last executing test programs: 5.429267043s ago: executing program 3 (id=173): ioctl$KVM_SET_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee1, &(0x7f0000000140)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000100)=0x4}) r0 = openat$kvm(0xffffff9c, &(0x7f0000000540), 0x8000, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_TSS_ADDR(r1, 0xae47, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="0c0100000001010400000000000000000a0000003c0001802c00018014000300fe800000fc00000000000000000000aa14000400fc0000000000000000000000000000000c00028005000100000000003c0002800c00028005000100000000002c000180140003000000000000000000000000000000000114000400fe8000000000000000000000000000aa08000740000000007800068014000500fc0200000000000000000000000000010c000380060001000000000014000400fc0200000000"], 0x10c}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000680)={0xac, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @empty}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @mcast1}]}]}, 0xac}}, 0x14) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)={0xac, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x400}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}]}, 0xac}}, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x3, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 5.408394794s ago: executing program 3 (id=174): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000000a80)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000ac0), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000b00)=0xcde, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000b40), r0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r1, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000c40)=ANY=[@ANYBLOB="4c00000010000106000000f0ff000000000000000000000000000000000000010b00033264756d6d7930000008001f0004000000180012000a00010064756d6d79"], 0x4c}], 0x1, 0x0, 0x0, 0x4040001}, 0x0) 5.383188367s ago: executing program 3 (id=175): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)="50000000320005f54500000000000000000000003c00010038000100090001006761637400000015280002801800020000000000000000000000002cae85560d4b5f536009c202cf0000000000000000", 0x50}], 0x1}, 0x0) 5.328096083s ago: executing program 3 (id=176): openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000080)={{0xb000, 0x0, 0xf000, 0x0, 0x7, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x1, 0xddccb000, 0xa, 0x0, 0x0, 0x7, 0x10, 0x0, 0x0, 0x1}, {0x41000, 0xdddd8000, 0x18, 0x8, 0x0, 0x4, 0x81, 0x0, 0x80, 0xe, 0x4, 0x6}, {0x10b002, 0x2000, 0xc, 0xfd, 0x80, 0x0, 0x3}, {0x1000, 0x0, 0xd, 0x0, 0x70, 0x80, 0x0, 0x0, 0xfd, 0x1c, 0x7, 0xa8}, {0x100026fff, 0x3000, 0x0, 0x4, 0x0, 0x8f, 0x0, 0x0, 0x6, 0xfc, 0x86, 0xfe}, {0xeeee8000, 0xe000, 0x0, 0x0, 0x5, 0x0, 0x0, 0x80, 0x2, 0x4}, {0x28000, 0x41000, 0x3, 0x1, 0x0, 0x10, 0x4, 0xe}, {0x100000}, {0x1, 0xfffe}, 0x80040010, 0x0, 0x0, 0x10, 0x1000000000000001, 0x0, 0x900, [0x0, 0x0, 0x0, 0x5]}) r3 = eventfd(0x9) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f0000000000)={0x4, r3, 0x1}) 5.271311328s ago: executing program 3 (id=177): r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x50, &(0x7f0000002380)={{{@in6=@remote, @in6=@private0}}, {{@in=@initdev}, 0x0, @in=@loopback}}, &(0x7f0000002480)=0xe8) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f00000022c0)=[{&(0x7f00000024c0)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000002340)={0x3, &(0x7f0000002300)=[{0x8, 0xc1, 0x0, 0x400}, {0x7, 0x4, 0x5, 0x5b}, {0x5, 0x3, 0x2, 0xffff}]}) modify_ldt$write(0x1, &(0x7f0000000180)={0x404, 0x20001000, 0x400, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1}, 0x10) modify_ldt$write(0x1, &(0x7f0000002280)={0x476, 0x20000800, 0x1000, 0x0, 0x1, 0x0, 0x1}, 0x10) ioctl$KVM_SET_CPUID2(r4, 0x4008ae90, &(0x7f0000000140)={0x1, 0x0, [{0x1, 0x3, 0x0, 0x0, 0x0, 0x20}]}) ioctl$KVM_SET_NESTED_STATE(r4, 0x4080aebf, &(0x7f0000000200)=@vmx={0x0, 0x0, 0x2080, {0x1000, 0xffffffffffffffff}, {'\x00', "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ebffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100"}}) syz_usb_connect(0x3, 0x32, &(0x7f00000022c0)=ANY=[], 0x0) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) faccessat2(r5, &(0x7f00000000c0)='\x00', 0x2, 0x1000) syz_usb_connect$uac2(0x4, 0x9a, &(0x7f0000000000)=ANY=[@ANYBLOB="12010102000000200c201810400001020301090288000301018008080b0001010c200609040000000101200009240103000428000408240a05004000020c24030207030503050303001424060305", @ANYRES16=r3], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0}) 5.137330262s ago: executing program 2 (id=179): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x8840, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)={0x0, 0xffffffff, 0x1, 0x8, 0xa, "ff00f70000e5020052c4f21c7f000000002000"}) (async) r1 = syz_open_pts(r0, 0x141601) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x1, 0x3032, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg$unix(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000180)=""/179, 0x33fe0}], 0x1}, 0x0) (async) sendmsg$inet(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)='>', 0x33fe0}], 0x1}, 0x0) (async) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) (async) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000280)={0x7, 0x544, 0x0, 0x7fff, 0x0, "4b002eace7012d93"}) 4.334447405s ago: executing program 2 (id=187): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) r2 = ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, r2, 0x300000b, 0x11, r1, 0x0) ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f0000000000)={[0x1, 0x0, 0x0, 0x7, 0x8000004, 0x0, 0x106c, 0x14, 0x5, 0x880000004000084, 0x9, 0x1, 0x2, 0xffffffffffffffff, 0x0, 0x6], 0x1dffa, 0x3c4210}) ioctl$KVM_RUN(r1, 0xae80, 0x0) 4.277377731s ago: executing program 2 (id=188): mkdir(&(0x7f0000000080)='./sys_mount\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys_mount\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) recvfrom(r0, &(0x7f00000000c0)=""/38, 0x26, 0x1, &(0x7f00000001c0)=@phonet={0x23, 0xfb, 0x0, 0x4}, 0x80) r1 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mount/block/loop0/queue/rotational\x00', &(0x7f0000000040)={0x200002, 0x100, 0xd}, 0x18) r2 = openat(r1, &(0x7f0000000180)='./sys_mount/block/loop0/queue/rotational\x00', 0x180, 0x0) write(r2, &(0x7f0000004b00)="fbac1313", 0x4) 3.468308014s ago: executing program 2 (id=191): r0 = syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000080)={0x24, 0x0, 0x0, &(0x7f0000000300)={0x0, 0x22, 0x1c, {[@global=@item_012={0x1, 0x1, 0x5, "01"}, @global=@item_012={0x1, 0x1, 0x1, "c0"}, @global=@item_4={0x3, 0x1, 0xa, "b30e89a6"}, @local=@item_4={0x3, 0x2, 0xa, "bcd27ca4"}, @main=@item_4={0x3, 0x0, 0x8, "223b54cc"}, @local=@item_012={0x1, 0x2, 0x3, "01"}, @main=@item_4={0x3, 0x0, 0xc, "3b61e549"}, @main=@item_012={0x1, 0x0, 0xe3e59cb50fc2fc28, "ac"}]}}, 0x0}, 0x0) 2.905222802s ago: executing program 2 (id=197): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f00000000c0)={0x0, 0x0, 0x10001, 0x5}) r1 = syz_create_resource$futex(&(0x7f0000000100)=0x1) r2 = syz_create_resource$futex(&(0x7f0000000140)=0x1) futex(r2, 0xb, 0x1, 0x0, r1, 0x403) futex(r1, 0x6, 0x0, 0x0, r1, 0x1) futex(r2, 0xc, 0x1, 0x0, r1, 0x1) futex_waitv(&(0x7f0000001240)=[{0x5, &(0x7f0000000e00)=0x8, 0x2}, {0x9, &(0x7f0000000e40)=0x9, 0x2}, {0x693, &(0x7f0000000e80)=0x80, 0x82}, {0x4, &(0x7f0000000ec0)=0x5, 0x82}, {0x2, &(0x7f0000000f00)=0x490b, 0x80}, {0x8, &(0x7f0000000f40), 0x82}, {0xffff, &(0x7f0000000f80)=0x8, 0x82}, {0x5, &(0x7f0000000fc0)=0x8, 0x2}, {0x0, &(0x7f0000001000)=0x3, 0x82}, {0x0, &(0x7f0000001040)=0x9, 0x2}, {0x8, &(0x7f0000001080)=0x4, 0x2}, {0xfffffffffffffff3, &(0x7f00000010c0)=0x9, 0x82}, {0xffff, &(0x7f0000001100)=0x400, 0x2}, {0x2, &(0x7f0000001140)=0x7f, 0x82}, {0x6, &(0x7f0000001180)=0x8000000000000000, 0x82}, {0x4, &(0x7f00000011c0)=0x7fffffff, 0x2}, {0x1, &(0x7f0000001200)=0xffffffffffffffc0, 0x2}], 0x11, 0x0, &(0x7f0000001400), 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0), 0x0) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440), 0xffffffffffffffff) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r5, 0x107, 0xa, &(0x7f0000000480)=0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000004c0)={'batadv_slave_0\x00', 0x0}) bind$packet(r5, &(0x7f0000000500)={0x11, 0x0, r6, 0x1, 0xf7, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000580)=0x14) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r8 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r8, 0x0, 0x2e, &(0x7f0000001440)={0x4, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @local}}}, 0x108) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000640)={'syztnl1\x00', &(0x7f00000005c0)={'syztnl0\x00', 0x0, 0x0, 0x6, 0xf1, 0x0, 0x20, @empty, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x8, 0x10, 0x1, 0x7}}) sendmsg$ETHTOOL_MSG_EEE_SET(r3, &(0x7f0000000dc0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000d80)={&(0x7f0000000680)=ANY=[@ANYBLOB="dc060000", @ANYRES16=r4, @ANYBLOB="000129bd7000ffdbdf2518000000f402028058000380240001800400030007000200245d000009000200636f6d6d00000000080001000300000030000180040003000400030008000100ffff000008000100050000000e0002004e4c424c5f4d474d540000000400030068000380080001800400030008000180040003002000018008000100b16b0000080001007bfdffff060002007d000000040003001c0001800400030004000300070002002b400000040003000400030008000180040003001000018005000200000000000400030028000380240001800800010005000000080001007bd7000008000100010000000800010006000000d6000500f3d04f45c975b939af0bb291b268cba10486ff8fac5f4ee7399ad09c9dbb3edf074a3b25b886bd2fe80c7d566515f76fb2b65c2e0aa678c93959842daf46561181c53792401d28a40a929a57da60915d453ad95ec470b598fb20e4fc641ab4f05f8c7308862a5a54ee299b7f9cec86ca2bbd40c02a62e93d33c99cae6d3fb8ca0dd23f4f74b54a28fa7f847b9ba227b00a3327c8e7631e45cba4ebf5d945059a396f8bed9bce8a7e952d2e63fc88a841054562d87a3db09a4b3c28c4504c774d45864696c79d04b19a37b5712fc03d3ea8ca000020010380040001802c0001800e0002004e4c424c5f4d474d540000000f0002002624265d2d2521272c2300000800010081ffffff2c0001800400030008000100080000000800010081000000080001000400000009000200636f6d6d00000000100001800400030008000100090000005400018008000100090000000400030005000200000000000400030008000100040000000e0002005b2d7b26242ced7d4000000008000200272a2a0008000100050000000d0002005b5c2b2153293a26000000001c000180080001000000000008000100ffffffff08000100010100000c00018008000100020000003400018008000100020000000800010005000000040003000900020066642f330000000008000100edd80000060002005c00000008000200e6000000040001000400010058030280e9000400b6213eb7c3de8d10bdd41f074eef709e507647a4dff2a4e0fcab78b80f6624619f87430240ad7963c0d626bfab5f460bce92c407835f8d7fe908fb2f799267149119af506e781772025ce567a6dd5b70d9da75a60755be6668d66e70ee613f4c4cd7c747456c1eba0cf7a3c8a62f70f56ce2e67b2e85ed747d86c907a0fe13107263e80934cf3ea989f39376d7de86e4fd4a208f34e11598cc94cae9cf280ec08d6c72ef992bf0330b390349a0130460d26cc4e82a346cc99ec6217d6db2bf842d972588e0ded1ca0f4a9d6dd1a7aa6490d7770551eca21458abe5db33264e178398eb66f9000000b9000500cd466f62bd12f585861fd0ce031c8692491f9e0786d4b945b37599136ccda307de63a65cdbdf70848e01ded76403507c61b25f16082b31a26c9129a162e1fbc3ed1d14e6063be22c3378928d25f3f382bf1f516e51506353b0d91b6ceec3094244c23c4a691377e9bd8e396c77d8d0fcc926b27b68ecdcb6e24b58a40a9038ac3ac4b3630b516e102a8483746f249bbaf6925b99edc304b48fac7f644ff7e4c703ea87e0e669b1509aea14917d664c8ede36efdc0000000004000100cc0003800c0001800400030004000300100001800400030008000100040000005000018008000100feffffff09000200636f6d6d00000000080001000700000004000300080001000600000004000300080001000700000008000100020000000e0002004e4c424c5f4d474d5400000008000180040003003400018004000300080001000300000009000200636f6d6d000000000500020000000000040003000400030008000100000000002000018008000100f9ffffff060002002d00000009000200636f6d6d000000000400010054000500d8fde635454b5b6655d966687f870c38ee39ff4e57f3144195529b72ff1802bf13028793da4bb434bc9260b6da3eed149033a3ed50c014756c846c5da39a2b97beb706bdb51f48963a8f0b4fdda7fe9d770004006fd55407df2a469c76f2f2c5e37b02a7d4fedaf61e079d7eff360609ba9e668ae77e930ebe68e1f7c691d2bb72b826dbd704ada8a318b39da344a7fdd8931e957e16baa063a9e85898347b1073f10aa3f7ab1f7ebb974b8dac6b910a1a7039be5d18d7f9fccc06ed128610f2d6a460d0ce91c7000b0004000a9cc87479a8850064000180080003000200000008000100", @ANYRES32=r6, @ANYBLOB="140002006970766c616e3100000000000000000008000100", @ANYRES32=r7, @ANYBLOB="080003000100000008000300010000001400020076657468305f746d5f626f6e64000000080003000300000008000100", @ANYRES32=r9, @ANYBLOB="080007000080000005000500000000000500060001000000"], 