last executing test programs: 3.855014256s ago: executing program 0 (id=499): creat(&(0x7f00000000c0)='./file0\x00', 0xdafbe5d6891b7ec) (async) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0xdafbe5d6891b7ec) write$binfmt_elf32(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="7f454c46800c040001200000010000000200060041000000dd0000003800000045030000080000000100200002000400090000000000000005000000a86bbf2503000000ffffffff0900000004000000ae0000000100000003"], 0x78) getsockopt$inet_tcp_buf(r0, 0x6, 0xe, &(0x7f0000000280)=""/169, &(0x7f0000000040)=0xa9) close(r0) (async) close(r0) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000180), 0xa15c2, 0x0) (async) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000180), 0xa15c2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x8, 0x7, 0x10000, 0xf6fd, 0x7, 0x0}) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x19) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0xc2ec2fa08b95a997, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) write(r1, &(0x7f0000000000)="88de80841d87", 0x6) 3.854764716s ago: executing program 0 (id=500): r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000440)="580000001400192340834b80040d8c560a067fbc45ff810500000000070058000b480400945f640094272d7061d328b92d0000000000008000f0fffeffe809000000fff5dd000000100001000b0808004149004001040800", 0x58}], 0x1) 3.77729448s ago: executing program 0 (id=501): getrandom(0x0, 0x0, 0x3) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000800)=@updpolicy={0xb8, 0x19, 0x17, 0xfffffffc, 0x40090000, {{@in=@multicast2, @in=@empty, 0x0, 0x10, 0x0, 0x0, 0xa, 0x20, 0x0, 0x62}, {0x8, 0x12, 0x100000002, 0x0, 0xfff, 0xfffffffffffffffb, 0xffffffffffffffff}, {0x6, 0x2000000000000003, 0x2, 0xffffffffffffffff}, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0xb8}}, 0x4004) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="b800000019000100ea17f96400000140e0003002000000000000000001"], 0xb8}}, 0x4004) 3.77690491s ago: executing program 0 (id=502): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$incfs(&(0x7f0000000080)='./file0\x00', 0x0, &(0x7f0000000280), 0x80, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000380)="a7"}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x2440c2, 0x8c) chmod(&(0x7f0000000180)='./file0\x00', 0x23f) setuid(0xee01) r1 = openat$incfs(r0, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) ioctl$TIOCL_GETKMSGREDIRECT(r1, 0xc058671e, &(0x7f00000000c0)) 3.77665819s ago: executing program 0 (id=503): read$FUSE(0xffffffffffffffff, &(0x7f0000000380)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) prlimit64(r0, 0x1, &(0x7f0000000000)={0x8, 0x4008}, 0x0) gettid() timer_create(0x3, 0x0, &(0x7f0000044000)) timer_create(0x6, &(0x7f0000000040)={0x0, 0x11, 0x1, @tid=r0}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) unshare(0x60000600) 3.664599555s ago: executing program 0 (id=505): r0 = syz_usb_connect$hid(0x5, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000000000204f045db600000000000107002d00010000600209040010050300010009210002008f63e8a5e080526656440602284d36012205000d058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$inet(0x2, 0x1, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$inet_opts(r1, 0x0, 0x4, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) r2 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setsockopt$inet_opts(r2, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000180)='bridge0\x00', 0x10) connect$inet(r2, &(0x7f0000000100)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f0000000140), 0x4) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x200000000000000) syz_usb_control_io$hid(r0, &(0x7f0000000380)={0x24, 0x0, 0x0, &(0x7f0000000200)={0x0, 0x22, 0x5, {[@local=@item_4={0x3, 0x2, 0x1, "a7403d81"}]}}, 0x0}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000008300), 0x2, 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000180)='./file0/../file0\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x18d883, 0x0) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x89801) keyctl$set_reqkey_keyring(0xe, 0x0) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f0000000000), 0x800804, &(0x7f0000002100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) 3.041297157s ago: executing program 2 (id=511): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000001b80), r0) sendmsg$IEEE802154_LIST_IFACE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001c40)={&(0x7f0000000280)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="bb15b3ad3300ffcbdf251f0000"], 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f00000001c0)={0x1fd, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$NL80211_CMD_NEW_STATION(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB='h\x00', @ANYRES16], 0x68}, 0x1, 0x0, 0x0, 0x4000000}, 0x4814) ioctl$KVM_SET_IRQCHIP(r3, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x3, 0x7, 0xe1, 0x81, 0x9, 0xd9, 0x40, 0x41, 0xfb, 0x5e, 0x9, 0x0, 0x1, 0x40, 0x1, 0x5}}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) r5 = socket$inet_udp(0x2, 0x2, 0x0) fstat(r5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) setreuid(r6, r6) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r7, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000500)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000004c0)={&(0x7f0000000200)={0x24, r1, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x1f}, @IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x840}, 0x8041) sendmmsg$inet(r7, &(0x7f00000060c0)=[{{0x0, 0x0, &(0x7f0000000a40)=[{&(0x7f0000000140)='@', 0x1}, {&(0x7f00000007c0)='y', 0x1}, {&(0x7f0000000340)="b9", 0x1}, {&(0x7f0000000940)="99", 0x1}, {&(0x7f00000008c0)='z', 0x1}, {&(0x7f00000009c0)='~', 0x1}, {&(0x7f0000000a00)='x', 0x1}, {&(0x7f0000000440)="06", 0x1}, {&(0x7f0000000580)='k', 0xffffffc6}, {&(0x7f00000006c0)="1d", 0x1}, {&(0x7f0000000800)='a', 0x1}, {&(0x7f0000000280)='$', 0x1}], 0xc}}, {{0x0, 0x0, &(0x7f00000035c0)=[{&(0x7f0000001040)="fc"}, {&(0x7f0000001080)="c9", 0x1}, {&(0x7f0000002180)='-', 0x1}, {&(0x7f0000002240)='R', 0x1}, {&(0x7f00000033c0)="c4", 0x1}], 0x5}}], 0x2, 0x4000000) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) futex(&(0x7f00000040c0), 0x6, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) madvise(&(0x7f0000000000/0x400000)=nil, 0x40001e, 0x15) futex(&(0x7f00000040c0), 0x87, 0x0, 0x0, 0x0, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) read(r8, 0x0, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x5, 0x20, 0x3, 0x100000000, 0x106c, 0x100, 0x8000000000000, 0x80000004000080, 0x0, 0x8, 0x0, 0x4, 0x0, 0x8000], 0x1, 0x3c4210}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 2.923511593s ago: executing program 2 (id=512): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x2, 0x10) ioctl$NILFS_IOCTL_SYNC(r0, 0x80086e8a, &(0x7f0000000040)) ioctl$BTRFS_IOC_SPACE_INFO(r0, 0xc0109414, &(0x7f0000000080)={0xbf3, 0x9, ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}) (async) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000011fc0), r0) sendmsg$TIPC_CMD_RESET_LINK_STATS(r0, &(0x7f0000012080)={&(0x7f0000011f80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000012040)={&(0x7f0000012000)={0x30, r1, 0x800, 0x70bd2b, 0x25dfdbfd, {{}, {}, {0x14, 0x14, 'broadcast-link\x00'}}, ["", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x0) (async, rerun: 64) syz_usb_connect$hid(0x1, 0x3f, &(0x7f00000120c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x30, 0x56a, 0x27, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x84, 0x40, 0x4, "", [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x3, 0x1, 0x0, 0x81, {0x9, 0x21, 0xff7f, 0xf, 0x1, {0x22, 0x279}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x1, 0x8, 0x5}}, [{{0x9, 0x5, 0x2, 0x3, 0x200, 0xf, 0x2, 0x7f}}]}}}]}}]}}, &(0x7f0000012280)={0xa, &(0x7f0000012100)={0xa, 0x6, 0x300, 0xaf, 0x3, 0xff, 0x20, 0x2}, 0xf7, &(0x7f0000012140)={0x5, 0xf, 0xf7, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0xd, 0x7c, 0x0, 0x7fff}, @ssp_cap={0x10, 0x10, 0xa, 0xc, 0x1, 0x5, 0x8800, 0xc09d, [0x0]}, @ext_cap={0x7, 0x10, 0x2, 0x2, 0x5, 0xc, 0x200}, @generic={0xc3, 0x10, 0xa, "01a918ba26504426538a587d136933fc278e4b76d6da5e852d1a3b1aa688a10a2041188b35ae356dec612284a1de8514cee27eb835ff76101da8c187260c698cfc5f8c09260008ba8acd11b6f2e8a2dc5995687a1e1804776c8ea510b034483bf334e2f36dfa07acc3aad0afc97cc28222229f1f36ec456bbe11d2aa653bd3baffb81121cf92aac9486d6f8190eb97f70ac0b6888fb671d53384a8fedaf63ed5d639c676e3f2c91808d772e99d28f9335feb6fd18c016bf70a71e0ef60f2308f"}, @ext_cap={0x7, 0x10, 0x2, 0xa, 0xd, 0x2, 0x4f8}, @ext_cap={0x7, 0x10, 0x2, 0x8, 0x3, 0x1, 0x3ff}]}, 0x1, [{0x24, &(0x7f0000012240)=@string={0x24, 0x3, "db14a18d7da40329186bbdaf81e9e5a6018a4fa185558ee36825d43273d35b83ee6e"}}]}) (async, rerun: 64) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000012340)={'syztnl0\x00', &(0x7f00000122c0)={'syztnl1\x00', 0x0, 0x29, 0xf, 0x7, 0x8, 0x4, @mcast1, @local, 0x7, 0x20, 0x1}}) (async) fstat(r0, &(0x7f0000012380)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000012400)={{{@in6=@mcast1, @in=@dev={0xac, 0x14, 0x14, 0x44}, 0x4e21, 0x6e, 0x4e23, 0x0, 0x2, 0x120, 0xb0, 0x87, r2, r3}, {0x100, 0x3, 0x8, 0x2, 0x1, 0x7, 0x200, 0xdc9}, {0x3, 0x4, 0xc92, 0x43}, 0x5, 0x6e6bb5, 0x2, 0x0, 0x1}, {{@in6=@remote, 0x4d6, 0x3c}, 0xa, @in6=@loopback, 0x3500, 0x0, 0x3, 0x0, 0x60, 0x2, 0x7}}, 0xe8) sendmsg$NL80211_CMD_DEL_PMKSA(r0, &(0x7f00000125c0)={&(0x7f0000012500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000012580)={&(0x7f0000012540)={0x28, 0x0, 0x800, 0x70bd28, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_PMKID={0x14, 0x55, "82b73922342a64d4fcad01d62a3bcc31"}]}, 0x28}, 0x1, 0x0, 0x0, 0x400c800}, 0x4000010) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000012600)={@private1={0xfc, 0x1, '\x00', 0x1}, 0x77, r2}) (async) r4 = syz_genetlink_get_family_id$fou(&(0x7f0000012680), r0) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000012740)={&(0x7f0000012640)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000012700)={&(0x7f00000126c0)={0x38, r4, 0x100, 0x70bd29, 0x25dfdbfe, {}, [@FOU_ATTR_IPPROTO={0x5}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @remote}, @FOU_ATTR_AF={0x5, 0x2, 0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000810}, 0x800) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f00000127c0)=&(0x7f0000012780)) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000012840), r0) sendmsg$NL80211_CMD_GET_REG(r6, &(0x7f0000012900)={&(0x7f0000012800)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000128c0)={&(0x7f0000012880)={0x2c, r7, 0x2, 0x70bd27, 0x25dfdbfb, {}, [@NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x2}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x9}, @NL80211_ATTR_REG_ALPHA2={0x7, 0x21, 'aa\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4bd3477312824efd}, 0x5) close_range(r6, r5, 0x0) (async) r8 = syz_open_dev$evdev(&(0x7f0000012940), 0x7, 0xb8440) (async, rerun: 32) r9 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) sendmsg$NL80211_CMD_ASSOCIATE(r9, &(0x7f0000012a80)={&(0x7f0000012980)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000012a40)={&(0x7f00000129c0)={0x48, r7, 0x100, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0xbc, 0x39}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @crypto_settings=[@NL80211_ATTR_SAE_PASSWORD={0x5, 0x115, 'E'}, @NL80211_ATTR_CONTROL_PORT={0x4}], @NL80211_ATTR_VHT_CAPABILITY={0x10, 0x9d, {0x70000, {0x0, 0x3, 0x4, 0x6}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) (async) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000012ac0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x5ac, 0x220, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x7f, 0xe0, 0x0, "", [{{0x9, 0x4, 0x0, 0x3, 0x1, 0x3, 0x1, 0x1, 0x7, {0x9, 0x21, 0xfff7, 0xb9, 0x1, {0x22, 0x16d}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0xe6, 0x1, 0x40}}}}}]}}]}}, &(0x7f0000012d80)={0xa, &(0x7f0000012b00)={0xa, 0x6, 0x201, 0x3, 0x8, 0x9, 0x10, 0x41}, 0x19, &(0x7f0000012b40)={0x5, 0xf, 0x19, 0x1, [@ss_container_id={0x14, 0x10, 0x4, 0xf4, "b2bae250f9e2335f38f37b0c226419c5"}]}, 0x4, [{0xa5, &(0x7f0000012b80)=@string={0xa5, 0x3, "7b3f2e07471394ca70c9e35c8212775e69214868c87064ae6eb8695897eca43c6fd08be94d01d01f17f755fa8186295e8c4bb4c39067e58e9e3c2ab24ab760d23cce990476b7174207a0ff15994271ea1ac513e5250dfa4331346bdb5394aadcfdad401b757dca30d1e8f3007ae92213a8fd5484c8ca732e1d3663b963fb58eec79aab1dd40e14a8940363b42a7a64f41a2a20b415aa90c5d318bf71a3fbb54ab80800"}}, {0x4, &(0x7f0000012c40)=@lang_id={0x4, 0x3, 0x3c0a}}, {0x28, &(0x7f0000012c80)=@string={0x28, 0x3, "0fd086d6f42bafae5b136e1182a089400196ab822a192fd3f7e3d53e3ecec354798d97f50bfc"}}, {0xaf, &(0x7f0000012cc0)=@string={0xaf, 0x3, "3335ce48e8beacdf11b93e043dfeee13f8da8d809d5394f4ade531bdf2f6a5292e23e8d5509334042317f48794f923f5e171b5e77ca4ded6304b372e14c7ae965960e313febd9a7294479ed3f9f491c3fb5d6b51bbe293d9893276b71265cdaa6f7df12301ffe36617b02c9031ff1a942020dd7000e726324fd5e0b219326a48a3b6776cb0096398f2f22a2121bb51cec56bd6dad779f143d8d3484e1a9c2231e5a7ab64cd0be3f1c0cdb3590e"}}]}) r10 = openat$cgroup_ro(r0, &(0x7f0000012e00)='blkio.bfq.io_service_time\x00', 0x0, 0x0) (async) r11 = syz_genetlink_get_family_id$ethtool(&(0x7f0000012e80), r0) sendmsg$ETHTOOL_MSG_EEE_SET(r10, &(0x7f00000130c0)={&(0x7f0000012e40)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000013080)={&(0x7f0000012ec0)={0x19c, r11, 0x10, 0x70bd2c, 0x25dfdbff, {}, [@ETHTOOL_A_EEE_MODES_OURS={0xe0, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x1}, @ETHTOOL_A_BITSET_VALUE={0xc3, 0x4, "b2d3186d434cbb96be8d9023d18e430988fce06ec188dda474f16adb7bd01d1c01392326be707e58c10c80806eeaea5c87c9c8040022a4d913aac5b25cd3ff476beb1b3104ab2921694dfee660b2efac774eade83d5cfe1b4ab701bc42d34b81dcdcb0485c2a60411de433439f0a2b39b39619e0534c66a888ea636661561df346e4a3332bff3889e30f7284e05aba9b85cf2909371d03c27f14e9c1cfc2214a1f3ab41a86e029328d2c972ea5845e1b3e9c2abe2474764064fa92ad83e76d"}, @ETHTOOL_A_BITSET_MASK={0x10, 0x5, "78921870b095a45e19192ee6"}]}, @ETHTOOL_A_EEE_ENABLED={0x5}, @ETHTOOL_A_EEE_MODES_OURS={0x14, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0xfff}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_VALUE={0x4}]}, @ETHTOOL_A_EEE_TX_LPI_TIMER={0x8}, @ETHTOOL_A_EEE_TX_LPI_TIMER={0x8, 0x7, 0xffffffff}, @ETHTOOL_A_EEE_MODES_OURS={0x7c, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x78, 0x3, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xd}, @ETHTOOL_A_BITSET_BIT_NAME={0x9, 0x2, 'TIPC\x00'}]}, {0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '*\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x16, 0x2, '/dev/input/event#\x00'}]}, {0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xfffffffe}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x2}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8}]}]}]}]}, 0x19c}, 0x1, 0x0, 0x0, 0x2000000}, 0x24000005) sendmsg$NL80211_CMD_GET_SCAN(r6, &(0x7f00000131c0)={&(0x7f0000013100), 0xc, &(0x7f0000013180)={&(0x7f0000013140)={0x14, r7, 0x301, 0x70bd2d, 0x25dfdbfe, {{}, {@void, @void}}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x240000d1) (async) write$binfmt_script(r0, &(0x7f0000013200)={'#! ', './file1', [{0x20, 'fou\x00'}, {0x20, 'syztnl0\x00'}, {0x20, 'aa\x00'}], 0xa, "455827904a651aece50bc0dd3d871b338200394ff1c57fc47bea9a7fcda3d14fb5263203049541257111e9f761b3c66317954b504bac9b2369b2a0713afe9ee3a93f298ad4232ea070518ddaba277fbf9092779ca9c44fea9dc1bd55d2574144f0198afadb8c1cf6e2478d12181d67b1e0f11dd6277ea9be307c844664e3b9bb2ba5023dffd08265bfb976a6ce304640c657106035414df8b9210f64b432b90b0ac726333a849744aa6d618bf18e39a057e06c4cd8b89d2d0dc852935829e25124c00a13426477c9051c70702a3f2b114409679d03b4a2889e1657634ef75d511b2c4de48fcdc0b00940d000014e6d245464eaa0"}, 0x111) (async) r12 = socket$unix(0x1, 0x5, 0x0) ioctl$FICLONE(r8, 0x40049409, r12) 2.412889868s ago: executing program 2 (id=521): syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x40, 0xa, 0x4, "a0e763a8"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x44, &(0x7f0000000980)={0x0, 0x17, 0x6, "f222d66d10a8"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(0xffffffffffffffff, 0x0, &(0x7f00000005c0)={0x44, &(0x7f0000000180)={0x0, 0x15, 0x4, "b25f66fe"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(0xffffffffffffffff, &(0x7f00000000c0)={0x14, &(0x7f0000000000)={0x0, 0x8, 0x40, {0x40, 0xd, "e3745c4ec79defbd04ab99b111a21bd52d7e16986d65c1c7efe6ded604e1aadc0c2ee4df0318c75f72ab0375188a0e258a62f9b661d7ab7db7ae9b1a2a5f"}}, &(0x7f0000000080)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x42d}}}, &(0x7f0000000640)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xc0, "04290943271fed4392dd8933439711e098b2022cd08beb55d775a30de8851e8e85766615f2d81b27d7db079187f91385935909722ce02747d4c55c51d3fc1efeb5d7ae22b891c3bce5a7435695b0e979161a04745c009b3a58e6a543ad8ca6466aa5a26f46572c58e5452e147cba959d34fcbc61b9c2f84a5815aa25da88fd9cf0476593f5a2fd26868fe9b52f74baac3ff716a802b6d2580a11d963b157fca732d8fde068e28d309510d111d8375c1d900d98f4388b03e995170e67257c315e"}, &(0x7f0000000100)={0x0, 0xa, 0x1, 0x7b}, &(0x7f0000000140)={0x0, 0x8, 0x1, 0x1}, &(0x7f00000002c0)={0x20, 0x81, 0x3, "e11c4f"}, &(0x7f0000000300)={0x20, 0x82, 0x1, "e1"}, &(0x7f0000000340)={0x20, 0x83, 0x1, 's'}, &(0x7f0000000400)={0x20, 0x84, 0x3, "0caa38"}, &(0x7f0000000440)={0x20, 0x85, 0x3, "74da15"}}) 2.259992976s ago: executing program 1 (id=525): socket$nl_netfilter(0x10, 0x3, 0xc) socket(0xa, 0x1, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$nl_route(0x10, 0x3, 0x0) socket$inet6(0xa, 0x80002, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) vmsplice(r0, 0x0, 0x0, 0x0) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x80000, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) openat$binfmt_register(0xffffff9c, &(0x7f00000001c0), 0x1, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x4b301, 0x0) r1 = socket(0x2, 0x3, 0x6) syz_usb_connect$uac1(0x3, 0xdc, &(0x7f00000017c0)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c240208000103000000ff000924060506020100000924030003030005490c240206", @ANYRES8=r1, @ANYBLOB='\a'], 0x0) 1.898516494s ago: executing program 2 (id=526): r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x2141, 0x4d) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x20, 0x0, 0x0, 0x8}, {0x6}]}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_int(r1, 0x29, 0x3c, 0x0, &(0x7f0000000080)) 1.606775669s ago: executing program 1 (id=528): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000100)={0x0, 0x0, 0x1000000}) 1.58758209s ago: executing program 1 (id=529): r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdir(&(0x7f00000000c0)='./file0\x00', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r1 = inotify_init() inotify_add_watch(r1, &(0x7f00000001c0)='./file0\x00', 0x4a9) inotify_add_watch(r1, &(0x7f0000000040)='./file0\x00', 