last executing test programs: 4.937721269s ago: executing program 0 (id=1): memfd_create(0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000280)={@mcast1, 0x800, 0x0, 0x103, 0x9}, 0x20) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ip6_flowlabel\x00') read$FUSE(r1, &(0x7f0000006200)={0x2020}, 0xffe8) read$FUSE(r1, &(0x7f00000000c0)={0x2020}, 0x2020) 4.891474801s ago: executing program 0 (id=5): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r3, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000900)={0x44, 0x0, &(0x7f00000007c0)=[@reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 4.804791332s ago: executing program 2 (id=6): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) r1 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000540), &(0x7f0000000600)={'syz', 0x2}, 0x0, 0x0, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000000c0)={'fscrypt:', @auto=[0x30, 0x30, 0x36, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) keyctl$read(0xb, r1, &(0x7f0000000740)=""/172, 0xac) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000180)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x32]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000001c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x65, 0x38, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x33]}, &(0x7f0000000840)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x1b}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000200)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x34]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000240)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x35]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000280)={'fscrypt:', @auto=[0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x36]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) syz_usb_disconnect(r0) r2 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_connect$midi(0x0, 0x45, &(0x7f00000001c0)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x8, 0x1430, 0x474b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x33, 0x1, 0x1, 0x8, 0x30, 0xc, "", {{{0x9, 0x4, 0x0, 0x0, 0x2, 0x1, 0x3, 0x20, 0x1, [@ms_header={0x7, 0x24, 0x1, 0x0, 0x7}], [{{0x9, 0x5, 0x8, 0x0, 0x200, 0x92, 0xde, 0x7, {0x4}}}, {{0x9, 0x5, 0xf, 0x76f40b2c72d285e5, 0x400, 0xb, 0x0, 0x4, {0x4}}}]}}}}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000") 4.040833122s ago: executing program 0 (id=11): syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) epoll_create1(0x0) epoll_create1(0x0) socket$key(0xf, 0x3, 0x2) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./debug\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./debug/failslab/times\x00', 0x1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) r1 = syz_ublk_setup_io_uring(0x7501, &(0x7f00000008c0)={0x0, 0xba29, 0x1, 0x2, 0x29c}, 0x0, 0x0, 0x0) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x1ae7, 0x0, 0x2, 0x151, 0x0, r1}, 0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r2) r3 = socket(0x2, 0x3, 0x6) syz_usb_connect$uac1(0x3, 0xdc, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ef915f210070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c2402080001030000eefe000924060506020100000924030003030005490c240206", @ANYRES8=r3, @ANYBLOB='\a'], 0x0) connect$inet6(r0, 0x0, 0x0) 3.947929313s ago: executing program 1 (id=13): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000000480)=""/74, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000400)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x0, 0x1, 0x0, &(0x7f0000000340)=""/185, &(0x7f0000000140)=""/92, 0x4000}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000001500)={@my=0x1}) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001"], 0x64}}, 0x40110) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000200)={0x28, 0x0, 0xffffffff, @my=0x1}, 0x10) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000080)=""/57, 0x0, &(0x7f0000001540)=""/4092}) syz_open_dev$evdev(&(0x7f0000000080), 0x1, 0x40000) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) 3.137520513s ago: executing program 1 (id=14): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000080)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0xc048aeca, &(0x7f00000001c0)) 3.090218164s ago: executing program 1 (id=15): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f00000004c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r1, 0x5b01, 0x0) 2.811964101s ago: executing program 0 (id=16): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0xfffffffc}]}) ioctl$TUNGETVNETLE(r0, 0x40107446, &(0x7f0000000180)) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r2, 0x4004743d, 0x110e22fff6) write$cgroup_type(r2, &(0x7f0000000280), 0x9) 2.797642072s ago: executing program 0 (id=18): ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, 0x0) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d3750820c80a2103be6f000000010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000540)={0x1c, &(0x7f0000000380)={0x40, 0xc}, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 2.739602613s ago: executing program 3 (id=19): syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x2, 0x2}, 0xe) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x50}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r4 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x143802, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0xb522f000) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0xb522f000) ioctl$BLKFLSBUF(r4, 0x1261, &(0x7f0000000080)=0x1) mount$9p_fd(0x0, 0x0, 0x0, 0x2204803, &(0x7f0000000280)) (async) mount$9p_fd(0x0, 0x0, 0x0, 0x2204803, &(0x7f0000000280)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) mount(&(0x7f00000000c0)=@filename='./cgroup\x00', &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='proc\x00', 0x200000, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r5) (async) r6 = dup(r5) syz_ublk_setup_queues(r6, r3, &(0x7f0000000180)={0x0, 