last executing test programs: 5.323032871s ago: executing program 2 (id=586): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x2, &(0x7f0000000040)=0x40, 0x4) sendto$inet6(r0, &(0x7f00000002c0)="0593cb862fba9b3207337dcd91224d8c59236a60dec7d76e95e09ebf9f8877cae2dd92718a5e78fad5fa5e3ea6e57a2ba2fcedc4aff08c3ef9193894db2d08703b5aaf29375532920a27fcd07a1d0027535bbc94972c477beed690aee2673091c34039aa392e429e87425df21a461cb09d001af5436c3bce5e819eb126d42ced5735165828b3090bbaaca0870cfbd60241af45e49376b4bba82f832e48f4fceaf8c7eed38c8cc0422ada7f8ba682d3b9843fbf0aa6a5109db219a7ddd437dddcf56f7757fe37caf2507683703c255fe93cc907ecd20bb8b315db403687c9eaf1685547", 0xe3, 0x14000000, &(0x7f00000003c0)={0xa, 0x4e21, 0x5a1, @loopback, 0x7f2}, 0x1c) keyctl$KEYCTL_PKEY_VERIFY(0x1c, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="656e633d6f61657020686173683df7"], 0x0, 0x0) keyctl$KEYCTL_PKEY_QUERY(0x18, 0x0, 0x0, &(0x7f0000000080)=' hash=', 0x0) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000240), 0x800, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000000400)) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="440000000101010100000000000000000200000004000180180002801400018008000100b04c94a708000200ac1414aa140019800800010004000000080002"], 0x44}}, 0x4000) syz_usb_connect$midi(0x0, 0x31, &(0x7f0000000100)=ANY=[@ANYRESHEX=r0, @ANYRES8=r0, @ANYRES8=r0, @ANYRES8=r2, @ANYBLOB="57090f24a5ac5dd329c7b2b27c78ee12c6e1273fe8edc36e1c25d5d78194ced2ca43efb096985a8f1bb27ef417babc8770c81f7ef8790009a84c032f93015145efa151c7fe42f4c8742b5b30fd394e56c8e164436993be6aee76e3131d83493199023790ca20114659d200e57e999bfe9e631379e44f3d7b812d13f558f96acb2a01701fbf804880f35b195a7b8585d6669732de614a3ca7c3d47b4b0de414b7df001ceb31ef4ed9f4cdca5f3401965b7405ac9815fa55568b7e86fefbcbc29974e757d143367ee511b0789dd96cde4262db4fbd5d5f8e36c9e4ebb3a67d4d49258ef8c1191383beab2ee87f"], 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000000)={@local, 0x400}, 0x20) 3.141881064s ago: executing program 1 (id=600): r0 = socket(0x10, 0x802, 0x0) write(r0, &(0x7f0000000140)="fc00000018000703ab092500090007000a070000000000060000369321000700ff2500000005d00000000000000398996c92773411419da79bb94b46fe00006cf0abbb0000036c6c256f1a272f2e117c22ebc205214000000000008934d07302ad031720d7d5bbc91a3e2e80772c05defd5a32e280fc83ab00f605f70c9ddefefe082038f4f8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f295ed94e0ad91bd0734babc7c3f2eeb57d43dd16b17e583df150c3b880f411f46a6b567b4d5715587e658a1ad0a4f01731d05b0350b0041f0d48f6f0000080548deac270e33429fd3000175e63fb8d38a873cf1587c3b41", 0xfc) (async) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000380), 0x80100, 0x0) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2, 0x10, r1, 0x68c8f000) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) (async) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r3, 0x29, 0x2, &(0x7f0000000040)=0x2, 0x4) (async) getsockopt$inet6_buf(r3, 0x29, 0x6, &(0x7f0000000080)=""/21, &(0x7f0000000240)=0x15) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000580)={'xfrm0\x00', 0x0}) (async) r5 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$sock_int(r5, 0x1, 0x21, &(0x7f00000002c0)=0x101, 0x26) sendmsg$can_raw(r5, &(0x7f0000000300)={&(0x7f0000000800)={0x1d, r4}, 0x10, &(0x7f0000000880)={&(0x7f0000000240)=@canfd={{0x3}, 0x19, 0x0, 0x0, 0x0, "9a24167cba893ffab5569100e4dbaad451ec0779fccf1baab043d01ec54368bd8a0314dad16c03f5b82fb833488a9c4ef2a50b971ca9945113253001fc93ad16"}, 0x48}}, 0x8000) (async) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r0, 0x28, 0x0, &(0x7f0000000100)=0xb, 0x8) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x80040, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) bind$unix(r9, &(0x7f0000000400)=@abs={0x1, 0x0, 0x4e21}, 0x6e) (async) listen(r9, 0x0) (async) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) syz_clone3(&(0x7f0000000080)={0x180801400, &(0x7f0000000000)=0xffffffffffffffff, 0x0, 0x0, {0x3d}, 0x0, 0x0, 0x0, 0x0}, 0x58) pidfd_send_signal(r10, 0x21, 0x0, 0x0) (async) waitid$P_PIDFD(0x3, r10, 0x0, 0x40000004, 0x0) pidfd_getfd(r10, r10, 0x0) (async) r11 = socket$unix(0x1, 0x1, 0x0) connect$unix(r11, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) (async) sendmmsg$unix(r11, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000240)="b2", 0x1}], 0x1, &(0x7f0000000040)=ANY=[@ANYBLOB="14"], 0x18, 0xc00c890}}], 0x1, 0x20000001) syz_usb_connect(0x3, 0x62, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000fb5d7d086d04c308166b0102030109025000010000000009041f0000ff0100000a24010400050201020724070500000508240805040004960d24060101030200010006000609240305050306058109240306010304050507240405"], 0x0) (async) ioctl$KVM_GET_STATS_FD_cpu(r8, 0xaece) 3.035154836s ago: executing program 1 (id=602): bind$tipc(0xffffffffffffffff, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(0xffffffffffffffff, 0x0, 0x4) syz_usb_connect$uac3(0x5, 0x80, &(0x7f0000000080)=ANY=[@ANYBLOB="12010003000000401e04373240000102030109026e000301635002080b0002010130020904000600010130"], &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0}) 2.230826616s ago: executing program 2 (id=608): sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4004080, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c00000010008100000000000080000000000000", @ANYRES32=0x0, @ANYBLOB="0a043cbf", @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c00000010008100000000000080000000000000", @ANYRES32=0x0, @ANYBLOB="1f"], 0x2c}], 0x1}, 0x0) 1.6403109s ago: executing program 0 (id=609): openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) socket$netlink(0x10, 0x3, 0x0) 1.63455649s ago: executing program 1 (id=610): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) (async) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_ABS_SETUP(r1, 0x401c5504, &(0x7f0000000080)={0x2f, {0x8000008, 0x127, 0x200100, 0xd, 0xffc, 0x5}}) write$UHID_INPUT(r0, 0x0, 0x0) r2 = fsmount(0xffffffffffffffff, 0x0, 0x85) r3 = socket(0x8000000010, 0x2, 0x0) clock_settime(0x3, 0x0) write(r3, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc) socket$inet(0x2, 0x4000000000000001, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) (async) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r5, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="6c00000066001f03"], 0x6c}], 0x1}, 0x0) fspick(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) (async) r6 = fspick(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) close_range(r5, r6, 0x0) dup3(r5, r2, 0x0) (async) dup3(r5, r2, 0x0) unlinkat(r0, &(0x7f00000000c0)='./file0\x00', 0x200) writev(r4, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) 1.570764542s ago: executing program 2 (id=611): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) (async) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) writev(r3, &(0x7f0000000100)=[{&(0x7f0000000a40)="2e9b3d0007e03dd651930100c575963f886411", 0x13}, {&(0x7f0000000140)='\x00\x00\x00\x00\x00\x00W', 0x7}], 0x2) (async) r4 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@wrmsr={0x65, 0x20, {0x40000000, 0x1}}], 0x20}) ioctl$KVM_RUN(r4, 0xae80, 0x0) (async) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r6 = socket(0x2b, 0x3, 0x0) (async) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000000)={'\x00', 0x5}) (async, rerun: 32) ioctl$TUNSETLINK(r7, 0x400454cd, 0x1) (async, rerun: 32) sendmsg$nl_generic(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="480000001900010000000000fbdbdf650a0109001000128004001d8108001e000000fa"], 0x48}, 0x1, 0x0, 0x0, 0x5}, 0x0) (async) setsockopt$bt_l2cap_L2CAP_LM(r5, 0x6, 0x3, &(0x7f0000000000)=0x46, 0x4) 1.335104988s ago: executing program 0 (id=612): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000d40)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x4, 0x0, {{@in=@empty, @in=@rand_addr=0x64010101, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x32, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x9}, {0x0, 0xa00, 0x40800000000000, 0x800000000004000}, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000c80)=ANY=[@ANYBLOB="bc000000210001000000000000000000fc02000000003a000000000000000000fc02000000000000000000010000000100000000000000000200002000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000500011"], 0xbc}}, 0x0) 1.144067952s ago: executing program 1 (id=613): mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) r0 = accept4$unix(0xffffffffffffffff, &(0x7f0000000240)=@abs, &(0x7f00000001c0)=0x6e, 0x80800) r1 = openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x44080, 0x11) mknodat(r1, &(0x7f00000003c0)='./file1/file0\x00', 0x2, 0xd) connect$unix(r0, &(0x7f0000000340)=@abs={0x1, 0x0, 0x4e23}, 0x6e) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r2 = gettid() getpgid(r2) r3 = open(&(0x7f0000000040)='./file0\x00', 0x400, 0x43) mknodat$loop(r3, &(0x7f0000000200)='./file1\x00', 0x800, 0x1) landlock_create_ruleset(0x0, 0x0, 0x3) r4 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x718bb647156ec3b7) chdir(&(0x7f0000000000)='./bus\x00') linkat(r4, &(0x7f0000000100)='./file1\x00', r4, &(0x7f0000000180)='./file0\x00', 0x1000) rename(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./bus\x00') open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x190) 1.090963064s ago: executing program 0 (id=614): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="90010000100013070000000000000000ff010000000000000000000000000001000000000000000000001f0000000001000000000000ffff0000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffffff000000000000000000000000000004d432000000ac1e0001000000000000000000000000000000000000000009000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000002000400000000000000000048000200656362286369706865725f6e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000005800010078636263286165732900"], 0x190}, 0x1, 0x0, 0x0, 0x40}, 0x40082) 1.090584514s ago: executing program 2 (id=615): setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40e41, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller1\x00', 0xc201}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100bb8001400000060ec97000fc83c00fe8000000000000000000000000000aaff02000000000000000000000001000111"], 0xffe) 970.774136ms ago: executing program 3 (id=616): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r0, 0x200, 0x70bd2b, 0x25dfdbfb, {{}, {@void, @void, @void}}, [@NL80211_ATTR_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40840}, 0x1) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000240)={'gre0\x00', &(0x7f00000001c0)={'gretap0\x00', 0x0, 0x1, 0x7, 0x87, 0x9, {{0xc, 0x4, 0x2, 0x3f, 0x30, 0x65, 0x0, 0x23, 0x29, 0x0, @private=0xa010102, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_prespec={0x44, 0x1c, 0x8, 0x3, 0xc, [{@multicast2, 0x6}, {@multicast2, 0xfffffa1f}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0xed}]}]}}}}}) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x68, r1, 0x20, 0x70bd2a, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x3c, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xb}]}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000380), 0x40080, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000400)={{{@in=@loopback, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}}}, &(0x7f0000000500)=0xe8) sendmsg$nl_generic(r3, &(0x7f0000000680)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000640)={&(0x7f0000000540)={0xec, 0x32, 0x100, 0x70bd2c, 0x25dfdbfd, {0x20}, [@generic="a200c96cd764ae40a05b7c0ef86d102f378d68140cde387def35a0ddc168f04ceaedd5d5dbf35fd705d0139497bce9957f5cd8ca1a444742138878ccc4220eb743872a86ab0c4782eeb3cb5b62cd85e11bb95ba5ec907e3239fbaba501e5207ef73e770686806b8749c1d03e", @generic="7406f09351c3a66c75d038f1d45b5e87933ca27e7def91e92c9f1b970e40b588269f29ab01fa86a0b79bd657a2d946bcc74cd9320168ec5714f5c79846636a6d620b902a2ee11945dd692b4813c483793113", @typed={0x8, 0x9, 0x0, 0x0, @ipv4=@rand_addr=0x64010101}, @typed={0x6, 0xf, 0x0, 0x0, @str='[\x00'}, @typed={0x8, 0xd4, 0x0, 0x0, @uid=r5}]}, 0xec}, 0x1, 0x0, 0x0, 0x8000}, 0x20008000) write(r3, &(0x7f00000006c0)="565220383a74f99b2791b6c9a272a2a596272f9bf191c2b4d50aefa301e6e3c2191e4fbefbc690761ab2fba619e69454cf021ed142aeba48e769784729d453d18d8bd9773c017f9869b119d125dee080a733033429f23351287a24d4e2f44b45e86e67d15d098d0df92897eb7ec51a22e775002052deb00a98e0045e7bbd4af0", 0x80) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000780), r3) sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(r3, &(0x7f00000009c0)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000980)={&(0x7f00000007c0)={0x1c0, r6, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0x8e, 0x2}, {0xc, 0x8f, 0x5}, {0xc, 0x90, 0xe4e}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x2}, {0xc, 0x8f, 0xb6}, {0xc, 0x90, 0x6ec}}, {@pci={{0x8}, {0x11}}, {0x8}, {0xc}, {0xc, 0x90, 0x8000}}, {@pci={{0x8}, {0x11}}, {0x8, 0x8e, 0x9aeb57ac6dbc3cff}, {0xc, 0x8f, 0x3}, {0xc, 0x90, 0x3}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}, {0xc, 0x8f, 0x1}, {0xc, 0x90, 0x8}}, {@pci={{0x8}, {0x11}}, {0x8, 0x8e, 0x2}, {0xc, 0x8f, 0x7}, {0xc, 0x90, 0x1}}, {@pci={{0x8}, {0x11}}, {0x8, 0x8e, 0x1}, {0xc, 0x8f, 0x5}, {0xc, 0x90, 0x2}}]}, 0x1c0}, 0x1, 0x0, 0x0, 0x40080}, 0x4008050) r7 = socket$inet_udplite(0x2, 0x2, 0x88) r8 = pidfd_getfd(r3, r3, 0x0) sendmsg$netlink(r3, &(0x7f0000002840)={&(0x7f0000000a00)=@proc={0x10, 0x0, 0x25dfdbfd, 0x800}, 0xc, &(0x7f00000027c0)=[{&(0x7f0000000a40)={0x2b4, 0x21, 0x8, 0x70bd25, 0x25dfdbfc, "", [@nested={0x110, 0xe2, 0x0, 0x1, [@generic="86ece2059cb2f451fa4972fa0fec1815fd34a22c93f80dcab03258f24c9554bd7291d45435fa10bfb59aede506afd7464ea2655934b9777710", @typed={0x8, 0x57, 0x0, 0x0, @ipv4=@private=0xa010100}, @generic="307bc4dd309e774b95ac794b08675ab612385dadfeeb43922b9144de099f6c2cbb1553b692588513bd1e401dd92fb7b52271e9feaaec15e7c46c339ef07f0f3e9aca95f66b06135e3c11acf8efd7ae9291d2758d127d4d2456c0997e5417167643fd181ce8f7b6f0aecb568aff8e31a64492ab687305b7d95339c94236991d9a57fbb7d557d0395319100e1253585d8a9310ff73d4a0c166bf704394a5acaba6fe293304bcdc46b9d8fe7ca4c6cc8c8343c3ce9eb3baaf434496777acc66b8640ba0fb4b06db0a", @nested={0x4, 0xc9}]}, @typed={0x8, 0x27, 0x0, 0x0, @fd=r3}, @nested={0xe0, 0x19, 0x0, 0x1, [@typed={0x8, 0x12d, 0x0, 0x0, @uid=r5}, @typed={0x8, 0x125, 0x0, 0x0, @fd=r3}, @typed={0xc9, 0x5b, 0x0, 0x0, @binary="ffb2d65fa3cd8f41bf1621933c5818370b3fa375b076b7f7ddf1baa874e7a451d973dfb0ea5a60bf60d1b1659d458d5c1d8ced7bdb06c3c1326dae72f7a3a8cf1adb076cc68f3311bbe5e0990745ba67b158b3ed4d088b66f2f6b5dc00cc22e482b5b03c789d5a4632a3f13975057f53706ee376ad417359e76ead2e8087bacba727d1a31fbd1d26a7e7c5b68ac9eab096d8a81dc31d159c6f9cb314a09e3dabbea08f23f263e49b98466bd56bd65fec81fb795eab358224d1d67da396837ab1f87f1cd820"}]}, @generic="bf809b823ecef9c3cd13054673bf1b2167cf35e9e5c27926319eea3a097cba9e59a02664a85f6f8036f5b82d47a6ded1667625dc0c3e86439f7ecf1634e20ba3e2d185b54dc445aa7c67870eb886ec71118fae1ca86fdaae08925d45f37b4f67d111af2b37012f15feafe7a299e1e06223befa95d782275451cb298c23c1aa5451a7bb5d6e32fe0a6d3db127119bae5bfb4cbf376b710c8d", @typed={0x8, 0xf3, 0x0, 0x0, @fd=r3}, @typed={0xc, 0xe5, 0x0, 0x0, @u64=0x6}]}, 0x2b4}, {&(0x7f0000000d00)={0x340, 0x22, 0x100, 0x70bd26, 0x25dfdbfd, "", [@typed={0x4, 0x123}, @generic="c3d122acb7bcbb4e936fb948d57d2f6110b395f64e51b9e6db496394214add317c52079c7b5de23b17cc766894df92c9b783eac01b8ae42d2a58f1a1fd05a29e151db6ea607c304bbc8811cd395cee0a09339aa17601fc6159051dcd79363b71b49505fe7e8a97f7d817e06eba748148ca3faacd4ab81b01bcc6f15fbcaff8faf622fb3c3a709ba0a84b0cb72ec2eb54d74e49bc4f98e129cd8d5266f66e384291a96b1a505992bc12008d4b2d53d2bb4ef4c692068b62ac1ce8c3850357505220bef23ba53fb04887d0096b9c1d77a67fd19167197747ffa7264b1b6bd1df08", @nested={0x24a, 0x168, 0x0, 0x1, [@generic="cbf7571e56654d6d0a972b5a3b165f74819a0ae07d43c4c930896660b2f280b702d8be26ef56c850761d25a032fbd4e2132f442a5de1976e609e76235c0699668a3b080f93bc453cb7335405ffff34e112d73093a76a55c0957fbb19081f8d3d8d3a4370780aeb7ca26c5bf58ef7f20a369e10d991a08cae4b99f61dd5815981bbfe05b464454c55869a00c966f09be5f37301e84064ec", @generic="339e", @typed={0xc, 0x28, 0x0, 0x0, @str='devlink\x00'}, @generic="fa0f2881026f5c099233a8b5c0e12ca420b0112dd0350da21b", @typed={0xc, 0x1b, 0x0, 0x0, @u64=0xffffffffffffff81}, @typed={0x4d, 0x80, 0x0, 0x0, @binary="4acca1889004ead077b2789cceb8533eb65987e1f44f62af4eca27fc781745f7f5a1b34d3451808b17835f1d24d47d1f68ba05c149bacace96cc47a485d91743b6b8cb2c9095012103"}, @typed={0xf6, 0x1e, 0x0, 0x0, @binary="c0ba550d4644c6456a5ed7ac3caa92c34ac0bfd5d8c8f9661846602b0f5e811d5be819dcf53e78738b4eb55c7245f536fc65db3358c2f02434492c98345f27aa89fdb03ae0b3cd71ea453683fd9d53ddf91ee5eea206db3631b64de9d0e37c3ce132660379d306cb9fc44eacc204e760c8366d85f595ed95cd926b7fdb1893ead58320f6bb5f5d6613c6cd492bc2dd8dfe25cedea707717e56b154330ac738fd7f6ee22a37695485d699528d500e5c24f0987829ac04db4340ee9dc4cb74857120fd8554fc7b3f938da8d19d43e744d91c577a636e857d3a864a1e6885ab13482983ed69522850dab7aecc5450462d7bb3b4"}, @typed={0x8, 0xac, 0x0, 0x0, @ipv4=@private=0xa010100}, @typed={0x28, 0x19, 0x0, 0x0, @binary="cf3d4d089ddbe5faf3d601578acd2fe64fcc66b46bc23bb9bc33ba5c9a76001ff5b65017"}, @nested={0x4, 0xb4}]}]}, 0x340}, {&(0x7f0000001040)={0x10, 0x3f, 0x300, 0x70bd25, 0x25dfdbfe}, 0x10}, {&(0x7f0000001080)={0x171c, 0x3d, 0x400, 0x70bd2c, 0x25dfdbfc, "", [@generic="8d5794cb38ef07a07419e322dfb20f57a689dcacbbd5c4a306dacd0b919eed1a53d69e395195e9c241cd9084ac39a0d48f0973a3bd50f8d56939276a8e8080497f87c35884d1c6365d917f6f8c64892d844a987b279989bad65b088b526a4be600e13c8e34a98278b42295737aff027da4610dd27a33386007c152064d63e227741e5e97d699480177d42c8d02e1c9965f1cb6710cc5828a82591e67fc7e53f3262c07ed98a1558db06e3590d28503d74035b1bab7d7c0e3e0ade607db7c03c8391fa626b79ad3dd", @nested={0x209, 0x78, 0x0, 0x1, [@generic="48892a2ef041b4370b6fa2685d3823112eb653a202639e42446454f20ab8531cf2fbeb51f62921b41a545b89cbbcaf5d3aafcc51436c13e1972093026e0a613c23343d2471b73600d9d0f4464890b8e3ed8b128cd7be4a4772d0541ecca9a405f059376f04d177e47570", @typed={0xbe, 0xe2, 0x0, 0x0, @binary="556303a13f3ae621bf9897948089535cfd8a89570c2b510afa7d4addeee1234088d1d82d10384b90130b43d4050431f1986b977ba75166e815bb21d525d236d8776d61677b70999e2a6441199fbabc71661e3843f9cda133ac9310a1f2070431af2601405c785457c8504f21e200b5620c85390e01c96619518f4e7e4b15829872662369d3923fe7e7d71d57a79f8989f9e6a61a6ce53f2d00a79692c809d53ba80d0dc72d368c1f73dd956abe653d1c5a75ffc1ef680bd749d2"}, @generic="c9de97713a96e2a58fd836496e079c6c6d87f400576d93e88d8fa4e8d446e677e6e36c566470f3a627d6657e16a9fca7c68288e5cefa7610513ae5de1b9b82f06664cbe40719bda4c6d744f171417c5fdc372c91f8d3051f10c6380cad64ac330f0ce22fe1e8d80ddfbf2150b7bbecb5de76ec2c04ae719c26fccd84a19689de2b384026841bf423390e918b0e4c3cc459f7b6e0ef3ec91e6ff19b9fab1e2a49d5f04cbd8e9249c9cc354ee7fdfa93569bfa0c0222980789014ac8034477742f610e02de700e9be04d89ef553f9d1c", @typed={0x8, 0xa3, 0x0, 0x0, @fd=r7}, @nested={0x4, 0xdc}]}, @nested={0x11b0, 0xc3, 0x0, 0x1, [@nested={0x4, 0xb0}, @nested={0x4, 0x151}, @generic="bc994062b6f71fe15ee82c81836028609efd3016bad3d815fa1d835686d4b39c9404d4de2a07807a483eec2bd77aef864d92024d2636d544bc370bbbc055b0c4c81adf75a39634dd555ef6fcca2f000235424245035c7e649aac0cdf00287871a1bbfb6bd1ad2776053427afcb0bf9ad52768c7f343d89730d6d539b4699ab227c2cae1b72e6d0600791285c98f61bd66088b607851b28ff7b27d45f4758e9df9c444716123cc8203b1c2874281d3a6d291b94451fce0875680c9bf889aa30d6f7b19c6f5f15277676933d5dbc080821cf547bc34a784fe84593aaa30576d3d856", @generic='#$ ', @typed={0xc, 0xc6, 0x0, 0x0, @u64=0x80000000}, @typed={0x8, 0x75, 0x0, 0x0, @u32=0x8}, @typed={0x8, 0x157, 0x0, 