago: executing program 2 (id=600): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) r2 = openat$fault_inject(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/fail_page_alloc/interval\x00', 0x1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x44, 0xf7, &(0x7f0000000200)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000280)={@fd={0x66642a85, 0x0, r2, 0x0, 0x3}, @flat=@binder={0x73622a85, 0x2000, 0x2, 0x2}, @flat=@weak_binder={0x77622a85, 0x0, 0x3, 0x2}}, &(0x7f0000000300)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 23.032585738s ago: executing program 2 (id=604): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x100}) pwrite64(r0, 0x0, 0x0, 0x7fffffffbfffffff) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000200)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000280)={@flat=@binder={0x73622a85, 0x0, 0x1, 0x1}, @flat=@binder={0x73622a85, 0x0, 0x2, 0x2}, @flat=@weak_binder={0x77622a85, 0x0, 0x3, 0x3}}, &(0x7f0000000300)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000480)=[@enter_looper], 0x100, 0x0, &(0x7f00000004c0)=""/256}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000005c0)={0x44, 0x0, &(0x7f0000000b80)=[@reply={0x40406301, {0x0, 0x0, 0x2, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000680)={@flat=@handle={0x73682a85, 0x0, 0x1}, @flat=@handle={0x73682a85, 0x1, 0x3}, @flat=@weak_handle={0x77682a85, 0x0, 0x3}}, &(0x7f0000000b40)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 22.985314579s ago: executing program 32 (id=604): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x100}) pwrite64(r0, 0x0, 0x0, 0x7fffffffbfffffff) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000200)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000280)={@flat=@binder={0x73622a85, 0x0, 0x1, 0x1}, @flat=@binder={0x73622a85, 0x0, 0x2, 0x2}, @flat=@weak_binder={0x77622a85, 0x0, 0x3, 0x3}}, &(0x7f0000000300)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000480)=[@enter_looper], 0x100, 0x0, &(0x7f00000004c0)=""/256}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000005c0)={0x44, 0x0, &(0x7f0000000b80)=[@reply={0x40406301, {0x0, 0x0, 0x2, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000680)={@flat=@handle={0x73682a85, 0x0, 0x1}, @flat=@handle={0x73682a85, 0x1, 0x3}, @flat=@weak_handle={0x77682a85, 0x0, 0x3}}, &(0x7f0000000b40)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 9.736289682s ago: executing program 4 (id=605): eventfd(0xd33) socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_audit(0x10, 0x3, 0x9) socket$netlink(0x10, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x800, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = open(0x0, 0x60840, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x100000000004, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r2 = syz_ublk_setup_io_uring(0x3, &(0x7f0000000040)={0x0, 0x4, 0x1000}, &(0x7f0000000000)=0x0, &(0x7f0000000540), &(0x7f00000003c0)) syz_io_uring_modify_offsets$flags(r3, 0x0, 0x68, 0x1) syz_ublk_setup_queues(r0, r1, &(0x7f0000000340)={0x0, 0x2, 0x4000000, 0xfffffffe, 0x257, 0x0, r0}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x4000, 0xffffff, 0x1c7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfc4a, 0x8000, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xcf78, 0x20000, 0x1, 0x0, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3948, 0xa000, 0x2, 0x2b2}}], 0x1, 0x0, 0x0) 7.978484435s ago: executing program 4 (id=605): eventfd(0xd33) socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_audit(0x10, 0x3, 0x9) socket$netlink(0x10, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x800, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = open(0x0, 0x60840, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x100000000004, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r2 = syz_ublk_setup_io_uring(0x3, &(0x7f0000000040)={0x0, 0x4, 0x1000}, &(0x7f0000000000)=0x0, &(0x7f0000000540), &(0x7f00000003c0)) syz_io_uring_modify_offsets$flags(r3, 0x0, 0x68, 0x1) syz_ublk_setup_queues(r0, r1, &(0x7f0000000340)={0x0, 0x2, 0x4000000, 0xfffffffe, 0x257, 0x0, r0}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x4000, 0xffffff, 0x1c7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfc4a, 0x8000, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xcf78, 0x20000, 0x1, 0x0, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3948, 0xa000, 0x2, 0x2b2}}], 0x1, 0x0, 0x0) 6.178767509s ago: executing program 1 (id=679): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000080)={0x0, 0x0, 0x0, &(0x7f0000000100)=""/54, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x1, 0x0, 0x0, &(0x7f0000000200)=""/87, 0x0, 0xeeee0000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000280)) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000380)=0x1) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f00000003c0)=0x4000000) 6.12556644s ago: executing program 1 (id=680): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000d00)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a20000000000a010400000000000000000500000a0900010073797a30000000005c000000030a010400000000000000000500000a0900010073797a30000000000900030073797a30000000002800048008000140000000000800024000000001140003006e657464657673696d3000000000000008000a400000000204010000060a010400000000000000000500000a0900010073797a30000000000900020073797a3000000000d800048024000180090001006d6574610000000014000280080001400000000108000240000000004800018008000100636d70003c000280080001400000000108000240000000002800038005000100000000001c00028008000180fffffffb08000180fffffffd0800034000000001680001800e000100696d6d65646961746500000054000280080001"], 0x1a8}}, 0x0) 6.12544782s ago: executing program 1 (id=681): syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201fb0009030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0) 6.12534484s ago: executing program 4 (id=605): eventfd(0xd33) socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_audit(0x10, 0x3, 0x9) socket$netlink(0x10, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x800, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = open(0x0, 0x60840, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x100000000004, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r2 = syz_ublk_setup_io_uring(0x3, &(0x7f0000000040)={0x0, 0x4, 0x1000}, &(0x7f0000000000)=0x0, &(0x7f0000000540), &(0x7f00000003c0)) syz_io_uring_modify_offsets$flags(r3, 0x0, 0x68, 0x1) syz_ublk_setup_queues(r0, r1, &(0x7f0000000340)={0x0, 0x2, 0x4000000, 0xfffffffe, 0x257, 0x0, r0}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x4000, 0xffffff, 0x1c7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfc4a, 0x8000, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xcf78, 0x20000, 0x1, 0x0, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3948, 0xa000, 0x2, 0x2b2}}], 0x1, 0x0, 0x0) 4.313759075s ago: executing program 1 (id=683): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x22003, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, &(0x7f0000000240)="0f30c402fd3eecae660f38800a66b80c010f00d0662e3646d87213460f09b98c0900000f32b8010000000f01c12e644c0fc72f", 0x33}], 0x1, 0x41, 0x0, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000280)={[0xa, 0x3, 0x10000d, 0x8000000000000001, 0x403, 0x8000040000000001, 0xb3, 0x8, 0x2, 0x2, 0xffffffffe, 0x2081, 0x7, 0x1fd, 0xe6, 0x4], 0x1000, 0x383fc2}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 4.313644215s ago: executing program 3 (id=684): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)="68000000000905040000000000000000020000000900010073797a3000000000140002800600010000020000050002000600000008000500000000002c0004800800010000000001200002800c000100706f6c69637930000800020000000002080003000000001e", 0x68}], 0x1}, 0x4800) sendmsg$NFNL_MSG_CTHELPER_DEL(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000740)={0x14, 0x2, 0x9, 0x3, 0x0, 0x0, {0xa, 0x0, 0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x80) 4.284308215s ago: executing program 3 (id=685): mkdirat(0xffffffffffffff9c, &(0x7f000001cd40)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f000001cd80)='./nfsd\x00', &(0x7f000001cdc0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f000001ce00)='./nfsd/nfsv4leasetime\x00', 0x1, 0x0) write$binfmt_aout(r0, 0x0, 0x0) 4.269446706s ago: executing program 3 (id=687): pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f00000000c0)={0x6000000d}) splice(r0, 0x0, r2, 0x0, 0x8001, 0xd) 4.185139388s ago: executing program 4 (id=605): eventfd(0xd33) socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_audit(0x10, 0x3, 0x9) socket$netlink(0x10, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x800, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = open(0x0, 0x60840, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x100000000004, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r2 = syz_ublk_setup_io_uring(0x3, &(0x7f0000000040)={0x0, 0x4, 0x1000}, &(0x7f0000000000)=0x0, &(0x7f0000000540), &(0x7f00000003c0)) syz_io_uring_modify_offsets$flags(r3, 0x0, 0x68, 0x1) syz_ublk_setup_queues(r0, r1, &(0x7f0000000340)={0x0, 0x2, 0x4000000, 0xfffffffe, 0x257, 0x0, r0}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x4000, 0xffffff, 0x1c7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfc4a, 0x8000, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xcf78, 0x20000, 0x1, 0x0, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3948, 0xa000, 0x2, 0x2b2}}], 0x1, 0x0, 0x0) 2.273268845s ago: executing program 0 (id=689): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000002b00), 0x20a02, 0x0) ioctl$TIOCSSOFTCAR(r0, 0x5453, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000002e80), 0x2982, 0x0) 2.272432854s ago: executing program 1 (id=690): r0 = syz_usb_connect$hid(0x5, 0x6b, &(0x7f0000000040)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x1e7d, 0x3138, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x80, 0x3, "", [{{0x9, 0x4, 0x0, 0x0, 0x9, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x4, 0x9, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0x2b, 0xfe}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000080)={0x2c, &(0x7f00000000c0)={0x60, 0xc, 0x28, {0x28, 0x23, "f79bdf2f21c73f55340b560fb30d54f365c5b1d4dd6c4fbf6fc93f0808251f5ee472a0df4015"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 2.272196314s ago: executing program 3 (id=691): timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000004c0)={'vxcan1\x00', 0x0}) bind$can_raw(r1, &(0x7f0000000500), 0x10) read(r1, &(0x7f0000000540)=""/4073, 0xfe9) sendmsg$can_raw(r1, &(0x7f0000001540)={&(0x7f0000001580)={0x1d, r2}, 0x10, &(0x7f00000015c0)={&(0x7f0000001600)=@can={{0x1, 0x0, 0x1, 0x1}, 0x7, 0x2, 0x0, 0x0, "eb778610de7e3023"}, 0x10}}, 0x4000040) 2.240099185s ago: executing program 0 (id=692): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000900)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010800000000000000000b00000008000300", @ANYRES32=r2, @ANYBLOB="0a0006000802110000010000300050800800070000000000050002000100000011000100a38feb81000000e1cdccdeac550000000800030005ac0f"], 0x58}}, 0x0) 2.174052047s ago: executing program 0 (id=693): r0 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) r1 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r1, &(0x7f0000000500)={0x28, 0x0, 0x0, @local}, 0x10) 2.117442258s ago: executing program 0 (id=694): r0 = socket(0x2, 0x3, 0xff) sendmmsg$inet(r0, &(0x7f0000000180)=[{{&(0x7f0000000200)={0x2, 0x4e22, @multicast1}, 0x10, &(0x7f0000000240)=[{&(0x7f0000000380)="281effe935fdca24ffffff556ea6e50000000000000000000000263bbec9fc4b", 0x20}], 0x1, &(0x7f0000000440)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x37}, @empty}}}], 0x20}}], 0x1, 0x4804) 2.117287798s ago: executing program 4 (id=605): eventfd(0xd33) socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_audit(0x10, 0x3, 0x9) socket$netlink(0x10, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x800, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = open(0x0, 0x60840, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x100000000004, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r2 = syz_ublk_setup_io_uring(0x3, &(0x7f0000000040)={0x0, 0x4, 0x1000}, &(0x7f0000000000)=0x0, &(0x7f0000000540), &(0x7f00000003c0)) syz_io_uring_modify_offsets$flags(r3, 0x0, 0x68, 0x1) syz_ublk_setup_queues(r0, r1, &(0x7f0000000340)={0x0, 0x2, 0x4000000, 0xfffffffe, 0x257, 0x0, r0}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x4000, 0xffffff, 0x1c7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfc4a, 0x8000, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xcf78, 0x20000, 0x1, 0x0, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3948, 0xa000, 0x2, 0x2b2}}], 0x1, 0x0, 0x0) 104.485747ms ago: executing program 0 (id=695): socket(0x2, 0x80805, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./sys\x00', &(0x7f0000000280)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000380)='./dev\x00', &(0x7f00000003c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000440), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./dev/md0\x00', 0x2, 0x0) ioctl(r1, 0x40480923, &(0x7f00000004c0)="00000000000000000000000000000000050000000010000003000000030000000000000001000000000000000100000003000000030000000000000000000000020000000010") ioctl(r1, 0x40140921, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000540)="0100000001000000010000000100000006") 100.955447ms ago: executing program 1 (id=696): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000540)={0x73622a85, 0x1000, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000005c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x8, 0x0, &(0x7f0000000640)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000680)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000700)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000740)={0x8, 0x0, &(0x7f00000007c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x44, 0x0, &(0x7f0000000840)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x23, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 100.752697ms ago: executing program 3 (id=697): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x26) write(r0, &(0x7f0000000180)='7', 0x1) syz_clone(0x82020000, 0x0, 0x0, 0x0, 0x0, 0x0) 60.912699ms ago: executing program 0 (id=698): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0xc369d000) r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x6, @mcast1={0xff, 0x7}, 0x20000}}, {{0xa, 0x0, 0x3, @local}}}, 0x108) close(r0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000000340)={'syz_tun\x00', 0x101}) 60.510799ms ago: executing program 3 (id=699): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000340)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="3f9d00000000000000001700000008000300", @ANYRES32=r2, @ANYBLOB="60003080050002000000000014000400403a050c5bae9c544ef2b6d713c59a7a1c0001800500023ced6d00000800040005000000080001000200"], 0x7c}, 0x1, 0x0, 0x0, 0x4004}, 0x0) 0s ago: executing program 4 (id=605): eventfd(0xd33) socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_audit(0x10, 0x3, 0x9) socket$netlink(0x10, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x800, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = open(0x0, 0x60840, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x100000000004, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r2 = syz_ublk_setup_io_uring(0x3, &(0x7f0000000040)={0x0, 0x4, 0x1000}, &(0x7f0000000000)=0x0, &(0x7f0000000540), &(0x7f00000003c0)) syz_io_uring_modify_offsets$flags(r3, 0x0, 0x68, 0x1) syz_ublk_setup_queues(r0, r1, &(0x7f0000000340)={0x0, 0x2, 0x4000000, 0xfffffffe, 0x257, 0x0, r0}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x4000, 0xffffff, 0x1c7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfc4a, 0x8000, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xcf78, 0x20000, 0x1, 0x0, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3948, 0xa000, 0x2, 0x2b2}}], 0x1, 0x0, 0x0) kernel console output (not intermixed with test programs): +0x50/0xa0 [ 56.315058][ T1234] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 56.315081][ T1234] RIP: 0033:0x7fe75c95ed8e [ 56.315097][ T1234] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 56.315114][ T1234] RSP: 002b:00007fe75d7a3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 56.315129][ T1234] RAX: ffffffffffffffda RBX: 00007fe75d7a46c0 RCX: 00007fe75c95ed8e [ 56.315137][ T1234] RDX: 000000000000000f RSI: 00007fe75d7a40a0 RDI: 0000000000000007 [ 56.315144][ T1234] RBP: 00007fe75d7a4090 R08: 0000000000000000 R09: 0000000000000000 [ 56.315151][ T1234] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 56.315157][ T1234] R13: 00007fe75cc26038 R14: 00007fe75cc25fa0 R15: 00007ffd58386b58 [ 56.315165][ T1234] [ 56.388384][ T1209] netlink: 'syz.3.325': attribute type 30 has an invalid length. [ 56.568050][ T349] usb 1-1: device descriptor read/64, error -71 [ 56.574353][ T45] uclogic 0003:256C:006D.000A: failed retrieving string descriptor #200: -71 [ 56.584154][ T45] uclogic 0003:256C:006D.000A: failed retrieving pen parameters: -71 [ 56.592338][ T45] uclogic 0003:256C:006D.000A: failed probing pen v2 parameters: -71 [ 56.600464][ T45] uclogic 0003:256C:006D.000A: failed probing parameters: -71 [ 56.608144][ T45] uclogic 0003:256C:006D.000A: probe with driver uclogic failed with error -71 [ 56.619151][ T45] usb 2-1: USB disconnect, device number 13 [ 56.660069][ T64] uvcvideo 4-1:1.1: Failed to query (129) UVC probe control : -71 (exp. 26). [ 56.671523][ T64] uvcvideo 4-1:1.1: Failed to initialize the device (-71). [ 56.683890][ T64] usb 4-1: USB disconnect, device number 19 [ 56.766690][ T1239] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.773812][ T1239] bridge0: port 1(bridge_slave_0) entered disabled state [ 56.781078][ T1239] bridge_slave_0: entered allmulticast mode [ 56.787266][ T1239] bridge_slave_0: entered promiscuous mode [ 56.793862][ T1239] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.800986][ T1239] bridge0: port 2(bridge_slave_1) entered disabled state [ 56.808346][ T1239] bridge_slave_1: entered allmulticast mode [ 56.814557][ T1239] bridge_slave_1: entered promiscuous mode [ 56.820428][ T349] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 56.853790][ T1239] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.860908][ T1239] bridge0: port 2(bridge_slave_1) entered forwarding state [ 56.868214][ T1239] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.875256][ T1239] bridge0: port 1(bridge_slave_0) entered forwarding state [ 56.894025][ T429] bridge0: port 1(bridge_slave_0) entered disabled state [ 56.901658][ T429] bridge0: port 2(bridge_slave_1) entered disabled state [ 56.911850][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.918932][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 56.928471][ T429] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.935522][ T429] bridge0: port 2(bridge_slave_1) entered forwarding state [ 56.957703][ T349] usb 1-1: device descriptor read/64, error -71 [ 56.971107][ T1239] veth0_vlan: entered promiscuous mode [ 56.987746][ T1239] veth1_macvtap: entered promiscuous mode [ 57.005469][ T36] audit: type=1400 audit(1792078294.070:350): avc: denied { mount } for pid=1239 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 57.033855][ T36] audit: type=1400 audit(1792078294.100:351): avc: denied { mount } for pid=1248 comm="syz.2.336" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 57.035351][ T1249] FAULT_INJECTION: forcing a failure. [ 57.035351][ T1249] name failslab, interval 1, probability 0, space 0, times 0 [ 57.068344][ T1249] CPU: 1 UID: 0 PID: 1249 Comm: syz.2.336 Not tainted syzkaller #0 0dce1a42a4db61fd93e445decfbc7fc3d71b95b8 [ 57.068377][ T1249] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 57.068389][ T1249] Call Trace: [ 57.068395][ T1249] [ 57.068403][ T1249] __dump_stack+0x21/0x30 [ 57.068433][ T1249] dump_stack_lvl+0x140/0x1c0 [ 57.068456][ T1249] ? __cfi_dump_stack_lvl+0x10/0x10 [ 57.068483][ T1249] dump_stack+0x19/0x20 [ 57.068508][ T1249] should_fail_ex+0x3c2/0x510 [ 57.068527][ T1249] should_failslab+0xac/0x100 [ 57.068545][ T1249] __kmalloc_cache_noprof+0x41/0x470 [ 57.068570][ T1249] ? selinux_perf_event_alloc+0x110/0x110 [ 57.068595][ T1249] ? v9fs_mount+0xc1/0x9d0 [ 57.068614][ T1249] v9fs_mount+0xc1/0x9d0 [ 57.068630][ T1249] ? __cfi_v9fs_mount+0x10/0x10 [ 57.068648][ T1249] ? selinux_capable+0x38/0x50 [ 57.068667][ T1249] legacy_get_tree+0x106/0x1b0 [ 57.068685][ T1249] ? __cfi_v9fs_mount+0x10/0x10 [ 57.068700][ T1249] vfs_get_tree+0x9e/0x290 [ 57.068724][ T1249] do_new_mount+0x251/0xb40 [ 57.068748][ T1249] ? security_capable+0x44/0x130 [ 57.068776][ T1249] path_mount+0x66a/0xff0 [ 57.068800][ T1249] ? putname+0x113/0x150 [ 57.068826][ T1249] __se_sys_mount+0x2bf/0x480 [ 57.068859][ T1249] ? ksys_write+0x1f3/0x260 [ 57.068884][ T1249] ? __x64_sys_mount+0xf0/0xf0 [ 57.068910][ T1249] __x64_sys_mount+0xc3/0xf0 [ 57.068935][ T1249] x64_sys_call+0x2021/0x2ee0 [ 57.068954][ T1249] do_syscall_64+0x57/0xf0 [ 57.068971][ T1249] ? clear_bhb_loop+0x50/0xa0 [ 57.068994][ T1249] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 57.069016][ T1249] RIP: 0033:0x7f2db6d9e559 [ 57.069032][ T1249] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 57.069049][ T1249] RSP: 002b:00007f2db7b96028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 57.069070][ T1249] RAX: ffffffffffffffda RBX: 00007f2db7025fa0 RCX: 00007f2db6d9e559 [ 57.069085][ T1249] RDX: 0000200000004500 RSI: 00002000000000c0 RDI: 0000000000000000 [ 57.069099][ T1249] RBP: 00007f2db7b96090 R08: 0000200000000100 R09: 0000000000000000 [ 57.069112][ T1249] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 57.069124][ T1249] R13: 00007f2db7026038 R14: 00007f2db7025fa0 R15: 00007ffedaf11a98 [ 57.069141][ T1249] [ 57.076082][ T36] audit: type=1400 audit(1792078294.140:352): avc: denied { unmount } for pid=1239 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 57.207624][ T349] usb 1-1: device descriptor read/64, error -71 [ 57.343165][ T1263] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 57.353379][ T1263] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 57.391892][ T1273] netlink: 44 bytes leftover after parsing attributes in process `syz.1.347'. [ 57.437760][ T349] usb usb1-port1: attempt power cycle [ 57.457678][ T45] usb 3-1: new full-speed USB device number 18 using dummy_hcd [ 57.595973][ T1279] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=257 sclass=netlink_route_socket pid=1279 comm=syz.1.349 [ 57.608555][ T45] usb 3-1: not running at top speed; connect to a high speed hub [ 57.617594][ T9] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 57.617787][ T45] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 57.636188][ T45] usb 3-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 57.645424][ T45] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 57.655446][ T45] usb 3-1: Found UVC 1.00 device (046d:0825) [ 57.685784][ T1285] netlink: 36 bytes leftover after parsing attributes in process `syz.1.352'. [ 57.712845][ T1290] tipc: Started in network mode [ 57.717855][ T1290] tipc: Node identity ac14142f, cluster identity 4711 [ 57.724715][ T1290] tipc: New replicast peer: 255.255.255.255 [ 57.731444][ T1290] tipc: Enabled bearer , priority 10 [ 57.778927][ T349] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 57.781762][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 57.797764][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 57.808476][ T349] usb 1-1: device descriptor read/8, error -71 [ 57.809003][ T9] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 57.826771][ T9] usb 4-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 57.835286][ T9] usb 4-1: Manufacturer: syz [ 57.843088][ T9] usb 4-1: config 0 descriptor?? [ 57.850503][ T1295] netlink: 64 bytes leftover after parsing attributes in process `syz.1.356'. [ 57.941018][ T349] usb 1-1: device descriptor read/8, error -71 [ 58.044411][ T36] audit: type=1400 audit(1792078295.110:353): avc: denied { bind } for pid=1309 comm="syz.1.360" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 58.063718][ T45] usb 3-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 58.073564][ T36] audit: type=1400 audit(1792078295.110:354): avc: denied { name_bind } for pid=1309 comm="syz.1.360" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 58.149903][ T1316] netlink: 36 bytes leftover after parsing attributes in process `syz.1.362'. [ 58.171288][ T1318] netlink: 'syz.1.363': attribute type 4 has an invalid length. [ 58.179044][ T1318] netlink: 17 bytes leftover after parsing attributes in process `syz.1.363'. [ 58.197656][ T349] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 58.218581][ T349] usb 1-1: device descriptor read/8, error -71 [ 58.348593][ T349] usb 1-1: device descriptor read/8, error -71 [ 58.368488][ T1325] netlink: 532 bytes leftover after parsing attributes in process `syz.1.365'. [ 58.442868][ T1331] FAULT_INJECTION: forcing a failure. [ 58.442868][ T1331] name failslab, interval 1, probability 0, space 0, times 0 [ 58.455986][ T1331] CPU: 0 UID: 0 PID: 1331 Comm: syz.1.367 Not tainted syzkaller #0 0dce1a42a4db61fd93e445decfbc7fc3d71b95b8 [ 58.456012][ T1331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 58.456020][ T1331] Call Trace: [ 58.456024][ T1331] [ 58.456028][ T1331] __dump_stack+0x21/0x30 [ 58.456049][ T1331] dump_stack_lvl+0x140/0x1c0 [ 58.456065][ T1331] ? __cfi_dump_stack_lvl+0x10/0x10 [ 58.456081][ T1331] ? futex_wake+0x666/0x950 [ 58.456094][ T1331] dump_stack+0x19/0x20 [ 58.456107][ T1331] should_fail_ex+0x3c2/0x510 [ 58.456118][ T1331] should_failslab+0xac/0x100 [ 58.456128][ T1331] __kmalloc_cache_noprof+0x41/0x470 [ 58.456142][ T1331] ? io_ring_ctx_alloc+0x61/0x1dc0 [ 58.456154][ T1331] io_ring_ctx_alloc+0x61/0x1dc0 [ 58.456165][ T1331] io_uring_create+0x2e0/0x13f0 [ 58.456176][ T1331] ? __kasan_check_write+0x18/0x20 [ 58.456190][ T1331] __se_sys_io_uring_setup+0x2a4/0x2b0 [ 58.456203][ T1331] ? __x64_sys_io_uring_setup+0x80/0x80 [ 58.456216][ T1331] ? __secure_computing+0xee/0x2b0 [ 58.456225][ T1331] __x64_sys_io_uring_setup+0x5f/0x80 [ 58.456237][ T1331] x64_sys_call+0x22c0/0x2ee0 [ 58.456247][ T1331] do_syscall_64+0x57/0xf0 [ 58.456256][ T1331] ? clear_bhb_loop+0x50/0xa0 [ 58.456268][ T1331] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 58.456280][ T1331] RIP: 0033:0x7f8498b9e559 [ 58.456290][ T1331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 58.456300][ T1331] RSP: 002b:00007f84999e0fb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 58.456313][ T1331] RAX: ffffffffffffffda RBX: 0000200000000440 RCX: 00007f8498b9e559 [ 58.456322][ T1331] RDX: 0000200000000500 RSI: 0000200000000440 RDI: 0000000000001f85 [ 58.456330][ T1331] RBP: 00007f8498c358b0 R08: 0000000000000000 R09: 0000000000000000 [ 58.456337][ T1331] R10: 0000200000000540 R11: 0000000000000206 R12: 0000200000000500 [ 58.456344][ T1331] R13: 0000200000000540 R14: 00002000000004c0 R15: 00007ffd99b050f8 [ 58.456354][ T1331] [ 58.457710][ T349] usb usb1-port1: unable to enumerate USB device [ 58.483137][ T64] usb 3-1: USB disconnect, device number 18 [ 58.673173][ T9] uclogic 0003:256C:006D.000B: failed retrieving string descriptor #200: -71 [ 58.682067][ T9] uclogic 0003:256C:006D.000B: failed retrieving pen parameters: -71 [ 58.690311][ T9] uclogic 0003:256C:006D.000B: failed probing pen v2 parameters: -71 [ 58.698467][ T9] uclogic 0003:256C:006D.000B: failed probing parameters: -71 [ 58.705980][ T9] uclogic 0003:256C:006D.000B: probe with driver uclogic failed with error -71 [ 58.707576][ T45] rust_binder: 1332: undelivered TRANSACTION_COMPLETE [ 58.716870][ T9] usb 4-1: USB disconnect, device number 20 [ 58.760722][ T1339] netlink: 36 bytes leftover after parsing attributes in process `syz.0.371'. [ 58.847677][ T547] tipc: Node number set to 2886997039 [ 59.074219][ T1351] FAULT_INJECTION: forcing a failure. [ 59.074219][ T1351] name fail_futex, interval 1, probability 0, space 0, times 1 [ 59.087632][ T1351] CPU: 0 UID: 0 PID: 1351 Comm: syz.2.375 Not tainted syzkaller #0 0dce1a42a4db61fd93e445decfbc7fc3d71b95b8 [ 59.087664][ T1351] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 59.087676][ T1351] Call Trace: [ 59.087700][ T1351] [ 59.087705][ T1351] __dump_stack+0x21/0x30 [ 59.087725][ T1351] dump_stack_lvl+0x140/0x1c0 [ 59.087740][ T1351] ? __cfi_dump_stack_lvl+0x10/0x10 [ 59.087755][ T1351] dump_stack+0x19/0x20 [ 59.087769][ T1351] should_fail_ex+0x3c2/0x510 [ 59.087780][ T1351] should_fail+0xf/0x20 [ 59.087788][ T1351] get_futex_key+0x178/0x940 [ 59.087799][ T1351] ? ttwu_queue_wakelist+0x323/0x520 [ 59.087812][ T1351] ? __cfi_get_futex_key+0x10/0x10 [ 59.087821][ T1351] ? __smp_call_single_queue+0xd5/0x380 [ 59.087835][ T1351] ? ttwu_do_activate+0x620/0x620 [ 59.087847][ T1351] ? ttwu_queue_wakelist+0x323/0x520 [ 59.087860][ T1351] futex_wait_setup+0xae/0x260 [ 59.087872][ T1351] ? __cfi_futex_wait_setup+0x10/0x10 [ 59.087884][ T1351] ? __asan_memcpy+0x5a/0x80 [ 59.087898][ T1351] __futex_wait+0x12c/0x3d0 [ 59.087910][ T1351] ? __cfi___futex_wait+0x10/0x10 [ 59.087922][ T1351] ? __cfi_futex_wake_mark+0x10/0x10 [ 59.087934][ T1351] ? futex_wake+0x666/0x950 [ 59.087945][ T1351] futex_wait+0x128/0x7c0 [ 59.087957][ T1351] ? __cfi_futex_wait+0x10/0x10 [ 59.087970][ T1351] do_futex+0x32a/0x510 [ 59.087979][ T1351] ? __kasan_slab_free+0x6a/0x80 [ 59.087989][ T1351] ? kfree+0x158/0x440 [ 59.088001][ T1351] ? __cfi_do_futex+0x10/0x10 [ 59.088012][ T1351] __se_sys_futex+0x13c/0x320 [ 59.088022][ T1351] ? native_write_gdt_entry+0x40/0x40 [ 59.088035][ T1351] ? __x64_sys_futex+0x110/0x110 [ 59.088046][ T1351] __x64_sys_futex+0xe9/0x110 [ 59.088058][ T1351] x64_sys_call+0x227f/0x2ee0 [ 59.088076][ T1351] do_syscall_64+0x57/0xf0 [ 59.088092][ T1351] ? clear_bhb_loop+0x50/0xa0 [ 59.088114][ T1351] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 59.088126][ T1351] RIP: 0033:0x7f2db6d9e559 [ 59.088136][ T1351] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 59.088145][ T1351] RSP: 002b:00007f2db57f70e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 59.088157][ T1351] RAX: ffffffffffffffda RBX: 00007f2db7026098 RCX: 00007f2db6d9e559 [ 59.088165][ T1351] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f2db7026098 [ 59.088172][ T1351] RBP: 00007f2db7026090 R08: 0000000000000000 R09: 0000000000000000 [ 59.088178][ T1351] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 59.088187][ T1351] R13: 00007f2db7026128 R14: 00007ffedaf119b0 R15: 00007ffedaf11a98 [ 59.088197][ T1351] [ 59.421266][ T1354] FAULT_INJECTION: forcing a failure. [ 59.421266][ T1354] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 59.427147][ T1358] rust_binder: Write failure EINVAL in pid:177 [ 59.434413][ T1354] CPU: 1 UID: 0 PID: 1354 Comm: syz.2.376 Not tainted syzkaller #0 0dce1a42a4db61fd93e445decfbc7fc3d71b95b8 [ 59.434443][ T1354] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 59.434456][ T1354] Call Trace: [ 59.434464][ T1354] [ 59.434472][ T1354] __dump_stack+0x21/0x30 [ 59.434501][ T1354] dump_stack_lvl+0x140/0x1c0 [ 59.434525][ T1354] ? __cfi_dump_stack_lvl+0x10/0x10 [ 59.434551][ T1354] ? check_stack_object+0x138/0x150 [ 59.434576][ T1354] dump_stack+0x19/0x20 [ 59.434600][ T1354] should_fail_ex+0x3c2/0x510 [ 59.434626][ T1354] should_fail+0xf/0x20 [ 59.434641][ T1354] should_fail_usercopy+0x1e/0x30 [ 59.434660][ T1354] _copy_to_user+0x24/0xa0 [ 59.434681][ T1354] simple_read_from_buffer+0xed/0x160 [ 59.434702][ T1354] proc_fail_nth_read+0x1aa/0x220 [ 59.434725][ T1354] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 59.434745][ T1354] ? bpf_lsm_file_permission+0xd/0x20 [ 59.434764][ T1354] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 59.434785][ T1354] vfs_read+0x28b/0xc70 [ 59.434809][ T1354] ? __cfi_vfs_read+0x10/0x10 [ 59.434831][ T1354] ? __kasan_check_write+0x18/0x20 [ 59.434853][ T1354] ? mutex_lock+0x97/0x1d0 [ 59.434873][ T1354] ? __cfi_mutex_lock+0x10/0x10 [ 59.434894][ T1354] ksys_read+0x145/0x260 [ 59.434917][ T1354] ? xfd_validate_state+0x68/0x140 [ 59.434943][ T1354] ? __cfi_ksys_read+0x10/0x10 [ 59.434966][ T1354] ? __kasan_check_write+0x18/0x20 [ 59.434988][ T1354] ? fpregs_restore_userregs+0x11c/0x260 [ 59.435011][ T1354] __x64_sys_read+0x7f/0x90 [ 59.435034][ T1354] x64_sys_call+0x2638/0x2ee0 [ 59.435052][ T1354] do_syscall_64+0x57/0xf0 [ 59.435068][ T1354] ? clear_bhb_loop+0x50/0xa0 [ 59.435090][ T1354] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 59.435110][ T1354] RIP: 0033:0x7f2db6d5ed8e [ 59.435126][ T1354] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 59.435142][ T1354] RSP: 002b:00007f2db7b95fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 59.435162][ T1354] RAX: ffffffffffffffda RBX: 00007f2db7b966c0 RCX: 00007f2db6d5ed8e [ 59.435176][ T1354] RDX: 000000000000000f RSI: 00007f2db7b960a0 RDI: 0000000000000004 [ 59.435188][ T1354] RBP: 00007f2db7b96090 R08: 0000000000000000 R09: 0000000000000000 [ 59.435200][ T1354] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 59.435211][ T1354] R13: 00007f2db7026038 R14: 00007f2db7025fa0 R15: 00007ffedaf11a98 [ 59.435227][ T1354] [ 