0xfffffffe, 0x80, 0xfffffffe, 0x2f8}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5e87, 0x2000, 0x3, 0x3aa, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x800, 0x40000001, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xfffffffd}}], 0x1, 0x0, 0x0) (async) syz_ublk_setup_queues(r6, r3, &(0x7f0000000180)={0x0, 0xfffffffe, 0x80, 0xfffffffe, 0x2f8}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5e87, 0x2000, 0x3, 0x3aa, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x800, 0x40000001, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xfffffffd}}], 0x1, 0x0, 0x0) 2.739464673s ago: executing program 3 (id=20): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x21c0, 0x103) r0 = landlock_create_ruleset(&(0x7f0000000080)={0x8000}, 0x18, 0x0) landlock_restrict_self(r0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x2, 0x0) ioctl$FIDEDUPERANGE(r1, 0xc0189436, 0x0) 2.739286203s ago: executing program 3 (id=21): getrandom(&(0x7f0000000000)=""/289, 0xfffffe23, 0x1) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3000002, 0x4008032, 0xffffffffffffffff, 0x3dbc3000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/59, 0x1204000, 0x800, 0x0, 0x3}, 0x20) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) sendmsg$NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000480)=ANY=[@ANYBLOB="2c010000", @ANYRES16=0x0, @ANYBLOB="00032dbd7000fcdbdf251f0000007c0022801c0000800800050022990000080003000004000008000700070000001c0000800800030006000000080002000b000000080005004e000000340000800800040001000000080001000500000008000400010001000800010000080000080007000600000008000200000000000c00008008000200030000000400cc000400cc00940022801400008008000300e90500000800020008000000440000800800070031ffffff080001007d93000008000200feffffff080001000500000008000700030000000800040002000000080004000200000008000700090000001c0000800800040008000000080007000000000108000700ff7f00001c0000800800a6000002000008000300080000000800060004000000"], 0x12c}, 0x1, 0x0, 0x0, 0x20008000}, 0x4000000) r1 = socket$netlink(0x10, 0x3, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000002780)) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f0000000140)={'filter\x00', 0x7, 0x4, 0x3c0, 0x108, 0x1f0, 0x0, 0x108, 0x2d8, 0x108, 0x4, 0x0, {[{{@uncond, 0xc0, 0x108}, @unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}, {{@uncond, 0xc0, 0xe8, 0x0, {0xa00}}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE2={0x28}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x447) sendmsg$netlink(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000580)=ANY=[@ANYBLOB="3400000013000100000100dffddbdf25070000f61600000008000000", @ANYRES32, @ANYBLOB="14000c80"], 0x34}], 0x1, 0x0, 0x0, 0x4000}, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x3e) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x10) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f00000005c0)={0x4, 0x1, 0x5000, 0x2000, &(0x7f00002ed000/0x2000)=nil}) userfaultfd(0x40000) 2.430428981s ago: executing program 3 (id=22): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x0, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02}) r4 = socket$netlink(0x10, 0x3, 0x0) preadv(r3, &(0x7f00000032c0)=[{&(0x7f0000000400)=""/4, 0x4}], 0x1, 0x0, 0x1) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000080)={'veth1_to_team\x00', 0x3}) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f00000005c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x1058, 0x0, 0x30, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000300)={@flat=@handle={0x73682a85, 0x1, 0x1}, @fd, @fda={0x66646185, 0xc, 0x0, 0x10}}, &(0x7f0000000600)={0x0, 0x18, 0x30}}, 0x40}], 0x0, 0x0, 0x0}) 2.289923393s ago: executing program 3 (id=23): syz_usb_connect$uac1(0x5, 0xa6, &(0x7f0000000280)=ANY=[@ANYBLOB="12011001000000406b1d0101400001020301090294000301080008090400000001010000062401"], 0x0) syz_usb_connect(0x1, 0x36, &(0x7f0000000040)=ANY=[], 0x0) 1.747342547s ago: executing program 2 (id=24): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x1ff) r1 = socket(0xa, 0x1, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f00000001c0)={0x3, {{0xa, 0x4e24, 0x2, @mcast1, 0xff7ffffd}}, {{0xa, 0x4e08, 0x4a3, @local, 0x4f1}}}, 0x108) r2 = socket(0xa, 0x1, 0x0) setsockopt$inet6_group_source_req(r2, 0x29, 0x2a, &(0x7f00000001c0)={0x3, {{0xa, 0x4e24, 0x2, @mcast1, 0xfffffffe}}, {{0xa, 0x4e08, 0x4a3, @private2, 0x4f0}}}, 0x108) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/set_event\x00', 0x121302, 0x0) write$snapshot(r3, &(0x7f00000003c0)="1e8f194d159d122deda87e732f5230186340f285c3bc819ae828b3a3e683e1271659246bb75cec9618213a", 0x2b) r4 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0) pwritev2(r4, &(0x7f0000000240)=[{&(0x7f00000000c0)="2e5960258a252434620b5cffcd89338203901e3516ae706653771b7d169ea34a61b022af988414cd789ff0d50c66f589c761155c3d09251324aed0166ab5c96e2bb59d9b7a29940a914376d0b44ba02aa7ab97e373ec43f568957a6b0ec09561dd6e2a45980a7a7752d8e639b93580", 0x6f}, {&(0x7f0000000140)="3ca401b099a8fc46744b51cf08398bb1fa9404f9c68b0c59aad53698e7b9c4ad8a14984a7aa38d34dcfc1b761c71a81fa14b9e6d078d4d9e802355634331457cab99c269d89809d445c2474af7cda9ea0219010fc423a1060f7f6164e9db178241a67473199c5d763b009617ff791f451f75abb93bcab8feb0166fd7c3e301debe3559da267ee9c64f4608eab0cdd47c336ee194101f776cb9b4ca30be0b1c44ca8e88e5ebd41bbebf11917be604f5137b3686aed185c67b7e13a6f300e1c916c0ff3035065798f00db45a626f65074e6c87ccaed495487a3edfa73d3e3e38122cdfcb90399c58fc586fe26605c99d7892fde722", 0xf4}], 0x2, 0x8, 0xfffffbff, 0x2) unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x0) r5 = open(&(0x7f0000000040)='./cgroup.cpu/cpuset.cpus\x00', 0x121342, 0x0) sendfile(r5, r5, 0x0, 0x3) 1.647228999s ago: executing program 2 (id=25): syz_open_procfs(0x0, &(0x7f0000000000)='net/fib_trie\x00') prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x3, &(0x7f0000000000)=[{0x200000000006, 0x7e, 0x5, 0x7ffc0002}, {0x1, 0x4, 0x2}, {0x6, 0x3, 0x0, 0x800}]}) r0 = timerfd_create(0x5, 