0x0, @u32=0x5}, @generic="ef45678d9ea4c6a882ddae51a32b901db30b40bc07e16948e96cbe96a3b4ecedc6e3fa5e96654561f66ea4148615a22cfbeb926a57f315bf129dd149c3e6ebfd229c93eac2d2e72ed8a264dc818f793665996b17c99260e9e857231eccb7b0949a056fbda4b1725d4fd80b6474d21f804db268c74204f30de3284dbfe4c854ee91ca21f6714eef13337fd4338a33b68e2941c1ed7c036867caf8b5d6199315a02ccbab094f1862cac16491549345db1f0dc525f931bf2efa6e61643bcf8bf43eac47d13f3f451662f5977a311a83f76193091da122382deb201fb346b31b05be5df6b3d28d363d132ec4b9beb81098bbdd5da43e08fd4253c89f55134b059e07beab8de649d54af3e631c335d61a4cd9d2129cb38121d6de94684d800b9f2cc411e72f657cd04cae22dd62ce3901012be46705bd0ea01b6821adac4f6154bc74bddca82caab9a90ddef3fbba7644694c25833a901ad98dbb07ed9d8160d7154de9022d6feca7bd686a629f620af78e2a84215201c0f2d7a9329395436f30937530127b83a6b8a78942c07dacb6e09383ee93ff6339b7524b91981a80406a34df069ae37ce8e8d5158e41fdeafdc85e2099da1e2296cf4c9f533572ffa82f8b75ca304152a84c3115cbce69f5632c24ea5982a85af646cb318af512a20579cb4f4a73a661e8394b69b4415ad06f274323f8ca20ce66d3550c1ba42cc659b09942ebb35556db775d577b3e15e950a8c2a710df7be2610d1fc243ce7657df791fc3acab689f928444fbff84806e79c7da8a705a741adb8bba99f4b0346463156f5035412179100c291ca164fc5d5fd18a35d88ca44c9d097306a5885e538949e059928d11d834e1820f98b53e41adf1f5c8592abe345055f0a6d528f94216f6e4550d7f7fe9670553ce17d7a81c59125c8e60c27cd277bc77ba26130a4092a2deb520817dc23621e52aeef6749b10b9a09a7871b2ac0f49d2be6db25fcaa1ad5df8250898c3d4082c9b785f99e7d2c7afd82833f884569b5a143d188e4dbeb81bb5b47a7919a9e55afeb05f289cd6bc08f4910b60236451a015626a17746384c770eea4d370e6c99d1670adf8c00b34d0a70810ad86150972cbb9df79e57444e76eeee11fba28776f1559bd0090dad7dbb3ccc94d8bd8c070651ab3cb33897f853881242c0251199fe95dae6eec74fbd04cadd98029775260f1bcf6784763fed849e16573ee22e7fc593768bd346dd622b36c2e4092fa0bc01778e63649e0dab507b088903a059d04128437f732441722c9bc133d8d8a836e757bc42609701586196a09ef278c20ca56ad22ce8085fcee04385a12989cc3dced188c78d47325078a9ca6e19e54ccb13d210d1469c130d8e119780a58b5abb25f2f0ea20817653cdfeba3b79f3cfe259cd5bbc4452e513b0948b4deb2d0fb31ec96cbdf68060b9c0e8f7488490b3a662f565f54153dc1a4614a0dc76a3f3368f04ce3aca0f096aa9ad84a6255d3471e3d9a22d4dd11982f40f1963b1501f3a9fa0a6b60050aa5262526722b36c5232a24a775833b5acda37e02a1f393d5a625ba8d8a74c89d0e3ebb00032f5ba1d4aadb30d1dfc8f025a5e8295c47d4fb41aa3f28aec09dae8d99cf5fd5ced3173e07bf9bf954b011ba64266124a36bc6bf36f8c3b89c5a48b367570bde8d4d9ab3a00fda782186dafb4b5ea60f568d3000266fde0c7558ca66568091493347791ed375a256cd25c569ee60b45ada31f4447286661b4f2b60a685e6619962725e097ac936d72afc1a73f49da267762e5bb4b84bafe0fc57e70c065b8bc67714d3b5261fe20b66ef21a7a5148041219793def8d4e1b529f5c39abaca6ae3d09b736ccee14fe5ca7f689f6fd2ced1ceb9f12d5c5b56286f93952c4ee4bb6ab0e5fb5cf25a59330836c2129ab8318796908766388c8ebfeae6bf223e9123d611da5c72bd9568864b7ffd6db646ccad89456413a063baa9b6540dd79493ca4917704c6b5603fd283f9a7489406599ad61a69387a42272672dde3097f3e64a8d27f48465a994a631a4115618ff15318b0805a0faa55c0552bf8584b3442cc41afd78752d5a5ed89c41e32eec1ac2afd2db2d533a354c5bd9a0adff7b709ee84595e0cff857f6be5d4d9442827041fa9e27ecf5cc7ef58e5de19a12a18d5fa6928f034e260a666e7e618253d6103fb69e5e13d8b0a23fac5ae0da15283141ba61df7563441b19e1f61feb269b7cd443743c864725cbfeeff2ede1e4a47f5a7586700bb716ca32171b6e9de4d03696989a1d80e12c498925399b0f415e21292cb9d1a2caee968fece3d427a86484899fea41510dc5620a7915263b16a7088f902f035d8c83513a868f86c8ed3c18862a065f1963f565616f5d2e49409baf67d8c4e326c9beac4c97f5a288acd315f5883e20fc9baa20361e1bfa412095d4001861e6a9d94ad5d52de51ab0ab299c6e890beff9b91f6d820c9839f070c7bc7a987ea6f36c5af9d145b08ab26864a1d1c38bb15b9f05f11aae5ab79647aada7b1f87ebc1a095db586dafe3bb965eff346efc1fc0037595e972e4d62be9aa57a289e9e5d831ab2545967980a6430389e69c9593d4bad6cb813531217f92ab82dd6da5e79a8fc1ef02d61aee0855d94222c2ecb4ccc070627a12137355aaeb2cc25d0faff036074c2b958b29bdb6e672a26b4d516480c3c2774516d997c2622fee6c6f86b4bddca6b1ef43948eda867ad6605fe9f48be9dfa863f6221bf43b20d4f1daeb5a75564fbf947894f05cdb53e0ee6e546b8d024a3a0b82dc62aaeb6538cc99187d6e594088bc699bf7aed7dba0ada2a74bbc7aae907fe43928873fbd66b7a07c3b6410236bab4b33ad7ab12d5527f9243a7a117c6c38728fbb495b4aec5fea8036c14899984c536c0eae47c00c07278d8bbc46f1e1aa2d35676fdb8ac34e6c7595ed5ed46e85b4c70418046d06756517381267f7801f37277f21b4a2712b327562cc11cc8ade83c5640202ec7c7c9592dc670eb77d60b7b501a9e238e9b451ef03f2cad6d0f87496c72cbb2ae260bc2287a0d947f88675663ee5e8282d044ac3b5a99cdda36e6401ff333f377263a8f6ced989da96a3dd2479335ae1f05dd16ba10a551bf6c3d19407ec2bd2b96e0e5acc87bee074f93087d54e7e04809ac0111e5a2392361edfa984c62e7404230deb2542d163b99ee3a4b19fb6666cd0b00034ce0eb5342006ac2665a0c6e86d16b9df31ca7292c9d9957448291805190b1feef8265d1462dbfa3b8e5e51d22a7fe71be0e17fb8b346958ca38247d96deed067d6921b1fc6c5dee0910b4913cf3d652eb45ae0e106bea438ccd47e05841b5884920c383d31aae990e4c38566fddc8e1568be2c7be496190c0edd7e0c04675733724367252d43734b5fa817a6e5d412f37988b449b5ce9f7f71835eb4cc46955432c51fdd72061baa426ecec5c3981e7e8b751e12d48fe494aab61ca5184a43868fc88cb1b192e57952767ca3dc119d2b116dcf2e0a36273ef219ee2fc81dfe91d4d3ea750022ed3ebcc1206fceec2492e11c9bd74cf7776ce7f61de074aac1a801e98252fc32727f37198dc7ccb9a58b1daeb6182b4322a1618574b7c259712f368189070b5dc9f14f9c0a07746e77adf1426168963e3da526f4971e6c42fd5574206a3c214e3e43637f23f57b15398de184229b03ffee651f4f7200b44b79ca3fd7c68c2d3a6c1ee9f929a6fea955d2950f7871b0c06532ec2eafe4517e124f5e025678cf51a5c754cfe9853391f313796324125362abe226ea6c66125a69ff514ef63afd7cd3b883de8ad319e47ea7bb2a463e149a863d5ee5e0f9f739fbeb9058fffd959af3e7979732983aaa27aa944746ec6866938f5c8a5f31f5cc1590f6e73ec7a2a0fe53fa1dfb4eeceba59f6a1bcc71eb6761d326e4ef25ba91a1ce2ebec0093c4ef6abab1e6880896a789b31dc80262f20aca5da180aea98375aafe038a479eabf4b0ecd343fe2c51d25f8ee16f6823793321770541ca5c7858cd1d083797f4840c304d49bf8bb2c57683f26d7d9091fc600defac9ebf3a67b49089b96b943a1b0265305e637e0176d2baa94b26a8f65c2aeb44701ff43b11e984df9f323da4cabfcf3903e01da643899f231deba0abf64dd484a9ca8577304f8c9a59583ebd831423cee70fe3ba378891e5a3230fdf8a1b5a08c02e30eee726811b3f46877e8fd2b6a00e34cded6854f63aabcd4e494aea702c415a3370092de99edfb6c732fdbb2f3387431450607bf8f18aa31f396411f6fd758d1c895813fd76589f93f770711a442f5a9b2bdd90f2c434cd1959921e3a061c8c381caccf00764bd8d31b9159afe1b56bce6fc35626b1db066afb012fe3d27bb630800c4affacbd88cf6a524d1efd990c4ea91ec176eed6c5ac676c0acaafaf17c6d65ee006a29a92ad63b914638f88791b8ad4b0766b651afe487c35288d97a9dfa39889d622c1eb976ec2eb4fe50520973b128cb89905a5cba19895023e8285d6d1c618e0e139c1adc59fea840c76e91236cad92da4ec83086ebc697628c6171b2871d42c9f520be5d3865bf9e99b5a8e1b84445fe212c6518384e2f1899b0c89d5ce8d5ad660035a3353976fbd1ad9bd7c8f4a557fd120ec0d5dbbed8dda4da439f6f0711dd0fe42e706af9a34d612cebac1428fb02abc80dd9fe446f8a22eea1ecb9c59f84434a662f8d087a379360fe2bf177854faaaaf6974da4f7897b88b2b312c658535b78094fae66f85b230a4ff3a5641915984a775e06f7f8d3c8b67e7c32bb462dae7597156d6b57c9637105d7dd893146a9d05af7e7372050027229ef07fbe79f5bcb99a3d2d21fbc185c63185e808b7822a1f0091f4624526df8d1f93efa9c0c0adaa4fadc8d25bee0e389c585a1b5e6eda53aa259dda20ab361379fb5b62e70070cd13711199d48c3418820b2c8d77b60b02320e61a07a098f9590050923ef14406b1c33441c0569a8a2cd6f6db068c200bf4071281c09779040fdbc1bd4bec80fde6f11718ad49dce07dbc298d61440d0dddcf250a86a531701a5d1525dcef6a23b10b04684552d601c5263b1d6f5c5827de14d68fcc90dbcb6190098b6481bc1ed9d24940dd6bbac08eb972a1de03844e0e4a6f1e3d502dec9fd0337dc9a30fd7c17f6fab39ed7d7b74588c5ffe93fe430fb8f80dcc1f8de43cd1c8e5eeefd4da8a6f91e653760de96e5f52731897060a7caca10ff9da1f205c28c7594c6405194615da0e1fb5165789bd11ade70867d05065a78688163a4d4977c5efca5f10c3e1cce891d52a9b6b0f83a61c6d801feb93958999f217e6be7a10bd14f4f535d69c52d4e46a5aa90caa82cbd922994dff1f3b14582ae9b308a78e6404efa2a6fc64f3af53492e299d71bc6e9b0c131d07e9ac8879a40eba8e689bfef38382026b45428fc3a43c4d13285fa213460954825bff3b1c01f61b745dadfbe9837091fc5c178ad161792cb29455366188778f7cf3b590221e8245fe60fec1847feee7b3be7944136c9e7c1899b3f92e7f756b1cb0c0c3de355cdc1e672d1e2be341dd65729cc0734560808b102d484e34999aca71d714886fceffbf9c8125aac7730f0f5a2b12996b1de46f13028de16fe4ae7c774d0cd3e2e76c95d3bc7958da967efee6bdd0ff4feb8840252601f736732f6abac90308e2d79cc55b167e8ebcc84cb98f6567a8550a7349d6d991488d169725dfbc98f937d8527b06e97c67e62d73f2fafcc939170acd3dcd2d2f1aeadc48e09fbdd0525efc90613d", @typed={0x14, 0xa4, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @private=0xa010101}}, @typed={0x8f, 0x7f, 0x0, 0x0, @binary="1006469041fb739c81484b53890275a47b86046f994b69db7e3b8e5513814e0875756d0bcd3e6cfa62c3ba898c23c88dfbc582e384cab89d0e9776aed9d61eea991d28b52809310b5da145a24b8d883c69bc79492c8d03212be21c1ab8adcff0b7749cbb18f2f32a8e8d790f2304ad4bc11e5ac9494fea980a8340477f57847ebc70fbe6f846c05f63e0ee"}]}, @nested={0x1fd, 0xe5, 0x0, 0x1, [@nested={0x4, 0x7d}, @generic="ad8a9626c3d3c86530756183752bd0729e32ddad9330de3abacab8af4e2fdc38189664704d", @generic="a182514f515816b4931cfa79faa029ac874fa57cfa689fe4e343e01d2cffb384c894b83ca826ca536c3057cca4bacf796011c7f10e4ae02ade53147a528b2f425ae86be527a429d6b05779a51ba0df79b3c2e2799379ef", @generic="1f956b105e22f685714c2689cb5eb97d0fa5cbf9410812a7290606b136f719c120df736df41c63d22a004c7fbb4f418ccefd1939c5d3041a8e072fd3c038527b41255f6dab292dde36743828ee8c3a93a3f295ff80989fddb5ed67b0a3373a75feccf09b6d30bfc52da39d7eca0e0c8bfebac93f4c29785111fea069dff25a3c418981d5bf91eed41f257eaf5d8c4a58510936d32df377cae07e67e53fd2ff7fa1c25b10a72b478daca01be30398b27071faee4ce48228a1d23cd8927e3db68b526da9655bf3b090317d19bfc3b6627200a969e68f19eb71e9c2b0f2fda4e4b5bd6e63c99a8b125a489f448950c9a74639", @typed={0x8, 0xc1, 0x0, 0x0, @ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}}, @nested={0x4, 0x157}, @typed={0xc, 0x168, 0x0, 0x0, @u64=0x7}, @generic="aa0c663caec4b0e8fac6abef79b3855e5f46c68194cb0fd8430172799f3d346c4f8469856b62154bd4ca499ad5dbb6f66b4a31d7fbe278185d5c30ee5a82631d699552fbff2752101193e9650dc32259c9f639013ec36d5999133b2385b895550555322a", @nested={0x4, 0xba}, @typed={0x8, 0xad, 0x0, 0x0, @ipv4=@broadcast}]}, @typed={0x4, 0x16b}, @nested={0x59, 0x6f, 0x0, 0x1, [@generic="c6c0af0c9ca36c4aa6725dbb623fa7a3080f213f24e47141f998c47c314bc08f4cf45fee81649bd6c262509e41045456ca0996cf20c2685f0bb68640b29c27ae5de351cfc918047200433cf617", @nested={0x4, 0x119}, @nested={0x4, 0x38}]}, @typed={0x8, 0xef, 0x0, 0x0, @str='@\x03,\x00'}, @typed={0x1d, 0x13, 0x0, 0x0, @binary="f1f74fc918e375635f076b693659f9f7d13b68b870bba25a9b"}]}, 0x171c}], 0x4, &(0x7f0000002800)=[@rights={{0x28, 0x1, 0x1, [r3, r3, r3, r8, r3, r3]}}], 0x28}, 0x40000) r9 = syz_genetlink_get_family_id$batadv(&(0x7f00000028c0), r8) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r3, &(0x7f00000029c0)={&(0x7f0000002880)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000002980)={&(0x7f0000002900)={0x48, r9, 0x800, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xcd98}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x7}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}]}, 0x48}, 0x1, 0x0, 0x0, 0x80}, 0x0) bind$netlink(r8, &(0x7f0000002a00)={0x10, 0x0, 0x25dfdbfe, 0x80000000}, 0xc) setns(r8, 0x10000000) ioctl$XFS_IOC_SWAPEXT(r8, 0xc0c0586d, &(0x7f0000002a40)={0x0, r8, r8, 0x6, 0x100000000, '\x00', {0x1, 0x2, 0x6f87, 0x81, 0x7fff, 0x3, 0x4, 0x5, {0xfffffffffffffbff, 0x2e5d}, {0x2, 0xfff}, {0x8, 0x5}, 0xffffffffffffff8e, 0x8, 0x2, 0x5, 0x10, 0x2, 0x8000, 0xfff7, 0x8, 0x7, '\x00', 0xd5, 0x10000, 0x2, 0x3ff}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r3, 0x89f2, &(0x7f0000002c00)={'sit0\x00', &(0x7f0000002b00)={'sit0\x00', r4, 0x700, 0x8, 0x6, 0x0, {{0x30, 0x4, 0x3, 0x27, 0xc0, 0x67, 0x0, 0x4, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0x1a}, @dev={0xac, 0x14, 0x14, 0x27}, {[@timestamp_addr={0x44, 0x24, 0xf7, 0x1, 0xd, [{@remote}, {@local, 0x4}, {@rand_addr=0x64010101}, {@multicast2, 0xd8f}]}, @timestamp_addr={0x44, 0xc, 0x30, 0x1, 0x5, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0xd}]}, @cipso={0x86, 0x27, 0x1, [{0x6, 0x3, "ae"}, {0x0, 0xf, "49e214929363629790e32da604"}, {0x6, 0xf, "358b102f62f0030066df8def98"}]}, @timestamp_prespec={0x44, 0xc, 0xb2, 0x3, 0x1, [{@rand_addr=0x64010102, 0x4}]}, @timestamp_addr={0x44, 0x1c, 0xc0, 0x1, 0x9, [{@private=0xa010101, 0x1}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x3}, {@loopback, 0xffff}]}, @timestamp={0x44, 0x24, 0x5e, 0x0, 0x5, [0x200, 0x3, 0x200, 0xb49, 0x9, 0x0, 0x1, 0xff]}, @ssrr={0x89, 0x7, 0x7c, [@rand_addr=0x64010101]}]}}}}}) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f0000002c40)=0x4) getsockopt$inet6_opts(r8, 0x29, 0x3b, &(0x7f0000002c80)=""/194, &(0x7f0000002d80)=0xc2) sendmsg(r7, &(0x7f0000003240)={0x0, 0x0, &(0x7f0000003100)=[{&(0x7f0000002dc0)="23c00e1033063814173a61bf19efc157721af4f39f9d5dfc21f2d1ff545111c5f3ce6e3f421899c2b62d3f24aa65c8bc1d9b302520fd140ec90d9b2d1fe001daa3229c5bfe60d7fd1e4ff58f9041d2a2e41b6639ef61ecc81dc9e299ef7b65019d3c3f316718d3fedbce716f3d47e9778da4250b8a05e9b1c0d266743ecce8791f8e189914e0f89be01eb87d73900953d46e14", 0x93}, {&(0x7f0000002e80)="7bbed9ab4e6a3620e5318465d5f4ea03f23e0084b29d209026a3247a79316d656b8bcb4937ac66962918182e735b0bc569e9a680d8426dd5d1fb845ae86081219f181a51c54c33da9bd9ac98ae97df452daf43481e415dbb3dcbf32ef6e59b2948b5462b3a78a38364736a29cdc400f4f61b439d1463b82a4201793e6f3fe3ba77f9539681d401d7855af5a6a068bd2422f21815cd045e1c74", 0x99}, {&(0x7f0000002f40)="7e60534255b00f09f8e8d99fa8c8f0d6cc48d38ae3b824dee5e85e2634c9e2153711ebc19824db9b130b5c5f98c2b4bcdeebe74ebaa0826f70e9e2d290f894009fd6c14a457a02b52cfeb42dff3dac19b4556d7b09e9179f5f560d18695ed645c439f570e93dec5d83fdfcf9c3645d892e7f351fab0e362eeaad7eb88ab1e07c44ea49d9892b66e58fcf385cbb52c742fdd4d7682bbd87ad9920f6fa7caf7cf4d36aafb009785d1810ce53b747c141ba925d169d98bf269b349ec7b1b9468e087f281d4ab3d82fd1fb8e1bcb74191008", 0xd0}, {&(0x7f0000003040)="3e720663c1eb791a014a1ee5a30a434cf0ed148d465e2974380b6644bb4d3e8179c3b2416979d22940a0bb4c6860e436cedc23c7fbd688dabfcb17d3cdec92b0238e5b67c99dbb636c965f0dcd37d37ad4ea2d52532190432aba5789f0266b1824d5b05e3d5a2dfb1db60bdca9b07e88454adb93546fc43af498", 0x7a}, {&(0x7f00000030c0)="40e1", 0x2}], 0x5, &(0x7f0000003180)=[{0x68, 0x10f, 0xe06c, "828ad2f7b2cc7e360ef20d8172a1c29acd6e078ce2ed133fcf9ba880c3c21de122e7c8d818c8d929e4b928ed20adab021cd765f9d854cd1722d349f7ec4d88dac019eb8fee21d8eddf749c3e948de84ba84b"}, {0x40, 0x113, 0x3, "552199f7925c716a75066bbfade23eac64fc692b0f89b45ce16f1b1e416e999389392ea2e6ca3e509a6e5210441963"}], 0xa8}, 0x10) ioctl$ASHMEM_GET_SIZE(r8, 0x7704, 0x0) ioctl$VHOST_SET_VRING_ERR(r3, 0x4008af22, &(0x7f0000003280)={0x3, r8}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r8, 0x89f3, &(0x7f0000003380)={'erspan0\x00', &(0x7f00000032c0)={'ip_vti0\x00', r2, 0x80, 0x7, 0x48000, 0x5, {{0x1f, 0x4, 0x1, 0x9, 0x7c, 0x67, 0x0, 0x5, 0x2f, 0x0, @remote, @remote, {[@cipso={0x86, 0x21, 0x3, [{0x7, 0xf, "2ba56ad7d422b8848d8433f149"}, {0x1, 0xc, "50645faeaa6c9cc36a37"}]}, @rr={0x7, 0x17, 0x70, [@dev={0xac, 0x14, 0x14, 0x3b}, @multicast1, @remote, @broadcast, @rand_addr=0x64010101]}, @lsrr={0x83, 0x27, 0x68, [@multicast1, @empty, @multicast1, @empty, @empty, @private=0xa010101, @private=0xa010101, @multicast1, @local]}, @noop, @timestamp={0x44, 0x4, 0xf, 0x0, 0xf}, @ra={0x94, 0x4, 0x1}]}}}}}) socket$inet_tcp(0x2, 0x1, 0x0) r10 = socket$inet6(0xa, 0x5, 0x101) setsockopt$inet6_int(r10, 0x29, 0x16, &(0x7f00000033c0)=0xe97, 0x4) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r8, 0x89f6, &(0x7f0000003480)={'sit0\x00', &(0x7f0000003400)={@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x0, 0x70, 0x0, [{@remote}, {@local}, {@local}, {@remote}, {@multicast2}, {@private}, {@local}]}}) 894.976148ms ago: executing program 0 (id=617): mknodat$loop(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0x6000, 0x0) r0 = open(&(0x7f0000000040)='./file2\x00', 0x0, 0xf3) r1 = fsopen(&(0x7f0000000240)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) fchdir(r2) open(&(0x7f0000000380)='./file0\x00', 0xe6242, 0x4ebfac6bbaf7949) stat(&(0x7f0000000740)='./file0\x00', &(0x7f0000000780)) ioctl$BTRFS_IOC_DEFRAG(r0, 0x40101287, 0x3) 751.031541ms ago: executing program 2 (id=618): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000021c0)=[{&(0x7f0000000200)=ANY=[@ANYBLOB="a0000000250001002bbd7000fce6df25ffdd187513000004002e"], 0xa0}], 0x1, 0x0, 0x0, 0x4050}, 0x40) 706.343703ms ago: executing program 3 (id=619): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x101080, 0x0) ioctl$BLKBSZGET(r0, 0x80081270, &(0x7f0000000040)) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) (async) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) (async) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, &(0x7f0000000400)='\x00') mkdir(&(0x7f0000000500)='./config/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000600)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdir(&(0x7f0000000700)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) mkdir(&(0x7f0000000800)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0x1ff) symlink(&(0x7f0000000b00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', &(0x7f0000000c00)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/ss/h\x00') mkdir(&(0x7f0000000d00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0x1ff) (async) mkdir(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u/360p\x00', 0x1ff) mkdir(&(0x7f0000000f00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x1ff) symlink(&(0x7f0000001000)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', &(0x7f0000001100)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h/u\x00') symlink(&(0x7f0000001400)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', &(0x7f0000001500)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/hs/h\x00') symlink(&(0x7f0000001600)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', &(0x7f0000001700)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/ss/h\x00') (async) symlink(&(0x7f0000001800)='./config/usb_gadget/g1/functions/uvc.usb0\x00', &(0x7f0000001900)='./config/usb_gadget/g1/configs/c.1/uvc.usb0\x00') (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000001a00)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r1, &(0x7f0000001b00)='dummy_udc.0', 0xb) (async) close(r1) ptrace(0x10, 0x0) (async) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0xfffffffffffffe26, 0x0, 0x1, 0x0, 0x0, 0x20004094}, 0x44000) (async) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x40482, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000140)) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={{0x14, 0xa, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x601, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWOBJ={0x20, 0x12, 0xa, 0x601, 0x0, 0x0, {0x2, 0x0, 0xa}, @NFT_OBJECT_CT_TIMEOUT=@NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}}, @NFT_MSG_NEWOBJ={0x20, 0x12, 0xa, 0x601, 0x0, 0x0, {0x2, 0x0, 0xa}, @NFT_OBJECT_CT_TIMEOUT=@NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}}, @NFT_MSG_NEWOBJ={0x1c, 0x12, 0xa, 0x601, 0x0, 0x0, {0x2, 0x0, 0xa}, @NFT_OBJECT_CT_TIMEOUT=@NFTA_OBJ_TYPE={0x8}}, @NFT_MSG_NEWOBJ={0x34, 0x12, 0xa, 0x601, 0x0, 0x0, {0x2, 0x0, 0xa}, @NFT_OBJECT_CT_TIMEOUT=@NFTA_OBJ_DATA={0x20, 0x4, 0x0, 0x1, [@NFTA_CT_TIMEOUT_L3PROTO={0x6, 0x1, 0x1, 0x0, 0x800}, @NFTA_CT_TIMEOUT_L4PROTO={0x5, 0x2, 0x11}, @NFTA_CT_TIMEOUT_DATA={0xc, 0x3, 0x0, 0x1, @udp=[@CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x1e}]}]}}], {0x14, 0xb, 0x1, 0x0, 0x0, {0x2}}}, 0xd8}}, 0x0) (async) sendmsg$NFT_MSG_GETOBJ(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="34000000130a0100968ccfd80000000000000000020000040900010073797a3000000000090002d173797a300000000000000000"], 0x34}}, 0x0) (async) pwritev(r2, &(0x7f0000000040)=[{0x0}], 0x1, 0x0, 0x4) 691.192103ms ago: executing program 0 (id=620): sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4004080, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c00000010008100000000000080000000000000", @ANYRES32=0x0, @ANYBLOB="0a043cbf", @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c00000010008100000000000080000000000000", @ANYRES32=0x0, @ANYBLOB="1f"], 0x2c}], 0x1}, 0x0) 586.881036ms ago: executing program 1 (id=621): socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r0) r3 = socket(0x80000000000000a, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r3, 0x89f2, &(0x7f0000000540)={'ip6gre0\x00', 0x0}) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r3, 0x89f2, &(0x7f0000000540)={'ip6gre0\x00', 0x0}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0xc, &(0x7f0000000540)=0x4, 0x4) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r2, 0x400, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4040085}, 0x20004841) (async) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r2, 0x400, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4040085}, 0x20004841) sendmsg$TIPC_NL_MEDIA_SET(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x18, r1, 0x1, 0x703d28, 0x25dfdbfd, {}, [@TIPC_NLA_MEDIA={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x24000881}, 0x24004084) 586.285185ms ago: executing program 2 (id=622): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/slabinfo\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x100, 0x0) connect$unix(r2, &(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e) close(0x3) ioctl$sock_inet_SIOCGARP(0xffffffffffffffff, 0x8954, 0x0) ioctl$UI_BEGIN_FF_UPLOAD(r0, 0xc06855c8, &(0x7f00000000c0)={0x40f, 0x80, {0x51, 0x8, 0x5, {0x10, 0x4fed}, {0x7fff, 0x8001}, @cond=[{0x6, 0x1, 0x7, 0x3b8, 0x3, 0x6}, {0x1, 0x6, 0xfff, 0xa2bf, 0x401, 0x8}]}, {0x52, 0xf, 0x8, {0x2, 0x6}, {0xd, 0x101}, @const={0xf5a, {0x0, 0x6, 0xfff, 0x23}}}}) 400.15567ms ago: executing program 3 (id=623): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000d40)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x4, 0x0, {{@in=@empty, @in=@rand_addr=0x64010101, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x32, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x9}, {0x0, 0xa00, 0x40800000000000, 0x800000000004000}, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000c80)=ANY=[@ANYBLOB="bc000000210001000000000000000000fc02000000003a000000000000000000fc02000000000000000000020000000100000000000000000200002000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000500011"], 0xbc}}, 0x0) 255.671264ms ago: executing program 3 (id=624): r0 = socket$netlink(0x10, 0x3, 0x0) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="e00000010000000000060000000000000000000032000000ac1414bb000000000000000000000000fdffffffffffffff00000000000400000200000000000000cd2d000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000010000000000002dbd7000000000000a00040000000000000000004a000200656362286369706865725f6e756c6c2900000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000010000000c9050000"], 0x13c}, 0x1, 0x0, 0x0, 0x24000884}, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) (async) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_freezer_state(r2, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r3, &(0x7f0000000040)='FROZEN\x00', 0x7) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) (async) r4 = openat$cgroup_procs(r2, &(0x7f00000002c0)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r4, 0x0, 0x0) (async) write$cgroup_freezer_state(r3, &(0x7f0000000080)='THAWED\x00', 0x7) (async) r5 = inotify_init() inotify_add_watch(r5, &(0x7f0000000000)='.