59.619973][ T1362] rust_binder: Write failure EINVAL in pid:188 [ 59.947649][ T349] usb 1-1: new full-speed USB device number 19 using dummy_hcd [ 59.987617][ T64] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 60.098359][ T349] usb 1-1: not running at top speed; connect to a high speed hub [ 60.106785][ T349] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 60.116943][ T349] usb 1-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 60.126020][ T349] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 60.137389][ T349] usb 1-1: Found UVC 1.00 device (046d:0825) [ 60.148839][ T64] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 60.159854][ T64] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 60.170072][ T64] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 60.181227][ T64] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 60.190400][ T64] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 60.198411][ T64] usb 2-1: Product: syz [ 60.202590][ T64] usb 2-1: Manufacturer: syz [ 60.207196][ T64] usb 2-1: SerialNumber: syz [ 60.215197][ T64] cdc_mbim 2-1:1.0: skipping garbage [ 60.218539][ T1379] FAULT_INJECTION: forcing a failure. [ 60.218539][ T1379] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 60.233632][ T1379] CPU: 0 UID: 0 PID: 1379 Comm: syz.3.385 Not tainted syzkaller #0 0dce1a42a4db61fd93e445decfbc7fc3d71b95b8 [ 60.233665][ T1379] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 60.233679][ T1379] Call Trace: [ 60.233686][ T1379] [ 60.233693][ T1379] __dump_stack+0x21/0x30 [ 60.233723][ T1379] dump_stack_lvl+0x140/0x1c0 [ 60.233748][ T1379] ? __cfi_dump_stack_lvl+0x10/0x10 [ 60.233776][ T1379] dump_stack+0x19/0x20 [ 60.233800][ T1379] should_fail_ex+0x3c2/0x510 [ 60.233813][ T1379] should_fail+0xf/0x20 [ 60.233821][ T1379] should_fail_usercopy+0x1e/0x30 [ 60.233831][ T1379] _copy_from_user+0x20/0xa0 [ 60.233843][ T1379] kvm_arch_dev_ioctl+0x12f/0x990 [ 60.233855][ T1379] ? __cfi_kvm_arch_dev_ioctl+0x10/0x10 [ 60.233867][ T1379] ? selinux_file_ioctl+0x732/0x1480 [ 60.233893][ T1379] ? vfs_write+0xbcf/0xfd0 [ 60.233918][ T1379] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 60.233942][ T1379] ? __cfi_vfs_write+0x10/0x10 [ 60.233957][ T1379] ? __kasan_check_write+0x18/0x20 [ 60.233970][ T1379] ? mutex_unlock+0x90/0x240 [ 60.233982][ T1379] ? __cfi_mutex_unlock+0x10/0x10 [ 60.233993][ T1379] kvm_dev_ioctl+0x48e/0x14c0 [ 60.234004][ T1379] ? __cfi_kvm_dev_ioctl+0x10/0x10 [ 60.234019][ T1379] ? bpf_lsm_file_ioctl+0xd/0x20 [ 60.234039][ T1379] ? security_file_ioctl+0x3e/0x110 [ 60.234062][ T1379] ? __cfi_kvm_dev_ioctl+0x10/0x10 [ 60.234080][ T1379] __se_sys_ioctl+0x126/0x1b0 [ 60.234093][ T1379] __x64_sys_ioctl+0x7f/0xa0 [ 60.234102][ T1379] x64_sys_call+0x1878/0x2ee0 [ 60.234120][ T1379] do_syscall_64+0x57/0xf0 [ 60.234129][ T1379] ? clear_bhb_loop+0x50/0xa0 [ 60.234142][ T1379] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 60.234157][ T1379] RIP: 0033:0x7f29c119e559 [ 60.234174][ T1379] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 60.234190][ T1379] RSP: 002b:00007f29c20cd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 60.234211][ T1379] RAX: ffffffffffffffda RBX: 00007f29c1425fa0 RCX: 00007f29c119e559 [ 60.234226][ T1379] RDX: 0000000000000000 RSI: 000000004018aee3 RDI: 0000000000000003 [ 60.234235][ T1379] RBP: 00007f29c20cd090 R08: 0000000000000000 R09: 0000000000000000 [ 60.234241][ T1379] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 60.234248][ T1379] R13: 00007f29c1426038 R14: 00007f29c1425fa0 R15: 00007ffdd272d118 [ 60.234256][ T1379] [ 60.477844][ T64] cdc_mbim 2-1:1.0: bind() failure [ 60.483705][ T64] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 60.490629][ T64] cdc_ncm 2-1:1.1: bind() failure [ 60.496646][ T64] usb 2-1: USB disconnect, device number 14 [ 60.678073][ T349] usb 1-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 60.747632][ T45] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 60.889996][ T310] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 60.902309][ T45] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 60.917299][ T45] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 60.929784][ T45] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 60.939204][ T45] usb 4-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 60.947380][ T45] usb 4-1: Manufacturer: syz [ 60.954827][ T1389] __nla_validate_parse: 2 callbacks suppressed [ 60.954845][ T1389] netlink: 8 bytes leftover after parsing attributes in process `syz.1.389'. [ 60.956153][ T45] usb 4-1: config 0 descriptor?? [ 61.036792][ T1391] netlink: 36 bytes leftover after parsing attributes in process `syz.1.390'. [ 61.047739][ T310] usb 3-1: Using ep0 maxpacket: 32 [ 61.056964][ T310] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 61.065454][ T310] usb 3-1: config 0 has no interface number 0 [ 61.071958][ T310] usb 3-1: config 0 interface 184 has no altsetting 0 [ 61.082823][ T349] usb 1-1: USB disconnect, device number 19 [ 61.089058][ T310] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 61.100502][ T310] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 61.109207][ T310] usb 3-1: Product: syz [ 61.114659][ T310] usb 3-1: Manufacturer: syz [ 61.120827][ T310] usb 3-1: SerialNumber: syz [ 61.127922][ T310] usb 3-1: config 0 descriptor?? [ 61.133725][ T310] smsc75xx v1.0.0 [ 61.234051][ T1406] netlink: 2 bytes leftover after parsing attributes in process `syz.1.397'. [ 61.261571][ T1410] netlink: 36 bytes leftover after parsing attributes in process `syz.1.399'. [ 61.281911][ T36] kauditd_printk_skb: 11 callbacks suppressed [ 61.281927][ T36] audit: type=1400 audit(1792078298.350:366): avc: granted { setsecparam } for pid=1411 comm="syz.1.400" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security [ 61.611698][ T36] audit: type=1400 audit(1792078298.680:367): avc: denied { mount } for pid=1424 comm="syz.0.405" name="/" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 61.633748][ T36] audit: type=1400 audit(1792078298.680:368): avc: denied { append } for pid=1424 comm="syz.0.405" name="001" dev="devtmpfs" ino=95 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 61.717585][ T9] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 61.735155][ T310] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 61.746113][ T310] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 61.755682][ T310] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 61.766529][ T310] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 61.776619][ T310] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 61.787344][ T310] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 61.797323][ T45] uclogic 0003:256C:006D.000C: failed retrieving string descriptor #200: -71 [ 61.806229][ T310] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -32 [ 61.814548][ T45] uclogic 0003:256C:006D.000C: failed retrieving pen parameters: -71 [ 61.823657][ T45] uclogic 0003:256C:006D.000C: failed probing pen v2 parameters: -71 [ 61.831848][ T45] uclogic 0003:256C:006D.000C: failed probing parameters: -71 [ 61.839378][ T45] uclogic 0003:256C:006D.000C: probe with driver uclogic failed with error -71 [ 61.849781][ T45] usb 4-1: USB disconnect, device number 21 [ 61.857845][ T9] usb 2-1: device descriptor read/64, error -71 [ 62.097619][ T9] usb 2-1: device descriptor read/64, error -71 [ 62.320714][ T1433] netlink: 36 bytes leftover after parsing attributes in process `syz.3.408'. [ 62.337978][ T36] audit: type=1400 audit(1792078299.410:369): avc: denied { setattr } for pid=1434 comm="syz.3.409" name="[userfaultfd]" dev="anon_inodefs" ino=14968 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 62.362965][ T9] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 62.497634][ T9] usb 2-1: device descriptor read/64, error -71 [ 62.535939][ T36] audit: type=1400 audit(1792078299.600:370): avc: denied { compute_member } for pid=1440 comm="syz.0.411" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 62.562165][ T1443] netlink: 'syz.0.412': attribute type 3 has an invalid length. [ 62.577659][ T45] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 62.737624][ T9] usb 2-1: device descriptor read/64, error -71 [ 62.739222][ T45] usb 4-1: unable to get BOS descriptor or descriptor too short [ 62.752505][ T45] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 62.762674][ T45] usb 4-1: too many endpoints for config 1 interface 0 altsetting 1: 255, using maximum allowed: 30 [ 62.773544][ T45] usb 4-1: config 1 interface 0 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 62.787982][ T45] usb 4-1: New USB device found, idVendor=2b53, idProduct=0031, bcdDevice= 0.40 [ 62.797053][ T45] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 62.805091][ T45] usb 4-1: Product: syz [ 62.809343][ T45] usb 4-1: Manufacturer: syz [ 62.814162][ T45] usb 4-1: SerialNumber: syz [ 62.827606][ T547] usb 1-1: new full-speed USB device number 20 using dummy_hcd [ 62.847674][ T9] usb usb2-port1: attempt power cycle [ 62.978374][ T547] usb 1-1: not running at top speed; connect to a high speed hub [ 62.986834][ T547] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 62.997088][ T547] usb 1-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 63.006164][ T547] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 63.018518][ T547] usb 1-1: Found UVC 1.00 device (046d:0825) [ 63.024214][ T45] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 63.035698][ T45] snd-usb-audio 4-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 63.048581][ T45] snd-usb-audio 4-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 63.058829][ T45] usb 4-1: USB disconnect, device number 22 [ 63.065672][ T324] udevd[324]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.2/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 63.187624][ T9] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 63.208721][ T9] usb 2-1: device descriptor read/8, error -71 [ 63.338589][ T9] usb 2-1: device descriptor read/8, error -71 [ 63.416933][ T547] usb 1-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 63.534488][ T1453] FAULT_INJECTION: forcing a failure. [ 63.534488][ T1453] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 63.547591][ T1453] CPU: 0 UID: 0 PID: 1453 Comm: syz.3.415 Not tainted syzkaller #0 0dce1a42a4db61fd93e445decfbc7fc3d71b95b8 [ 63.547619][ T1453] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 63.547627][ T1453] Call Trace: [ 63.547631][ T1453] [ 63.547637][ T1453] __dump_stack+0x21/0x30 [ 63.547657][ T1453] dump_stack_lvl+0x140/0x1c0 [ 63.547672][ T1453] ? __cfi_dump_stack_lvl+0x10/0x10 [ 63.547687][ T1453] ? check_stack_object+0x138/0x150 [ 63.547705][ T1453] dump_stack+0x19/0x20 [ 63.547719][ T1453] should_fail_ex+0x3c2/0x510 [ 63.547729][ T1453] should_fail+0xf/0x20 [ 63.547740][ T1453] should_fail_usercopy+0x1e/0x30 [ 63.547750][ T1453] _copy_to_user+0x24/0xa0 [ 63.547763][ T1453] simple_read_from_buffer+0xed/0x160 [ 63.547775][ T1453] proc_fail_nth_read+0x1aa/0x220 [ 63.547789][ T1453] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 63.547800][ T1453] ? l2cap_sock_setsockopt+0x144e/0x1d00 [ 63.547811][ T1453] ? bpf_lsm_file_permission+0xd/0x20 [ 63.547823][ T1453] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 63.547834][ T1453] vfs_read+0x28b/0xc70 [ 63.547848][ T1453] ? __cfi_l2cap_sock_setsockopt+0x10/0x10 [ 63.547858][ T1453] ? __cfi_vfs_read+0x10/0x10 [ 63.547871][ T1453] ? __kasan_check_write+0x18/0x20 [ 63.547885][ T1453] ? mutex_lock+0x97/0x1d0 [ 63.547897][ T1453] ? __cfi_mutex_lock+0x10/0x10 [ 63.547908][ T1453] ksys_read+0x145/0x260 [ 63.547921][ T1453] ? __fget_files+0x2bc/0x330 [ 63.547931][ T1453] ? __cfi_ksys_read+0x10/0x10 [ 63.547944][ T1453] ? __kasan_check_write+0x18/0x20 [ 63.547957][ T1453] ? __kasan_check_read+0x15/0x20 [ 63.547969][ T1453] __x64_sys_read+0x7f/0x90 [ 63.547983][ T1453] x64_sys_call+0x2638/0x2ee0 [ 63.547993][ T1453] do_syscall_64+0x57/0xf0 [ 63.548002][ T1453] ? clear_bhb_loop+0x50/0xa0 [ 63.548015][ T1453] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 63.548027][ T1453] RIP: 0033:0x7f29c115ed8e [ 63.548037][ T1453] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 63.548046][ T1453] RSP: 002b:00007f29c20ccfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 63.548058][ T1453] RAX: ffffffffffffffda RBX: 00007f29c20cd6c0 RCX: 00007f29c115ed8e [ 63.548065][ T1453] RDX: 000000000000000f RSI: 00007f29c20cd0a0 RDI: 0000000000000003 [ 63.548072][ T1453] RBP: 00007f29c20cd090 R08: 0000000000000000 R09: 0000000000000000 [ 63.548078][ T1453] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 63.548085][ T1453] R13: 00007f29c1426038 R14: 00007f29c1425fa0 R15: 00007ffdd272d118 [ 63.548093][ T1453] [ 63.811645][ T9] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 63.839692][ T9] usb 2-1: device descriptor read/8, error -71 [ 63.968733][ T9] usb 2-1: device descriptor read/8, error -71 [ 64.013094][ T547] usb 1-1: USB disconnect, device number 20 [ 64.047618][ T64] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 64.077717][ T9] usb usb2-port1: unable to enumerate USB device [ 64.198772][ T64] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 64.209740][ T64] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 64.220323][ T64] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 64.230059][ T64] usb 4-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 64.238087][ T64] usb 4-1: Manufacturer: syz [ 64.243335][ T64] usb 4-1: config 0 descriptor?? [ 64.471607][ T1459] netlink: 36 bytes leftover after parsing attributes in process `syz.1.417'. [ 64.504880][ T1461] veth1_macvtap: entered allmulticast mode [ 64.532682][ T547] usb 3-1: USB disconnect, device number 19 [ 64.562333][ T36] audit: type=1400 audit(1792078301.630:371): avc: denied { map } for pid=1466 comm="syz.0.422" path="socket:[15106]" dev="sockfs" ino=15106 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 64.660685][ T1482] netlink: 36 bytes leftover after parsing attributes in process `syz.0.426'. [ 64.927667][ T9] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 64.967594][ T547] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 65.037598][ T310] usb 3-1: new full-speed USB device number 20 using dummy_hcd [ 65.056602][ C0] raw-gadget.1 gadget.3: ignoring, device is not running [ 65.063789][ T9] usb 1-1: device descriptor read/64, error -71 [ 65.071514][ T64] uclogic 0003:256C:006D.000D: interface is invalid, ignoring [ 65.080306][ T64] usb 4-1: USB disconnect, device number 23 [ 65.119130][ T547] usb 2-1: unable to get BOS descriptor or descriptor too short [ 65.127488][ T547] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 65.138045][ T547] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 65.147001][ T547] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 65.161111][ T547] usb 2-1: New USB device found, idVendor=8086, idProduct=0ad2, bcdDevice= 0.00 [ 65.170228][ T547] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 65.178466][ T547] usb 2-1: Product: syz [ 65.182752][ T547] usb 2-1: Manufacturer: syz [ 65.189407][ T547] uvcvideo 2-1:1.0: Found Unit with invalid ID 0 [ 65.195791][ T547] uvcvideo 2-1:1.0: Found Unit with invalid ID 0 [ 65.202191][ T547] usb 2-1: Found UVC 0.00 device syz (8086:0ad2) [ 65.208592][ T547] usb 2-1: No valid video chain found. [ 65.218590][ T310] usb 3-1: not running at top speed; connect to a high speed hub [ 65.227187][ T310] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 65.238714][ T310] usb 3-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 65.247872][ T310] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 65.257849][ T310] usb 3-1: Found UVC 1.00 device (046d:0825) [ 65.317666][ T9] usb 1-1: device descriptor read/64, error -71 [ 65.557584][ T9] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 65.630408][ T1501] netlink: 72 bytes leftover after parsing attributes in process `syz.3.432'. [ 65.639960][ T1501] bridge: RTM_NEWNEIGH with invalid ether address [ 65.647210][ T1501] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 65.654640][ T1501] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 65.658680][ T310] usb 3-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 65.687591][ T9] usb 1-1: device descriptor read/64, error -71 [ 65.861608][ T310] uvcvideo 3-1:1.1: Failed to query (129) UVC probe control : -71 (exp. 26). [ 65.870572][ T310] uvcvideo 3-1:1.1: Failed to initialize the device (-71). [ 65.879275][ T310] usb 3-1: USB disconnect, device number 20 [ 65.928130][ T9] usb 1-1: device descriptor read/64, error -71 [ 