0x6dc}, 0x1, 0x0, 0x0, 0x10}, 0x20008010) timer_settime(r0, 0x1, &(0x7f0000000180)={{}, {0x0, 0x989680}}, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='comm\x00') exit(0x1ff) setns(0xc9, 0x0) r10 = socket$netlink(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(r10, &(0x7f0000001580)={0x0, 0x0, &(0x7f00000015c0)={&(0x7f0000001600)=ANY=[@ANYBLOB="140000001000010300000ae6f72087a003"], 0x3c}}, 0x80) recvmmsg(r10, &(0x7f0000001640)=[{{0x0, 0x0, &(0x7f0000001680)=[{&(0x7f00000016c0)=""/4112, 0x1041}, {&(0x7f0000002700)=""/194, 0xc2}], 0x2}, 0xb}], 0x1, 0x140, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') 2.112972893s ago: executing program 3 (id=207): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000240)=0x7fffffff, 0x4) (async, rerun: 64) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000280)={'batadv_slave_1\x00', 0x0}) (rerun: 64) bind$packet(r0, &(0x7f00000002c0)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xd}}, 0x14) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000300)=@req={0x1000, 0x4, 0x800, 0x8}, 0x10) (async, rerun: 64) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x3, 0x11, r0, 0x0) (async, rerun: 64) write(r0, &(0x7f0000000340)="01", 0x1) (async) r2 = syz_usb_connect$cdc_ncm(0x5, 0x76, &(0x7f00000001c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x64, 0x2, 0x1, 0x0, 0x0, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x6, 0xffff, 0x0, 0xf}, {0x6}, [@mbim_extended={0x8, 0x24, 0x1c, 0x5, 0x2a, 0x9}]}, {{0x9, 0x5, 0x81, 0x3, 0x20}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x7}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) (async) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) (async) syz_usb_control_io(r2, 0x0, &(0x7f0000000b40)={0x84, &(0x7f00000006c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xffffffff7ffffffd]}, 0x0, 0x8) (async) r3 = gettid() (async) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='mounts\x00') ftruncate(r4, 0x7fffffffffffffff) (async) timer_create(0x3, &(0x7f0000000100)={0x0, 0x14, 0x4, @tid=r3}, &(0x7f0000000140)) timer_settime(0x0, 0x236bd4336e4642df, &(0x7f0000000180)={{}, {0x0, 0xe4c}}, 0x0) (async) tkill(r3, 0x12) (async, rerun: 32) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) (async, rerun: 32) syz_usb_control_io$cdc_ncm(r2, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) 2.093155685s ago: executing program 2 (id=208): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xeef, 0x72c4, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x1, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000a00)={0x24, 0x0, 0x0, &(0x7f0000000940)={0x0, 0x22, 0x18, {[@global=@item_012={0x2, 0x1, 0x0, '4B'}, @global=@item_012={0x1, 0x1, 0x1, '\x00'}, @global=@item_012={0x1, 0x1, 0x2, "b4"}, @local=@item_012={0x1, 0x2, 0x7, "04"}, @main=@item_4={0x3, 0x0, 0x0, "f5292ce8"}, @local=@item_4={0x3, 0x2, 0x4, "e5baec3f"}, @local=@item_012={0x0, 0x2, 0x3}, @global=@item_012={0x1, 0x1, 0x8, '\b'}, @global=@item_012={0x1, 0x1, 0x7, "01"}]}}, 0x0}, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000000)={0xffffffffffffffff, 0x8, 0x4d79, 0x7}) sendmsg$nl_xfrm(r1, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)=@newae={0x1b0, 0x1e, 0x800, 0x70bd28, 0x25dfdbfe, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4d4, 0x2, 0x2b}, @in=@dev={0xac, 0x14, 0x14, 0x16}, 0x400, 0x3501}, [@tmpl={0xc4, 0x5, [{{@in6=@loopback, 0x4d6, 0xff}, 0x2, @in=@loopback, 0x3501, 0x1, 0x3, 0xc0, 0x2, 0xfffffff6, 0x3}, {{@in=@multicast2, 0x4d2, 0x2b}, 0x2, @in=@local, 0x3504, 0x3, 0x1, 0xf4, 0x9, 0x1, 0x2}, {{@in=@local, 0x4d4, 0x32}, 0x2, @in=@rand_addr=0x64010100, 0x3507, 0x1, 0x0, 0x7, 0x0, 0x7, 0x1}]}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x5}, @migrate={0x9c, 0x11, [{@in=@empty, @in=@multicast2, @in6=@local, @in6=@remote, 0x3c, 0x1, 0x0, 0x3502, 0xa, 0x2}, {@in=@multicast1, @in6=@local, @in6=@empty, @in=@remote, 0x17, 0x3, 0x0, 0x0, 0x2, 0xa}]}, @iptfs_pkt_size={0x8, 0x29, 0xffffffff}]}, 0x1b0}, 0x1, 0x0, 0x0, 0x200000c0}, 0x8044) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) syz_usb_connect$hid(0x5, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xeef, 0x72c4, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x1, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400}}}}}]}}]}}, 0x0) (async) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) syz_usb_control_io$hid(r0, &(0x7f0000000a00)={0x24, 0x0, 0x0, &(0x7f0000000940)={0x0, 0x22, 0x18, {[@global=@item_012={0x2, 0x1, 0x0, '4B'}, @global=@item_012={0x1, 0x1, 0x1, '\x00'}, @global=@item_012={0x1, 0x1, 0x2, "b4"}, @local=@item_012={0x1, 0x2, 0x7, "04"}, @main=@item_4={0x3, 0x0, 0x0, "f5292ce8"}, @local=@item_4={0x3, 0x2, 0x4, "e5baec3f"}, @local=@item_012={0x0, 0x2, 0x3}, @global=@item_012={0x1, 0x1, 0x8, '\b'}, @global=@item_012={0x1, 0x1, 0x7, "01"}]}}, 0x0}, 0x0) (async) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000000)={0xffffffffffffffff, 0x8, 0x4d79, 0x7}) (async) sendmsg$nl_xfrm(r1, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)=@newae={0x1b0, 0x1e, 0x800, 0x70bd28, 0x25dfdbfe, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4d4, 0x2, 0x2b}, @in=@dev={0xac, 0x14, 0x14, 0x16}, 0x400, 0x3501}, [@tmpl={0xc4, 0x5, [{{@in6=@loopback, 0x4d6, 0xff}, 0x2, @in=@loopback, 0x3501, 0x1, 0x3, 0xc0, 0x2, 0xfffffff6, 0x3}, {{@in=@multicast2, 0x4d2, 0x2b}, 0x2, @in=@local, 0x3504, 0x3, 0x1, 0xf4, 0x9, 0x1, 0x2}, {{@in=@local, 0x4d4, 0x32}, 0x2, @in=@rand_addr=0x64010100, 0x3507, 0x1, 0x0, 0x7, 0x0, 0x7, 0x1}]}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x5}, @migrate={0x9c, 0x11, [{@in=@empty, @in=@multicast2, @in6=@local, @in6=@remote, 0x3c, 0x1, 0x0, 0x3502, 0xa, 0x2}, {@in=@multicast1, @in6=@local, @in6=@empty, @in=@remote, 0x17, 0x3, 0x0, 0x0, 0x2, 0xa}]}, @iptfs_pkt_size={0x8, 0x29, 0xffffffff}]}, 0x1b0}, 0x1, 0x0, 0x0, 0x200000c0}, 0x8044) (async) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) 2.015946963s ago: executing program 0 (id=211): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8801}, 0x8050) (async) cachestat(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = landlock_create_ruleset(&(0x7f0000000100)={0xe020, 0x0, 0x3}, 0x18, 0x0) landlock_restrict_self(r0, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000180), 0x318, 0x0) (async) r3 = socket$netlink(0x10, 0x3, 0x0) (async) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_int(r4, 0x29, 0x35, 0x0, &(0x7f0000000280)) (async) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000080)=0x4, 0x4) r5 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0, 0x0}, &(0x7f0000000040)=0x5) (async) r8 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r8, 0x29, 0x43, &(0x7f00000016c0)=0x5c0d, 0x4) (async) setreuid(r6, 0x0) symlink(&(0x7f0000001180)='./file1\x00', &(0x7f0000001300)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') (async) readlink(&(0x7f0000001400)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000001500)=""/83, 0x53) (async) readlink(&(0x7f0000001580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000001680)=""/59, 0x3b) r9 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$DM_DEV_CREATE(r9, 0xc138fd03, &(0x7f0000000500)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) (async) ioctl$DM_TARGET_MSG(r9, 0xc138fd0e, &(0x7f0000000640)={0x4, 0x0, 0x0, 0x170, 0x138, 0x0, 0x0, 0x800, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, {0x1000, @stats_create={'@stats_create ', '-', 0x20, '/1', ' 1 histogram:10,100,1000'}}}) (async) getsockname$unix(r2, &(0x7f0000001700), &(0x7f0000001780)=0x6e) (async) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r1, 0x4058587a, &(0x7f0000001100)={{r2, &(0x7f0000000f00)='0\x00', 0x400000, &(0x7f00000017c0)={@align=0x10, {0x400, 0x9, 0xc85e, 0x3}}, 0x200, &(0x7f0000000f80), &(0x7f0000000fc0)=0x5}, {[0xab, 0x8, 0x10001, 0x8]}, 0x1ff, 0xd9, &(0x7f0000001000)=""/217}) writev(r10, &(0x7f00000012c0)=[{&(0x7f0000001180)}, {&(0x7f00000011c0)="1100e5ea1c88a2f7fbc16d7a72afc0cc99c0b443", 0x14}, {&(0x7f0000001200)="40b86f7303e162ecc9db7f53ab2eb7ae8c9b9244250999b0c739e46f6fca128579736bf712c995e3a116aa5d5f71ec7e1a184b107e72828e3d61f42a35842b793bd962525d425cc26f6ac18620107a482c048cd14b638f2250459e0e3ddb9b9bb15b117c2cf0f7ac67bd67a83c2b57edb513692f591ec882a43e8dd9f8d1f6852a7952ae3066c729e14c27185a69a071e6ff087c25c75ed0a98c29c8", 0x9c}], 0x3) ioctl$DM_DEV_REMOVE(r9, 0xc138fd04, &(0x7f00000007c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x20000, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}}) (async) r11 = add_key$keyring(&(0x7f0000000480), &(0x7f0000000900)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) add_key(&(0x7f0000000940)='asymmetric\x00', 0x0, &(0x7f0000000980)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db595030000000000000063803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560ef801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c587900020000000000007aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3000000", 0x559, r11) sendmsg$netlink(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)=ANY=[@ANYBLOB="04010000120001000000000000000000f4000000ed00928008003300", @ANYRES32=0x0, @ANYBLOB="41006c80040050800400a88004004880437928b853e7c08502f62f0c86d4d39ac30c002300621bb949000000000400340008003900", @ANYRES32=r6, @ANYBLOB="08001300050000000000000800f800", @ANYRES32=r3, @ANYBLOB="dbb07465ce00ce7f41c05614d6d0993fa4cc230a83e6c323fdaf7b5c58b9712b42f213d3efe3b6f5dc71318d87c5ded9de158021378d666a8a4f1d4bb726fcb15b60ba0d687d5a55b4dca8029a8f02bf5a21b4a5db0c9ef7bc59d593674844a09ee4c64f6bf69bdba5eb1a4bcf00053704417fd4d8fc7d357772049a9950de1434d5b12ff9da3ead7a3db6de891ce8dfe04696d08c0000002aa2896571b4950e71add42e1bb162b2c6a2e514b585c1de206cba0c3b8c0f0c4b11e3322d8c5107655e00b22a4ab7981aa8f84d766a414f1f646a77ab2f8ba1be3389527631a619b80e8a240f3296eab0a03cbb1b0f8e922d"], 0x104}], 0x1}, 0x20000000) (async) pipe2$9p(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80080) write$P9_RSTATu(r12, &(0x7f00000001c0)=ANY=[@ANYBLOB="530000007d020000003d00090209000000020200000008000000000000000000021000f0ffffe7e800006e0100554a0000002400292d0400af264028010026030028405d010021", @ANYRES32=r6, @ANYRES32=r7, @ANYRES32=0x0], 0x53) 2.015746983s ago: executing program 0 (id=212): ioctl$KVM_SET_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee1, &(0x7f0000000140)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000100)=0x4}) r0 = openat$kvm(0xffffff9c, &(0x7f0000000540), 0x8000, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_TSS_ADDR(r1, 0xae47, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="0c0100000001010400000000000000000a0000003c0001802c00018014000300fe8000000020000000000000000000aa14000400fc0000000000000000000000000000000c00028005000100000000003c0002800c00028005000100000000002c000180140003000000000000000000000000000000000114000400fe8000000000000000000000000000aa08000740000000007800068014000500fc0200000000000000000000000000010c000380060001000000000014000400fc0200000000"], 0x10c}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000680)={0xac, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @empty}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @mcast1}]}]}, 0xac}}, 0x14) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)={0xac, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x400}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}]}, 