0x1100001c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x304}, "26c9dd0b1fd2fe33", "12ac6af0a6c27e614c1d490f86abd75e", "8a5c498a", "369199b27dc6f1de"}, 0x28) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_inet6_SIOCDIFADDR(r3, 0x8936, &(0x7f0000000000)={@private0, 0x39}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r3, 0x89f0, &(0x7f0000000680)={'ip6gre0\x00', &(0x7f0000000600)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x4, 0x10, @loopback, @empty, 0x1, 0x10, 0x800, 0x200}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r3, 0x89f0, &(0x7f0000000780)={'tunl0\x00', &(0x7f00000006c0)={'syztnl0\x00', r4, 0x20, 0x7800, 0xfff, 0x76, {{0x1d, 0x4, 0x2, 0x0, 0x74, 0x65, 0x0, 0x7, 0x29, 0x0, @local, @multicast1, {[@end, @cipso={0x86, 0x5e, 0x3, [{0x7, 0xc, "424bdfd7055c9a53e162"}, {0x7, 0xf, "2f014382b6776feb79b2622d5f"}, {0x5, 0x9, "c578094af71844"}, {0x2, 0xf, "44921b8b44e2d5d203a21d62f5"}, {0x7, 0x7, "74dd582a76"}, {0x1, 0x3, '\v'}, {0x6, 0xa, "01f1b9e6e7d5c616"}, {0x6, 0x11, "6546d2c5bc68669ee558b35603f7d5"}]}]}}}}}) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000140)={0x0, @remote, @local}, &(0x7f0000000180)=0xc) sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000480)={0x68, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@GTPA_LINK={0x8, 0x1, r5}, @GTPA_TID={0xc, 0x3, 0x1}, @GTPA_FAMILY={0x5, 0xd, 0xf}, @GTPA_MS_ADDR6={0x14, 0xc, @dev={0xfe, 0x80, '\x00', 0x20}}, @GTPA_FAMILY={0x5, 0xd, 0x10}, @GTPA_FLOW={0x6, 0x6, 0x2}, @GTPA_MS_ADDR6={0x14, 0xc, @mcast2}]}, 0x68}, 0x1, 0x0, 0x0, 0x8854}, 0xc000) r6 = socket$xdp(0x2c, 0x3, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) setsockopt$bt_BT_SECURITY(r7, 0x112, 0x4, &(0x7f0000000200)={0x3, 0x6}, 0x2) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r2, 0x8983, &(0x7f00000005c0)={0x1, 'wlan1\x00', {}, 0x4}) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000540)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="01002cbd7000ffdbdf250c000000180001801400020076657468315f746f5f626174616476000800038004000380529c0968bc2cee1de3ba8705dcf1601f22075daf3423ada5"], 0x34}, 0x1, 0x0, 0x0, 0x818}, 0x20000004) ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f0000000440)={0x2, {0x2, 0x1ff, 0x3, 0x7, 0x800}}) syz_usb_connect$cdc_ecm(0x5, 0x56, &(0x7f00000007c0)=ANY=[@ANYRESDEC=r2, @ANYRESOCT=0x0, @ANYRESOCT=r0, @ANYBLOB="9e2fb629711e198be05cd0ff1dda0ca356efa6687941bd8affe4b627c11169a5df84e668cb12c96e7cb8bd6373f0ca16dd78e76a545e26a32ba474271b48a8e8d12d2ea359fb35b3834fd356f3a618feca604678b897bd7a314c3dc1eadb3fe69eef26bc7079f3448f27fee8fd6a59c54c", @ANYRESHEX, @ANYRES64=r3, @ANYRES16=r6], 0x0) r9 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r9, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r10 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r10, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r11 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="120100000000010902240001000000e50000000009030000000920000000012229000905810300000000000000000000000000000000ae03afc47ee14ac7"], 0x0) syz_usb_control_io$hid(r11, 0x0, 0x0) syz_usb_control_io$hid(r11, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.054976626s ago: executing program 2 (id=533): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r0, &(0x7f0000000100), 0x8) bind$bt_sco(r0, &(0x7f0000000040)={0x1f, @none}, 0x1e) (async) bind$bt_sco(r0, &(0x7f0000000040)={0x1f, @none}, 0x1e) syz_usb_connect$uac2(0x5, 0x7b, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1235, 0x8212, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x6, 0xc0, 0x1, {0x8, 0xb, 0x1, 0x2, 0x1, 0x3, 0x20, 0x6}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x3, 0x6, 0x9, 0xed}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0xe, 0x4, 0x1, {0x8, 0x25, 0x1, 0x1, 0x0, 0x3}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x30, 0x5, 0xa9, 0x9, {0x8, 0x25, 0x1, 0x0, 0x0, 0x10, 0xf}}}}}}}}]}}, 0x0) 1.032583968s ago: executing program 1 (id=534): syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x40, 0xa, 0x4, "a0e763a8"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x44, &(0x7f0000000980)={0x0, 0x17, 0x6, "f222d66d10a8"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(0xffffffffffffffff, 0x0, &(0x7f00000005c0)={0x44, &(0x7f0000000180)={0x0, 0x15, 0x4, "b25f66fe"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(0xffffffffffffffff, &(0x7f00000000c0)={0x14, &(0x7f0000000000)={0x0, 0x8, 0x40, {0x40, 0xd, "e3745c4ec79defbd04ab99b111a21bd52d7e16986d65c1c7efe6ded604e1aadc0c2ee4df0318c75f72ab0375188a0e258a62f9b661d7ab7db7ae9b1a2a5f"}}, &(0x7f0000000080)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x42d}}}, &(0x7f0000000640)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xc0, "04290943271fed4392dd8933439711e098b2022cd08beb55d775a30de8851e8e85766615f2d81b27d7db079187f91385935909722ce02747d4c55c51d3fc1efeb5d7ae22b891c3bce5a7435695b0e979161a04745c009b3a58e6a543ad8ca6466aa5a26f46572c58e5452e147cba959d34fcbc61b9c2f84a5815aa25da88fd9cf0476593f5a2fd26868fe9b52f74baac3ff716a802b6d2580a11d963b157fca732d8fde068e28d309510d111d8375c1d900d98f4388b03e995170e67257c315e"}, &(0x7f0000000100)={0x0, 0xa, 0x1, 0x7b}, &(0x7f0000000140)={0x0, 0x8, 0x1, 0x1}, &(0x7f00000002c0)={0x20, 0x81, 0x3, "e11c4f"}, &(0x7f0000000300)={0x20, 0x82, 0x1, "e1"}, &(0x7f0000000340)={0x20, 0x83, 0x1, 's'}, &(0x7f0000000400)={0x20, 0x84, 0x3, "0caa38"}, &(0x7f0000000440)={0x20, 0x85, 0x3, "74da15"}}) 940.546992ms ago: executing program 3 (id=535): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1000000}) 940.118193ms ago: executing program 3 (id=536): openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r0, 0x0) 884.672085ms ago: executing program 3 (id=537): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000001c0)={0x1fd, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$NL80211_CMD_NEW_STATION(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x68}, 0x1, 0x0, 0x0, 0x4000000}, 0x4814) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x3, 0x7, 0xe1, 0x81, 0x9, 0xd9, 0x40, 0x41, 0xfb, 0x5e, 0x9, 0x0, 0x1, 0x40, 0x1, 0x5}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x5, 0x20, 0x3, 0x100000000, 0x106c, 0x100, 0x8000000000000, 0x80000004000080, 0x0, 0x8, 0x0, 0x4, 0x0, 0x8000], 0x1, 0x3c4210}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 817.908939ms ago: executing program 3 (id=538): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1000000}) (fail_nth: 1) 787.71374ms ago: executing program 3 (id=539): capset(&(0x7f0000000380)={0x20080522}, &(0x7f0000000040)={0x200000, 0x40200003, 0x0, 0x6, 0x7}) r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/keycreate\x00', 0x2, 0x0) write$selinux_attr(r0, &(0x7f0000000100)='system_u:object_r:hugetlbfs_t:s0\x00', 0x1d) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x100}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r2, &(0x7f0000000180)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10, 0x0}, 0x4000000) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0xc3) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) 392.45841ms ago: executing program 2 (id=540): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e34, 0x4, @remote, 0x2}, 0x1c) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x3c) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x0) r3 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000000640), 0x2, 0x0) ppoll(&(0x7f0000000080)=[{r3, 0x8103}], 0x1, &(0x7f00000001c0)={0x77359400}, 0x0, 0x0) r4 = syz_usb_connect(0x3, 0x36, &(0x7f0000001340)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f00000000c0)={0xa, 0x4e20, 0x7ff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x200}, 0x1c, 0x0}, 0x8010) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f0000000080)=0xb309) syz_usb_ep_write$ath9k_ep2(r4, 0x83, 0x8, &(0x7f0000000080)=ANY=[]) syz_usb_connect$printer(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="0d01"], 0x0) syz_usb_ep_write$ath9k_ep2(r4, 0x83, 0x8, &(0x7f00000000c0)=ANY=[]) r5 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet6(r5, &(0x7f0000006b80)=[{{&(0x7f0000000040)={0xa, 0x4e24, 0x0, @local}, 0x1c, 0x0}}, {{&(0x7f0000000340)={0xa, 0x4e24, 0x0, @remote}, 0x1c, 0x0, 0x0, &(0x7f0000003700)=ANY=[@ANYBLOB="e8020000000000002900000004000000005a000000000000c2040000000000dfaac7f65dde66007550d861b7b537fd49b44ed35b0b7c2ed243f39735881ba7309715165c3b9edec92e7dadb7a5bbdd45a5fd4320d89ed45cf375461e38967ad0f0891dc4bbba54a2c4b99498353dcc9f0233d55a6e0fbf78c3ba4e983f48b6f65060c96fd75c4a82e937f62c958445a04c99c7646db75133bf141405b7db695b0de9a482a9dc8dc3a25f15db0153211c3604213a2baf4222bf165fdfa2ca3fddc94be49ac220c6fec65b5f419d364efc16072c068df6df4ff736f92d14e2d5c87eb699c31f1755ba93bf935b06fb93bdb8639b796b4fa365b5b80e7eacb78b04010007180000000004000000000000000000000000000000000000000774000000000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000700"/368], 0x2e8}}], 0x2, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$BLKIOMIN(r6, 0x1278, &(0x7f0000000040)) setsockopt$bt_BT_SECURITY(r0, 0x112, 0x4, 0x0, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = fcntl$dupfd(r7, 0x0, r7) pidfd_getfd(r8, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCSIFBR(r8, 0x8941, &(0x7f0000000680)=@generic={0x0, 0xffffffffffffff55, 0x9}) ioctl$XFS_IOC_FSINUMBERS(r2, 0xc0205867, &(0x7f0000000140)={&(0x7f00000000c0)=0xcbb4, 0x5d41, &(0x7f0000000280)=[{}, {}, {}, {}, {}], &(0x7f0000000100)}) 92.958765ms ago: executing program 3 (id=541): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000006c0)=ANY=[@ANYBLOB="1201000000000040c41090ea80000000000109022400010000000009040000010300000009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\n'], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000000)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x20, 0x1, 0x3, "c282fe"}, 0x0}) timer_create(0x5, 0x0, &(0x7f0000000040)) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched_retired(r1, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000200)=@newtclass={0x24, 0x28, 0x1d, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0xf, 0xf}, {0x2, 0xfffb}, {0xf, 0x6}}}, 0x24}, 0x1, 0x0, 0x0, 0x4080}, 0x4000000) r4 = socket(0x10, 0x3, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_int(r5, 0x29, 0x1d, 0x0, &(0x7f0000000080)=0xffffffffffffffef) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000000)={0x4800}, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000c40)=ANY=[@ANYBLOB="1c0000001600010a10000040000000000207"], 0x1c}}, 0x0) readv(r1, &(0x7f0000001740)=[{&(0x7f0000000180)=""/98, 0x62}, {&(0x7f0000000200)=""/156, 0x9c}, {&(0x7f00000004c0)=""/4096, 0x1000}, {&(0x7f00000014c0)=""/112, 0x70}, {&(0x7f0000001540)=""/225, 0xe1}, {&(0x7f00000002c0)=""/43, 0x2b}, {&(0x7f0000001640)=""/153, 0x99}, {&(0x7f0000001700)=""/33, 0x21}], 0x8) r6 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) fcntl$setownex(r6, 0xf, &(0x7f0000000040)={0x480b5b90d835e45c}) timer_settime(0x0, 0x236bd4336e4642df, &(0x7f0000000300)={{0x0, 0x1}, {0x0, 0xe4c}}, 0x0) r7 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000100), 0x2) r8 = socket$unix(0x1, 0x5, 0x0) r9 = syz_open_dev$usbmon(&(0x7f0000000080), 0x3, 0x14ba00) getsockopt$inet6_mreq(r4, 0x29, 0x0, &(0x7f00000017c0)={@empty}, &(0x7f0000001800)=0x14) poll(&(0x7f00000000c0)=[{r8, 0x9112}, {r9}], 0x2, 0x7fff) r10 = memfd_create(&(0x7f0000000340)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\xdenJ\xeb\x87\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\x008\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38\x14\xcb\xfa\xb3j\x92\f\xe0\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xd9w\\\xf0\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xd9\xbd\xd9\xaf\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x2) syz_usb_control_io(r0, &(0x7f00000019c0)={0x2c, &(0x7f0000001840)={0x20, 0x5, 0x79, {0x79, 0x21, "eaa6d12dc3c3f42b0bce90b7daf6233a50d91709a408df634167a4769a187d1a2268019e1457457a65dadfeba20db8c82dc1dfbae7177b6f6624a7f105fca178b08efa7e2269675cd0ef619bdf0f67b0cba29e527d43a3ffc6492933c17e5e269292eafe6bcf0c0ee7a3cd24673d6036841cda07b97956"}}, &(0x7f00000018c0)={0x0, 0x3, 0xf, @string={0xf, 0x3, "828aaf527d946d52ac6af64fad"}}, &(0x7f0000001900)={0x0, 0xf, 0x5, {0x5, 0xf, 0x5}}, &(0x7f0000001940)={0x20, 0x29, 0xf, {0xf, 0x29, 0x0, 0x2, 0x8, 0x0, "9968a870", "a7cac4fa"}}, &(0x7f0000001980)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x6, 0x0, 0x5, 0x4, 0xff, 0x3, 0xf96a}}}, &(0x7f0000001ec0)={0x84, &(0x7f0000001a00)={0x0, 0xa, 0xda, "bb8a218fbcf0a26c28c196c1fab063927b02d8135197068c34f4067d555775481e7100caacc515f1692fdfab2299e748746a7f9df26a6e97ace4437887c9016c3887e479b6fad447a62ad8eea548c92b975fac700c9f3a1750698f5c001b266f9867f53590f2686273f13c057f5186b8830892c8dba6607bed00fb479a0c7e4e1d38ff12de096f8ac088987ca22ccd224365d4a31c5b4a8bf78396e7137bccb117f1e5c4df1b0284e41f7ecccf5968bed34742abe293ccd50e6dfb8ddeed3abe6460ef252f8ece4139eb41762e1021e0ac4c674af65f9f0313b3"}, &(0x7f0000001b00)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000001b40)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000001b80)={0x20, 0x0, 0x4, {0x1, 0x1}}, &(0x7f0000001bc0)={0x20, 0x0, 0x8, {0x120, 0x37, [0xf0]}}, &(0x7f0000001c00)={0x40, 0x7, 0x2, 0xf}, &(0x7f0000001c40)={0x40, 0x9, 0x1, 0x7}, &(0x7f0000001c80)={0x40, 0xb, 0x2, "1744"}, &(0x7f0000001cc0)={0x40, 0xf, 0x2}, &(0x7f0000001d00)={0x40, 0x13, 0x6}, &(0x7f0000001d40)={0x40, 0x17, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, &(0x7f0000001d80)={0x40, 0x19, 0x2, "ca6f"}, &(0x7f0000001dc0)={0x40, 0x1a, 0x2, 0x1}, &(0x7f0000001e00)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000001e40)={0x40, 0x1e, 0x1, 0x5}, &(0x7f0000001e80)={0x40, 0x21, 0x1, 0x60}}) ioctl$UDMABUF_CREATE(r7, 0x40187542, &(0x7f0000000140)={r10, 0x0, 0x4000, 0x4000}) r11 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TCSETS2(r11, 0x402c542b, &(0x7f0000001f80)={0x168, 0xb9b, 0x5, 0x5, 0x7, "939febdae446a3683ac07ff70c1efa5fe23cfd", 0x2, 0x3}) r12 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_GET_EMULATED_CPUID(r12, 0x4018aee3, &(0x7f0000000480)) 71.115226ms ago: executing program 1 (id=542): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) (async) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2c}}, 0x14) (async) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2c}}, 0x14) sendto$inet6(r0, &(0x7f0000000800)="4103082c1116480401020200c52cf7c25975e005b02f000006892f000300897c6b118777faffffff3066090cb600c5471d130a66321a54e7df305fbe258161b6fd8f2428652265d94c6fdbaefc57376a57c2feffff188be9427c323ef024a37016d2a7f9ab6e7941a6fc4f95aa73c1dfff4941f6503b5bd8c91db22cd33795481c94085fa12cdc679ac2a5d7b5d99b93fb07acb0da680e78b74c74aae8d7690d5986a9af81622a0ac210bc7b5ca5fed11cb54d046642670041e846bb184ff5d39fe8516d2d2a8d84e6e7dfcb2b8a8023444db513a3d7a124b59f0a5cd36489dbbb75cce3145d0ea3c3aa21af7cbcbc7a7575db782e757ca543109f5ddcec4930aa91f4119ea3d1f56140cb86cfe0724b23904ef5d05c725ee23918a502b1afe09fb0757d", 0xfc13, 0x880, 0x0, 0xfffffffffffffef0) 0s ago: executing program 1 (id=543): mount$incfs(&(0x7f0000000080)='./cgroup\x00', &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000040), 0xa18082, &(0x7f0000000140)={[{@rlog_wakeup_cnt={'rlog_wakeup_cnt', 0x3d, 0x3}}, {@rlog_pages={'rlog_pages', 0x3d, 0xffffffffffff0001}}]}) kernel console output (not intermixed with test programs): binder_main17rust_binder_ioctl+0x10/0x10 [ 33.840308][ T589] ? is_bpf_text_address+0x17b/0x1a0 [ 33.840332][ T589] ? kernel_text_address+0xa9/0xe0 [ 33.840352][ T589] ? __kernel_text_address+0x11/0x40 [ 33.840371][ T589] ? unwind_get_return_address+0x51/0x90 [ 33.840391][ T589] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 33.840409][ T589] ? arch_stack_walk+0x10a/0x170 [ 33.840434][ T589] ? stack_depot_save_flags+0x38/0x800 [ 33.840459][ T589] ? is_bpf_text_address+0x17b/0x1a0 [ 33.840480][ T589] ? kernel_text_address+0xa9/0xe0 [ 33.840500][ T589] ? __kernel_text_address+0x11/0x40 [ 33.840519][ T589] ? unwind_get_return_address+0x51/0x90 [ 33.840538][ T589] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 33.840555][ T589] ? arch_stack_walk+0x10a/0x170 [ 33.840582][ T589] ? is_bpf_text_address+0x17b/0x1a0 [ 33.840603][ T589] ? kernel_text_address+0xa9/0xe0 [ 33.840623][ T589] ? __kernel_text_address+0x11/0x40 [ 33.840642][ T589] ? unwind_get_return_address+0x51/0x90 [ 33.840660][ T589] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 33.840677][ T589] ? arch_stack_walk+0x10a/0x170 [ 33.840702][ T589] ? stack_depot_save_flags+0x38/0x800 [ 33.840722][ T589] ? stack_trace_save+0xaa/0x100 [ 33.840740][ T589] ? kasan_save_track+0x4f/0x80 [ 33.840764][ T589] ? kasan_save_track+0x3e/0x80 [ 33.840795][ T589] ? kasan_save_alloc_info+0x40/0x50 [ 33.840815][ T589] ? __kasan_slab_alloc+0x73/0x90 [ 33.840830][ T589] ? kmem_cache_alloc_noprof+0x1bf/0x410 [ 33.840852][ T589] ? security_inode_alloc+0x51/0x230 [ 33.840875][ T589] ? inode_init_always_gfp+0x756/0x9e0 [ 33.840899][ T589] ? alloc_inode+0xc5/0x270 [ 33.840914][ T589] ? new_inode+0x25/0x1e0 [ 33.840929][ T589] ? proc_pid_make_inode+0x25/0x140 [ 33.840953][ T589] ? proc_pident_instantiate+0x6d/0x2c0 [ 33.840977][ T589] ? proc_tid_base_lookup+0x2f/0x40 [ 33.840997][ T589] ? path_openat+0x1315/0x34f0 [ 33.841013][ T589] ? do_filp_open+0x1f5/0x440 [ 33.841029][ T589] ? do_sys_openat2+0x134/0x1d0 [ 33.841048][ T589] ? __x64_sys_openat+0x13a/0x170 [ 33.841066][ T589] ? x64_sys_call+0xe69/0x2ee0 [ 33.841089][ T589] ? do_syscall_64+0x57/0xf0 [ 33.841110][ T589] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 33.841134][ T589] ? avc_has_perm_noaudit+0x26c/0x360 [ 33.841156][ T589] ? __asan_memcpy+0x5a/0x80 [ 33.841178][ T589] ? avc_has_perm_noaudit+0x28a/0x360 [ 33.841202][ T589] ? avc_has_perm+0x155/0x240 [ 33.841224][ T589] ? __cfi_avc_has_perm+0x10/0x10 [ 33.841245][ T589] ? kasan_save_alloc_info+0x40/0x50 [ 33.841266][ T589] ? selinux_file_open+0x46c/0x630 [ 33.841287][ T589] ? __cfi_selinux_file_open+0x10/0x10 [ 33.841309][ T589] ? avc_has_extended_perms+0x80b/0xe70 [ 33.841331][ T589] ? __asan_memcpy+0x5a/0x80 [ 33.841352][ T589] ? avc_has_extended_perms+0x969/0xe70 [ 33.841376][ T589] ? __asan_set_shadow_00+0x12/0x20 [ 33.841395][ T589] ? do_vfs_ioctl+0x182d/0x2010 [ 33.841410][ T589] ? arch_stack_walk+0x10a/0x170 [ 33.841433][ T589] ? __ia32_compat_sys_ioctl+0x920/0x920 [ 33.841460][ T589] ? _parse_integer+0x2e/0x40 [ 33.841480][ T589] ? ioctl_has_perm+0x39a/0x500 [ 33.841501][ T589] ? has_cap_mac_admin+0xd0/0xd0 [ 33.841521][ T589] ? proc_fail_nth_write+0x184/0x220 [ 33.841540][ T589] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 33.841560][ T589] ? selinux_file_ioctl+0x732/0x1480 [ 33.841579][ T589] ? vfs_write+0x9a4/0xf90 [ 33.841600][ T589] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 33.841620][ T589] ? __cfi_vfs_write+0x10/0x10 [ 33.841641][ T589] ? __kasan_check_write+0x18/0x20 [ 33.841662][ T589] ? mutex_unlock+0x90/0x240 [ 33.841677][ T589] ? __cfi_mutex_unlock+0x10/0x10 [ 33.841700][ T589] ? __fget_files+0x2c5/0x340 [ 33.841726][ T589] ? __fget_files+0x2c5/0x340 [ 33.841749][ T589] ? bpf_lsm_file_ioctl+0xd/0x20 [ 33.841773][ T589] ? security_file_ioctl+0x3e/0x110 [ 33.841792][ T589] ? __cfi__RNvCskDQVOo9v79Q_16rust_binder_main17rust_binder_ioctl+0x10/0x10 [ 33.841818][ T589] __se_sys_ioctl+0x132/0x1b0 [ 33.841842][ T589] __x64_sys_ioctl+0x7f/0xa0 [ 33.841866][ T589] x64_sys_call+0x1878/0x2ee0 [ 33.841889][ T589] do_syscall_64+0x57/0xf0 [ 33.841909][ T589] ? clear_bhb_loop+0x50/0xa0 [ 33.841930][ T589] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 33.841951][ T589] RIP: 0033:0x7fca0e39c799 [ 33.841967][ T589] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 33.841981][ T589] RSP: 002b:00007fca0f209028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 33.842001][ T589] RAX: ffffffffffffffda RBX: 00007fca0e615fa0 RCX: 00007fca0e39c799 [ 33.842015][ T589] RDX: 0000200000000100 RSI: 00000000c018620c RDI: 0000000000000003 [ 33.842027][ T589] RBP: 00007fca0f209090 R08: 0000000000000000 R09: 0000000000000000 [ 33.842038][ T589] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 33.842050][ T589] R13: 00007fca0e616038 R14: 00007fca0e615fa0 R15: 00007ffcf2378db8 [ 33.842064][ T589] [ 34.423302][ T382] usb 2-1: new full-speed USB device number 6 using dummy_hcd [ 34.579761][ T382] usb 2-1: not running at top speed; connect to a high speed hub [ 34.588268][ T382] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 200, changing to 4 [ 34.602527][ T382] usb 2-1: New USB device found, idVendor=2a39, idProduct=3fb0, bcdDevice= 0.40 [ 34.611608][ T382] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.619683][ T382] usb 2-1: Product: á ‰ [ 34.623890][ T382] usb 2-1: SerialNumber: à   [ 34.668396][ T370] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 34.818392][ T370] usb 4-1: Using ep0 maxpacket: 16 [ 34.825016][ T370] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 34.835341][ T370] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 34.862403][ T370] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 34.871625][ T370] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.879730][ T370] usb 4-1: Product: syz [ 34.883983][ T370] usb 4-1: Manufacturer: syz [ 34.888667][ T370] usb 4-1: SerialNumber: syz [ 34.998417][ T330] Bluetooth: hci0: Frame reassembly failed (-84) [ 35.055970][ T382] usb 2-1: Audio class v2/v3 interfaces need an interface association [ 35.066762][ T382] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 35.078324][ T382] usb 2-1: USB disconnect, device number 6 [ 35.097506][ T370] usb 4-1: 0:2 : does not exist [ 35.105768][ T370] usb 4-1: USB disconnect, device number 7 [ 35.109226][ T342] udevd[342]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 35.132732][ T343] udevd[343]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 35.298593][ T45] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 35.448359][ T45] usb 1-1: Using ep0 maxpacket: 32 [ 35.454763][ T45] usb 1-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 35.466509][ T45] usb 1-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.1e [ 35.475830][ T45] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.483853][ T45] usb 1-1: Product: syz [ 35.488047][ T45] usb 1-1: Manufacturer: syz [ 35.492667][ T45] usb 1-1: SerialNumber: syz [ 35.499161][ T45] asix 1-1:2.0: probe with driver asix failed with error -22 [ 35.818348][ T382] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 35.868338][ T45] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 35.968349][ T382] usb 2-1: Using ep0 maxpacket: 16 [ 35.974659][ T382] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 35.984817][ T382] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 35.995406][ T382] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 36.004594][ T382] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.012890][ T382] usb 2-1: Product: syz [ 36.017051][ T382] usb 2-1: Manufacturer: syz [ 36.021695][ T382] usb 2-1: SerialNumber: syz [ 36.038358][ T45] usb 4-1: Using ep0 maxpacket: 16 [ 36.044718][ T45] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 36.054924][ T45] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 36.067002][ T45] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 36.076217][ T45] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.084570][ T45] usb 4-1: Product: syz [ 36.088799][ T45] usb 4-1: Manufacturer: syz [ 36.093435][ T45] usb 4-1: SerialNumber: syz [ 36.228571][ T382] usb 2-1: 0:2 : does not exist [ 36.235931][ T382] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 36.248613][ T382] usb 2-1: USB disconnect, device number 7 [ 36.302600][ T45] usb 4-1: 0:2 : does not exist [ 36.309491][ T45] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 36.321219][ T45] usb 4-1: USB disconnect, device number 8 [ 36.326439][ T342] udevd[342]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 36.350812][ T343] udevd[343]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card1/controlC1/../uevent} for writing: No such file or directory [ 36.757876][ T36] kauditd_printk_skb: 13 callbacks suppressed [ 36.757896][ T36] audit: type=1400 audit(2000000004.440:206): avc: denied { setattr } for pid=614 comm="syz.1.110" name="/" dev="incremental-fs" ino=153 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 36.850111][ T36] audit: type=1400 audit(2000000004.540:207): avc: denied { setopt } for pid=623 comm="syz.1.113" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 36.870076][ T36] audit: type=1400 audit(2000000004.560:208): avc: denied { connect } for pid=623 comm="syz.1.113" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 36.889472][ T36] audit: type=1400 audit(2000000004.560:209): avc: denied { write } for pid=623 comm="syz.1.113" laddr=fe80::782a:1ff:fe87:cc98 lport=1 faddr=ff02::1 fport=20004 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 36.929777][ T36] audit: type=1400 audit(2000000004.620:210): avc: denied { bind } for pid=625 comm="syz.1.114" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 36.949552][ T36] audit: type=1400 audit(2000000004.630:211): avc: denied { getopt } for pid=625 comm="syz.1.114" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 36.969750][ T36] audit: type=1400 audit(2000000004.630:212): avc: denied { listen } for pid=625 comm="syz.1.114" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 36.990001][ T36] audit: type=1400 audit(2000000004.630:213): avc: denied { create } for pid=625 comm="syz.1.114" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 37.009492][ T36] audit: type=1400 audit(2000000004.630:214): avc: denied { connect } for pid=625 comm="syz.1.114" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 37.030173][ T36] audit: type=1400 audit(2000000004.630:215): avc: denied { setopt } for pid=625 comm="syz.1.114" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 37.038348][ T599] Bluetooth: hci0: command 0x1003 tx timeout [ 37.050093][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 37.061769][ T597] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 37.068644][ T45] usb 1-1: USB disconnect, device number 8 [ 37.268353][ T426] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 37.558357][ T45] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 37.609529][ T640] kvm: pic: level sensitive irq not supported [ 37.654512][ T645] netlink: 'syz.2.122': attribute type 4 has an invalid length. [ 37.676226][ T645] netlink: 'syz.2.122': attribute type 4 has an invalid length. [ 37.710686][ T45] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 37.720954][ T45] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 37.730766][ T45] usb 2-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 37.742086][ T45] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 37.755731][ T45] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 37.764848][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 37.772912][ T45] usb 2-1: SerialNumber: syz [ 37.835007][ T653] capability: warning: `syz.2.125' uses deprecated v2 capabilities in a way that may be insecure [ 37.926080][ T426] usb 4-1: unable to get BOS descriptor or descriptor too short [ 37.928400][ T404] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 37.945043][ T426] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 37.952800][ T426] usb 4-1: can't read configurations, error -71 [ 37.986949][ T45] usb 2-1: 0:2 : does not exist [ 37.992042][ T45] usb 2-1: unit 5 not found! [ 37.998975][ T45] usb 2-1: USB disconnect, device number 8 [ 38.006735][ T342] udevd[342]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 38.037802][ T658] netlink: 'syz.3.127': attribute type 13 has an invalid length. [ 38.089530][ T404] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 38.101204][ T404] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 38.112646][ T404] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 38.124095][ T404] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 38.137117][ T404] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 38.146202][ T404] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 38.154953][ T404] usb 1-1: config 0 descriptor?? [ 38.160531][ T648] raw-gadget.3 gadget.0: fail, usb_ep_enable returned -22 [ 38.501633][ T670] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 38.576153][ T404] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 38.578386][ T426] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 38.582713][ T404] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 38.605149][ T404] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 38.612598][ T404] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 38.620924][ T404] plantronics 0003:047F:FFFF.0002: No inputs registered, leaving [ 38.630225][ T404] plantronics 0003:047F:FFFF.0002: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 38.652262][ T675] netlink: 'syz.1.134': attribute type 4 has an invalid length. [ 38.673559][ T677] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 38.715935][ T681] netlink: 'syz.1.137': attribute type 1 has an invalid length. [ 38.723859][ T681] netlink: 8 bytes leftover after parsing attributes in process `syz.1.137'. [ 38.732962][ T681] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.740180][ T681] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.757361][ T426] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 38.768455][ T426] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 38.779318][ T426] usb 4-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 38.791403][ T426] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 38.800469][ T426] usb 4-1: config 0 descriptor?? [ 38.839915][ T648] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 38.848495][ T648] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 38.858216][ T10] usb 1-1: USB disconnect, device number 9 [ 39.211012][ T426] usbhid 4-1:0.0: can't add hid device: -71 [ 39.217208][ T426] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 39.225024][ T382] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 39.233791][ T426] usb 4-1: USB disconnect, device number 10 [ 39.389386][ T382] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 39.399580][ T382] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 39.408725][ T382] usb 2-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 39.419839][ T382] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 39.435570][ T13] bridge_slave_1: left allmulticast mode [ 39.441404][ T13] bridge_slave_1: left promiscuous mode [ 39.447172][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.455079][ T13] bridge_slave_0: left allmulticast mode [ 39.458978][ T382] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 39.460974][ T13] bridge_slave_0: left promiscuous mode [ 39.475612][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.478391][ T382] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 39.491132][ T382] usb 2-1: SerialNumber: syz [ 39.624706][ T696] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.631885][ T696] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.639146][ T696] bridge_slave_0: entered allmulticast mode [ 39.645487][ T696] bridge_slave_0: entered promiscuous mode [ 39.652878][ T13] veth1_macvtap: left promiscuous mode [ 39.658679][ T13] veth0_vlan: left promiscuous mode [ 39.707138][ T382] usb 2-1: 0:2 : does not exist [ 39.712166][ T382] usb 2-1: unit 5 not found! [ 39.725291][ T696] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.739743][ T382] usb 2-1: USB disconnect, device number 9 [ 39.756148][ T696] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.765991][ T696] bridge_slave_1: entered allmulticast mode [ 39.767239][ T342] udevd[342]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 39.772474][ T696] bridge_slave_1: entered promiscuous mode [ 39.820466][ T703] kvm: pic: level sensitive irq not supported [ 39.845132][ T696] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.858725][ T696] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.865999][ T696] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.873066][ T696] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.881195][ T330] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.888624][ T330] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.910950][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.918128][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.927604][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.934694][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.965967][ T696] veth0_vlan: entered promiscuous mode [ 39.986915][ T696] veth1_macvtap: entered promiscuous mode [ 40.318362][ T45] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 40.334758][ T730] rust_binder: 729 RLIMIT_NICE not set [ 40.334957][ T729] rust_binder: Write failure EINVAL in pid:91 [ 40.478379][ T45] usb 1-1: Using ep0 maxpacket: 32 [ 40.491281][ T45] usb 1-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 40.502926][ T45] usb 1-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.1e [ 40.512084][ T45] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.520146][ T351] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 40.527766][ T45] usb 1-1: Product: syz [ 40.532327][ T45] usb 1-1: Manufacturer: syz [ 40.536960][ T45] usb 1-1: SerialNumber: syz [ 40.543761][ T45] asix 1-1:2.0: probe with driver asix failed with error -22 [ 40.598529][ T404] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 40.679426][ T351] usb 2-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 40.689921][ T351] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 40.705066][ T351] usb 2-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 40.714209][ T351] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.722352][ T351] usb 2-1: Product: syz [ 40.726630][ T351] usb 2-1: Manufacturer: syz [ 40.731316][ T351] usb 2-1: SerialNumber: syz [ 40.746555][ T426] usb 1-1: USB disconnect, device number 10 [ 40.749454][ T404] usb 4-1: config 0 has no interfaces? [ 40.759657][ T404] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 40.768773][ T404] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.776778][ T404] usb 4-1: Product: syz [ 40.781389][ T404] usb 4-1: Manufacturer: syz [ 40.786062][ T404] usb 4-1: SerialNumber: syz [ 40.791881][ T404] usb 4-1: config 0 descriptor?? [ 40.881267][ T738] incfs_lookup_dentry err:-13 [ 40.951844][ T742] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 40.960617][ T742] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 41.050784][ T744] netlink: 8 bytes leftover after parsing attributes in process `syz.3.155'. [ 41.279754][ T746] netlink: 12 bytes leftover after parsing attributes in process `syz.0.160'. [ 41.548379][ T426] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 41.575900][ T752] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 41.584650][ T752] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 41.698359][ T426] usb 1-1: Using ep0 maxpacket: 32 [ 41.704671][ T426] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 41.713076][ T426] usb 1-1: config 0 has no interface number 0 [ 41.719394][ T426] usb 1-1: config 0 interface 184 has no altsetting 0 [ 41.727751][ T426] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 41.736960][ T426] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 41.745238][ T426] usb 1-1: Product: syz [ 41.749503][ T426] usb 1-1: Manufacturer: syz [ 41.754118][ T426] usb 1-1: SerialNumber: syz [ 41.759479][ T426] usb 1-1: config 0 descriptor?? [ 41.765838][ T426] smsc75xx v1.0.0 [ 42.107767][ T36] kauditd_printk_skb: 19 callbacks suppressed [ 42.107786][ T36] audit: type=1326 audit(2000000009.790:235): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=753 comm="syz.2.164" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f40cc79c799 code=0x0 [ 42.768866][ T426] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): EEPROM read operation timeout [ 43.169499][ T426] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 43.180959][ T426] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 43.191343][ T426] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 43.201800][ T426] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 43.211299][ T426] smsc75xx 1-1:0.184: probe with driver smsc75xx failed with error -71 [ 43.220703][ T426] usb 1-1: USB disconnect, device number 11 [ 43.266959][ T351] rtl8150 2-1:1.0: couldn't find required endpoints [ 43.274046][ T351] rtl8150 2-1:1.0: probe with driver rtl8150 failed with error -5 [ 43.284617][ T351] usb 2-1: USB disconnect, device number 10 [ 43.363791][ T404] usb 4-1: USB disconnect, device number 11 [ 43.406336][ T36] audit: type=1400 audit(2000000011.090:236): avc: denied { getopt } for pid=764 comm="syz.1.169" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 43.436249][ T767] netlink: 12 bytes leftover after parsing attributes in process `syz.1.170'. [ 43.482567][ T36] audit: type=1400 audit(2000000011.170:237): avc: denied { write } for pid=771 comm="syz.3.172" name="uinput" dev="devtmpfs" ino=194 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 43.758405][ T351] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 43.818391][ T426] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 43.909511][ T351] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 43.919817][ T351] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 43.929528][ T351] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 43.938904][ T351] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 43.946912][ T351] usb 2-1: SerialNumber: syz [ 43.978429][ T426] usb 4-1: Using ep0 maxpacket: 16 [ 43.984934][ T426] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 43.995143][ T426] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 44.005796][ T426] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 44.014921][ T426] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 44.023120][ T426] usb 4-1: Product: syz [ 44.027304][ T426] usb 4-1: Manufacturer: syz [ 44.032106][ T426] usb 4-1: SerialNumber: syz [ 44.068400][ T404] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 44.219862][ T404] usb 1-1: config 0 has no interfaces? [ 44.226895][ T404] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 44.236170][ T404] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 44.244352][ T404] usb 1-1: Product: syz [ 44.246699][ T426] usb 4-1: 0:2 : does not exist [ 44.249334][ T404] usb 1-1: Manufacturer: syz [ 44.257068][ T426] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 44.258332][ T404] usb 1-1: SerialNumber: syz [ 44.270284][ T351] usb 2-1: 0:2 : does not exist [ 44.270602][ T426] usb 4-1: USB disconnect, device number 12 [ 44.275179][ T351] usb 2-1: unit 5 not found! [ 44.286380][ T404] usb 1-1: config 0 descriptor?? [ 44.294161][ T351] usb 2-1: USB disconnect, device number 11 [ 44.308923][ T343] udevd[343]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card1/controlC1/../uevent} for writing: No such file or directory [ 44.311128][ T342] udevd[342]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 44.545822][ T783] netlink: 8 bytes leftover after parsing attributes in process `syz.0.175'. [ 44.752836][ T36] audit: type=1400 audit(2000000012.440:238): avc: denied { execute } for pid=788 comm="syz.1.178" dev="tmpfs" ino=1031 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 44.752870][ T789] process 'syz.1.178' launched '/dev/fd/3' with NULL argv: empty string added [ 44.785506][ T36] audit: type=1400 audit(2000000012.470:239): avc: denied { execute_no_trans } for pid=788 comm="syz.1.178" path=2F6D656D66643A5B0BDB58AE5B1AA9FDFAADD16D64C8854858A9250C1A65E0202864656C6574656429 dev="tmpfs" ino=1031 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 44.819353][ T792] netlink: 12 bytes leftover after parsing attributes in process `syz.3.179'. [ 45.058595][ T351] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 45.182015][ T803] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 45.188362][ T404] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 45.190619][ T803] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 45.218336][ T351] usb 2-1: Using ep0 maxpacket: 32 [ 45.225815][ T351] usb 2-1: config 0 has an invalid interface number: 188 but max is 0 [ 45.234849][ T351] usb 2-1: config 0 has no interface number 0 [ 45.241125][ T351] usb 2-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 45.252694][ T351] usb 2-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 45.261940][ T351] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 45.270180][ T351] usb 2-1: Product: syz [ 45.274373][ T351] usb 2-1: Manufacturer: syz [ 45.279155][ T351] usb 2-1: SerialNumber: syz [ 45.284303][ T351] usb 2-1: config 0 descriptor?? [ 45.289768][ T794] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 45.358367][ T404] usb 4-1: Using ep0 maxpacket: 32 [ 45.364791][ T404] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 45.375952][ T404] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 45.385856][ T404] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 45.395358][ T404] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 45.404076][ T404] usb 4-1: config 0 descriptor?? [ 45.410101][ T404] hub 4-1:0.0: USB hub found [ 45.497898][ T794] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 45.610754][ T404] hub 4-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 45.846170][ T808] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 45.854954][ T808] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 45.906412][ T36] audit: type=1400 audit(2000000013.590:240): avc: denied { ioctl } for pid=793 comm="syz.1.180" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=8141 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 45.959731][ T351] asix 2-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 45.969995][ T351] asix 2-1:0.188: probe with driver asix failed with error -71 [ 45.978815][ T351] usb 2-1: USB disconnect, device number 12 [ 46.015916][ T36] audit: type=1400 audit(2000000013.700:241): avc: denied { map } for pid=798 comm="syz.3.182" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=9228 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 46.039890][ T36] audit: type=1400 audit(2000000013.700:242): avc: denied { read write } for pid=798 comm="syz.3.182" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=9228 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 46.068519][ T36] audit: type=1400 audit(2000000013.760:243): avc: denied { ioctl } for pid=798 comm="syz.3.182" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 ioctlcmd=0xaf26 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 46.095034][ T799] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=64 sclass=netlink_route_socket pid=799 comm=syz.3.182 [ 46.532030][ T404] usbhid 4-1:0.0: can't add hid device: -71 [ 46.538115][ T404] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 46.548090][ T813] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=24 (48 ns) > initial count (46 ns). Using initial count to start timer. [ 46.570876][ T404] usb 4-1: USB disconnect, device number 13 [ 46.589324][ T818] netlink: 24 bytes leftover after parsing attributes in process `syz.1.188'. [ 46.688734][ T36] audit: type=1326 audit(2000000014.380:244): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=824 comm="syz.2.191" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f40cc79c799 code=0x0 [ 46.825397][ T832] netlink: 4 bytes leftover after parsing attributes in process `syz.1.194'. [ 46.834744][ T832] netlink: 8 bytes leftover after parsing attributes in process `syz.1.194'. [ 46.843020][ T404] usb 1-1: USB disconnect, device number 12 [ 46.972203][ T850] Invalid logical block size (32768) [ 47.099399][ T858] IPv6: NLM_F_CREATE should be specified when creating new route [ 47.135978][ T36] audit: type=1400 audit(2000000014.820:245): avc: denied { accept } for pid=861 comm="syz.0.209" lport=47 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 47.156197][ T36] audit: type=1400 audit(2000000014.820:246): avc: denied { connect } for pid=861 comm="syz.0.209" lport=47 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 47.198371][ T36] audit: type=1400 audit(2000000014.880:247): avc: denied { execute } for pid=866 comm="syz.0.211" path="/dev/ashmem" dev="devtmpfs" ino=201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 47.228359][ T426] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 47.340197][ T871] kvm: pic: level sensitive irq not supported [ 47.379464][ T426] usb 4-1: config 0 has no interfaces? [ 47.397539][ T426] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 47.408712][ T426] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 47.416986][ T426] usb 4-1: Product: syz [ 47.421455][ T426] usb 4-1: Manufacturer: syz [ 47.426305][ T426] usb 4-1: SerialNumber: syz [ 47.431713][ T426] usb 4-1: config 0 descriptor?? [ 47.438382][ T10] usb 1-1: new low-speed USB device number 13 using dummy_hcd [ 47.580652][ T36] audit: type=1400 audit(2000000015.270:248): avc: denied { bind } for pid=880 comm="syz.1.217" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 47.601655][ T36] audit: type=1400 audit(2000000015.270:249): avc: denied { node_bind } for pid=880 comm="syz.1.217" saddr=172.20.20.170 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 47.625577][ T10] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 47.636668][ T10] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 47.646531][ T10] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x82 is Bulk; changing to Interrupt [ 47.656649][ T10] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 47.666461][ T10] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x3 is Bulk; changing to Interrupt [ 47.676438][ T10] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 47.688493][ T10] usb 1-1: string descriptor 0 read error: -22 [ 47.694774][ T10] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 47.698795][ T884] netlink: 8 bytes leftover after parsing attributes in process `syz.3.204'. [ 47.704033][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 47.848346][ T426] usb 2-1: new full-speed USB device number 13 using dummy_hcd [ 47.922836][ T10] cdc_ncm 1-1:1.0: bind() failure [ 47.930378][ T10] cdc_ncm 1-1:1.1: CDC Union missing and no IAD found [ 47.937384][ T10] cdc_ncm 1-1:1.1: bind() failure [ 47.943906][ T10] usb 1-1: USB disconnect, device number 13 [ 47.999720][ T426] usb 2-1: unable to get BOS descriptor or descriptor too short [ 48.007811][ T426] usb 2-1: not running at top speed; connect to a high speed hub [ 48.016297][ T426] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 1024, setting to 1023 [ 48.028772][ T426] usb 2-1: New USB device found, idVendor=0a67, idProduct=5011, bcdDevice= 0.40 [ 48.037955][ T426] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 48.045967][ T426] usb 2-1: Product: syz [ 48.050210][ T426] usb 2-1: Manufacturer: syz [ 48.054828][ T426] usb 2-1: SerialNumber: syz [ 48.263850][ T426] usb 2-1: BAAD HEADPHONE p_chmask mismatch [ 48.271400][ T426] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 48.283068][ T426] usb 2-1: USB disconnect, device number 13 [ 48.318946][ T342] udevd[342]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 48.467726][ T888] ======================================================= [ 48.467726][ T888] WARNING: The mand mount option has been deprecated and [ 48.467726][ T888] and is ignored by this kernel. Remove the mand [ 48.467726][ T888] option from the mount to silence this warning. [ 48.467726][ T888] ======================================================= [ 48.467774][ T36] audit: type=1400 audit(2000000016.150:250): avc: denied { remount } for pid=887 comm="syz.0.219" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 48.503194][ T888] binder: Unknown parameter 'contextÌ' [ 48.532876][ T888] netlink: 12 bytes leftover after parsing attributes in process `syz.0.219'. [ 48.553796][ T36] audit: type=1326 audit(2000000016.240:251): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=890 comm="syz.0.220" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fdbee39c799 code=0x0 [ 48.850039][ T900] netlink: 'syz.1.224': attribute type 4 has an invalid length. [ 49.022854][ T906] incfs_lookup_dentry err:-13 [ 49.090775][ T909] rust_binder: 908 RLIMIT_NICE not set [ 49.090941][ T908] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 49.096490][ T908] rust_binder: Failure BR_FAILED_REPLY { source: EINVAL } during reply - delivering BR_FAILED_REPLY to sender. [ 49.106007][ T908] rust_binder: Transaction failed: BR_TRANSACTION_COMPLETE my_pid:190 [ 49.145531][ T36] audit: type=1326 audit(2000000016.830:252): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=912 comm="syz.1.229" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f901e79c799 code=0x0 [ 49.246880][ T36] audit: type=1400 audit(2000000016.930:253): avc: denied { getopt } for pid=912 comm="syz.1.229" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 49.397114][ T36] audit: type=1400 audit(2000000017.080:254): avc: denied { append } for pid=915 comm="syz.0.230" name="loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 49.638344][ T426] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 49.705490][ T918] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 49.714619][ T918] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 49.788333][ T426] usb 1-1: Using ep0 maxpacket: 16 [ 49.794779][ T426] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 255, changing to 7 [ 49.805884][ T426] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 95, changing to 7 [ 49.819264][ T426] usb 1-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 49.828404][ T426] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 49.836435][ T426] usb 1-1: Product: syz [ 49.840703][ T426] usb 1-1: Manufacturer: syz [ 49.845319][ T426] usb 1-1: SerialNumber: syz [ 50.008065][ T10] usb 4-1: USB disconnect, device number 14 [ 50.238919][ T404] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 50.388340][ T404] usb 2-1: Using ep0 maxpacket: 16 [ 50.394787][ T404] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 50.405037][ T404] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 50.415443][ T404] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 50.424636][ T404] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 50.432674][ T404] usb 2-1: Product: syz [ 50.436848][ T404] usb 2-1: Manufacturer: syz [ 50.441476][ T404] usb 2-1: SerialNumber: syz [ 50.650559][ T404] usb 2-1: 0:2 : does not exist [ 50.655575][ T404] usb 2-1: unit 6 not found! [ 50.662023][ T404] usb 2-1: USB disconnect, device number 14 [ 50.673023][ T343] udevd[343]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 51.488335][ T404] usb 2-1: new full-speed USB device number 15 using dummy_hcd [ 51.639403][ T404] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 51.649801][ T404] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 51.660653][ T404] usb 2-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 51.669812][ T404] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 51.677846][ T404] usb 2-1: Product: syz [ 51.682052][ T404] usb 2-1: Manufacturer: syz [ 51.686662][ T404] usb 2-1: SerialNumber: syz [ 51.718367][ T351] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 51.869423][ T351] usb 4-1: config 0 has no interfaces? [ 51.877088][ T351] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 51.886230][ T351] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 51.894276][ T351] usb 4-1: Product: syz [ 51.898619][ T351] usb 4-1: Manufacturer: syz [ 51.903398][ T351] usb 4-1: SerialNumber: syz [ 51.908931][ T351] usb 4-1: config 0 descriptor?? [ 52.117876][ T10] usb 4-1: USB disconnect, device number 15 [ 52.417160][ T426] usb 1-1: 1:1 : incorrect wMaxPacketSize for BADD profile [ 52.430407][ T426] usb 1-1: incorrect wMaxPacketSize 0x3ff for BADD profile [ 52.440289][ T426] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 52.454911][ T426] usb 1-1: USB disconnect, device number 14 [ 52.468610][ T957] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 52.477147][ T957] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 52.485393][ T36] kauditd_printk_skb: 2 callbacks suppressed [ 52.485410][ T36] audit: type=1400 audit(2000000020.150:257): avc: denied { name_bind } for pid=956 comm="syz.1.246" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 52.513910][ T36] audit: type=1400 audit(2000000020.150:258): avc: denied { read } for pid=956 comm="syz.1.246" path="socket:[10014]" dev="sockfs" ino=10014 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 52.537042][ T36] audit: type=1400 audit(2000000020.150:259): avc: denied { ioctl } for pid=956 comm="syz.1.246" path="socket:[10012]" dev="sockfs" ino=10012 ioctlcmd=0x890d scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 52.567864][ T342] udevd[342]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 52.637726][ T960] Invalid logical block size (32768) [ 52.848351][ T426] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 52.888378][ T10] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 52.998339][ T426] usb 1-1: Using ep0 maxpacket: 16 [ 53.004651][ T426] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 53.015071][ T426] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 53.025722][ T426] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 53.039266][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 53.048338][ T426] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 53.056369][ T426] usb 1-1: Product: syz [ 53.060819][ T426] usb 1-1: Manufacturer: syz [ 53.065661][ T426] usb 1-1: SerialNumber: syz [ 53.070960][ T10] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 53.079256][ T10] usb 4-1: config 0 has no interface number 0 [ 53.085674][ T10] usb 4-1: config 0 interface 184 has no altsetting 0 [ 53.099433][ T10] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 53.109230][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 53.117414][ T10] usb 4-1: Product: syz [ 53.121702][ T10] usb 4-1: Manufacturer: syz [ 53.126369][ T10] usb 4-1: SerialNumber: syz [ 53.138593][ T10] usb 4-1: config 0 descriptor?? [ 53.146029][ T10] smsc75xx v1.0.0 [ 53.197130][ T968] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 53.205819][ T968] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 53.296520][ T426] usb 1-1: 0:2 : does not exist [ 53.305041][ T426] usb 1-1: 5:0: failed to get current value for ch 0 (-22) [ 53.316456][ T426] usb 1-1: USB disconnect, device number 15 [ 53.326212][ T342] udevd[342]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 53.387292][ T36] audit: type=1400 audit(2000000021.070:260): avc: denied { accept } for pid=971 comm="syz.2.251" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 53.437830][ T36] audit: type=1400 audit(2000000021.120:261): avc: denied { shutdown } for pid=971 comm="syz.2.251" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 53.557360][ T978] netlink: 'syz.2.253': attribute type 4 has an invalid length. [ 53.565224][ T978] netlink: 'syz.2.253': attribute type 27 has an invalid length. [ 53.573006][ T978] netlink: 3609 bytes leftover after parsing attributes in process `syz.2.253'. [ 53.759470][ T980] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 53.768186][ T980] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 54.147616][ T10] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): EEPROM read operation timeout [ 54.198329][ T351] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 54.340033][ T998] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=24 (48 ns) > initial count (46 ns). Using initial count to start timer. [ 54.350117][ T999] rust_binder: 996 RLIMIT_NICE not set [ 54.355520][ T351] usb 1-1: Using ep0 maxpacket: 32 [ 54.357405][ T996] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 54.366342][ T996] rust_binder: Failure BR_FAILED_REPLY { source: EINVAL } during reply - delivering BR_FAILED_REPLY to sender. [ 54.371551][ T351] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 54.376008][ T10] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 54.388475][ T351] usb 1-1: config 0 has no interface number 0 [ 54.396355][ T996] rust_binder: Transaction failed: BR_TRANSACTION_COMPLETE my_pid:172 [ 54.407479][ T351] usb 1-1: config 0 interface 184 has no altsetting 0 [ 54.413080][ T10] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 54.422849][ T351] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 54.428503][ T10] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 54.437889][ T351] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 