0x40000) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, &(0x7f0000000040)) 1.647063399s ago: executing program 2 (id=26): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x80042, 0x4d) pwrite64(r1, &(0x7f0000000140)='2', 0xfe34, 0xe7c) fallocate(r1, 0x0, 0x37e9, 0x2f92) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x40, r3, 0x7, 0x70bd25, 0x25dfdbfd, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_OURS={0xc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}, @ETHTOOL_A_LINKMODES_SPEED={0x8, 0x5, 0x2710}]}, 0x40}, 0x1, 0x0, 0x0, 0x200000c0}, 0x0) sendmsg$ETHTOOL_MSG_EEE_SET(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r3, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@ETHTOOL_A_EEE_ENABLED={0x5, 0x5, 0x1}, @ETHTOOL_A_EEE_TX_LPI_ENABLED={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x4008001}, 0x10) getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f0000000000), &(0x7f0000000400)=0x19) 1.62692962s ago: executing program 2 (id=27): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2840, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f00000001c0)={{0x40000, 0x41000, 0x8, 0x5f, 0x3, 0xe4, 0x40, 0x3, 0x0, 0x20, 0x19}, {0x41000, 0xa000, 0xa, 0x4, 0x40, 0x5, 0x7d, 0xa, 0x58, 0x3, 0xff}, {0xc000, 0x4000, 0xb, 0x5, 0x3, 0x7, 0xfe, 0x89, 0x1, 0xab, 0x5, 0x81}, {0xdddd0000, 0xffff1000, 0x3, 0x40, 0x4, 0x43, 0x9, 0xfa, 0x80, 0x6, 0xe}, {0xdddd0000, 0x1, 0x10, 0x2d, 0x3, 0x7, 0xab, 0x7f, 0x47, 0x83, 0xf9, 0x2}, {0x1000, 0x80a0000, 0x8, 0x7, 0xb5, 0x8, 0x1, 0xd, 0x88, 0xf, 0x1, 0xfd}, {0x54000, 0x2, 0x4, 0x5, 0x7, 0x2, 0x4b, 0x0, 0x5, 0x7e, 0xef, 0x70}, {0xffff1000, 0xb000, 0x10, 0x5, 0xf, 0x7, 0x1, 0x16, 0x2, 0x3, 0xb, 0x9}, {0xb000, 0x2d}, {0x1, 0x3ff}, 0x80000031, 0x0, 0x5000, 0x42024, 0xb, 0x9501, 0x3000, [0x6840000000000002, 0x7, 0x91, 0xff]}) 1.430310055s ago: executing program 2 (id=28): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) ioctl$KDFONTOP_SET(0xffffffffffffffff, 0x4b72, &(0x7f0000000080)={0x4, 0x0, 0x5, 0x0, 0x100, &(0x7f00000000c0)="387ed7626d850509a2d6c1aa38f15cd00f85c263cb226db671261fff7ce9c555f18dafae3530db6dd493f2a3cc88691b9ae21b3e3b4523ae25c1e27d8f62b480c4160b1f90ac9c41fae6ab12ac4c113fef588684ef494c89092883b902a41cd75387ef6f7bc7d460d5e665f398ff95596dc94ec97003c7e6f3c82fbd8de6e11aa4033d61c51caf7a65a2b613bda33f3eaeae635d7cd81761e74c38a7695800a15516eb337056e02335f9a7d10aa2eaf7beb7e1aed6e850ecb3421143c5c4ded0f06affc524dcf3208272619b6a952db5bc96141b2687a3b6f7aadf50bc549974b6401a19cdb130282b955592efa94242065a4c8d695a2cdd9ada350defd58c775b92d348307774d3a256c7520b285d8da0dbf5e20d604413ed2ddf9bcbf881caf811852806175d63892a15234fbcd7a88a2a0aea45d19148f0e7dada7d6d0d7788b8ebfdeaa0284abe90b88dfff412bff40c31c6415c54ae3335e54a49d315851feffe30d999c36def4df7df747695efbd649f42f310859122c0d2c1e558dc6586958a283762386ecf369274e43003a0fdff59ea515eb44521901ef0d00baa91c10a8e44a76aac3468a15bd3d45ad389977467f306f9bcde071b30769795eed2f1580414d168f557cd90040c4bd2a3d6bc5092548feaef7204a12cece59181fcb5bad8c24bd9f8f78d17ab82831325501e80d800f4dd9f45657f8224fc78eb1168fe0527fac33466aadf48f16994d29a47778566e0f3945b2bf36b6eecc7fa18914beb66ac9e519bd333b30d3ce2f50dddeea3447aebbe3bed781e39d5a0fb0cdc60e196f2261305feb596b68986af3eee7b199fefb5f79ffb2d1050e46982af1c14a88dd9000400002f56a8404755c73e74bb90e64bab907d14df8aa9df6f40a80ace2bb8a2aad3b0c66915927db4233181943d88c0c76d5969e2043db5bd77fd60ba0f013139929ccfec960400000085a4d23332ba1f0875e3146afef5b20cc306d3ecee65944fe9829e0ad0c3f6bb2fd81bc31152538db50f47dc38ba908a0d808687e478a609fe0daa02d4e9c618b99266e7f2e98597e2813e1dba9c3c16e9fab3bda6ed33cb1c75513e2264b69d472dd0e1338688ba782b41bde141f99c4894ded98eff9aa53d22eb77c9d93169c04ab2490bf28106f770e07eb7a9e87dde71829f918b98c4cbfcb11a90139264a9ee8081973167f493760278df0cc34be9e8f86f948d9a62e63ad6ca9d2195ff9c6320c85bddc4291507000000000000002195a3d64e04c9ecd1c313c08e29b814bd8fed1ab6d2846c73345962895d289ac77152cac2e0e32b75ce814731c542091f218dd1e68a15d34ca7a819c85e800555db64a717eb23a811356d00"}) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) add_key$fscrypt_v1(0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_connect$midi(0x0, 0x38, &(0x7f00000001c0)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x8, 0x1430, 0x474b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x26, 0x1, 0x1, 0x8, 0x30, 0xc, "", {{{0x9, 0x4, 0x0, 0x0, 0x1, 0x1, 0x3, 0x20, 0x1, [@ms_header={0x7, 0x24, 0x1, 0x0, 0x7}], [{{0x9, 0x5, 0x8, 0x0, 0x200, 0x92, 0xde, 0x7, {0x4}}}]}}}}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000") 1.013793545s ago: executing program 3 (id=29): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000009c0)=ANY=[@ANYBLOB="120100003a982a08cd0ca310a223010203010902120001000000000904"], 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000380)={0x44, &(0x7f00000000c0)=ANY=[@ANYBLOB="400a06"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000240)={0x2c, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x430}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac2(r0, &(0x7f0000000100)={0x14, 0x0, 0x0}, &(0x7f0000000440)={0x44, &(0x7f0000000140)={0x40, 0x8}, 0x0, 0x0, &(0x7f0000000280)={0x20, 0x81, 0x1, "03"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) 71.340318ms ago: executing program 1 (id=30): r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x8020000) open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) 55.771028ms ago: executing program 1 (id=31): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000c80)="91f8a984851bdef38491bbc4173c3c6f357d028feff84ab17c417789f9fc9b8572c98172b7319130feaab952ac4703cad04be6890ee50e997fc26e0000ea4feb931647fc5393de25000000000000000000f4922da20bf1f802970c30f03cc271337e892c99bda9475d51361f8b78938a6a68ba85987219000000eb52c9ff439180b413ec4d4fe130b41d113ce7efb5e9838379c5a554eb896f7808d5904cd8da06fd5159085c9275f49e775e92fb106c2f10442d508891e58a3f117fc203f787901de99a6a1b851ff5c85244beacba25d854577d68ca555e88fc249340ab9bdd8680abbbde02b0307ef45cb7ffffffff984c7bbb7bb3c689ef8daa63ca62e496be091cc1c7d4f371acaaec43337aee38542c35292cf3fdbfc45af8630174371535dbab0b2ec6403658ab3b48a93093de50c743a4f987cc433b546f194f00ba2d1cb675b44bdec6b6955889fcc8cce51ecd73721ad8c044534221e4572f8ab98df38845f0077e10f19314402484b81bc3727426283f803d9c60eb5e9320574a599d763952148fb2bd655e900c850243e43246c70a3b317b0d87a001ce1972a24ba7a5e294243829ead8f34d4d740101685fc8608e", 