last executing test programs: 6.963320792s ago: executing program 3 (id=57): syz_clone3(&(0x7f0000000080)={0x180801400, &(0x7f0000000000)=0xffffffffffffffff, 0x0, 0x0, {0x3d}, 0x0, 0x0, 0x0, 0x0, 0xffaa}, 0x58) waitid$P_PIDFD(0x3, r0, 0x0, 0x40000004, 0x0) 6.942035493s ago: executing program 3 (id=58): openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) (async) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) memfd_secret(0x80000) (async) r3 = memfd_secret(0x80000) mmap$IORING_OFF_SQ_RING(0x0, 0x3000, 0x4000002, 0x22013, r3, 0x0) ioctl$TIOCSERGETLSR(r3, 0x5459, &(0x7f00000001c0)) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000380)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0xc0686611, &(0x7f0000000180)={0x67, 0x0, 0x18, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1400000014000103f7000000010000000a"], 0x14}}, 0x4014) syz_genetlink_get_family_id$smc(&(0x7f0000000100), r5) syz_usb_connect(0x3, 0x36, &(0x7f0000000500)=ANY=[@ANYRES16=r5], &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x5, [{0xe8, &(0x7f0000000300)=@string={0xe8, 0x3, "7ed2765053bb7ccb478109dc8823f499b0673d364db843d946f1ecd89fc0816704d09fe7f2f624fa42c2208d1e249bb806b94994bbd2da8ea25787590a4e97a39d19ad9685b4f455e6d75157b5b83ac62aa0f2422928cbfad67f736fad1141c0dcd9de93f0befe2aaa23e6a06b9a8e4f3c3cbe81b1f50aa375456fe5663ccff93ab2f7b9d0ef34b069a67c8e080db6a34562c75c1a78a79b3bbd49b998d8a3567df68b1db237d24ff118669faacd981a87c398c46df78d0280ce58c449ad57052f1797a083f0339fe8eafb2a381c6abf08ed217f90903d7648b7ab7ad802f66cb50feae8cfbc"}}, {0x4, &(0x7f0000000040)=@lang_id={0x4, 0x3, 0x180a}}, {0xb1, &(0x7f0000000080)=@string={0xb1, 0x3, "9cba31528dc6a463850fd1f4b2e8440f8d1d5e36fd7a38876000ab0187c48682ebd3ab6525223fab5b8a79e144bd844667cb75210780f9cc7bcda58ceef8aec370b8372406dee72ae82619771e525fdff7f0581dbfb76a0e65f7f40b7e37814158551906b8b038a51a0eaa0a25df5905fb3a36d9d96a51e45ff8732c745a667fd0b8df3f2aedaa1e1b4b4d2b08b741890b546136528dc24888f1e3095752b12f412e0bc46d7198f10e2d2a8a0c3a75"}}, {0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x3001}}, {0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x240a}}]}) 4.308709224s ago: executing program 0 (id=77): socket(0xa, 0x3, 0x3a) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$ppp(0xffffffffffffff9c, 0x0, 0x24440, 0x0) (async) ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000440)={0x2, 'vlan1\x00', {0x7f}, 0x11}) (async) r1 = socket(0x2, 0x2, 0x0) ioctl$BTRFS_IOC_GET_DEV_STATS(r1, 0xc4089434, &(0x7f0000000480)={0x0, 0xfffffffffffffffd, 0x1, [0x400, 0x50000, 0x8, 0xfffffffffffffffd, 0x5], [0xa, 0x0, 0x3, 0x80000001, 0x100000001, 0x68c4, 0x4, 0x1b4, 0x8, 0x5, 0xfffffffffffffffb, 0x7fff, 0x3, 0x4, 0x3, 0x8, 0xe, 0x8, 0x7fff, 0x5, 0x7, 0x7, 0x9, 0x4, 0x7, 0x1, 0xa6, 0x7fffffff, 0x393cce19, 0xfffffffffffffff8, 0x6, 0x9, 0x7, 0x100000001, 0xe, 0x5, 0x7fff, 0x100000001, 0x8, 0x1, 0x7, 0x0, 0x200, 0x8, 0x40, 0x407b, 0x40, 0xa, 0xaa, 0x9, 0x8001, 0x564, 0xc1a, 0x1, 0x0, 0x6, 0x6, 0x5, 0xffffffffffffffff, 0x3, 0x9, 0xc5, 0x5, 0xbdbe, 0x2fd, 0x5, 0x0, 0x94d5, 0x1, 0x7fffffff, 0x7, 0x7, 0x7, 0x4, 0x9, 0xf, 0x7, 0x767f, 0x8, 0xb717, 0x5, 0x7, 0x9, 0xfffffffffffffff9, 0x7, 0xfff, 0x0, 0x5, 0x7fffffff, 0x5, 0x2, 0x3, 0x1, 0x2, 0x3ff, 0x2, 0x8000, 0x3ff, 0x9, 0xf, 0xe50, 0x200, 0x0, 0x2d, 0x5, 0xffffffffffffff80, 0x9, 0xf3, 0xa, 0x6, 0x7fffffffffffffff, 0x80000000, 0x3, 0x1, 0x8, 0x7, 0x8ba0, 0x3891, 0x5, 0x6, 0x1]}) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000000)={0x18, r4, 0x1, 0x70bd28, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x810}, 0x4000010) (async) ioctl$BTRFS_IOC_RESIZE(r0, 0x50009403, &(0x7f00000008c0)={{r0}, {@val={r2}, @actul_num={@val=0x2d, 0x0, 0x70}}}) (async) r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x142, 0x14) (async) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) (async) socket$xdp(0x2c, 0x3, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) (async) write(r5, &(0x7f0000000080)='4', 0x1) (async) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r1, 0x8983, &(0x7f0000000000)={0x1, 'vlan1\x00', {}, 0x5832}) 4.308365804s ago: executing program 0 (id=78): syz_usb_connect$uac3(0x5, 0xb3, &(0x7f0000000000)=ANY=[@ANYRESOCT=0x0, @ANYRESHEX=0x0], 0x0) 3.750499159s ago: executing program 3 (id=82): r0 = socket$inet_udp(0x2, 0x2, 0x0) socket(0x10, 0x3, 0x0) (async) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f0000000240)="aefc00001a0025f01d85bc04fef7681d020b49ff708800008003280008021000ac0a1410bc71176a36ede498534108e58342fa94a235a2a441f9", 0xfcae) socket$pppl2tp(0x18, 0x1, 0x1) (async) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r3, &(0x7f0000f5dfe4)={0xa, 0x4e1d, 0x3, @empty}, 0x1c) recvmmsg(r3, &(0x7f0000000780)=[{{0x0, 0x0, 0x0}, 0x2}], 0x1, 0x2, 0x0) (async) recvmmsg(r3, &(0x7f0000000780)=[{{0x0, 0x0, 0x0}, 0x2}], 0x1, 0x2, 0x0) setsockopt$inet6_int(r3, 0x29, 0x4, &(0x7f0000000000)=0x7f, 0x28) sendto$inet6(r3, 0x0, 0x0, 0x20000001, &(0x7f0000000300)={0xa, 0x4e1d, 0xffffffff, @mcast1}, 0x1c) dup2(r2, r0) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@broadcast, @in6=@dev={0xfe, 0x80, '\x00', 0x29}, 0x4e21, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x84}, {0xfffffffffffffffc, 0x0, 0xfffffffffffffffa, 0x0, 0x81, 0x1}, {0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0x0, 0x1}, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4d5, 0x6c}, 0x9, @in=@private=0xa010101, 0x3501, 0x0, 0x0, 0xb7, 0x2, 0x0, 0x8}}, 0xe8) r4 = socket(0x10, 0x3, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x202, 0x0) ioctl$TCSETS(r5, 0x40045431, &(0x7f0000000dc0)={0x0, 0x3, 0x1000002, 0x0, 0x5, "d52c2000000102000300ecffffff0100"}) (async) ioctl$TCSETS(r5, 0x40045431, &(0x7f0000000dc0)={0x0, 0x3, 0x1000002, 0x0, 0x5, "d52c2000000102000300ecffffff0100"}) syz_open_pts(r5, 0x0) (async) r6 = syz_open_pts(r5, 0x0) r7 = dup(r6) r8 = socket$inet(0x2, 0x1, 0x0) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r10, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)={0xd0, 0x0, 0x2, 0x201, 0x0, 0x0, {0xa, 0x0, 0x7}, [@CTA_EXPECT_MASTER={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @loopback}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x98}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}, @CTA_EXPECT_MASK={0x3c, 0x3, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x89}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x2a}}, {0x14, 0x4, @loopback}}}]}, @CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x3e}}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @multicast2}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}]}]}, 0xd0}, 0x1, 0x0, 0x0, 0x20008004}, 0x4) (async) sendmsg$IPCTNL_MSG_EXP_NEW(r10, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)={0xd0, 0x0, 0x2, 0x201, 0x0, 0x0, {0xa, 0x0, 0x7}, [@CTA_EXPECT_MASTER={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @loopback}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x98}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}, @CTA_EXPECT_MASK={0x3c, 0x3, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x89}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x2a}}, {0x14, 0x4, @loopback}}}]}, @CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x3e}}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @multicast2}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4}}]}]}, 0xd0}, 0x1, 0x0, 0x0, 0x20008004}, 0x4) splice(r8, 0x0, r9, 0x0, 0x7ffff000, 0x9) ioctl$TIOCSETD(r7, 0x5423, &(0x7f00000000c0)=0x3) ioctl$KVM_RUN(r7, 0xae80, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000280)={0x4000, 0x2}, 0x10) sendmsg$netlink(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000002c0)=ANY=[@ANYBLOB="780000001a0001002abd7000000000000a"], 0x78}], 0x1, 0x0, 0x0, 0x20400}, 0x0) (async) sendmsg$netlink(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000002c0)=ANY=[@ANYBLOB="780000001a0001002abd7000000000000a"], 0x78}], 0x1, 0x0, 0x0, 0x20400}, 0x0) getsockopt$inet_buf(r0, 0x0, 0x30, 0x0, 0x0) (async) getsockopt$inet_buf(r0, 0x0, 0x30, 0x0, 0x0) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) (async) r11 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x11, r11, 0x8000) ioctl$KVM_GET_MP_STATE(r7, 0x8004ae98, &(0x7f0000000080)) 3.552173044s ago: executing program 1 (id=91): sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)={0x20, 0x0, 0x1, 0x70bd24, 0x25dfdbfc, {}, [@ETHTOOL_A_LINKINFO_HEADER={0x4}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}]}, 0x20}, 0x1, 0x0, 0x0, 0x20005005}, 0x24000084) r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = add_key$fscrypt_v1(&(0x7f0000002a00), &(0x7f0000000500)={'fscrypt:', @desc2}, &(0x7f0000000580)={0x0, "f1a1173fb9462d3589e67197f90be6e423ceb0ab4912f9f6a31854ec98e950cfed21fcad7ff0fbcb566a0982f8938caa00", 0x29}, 0x48, 0xffffffffffffffff) add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f0000000080)={'fscrypt:', @desc2}, &(0x7f00000000c0)={0x0, "f1a1173fb9462d3589e67197f90be6e423ceb0ab4912f9f6a31854ec98e950cfed21fcad7ff0fbcb566a0982f8938caa52dd8d39af14c31ed56ad59300"}, 0x52ba, 0xffffffffffffffff) (async) keyctl$KEYCTL_MOVE(0x4, r3, r3, 0x0, 0x0) (async) sendmsg$ETHTOOL_MSG_PAUSE_SET(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="04"], 0x14}, 0x1, 0x0, 0x0, 0x4044020}, 0x4000000) (async) recvmmsg(r2, &(0x7f0000001640)=[{{0x0, 0x0, &(0x7f0000001580)=[{&(0x7f0000000200)=""/60, 0x3c}, {&(0x7f0000001680)=""/4104, 0x1008}], 0x2}}], 0x1, 0x40030002, 0x0) (async) sendmsg$nl_generic(r2, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002b40)=ANY=[@ANYBLOB="200000001000010700000000000000000a0000000c0002006e6c3830323131"], 0x20}}, 0x0) (async) sendmsg$TIPC_NL_PUBL_GET(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="d8000000", @ANYRES16=r1, @ANYBLOB="f327000000000000000007000000c40002"], 0xd8}, 0x1, 0x0, 0x0, 0x6}, 0x4020) 3.551377664s ago: executing program 1 (id=92): r0 = open(&(0x7f0000001440)='./file1\x00', 0x14d77e, 0xc2) ioctl$BLKFRAGET(r0, 0x1265, &(0x7f0000000080)) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) write$tun(r1, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000400)=0x20) link(&(0x7f00000001c0)='./file1\x00', &(0x7f0000000240)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') ioctl$UI_END_FF_UPLOAD(r0, 0x406855c9, &(0x7f0000000340)={0xc, 0x1000, {0x55, 0xfffa, 0x1c, {0x1ff, 0x1}, {0x3, 0x8}, @ramp={0x400, 0x538, {0x9, 0x4, 0xc42, 0x1}}}, {0x55, 0x9, 0xe, {0x3, 0x7}, {0x5, 0x5}, @ramp={0x7, 0x7fff, {0x2, 0x2, 0xa, 0x3}}}}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$TIOCSSOFTCAR(r0, 0x541a, &(0x7f0000000140)=0x7) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1000}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f00000006c0)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) syz_usb_connect(0x2, 0x64, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000cb5200010000000009044000000e0100390a240108000b020102082407010500070e01000606000009002402050302f80254df000a092402050001031f04092403c6d44500"/87, @ANYRES64], 0x0) 2.840427364s ago: executing program 3 (id=99): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet_icmp(0x2, 0x2, 0x1) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e21, @empty}, 0x10) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) r4 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000100)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x172f, 0x37, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x80, 0x8, "", [{{0x9, 0x4, 0x0, 0xfe, 0x1, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x85, 0x3, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x2, 0xf, 