66.037781][ T9] usb usb1-port1: attempt power cycle [ 66.387623][ T9] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 66.406345][ T1508] netlink: 'syz.2.434': attribute type 5 has an invalid length. [ 66.408632][ T9] usb 1-1: device descriptor read/8, error -71 [ 66.414441][ T1508] netlink: 3657 bytes leftover after parsing attributes in process `syz.2.434'. [ 66.432156][ T1508] netlink: 44 bytes leftover after parsing attributes in process `syz.2.434'. [ 66.432881][ T1510] netlink: 36 bytes leftover after parsing attributes in process `syz.3.435'. [ 66.484497][ T547] rust_binder: 1511: undelivered TRANSACTION_COMPLETE [ 66.487636][ T45] rust_binder: 45:45 release transaction 68 in, still active [ 66.548615][ T9] usb 1-1: device descriptor read/8, error -71 [ 66.556218][ T36] audit: type=1400 audit(1792078303.620:372): avc: denied { unmount } for pid=1518 comm="syz.3.439" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 66.787620][ T9] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 66.808736][ T9] usb 1-1: device descriptor read/8, error -71 [ 66.897636][ T547] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 66.948664][ T9] usb 1-1: device descriptor read/8, error -71 [ 67.048798][ T547] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 67.059863][ T547] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 67.069992][ T9] usb usb1-port1: unable to enumerate USB device [ 67.077754][ T547] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 67.087005][ T547] usb 4-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 67.095042][ T547] usb 4-1: Manufacturer: syz [ 67.100159][ T547] usb 4-1: config 0 descriptor?? [ 67.487591][ T45] usb 3-1: new full-speed USB device number 21 using dummy_hcd [ 67.638345][ T45] usb 3-1: not running at top speed; connect to a high speed hub [ 67.647024][ T45] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 67.657264][ T45] usb 3-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 67.666345][ T45] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 67.678210][ T45] usb 3-1: Found UVC 1.00 device (046d:0825) [ 67.711948][ T46] Bluetooth: hci0: Frame reassembly failed (-84) [ 67.758745][ T352] usb 2-1: USB disconnect, device number 19 [ 67.771835][ T1536] netlink: 36 bytes leftover after parsing attributes in process `syz.1.445'. [ 67.914060][ T547] uclogic 0003:256C:006D.000E: failed retrieving string descriptor #100: -71 [ 67.924268][ T547] uclogic 0003:256C:006D.000E: failed retrieving pen parameters: -71 [ 67.932782][ T547] uclogic 0003:256C:006D.000E: failed probing pen v1 parameters: -71 [ 67.940991][ T547] uclogic 0003:256C:006D.000E: failed probing parameters: -71 [ 67.948533][ T547] uclogic 0003:256C:006D.000E: probe with driver uclogic failed with error -71 [ 67.959020][ T547] usb 4-1: USB disconnect, device number 24 [ 68.077675][ T45] usb 3-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 68.167657][ T352] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 68.279563][ T45] uvcvideo 3-1:1.1: Failed to query (129) UVC probe control : -71 (exp. 26). [ 68.288432][ T45] uvcvideo 3-1:1.1: Failed to initialize the device (-71). [ 68.296967][ T45] usb 3-1: USB disconnect, device number 21 [ 68.318698][ T352] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 68.329656][ T352] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 68.339639][ T352] usb 2-1: New USB device found, idVendor=1e7d, idProduct=30d4, bcdDevice= 0.01 [ 68.348715][ T352] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 68.357272][ T352] usb 2-1: config 0 descriptor?? [ 68.508538][ T1190] tipc: Resetting bearer [ 68.515536][ T1190] tipc: Disabling bearer [ 68.550037][ T46] bridge_slave_1: left allmulticast mode [ 68.555942][ T46] bridge_slave_1: left promiscuous mode [ 68.561835][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.571493][ T352] arvo 0003:1E7D:30D4.000F: unknown main item tag 0x0 [ 68.578718][ T46] bridge_slave_0: left allmulticast mode [ 68.584693][ T352] arvo 0003:1E7D:30D4.000F: unknown main item tag 0x0 [ 68.591621][ T46] bridge_slave_0: left promiscuous mode [ 68.597652][ T352] arvo 0003:1E7D:30D4.000F: unknown main item tag 0x0 [ 68.604896][ T352] arvo 0003:1E7D:30D4.000F: unknown main item tag 0x0 [ 68.611894][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.619477][ T352] arvo 0003:1E7D:30D4.000F: unknown main item tag 0x0 [ 68.634430][ T352] arvo 0003:1E7D:30D4.000F: unknown main item tag 0x0 [ 68.648955][ T352] arvo 0003:1E7D:30D4.000F: unknown main item tag 0x0 [ 68.659895][ T352] arvo 0003:1E7D:30D4.000F: hidraw0: USB HID v0.00 Device [HID 1e7d:30d4] on usb-dummy_hcd.1-1/input0 [ 68.733496][ T1550] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.740735][ T1550] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.747941][ T1550] bridge_slave_0: entered allmulticast mode [ 68.754197][ T1550] bridge_slave_0: entered promiscuous mode [ 68.760911][ T46] tipc: Left network mode [ 68.761292][ T1550] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.772837][ T1550] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.780075][ T1550] bridge_slave_1: entered allmulticast mode [ 68.780630][ T36] audit: type=1400 audit(1792078305.850:373): avc: denied { read write } for pid=1542 comm="syz.1.448" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 68.786926][ T1550] bridge_slave_1: entered promiscuous mode [ 68.822520][ T46] veth1_macvtap: left promiscuous mode [ 68.831408][ T46] veth0_vlan: left promiscuous mode [ 68.838807][ T1555] 9pnet_fd: Insufficient options for proto=fd [ 68.845288][ T36] audit: type=1400 audit(1792078305.850:374): avc: denied { open } for pid=1542 comm="syz.1.448" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 68.940897][ T1559] netlink: 36 bytes leftover after parsing attributes in process `syz.2.454'. [ 68.949005][ T1550] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.956807][ T1550] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.964138][ T1550] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.971236][ T1550] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.992882][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.000211][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.009940][ T429] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.017028][ T429] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.017746][ T352] usb 2-1: USB disconnect, device number 20 [ 69.032528][ T429] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.039646][ T429] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.059977][ T1550] veth0_vlan: entered promiscuous mode [ 69.070470][ T1550] veth1_macvtap: entered promiscuous mode [ 69.244548][ T36] audit: type=1400 audit(1792078306.310:375): avc: denied { ioctl } for pid=1566 comm="syz.3.456" path="socket:[17703]" dev="sockfs" ino=17703 ioctlcmd=0x5869 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 69.767659][ T367] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 69.767667][ T547] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 69.770326][ T366] Bluetooth: hci0: command 0x1003 tx timeout [ 69.938788][ T547] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 69.949936][ T547] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 69.960693][ T547] usb 2-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 69.969815][ T547] usb 2-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 69.978018][ T547] usb 2-1: Manufacturer: syz [ 69.983553][ T547] usb 2-1: config 0 descriptor?? [ 70.057590][ T349] usb 1-1: new full-speed USB device number 25 using dummy_hcd [ 70.135245][ T1587] netlink: 36 bytes leftover after parsing attributes in process `syz.3.464'. [ 70.208276][ T349] usb 1-1: not running at top speed; connect to a high speed hub [ 70.216803][ T349] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 70.227038][ T349] usb 1-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 70.236108][ T349] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 70.246154][ T349] usb 1-1: Found UVC 1.00 device (046d:0825) [ 70.437689][ T352] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 70.587709][ T352] usb 4-1: Using ep0 maxpacket: 32 [ 70.594574][ T352] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 128, changing to 7 [ 70.607004][ T352] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 70.616150][ T352] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 70.624434][ T352] usb 4-1: Product: Ф [ 70.628566][ T352] usb 4-1: Manufacturer: 䰊 [ 70.633216][ T352] usb 4-1: SerialNumber: ꉎ蜍璤諭縱⼃ὈḊ왺뚼２兀랧떃㕔䱾᜸﷔捦䔯㽘랸 [ 70.646994][ T349] usb 1-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 70.798615][ T547] uclogic 0003:256C:006D.0010: failed retrieving string descriptor #100: -71 [ 70.807769][ T547] uclogic 0003:256C:006D.0010: failed retrieving pen parameters: -71 [ 70.816038][ T547] uclogic 0003:256C:006D.0010: failed probing pen v1 parameters: -71 [ 70.824253][ T547] uclogic 0003:256C:006D.0010: failed probing parameters: -71 [ 70.831866][ T547] uclogic 0003:256C:006D.0010: probe with driver uclogic failed with error -71 [ 70.842336][ T547] usb 2-1: USB disconnect, device number 21 [ 70.853657][ T349] uvcvideo 1-1:1.1: Failed to query (129) UVC probe control : -71 (exp. 26). [ 70.858381][ T1592] FAULT_INJECTION: forcing a failure. [ 70.858381][ T1592] name failslab, interval 1, probability 0, space 0, times 0 [ 70.862897][ T36] audit: type=1400 audit(1792078307.930:376): avc: denied { mounton } for pid=1591 comm="syz.3.466" path="/7/proc" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=dir permissive=1 [ 70.875341][ T1592] CPU: 0 UID: 0 PID: 1592 Comm: syz.3.466 Not tainted syzkaller #0 0dce1a42a4db61fd93e445decfbc7fc3d71b95b8 [ 70.875371][ T1592] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 70.875384][ T1592] Call Trace: [ 70.875391][ T1592] [ 70.875400][ T1592] __dump_stack+0x21/0x30 [ 70.875436][ T1592] dump_stack_lvl+0x140/0x1c0 [ 70.875464][ T1592] ? __cfi_dump_stack_lvl+0x10/0x10 [ 70.875489][ T1592] ? tun_net_init+0x7b/0x400 [ 70.875515][ T1592] ? tun_chr_ioctl+0x2e/0x40 [ 70.875538][ T1592] ? __x64_sys_ioctl+0x7f/0xa0 [ 70.875556][ T1592] ? x64_sys_call+0x1878/0x2ee0 [ 70.875575][ T1592] ? do_syscall_64+0x57/0xf0 [ 70.875592][ T1592] dump_stack+0x19/0x20 [ 70.875615][ T1592] should_fail_ex+0x3c2/0x510 [ 70.875635][ T1592] should_failslab+0xac/0x100 [ 70.875653][ T1592] __kmalloc_node_noprof+0x69/0x500 [ 70.875678][ T1592] ? __kvmalloc_node_noprof+0x128/0x300 [ 70.875700][ T1592] ? timer_update_keys+0xd0/0xd0 [ 70.875720][ T1592] __kvmalloc_node_noprof+0x128/0x300 [ 70.875742][ T1592] ? __cfi___kvmalloc_node_noprof+0x10/0x10 [ 70.875766][ T1592] ? selinux_tun_dev_attach_queue+0x60/0x100 [ 70.875789][ T1592] ? bpf_lsm_tun_dev_attach+0xd/0x20 [ 70.875806][ T1592] tun_attach+0x7ba/0xed0 [ 70.875833][ T1592] tun_net_init+0x31c/0x400 [ 70.875857][ T1592] register_netdevice+0x3f6/0x1a80 [ 70.875884][ T1592] ? __kmalloc_cache_noprof+0x23c/0x470 [ 70.875909][ T1592] ? __cfi_register_netdevice+0x10/0x10 [ 70.875934][ T1592] ? alloc_netdev_mqs+0xd45/0x13d0 [ 70.875952][ T1592] tun_set_iff+0x828/0xec0 [ 70.875977][ T1592] __tun_chr_ioctl+0x852/0x1fb0 [ 70.876002][ T1592] ? tun_flow_create+0x400/0x400 [ 70.876027][ T1592] ? __fget_files+0x2bc/0x330 [ 70.876045][ T1592] tun_chr_ioctl+0x2e/0x40 [ 70.876068][ T1592] ? __cfi_tun_chr_ioctl+0x10/0x10 [ 70.876099][ T1592] __se_sys_ioctl+0x126/0x1b0 [ 70.876118][ T1592] __x64_sys_ioctl+0x7f/0xa0 [ 70.876135][ T1592] x64_sys_call+0x1878/0x2ee0 [ 70.876154][ T1592] do_syscall_64+0x57/0xf0 [ 70.876170][ T1592] ? clear_bhb_loop+0x50/0xa0 [ 70.876194][ T1592] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 70.876216][ T1592] RIP: 0033:0x7f4fab99e559 [ 70.876234][ T1592] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 70.876249][ T1592] RSP: 002b:00007f4fac815028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 70.876269][ T1592] RAX: ffffffffffffffda RBX: 00007f4fabc25fa0 RCX: 00007f4fab99e559 [ 70.876283][ T1592] RDX: 0000200000002d40 RSI: 00000000400454ca RDI: 0000000000000009 [ 70.876296][ T1592] RBP: 00007f4faba358b0 R08: 0000000000000000 R09: 0000000000000000 [ 70.876308][ T1592] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 70.876320][ T1592] R13: 00007f4fabc26038 R14: 00007f4fabc25fa0 R15: 00007ffd18efb138 [ 70.876335][ T1592] [ 70.931468][ T1592] 9pnet: p9_errstr2errno: server reported unknown error [ 70.933887][ T349] uvcvideo 1-1:1.1: Failed to initialize the device (-71). [ 70.971731][ T366] Bluetooth: hci1: command 0x1003 tx timeout [ 70.977195][ T54] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 71.209606][ T352] usb 4-1: found format II with max.bitrate = 4095, frame size=0 [ 71.217397][ T352] usb 4-1: 1:1 : invalid UAC_FORMAT_TYPE desc [ 71.224324][ T352] usb 4-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 71.234318][ T349] usb 1-1: USB disconnect, device number 25 [ 71.246761][ T352] usb 4-1: USB disconnect, device number 25 [ 71.329870][ T36] audit: type=1400 audit(1792078308.400:377): avc: denied { getopt } for pid=1598 comm="syz.2.469" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 71.379304][ T1611] netlink: 'syz.0.472': attribute type 64 has an invalid length. [ 71.414551][ T1614] FAULT_INJECTION: forcing a failure. [ 71.414551][ T1614] name failslab, interval 1, probability 0, space 0, times 0 [ 71.436399][ T1614] CPU: 0 UID: 0 PID: 1614 Comm: syz.0.473 Not tainted syzkaller #0 0dce1a42a4db61fd93e445decfbc7fc3d71b95b8 [ 71.436422][ T1614] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 71.436430][ T1614] Call Trace: [ 71.436434][ T1614] [ 71.436438][ T1614] __dump_stack+0x21/0x30 [ 71.436461][ T1614] dump_stack_lvl+0x140/0x1c0 [ 71.436475][ T1614] ? __cfi_dump_stack_lvl+0x10/0x10 [ 71.436490][ T1614] ? __kasan_check_write+0x18/0x20 [ 71.436505][ T1614] ? proc_fail_nth_write+0x184/0x220 [ 71.436518][ T1614] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 71.436535][ T1614] dump_stack+0x19/0x20 [ 71.436550][ T1614] should_fail_ex+0x3c2/0x510 [ 71.436562][ T1614] should_failslab+0xac/0x100 [ 71.436573][ T1614] kmem_cache_alloc_noprof+0x42/0x410 [ 71.436589][ T1614] ? getname_flags+0xcc/0x6b0 [ 71.436604][ T1614] ? __cfi_vfs_write+0x10/0x10 [ 71.436618][ T1614] getname_flags+0xcc/0x6b0 [ 71.436632][ T1614] getname+0x1b/0x30 [ 71.436651][ T1614] do_sys_openat2+0xda/0x1d0 [ 71.436670][ T1614] ? fput+0x1a4/0x230 [ 71.436687][ T1614] ? do_sys_open+0x100/0x100 [ 71.436707][ T1614] ? ksys_write+0x1f3/0x260 [ 71.436721][ T1614] ? __cfi_ksys_write+0x10/0x10 [ 71.436734][ T1614] __x64_sys_openat+0x13a/0x170 [ 71.436746][ T1614] x64_sys_call+0xe69/0x2ee0 [ 71.436756][ T1614] do_syscall_64+0x57/0xf0 [ 71.436766][ T1614] ? clear_bhb_loop+0x50/0xa0 [ 71.436779][ T1614] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 71.436791][ T1614] RIP: 0033:0x7f9445f9e559 [ 71.436801][ T1614] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 71.436810][ T1614] RSP: 002b:00007f9446eb4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 71.436822][ T1614] RAX: ffffffffffffffda RBX: 00007f9446225fa0 RCX: 00007f9445f9e559 [ 71.436830][ T1614] RDX: 0000000000002000 RSI: 00002000000001c0 RDI: ffffffffffffff9c [ 71.436837][ T1614] RBP: 00007f9446eb4090 R08: 0000000000000000 R09: 0000000000000000 [ 71.436844][ T1614] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 71.436850][ T1614] R13: 00007f9446226038 R14: 00007f9446225fa0 R15: 00007ffc54852438 [ 71.436859][ T1614] [ 71.686165][ T366] Bluetooth: hci0: sending frame failed (-49) [ 71.693716][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -49 [ 71.821660][ T1628] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.828745][ T1628] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.835824][ T1628] bridge_slave_0: entered allmulticast mode [ 71.842200][ T1628] bridge_slave_0: entered promiscuous mode [ 71.849498][ T1628] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.856603][ T1628] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.864103][ T1628] bridge_slave_1: entered allmulticast mode [ 71.870358][ T1628] bridge_slave_1: entered promiscuous mode [ 71.876511][ T46] bridge_slave_1: left allmulticast mode [ 71.882418][ T46] bridge_slave_1: left promiscuous mode [ 71.888128][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.895558][ T46] bridge_slave_0: left allmulticast mode [ 71.901397][ T46] bridge_slave_0: left promiscuous mode [ 71.907112][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.981288][ T1628] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.988379][ T1628] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.995738][ T1628] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.002804][ T1628] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.010348][ T352] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 72.019591][ T46] tipc: Disabling bearer [ 72.025073][ T46] tipc: Left network mode [ 72.030050][ T349] usb 4-1: new full-speed USB device number 26 using dummy_hcd [ 72.037763][ T429] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.045323][ T429] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.054509][ T46] veth0_vlan: left promiscuous mode [ 72.095381][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.102482][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.112438][ T429] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.119509][ T429] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.151907][ T1628] veth0_vlan: entered promiscuous mode [ 72.163031][ T1628] veth1_macvtap: entered promiscuous mode [ 72.186874][ T352] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 72.203771][ T349] usb 4-1: not running at top speed; connect to a high speed hub [ 72.211632][ T1638] 9pnet_fd: p9_fd_create_tcp (1638): problem connecting socket to 127.0.0.1 [ 72.217650][ T352] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 72.232698][ T349] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 72.239224][ T36] audit: type=1400 audit(1792078309.310:378): avc: denied { setattr } for pid=1639 comm="syz.1.483" name="binder0" dev="binder" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 72.243633][ T349] usb 4-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 72.267930][ T64] rust_binder: 1639: undelivered TRANSACTION_COMPLETE [ 72.275250][ T349] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 72.289583][ T352] usb 1-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 72.298947][ T352] usb 1-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 72.307829][ T352] usb 1-1: Manufacturer: syz [ 72.314310][ T349] usb 4-1: Found UVC 1.00 device (046d:0825) [ 72.321917][ T352] usb 1-1: config 0 descriptor?? [ 72.349651][ T1643] Restarting kernel threads ... done. [ 72.405700][ T1645] ======================================================= [ 72.405700][ T1645] WARNING: The mand mount option has been deprecated and [ 72.405700][ T1645] and is ignored by this kernel. Remove the mand [ 72.405700][ T1645] option from the mount to silence this warning. [ 72.405700][ T1645] ======================================================= [ 72.475453][ T1652] rust_binder: 1651:1652 no such ref 3 [ 72.677698][ T64] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 72.715013][ T349] usb 4-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 72.737667][ T547] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 72.807887][ T64] usb 2-1: device descriptor read/64, error -71 [ 72.889442][ T547] usb 3-1: unable to get BOS descriptor or descriptor too short [ 72.897894][ T547] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 72.908019][ T547] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 72.919035][ T547] usb 3-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 72.937565][ T547] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 72.945630][ T547] usb 3-1: Product: syz [ 72.960264][ T547] usb 3-1: Manufacturer: syz [ 72.965337][ T547] usb 3-1: SerialNumber: syz [ 73.057619][ T64] usb 2-1: device descriptor read/64, error -71 [ 73.126807][ T45] usb 4-1: USB disconnect, device number 26 [ 73.145469][ T352] uclogic 0003:256C:006D.0011: failed retrieving string descriptor #100: -71 [ 73.154382][ T352] uclogic 0003:256C:006D.0011: failed retrieving pen parameters: -71 [ 73.162756][ T352] uclogic 0003:256C:006D.0011: failed probing pen v1 parameters: -71 [ 73.170938][ T352] uclogic 0003:256C:006D.0011: failed probing parameters: -71 [ 73.178557][ T352] uclogic 0003:256C:006D.0011: probe with driver uclogic failed with error -71 [ 73.179499][ T547] usb 3-1: selecting invalid altsetting 1 [ 73.189085][ T352] usb 1-1: USB disconnect, device number 26 [ 73.200654][ T547] usb 3-1: unit 3 not found! [ 73.206321][ T547] usb 3-1: unit 6 not found! [ 73.297615][ T64] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 73.396115][ T547] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 73.411891][ T360] udevd[360]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 73.427670][ T64] usb 2-1: device descriptor read/64, error -71 [ 73.596175][ T547] usb 3-1: USB disconnect, device number 22 [ 73.667690][ T64] usb 2-1: device descriptor read/64, error -71 [ 73.776547][ T1676] device-mapper: ioctl: ioctl interface mismatch: kernel(4.48.0), user(0.0.0), cmd(9) [ 73.777708][ T64] usb usb2-port1: attempt power cycle [ 73.800047][ T1678] FAULT_INJECTION: forcing a failure. [ 73.800047][ T1678] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 73.813833][ T1678] CPU: 0 UID: 0 PID: 1678 Comm: syz.0.497 Not tainted syzkaller #0 0dce1a42a4db61fd93e445decfbc7fc3d71b95b8 [ 73.813867][ T1678] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 73.813879][ T1678] Call Trace: [ 73.813884][ T1678] [ 73.813891][ T1678] __dump_stack+0x21/0x30 [ 73.813922][ T1678] dump_stack_lvl+0x140/0x1c0 [ 73.813968][ T1678] ? __cfi_dump_stack_lvl+0x10/0x10 [ 73.813993][ T1678] dump_stack+0x19/0x20 [ 73.814012][ T1678] should_fail_ex+0x3c2/0x510 [ 73.814027][ T1678] should_fail+0xf/0x20 [ 73.814040][ T1678] should_fail_usercopy+0x1e/0x30 [ 73.814055][ T1678] _copy_from_user+0x20/0xa0 [ 73.814073][ T1678] dm_ctl_ioctl+0x151/0xde0 [ 73.814094][ T1678] ? selinux_file_ioctl+0x732/0x1480 [ 73.814114][ T1678] ? __cfi_dm_ctl_ioctl+0x10/0x10 [ 73.814136][ T1678] ? __fget_files+0x2bc/0x330 [ 73.814151][ T1678] ? bpf_lsm_file_ioctl+0xd/0x20 [ 73.814165][ T1678] ? security_file_ioctl+0x3e/0x110 [ 73.814184][ T1678] ? __cfi_dm_ctl_ioctl+0x10/0x10 [ 73.814203][ T1678] __se_sys_ioctl+0x126/0x1b0 [ 73.814218][ T1678] __x64_sys_ioctl+0x7f/0xa0 [ 73.814231][ T1678] x64_sys_call+0x1878/0x2ee0 [ 73.814246][ T1678] do_syscall_64+0x57/0xf0 [ 73.814260][ T1678] ? clear_bhb_loop+0x50/0xa0 [ 73.814279][ T1678] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 73.814296][ T1678] RIP: 0033:0x7f9445f9e559 [ 73.814309][ T1678] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 73.814322][ T1678] RSP: 002b:00007f9446eb4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 73.814339][ T1678] RAX: ffffffffffffffda RBX: 00007f9446225fa0 RCX: 00007f9445f9e559 [ 73.814350][ T1678] RDX: 0000200000000280 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 73.814360][ T1678] RBP: 00007f9446eb4090 R08: 0000000000000000 R09: 0000000000000000 [ 73.814370][ T1678] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 73.814386][ T1678] R13: 00007f9446226038 R14: 00007f9446225fa0 R15: 00007ffc54852438 [ 73.814399][ T1678] [ 74.108079][ T352] usb 4-1: new full-speed USB device number 27 using dummy_hcd [ 74.258278][ T352] usb 4-1: not running at top speed; connect to a high speed hub [ 74.266727][ T352] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 74.277235][ T352] usb 4-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 74.286321][ T45] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 74.294041][ T352] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 74.297570][ T64] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 74.314244][ T352] usb 4-1: Found UVC 1.00 device (046d:0825) [ 74.328778][ T64] usb 2-1: device descriptor read/8, error -71 [ 74.448563][ T45] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 74.459549][ T45] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 74.468621][ T64] usb 2-1: device descriptor read/8, error -71 [ 74.470200][ T45] usb 1-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 74.484562][ T45] usb 1-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 74.492839][ T45] usb 1-1: Manufacturer: syz [ 74.498221][ T45] usb 1-1: config 0 descriptor?? [ 74.567818][ T349] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 74.707609][ T64] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 74.716440][ T352] usb 4-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 74.725898][ T349] usb 3-1: Using ep0 maxpacket: 16 [ 74.732433][ T349] usb 3-1: unable to get BOS descriptor or descriptor too short [ 74.739392][ T64] usb 2-1: device descriptor read/8, error -71 [ 74.740272][ T349] usb 3-1: no configurations [ 74.751324][ T349] usb 3-1: can't read configurations, error -22 [ 74.868714][ T64] usb 2-1: device descriptor read/8, error -71 [ 74.887874][ T349] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 74.977669][ T64] usb usb2-port1: unable to enumerate USB device [ 75.037578][ T349] usb 3-1: Using ep0 maxpacket: 16 [ 75.044177][ T349] usb 3-1: unable to get BOS descriptor or descriptor too short [ 75.052468][ T349] usb 3-1: no configurations [ 75.057092][ T349] usb 3-1: can't read configurations, error -22 [ 75.063526][ T349] usb usb3-port1: attempt power cycle [ 75.119160][ T352] usb 4-1: USB disconnect, device number 27 [ 75.312726][ T45] uclogic 0003:256C:006D.0012: failed retrieving string descriptor #100: -71 [ 75.321637][ T45] uclogic 0003:256C:006D.0012: failed retrieving pen parameters: -71 [ 75.329908][ T45] uclogic 0003:256C:006D.0012: failed probing pen v1 parameters: -71 [ 75.338151][ T45] uclogic 0003:256C:006D.0012: failed probing parameters: -71 [ 75.345643][ T45] uclogic 0003:256C:006D.0012: probe with driver uclogic failed with error -71 [ 75.356280][ T45] usb 1-1: USB disconnect, device number 27 [ 75.417650][ T349] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 75.432422][ T1691] kvm: pic: non byte read [ 75.437758][ T1691] device-mapper: ioctl: ioctl interface mismatch: kernel(4.48.0), user(46.0.0), cmd(9) [ 75.437976][ T349] usb 3-1: Using ep0 maxpacket: 16 [ 75.453972][ T349] usb 3-1: unable to get BOS descriptor or descriptor too short [ 75.461797][ T349] usb 3-1: no configurations [ 75.466380][ T349] usb 3-1: can't read configurations, error -22 [ 75.546220][ T1694] rust_binder: Write failure EINVAL in pid:18 [ 75.597723][ T349] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 75.637772][ T349] usb 3-1: Using ep0 maxpacket: 16 [ 75.644348][ T349] usb 3-1: unable to get BOS descriptor or descriptor too short [ 75.652130][ T349] usb 3-1: no configurations [ 75.656835][ T349] usb 3-1: can't read configurations, error -22 [ 75.677715][ T349] usb usb3-port1: unable to enumerate USB device [ 75.967631][ T349] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 76.117588][ T349] usb 4-1: Using ep0 maxpacket: 8 [ 76.124161][ T349] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 76.134826][ T349] usb 4-1: New USB device found, idVendor=0421, idProduct=0335, bcdDevice=5f.0e [ 76.144288][ T349] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 76.155005][ T349] usb 4-1: config 0 descriptor?? [ 76.165611][ T349] usb 4-1: bad CDC descriptors [ 76.365749][ T349] usb 4-1: USB disconnect, device number 28 [ 76.514078][ T36] audit: type=1400 audit(1792078313.580:379): avc: denied { listen } for pid=1714 comm="syz.1.511" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 76.572203][ T36] audit: type=1400 audit(1792078313.640:380): avc: denied { map } for pid=1717 comm="syz.1.512" path="/9/mnt" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 76.573738][ T1718] syz.1.512 uses obsolete (PF_INET,SOCK_PACKET) [ 76.625670][ T36] audit: type=1400 audit(1792078313.690:381): avc: denied { associate } for pid=1721 comm="syz.1.513" name="core" scontext=root:object_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 76.647748][ T36] audit: type=1400 audit(1792078313.690:382): avc: denied { mounton } for pid=1719 comm="syz.1.513" path="/proc/29/task" dev="proc" ino=17402 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 76.897614][ T36] audit: type=1400 audit(1792078313.960:383): avc: denied { read } for pid=1728 comm="syz.0.517" name="usbmon8" dev="devtmpfs" ino=115 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 76.917627][ T349] usb 2-1: new full-speed USB device number 26 using dummy_hcd [ 76.922598][ T36] audit: type=1400 audit(1792078313.970:384): avc: denied { open } for pid=1728 comm="syz.0.517" path="/dev/usbmon8" dev="devtmpfs" ino=115 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 77.078363][ T349] usb 2-1: not running at top speed; connect to a high speed hub [ 77.086933][ T349] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 77.097120][ T349] usb 2-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 77.107105][ T349] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 77.117594][ T352] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 77.125869][ T349] usb 2-1: Found UVC 1.00 device (046d:0825) [ 77.157588][ T45] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 77.278649][ T352] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 77.289887][ T352] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 77.300456][ T352] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 77.309608][ T352] usb 4-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 77.317701][ T45] usb 1-1: Using ep0 maxpacket: 8 [ 77.322794][ T352] usb 4-1: Manufacturer: syz [ 77.329260][ T45] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 77.339787][ T352] usb 4-1: config 0 descriptor?? [ 77.345256][ T45] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 77.356315][ T45] usb 1-1: New USB device found, idVendor=0e41, idProduct=4249, bcdDevice= 0.40 [ 77.361441][ T1736] /dev/sr0: Can't lookup blockdev [ 77.365509][ T45] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 77.378920][ T45] usb 1-1: Product: syz [ 77.383125][ T45] usb 1-1: Manufacturer: syz [ 77.387784][ T45] usb 1-1: SerialNumber: syz [ 77.407332][ T36] audit: type=1400 audit(1792078314.470:385): avc: denied { connect } for pid=1739 comm="new_name" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 77.409497][ T1740] rust_binder: 1739:1740 tried to use weak ref as strong ref [ 77.434240][ T1740] rust_binder: 1739:1740 error while translating object: EINVAL [ 77.442038][ T1740] rust_binder: 1739:1740 transaction reply to 1739:1740 failed EINVAL, code 0 size 72-24 line thread.rs:865 [ 77.461763][ T402] rust_binder: 1739: undelivered TRANSACTION_COMPLETE [ 77.468801][ T402] rust_binder: 1739: undelivered TRANSACTION_ERROR: 29201 [ 77.476215][ T402] rust_binder: 1739: undelivered TRANSACTION_ERROR: 29190 [ 77.528650][ T349] usb 2-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 77.787662][ T402] usb 3-1: new full-speed USB device number 27 using dummy_hcd [ 77.932285][ T349] usb 2-1: USB disconnect, device number 26 [ 77.939611][ T402] usb 3-1: too many endpoints for config 1 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 77.950960][ T402] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 77.962630][ T402] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 77.973621][ T402] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 255 [ 77.988200][ T402] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 77.997489][ T402] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 78.005600][ T402] usb 3-1: SerialNumber: syz [ 78.169426][ C1] raw-gadget.1 gadget.3: ignoring, device is not running [ 78.176704][ T352] uclogic 0003:256C:006D.0013: interface is invalid, ignoring [ 78.186948][ T352] usb 4-1: USB disconnect, device number 29 [ 78.214133][ T402] cdc_acm 3-1:1.0: probe with driver cdc_acm failed with error -12 [ 78.223466][ T402] usb 3-1: USB disconnect, device number 27 [ 78.464508][ T36] audit: type=1400 audit(1792078315.530:386): avc: denied { read write } for pid=1751 comm="syz.1.526" name="mtrr" dev="proc" ino=4026532004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 78.488163][ T36] audit: type=1400 audit(1792078315.530:387): avc: denied { open } for pid=1751 comm="syz.1.526" path="/14/proc/mtrr" dev="proc" ino=4026532004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 78.511684][ T36] audit: type=1400 audit(1792078315.540:388): avc: denied { ioctl } for pid=1751 comm="syz.1.526" path="/14/proc/mtrr" dev="proc" ino=4026532004 ioctlcmd=0x4d08 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 78.634360][ T36] audit: type=1400 audit(1792078315.700:389): avc: denied { write } for pid=1758 comm="syz.1.529" name="usb_gadget" dev="configfs" ino=1257 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 78.657660][ T36] audit: type=1400 audit(1792078315.700:390): avc: denied { add_name } for pid=1758 comm="syz.1.529" name="g_uac2" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 78.678545][ T36] audit: type=1400 audit(1792078315.700:391): avc: denied { write } for pid=1758 