0x1b4}, {&(0x7f0000000700)="44900001000056ee66c372f3105eb186dd8062fad2d5b5bfb0ba06f274a8d026bd209da8ffa6a26e3b3f8075704a9d0ef9aff7f1e7db24609f02d34e76992c9df9fe6888c6c9a4825c6223be6ac54536025af1dea54e527c68b0ff250261953f2da79a78104c2d9e7b16ed86b124945aa9ab7581ebd385fb61d442035db81e18c2d2462d0bb25fffe4b81ce90b597992b2a4d541611ce77f58dce7c9500118229e7cdf4ca7f6adca92c73d97ce54164c1942b2568635bec8e020b41fb2f8bba4154f0013000000000000000000001c8a9f7956583e26f6f0edc415851d0b8305fe66c2b7c114e3712d87744938848f28a13cb604000000000000000000000000000000c7aa5035897b20a6c23f1fc4af2990c07f6d8a0d18974e26a607febe419d816e57a6ef190303200f389f9e4b5e92d4810a60107f8bb2da65ef951e9cba1c0cef429fff445668c354f96960925ce061dcb59a9cd763d1c9fef144d8acb14145259718968d6a99e63bd0aff1324382589c5398764edb99934e0cd01760e3da892cdc4fadbc6204cc7727aecb332b2453b6b7555db5b9d31b9755346b168e44035701bf014449bba893a8b1732f60048adfbd", 0x1b4}], 0x2}}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000e40)="31fdffffffffffffff74098b2e5e55a1828636f60fbfcfdac56c75f1687f0c562874230300d69f117e766bdbad0c2171ad6227e1173afcb1c420a51a0917861009000000f049c606ccab7cda1f0e3490fbb9de494c9721d9bf80f2f75c3b4bea78e385ea38", 0x65}], 0x1}}], 0x2, 0x2090) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdf8, 0x4) write(r0, &(0x7f0000001e00)="39270725d93c4ab6cb559938ef75d3d7fd5c06a228a59b717b6934bdefb8b8e2dfca955f26b8cab29bdfdce27e4f9cb112fe41e0a6799578f252519cd4a289985be050d209b4c9617cfb94f1bed81696b0c741f6d366efd7ad3dc7cef66647abaf4108076fdffecb7457f5b6b01835a3c79b873f6ebbcb5ee659861a7b4cce43711bbd6b13c941fbb38ef7e1fe0c70fa4aa49b98b43615605d51cc4d742b364a4e7a2f3dee73b86af3fa4ca8f616eaaedcf155820e1767f7d66ecd818ece03f32c3367bbd9ce6656123f394b7f26f1e0420a9ac4cb25638c75fc3c487ba76fd64c26da6d7ce7f1ee8f49d6e9cc95f5c94bf93183ebf8e6be081e0b9f34bd6c2fe5f895dc1cc01e3018cef11ad9e2e1baf35254258efbaf3e8898f561bdb5c4c49f9d3146503df48e194ea3d06396e970ea9fc7c47eb9988477ed1a7e8641dfeea7b57b5a9967c58762574262efde8795f20f2d45e964ede39c7a6502c03f863e6a21a33ba324e6474d4f0495054745f3a80e6554d4d1fd5ddbca11c5e3e6f9087ca1981a14baa3a2956faa8f6b1652e8cf30d7c37a060bc6c836862451c4e76fc9cb221db8d4b449c27aa44564cb33ef144ed0c51bdd66675302692d979297f30e2d9523f85afbbf54c5b5e2261f8b792f83b33cca78c44a5c4e6ff96273979acbb447d49c0502cc9f8991e9bc784a2e978912d8102d867b631d54269936f54bb20ee57e2b4ba4b6c44e767aef24f6c3a8bb5a3b2084d793082e4c5e517694b220e35ac140913e0e55257af03c4dcf376f24773642c14279e2b55906b0b8a4a34fa4d73f37a5feeca1cf93395b998ddcc557d0e2ae112cf1566f7097e7acb6c0bdf9350781341bb83936b355779417839a70c3cbe13e9561b0820df44dbd2a24bd3d6d8b0d9e83983cb7ad8f147f980b06be823e93a93395f5e60b7f31f5aeadc81f02e177446888c15d2845fd675b98360ac2f584a8ab618789499babac77e3311c563fa519a8dbbe49b91a46cc355f8e956c04dfc3b8e218dbe0302ff463fc94eceec7050b7477d9542f6d05d36ee13e664dfc0bb165601e6bd70615f3c299a9c7c7004cc9987a76afc54b3c83e5d23c0790f39593437b2592cf0548f21823f61076340a87dae9d3427acc844357d6bdbba726e7a41eb30a916df698ab241b5e4991f41d34afd2c2b99f259ca582f09c8027c3381e64070aad6ec7f7c7c973d55a33eca3cc4245bf488a497ac966aa13111ec3033172a3512e97700b3b58b621ccb71309d6ccafb05352718a362d14c38501ec45a522fb86563533d1f46e3fc182181ca5583096ec3849fb5db88ba0bcf565ec4665280402275fe98483a6c6b9da4665196aeff9b18c1e4fe3f19f1ff296702a10a27684a6cf0f9c003fd4b20127b080bf82664e51c36a4c4681dd332c6cb068cd11d13dae5f798032ed4237ad618305d0bffb28dac3b13bd148e2d7e8798ce2deb330ec7cdfdc5cddd477f3ffd22b884e91529740da75f625d46b48a6aa4c40adced23638423cdc401bdd228b0590432be970bd3c9c7b2a6ee3dabba57022a222a4b012ef17e0385b92f034fe82ff530fddd4285581275eecee8a722e309654717a604b740ca6dbc00e7c878d6dd35f55413fc7c8cb1fd3beda73c7db9903f9d44c4faf64095a03292fda7cb99bc539914391c4ca199090cd5fd133969265c62ed24a87055dd031a71479489af1fde720611d613ab67cd77d9b0741367da527a4afcc9f7bbe806c0c0e155c5d5f227dc9933bb33b535f241c984bdb7084664329f3185c355d429c41f52ea5532f4e27ac3599939bd6a476e88e857942705607ad7c21", 0x517) 0s ago: executing program 1 (id=32): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0x78b}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)=@x86={0x7, 0xe, 0x2, 0x0, 0x480, 0x6, 0x9, 0x3, 0x5, 0xb, 0xa, 0x1, 0x0, 0xf23, 0x1, 0x2, 0x6, 0xc, 0x40, '\x00', 0x9, 0x1}) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r2, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000000c0)={[0x800, 0x4, 0x81, 0x4, 0x1, 0x0, 0x3, 0x100000012, 0x0, 0x0, 0x0, 0x7, 0x4, 0x2, 0x100000000001], 0x6000, 0x4bb40}) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x6) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000000)=0x2) ioctl$KVM_RUN(r2, 0xae80, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.104' (ED25519) to the list of known hosts. [ 20.964247][ T36] audit: type=1400 audit(1786198899.720:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 20.965384][ T286] cgroup: Unknown subsys name 'net' [ 20.986905][ T36] audit: type=1400 audit(1786198899.720:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.014615][ T36] audit: type=1400 audit(1786198899.750:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.014828][ T286] cgroup: Unknown subsys name 'devices' [ 21.141944][ T286] cgroup: Unknown subsys name 'hugetlb' [ 21.147563][ T286] cgroup: Unknown subsys name 'rlimit' [ 21.260413][ T36] audit: type=1400 audit(1786198900.020:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.283783][ T36] audit: type=1400 audit(1786198900.020:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 21.292814][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 21.308848][ T36] audit: type=1400 audit(1786198900.020:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 