0xd}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io(r4, &(0x7f0000000080)={0x2c, &(0x7f0000000000)={0x20, 0x5, 0x28, {0x28, 0x10, "c26313852642792c3cbdeace918d0fb74237cc0044b72fb0688881ce2a52973661a4080c5544"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000}) r5 = userfaultfd(0x80801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r5, 0xc028aa03, &(0x7f0000000240)={&(0x7f000046a000/0x2000)=nil, &(0x7f000012a000/0x3000)=nil, 0x2000, 0x3}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) getsockopt$IP6T_SO_GET_REVISION_MATCH(r1, 0x29, 0x44, &(0x7f0000000500)={'icmp6\x00'}, &(0x7f0000000540)=0x1e) ioctl$sock_SIOCETHTOOL(r0, 0x89f1, &(0x7f0000000340)={'ip6gre0\x00', &(0x7f0000000140)=@ethtool_cmd={0x0, 0x80000000, 0x0, 0x9, 0xf, 0x3, 0x3, 0xfc, 0x0, 0x1, 0x0, 0x0, 0x6, 0xff, 0x0, 0xfffffeff}}) 1.314914034s ago: executing program 0 (id=118): r0 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) read(r0, &(0x7f0000000000)=""/14, 0xe) (async, rerun: 32) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x1dc) (rerun: 32) ioctl$LOOP_SET_FD(r1, 0x4c00, 0xffffffffffffffff) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) r2 = syz_usb_connect$uac1(0x3, 0xcf, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x499, 0x1042, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xbd, 0x3, 0x1, 0xbe, 0x40, 0x4, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x7ff, 0x36}, [@feature_unit={0xf, 0x24, 0x6, 0x6, 0x4, 0x4, [0x8, 0x1, 0x8, 0xa], 0xa8}, @extension_unit={0xa, 0x24, 0x8, 0x6, 0x7f, 0x0, '$G\\'}, @feature_unit={0x13, 0x24, 0x6, 0x6, 0x5, 0x6, [0x1, 0x5, 0x0, 0x1, 0x7, 0x5], 0xa}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x8, 0xf7, 0xb, 0x5, 0x7}, @as_header={0x7, 0x24, 0x1, 0x1, 0x2, 0x1002}, @as_header={0x7, 0x24, 0x1, 0xb, 0x8, 0x5}, @format_type_i_discrete={0x11, 0x24, 0x2, 0x1, 0x75, 0x2, 0x8, 0x52, "186ae7be4bb08639da"}]}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x1, 0xf8, 0x0, {0x7, 0x25, 0x1, 0xc, 0x7, 0xae08}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x7, 0x8, 0x5, 0x8e, 0x9}]}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x45, 0xfe, 0x5, {0x7, 0x25, 0x1, 0xc, 0x7, 0xfff}}}}}}}}]}}, &(0x7f0000000440)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x2, 0xb, 0xa, 0xff, 0xfb}, 0x5, &(0x7f0000000200)={0x5, 0xf, 0x5}, 0x3, [{0x9f, &(0x7f0000000240)=@string={0x9f, 0x3, "3f0fbac4971a80b6515014424a170fa6bdf992309ef8b9b94310e09557a2f9df61b1bc77727072f1400f4e0657c125433772783e7aedc11befb80bc54b590b765464565b4c4914bdc1d3dddb6a0e81aeb3c53ac3cfe36ab13724de006e1a40703179dca6e71051e0199a6fb5ce860b8cddb13ec87948aa2ecd32b4b678ba457d0f8fa5cb8b8f0ec045aab94d18ae07fc5c39deddfdbdfcda9654d1d798"}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x2831}}, {0xe0, &(0x7f0000000340)=@string={0xe0, 0x3, "09ca5ea766a9ee89d39594ef34b23eb757b6cbad9d31560944c03489e99ebd8342743d2f25ecf595d39e0465067bb2e57697a17ab2e6e89459a1cd59330a9a42d14966c4cd5385f66e503026d2b75d6507274e9af57e6fb325a86bb515cafe7f0909c1ac4c06feeb585e6c7bcab70e750bd187fc6488b41767573c50faef61323b894c7e1bef81d74fa0ff8fa30d4f27183821221724333408827fd4246e7393dfff16979f693d671cd6d24941cd5aefba7e8fba3dfef640135c75903d4bae38aaaab6e5640f5beba8cf23090c6ab19ce848cc09af407114b5fdb17679b8"}}]}) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000480), 0x42203, 0x0) ioctl$KVM_CAP_X86_GUEST_MODE(r3, 0x4068aea3, &(0x7f00000004c0)) (async, rerun: 32) syz_usb_disconnect(r2) (rerun: 32) ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f0000000540)=0x4c) (async) ioctl$ASHMEM_GET_PIN_STATUS(r1, 0x7709, 0x0) (async) ioctl$BTRFS_IOC_DEFRAG(r3, 0x50009402, 0x0) (async, rerun: 64) write$hidraw(r0, &(0x7f0000000580)="73ac2872374fbfbf5d06272c927a2e24937d5f10ac46e5a1a13cf6f1d818f82001815ff486e991fc7009c84b8e0ec047baff3eb8a1b7fb1a42112509537a11de5d9aac21efdebbbc34f0608bf4159afd9ecb9a068fe464784f01c099a3c2dbbb147cffbbf3d14c", 0x67) (rerun: 64) socket$key(0xf, 0x3, 0x2) (async, rerun: 64) r4 = syz_usb_connect(0x4, 0x533, &(0x7f0000000600)={{0x12, 0x1, 0x200, 0xdd, 0x14, 0xca, 0x20, 0x6cb, 0x10, 0xc963, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x521, 0x3, 0xfd, 0xe8, 0xd0, 0x6, "", [{{0x9, 0x4, 0x8a, 0x0, 0x2, 0x93, 0xd8, 0x8b, 0x4d, [@generic={0x18, 0xd, "94b5de8e74d811ab7e2cef5507c9ed7bf6ea38b9b0d4"}], [{{0x9, 0x5, 0x6, 0x2, 0x8, 0x5, 0x0, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0x5, 0x3}, @generic={0x50, 0x22, "d67934acf89d3b03e4296c1083f56a15f6bc1bc0fea6e47d749d0ddeefe15ee27a9f93169bc7ceb02ef57c9793dd4eee736be06e52d10dbec33aa983559f922496c0ac62fe30721f8577e9ab6d9b"}]}}, {{0x9, 0x5, 0x2, 0x0, 0x8, 0x0, 0xd, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0x5}]}}]}}, {{0x9, 0x4, 0x2e, 0x0, 0x3, 0xcd, 0x84, 0xa0, 0x9, [@cdc_ncm={{0x5}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0xf, 0x6d, 0x9}, {0x6, 0x24, 0x1a, 0x9, 0x32}, [@mbim={0xc, 0x24, 0x1b, 0x5, 0x4, 0x59, 0x3, 0x8, 0x1}, @mbim_extended={0x8, 0x24, 0x1c, 0xeede, 0xc0, 0x4}, @call_mgmt={0x5, 0x24, 0x1, 0x2, 0x5}, @mbim={0xc, 0x24, 0x1b, 0xa, 0x2, 0xf6, 0x1, 0x7, 0x2}, @network_terminal={0x7, 0x24, 0xa, 0x2, 0x1, 0x5, 0x3}, @mbim={0xc, 0x24, 0x1b, 0x5, 0xfffd, 0x7, 0xf0, 0x7, 0x80}]}], [{{0x9, 0x5, 0xe, 0x3, 0x3ff, 0x3, 0x0, 0x9, [@generic={0xe4, 0x7, "8a8327447448b753779747bad0f748e2c742c0e6fb6ea18d6f8466cf82f657fa3fffa7ed9944f9d114e0df86f069d006e0ac97e5a38b44ece322265e19ec7f541d12ddc4804a1ff00414cfca688d659a171a388f346b4d8678f48a0e14d4b82779d091784c87809e386c0eac9c309d31bf1d24c807833a09eaddb3fac6d30accdcaf6731e818b0d63e682b50282a71d734d9df803dafbbcf54909efd5ffcf238657150a4ac45e1e14d93e258c3636d1f0dd893374caa489adaff837682c5abfa1753d20283832403b4dd0c4df20ea63ed7c205a43a96393b300ee82d0814ee5b8d40"}]}}, {{0x9, 0x5, 0x6, 0x10, 0x200, 0x9, 0xb2, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0xff, 0x1}]}}, {{0x9, 0x5, 0x5, 0x3, 0x40, 0x7, 0x8, 0x8, [@generic={0xac, 0x21, "6f71c773102ea53fb084102672ab9ae1f09c135824179a214104fc91e07a9272993b976d137afd39812c255c4f3a654ad80d53b6b0fc74529a559187545782de06dfe15c849dc2b22456e8983e97fac7e4270b4a18aa48b3493bada8cebe5ab5c6ef076afff1de764aa16a1b1ba9e8909110295a1dadba090030ee6ad7f37525468cc0cf8fefd192d845ba0e6acf0958b857a27c148e04a421adcc64a242663f2b14935d09575380dd20"}]}}]}}, {{0x9, 0x4, 0xb1, 0x6, 0xa, 0xb3, 0xa7, 0xfa, 0x4, [@uac_control={{0xa, 0x24, 0x1, 0x3, 0x3f}, [@output_terminal={0x9, 0x24, 0x3, 0x6, 0x306, 0x1, 0x3, 0x2}, @output_terminal={0x9, 0x24, 0x3, 0x1, 0x405, 0x3, 0x6, 0x9}, @feature_unit={0xf, 0x24, 0x6, 0x5, 0x5, 0x4, [0x9, 0x2, 0xa, 0x5], 0xfd}, @feature_unit={0x9, 0x24, 0x6, 0x3, 0x4, 0x1, [0x5], 0x40}, @selector_unit={0xb, 0x24, 0x5, 0x3, 0x6, "78265656b2a2"}]}], [{{0x9, 0x5, 0xf, 0xc, 0x40, 0x5, 0x6a, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x4, 0x8}]}}, {{0x9, 0x5, 0xb, 0x8, 0x3ff, 0x0, 0x3, 0x5, [@generic={0x72, 0x8, "a65dfcab0edf96bcac2d4931e1005245d715849a50a9153afde1c25f226cfdcb234b1fc21d6650aef882e16df55e6b5063e0da641e7992e45e643465d44b359570761ade9aae90fd91eca775bde4afbf62fb69c4f07c133f1cb8f30953e87d567f6f8e70968be75cd5aa749975dd3a19"}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0x5, 0x40}]}}, {{0x9, 0x5, 0x80, 0x0, 0x8, 0x6, 0x2, 0x8, [@generic={0x24, 0x8, "f88a6a3fda7e207b0f44cf1b2a994806f34d678955fb956227a2d2b8fd0325684372"}]}}, {{0x9, 0x5, 0x4, 0xf, 0x200, 0x5, 0x6, 0xf, [@generic={0x21, 0xe, "7424981c5de513df4c94891e1f83a663734e88cc76d0ffd1c21d05c4425ec9"}]}}, {{0x9, 0x5, 0xe, 0x2, 0x200, 0x9, 0x5b, 0x3, [@generic={0x1b, 0x23, "1bafb1eff829f3b3914b3cfeb624a7055deef3221eb3912bc8"}]}}, {{0x9, 0x5, 0xf, 0x10, 0x10, 0x7, 0xa1, 0x1, [@generic={0xaf, 0x22, "ab1373b0a11179df32b3f8eeade3a72fdce2917c61cdf02c54efc72a54b5b0ae031cd9e9d3a4060e87dc27463c8184972892fdd6a8d9336f1df7280b37f3f2fdbb34e1039b05512a2a1bdd3a1246ce04c6db4091dfc00e5f91df948c081e5ec2da078d721afdce4830e76d18d12e54580a1de9bf1baab41c89158d348e0c5919df2f31fe15af2bdcac76e8b22864689dbf72b497b671f8dadb8764fb4cc23e1a1f5b7b5e6aab6a729eec643b36"}, @uac_iso={0x7, 0x25, 0x1, 0x4, 0xb, 0x8}]}}, {{0x9, 0x5, 0xc, 0x1, 0x80, 0x3, 0xc2, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x40}, @generic={0x23, 0xe, "d4d9d864de0a949f79df6feabec979c35e9a945a4c2712633f10c48193fa5c2361"}]}}, {{0x9, 0x5, 0x1, 0xc, 0x10, 0x3, 0xe, 0xf3, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x2d}]}}, {{0x9, 0x5, 0x1, 0x10, 0x200, 0xf9, 0x2, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0x3, 0x4}]}}, {{0x9, 0x5, 0x2, 0xc, 0x3ff, 0x3, 0x6, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x1, 0x6}]}}]}}]}}]}}, &(0x7f0000000cc0)={0xa, &(0x7f0000000b40)={0xa, 0x6, 0x241, 0x51, 0x1d, 0x4, 0xd7, 0x80}, 0x19, &(0x7f0000000b80)={0x5, 0xf, 0x19, 0x1, [@ssp_cap={0x14, 0x10, 0xa, 0x9, 0x2, 0x1, 0xf00, 0x1ff, [0x3fd8, 0xc000]}]}, 0x1, [{0xf1, &(0x7f0000000bc0)=@string={0xf1, 0x3, "ec514d25a68926c888e6162270871d7bd7f3ebfafc3a62c75d6ac8ffeec38df8d706fdec7d176e9d1c0beb0e30e2b2ea08b7447a4e1b1f9bca2cb20f94e10260dad950e279bc8ea6fcfbb729b46fdac1edc197409ccfa3e98c560cb0ec9a8d2a37cad0f5e1c0c0041af3d1c937708639113a057f157d8aa9e9c38452f83bbd4857cb501d15d4102277872078aa67a54d0a073da6a9276593a8c2530f69983f9e9efc22b38a16cb78290536ed85e08bf4c0bf1b917c507540278ff6580bc0264ae95a991733317a3edb9c9fa29243a8352e1e9bfe55581c2f0c7d8edaccf85b7f8999951a81ac6637231dc8dfd88fe0"}}]}) (rerun: 64) syz_usb_control_io$hid(r4, &(0x7f0000000ec0)={0x24, &(0x7f0000000d00)={0x60, 0x1e, 0xbf, {0xbf, 0x0, "c72a4efddc507695d3f01c7e87c3e01c2285e2ba997a391670d80ea560fb6f349d0a8b20cdb7c17d4b2411923b811ee62968d7cc64afb821994eb704748fc777533aa297c5a397e02de146809cfea3617ff0f523ec604c44f2a3b7041db9079114bd0eed64aac458fed50b8676b8f6b3451f3ffd0bf1559214b3c02b04600c01ba2d52ae3bb2c9aaa99e1718938b22de6f10ee4646c7be535011b812a06fdc5490ee4263335a8d6bc7b6018da21343e92ed7e0e27fc042de99a7519989"}}, &(0x7f0000000e00)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1009}}, &(0x7f0000000e40)={0x0, 0x22, 0x5, {[@main=@item_4={0x3, 0x0, 0x9, "fe083541"}]}}, &(0x7f0000000e80)={0x0, 0x21, 0x9, {0x9, 0x21, 0x7, 0x2, 0x1, {0x22, 0x81b}}}}, &(0x7f0000001100)={0x2c, &(0x7f0000000f00)={0x0, 0x17, 0x87, "0c45d794bfb69f6a3e4b5a22456d3a40e233afae06d9a3b5c5af4a3d41c558396b32b0c6a00440c103ddbc2fc688041b5427099d6b3dc4afe0918092b24894da273054a8b4cde3edd2428c6a2e6d19e363cb9f29ce78b70f5ddcafdc7a8db3f56aa83fb4d18fa5111093318954431daf9a1090ed19135bd8d3a518dff70ae90bd14bb4e96062ee"}, &(0x7f0000000fc0)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000001000)={0x0, 0x8, 0x1, 0x5}, &(0x7f0000001040)={0x20, 0x1, 0x49, "fd057faf40eb63ce3002e27aee57c92e8393e219245129cd90a2f4ed9a982f094b104b8bce01696cc0f96a65fe65dabb7b05162e5c4e98a950e993563c748b4113514832e7ef37867a"}, &(0x7f00000010c0)={0x20, 0x3, 0x1, 0x80}}) (async) r5 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000001140)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_control_io(r5, &(0x7f00000013c0)={0x2c, &(0x7f00000011c0)={0x0, 0x24, 0xa0, {0xa0, 0x24a19fe424fdeae6, "6299cae3bbda87bcec486bd3cccfb87b44a55d41e0b4c60820ab076e95ff4f2231a084a207b5fa98b345a67a836f2bbb262a778d2ed933f7687c7b50d6a110196ac5657e1027254b27647d9846e0f09900ed14834fe854dd4367858f2a6662962e8e1bf5697065a39254aa0a272f8434e67806134e2ba8f397f1196caaddae121e00eb4f921e799f27e127d84183975436b4b47a2a45843c8512b4fb600f"}}, &(0x7f0000001280)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1cdadf9ad322b5be}}, &(0x7f00000012c0)={0x0, 0xf, 0x44, {0x5, 0xf, 0x44, 0x4, [@ssp_cap={0xc, 0x10, 0xa, 0xff, 0x0, 0x2}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "22b4d2078e5d9609d2534765e0d42704"}, @ss_container_id={0x14, 0x10, 0x4, 0x4f, "d45399c7f69123b8cb31878a37a073cc"}, @wireless={0xb, 0x10, 0x1, 0x8, 0x2, 0x4, 0xf9, 0x7, 