0xac}}, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x3, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.968532668s ago: executing program 0 (id=213): r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000000)="340000001a000100000000000000000002202000000000000000000008000100e0000001080002007f1414bb0800030001f00000", 0x34) 1.957171829s ago: executing program 0 (id=214): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in6=@mcast2, @in=@multicast2, 0xc, 0x2, 0x4e21, 0x2, 0x2d, 0x0, 0x0, 0x1d}, {@in6=@private1, 0xfe, 0x32}, @in=@loopback, {0x0, 0x7, 0xfffffffffffffffd, 0x8, 0x1, 0x9, 0x7fffffff, 0x543}, {0x4, 0x7fffffbfffffffff, 0xe83, 0x8000}, {0x1003}, 0x70bd26, 0x3500, 0xa, 0x4}}, 0xf0}, 0x1, 0x0, 0x0, 0x48010}, 0x48080) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000002c0)={'\x00', 0xffff, 0x401, 0x0, 0x9, 0xc518, 0x0}) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000340)=r1) r2 = syz_io_uring_complete(0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000640), 0x2, 0x0) r3 = syz_genetlink_get_family_id$batadv(&(0x7f00000003c0), 0xffffffffffffffff) clock_adjtime(0x0, &(0x7f0000000500)={0x1000000000d1, 0x8000000000000001, 0x80004001, 0xd6, 0x9c7, 0xfff, 0x100, 0xc5e3, 0x7, 0x8000, 0x3, 0x7, 0xf2e9, 0x8000000000000001, 0x6, 0x2, 0x6, 0x6, 0x81, 0x6, 0x2, 0x4d9, 0x8, 0x200, 0x8005, 0x4}) r4 = syz_open_dev$usbfs(&(0x7f0000000600), 0x76, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r4, 0x802c550a, &(0x7f0000000640)=ANY=[]) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r2, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x54, r3, 0x0, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x40}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x101}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8}]}, 0x54}, 0x1, 0x0, 0x0, 0x8000}, 0x4040000) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="ec00000021000100feffffff000000000000000000000000000000000000000000000000007c0000000000000000000000000000000000001700a00000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000009c00110000000000000000000000000000000000fe8000000000000000000000000000bbac141421000000000000000000000000200100000000000000000000000000000001a800000000000000020000000000000000000000000000000000fe8000000000000000000000000000bb"], 0xec}}, 0x0) socket$packet(0x11, 0x2, 0x300) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in6=@mcast2, @in=@multicast2, 0xc, 0x2, 0x4e21, 0x2, 0x2d, 0x0, 0x0, 0x1d}, {@in6=@private1, 0xfe, 0x32}, @in=@loopback, {0x0, 0x7, 0xfffffffffffffffd, 0x8, 0x1, 0x9, 0x7fffffff, 0x543}, {0x4, 0x7fffffbfffffffff, 0xe83, 0x8000}, {0x1003}, 0x70bd26, 0x3500, 0xa, 0x4}}, 0xf0}, 0x1, 0x0, 0x0, 0x48010}, 0x48080) (async) socket$nl_xfrm(0x10, 0x3, 0x6) (async) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000002c0)={'\x00', 0xffff, 0x401, 0x0, 0x9, 0xc518}) (async) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000340)=r1) (async) syz_io_uring_complete(0x0, 0x0) (async) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000640), 0x2, 0x0) (async) syz_genetlink_get_family_id$batadv(&(0x7f00000003c0), 0xffffffffffffffff) (async) clock_adjtime(0x0, &(0x7f0000000500)={0x1000000000d1, 0x8000000000000001, 0x80004001, 0xd6, 0x9c7, 0xfff, 0x100, 0xc5e3, 0x7, 0x8000, 0x3, 0x7, 0xf2e9, 0x8000000000000001, 0x6, 0x2, 0x6, 0x6, 0x81, 0x6, 0x2, 0x4d9, 0x8, 0x200, 0x8005, 0x4}) (async) syz_open_dev$usbfs(&(0x7f0000000600), 0x76, 0x101301) (async) ioctl$USBDEVFS_FREE_STREAMS(r4, 0x802c550a, &(0x7f0000000640)=ANY=[]) (async) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r2, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x54, r3, 0x0, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x40}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x101}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8}]}, 0x54}, 0x1, 0x0, 0x0, 0x8000}, 0x4040000) (async) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="ec00000021000100feffffff000000000000000000000000000000000000000000000000007c0000000000000000000000000000000000001700a00000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000009c00110000000000000000000000000000000000fe8000000000000000000000000000bbac141421000000000000000000000000200100000000000000000000000000000001a800000000000000020000000000000000000000000000000000fe8000000000000000000000000000bb"], 0xec}}, 0x0) (async) socket$packet(0x11, 0x2, 0x300) (async) 1.872250297s ago: executing program 0 (id=215): r0 = openat$binfmt_format(0xffffff9c, &(0x7f0000000040)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0) syz_usb_connect(0x3, 0x38, &(0x7f0000000480)={{0x12, 0x1, 0x110, 0x91, 0x8, 0x31, 0x20, 0x5ac, 0x1402, 0xe9d2, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x26, 0x2, 0x6, 0xa4, 0x20, 0x1, "", [{{0x9, 0x4, 0xfb, 0x3, 0x1, 0x23, 0x58, 0xd7, 0x4, [@generic={0x2, 0x3b}], [{{0x9, 0x5, 0x9, 0x10, 0x10, 0x3, 0x7, 0x8}}]}}, {{0x9, 0x4, 0x9, 0x8, 0x0, 0x52, 0xef, 0x77, 0x40}}]}}]}}, 0x0) (async) r1 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000c40), 0x2, 0x0) write$selinux_user(r1, 0x0, 0x27) (async) read(r1, 0x0, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="c39203100400341aea0b5f"], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x4050) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000004c0)={'syz0\x00', {0x8, 0x4, 0x6, 0xfffa}, 0x1d, [0x6, 0xc95a, 0xfffffff3, 0x9, 0x7f, 0x4000002, 0x1, 0x7f, 0x6, 0xfffffff7, 0xfffffff2, 0x5f, 0xa, 0x3, 0xffff2d37, 0x1dd2, 0x6, 0x8, 0x0, 0x2, 0x4, 0x5, 0x3, 0x3c5b, 0x1, 0x24, 0xffffffff, 0x100, 0x1f461e2c, 0x1, 0xe661, 0x4, 0x9, 0x3, 0x7fff, 0x4c74, 0x8f01, 0x642, 0x3, 0xa, 0x0, 0x71, 0x7, 0x7, 0x103, 0x0, 0x7, 0x3c, 0x91, 0x6, 0xfffffffd, 0x3, 0x5, 0x4, 0x8, 0x0, 0x82, 0x0, 0x5, 0x6, 0x8, 0x6, 0x1, 0x40], [0x10000003, 0x8, 0x5, 0x8000, 0x0, 0x8, 0x129432e2, 0x40000cb, 0xf6, 0xb, 0xbf, 0x6c9, 0x9, 0xfffffffe, 0x7, 0x1, 0x7, 0x5, 0x2f, 0xe, 0x3, 0x78, 0xea4, 0x73b, 0x4, 0x4000, 0x108000, 0x9, 0x400, 0x3, 0x6, 0xfffffffd, 0xff, 0x1005, 0x7f, 0x5f31, 0x4, 0x0, 0x6, 0x2, 0x9, 0x20000004, 0x100009, 0x6, 0x9, 0x40000006, 0x5, 0x0, 0x0, 0xf, 0xffff, 0x2, 0x7f, 0x9, 0x5, 0x10003, 0x4, 0x1, 0x7, 0xb, 0x9, 0x48c93690, 0x3, 0x9], [0x7, 0x4, 0x0, 0x64e, 0xfffffdfe, 0x7fffffff, 0x40008ce, 0x9, 0x1, 0x5, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x6, 0x7f, 0x5, 0x86, 0x3, 0x10000009, 0x3e7, 0xfff, 0x5, 0x2, 0x2, 0xf, 0x8, 0x4, 0x6d01, 0x5, 0x3b, 0x3, 0x1fd, 0x80, 0x3, 0x4, 0x2, 0x0, 0x4ccf, 0x7, 0x53cf697b, 0x7, 0x6, 0x3, 0xbf, 0x200, 0x3, 0x400002, 0xfffffff9, 0x0, 0x6, 0x5, 0x0, 0x3, 0xfffffffb, 0x120000, 0x3, 0x6, 0x80000009, 0x0, 0x3], [0x9, 0xbb2f, 0x3, 0x7, 0x5, 0x938, 0x6, 0x6, 0xfffffffd, 0x5, 0xce7, 0x1ff, 0x6, 0x8af, 0x5, 0x3, 0x101, 0x10000, 0x6, 0x7fff, 0x8ffff, 0xa620, 0x2, 0x8001, 0x6, 0x7, 0x14c, 0x60a7, 0x6, 0x1, 0xffffffff, 0x7ffffffe, 0x4f, 0x7, 0x0, 0x3, 0x3, 0xffff, 0x3, 0x9, 0xfe, 0x9602, 0xa, 0x97f, 0x1fffffd, 0x1c3880, 0x1, 0x10000, 0x2, 0x8, 0x2b91, 0x4, 0x8, 0x9, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x1, 0xffff3441, 0xfff]}, 0x45c) r4 = socket$netlink(0x10, 0x3, 0x0) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_GET(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000c80)=ANY=[@ANYBLOB="51136e8c2e52a11a", @ANYRES16=r6, @ANYBLOB="01002bbd7000fedbdf250b00000004000580"], 0x18}}, 0x20000000) (async) sendmsg$nl_generic(r4, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000980)={&(0x7f00000009c0)=ANY=[@ANYBLOB="280000001c0021000000000000000000070000001600000002000f000a0002"], 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x50) r7 = syz_open_dev$evdev(&(0x7f00000000c0), 0x25c, 0x280042) ioctl$EVIOCSABS3F(r7, 0x401845ff, &(0x7f0000000200)={0x2, 0x2, 0xfffffffe, 0x9613, 0xfffffadf, 0x40}) r8 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r8, &(0x7f0000000080)={0x2, 0x4e20, @local}, 0x10) (async) r9 = creat(&(0x7f0000000340)='./file0\x00', 0x6a) close(r9) r10 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r10, 0x10f, 0x87, &(0x7f0000000380)={0x41}, 0x10) (async) mount$9p_fd(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000400), 0x200480, &(0x7f0000000b00)=ANY=[@ANYBLOB="747261ff0c43c9afffffff646e6f41951b1a9f4dca2afcdcacef26c72f602ebf296d70e922e6334a12088c165a782e948c128680f3b611169da49a98458a4afe20684411", @ANYRESHEX=r9, @ANYBLOB=',wfdno=', @ANYRESHEX=r10, @ANYBLOB=',\x00']) (async) sendto$inet(r8, &(0x7f00000000c0), 0x0, 0x20008005, &(0x7f0000000100)={0x2, 0x4e24}, 0x10) (async) recvfrom(r8, &(0x7f0000000140)=""/110, 0xfffffffffffffe9a, 0x734, 0x0, 0xfffffffffffffecb) ioctl$sock_SIOCINQ(r8, 0x541b, &(0x7f00000001c0)) pipe(&(0x7f0000000a00)={0xffffffffffffffff}) (async) io_setup(0x3ff, &(0x7f0000000a40)=0x0) io_submit(r12, 0x1ffffe23, &(0x7f0000000a80)=[&(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x5, 0x0, r11, 0x0, 0x5f}]) write$binfmt_format(r0, &(0x7f0000000000)='0\x00', 0x1) 687.580339ms ago: executing program 1 (id=220): socket$packet(0x11, 0x3, 0x300) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/net/ipv4/neigh/lo/unres_qlen\x00', 0x202, 0x2) r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000002700)=[{&(0x7f0000002740)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff08000400000000fffffffe", 0x39}], 0x1) 664.966792ms ago: executing program 1 (id=221): mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x1c0) capset(&(0x7f00000001c0)={0x20080522}, &(0x7f0000000200)={0x200003, 0x200007, 0x801, 0x4, 0x7}) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./bus\x00', 0x180) mount$overlay(0x0, &(0x7f0000000280)='./bus\x00', &(0x7f00000002c0), 0x8, &(0x7f0000000300)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@nfs_export_on}]}) r0 = socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000340), r0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f00000000c0)={@private, @broadcast, 0x0}, &(0x7f0000000100)=0xc) r3 = socket$inet_icmp(0x2, 0x2, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000380)={'vcan0\x00', 0x0}) r5 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r5, &(0x7f00000003c0)="99", 0x1, 0x4000000, &(0x7f0000000400)={0x11, 0x6558, r4, 0x1, 0x7, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xe}}, 0x14) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000000480)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x2a0, r1, 0x200, 0x70bd29, 0x25dfdbfc, {}, [@ETHTOOL_A_STRSET_STRINGSETS={0xb8}, @ETHTOOL_A_STRSET_STRINGSETS={0xd8, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}]}, {0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}]}, {0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}]}, {0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8}]}, {0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x2, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8}]}, {0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8}]}]}, @ETHTOOL_A_STRSET_HEADER={0x0, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x0, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x0, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x0, 0x2, 'veth0_vlan\x00'}]}, @ETHTOOL_A_STRSET_STRINGSETS={0xf8, 0x2, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}]}, {0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8}]}, {0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}]}, {0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x4b, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}]}, {0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}]}, {0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}]}, {0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0xfffffe48, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x9}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}]}]}]}, 0x2a0}, 0x1, 0x0, 0x0, 0x44870}, 0x400d0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) ioprio_set$uid(0x3, 0x0, 0x0) read$FUSE(r0, 0x0, 0x0) 594.932009ms ago: executing program 1 (id=222): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x28, r1, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xe, 0x1, @l2={'eth', 0x3a, 'tunl0\x00'}}]}]}, 0x28}, 0x1, 