54.462747][ T10] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 54.475316][ T10] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -71 [ 54.475616][ T1002] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 54.487907][ T10] usb 4-1: USB disconnect, device number 16 [ 54.496813][ T351] usb 1-1: Product: syz [ 54.500365][ T1002] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 54.505740][ T351] usb 1-1: Manufacturer: syz [ 54.516449][ T351] usb 1-1: SerialNumber: syz [ 54.517283][ T1002] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 54.529849][ T1002] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 54.552592][ T351] usb 1-1: config 0 descriptor?? [ 54.561556][ T351] smsc75xx v1.0.0 [ 54.561599][ T1004] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 54.574731][ T1004] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 55.094603][ T1009] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 55.103491][ T1009] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 55.113823][ T36] audit: type=1400 audit(2000000022.800:262): avc: denied { create } for pid=1008 comm="syz.2.265" name="file2" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 55.135249][ T36] audit: type=1400 audit(2000000022.820:263): avc: denied { read } for pid=1008 comm="syz.2.265" name="file2" dev="tmpfs" ino=407 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 55.159772][ T10] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 55.174287][ T36] audit: type=1400 audit(2000000022.850:264): avc: denied { open } for pid=1008 comm="syz.2.265" path="/70/file2" dev="tmpfs" ino=407 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 55.214256][ T36] audit: type=1400 audit(2000000022.850:265): avc: denied { ioctl } for pid=1008 comm="syz.2.265" path="/70/file2" dev="tmpfs" ino=407 ioctlcmd=0x583c scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 55.290220][ T351] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 55.301472][ T351] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 55.311664][ T351] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 55.324878][ T351] smsc75xx 1-1:0.184: probe with driver smsc75xx failed with error -71 [ 55.343057][ T351] usb 1-1: USB disconnect, device number 16 [ 55.345961][ T36] audit: type=1400 audit(2000000023.030:266): avc: denied { create } for pid=1013 comm="syz.1.267" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 55.369778][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 55.376056][ T10] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 55.386266][ T10] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 55.397462][ T10] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 55.406743][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 55.415093][ T10] usb 4-1: Product: syz [ 55.420204][ T10] usb 4-1: Manufacturer: syz [ 55.424843][ T10] usb 4-1: SerialNumber: syz [ 55.641406][ T10] usb 4-1: 0:2 : does not exist [ 55.650557][ T10] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 55.663024][ T10] usb 4-1: USB disconnect, device number 17 [ 55.675272][ T342] udevd[342]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 56.037861][ T1032] rust_binder: 1031 RLIMIT_NICE not set [ 56.038053][ T1031] rust_binder: Write failure EINVAL in pid:188 [ 56.057498][ T1034] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 56.072625][ T1034] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 56.168384][ T351] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 56.170226][ T1039] netlink: 4 bytes leftover after parsing attributes in process `syz.3.276'. [ 56.328333][ T351] usb 1-1: Using ep0 maxpacket: 32 [ 56.334545][ T351] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 56.342950][ T351] usb 1-1: config 0 has no interface number 0 [ 56.349165][ T351] usb 1-1: config 0 interface 184 has no altsetting 0 [ 56.357455][ T351] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 56.366574][ T351] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 56.374614][ T351] usb 1-1: Product: syz [ 56.378807][ T351] usb 1-1: Manufacturer: syz [ 56.383417][ T351] usb 1-1: SerialNumber: syz [ 56.388759][ T351] usb 1-1: config 0 descriptor?? [ 56.394653][ T351] smsc75xx v1.0.0 [ 56.468368][ T10] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 56.619439][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 56.630562][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 56.640491][ T10] usb 4-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 56.649867][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 56.659853][ T10] usb 4-1: config 0 descriptor?? [ 56.684960][ T1053] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 56.693663][ T1053] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 56.706149][ T404] usb 2-1: 0:2 : does not exist [ 56.711112][ T404] usb 2-1: unit 3 not found! [ 56.715748][ T404] usb 2-1: unit 64 not found! [ 56.721565][ T404] usb 2-1: 1:2 : does not exist [ 56.727680][ T404] snd-usb-audio 2-1:1.1: probe with driver snd-usb-audio failed with error -16 [ 57.076635][ T1055] netlink: 12 bytes leftover after parsing attributes in process `syz.1.282'. [ 57.076938][ T10] cp2112 0003:10C4:EA90.0003: unknown main item tag 0x0 [ 57.101258][ T10] cp2112 0003:10C4:EA90.0003: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.3-1/input0 [ 57.166007][ T1060] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 57.174631][ T1060] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 57.224435][ T1062] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 57.233063][ T1062] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 57.276849][ T10] cp2112 0003:10C4:EA90.0003: error requesting version [ 57.284847][ T10] cp2112 0003:10C4:EA90.0003: probe with driver cp2112 failed with error -71 [ 57.296237][ T10] usb 4-1: USB disconnect, device number 18 [ 57.398414][ T1029] netlink: 16 bytes leftover after parsing attributes in process `syz.0.272'. [ 57.608585][ T351] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): EEPROM read operation timeout [ 57.706172][ T1064] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 57.714749][ T1064] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 57.723759][ T1064] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 57.732307][ T1065] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 57.733010][ T1064] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 57.740860][ T1065] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 57.809290][ T351] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 57.817768][ T36] kauditd_printk_skb: 8 callbacks suppressed [ 57.817785][ T36] audit: type=1326 audit(2000000025.500:275): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1069 comm="syz.3.288" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fca0e39c799 code=0x0 [ 57.821982][ T1071] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 57.857492][ T351] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 57.858834][ T1071] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 57.867199][ T351] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 57.885567][ T351] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 57.895071][ T351] smsc75xx 1-1:0.184: probe with driver smsc75xx failed with error -71 [ 57.904561][ T351] usb 1-1: USB disconnect, device number 17 [ 58.267935][ T36] audit: type=1400 audit(2000000025.950:276): avc: denied { setopt } for pid=1073 comm="syz.1.289" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 58.269873][ T1074] x_tables: duplicate underflow at hook 4 [ 58.482484][ T1091] fuse: Invalid rootmode [ 58.486816][ T36] audit: type=1400 audit(2000000026.170:277): avc: denied { mounton } for pid=1090 comm="syz.2.296" path="/81/file0" dev="tmpfs" ino=464 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 58.568334][ T10] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 58.718363][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 58.725030][ T10] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 58.733401][ T10] usb 1-1: config 0 has no interface number 0 [ 58.739658][ T10] usb 1-1: config 0 interface 184 has no altsetting 0 [ 58.747791][ T10] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 58.756940][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 58.765024][ T10] usb 1-1: Product: syz [ 58.769294][ T10] usb 1-1: Manufacturer: syz [ 58.773929][ T10] usb 1-1: SerialNumber: syz [ 58.780016][ T10] usb 1-1: config 0 descriptor?? [ 58.785930][ T10] smsc75xx v1.0.0 [ 58.836589][ T36] audit: type=1400 audit(2000000026.520:278): avc: denied { ioctl } for pid=1104 comm="syz.1.301" path="/dev/fuse" dev="devtmpfs" ino=23 ioctlcmd=0xe501 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 58.837330][ T1105] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 58.870118][ T1105] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 59.364523][ T36] audit: type=1326 audit(2000000027.050:279): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1095 comm="syz.2.298" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40cc79c799 code=0x7fc00000 [ 59.388177][ T36] audit: type=1326 audit(2000000027.050:280): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1095 comm="syz.2.298" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f40cc79c799 code=0x7fc00000 [ 59.411538][ T36] audit: type=1326 audit(2000000027.050:281): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1095 comm="syz.2.298" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40cc79c799 code=0x7fc00000 [ 59.435433][ T36] audit: type=1326 audit(2000000027.050:282): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1095 comm="syz.2.298" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40cc79c799 code=0x7fc00000 [ 59.459281][ T36] audit: type=1326 audit(2000000027.050:283): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1095 comm="syz.2.298" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40cc79c799 code=0x7fc00000 [ 59.483738][ T36] audit: type=1326 audit(2000000027.050:284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1095 comm="syz.2.298" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40cc79c799 code=0x7fc00000 [ 59.551059][ T1109] netlink: 'syz.1.303': attribute type 4 has an invalid length. [ 59.566105][ T10] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 59.577318][ T10] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 59.592566][ T10] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 59.609345][ T10] smsc75xx 1-1:0.184: probe with driver smsc75xx failed with error -71 [ 59.617806][ T1111] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=24 (48 ns) > initial count (46 ns). Using initial count to start timer. [ 59.622004][ T10] usb 1-1: USB disconnect, device number 18 [ 59.642340][ T1113] FAULT_INJECTION: forcing a failure. [ 59.642340][ T1113] name failslab, interval 1, probability 0, space 0, times 0 [ 59.656462][ T1113] CPU: 0 UID: 0 PID: 1113 Comm: syz.1.305 Not tainted syzkaller #0 67ca8ba3aa6540f07d3e691c9ce537bd6d0a0d70 [ 59.656496][ T1113] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 59.656509][ T1113] Call Trace: [ 59.656515][ T1113] [ 59.656523][ T1113] __dump_stack+0x21/0x30 [ 59.656553][ T1113] dump_stack_lvl+0x140/0x1c0 [ 59.656577][ T1113] ? __cfi_dump_stack_lvl+0x10/0x10 [ 59.656600][ T1113] dump_stack+0x19/0x20 [ 59.656622][ T1113] should_fail_ex+0x3d7/0x530 [ 59.656645][ T1113] should_failslab+0xac/0x100 [ 59.656662][ T1113] kmem_cache_alloc_node_noprof+0x45/0x420 [ 59.656699][ T1113] ? __alloc_skb+0x108/0x370 [ 59.656718][ T1113] ? kernel_text_address+0xa9/0xe0 [ 59.656741][ T1113] __alloc_skb+0x108/0x370 [ 59.656759][ T1113] ? arch_stack_walk+0x10a/0x170 [ 59.656788][ T1113] alloc_skb_with_frags+0xce/0x8b0 [ 59.656810][ T1113] sock_alloc_send_pskb+0x883/0x9a0 [ 59.656834][ T1113] ? __kasan_check_write+0x18/0x20 [ 59.656859][ T1113] ? __cfi_ref_tracker_alloc+0x10/0x10 [ 59.656886][ T1113] ? __cfi_sock_alloc_send_pskb+0x10/0x10 [ 59.656912][ T1113] packet_sendmsg+0x393d/0x5740 [ 59.656933][ T1113] ? __asan_memcpy+0x5a/0x80 [ 59.656958][ T1113] ? avc_has_perm+0x155/0x240 [ 59.656987][ T1113] ? selinux_socket_sendmsg+0x281/0x380 [ 59.657016][ T1113] ? __cfi_selinux_socket_sendmsg+0x10/0x10 [ 59.657044][ T1113] ? __cfi_packet_sendmsg+0x10/0x10 [ 59.657068][ T1113] ? bpf_lsm_socket_sendmsg+0xd/0x20 [ 59.657095][ T1113] ? security_socket_sendmsg+0x3d/0x100 [ 59.657123][ T1113] ? __cfi_packet_sendmsg+0x10/0x10 [ 59.657146][ T1113] ____sys_sendmsg+0xa8f/0xae0 [ 59.657180][ T1113] ? __import_iovec+0x5ad/0x7c0 [ 59.657197][ T1113] ? __sys_sendmsg_sock+0x50/0x50 [ 59.657220][ T1113] ? import_iovec+0x80/0xb0 [ 59.657237][ T1113] ___sys_sendmsg+0x2a6/0x370 [ 59.657258][ T1113] ? __sys_sendmsg+0x2a0/0x2a0 [ 59.657280][ T1113] ? kstrtouint+0x78/0xf0 [ 59.657303][ T1113] __sys_sendmmsg+0x2b4/0x4e0 [ 59.657325][ T1113] ? __cfi___sys_sendmmsg+0x10/0x10 [ 59.657352][ T1113] ? __cfi_ksys_write+0x10/0x10 [ 59.657377][ T1113] __x64_sys_sendmmsg+0xa4/0xc0 [ 59.657399][ T1113] x64_sys_call+0xfec/0x2ee0 [ 59.657424][ T1113] do_syscall_64+0x57/0xf0 [ 59.657456][ T1113] ? clear_bhb_loop+0x50/0xa0 [ 59.657480][ T1113] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 59.657510][ T1113] RIP: 0033:0x7f901e79c799 [ 59.657532][ T1113] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 59.657548][ T1113] RSP: 002b:00007f901d1f7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 59.657571][ T1113] RAX: ffffffffffffffda RBX: 00007f901ea15fa0 RCX: 00007f901e79c799 [ 59.657587][ T1113] RDX: 0000000000000001 RSI: 0000200000000300 RDI: 0000000000000003 [ 59.657599][ T1113] RBP: 00007f901d1f7090 R08: 0000000000000000 R09: 0000000000000000 [ 59.657611][ T1113] R10: 00000000240400c5 R11: 0000000000000246 R12: 0000000000000001 [ 59.657624][ T1113] R13: 00007f901ea16038 R14: 00007f901ea15fa0 R15: 00007ffefdb19698 [ 59.657640][ T1113] [ 60.113173][ T1132] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 60.121828][ T1132] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 60.428333][ T10] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 60.578349][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 60.584628][ T10] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 60.593006][ T10] usb 1-1: config 0 has no interface number 0 [ 60.599233][ T10] usb 1-1: config 0 interface 184 has no altsetting 0 [ 60.607531][ T10] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 60.616795][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 60.624907][ T10] usb 1-1: Product: syz [ 60.629132][ T10] usb 1-1: Manufacturer: syz [ 60.633912][ T10] usb 1-1: SerialNumber: syz [ 60.642672][ T10] usb 1-1: config 0 descriptor?? [ 60.649659][ T10] smsc75xx v1.0.0 [ 60.842520][ T1151] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 60.868589][ T1151] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 61.038348][ T1160] support for the xor transformation has been removed. [ 61.114746][ T1166] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 61.124403][ T1166] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 61.420118][ T10] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 61.431634][ T10] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 61.441822][ T10] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 61.452300][ T10] smsc75xx 1-1:0.184: probe with driver smsc75xx failed with error -71 [ 61.466633][ T10] usb 1-1: USB disconnect, device number 19 [ 61.651482][ T1177] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 61.660288][ T1177] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 61.852726][ T1188] rust_binder: 1187 RLIMIT_NICE not set [ 61.852952][ T1187] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 61.858783][ T1187] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:296 [ 62.053160][ T1199] kvm: kvm [1198]: vcpu2, guest rIP: 0x9131 Unhandled WRMSR(0x11e) = 0xef4000000000 [ 62.075101][ T1199] kvm: kvm [1198]: vcpu2, guest rIP: 0x9131 Unhandled WRMSR(0x186) = 0xef4000000000 [ 62.084764][ T1199] kvm: kvm [1198]: vcpu2, guest rIP: 0x9131 Unhandled WRMSR(0x187) = 0xef4000000000 [ 62.338343][ T426] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 62.420161][ T1217] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 62.428837][ T1217] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 62.478350][ T426] usb 1-1: device descriptor read/64, error -71 [ 62.723480][ T426] usb 1-1: device descriptor read/64, error -71 [ 62.890615][ T1223] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 62.899858][ T1223] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 62.968371][ T426] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 63.098448][ T426] usb 1-1: device descriptor read/64, error -71 [ 63.145288][ T1234] netlink: 4 bytes leftover after parsing attributes in process `syz.2.353'. [ 63.218373][ T1236] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 63.227030][ T1236] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 63.236611][ T1236] netlink: 'syz.2.354': attribute type 4 has an invalid length. [ 63.245757][ T1236] netlink: 'syz.2.354': attribute type 4 has an invalid length. [ 63.338515][ T426] usb 1-1: device descriptor read/64, error -71 [ 63.437041][ T1240] veth1_to_bond: entered allmulticast mode [ 63.447071][ T1240] veth1_to_bond: left allmulticast mode [ 63.453396][ T426] usb usb1-port1: attempt power cycle [ 63.460744][ T1242] netlink: 8 bytes leftover after parsing attributes in process `syz.1.357'. [ 63.473652][ T1242] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 63.482451][ T1243] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 63.491106][ T1242] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 63.499165][ T1243] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 63.765720][ T36] kauditd_printk_skb: 307 callbacks suppressed [ 63.765741][ T36] audit: type=1400 audit(2000000031.450:592): avc: denied { getopt } for pid=1244 comm="syz.2.358" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 63.798391][ T426] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 63.819501][ T426] usb 1-1: device descriptor read/8, error -71 [ 63.876313][ T36] audit: type=1400 audit(2000000031.560:593): avc: denied { write } for pid=1248 comm="syz.2.359" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 63.957284][ T426] usb 1-1: device descriptor read/8, error -71 [ 64.080325][ T36] audit: type=1400 audit(2000000031.770:594): avc: denied { write } for pid=1255 comm="syz.1.362" name="ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 64.107098][ T1256] vlan1: entered promiscuous mode [ 64.120232][ T1256] vlan1: entered allmulticast mode [ 64.127754][ T1256] veth0_vlan: entered allmulticast mode [ 64.135766][ T1265] Invalid logical block size (32768) [ 64.182042][ T1269] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 64.199342][ T1269] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 64.208392][ T426] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 64.229393][ T426] usb 1-1: device descriptor read/8, error -71 [ 64.359329][ T426] usb 1-1: device descriptor read/8, error -71 [ 64.468425][ T426] usb usb1-port1: unable to enumerate USB device [ 64.655149][ T1277] can0: slcan on ttyS3. [ 64.655380][ T36] audit: type=1400 audit(2000000032.340:595): avc: denied { read } for pid=149 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 64.701353][ T1277] can0 (unregistered): slcan off ttyS3. [ 64.754222][ T36] audit: type=1326 audit(2000000032.440:596): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1287 comm="syz.2.375" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f40cc79c799 code=0x0 [ 64.778387][ T1284] capability: warning: `syz.1.373' uses 32-bit capabilities (legacy support in use) [ 64.880347][ T1293] netlink: 'syz.1.376': attribute type 4 has an invalid length. [ 64.969070][ T36] audit: type=1400 audit(2000000032.660:597): avc: denied { setopt } for pid=1294 comm="syz.1.378" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 65.090380][ T36] audit: type=1326 audit(2000000032.780:598): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1300 comm="syz.1.379" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f901e79c799 code=0x0 [ 65.148337][ T370] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 65.192042][ T36] audit: type=1400 audit(2000000032.880:599): avc: denied { mount } for pid=1300 comm="syz.1.379" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 65.308323][ T370] usb 4-1: Using ep0 maxpacket: 32 [ 65.314705][ T370] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 65.323056][ T370] usb 4-1: config 0 has no interface number 0 [ 65.329298][ T370] usb 4-1: config 0 interface 184 has no altsetting 0 [ 65.337652][ T370] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 65.346808][ T370] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 65.354970][ T370] usb 4-1: Product: syz [ 65.359189][ T370] usb 4-1: Manufacturer: syz [ 65.363970][ T370] usb 4-1: SerialNumber: syz [ 65.369561][ T370] usb 4-1: config 0 descriptor?? [ 65.375527][ T370] smsc75xx v1.0.0 [ 65.392572][ T36] audit: type=1400 audit(2000000033.080:600): avc: denied { write } for pid=1310 comm="syz.0.382" name="loop-control" dev="devtmpfs" ino=48 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 65.416869][ T36] audit: type=1400 audit(2000000033.080:601): avc: denied { open } for pid=1310 comm="syz.0.382" path="/dev/loop-control" dev="devtmpfs" ino=48 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 65.638360][ T694] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 65.788362][ T694] usb 1-1: Using ep0 maxpacket: 16 [ 65.794847][ T694] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 65.805467][ T694] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 65.816245][ T694] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 65.825494][ T694] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 65.833726][ T694] usb 1-1: Product: syz [ 65.837898][ T694] usb 1-1: Manufacturer: syz [ 65.842530][ T694] usb 1-1: SerialNumber: syz [ 65.979207][ T370] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 65.990153][ T370] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 66.012052][ T1319] kvm: pic: level sensitive irq not supported [ 66.051967][ T694] usb 1-1: 0:2 : does not exist [ 66.066152][ T694] usb 1-1: 5:0: failed to get current value for ch 0 (-22) [ 66.079697][ T694] usb 1-1: USB disconnect, device number 24 [ 66.095146][ T343] udevd[343]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card1/controlC1/../uevent} for writing: No such file or directory [ 66.129757][ T1322] FAULT_INJECTION: forcing a failure. [ 66.129757][ T1322] name failslab, interval 1, probability 0, space 0, times 0 [ 66.142773][ T1322] CPU: 0 UID: 0 PID: 1322 Comm: syz.1.387 Not tainted syzkaller #0 67ca8ba3aa6540f07d3e691c9ce537bd6d0a0d70 [ 66.142805][ T1322] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 66.142816][ T1322] Call Trace: [ 66.142823][ T1322] [ 66.142830][ T1322] __dump_stack+0x21/0x30 [ 66.142859][ T1322] dump_stack_lvl+0x140/0x1c0 [ 66.142881][ T1322] ? __cfi_dump_stack_lvl+0x10/0x10 [ 66.142903][ T1322] ? __cfi_avc_has_perm+0x10/0x10 [ 66.142919][ T1322] ? kasan_save_alloc_info+0x40/0x50 [ 66.142934][ T1322] dump_stack+0x19/0x20 [ 66.142948][ T1322] should_fail_ex+0x3d7/0x530 [ 66.142967][ T1322] should_failslab+0xac/0x100 [ 66.142984][ T1322] __kmalloc_cache_noprof+0x41/0x470 [ 66.143009][ T1322] ? vhost_task_create+0x12c/0x400 [ 66.143037][ T1322] ? __cfi_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 66.143055][ T1322] vhost_task_create+0x12c/0x400 [ 66.143070][ T1322] ? __cfi_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 66.143083][ T1322] ? __cfi_vhost_task_create+0x10/0x10 [ 66.143098][ T1322] ? __cfi_vhost_task_fn+0x10/0x10 [ 66.143118][ T1322] ? __kasan_check_write+0x18/0x20 [ 66.143141][ T1322] ? mutex_lock+0x97/0x1d0 [ 66.143168][ T1322] ? __cfi_mutex_lock+0x10/0x10 [ 66.143193][ T1322] ? kernel_text_address+0xa9/0xe0 [ 66.143210][ T1322] kvm_mmu_post_init_vm+0x161/0x300 [ 66.143225][ T1322] kvm_arch_vcpu_ioctl_run+0xf3/0x1bd0 [ 66.143240][ T1322] ? __cfi_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 66.143254][ T1322] ? kstrtoull+0x13b/0x1e0 [ 66.143272][ T1322] ? kstrtouint+0x78/0xf0 [ 66.143292][ T1322] ? ioctl_has_perm+0x1bc/0x500 [ 66.143313][ T1322] ? __asan_memcpy+0x5a/0x80 [ 66.143336][ T1322] ? ioctl_has_perm+0x408/0x500 [ 66.143355][ T1322] ? has_cap_mac_admin+0xd0/0xd0 [ 66.143368][ T1322] ? __kasan_check_write+0x18/0x20 [ 66.143381][ T1322] ? mutex_lock_killable+0x97/0x1d0 [ 66.143392][ T1322] ? __cfi_mutex_lock_killable+0x10/0x10 [ 66.143402][ T1322] ? proc_fail_nth_write+0x184/0x220 [ 66.143433][ T1322] kvm_vcpu_ioctl+0xa48/0x1000 [ 66.143460][ T1322] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 66.143485][ T1322] ? __cfi_vfs_write+0x10/0x10 [ 66.143506][ T1322] ? __kasan_check_write+0x18/0x20 [ 66.143519][ T1322] ? mutex_unlock+0x90/0x240 [ 66.143529][ T1322] ? __cfi_mutex_unlock+0x10/0x10 [ 66.143544][ T1322] ? __fget_files+0x2c5/0x340 [ 66.143562][ T1322] ? __fget_files+0x2c5/0x340 [ 66.143588][ T1322] ? bpf_lsm_file_ioctl+0xd/0x20 [ 66.143606][ T1322] ? security_file_ioctl+0x3e/0x110 [ 66.143627][ T1322] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 66.143650][ T1322] __se_sys_ioctl+0x132/0x1b0 [ 66.143669][ T1322] __x64_sys_ioctl+0x7f/0xa0 [ 66.143684][ T1322] x64_sys_call+0x1878/0x2ee0 [ 66.143699][ T1322] do_syscall_64+0x57/0xf0 [ 66.143716][ T1322] ? clear_bhb_loop+0x50/0xa0 [ 66.143741][ T1322] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 66.143765][ T1322] RIP: 0033:0x7f901e79c799 [ 66.143783][ T1322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 66.143799][ T1322] RSP: 002b:00007f901d1f7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 66.143822][ T1322] RAX: ffffffffffffffda RBX: 00007f901ea15fa0 RCX: 00007f901e79c799 [ 66.143834][ T1322] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 66.143841][ T1322] RBP: 00007f901d1f7090 R08: 0000000000000000 R09: 0000000000000000 [ 66.143849][ T1322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 66.143857][ T1322] R13: 00007f901ea16038 R14: 00007f901ea15fa0 R15: 00007ffefdb19698 [ 66.143869][ T1322] [ 66.400955][ T370] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000010: -71 [ 66.511336][ T370] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to write HW_CFG: -71 [ 66.521048][ T370] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 66.530628][ T370] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -71 [ 66.540220][ T370] usb 4-1: USB disconnect, device number 19 [ 66.592286][ T1326] kvm: pic: level sensitive irq not supported [ 66.673167][ T1335] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 66.687856][ T1335] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 66.977732][ T1346] rust_binder: 1342 RLIMIT_NICE not set [ 66.977872][ T1346] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:173 [ 67.050088][ T1348] netlink: 4 bytes leftover after parsing attributes in process `syz.3.397'. [ 67.282515][ T370] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 67.307311][ T1365] input: syz1 as /devices/virtual/input/input8 [ 67.448327][ T370] usb 1-1: Using ep0 maxpacket: 16 [ 67.457264][ T370] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 67.467963][ T370] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 67.480658][ T370] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 67.490196][ T351] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 67.498043][ T370] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 67.506688][ T370] usb 1-1: Product: syz [ 67.510940][ T370] usb 1-1: Manufacturer: syz [ 67.515556][ T370] usb 1-1: SerialNumber: syz [ 67.658314][ T351] usb 4-1: Using ep0 maxpacket: 32 [ 67.664529][ T351] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 67.672758][ T351] usb 4-1: config 0 has no interface number 0 [ 67.678990][ T351] usb 4-1: config 0 interface 184 has no altsetting 0 [ 67.687061][ T351] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 67.696138][ T351] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 67.704247][ T351] usb 4-1: Product: syz [ 67.708453][ T351] usb 4-1: Manufacturer: syz [ 67.713083][ T351] usb 4-1: SerialNumber: syz [ 67.718558][ T351] usb 4-1: config 0 descriptor?? [ 67.725275][ T370] usb 1-1: 0:2 : does not exist [ 67.730745][ T351] smsc75xx v1.0.0 [ 67.736363][ T370] usb 1-1: 5:0: failed to get current value for ch 0 (-22) [ 67.748028][ T370] usb 1-1: USB disconnect, device number 25 [ 67.762763][ T342] udevd[342]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card1/controlC1/../uevent} for writing: No such file or directory [ 67.799371][ T1382] overlayfs: upperdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 67.813699][ T1382] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 67.829642][ T1382] overlayfs: maximum fs stacking depth exceeded [ 68.021755][ T1393] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 68.030562][ T1393] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 68.040172][ T1393] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 68.048922][ T1393] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 68.326865][ T351] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 68.337858][ T351] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 68.473989][ T1405] binfmt_misc: register: failed to install interpreter file ./cgroup.cpu/cpuset.cpus [ 68.639238][ T1414] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 68.648215][ T1414] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 68.698095][ T1420] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 68.707049][ T1420] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 68.749307][ T351] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000010: -71 [ 68.760352][ T351] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to write HW_CFG: -71 [ 68.770067][ T351] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 68.779744][ T351] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -71 [ 68.788939][ T351] usb 4-1: USB disconnect, device number 20 [ 69.231791][ T36] kauditd_printk_skb: 9 callbacks suppressed [ 69.231811][ T36] audit: type=1400 audit(2000000036.920:611): avc: denied { mounton } for pid=1422 comm="syz.1.426" path="/bus" dev="proc" ino=4026531855 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=dir permissive=1 [ 69.231830][ T1423] overlay: filesystem on ./bus is read-only [ 69.301926][ T36] audit: type=1400 audit(2000000036.990:612): avc: denied { ioctl } for pid=1427 comm="syz.1.428" path="socket:[15251]" dev="sockfs" ino=15251 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 69.333300][ T1432] netlink: 'syz.1.429': attribute type 1 has an invalid length. [ 69.340991][ T36] audit: type=1400 audit(2000000037.030:613): avc: denied { write } for pid=1433 comm="syz.2.430" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 69.361145][ T1432] netlink: 8 bytes leftover after parsing attributes in process `syz.1.429'. [ 69.392536][ T1438] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 69.401284][ T1438] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 69.419785][ T1442] netlink: 1335 bytes leftover after parsing attributes in process `syz.1.434'. [ 69.548345][ T10] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 69.698352][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 69.704750][ T10] usb 4-1: config 1 has an invalid descriptor of length 128, skipping remainder of the config [ 69.715087][ T10] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 69.725331][ T10] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 69.734559][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 69.742744][ T10] usb 4-1: Product: syz [ 69.746901][ T10] usb 4-1: Manufacturer: syz [ 69.751519][ T10] usb 4-1: SerialNumber: syz [ 69.931042][ T1454] Invalid logical block size (32768) [ 69.956764][ T36] audit: type=1400 audit(2000000037.640:614): avc: granted { setsecparam } for pid=1457 comm="syz.2.442" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security [ 69.978054][ T10] usb 4-1: 0:2 : does not exist [ 69.984415][ T1458] rust_binder: 338: no such ref 3 [ 69.989718][ T1458] rust_binder: Write failure EINVAL in pid:338 [ 69.992166][ T10] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 70.013193][ T10] usb 4-1: USB disconnect, device number 21 [ 70.038597][ T342] udevd[342]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card1/controlC1/../uevent} for writing: No such file or directory [ 70.069258][ T1468] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 70.078186][ T1468] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 70.163927][ T36] audit: type=1326 audit(2000000037.850:615): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1463 comm="syz.2.446" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40cc79c799 code=0x7fc00000 [ 70.748328][ T10] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 70.893881][ T36] audit: type=1326 audit(2000000038.580:616): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1463 comm="syz.2.446" exe="/root/syz-executor" sig=0 arch=c000003e syscall=302 compat=0 ip=0x7f40cc79c799 code=0x7fc00000 [ 70.898347][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 70.925411][ T36] audit: type=1326 audit(2000000038.580:617): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1463 comm="syz.2.446" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40cc79c799 code=0x7fc00000 [ 70.951765][ T36] audit: type=1326 audit(2000000038.580:618): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1463 comm="syz.2.446" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40cc79c799 code=0x7fc00000 [ 70.975741][ T36] audit: type=1326 audit(2000000038.580:619): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1463 comm="syz.2.446" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40cc79c799 code=0x7fc00000 [ 70.999394][ T36] audit: type=1326 audit(2000000038.580:620): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1463 comm="syz.2.446" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40cc79c799 code=0x7fc00000 [ 71.006262][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 71.035473][ T10] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 71.058735][ T1476] netlink: 'syz.2.450': attribute type 4 has an invalid length. [ 71.068824][ T10] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 71.088337][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 71.097729][ T10] usb 4-1: config 0 descriptor?? [ 71.104380][ T10] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 71.145607][ T1478] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=24 (48 ns) > initial count (46 ns). Using initial count to start timer. [ 71.313006][ T1486] FAULT_INJECTION: forcing a failure. [ 71.313006][ T1486] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 71.348334][ T1486] CPU: 1 UID: 0 PID: 1486 Comm: syz.0.454 Not tainted syzkaller #0 67ca8ba3aa6540f07d3e691c9ce537bd6d0a0d70 [ 71.348373][ T1486] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 71.348386][ T1486] Call Trace: [ 71.348394][ T1486] [ 71.348402][ T1486] __dump_stack+0x21/0x30 [ 71.348442][ T1486] dump_stack_lvl+0x140/0x1c0 [ 71.348467][ T1486] ? __cfi_dump_stack_lvl+0x10/0x10 [ 71.348493][ T1486] dump_stack+0x19/0x20 [ 71.348516][ T1486] should_fail_ex+0x3d7/0x530 [ 71.348540][ T1486] should_fail+0xf/0x20 [ 71.348562][ T1486] should_fail_usercopy+0x1e/0x30 [ 71.348587][ T1486] _copy_from_iter+0x1a9/0x1510 [ 71.348616][ T1486] ? __virt_addr_valid+0x2a6/0x380 [ 71.348639][ T1486] ? __cfi__copy_from_iter+0x10/0x10 [ 71.348665][ T1486] ? __check_object_size+0x527/0x830 [ 71.348692][ T1486] ? __cfi___check_object_size+0x10/0x10 [ 71.348718][ T1486] ? __cfi_sock_alloc_send_pskb+0x10/0x10 [ 71.348743][ T1486] skb_copy_datagram_from_iter+0x100/0x700 [ 71.348768][ T1486] packet_sendmsg+0x3d18/0x5740 [ 71.348791][ T1486] ? __asan_memcpy+0x5a/0x80 [ 71.348818][ T1486] ? avc_has_perm+0x155/0x240 [ 71.348847][ T1486] ? selinux_socket_sendmsg+0x281/0x380 [ 71.348876][ T1486] ? __cfi_selinux_socket_sendmsg+0x10/0x10 [ 71.348906][ T1486] ? __cfi_packet_sendmsg+0x10/0x10 [ 71.348931][ T1486] ? bpf_lsm_socket_sendmsg+0xd/0x20 [ 71.348960][ T1486] ? security_socket_sendmsg+0x3d/0x100 [ 71.348989][ T1486] ? __cfi_packet_sendmsg+0x10/0x10 [ 71.349011][ T1486] ____sys_sendmsg+0xa8f/0xae0 [ 71.349036][ T1486] ? __import_iovec+0x5ad/0x7c0 [ 71.349054][ T1486] ? __sys_sendmsg_sock+0x50/0x50 [ 71.349079][ T1486] ? import_iovec+0x80/0xb0 [ 71.349097][ T1486] ___sys_sendmsg+0x2a6/0x370 [ 71.349122][ T1486] ? __sys_sendmsg+0x2a0/0x2a0 [ 71.349146][ T1486] ? kstrtouint+0x78/0xf0 [ 71.349174][ T1486] __sys_sendmmsg+0x2b4/0x4e0 [ 71.349199][ T1486] ? __cfi___sys_sendmmsg+0x10/0x10 [ 71.349227][ T1486] ? __cfi_ksys_write+0x10/0x10 [ 71.349255][ T1486] __x64_sys_sendmmsg+0xa4/0xc0 [ 71.349279][ T1486] x64_sys_call+0xfec/0x2ee0 [ 71.349307][ T1486] do_syscall_64+0x57/0xf0 [ 71.349332][ T1486] ? clear_bhb_loop+0x50/0xa0 [ 71.349363][ T1486] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 71.349388][ T1486] RIP: 0033:0x7fdbee39c799 [ 71.349407][ T1486] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 71.349433][ T1486] RSP: 002b:00007fdbef312028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 71.349457][ T1486] RAX: ffffffffffffffda RBX: 00007fdbee615fa0 RCX: 00007fdbee39c799 [ 71.349473][ T1486] RDX: 0000000000000001 RSI: 0000200000000300 RDI: 0000000000000003 [ 71.349487][ T1486] RBP: 00007fdbef312090 R08: 0000000000000000 R09: 0000000000000000 [ 71.349501][ T1486] R10: 00000000240400c5 R11: 0000000000000246 R12: 0000000000000001 [ 71.349514][ T1486] R13: 00007fdbee616038 R14: 00007fdbee615fa0 R15: 00007fff43563b48 [ 71.349532][ T1486] [ 71.454328][ T10] usb 4-1: USB disconnect, device