0x40}]}}, &(0x7f0000001340)={0x20, 0x29, 0xf, {0xf, 0x29, 0x2, 0x0, 0xa5, 0x7, "e991093f", "6b2220ba"}}, &(0x7f0000001380)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xa2, 0x1, 0x2, 0xa0, 0x5, 0x5, 0x7}}}, &(0x7f00000018c0)={0x84, &(0x7f0000001400)={0x20, 0xd, 0xec, "6b276573eabee17d6e8cbaca9bf11547ecdf65c5670ab95be306cf23ec99cd3a8dcb8055aa6a19bdab01dc6ac60bf650f992f430e6902f07de3befe5c4c6858a0620c10859231593eadeaaa379fea00dd625115a1b6fe3c65a09a6022e3cc4728d21e78bf0280957c5adabccfcdda963e654d645f4c1ba81466bb0db72cc03d72ca910b674e198c22a7e243a0cfb06b7f8a3856e7029a6916ae7f4556ea7a5bd7d441608e7fdf2108e0bc74214e1ea4878381a21ad33aa9dafc06cee85637dcecc5f309bd24e3dd0cf6d70bf0e4c256433f5985c9a6f94e65c6156ec2aae2c49c220d9d1ddbb2b61ec566669"}, &(0x7f0000001500)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000001540)={0x0, 0x8, 0x1, 0xe}, &(0x7f0000001580)={0x20, 0x0, 0x4, {0x1, 0x1}}, &(0x7f00000015c0)={0x20, 0x0, 0x4, {0x100, 0x2}}, &(0x7f0000001600)={0x40, 0x7, 0x2, 0x30df}, &(0x7f0000001640)={0x40, 0x9, 0x1, 0x8}, &(0x7f0000001680)={0x40, 0xb, 0x2, "a705"}, &(0x7f00000016c0)={0x40, 0xf, 0x2, 0x7}, &(0x7f0000001700)={0x40, 0x13, 0x6, @remote}, &(0x7f0000001740)={0x40, 0x17, 0x6, @random="4aa73646ba28"}, &(0x7f0000001780)={0x40, 0x19, 0x2, ')A'}, &(0x7f00000017c0)={0x40, 0x1a, 0x2, 0x3}, &(0x7f0000001800)={0x40, 0x1c, 0x1, 0x8}, &(0x7f0000001840)={0x40, 0x1e, 0x1, 0x6}, &(0x7f0000001880)={0x40, 0x21, 0x1, 0xfc}}) (async, rerun: 32) recvmsg(r0, &(0x7f0000003d40)={0x0, 0x0, &(0x7f0000003cc0)=[{&(0x7f0000001980)=""/11, 0xb}, {&(0x7f00000019c0)=""/4096, 0x1000}, {&(0x7f00000029c0)=""/15, 0xf}, {&(0x7f0000002a00)=""/161, 0xa1}, {&(0x7f0000002ac0)=""/4096, 0x1000}, {&(0x7f0000003ac0)=""/32, 0x20}, {&(0x7f0000003b00)=""/232, 0xe8}, {&(0x7f0000003c00)=""/187, 0xbb}], 0x8}, 0x2000) (async, rerun: 32) syz_usb_connect$cdc_ecm(0x4, 0x6b, &(0x7f0000003d80)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x59, 0x1, 0x1, 0x9, 0x40, 0x3, "", [{{0x9, 0x4, 0x0, 0x3, 0x2, 0x2, 0x6, 0x0, 0x7, {{0x9, 0x24, 0x6, 0x0, 0x0, "c2be707d"}, {0x5, 0x24, 0x0, 0x7}, {0xd, 0x24, 0xf, 0x1, 0xf, 0xb4, 0x2, 0x40}, [@obex={0x5, 0x24, 0x15, 0x4}, @mdlm={0x15, 0x24, 0x12, 0x636}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x40, 0xc, 0x8, 0x4}}, {{0x9, 0x5, 0x3, 0x2, 0x400, 0x0, 0x0, 0x2}}}}}]}}]}}, &(0x7f0000004040)={0xa, &(0x7f0000003e00)={0xa, 0x6, 0x200, 0x3, 0xa, 0xdf, 0x10, 0x7f}, 0x70, &(0x7f0000003e40)={0x5, 0xf, 0x70, 0x5, [@ss_container_id={0x14, 0x10, 0x4, 0xa, "fb2e6414c7a8eb7701546dd03b6df6dc"}, @ext_cap={0x7, 0x10, 0x2, 0x8, 0x2, 0x1, 0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x1, "6da1f6ea5390fd672aadce9c99e92519"}, @ssp_cap={0x24, 0x10, 0xa, 0x5, 0x6, 0x9, 0xff00, 0xfffc, [0xc0f0, 0xff3f0f, 0xc0c0, 0x8, 0x0, 0xff3f30]}, @ssp_cap={0x18, 0x10, 0xa, 0xfe, 0x3, 0x8, 0xff00, 0x8, [0x0, 0xff3f3f, 0xff3f3f]}]}, 0x3, [{0xe9, &(0x7f0000003ec0)=@string={0xe9, 0x3, "a04852836c17a4c2377e85e3d54ab6cce96d5a08c7d49d430252b3c82266e93ebab5880e67ceac1a7c848a11caa2591f1ca3e7b012cfd1e05e53eeb7fbebc067ac54d0afdbfb42d285ba4dd4087a01e5d1829acd7b5c135126177caf655831a459859167f1424e61434fa43f296c1f127519075a97b00c17b6d3df58af1861d8e29dd2bca426c785428e4507bb68d938cbc1818cbd79c898bdae606bf3af1726dac8f99d001be3636b58b3c357113560fd04155190c85e54888eb5bf8560bb9f408c03004c15e8c2e33a797b4a477300ae15fd9168e9f1870b43a193a4e52e950d5d029bcc841a"}}, {0x4, &(0x7f0000003fc0)=@lang_id={0x4, 0x3, 0x500a}}, {0x4, &(0x7f0000004000)=@lang_id={0x4, 0x3, 0x1009}}]}) (async) ioctl$FS_IOC_GETFSSYSFSPATH(r0, 0x80811501, &(0x7f0000004080)={0x80}) (async) pipe2$9p(&(0x7f0000004140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x40800) (async) r7 = fcntl$getown(0xffffffffffffffff, 0x9) write$P9_RGETLOCK(r6, &(0x7f0000004180)={0x26, 0x37, 0x1, {0x0, 0x0, 0x0, r7, 0x8, ']:\x9f]\xcb#\\\\'}}, 0x26) syz_usb_control_io(r4, &(0x7f0000004580)={0x2c, &(0x7f00000041c0)={0x20, 0x4, 0x93, {0x93, 0x0, "316be09c2af727817de463a0b5dcd629fee28cb36b035aeb941736c4856f7841d53121c74d0feee61bf0027bab43ce1cb39c0d8274ed501915126e151e9093cd06fd902de18b7edcf31091708fe7384049e60f7fe15b0936d6195ca6ec69adf36309cee702c13dc7cbd386455b88b442fa7162d5c30dc8912eea37b3b530da56d5124f794f3183d9c9ce12a79b05c9ed09"}}, &(0x7f0000004280)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x242e}}, &(0x7f00000042c0)={0x0, 0xf, 0x22d, {0x5, 0xf, 0x22d, 0x6, [@ptm_cap={0x3}, @ssp_cap={0x10, 0x10, 0xa, 0x4, 0x1, 0x7, 0xf00, 0x1000, [0x3f00]}, @generic={0xd2, 0x10, 0x2, "d34b4b300b29b8c71f255a046450ec53be3a6442e9feae657507370078e6c6c875b00da0f5ee50b9fb7334021e1bbcbf8293ea837d708a5b77b74745d5fc70259624385ff52e9760e82ac7a778821dff309b1c1629bc75768ab23c6a64023cde7598fceae929ee76bdc9804b481e996d8f1d4268ac2c66388592cdf5ecfeab5715be497dc02a5553e115cf11a55f5b5b29863bf3ba42eecf30864419c6553bec6bbabf66638f5116148a63431d1b323d24574fca4159c7a7e51321248a6dfbec1873ed329fbd2c396b5a5e5cdb226a"}, @generic={0x90, 0x10, 0x4, "f539df85afa8047c1e6664a206062d3f65090a8277768e092e0fb8430009593ae1b19f422079ee8224a57312decaf3ebb921fcfd9fe0a65bbe5974d5a1ad06b949e5c9710820f4259bbe12c9f17d5a86fe2159f40630e08d4efb82ee40da01872a0bde84e9df6de22f702463d2cbb2917ca7ccd6a94a396d4db9abd8a379956183f41b11b3b60157d528cfb131"}, @ptm_cap={0x3}, @generic={0xb0, 0x10, 0x4, "8b309a68a97546796ba6dcc7ea9de53b1f33d24f4bc615af05516bb7a900e02757df47810de5cafaa58ef609beebf80f87ec0fc72ce12688d179b2549fff86eef77703397ba8a6825492ccc2575980f7b929b5b212a769e053c7dcc676a6ee2a88fe28cea3f1ca26af4f9dc953929fa6c132e95bee7e11e0be52fee2a28d7812b1d2632128a16ad2dab385c191bfc471e8f1dff21d80d52ff390ee97e27999f58c3efb74d6f6eba79806925526"}]}}, &(0x7f0000004500)={0x20, 0x29, 0xf, {0xf, 0x29, 0x8f, 0x4, 0xf, 0x8, "6fff2917", "0f0fb0da"}}, &(0x7f0000004540)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x0, 0x4, 0xd, 0x13, 0x4, 0xa1c0}}}, &(0x7f0000004a80)={0x84, &(0x7f00000045c0)={0x20, 0xa, 0xd6, "9b30eb26ac4884e06e48fc53a64a764a6b34ca24a250fbecbc00f8dfb56639ce44853a60c923feeed5dd987d756bb96ddbf992067720d065647b2d871daae3430ae3fd470464910a63882bd6ec9b366591cf71ca4f9642a3a29e9027b9d2f47a5496468c4d6e946b92edd5df13e61720b2f57b0330b2986438ff011d5b7097e13854ce8e828526bb54ce4e9d3e1de08f05f923f0c80f24d4dce0a425153641e8c12ef69b7601b8060306f079566f620896a9d4d272edb383a10d13d7c72f24dbf462fc10ebc494beb9bf611d34e9e07e0a3aae643221"}, &(0x7f00000046c0)={0x0, 0xa, 0x1}, &(0x7f0000004700)={0x0, 0x8, 0x1, 0xb}, &(0x7f0000004740)={0x20, 0x0, 0x4, {0x0, 0x2}}, &(0x7f0000004780)={0x20, 0x0, 0x8, {0x1e0, 0x8, [0x26c6c3b5b43a2449]}}, &(0x7f00000047c0)={0x40, 0x7, 0x2, 0x8000}, &(0x7f0000004800)={0x40, 0x9, 0x1, 0x6}, &(0x7f0000004840)={0x40, 0xb, 0x2, "7e8f"}, &(0x7f0000004880)={0x40, 0xf, 0x2, 0xffff}, &(0x7f00000048c0)={0x40, 0x13, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, &(0x7f0000004900)={0x40, 0x17, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, &(0x7f0000004940)={0x40, 0x19, 0x2, "cb29"}, &(0x7f0000004980)={0x40, 0x1a, 0x2, 0x6}, &(0x7f00000049c0)={0x40, 0x1c, 0x1, 0x5d}, &(0x7f0000004a00)={0x40, 0x1e, 0x1, 0x49}, &(0x7f0000004a40)={0x40, 0x21, 0x1, 0x5}}) (async) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000004b40)={0x0, 0x0}, &(0x7f0000004b80)=0xc) setsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000004bc0)={{{@in6=@mcast2, @in=@rand_addr=0x64010102, 0x4e21, 0x0, 0x4e23, 0xd80, 0x2, 0x40, 0x0, 0x4, 0x0, r8}, {0x9, 0x9, 0xff, 0x1000000000, 0x2000000000000000, 0x6bc, 0x5, 0x2}, {0x9, 0x1, 0x7, 0x1}, 0x5, 0x6e6bbc, 0x1, 0x1, 0x1, 0x2}, {{@in6=@dev={0xfe, 0x80, '\x00', 0xb}, 0x4d4, 0x2b}, 0x2, @in=@multicast1, 0x3503, 0x0, 0x1, 0xd, 0x7, 0x1000, 0xfffffffa}}, 0xe8) (async) syz_usb_connect$cdc_ecm(0x1, 0x80, &(0x7f0000004cc0)={{0x12, 0x1, 0x101, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x1, 0x1, 0x4, 0x0, 0x3, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0x6, 0x0, 0x8, {{0x8, 0x24, 0x6, 0x0, 0x0, "dc5502"}, {0x5, 0x24, 0x0, 0x80}, {0xd, 0x24, 0xf, 0x1, 0x1, 0x5, 0x8, 0x3}, [@mbim={0xc, 0x24, 0x1b, 0x2, 0x5, 0xe5, 0x0, 0x7, 0x6}, @country_functional={0x12, 0x24, 0x7, 0x9, 0x5, [0x7, 0x10, 0x1, 0x4, 0x800, 0xd]}, @country_functional={0x12, 0x24, 0x7, 0x1, 0xc91, [0xe, 0xfeff, 0x6, 0x1260, 0x2000, 0x2]}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x400, 0x16, 0xe5, 0xa0}}, {{0x9, 0x5, 0x3, 0x2, 0x0, 0x4, 0x7, 0x8e}}}}}]}}]}}, &(0x7f00000052c0)={0xa, &(0x7f0000004d40)={0xa, 0x6, 0x201, 0x2, 0x3, 0x0, 0x8, 0x4}, 0x4c, &(0x7f0000004d80)={0x5, 0xf, 0x4c, 0x5, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x1, 0x6, 0xb, 0xa}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x8, 0xa4, 0x1}, @wireless={0xb, 0x10, 0x1, 0x0, 0x10, 0x4, 0x8, 0x0, 0x2}, @generic={0x1d, 0x10, 0xb, "33c7c4d5cd8b29c1e53bb06bec256124cb3acc40366aa61c5618"}, @wireless={0xb, 0x10, 0x1, 0x8, 0x8c, 0xfb, 0x3, 0x0, 0x2}]}, 0x7, [{0x44, &(0x7f0000004e00)=@string={0x44, 0x3, "6e6d089e553dc01ce3e4587daef142a814822de27f27639ccb23a8591c10d01815d0c2937379ac721a9eab3a147ff78eff03a3015cbf686c6bbb2d3b466dfa3b5a83"}}, {0x4, &(0x7f0000004e80)=@lang_id={0x4, 0x3, 0x414}}, {0x4, &(0x7f0000004ec0)=@lang_id={0x4, 0x3, 0x1409}}, {0xc2, &(0x7f0000004f00)=@string={0xc2, 0x3, "dd314b5d79583ed4a81d0cc845cf5b103d95412dd57453d917d9c6ad6d0b8f8b2fb3f843cfc2a59a49fc734bdc34b152834c1d2a8fda60f5a28de71180a2406ce73022cab832f70d21b919822dfe7b0aa2ab1a4fac17a97b3ba775e66d4439a9457b6d9d8ae39ca1633246da962820f5be188ca3ade5c9741ce3c8a2af336dc4d241be48f62def1c2969442cee9986eefcc915535fedabfffe800faaeb7e9cb831c10ff860af6e3f00c7f982cf92fc011d4098dba899df364113e36f72709925"}}, {0xf6, &(0x7f0000005000)=@string={0xf6, 0x3, "e77bcce306ef29c3c25e29080288f946bcb7b5eccdf2c71462ae8def707f1ddb850ae0f4f54f36167007a460914f892b5fa50f7b17e616e8f1ce76b5eb19491e0087430375e2354d3f7396417b8fb9f6d76176f645105eb8bb2be7fbf036544b66eac918f13fc313596d72d84390334257f51ed04436dc7da3accf08662efc6c7bbde8085322f7385742337f962df0dca5ed86fa1c0f524ff1a24f23b234acd7f683af65a745c681dfb82bc2517b5dfe1e9f0a76084f0a2264133e485b292b077a5d3e8e52a521307393df2cb3e6b43f0d0a3c45e50f2ae32f00f4c5eb64761c5e78a953cb51c5bda49b3f86478142c025843bca"}}, {0xdc, &(0x7f0000005100)=@string={0xdc, 0x3, "fee8267e65631575da15a0e8303a873435389d99053bfcee6f7dbe3c0f1482c988511b2a746884ee63b5a0bc317c9fc15013e025a563e9e844c2383383ebdadcf941d2233a8a4d4e7e0ea9c165228455fa6cccf3ac362d035904f2f5b78b4acf6c561669de2b84197fba9206152874887ebf5a749ca86fe91224de98e9cec216fc6ece97abfd9efe8430643d3e7237015ad400244f0dc2b542eb15b670415ab9042065cbf4a7481b7a96a307e55521aa02dfe565e009202acf9a882b55b2d1116ae7dfba954a20a4b8e807e9542c3ed3b7978b6685b9066870ff"}}, {0xbe, &(0x7f0000005200)=@string={0xbe, 0x3, "71e07b0f4f7e9ee7361a2bf55e673c295e39a29fe03a108dc6d9b351c8b2bf0af74de1baf3e40b255cc7e86e11051f08de75bc01b3221249dfe9f6f9698adf6df5f908795ce1fc68ec0b99e70269fead09b7851a307dd4562fee6236af661cfa3b7a82d4ef1e06135727458a31b6527ed7dd16826afee2232c85bf228d30d7921e7b5536a2ccda1da8d03c0ae21e7b4ea8f974599e6224e73ccf6c8785cd2a8a22166e2fda92782e79c9071a2dcfff3ecabb5dff1e21d75c440dff48"}}]}) (async, rerun: 32) r9 = socket$packet(0x11, 0x3, 0x300) (rerun: 32) getsockopt$sock_buf(r9, 0x1, 0x0, &(0x7f0000005340)=""/190, &(0x7f0000005400)=0xbe) 1.294360945s ago: executing program 3 (id=119): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000000000403810b61200000000000109022400010000000009040000010300000009210000000122070009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000140)={0x1f, 0xffff, 0x3}, 0x6) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2}) (async) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$igmp(0x2, 0x3, 0x2) (async) r4 = dup(r3) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @multicast}) (async) write$tun(r2, &(0x7f0000000200)={@void, @void, @eth={@multicast, @random="ff00", @val={@void}, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x2, 0x7, 0x5c, 0x68, 0x4000, 0x7, 0x1, 0x0, @empty=0x1c, @local}, @redirect={0x5, 0x1, 0x0, @rand_addr=0x64010102, {0x10, 0x4, 0x1, 0x31, 0x8, 0x66, 0xfffe, 0x6, 0x2, 0xd92, @remote, @empty=0x7f000000, {[@ssrr={0x89, 0x3, 0xbc}, @cipso={0x86, 0x20, 0x0, [{0x5, 0x12, "bc7838a2f03ea58e38657648f257cf7b"}, {0x5, 0x8, "604079bd96df"}]}, @cipso={0x86, 0x6, 0xffffffffffffffff}]}}}}}}}}, 0x6e) (async) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000140)={0x1f, 0xffff, 0x2}, 0x6) (async) syz_usb_control_io(r0, &(0x7f0000000540)={0x2c, &(0x7f0000000100)={0x20, 0x1, 0x7, {0x7, 0x30, "24ddcd72e6"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 949.038195ms ago: executing program 0 (id=121): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) ioctl$FITHAW(r0, 0xc0045878) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000001, 0x10, r0, 0x0) (async) lseek(0xffffffffffffffff, 0x3, 0x4) (async) r1 = socket$packet(0x11, 0x3, 0x300) close(0xffffffffffffffff) (async) setsockopt$packet_int(r1, 0x107, 0x17, &(0x7f0000000340)=0x1, 0x4) (async) r2 = socket$inet(0x2, 0x2, 0x0) fsetxattr$security_capability(r2, &(0x7f0000000380), &(0x7f00000003c0)=@v3={0x3000000, [{0xac, 0x2}, {0x6, 0x4}], 0xffffffffffffffff}, 0x18, 0x0) r3 = fsopen(&(0x7f0000000000)='devpts\x00', 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000100)='mode\x00', &(0x7f0000000140)='7', 0x0) (async) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) syz_usb_connect$uac1(0x4, 0xaa, &(0x7f0000000000)=ANY=[@ANYRESHEX, @ANYRES8], 0x0) (async) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r5, 0x107, 0x5, &(0x7f0000000080)=@req3={0x8000, 0x40000200, 0x80, 0x20000, 0x0, 0x0, 0x8}, 0x1c) (async, rerun: 32) r6 = syz_open_procfs(0x0, 0x0) (rerun: 32) preadv(r6, 0x0, 0x0, 0xa0, 0x3) syz_open_procfs(0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0xa, 0x7fff, 0x0, 0x1, 0x4000000000010001, 0x1000000000000008, 0x400, 0x7}, &(0x7f0000000080)={0x9, 0x6, 0x4010001, 0x5, 0x11, 0x0, 0x6, 0x1004}, 0x0, 0x0, 0x0) (async) setsockopt$inet_tcp_int(r0, 0x6, 0x1, &(0x7f0000000040)=0x4, 0x4) 620.591743ms ago: executing program 2 (id=122): mount(0x0, &(0x7f00000000c0)='sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='sys_mnt/block/zram0/comp_algorithm\x00', 0x1, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) write(r0, &(0x7f0000000300)='l', 0x1) 560.864785ms ago: executing program 2 (id=123): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000600)=ANY=[@ANYBLOB="0a0072d10180c2000002aaaaaaaaaaaa86dd694fd2cd00103aff00000000000000000000ffffac1414aaff020000000100000000000000000001"], 0x4a) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) 560.623635ms ago: executing program 2 (id=124): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000002c0)={'geneve1\x00', 0x1}) setns(0xc9, 0x0) ioctl$TUNSETLINK(r0, 0x400454cd, 0x118) socket$can_raw(0x1d, 0x3, 0x1) socket$can_raw(0x1d, 0x3, 0x1) close(0x3) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @dev}, {0x1, @broadcast}, 0x4a, {0x2, 0x4e22, @dev}}) fcntl$getownex(r0, 0x10, &(0x7f0000000100)) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpu.stat\x00', 0x275a, 0x0) write$cgroup_devices(r2, &(0x7f0000000000)=ANY=[], 0x9) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = epoll_create(0x4) r5 = dup(r3) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r5, &(0x7f0000000740)={0xb467d103e8338fee}) epoll_pwait2(r4, &(0x7f0000000040)=[{}], 0x1, 0x0, 0x0, 0x0) close(0x3) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200), r2) sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f0000000300)={&(0x7f00000001c0), 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r6, 0x200, 0x70bd2d, 0x25dfdbfe, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x8001}, 0x4040000) getsockopt$TIPC_CONN_TIMEOUT(r2, 0x10f, 0x82, &(0x7f0000000080), &(0x7f0000000180)=0x5e) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r2, 0x0) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f0000000000)={0x1}) syz_usb_connect$uac2(0x0, 0x98, &(0x7f0000000340)=ANY=[@ANYBLOB="1201000200000008cc171d0440000102030109028600030180e007080b0101010120000924010200032600c51124080601000200feff03000c2403fd0004a80306f9ff0a0904010000010220000904010101010220000905010940000504000825019a09090200090402000001022000090402010101022000250183300a0200000000000000000000000000000000000000000000000000e646f97742143873cf878358b1165f"], 0x0) 499.774527ms ago: executing program 1 (id=125): inotify_init1(0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000019080)=@file={0x1, './file1\x00'}, 0x6e) prlimit64(r1, 0xe, 0x0, 0x0) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)={0x78, r4, 0x9c3fa077fa966179, 0x1f, 0x0, {{0x7e}, {@val={0x8}, @val={0xc, 0x99, {0x4437, 0x4}}}}, [@NL80211_ATTR_DURATION={0x8, 0x57, 0x17410c35}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x2}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x9}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x4}, @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_WIPHY_FREQ={0x8}], @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x10}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x8}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0xf0}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x1bc}]]}, 0x78}}, 0x4000054) inotify_init1(0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) prlimit64(0x0, 0xe, 0x0, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) (async) getpid() (async) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) (async) connect$unix(r2, &(0x7f0000019080)=@file={0x1, './file1\x00'}, 0x6e) (async) prlimit64(r1, 0xe, 0x0, 0x0) (async) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) (async) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) (async) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)={0x78, r4, 0x9c3fa077fa966179, 0x1f, 0x0, {{0x7e}, {@val={0x8}, @val={0xc, 0x99, {0x4437, 0x4}}}}, [@NL80211_ATTR_DURATION={0x8, 0x57, 0x17410c35}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x2}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x9}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x4}, @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_WIPHY_FREQ={0x8}], @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x10}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x8}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0xf0}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x1bc}]]}, 0x78}}, 0x4000054) (async) 425.486938ms ago: executing program 0 (id=126): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r0 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000240)={'wg2\x00', &(0x7f0000000280)=@ethtool_cmd={0x1c, 0x10000000, 0xa, 0x6, 0x2, 0x7, 0x7f, 0x8, 0x7, 0x10, 0x9, 0x0, 0x5, 0x1, 0x5, 0x7, [0x1, 0x4]}}) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x14) 376.39154ms ago: executing program 3 (id=127): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000800), r0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r2, 0x0, 0x3, 0x0, 0x0) r3 = socket$key(0xf, 0x3, 0x2) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="a8010000100001040000000000000000000000000000000000000000000000010000000000000000000000000000000100000000000000000a00808000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000001000012343200000000000000000000000000000000000001ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000060001400686d6163287368613129"], 0x1a8}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) syz_usb_connect$uac2(0x0, 0x98, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x1235, 0x8002, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x86, 0x3, 0x1, 0x80, 0xe0, 0x7, {0x8, 0xb, 0x1, 0x1, 0x1, 0xa}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x2, 0x3, 0x26, 0xc5}, [@processing_unit={0x11, 0x24, 0x8, 0x6, 0x6, [0x0, 0x2, 0x2, 0x2, 0xfffffffffffffffe, 0x3]}, @output_terminal={0xc, 0x24, 0x3, 0xfd, 0x400, 0xa8, 0x2, 0x6, 0xfff9, 0xa}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x5, 0x4, 0x0, {0x8, 0x25, 0x1, 0x81, 0x9, 0x9, 0x2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x5, 0x4, 0x2, {0x8, 0x25, 0x1, 0x83, 0x0, 0xa, 0x2}}}}}}}}]}}, 0x0) sendmsg$key(r3, &(0x7f00000001c0)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="020100030e000000fcffffff0400000005000600000000000a00000000000000fc01ff80000000000000000000000000000000000000000005000500000000000a0000002efcb098950a0ec00000000000000000000000aa0000000000000000020013"], 0x70}}, 0x0) sendmmsg(r3, &(0x7f0000000180), 0x400008a, 0x0) r5 = open(&(0x7f0000000100)='./file1\x00', 0x14f840, 0xa4) r6 = socket$netlink(0x10, 0x3, 0x8000000004) capset(&(0x7f0000000140)={0x19980330}, &(0x7f0000000100)={0x0, 0x4, 0x6, 0x0, 0x80010, 0xfffffffd}) writev(r6, &(0x7f00000000c0)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fbc45ff810500000000000058000b480400945f6400947e570028925a01000000000000008000f0fffeffe809000000fff5dd000000100001000a081000418e00000004fcff", 0x58}], 0x1) preadv2(r5, &(0x7f0000000540)=[{&(0x7f0000001200)=""/4083, 0xff3}], 0x1, 0x1, 0x20, 0xd) sendmsg$NL80211_CMD_SET_REG(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="8de9fe519ee3505caca359b7422d6209fae5d0165faad03c2831", @ANYRESHEX], 0x28}, 0x1, 0x0, 0x0, 0x4000011}, 0x24000880) lsm_set_self_attr(0x69, &(0x7f0000001940)={0x65, 0xa, 0x25, 0x5, "0a5cb59ce8"}, 0x25, 0x0) 343.391291ms ago: executing program 0 (id=128): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="3000000010000100000000020000000008000000", @ANYRES32=r0, @ANYBLOB='\b\x00\x00\x00', @ANYRES32, @ANYBLOB="0d002b80080002"], 0x30}], 0x1}, 0x0) syz_usb_connect(0x0, 0x2d0, &(0x7f0000000040)={{0x12, 0x1, 0x110, 0xe4, 0x61, 0x8c, 0x20, 0xc52, 0x2413, 0x96b8, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2be, 0x1, 0x3, 0x0, 0xa0, 0x23, "", [{{0x9, 0x4, 0x48, 0x6, 0x9, 0xa5, 0x3b, 0xb7, 0xe5, [], [{{0x9, 0x5, 0x4, 0x0, 0x3ff, 0x3, 0x8, 0x1, [@generic={0x4e, 0x21, "40faa38bd70a474f57b16fca28e14e5af22e948b776a454a5526876985eeb5b5ce00b98846cae69db3f08d1270429b0d473f8fb0b57f4437cf3d2e0a893530e6846fc175bf560f22411114bf"}]}}, {{0x9, 0x5, 0xf, 0x0, 0x20, 0x1d, 0x6, 0xbd}}, {{0x9, 0x5, 0x1, 0x4, 0x40, 0x8, 0x3, 0x20}}, {{0x9, 0x5, 0xf, 0x4, 0x10, 0x3, 0x7, 0x7, [@generic={0x47, 0x2, "37b96506f19598e13bc60bdbf3dba35435ccffaf7158a374007a7992721042d8e5aa7382f6f168e520e46830f27672c6e7b0c2c1f8bd7ad729bd142d027f6b6bd3a7b2c0d4"}]}}, {{0x9, 0x5, 0x7, 0x0, 0x200, 0xc, 0xfe, 0xff}}, {{0x9, 0x5, 0x3, 0x0, 0x200, 0xec, 0x0, 0x8c, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0xf6, 0xbc}]}}, {{0x9, 0x5, 0x0, 0x2, 0x20, 0x65, 0x1, 0x8, [@generic={0xe3, 0x23, "4f3ce14887d9defc164290e4bd5f19be54914b28bb08e8af2fd964eb48266491d8fe1af8988638578e712a7a353c14e2a1ba6e9ae6ff8774ff5e7663b8a7a5dcf6d48735baf992651de1d96c049a8c40dac39b4e386ad6c173aaae08d898077750aa8121ba7454b1d0cdd5340a99eacc505885c2540c2dc1e25ef9d28a4c0f1cfc83ecf352ab7c4adfb1ec4078896f8541df7ac773e3e7b1f8d3edb4a9cb420c182e7e7bff07a4381ba25c7edfa17ee9fe81e28209315435a59fb5a1970ecf61e023fa557b3e641c4b4f1c717cac5c4cb722a559ca6dc21c4f2dc420500f51d37b"}]}}, {{0x9, 0x5, 0x4, 0xc, 0x10, 0xf, 0x6, 0x1, [@generic={0x6b, 0xf, "40197a498feab1e0d8dad759409a9107cff15fccb1cc11909d46a5e3a5f2443bb5ce792a4b3d21a47bf9dbe4d610ce5826a2106d8774f69a3babfc6af2c4fb80aea5097885db34d71a426687177734b0e6359f76ce60f7eeadf182df1cafd9ffe5cb973fb05446ed1a"}]}}, {{0x9, 0x5, 0xb, 0x10, 0x3ff, 0x9, 0x9, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x1, 0x5}, @generic={0x6a, 