21.340356][ T36] audit: type=1400 audit(1786198900.070:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.366045][ T36] audit: type=1400 audit(1786198900.070:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.399525][ T36] audit: type=1400 audit(1786198900.150:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.425162][ T36] audit: type=1400 audit(1786198900.150:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.425398][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.296024][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.303164][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.310368][ T293] bridge_slave_0: entered allmulticast mode [ 22.316558][ T293] bridge_slave_0: entered promiscuous mode [ 22.325223][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.332330][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.339453][ T293] bridge_slave_1: entered allmulticast mode [ 22.345643][ T293] bridge_slave_1: entered promiscuous mode [ 22.420101][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.427170][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.434423][ T295] bridge_slave_0: entered allmulticast mode [ 22.440749][ T295] bridge_slave_0: entered promiscuous mode [ 22.448894][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.456241][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.463377][ T295] bridge_slave_1: entered allmulticast mode [ 22.469614][ T295] bridge_slave_1: entered promiscuous mode [ 22.503007][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.510108][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.517164][ T294] bridge_slave_0: entered allmulticast mode [ 22.523617][ T294] bridge_slave_0: entered promiscuous mode [ 22.530096][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.537130][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.544270][ T294] bridge_slave_1: entered allmulticast mode [ 22.550687][ T294] bridge_slave_1: entered promiscuous mode [ 22.595943][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.603063][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.610174][ T296] bridge_slave_0: entered allmulticast mode [ 22.616364][ T296] bridge_slave_0: entered promiscuous mode [ 22.626206][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.633335][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.640432][ T296] bridge_slave_1: entered allmulticast mode [ 22.646631][ T296] bridge_slave_1: entered promiscuous mode [ 22.743170][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.750248][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.757481][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.764543][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.795095][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.802180][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.809464][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.816567][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.848586][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.855672][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.863001][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.870072][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.881105][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.888166][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.895460][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.902561][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.916335][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.923696][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.931335][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.939353][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.946865][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.954522][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.961900][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.969047][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.992206][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.999264][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.006975][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.014057][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.030124][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.037189][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.044899][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.051958][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.085821][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.092908][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.112406][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.119471][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.132600][ T293] veth0_vlan: entered promiscuous mode [ 23.142557][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.149620][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.161805][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.168860][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.188035][ T295] veth0_vlan: entered promiscuous mode [ 23.202850][ T293] veth1_macvtap: entered promiscuous mode [ 23.239809][ T295] veth1_macvtap: entered promiscuous mode [ 23.247206][ T294] veth0_vlan: entered promiscuous mode [ 23.273026][ T293] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 23.273626][ T296] veth0_vlan: entered promiscuous mode [ 23.298014][ T294] veth1_macvtap: entered promiscuous mode [ 23.320798][ T296] veth1_macvtap: entered promiscuous mode [ 23.348711][ T314] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 23.504982][ T328] rust_binder: 325:328 got reply transaction with no transaction stack [ 23.513649][ T328] rust_binder: 325:328 transaction reply to 0:0 failed EINVAL, code 0 size 0-0 [ 23.790194][ T31] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 23.941321][ T31] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 23.952864][ T31] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 