comm="syz.1.529" name="c_volume_present" dev="configfs" ino=18927 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 78.702355][ T36] audit: type=1400 audit(1792078315.700:392): avc: denied { open } for pid=1758 comm="syz.1.529" path="/17/config/usb_gadget/g_uac2/functions/uac2.usb0/c_volume_present" dev="configfs" ino=18927 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 78.730691][ T36] audit: type=1400 audit(1792078315.700:393): avc: denied { ioctl } for pid=1758 comm="syz.1.529" path="/17/config/usb_gadget/g_uac2/functions/uac2.usb0/c_volume_present" dev="configfs" ino=18927 ioctlcmd=0x586b scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 78.779867][ T1769] 9pnet_fd: Insufficient options for proto=fd [ 78.957588][ T384] usb 4-1: new full-speed USB device number 30 using dummy_hcd [ 79.108463][ T384] usb 4-1: not running at top speed; connect to a high speed hub [ 79.116977][ T384] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 79.127206][ T384] usb 4-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 79.136285][ T384] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 79.144479][ T64] usb 3-1: new full-speed USB device number 28 using dummy_hcd [ 79.154595][ T384] usb 4-1: Found UVC 1.00 device (046d:0825) [ 79.224673][ T1787] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=1787 comm=syz.1.541 [ 79.298301][ T64] usb 3-1: not running at top speed; connect to a high speed hub [ 79.307138][ T64] usb 3-1: config 1 has an invalid descriptor of length 49, skipping remainder of the config [ 79.317547][ T64] usb 3-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 79.326612][ T64] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 79.337155][ T64] usb 3-1: Found UVC 1.00 device (046d:0825) [ 79.344420][ T64] usb 3-1: No streaming interface found for terminal 2. [ 79.487622][ T547] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 79.538851][ T402] usb 3-1: USB disconnect, device number 28 [ 79.563340][ T384] usb 4-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 79.648717][ T547] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 79.659719][ T547] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 79.670329][ T547] usb 2-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 79.679527][ T547] usb 2-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 79.687570][ T547] usb 2-1: Manufacturer: syz [ 79.693111][ T547] usb 2-1: config 0 descriptor?? [ 79.855824][ T45] usb 1-1: unit 6 not found! [ 79.860509][ T45] usb 1-1: unit 0 not found! [ 79.869575][ T45] usb 1-1: USB disconnect, device number 28 [ 79.882483][ T361] udevd[361]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 79.957090][ T1797] overlayfs: unescaped trailing colons in lowerdir mount option. [ 79.976670][ T384] usb 4-1: USB disconnect, device number 30 [ 80.044938][ T1804] FAULT_INJECTION: forcing a failure. [ 80.044938][ T1804] name failslab, interval 1, probability 0, space 0, times 0 [ 80.057730][ T1804] CPU: 0 UID: 0 PID: 1804 Comm: syz.0.548 Not tainted syzkaller #0 0dce1a42a4db61fd93e445decfbc7fc3d71b95b8 [ 80.057762][ T1804] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 80.057773][ T1804] Call Trace: [ 80.057778][ T1804] [ 80.057784][ T1804] __dump_stack+0x21/0x30 [ 80.057817][ T1804] dump_stack_lvl+0x140/0x1c0 [ 80.057840][ T1804] ? __cfi_dump_stack_lvl+0x10/0x10 [ 80.057866][ T1804] dump_stack+0x19/0x20 [ 80.057889][ T1804] should_fail_ex+0x3c2/0x510 [ 80.057907][ T1804] should_failslab+0xac/0x100 [ 80.057925][ T1804] __kmalloc_node_track_caller_noprof+0x65/0x4f0 [ 80.057952][ T1804] ? v9fs_session_init+0xb7/0x18a0 [ 80.057977][ T1804] kstrdup+0x4d/0x130 [ 80.057998][ T1804] ? v9fs_session_init+0xa6/0x18a0 [ 80.058021][ T1804] v9fs_session_init+0xb7/0x18a0 [ 80.058046][ T1804] ? __cfi_v9fs_session_init+0x10/0x10 [ 80.058067][ T1804] ? kasan_save_alloc_info+0x3a/0x50 [ 80.058089][ T1804] ? __kasan_kmalloc+0x96/0xb0 [ 80.058106][ T1804] ? __kmalloc_cache_noprof+0x23c/0x470 [ 80.058141][ T1804] ? v9fs_mount+0xc1/0x9d0 [ 80.058155][ T36] audit: type=1400 audit(1792078317.130:394): avc: denied { ioctl } for pid=1805 comm="syz.2.549" path="/dev/fuse" dev="devtmpfs" ino=23 ioctlcmd=0xe500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 80.058157][ T1804] v9fs_mount+0xdb/0x9d0 [ 80.058175][ T1804] ? __cfi_v9fs_mount+0x10/0x10 [ 80.058192][ T1804] ? selinux_capable+0x38/0x50 [ 80.058209][ T1804] legacy_get_tree+0x106/0x1b0 [ 80.058228][ T1804] ? __cfi_v9fs_mount+0x10/0x10 [ 80.058245][ T1804] vfs_get_tree+0x9e/0x290 [ 80.058269][ T1804] do_new_mount+0x251/0xb40 [ 80.058293][ T1804] ? security_capable+0x44/0x130 [ 80.058319][ T1804] path_mount+0x66a/0xff0 [ 80.058340][ T1804] ? putname+0x113/0x150 [ 80.058365][ T1804] __se_sys_mount+0x2bf/0x480 [ 80.058389][ T1804] ? ksys_write+0x1f3/0x260 [ 80.058412][ T1804] ? __x64_sys_mount+0xf0/0xf0 [ 80.058437][ T1804] __x64_sys_mount+0xc3/0xf0 [ 80.058460][ T1804] x64_sys_call+0x2021/0x2ee0 [ 80.058478][ T1804] do_syscall_64+0x57/0xf0 [ 80.058495][ T1804] ? clear_bhb_loop+0x50/0xa0 [ 80.058516][ T1804] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 80.058536][ T1804] RIP: 0033:0x7f9445f9e559 [ 80.058552][ T1804] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 80.058567][ T1804] RSP: 002b:00007f9446eb4028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 80.058587][ T1804] RAX: ffffffffffffffda RBX: 00007f9446225fa0 RCX: 00007f9445f9e559 [ 80.058600][ T1804] RDX: 0000200000004500 RSI: 00002000000000c0 RDI: 0000000000000000 [ 80.058613][ T1804] RBP: 00007f9446eb4090 R08: 0000200000000100 R09: 0000000000000000 [ 80.058625][ T1804] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 80.058636][ T1804] R13: 00007f9446226038 R14: 00007f9446225fa0 R15: 00007ffc54852438 [ 80.058652][ T1804] [ 80.450228][ T1813] kvm: emulating exchange as write [ 80.531162][ T547] uclogic 0003:256C:006D.0014: failed retrieving string descriptor #100: -71 [ 80.541639][ T547] uclogic 0003:256C:006D.0014: failed retrieving pen parameters: -71 [ 80.549775][ T547] uclogic 0003:256C:006D.0014: failed probing pen v1 parameters: -71 [ 80.557945][ T547] uclogic 0003:256C:006D.0014: failed probing parameters: -71 [ 80.565433][ T547] uclogic 0003:256C:006D.0014: probe with driver uclogic failed with error -71 [ 80.579586][ T547] usb 2-1: USB disconnect, device number 27 [ 80.687602][ T45] usb 1-1: new full-speed USB device number 29 using dummy_hcd [ 80.838413][ T45] usb 1-1: not running at top speed; connect to a high speed hub [ 80.847889][ T45] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 80.858548][ T45] usb 1-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 80.867889][ T45] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 80.888527][ T45] usb 1-1: Found UVC 1.00 device (046d:0825) [ 81.118424][ T1828] netlink: 44 bytes leftover after parsing attributes in process `syz.1.557'. [ 81.647608][ T402] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 81.797568][ T402] usb 4-1: Using ep0 maxpacket: 32 [ 81.802784][ T349] usb 3-1: new full-speed USB device number 29 using dummy_hcd [ 81.811426][ T402] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 81.819961][ T402] usb 4-1: config 0 has no interface number 0 [ 81.826382][ T402] usb 4-1: config 0 interface 184 has no altsetting 0 [ 81.835610][ T402] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 81.844711][ T402] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 81.852752][ T402] usb 4-1: Product: syz [ 81.856945][ T402] usb 4-1: Manufacturer: syz [ 81.861564][ T402] usb 4-1: SerialNumber: syz [ 81.866730][ T402] usb 4-1: config 0 descriptor?? [ 81.872487][ T402] smsc75xx v1.0.0 [ 81.958249][ T349] usb 3-1: not running at top speed; connect to a high speed hub [ 81.966750][ T349] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 81.976913][ T349] usb 3-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 81.985991][ T349] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 81.996346][ T349] usb 3-1: Found UVC 1.00 device (046d:0825) [ 82.067589][ T547] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 82.189492][ T45] uvcvideo 1-1:1.1: Failed to query (129) UVC probe control : -71 (exp. 26). [ 82.199349][ T45] uvcvideo 1-1:1.1: Failed to initialize the device (-71). [ 82.208191][ T45] usb 1-1: USB disconnect, device number 29 [ 82.219091][ T547] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 82.230087][ T547] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 82.241422][ T547] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 82.251217][ T547] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 82.265187][ T547] usb 2-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 82.275197][ T547] usb 2-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 82.283340][ T547] usb 2-1: Manufacturer: syz [ 82.288680][ T547] usb 2-1: config 0 descriptor?? [ 82.407182][ T349] usb 3-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 82.484498][ T402] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 82.495446][ T402] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 82.495840][ T1842] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=1842 comm=syz.1.563 [ 82.518312][ T547] appleir 0003:05AC:8243.0015: unknown main item tag 0x0 [ 82.525762][ T547] appleir 0003:05AC:8243.0015: No inputs registered, leaving [ 82.534559][ T547] appleir 0003:05AC:8243.0015: hiddev96,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.1-1/input0 [ 82.597623][ T45] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 82.705613][ T402] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -32 [ 82.717780][ T402] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -32 [ 82.730021][ T402] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 82.730536][ T547] usb 2-1: USB disconnect, device number 28 [ 82.739604][ T402] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -32 [ 82.759312][ T45] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 82.770285][ T45] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 82.770834][ T384] usb 4-1: USB disconnect, device number 31 [ 82.780812][ T45] usb 1-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 82.795063][ T45] usb 1-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 82.803155][ T45] usb 1-1: Manufacturer: syz [ 82.810316][ T64] usb 3-1: USB disconnect, device number 29 [ 82.811449][ T45] usb 1-1: config 0 descriptor?? [ 83.356124][ T36] kauditd_printk_skb: 3 callbacks suppressed [ 83.356142][ T36] audit: type=1400 audit(1792078320.420:398): avc: denied { wake_alarm } for pid=1865 comm="syz.3.571" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 83.406155][ T36] audit: type=1400 audit(1792078320.470:399): avc: denied { write } for pid=1877 comm="syz.1.574" name="ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 83.441530][ T1881] FAULT_INJECTION: forcing a failure. [ 83.441530][ T1881] name failslab, interval 1, probability 0, space 0, times 0 [ 83.454622][ T1881] CPU: 1 UID: 0 PID: 1881 Comm: syz.1.575 Not tainted syzkaller #0 0dce1a42a4db61fd93e445decfbc7fc3d71b95b8 [ 83.454655][ T1881] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 83.454667][ T1881] Call Trace: [ 83.454672][ T1881] [ 83.454680][ T1881] __dump_stack+0x21/0x30 [ 83.454713][ T1881] dump_stack_lvl+0x140/0x1c0 [ 83.454739][ T1881] ? __cfi_dump_stack_lvl+0x10/0x10 [ 83.454762][ T1881] ? avc_has_perm+0x155/0x240 [ 83.454779][ T1881] ? __cfi_avc_has_perm+0x10/0x10 [ 83.454795][ T1881] dump_stack+0x19/0x20 [ 83.454818][ T1881] should_fail_ex+0x3c2/0x510 [ 83.454834][ T1881] should_failslab+0xac/0x100 [ 83.454851][ T1881] __kmalloc_cache_noprof+0x41/0x470 [ 83.454874][ T1881] ? vhost_task_create+0x12c/0x3f0 [ 83.454894][ T1881] ? __cfi_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 83.454920][ T1881] vhost_task_create+0x12c/0x3f0 [ 83.454939][ T1881] ? __cfi_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 83.454967][ T1881] ? __cfi_vhost_task_create+0x10/0x10 [ 83.454997][ T1881] ? __cfi_vhost_task_fn+0x10/0x10 [ 83.455014][ T1881] ? __kasan_check_write+0x18/0x20 [ 83.455035][ T1881] ? mutex_lock+0x97/0x1d0 [ 83.455056][ T1881] ? __cfi_mutex_lock+0x10/0x10 [ 83.455074][ T1881] ? kernel_text_address+0xa9/0xe0 [ 83.455100][ T1881] kvm_mmu_post_init_vm+0x161/0x300 [ 83.455118][ T1881] kvm_arch_vcpu_ioctl_run+0xf3/0x1bc0 [ 83.455142][ T1881] ? _parse_integer_limit+0x195/0x1e0 [ 83.455166][ T1881] ? __cfi_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 83.455191][ T1881] ? kstrtoull+0x13b/0x1e0 [ 83.455215][ T1881] ? kstrtouint+0x78/0xf0 [ 83.455238][ T1881] ? ioctl_has_perm+0x1bc/0x500 [ 83.455255][ T1881] ? __asan_memcpy+0x5a/0x80 [ 83.455272][ T1881] ? ioctl_has_perm+0x408/0x500 [ 83.455285][ T1881] ? has_cap_mac_admin+0xd0/0xd0 [ 83.455298][ T1881] ? __kasan_check_write+0x18/0x20 [ 83.455314][ T1881] ? mutex_lock_killable+0x97/0x1d0 [ 83.455331][ T1881] ? __cfi_mutex_lock_killable+0x10/0x10 [ 83.455344][ T1881] ? proc_fail_nth_write+0x184/0x220 [ 83.455360][ T1881] kvm_vcpu_ioctl+0xa43/0x1000 [ 83.455372][ T1881] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 83.455386][ T1881] ? __cfi_vfs_write+0x10/0x10 [ 83.455403][ T1881] ? __kasan_check_write+0x18/0x20 [ 83.455418][ T1881] ? mutex_unlock+0x90/0x240 [ 83.455429][ T1881] ? __cfi_mutex_unlock+0x10/0x10 [ 83.455446][ T1881] ? __fget_files+0x2bc/0x330 [ 83.455457][ T1881] ? bpf_lsm_file_ioctl+0xd/0x20 [ 83.455470][ T1881] ? security_file_ioctl+0x3e/0x110 [ 83.455490][ T1881] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 83.455500][ T1881] __se_sys_ioctl+0x126/0x1b0 [ 83.455513][ T1881] __x64_sys_ioctl+0x7f/0xa0 [ 83.455522][ T1881] x64_sys_call+0x1878/0x2ee0 [ 83.455537][ T1881] do_syscall_64+0x57/0xf0 [ 83.455547][ T1881] ? clear_bhb_loop+0x50/0xa0 [ 83.455563][ T1881] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 83.455576][ T1881] RIP: 0033:0x7f910ff9e559 [ 83.455588][ T1881] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 83.455598][ T1881] RSP: 002b:00007f9110dbc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 83.455614][ T1881] RAX: ffffffffffffffda RBX: 00007f9110225fa0 RCX: 00007f910ff9e559 [ 83.455622][ T1881] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 83.455629][ T1881] RBP: 00007f9110dbc090 R08: 0000000000000000 R09: 0000000000000000 [ 83.455635][ T1881] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 83.455642][ T1881] R13: 00007f9110226038 R14: 00007f9110225fa0 R15: 00007ffc4ed1c968 [ 83.455651][ T1881] [ 83.819908][ T45] uclogic 0003:256C:006D.0016: failed retrieving string descriptor #100: -71 [ 83.829297][ T45] uclogic 0003:256C:006D.0016: failed retrieving pen parameters: -71 [ 83.837482][ T45] uclogic 0003:256C:006D.0016: failed probing pen v1 parameters: -71 [ 83.845790][ T45] uclogic 0003:256C:006D.0016: failed probing parameters: -71 [ 83.853520][ T45] uclogic 0003:256C:006D.0016: probe with driver uclogic failed with error -71 [ 83.864498][ T45] usb 1-1: USB disconnect, device number 30 [ 83.877568][ T384] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 83.939160][ T36] audit: type=1400 audit(1792078321.010:400): avc: denied { map } for pid=1888 comm="syz.3.577" path="pipe:[20632]" dev="pipefs" ino=20632 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 84.037621][ T384] usb 3-1: Using ep0 maxpacket: 32 [ 84.044865][ T384] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x8C has invalid maxpacket 1536, setting to 1024 [ 84.056105][ T384] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 1024 [ 84.068326][ T384] usb 3-1: string descriptor 0 read error: -22 [ 84.074652][ T384] usb 3-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 84.083942][ T384] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 84.092950][ T1861] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 84.101731][ T384] usb 3-1: MIDIStreaming interface descriptor not found [ 84.117592][ T402] usb 2-1: new full-speed USB device number 29 using dummy_hcd [ 84.268319][ T402] usb 2-1: not running at top speed; connect to a high speed hub [ 84.276903][ T402] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 84.287090][ T402] usb 2-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 84.296193][ T402] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 84.308923][ T402] usb 2-1: Found UVC 1.00 device (046d:0825) [ 84.427669][ T384] rust_binder: 1898: undelivered TRANSACTION_COMPLETE [ 84.687629][ T45] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 84.709841][ T402] usb 2-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 84.817598][ T45] usb 1-1: device descriptor read/64, error -71 [ 85.057595][ T45] usb 1-1: device descriptor