0x0, 0x22000000, 0x8008080}, 0x0) 594.796859ms ago: executing program 1 (id=223): ioctl$KVM_SET_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee1, &(0x7f0000000140)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000100)=0x4}) r0 = openat$kvm(0xffffff9c, &(0x7f0000000540), 0x8000, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_TSS_ADDR(r1, 0xae47, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="0c0100000001010400000000000000000a0000003c0001802c00018014000300fe8000000021000000000000000000aa14000400fc0000000000000000000000000000000c00028005000100000000003c0002800c00028005000100000000002c000180140003000000000000000000000000000000000114000400fe8000000000000000000000000000aa08000740000000007800068014000500fc0200000000000000000000000000010c000380060001000000000014000400fc0200000000"], 0x10c}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000680)={0xac, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @empty}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @mcast1}]}]}, 0xac}}, 0x14) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)={0xac, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x400}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}]}, 0xac}}, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x3, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 582.39558ms ago: executing program 0 (id=224): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000080)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./dev_mnt\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000000000407d1e5a2d00000000000109022400010000000009040000010301020009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f00000003c0)={0x24, 0x0, 0x0, &(0x7f0000000400)={0x0, 0x22, 0x22, {[@global=@item_012={0x2, 0x1, 0x9, "2313"}, @global=@item_012={0x2, 0x1, 0x0, "e53f"}, @global=@item_4={0x3, 0x1, 0x0, '\f\x00'}, @local=@item_012={0x2, 0x2, 0x2, "9000"}, @global=@item_4={0x3, 0x1, 0x0, "0900be00"}, @main=@item_4={0x3, 0x0, 0x8}, @local=@item_4={0x3, 0x2, 0x0, "09007a15"}, @local=@item_4={0x3, 0x2, 0x0, "5d8c3dda"}]}}, 0x0}, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./dev_mnt/roccatsavu0\x00', 0x2, 0x0) read$FUSE(r2, &(0x7f0000000480)={0x2020}, 0x2020) close_range(r0, 0xffffffffffffffff, 0x0) 485.42819ms ago: executing program 1 (id=225): r0 = syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000080)={0x24, 0x0, 0x0, &(0x7f0000000300)={0x0, 0x22, 0x1c, {[@global=@item_012={0x1, 0x1, 0x5, "01"}, @global=@item_012={0x1, 0x1, 0x1, "c0"}, @global=@item_4={0x3, 0x1, 0xa, "b30e89a6"}, @local=@item_4={0x3, 0x2, 0xa, "bcd27ca4"}, @main=@item_4={0x3, 0x0, 0x8, "223b54cc"}, @local=@item_012={0x1, 0x2, 0x3, "01"}, @main=@item_4={0x3, 0x0, 0xc, "3b61e549"}, @main=@item_012={0x1, 0x0, 0xe3e59cb50fc2fc28, "ac"}]}}, 0x0}, 0x0) 0s ago: executing program 1 (id=226): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000002c0), 0x800, 0x0) ioctl$UI_GET_VERSION(r1, 0x8004552d, &(0x7f0000000280)) write(r0, &(0x7f0000000100)='100', 0x3) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) r2 = fsopen(&(0x7f0000000180)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) fsmount(r2, 0x0, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socket$can_raw(0x1d, 0x3, 0x1) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) syz_ublk_setup_io_uring(0x3, &(0x7f00000003c0)={0x0, 0x4, 0x1000}, 0x0, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x2002, 0x0) socket(0x10, 0x803, 0x5) socket$xdp(0x2c, 0x3, 0x0) sendmsg$inet(r4, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)=ANY=[], 0x128}, 0x0) recvmsg$unix(r3, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x10}}], 0x88}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket(0x1, 0x2, 0x0) openat$kvm(0x0, &(0x7f00000005c0), 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) clock_adjtime(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000680)=@new_dev={0x4, 0x3cd, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f00000006c0)) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r5) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 21.055941][ T36] kauditd_printk_skb: 31 callbacks suppressed [ 21.055959][ T36] audit: type=1400 audit(1793620753.780:59): avc: denied { transition } for pid=274 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 21.060326][ T36] audit: type=1400 audit(1793620753.780:60): avc: denied { noatsecure } for pid=274 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 21.064712][ T36] audit: type=1400 audit(1793620753.790:61): avc: denied { write } for pid=274 comm="sh" path="pipe:[1534]" dev="pipefs" ino=1534 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 21.068152][ T36] audit: type=1400 audit(1793620753.790:62): avc: denied { rlimitinh } for pid=274 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 21.071177][ T36] audit: type=1400 audit(1793620753.790:63): avc: denied { siginh } for pid=274 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.40' (ED25519) to the list of known hosts. [ 29.459945][ T36] audit: type=1400 audit(1793620762.190:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 29.463722][ T286] cgroup: Unknown subsys name 'net' [ 29.482677][ T36] audit: type=1400 audit(1793620762.190:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.510073][ T36] audit: type=1400 audit(1793620762.220:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.510601][ T286] cgroup: Unknown subsys name 'devices' [ 29.631549][ T286] cgroup: Unknown subsys name 'hugetlb' [ 29.637287][ T286] cgroup: Unknown subsys name 'rlimit' [ 29.733252][ T36] audit: type=1400 audit(1793620762.460:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 29.756843][ T36] audit: type=1400 audit(1793620762.460:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 29.782650][ T36] audit: type=1400 audit(1793620762.460:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 29.803361][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 29.814937][ T36] audit: type=1400 audit(1793620762.550:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.840454][ T36] audit: type=1400 audit(1793620762.550:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.858009][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 29.866538][ T36] audit: type=1400 audit(1793620762.580:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.900447][ T36] audit: type=1400 audit(1793620762.580:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.785071][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.792355][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.799591][ T293] bridge_slave_0: entered allmulticast mode [ 30.805942][ T293] bridge_slave_0: entered promiscuous mode [ 30.815631][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.822806][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.830058][ T293] bridge_slave_1: entered allmulticast mode [ 30.836330][ T293] bridge_slave_1: entered promiscuous mode [ 30.850701][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.857783][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.865286][ T295] bridge_slave_0: entered allmulticast mode [ 30.871648][ T295] bridge_slave_0: entered promiscuous mode [ 30.881553][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.888632][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.895771][ T295] bridge_slave_1: entered allmulticast mode [ 30.902140][ T295] bridge_slave_1: entered promiscuous mode [ 30.946363][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.953501][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.960658][ T296] bridge_slave_0: entered allmulticast mode [ 30.966967][ T296] bridge_slave_0: entered promiscuous mode [ 30.976491][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.983617][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.990794][ T296] bridge_slave_1: entered allmulticast mode [ 30.997174][ T296] bridge_slave_1: entered promiscuous mode [ 31.010248][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.017344][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.024512][ T294] bridge_slave_0: entered allmulticast mode [ 31.030858][ T294] bridge_slave_0: entered promiscuous mode [ 31.040360][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.047670][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.054902][ T294] bridge_slave_1: entered allmulticast mode [ 31.061565][ T294] bridge_slave_1: entered promiscuous mode [ 31.201977][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.209100][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.216485][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.223764][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.250161][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.257252][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.264957][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.272038][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.287857][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.295068][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.302405][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.309509][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.321321][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.328417][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.335848][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.342932][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.382851][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.390674][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.398204][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.405796][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.414062][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.421440][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.428691][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.436203][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.449466][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.456546][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.470258][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.477329][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.494631][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.501749][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.520835][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.527934][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.553317][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.560520][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.573957][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.581058][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.588746][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.595848][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.611946][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.619015][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.631147][ T296] veth0_vlan: entered promiscuous mode [ 31.657682][ T296] veth1_macvtap: entered promiscuous mode [ 31.670897][ T293] veth0_vlan: entered promiscuous mode [ 31.702121][ T295] veth0_vlan: entered promiscuous mode [ 31.712476][ T293] veth1_macvtap: entered promiscuous mode [ 31.745797][ T294] veth0_vlan: entered promiscuous mode [ 31.752539][ T295] veth1_macvtap: entered promiscuous mode [ 31.755023][ T296] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 31.805550][ T294] veth1_macvtap: entered promiscuous mode [ 31.819920][ T311] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 32.109195][ T9] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 32.169152][ T45] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 32.249300][ T309] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 32.260461][ T9] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid wMaxPacketSize 0 [ 32.270443][ T9] usb 4-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 32.283466][ T9] usb 4-1: config 0 interface 0 has no altsetting 0 [ 32.290820][ T9] usb 4-1: New USB device