\x00', 0x400017e) (async) open(&(0x7f0000000000)='.\x00', 0x0, 0x0) (async) open(&(0x7f0000000000)='.\x00', 0x0, 0x0) (async) sendmsg$netlink(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000600)=ANY=[@ANYBLOB="2000000076001f0329bd7000fbdbdf2508004700", @ANYRES32, @ANYBLOB="080005"], 0x20}], 0x1, 0x0, 0x0, 0x400c814}, 0x0) (async) syz_usb_connect$uac1(0x3, 0xa7, &(0x7f0000000400)=ANY=[@ANYBLOB="12015002000000206b1d0101400001020301090295000301a0a0090904000000010100000a2401900c020201020c240202060203840c0008120daa471fcfda0a0007000500190c240803090034c5e5eb68a3082405010201013f0924030201030301"], &(0x7f0000001c40)={0x0, 0x0, 0x0, 0x0, 0x15555599}) 99.038308ms ago: executing program 1 (id=625): r0 = open$dir(&(0x7f0000000000)='.\x00', 0x0, 0x20) fsetxattr$system_posix_acl(r0, &(0x7f0000000380)='system.posix_acl_access\x00', &(0x7f00000003c0)=ANY=[@ANYBLOB="0200000001000000000000000800060000000000100007000000000020"], 0x24, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.stat\x00', 0x275a, 0x0) fchmod(r1, 0x20049549e2a2d659) (async) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'ip6tnl0\x00', 0x0}) (async) r4 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r4, 0x65, 0x7, &(0x7f0000000100)=0x6, 0x4) (async) sendmsg$can_raw(r4, &(0x7f0000000240)={&(0x7f0000000140)={0x1d, r3}, 0x10, &(0x7f0000000040)={&(0x7f00000002c0)=@canfd={{0x0, 0x1, 0x1}, 0x1a, 0x2, 0x0, 0x0, "d31a5c0c8a99b3ad23cceec63f99a8bebbbd5df127286761c993309a2a3fb1da9aab2d90e6ec91b3b85ae5a95a0d89354663dc24d0eafd2289ea528293cefd50"}, 0x48}, 0x1, 0x0, 0x0, 0x2408408c}, 0xc008004) (async) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x181, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r5, 0xc008ae05, &(0x7f0000000140)={0x28729f328c68897}) r6 = socket$inet_udplite(0x2, 0x2, 0x11) flistxattr(r6, &(0x7f0000000040)=""/9, 0x3f) (async) r7 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x8) fallocate(r7, 0x66, 0x3, 0x6) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r8, 0x4018620d, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r8, 0x6611) (async) r9 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_buf(r9, 0x0, 0x2, &(0x7f0000000100)="813f0ea6", 0x4) (async) r10 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) syz_usb_disconnect(r10) syz_usb_connect$printer(0x4, 0x2d, &(0x7f00000000c0)=ANY=[@ANYRES16=0x0], 0x0) (async) ioctl$EVIOCRMFF(r10, 0x40085503, 0x0) (async) socket(0x10, 0x3, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r11 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r12 = openat$cgroup_subtree(r11, &(0x7f0000000200), 0x2, 0x0) sendfile(r12, r12, &(0x7f0000002700)=0xa3, 0x1c) 98.775868ms ago: executing program 3 (id=626): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="90010000100013070000000000000000ff01000000000000000000000000000100000000000000000000200000000001000000000000ffff0000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffffff000000000000000000000000000004d432000000ac1e0001000000000000000000000000000000000000000009000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000002000400000000000000000048000200656362286369706865725f6e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000005800010078636263286165732900"], 0x190}, 0x1, 0x0, 0x0, 0x40}, 0x40082) 96.689288ms ago: executing program 0 (id=627): setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40e41, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller1\x00', 0xc201}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100bb8001400000060ec97000fc83c00fe8000000000000000000000000000aaff02000000000000000000000002000111"], 0xffe) 0s ago: executing program 3 (id=628): r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f0000cf5000/0x2000)=nil, 0x2000}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0xaa101, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) mkdir(&(0x7f00000003c0)='./file0\x00', 0x25) r4 = syz_open_procfs(0x0, &(0x7f0000000540)='mounts\x00') r5 = add_key$keyring(&(0x7f0000000280), &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key(&(0x7f0000000440)='asymmetric\x00', 0x0, &(0x7f0000000000)="3080", 0x2, r5) mount(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000140)='ramfs\x00', 0x2008c5a, 0x0) read$FUSE(r4, &(0x7f0000000580)={0x2020}, 0x2020) read$FUSE(r4, &(0x7f0000002c00)={0x2020}, 0x2020) ioctl$KVM_GET_MSRS_cpu(r3, 0xc008ae88, &(0x7f0000000100)={0x1, 0x0, [{0xc0000103}]}) syz_usb_connect(0x3, 0x24, &(0x7f0000000000)=ANY=[@ANYRES8=r2, @ANYRESOCT=r3, @ANYRES8=r1, @ANYRES16=r3, @ANYRESDEC=r2], 0x0) kernel console output (not intermixed with test programs): 260'. [ 61.724247][ T517] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 61.760688][ T517] usb 1-1: device descriptor read/8, error -71 [ 61.894265][ T310] usb 3-1: device descriptor read/64, error -71 [ 61.903235][ T517] usb 1-1: device descriptor read/8, error -71 [ 62.004863][ T310] usb usb3-port1: attempt power cycle [ 62.014280][ T315] usb 4-1: new full-speed USB device number 18 using dummy_hcd [ 62.015561][ T517] usb usb1-port1: unable to enumerate USB device [ 62.177379][ T315] usb 4-1: config 1 has an invalid descriptor of length 100, skipping remainder of the config [ 62.187743][ T315] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 62.199988][ T315] usb 4-1: New USB device found, idVendor=2a39, idProduct=3fd2, bcdDevice= 0.40 [ 62.209118][ T315] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 62.217161][ T315] usb 4-1: Product: syz [ 62.221360][ T315] usb 4-1: Manufacturer: syz [ 62.226103][ T315] usb 4-1: SerialNumber: syz [ 62.304285][ T517] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 62.344293][ T310] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 62.366922][ T310] usb 3-1: device descriptor read/8, error -71 [ 62.452884][ T315] usb 4-1: 0:1 : does not exist [ 62.457917][ T315] usb 4-1: unit 1 not found! [ 62.462551][ T315] usb 4-1: unit 127 not found! [ 62.494372][ T315] usb 4-1: USB disconnect, device number 18 [ 62.503764][ T517] usb 2-1: New USB device found, idVendor=093a, idProduct=2476, bcdDevice= d.5b [ 62.534225][ T310] usb 3-1: device descriptor read/8, error -71 [ 62.554221][ T517] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 62.562296][ T517] usb 2-1: Product: syz [ 62.584294][ T517] usb 2-1: Manufacturer: syz [ 62.588970][ T517] usb 2-1: SerialNumber: syz [ 62.681689][ T1023] udevd[1023]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 62.774231][ T310] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 62.789994][ T1091] kvm: kvm [1089]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0xc1) = 0xfffffc00 [ 62.815036][ T1091] kvm: kvm [1089]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0xc2) = 0xfffffc00 [ 62.858478][ T1091] kvm: kvm [1089]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0x11e) = 0xfffffc00 [ 62.867971][ T310] usb 3-1: device descriptor read/8, error -71 [ 62.897290][ T1091] kvm: kvm [1089]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0x186) = 0xfffffc00 [ 62.915268][ T1091] kvm: kvm [1089]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0x187) = 0xfffffc00 [ 63.010390][ T517] usb 2-1: Found UVC 0.00 device syz (093a:2476) [ 63.017018][ T517] usb 2-1: No valid video chain found. [ 63.026873][ T310] usb 3-1: device descriptor read/8, error -71 [ 63.034102][ T517] usb 2-1: USB disconnect, device number 11 [ 63.096289][ T1100] netlink: 'syz.0.267': attribute type 27 has an invalid length. [ 63.138918][ T1100] bridge0: port 2(bridge_slave_1) entered disabled state [ 63.146307][ T1100] bridge0: port 1(bridge_slave_0) entered disabled state [ 63.158784][ T310] usb usb3-port1: unable to enumerate USB device [ 63.229157][ T1101] netlink: 'syz.0.267': attribute type 27 has an invalid length. [ 63.290097][ T1101] ÿÿÿÿÿÿ: left promiscuous mode [ 63.304610][ T1101] ÿÿÿÿÿÿ: entered promiscuous mode [ 63.314959][ T1101] veth1_macvtap: left promiscuous mode [ 63.335110][ T1101] veth1_macvtap: entered promiscuous mode [ 63.355087][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.362264][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 63.371817][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.378971][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 63.458028][ T1063] batadv_slave_0: left promiscuous mode [ 63.735478][ T1119] netlink: 28 bytes leftover after parsing attributes in process `syz.0.274'. [ 63.770144][ T1122] netlink: 12 bytes leftover after parsing attributes in process `syz.3.273'. [ 63.911473][ T1134] FAULT_INJECTION: forcing a failure. [ 63.911473][ T1134] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 63.920746][ T1127] netlink: 72 bytes leftover after parsing attributes in process `syz.0.277'. [ 63.954911][ T1134] CPU: 1 UID: 0 PID: 1134 Comm: syz.3.279 Not tainted syzkaller #0 0b31bef96cff8e44f9e14c4f768eb06c85e3b290 [ 63.954948][ T1134] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 63.954968][ T1134] Call Trace: [ 63.954975][ T1134] [ 63.954984][ T1134] __dump_stack+0x21/0x30 [ 63.955026][ T1134] dump_stack_lvl+0x140/0x1c0 [ 63.955057][ T1134] ? __cfi_dump_stack_lvl+0x10/0x10 [ 63.955088][ T1134] ? ____sys_sendmsg+0x780/0xa00 [ 63.955114][ T1134] dump_stack+0x19/0x20 [ 63.955151][ T1134] should_fail_ex+0x3c2/0x510 [ 63.955179][ T1134] should_fail+0xf/0x20 [ 63.955202][ T1134] should_fail_usercopy+0x1e/0x30 [ 63.955230][ T1134] _copy_from_user+0x20/0xa0 [ 63.955262][ T1134] ___sys_sendmsg+0x1c7/0x370 [ 63.955286][ T1134] ? __sys_sendmsg+0x2a0/0x2a0 [ 63.955310][ T1134] ? do_user_addr_fault+0xbf5/0x1230 [ 63.955354][ T1134] __sys_sendmmsg+0x2b4/0x4e0 [ 63.955378][ T1134] ? __cfi___sys_sendmmsg+0x10/0x10 [ 63.955406][ T1134] ? __cfi_ksys_write+0x10/0x10 [ 63.955432][ T1134] __x64_sys_sendmmsg+0xa4/0xc0 [ 63.955454][ T1134] x64_sys_call+0xfec/0x2ee0 [ 63.955475][ T1134] do_syscall_64+0x57/0xf0 [ 63.955500][ T1134] ? clear_bhb_loop+0x50/0xa0 [ 63.955531][ T1134] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 63.955560][ T1134] RIP: 0033:0x7fcbd3f9e019 [ 63.955579][ T1134] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 63.955599][ T1134] RSP: 002b:00007fcbd4f0e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 63.955630][ T1134] RAX: ffffffffffffffda RBX: 00007fcbd4225fa0 RCX: 00007fcbd3f9e019 [ 63.955647][ T1134] RDX: 0000000000000100 RSI: 00002000000bd000 RDI: 0000000000000004 [ 63.955663][ T1134] RBP: 00007fcbd4f0e090 R08: 0000000000000000 R09: 0000000000000000 [ 63.955678][ T1134] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 63.955693][ T1134] R13: 00007fcbd4226038 R14: 00007fcbd4225fa0 R15: 00007ffd7efd1da8 [ 63.955714][ T1134] [ 64.172962][ T1136] netlink: 'syz.2.280': attribute type 27 has an invalid length. [ 64.195061][ T1136] bridge0: port 2(bridge_slave_1) entered disabled state [ 64.202403][ T1136] bridge0: port 1(bridge_slave_0) entered disabled state [ 64.446565][ T1137] netlink: 'syz.2.280': attribute type 27 has an invalid length. [ 64.525758][ T1151] tipc: Failed to remove unknown binding: 66,0,0/0:1332643645/1332643646 [ 64.560362][ T1151] tipc: Failed to remove unknown binding: 66,0,0/0:1332643645/1332643646 [ 64.579967][ T1137] veth0_vlan: left promiscuous mode [ 64.590744][ T1137] veth0_vlan: entered promiscuous mode [ 64.620737][ T1137] veth1_macvtap: left promiscuous mode [ 64.632699][ T1137] veth1_macvtap: entered promiscuous mode [ 64.661762][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.668941][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 64.678257][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.685382][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 64.715481][ T1150] tmpfs: Unsupported parameter 'mpol' [ 64.836417][ T1163] netlink: 28 bytes leftover after parsing attributes in process `syz.1.286'. [ 64.850898][ T1166] netlink: 12 bytes leftover after parsing attributes in process `syz.2.288'. [ 64.973000][ T1172] netlink: 72 bytes leftover after parsing attributes in process `syz.2.291'. [ 65.116566][ T1175] FAULT_INJECTION: forcing a failure. [ 65.116566][ T1175] name failslab, interval 1, probability 0, space 0, times 0 [ 65.140667][ T1175] CPU: 1 UID: 0 PID: 1175 Comm: syz.2.292 Not tainted syzkaller #0 0b31bef96cff8e44f9e14c4f768eb06c85e3b290 [ 65.140704][ T1175] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 65.140719][ T1175] Call Trace: [ 65.140727][ T1175] [ 65.140736][ T1175] __dump_stack+0x21/0x30 [ 65.140773][ T1175] dump_stack_lvl+0x140/0x1c0 [ 65.140805][ T1175] ? __cfi_dump_stack_lvl+0x10/0x10 [ 65.140840][ T1175] dump_stack+0x19/0x20 [ 65.140870][ T1175] should_fail_ex+0x3c2/0x510 [ 65.140896][ T1175] should_failslab+0xac/0x100 [ 65.140925][ T1175] kmem_cache_alloc_node_noprof+0x45/0x420 [ 65.140951][ T1175] ? avc_has_perm_noaudit+0x26b/0x360 [ 65.140978][ T1175] ? __alloc_skb+0x10c/0x360 [ 65.141010][ T1175] ? __asan_memcpy+0x5a/0x80 [ 65.141032][ T1175] __alloc_skb+0x10c/0x360 [ 65.141064][ T1175] alloc_skb_with_frags+0xd0/0x8b0 [ 65.141097][ T1175] ? __cfi_avc_has_perm+0x10/0x10 [ 65.141123][ T1175] ? __kasan_check_write+0x18/0x20 [ 65.141147][ T1175] sock_alloc_send_pskb+0x883/0x9a0 [ 65.141175][ T1175] ? __cfi_sock_alloc_send_pskb+0x10/0x10 [ 65.141199][ T1175] ? __kasan_check_write+0x18/0x20 [ 65.141222][ T1175] ? _raw_spin_lock+0x92/0x120 [ 65.141247][ T1175] ? __cfi__raw_spin_lock+0x10/0x10 [ 65.141275][ T1175] unix_dgram_sendmsg+0x63a/0x1a90 [ 65.141310][ T1175] ? selinux_socket_sendmsg+0x281/0x380 [ 65.141343][ T1175] ? __cfi_unix_dgram_sendmsg+0x10/0x10 [ 65.141379][ T1175] ? __count_memcg_events+0xdf/0x3a0 [ 65.141409][ T1175] ? bpf_lsm_socket_sendmsg+0xd/0x20 [ 65.141435][ T1175] ? security_socket_sendmsg+0x3d/0x100 [ 65.141465][ T1175] ____sys_sendmsg+0x99e/0xa00 [ 65.141497][ T1175] ? __import_iovec+0x3fa/0x7d0 [ 65.141531][ T1175] ? __sys_sendmsg_sock+0x50/0x50 [ 65.141557][ T1175] ? import_iovec+0x80/0xb0 [ 65.141589][ T1175] ___sys_sendmsg+0x2a6/0x370 [ 65.141614][ T1175] ? __sys_sendmsg+0x2a0/0x2a0 [ 65.141637][ T1175] ? do_user_addr_fault+0xbf5/0x1230 [ 65.141681][ T1175] __sys_sendmmsg+0x2b4/0x4e0 [ 65.141705][ T1175] ? __cfi___sys_sendmmsg+0x10/0x10 [ 65.141734][ T1175] ? __cfi_ksys_write+0x10/0x10 [ 65.141760][ T1175] __x64_sys_sendmmsg+0xa4/0xc0 [ 65.141785][ T1175] x64_sys_call+0xfec/0x2ee0 [ 65.141806][ T1175] do_syscall_64+0x57/0xf0 [ 65.141832][ T1175] ? clear_bhb_loop+0x50/0xa0 [ 65.141863][ T1175] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 65.141893][ T1175] RIP: 0033:0x7f7b5299e019 [ 65.141913][ T1175] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 65.141933][ T1175] RSP: 002b:00007f7b53785028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 65.141959][ T1175] RAX: ffffffffffffffda RBX: 00007f7b52c25fa0 RCX: 00007f7b5299e019 [ 65.141977][ T1175] RDX: 0000000000000100 RSI: 00002000000bd000 RDI: 0000000000000004 [ 65.141993][ T1175] RBP: 00007f7b53785090 R08: 0000000000000000 R09: 0000000000000000 [ 65.142008][ T1175] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 65.142023][ T1175] R13: 00007f7b52c26038 R14: 00007f7b52c25fa0 R15: 00007fff0a6d6c08 [ 65.142043][ T1175] [ 65.499312][ T1182] netlink: 'syz.3.295': attribute type 27 has an invalid length. [ 65.507216][ T1142] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 65.606750][ T1182] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.614083][ T1182] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.677361][ T1142] usb 2-1: config 220 has an invalid interface number: 76 but max is 2 [ 65.685810][ T1142] usb 2-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 65.696170][ T1142] usb 2-1: config 220 has no interface number 2 [ 65.702482][ T1142] usb 2-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 65.715689][ T1142] usb 2-1: config 220 interface 0 has no altsetting 0 [ 65.722502][ T1142] usb 2-1: config 220 interface 76 has no altsetting 0 [ 65.729461][ T1142] usb 2-1: config 220 interface 1 has no altsetting 0 [ 65.743932][ T1142] usb 2-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 65.753094][ T1142] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 65.761185][ T1142] usb 2-1: Product: syz [ 65.765784][ T1142] usb 2-1: Manufacturer: syz [ 65.772529][ T1142] usb 2-1: SerialNumber: syz [ 65.896067][ T1184] netlink: 'syz.3.295': attribute type 27 has an invalid length. [ 65.929453][ T1195] netlink: 28 bytes leftover after parsing attributes in process `syz.2.298'. [ 65.968297][ T36] kauditd_printk_skb: 553 callbacks suppressed [ 65.968318][ T36] audit: type=1400 audit(1785446543.950:4722): avc: denied { read write } for pid=295 comm="syz-executor" name="loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 66.000756][ T1184] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.007893][ T1184] bridge0: port 1(bridge_slave_0) entered forwarding state [ 66.028278][ T1169] incfs: Options parsing error. -22 [ 66.058363][ T1184] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.065526][ T1184] bridge0: port 2(bridge_slave_1) entered forwarding state [ 66.075538][ T1169] incfs: mount failed -22 [ 66.080027][ T36] audit: type=1400 audit(1785446543.950:4723): avc: denied { read write open } for pid=295 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 66.106800][ T1169] SELinux: Context system_u:object_r:syslogd_var_run_t:s0 is not valid (left unmapped). [ 66.150893][ T36] audit: type=1400 audit(1785446543.950:4724): avc: denied { ioctl } for pid=295 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=51 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 66.185059][ T1184] veth0_vlan: left promiscuous mode [ 66.190985][ T1184] veth0_vlan: entered promiscuous mode [ 66.207835][ T1203] netlink: 12 bytes leftover after parsing attributes in process `syz.2.300'. [ 66.229425][ T36] audit: type=1400 audit(1785446543.980:4725): avc: denied { read } for pid=1196 comm="syz.0.299" dev="nsfs" ino=4026532468 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 66.254971][ T1201] netlink: 72 bytes leftover after parsing attributes in process `syz.0.301'. [ 66.286921][ T36] audit: type=1400 audit(1785446543.980:4726): avc: denied { read open } for pid=1196 comm="syz.0.299" path="net:[4026532468]" dev="nsfs" ino=4026532468 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 66.303539][ T1184] veth1_macvtap: left promiscuous mode [ 66.376450][ T36] audit: type=1400 audit(1785446543.980:4727): avc: denied { create } for pid=1196 comm="syz.0.299" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 66.388405][ T1184] veth1_macvtap: entered promiscuous mode [ 66.418471][ T1142] usb 2-1: selecting invalid altsetting 0 [ 66.442222][ T36] audit: type=1400 audit(1785446544.010:4728): avc: denied { mounton } for pid=1167 comm="syz.1.290" path="/syzcgroup/unified/syz1" dev="cgroup2" ino=85 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 66.449772][ T1142] usb 2-1: Found UVC 7.01 device syz (8086:0b07) [ 66.534350][ T1142] usb 2-1: No valid video chain found. [ 66.561371][ T36] audit: type=1400 audit(1785446544.040:4729): avc: denied { read write } for pid=296 comm="syz-executor" name="loop0" dev="devtmpfs" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 66.586339][ T1142] usb 2-1: USB disconnect, device number 12 [ 66.675383][ T36] audit: type=1400 audit(1785446544.040:4730): avc: denied { read write open } for pid=296 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 66.715070][ T1214] audit: audit_backlog=65 > audit_backlog_limit=64 [ 66.739153][ T1214] input: syz1 as /devices/virtual/input/input10 [ 66.806508][ T1225] netlink: 28 bytes leftover after parsing attributes in process `syz.3.309'. [ 66.896614][ T1230] netlink: 72 bytes leftover after parsing attributes in process `syz.1.310'. [ 66.911358][ T1233] netlink: 188 bytes leftover after parsing attributes in process `syz.2.307'. [ 67.085254][ T1237] netlink: 12 bytes leftover after parsing attributes in process `syz.1.312'. [ 67.304893][ T1243] netlink: 'syz.3.315': attribute type 27 has an invalid length. [ 67.363888][ T1243] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.371614][ T1243] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.448224][ T1247] netlink: 'syz.3.315': attribute type 27 has an invalid length. [ 67.503144][ T1247] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.510279][ T1247] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.536862][ T1247] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.544457][ T1247] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.591342][ T1247] veth0_vlan: left promiscuous mode [ 67.597224][ T1247] veth0_vlan: entered promiscuous mode [ 67.610997][ T1247] veth1_macvtap: left promiscuous mode [ 67.625812][ T1247] veth1_macvtap: entered promiscuous mode [ 67.914712][ T1258] FAULT_INJECTION: forcing a failure. [ 67.914712][ T1258] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 67.944757][ T1258] CPU: 0 UID: 0 PID: 1258 Comm: syz.3.319 Not tainted syzkaller #0 0b31bef96cff8e44f9e14c4f768eb06c85e3b290 [ 67.944793][ T1258] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 67.944807][ T1258] Call Trace: [ 67.944815][ T1258] [ 67.944823][ T1258] __dump_stack+0x21/0x30 [ 67.944859][ T1258] dump_stack_lvl+0x140/0x1c0 [ 67.944892][ T1258] ? __cfi_dump_stack_lvl+0x10/0x10 [ 67.944924][ T1258] ? ____sys_sendmsg+0x780/0xa00 [ 67.944950][ T1258] dump_stack+0x19/0x20 [ 67.944980][ T1258] should_fail_ex+0x3c2/0x510 [ 67.945007][ T1258] should_fail+0xf/0x20 [ 67.945030][ T1258] should_fail_usercopy+0x1e/0x30 [ 67.945059][ T1258] _copy_from_user+0x20/0xa0 [ 67.945090][ T1258] ___sys_sendmsg+0x1c7/0x370 [ 67.945114][ T1258] ? __sys_sendmsg+0x2a0/0x2a0 [ 67.945138][ T1258] ? do_user_addr_fault+0xbf5/0x1230 [ 67.945181][ T1258] __sys_sendmmsg+0x2b4/0x4e0 [ 67.945206][ T1258] ? __cfi___sys_sendmmsg+0x10/0x10 [ 67.945235][ T1258] ? __cfi_ksys_write+0x10/0x10 [ 67.945262][ T1258] __x64_sys_sendmmsg+0xa4/0xc0 [ 67.945296][ T1258] x64_sys_call+0xfec/0x2ee0 [ 67.945317][ T1258] do_syscall_64+0x57/0xf0 [ 67.945342][ T1258] ? clear_bhb_loop+0x50/0xa0 [ 67.945373][ T1258] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 67.945403][ T1258] RIP: 0033:0x7fcbd3f9e019 [ 67.945423][ T1258] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 67.945444][ T1258] RSP: 002b:00007fcbd4f0e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 67.945469][ T1258] RAX: ffffffffffffffda RBX: 00007fcbd4225fa0 RCX: 00007fcbd3f9e019 [ 67.945487][ T1258] RDX: 0000000000000100 RSI: 00002000000bd000 RDI: 0000000000000004 [ 67.945503][ T1258] RBP: 00007fcbd4f0e090 R08: 0000000000000000 R09: 0000000000000000 [ 67.945518][ T1258] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 67.945532][ T1258] R13: 00007fcbd4226038 R14: 00007fcbd4225fa0 R15: 00007ffd7efd1da8 [ 67.945553][ T1258] [ 68.118007][ T1262] netlink: 28 bytes leftover after parsing attributes in process `syz.1.321'. [ 68.287479][ T1266] netlink: 72 bytes leftover after parsing attributes in process `syz.3.322'. [ 68.339881][ T1188] smpboot: CPU 1 is now offline [ 68.356958][ T1269] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 68.497561][ T1273] netlink: 12 bytes leftover after parsing attributes in process `syz.1.325'. [ 68.519091][ T1276] netlink: 'syz.2.327': attribute type 27 has an invalid length. [ 68.575878][ T1276] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.583173][ T1276] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.803196][ T1277] netlink: 'syz.2.327': attribute type 27 has an invalid length. [ 68.865355][ T1277] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.873096][ T1277] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.903478][ T1277] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.910600][ T1277] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.948519][ T1277] veth0_vlan: left promiscuous mode [ 68.960849][ T1277] veth0_vlan: entered promiscuous mode [ 68.976102][ T1277] veth1_macvtap: left promiscuous mode [ 68.989124][ T1277] veth1_macvtap: entered promiscuous mode [ 69.635613][ T1311] netlink: 'syz.0.340': attribute type 27 has an invalid length. [ 69.700768][ T1311] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.707984][ T1311] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.850039][ T1312] netlink: 'syz.0.340': attribute type 27 has an invalid length. [ 69.965465][ T1312] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.972571][ T1312] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.019408][ T1312] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.026537][ T1312] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.099918][ T1312] ÿÿÿÿÿÿ: left promiscuous mode [ 70.117614][ T1312] ÿÿÿÿÿÿ: entered promiscuous mode [ 70.140533][ T1312] veth1_macvtap: left promiscuous mode [ 70.155117][ T1312] veth1_macvtap: entered promiscuous mode [ 70.356873][ T1334] FAULT_INJECTION: forcing a failure. [ 70.356873][ T1334] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 70.411572][ T1334] CPU: 0 UID: 0 PID: 1334 Comm: syz.3.346 Not tainted syzkaller #0 0b31bef96cff8e44f9e14c4f768eb06c85e3b290 [ 70.411612][ T1334] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 70.411628][ T1334] Call Trace: [ 70.411635][ T1334] [ 70.411644][ T1334] __dump_stack+0x21/0x30 [ 70.411680][ T1334] dump_stack_lvl+0x140/0x1c0 [ 70.411710][ T1334] ? __cfi_dump_stack_lvl+0x10/0x10 [ 70.411742][ T1334] ? ____sys_sendmsg+0x780/0xa00 [ 70.411768][ T1334] dump_stack+0x19/0x20 [ 70.411798][ T1334] should_fail_ex+0x3c2/0x510 [ 70.411825][ T1334] should_fail+0xf/0x20 [ 70.411848][ T1334] should_fail_usercopy+0x1e/0x30 [ 70.411877][ T1334] _copy_from_user+0x20/0xa0 [ 70.411907][ T1334] ___sys_sendmsg+0x1c7/0x370 [ 70.411931][ T1334] ? __sys_sendmsg+0x2a0/0x2a0 [ 70.411955][ T1334] ? do_user_addr_fault+0xbf5/0x1230 [ 70.411999][ T1334] __sys_sendmmsg+0x2b4/0x4e0 [ 70.412046][ T1334] ? __cfi___sys_sendmmsg+0x10/0x10 [ 70.412075][ T1334] ? __cfi_ksys_write+0x10/0x10 [ 70.412102][ T1334] __x64_sys_sendmmsg+0xa4/0xc0 [ 70.412127][ T1334] x64_sys_call+0xfec/0x2ee0 [ 70.412154][ T1334] do_syscall_64+0x57/0xf0 [ 70.412177][ T1334] ? clear_bhb_loop+0x50/0xa0 [ 70.412209][ T1334] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 70.412239][ T1334] RIP: 0033:0x7fcbd3f9e019 [ 70.412258][ T1334] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 70.412279][ T1334] RSP: 002b:00007fcbd4f0e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 70.412304][ T1334] RAX: ffffffffffffffda RBX: 00007fcbd4225fa0 RCX: 00007fcbd3f9e019 [ 70.412322][ T1334] RDX: 0000000000000100 RSI: 00002000000bd000 RDI: 0000000000000004 [ 70.412338][ T1334] RBP: 00007fcbd4f0e090 R08: 0000000000000000 R09: 0000000000000000 [ 70.412353][ T1334] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 70.412367][ T1334] R13: 00007fcbd4226038 R14: 00007fcbd4225fa0 R15: 00007ffd7efd1da8 [ 70.412388][ T1334] [ 70.974747][ T36] kauditd_printk_skb: 1565 callbacks suppressed [ 70.974767][ T36] audit: type=1400 audit(1785446548.960:6246): avc: denied { ioctl } for pid=1342 comm="syz.1.350" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 71.034257][ T1105] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 71.054225][ T36] audit: type=1400 audit(1785446548.970:6247): avc: denied { create } for pid=1348 comm="syz.3.352" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 71.085810][ T36] audit: type=1400 audit(1785446548.970:6248): avc: denied { create } for pid=1348 comm="syz.3.352" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 71.106286][ T36] audit: type=1400 audit(1785446548.990:6249): avc: denied { create } for pid=1348 comm="syz.3.352" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 71.127803][ T36] audit: type=1400 audit(1785446548.990:6250): avc: denied { create } for pid=1348 comm="syz.3.352" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 71.148392][ T36] audit: type=1400 audit(1785446549.000:6251): avc: denied { create } for pid=1348 comm="syz.3.352" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 71.184567][ T36] audit: type=1400 audit(1785446549.000:6252): avc: denied { create } for pid=1348 comm="syz.3.352" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 71.228120][ T1105] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 71.234399][ T36] audit: type=1400 audit(1785446549.000:6253): avc: denied { create } for pid=1348 comm="syz.3.352" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 71.249203][ T1105] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 71.292730][ T1105] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 71.293031][ T36] audit: type=1400 audit(1785446549.000:6254): avc: denied { create } for pid=1348 comm="syz.3.352" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 71.323232][ T1343] audit: audit_backlog=65 > audit_backlog_limit=64 [ 71.344417][ T1105] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 71.367961][ T1360] netlink: 'syz.3.355': attribute type 27 has an invalid length. [ 71.375938][ T1105] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 71.384021][ T1105] usb 2-1: Product: syz [ 71.392350][ T1359] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 71.422680][ T1105] usb 2-1: Manufacturer: syz [ 71.435668][ T1105] usb 2-1: SerialNumber: syz [ 71.445327][ T1360] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.452607][ T1360] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.541571][ T1362] netlink: 'syz.3.355': attribute type 27 has an invalid length. [ 71.595364][ T1362] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.602570][ T1362] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.627544][ T1362] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.634690][ T1362] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.677602][ T1343] __nla_validate_parse: 5 callbacks suppressed [ 71.677618][ T1343] netlink: 12 bytes leftover after parsing attributes in process `syz.1.350'. [ 71.697141][ T1362] veth0_vlan: left promiscuous mode [ 71.713568][ T1362] veth0_vlan: entered promiscuous mode [ 71.725751][ T1105] usb 2-1: 1:1 : invalid UAC_AS_GENERAL desc [ 71.737897][ T1362] veth1_macvtap: left promiscuous mode [ 71.746856][ T1105] usb 2-1: 0:2 : does not exist [ 71.756182][ T1362] veth1_macvtap: entered promiscuous mode [ 71.769773][ T1105] usb 2-1: USB disconnect, device number 13 [ 71.932935][ T1023] udevd[1023]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 72.324740][ T1379] netlink: 28 bytes leftover after parsing attributes in process `syz.0.361'. [ 72.399397][ T1381] netlink: 72 bytes leftover after parsing attributes in process `syz.1.363'. [ 72.409461][ T1383] netlink: 12 bytes leftover after parsing attributes in process `syz.0.364'. [ 72.527685][ T1388] netlink: 'syz.0.366': attribute type 27 has an invalid length. [ 72.590494][ T1387] KVM: debugfs: duplicate directory 1387-4 [ 72.617286][ T1388] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.624578][ T1388] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.694297][ T1390] netlink: 'syz.0.366': attribute type 27 has an invalid length. [ 72.738003][ T1390] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.745122][ T1390] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.763426][ T1390] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.770527][ T1390] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.805647][ T1390] ÿÿÿÿÿÿ: left promiscuous mode [ 72.816447][ T1390] ÿÿÿÿÿÿ: entered promiscuous mode [ 72.830991][ T1390] veth1_macvtap: left promiscuous mode [ 72.859482][ T1390] veth1_macvtap: entered promiscuous mode [ 73.049621][ T1397] netlink: 4 bytes leftover after parsing attributes in process `syz.0.368'. [ 73.069303][ T1398] netlink: 4 bytes leftover after parsing attributes in process `syz.0.368'. [ 73.084230][ T473] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 73.254599][ T473] usb 2-1: Using ep0 maxpacket: 32 [ 73.262554][ T473] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 73.277040][ T473] usb 2-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 73.286836][ T473] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 73.294972][ T473] usb 2-1: Product: syz [ 73.299548][ T473] usb 2-1: Manufacturer: syz [ 73.304820][ T473] usb 2-1: SerialNumber: syz [ 73.311234][ T473] usb 2-1: config 0 descriptor?? [ 73.316334][ T1105] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 73.336350][ T473] usb 2-1: bad CDC descriptors [ 73.341363][ T473] usb 2-1: unsupported MDLM descriptors [ 73.444262][ T310] usb 1-1: new full-speed USB device number 21 using dummy_hcd [ 73.509968][ T1105] usb 4-1: New USB device found, idVendor=1235, idProduct=000e, bcdDevice= 0.40 [ 73.519863][ T1105] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 73.534264][ T1105] usb 4-1: Product: syz [ 73.538500][ T1105] usb 4-1: Manufacturer: syz [ 73.559673][ T1387] overlayfs: overlapping lowerdir path [ 73.565319][ T1105] usb 4-1: SerialNumber: syz [ 73.577534][ T1387] overlayfs: overlapping lowerdir path [ 73.607756][ T473] usb 2-1: USB disconnect, device number 14 [ 73.640926][ T1408] netlink: 28 bytes leftover after parsing attributes in process `syz.2.373'. [ 73.658367][ T310] usb 1-1: not running at top speed; connect to a high speed hub [ 73.687014][ T310] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 4 [ 73.728826][ T310] usb 1-1: New USB device found, idVendor=1235, idProduct=0018, bcdDevice= 0.40 [ 73.744363][ T310] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 73.762696][ T310] usb 1-1: Product: syz [ 73.769001][ T310] usb 1-1: Manufacturer: syz [ 73.779561][ T310] usb 1-1: SerialNumber: syz [ 73.871975][ T1415] netlink: 72 bytes leftover after parsing attributes in process `syz.2.375'. [ 73.893451][ T1105] usb 4-1: USB disconnect, device number 19 [ 73.956471][ T1418] netlink: 12 bytes leftover after parsing attributes in process `syz.2.376'. [ 74.003596][ T310] usb 1-1: selecting invalid altsetting 1 [ 74.019930][ T310] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 74.048811][ T310] usb 1-1: selecting invalid altsetting 1 [ 74.062555][ T1024] udevd[1024]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 74.075296][ T310] snd-usb-audio 1-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 74.110958][ T310] usb 1-1: selecting invalid altsetting 1 [ 74.135979][ T310] snd-usb-audio 1-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 74.156945][ T310] usb 1-1: USB disconnect, device number 21 [ 74.265741][ T1423] netlink: 'syz.2.378': attribute type 27 has an invalid length. [ 74.296427][ T414] udevd[414]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.2/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 74.347827][ T1423] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.355134][ T1423] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.479665][ T1426] netlink: 'syz.2.378': attribute type 27 has an invalid length. [ 74.546951][ T1426] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.554100][ T1426] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.597312][ T1426] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.604487][ T1426] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.702147][ T1426] veth0_vlan: left promiscuous mode [ 74.728520][ T1426] veth0_vlan: entered promiscuous mode [ 74.763924][ T1426] veth1_macvtap: left promiscuous mode [ 74.787962][ T1436] FAULT_INJECTION: forcing a failure. [ 74.787962][ T1436] name failslab, interval 1, probability 0, space 0, times 0 [ 74.802627][ T1426] veth1_macvtap: entered promiscuous mode [ 74.854331][ T1436] CPU: 0 UID: 0 PID: 1436 Comm: syz.0.382 Not tainted syzkaller #0 0b31bef96cff8e44f9e14c4f768eb06c85e3b290 [ 74.854369][ T1436] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 74.854385][ T1436] Call Trace: [ 74.854392][ T1436] [ 74.854401][ T1436] __dump_stack+0x21/0x30 [ 74.854438][ T1436] dump_stack_lvl+0x140/0x1c0 [ 74.854468][ T1436] ? __cfi_dump_stack_lvl+0x10/0x10 [ 74.854503][ T1436] dump_stack+0x19/0x20 [ 74.854529][ T1436] should_fail_ex+0x3c2/0x510 [ 74.854555][ T1436] should_failslab+0xac/0x100 [ 74.854585][ T1436] kmem_cache_alloc_node_noprof+0x45/0x420 [ 74.854611][ T1436] ? avc_has_perm_noaudit+0x26b/0x360 [ 74.854636][ T1436] ? __alloc_skb+0x10c/0x360 [ 74.854666][ T1436] ? __asan_memcpy+0x5a/0x80 [ 74.854691][ T1436] __alloc_skb+0x10c/0x360 [ 74.854723][ T1436] alloc_skb_with_frags+0xd0/0x8b0 [ 74.854758][ T1436] ? __cfi_avc_has_perm+0x10/0x10 [ 74.854785][ T1436] ? __kasan_check_write+0x18/0x20 [ 74.854810][ T1436] sock_alloc_send_pskb+0x883/0x9a0 [ 74.854838][ T1436] ? __cfi_sock_alloc_send_pskb+0x10/0x10 [ 74.854863][ T1436] ? __kasan_check_write+0x18/0x20 [ 74.854899][ T1436] ? _raw_spin_lock+0x92/0x120 [ 74.854925][ T1436] ? __cfi__raw_spin_lock+0x10/0x10 [ 74.854953][ T1436] unix_dgram_sendmsg+0x63a/0x1a90 [ 74.854990][ T1436] ? selinux_socket_sendmsg+0x281/0x380 [ 74.855025][ T1436] ? __cfi_unix_dgram_sendmsg+0x10/0x10 [ 74.855062][ T1436] ? __count_memcg_events+0xdf/0x3a0 [ 74.855090][ T1436] ? bpf_lsm_socket_sendmsg+0xd/0x20 [ 74.855117][ T1436] ? security_socket_sendmsg+0x3d/0x100 [ 74.855150][ T1436] ____sys_sendmsg+0x99e/0xa00 [ 74.855176][ T1436] ? __import_iovec+0x3fa/0x7d0 [ 74.855210][ T1436] ? __sys_sendmsg_sock+0x50/0x50 [ 74.855236][ T1436] ? import_iovec+0x80/0xb0 [ 74.855270][ T1436] ___sys_sendmsg+0x2a6/0x370 [ 74.855296][ T1436] ? __sys_sendmsg+0x2a0/0x2a0 [ 74.855320][ T1436] ? do_user_addr_fault+0xbf5/0x1230 [ 74.855365][ T1436] __sys_sendmmsg+0x2b4/0x4e0 [ 74.855404][ T1436] ? __cfi___sys_sendmmsg+0x10/0x10 [ 74.855435][ T1436] ? __cfi_ksys_write+0x10/0x10 [ 74.855463][ T1436] __x64_sys_sendmmsg+0xa4/0xc0 [ 74.855490][ T1436] x64_sys_call+0xfec/0x2ee0 [ 74.855514][ T1436] do_syscall_64+0x57/0xf0 [ 74.855540][ T1436] ? clear_bhb_loop+0x50/0xa0 [ 74.855574][ T1436] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 74.855606][ T1436] RIP: 0033:0x7fe8f8b9e019 [ 74.855628][ T1436] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 74.855650][ T1436] RSP: 002b:00007fe8f9aaf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 74.855677][ T1436] RAX: ffffffffffffffda RBX: 00007fe8f8e25fa0 RCX: 00007fe8f8b9e019 [ 74.855715][ T1436] RDX: 0000000000000100 RSI: 00002000000bd000 RDI: 0000000000000004 [ 74.855733][ T1436] RBP: 00007fe8f9aaf090 R08: 0000000000000000 R09: 0000000000000000 [ 74.855749][ T1436] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 74.855765][ T1436] R13: 00007fe8f8e26038 R14: 00007fe8f8e25fa0 R15: 00007ffdfcc1c698 [ 74.855788][ T1436] [ 75.222929][ T1439] syz.0.383 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 75.236728][ T1439] raw_sendmsg: syz.0.383 forgot to set AF_INET. Fix it! [ 75.283540][ T1441] netlink: 28 bytes leftover after parsing attributes in process `syz.0.384'. [ 75.454148][ T1430] tipc: Started in network mode [ 75.459197][ T1430] tipc: Node identity 1000001, cluster identity 4711 [ 75.466044][ T1430] tipc: Node number set to 16777217 [ 75.474838][ T1431] tipc: Enabling of bearer rejected, failed to enable media [ 75.483970][ T1450] : renamed from bridge0 (while UP) [ 75.513594][ T1450] input: syz1 as /devices/virtual/input/input11 [ 75.543850][ T1450] incfs: Error accessing: ./file0. [ 75.576402][ T1450] incfs: mount failed -2 [ 75.684232][ T310] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 75.836526][ T310] usb 3-1: Using ep0 maxpacket: 32 [ 75.866476][ T310] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 75.898217][ T310] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 75.940018][ T310] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 75.969534][ T310] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 76.004569][ T310] usb 3-1: config 0 descriptor?? [ 76.026092][ T310] hub 3-1:0.0: USB hub found [ 76.028432][ T36] kauditd_printk_skb: 534 callbacks suppressed [ 76.028488][ T36] audit: type=1400 audit(1785446554.000:6769): avc: denied { ioctl } for pid=1444 comm="syz.2.386" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x550a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 76.069617][ T36] audit: type=1400 audit(1785446554.000:6770): avc: denied { ioctl } for pid=1444 comm="syz.2.386" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5509 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 76.096052][ T36] audit: type=1400 audit(1785446554.000:6771): avc: denied { ioctl } for pid=1444 comm="syz.2.386" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5505 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 76.122744][ T36] audit: type=1400 audit(1785446554.000:6772): avc: denied { ioctl } for pid=1444 comm="syz.2.386" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5504 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 76.155040][ T1469] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=1469 comm=syz.0.395 [ 76.174226][ T1105] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 76.175696][ T36] audit: type=1400 audit(1785446554.010:6773): avc: denied { read } for pid=1468 comm="syz.0.395" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 76.218784][ T310] hub 3-1:0.0: 1 port detected [ 76.262086][ T36] audit: type=1400 audit(1785446554.010:6774): avc: denied { read open } for pid=1468 comm="syz.0.395" path="/dev/kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 76.286610][ T36] audit: type=1400 audit(1785446554.030:6775): avc: denied { ioctl } for pid=1466 comm="syz.1.394" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 76.312594][ T36] audit: type=1400 audit(1785446554.030:6776): avc: denied { ioctl } for pid=1468 comm="syz.0.395" path="/dev/kvm" dev="devtmpfs" ino=13 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 76.334404][ T1105] usb 2-1: Using ep0 maxpacket: 8 [ 76.345732][ T36] audit: type=1400 audit(1785446554.100:6777): avc: denied { ioctl } for pid=1466 comm="syz.1.394" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 76.354412][ T1105] usb 2-1: unable to get BOS descriptor or descriptor too short [ 76.374015][ T36] audit: type=1400 audit(1785446554.170:6778): avc: denied { read } for pid=1461 comm="syz.3.392" dev="nsfs" ino=4026532476 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 76.415446][ T1105] usb 2-1: New USB device found, idVendor=041e, idProduct=3040, bcdDevice= 0.40 [ 76.426584][ T1105] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 76.467143][ T1105] usb 2-1: Product: syz [ 76.471409][ T1105] usb 2-1: Manufacturer: syz [ 76.487932][ T1473] netlink: 'syz.3.396': attribute type 27 has an invalid length. [ 76.495887][ T1105] usb 2-1: SerialNumber: syz [ 76.550975][ T1473] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.558277][ T1473] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.672431][ T1476] netlink: 'syz.3.396': attribute type 27 has an invalid length. [ 76.698260][ T1476] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.705438][ T1476] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.718291][ T1105] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 76.736583][ T1476] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.743743][ T1476] bridge0: port 2(bridge_slave_1) entered forwarding state [ 76.752568][ T1105] usb 2-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 76.766991][ T1105] usb 2-1: USB disconnect, device number 15 [ 76.782556][ T1476] veth0_vlan: left promiscuous mode [ 76.790837][ T1476] veth0_vlan: entered promiscuous mode [ 76.821192][ T1476] veth1_macvtap: left promiscuous mode [ 76.831401][ T1480] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 76.847641][ T1476] veth1_macvtap: entered promiscuous mode [ 76.855884][ T1480] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 76.929298][ T311] udevd[311]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 76.966427][ T473] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 76.984737][ T310] hub 3-1:0.0: activate --> -90 [ 77.001461][ T1482] __nla_validate_parse: 5 callbacks suppressed [ 77.001482][ T1482] netlink: 12 bytes leftover after parsing attributes in process `syz.3.399'. [ 77.138341][ T473] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 77.151077][ T473] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 77.161166][ T473] usb 1-1: New USB device found, idVendor=1e7d, idProduct=30d4, bcdDevice= 0.01 [ 77.186421][ T473] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 77.206494][ T473] usb 1-1: config 0 descriptor?? [ 77.358897][ T1491] FAULT_INJECTION: forcing a failure. [ 77.358897][ T1491] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 77.387240][ T1491] CPU: 0 UID: 0 PID: 1491 Comm: syz.1.403 Not tainted syzkaller #0 0b31bef96cff8e44f9e14c4f768eb06c85e3b290 [ 77.387268][ T1491] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 77.387279][ T1491] Call Trace: [ 77.387284][ T1491] [ 77.387291][ T1491] __dump_stack+0x21/0x30 [ 77.387318][ T1491] dump_stack_lvl+0x140/0x1c0 [ 77.387343][ T1491] ? __cfi_dump_stack_lvl+0x10/0x10 [ 77.387365][ T1491] ? ____sys_sendmsg+0x780/0xa00 [ 77.387383][ T1491] dump_stack+0x19/0x20 [ 77.387403][ T1491] should_fail_ex+0x3c2/0x510 [ 77.387422][ T1491] should_fail+0xf/0x20 [ 77.387438][ T1491] should_fail_usercopy+0x1e/0x30 [ 77.387457][ T1491] _copy_from_user+0x20/0xa0 [ 77.387478][ T1491] ___sys_sendmsg+0x1c7/0x370 [ 77.387494][ T1491] ? __sys_sendmsg+0x2a0/0x2a0 [ 77.387510][ T1491] ? do_user_addr_fault+0xbf5/0x1230 [ 77.387540][ T1491] __sys_sendmmsg+0x2b4/0x4e0 [ 77.387557][ T1491] ? __cfi___sys_sendmmsg+0x10/0x10 [ 77.387577][ T1491] ? __cfi_ksys_write+0x10/0x10 [ 77.387594][ T1491] __x64_sys_sendmmsg+0xa4/0xc0 [ 77.387611][ T1491] x64_sys_call+0xfec/0x2ee0 [ 77.387625][ T1491] do_syscall_64+0x57/0xf0 [ 77.387643][ T1491] ? clear_bhb_loop+0x50/0xa0 [ 77.387671][ T1491] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 77.387692][ T1491] RIP: 0033:0x7f24b019e019 [ 77.387707][ T1491] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 77.387720][ T1491] RSP: 002b:00007f24b101f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 77.387737][ T1491] RAX: ffffffffffffffda RBX: 00007f24b0425fa0 RCX: 00007f24b019e019 [ 77.387750][ T1491] RDX: 0000000000000100 RSI: 00002000000bd000 RDI: 0000000000000004 [ 77.387761][ T1491] RBP: 00007f24b101f090 R08: 0000000000000000 R09: 0000000000000000 [ 77.387771][ T1491] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 77.387781][ T1491] R13: 00007f24b0426038 R14: 00007f24b0425fa0 R15: 00007ffc57d195a8 [ 77.387795][ T1491] [ 78.116495][ T473] usbhid 1-1:0.0: can't add hid device: -71 [ 78.122595][ T473] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 78.131612][ T473] usb 1-1: USB disconnect, device number 22 [ 78.217305][ T1495] netlink: 28 bytes leftover after parsing attributes in process `syz.3.405'. [ 78.304231][ T1192] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 78.364032][ T1497] netlink: 72 bytes leftover after parsing attributes in process `syz.3.406'. [ 78.378711][ T310] hub 3-1:0.0: hub_ext_port_status failed (err = -71) [ 78.386401][ T310] usb 3-1: USB disconnect, device number 22 [ 78.444258][ T1192] usb 2-1: device descriptor read/64, error -71 [ 78.534034][ T1502] netlink: 'syz.3.408': attribute type 27 has an invalid length. [ 78.645864][ T1502] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.653142][ T1502] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.704271][ T1192] usb 2-1: device descriptor read/64, error -71 [ 78.723215][ T1505] netlink: 12 bytes leftover after parsing attributes in process `syz.0.409'. [ 78.774372][ T310] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 78.905663][ T1503] netlink: 'syz.3.408': attribute type 27 has an invalid length. [ 78.944269][ T310] usb 3-1: Using ep0 maxpacket: 32 [ 78.949567][ T1192] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 78.966819][ T310] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 79.000733][ T310] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 79.031048][ T310] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 79.058699][ T1503] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.065866][ T1503] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.083332][ T310] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 79.101982][ T310] usb 3-1: config 0 descriptor?? [ 79.114235][ T1192] usb 2-1: device descriptor read/64, error -71 [ 79.128888][ T310] hub 3-1:0.0: USB hub found [ 79.140421][ T1503] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.147587][ T1503] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.213534][ T1503] veth0_vlan: left promiscuous mode [ 79.225965][ T1503] veth0_vlan: entered promiscuous mode [ 79.247931][ T1503] veth1_macvtap: left promiscuous mode [ 79.261017][ T1503] veth1_macvtap: entered promiscuous mode [ 79.332701][ T310] hub 3-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 79.365595][ T1192] usb 2-1: device descriptor read/64, error -71 [ 79.484816][ T1192] usb usb2-port1: attempt power cycle [ 79.642274][ T1519] FAULT_INJECTION: forcing a failure. [ 79.642274][ T1519] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 79.655631][ T1519] CPU: 0 UID: 0 PID: 1519 Comm: syz.3.414 Not tainted syzkaller #0 0b31bef96cff8e44f9e14c4f768eb06c85e3b290 [ 79.655669][ T1519] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 79.655684][ T1519] Call Trace: [ 79.655691][ T1519] [ 79.655700][ T1519] __dump_stack+0x21/0x30 [ 79.655741][ T1519] dump_stack_lvl+0x140/0x1c0 [ 79.655769][ T1519] ? __cfi_dump_stack_lvl+0x10/0x10 [ 79.655797][ T1519] ? ____sys_sendmsg+0x780/0xa00 [ 79.655823][ T1519] dump_stack+0x19/0x20 [ 79.655853][ T1519] should_fail_ex+0x3c2/0x510 [ 79.655879][ T1519] should_fail+0xf/0x20 [ 79.655903][ T1519] should_fail_usercopy+0x1e/0x30 [ 79.655931][ T1519] _copy_from_user+0x20/0xa0 [ 79.655971][ T1519] ___sys_sendmsg+0x1c7/0x370 [ 79.655995][ T1519] ? __sys_sendmsg+0x2a0/0x2a0 [ 79.656018][ T1519] ? do_user_addr_fault+0xbf5/0x1230 [ 79.656061][ T1519] __sys_sendmmsg+0x2b4/0x4e0 [ 79.656086][ T1519] ? __cfi___sys_sendmmsg+0x10/0x10 [ 79.656115][ T1519] ? __cfi_ksys_write+0x10/0x10 [ 79.656139][ T1519] ? handle_softirqs+0x54c/0x620 [ 79.656164][ T1519] __x64_sys_sendmmsg+0xa4/0xc0 [ 79.656188][ T1519] x64_sys_call+0xfec/0x2ee0 [ 79.656208][ T1519] do_syscall_64+0x57/0xf0 [ 79.656232][ T1519] ? clear_bhb_loop+0x50/0xa0 [ 79.656265][ T1519] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 79.656295][ T1519] RIP: 0033:0x7fcbd3f9e019 [ 79.656314][ T1519] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 79.656334][ T1519] RSP: 002b:00007fcbd4f0e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 79.656358][ T1519] RAX: ffffffffffffffda RBX: 00007fcbd4225fa0 RCX: 00007fcbd3f9e019 [ 79.656377][ T1519] RDX: 0000000000000100 RSI: 00002000000bd000 RDI: 0000000000000004 [ 79.656392][ T1519] RBP: 00007fcbd4f0e090 R08: 0000000000000000 R09: 0000000000000000 [ 79.656407][ T1519] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 79.656420][ T1519] R13: 00007fcbd4226038 R14: 00007fcbd4225fa0 R15: 00007ffd7efd1da8 [ 79.656441][ T1519] [ 79.872447][ T310] hid-generic 0003:046D:C31C.0008: unknown main item tag 0x0 [ 79.885462][ T310] hid-generic 0003:046D:C31C.0008: hidraw0: USB HID v8.00 Device [HID 046d:c31c] on usb-dummy_hcd.2-1/input0 [ 79.948072][ T1192] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 79.996002][ T1192] usb 2-1: device descriptor read/8, error -71 [ 80.031291][ T1525] netlink: 28 bytes leftover after parsing attributes in process `syz.3.415'. [ 80.086413][ T1500] netlink: 8 bytes leftover after parsing attributes in process `syz.2.407'. [ 80.134138][ T1527] netlink: 72 bytes leftover after parsing attributes in process `syz.3.417'. [ 80.162151][ T1192] usb 2-1: device descriptor read/8, error -71 [ 80.214373][ T310] usb 3-1: USB disconnect, device number 23 [ 80.238977][ T1529] netlink: 12 bytes leftover after parsing attributes in process `syz.0.418'. [ 80.356175][ T1536] netlink: 'syz.0.420': attribute type 27 has an invalid length. [ 80.404255][ T1192] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 80.424879][ T1536] : port 2(bridge_slave_1) entered disabled state [ 80.431683][ T1536] : port 1(bridge_slave_0) entered disabled state [ 80.467157][ T1192] usb 2-1: device descriptor read/8, error -71 [ 80.560113][ T1537] netlink: 'syz.0.420': attribute type 27 has an invalid length. [ 80.606798][ T1192] usb 2-1: device descriptor read/8, error -71 [ 80.638914][ T1537] : port 1(bridge_slave_0) entered blocking state [ 80.645566][ T1537] : port 1(bridge_slave_0) entered forwarding state [ 80.667757][ T1537] : port 2(bridge_slave_1) entered blocking state [ 80.674407][ T1537] : port 2(bridge_slave_1) entered forwarding state [ 80.710883][ T1537] ÿÿÿÿÿÿ: left promiscuous mode [ 80.721737][ T1537] ÿÿÿÿÿÿ: entered promiscuous mode [ 80.727619][ T1192] usb usb2-port1: unable to enumerate USB device [ 80.744571][ T1537] veth1_macvtap: left promiscuous mode [ 80.757605][ T1537] veth1_macvtap: entered promiscuous mode [ 80.947649][ T1545] FAULT_INJECTION: forcing a failure. [ 80.947649][ T1545] name failslab, interval 1, probability 0, space 0, times 0 [ 80.960623][ T1545] CPU: 0 UID: 0 PID: 1545 Comm: syz.0.424 Not tainted syzkaller #0 0b31bef96cff8e44f9e14c4f768eb06c85e3b290 [ 80.960662][ T1545] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 80.960678][ T1545] Call Trace: [ 80.960685][ T1545] [ 80.960693][ T1545] __dump_stack+0x21/0x30 [ 80.960731][ T1545] dump_stack_lvl+0x140/0x1c0 [ 80.960763][ T1545] ? __cfi_dump_stack_lvl+0x10/0x10 [ 80.960797][ T1545] dump_stack+0x19/0x20 [ 80.960827][ T1545] should_fail_ex+0x3c2/0x510 [ 80.960853][ T1545] should_failslab+0xac/0x100 [ 80.960900][ T1545] kmem_cache_alloc_node_noprof+0x45/0x420 [ 80.960925][ T1545] ? avc_has_perm_noaudit+0x26b/0x360 [ 80.960953][ T1545] ? __alloc_skb+0x10c/0x360 [ 80.960984][ T1545] ? __asan_memcpy+0x5a/0x80 [ 80.961006][ T1545] __alloc_skb+0x10c/0x360 [ 80.961038][ T1545] alloc_skb_with_frags+0xd0/0x8b0 [ 80.961071][ T1545] ? __cfi_avc_has_perm+0x10/0x10 [ 80.961097][ T1545] ? __kasan_check_write+0x18/0x20 [ 80.961120][ T1545] sock_alloc_send_pskb+0x883/0x9a0 [ 80.961147][ T1545] ? __cfi_sock_alloc_send_pskb+0x10/0x10 [ 80.961171][ T1545] ? __kasan_check_write+0x18/0x20 [ 80.961194][ T1545] ? _raw_spin_lock+0x92/0x120 [ 80.961219][ T1545] ? __cfi__raw_spin_lock+0x10/0x10 [ 80.961246][ T1545] unix_dgram_sendmsg+0x63a/0x1a90 [ 80.961281][ T1545] ? selinux_socket_sendmsg+0x281/0x380 [ 80.961313][ T1545] ? __cfi_unix_dgram_sendmsg+0x10/0x10 [ 80.961357][ T1545] ? __count_memcg_events+0xdf/0x3a0 [ 80.961387][ T1545] ? bpf_lsm_socket_sendmsg+0xd/0x20 [ 80.961413][ T1545] ? security_socket_sendmsg+0x3d/0x100 [ 80.961444][ T1545] ____sys_sendmsg+0x99e/0xa00 [ 80.961468][ T1545] ? __import_iovec+0x3fa/0x7d0 [ 80.961502][ T1545] ? __sys_sendmsg_sock+0x50/0x50 [ 80.961526][ T1545] ? import_iovec+0x80/0xb0 [ 80.961562][ T1545] ___sys_sendmsg+0x2a6/0x370 [ 80.961586][ T1545] ? __sys_sendmsg+0x2a0/0x2a0 [ 80.961609][ T1545] ? do_user_addr_fault+0xbf5/0x1230 [ 80.961653][ T1545] __sys_sendmmsg+0x2b4/0x4e0 [ 80.961678][ T1545] ? __cfi___sys_sendmmsg+0x10/0x10 [ 80.961707][ T1545] ? __cfi_ksys_write+0x10/0x10 [ 80.961732][ T1545] __x64_sys_sendmmsg+0xa4/0xc0 [ 80.961756][ T1545] x64_sys_call+0xfec/0x2ee0 [ 80.961778][ T1545] do_syscall_64+0x57/0xf0 [ 80.961803][ T1545] ? clear_bhb_loop+0x50/0xa0 [ 80.961834][ T1545] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 80.961864][ T1545] RIP: 0033:0x7fe8f8b9e019 [ 80.961881][ T1545] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 80.961898][ T1545] RSP: 002b:00007fe8f9aaf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 80.961920][ T1545] RAX: ffffffffffffffda RBX: 00007fe8f8e25fa0 RCX: 00007fe8f8b9e019 [ 80.961937][ T1545] RDX: 0000000000000100 RSI: 00002000000bd000 RDI: 0000000000000004 [ 80.961952][ T1545] RBP: 00007fe8f9aaf090 R08: 0000000000000000 R09: 0000000000000000 [ 80.961968][ T1545] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 80.961981][ T1545] R13: 00007fe8f8e26038 R14: 00007fe8f8e25fa0 R15: 00007ffdfcc1c698 [ 80.962001][ T1545] [ 81.307697][ T1547] netlink: 72 bytes leftover after parsing attributes in process `syz.1.425'. [ 81.322458][ T36] kauditd_printk_skb: 421 callbacks suppressed [ 81.322484][ T36] audit: type=1400 audit(1785446559.260:7199): avc: denied { read write } for pid=294 comm="syz-executor" name="loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 81.356292][ T36] audit: type=1400 audit(1785446559.260:7200): avc: denied { read write open } for pid=294 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 81.382863][ T36] audit: type=1400 audit(1785446559.260:7201): avc: denied { ioctl } for pid=294 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 81.594677][ T36] audit: type=1400 audit(1785446559.580:7202): avc: denied { ioctl } for pid=1540 comm="syz.3.422" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 81.655009][ T36] audit: type=1400 audit(1785446559.640:7203): avc: denied { read write } for pid=294 comm="syz-executor" name="loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 81.679566][ T36] audit: type=1400 audit(1785446559.640:7204): avc: denied { read write open } for pid=294 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 81.684717][ T1278] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 81.713545][ T36] audit: type=1400 audit(1785446559.640:7205): avc: denied { ioctl } for pid=294 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 81.739547][ T36] audit: type=1400 audit(1785446559.720:7206): avc: denied { ioctl } for pid=1540 comm="syz.3.422" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 81.767991][ T36] audit: type=1400 audit(1785446559.720:7207): avc: denied { ioctl } for pid=1540 comm="syz.3.422" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 81.770110][ T1552] netlink: 28 bytes leftover after parsing attributes in process `syz.1.426'. [ 81.796535][ T36] audit: type=1400 audit(1785446559.720:7208): avc: denied { ioctl } for pid=1540 comm="syz.3.422" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 81.884373][ T1278] usb 4-1: Using ep0 maxpacket: 16 [ 81.894109][ T1278] usb 4-1: config index 0 descriptor too short (expected 51443, got 18) [ 81.906227][ T1278] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 81.928122][ T1278] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 81.948761][ T1278] usb 4-1: Product: syz [ 81.953044][ T1278] usb 4-1: Manufacturer: syz [ 81.976334][ T1278] usb 4-1: SerialNumber: syz [ 81.985561][ T1556] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 82.004922][ T1556] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 82.018965][ T1278] r8152-cfgselector 4-1: Unknown version 0x0000 [ 82.031518][ T1278] r8152-cfgselector 4-1: config 0 descriptor?? [ 82.043269][ T1559] __nla_validate_parse: 1 callbacks suppressed [ 82.043292][ T1559] netlink: 12 bytes leftover after parsing attributes in process `syz.0.429'. [ 82.171908][ T1563] netlink: 100 bytes leftover after parsing attributes in process `syz.0.431'. [ 82.204276][ T1192] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 82.237952][ T1565] netlink: 'syz.0.432': attribute type 27 has an invalid length. [ 82.275699][ T1565] : port 2(bridge_slave_1) entered disabled state [ 82.282448][ T1565] : port 1(bridge_slave_0) entered disabled state [ 82.351307][ T1566] netlink: 'syz.0.432': attribute type 27 has an invalid length. [ 82.359387][ T1192] usb 2-1: Using ep0 maxpacket: 8 [ 82.385497][ T1192] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 82.409364][ T1192] usb 2-1: New USB device found, idVendor=1235, idProduct=8002, bcdDevice= 0.40 [ 82.430386][ T1192] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 82.445949][ T1566] : port 1(bridge_slave_0) entered blocking state [ 82.452535][ T1566] : port 1(bridge_slave_0) entered forwarding state [ 82.469902][ T1192] usb 2-1: Product: syz [ 82.476860][ T1192] usb 2-1: Manufacturer: syz [ 82.491761][ T1192] usb 2-1: SerialNumber: syz [ 82.497799][ T1566] : port 2(bridge_slave_1) entered blocking state [ 82.504437][ T1566] : port 2(bridge_slave_1) entered forwarding state [ 82.547276][ T1566] ÿÿÿÿÿÿ: left promiscuous mode [ 82.564023][ T1566] ÿÿÿÿÿÿ: entered promiscuous mode [ 82.576040][ T1566] veth1_macvtap: left promiscuous mode [ 82.594934][ T1566] veth1_macvtap: entered promiscuous mode [ 82.642879][ T1190] r8152-cfgselector 4-1: USB disconnect, device number 20 [ 83.033146][ T1575] FAULT_INJECTION: forcing a failure. [ 83.033146][ T1575] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 83.046642][ T1575] CPU: 0 UID: 0 PID: 1575 Comm: syz.3.435 Not tainted syzkaller #0 0b31bef96cff8e44f9e14c4f768eb06c85e3b290 [ 83.046682][ T1575] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 83.046714][ T1575] Call Trace: [ 83.046721][ T1575] [ 83.046731][ T1575] __dump_stack+0x21/0x30 [ 83.046770][ T1575] dump_stack_lvl+0x140/0x1c0 [ 83.046804][ T1575] ? __cfi_dump_stack_lvl+0x10/0x10 [ 83.046837][ T1575] ? ____sys_sendmsg+0x780/0xa00 [ 83.046864][ T1575] dump_stack+0x19/0x20 [ 83.046895][ T1575] should_fail_ex+0x3c2/0x510 [ 83.046923][ T1575] should_fail+0xf/0x20 [ 83.046947][ T1575] should_fail_usercopy+0x1e/0x30 [ 83.046972][ T1575] _copy_from_user+0x20/0xa0 [ 83.047005][ T1575] ___sys_sendmsg+0x1c7/0x370 [ 83.047030][ T1575] ? __sys_sendmsg+0x2a0/0x2a0 [ 83.047055][ T1575] ? do_user_addr_fault+0xbf5/0x1230 [ 83.047100][ T1575] __sys_sendmmsg+0x2b4/0x4e0 [ 83.047124][ T1575] ? __cfi___sys_sendmmsg+0x10/0x10 [ 83.047154][ T1575] ? __cfi_ksys_write+0x10/0x10 [ 83.047193][ T1575] __x64_sys_sendmmsg+0xa4/0xc0 [ 83.047218][ T1575] x64_sys_call+0xfec/0x2ee0 [ 83.047240][ T1575] do_syscall_64+0x57/0xf0 [ 83.047267][ T1575] ? clear_bhb_loop+0x50/0xa0 [ 83.047300][ T1575] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 83.047331][ T1575] RIP: 0033:0x7fcbd3f9e019 [ 83.047353][ T1575] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 83.047372][ T1575] RSP: 002b:00007fcbd4f0e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 83.047398][ T1575] RAX: ffffffffffffffda RBX: 00007fcbd4225fa0 RCX: 00007fcbd3f9e019 [ 83.047416][ T1575] RDX: 0000000000000100 RSI: 00002000000bd000 RDI: 0000000000000004 [ 83.047432][ T1575] RBP: 00007fcbd4f0e090 R08: 0000000000000000 R09: 0000000000000000 [ 83.047448][ T1575] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 83.047464][ T1575] R13: 00007fcbd4226038 R14: 00007fcbd4225fa0 R15: 00007ffd7efd1da8 [ 83.047485][ T1575] [ 83.300398][ T1577] netlink: 28 bytes leftover after parsing attributes in process `syz.3.436'. [ 83.604382][ T1190] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 83.728431][ T1581] netlink: 72 bytes leftover after parsing attributes in process `syz.0.438'. [ 83.757006][ T1190] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 83.779136][ T1190] usb 4-1: config 0 has no interfaces? [ 83.791330][ T1190] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 83.810762][ T1190] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 83.826053][ T1583] netlink: 12 bytes leftover after parsing attributes in process `syz.0.439'. [ 83.837330][ T1190] usb 4-1: config 0 descriptor?? [ 84.031911][ T1585] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=1585 comm=syz.0.440 [ 84.046739][ T1585] netlink: 'syz.0.440': attribute type 16 has an invalid length. [ 84.057312][ T1579] netlink: 'syz.3.437': attribute type 16 has an invalid length. [ 84.073070][ T1579] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 84.081933][ T1579] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 84.117780][ T1579] SELinux: failed to load policy [ 84.131746][ T310] usb 4-1: USB disconnect, device number 21 [ 84.256634][ T1590] netlink: 'syz.2.442': attribute type 27 has an invalid length. [ 84.286845][ T1590] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.294044][ T1590] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.360659][ T1591] netlink: 'syz.2.442': attribute type 27 has an invalid length. [ 84.413542][ T1591] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.420670][ T1591] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.446810][ T1591] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.454042][ T1591] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.494084][ T1591] veth0_vlan: left promiscuous mode [ 84.506460][ T1591] veth0_vlan: entered promiscuous mode [ 84.530531][ T1591] veth1_macvtap: left promiscuous mode [ 84.543668][ T1591] veth1_macvtap: entered promiscuous mode [ 84.743016][ T1597] FAULT_INJECTION: forcing a failure. [ 84.743016][ T1597] name failslab, interval 1, probability 0, space 0, times 0 [ 84.756150][ T1597] CPU: 0 UID: 0 PID: 1597 Comm: syz.3.445 Not tainted syzkaller #0 0b31bef96cff8e44f9e14c4f768eb06c85e3b290 [ 84.756191][ T1597] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 84.756215][ T1597] Call Trace: [ 84.756223][ T1597] [ 84.756232][ T1597] __dump_stack+0x21/0x30 [ 84.756271][ T1597] dump_stack_lvl+0x140/0x1c0 [ 84.756305][ T1597] ? __cfi_dump_stack_lvl+0x10/0x10 [ 84.756341][ T1597] dump_stack+0x19/0x20 [ 84.756368][ T1597] should_fail_ex+0x3c2/0x510 [ 84.756393][ T1597] should_failslab+0xac/0x100 [ 84.756421][ T1597] kmem_cache_alloc_node_noprof+0x45/0x420 [ 84.756448][ T1597] ? avc_has_perm_noaudit+0x26b/0x360 [ 84.756476][ T1597] ? __alloc_skb+0x10c/0x360 [ 84.756507][ T1597] ? __asan_memcpy+0x5a/0x80 [ 84.756531][ T1597] __alloc_skb+0x10c/0x360 [ 84.756570][ T1597] alloc_skb_with_frags+0xd0/0x8b0 [ 84.756604][ T1597] ? __cfi_avc_has_perm+0x10/0x10 [ 84.756632][ T1597] ? __kasan_check_write+0x18/0x20 [ 84.756657][ T1597] sock_alloc_send_pskb+0x883/0x9a0 [ 84.756686][ T1597] ? __cfi_sock_alloc_send_pskb+0x10/0x10 [ 84.756710][ T1597] ? __kasan_check_write+0x18/0x20 [ 84.756733][ T1597] ? _raw_spin_lock+0x92/0x120 [ 84.756760][ T1597] ? __cfi__raw_spin_lock+0x10/0x10 [ 84.756788][ T1597] unix_dgram_sendmsg+0x63a/0x1a90 [ 84.756825][ T1597] ? selinux_socket_sendmsg+0x281/0x380 [ 84.756859][ T1597] ? __cfi_unix_dgram_sendmsg+0x10/0x10 [ 84.756905][ T1597] ? __count_memcg_events+0xdf/0x3a0 [ 84.756936][ T1597] ? bpf_lsm_socket_sendmsg+0xd/0x20 [ 84.756963][ T1597] ? security_socket_sendmsg+0x3d/0x100 [ 84.756996][ T1597] ____sys_sendmsg+0x99e/0xa00 [ 84.757022][ T1597] ? __import_iovec+0x3fa/0x7d0 [ 84.757055][ T1597] ? __sys_sendmsg_sock+0x50/0x50 [ 84.757079][ T1597] ? import_iovec+0x80/0xb0 [ 84.757114][ T1597] ___sys_sendmsg+0x2a6/0x370 [ 84.757139][ T1597] ? __sys_sendmsg+0x2a0/0x2a0 [ 84.757163][ T1597] ? do_user_addr_fault+0xbf5/0x1230 [ 84.757208][ T1597] __sys_sendmmsg+0x2b4/0x4e0 [ 84.757234][ T1597] ? __cfi___sys_sendmmsg+0x10/0x10 [ 84.757264][ T1597] ? __cfi_ksys_write+0x10/0x10 [ 84.757291][ T1597] __x64_sys_sendmmsg+0xa4/0xc0 [ 84.757317][ T1597] x64_sys_call+0xfec/0x2ee0 [ 84.757338][ T1597] do_syscall_64+0x57/0xf0 [ 84.757365][ T1597] ? clear_bhb_loop+0x50/0xa0 [ 84.757397][ T1597] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 84.757429][ T1597] RIP: 0033:0x7fcbd3f9e019 [ 84.757450][ T1597] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 84.757471][ T1597] RSP: 002b:00007fcbd4f0e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 84.757497][ T1597] RAX: ffffffffffffffda RBX: 00007fcbd4225fa0 RCX: 00007fcbd3f9e019 [ 84.757516][ T1597] RDX: 0000000000000100 RSI: 00002000000bd000 RDI: 0000000000000004 [ 84.757531][ T1597] RBP: 00007fcbd4f0e090 R08: 0000000000000000 R09: 0000000000000000 [ 84.757547][ T1597] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 84.757563][ T1597] R13: 00007fcbd4226038 R14: 00007fcbd4225fa0 R15: 00007ffd7efd1da8 [ 84.757584][ T1597] [ 85.238542][ T1603] netlink: 72 bytes leftover after parsing attributes in process `syz.1.448'. [ 85.327008][ T1607] netlink: 12 bytes leftover after parsing attributes in process `syz.2.450'. [ 85.377791][ T1601] netlink: 28 bytes leftover after parsing attributes in process `syz.0.447'. [ 85.412099][ T1192] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 85.434269][ T1192] usb 2-1: unit 2 not found! [ 85.444294][ T1192] usb 2-1: 6:0: failed to get current value for ch 0 (-71) [ 85.534905][ T1613] netlink: 'syz.0.453': attribute type 27 has an invalid length. [ 85.555792][ T1192] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 85.634307][ T1192] usb 2-1: USB disconnect, device number 20 [ 85.652591][ T1613] : port 2(bridge_slave_1) entered disabled state [ 85.659373][ T1613] : port 1(bridge_slave_0) entered disabled state [ 85.782047][ T1023] udevd[1023]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 85.849398][ T1614] netlink: 'syz.0.453': attribute type 27 has an invalid length. [ 85.901906][ T1614] : port 1(bridge_slave_0) entered blocking state [ 85.908547][ T1614] : port 1(bridge_slave_0) entered forwarding state [ 85.931509][ T1614] : port 2(bridge_slave_1) entered blocking state [ 85.938812][ T1614] : port 2(bridge_slave_1) entered forwarding state [ 85.974333][ T1192] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 85.985794][ T1614] ÿÿÿÿÿÿ: left promiscuous mode [ 85.996637][ T1614] ÿÿÿÿÿÿ: entered promiscuous mode [ 86.013002][ T1614] veth1_macvtap: left promiscuous mode [ 86.026510][ T1614] veth1_macvtap: entered promiscuous mode [ 86.124220][ T1192] usb 2-1: Using ep0 maxpacket: 16 [ 86.146090][ T1192] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 86.165366][ T1192] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 86.204040][ T1192] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 86.225158][ T1192] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 86.233228][ T1192] usb 2-1: Product: syz [ 86.255222][ T1626] netlink: 72 bytes leftover after parsing attributes in process `syz.0.457'. [ 86.268697][ T1192] usb 2-1: Manufacturer: syz [ 86.273368][ T1192] usb 2-1: SerialNumber: syz [ 86.333721][ T36] kauditd_printk_skb: 398 callbacks suppressed [ 86.333739][ T36] audit: type=1400 audit(1785446564.310:7607): avc: denied { read write } for pid=296 comm="syz-executor" name="loop0" dev="devtmpfs" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 86.412861][ T36] audit: type=1400 audit(1785446564.350:7608): avc: denied { ioctl } for pid=1623 comm="syz.2.456" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 86.437817][ T310] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 86.456041][ T36] audit: type=1400 audit(1785446564.360:7609): avc: denied { read write open } for pid=296 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 86.483031][ T36] audit: type=1400 audit(1785446564.360:7610): avc: denied { ioctl } for pid=296 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=49 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 86.525310][ T1192] usb 2-1: 0:2 : does not exist [ 86.530909][ T36] audit: type=1400 audit(1785446564.370:7611): avc: denied { read write } for pid=1627 comm="syz.3.458" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 86.544313][ T1192] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 86.580974][ T36] audit: type=1400 audit(1785446564.370:7612): avc: denied { read write open } for pid=1627 comm="syz.3.458" path="/dev/raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 86.607488][ T36] audit: type=1400 audit(1785446564.370:7613): avc: denied { ioctl } for pid=1627 comm="syz.3.458" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 86.624343][ T1190] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 86.643424][ T36] audit: type=1400 audit(1785446564.370:7614): avc: denied { ioctl } for pid=1627 comm="syz.3.458" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5501 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 86.647634][ T310] usb 3-1: unable to get BOS descriptor or descriptor too short [ 86.674357][ T36] audit: type=1400 audit(1785446564.370:7615): avc: denied { ioctl } for pid=1627 comm="syz.3.458" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 86.694777][ T1192] usb 2-1: USB disconnect, device number 21 [ 86.729289][ T310] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 86.749691][ T310] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 50, changing to 7 [ 86.765640][ T36] audit: type=1400 audit(1785446564.370:7616): avc: denied { ioctl } for pid=1627 comm="syz.3.458" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 86.774430][ T310] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 86.810967][ T1633] netlink: 12 bytes leftover after parsing attributes in process `syz.0.460'. [ 86.838454][ T310] usb 3-1: New USB device found, idVendor=2b53, idProduct=0024, bcdDevice= 0.40 [ 86.849012][ T310] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=2 [ 86.868072][ T310] usb 3-1: Product: syz [ 86.874304][ T1190] usb 4-1: Using ep0 maxpacket: 16 [ 86.883985][ T1190] usb 4-1: config 0 has an invalid interface number: 34 but max is 0 [ 86.893488][ T310] usb 3-1: Manufacturer: syz [ 86.902355][ T1190] usb 4-1: config 0 has no interface number 0 [ 86.912460][ T310] usb 3-1: SerialNumber: syz [ 86.917515][ T1190] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 86.941357][ T1190] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 86.953361][ T1023] udevd[1023]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 86.973544][ T1190] usb 4-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 86.992089][ T1190] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 87.010482][ T1190] usb 4-1: Product: syz [ 87.020567][ T1190] usb 4-1: Manufacturer: syz [ 87.031571][ T1190] usb 4-1: SerialNumber: syz [ 87.042876][ T1190] usb 4-1: config 0 descriptor?? [ 87.064303][ T1629] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 87.082200][ T1629] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 87.154518][ T310] usb 3-1: USB disconnect, device number 24 [ 87.201348][ T1640] netlink: 28 bytes leftover after parsing attributes in process `syz.1.463'. [ 87.310645][ T1628] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 87.345006][ T1628] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 87.371267][ T346] udevd[346]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 87.410637][ T1646] netlink: 'syz.0.466': attribute type 27 has an invalid length. [ 87.491884][ T1646] : port 2(bridge_slave_1) entered disabled state [ 87.498662][ T1646] : port 1(bridge_slave_0) entered disabled state [ 87.608939][ T1190] asix 4-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 87.636487][ T1648] netlink: 'syz.0.466': attribute type 27 has an invalid length. [ 87.765235][ T1648] : port 1(bridge_slave_0) entered blocking state [ 87.772009][ T1648] : port 1(bridge_slave_0) entered forwarding state [ 87.810037][ T1190] asix 4-1:0.34 (unnamed net_device) (uninitialized): invalid PHY address: 36 [ 87.823570][ T1653] netlink: 72 bytes leftover after parsing attributes in process `syz.2.468'. [ 87.843556][ T1648] : port 2(bridge_slave_1) entered blocking state [ 87.850141][ T1648] : port 2(bridge_slave_1) entered forwarding state [ 87.936131][ T1648] ÿÿÿÿÿÿ: left promiscuous mode [ 87.955789][ T1648] ÿÿÿÿÿÿ: entered promiscuous mode [ 87.986281][ T1648] veth1_macvtap: left promiscuous mode [ 88.018371][ T1648] veth1_macvtap: entered promiscuous mode [ 88.115779][ T1278] usb 4-1: USB disconnect, device number 22 [ 88.241843][ T1659] netlink: 12 bytes leftover after parsing attributes in process `syz.2.471'. [ 88.480005][ T1665] netlink: 28 bytes leftover after parsing attributes in process `syz.2.474'. [ 89.119910][ T1677] netlink: 'syz.3.478': attribute type 27 has an invalid length. [ 89.137338][ T1674] netlink: 72 bytes leftover after parsing attributes in process `syz.0.477'. [ 89.197610][ T1677] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.204868][ T1677] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.441851][ T1678] netlink: 'syz.3.478': attribute type 27 has an invalid length. [ 89.468808][ T1683] netlink: 12 bytes leftover after parsing attributes in process `syz.1.481'. [ 89.523947][ T1678] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.531076][ T1678] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.595093][ T1678] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.602218][ T1678] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.692283][ T1678] veth0_vlan: left promiscuous mode [ 89.713182][ T1678] veth0_vlan: entered promiscuous mode [ 89.733389][ T1678] veth1_macvtap: left promiscuous mode [ 89.753891][ T1678] veth1_macvtap: entered promiscuous mode [ 89.980137][ T1696] netlink: 28 bytes leftover after parsing attributes in process `syz.3.484'. [ 90.049426][ T1698] FAULT_INJECTION: forcing a failure. [ 90.049426][ T1698] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 90.083997][ T1698] CPU: 0 UID: 0 PID: 1698 Comm: syz.0.486 Not tainted syzkaller #0 0b31bef96cff8e44f9e14c4f768eb06c85e3b290 [ 90.084035][ T1698] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 90.084059][ T1698] Call Trace: [ 90.084067][ T1698] [ 90.084083][ T1698] __dump_stack+0x21/0x30 [ 90.084120][ T1698] dump_stack_lvl+0x140/0x1c0 [ 90.084183][ T1698] ? __cfi_dump_stack_lvl+0x10/0x10 [ 90.084213][ T1698] ? check_stack_object+0x138/0x150 [ 90.084238][ T1698] dump_stack+0x19/0x20 [ 90.084269][ T1698] should_fail_ex+0x3c2/0x510 [ 90.084296][ T1698] should_fail+0xf/0x20 [ 90.084319][ T1698] should_fail_usercopy+0x1e/0x30 [ 90.084347][ T1698] _copy_to_user+0x24/0xa0 [ 90.084379][ T1698] simple_read_from_buffer+0xed/0x160 [ 90.084412][ T1698] proc_fail_nth_read+0x1aa/0x220 [ 90.084451][ T1698] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 90.084485][ T1698] ? bpf_lsm_file_permission+0xd/0x20 [ 90.084516][ T1698] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 90.084549][ T1698] vfs_read+0x28b/0xc70 [ 90.084574][ T1698] ? __cfi_vfs_read+0x10/0x10 [ 90.084596][ T1698] ? __kasan_check_write+0x18/0x20 [ 90.084619][ T1698] ? mutex_lock+0x97/0x1d0 [ 90.084647][ T1698] ? __cfi_mutex_lock+0x10/0x10 [ 90.084676][ T1698] ksys_read+0x145/0x260 [ 90.084698][ T1698] ? xfd_validate_state+0x68/0x140 [ 90.084730][ T1698] ? __cfi_ksys_read+0x10/0x10 [ 90.084754][ T1698] ? __kasan_check_write+0x18/0x20 [ 90.084777][ T1698] ? fpregs_restore_userregs+0x11c/0x260 [ 90.084815][ T1698] __x64_sys_read+0x7f/0x90 [ 90.084838][ T1698] x64_sys_call+0x2638/0x2ee0 [ 90.084860][ T1698] do_syscall_64+0x57/0xf0 [ 90.084885][ T1698] ? clear_bhb_loop+0x50/0xa0 [ 90.084916][ T1698] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 90.084947][ T1698] RIP: 0033:0x7fe8f8b5e84e [ 90.084966][ T1698] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 90.084993][ T1698] RSP: 002b:00007fe8f9aaefe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 90.085019][ T1698] RAX: ffffffffffffffda RBX: 00007fe8f9aaf6c0 RCX: 00007fe8f8b5e84e [ 90.085037][ T1698] RDX: 000000000000000f RSI: 00007fe8f9aaf0a0 RDI: 0000000000000005 [ 90.085052][ T1698] RBP: 00007fe8f9aaf090 R08: 0000000000000000 R09: 0000000000000000 [ 90.085067][ T1698] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 90.085082][ T1698] R13: 00007fe8f8e26038 R14: 00007fe8f8e25fa0 R15: 00007ffdfcc1c698 [ 90.085102][ T1698] [ 90.359166][ T1705] netlink: 72 bytes leftover after parsing attributes in process `syz.2.487'. [ 90.429746][ T1708] netlink: 12 bytes leftover after parsing attributes in process `syz.3.490'. [ 90.514516][ T1712] netlink: 'syz.3.492': attribute type 27 has an invalid length. [ 90.577308][ T1712] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.584554][ T1712] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.693696][ T1715] UDC core: g1: couldn't find an available UDC or it's busy [ 90.720990][ T1713] netlink: 'syz.3.492': attribute type 27 has an invalid length. [ 90.867905][ T1713] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.875127][ T1713] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.938661][ T1713] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.945824][ T1713] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.009470][ T1723] netlink: 28 bytes leftover after parsing attributes in process `syz.0.496'. [ 91.029362][ T1713] veth0_vlan: left promiscuous mode [ 91.045018][ T1713] veth0_vlan: entered promiscuous mode [ 91.063303][ T1713] veth1_macvtap: left promiscuous mode [ 91.086521][ T1713] veth1_macvtap: entered promiscuous mode [ 91.350551][ T36] kauditd_printk_skb: 862 callbacks suppressed [ 91.350569][ T36] audit: type=1400 audit(1785446569.330:8479): avc: denied { create } for pid=1730 comm="syz.3.499" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 91.426621][ T36] audit: type=1400 audit(1785446569.330:8480): avc: denied { write } for pid=1730 comm="syz.3.499" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 91.448480][ T36] audit: type=1400 audit(1785446569.350:8481): avc: denied { create } for pid=1732 comm="syz.0.500" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 91.484225][ T36] audit: type=1400 audit(1785446569.360:8482): avc: denied { write } for pid=1732 comm="syz.0.500" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 91.524358][ T36] audit: type=1400 audit(1785446569.380:8483): avc: denied { read write } for pid=1728 comm="syz.2.498" name="binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 91.580323][ T36] audit: type=1400 audit(1785446569.380:8484): avc: denied { read write open } for pid=1728 comm="syz.2.498" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 91.644385][ T36] audit: type=1400 audit(1785446569.380:8485): avc: denied { read write } for pid=297 comm="syz-executor" name="loop3" dev="devtmpfs" ino=52 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 91.686780][ T36] audit: type=1400 audit(1785446569.380:8486): avc: denied { read write open } for pid=297 comm="syz-executor" path="/dev/loop3" dev="devtmpfs" ino=52 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 91.759327][ T36] audit: type=1400 audit(1785446569.380:8487): avc: denied { ioctl } for pid=297 comm="syz-executor" path="/dev/loop3" dev="devtmpfs" ino=52 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 91.803097][ T36] audit: type=1400 audit(1785446569.390:8488): avc: denied { ioctl } for pid=1728 comm="syz.2.498" path="/dev/binderfs/binder0" dev="binder" ino=13 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 91.953795][ T1755] netlink: 'syz.2.507': attribute type 27 has an invalid length. [ 92.003323][ T1755] bridge0: port 2(bridge_slave_1) entered disabled state [ 92.010843][ T1755] bridge0: port 1(bridge_slave_0) entered disabled state [ 92.074276][ T1193] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 92.103437][ T1758] netlink: 'syz.2.507': attribute type 27 has an invalid length. [ 92.196051][ T1758] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.203215][ T1758] bridge0: port 1(bridge_slave_0) entered forwarding state [ 92.231720][ T1758] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.238899][ T1758] bridge0: port 2(bridge_slave_1) entered forwarding state [ 92.256482][ T1193] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 92.267867][ T1193] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 92.295424][ T1193] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 92.306311][ T1758] veth0_vlan: left promiscuous mode [ 92.334903][ T1758] veth0_vlan: entered promiscuous mode [ 92.340562][ T1193] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 92.356620][ T1758] veth1_macvtap: left promiscuous mode [ 92.366701][ T1193] usb 1-1: config 0 descriptor?? [ 92.379152][ T1758] veth1_macvtap: entered promiscuous mode [ 92.465809][ T1761] __nla_validate_parse: 3 callbacks suppressed [ 92.465830][ T1761] netlink: 72 bytes leftover after parsing attributes in process `syz.3.509'. [ 92.544407][ T415] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 92.661013][ T1768] netlink: 12 bytes leftover after parsing attributes in process `syz.2.512'. [ 92.714243][ T415] usb 2-1: Using ep0 maxpacket: 8 [ 92.730875][ T415] usb 2-1: unable to get BOS descriptor or descriptor too short [ 92.785366][ T415] usb 2-1: string descriptor 0 read error: -22 [ 92.794831][ T1193] pyra 0003:1E7D:2CF6.0009: unknown main item tag 0x0 [ 92.812109][ T415] usb 2-1: New USB device found, idVendor=041e, idProduct=3048, bcdDevice= 0.40 [ 92.824384][ T1193] pyra 0003:1E7D:2CF6.0009: unknown main item tag 0x0 [ 92.841166][ T1193] pyra 0003:1E7D:2CF6.0009: unknown main item tag 0x0 [ 92.855703][ T415] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 92.868475][ T1193] pyra 0003:1E7D:2CF6.0009: unknown main item tag 0x0 [ 92.892743][ T1193] pyra 0003:1E7D:2CF6.0009: unknown main item tag 0x0 [ 92.905105][ T415] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 92.930655][ T1193] pyra 0003:1E7D:2CF6.0009: unknown main item tag 0x0 [ 92.944268][ T1193] pyra 0003:1E7D:2CF6.0009: unknown main item tag 0x0 [ 92.972360][ T1193] pyra 0003:1E7D:2CF6.0009: hidraw0: USB HID v0.00 Device [HID 1e7d:2cf6] on usb-dummy_hcd.0-1/input0 [ 93.025467][ T1774] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 93.058588][ T1774] 9p: Unknown uid 00000000004294967295 [ 93.252292][ T1781] netlink: 'syz.3.518': attribute type 27 has an invalid length. [ 93.288803][ T1781] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.296449][ T1781] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.410932][ T1783] netlink: 'syz.3.518': attribute type 27 has an invalid length. [ 93.460739][ T1783] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.467885][ T1783] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.485229][ T415] usb 2-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 93.507027][ T1783] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.514202][ T1783] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.522927][ T415] usb 2-1: USB disconnect, device number 22 [ 93.573279][ T1783] veth0_vlan: left promiscuous mode [ 93.588094][ T1783] veth0_vlan: entered promiscuous mode [ 93.614689][ T1783] veth1_macvtap: left promiscuous mode [ 93.625409][ T311] udevd[311]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 93.645122][ T1783] veth1_macvtap: entered promiscuous mode [ 93.793803][ T1785] netlink: 72 bytes leftover after parsing attributes in process `syz.3.519'. [ 93.997707][ T1789] netlink: 'syz.3.521': attribute type 9 has an invalid length. [ 94.046719][ T1193] pyra 0003:1E7D:2CF6.0009: couldn't init struct pyra_device [ 94.056159][ T1193] pyra 0003:1E7D:2CF6.0009: couldn't install mouse [ 94.065315][ T1193] pyra 0003:1E7D:2CF6.0009: probe with driver pyra failed with error -71 [ 94.108238][ T1193] usb 1-1: USB disconnect, device number 23 [ 94.124973][ T1791] netlink: 12 bytes leftover after parsing attributes in process `syz.1.522'. [ 94.336084][ T1799] netlink: 'syz.2.524': attribute type 27 has an invalid length. [ 94.587370][ T1805] netlink: 'syz.1.527': attribute type 27 has an invalid length. [ 94.673003][ T1805] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.680337][ T1805] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.799661][ T1805] macsec0: left promiscuous mode [ 94.811842][ T1805] macsec0: left allmulticast mode [ 94.821194][ T1811] netlink: 72 bytes leftover after parsing attributes in process `syz.2.529'. [ 94.834713][ T1806] netlink: 'syz.1.527': attribute type 27 has an invalid length. [ 94.902124][ T1806] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.909302][ T1806] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.950194][ T1806] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.957333][ T1806] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.997444][ T1806] veth0_vlan: left promiscuous mode [ 95.009696][ T1806] veth0_vlan: entered promiscuous mode [ 95.049727][ T1806] veth1_macvtap: entered promiscuous mode [ 95.081837][ T1815] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.124383][ T1815] netlink: 'syz.2.530': attribute type 1 has an invalid length. [ 95.154263][ T1815] netlink: 9 bytes leftover after parsing attributes in process `syz.2.530'. [ 95.168065][ T12] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 95.204573][ T407] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 95.214076][ T12] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 95.336259][ T1826] netlink: 12 bytes leftover after parsing attributes in process `syz.2.534'. [ 95.354546][ T1824] netlink: 4 bytes leftover after parsing attributes in process `syz.1.533'. [ 95.474246][ T415] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 95.611810][ T1838] netlink: 72 bytes leftover after parsing attributes in process `syz.1.538'. [ 95.644273][ T415] usb 4-1: Using ep0 maxpacket: 32 [ 95.666923][ T415] usb 4-1: unable to get BOS descriptor or descriptor too short [ 95.704120][ T415] usb 4-1: config 1 has an invalid descriptor of length 36, skipping remainder of the config [ 95.724729][ T407] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 95.739762][ T415] usb 4-1: New USB device found, idVendor=041e, idProduct=3263, bcdDevice= 0.40 [ 95.759978][ T415] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.778200][ T415] usb 4-1: Product: syz [ 95.794283][ T415] usb 4-1: Manufacturer: syz [ 95.809342][ T415] usb 4-1: SerialNumber: syz [ 95.817154][ T1843] can0: slcan on ptm0. [ 95.880481][ T1846] netlink: 'syz.0.541': attribute type 27 has an invalid length. [ 95.944204][ T1846] : port 2(bridge_slave_1) entered disabled state [ 95.950970][ T1846] : port 1(bridge_slave_0) entered disabled state [ 96.018019][ T1848] netlink: 'syz.0.541': attribute type 27 has an invalid length. [ 96.049103][ T415] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 96.062376][ T1840] can0 (unregistered): slcan off ptm0. [ 96.111885][ T415] usb 4-1: USB disconnect, device number 23 [ 96.127811][ T1848] : port 1(bridge_slave_0) entered blocking state [ 96.134758][ T1848] : port 1(bridge_slave_0) entered forwarding state [ 96.154632][ T1848] : port 2(bridge_slave_1) entered blocking state [ 96.161347][ T1848] : port 2(bridge_slave_1) entered forwarding state [ 96.184682][ T407] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 96.218587][ T1848] ÿÿÿÿÿÿ: left promiscuous mode [ 96.235400][ T1848] ÿÿÿÿÿÿ: entered promiscuous mode [ 96.257124][ T1848] veth1_macvtap: left promiscuous mode [ 96.267991][ T311] udevd[311]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 96.280833][ T1848] veth1_macvtap: entered promiscuous mode [ 96.357931][ T1188] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 96.386369][ T36] kauditd_printk_skb: 648 callbacks suppressed [ 96.386420][ T36] audit: type=1400 audit(1785446574.370:9113): avc: denied { ioctl } for pid=1845 comm="syz.1.542" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 96.433015][ T1851] netlink: 12 bytes leftover after parsing attributes in process `syz.0.543'. [ 96.482529][ T36] audit: type=1400 audit(1785446574.400:9114): avc: denied { ioctl } for pid=1845 comm="syz.1.542" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 96.575837][ T36] audit: type=1400 audit(1785446574.400:9115): avc: denied { ioctl } for pid=1845 comm="syz.1.542" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 96.617819][ T1188] usb 2-1: config 24 has too many interfaces: 158, using maximum allowed: 32 [ 96.641464][ T1188] usb 2-1: config 24 has an invalid descriptor of length 0, skipping remainder of the config [ 96.677099][ T1188] usb 2-1: config 24 has 1 interface, different from the descriptor's value: 158 [ 96.692643][ T36] audit: type=1400 audit(1785446574.410:9116): avc: denied { read write } for pid=295 comm="syz-executor" name="loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 96.722887][ T36] audit: type=1400 audit(1785446574.410:9117): avc: denied { read write open } for pid=295 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 96.730804][ T1188] usb 2-1: New USB device found, idVendor=0ccd, idProduct=0014, bcdDevice= 0.40 [ 96.796713][ T1188] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 96.814716][ T1188] usb 2-1: Product: syz [ 96.819169][ T36] audit: type=1400 audit(1785446574.410:9118): avc: denied { ioctl } for pid=295 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=51 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 96.827452][ T1188] usb 2-1: Manufacturer: syz [ 96.854847][ T1856] audit: audit_backlog=65 > audit_backlog_limit=64 [ 96.856591][ T1862] audit: audit_backlog=65 > audit_backlog_limit=64 [ 96.861416][ T1856] audit: audit_lost=42 audit_rate_limit=0 audit_backlog_limit=64 [ 96.884830][ T1862] audit: audit_lost=43 audit_rate_limit=0 audit_backlog_limit=64 [ 96.904416][ T415] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 96.912207][ T1188] usb 2-1: SerialNumber: syz [ 97.084824][ T415] usb 1-1: New USB device found, idVendor=0b49, idProduct=064f, bcdDevice=d4.fd [ 97.105126][ T415] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 97.121139][ T415] usb 1-1: Product: syz [ 97.125576][ T415] usb 1-1: Manufacturer: syz [ 97.143804][ T1871] netlink: 'syz.2.549': attribute type 4 has an invalid length. [ 97.158249][ T415] usb 1-1: SerialNumber: syz [ 97.163189][ T1871] netlink: 'syz.2.549': attribute type 6 has an invalid length. [ 97.205560][ T1188] usb 2-1: 0:1 : does not exist [ 97.210757][ T1188] usb 2-1: unit 80 not found! [ 97.266616][ T1188] usb 2-1: USB disconnect, device number 23 [ 97.332031][ T1882] netlink: 'syz.1.551': attribute type 27 has an invalid length. [ 97.399339][ T415] usb 1-1: USB disconnect, device number 24 [ 97.419600][ T1882] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.426955][ T1882] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.507687][ T1023] udevd[1023]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:24.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 97.569218][ T1885] netlink: 'syz.1.551': attribute type 27 has an invalid length. [ 97.664327][ T1278] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 97.688376][ T1885] veth0_vlan: left promiscuous mode [ 97.702580][ T1885] veth0_vlan: entered promiscuous mode [ 97.724707][ T1885] veth1_macvtap: left promiscuous mode [ 97.745224][ T1885] veth1_macvtap: entered promiscuous mode [ 97.772353][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.779505][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 97.812857][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.820075][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.844223][ T1278] usb 4-1: Using ep0 maxpacket: 32 [ 97.859631][ T1278] usb 4-1: config 0 has an invalid interface number: 35 but max is 0 [ 97.884212][ T1278] usb 4-1: config 0 has no interface number 0 [ 97.913332][ T1278] usb 4-1: config 0 interface 35 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 97.936049][ T128] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 97.943688][ T128] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 97.951324][ T1278] usb 4-1: config 0 interface 35 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 97.964268][ T407] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 97.991858][ T1278] usb 4-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 98.012626][ T1894] __nla_validate_parse: 2 callbacks suppressed [ 98.012647][ T1894] netlink: 12 bytes leftover after parsing attributes in process `syz.1.553'. [ 98.027907][ T1278] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.043140][ T1278] usb 4-1: Product: syz [ 98.050579][ T1278] usb 4-1: Manufacturer: syz [ 98.073013][ T1278] usb 4-1: SerialNumber: syz [ 98.090654][ T1278] usb 4-1: config 0 descriptor?? [ 98.164489][ T407] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 98.321421][ T1278] usb 4-1: USB disconnect, device number 24 [ 98.537187][ T1915] netlink: 72 bytes leftover after parsing attributes in process `syz.1.558'. [ 98.564243][ T1509] usb 1-1: new full-speed USB device number 25 using dummy_hcd [ 98.728116][ T1509] usb 1-1: not running at top speed; connect to a high speed hub [ 98.738409][ T1509] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 64, changing to 4 [ 98.749622][ T1509] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x8 has invalid maxpacket 512, setting to 64 [ 98.767304][ T1509] usb 1-1: New USB device found, idVendor=1235, idProduct=8210, bcdDevice= 0.40 [ 98.784216][ T1509] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.802468][ T1509] usb 1-1: Product: syz [ 98.809400][ T1509] usb 1-1: Manufacturer: syz [ 98.815299][ T407] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 98.824299][ T1509] usb 1-1: SerialNumber: syz [ 98.887959][ T1925] netlink: 'syz.3.562': attribute type 27 has an invalid length. [ 98.959704][ T1925] bridge0: port 2(bridge_slave_1) entered disabled state [ 98.966945][ T1925] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.025271][ T1928] netlink: 8 bytes leftover after parsing attributes in process `syz.1.563'. [ 99.054302][ T1509] usb 1-1: MIDIStreaming interface descriptor not found [ 99.084355][ T1509] usb 1-1: USB disconnect, device number 25 [ 99.132676][ T1926] netlink: 'syz.3.562': attribute type 27 has an invalid length. [ 99.177177][ T414] udevd[414]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 99.223939][ T1926] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.231124][ T1926] bridge0: port 1(bridge_slave_0) entered forwarding state [ 99.273360][ T1926] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.281870][ T1926] bridge0: port 2(bridge_slave_1) entered forwarding state [ 99.291469][ T1933] netlink: 12 bytes leftover after parsing attributes in process `syz.1.564'. [ 99.374983][ T1926] veth0_vlan: left promiscuous mode [ 99.391125][ T1926] veth0_vlan: entered promiscuous mode [ 99.411779][ T1926] veth1_macvtap: left promiscuous mode [ 99.426826][ T1926] veth1_macvtap: entered promiscuous mode [ 99.506446][ T1937] size and base must be multiples of 4 kiB [ 99.512327][ T1937] CPU: 0 UID: 0 PID: 1937 Comm: syz.3.566 Not tainted syzkaller #0 0b31bef96cff8e44f9e14c4f768eb06c85e3b290 [ 99.512361][ T1937] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 99.512375][ T1937] Call Trace: [ 99.512381][ T1937] [ 99.512390][ T1937] __dump_stack+0x21/0x30 [ 99.512426][ T1937] dump_stack_lvl+0x140/0x1c0 [ 99.512457][ T1937] ? __cfi_dump_stack_lvl+0x10/0x10 [ 99.512488][ T1937] ? __cfi_futex_wait+0x10/0x10 [ 99.512510][ T1937] dump_stack+0x19/0x20 [ 99.512538][ T1937] mtrr_del+0xcd/0xf0 [ 99.512564][ T1937] mtrr_ioctl+0xbf8/0x1170 [ 99.512595][ T1937] ? do_futex+0x32a/0x510 [ 99.512624][ T1937] ? __cfi_mtrr_ioctl+0x10/0x10 [ 99.512653][ T1937] ? __cfi_mtrr_ioctl+0x10/0x10 [ 99.512677][ T1937] proc_reg_unlocked_ioctl+0x1f6/0x2f0 [ 99.512702][ T1937] ? __cfi_proc_reg_unlocked_ioctl+0x10/0x10 [ 99.512724][ T1937] __se_sys_ioctl+0x132/0x1b0 [ 99.512753][ T1937] __x64_sys_ioctl+0x7f/0xa0 [ 99.512779][ T1937] x64_sys_call+0x1878/0x2ee0 [ 99.512799][ T1937] do_syscall_64+0x57/0xf0 [ 99.512823][ T1937] ? clear_bhb_loop+0x50/0xa0 [ 99.512853][ T1937] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 99.512881][ T1937] RIP: 0033:0x7fcbd3f9e019 [ 99.512899][ T1937] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 99.512918][ T1937] RSP: 002b:00007fcbd4f0e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 99.512943][ T1937] RAX: ffffffffffffffda RBX: 00007fcbd4225fa0 RCX: 00007fcbd3f9e019 [ 99.512960][ T1937] RDX: 0000200000000040 RSI: 0000000040104d04 RDI: 0000000000000004 [ 99.512974][ T1937] RBP: 00007fcbd403500c R08: 0000000000000000 R09: 0000000000000000 [ 99.512987][ T1937] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 99.513000][ T1937] R13: 00007fcbd4226038 R14: 00007fcbd4225fa0 R15: 00007ffd7efd1da8 [ 99.513020][ T1937] [ 99.708171][ T1938] netlink: 4 bytes leftover after parsing attributes in process `syz.3.566'. [ 99.834286][ T1104] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 99.984319][ T1104] usb 2-1: Using ep0 maxpacket: 32 [ 99.992083][ T1104] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 100.000878][ T1103] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 100.008625][ T1104] usb 2-1: config 0 has no interface number 0 [ 100.014926][ T1104] usb 2-1: config 0 interface 67 altsetting 0 has a duplicate endpoint with address 0x82, skipping [ 100.030332][ T1104] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 100.055679][ T1104] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 100.063897][ T1104] usb 2-1: Product: syz [ 100.068269][ T1104] usb 2-1: Manufacturer: syz [ 100.072996][ T1104] usb 2-1: SerialNumber: syz [ 100.079860][ T1104] usb 2-1: config 0 descriptor?? [ 100.087992][ T1104] smsc95xx v2.0.0 [ 100.092915][ T1104] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 100.107105][ T1104] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -22 [ 100.174234][ T1103] usb 4-1: Using ep0 maxpacket: 32 [ 100.195351][ T1103] usb 4-1: config 0 contains an unexpected descriptor of type 0x1, skipping [ 100.214265][ T1103] usb 4-1: config 0 has an invalid descriptor of length 34, skipping remainder of the config [ 100.241950][ T1103] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 100.275025][ T1103] usb 4-1: New USB device found, idVendor=056a, idProduct=0302, bcdDevice= 0.00 [ 100.292658][ T1104] usb 2-1: USB disconnect, device number 24 [ 100.319011][ T1103] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 100.349638][ T1103] usb 4-1: config 0 descriptor?? [ 100.600550][ T1940] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 100.624526][ T1940] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 100.633690][ T1103] usb 4-1: string descriptor 0 read error: -71 [ 100.644809][ T1103] usb 4-1: USB disconnect, device number 25 [ 100.794239][ T1104] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 100.887560][ T1953] netlink: 12 bytes leftover after parsing attributes in process `syz.1.573'. [ 100.960028][ T1104] usb 3-1: config index 0 descriptor too short (expected 7768, got 18) [ 100.978630][ T1104] usb 3-1: New USB device found, idVendor=0483, idProduct=3747, bcdDevice=52.4d [ 100.996398][ T1956] incfs: Error accessing: ./file0. [ 101.008514][ T1104] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 101.016777][ T1956] incfs: mount failed -20 [ 101.041248][ T1104] usb 3-1: config 0 descriptor?? [ 101.057485][ T1104] ftdi_sio 3-1:0.0: Ignoring interface reserved for JTAG [ 101.218364][ T1961] netlink: 'syz.1.575': attribute type 27 has an invalid length. [ 101.323335][ T1961] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.330788][ T1961] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.411367][ T36] kauditd_printk_skb: 940 callbacks suppressed [ 101.411387][ T36] audit: type=1400 audit(1785446579.390:9982): avc: denied { search } for pid=1967 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 101.477393][ T36] audit: type=1400 audit(1785446579.420:9983): avc: denied { search } for pid=1967 comm="dhcpcd-run-hook" name="dhcpcd" dev="tmpfs" ino=421 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 101.529581][ T36] audit: type=1400 audit(1785446579.420:9984): avc: denied { search } for pid=1967 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=425 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 101.544899][ T1148] usb 3-1: USB disconnect, device number 25 [ 101.574965][ T1965] netlink: 'syz.1.575': attribute type 27 has an invalid length. [ 101.609253][ T36] audit: type=1400 audit(1785446579.430:9985): avc: denied { read write } for pid=297 comm="syz-executor" name="loop3" dev="devtmpfs" ino=52 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 101.682675][ T36] audit: type=1400 audit(1785446579.430:9986): avc: denied { read