0xf, "49da0fb3bf85bf1eaf6d644a7aaf78fcdc8fa3d7f772148e2bd7668cf68c27459d8bbf9a09c80045d3a70aab173c3721972278d985a9afdcb822f54c0c8a41838d55aa406347ace81246f411c5eecd5e70ddcf2b817a070d8a51d1842d3a6b169877ca2cebfbf7c9"}]}}]}}]}}]}}, 0x0) 149.588516ms ago: executing program 1 (id=129): ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000080)={0x0, 0x0}) r1 = syz_open_procfs(r0, &(0x7f0000000100)='net/ptype\x00') setresgid(0xee00, 0xee01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=[@cred={{0x49}}, @cred={{0x1c, 0x1, 0x2, {r0, 0xffffffffffffffff, 0xee00}}}], 0x40, 0x4000}}], 0x1, 0x14040804) pread64(r1, &(0x7f0000001240)=""/102400, 0x19000, 0x80000000000000) 92.151928ms ago: executing program 1 (id=130): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$TUNSETVNETHDRSZ(r1, 0x400454d8, &(0x7f0000000540)=0x8) close_range(r0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) mmap(&(0x7f0000ff4000/0xc000)=nil, 0xc000, 0x1000003, 0x20031, 0xffffffffffffffff, 0xffffe000) r2 = userfaultfd(0x80801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x100}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1}) ioctl$UFFDIO_ZEROPAGE(r2, 0xc020aa08, &(0x7f0000000000)={{&(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0x1}) madvise(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x9) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x40000, 0x1e4}, &(0x7f0000000000), &(0x7f0000000100), &(0x7f0000000140)=0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, r3, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x104, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x1, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @multicast}) write$tun(r4, &(0x7f0000002c40)={@void, @void, @eth={@multicast, @broadcast, @val={@val={0x88a8, 0x4, 0x1, 0x3}, {0x88a8}}, {@arp={0x806, @generic={0x30b, 0x17, 0x6, 0x0, 0xa, @broadcast, "", @dev={'\xaa\xaa\xaa\xaa\xaa', 0x31}}}}}}, 0x2a) r7 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080), 0x80000, 0x0) ioctl$RTC_ALM_READ(r7, 0x40187014, 0x0) 72.624388ms ago: executing program 2 (id=131): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f00000000c0)='sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='sys_mnt/block/zram0/comp_algorithm\x00', 0x1, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) write(r0, &(0x7f0000000300)='l', 0x1) 65.271448ms ago: executing program 2 (id=132): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000600)=ANY=[@ANYBLOB="0a0072d10180c2000002aaaaaaaaaaaa86dd694fd2cd00103aff00000000000000000000ffffac1414aaff020000000200000000000000000001"], 0x4a) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) 422.35µs ago: executing program 1 (id=133): socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmmsg$inet(r0, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0xf5) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000080)=[{0x6, 0x4, 0x0, 0x7fff0000}]}) close_range(r1, 0xffffffffffffffff, 0x0) setrlimit(0x1, 0x0) r2 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000005c0), 0x2, 0x0) r3 = openat$selinux_policy(0xffffff9c, &(0x7f00000000c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r3, 0x0) r4 = openat$cgroup(r3, &(0x7f0000000000)='syz1\x00', 0x200002, 0x0) openat$cgroup_ro(r4, &(0x7f0000000040)='cpuset.memory_pressure_enabled\x00', 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_DELETE(0xffffffffffffffff, &(0x7f0000001100)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000001040)={0x1c, 0x2, 0x2, 0x401, 0x0, 0x0, {0x0, 0x0, 0x3}, [@CTA_EXPECT_ID={0x8, 0x5, 0x1, 0x0, 0x40000}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000009}, 0x4000000) write$selinux_load(r2, &(0x7f0000000000)=ANY=[], 0x70b5) 0s ago: executing program 2 (id=134): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_open_dev$loop(&(0x7f0000000180), 0x7, 0x103482) (async) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='mounts\x00') listen(r2, 0x401) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) (async) mount$cgroup2(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0), 0x2000000, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) (async) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000002180)='./file0\x00', 0x0, 0x80) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r4, 0x40086602, &(0x7f0000000000)) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f00000002c0)={r3, 0x0, {0x2a00, 0x80010000, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0xd, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9683dda1af1ea89de2b7fb0a0100000000000000000300", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd00000014000800000000000000007f"}}) write(r3, &(0x7f0000000080)="1de4ba0d3d", 0x5) (async) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), r0) (async) r6 = socket$netlink(0x10, 0x3, 0x4) syz_usb_connect$cdc_ecm(0x2, 0x5a, &(0x7f0000000000)=ANY=[], 0x0) (async) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r6, 0x10e, 0x1, &(0x7f0000000000)=0x1a, 0x4) (async) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r6, 0x10e, 0x2, &(0x7f0000000300)=0x1a, 0x4) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r7, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r8, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) (async) listen(r8, 0x5) (async) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000200)={0x2c, r5, 0x200, 0x70bd28, 0x25dfdbfb, {0x21, 0x0, 0xffff}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x815}, 0x400c854) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.10' (ED25519) to the list of known hosts. [ 28.514747][ T36] audit: type=1400 audit(1785877491.440:64): avc: denied { mounton } for pid=287 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 28.518188][ T287] cgroup: Unknown subsys name 'net' [ 28.537638][ T36] audit: type=1400 audit(1785877491.440:65): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 28.565073][ T36] audit: type=1400 audit(1785877491.470:66): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 28.565653][ T287] cgroup: Unknown subsys name 'devices' [ 28.691431][ T287] cgroup: Unknown subsys name 'hugetlb' [ 28.697111][ T287] cgroup: Unknown subsys name 'rlimit' [ 28.813070][ T36] audit: type=1400 audit(1785877491.740:67): avc: denied { setattr } for pid=287 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 28.836461][ T36] audit: type=1400 audit(1785877491.740:68): avc: denied { mounton } for pid=287 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 28.861253][ T36] audit: type=1400 audit(1785877491.740:69): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 28.886246][ T289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 28.895100][ T36] audit: type=1400 audit(1785877491.820:70): avc: denied { relabelto } for pid=289 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.920588][ T36] audit: type=1400 audit(1785877491.820:71): avc: denied { write } for pid=289 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.948466][ T36] audit: type=1400 audit(1785877491.880:72): avc: denied { read } for pid=287 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.974319][ T36] audit: type=1400 audit(1785877491.880:73): avc: denied { open } for pid=287 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.974933][ T287] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 30.308940][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.316080][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.323349][ T297] bridge_slave_0: entered allmulticast mode [ 30.329939][ T297] bridge_slave_0: entered promiscuous mode [ 30.339259][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.346330][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.353657][ T297] bridge_slave_1: entered allmulticast mode [ 30.360049][ T297] bridge_slave_1: entered promiscuous mode [ 30.371300][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.378371][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.385531][ T295] bridge_slave_0: entered allmulticast mode [ 30.391935][ T295] bridge_slave_0: entered promiscuous mode [ 30.404183][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.411339][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.418439][ T294] bridge_slave_0: entered allmulticast mode [ 30.424910][ T294] bridge_slave_0: entered promiscuous mode [ 30.432551][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.439643][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.446763][ T294] bridge_slave_1: entered allmulticast mode [ 30.453129][ T294] bridge_slave_1: entered promiscuous mode [ 30.459214][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.466271][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.473414][ T295] bridge_slave_1: entered allmulticast mode [ 30.479753][ T295] bridge_slave_1: entered promiscuous mode [ 30.541764][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.548862][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.556231][ T296] bridge_slave_0: entered allmulticast mode [ 30.562528][ T296] bridge_slave_0: entered promiscuous mode [ 30.569171][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.576235][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.583581][ T296] bridge_slave_1: entered allmulticast mode [ 30.589946][ T296] bridge_slave_1: entered promiscuous mode [ 30.719850][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.726937][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.734379][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.741478][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.750405][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.757764][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.765164][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.772230][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.794286][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.801431][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.808752][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.815831][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.863593][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.871069][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.878374][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.886450][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.893835][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.901530][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.915925][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.923038][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.931102][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.938182][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.961953][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.969073][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.977032][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.984131][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.009537][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.016629][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.024381][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.031497][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.072241][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.079349][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.087297][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.094409][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.108586][ T294] veth0_vlan: entered promiscuous mode [ 31.122468][ T295] veth0_vlan: entered promiscuous mode [ 31.129579][ T297] veth0_vlan: entered promiscuous mode [ 31.161886][ T297] veth1_macvtap: entered promiscuous mode [ 31.168892][ T295] veth1_macvtap: entered promiscuous mode [ 31.181265][ T294] veth1_macvtap: entered promiscuous mode [ 31.222937][ T296] veth0_vlan: entered promiscuous mode [ 31.236225][ T297] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 31.268925][ T296] veth1_macvtap: entered promiscuous mode [ 31.354763][ T323] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 31.409399][ T326] netlink: 'syz.0.5': attribute type 4 has an invalid length. [ 31.556877][ T343] input: syz1 as /devices/virtual/input/input4 [ 31.849175][ T298] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 31.858821][ T350] process 'syz.2.11' launched './file0' with NULL argv: empty string added [ 31.959238][ T9] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 31.999239][ T298] usb 4-1: Using ep0 maxpacket: 16 [ 32.005819][ T298] usb 4-1: config 32 has an invalid interface number: 64 but max is 0 [ 32.014315][ T298] usb 4-1: config 32 has an invalid descriptor of length 0, skipping remainder of the config [ 32.025019][ T298] usb 4-1: config 32 has no interface number 0 [ 32.031454][ T298] usb 4-1: New USB device found, idVendor=0bd3, idProduct=0569, bcdDevice= 0.5b [ 32.040575][ T298] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.052626][ T298] usb 4-1: Found UVC 0.00 device (0bd3:0569) [ 32.060139][ T298] usb 4-1: No valid video chain found. [ 32.089208][ T9] usb 1-1: device descriptor read/64, error -71 [ 32.129227][ T65] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 32.257034][ T10] usb 4-1: USB disconnect, device number 2 [ 32.279189][ T65] usb 3-1: Using ep0 maxpacket: 8 [ 32.285847][ T65] usb 3-1: unable to get BOS descriptor or descriptor too short [ 32.294391][ T65] usb 3-1: config 252 has an invalid interface number: 223 but max is 0 [ 32.303096][ T65] usb 3-1: config 252 has an invalid interface association descriptor of length 2, skipping [ 32.313374][ T65] usb 3-1: config 252 has no interface number 0 [ 32.329334][ T65] usb 3-1: New USB device found, idVendor=1a86, idProduct=5a2f, bcdDevice=c6.a6 [ 32.338627][ T9] usb 1-1: device descriptor read/64, error -71 [ 32.345224][ T65] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.353328][ T65] usb 3-1: Product: syz [ 32.357636][ T65] usb 3-1: Manufacturer: syz [ 32.362341][ T65] usb 3-1: SerialNumber: syz [ 32.427627][ T358] syzkaller1: entered promiscuous mode [ 32.433214][ T358] syzkaller1: entered allmulticast mode [ 32.498135][ T360] netlink: 'syz.1.15': attribute type 4 has an invalid length. [ 32.581043][ T65] usb 3-1: USB disconnect, device number 2 [ 32.589323][ T9] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 32.612871][ T374] netlink: 'syz.1.20': attribute type 58 has an invalid length. [ 32.719260][ T9] usb 1-1: device descriptor read/64, error -71 [ 32.869569][ T10] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 32.969264][ T9] usb 1-1: device descriptor read/64, error -71 [ 33.021068][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 33.029525][ T10] usb 2-1: not running at top speed; connect to a high speed hub [ 33.038127][ T10] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 33.048488][ T10] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 120, changing to 4 [ 33.059693][ T10] usb 2-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 33.074166][ T10] usb 2-1: New USB device found, idVendor=0e41, idProduct=3020, bcdDevice= 0.40 [ 33.083429][ T9] usb usb1-port1: attempt power cycle [ 33.088952][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.097881][ T10] usb 2-1: Product: syz [ 33.105541][ T10] usb 2-1: Manufacturer: syz [ 33.110396][ T10] usb 2-1: SerialNumber: syz [ 33.177709][ T387] syzkaller1: entered promiscuous mode [ 33.183483][ T387] syzkaller1: entered allmulticast mode [ 33.323466][ T10] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 33.333535][ T10] usb 2-1: USB disconnect, device number 2 [ 33.379323][ T65] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 33.391028][ T393] udevd[393]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 33.429220][ T9] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 33.450339][ T9] usb 1-1: device descriptor read/8, error -71 [ 33.529668][ T65] usb 4-1: too many configurations: 62, using maximum allowed: 8 [ 33.538886][ T65] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 33.546624][ T65] usb 4-1: can't read configurations, error -61 [ 33.581181][ T9] usb 1-1: device descriptor read/8, error -71 [ 33.679219][ T65] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 33.819178][ T9] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 33.832204][ T65] usb 4-1: too many configurations: 62, using maximum allowed: 8 [ 33.847600][ T65] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 33.856732][ T65] usb 4-1: can't read configurations, error -61 [ 33.863393][ T65] usb usb4-port1: attempt power cycle [ 33.869604][ T9] usb 1-1: device descriptor read/8, error -71 [ 34.000430][ T9] usb 1-1: device descriptor read/8, error -71 [ 34.069235][ T298] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 34.099197][ T312] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 34.109266][ T9] usb usb1-port1: unable to enumerate USB device [ 34.209234][ T65] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 34.219316][ T298] usb 3-1: Using ep0 maxpacket: 16 [ 34.226271][ T298] usb 3-1: unable to get BOS descriptor or descriptor too short [ 34.230405][ T65] usb 4-1: too many configurations: 62, using maximum allowed: 8 [ 34.236721][ T298] usb 3-1: config 1 descriptor has 1 excess byte, ignoring [ 34.243925][ T65] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 34.249362][ T312] usb 2-1: Using ep0 maxpacket: 32 [ 34.257045][ T65] usb 4-1: can't read configurations, error -61 [ 34.265001][ T312] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 34.279231][ T312] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 34.289048][ T312] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 34.298266][ T298] usb 3-1: New USB device found, idVendor=fc08, idProduct=0101, bcdDevice= 0.40 [ 34.307474][ T312] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.315741][ T298] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.324197][ T298] usb 3-1: Product: syz [ 34.328656][ T312] usb 2-1: config 0 descriptor?? [ 34.333693][ T298] usb 3-1: Manufacturer: syz [ 34.338441][ T298] usb 3-1: SerialNumber: syz [ 34.344264][ T312] hub 2-1:0.0: USB hub found [ 34.409232][ T65] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 34.429957][ T65] usb 4-1: too many configurations: 62, using maximum allowed: 8 [ 34.439027][ T65] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 34.446691][ T65] usb 4-1: can't read configurations, error -61 [ 34.453146][ T65] usb usb4-port1: unable to enumerate USB device [ 34.545091][ T312] hub 2-1:0.0: 1 port detected [ 34.626666][ T298] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 34.633884][ T298] usb 3-1: 2:1 : no or invalid class specific endpoint descriptor [ 34.641877][ T298] usb 3-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 34.651288][ T298] usb 3-1: USB disconnect, device number 3 [ 34.666578][ T393] udevd[393]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 34.812163][ T36] kauditd_printk_skb: 71 callbacks suppressed [ 34.812181][ T36] audit: type=1400 audit(1785877497.740:145): avc: denied { create } for pid=403 comm="syz.0.31" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 34.838837][ T36] audit: type=1400 audit(1785877497.740:146): avc: denied { setopt } for pid=403 comm="syz.0.31" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 34.858432][ T36] audit: type=1400 audit(1785877497.770:147): avc: denied { map } for pid=403 comm="syz.0.31" path="socket:[4378]" dev="sockfs" ino=4378 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 34.881869][ T36] audit: type=1400 audit(1785877497.770:148): avc: denied { read } for pid=403 comm="syz.0.31" path="socket:[4378]" dev="sockfs" ino=4378 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 34.947535][ T399] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 34.956649][ T399] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 34.968937][ T312] usb 2-1: USB disconnect, device number 3 [ 35.234590][ T36] audit: type=1400 audit(1785877498.160:149): avc: denied { create } for pid=411 comm="syz.2.34" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 35.269183][ T36] audit: type=1400 audit(1785877498.160:150): avc: denied { getopt } for pid=411 comm="syz.2.34" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 35.374978][ T415] syzkaller1: entered promiscuous mode [ 35.380788][ T415] syzkaller1: entered allmulticast mode [ 35.455414][ T36] audit: type=1400 audit(1785877498.380:151): avc: denied { create } for pid=416 comm="syz.2.36" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 35.486549][ T36] audit: type=1400 audit(1785877498.410:152): avc: denied { bind } for pid=416 comm="syz.2.36" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 35.510866][ T36] audit: type=1400 audit(1785877498.410:153): avc: denied { connect } for pid=416 comm="syz.2.36" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 35.530545][ T36] audit: type=1400 audit(1785877498.410:154): avc: denied { write } for pid=416 comm="syz.2.36" path="socket:[4534]" dev="sockfs" ino=4534 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 35.826871][ T444] FAULT_INJECTION: forcing a failure. [ 35.826871][ T444] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 35.840191][ T444] CPU: 1 UID: 0 PID: 444 Comm: syz.1.45 Not tainted syzkaller #0 1c659cfea3877f078df945e50c8eb7045fd035a9 [ 35.840217][ T444] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 35.840233][ T444] Call Trace: [ 35.840238][ T444] [ 35.840244][ T444] __dump_stack+0x21/0x30 [ 35.840274][ T444] dump_stack_lvl+0x140/0x1c0 [ 35.840296][ T444] ? __cfi_dump_stack_lvl+0x10/0x10 [ 35.840319][ T444] dump_stack+0x19/0x20 [ 35.840339][ T444] should_fail_ex+0x3c2/0x510 [ 35.840358][ T444] should_fail+0xf/0x20 [ 35.840373][ T444] should_fail_usercopy+0x1e/0x30 [ 35.840392][ T444] strncpy_from_user+0x29/0x280 [ 35.840409][ T444] getname_flags+0x106/0x6b0 [ 35.840426][ T444] ? __kasan_check_write+0x18/0x20 [ 35.840442][ T444] getname+0x1b/0x30 [ 35.840458][ T444] io_openat_prep+0x23e/0x560 [ 35.840474][ T444] ? __cfi_io_openat_prep+0x10/0x10 [ 35.840490][ T444] io_submit_sqes+0x9d7/0x1b70 [ 35.840533][ T444] __se_sys_io_uring_enter+0x302/0x25c0 [ 35.840555][ T444] ? lru_add_drain_cpu+0x338/0x450 [ 35.840575][ T444] ? __cfi_lru_add_drain_cpu+0x10/0x10 [ 35.840595][ T444] ? down_read+0x7f/0xe0 [ 35.840619][ T444] ? __kasan_check_write+0x18/0x20 [ 35.840634][ T444] ? __x64_sys_io_uring_enter+0x110/0x110 [ 35.840655][ T444] ? __mm_populate+0x3ea/0x440 [ 35.840676][ T444] ? vm_mmap_pgoff+0x152/0x4b0 [ 35.840691][ T444] ? __cfi_vm_mmap_pgoff+0x10/0x10 [ 35.840705][ T444] ? __fget_files+0x2bc/0x330 [ 35.840724][ T444] ? __kasan_check_write+0x18/0x20 [ 35.840739][ T444] ? fput+0x1a4/0x230 [ 35.840760][ T444] __x64_sys_io_uring_enter+0xe9/0x110 [ 35.840781][ T444] x64_sys_call+0x2d28/0x2ee0 [ 35.840795][ T444] do_syscall_64+0x57/0xf0 [ 35.840812][ T444] ? clear_bhb_loop+0x50/0xa0 [ 35.840833][ T444] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 35.840853][ T444] RIP: 0033:0x7fc0ddb9e019 [ 35.840867][ T444] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.840880][ T444] RSP: 002b:00007fc0dea95f38 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 35.840901][ T444] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc0ddb9e019 [ 35.840912][ T444] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000016 [ 35.840921][ T444] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000008 [ 35.840930][ T444] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000800 [ 35.840940][ T444] R13: 0000200000000808 R14: 0000000000000c41 R15: 0000000000000000 [ 35.840953][ T444] [ 36.105972][ T312] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 36.273007][ T312] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 36.283301][ T312] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 36.307228][ T312] usb 3-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice= 1.00 [ 36.317203][ T312] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.325312][ T312] usb 3-1: Product: syz [ 36.329645][ T312] usb 3-1: Manufacturer: syz [ 36.334289][ T312] usb 3-1: SerialNumber: syz [ 36.352957][ T425] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 36.367241][ T425] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 36.378741][ T312] usbserial_generic 3-1:1.0: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 36.390871][ T312] usbserial_generic 3-1:1.0: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 36.402080][ T312] usbserial_generic 3-1:1.0: generic converter detected [ 36.416534][ T312] usb 3-1: generic converter now attached to ttyUSB0 [ 36.516516][ T479] FAULT_INJECTION: forcing a failure. [ 36.516516][ T479] name failslab, interval 1, probability 0, space 0, times 1 [ 36.529242][ T479] CPU: 0 UID: 0 PID: 479 Comm: syz.0.59 Not tainted syzkaller #0 1c659cfea3877f078df945e50c8eb7045fd035a9 [ 36.529275][ T479] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 36.529289][ T479] Call Trace: [ 36.529296][ T479] [ 36.529305][ T479] __dump_stack+0x21/0x30 [ 36.529339][ T479] dump_stack_lvl+0x140/0x1c0 [ 36.529361][ T479] ? __cfi_dump_stack_lvl+0x10/0x10 [ 36.529385][ T479] dump_stack+0x19/0x20 [ 36.529406][ T479] should_fail_ex+0x3c2/0x510 [ 36.529424][ T479] should_failslab+0xac/0x100 [ 36.529444][ T479] kmem_cache_alloc_noprof+0x42/0x410 [ 36.529461][ T479] ? security_file_alloc+0x49/0x220 [ 36.529486][ T479] ? kasan_save_alloc_info+0x3a/0x50 [ 36.529511][ T479] security_file_alloc+0x49/0x220 [ 36.529535][ T479] init_file+0x9e/0x210 [ 36.529555][ T479] alloc_empty_file+0xd9/0x270 [ 36.529575][ T479] ? is_bpf_text_address+0x17b/0x1a0 [ 36.529599][ T479] path_openat+0xf4/0x35a0 [ 36.529620][ T479] ? __kernel_text_address+0x11/0x40 [ 36.529641][ T479] ? unwind_get_return_address+0x51/0x90 [ 36.529691][ T479] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 36.529710][ T479] ? arch_stack_walk+0x10a/0x170 [ 36.529728][ T479] ? stack_depot_save_flags+0x38/0x800 [ 36.529747][ T479] ? io_openat2+0x11a/0x5a0 [ 36.529761][ T479] ? io_openat+0x1f/0x30 [ 36.529775][ T479] ? io_submit_sqes+0xa77/0x1b70 [ 36.529796][ T479] ? do_filp_open+0x440/0x440 [ 36.529816][ T479] ? kasan_save_track+0x4f/0x80 [ 36.529833][ T479] ? kasan_save_track+0x3e/0x80 [ 36.529849][ T479] ? kasan_save_alloc_info+0x3a/0x50 [ 36.529872][ T479] ? __kasan_slab_alloc+0x73/0x90 [ 36.529897][ T479] ? kmem_cache_alloc_noprof+0x1bf/0x410 [ 36.529914][ T479] do_filp_open+0x1f2/0x440 [ 36.529935][ T479] ? __cfi_do_filp_open+0x10/0x10 [ 36.529958][ T479] ? _raw_spin_unlock+0x45/0x60 [ 36.529975][ T479] ? alloc_fd+0x4c1/0x570 [ 36.529994][ T479] io_openat2+0x3b4/0x5a0 [ 36.530009][ T479] ? __cfi_io_openat2+0x10/0x10 [ 36.530024][ T479] ? getname_flags+0x203/0x6b0 [ 36.530041][ T479] ? __kasan_check_write+0x18/0x20 [ 36.530058][ T479] io_openat+0x1f/0x30 [ 36.530072][ T479] __io_issue_sqe+0x1ae/0x470 [ 36.530093][ T479] io_issue_sqe+0x157/0x1520 [ 36.530114][ T479] io_submit_sqes+0xa77/0x1b70 [ 36.530138][ T479] __se_sys_io_uring_enter+0x302/0x25c0 [ 36.530163][ T479] ? lru_add_drain_cpu+0x338/0x450 [ 36.530196][ T479] ? __cfi_lru_add_drain_cpu+0x10/0x10 [ 36.530215][ T479] ? down_read+0x7f/0xe0 [ 36.530238][ T479] ? __kasan_check_write+0x18/0x20 [ 36.530253][ T479] ? __x64_sys_io_uring_enter+0x110/0x110 [ 36.530274][ T479] ? __mm_populate+0x3ea/0x440 [ 36.530295][ T479] ? vm_mmap_pgoff+0x152/0x4b0 [ 36.530310][ T479] ? __cfi_vm_mmap_pgoff+0x10/0x10 [ 36.530325][ T479] ? __fget_files+0x2bc/0x330 [ 36.530343][ T479] ? __kasan_check_write+0x18/0x20 [ 36.530357][ T479] ? fput+0x1a4/0x230 [ 36.530378][ T479] __x64_sys_io_uring_enter+0xe9/0x110 [ 36.530399][ T479] x64_sys_call+0x2d28/0x2ee0 [ 36.530413][ T479] do_syscall_64+0x57/0xf0 [ 36.530430][ T479] ? clear_bhb_loop+0x50/0xa0 [ 36.530452][ T479] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 36.530472][ T479] RIP: 0033:0x7f364919e019 [ 36.530485][ T479] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 36.530498][ T479] RSP: 002b:00007f364a0eff38 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 36.530515][ T479] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f364919e019 [ 36.530527][ T479] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000016 [ 36.530537][ T479] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000008 [ 36.530546][ T479] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000800 [ 36.530556][ T479] R13: 0000200000000808 R14: 0000000000000c41 R15: 0000000000000000 [ 36.530568][ T479] [ 36.585961][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 36.719306][ T9] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 36.763667][ T312] usb 3-1: USB disconnect, device number 4 [ 36.772386][ T65] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 36.783067][ T312] generic ttyUSB0: generic converter now disconnected from ttyUSB0 [ 36.783956][ T312] usbserial_generic 3-1:1.0: device disconnected [ 36.939306][ T65] usb 4-1: device descriptor read/64, error -71 [ 36.990465][ T9] usb 2-1: config 127 has an invalid interface number: 57 but max is 0 [ 36.998759][ T9] usb 2-1: config 127 has no interface number 0 [ 37.005142][ T9] usb 2-1: config 127 interface 57 altsetting 0 endpoint 0xC has invalid maxpacket 1023, setting to 64 [ 37.020483][ T9] usb 2-1: New USB device found, idVendor=0df6, idProduct=0056, bcdDevice=d2.4b [ 37.029929][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.037966][ T9] usb 2-1: Product: syz [ 37.042271][ T9] usb 2-1: Manufacturer: syz [ 37.046901][ T9] usb 2-1: SerialNumber: syz [ 37.055014][ T469] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 37.229247][ T65] usb 4-1: device descriptor read/64, error -71 [ 37.479220][ T65] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 37.549179][ T312] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 37.565748][ T510] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 37.577394][ T506] netlink: 108 bytes leftover after parsing attributes in process `syz.0.68'. [ 37.629229][ T65] usb 4-1: device descriptor read/64, error -71 [ 37.703563][ T312] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 37.714785][ T312] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 37.724701][ T312] usb 3-1: New USB device found, idVendor=1d34, idProduct=000a, bcdDevice= 0.00 [ 37.733846][ T312] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 37.746534][ T312] usb 3-1: config 0 descriptor?? [ 37.869166][ T65] usb 4-1: device descriptor read/64, error -71 [ 37.979321][ T65] usb usb4-port1: attempt power cycle [ 38.089192][ T392] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 38.154230][ T494] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 38.162915][ T494] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 38.172689][ T312] usbhid 3-1:0.0: can't add hid device: -71 [ 38.178860][ T312] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 38.187995][ T312] usb 3-1: USB disconnect, device number 5 [ 38.250284][ T392] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 38.260783][ T392] usb 1-1: New USB device found, idVendor=050d, idProduct=011b, bcdDevice=6f.a4 [ 38.269982][ T392] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 38.279670][ T392] usb 1-1: config 0 descriptor?? [ 38.285931][ T392] usb 1-1: bad CDC descriptors [ 38.319184][ T65] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 38.340266][ T65] usb 4-1: device descriptor read/8, error -71 [ 38.470343][ T65] usb 4-1: device descriptor read/8, error -71 [ 38.487131][ T312] usb 1-1: USB disconnect, device number 6 [ 38.709209][ T65] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 38.730246][ T65] usb 4-1: device descriptor read/8, error -71 [ 38.860829][ T65] usb 4-1: device descriptor read/8, error -71 [ 38.969326][ T65] usb usb4-port1: unable to enumerate USB device [ 39.309370][ T312] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 39.439157][ T312] usb 1-1: device descriptor read/64, error -71 [ 39.451805][ T9] asix 2-1:127.57 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 39.462241][ T9] asix 2-1:127.57: probe with driver asix failed with error -71 [ 39.473144][ T9] usb 2-1: USB disconnect, device number 4 [ 39.668579][ T548] netlink: 'syz.3.82': attribute type 16 has an invalid length. [ 39.676389][ T548] netlink: 64138 bytes leftover after parsing attributes in process `syz.3.82'. [ 39.685784][ T312] usb 1-1: device descriptor read/64, error -71 [ 39.745238][ T548] netlink: 'syz.3.82': attribute type 1 has an invalid length. [ 39.755166][ T560] netlink: 'syz.3.82': attribute type 1 has an invalid length. [ 39.763640][ T548] netlink: 92 bytes leftover after parsing attributes in process `syz.3.82'. [ 39.773668][ T560] netlink: 92 bytes leftover after parsing attributes in process `syz.3.82'. [ 39.843656][ T36] kauditd_printk_skb: 38 callbacks suppressed [ 39.843677][ T36] audit: type=1400 audit(1785877502.770:193): avc: denied { read } for pid=575 comm="syz.1.92" name="binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 39.850844][ T576] rust_binder: Failure in copy_transaction_data: EFAULT [ 39.872826][ T36] audit: type=1400 audit(1785877502.770:194): avc: denied { open } for pid=575 comm="syz.1.92" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 39.872862][ T576] rust_binder: 575:576 transaction call to 575:0 failed EFAULT, code 0 size 76-0 [ 39.880530][ T36] audit: type=1400 audit(1785877502.770:195): avc: denied { ioctl } for pid=575 comm="syz.1.92" path="/dev/binderfs/binder0" dev="binder" ino=13 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 39.937911][ T36] audit: type=1400 audit(1785877502.770:196): avc: denied { set_context_mgr } for pid=575 comm="syz.1.92" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 39.957543][ T36] audit: type=1400 audit(1785877502.770:197): avc: denied { map } for pid=575 comm="syz.1.92" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 39.981097][ T36] audit: type=1400 audit(1785877502.770:198): avc: denied { write } for pid=575 comm="syz.1.92" name="binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 39.989366][ T312] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 40.003625][ T36] audit: type=1400 audit(1785877502.770:199): avc: denied { call } for pid=575 comm="syz.1.92" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 40.139242][ T46] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 40.146834][ T312] usb 1-1: device descriptor read/64, error -71 [ 40.279223][ T46] usb 2-1: device descriptor read/64, error -71 [ 40.357133][ T36] audit: type=1400 audit(1785877503.280:200): avc: denied { ioctl } for pid=578 comm="syz.2.93" path="socket:[5870]" dev="sockfs" ino=5870 ioctlcmd=0x8916 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 40.389320][ T312] usb 1-1: device descriptor read/64, error -71 [ 40.483902][ T36] audit: type=1400 audit(1785877503.410:201): avc: denied { connect } for