23.962185][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 23.971193][ T31] usb 3-1: config 0 descriptor?? [ 24.169957][ T331] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 24.183677][ T31] usbhid 3-1:0.0: can't add hid device: -71 [ 24.189675][ T31] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 24.199030][ T31] usb 3-1: USB disconnect, device number 2 [ 24.286279][ T9] rust_binder: 325: undelivered TRANSACTION_ERROR: 29201 [ 24.326644][ T347] netlink: 272 bytes leftover after parsing attributes in process `syz.1.12'. [ 24.327449][ T331] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 24.351649][ T331] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 24.363031][ T331] usb 4-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 24.372256][ T331] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 24.380296][ T331] usb 4-1: Product: syz [ 24.384485][ T331] usb 4-1: Manufacturer: syz [ 24.389134][ T331] usb 4-1: SerialNumber: syz [ 24.539981][ T9] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 24.599805][ T331] usblp 4-1:1.0: usblp0: USB Bidirectional printer dev 2 if 0 alt 0 proto 2 vid 0x0711 pid 0x0900 [ 24.629987][ T324] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 24.690377][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 24.696703][ T9] usb 1-1: config index 0 descriptor too short (expected 37359, got 202) [ 24.705290][ T9] usb 1-1: config 33 has too many interfaces: 95, using maximum allowed: 32 [ 24.714416][ T9] usb 1-1: config 33 has an invalid descriptor of length 0, skipping remainder of the config [ 24.724928][ T9] usb 1-1: config 33 has 1 interface, different from the descriptor's value: 95 [ 24.735316][ T9] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 24.744438][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 24.752678][ T9] usb 1-1: Product: syz [ 24.756859][ T9] usb 1-1: Manufacturer: syz [ 24.761789][ T9] usb 1-1: SerialNumber: syz [ 24.791105][ T324] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 24.802421][ T324] usb 3-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 24.812492][ T324] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 24.821392][ T324] usb 3-1: config 0 descriptor?? [ 24.969412][ T9] usb 1-1: 0:2 : does not exist [ 24.976478][ T9] usb 1-1: 5:0: failed to get current value for ch 0 (-22) [ 24.989169][ T9] usb 1-1: USB disconnect, device number 2 [ 25.002137][ T317] udevd[317]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:33.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 25.018545][ T352] usb 4-1: USB disconnect, device number 2 [ 25.027158][ T352] usblp0: removed [ 25.432257][ T330] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 25.440835][ T330] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 25.489990][ T352] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 25.651228][ T324] aiptek 3-1:0.0: Aiptek using 400 ms programming speed [ 25.658302][ T352] usb 2-1: Using ep0 maxpacket: 8 [ 25.671280][ T324] input: Aiptek as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input4 [ 25.689098][ T352] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 25.699999][ T352] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 25.728292][ T352] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 25.743094][ T352] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 25.755538][ T352] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 25.769260][ T352] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 25.769563][ T371] x_tables: unsorted underflow at hook 2 [ 25.778417][ T352] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.792159][ T9] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 25.802983][ T371] netlink: 'syz.3.21': attribute type 6 has an invalid length. [ 25.810906][ T371] netlink: 8 bytes leftover after parsing attributes in process `syz.3.21'. [ 25.970004][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 25.976506][ T9] usb 1-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 25.985743][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.994411][ T9] usb 1-1: config 0 descriptor?? [ 26.066683][ T9] usb 3-1: USB disconnect, device number 3 [ 26.066714][ C0] aiptek 3-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 26.290029][ T343] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 26.441003][ T343] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 26.451131][ T343] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 26.461436][ T343] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 26.470610][ T343] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.478627][ T343] usb 4-1: Product: syz [ 26.482912][ T343] usb 4-1: Manufacturer: syz [ 26.487518][ T343] usb 4-1: SerialNumber: syz [ 26.592145][ T36] kauditd_printk_skb: 81 callbacks suppressed [ 26.592164][ T36] audit: type=1400 audit(1786198905.350:155): avc: denied { mount } for pid=380 comm="syz.2.24" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 26.620404][ T36] audit: type=1400 audit(1786198905.350:156): avc: denied { search } for pid=380 comm="syz.2.24" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 26.641988][ T36] audit: type=1400 audit(1786198905.350:157): avc: denied { read write } for pid=380 comm="syz.2.24" name="set_event" dev="tracefs" ino=30 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 26.664716][ T36] audit: type=1400 audit(1786198905.350:158): avc: denied { open } for pid=380 comm="syz.2.24" path="/2/trace/set_event" dev="tracefs" ino=30 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 26.688276][ T36] audit: type=1400 audit(1786198905.380:159): avc: denied { unmount } for pid=295 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 26.710682][ T377] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 26.721599][ T377] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 26.729452][ T36] audit: type=1400 audit(1786198905.400:160): avc: denied { write } for pid=382 