write open } for pid=297 comm="syz-executor" path="/dev/loop3" dev="devtmpfs" ino=52 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 101.725040][ T1965] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.732190][ T1965] bridge0: port 1(bridge_slave_0) entered forwarding state [ 101.750527][ T36] audit: type=1400 audit(1785446579.430:9987): avc: denied { search } for pid=1967 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=426 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 101.775082][ T36] audit: type=1400 audit(1785446579.440:9988): avc: denied { ioctl } for pid=297 comm="syz-executor" path="/dev/loop3" dev="devtmpfs" ino=52 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 101.801748][ T36] audit: type=1400 audit(1785446579.590:9989): avc: denied { search } for pid=1968 comm="sed" name="resolv.conf" dev="tmpfs" ino=426 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 101.825377][ T1965] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.829066][ T36] audit: type=1400 audit(1785446579.590:9990): avc: denied { read } for pid=1968 comm="sed" name="eth0.dhcp" dev="tmpfs" ino=435 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 101.832540][ T1965] bridge0: port 2(bridge_slave_1) entered forwarding state [ 101.856747][ T36] audit: type=1400 audit(1785446579.590:9991): avc: denied { read open } for pid=1968 comm="sed" path="/run/dhcpcd/hook-state/resolv.conf/eth0.dhcp" dev="tmpfs" ino=435 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 102.024215][ T517] usb 4-1: new full-speed USB device number 26 using dummy_hcd [ 102.079747][ T1965] veth0_vlan: left promiscuous mode [ 102.097503][ T1965] veth0_vlan: entered promiscuous mode [ 102.122391][ T1965] veth1_macvtap: left promiscuous mode [ 102.150066][ T1965] veth1_macvtap: entered promiscuous mode [ 102.177257][ T517] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 102.204239][ T517] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 102.212592][ T128] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 102.256458][ T517] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 102.264623][ T407] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 102.276167][ T128] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 102.304242][ T517] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 102.353245][ T517] usb 4-1: New USB device found, idVendor=056e, idProduct=010d, bcdDevice= 0.00 [ 102.401607][ T517] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.450482][ T517] usb 4-1: config 0 descriptor?? [ 102.468097][ T1972] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 102.552781][ T1995] netlink: 12 bytes leftover after parsing attributes in process `syz.2.583'. [ 102.794438][ T1249] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 102.977036][ T517] elecom 0003:056E:010D.000A: ignoring exceeding usage max [ 102.999557][ T517] elecom 0003:056E:010D.000A: hidraw0: USB HID v0.82 Device [HID 056e:010d] on usb-dummy_hcd.3-1/input0 [ 103.045248][ T1249] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 103.074211][ T310] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 103.199926][ T1972] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 103.215045][ T310] usb 3-1: device descriptor read/64, error -71 [ 103.230047][ T1972] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 103.272527][ T517] usb 4-1: USB disconnect, device number 26 [ 103.484223][ T310] usb 3-1: device descriptor read/64, error -71 [ 103.694310][ T517] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 103.734287][ T310] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 103.867524][ T517] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 103.884284][ T310] usb 3-1: device descriptor read/64, error -71 [ 103.904257][ T517] usb 2-1: config 1 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 103.944217][ T517] usb 2-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 103.956157][ T517] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 103.972737][ T517] usb 2-1: Product: syz [ 103.990337][ T2030] 9pnet: p9_errstr2errno: server reported unknown error 0x0000000000 [ 104.005969][ T517] usb 2-1: Manufacturer: syz [ 104.015056][ T517] usb 2-1: SerialNumber: syz [ 104.037619][ T517] usb-storage 2-1:1.0: USB Mass Storage device detected [ 104.060180][ T517] usb-storage 2-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 104.086327][ T517] scsi host1: usb-storage 2-1:1.0 [ 104.134221][ T310] usb 3-1: device descriptor read/64, error -71 [ 104.224908][ T2040] netlink: 12 bytes leftover after parsing attributes in process `syz.3.594'. [ 104.244919][ T310] usb usb3-port1: attempt power cycle [ 104.257057][ T517] usb 2-1: USB disconnect, device number 25 [ 104.594629][ T310] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 104.634672][ T310] usb 3-1: device descriptor read/8, error -71 [ 104.766541][ T310] usb 3-1: device descriptor read/8, error -71 [ 104.860914][ T2053] netlink: 188 bytes leftover after parsing attributes in process `syz.1.600'. [ 104.924237][ T517] usb 1-1: new full-speed USB device number 26 using dummy_hcd [ 105.014725][ T310] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 105.048059][ T310] usb 3-1: device descriptor read/8, error -71 [ 105.064249][ T2064] netlink: 28 bytes leftover after parsing attributes in process `syz.3.603'. [ 105.097728][ T517] usb 1-1: unable to get BOS descriptor or descriptor too short [ 105.107225][ T517] usb 1-1: not running at top speed; connect to a high speed hub [ 105.123686][ T517] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 105.139874][ T517] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 105.162301][ T517] usb 1-1: New USB device found, idVendor=1235, idProduct=8215, bcdDevice= 0.40 [ 105.181958][ T517] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 105.193009][ T310] usb 3-1: device descriptor read/8, error -71 [ 105.202189][ T517] usb 1-1: Product: syz [ 105.206505][ T1191] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 105.223702][ T517] usb 1-1: Manufacturer: syz [ 105.228626][ T517] usb 1-1: SerialNumber: syz [ 105.251774][ T2068] file system registered [ 105.258466][ T2068] ffs_data_put(): freeing [ 105.324799][ T310] usb usb3-port1: unable to enumerate USB device [ 105.393907][ T1191] usb 2-1: unable to get BOS descriptor or descriptor too short [ 105.413879][ T1191] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 105.434206][ T1191] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 105.463493][ T1191] usb 2-1: config 1 interface 0 has no altsetting 0 [ 105.471163][ T2049] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 105.495430][ T1191] usb 2-1: New USB device found, idVendor=041e, idProduct=3237, bcdDevice= 0.40 [ 105.507021][ T2049] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 105.515047][ T1191] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 105.526095][ T1191] usb 2-1: Product: syz [ 105.530376][ T1191] usb 2-1: Manufacturer: syz [ 105.535132][ T1191] usb 2-1: SerialNumber: syz [ 105.727448][ T517] usb 1-1: 0:2 : does not exist [ 105.732442][ T517] usb 1-1: Focusrite Scarlett Gen 3 Mixer Driver enabled (pid=0x8215); report any issues to https://github.com/geoffreybennett/scarlett-gen2/issues [ 105.761311][ T310] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 105.772048][ T2077] netlink: 'syz.2.608': attribute type 27 has an invalid length. [ 105.801800][ T517] usb 1-1: Error initialising Scarlett Gen 3 Mixer Driver: -22 [ 105.825709][ T2077] bridge0: port 1(bridge_slave_0) entered disabled state [ 105.841386][ T517] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 105.855665][ T1191] usb 2-1: 0:1 : does not exist [ 105.876854][ T517] usb 1-1: USB disconnect, device number 26 [ 105.887037][ T1191] usb 2-1: USB disconnect, device number 26 [ 105.938619][ T310] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 105.958034][ T310] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 105.970670][ T2078] netlink: 'syz.2.608': attribute type 27 has an invalid length. [ 105.998249][ T310] usb 4-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice= 1.00 [ 106.017722][ T310] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.026953][ T1023] udevd[1023]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 106.046307][ T310] usb 4-1: Product: syz [ 106.053651][ T414] udevd[414]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 106.054889][ T310] usb 4-1: Manufacturer: syz [ 106.087995][ T2078] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.095189][ T2078] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.112749][ T310] usb 4-1: SerialNumber: syz [ 106.126329][ T2075] raw-gadget.4 gadget.3: fail, usb_ep_enable returned -22 [ 106.134136][ T2075] raw-gadget.4 gadget.3: fail, usb_ep_enable returned -22 [ 106.161750][ T310] usbserial_generic 4-1:1.0: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 106.180602][ T2078] veth0_vlan: left promiscuous mode [ 106.194841][ T2078] veth0_vlan: entered promiscuous mode [ 106.200507][ T310] usbserial_generic 4-1:1.0: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 106.222091][ T2078] veth1_macvtap: left promiscuous mode [ 106.231769][ T310] usbserial_generic 4-1:1.0: generic converter detected [ 106.240164][ T2078] veth1_macvtap: entered promiscuous mode [ 106.274346][ T310] usb 4-1: generic converter now attached to ttyUSB0 [ 106.285631][ T1320] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.292789][ T1320] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.394425][ C0] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 106.403985][ C0] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 106.414438][ C0] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 106.518108][ T36] kauditd_printk_skb: 742 callbacks suppressed [ 106.518130][ T36] audit: type=1400 audit(1785446584.500:10734): avc: denied { read write } for pid=2080 comm="syz.0.609" name="vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 106.522458][ T517] usb 4-1: USB disconnect, device number 27 [ 106.532738][ T36] audit: type=1400 audit(1785446584.500:10735): avc: denied { read write open } for pid=2080 comm="syz.0.609" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 106.579618][ C1] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 106.602665][ T2082] netlink: 'syz.1.610': attribute type 12 has an invalid length. [ 106.652323][ T2084] netlink: 72 bytes leftover after parsing attributes in process `syz.1.610'. [ 106.675128][ T517] generic ttyUSB0: generic converter now disconnected from ttyUSB0 [ 106.694213][ T36] audit: type=1400 audit(1785446584.560:10736): avc: denied { read write } for pid=2079 comm="syz.1.610" name="uinput" dev="devtmpfs" ino=194 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 106.707380][ T2082] netlink: 'syz.1.610': attribute type 4 has an invalid length. [ 106.726515][ T517] usbserial_generic 4-1:1.0: device disconnected [ 106.754466][ T36] audit: type=1400 audit(1785446584.560:10737): avc: denied { read write open } for pid=2079 comm="syz.1.610" path="/dev/uinput" dev="devtmpfs" ino=194 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 106.768093][ T2090] netlink: 28 bytes leftover after parsing attributes in process `syz.0.612'. [ 106.839092][ T36] audit: type=1400 audit(1785446584.570:10738): avc: denied { read write } for pid=2079 comm="syz.1.610" name="uinput" dev="devtmpfs" ino=194 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 106.918198][ T36] audit: type=1400 audit(1785446584.570:10739): avc: denied { read write open } for pid=2079 comm="syz.1.610" path="/dev/uinput" dev="devtmpfs" ino=194 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 106.947923][ T36] audit: type=1400 audit(1785446584.580:10740): avc: denied { ioctl } for pid=2079 comm="syz.1.610" path="/dev/uinput" dev="devtmpfs" ino=194 ioctlcmd=0x5504 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 107.044326][ T36] audit: type=1400 audit(1785446584.600:10741): avc: denied { read write } for pid=296 comm="syz-executor" name="loop0" dev="devtmpfs" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 107.098294][ T36] audit: type=1400 audit(1785446584.600:10743): avc: denied { read } for pid=2083 comm="syz.2.611" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 107.139913][ T36] audit: type=1400 audit(1785446584.600:10744): avc: denied { read open } for pid=2083 comm="syz.2.611" path="/dev/kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 107.300998][ T2103] netlink: 124 bytes leftover after parsing attributes in process `syz.2.618'. [ 107.404878][ T2107] netlink: 'syz.0.620': attribute type 27 has an invalid length. [ 107.475789][ T2107] : port 2(bridge_slave_1) entered disabled state [ 107.482470][ T2107] : port 1(bridge_slave_0) entered disabled state [ 107.597269][ T2114] netlink: 'syz.0.620': attribute type 27 has an invalid length. [ 107.667999][ T2122] netlink: 28 bytes leftover after parsing attributes in process `syz.3.623'. [ 107.677320][ T2114] : port 1(bridge_slave_0) entered blocking state [ 107.683931][ T2114] : port 1(bridge_slave_0) entered forwarding state [ 107.698646][ T2114] : port 2(bridge_slave_1) entered blocking state [ 107.705309][ T2114] : port 2(bridge_slave_1) entered forwarding state [ 107.748423][ T2114] ÿÿÿÿÿÿ: left promiscuous mode [ 107.760546][ T2114] ÿÿÿÿÿÿ: entered promiscuous mode [ 107.774227][ T310] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 107.785545][ T2114] veth1_macvtap: left promiscuous mode [ 107.797748][ T2114] veth1_macvtap: entered promiscuous mode [ 107.925100][ T310] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 107.951237][ T310] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 107.981157][ T310] usb 1-1: Dual-Role OTG device on HNP port [ 107.999622][ T310] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 6.12 [ 108.026548][ T310] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 108.054027][ C0] ------------[ cut here ]------------ [ 108.059560][ C0] usb_ep_enable: ep129 (ep1in-bulk) has maxpacket 0 [ 108.066528][ C0] WARNING: CPU: 0 PID: 2139 at drivers/usb/gadget/udc/core.c:123 usb_ep_enable+0x210/0x3c0 [ 108.076583][ C0] Modules linked in: [ 108.080525][ C0] CPU: 0 UID: 0 PID: 2139 Comm: syz.3.628 Not tainted syzkaller #0 0b31bef96cff8e44f9e14c4f768eb06c85e3b290 [ 108.092166][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 108.102425][ C0] RIP: 0010:usb_ep_enable+0x210/0x3c0 [ 108.107914][ C0] Code: 4d 00 48 c7 c0 e0 52 6d 86 49 c7 c0 00 53 6d 86 4c 0f 44 c0 48 c7 c7 a0 52 6d 86 48 c7 c6 46 ec 1c 87 44 89 f2 e8 20 c8 4b fd <0f> 0b e9 4c ff ff ff e8 e4 ef ce fd 49 bc 00 00 00 00 00 fc ff df [ 108.127573][ C0] RSP: 0018:ffffc90000007878 EFLAGS: 00010046 [ 108.133704][ C0] RAX: 9c1b70da1ebe9d00 RBX: ffff888105b800b0 RCX: ffff888133955f00 [ 108.141728][ C0] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002 [ 108.149750][ C0] RBP: ffffc900000078a0 R08: ffff8881f6e294d3 R09: 1ffff1103edc529a [ 108.157774][ C0] R10: dffffc0000000000 R11: ffffed103edc529b R12: dffffc0000000000 [ 108.165794][ C0] R13: ffff888105b800b8 R14: 0000000000000081 R15: ffff88810fa422ba [ 108.173821][ C0] FS: 00007fcbd4f0e6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 108.182799][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 108.189461][ C0] CR2: 00002000000000c0 CR3: 0000000114fbc000 CR4: 00000000003526b0 [ 108.197492][ C0] Call Trace: [ 108.200870][ C0] [ 108.203842][ C0] hidg_set_alt+0x138/0xa70 [ 108.208402][ C0] set_config+0x812/0xd10 [ 108.212802][ C0] composite_setup+0x1885/0x32f0 [ 108.217818][ C0] ? __kasan_check_write+0x18/0x20 [ 108.222991][ C0] configfs_composite_setup+0xc6/0x110 [ 108.228507][ C0] dummy_timer+0x2eee/0x4900 [ 108.233148][ C0] ? __cfi_check_preempt_wakeup_fair+0x10/0x10 [ 108.239371][ C0] ? activate_task+0x43b/0x480 [ 108.244200][ C0] ? ttwu_do_activate+0x290/0x620 [ 108.249280][ C0] ? try_to_wake_up+0x111a/0x1fd0 [ 108.254359][ C0] ? psi_account_irqtime+0x307/0x9a0 [ 108.259695][ C0] ? run_posix_cpu_timers+0x2d1/0x620 [ 108.265135][ C0] ? __cfi_dummy_timer+0x10/0x10 [ 108.270124][ C0] ? timerqueue_del+0xd7/0x130 [ 108.274940][ C0] ? __hrtimer_run_queues+0x2bd/0x8e0 [ 108.280414][ C0] ? __cfi_dummy_timer+0x10/0x10 [ 108.285398][ C0] __hrtimer_run_queues+0x3ae/0x8e0 [ 108.290701][ C0] ? hrtimer_interrupt+0xf30/0xf30 [ 108.295893][ C0] ? read_tsc+0xd/0x20 [ 108.300052][ C0] ? ktime_get_update_offsets_now+0x3c0/0x3e0 [ 108.306184][ C0] hrtimer_run_softirq+0x159/0x560 [ 108.311380][ C0] ? irqtime_account_irq+0x51/0x1c0 [ 108.316648][ C0] handle_softirqs+0x1aa/0x620 [ 108.321474][ C0] __irq_exit_rcu+0x47/0xb0 [ 108.326029][ C0] irq_exit_rcu+0xd/0x30 [ 108.330317][ C0] sysvec_apic_timer_interrupt+0x82/0x90 [ 108.336014][ C0] [ 108.338983][ C0] [ 108.341960][ C0] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 108.348003][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x5b/0x70 [ 108.354469][ C0] Code: 4e 87 e8 f8 63 3a fc 4c 89 f7 48 83 3d fd be a8 01 00 74 29 e8 d6 0d 00 00 90 f7 c3 00 02 00 00 74 01 fb 65 ff 0d ed 1a 5f 7a <74> 0a 5b 41 5e 5d c3 cc cc cc cc cc e8 24 2b 64 fb eb ef 0f 0b b8 [ 108.374288][ C0] RSP: 0018:ffffc9001163f780 EFLAGS: 00000286 [ 108.380421][ C0] RAX: 0000000000000001 RBX: 0000000000000202 RCX: dffffc0000000000 [ 108.388562][ C0] RDX: ffffc90002254000 RSI: 0000000000000202 RDI: ffffffff88c18200 [ 108.396599][ C0] RBP: ffffc9001163f790 R08: 0000000000000003 R09: 0000000000000004 [ 108.404698][ C0] R10: dffffc0000000000 R11: fffff520022c7ee4 R12: 0000000000000202 [ 108.412720][ C0] R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000 [ 108.420856][ C0] avc_alloc_node+0x3ea/0x520 [ 108.425671][ C0] ? security_compute_av+0xc5f/0xfb0 [ 108.431035][ C0] ? avc_node_free+0x2f0/0x2f0 [ 108.435866][ C0] avc_compute_av+0xeb/0x760 [ 108.440517][ C0] avc_has_extended_perms+0x368/0xe60 [ 108.445963][ C0] ? __cfi_avc_has_extended_perms+0x10/0x10 [ 108.451890][ C0] ? __futex_queue+0x19f/0x350 [ 108.456733][ C0] ? schedule+0xc5/0x240 [ 108.461032][ C0] ? futex_unqueue+0x136/0x160 [ 108.465837][ C0] ioctl_has_perm+0x39a/0x500 [ 108.470561][ C0] ? has_cap_mac_admin+0xd0/0xd0 [ 108.475536][ C0] ? futex_wait+0x2b8/0x7c0 [ 108.480107][ C0] ? __cfi_futex_wait+0x10/0x10 [ 108.485157][ C0] ? security_file_alloc+0x49/0x220 [ 108.490410][ C0] selinux_file_ioctl+0x732/0x1480 [ 108.495534][ C0] ? file_init_path+0x3b/0x590 [ 108.500318][ C0] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 108.505981][ C0] ? do_futex+0x32a/0x510 [ 108.510391][ C0] ? __cfi_do_futex+0x10/0x10 [ 108.515094][ C0] ? anon_inode_make_secure_inode+0xf5/0x150 [ 108.521125][ C0] security_file_ioctl+0x87/0x110 [ 108.526177][ C0] __se_sys_ioctl+0x53/0x1b0 [ 108.530814][ C0] ? fpregs_restore_userregs+0x11c/0x260 [ 108.536497][ C0] __x64_sys_ioctl+0x7f/0xa0 [ 108.541138][ C0] x64_sys_call+0x1878/0x2ee0 [ 108.545833][ C0] do_syscall_64+0x57/0xf0 [ 108.550270][ C0] ? clear_bhb_loop+0x50/0xa0 [ 108.554964][ C0] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 108.560875][ C0] RIP: 0033:0x7fcbd3f9e019 [ 108.565326][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 108.584944][ C0] RSP: 002b:00007fcbd4f0e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 108.593376][ C0] RAX: ffffffffffffffda RBX: 00007fcbd4225fa0 RCX: 00007fcbd3f9e019 [ 108.601400][ C0] RDX: 00002000000000c0 RSI: 00000000c018aa3f RDI: 0000000000000003 [ 108.609654][ C0] RBP: 00007fcbd403500c R08: 0000000000000000 R09: 0000000000000000 [ 108.617663][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 108.625648][ C0] R13: 00007fcbd4226038 R14: 00007fcbd4225fa0 R15: 00007ffd7efd1da8 [ 108.633634][ C0] [ 108.636666][ C0] ---[ end trace 0000000000000000 ]--- [ 108.642160][ C0] configfs-gadget.g1 gadget.0: Enable IN endpoint FAILED! [ 108.717266][ T310] usb 1-1: can't set config #1, error -32 [ 108.984360][ T310] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 109.124272][ T310] usb 4-1: device descriptor read/64, error -71 [ 109.384332][ T310] usb 4-1: device descriptor read/64, error -71 [ 109.634283][ T310] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 109.774383][ T310] usb 4-1: device descriptor read/64, error -71 [ 110.014310][ T310] usb 4-1: device descriptor read/64, error -71 [ 110.125026][ T310] usb usb4-port1: attempt power cycle [ 110.464271][ T310] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 110.487781][ T310] usb 4-1: device descriptor read/8, error -71 [ 110.626989][ T310] usb 4-1: device descriptor read/8, error -71 [ 110.864278][ T310] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 110.887440][ T310] usb 4-1: device descriptor read/8, error -71 [ 111.017336][ T310] usb 4-1: device descriptor read/8, error -71 [ 111.124384][ T310] usb usb4-port1: unable to enumerate USB device [ 114.884486][ C1] ip6_tunnel: syztnl1 xmit: Local address not yet configured!