found, idVendor=1b1c, idProduct=0a55, bcdDevice= 0.00 [ 32.300131][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.310261][ T9] usb 4-1: config 0 descriptor?? [ 32.340433][ T45] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 32.351733][ T45] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 32.362262][ T45] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 32.371758][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.380999][ T45] usb 2-1: config 0 descriptor?? [ 32.400417][ T309] usb 1-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid wMaxPacketSize 0 [ 32.410270][ T309] usb 1-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 32.423190][ T309] usb 1-1: config 0 interface 0 has no altsetting 0 [ 32.429880][ T309] usb 1-1: New USB device found, idVendor=1b1c, idProduct=0a55, bcdDevice= 0.00 [ 32.438990][ T309] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.448005][ T309] usb 1-1: config 0 descriptor?? [ 32.719605][ T9] hid (null): report_id 0 is invalid [ 32.731485][ T9] hid-generic 0003:1B1C:0A55.0001: report_id 0 is invalid [ 32.738715][ T9] hid-generic 0003:1B1C:0A55.0001: item 0 2 1 8 parsing failed [ 32.746886][ T9] hid-generic 0003:1B1C:0A55.0001: probe with driver hid-generic failed with error -22 [ 32.791309][ T45] savu 0003:1E7D:2D5A.0002: hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.1-1/input0 [ 32.857672][ T309] hid-generic 0003:1B1C:0A55.0003: item fetching failed at offset 21/24 [ 32.866302][ T309] hid-generic 0003:1B1C:0A55.0003: probe with driver hid-generic failed with error -22 [ 32.936660][ T309] usb 4-1: USB disconnect, device number 2 [ 33.045034][ T31] usb 2-1: USB disconnect, device number 2 [ 33.057124][ T324] hid_roccat: roccat device with minor 0 doesn't exist [ 33.071255][ T318] usb 1-1: USB disconnect, device number 2 [ 33.607290][ T350] netlink: 'syz.0.12': attribute type 4 has an invalid length. [ 33.695199][ T365] syz.1.13 uses obsolete (PF_INET,SOCK_PACKET) [ 33.710174][ T352] Zero length message leads to an empty skb [ 33.767927][ T370] netlink: 64 bytes leftover after parsing attributes in process `syz.2.19'. [ 33.785233][ T374] cgroup: none used incorrectly [ 33.809233][ T318] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 33.960438][ T318] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid wMaxPacketSize 0 [ 33.970369][ T318] usb 4-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 33.983805][ T318] usb 4-1: config 0 interface 0 has no altsetting 0 [ 33.990499][ T318] usb 4-1: New USB device found, idVendor=1b1c, idProduct=0a55, bcdDevice= 0.00 [ 33.999671][ T318] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.009575][ T318] usb 4-1: config 0 descriptor?? [ 34.069132][ T31] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 34.220310][ T31] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid wMaxPacketSize 0 [ 34.230186][ T31] usb 2-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 34.243424][ T31] usb 2-1: config 0 interface 0 has no altsetting 0 [ 34.250242][ T31] usb 2-1: New USB device found, idVendor=1b1c, idProduct=0a55, bcdDevice= 0.00 [ 34.259493][ T31] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.268534][ T31] usb 2-1: config 0 descriptor?? [ 34.421104][ T318] hid-generic 0003:1B1C:0A55.0004: collection stack underflow [ 34.429131][ T318] hid-generic 0003:1B1C:0A55.0004: item 0 1 0 12 parsing failed [ 34.437227][ T318] hid-generic 0003:1B1C:0A55.0004: probe with driver hid-generic failed with error -22 [ 34.615148][ T36] kauditd_printk_skb: 79 callbacks suppressed [ 34.615167][ T36] audit: type=1400 audit(1793620767.340:153): avc: denied { setopt } for pid=385 comm="syz.0.24" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 34.660091][ T318] usb 4-1: USB disconnect, device number 3 [ 34.669101][ T36] audit: type=1400 audit(1793620767.340:154): avc: denied { connect } for pid=385 comm="syz.0.24" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 34.690962][ T31] hid-generic 0003:1B1C:0A55.0005: item fetching failed at offset 21/24 [ 34.717929][ T31] hid-generic 0003:1B1C:0A55.0005: probe with driver hid-generic failed with error -22 [ 34.732358][ T36] audit: type=1400 audit(1793620767.430:155): avc: denied { write } for pid=389 comm="syz.0.26" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 34.751946][ T36] audit: type=1400 audit(1793620767.460:156): avc: denied { write } for pid=391 comm="syz.0.27" name="001" dev="devtmpfs" ino=120 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 34.843453][ T36] audit: type=1400 audit(1793620767.570:157): avc: denied { append } for pid=397 comm="syz.2.29" name="001" dev="devtmpfs" ino=114 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 34.866498][ T36] audit: type=1400 audit(1793620767.570:158): avc: denied { create } for pid=397 comm="syz.2.29" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 34.885792][ T36] audit: type=1400 audit(1793620767.570:159): avc: denied { getopt } for pid=397 comm="syz.2.29" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 34.898178][ T318] usb 2-1: USB disconnect, device number 3 [ 34.914820][ T36] audit: type=1400 audit(1793620767.640:160): avc: denied { getopt } for pid=399 comm="syz.2.30" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 34.939339][ T36] audit: type=1400 audit(1793620767.640:161): avc: denied { accept } for pid=399 comm="syz.2.30" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 34.959823][ T36] audit: type=1400 audit(1793620767.660:162): avc: denied { mounton } for pid=399 comm="syz.2.30" path="/10/proc" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=dir permissive=1 [ 34.993212][ T404] netlink: 40 bytes leftover after parsing attributes in process `syz.2.31'. [ 35.039205][ T31] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 35.189149][ T31] usb 1-1: Using ep0 maxpacket: 8 [ 35.197870][ T412] netlink: 64 bytes leftover after parsing attributes in process `syz.3.34'. [ 35.206921][ T31] usb 1-1: config 0 interface 0 altsetting 255 endpoint 0x81 has an invalid bInterval 48, changing to 9 [ 35.221160][ T31] usb 1-1: config 0 interface 0 altsetting 255 endpoint 0x81 has invalid maxpacket 8256, setting to 1024 [ 35.232734][ T31] usb 1-1: config 0 interface 0 has no altsetting 0 [ 35.240289][ T31] usb 1-1: New USB device found, idVendor=046d, idProduct=c125, bcdDevice= 0.e7 [ 35.249671][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 35.258486][ T31] usb 1-1: config 0 descriptor?? [ 35.327086][ T430] overlayfs: missing 'lowerdir' [ 35.345057][ T432] netlink: 8 bytes leftover after parsing attributes in process `syz.2.39'. [ 35.473865][ T395] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 35.482504][ T395] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 35.749164][ T10] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 35.900413][ T10] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid wMaxPacketSize 0 [ 35.910395][ T10] usb 2-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 35.923441][ T10] usb 2-1: config 0 interface 0 has no altsetting 0 [ 35.930396][ T10] usb 2-1: New USB device found, idVendor=1b1c, idProduct=0a55, bcdDevice= 0.00 [ 35.939670][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 35.948414][ T10] usb 2-1: config 0 descriptor?? [ 36.153284][ T445] netlink: 84 bytes leftover after parsing attributes in process `syz.3.44'. [ 36.182780][ T447] netlink: 64 bytes leftover after parsing attributes in process `syz.3.45'. [ 36.564440][ T10] usbhid 2-1:0.0: can't add hid device: -71 [ 36.570573][ T10] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 36.584742][ T10] usb 2-1: USB disconnect, device number 4 [ 36.709138][ T318] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 36.870195][ T318] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 36.889158][ T318] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 36.899265][ T318] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 36.908773][ T318] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.927717][ T318] usb 3-1: config 0 descriptor?? [ 37.282732][ T469] netlink: 84 bytes leftover after parsing attributes in process `syz.1.53'. [ 37.337008][ T318] savu 0003:1E7D:2D5A.0006: hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.2-1/input0 [ 37.464132][ T474] netlink: 64 bytes leftover after parsing attributes in process `syz.1.55'. [ 37.539284][ T318] usb 3-1: USB disconnect, device number 2 [ 37.562371][ T477] netlink: 'syz.1.56': attribute type 4 has an invalid length. [ 37.636204][ T480] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 37.652600][ T480] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 37.757125][ T318] usb 1-1: USB disconnect, device number 3 [ 37.869106][ T31] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 38.029098][ T31] usb 2-1: Using ep0 maxpacket: 32 [ 38.036693][ T31] usb 2-1: unable to get BOS descriptor or descriptor too short [ 38.046688][ T31] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b1, bcdDevice= 0.40 [ 38.056076][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.069142][ T31] usb 2-1: Product: syz [ 38.073819][ T31] usb 2-1: Manufacturer: syz [ 38.087493][ T31] usb 2-1: SerialNumber: syz [ 38.249119][ T318] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 38.297103][ T31] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 38.317183][ T31] usb 2-1: USB disconnect, device number 5 [ 38.364769][ T495] process 'syz.2.63' launched './file1' with NULL argv: empty string added [ 38.410390][ T318] usb 1-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 38.429123][ T318] usb 1-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 38.449146][ T318] usb 1-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 38.469107][ T318] usb 1-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 38.478416][ T318] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 38.812714][ T498] netlink: 84 bytes leftover after parsing attributes in process `syz.1.64'. [ 38.937305][ T503] netlink: 'syz.1.66': attribute type 4 has an invalid length. [ 39.359153][ T10] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 39.399142][ T443] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 39.510137][ T10] usb 3-1: config 0 interface 0 has no altsetting 0 [ 39.516944][ T10] usb 3-1: New USB device found, idVendor=172f, idProduct=0501, bcdDevice= 0.00 [ 39.526520][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.534724][ T9] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 39.543200][ T10] usb 3-1: config 0 descriptor?? [ 39.560284][ T443] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 39.570057][ T443] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 39.581374][ T443] usb 2-1: New USB device found, idVendor=108c, idProduct=0159, bcdDevice= 0.01 [ 39.590575][ T443] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.598615][ T443] usb 2-1: Product: syz [ 39.602894][ T443] usb 2-1: Manufacturer: syz [ 39.607553][ T443] usb 2-1: SerialNumber: syz [ 39.690300][ T9] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid wMaxPacketSize 0 [ 39.700185][ T9] usb 4-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 39.713052][ T9] usb 4-1: config 0 interface 0 has no altsetting 0 [ 39.719791][ T9] usb 4-1: New USB device found, idVendor=1b1c, idProduct=0a55, bcdDevice= 0.00 [ 39.728853][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.737823][ T9] usb 4-1: config 0 descriptor?? [ 39.750606][ T517] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 39.759336][ T517] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 39.873062][ T518] capability: warning: `syz.1.71' uses deprecated v2 capabilities in a way that may be insecure [ 39.884210][ T36] kauditd_printk_skb: 26337 callbacks suppressed [ 39.884255][ T36] audit: type=1400 audit(1793620772.610:26500): avc: denied { write } for pid=513 comm="syz.1.71" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 39.910690][ T36] audit: type=1400 audit(1793620772.610:26501): avc: denied { setopt } for pid=513 comm="syz.1.71" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 39.930945][ T36] audit: type=1400 audit(1793620772.610:26502): avc: denied { create } for pid=513 comm="syz.1.71" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 39.950936][ T36] audit: type=1400 audit(1793620772.610:26503): avc: denied { getopt } for pid=513 comm="syz.1.71" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 39.971477][ T10] hid (null): unknown global tag 0xfd [ 39.980416][ T10] hid (null): global environment stack underflow [ 39.986828][ T10] hid (null): report_id 0 is invalid [ 39.994433][ T10] waltop 0003:172F:0501.0007: unexpected long global item [ 40.001859][ T10] waltop 0003:172F:0501.0007: probe with driver waltop failed with error -22 [ 40.171752][ T9] usbhid 4-1:0.0: can't add hid device: -71 [ 40.178561][ T31] usb 3-1: USB disconnect, device number 3 [ 40.180653][ T9] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 40.200531][ T9] usb 4-1: USB disconnect, device number 4 [ 40.719553][ T526] netlink: 64 bytes leftover after parsing attributes in process `syz.2.75'. [ 41.015477][ T318] aiptek 1-1:17.0: Aiptek using 400 ms programming speed [ 41.029130][ T31] usb 3-1: new full-speed USB device number 4 using dummy_hcd [ 41.034909][ T318] input: Aiptek as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:17.0/input/input4 [ 41.049122][ T36] audit: type=1400 audit(1793620773.780:26504): avc: denied { read } for pid=95 comm="acpid" name="event3" dev="devtmpfs" ino=472 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 41.074624][ T318] usb 1-1: USB disconnect, device number 4 [ 41.081554][ T36] audit: type=1400 audit(1793620773.780:26505): avc: denied { open } for pid=95 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=472 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 41.137278][ T36] audit: type=1400 audit(1793620773.860:26506): avc: denied { create } for pid=536 comm="syz.0.78" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 41.156911][ T36] audit: type=1400 audit(1793620773.870:26507): avc: denied { create } for pid=536 comm="syz.0.78" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 41.177780][ T36] audit: type=1400 audit(1793620773.890:26508): avc: denied { mmap_zero } for pid=536 comm="syz.0.78" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 41.200597][ T531] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 41.211564][ T531] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 41.222076][ T31] usb 3-1: unable to get BOS descriptor or descriptor too short [ 41.232335][ T31] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 41.240071][ T31] usb 3-1: can't read configurations, error -71 [ 41.390957][ T36] audit: type=1400 audit(1793620774.120:26509): avc: denied { create } for pid=545 comm="syz.0.81" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 41.421290][ T550] FAULT_INJECTION: forcing a failure. [ 41.421290][ T550] name failslab, interval 1, probability 0, space 0, times 1 [ 41.434133][ T550] CPU: 0 UID: 0 PID: 550 Comm: syz.0.82 Not tainted syzkaller #0 c6d530d213d6421e3ceaeda0202ca36fa97e3e13 [ 41.434167][ T550] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 41.434191][ T550] Call Trace: [ 41.434198][ T550] [ 41.434207][ T550] __dump_stack+0x21/0x30 [ 41.434234][ T550] dump_stack_lvl+0x140/0x1c0 [ 41.434254][ T550] ? __cfi_dump_stack_lvl+0x10/0x10 [ 41.434275][ T550] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 41.434299][ T550] ? __cfi__raw_spin_lock_irqsave+0x10/0x10 [ 41.434322][ T550] dump_stack+0x19/0x20 [ 41.434361][ T550] should_fail_ex+0x3c2/0x510 [ 41.434396][ T550] should_failslab+0xac/0x100 [ 41.434421][ T550] kmem_cache_alloc_lru_noprof+0x44/0x410 [ 41.434453][ T550] ? __sock_create+0x3a2/0x810 [ 41.434480][ T550] ? __sys_socket+0xe1/0x1c0 [ 41.434496][ T550] ? __d_alloc+0x42/0x8c0 [ 41.434519][ T550] ? expand_files+0xda/0x6f0 [ 41.434535][ T550] __d_alloc+0x42/0x8c0 [ 41.434557][ T550] d_alloc_pseudo+0x23/0xc0 [ 41.434580][ T550] alloc_file_pseudo+0xde/0x1f0 [ 41.434599][ T550] ? __cfi_alloc_file_pseudo+0x10/0x10 [ 41.434618][ T550] ? _raw_spin_unlock+0x45/0x60 [ 41.434666][ T550] sock_alloc_file+0xbe/0x2b0 [ 41.434681][ T550] __sys_socket+0x14c/0x1c0 [ 41.434697][ T550] __x64_sys_socket+0x7e/0x90 [ 41.434713][ T550] x64_sys_call+0x2608/0x2ee0 [ 41.434731][ T550] do_syscall_64+0x57/0xf0 [ 41.434746][ T550] ? clear_bhb_loop+0x50/0xa0 [ 41.434767][ T550] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 41.434788][ T550] RIP: 0033:0x7f58c379fb19 [ 41.434808][ T550] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 41.434821][ T550] RSP: 002b:00007f58c464e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 41.434843][ T550] RAX: ffffffffffffffda RBX: 00007f58c3a25fa0 RCX: 00007f58c379fb19 [ 41.434855][ T550] RDX: 0000000000000006 RSI: 0000000000000003 RDI: 0000000000000010 [ 41.434865][ T550] RBP: 00007f58c3837af8 R08: 0000000000000000 R09: 0000000000000000 [ 41.434875][ T550] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 41.434885][ T550] R13: 00007f58c3a26038 R14: 00007f58c3a25fa0 R15: 00007ffc2bb6fe38 [ 41.434899][ T550] [ 41.684093][ T555] netlink: 'syz.3.84': attribute type 4 has an invalid length. [ 41.719596][ T557] netlink: 8 bytes leftover after parsing attributes in process `syz.0.85'. [ 41.755247][ T563] netlink: 84 bytes leftover after parsing attributes in process `syz.3.88'. [ 41.784399][ T567] netlink: 64 bytes leftover after parsing attributes in process `syz.3.90'. [ 41.818831][ T570] 9pnet_fd: Insufficient options for proto=fd [ 41.941929][ T587] netlink: 'syz.0.96': attribute type 4 has an invalid length. [ 41.961689][ T589] netlink: 8 bytes leftover after parsing attributes in process `syz.3.97'. [ 41.999696][ T596] netlink: 84 bytes leftover after parsing attributes in process `syz.3.100'. [ 42.110889][ T10] usb 2-1: USB disconnect, device number 6 [ 42.138979][ T612] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 42.147743][ T610] netlink: 64 bytes leftover after parsing attributes in process `syz.0.104'. [ 42.152345][ T612] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 42.242976][ T620] netlink: 'syz.0.107': attribute type 4 has an invalid length. [ 42.259155][ T9] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 42.282472][ T626] netlink: 8 bytes leftover after parsing attributes in process `syz.0.109'. [ 42.429119][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 42.436236][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 42.451137][ T9] usb 4-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice= 0.40 [ 42.460414][ T10] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 42.468231][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 42.476722][ T9] usb 4-1: Product: syz [ 42.481012][ T9] usb 4-1: Manufacturer: syz [ 42.485718][ T9] usb 4-1: SerialNumber: syz [ 42.630484][ T10] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 42.641857][ T10] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 42.652275][ T10] usb 2-1: New USB device found, idVendor=04d8, idProduct=c002, bcdDevice= 0.00 [ 42.661703][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 42.908882][ T643] netlink: 64 bytes leftover after parsing attributes in process `syz.0.116'. [ 42.989168][ T318] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 43.076453][ T10] hid-picolcd 0003:04D8:C002.0008: unknown main item tag 0x2 [ 43.086708][ T10] hid-picolcd 0003:04D8:C002.0008: unknown main item tag 0x0 [ 43.094406][ T10] hid-picolcd 0003:04D8:C002.0008: unknown main item tag 0x0 [ 43.102343][ T10] hid-picolcd 0003:04D8:C002.0008: unknown main item tag 0x0 [ 43.105589][ T651] netlink: 'syz.0.119': attribute type 4 has an invalid length. [ 43.111333][ T10] hid-picolcd 0003:04D8:C002.0008: unknown main item tag 0x0 [ 43.125092][ T10] hid-picolcd 0003:04D8:C002.0008: unknown main item tag 0x0 [ 43.132668][ T10] hid-picolcd 0003:04D8:C002.0008: unknown main item tag 0x0 [ 43.140232][ T10] hid-picolcd 0003:04D8:C002.0008: unknown main item tag 0x0 [ 43.147719][ T10] hid-picolcd 0003:04D8:C002.0008: unknown main item tag 0x0 [ 43.155286][ T10] hid-picolcd 0003:04D8:C002.0008: unknown main item tag 0x0 [ 43.162808][ T10] hid-picolcd 0003:04D8:C002.0008: unknown main item tag 0x0 [ 43.172886][ T318] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 43.184161][ T10] hid-picolcd 0003:04D8:C002.0008: unknown main item tag 0x0 [ 43.191659][ T318] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 43.201515][ T10] hid-picolcd 0003:04D8:C002.0008: unknown main item tag 0x0 [ 43.209149][ T318] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 43.218426][ T318] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 43.233199][ T318] usb 3-1: config 0 descriptor?? [ 43.273939][ T9] usb 4-1: __uac_clock_find_source(): recursive clock topology detected, id 0. [ 43.284825][ T10] hid-picolcd 0003:04D8:C002.0008: unsupported KEY_STATE report [ 43.292928][ T10] hid-picolcd 0003:04D8:C002.0008: probe with driver hid-picolcd failed with error -22 [ 43.302928][ T9] usb 4-1: __uac_clock_find_source(): recursive clock topology detected, id 0. [ 43.326185][ T9] usb 4-1: USB disconnect, device number 5 [ 43.535980][ T685] netlink: 'syz.3.130': attribute type 4 has an invalid length. [ 43.564192][ T689] fuse: Bad value for 'fd' [ 43.649321][ T318] savu 0003:1E7D:2D5A.0009: hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.2-1/input0 [ 43.698893][ T766] mmap: syz.0.134 (766) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 43.873212][ T772] __nla_validate_parse: 2 callbacks suppressed [ 43.873227][ T772] netlink: 64 bytes leftover after parsing attributes in process `syz.3.137'. [ 43.899826][ T309] usb 3-1: USB disconnect, device number 6 [ 43.969176][ T318] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 44.119166][ T318] usb 1-1: Using ep0 maxpacket: 8 [ 44.125446][ T318] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 44.136828][ T318] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 44.149821][ T318] usb 1-1: New USB device found, idVendor=05ac, idProduct=029f, bcdDevice= 0.00 [ 44.159265][ T318] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 44.168058][ T318] usb 1-1: config 0 descriptor?? [ 44.219153][ T9] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 44.381059][ T318] apple 0003:05AC:029F.000A: unknown main item tag 0x0 [ 44.388424][ T318] apple 0003:05AC:029F.000A: ignoring exceeding usage max [ 44.396343][ T9] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid wMaxPacketSize 0 [ 44.407411][ T318] apple 0003:05AC:029F.000A: unknown main item tag 0x0 [ 44.414369][ T9] usb 4-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 44.427336][ T318] apple 0003:05AC:029F.000A: unknown main item tag 0x0 [ 44.434339][ T318] apple 0003:05AC:029F.000A: unknown main item tag 0x0 [ 44.441274][ T9] usb 4-1: config 0 interface 0 has no altsetting 0 [ 44.448021][ T9] usb 4-1: New USB device found, idVendor=1b1c, idProduct=0a55, bcdDevice= 0.00 [ 44.458807][ T318] apple 0003:05AC:029F.000A: unknown main item tag 0x0 [ 44.466320][ T318] apple 0003:05AC:029F.000A: unknown main item tag 0x0 [ 44.475184][ T318] apple 0003:05AC:029F.000A: unknown main item tag 0x0 [ 44.482152][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 44.490267][ T318] apple 0003:05AC:029F.000A: unknown main item tag 0x0 [ 44.498247][ T318] apple 0003:05AC:029F.000A: hidraw0: USB HID v0.00 Device [HID 05ac:029f] on usb-dummy_hcd.0-1/input0 [ 44.498446][ T9] usb 4-1: config 0 descriptor?? [ 44.578019][ T309] usb 1-1: USB disconnect, device number 5 [ 44.699219][ T31] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 44.849511][ T31] usb 3-1: Using ep0 maxpacket: 8 [ 44.856258][ T31] usb 3-1: config 0 interface 0 altsetting 255 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 44.867444][ T31] usb 3-1: config 0 interface 0 has no altsetting 0 [ 44.874144][ T31] usb 3-1: New USB device found, idVendor=046d, idProduct=c125, bcdDevice= 0.e7 [ 