read/64, error -71 [ 85.112021][ T402] usb 2-1: USB disconnect, device number 29 [ 85.137602][ T384] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 85.289373][ T384] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 85.297605][ T45] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 85.300384][ T384] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 85.322479][ T384] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 85.331655][ T384] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 85.339720][ T384] usb 4-1: Product: syz [ 85.343873][ T384] usb 4-1: Manufacturer: syz [ 85.348494][ T384] usb 4-1: SerialNumber: syz [ 85.355310][ T384] cdc_mbim 4-1:1.0: skipping garbage [ 85.437699][ T45] usb 1-1: device descriptor read/64, error -71 [ 85.554756][ T1906] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 85.687667][ T45] usb 1-1: device descriptor read/64, error -71 [ 85.764061][ T384] cdc_mbim 4-1:1.0: bind() failure [ 85.770069][ T384] cdc_ncm 4-1:1.1: probe with driver cdc_ncm failed with error -71 [ 85.778306][ T384] cdc_mbim 4-1:1.1: probe with driver cdc_mbim failed with error -71 [ 85.787991][ T384] usb 4-1: USB disconnect, device number 32 [ 85.807746][ T45] usb usb1-port1: attempt power cycle [ 85.887629][ T9] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 86.037589][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 86.043824][ T9] usb 2-1: config 0 has an invalid interface number: 196 but max is 0 [ 86.052207][ T9] usb 2-1: config 0 has no interface number 0 [ 86.058552][ T9] usb 2-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 86.068594][ T9] usb 2-1: config 0 interface 196 has no altsetting 0 [ 86.076796][ T9] usb 2-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 86.085976][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 86.094047][ T9] usb 2-1: Product: syz [ 86.098311][ T9] usb 2-1: Manufacturer: syz [ 86.102931][ T9] usb 2-1: SerialNumber: syz [ 86.108183][ T9] usb 2-1: config 0 descriptor?? [ 86.113476][ T1913] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 86.167792][ T45] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 86.188627][ T45] usb 1-1: device descriptor read/8, error -71 [ 86.318617][ T45] usb 1-1: device descriptor read/8, error -71 [ 86.350044][ T384] usb 3-1: USB disconnect, device number 30 [ 86.507655][ T402] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 86.557619][ T45] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 86.578650][ T45] usb 1-1: device descriptor read/8, error -71 [ 86.657650][ T402] usb 4-1: Using ep0 maxpacket: 32 [ 86.663955][ T402] usb 4-1: config 0 has an invalid interface number: 67 but max is 0 [ 86.672266][ T402] usb 4-1: config 0 has no interface number 0 [ 86.679917][ T402] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 86.689190][ T402] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 86.697187][ T402] usb 4-1: Product: syz [ 86.701390][ T402] usb 4-1: Manufacturer: syz [ 86.705996][ T402] usb 4-1: SerialNumber: syz [ 86.707581][ T384] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 86.718803][ T402] usb 4-1: config 0 descriptor?? [ 86.723831][ T45] usb 1-1: device descriptor read/8, error -71 [ 86.730932][ T402] smsc95xx v2.0.0 [ 86.827756][ T9] ipheth 2-1:0.196: ipheth_enable_ncm: usb_control_msg: -110 [ 86.837598][ T9] ipheth 2-1:0.196: Apple iPhone USB Ethernet device attached [ 86.837889][ T45] usb usb1-port1: unable to enumerate USB device [ 86.868820][ T384] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 86.879985][ T384] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 86.891546][ T384] usb 3-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 86.900905][ T384] usb 3-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 86.909013][ T384] usb 3-1: Manufacturer: syz [ 86.915258][ T384] usb 3-1: config 0 descriptor?? [ 87.132866][ T402] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 87.143721][ T402] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 87.189453][ T9] usb 2-1: USB disconnect, device number 30 [ 87.248626][ T9] ipheth 2-1:0.196: Apple iPhone USB Ethernet now disconnected [ 87.601841][ T1958] rust_binder: Write failure EINVAL in pid:183 [ 87.639696][ T36] audit: type=1400 audit(1792078324.710:401): avc: denied { create } for pid=1959 comm="syz.0.592" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 87.731028][ T384] uclogic 0003:256C:006D.0017: failed retrieving string descriptor #100: -71 [ 87.739912][ T384] uclogic 0003:256C:006D.0017: failed retrieving pen parameters: -71 [ 87.748262][ T384] uclogic 0003:256C:006D.0017: failed probing pen v1 parameters: -71 [ 87.756440][ T384] uclogic 0003:256C:006D.0017: failed probing parameters: -71 [ 87.758638][ T402] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000104: -71 [ 87.764097][ T384] uclogic 0003:256C:006D.0017: probe with driver uclogic failed with error -71 [ 87.776549][ T402] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -71 [ 87.788306][ T384] usb 3-1: USB disconnect, device number 31 [ 87.794257][ T402] usb 4-1: USB disconnect, device number 33 [ 87.947606][ T349] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 87.955230][ T45] usb 2-1: new full-speed USB device number 31 using dummy_hcd [ 88.107639][ T349] usb 1-1: Using ep0 maxpacket: 16 [ 88.113624][ T45] usb 2-1: not running at top speed; connect to a high speed hub [ 88.121921][ T349] usb 1-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 88.132253][ T349] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 88.141238][ T45] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 88.151448][ T45] usb 2-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 88.160632][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 88.169059][ T349] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 88.178596][ T349] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 88.186638][ T349] usb 1-1: SerialNumber: syz [ 88.192301][ T45] usb 2-1: Found UVC 1.00 device (046d:0825) [ 88.200580][ T349] usb 1-1: 0:2 : does not exist [ 88.254725][ T36] audit: type=1400 audit(1792078325.320:402): avc: denied { mounton } for pid=1965 comm="syz.2.594" path="/48/mnt/proc" dev="sda1" ino=1264 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 88.280562][ T1969] FAULT_INJECTION: forcing a failure. [ 88.280562][ T1969] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 88.293742][ T1969] CPU: 1 UID: 0 PID: 1969 Comm: syz.3.595 Not tainted syzkaller #0 0dce1a42a4db61fd93e445decfbc7fc3d71b95b8 [ 88.293775][ T1969] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 88.293788][ T1969] Call Trace: [ 88.293795][ T1969] [ 88.293810][ T1969] __dump_stack+0x21/0x30 [ 88.293843][ T1969] dump_stack_lvl+0x140/0x1c0 [ 88.293873][ T1969] ? __cfi_dump_stack_lvl+0x10/0x10 [ 88.293901][ T1969] ? check_stack_object+0x138/0x150 [ 88.293929][ T1969] dump_stack+0x19/0x20 [ 88.293954][ T1969] should_fail_ex+0x3c2/0x510 [ 88.293974][ T1969] should_fail+0xf/0x20 [ 88.293991][ T1969] should_fail_usercopy+0x1e/0x30 [ 88.294011][ T1969] _copy_to_user+0x24/0xa0 [ 88.294034][ T1969] simple_read_from_buffer+0xed/0x160 [ 88.294056][ T1969] proc_fail_nth_read+0x1aa/0x220 [ 88.294080][ T1969] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 88.294102][ T1969] ? kvm_arch_dev_ioctl+0x14a/0x990 [ 88.294122][ T1969] ? __cfi_kvm_arch_dev_ioctl+0x10/0x10 [ 88.294143][ T1969] ? bpf_lsm_file_permission+0xd/0x20 [ 88.294163][ T1969] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 88.294185][ T1969] vfs_read+0x28b/0xc70 [ 88.294210][ T1969] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 88.294236][ T1969] ? __cfi_vfs_read+0x10/0x10 [ 88.294260][ T1969] ? __kasan_check_write+0x18/0x20 [ 88.294285][ T1969] ? mutex_lock+0x97/0x1d0 [ 88.294305][ T1969] ? __cfi_mutex_lock+0x10/0x10 [ 88.294327][ T1969] ksys_read+0x145/0x260 [ 88.294351][ T1969] ? __cfi_ksys_read+0x10/0x10 [ 88.294374][ T1969] ? __kasan_check_write+0x18/0x20 [ 88.294397][ T1969] ? fput+0x1a4/0x230 [ 88.294416][ T1969] ? __kasan_check_read+0x15/0x20 [ 88.294440][ T1969] __x64_sys_read+0x7f/0x90 [ 88.294464][ T1969] x64_sys_call+0x2638/0x2ee0 [ 88.294484][ T1969] do_syscall_64+0x57/0xf0 [ 88.294501][ T1969] ? clear_bhb_loop+0x50/0xa0 [ 88.294524][ T1969] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 88.294546][ T1969] RIP: 0033:0x7f4fab95ed8e [ 88.294563][ T1969] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 88.294579][ T1969] RSP: 002b:00007f4fac814fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 88.294601][ T1969] RAX: ffffffffffffffda RBX: 00007f4fac8156c0 RCX: 00007f4fab95ed8e [ 88.294616][ T1969] RDX: 000000000000000f RSI: 00007f4fac8150a0 RDI: 0000000000000004 [ 88.294628][ T1969] RBP: 00007f4fac815090 R08: 0000000000000000 R09: 0000000000000000 [ 88.294641][ T1969] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 88.294653][ T1969] R13: 00007f4fabc26038 R14: 00007f4fabc25fa0 R15: 00007ffd18efb138 [ 88.294670][ T1969] [ 88.693033][ T1976] rust_binder: 1975:1976 got transaction to invalid handle 1 [ 88.700543][ T1976] rust_binder: 1975:1976 transaction call to 0:0 failed ENOENT, code 0 size 0-0 line process.rs:952 [ 88.711996][ T1976] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 88.720226][ T1976] rust_binder: Read failure Err(EFAULT) in pid:95 [ 88.738172][ T352] rust_binder: 1975: undelivered TRANSACTION_ERROR: 29201 [ 88.745447][ T45] usb 2-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 88.757167][ T349] usb 1-1: 5:0: failed to get current value for ch 1 (-22) [ 88.769947][ T349] usb 1-1: 5:0: failed to get current value for ch 2 (-22) [ 88.782295][ T349] usb 1-1: 5:0: failed to get current value for ch 3 (-22) [ 88.797235][ T349] usb 1-1: 5:0: failed to get current value for ch 0 (-22) [ 88.813421][ T349] usb 1-1: 5:0: cannot get min/max values for control 2 (id 5) [ 88.824842][ T349] usb 1-1: 5:0: cannot get min/max values for control 2 (id 5) [ 88.835257][ T349] usb 1-1: 5:0: cannot get min/max values for control 3 (id 5) [ 88.845329][ T349] usb 1-1: 5:0: cannot get min/max values for control 3 (id 5) [ 88.856024][ T349] usb 1-1: 5:0: cannot get min/max values for control 4 (id 5) [ 88.865832][ T349] usb 1-1: 5:0: cannot get min/max values for control 4 (id 5) [ 88.876024][ T349] usb 1-1: 5:0: cannot get min/max values for control 5 (id 5) [ 88.885879][ T349] usb 1-1: 5:0: cannot get min/max values for control 5 (id 5) [ 88.897896][ T349] usb 1-1: 5:0: failed to get current value for ch 1 (-22) [ 88.909602][ T349] usb 1-1: 5:0: failed to get current value for ch 2 (-22) [ 88.923218][ T349] usb 1-1: 5:0: failed to get current value for ch 3 (-22) [ 88.931065][ T36] audit: type=1400 audit(1792078326.010:403): avc: denied { rmdir } for pid=1239 comm="syz-executor" name="proc" dev="sda1" ino=1264 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 88.962576][ T349] usb 1-1: 5:0: failed to get current value for ch 0 (-22) [ 88.986104][ T349] usb 1-1: 5:0: cannot get min/max values for control 8 (id 5) [ 89.006926][ T349] usb 1-1: 5:0: cannot get min/max values for control 8 (id 5) [ 89.020869][ T1986] netlink: 12 bytes leftover after parsing attributes in process `syz.3.601'. [ 89.031291][ T349] usb 1-1: USB disconnect, device number 35 [ 89.046039][ T360] udevd[360]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 89.107656][ T1988] incfs: Can't find or create .index dir in ./cgroup [ 89.114682][ T1988] incfs: mount failed -22 [ 89.132642][ T36] audit: type=1400 audit(1792078326.200:404): avc: denied { read write } for pid=1989 comm="syz.3.603" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 89.155939][ T384] usb 2-1: USB disconnect, device number 31 [ 89.163645][ T36] audit: type=1400 audit(1792078326.200:405): avc: denied { open } for pid=1989 comm="syz.3.603" path="/dev/raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 89.187230][ T36] audit: type=1400 audit(1792078326.200:406): avc: denied { ioctl } for pid=1989 comm="syz.3.603" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 89.367603][ T9] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 89.518642][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 89.529693][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 89.540175][ T9] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 89.549303][ T9] usb 4-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 89.557311][ T9] usb 4-1: Manufacturer: syz [ 89.562551][ T9] usb 4-1: config 0 descriptor?? [ 89.712672][ T1239] EXT4-fs error (device sda1): ext4_lookup:1819: inode #529: comm syz-executor: iget: checksum invalid [ 89.723973][ T1239] EXT4-fs error (device sda1): ext4_lookup:1819: inode #529: comm syz-executor: iget: checksum invalid [ 89.781879][ T297] bridge_slave_1: left allmulticast mode [ 89.792079][ T297] bridge_slave_1: left promiscuous mode [ 89.799215][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.807684][ T297] bridge_slave_0: left allmulticast mode [ 89.818748][ T297] bridge_slave_0: left promiscuous mode [ 89.828896][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.949982][ T297] veth1_macvtap: left promiscuous mode [ 89.955700][ T297] veth0_vlan: left promiscuous mode [ 90.037626][ T384] usb 2-1: new full-speed USB device number 32 using dummy_hcd [ 90.208261][ T384] usb 2-1: not running at top speed; connect to a high speed hub [ 90.227964][ T384] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 90.242837][ T384] usb 2-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 90.251925][ T384] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 90.263351][ T384] usb 2-1: Found UVC 1.00 device (046d:0825) [ 90.377065][ T9] uclogic 0003:256C:006D.0018: failed retrieving string descriptor #100: -71 [ 90.385982][ T9] uclogic 0003:256C:006D.0018: failed retrieving pen parameters: -71 [ 90.394092][ T9] uclogic 0003:256C:006D.0018: failed probing pen v1 parameters: -71 [ 90.402222][ T9] uclogic 0003:256C:006D.0018: failed probing parameters: -71 [ 90.410198][ T9] uclogic 0003:256C:006D.0018: probe with driver uclogic failed with error -71 [ 90.420429][ T9] usb 4-1: USB disconnect, device number 34 [ 90.863101][ T384] uvcvideo 2-1:1.1: Failed to set UVC probe control : -71 (exp. 26). [ 90.871465][ T384] uvcvideo 2-1:1.1: Failed to query (129) UVC probe control : -71 (exp. 26). [ 90.880278][ T384] uvcvideo 2-1:1.1: Failed to initialize the device (-71). [ 90.889051][ T384] usb 2-1: USB disconnect, device number 32 [ 91.254195][ T2039] netlink: 2 bytes leftover after parsing attributes in process `syz.0.607'. [ 91.265952][ T36] audit: type=1400 audit(1792078328.330:407): avc: denied { create } for pid=2037 comm="syz.3.608" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 91.288196][ T36] audit: type=1400 audit(1792078328.360:408): avc: denied { write } for pid=2037 comm="syz.3.608" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 91.308503][ T36] audit: type=1400 audit(1792078328.360:409): avc: denied { nlmsg_write } for pid=2037 comm="syz.3.608" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 91.497622][ T352] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 91.648787][ T352] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 91.658921][ T352] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 91.672480][ T352] usb 1-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 0.09 [ 91.681549][ T352] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 91.689998][ T352] usb 1-1: SerialNumber: syz [ 91.696732][ T352] usb-storage 1-1:1.0: USB Mass Storage device detected [ 91.898371][ T384] usb 1-1: USB disconnect, device number 36 [ 91.992224][ T2055] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 92.001951][ T2055] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 92.010763][ T2055] bpf: Bad value for 'gid' [ 92.013382][ T36] audit: type=1400 audit(1792078329.090:410): avc: denied { mounton } for pid=2053 comm="syz.1.614" path="/43/bus" dev="tmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 92.037903][ T2049] fuse: Bad value for 'rootmode' [ 92.039727][ T2056] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=145 sclass=netlink_route_socket pid=2056 comm=syz.1.614 [ 92.055609][ T2057] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=145 sclass=netlink_route_socket pid=2057 comm=syz.1.614 [ 92.068918][ T36] audit: type=1400 audit(1792078329.110:411): avc: denied { mounton } for pid=2048 comm="syz.3.611" path="/41/file0" dev="tmpfs" ino=235 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=sock_file permissive=1 [ 92.237619][ T349] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 92.387584][ T349] usb 2-1: Using ep0 maxpacket: 16 [ 