number 22 [ 71.724747][ T1494] syz_tun: entered allmulticast mode [ 71.745791][ T1494] netlink: 36 bytes leftover after parsing attributes in process `syz.0.457'. [ 71.790813][ T1500] rust_binder: 1498 RLIMIT_NICE not set [ 71.791065][ T1498] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 71.796840][ T1498] rust_binder: Failure BR_FAILED_REPLY { source: EINVAL } during reply - delivering BR_FAILED_REPLY to sender. [ 71.806806][ T1498] rust_binder: Transaction failed: BR_TRANSACTION_COMPLETE my_pid:367 [ 71.844845][ T1502] FAULT_INJECTION: forcing a failure. [ 71.844845][ T1502] name failslab, interval 1, probability 0, space 0, times 0 [ 71.866549][ T1502] CPU: 0 UID: 0 PID: 1502 Comm: syz.2.460 Not tainted syzkaller #0 67ca8ba3aa6540f07d3e691c9ce537bd6d0a0d70 [ 71.866581][ T1502] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 71.866593][ T1502] Call Trace: [ 71.866600][ T1502] [ 71.866607][ T1502] __dump_stack+0x21/0x30 [ 71.866636][ T1502] dump_stack_lvl+0x140/0x1c0 [ 71.866669][ T1502] ? __cfi_dump_stack_lvl+0x10/0x10 [ 71.866694][ T1502] dump_stack+0x19/0x20 [ 71.866715][ T1502] should_fail_ex+0x3d7/0x530 [ 71.866738][ T1502] should_failslab+0xac/0x100 [ 71.866754][ T1502] __kmalloc_node_track_caller_noprof+0x68/0x4f0 [ 71.866782][ T1502] ? _RNvYNtNtNtCs1ewLyjEZ7Le_6kernel5alloc9allocator7KmallocNtB6_9Allocator5allocCskDQVOo9v79Q_16rust_binder_main+0xb4/0x200 [ 71.866816][ T1502] krealloc_noprof+0x8d/0x130 [ 71.866840][ T1502] _RNvYNtNtNtCs1ewLyjEZ7Le_6kernel5alloc9allocator7KmallocNtB6_9Allocator5allocCskDQVOo9v79Q_16rust_binder_main+0xb4/0x200 [ 71.866867][ T1502] ? __cfi__RNvYNtNtNtCs1ewLyjEZ7Le_6kernel5alloc9allocator7KmallocNtB6_9Allocator5allocCskDQVOo9v79Q_16rust_binder_main+0x10/0x10 [ 71.866895][ T1502] ? __kasan_check_write+0x18/0x20 [ 71.866918][ T1502] ? _raw_spin_lock+0x92/0x120 [ 71.866941][ T1502] ? __cfi__raw_spin_lock+0x10/0x10 [ 71.866966][ T1502] _RNvMs4_NtCskDQVOo9v79Q_16rust_binder_main7processNtB5_7Process18get_current_thread+0x4c8/0x1be0 [ 71.867011][ T1502] ? __cfi__RNvMs4_NtCskDQVOo9v79Q_16rust_binder_main7processNtB5_7Process18get_current_thread+0x10/0x10 [ 71.867072][ T1502] ? unwind_next_frame+0x3c1/0x750 [ 71.867095][ T1502] ? do_sys_openat2+0x134/0x1d0 [ 71.867116][ T1502] ? do_sys_openat2+0x134/0x1d0 [ 71.867136][ T1502] ? __kernel_text_address+0x11/0x40 [ 71.867159][ T1502] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 71.867179][ T1502] ? arch_stack_walk+0x12c/0x170 [ 71.867206][ T1502] _RNvCskDQVOo9v79Q_16rust_binder_main17rust_binder_ioctl+0x3ef/0x55c0 [ 71.867236][ T1502] ? stack_depot_save_flags+0x38/0x800 [ 71.867263][ T1502] ? __cfi__RNvCskDQVOo9v79Q_16rust_binder_main17rust_binder_ioctl+0x10/0x10 [ 71.867289][ T1502] ? save_stack+0x149/0x240 [ 71.867308][ T1502] ? free_contig_range+0x260/0x260 [ 71.867332][ T1502] ? __reset_page_owner+0x450/0x450 [ 71.867351][ T1502] ? post_alloc_hook+0x3b8/0x3f0 [ 71.867370][ T1502] ? prep_new_page+0x20/0x120 [ 71.867388][ T1502] ? get_page_from_freelist+0x496e/0x4a20 [ 71.867410][ T1502] ? __alloc_pages_noprof+0x35f/0x7e0 [ 71.867432][ T1502] ? alloc_slab_page+0x6b/0x1e0 [ 71.867450][ T1502] ? allocate_slab+0x69/0x420 [ 71.867469][ T1502] ? __kasan_check_write+0x18/0x20 [ 71.867493][ T1502] ? __update_page_owner_handle+0x318/0x370 [ 71.867515][ T1502] ? __kasan_check_write+0x18/0x20 [ 71.867556][ T1502] ? __set_page_owner+0x3fe/0x600 [ 71.867576][ T1502] ? __cfi___set_page_owner+0x10/0x10 [ 71.867596][ T1502] ? kasan_unpoison+0x4a/0x70 [ 71.867623][ T1502] ? post_alloc_hook+0x3b8/0x3f0 [ 71.867652][ T1502] ? __cfi_post_alloc_hook+0x10/0x10 [ 71.867672][ T1502] ? gfp_to_alloc_flags_cma+0x1c0/0x1c0 [ 71.867698][ T1502] ? _raw_spin_trylock+0xb5/0x140 [ 71.867722][ T1502] ? __cfi__raw_spin_trylock+0x10/0x10 [ 71.867752][ T1502] ? is_bpf_text_address+0x17b/0x1a0 [ 71.867778][ T1502] ? kernel_text_address+0xa9/0xe0 [ 71.867801][ T1502] ? __kernel_text_address+0x11/0x40 [ 71.867825][ T1502] ? unwind_get_return_address+0x51/0x90 [ 71.867847][ T1502] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 71.867867][ T1502] ? arch_stack_walk+0x10a/0x170 [ 71.867900][ T1502] ? is_bpf_text_address+0x17b/0x1a0 [ 71.867925][ T1502] ? kernel_text_address+0xa9/0xe0 [ 71.867948][ T1502] ? __kernel_text_address+0x11/0x40 [ 71.867971][ T1502] ? unwind_get_return_address+0x51/0x90 [ 71.867992][ T1502] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 71.868013][ T1502] ? arch_stack_walk+0x10a/0x170 [ 71.868042][ T1502] ? stack_depot_save_flags+0x38/0x800 [ 71.868066][ T1502] ? stack_trace_save+0xaa/0x100 [ 71.868086][ T1502] ? kasan_save_track+0x4f/0x80 [ 71.868113][ T1502] ? kasan_save_track+0x3e/0x80 [ 71.868140][ T1502] ? kasan_save_alloc_info+0x40/0x50 [ 71.868164][ T1502] ? __kasan_slab_alloc+0x73/0x90 [ 71.868182][ T1502] ? kmem_cache_alloc_noprof+0x1bf/0x410 [ 71.868207][ T1502] ? security_inode_alloc+0x51/0x230 [ 71.868235][ T1502] ? inode_init_always_gfp+0x756/0x9e0 [ 71.868269][ T1502] ? alloc_inode+0xc5/0x270 [ 71.868286][ T1502] ? new_inode+0x25/0x1e0 [ 71.868303][ T1502] ? proc_pid_make_inode+0x25/0x140 [ 71.868331][ T1502] ? proc_pident_instantiate+0x6d/0x2c0 [ 71.868360][ T1502] ? proc_pident_lookup+0x1c7/0x270 [ 71.868388][ T1502] ? proc_tid_base_lookup+0x2f/0x40 [ 71.868409][ T1502] ? path_openat+0x1315/0x34f0 [ 71.868429][ T1502] ? do_filp_open+0x1f5/0x440 [ 71.868448][ T1502] ? do_sys_openat2+0x134/0x1d0 [ 71.868469][ T1502] ? __x64_sys_openat+0x13a/0x170 [ 71.868490][ T1502] ? x64_sys_call+0xe69/0x2ee0 [ 71.868516][ T1502] ? do_syscall_64+0x57/0xf0 [ 71.868540][ T1502] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 71.868567][ T1502] ? avc_has_perm_noaudit+0x26c/0x360 [ 71.868593][ T1502] ? __asan_memcpy+0x5a/0x80 [ 71.868616][ T1502] ? avc_has_perm_noaudit+0x28a/0x360 [ 71.868649][ T1502] ? avc_has_perm+0x155/0x240 [ 71.868674][ T1502] ? __cfi_avc_has_perm+0x10/0x10 [ 71.868698][ T1502] ? kasan_save_alloc_info+0x40/0x50 [ 71.868722][ T1502] ? selinux_file_open+0x46c/0x630 [ 71.868745][ T1502] ? __cfi_selinux_file_open+0x10/0x10 [ 71.868770][ T1502] ? avc_has_extended_perms+0x80b/0xe70 [ 71.868795][ T1502] ? __asan_memcpy+0x5a/0x80 [ 71.868819][ T1502] ? avc_has_extended_perms+0x969/0xe70 [ 71.868846][ T1502] ? __asan_set_shadow_00+0x12/0x20 [ 71.868867][ T1502] ? do_vfs_ioctl+0x182d/0x2010 [ 71.868884][ T1502] ? arch_stack_walk+0x10a/0x170 [ 71.868910][ T1502] ? __ia32_compat_sys_ioctl+0x920/0x920 [ 71.868941][ T1502] ? _parse_integer+0x2e/0x40 [ 71.868965][ T1502] ? ioctl_has_perm+0x39a/0x500 [ 71.868988][ T1502] ? has_cap_mac_admin+0xd0/0xd0 [ 71.869011][ T1502] ? proc_fail_nth_write+0x184/0x220 [ 71.869032][ T1502] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 71.869055][ T1502] ? selinux_file_ioctl+0x732/0x1480 [ 71.869077][ T1502] ? vfs_write+0x9a4/0xf90 [ 71.869101][ T1502] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 71.869125][ T1502] ? __cfi_vfs_write+0x10/0x10 [ 71.869150][ T1502] ? __kasan_check_write+0x18/0x20 [ 71.869174][ T1502] ? mutex_unlock+0x90/0x240 [ 71.869192][ T1502] ? __cfi_mutex_unlock+0x10/0x10 [ 71.869219][ T1502] ? __fget_files+0x2c5/0x340 [ 71.869249][ T1502] ? __fget_files+0x2c5/0x340 [ 71.869276][ T1502] ? bpf_lsm_file_ioctl+0xd/0x20 [ 71.869296][ T1502] ? security_file_ioctl+0x3e/0x110 [ 71.869318][ T1502] ? __cfi__RNvCskDQVOo9v79Q_16rust_binder_main17rust_binder_ioctl+0x10/0x10 [ 71.869347][ T1502] __se_sys_ioctl+0x132/0x1b0 [ 71.869377][ T1502] __x64_sys_ioctl+0x7f/0xa0 [ 71.869403][ T1502] x64_sys_call+0x1878/0x2ee0 [ 71.869430][ T1502] do_syscall_64+0x57/0xf0 [ 71.869453][ T1502] ? clear_bhb_loop+0x50/0xa0 [ 71.869478][ T1502] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 71.869501][ T1502] RIP: 0033:0x7f40cc79c799 [ 71.869519][ T1502] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 71.869534][ T1502] RSP: 002b:00007f40cd720028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 71.869559][ T1502] RAX: ffffffffffffffda RBX: 00007f40cca15fa0 RCX: 00007f40cc79c799 [ 71.869575][ T1502] RDX: 0000200000000100 RSI: 00000000c018620c RDI: 0000000000000003 [ 71.869588][ T1502] RBP: 00007f40cd720090 R08: 0000000000000000 R09: 0000000000000000 [ 71.869600][ T1502] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 71.869613][ T1502] R13: 00007f40cca16038 R14: 00007f40cca15fa0 R15: 00007ffdc5b98fa8 [ 71.869630][ T1502] [ 72.689436][ T1518] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 72.698835][ T1518] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 72.878336][ T404] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 73.038355][ T404] usb 1-1: Using ep0 maxpacket: 32 [ 73.044778][ T404] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 73.053369][ T404] usb 1-1: config 0 has no interface number 0 [ 73.059847][ T404] usb 1-1: config 0 interface 184 has no altsetting 0 [ 73.068582][ T404] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 73.077904][ T404] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 73.087525][ T404] usb 1-1: Product: syz [ 73.091824][ T404] usb 1-1: Manufacturer: syz [ 73.096495][ T404] usb 1-1: SerialNumber: syz [ 73.102118][ T404] usb 1-1: config 0 descriptor?? [ 73.107859][ T404] smsc75xx v1.0.0 [ 73.220175][ T1524] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 73.228722][ T1524] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 73.238108][ T1524] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 73.249240][ T1524] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 73.286581][ T1528] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 73.295395][ T1528] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 73.754615][ T404] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 73.765641][ T404] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 73.775355][ T404] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 73.785757][ T404] smsc75xx 1-1:0.184: probe with driver smsc75xx failed with error -71 [ 73.800309][ T404] usb 1-1: USB disconnect, device number 26 [ 73.821351][ T1530] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=576 (2304 ns) > initial count (272 ns). Using initial count to start timer. [ 73.875227][ T1537] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 73.883853][ T1537] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 74.337489][ T36] kauditd_printk_skb: 30 callbacks suppressed [ 74.337509][ T36] audit: type=1400 audit(2000000042.020:651): avc: denied { append } for pid=1549 comm="syz.0.479" name="001" dev="devtmpfs" ino=96 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 74.367210][ T1550] rust_binder: Error while translating object. [ 74.367240][ T1550] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 74.378353][ T1550] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:134 [ 74.422431][ T1554] incfs: Backing dir is not set, filesystem can't be mounted. [ 74.445494][ T1554] incfs: mount failed -2 [ 74.483490][ T36] audit: type=1400 audit(2000000042.170:652): avc: denied { ioctl } for pid=1557 comm="syz.0.483" path="socket:[15993]" dev="sockfs" ino=15993 ioctlcmd=0x7453 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 74.601162][ T1562] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=576 (2304 ns) > initial count (272 ns). Using initial count to start timer. [ 74.828190][ T1580] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 74.844205][ T1580] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 75.128336][ T10] usb 1-1: new low-speed USB device number 27 using dummy_hcd [ 75.145112][ T1583] netlink: 'syz.3.492': attribute type 1 has an invalid length. [ 75.153168][ T1583] netlink: 8 bytes leftover after parsing attributes in process `syz.3.492'. [ 75.241037][ T1587] kvm: pic: level sensitive irq not supported [ 75.279389][ T10] usb 1-1: config 0 has no interfaces? [ 75.291774][ T10] usb 1-1: config 0 has no interfaces? [ 75.298521][ T10] usb 1-1: config 0 has no interfaces? [ 75.309678][ T10] usb 1-1: string descriptor 0 read error: -22 [ 75.315914][ T10] usb 1-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 75.325037][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 75.335637][ T10] usb 1-1: config 0 descriptor?? [ 75.628321][ T10] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 75.820738][ T10] usb 4-1: New USB device found, idVendor=0a92, idProduct=1020, bcdDevice= 0.40 [ 75.882980][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 75.891162][ T10] usb 4-1: Product: syz [ 75.895436][ T10] usb 4-1: Manufacturer: syz [ 75.900943][ T10] usb 4-1: SerialNumber: syz [ 75.919420][ T1597] Invalid logical block size (32768) [ 76.112433][ T10] usb 4-1: MIDIStreaming interface descriptor not found [ 76.123031][ T10] usb 4-1: USB disconnect, device number 23 [ 76.469325][ T351] usb 1-1: USB disconnect, device number 27 [ 76.805063][ T1617] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 76.814299][ T1617] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 76.824071][ T1617] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 76.833166][ T1617] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 76.843889][ T1617] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 76.852886][ T1617] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 76.898563][ T10] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 76.950825][ T1621] netlink: 204 bytes leftover after parsing attributes in process `syz.1.508'. [ 76.958347][ T426] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 76.981278][ T1623] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 76.990711][ T1623] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 77.048389][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 77.054754][ T10] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 77.065080][ T10] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 77.075386][ T10] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 77.084535][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 77.092663][ T10] usb 4-1: Product: syz [ 77.096963][ T10] usb 4-1: Manufacturer: syz [ 77.101611][ T10] usb 4-1: SerialNumber: syz [ 77.108349][ T426] usb 1-1: Using ep0 maxpacket: 32 [ 77.115518][ T426] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 77.123143][ T426] usb 1-1: can't read configurations, error -61 [ 77.258347][ T426] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 77.308598][ T10] usb 4-1: 0:2 : does not exist [ 77.315408][ T10] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 77.327434][ T10] usb 4-1: USB disconnect, device number 24 [ 77.338917][ T342] udevd[342]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card1/controlC1/../uevent} for writing: No such file or directory [ 77.408348][ T426] usb 1-1: Using ep0 maxpacket: 32 [ 77.416491][ T426] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 77.424297][ T426] usb 1-1: can't read configurations, error -61 [ 77.431057][ T426] usb usb1-port1: attempt power cycle [ 77.459683][ T1630] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 77.468893][ T1630] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 77.592071][ T1637] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 77.601358][ T1637] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 77.768357][ T426] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 77.788686][ T426] usb 1-1: Using ep0 maxpacket: 32 [ 77.795217][ T426] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 77.803131][ T426] usb 1-1: can't read configurations, error -61 [ 77.827205][ T1640] netlink: 'syz.3.516': attribute type 4 has an invalid length. [ 77.846838][ T36] audit: type=1400 audit(2000000045.530:653): avc: denied { mount } for pid=1641 comm="syz.3.517" name="/" dev="pstore" ino=2167 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pstore_t tclass=filesystem permissive=1 [ 77.930373][ T36] audit: type=1400 audit(2000000045.620:654): avc: denied { unmount } for pid=290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pstore_t tclass=filesystem permissive=1 [ 77.938333][ T426] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 77.967322][ T1649] support for the xor transformation has been removed. [ 77.979798][ T426] usb 1-1: Using ep0 maxpacket: 32 [ 77.994278][ T426] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 78.002051][ T426] usb 1-1: can't read configurations, error -61 [ 78.009074][ T426] usb usb1-port1: unable to enumerate USB device [ 78.132585][ T1660] netlink: 'syz.3.524': attribute type 4 has an invalid length. [ 78.140403][ T1660] netlink: 'syz.3.524': attribute type 27 has an invalid length. [ 78.148124][ T1660] netlink: 3609 bytes leftover after parsing attributes in process `syz.3.524'. [ 78.171098][ T1662] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 78.180273][ T1662] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 78.528449][ T36] audit: type=1326 audit(2000000046.220:655): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1663 comm="syz.2.526" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f40cc79c799 code=0x0 [ 78.670694][ T1667] FAULT_INJECTION: forcing a failure. [ 78.670694][ T1667] name failslab, interval 1, probability 0, space 0, times 0 [ 78.683983][ T1667] CPU: 0 UID: 0 PID: 1667 Comm: syz.3.527 Not tainted syzkaller #0 67ca8ba3aa6540f07d3e691c9ce537bd6d0a0d70 [ 78.684020][ T1667] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 78.684032][ T1667] Call Trace: [ 78.684038][ T1667] [ 78.684046][ T1667] __dump_stack+0x21/0x30 [ 78.684076][ T1667] dump_stack_lvl+0x140/0x1c0 [ 78.684098][ T1667] ? __cfi_dump_stack_lvl+0x10/0x10 [ 78.684120][ T1667] ? stack_depot_save_flags+0x38/0x800 [ 78.684144][ T1667] dump_stack+0x19/0x20 [ 78.684165][ T1667] should_fail_ex+0x3d7/0x530 [ 78.684186][ T1667] should_failslab+0xac/0x100 [ 78.684203][ T1667] __kmalloc_node_track_caller_noprof+0x68/0x4f0 [ 78.684230][ T1667] ? _RNvYNtNtNtCs1ewLyjEZ7Le_6kernel5alloc9allocator7KmallocNtB6_9Allocator5allocCskDQVOo9v79Q_16rust_binder_main+0xb4/0x200 [ 78.684261][ T1667] krealloc_noprof+0x8d/0x130 [ 78.684322][ T1667] _RNvYNtNtNtCs1ewLyjEZ7Le_6kernel5alloc9allocator7KmallocNtB6_9Allocator5allocCskDQVOo9v79Q_16rust_binder_main+0xb4/0x200 [ 78.684350][ T1667] ? __cfi__RNvYNtNtNtCs1ewLyjEZ7Le_6kernel5alloc9allocator7KmallocNtB6_9Allocator5allocCskDQVOo9v79Q_16rust_binder_main+0x10/0x10 [ 78.684380][ T1667] _RNvMs3_NtCskDQVOo9v79Q_16rust_binder_main6threadNtB5_11ThreadError7try_new+0xc8/0x630 [ 78.684419][ T1667] ? __cfi__RNvMs3_NtCskDQVOo9v79Q_16rust_binder_main6threadNtB5_11ThreadError7try_new+0x10/0x10 [ 78.684450][ T1667] ? _RNvYNtNtNtCs1ewLyjEZ7Le_6kernel5alloc9allocator7KmallocNtB6_9Allocator5allocCskDQVOo9v79Q_16rust_binder_main+0xb4/0x200 [ 78.684478][ T1667] ? krealloc_noprof+0xfa/0x130 [ 78.684501][ T1667] ? _RNvYNtNtNtCs1ewLyjEZ7Le_6kernel5alloc9allocator7KmallocNtB6_9Allocator5allocCskDQVOo9v79Q_16rust_binder_main+0xcb/0x200 [ 78.684528][ T1667] ? __cfi__RNvYNtNtNtCs1ewLyjEZ7Le_6kernel5alloc9allocator7KmallocNtB6_9Allocator5allocCskDQVOo9v79Q_16rust_binder_main+0x10/0x10 [ 78.684555][ T1667] ? __kasan_check_write+0x18/0x20 [ 78.684578][ T1667] ? _raw_spin_lock+0x92/0x120 [ 78.684599][ T1667] ? __cfi__raw_spin_lock+0x10/0x10 [ 78.684622][ T1667] _RNvMs4_NtCskDQVOo9v79Q_16rust_binder_main7processNtB5_7Process18get_current_thread+0x500/0x1be0 [ 78.684662][ T1667] ? __cfi__RNvMs4_NtCskDQVOo9v79Q_16rust_binder_main7processNtB5_7Process18get_current_thread+0x10/0x10 [ 78.684714][ T1667] _RNvCskDQVOo9v79Q_16rust_binder_main17rust_binder_ioctl+0x3ef/0x55c0 [ 78.684745][ T1667] ? __cfi__RNvCskDQVOo9v79Q_16rust_binder_main17rust_binder_ioctl+0x10/0x10 [ 78.684773][ T1667] ? is_bpf_text_address+0x17b/0x1a0 [ 78.684796][ T1667] ? kernel_text_address+0xa9/0xe0 [ 78.684818][ T1667] ? __kernel_text_address+0x11/0x40 [ 78.684838][ T1667] ? unwind_get_return_address+0x51/0x90 [ 78.684857][ T1667] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 78.684876][ T1667] ? arch_stack_walk+0x10a/0x170 [ 78.684902][ T1667] ? stack_depot_save_flags+0x38/0x800 [ 78.684927][ T1667] ? is_bpf_text_address+0x17b/0x1a0 [ 78.684948][ T1667] ? kernel_text_address+0xa9/0xe0 [ 78.684968][ T1667] ? __kernel_text_address+0x11/0x40 [ 78.684988][ T1667] ? unwind_get_return_address+0x51/0x90 [ 78.685006][ T1667] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 78.685023][ T1667] ? arch_stack_walk+0x10a/0x170 [ 78.685050][ T1667] ? is_bpf_text_address+0x17b/0x1a0 [ 78.685071][ T1667] ? kernel_text_address+0xa9/0xe0 [ 78.685090][ T1667] ? __kernel_text_address+0x11/0x40 [ 78.685110][ T1667] ? unwind_get_return_address+0x51/0x90 [ 78.685128][ T1667] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 78.685146][ T1667] ? arch_stack_walk+0x10a/0x170 [ 78.685171][ T1667] ? stack_depot_save_flags+0x38/0x800 [ 78.685192][ T1667] ? stack_trace_save+0xaa/0x100 [ 78.685209][ T1667] ? kasan_save_track+0x4f/0x80 [ 78.685232][ T1667] ? kasan_save_track+0x3e/0x80 [ 78.685255][ T1667] ? kasan_save_alloc_info+0x40/0x50 [ 78.685282][ T1667] ? __kasan_slab_alloc+0x73/0x90 [ 78.685298][ T1667] ? kmem_cache_alloc_noprof+0x1bf/0x410 [ 78.685319][ T1667] ? security_inode_alloc+0x51/0x230 [ 78.685344][ T1667] ? inode_init_always_gfp+0x756/0x9e0 [ 78.685368][ T1667] ? alloc_inode+0xc5/0x270 [ 78.685384][ T1667] ? new_inode+0x25/0x1e0 [ 78.685400][ T1667] ? proc_pid_make_inode+0x25/0x140 [ 78.685423][ T1667] ? proc_pident_instantiate+0x6d/0x2c0 [ 78.685448][ T1667] ? proc_pident_lookup+0x1c7/0x270 [ 78.685471][ T1667] ? proc_tid_base_lookup+0x2f/0x40 [ 78.685492][ T1667] ? path_openat+0x1315/0x34f0 [ 78.685509][ T1667] ? do_filp_open+0x1f5/0x440 [ 78.685526][ T1667] ? do_sys_openat2+0x134/0x1d0 [ 78.685546][ T1667] ? __x64_sys_openat+0x13a/0x170 [ 78.685564][ T1667] ? x64_sys_call+0xe69/0x2ee0 [ 78.685587][ T1667] ? do_syscall_64+0x57/0xf0 [ 78.685608][ T1667] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 78.685631][ T1667] ? avc_has_perm_noaudit+0x26c/0x360 [ 78.685655][ T1667] ? __asan_memcpy+0x5a/0x80 [ 78.685676][ T1667] ? avc_has_perm_noaudit+0x28a/0x360 [ 78.685705][ T1667] ? avc_has_perm+0x155/0x240 [ 78.685728][ T1667] ? __cfi_avc_has_perm+0x10/0x10 [ 78.685749][ T1667] ? kasan_save_alloc_info+0x40/0x50 [ 78.685779][ T1667] ? selinux_file_open+0x46c/0x630 [ 78.685800][ T1667] ? __cfi_selinux_file_open+0x10/0x10 [ 78.685822][ T1667] ? avc_has_extended_perms+0x80b/0xe70 [ 78.685845][ T1667] ? __asan_memcpy+0x5a/0x80 [ 78.685867][ T1667] ? avc_has_extended_perms+0x969/0xe70 [ 78.685890][ T1667] ? __asan_set_shadow_00+0x12/0x20 [ 78.685911][ T1667] ? do_vfs_ioctl+0x182d/0x2010 [ 78.685926][ T1667] ? arch_stack_walk+0x10a/0x170 [ 78.685949][ T1667] ? __ia32_compat_sys_ioctl+0x920/0x920 [ 78.685977][ T1667] ? _parse_integer+0x2e/0x40 [ 78.685998][ T1667] ? ioctl_has_perm+0x39a/0x500 [ 78.686019][ T1667] ? has_cap_mac_admin+0xd0/0xd0 [ 78.686039][ T1667] ? proc_fail_nth_write+0x184/0x220 [ 78.686058][ T1667] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 78.686079][ T1667] ? selinux_file_ioctl+0x732/0x1480 [ 78.686098][ T1667] ? vfs_write+0x9a4/0xf90 [ 78.686119][ T1667] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 78.686140][ T1667] ? __cfi_vfs_write+0x10/0x10 [ 78.686162][ T1667] ? __kasan_check_write+0x18/0x20 [ 78.686183][ T1667] ? mutex_unlock+0x90/0x240 [ 78.686199][ T1667] ? __cfi_mutex_unlock+0x10/0x10 [ 78.686223][ T1667] ? __fget_files+0x2c5/0x340 [ 78.686249][ T1667] ? __fget_files+0x2c5/0x340 [ 78.686272][ T1667] ? bpf_lsm_file_ioctl+0xd/0x20 [ 78.686298][ T1667] ? security_file_ioctl+0x3e/0x110 [ 78.686317][ T1667] ? __cfi__RNvCskDQVOo9v79Q_16rust_binder_main17rust_binder_ioctl+0x10/0x10 [ 78.686343][ T1667] __se_sys_ioctl+0x132/0x1b0 [ 78.686368][ T1667] __x64_sys_ioctl+0x7f/0xa0 [ 78.686392][ T1667] x64_sys_call+0x1878/0x2ee0 [ 78.686416][ T1667] do_syscall_64+0x57/0xf0 [ 78.686437][ T1667] ? clear_bhb_loop+0x50/0xa0 [ 78.686458][ T1667] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 78.686480][ T1667] RIP: 0033:0x7fca0e39c799 [ 78.686497][ T1667] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 78.686512][ T1667] RSP: 002b:00007fca0f209028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 78.686535][ T1667] RAX: ffffffffffffffda RBX: 00007fca0e615fa0 RCX: 00007fca0e39c799 [ 78.686549][ T1667] RDX: 0000200000000100 RSI: 00000000c018620c RDI: 0000000000000003 [ 78.686562][ T1667] RBP: 00007fca0f209090 R08: 0000000000000000 R09: 0000000000000000 [ 78.686574][ T1667] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 78.686585][ T1667] R13: 00007fca0e616038 R14: 00007fca0e615fa0 R15: 00007ffcf2378db8 [ 78.686600][ T1667] [ 78.829850][ T36] audit: type=1400 audit(2000000046.520:656): avc: denied { watch watch_reads } for pid=1671 comm="syz.1.529" path="/178/file0" dev="tmpfs" ino=974 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 79.430441][ T36] audit: type=1400 audit(2000000046.550:657): avc: denied { bind } for pid=1671 comm="syz.1.529" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 79.456469][ T1680] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 79.466878][ T1680] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 79.539712][ T1690] kvm: pic: level sensitive irq not supported [ 79.609457][ T1693] FAULT_INJECTION: forcing a failure. [ 79.609457][ T1693] name failslab, interval 1, probability 0, space 0, times 0 [ 79.628519][ T1693] CPU: 1 UID: 0 PID: 1693 Comm: syz.3.538 Not tainted syzkaller #0 67ca8ba3aa6540f07d3e691c9ce537bd6d0a0d70 [ 79.628554][ T1693] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 79.628563][ T1693] Call Trace: [ 79.628568][ T1693] [ 79.628574][ T1693] __dump_stack+0x21/0x30 [ 79.628595][ T1693] dump_stack_lvl+0x140/0x1c0 [ 79.628609][ T1693] ? __cfi_dump_stack_lvl+0x10/0x10 [ 79.628623][ T1693] dump_stack+0x19/0x20 [ 79.628636][ T1693] should_fail_ex+0x3d7/0x530 [ 79.628651][ T1693] should_failslab+0xac/0x100 [ 79.628662][ T1693] __kmalloc_node_track_caller_noprof+0x68/0x4f0 [ 79.628680][ T1693] ? _RNvYNtNtNtCs1ewLyjEZ7Le_6kernel5alloc9allocator7KmallocNtB6_9Allocator5allocCskDQVOo9v79Q_16rust_binder_main+0xb4/0x200 [ 79.628701][ T1693] krealloc_noprof+0x8d/0x130 [ 79.628717][ T1693] _RNvYNtNtNtCs1ewLyjEZ7Le_6kernel5alloc9allocator7KmallocNtB6_9Allocator5allocCskDQVOo9v79Q_16rust_binder_main+0xb4/0x200 [ 79.628738][ T1693] ? __cfi__RNvYNtNtNtCs1ewLyjEZ7Le_6kernel5alloc9allocator7KmallocNtB6_9Allocator5allocCskDQVOo9v79Q_16rust_binder_main+0x10/0x10 [ 79.628756][ T1693] ? __kasan_check_write+0x18/0x20 [ 79.628770][ T1693] ? _raw_spin_lock+0x92/0x120 [ 79.628784][ T1693] ? __cfi__raw_spin_lock+0x10/0x10 [ 79.628798][ T1693] _RNvMs4_NtCskDQVOo9v79Q_16rust_binder_main7processNtB5_7Process18get_current_thread+0x4c8/0x1be0 [ 79.628826][ T1693] ? __cfi__RNvMs4_NtCskDQVOo9v79Q_16rust_binder_main7processNtB5_7Process18get_current_thread+0x10/0x10 [ 79.628858][ T1693] _RNvCskDQVOo9v79Q_16rust_binder_main17rust_binder_ioctl+0x3ef/0x55c0 [ 79.628877][ T1693] ? __cfi__RNvCskDQVOo9v79Q_16rust_binder_main17rust_binder_ioctl+0x10/0x10 [ 79.628895][ T1693] ? is_bpf_text_address+0x17b/0x1a0 [ 79.628910][ T1693] ? kernel_text_address+0xa9/0xe0 [ 79.628923][ T1693] ? __kernel_text_address+0x11/0x40 [ 79.628936][ T1693] ? unwind_get_return_address+0x51/0x90 [ 79.628950][ T1693] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 79.628961][ T1693] ? arch_stack_walk+0x10a/0x170 [ 79.628978][ T1693] ? stack_depot_save_flags+0x38/0x800 [ 79.628995][ T1693] ? is_bpf_text_address+0x17b/0x1a0 [ 79.629009][ T1693] ? kernel_text_address+0xa9/0xe0 [ 79.629021][ T1693] ? __kernel_text_address+0x11/0x40 [ 79.629034][ T1693] ? unwind_get_return_address+0x51/0x90 [ 79.629047][ T1693] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 79.629058][ T1693] ? arch_stack_walk+0x10a/0x170 [ 79.629075][ T1693] ? is_bpf_text_address+0x17b/0x1a0 [ 79.629089][ T1693] ? kernel_text_address+0xa9/0xe0 [ 79.629102][ T1693] ? __kernel_text_address+0x11/0x40 [ 79.629115][ T1693] ? unwind_get_return_address+0x51/0x90 [ 79.629127][ T1693] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 79.629139][ T1693] ? arch_stack_walk+0x10a/0x170 [ 79.629154][ T1693] ? stack_depot_save_flags+0x38/0x800 [ 79.629168][ T1693] ? stack_trace_save+0xaa/0x100 [ 79.629179][ T1693] ? kasan_save_track+0x4f/0x80 [ 79.629194][ T1693] ? kasan_save_track+0x3e/0x80 [ 79.629209][ T1693] ? kasan_save_alloc_info+0x40/0x50 [ 79.629222][ T1693] ? __kasan_slab_alloc+0x73/0x90 [ 79.629232][ T1693] ? kmem_cache_alloc_noprof+0x1bf/0x410 [ 79.629246][ T1693] ? security_inode_alloc+0x51/0x230 [ 79.629262][ T1693] ? inode_init_always_gfp+0x756/0x9e0 [ 79.629278][ T1693] ? alloc_inode+0xc5/0x270 [ 79.629288][ T1693] ? new_inode+0x25/0x1e0 [ 79.629298][ T1693] ? proc_pid_make_inode+0x25/0x140 [ 79.629314][ T1693] ? proc_pident_instantiate+0x6d/0x2c0 [ 79.629329][ T1693] ? proc_pident_lookup+0x1c7/0x270 [ 79.629344][ T1693] ? proc_tid_base_lookup+0x2f/0x40 [ 79.629357][ T1693] ? path_openat+0x1315/0x34f0 [ 79.629368][ T1693] ? do_filp_open+0x1f5/0x440 [ 79.629379][ T1693] ? do_sys_openat2+0x134/0x1d0 [ 79.629391][ T1693] ? __x64_sys_openat+0x13a/0x170 [ 79.629403][ T1693] ? x64_sys_call+0xe69/0x2ee0 [ 79.629417][ T1693] ? do_syscall_64+0x57/0xf0 [ 79.629431][ T1693] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 79.629447][ T1693] ? avc_has_perm_noaudit+0x26c/0x360 [ 79.629462][ T1693] ? __asan_memcpy+0x5a/0x80 [ 79.629483][ T1693] ? avc_has_perm_noaudit+0x28a/0x360 [ 79.629498][ T1693] ? avc_has_perm+0x155/0x240 [ 79.629513][ T1693] ? __cfi_avc_has_perm+0x10/0x10 [ 79.629527][ T1693] ? kasan_save_alloc_info+0x40/0x50 [ 79.629541][ T1693] ? selinux_file_open+0x46c/0x630 [ 79.629554][ T1693] ? __cfi_selinux_file_open+0x10/0x10 [ 79.629568][ T1693] ? avc_has_extended_perms+0x80b/0xe70 [ 79.629582][ T1693] ? __asan_memcpy+0x5a/0x80 [ 79.629596][ T1693] ? avc_has_extended_perms+0x969/0xe70 [ 79.629611][ T1693] ? __asan_set_shadow_00+0x12/0x20 [ 79.629624][ T1693] ? do_vfs_ioctl+0x182d/0x2010 [ 79.629634][ T1693] ? arch_stack_walk+0x10a/0x170 [ 79.629649][ T1693] ? __ia32_compat_sys_ioctl+0x920/0x920 [ 79.629666][ T1693] ? _parse_integer+0x2e/0x40 [ 79.629680][ T1693] ? ioctl_has_perm+0x39a/0x500 [ 79.629694][ T1693] ? has_cap_mac_admin+0xd0/0xd0 [ 79.629707][ T1693] ? proc_fail_nth_write+0x184/0x220 [ 79.629719][ T1693] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 79.629735][ T1693] ? selinux_file_ioctl+0x732/0x1480 [ 79.629747][ T1693] ? vfs_write+0x9a4/0xf90 [ 79.629761][ T1693] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 79.629774][ T1693] ? __cfi_vfs_write+0x10/0x10 [ 79.629788][ T1693] ? __kasan_check_write+0x18/0x20 [ 79.629801][ T1693] ? mutex_unlock+0x90/0x240 [ 79.629811][ T1693] ? __cfi_mutex_unlock+0x10/0x10 [ 79.629827][ T1693] ? __fget_files+0x2c5/0x340 [ 79.629842][ T1693] ? __fget_files+0x2c5/0x340 [ 79.629857][ T1693] ? bpf_lsm_file_ioctl+0xd/0x20 [ 79.629869][ T1693] ? security_file_ioctl+0x3e/0x110 [ 79.629881][ T1693] ? __cfi__RNvCskDQVOo9v79Q_16rust_binder_main17rust_binder_ioctl+0x10/0x10 [ 79.629897][ T1693] __se_sys_ioctl+0x132/0x1b0 [ 79.629913][ T1693] __x64_sys_ioctl+0x7f/0xa0 [ 79.629929][ T1693] x64_sys_call+0x1878/0x2ee0 [ 79.629943][ T1693] do_syscall_64+0x57/0xf0 [ 79.629956][ T1693] ? clear_bhb_loop+0x50/0xa0 [ 79.629969][ T1693] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 79.629983][ T1693] RIP: 0033:0x7fca0e39c799 [ 79.629995][ T1693] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 79.630005][ T1693] RSP: 002b:00007fca0f209028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 79.630020][ T1693] RAX: ffffffffffffffda RBX: 00007fca0e615fa0 RCX: 00007fca0e39c799 [ 79.630029][ T1693] RDX: 0000200000000100 RSI: 00000000c018620c RDI: 0000000000000003 [ 79.630037][ T1693] RBP: 00007fca0f209090 R08: 0000000000000000 R09: 0000000000000000 [ 79.630045][ T1693] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 79.630052][ T1693] R13: 00007fca0e616038 R14: 00007fca0e615fa0 R15: 00007ffcf2378db8 [ 79.630063][ T1693] [ 80.044019][ T1698] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 80.054739][ T36] audit: type=1400 audit(2000000047.740:658): avc: denied { create } for pid=1694 comm="syz.3.539" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=key permissive=1 [ 80.055944][ T1698] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 80.329626][ T1698] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 80.340049][ T1698] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 80.374571][ T1706] ------------[ cut here ]------------ [ 80.380111][ T1706] WARNING: CPU: 0 PID: 1706 at mm/page_alloc.c:5268 __alloc_pages_noprof+0x109/0x7e0 [ 80.389640][ T1706] Modules linked in: [ 80.393613][ T1706] CPU: 0 UID: 0 PID: 1706 Comm: syz.1.543 Not tainted syzkaller #0 67ca8ba3aa6540f07d3e691c9ce537bd6d0a0d70 [ 80.405255][ T1706] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 80.415418][ T1706] RIP: 0010:__alloc_pages_noprof+0x109/0x7e0 [ 80.421752][ T1706] Code: 00 0f 1f 44 00 00 83 fb 0b 72 28 b8 00 20 00 00 23 44 24 40 75 1d 80 3d 6a 75 0b 06 00 0f 85 c2 00 00 00 c6 05 5d 75 0b 06 01 <0f> 0b 31 c0 e9 b4 00 00 00 83 fb 0a 0f 87 a9 00 00 00 44 8b 64 24 [ 80.441652][ T1706] RSP: 0018:ffffc90000faf860 EFLAGS: 00010246 [ 80.447749][ T1706] RAX: 0000000000000000 RBX: 0000000000000020 RCX: 0000000000000000 [ 80.455769][ T1706] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90000faf918 [ 80.463879][ T1706] RBP: ffffc90000faf988 R08: ffffc90000faf917 R09: 0000000000000000 [ 80.471974][ T1706] R10: ffffc90000faf900 R11: fffff520001f5f23 R12: ffffc90000faf8a0 [ 80.480278][ T1706] R13: dffffc0000000000 R14: 1ffff920001f5f10 R15: 0000000000000000 [ 80.488325][ T1706] FS: 00007f901d1f76c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 80.497578][ T1706] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 80.504190][ T1706] CR2: 0000200000001000 CR3: 000000012607c000 CR4: 00000000003526b0 [ 80.512231][ T1706] Call Trace: [ 80.515519][ T1706] [ 80.518511][ T1706] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 80.524615][ T1706] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 80.530400][ T1706] ? incfs_realloc_mount_info+0xa7/0x4d0 [ 80.536066][ T1706] ___kmalloc_large_node+0x81/0x210 [ 80.541326][ T1706] ? incfs_realloc_mount_info+0xa7/0x4d0 [ 80.547217][ T1706] __kmalloc_large_node_noprof+0x1e/0xd0 [ 80.552901][ T1706] ? incfs_realloc_mount_info+0xa7/0x4d0 [ 80.558588][ T1706] __kmalloc_noprof+0x326/0x500 [ 80.563464][ T1706] ? __cfi_lockref_get+0x10/0x10 [ 80.568481][ T1706] incfs_realloc_mount_info+0xa7/0x4d0 [ 80.573994][ T1706] ? incfs_add_sysfs_node+0x118/0x230 [ 80.579416][ T1706] incfs_alloc_mount_info+0x478/0x5f0 [ 80.584813][ T1706] incfs_mount_fs+0x3ca/0x970 [ 80.588323][ T404] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 80.589535][ T1706] ? __cfi_incfs_mount_fs+0x10/0x10 [ 80.602292][ T1706] ? vfs_parse_fs_string+0x10f/0x180 [ 80.607611][ T1706] ? selinux_capable+0x38/0x50 [ 80.612434][ T1706] legacy_get_tree+0x103/0x1b0 [ 80.617219][ T1706] ? __cfi_incfs_mount_fs+0x10/0x10 [ 80.622540][ T1706] vfs_get_tree+0x9e/0x290 [ 80.626974][ T1706] do_new_mount+0x251/0xb30 [ 80.631540][ T1706] ? security_capable+0x44/0x130 [ 80.636526][ T1706] path_mount+0x682/0x1010 [ 80.641013][ T1706] __se_sys_mount+0x2bf/0x480 [ 80.645803][ T1706] ? __x64_sys_mount+0xf0/0xf0 [ 80.650641][ T1706] __x64_sys_mount+0xc3/0xf0 [ 80.655274][ T1706] x64_sys_call+0x2021/0x2ee0 [ 80.660021][ T1706] do_syscall_64+0x57/0xf0 [ 80.664497][ T1706] ? clear_bhb_loop+0x50/0xa0 [ 80.669402][ T1706] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 80.675343][ T1706] RIP: 0033:0x7f901e79c799 [ 80.679804][ T1706] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 80.699683][ T1706] RSP: 002b:00007f901d1f7028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 80.708223][ T1706] RAX: ffffffffffffffda RBX: 00007f901ea15fa0 RCX: 00007f901e79c799 [ 80.716253][ T1706] RDX: 0000200000000040 RSI: 0000200000000000 RDI: 0000200000000080 [ 80.724282][ T1706] RBP: 00007f901e832c99 R08: 0000200000000140 R09: 0000000000000000 [ 80.732296][ T1706] R10: 0000000000a18082 R11: 0000000000000246 R12: 0000000000000000 [ 80.740350][ T1706] R13: 00007f901ea16038 R14: 00007f901ea15fa0 R15: 00007ffefdb19698 [ 80.748385][ T1706] [ 80.751415][ T1706] ---[ end trace 0000000000000000 ]--- [ 80.757055][ T1706] incfs: Error allocating mount info. -12 [ 80.763327][ T1706] incfs: mount failed -12 [ 80.769716][ T404] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 80.780924][ T404] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 80.791188][ T404] usb 4-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 80.800399][ T404] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 80.809286][ T404] usb 4-1: config 0 descriptor?? [ 81.111317][ T36] audit: type=1400 audit(2000000048.800:659): avc: denied { unmount } for pid=696 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 81.138338][ T696] syz_tun (unregistering): left allmulticast mode [ 81.217626][ T404] cp2112 0003:10C4:EA90.0004: unknown main item tag 0x0 [ 81.228015][ T404] cp2112 0003:10C4:EA90.0004: unknown main item tag 0x0 [ 81.235184][ T404] cp2112 0003:10C4:EA90.0004: unknown main item tag 0x0 [ 81.242332][ T404] cp2112 0003:10C4:EA90.0004: unknown main item tag 0x0 [ 81.249481][ T404] cp2112 0003:10C4:EA90.0004: unknown main item tag 0x0 [ 81.256444][ T404] cp2112 0003:10C4:EA90.0004: unknown main item tag 0x0 [ 81.263765][ T404] cp2112 0003:10C4:EA90.0004: unknown main item tag 0x0 [ 81.278489][ T404] cp2112 0003:10C4:EA90.0004: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.3-1/input0 [ 81.417087][ T404] cp2112 0003:10C4:EA90.0004: Part Number: 0x82 Device Version: 0xFE [ 81.822519][ T404] cp2112 0003:10C4:EA90.0004: error setting SMBus config [ 81.838842][ T404] cp2112 0003:10C4:EA90.0004: probe with driver cp2112 failed with error -71 [ 81.853625][ T404] usb 4-1: USB disconnect, device number 25