44.883249][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 44.892178][ T31] usb 3-1: config 0 descriptor?? [ 44.924296][ T9] usbhid 4-1:0.0: can't add hid device: -71 [ 44.930412][ T9] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 44.939519][ T9] usb 4-1: USB disconnect, device number 6 [ 45.102329][ T36] kauditd_printk_skb: 34 callbacks suppressed [ 45.102347][ T36] audit: type=1400 audit(1793620777.830:26544): avc: denied { mount } for pid=779 comm="syz.2.139" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 45.131299][ T36] audit: type=1326 audit(1793620777.830:26545): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=779 comm="syz.2.139" exe="/root/ci2-android-6-12-rust/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f9bf3b9fb19 code=0x0 [ 45.157169][ T31] usb 2-1: USB disconnect, device number 7 [ 45.164836][ T36] audit: type=1400 audit(1793620777.900:26546): avc: denied { unmount } for pid=294 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 45.171951][ T782] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 45.191450][ T36] audit: type=1326 audit(1793620777.900:26547): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=779 comm="syz.2.139" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9bf3b9fb19 code=0x7ffc0000 [ 45.226646][ T36] audit: type=1326 audit(1793620777.900:26548): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=779 comm="syz.2.139" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=133 compat=0 ip=0x7f9bf3b9fb19 code=0x7ffc0000 [ 45.252436][ T36] audit: type=1326 audit(1793620777.900:26549): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=779 comm="syz.2.139" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9bf3b9fb19 code=0x7ffc0000 [ 45.277140][ T784] netlink: 'syz.1.140': attribute type 4 has an invalid length. [ 45.280120][ T36] audit: type=1326 audit(1793620777.900:26550): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=779 comm="syz.2.139" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f9bf3b9fb19 code=0x7ffc0000 [ 45.310590][ T36] audit: type=1326 audit(1793620777.900:26551): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=779 comm="syz.2.139" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9bf3b9fb19 code=0x7ffc0000 [ 45.336123][ T36] audit: type=1326 audit(1793620777.900:26552): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=779 comm="syz.2.139" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=428 compat=0 ip=0x7f9bf3b9fb19 code=0x7ffc0000 [ 45.361705][ T36] audit: type=1326 audit(1793620777.900:26553): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=779 comm="syz.2.139" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9bf3b9fb19 code=0x7ffc0000 [ 45.478116][ T802] netlink: 84 bytes leftover after parsing attributes in process `syz.3.148'. [ 45.505341][ T806] netlink: 8 bytes leftover after parsing attributes in process `syz.3.150'. [ 45.528662][ T809] tmpfs: Unknown parameter 'noinode32' [ 45.579660][ T813] netlink: 64 bytes leftover after parsing attributes in process `syz.0.152'. [ 45.661617][ T816] netlink: 8 bytes leftover after parsing attributes in process `syz.0.153'. [ 45.670565][ T309] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 45.805248][ T822] syz.0.156 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 45.817782][ T823] ./dev/sda1: Can't lookup blockdev [ 45.824197][ T309] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 45.836026][ T309] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 45.852404][ T309] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 45.861693][ T309] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 45.873800][ T309] usb 2-1: config 0 descriptor?? [ 45.957142][ T831] netlink: 144 bytes leftover after parsing attributes in process `syz.3.158'. [ 46.019868][ T832] kernel profiling enabled (shift: 63) [ 46.025388][ T832] profiling shift: 63 too large [ 46.031316][ T831] 9pnet_fd: Insufficient options for proto=fd [ 46.069375][ T838] netlink: 84 bytes leftover after parsing attributes in process `syz.3.160'. [ 46.079974][ T31] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 46.230303][ T31] usb 1-1: config index 0 descriptor too short (expected 23569, got 27) [ 46.239016][ T31] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 16596, setting to 1024 [ 46.251817][ T31] usb 1-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 46.261261][ T31] usb 1-1: New USB device strings: Mfr=5, Product=0, SerialNumber=64 [ 46.269635][ T31] usb 1-1: Manufacturer: syz [ 46.274416][ T31] usb 1-1: SerialNumber: syz [ 46.283432][ T309] savu 0003:1E7D:2D5A.000B: hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.1-1/input0 [ 46.295896][ T31] usb 1-1: config 0 descriptor?? [ 46.512759][ T31] usb 1-1: USB disconnect, device number 6 [ 46.552309][ T9] usb 2-1: USB disconnect, device number 8 [ 47.092597][ T860] tipc: Started in network mode [ 47.097621][ T860] tipc: Node identity ac14140f, cluster identity 4711 [ 47.106565][ T860] tipc: New replicast peer: 255.255.255.255 [ 47.112915][ T860] tipc: Enabled bearer , priority 10 [ 47.176355][ T866] netlink: 84 bytes leftover after parsing attributes in process `syz.0.170'. [ 47.302915][ T876] netlink: 64 bytes leftover after parsing attributes in process `syz.3.173'. [ 47.355155][ T879] netlink: 8 bytes leftover after parsing attributes in process `syz.3.174'. [ 47.491999][ T886] netlink: 'syz.3.177': attribute type 4 has an invalid length. [ 47.519659][ T9] usb 3-1: USB disconnect, device number 7 [ 47.739162][ T31] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 47.869163][ T31] usb 4-1: device descriptor read/64, error -71 [ 48.109227][ T31] usb 4-1: device descriptor read/64, error -71 [ 48.239185][ T9] tipc: Node number set to 2886997007 [ 48.349152][ T31] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 48.379197][ T309] usb 1-1: new full-speed USB device number 7 using dummy_hcd [ 48.479404][ T31] usb 4-1: device descriptor read/64, error -71 [ 48.530036][ T309] usb 1-1: not running at top speed; connect to a high speed hub [ 48.538556][ T309] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 48.548765][ T309] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 48.557787][ T309] usb 1-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 48.566939][ T309] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 48.577169][ T309] usb 1-1: Found UVC 1.00 device (046d:0825) [ 48.584430][ T309] usb 1-1: Failed to create links for entity 1 [ 48.590741][ T309] usb 1-1: Failed to register entities (-22). [ 48.596915][ T309] usb 1-1: No streaming interface found for terminal 2. [ 48.729143][ T31] usb 4-1: device descriptor read/64, error -71 [ 48.787197][ T923] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 48.795811][ T923] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 48.804453][ T9] usb 1-1: USB disconnect, device number 7 [ 48.839317][ T31] usb usb4-port1: attempt power cycle [ 49.179160][ T31] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 49.199266][ T309] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 49.208145][ T31] usb 4-1: device descriptor read/8, error -71 [ 49.327896][ T934] __nla_validate_parse: 2 callbacks suppressed [ 49.327913][ T934] netlink: 84 bytes leftover after parsing attributes in process `syz.0.192'. [ 49.341215][ T31] usb 4-1: device descriptor read/8, error -71 [ 49.349583][ T309] usb 2-1: Using ep0 maxpacket: 16 [ 49.355954][ T309] usb 2-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 49.367217][ T309] usb 2-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 49.377392][ T309] usb 2-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 28 [ 49.390910][ T309] usb 2-1: config 0 interface 0 has no altsetting 0 [ 49.397636][ T309] usb 2-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 49.407054][ T309] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 49.417081][ T309] usb 2-1: config 0 descriptor?? [ 49.439466][ T940] fuse: Bad value for 'user_id' [ 49.444435][ T940] fuse: Bad value for 'user_id' [ 49.531697][ T940] binder: Unknown parameter 'defcontext01777777777777777777777' [ 49.599159][ T31] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 49.620101][ T31] usb 4-1: device descriptor read/8, error -71 [ 49.750607][ T31] usb 4-1: device descriptor read/8, error -71 [ 49.752704][ T940] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input7 [ 49.829885][ T309] hid (null): report_id 0 is invalid [ 49.835462][ T309] hid (null): unknown global tag 0xc [ 49.859289][ T31] usb usb4-port1: unable to enumerate USB device [ 50.029817][ T31] usb 2-1: USB disconnect, device number 9 [ 50.322428][ T958] netlink: 8 bytes leftover after parsing attributes in process `syz.0.198'. [ 50.362511][ T36] kauditd_printk_skb: 30 callbacks suppressed [ 50.362554][ T36] audit: type=1400 audit(1793620783.090:26584): avc: denied { unmount } for pid=961 comm="syz.0.200" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 50.416963][ T964] netlink: 84 bytes leftover after parsing attributes in process `syz.0.201'. [ 50.607561][ T36] audit: type=1400 audit(1793620783.330:26585): avc: denied { map } for pid=976 comm="syz.3.207" path="socket:[10780]" dev="sockfs" ino=10780 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 50.631349][ T36] audit: type=1400 audit(1793620783.330:26586): avc: denied { read } for pid=976 comm="syz.3.207" path="socket:[10780]" dev="sockfs" ino=10780 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 50.682556][ T984] netlink: 'syz.0.209': attribute type 4 has an invalid length. [ 50.716322][ T988] netlink: 152 bytes leftover after parsing attributes in process `syz.0.211'. [ 50.746302][ T995] netlink: 64 bytes leftover after parsing attributes in process `syz.0.212'. [ 50.804615][ T36] audit: type=1400 audit(1793620783.530:26587): avc: denied { ioctl } for pid=999 comm="syz.0.214" path="socket:[10799]" dev="sockfs" ino=10799 ioctlcmd=0x8901 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 50.844672][ T1010] bridge: RTM_NEWNEIGH with invalid ether address [ 50.899192][ T10] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 50.919198][ T9] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 51.049212][ T9] usb 4-1: device descriptor read/64, error -71 [ 51.056635][ T10] usb 3-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 51.067963][ T10] usb 3-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 51.081339][ T10] usb 3-1: config 0 interface 0 has no altsetting 0 [ 51.088232][ T10] usb 3-1: New USB device found, idVendor=0eef, idProduct=72c4, bcdDevice= 0.00 [ 51.089272][ T31] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 51.098183][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 51.114367][ T36] audit: type=1400 audit(1793620783.840:26588): avc: denied { getopt } for pid=1013 comm="syz.1.216" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 51.135306][ T10] usb 3-1: config 0 descriptor?? [ 51.279433][ T31] usb 1-1: Using ep0 maxpacket: 32 [ 51.285886][ T31] usb 1-1: config 6 has an invalid interface number: 251 but max is 1 [ 51.289888][ T9] usb 4-1: device descriptor read/64, error -71 [ 51.294610][ T31] usb 1-1: config 6 has an invalid interface number: 9 but max is 1 [ 51.310029][ T31] usb 1-1: config 6 has no interface number 0 [ 51.316211][ T31] usb 1-1: config 6 has no interface number 1 [ 51.322816][ T31] usb 1-1: config 6 interface 251 has no altsetting 0 [ 51.329641][ T31] usb 1-1: config 6 interface 9 has no altsetting 0 [ 51.338050][ T31] usb 1-1: New USB device found, idVendor=05ac, idProduct=1402, bcdDevice=e9.d2 [ 51.347407][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 51.355661][ T31] usb 1-1: Product: syz [ 51.359906][ T31] usb 1-1: Manufacturer: syz [ 51.365089][ T31] usb 1-1: SerialNumber: syz [ 51.547884][ T9] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 51.557928][ T10] hid-multitouch 0003:0EEF:72C4.000D: unknown main item tag 0x0 [ 51.567077][ T10] hid-multitouch 0003:0EEF:72C4.000D: hidraw0: USB HID v0.00 Device [HID 0eef:72c4] on usb-dummy_hcd.2-1/input0 [ 51.581866][ T31] asix 1-1:6.251: probe with driver asix failed with error -22 [ 51.600144][ T31] asix 1-1:6.9: probe with driver asix failed with error -22 [ 51.611044][ T31] usb 1-1: USB disconnect, device number 8 [ 51.692407][ T9] usb 4-1: device descriptor read/64, error -71 [ 51.773138][ T982] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 51.782395][ T982] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 51.940136][ T9] usb 4-1: device descriptor read/64, error -71 [ 52.055600][ T9] usb usb4-port1: attempt power cycle [ 52.075830][ T1029] netlink: 'syz.1.220': attribute type 4 has an invalid length. [ 52.098406][ T1031] overlayfs: upper fs does not support file handles, falling back to index=off. [ 52.107728][ T1031] overlayfs: NFS export requires "index=on", falling back to nfs_export=off. [ 52.157628][ T1035] netlink: 64 bytes leftover after parsing attributes in process `syz.1.223'. [ 52.404554][ T9] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 52.425079][ T31] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 52.426630][ T9] usb 4-1: device descriptor read/8, error -71 [ 52.570530][ T9] usb 4-1: device descriptor read/8, error -71 [ 52.580798][ T31] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 52.591866][ T31] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 52.601677][ T31] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 52.610823][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 52.619754][ T31] usb 1-1: config 0 descriptor?? [ 52.767276][ T36] audit: type=1400 audit(1793620785.454:26589): avc: denied { create } for pid=1041 comm="syz.1.226" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_nflog_socket permissive=1 [ 52.816631][ T9] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 52.838354][ T9] usb 4-1: device descriptor read/8, error -71 [ 52.972096][ T9] usb 4-1: device descriptor read/8, error -71 [ 53.041773][ T31] savu 0003:1E7D:2D5A.000E: hidraw1: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.0-1/input0 [ 53.084477][ T9] usb usb4-port1: unable to enumerate USB device [ 53.299235][ T31] usb 1-1: USB disconnect, device number 9 [ 53.311876][ T31] ================================================================== [ 53.320011][ T31] BUG: KASAN: slab-use-after-free in roccat_disconnect+0x236/0x240 [ 53.328219][ T31] Read of size 4 at addr ffff8881178d5008 by task kworker/1:0/31 [ 53.335983][ T31] [ 53.338361][ T31] CPU: 1 UID: 0 PID: 31 Comm: kworker/1:0 Not tainted syzkaller #0 c6d530d213d6421e3ceaeda0202ca36fa97e3e13 [ 53.338396][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 53.338409][ T31] Workqueue: usb_hub_wq hub_event [ 53.338431][ T31] Call Trace: [ 53.338438][ T31] [ 53.338445][ T31] __dump_stack+0x21/0x30 [ 53.338462][ T31] dump_stack_lvl+0x140/0x1c0 [ 53.338477][ T31] ? __cfi_dump_stack_lvl+0x10/0x10 [ 53.338493][ T31] print_address_description+0x71/0x210 [ 53.338510][ T31] print_report+0x4a/0x70 [ 53.338523][ T31] kasan_report+0x162/0x1a0 [ 53.338541][ T31] ? roccat_disconnect+0x236/0x240 [ 53.338566][ T31] ? roccat_disconnect+0x236/0x240 [ 53.338589][ T31] __asan_report_load4_noabort+0x18/0x20 [ 53.338612][ T31] roccat_disconnect+0x236/0x240 [ 53.338635][ T31] savu_remove+0xf0/0x170 [ 53.338652][ T31] ? __cfi_savu_remove+0x10/0x10 [ 53.338668][ T31] hid_device_remove+0x293/0x400 [ 53.338691][ T31] ? __cfi_hid_device_remove+0x10/0x10 [ 53.338713][ T31] device_release_driver_internal+0x4ad/0x830 [ 53.338735][ T31] device_release_driver+0x1d/0x30 [ 53.338754][ T31] bus_remove_device+0x34f/0x370 [ 53.338781][ T31] device_del+0x583/0xcf0 [ 53.338799][ T31] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 53.338816][ T31] ? __pm_runtime_resume+0xa0/0xa0 [ 53.338840][ T31] ? __cfi_device_del+0x10/0x10 [ 53.338859][ T31] ? __kasan_check_write+0x18/0x20 [ 53.338883][ T31] ? _raw_spin_lock_irq+0x93/0x120 [ 53.338899][ T31] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 53.338915][ T31] hid_destroy_device+0x6e/0x110 [ 53.338938][ T31] usbhid_disconnect+0xa3/0xc0 [ 53.338957][ T31] usb_unbind_interface+0x2ad/0xa40 [ 53.338977][ T31] ? __cfi_usb_unbind_interface+0x10/0x10 [ 53.339021][ T31] device_release_driver_internal+0x525/0x830 [ 53.339058][ T31] device_release_driver+0x1d/0x30 [ 53.339078][ T31] bus_remove_device+0x34f/0x370 [ 53.339105][ T31] device_del+0x583/0xcf0 [ 53.339123][ T31] ? kfree_const+0x3d/0x50 [ 53.339144][ T31] ? __cfi_device_release+0x10/0x10 [ 53.339167][ T31] ? __cfi_device_del+0x10/0x10 [ 53.339185][ T31] ? kobject_put+0x238/0x2a0 [ 53.339200][ T31] ? device_unregister+0x2b/0x40 [ 53.339220][ T31] usb_disable_device+0x3af/0x770 [ 53.339237][ T31] usb_disconnect+0x331/0x950 [ 53.339253][ T31] hub_event+0x1ad5/0x4360 [ 53.339274][ T31] ? kthread_data+0x54/0xc0 [ 53.339293][ T31] ? psi_task_switch+0x4d7/0x9c0 [ 53.339312][ T31] ? __cfi_hub_event+0x10/0x10 [ 53.339330][ T31] ? kick_pool+0xb9/0x540 [ 53.339375][ T31] process_scheduled_works+0x7f7/0x1060 [ 53.339418][ T31] worker_thread+0xc99/0x13f0 [ 53.339440][ T31] kthread+0x2c7/0x360 [ 53.339461][ T31] ? __cfi_worker_thread+0x10/0x10 [ 53.339480][ T31] ? __cfi_kthread+0x10/0x10 [ 53.339501][ T31] ret_from_fork+0x64/0xa0 [ 53.339517][ T31] ? __cfi_kthread+0x10/0x10 [ 53.339538][ T31] ret_from_fork_asm+0x1a/0x30 [ 53.339558][ T31] [ 53.339563][ T31] [ 53.635743][ T31] Allocated by task 31: [ 53.639945][ T31] kasan_save_track+0x3e/0x80 [ 53.644672][ T31] kasan_save_alloc_info+0x3a/0x50 [ 53.649834][ T31] __kasan_kmalloc+0x96/0xb0 [ 53.654524][ T31] __kmalloc_cache_noprof+0x23c/0x470 [ 53.659916][ T31] roccat_connect+0x6a/0x540 [ 53.664545][ T31] savu_probe+0x1a7/0x3f0 [ 53.668909][ T31] hid_device_probe+0x2ce/0x5f0 [ 53.673790][ T31] really_probe+0x2e1/0x8b0 [ 53.678326][ T31] __driver_probe_device+0x193/0x280 [ 53.683634][ T31] driver_probe_device+0x54/0x3f0 [ 53.688707][ T31] __device_attach_driver+0x2f1/0x4b0 [ 53.694395][ T31] bus_for_each_drv+0x264/0x300 [ 53.699318][ T31] __device_attach+0x2c4/0x3c0 [ 53.704143][ T31] device_initial_probe+0x1e/0x30 [ 53.709225][ T31] bus_probe_device+0x18b/0x270 [ 53.714130][ T31] device_add+0x7fd/0xbf0 [ 53.718489][ T31] hid_add_device+0x3c4/0x5a0 [ 53.723430][ T31] usbhid_probe+0xdca/0x1310 [ 53.728098][ T31] usb_probe_interface+0x6ab/0xbf0 [ 53.733242][ T31] really_probe+0x2e1/0x8b0 [ 53.737822][ T31] __driver_probe_device+0x193/0x280 [ 53.743140][ T31] driver_probe_device+0x54/0x3f0 [ 53.748200][ T31] __device_attach_driver+0x2f1/0x4b0 [ 53.753621][ T31] bus_for_each_drv+0x264/0x300 [ 53.758646][ T31] __device_attach+0x2c4/0x3c0 [ 53.763565][ T31] device_initial_probe+0x1e/0x30 [ 53.768637][ T31] bus_probe_device+0x18b/0x270 [ 53.773537][ T31] device_add+0x7fd/0xbf0 [ 53.777978][ T31] usb_set_configuration+0x1aad/0x2080 [ 53.783460][ T31] usb_generic_driver_probe+0x95/0x160 [ 53.789010][ T31] usb_probe_device+0x1ef/0x3b0 [ 53.793880][ T31] really_probe+0x2e1/0x8b0 [ 53.798411][ T31] __driver_probe_device+0x193/0x280 [ 53.803979][ T31] driver_probe_device+0x54/0x3f0 [ 53.809045][ T31] __device_attach_driver+0x2f1/0x4b0 [ 53.814521][ T31] bus_for_each_drv+0x264/0x300 [ 53.819502][ T31] __device_attach+0x2c4/0x3c0 [ 53.824384][ T31] device_initial_probe+0x1e/0x30 [ 53.829473][ T31] bus_probe_device+0x18b/0x270 [ 53.834412][ T31] device_add+0x7fd/0xbf0 [ 53.838886][ T31] usb_new_device+0x98d/0x1500 [ 53.843699][ T31] hub_event+0x2dbd/0x4360 [ 53.848161][ T31] process_scheduled_works+0x7f7/0x1060 [ 53.853748][ T31] worker_thread+0xc99/0x13f0 [ 53.858479][ T31] kthread+0x2c7/0x360 [ 53.862563][ T31] ret_from_fork+0x64/0xa0 [ 53.866984][ T31] ret_from_fork_asm+0x1a/0x30 [ 53.871781][ T31] [ 53.874107][ T31] Freed by task 1037: [ 53.878086][ T31] kasan_save_track+0x3e/0x80 [ 53.882807][ T31] kasan_save_free_info+0x44/0x50 [ 53.887842][ T31] __kasan_slab_free+0x5f/0x80 [ 53.892623][ T31] kfree+0x158/0x440 [ 53.896531][ T31] roccat_release+0x2c3/0x390 [ 53.901239][ T31] __fput+0x20b/0xa30 [ 53.905246][ T31] ____fput+0x20/0x30 [ 53.909236][ T31] task_work_run+0x1e8/0x260 [ 53.913844][ T31] resume_user_mode_work+0x35/0x50 [ 53.919034][ T31] syscall_exit_to_user_mode+0x63/0xb0 [ 53.924696][ T31] do_syscall_64+0x63/0xf0 [ 53.929135][ T31] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 53.935085][ T31] [ 53.937420][ T31] The buggy address belongs to the object at ffff8881178d5000 [ 53.937420][ T31] which belongs to the cache kmalloc-512 of size 512 [ 53.951483][ T31] The buggy address is located 8 bytes inside of [ 53.951483][ T31] freed 512-byte region [ffff8881178d5000, ffff8881178d5200) [ 53.965394][ T31] [ 53.967727][ T31] The buggy address belongs to the physical page: [ 53.974255][ T31] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1178d4 [ 53.983289][ T31] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 53.991819][ T31] flags: 0x4000000000000040(head|zone=1) [ 53.997490][ T31] page_type: f5(slab) [ 54.001505][ T31] raw: 4000000000000040 ffff888100041c80 dead000000000122 0000000000000000 [ 54.010154][ T31] raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 54.018882][ T31] head: 4000000000000040 ffff888100041c80 dead000000000122 0000000000000000 [ 54.027590][ T31] head: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 54.036540][ T31] head: 4000000000000002 ffffea00045e3501 ffffffffffffffff 0000000000000000 [ 54.045326][ T31] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000 [ 54.054171][ T31] page dumped because: kasan: bad access detected [ 54.060620][ T31] page_owner tracks the page as allocated [ 54.066375][ T31] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 326, tgid 326 (udevd), ts 52171651168, free_ts 52090507592 [ 54.088423][ T31] post_alloc_hook+0x37d/0x3b0 [ 54.093242][ T31] prep_new_page+0x2d/0x180 [ 54.097770][ T31] get_page_from_freelist+0x4aea/0x4ba0 [ 54.103340][ T31] __alloc_pages_noprof+0x35a/0x7e0 [ 54.108589][ T31] alloc_slab_page+0x6b/0x1e0 [ 54.113410][ T31] allocate_slab+0x69/0x430 [ 54.117935][ T31] ___slab_alloc+0x591/0x8c0 [ 54.122573][ T31] __kmalloc_node_track_caller_noprof+0x2e3/0x4f0 [ 54.129106][ T31] kmalloc_reserve+0x144/0x4f0 [ 54.133915][ T31] __alloc_skb+0x13f/0x360 [ 54.138383][ T31] alloc_skb_with_frags+0xd0/0x8b0 [ 54.143534][ T31] sock_alloc_send_pskb+0x883/0x9a0 [ 54.149039][ T31] unix_dgram_sendmsg+0x63a/0x1a90 [ 54.154271][ T31] sock_write_iter+0x442/0x490 [ 54.159074][ T31] vfs_write+0x75f/0xfd0 [ 54.163463][ T31] ksys_write+0x145/0x260 [ 54.167852][ T31] page last free pid 286 tgid 286 stack trace: [ 54.174105][ T31] free_unref_page+0xb99/0xf50 [ 54.179004][ T31] __free_pages+0x6b/0x3b0 [ 54.183439][ T31] __free_slab+0xb2/0x110 [ 54.187786][ T31] free_slab+0x18/0xe0 [ 54.191985][ T31] __put_partials+0x115/0x150 [ 54.196686][ T31] put_cpu_partial+0x91/0xc0 [ 54.201327][ T31] __slab_free+0x1cf/0x2a0 [ 54.205796][ T31] ___cache_free+0xc9/0xe0 [ 54.210258][ T31] qlist_free_all+0xb5/0x130 [ 54.214890][ T31] kasan_quarantine_reduce+0x14f/0x180 [ 54.220377][ T31] __kasan_slab_alloc+0x28/0x90 [ 54.225270][ T31] kmem_cache_alloc_node_noprof+0x1ca/0x420 [ 54.231900][ T31] __alloc_skb+0x10c/0x360 [ 54.236387][ T31] tcp_stream_alloc_skb+0x43/0x370 [ 54.241555][ T31] tcp_sendmsg_locked+0xcbc/0x4ac0 [ 54.246689][ T31] tcp_sendmsg+0x3e/0xd0 [ 54.251011][ T31] [ 54.253363][ T31] Memory state around the buggy address: [ 54.259049][ T31] ffff8881178d4f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 54.267135][ T31] ffff8881178d4f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 54.275218][ T31] >ffff8881178d5000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 54.283382][ T31] ^ [ 54.287729][ T31] ffff8881178d5080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 54.295813][ T31] ffff8881178d5100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 54.303906][ T31] ================================================================== [ 54.318708][ T31] Disabling lock debugging due to kernel taint [ 54.327035][ T309] usb 3-1: USB disconnect, device number 8