92.393959][ T349] usb 2-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 92.404686][ T349] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 92.414335][ T349] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 92.423447][ T349] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 92.431467][ T349] usb 2-1: SerialNumber: syz [ 92.438302][ T349] usb 2-1: 0:2 : does not exist [ 92.829964][ T2065] EXT4-fs warning (device sda1): ext4_resize_begin:82: There are errors in the filesystem, so online resizing is not allowed [ 93.097577][ T352] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 93.191916][ T349] usb 2-1: 5:0: failed to get current value for ch 1 (-22) [ 93.202895][ T349] usb 2-1: 5:0: failed to get current value for ch 2 (-22) [ 93.214067][ T349] usb 2-1: 5:0: failed to get current value for ch 3 (-22) [ 93.225371][ T349] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 93.236933][ T349] usb 2-1: 5:0: cannot get min/max values for control 2 (id 5) [ 93.246720][ T349] usb 2-1: 5:0: cannot get min/max values for control 2 (id 5) [ 93.255536][ T352] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 93.266690][ T352] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 93.277385][ T352] usb 1-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 93.286567][ T352] usb 1-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 93.294636][ T349] usb 2-1: 5:0: cannot get min/max values for control 3 (id 5) [ 93.302422][ T352] usb 1-1: Manufacturer: syz [ 93.308303][ T352] usb 1-1: config 0 descriptor?? [ 93.314094][ T349] usb 2-1: 5:0: cannot get min/max values for control 3 (id 5) [ 93.324390][ T349] usb 2-1: 5:0: cannot get min/max values for control 4 (id 5) [ 93.334164][ T349] usb 2-1: 5:0: cannot get min/max values for control 4 (id 5) [ 93.343895][ T349] usb 2-1: 5:0: cannot get min/max values for control 5 (id 5) [ 93.353661][ T349] usb 2-1: 5:0: cannot get min/max values for control 5 (id 5) [ 93.363408][ T349] usb 2-1: 5:0: failed to get current value for ch 1 (-22) [ 93.374191][ T349] usb 2-1: 5:0: failed to get current value for ch 2 (-22) [ 93.384924][ T349] usb 2-1: 5:0: failed to get current value for ch 3 (-22) [ 93.396044][ T349] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 93.407086][ T349] usb 2-1: 5:0: cannot get min/max values for control 8 (id 5) [ 93.416932][ T349] usb 2-1: 5:0: cannot get min/max values for control 8 (id 5) [ 93.426991][ T349] usb 2-1: USB disconnect, device number 33 [ 93.733869][ T2075] rust_binder: 2074:2075 BC_CLEAR_DEATH_NOTIFICATION invalid ref 3 [ 93.977606][ T349] usb 4-1: new full-speed USB device number 35 using dummy_hcd [ 94.121697][ T352] uclogic 0003:256C:006D.0019: failed retrieving string descriptor #100: -71 [ 94.130716][ T352] uclogic 0003:256C:006D.0019: failed retrieving pen parameters: -71 [ 94.138934][ T352] uclogic 0003:256C:006D.0019: failed probing pen v1 parameters: -71 [ 94.147147][ T352] uclogic 0003:256C:006D.0019: failed probing parameters: -71 [ 94.154699][ T352] uclogic 0003:256C:006D.0019: probe with driver uclogic failed with error -71 [ 94.164811][ T349] usb 4-1: not running at top speed; connect to a high speed hub [ 94.164881][ T361] udevd[361]: setting mode of /dev/bus/usb/001/037 to 020664 failed: Read-only file system [ 94.172763][ T352] usb 1-1: USB disconnect, device number 37 [ 94.183612][ T361] udevd[361]: setting owner of /dev/bus/usb/001/037 to uid=0, gid=0 failed: Read-only file system [ 94.198346][ T349] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 94.205789][ T360] udevd[360]: symlink '../bus/usb/001/037' '/dev/char/189:36.tmp-c189:36' failed: Read-only file system [ 94.210187][ T349] usb 4-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 94.226692][ T360] udevd[360]: symlink '../bus/usb/001/037' '/dev/char/189:36.tmp-c189:36' failed: Read-only file system [ 94.229938][ T349] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.251369][ T349] usb 4-1: Found UVC 1.00 device (046d:0825) [ 94.852599][ T349] uvcvideo 4-1:1.1: Failed to set UVC probe control : -71 (exp. 26). [ 94.865568][ T349] uvcvideo 4-1:1.1: Failed to query (129) UVC probe control : -71 (exp. 26). [ 94.874622][ T349] uvcvideo 4-1:1.1: Failed to initialize the device (-71). [ 94.884490][ T349] usb 4-1: USB disconnect, device number 35 [ 95.859819][ T2099] netlink: 44 bytes leftover after parsing attributes in process `syz.1.627'. [ 95.891530][ T36] audit: type=1326 audit(1792078332.960:412): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2102 comm="syz.3.628" exe="/root/ci2-android-6-12-rust/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f4fab99e559 code=0x0 [ 95.898394][ T2107] rust_binder: 2106:2107 BC_CLEAR_DEATH_NOTIFICATION invalid ref 3 [ 96.117611][ T349] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 96.267592][ T349] usb 1-1: Using ep0 maxpacket: 16 [ 96.273854][ T349] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 96.284810][ T349] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 96.294579][ T349] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 96.307386][ T349] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 96.316448][ T349] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 96.325073][ T349] usb 1-1: config 0 descriptor?? [ 96.732043][ T2101] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 96.740638][ T2101] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 96.799873][ T349] usbhid 1-1:0.0: can't add hid device: -71 [ 96.805885][ T349] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 96.814934][ T349] usb 1-1: USB disconnect, device number 38 [ 97.347631][ T349] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 97.498613][ T349] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 97.509617][ T349] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 97.520104][ T349] usb 2-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 97.529211][ T349] usb 2-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 97.537190][ T349] usb 2-1: Manufacturer: syz [ 97.542469][ T349] usb 2-1: config 0 descriptor?? [ 98.355730][ T349] uclogic 0003:256C:006D.001A: failed retrieving string descriptor #100: -71 [ 98.364615][ T349] uclogic 0003:256C:006D.001A: failed retrieving pen parameters: -71 [ 98.372777][ T349] uclogic 0003:256C:006D.001A: failed probing pen v1 parameters: -71 [ 98.380897][ T349] uclogic 0003:256C:006D.001A: failed probing parameters: -71 [ 98.392578][ T349] uclogic 0003:256C:006D.001A: probe with driver uclogic failed with error -71 [ 98.414571][ T349] usb 2-1: USB disconnect, device number 34 [ 99.813349][ T2136] rust_binder: 2134:2136 BC_CLEAR_DEATH_NOTIFICATION invalid ref 3 [ 101.607698][ T384] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 101.758785][ T384] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 101.769700][ T384] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 101.780221][ T384] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 101.789322][ T384] usb 4-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 101.797295][ T384] usb 4-1: Manufacturer: syz [ 101.802512][ T384] usb 4-1: config 0 descriptor?? [ 102.611121][ T384] uclogic 0003:256C:006D.001B: failed retrieving string descriptor #100: -71 [ 102.620222][ T384] uclogic 0003:256C:006D.001B: failed retrieving pen parameters: -71 [ 102.628403][ T384] uclogic 0003:256C:006D.001B: failed probing pen v1 parameters: -71 [ 102.636516][ T384] uclogic 0003:256C:006D.001B: failed probing parameters: -71 [ 102.644040][ T384] uclogic 0003:256C:006D.001B: probe with driver uclogic failed with error -71 [ 102.654254][ T384] usb 4-1: USB disconnect, device number 36 [ 102.978484][ T2187] veth1_to_bond: entered promiscuous mode [ 102.984275][ T2187] veth1_to_bond: entered allmulticast mode [ 103.071209][ T2199] syzkaller0: entered promiscuous mode [ 103.077153][ T2199] syzkaller0: entered allmulticast mode [ 104.760854][ T36] audit: type=1400 audit(1792078341.830:413): avc: denied { view } for pid=2213 comm="syz.1.672" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 105.717656][ T384] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 105.867630][ T384] usb 4-1: Using ep0 maxpacket: 8 [ 105.873846][ T384] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 105.884171][ T384] usb 4-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 105.893592][ T384] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.904906][ T384] usb 4-1: config 0 descriptor?? [ 106.897608][ T384] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 107.047802][ T384] usb 2-1: Using ep0 maxpacket: 32 [ 107.054102][ T384] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 107.065697][ T384] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 107.074836][ T384] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 107.083278][ T384] usb 2-1: Product: syz [ 107.087443][ T384] usb 2-1: Manufacturer: syz [ 107.092090][ T384] usb 2-1: SerialNumber: syz [ 107.097616][ T384] usb 2-1: config 0 descriptor?? [ 107.102914][ T2240] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 107.110708][ T384] hub 2-1:0.0: bad descriptor, ignoring hub [ 107.116611][ T384] hub 2-1:0.0: probe with driver hub failed with error -5 [ 107.417680][ T349] usb 2-1: USB disconnect, device number 35 [ 107.732188][ T349] usb 4-1: USB disconnect, device number 37 [ 108.554683][ T36] audit: type=1400 audit(1792078345.620:414): avc: denied { append } for pid=2250 comm="syz.0.686" name="uprobe_events" dev="tracefs" ino=1054 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 110.579032][ T36] audit: type=1400 audit(1792078347.650:415): avc: denied { bind } for pid=2264 comm="syz.3.691" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 110.606368][ T36] audit: type=1400 audit(1792078347.650:416): avc: denied { read } for pid=2264 comm="syz.3.691" path="socket:[23580]" dev="sockfs" ino=23580 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 110.787586][ T384] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 110.947556][ T384] usb 2-1: Using ep0 maxpacket: 8 [ 110.953804][ T384] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 110.964967][ T384] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 110.977969][ T384] usb 2-1: New USB device found, idVendor=1e7d, idProduct=3138, bcdDevice= 0.00 [ 110.987114][ T384] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.000497][ T384] usb 2-1: config 0 descriptor?? [ 111.413031][ T384] ryos 0003:1E7D:3138.001C: unknown main item tag 0x2 [ 111.420088][ T384] ryos 0003:1E7D:3138.001C: unknown main item tag 0x2 [ 111.427076][ T384] ryos 0003:1E7D:3138.001C: item fetching failed at offset 37/40 [ 111.435340][ T384] ryos 0003:1E7D:3138.001C: parse failed [ 111.441191][ T384] ryos 0003:1E7D:3138.001C: probe with driver ryos failed with error -22 [ 111.619403][ T349] usb 2-1: USB disconnect, device number 36 [ 112.720331][ T2282] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 112.725223][ T2281] FAULT_INJECTION: forcing a failure. [ 112.725223][ T2281] name failslab, interval 1, probability 0, space 0, times 0 [ 112.738539][ T2282] rust_binder: 2278:2282 got transaction to invalid handle 1 [ 112.740161][ T2281] CPU: 1 UID: 0 PID: 2281 Comm: syz.3.697 Not tainted syzkaller #0 0dce1a42a4db61fd93e445decfbc7fc3d71b95b8 [ 112.740190][ T2281] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 112.740204][ T2281] Call Trace: [ 112.740211][ T2281] [ 112.740218][ T2281] __dump_stack+0x21/0x30 [ 112.740264][ T2281] dump_stack_lvl+0x140/0x1c0 [ 112.740293][ T2281] ? __cfi_dump_stack_lvl+0x10/0x10 [ 112.740329][ T2281] dump_stack+0x19/0x20 [ 112.740353][ T2281] should_fail_ex+0x3c2/0x510 [ 112.740374][ T2281] should_failslab+0xac/0x100 [ 112.740392][ T2281] kmem_cache_alloc_noprof+0x42/0x410 [ 112.740416][ T2281] ? dup_fd+0x63/0x9c0 [ 112.740443][ T2281] ? __cfi_avc_has_perm+0x10/0x10 [ 112.740462][ T2281] dup_fd+0x63/0x9c0 [ 112.740486][ T2281] ? __kasan_check_write+0x18/0x20 [ 112.740511][ T2281] ? selinux_task_alloc+0x91/0xc0 [ 112.740536][ T2281] copy_files+0xb7/0x130 [ 112.740569][ T2281] copy_process+0x11f4/0x3350 [ 112.740596][ T2281] ? __cfi_copy_process+0x10/0x10 [ 112.740621][ T2281] kernel_clone+0x233/0x810 [ 112.740648][ T2281] ? __cfi_kernel_clone+0x10/0x10 [ 112.740673][ T2281] ? do_futex+0x32a/0x510 [ 112.740693][ T2281] __x64_sys_clone+0x1b7/0x230 [ 112.740719][ T2281] ? __cfi___x64_sys_clone+0x10/0x10 SYZFAIL: open(/proc/self/ns/net) failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open(/proc/self/ns/net) failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open(/proc/self/ns/net) failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open(/proc/self/ns/net) failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open(/proc/self/ns/net) failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open(/proc/self/ns/net) failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open(/proc/self/ns/net) failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open(/proc/self/ns/net) failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open(/proc/self/ns/net) failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open(/proc/self/ns/net) failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open(/proc/self/ns/net) failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open(/proc/self/ns/net) failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open(/proc/self/ns/net) failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open(/proc/self/ns/net) failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open(/proc/self/ns/net) failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open(/proc/self/ns/net) failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open(/proc/self/ns/net) failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open(/proc/self/ns/net) failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open(/proc/self/ns/net) failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open(/proc/self/ns/net) failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open(/proc/self/ns/net) failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: repeatedly failed to execute the program proc=4 req=605 state=3 status=67 (errno 9: Bad file descriptor) [ 112.740746][ T2281] ? __kasan_check_write+0x18/0x20 [ 112.740769][ T2281] ? fpregs_restore_userregs+0x11c/0x260 [ 112.740792][ T2281] ? switch_fpu_return+0x12/0x20 [ 112.740815][ T2281] x64_sys_call+0x2b3c/0x2ee0 [ 112.740834][ T2281] do_syscall_64+0x57/0xf0 [ 112.740851][ T2281] ? clear_bhb_loop+0x50/0xa0 [ 112.740873][ T2281] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 112.740894][ T2281] RIP: 0033:0x7f4fab99e559 [ 112.740910][ T2281] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 112.740927][ T2281] RSP: 002b:00007f4fac814fd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 112.740948][ T2281] RAX: ffffffffffffffda RBX: 00007f4fabc25fa0 RCX: 00007f4fab99e559 [ 112.740963][ T2281] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000082020000 [ 112.740975][ T2281] RBP: 00007f4faba358b0 R08: 0000000000000000 R09: 0000000000000000 [ 112.740986][ T2281] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 112.740997][ T2281] R13: 00007f4fabc26038 R14: 00007f4fabc25fa0 R15: 00007ffd18efb138 [ 112.741013][ T2281] [ 112.893692][ T36] audit: type=1400 audit(1792078349.960:417): avc: denied { write } for pid=286 comm="syz-executor" path="pipe:[2892]" dev="pipefs" ino=2892 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 112.905477][ T2282] rust_binder: 2278:2282 transaction async to 0:0 failed ENOENT, code 0 size 0-0 line process.rs:952 [ 113.110049][ T402] rust_binder: 2278: undelivered TRANSACTION_ERROR: 29201 [ 113.118062][ T297] bridge_slave_1: left allmulticast mode [ 113.123718][ T297] bridge_slave_1: left promiscuous mode [ 113.129586][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 113.137069][ T297] bridge_slave_0: left allmulticast mode [ 113.142767][ T297] bridge_slave_0: left promiscuous mode [ 113.148466][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 113.250689][ T297] veth1_macvtap: left promiscuous mode [ 113.256204][ T297] veth0_vlan: left promiscuous mode [ 113.478438][ T297] bridge_slave_1: left allmulticast mode [ 113.484105][ T297] bridge_slave_1: left promiscuous mode [ 113.489750][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 113.497155][ T297] bridge_slave_0: left allmulticast mode [ 113.502933][ T297] bridge_slave_0: left promiscuous mode [ 113.508577][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 113.589297][ T297] veth1_macvtap: left promiscuous mode [ 113.594838][ T297] veth0_vlan: left promiscuous mode