comm="syz.2.25" name="fib_trie" dev="proc" ino=4026532487 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 26.753997][ T36] audit: type=1326 audit(1786198905.400:161): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=382 comm="syz.2.25" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf3539e0d9 code=0x7ffc0000 [ 26.780124][ T36] audit: type=1326 audit(1786198905.400:162): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=382 comm="syz.2.25" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf3539e0d9 code=0x7ffc0000 [ 26.805580][ T36] audit: type=1326 audit(1786198905.400:163): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=382 comm="syz.2.25" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=283 compat=0 ip=0x7faf3539e0d9 code=0x7ffc0000 [ 26.832095][ T343] usb 4-1: cannot find UAC_HEADER [ 26.838445][ T36] audit: type=1326 audit(1786198905.400:164): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=382 comm="syz.2.25" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf3539e0d9 code=0x7ffc0000 [ 26.839234][ T343] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 26.874467][ T343] usb 4-1: USB disconnect, device number 3 [ 26.881561][ T317] udevd[317]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 27.150576][ T352] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 27.301289][ T352] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 27.312576][ T352] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 27.321968][ T352] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.331166][ T352] usb 3-1: config 0 descriptor?? [ 27.519992][ T343] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 27.539790][ T352] usbhid 3-1:0.0: can't add hid device: -71 [ 27.545929][ T352] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 27.554719][ T352] usb 3-1: USB disconnect, device number 4 [ 27.669989][ T343] usb 4-1: Using ep0 maxpacket: 8 [ 27.677720][ T343] usb 4-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 27.686880][ T343] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.694905][ T343] usb 4-1: Product: syz [ 27.699087][ T343] usb 4-1: Manufacturer: syz [ 27.703894][ T343] usb 4-1: SerialNumber: syz [ 27.709148][ T343] usb 4-1: config 0 descriptor?? [ 27.979983][ T352] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 28.141156][ T352] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 28.152119][ T352] usb 3-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 28.161187][ T352] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.169733][ T352] usb 3-1: config 0 descriptor?? [ 28.258150][ T10] usb 2-1: USB disconnect, device number 2 [ 28.776581][ T392] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 28.786158][ T392] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 28.980300][ T352] aiptek 3-1:0.0: Aiptek using 400 ms programming speed [ 28.995982][ T352] input: Aiptek as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input5 [ 29.015435][ C0] ------------[ cut here ]------------ [ 29.020951][ C0] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31 [ 29.029565][ C0] index 19545 is out of range for type 'const int[34]' [ 29.036444][ C0] CPU: 0 UID: 0 PID: 317 Comm: udevd Not tainted syzkaller #0 4d4a838cf2fc485b043991145ccf8426a0241c16 [ 29.036477][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 29.036491][ C0] Call Trace: [ 29.036499][ C0] [ 29.036508][ C0] __dump_stack+0x21/0x30 [ 29.036547][ C0] dump_stack_lvl+0x140/0x1c0 [ 29.036580][ C0] ? __cfi_dump_stack_lvl+0x10/0x10 [ 29.036612][ C0] ? x64_sys_call+0x1821/0x2ee0 [ 29.036636][ C0] dump_stack+0x19/0x20 [ 29.036667][ C0] ubsan_epilogue+0xe/0x40 [ 29.036699][ C0] __ubsan_handle_out_of_bounds+0xe8/0xf0 [ 29.036732][ C0] aiptek_irq+0x208d/0x2a00 [ 29.036766][ C0] ? _raw_spin_unlock+0x45/0x60 [ 29.036793][ C0] ? kcov_remote_start+0x1d2/0x3c0 [ 29.036819][ C0] __usb_hcd_giveback_urb+0x36e/0x530 [ 29.036857][ C0] usb_hcd_giveback_urb+0x12b/0x400 [ 29.036892][ C0] dummy_timer+0xa3f/0x4900 [ 29.036920][ C0] ? psi_account_irqtime+0x307/0x9a0 [ 29.036952][ C0] ? __cfi_dummy_timer+0x10/0x10 [ 29.036974][ C0] ? timerqueue_del+0xd7/0x130 [ 29.036997][ C0] ? __hrtimer_run_queues+0x2bd/0x8e0 [ 29.037032][ C0] ? __cfi_dummy_timer+0x10/0x10 [ 29.037053][ C0] __hrtimer_run_queues+0x3ae/0x8e0 [ 29.037088][ C0] ? hrtimer_interrupt+0xf30/0xf30 [ 29.037120][ C0] ? read_tsc+0xd/0x20 [ 29.037150][ C0] ? ktime_get_update_offsets_now+0x3c0/0x3e0 [ 29.037179][ C0] hrtimer_run_softirq+0x159/0x560 [ 29.037201][ C0] ? irqtime_account_irq+0x51/0x1c0 [ 29.037233][ C0] handle_softirqs+0x1aa/0x620 [ 29.037258][ C0] __irq_exit_rcu+0x47/0xb0 [ 29.037279][ C0] irq_exit_rcu+0xd/0x30 [ 29.037300][ C0] sysvec_apic_timer_interrupt+0x82/0x90 [ 29.037334][ C0] [ 29.037342][ C0] [ 29.037350][ C0] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 29.037381][ C0] RIP: 0010:memset_orig+0x33/0xb0 [ 29.037407][ C0] Code: b6 ce 48 b8 01 01 01 01 01 01 01 01 48 0f af c1 41 89 f9 41 83 e1 07 75 70 48 89 d1 48 c1 e9 06 74 35 0f 1f 44 00 00 48 ff c9 <48> 89 07 48 89 47 08 48 89 47 10 48 89 47 18 48 89 47 20 48 89 47 [ 29.037426][ C0] RSP: 0018:ffffc9000b7efae8 EFLAGS: 00000202 [ 29.037453][ C0] RAX: 0000000000000000 RBX: ffff8881168f5500 RCX: 0000000000000007 [ 29.037468][ C0] RDX: 0000000000000200 RSI: 0000000000000000 RDI: ffffed1022d1eaa0 [ 29.037494][ C0] RBP: ffffc9000b7efb08 R08: ffffc9000b7efe27 R09: 0000000000000000 [ 29.037510][ C0] R10: ffffed1022d1eaa0 R11: fffff520016fdfc5 R12: 0000000000000001 [ 29.037527][ C0] R13: 0000000000022601 R14: 0000000000001000 R15: dffffc0000000000 [ 29.037547][ C0] ? kasan_unpoison+0x4a/0x70 [ 29.037582][ C0] __kasan_slab_alloc+0x5e/0x90 [ 29.037611][ C0] kmem_cache_alloc_noprof+0x1bf/0x410 [ 29.037635][ C0] ? getname_flags+0xcc/0x6b0 [ 29.037662][ C0] getname_flags+0xcc/0x6b0 [ 29.037687][ C0] ? putname+0x113/0x150 [ 29.037712][ C0] vfs_fstatat+0xcb/0x1d0 [ 29.037741][ C0] __se_sys_newfstatat+0x127/0x3c0 [ 29.037771][ C0] ? __x64_sys_newfstatat+0xc0/0xc0 [ 29.037803][ C0] ? call_rcu_hurry+0x30/0x30 [ 29.037836][ C0] __x64_sys_newfstatat+0x9f/0xc0 [ 29.037867][ C0] x64_sys_call+0x1821/0x2ee0 [ 29.037887][ C0] do_syscall_64+0x57/0xf0 [ 29.037908][ C0] ? clear_bhb_loop+0x50/0xa0 [ 29.037934][ C0] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 29.037961][ C0] RIP: 0033:0x7f9d2b511b0a [ 29.037979][ C0] Code: 48 8b 15 f1 f2 0d 00 f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 41 89 ca b8 06 01 00 00 0f 05 <3d> 00 f0 ff ff 77 07 31 c0 c3 0f 1f 40 00 48 8b 15 b9 f2 0d 00 f7 [ 29.037997][ C0] RSP: 002b:00007ffdc4068608 EFLAGS: 00000206 ORIG_RAX: 0000000000000106 [ 29.038020][ C0] RAX: ffffffffffffffda RBX: 00005580479c0735 RCX: 00007f9d2b511b0a [ 29.038037][ C0] RDX: 00007ffdc4068610 RSI: 00007ffdc40686a0 RDI: 00000000ffffff9c [ 29.038053][ C0] RBP: 0000558085cc5f70 R08: 00005580479c0735 R09: 0000000000000000 [ 29.038069][ C0] R10: 0000000000000100 R11: 0000000000000206 R12: 0000558085cc6060 [ 29.038085][ C0] R13: 00007ffdc40686a0 R14: 00007ffdc4069b80 R15: 0000000000000000 [ 29.038103][ C0] [ 29.038111][ C0] ---[ end trace ]--- [ 29.320103][ T343] usb 1-1: USB disconnect, device number 3 [ 29.323931][ C0] ------------[ cut here ]------------ [ 29.323943][ C0] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30 [ 29.323964][ C0] index 19546 is out of range for type 'const int[34]' [ 29.465509][ C0] CPU: 0 UID: 0 PID: 317 Comm: udevd Not tainted syzkaller #0 4d4a838cf2fc485b043991145ccf8426a0241c16 [ 29.465532][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 29.465539][ C0] Call Trace: [ 29.465544][ C0] [ 29.465550][ C0] __dump_stack+0x21/0x30 [ 29.465573][ C0] dump_stack_lvl+0x140/0x1c0 [ 29.465591][ C0] ? __cfi_dump_stack_lvl+0x10/0x10 [ 29.465614][ C0] ? input_event_dispose+0x2f5/0x6d0 [ 29.465634][ C0] dump_stack+0x19/0x20 [ 29.465649][ C0] ubsan_epilogue+0xe/0x40 [ 29.465660][ C0] __ubsan_handle_out_of_bounds+0xe8/0xf0 [ 29.465677][ C0] aiptek_irq+0x1f3c/0x2a00 [ 29.465694][ C0] ? kcov_remote_start+0x1d2/0x3c0 [ 29.465708][ C0] __usb_hcd_giveback_urb+0x36e/0x530 [ 29.465728][ C0] usb_hcd_giveback_urb+0x12b/0x400 [ 29.465746][ C0] dummy_timer+0xa3f/0x4900 [ 29.465760][ C0] ? psi_account_irqtime+0x307/0x9a0 [ 29.465779][ C0] ? __cfi_dummy_timer+0x10/0x10 [ 29.465791][ C0] ? timerqueue_del+0xd7/0x130 [ 29.465812][ C0] ? __hrtimer_run_queues+0x2bd/0x8e0 [ 29.465843][ C0] ? __cfi_dummy_timer+0x10/0x10 [ 29.465859][ C0] __hrtimer_run_queues+0x3ae/0x8e0 [ 29.465878][ C0] ? hrtimer_interrupt+0xf30/0xf30 [ 29.465894][ C0] ? read_tsc+0xd/0x20 [ 29.465910][ C0] ? ktime_get_update_offsets_now+0x3c0/0x3e0 [ 29.465925][ C0] hrtimer_run_softirq+0x159/0x560 [ 29.465936][ C0] ? irqtime_account_irq+0x51/0x1c0 [ 29.465954][ C0] handle_softirqs+0x1aa/0x620 [ 29.465967][ C0] __irq_exit_rcu+0x47/0xb0 [ 29.465978][ C0] irq_exit_rcu+0xd/0x30 [ 29.465989][ C0] sysvec_apic_timer_interrupt+0x82/0x90 [ 29.466007][ C0] [ 29.466011][ C0] [ 29.466015][ C0] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 29.466032][ C0] RIP: 0010:memset_orig+0x33/0xb0 [ 29.466046][ C0] Code: b6 ce 48 b8 01 01 01 01 01 01 01 01 48 0f af c1 41 89 f9 41 83 e1 07 75 70 48 89 d1 48 c1 e9 06 74 35 0f 1f 44 00 00 48 ff c9 <48> 89 07 48 89 47 08 48 89 47 10 48 89 47 18 48 89 47 20 48 89 47 [ 29.466056][ C0] RSP: 0018:ffffc9000b7efae8 EFLAGS: 00000202 [ 29.466068][ C0] RAX: 0000000000000000 RBX: ffff8881168f5500 RCX: 0000000000000007 [ 29.466077][ C0] RDX: 0000000000000200 RSI: 0000000000000000 RDI: ffffed1022d1eaa0 [ 29.466085][ C0] RBP: ffffc9000b7efb08 R08: ffffc9000b7efe27 R09: 0000000000000000 [ 29.466095][ C0] R10: ffffed1022d1eaa0 R11: fffff520016fdfc5 R12: 0000000000000001 [ 29.466105][ C0] R13: 0000000000022601 R14: 0000000000001000 R15: dffffc0000000000 [ 29.466115][ C0] ? kasan_unpoison+0x4a/0x70 [ 29.466129][ C0] __kasan_slab_alloc+0x5e/0x90 [ 29.466144][ C0] kmem_cache_alloc_noprof+0x1bf/0x410 [ 29.466156][ C0] ? getname_flags+0xcc/0x6b0 [ 29.466170][ C0] getname_flags+0xcc/0x6b0 [ 29.466182][ C0] ? putname+0x113/0x150 [ 29.466194][ C0] vfs_fstatat+0xcb/0x1d0 [ 29.466208][ C0] __se_sys_newfstatat+0x127/0x3c0 [ 29.466223][ C0] ? __x64_sys_newfstatat+0xc0/0xc0 [ 29.466239][ C0] ? call_rcu_hurry+0x30/0x30 [ 29.466256][ C0] __x64_sys_newfstatat+0x9f/0xc0 [ 29.466271][ C0] x64_sys_call+0x1821/0x2ee0 [ 29.466281][ C0] do_syscall_64+0x57/0xf0 [ 29.466294][ C0] ? clear_bhb_loop+0x50/0xa0 [ 29.466310][ C0] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 29.466326][ C0] RIP: 0033:0x7f9d2b511b0a [ 29.466335][ C0] Code: 48 8b 15 f1 f2 0d 00 f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 41 89 ca b8 06 01 00 00 0f 05 <3d> 00 f0 ff ff 77 07 31 c0 c3 0f 1f 40 00 48 8b 15 b9 f2 0d 00 f7 [ 29.466345][ C0] RSP: 002b:00007ffdc4068608 EFLAGS: 00000206 ORIG_RAX: 0000000000000106 [ 29.466356][ C0] RAX: ffffffffffffffda RBX: 00005580479c0735 RCX: 00007f9d2b511b0a [ 29.466365][ C0] RDX: 00007ffdc4068610 RSI: 00007ffdc40686a0 RDI: 00000000ffffff9c [ 29.466373][ C0] RBP: 0000558085cc5f70 R08: 00005580479c0735 R09: 0000000000000000 [ 29.466381][ C0] R10: 0000000000000100 R11: 0000000000000206 R12: 0000558085cc6060 [ 29.466389][ C0] R13: 00007ffdc40686a0 R14: 00007ffdc4069b80 R15: 0000000000000000 [ 29.466398][ C0] [ 29.466402][ C0] ---[ end trace ]--- [ 29.952225][ T310] bridge_slave_1: left allmulticast mode [ 29.957966][ T310] bridge_slave_1: left promiscuous mode [ 29.963763][ T310] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.971797][ T310] bridge_slave_0: left allmulticast mode [ 29.977496][ T310] bridge_slave_0: left promiscuous mode [ 29.983370][ T310] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.006525][ T331] usb 3-1: USB disconnect, device number 5 [ 30.006572][ C0] aiptek 3-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 30.111769][ T310] veth1_macvtap: left promiscuous mode [ 30.117324][ T310] veth0_vlan: left promiscuous mode [ 30.298569][ T331] usb 4-1: USB disconnect, device number 4