pid=587 comm="syz.2.97" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 40.499649][ T312] usb usb1-port1: attempt power cycle [ 40.521837][ T46] usb 2-1: device descriptor read/64, error -71 [ 40.537601][ T36] audit: type=1400 audit(1785877503.460:202): avc: denied { connect } for pid=592 comm="syz.3.99" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 40.703934][ T605] netlink: 12 bytes leftover after parsing attributes in process `syz.2.102'. [ 40.759170][ T46] usb 2-1: new full-speed USB device number 6 using dummy_hcd [ 40.769277][ T298] usb 4-1: new low-speed USB device number 11 using dummy_hcd [ 40.859305][ T312] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 40.889215][ T46] usb 2-1: device descriptor read/64, error -71 [ 40.896497][ T312] usb 1-1: device descriptor read/8, error -71 [ 40.930357][ T298] usb 4-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid maxpacket 64, setting to 8 [ 40.941283][ T298] usb 4-1: config 0 interface 0 has no altsetting 0 [ 40.947929][ T298] usb 4-1: New USB device found, idVendor=172f, idProduct=0037, bcdDevice= 0.00 [ 40.957234][ T298] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 40.966219][ T298] usb 4-1: config 0 descriptor?? [ 40.975507][ T593] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 41.035715][ T312] usb 1-1: device descriptor read/8, error -71 [ 41.139170][ T46] usb 2-1: device descriptor read/64, error -71 [ 41.263026][ T46] usb usb2-port1: attempt power cycle [ 41.309176][ T312] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 41.340984][ T312] usb 1-1: device descriptor read/8, error -71 [ 41.386292][ T298] hid (null): global environment stack underflow [ 41.394006][ T298] hid (null): usage index exceeded [ 41.401320][ T298] waltop 0003:172F:0037.0001: unknown main item tag 0x1 [ 41.408394][ T298] waltop 0003:172F:0037.0001: collection stack underflow [ 41.415540][ T298] waltop 0003:172F:0037.0001: item 0 2 0 12 parsing failed [ 41.423029][ T298] waltop 0003:172F:0037.0001: probe with driver waltop failed with error -22 [ 41.470358][ T312] usb 1-1: device descriptor read/8, error -71 [ 41.473407][ T633] netlink: 'syz.2.111': attribute type 4 has an invalid length. [ 41.484412][ T633] netlink: 3581 bytes leftover after parsing attributes in process `syz.2.111'. [ 41.494090][ T633] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=633 comm=syz.2.111 [ 41.542498][ T641] netlink: 4 bytes leftover after parsing attributes in process `syz.2.114'. [ 41.580100][ T312] usb usb1-port1: unable to enumerate USB device [ 41.593677][ T312] usb 4-1: USB disconnect, device number 11 [ 41.609234][ T46] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 41.630446][ T46] usb 2-1: device descriptor read/8, error -71 [ 41.647605][ T647] 9pnet_fd: Insufficient options for proto=fd [ 41.760367][ T46] usb 2-1: device descriptor read/8, error -71 [ 41.999237][ T46] usb 2-1: new full-speed USB device number 8 using dummy_hcd [ 42.020203][ T46] usb 2-1: device descriptor read/8, error -71 [ 42.150409][ T46] usb 2-1: device descriptor read/8, error -71 [ 42.259274][ T46] usb usb2-port1: unable to enumerate USB device [ 42.349233][ T298] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 42.500388][ T298] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 42.511363][ T298] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 42.521155][ T298] usb 4-1: New USB device found, idVendor=1038, idProduct=12b6, bcdDevice= 0.00 [ 42.530269][ T298] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 42.539925][ T298] usb 4-1: config 0 descriptor?? [ 42.851089][ T312] rust_binder: 575: undelivered TRANSACTION_ERROR: 29201 [ 42.983353][ T298] usbhid 4-1:0.0: can't add hid device: -71 [ 42.999179][ T298] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 43.011351][ T298] usb 4-1: USB disconnect, device number 12 [ 43.022625][ T685] netlink: 88 bytes leftover after parsing attributes in process `syz.3.127'. [ 43.068724][ T688] netlink: 'syz.0.128': attribute type 2 has an invalid length. [ 43.076657][ T688] netlink: 1 bytes leftover after parsing attributes in process `syz.0.128'. [ 43.205835][ T689] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12 [ 43.215239][ T689] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12 [ 43.295239][ T694] syzkaller1: entered promiscuous mode [ 43.300794][ T694] syzkaller1: entered allmulticast mode [ 43.339214][ T312] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 43.364307][ T700] overlayfs: failed to clone lowerpath [ 43.379217][ T298] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 43.388199][ T704] ------------[ cut here ]------------ [ 43.393819][ T704] WARNING: CPU: 0 PID: 704 at mm/page_alloc.c:5285 __alloc_pages_noprof+0x109/0x7e0 [ 43.403499][ T704] Modules linked in: [ 43.407520][ T704] CPU: 0 UID: 0 PID: 704 Comm: syz.1.133 Not tainted syzkaller #0 1c659cfea3877f078df945e50c8eb7045fd035a9 [ 43.419011][ T704] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 43.429170][ T704] RIP: 0010:__alloc_pages_noprof+0x109/0x7e0 [ 43.435208][ T704] Code: 00 0f 1f 44 00 00 83 fb 0b 72 28 b8 00 20 00 00 23 44 24 40 75 1d 80 3d 54 d8 0b 06 00 0f 85 c2 00 00 00 c6 05 47 d8 0b 06 01 <0f> 0b 31 c0 e9 b4 00 00 00 83 fb 0a 0f 87 a9 00 00 00 44 8b 64 24 [ 43.455791][ T704] RSP: 0018:ffffc9000e9df640 EFLAGS: 00010246 [ 43.462021][ T704] RAX: 0000000000000000 RBX: 0000000000000016 RCX: 0000000000000000 [ 43.470087][ T704] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000e9df6f8 [ 43.478122][ T704] RBP: ffffc9000e9df780 R08: ffffc9000e9df6f7 R09: 0000000000000000 [ 43.486515][ T704] R10: ffffc9000e9df6e0 R11: fffff52001d3bedf R12: ffffc9000e9df680 [ 43.494568][ T704] R13: dffffc0000000000 R14: 1ffff92001d3becc R15: 0000000000000000 [ 43.502616][ T704] FS: 00007fc0dea966c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 43.511610][ T704] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 43.518822][ T704] CR2: 0000200000007000 CR3: 0000000113fe4000 CR4: 00000000003526b0 [ 43.519268][ T312] usb 1-1: Using ep0 maxpacket: 32 [ 43.526869][ T704] Call Trace: [ 43.526881][ T704] [ 43.535509][ T312] usb 1-1: config 3 has an invalid interface number: 72 but max is 0 [ 43.538457][ T704] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 43.547635][ T312] usb 1-1: config 3 contains an unexpected descriptor of type 0x2, skipping [ 43.552364][ T704] ? __kasan_slab_alloc+0x73/0x90 [ 43.561301][ T298] usb 4-1: Using ep0 maxpacket: 8 [ 43.566310][ T704] ? kmem_cache_alloc_noprof+0x1e2/0x410 [ 43.573133][ T312] usb 1-1: config 3 has no interface number 0 [ 43.577174][ T704] ? hashtab_init+0xd6/0x1f0 [ 43.577223][ T704] ___kmalloc_large_node+0x81/0x220 [ 43.586095][ T312] usb 1-1: config 3 interface 72 altsetting 6 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 43.587987][ T704] ? hashtab_init+0xd6/0x1f0 [ 43.588031][ T704] __kmalloc_large_node_noprof+0x1e/0xd0 [ 43.595226][ T312] usb 1-1: config 3 interface 72 altsetting 6 has a duplicate endpoint with address 0xF, skipping [ 43.604180][ T704] ? hashtab_init+0xd6/0x1f0 [ 43.604225][ T704] __kmalloc_noprof+0x326/0x510 [ 43.610287][ T298] usb 4-1: New USB device found, idVendor=1235, idProduct=8002, bcdDevice= 0.40 [ 43.614814][ T704] ? __cfi_ebitmap_read+0x10/0x10 [ 43.625962][ T298] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 43.629914][ T704] hashtab_init+0xd6/0x1f0 [ 43.636619][ T312] usb 1-1: config 3 interface 72 altsetting 6 endpoint 0x7 has invalid maxpacket 512, setting to 64 [ 43.645013][ T704] ? policydb_read+0x865/0x2860 [ 43.650728][ T298] usb 4-1: Product: syz [ 43.658065][ T704] symtab_init+0x44/0x70 [ 43.663964][ T298] usb 4-1: Manufacturer: syz [ 43.673382][ T704] policydb_read+0x8e1/0x2860 [ 43.679376][ T312] usb 1-1: config 3 interface 72 altsetting 6 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 43.682524][ T704] ? __kasan_kmalloc+0x96/0xb0 [ 43.686978][ T312] usb 1-1: config 3 interface 72 altsetting 6 has an invalid descriptor for endpoint zero, skipping [ 43.691403][ T704] ? __cfi_policydb_read+0x10/0x10 [ 43.691435][ T704] ? security_load_policy+0x130/0x12d0 [ 43.697326][ T312] usb 1-1: config 3 interface 72 altsetting 6 has a duplicate endpoint with address 0x4, skipping [ 43.707392][ T704] security_load_policy+0x16a/0x12d0 [ 43.713014][ T298] usb 4-1: SerialNumber: syz [ 43.723030][ T704] ? irqentry_exit+0x4a/0x60 [ 43.736661][ T312] usb 1-1: config 3 interface 72 altsetting 6 endpoint 0xB has invalid maxpacket 1023, setting to 64 [ 43.744448][ T704] ? __kasan_check_write+0x18/0x20 [ 43.744484][ T704] ? mutex_lock+0x97/0x1d0 [ 43.744517][ T704] ? __cfi_security_load_policy+0x10/0x10 [ 43.756725][ T312] usb 1-1: config 3 interface 72 has no altsetting 0 [ 43.759079][ T704] ? rep_movs_alternative+0x4a/0xa0 [ 43.774154][ T312] usb 1-1: New USB device found, idVendor=0c52, idProduct=2413, bcdDevice=96.b8 [ 43.775430][ T704] sel_write_load+0x258/0x600 [ 43.781224][ T312] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 43.785689][ T704] ? __cfi_sel_write_load+0x10/0x10 [ 43.785725][ T704] ? bpf_lsm_file_permission+0xd/0x20 [ 43.793569][ T312] usb 1-1: Product: syz [ 43.797714][ T704] ? __cfi_sel_write_load+0x10/0x10 [ 43.797747][ T704] vfs_write+0x3c4/0xfd0 [ 43.808023][ T312] usb 1-1: Manufacturer: syz [ 43.811556][ T704] ? __cfi_vfs_write+0x10/0x10 [ 43.824822][ T312] usb 1-1: SerialNumber: syz [ 43.825852][ T704] ? __kasan_check_write+0x18/0x20 [ 43.836609][ T688] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 43.841236][ T704] ? mutex_lock+0x97/0x1d0 [ 43.876280][ T704] ? __cfi_mutex_lock+0x10/0x10 [ 43.881232][ T704] ksys_write+0x145/0x260 [ 43.885607][ T704] ? xfd_validate_state+0x68/0x140 [ 43.890834][ T704] ? __cfi_ksys_write+0x10/0x10 [ 43.895736][ T704] ? __secure_computing+0xee/0x2b0 [ 43.900943][ T704] __x64_sys_write+0x7f/0x90 [ 43.905579][ T704] x64_sys_call+0x271c/0x2ee0 [ 43.910324][ T704] do_syscall_64+0x57/0xf0 [ 43.914782][ T704] ? clear_bhb_loop+0x50/0xa0 [ 43.919537][ T704] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 43.925480][ T704] RIP: 0033:0x7fc0ddb9e019 [ 43.929957][ T704] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 43.938208][ T685] capability: warning: `syz.3.127' uses 32-bit capabilities (legacy support in use) [ 43.949651][ T704] RSP: 002b:00007fc0dea96028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 43.949685][ T704] RAX: ffffffffffffffda RBX: 00007fc0dde25fa0 RCX: 00007fc0ddb9e019 [ 43.975569][ T704] RDX: 00000000000070b5 RSI: 0000200000000000 RDI: 0000000000000000 [ 43.983620][ T704] RBP: 00007fc0ddc3500c R08: 0000000000000000 R09: 0000000000000000 [ 43.991517][ T298] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 43.991701][ T704] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 44.006391][ T704] R13: 00007fc0dde26038 R14: 00007fc0dde25fa0 R15: 00007ffcbbb55078 [ 44.008344][ T298] usb 4-1: unit 2 not found! [ 44.014555][ T704] [ 44.022228][ T704] ---[ end trace 0000000000000000 ]--- [ 44.027967][ T704] SELinux: failed to load policy [ 44.034339][ T298] usb 4-1: 6:0: cannot get min/max values for control 2 (id 6) [ 44.053994][ T312] ftdi_sio 1-1:3.72: FTDI USB Serial Device converter detected [ 44.066537][ T312] ftdi_sio ttyUSB0: unknown device type: 0x96b8 [ 44.087923][ T312] usb 1-1: USB disconnect, device number 11 [ 44.103549][ T312] ftdi_sio 1-1:3.72: device disconnected [ 44.110788][ T298] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 44.124431][ T298] usb 4-1: USB disconnect, device number 13 [ 44.155767][ T393] udevd[393]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory