last executing test programs: 10.047760936s ago: executing program 1 (id=2126): r0 = syz_open_dev$usbmon(&(0x7f0000000000), 0x0, 0x0) (async) r1 = socket$tipc(0x1e, 0x2, 0x0) getsockopt$TIPC_IMPORTANCE(r1, 0x10f, 0x7f, &(0x7f0000000040), &(0x7f0000000080)=0x4) (async) ioctl$MON_IOCT_RING_SIZE(r0, 0x9204, 0xa6db7) 8.319561494s ago: executing program 1 (id=2126): r0 = syz_open_dev$usbmon(&(0x7f0000000000), 0x0, 0x0) (async) r1 = socket$tipc(0x1e, 0x2, 0x0) getsockopt$TIPC_IMPORTANCE(r1, 0x10f, 0x7f, &(0x7f0000000040), &(0x7f0000000080)=0x4) (async) ioctl$MON_IOCT_RING_SIZE(r0, 0x9204, 0xa6db7) 6.587182762s ago: executing program 0 (id=2191): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc53}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) r3 = memfd_create(&(0x7f0000000480)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7\xc6yE\xa8\xd6A\xe8*\xedEd\x14m|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6E&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa\x00'/717, 0x2) ftruncate(r3, 0x80079a0) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0xb, 0x2012, r3, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) writev(r3, &(0x7f0000000780)=[{&(0x7f00000007c0)="d06b02", 0x3}], 0x1) sendfile(r3, r3, 0x0, 0xffff) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000240)=0x2) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 6.466307524s ago: executing program 2 (id=2198): r0 = openat$sysfs(0xffffff9c, &(0x7f0000000040)='/sys/power/wake_unlock', 0x82042, 0x102) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_opts(r1, 0x29, 0x40, &(0x7f0000000000)=ANY=[@ANYRES16=r1, @ANYRESHEX=r0, @ANYRESDEC=r0], 0xd0060) (fail_nth: 4) 6.459451175s ago: executing program 1 (id=2126): r0 = syz_open_dev$usbmon(&(0x7f0000000000), 0x0, 0x0) (async) r1 = socket$tipc(0x1e, 0x2, 0x0) getsockopt$TIPC_IMPORTANCE(r1, 0x10f, 0x7f, &(0x7f0000000040), &(0x7f0000000080)=0x4) (async) ioctl$MON_IOCT_RING_SIZE(r0, 0x9204, 0xa6db7) 4.332827264s ago: executing program 0 (id=2199): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) mprotect(&(0x7f0000004000/0x3000)=nil, 0x3000, 0x1) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffff3) ioctl$ASHMEM_SET_NAME(r0, 0x40087708, &(0x7f00000000c0)='\x00\x00\x03\x01\x00\x00\x00\x1f\x00x\x92\x12\xac\x06^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x02\x00g\x00\x00\x00\x80\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-\xac\x99\xb8\xd2\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc4\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b^:4\xeb\xd3\'\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13@`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\xa9\x96\xf8/0HdO\xb9\xa2\x1d\x13\x8fCha\xb3\x95w\x02\x00,\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfau\xfd\xf8\x9e\x86\xef.\xf6<\xbfB\xe7\x80Z\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\xa0\xa9\x13f=\xbd\x03\xe8\xbex:\xceY\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\x13\xba\x00|g]7\xdc\xe9=\"\xe4\xb3\x0f\xc6\x8f\x85fGGV&\x1d\xa3\xc4\xc3\xd2\xfd\xad\xa35o\xe8\xcd^/\xd8\xf4[n\x9fJ\xf4\n\x92c\xaa\xddT&L<+\x19R\a\xfc\xf2\x17\xb8$\xa9]\xc2\\\xda<\xd0d.w\x9c\xaf4\xbb\xe8Co\xb3\xd8\x82\x92\xba+\x99PXB\xdc\xbay\xa0\x92\x04\x92k\vJTRW\xc26\x06\x10\x92\xc7\xa55\x9fZ\xff*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7z\x84\xb9\x0fB\xe1\t\x00\xbaQj\x81\xc8\xf8\x146\'Z\x83H\xabF\x18<\x86h\x01=\x03\\\xc4\t\x8e/\x12\a\xdf\xe7zU\xcc\x02\x0e\xc1?\xeau\xb4\x84\x1b\xdaR-\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^1\xbc\x89\xe1\xeb\xf0tg\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&@\x00\x00\x00rT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\xd7c\t(\xf2\x93\x8d\\\x91\xef\xab(Jck\xdf\xa3 \x16\x9bH=\x01\x7f\x02\x1dF3\x7f\xd15\xa8\xd2\x94\xa7\xe9\xbd\xdc\x16\xe1Z\x9c\xe3\xeb9\x8f\xfdC\x0e\xd3]\xb5\xfdB\\\xd2\xfe\xd9H\x8ai}kDM\xbd\xfcJ{T{@i/\xb7x\xef\x1f\xf0t\xf5\xaf\xb21F\x01\xe0\x86\xde\x88\xb8\x8f \xfc\xcd\xbav\x16\xc1J\xb7\xe3\x04m\x0e\xaf\xd6X\xba.H\xe3\x86\x03\t\xcb\xdc\x80\xee\x0ec\x12\x8a\x92\x11\xb6\xcc#\x10\xec\xfd\xbb\xd3\\\xc8\x88\x04,\'\x14\xbf\x84\x16\xb3\x8f,6\xc6D\xae\xa1\xf9\xe7@\xac\xaa\x104\x8b\x8eQ8\x11\xa7|\x87\xe2\xccrj%\xc4r&\r\a\xa7\xda\xf5\'V\x89\xe6\xa4\x05\xde\xf5\xaa@\xec\xe2\xf6\xb5x\xa1w\n\xda\xf2\xd67\xc6%\x0f[sF\xb6\xaeS>\xe9^\xd4\xf03\xe9.\xc4\xd5\xe0\r\xa1Q\xa8\xf2\xa2`zs\'k\xd4pV\xab&%\xf8\x8a\x80\x9d\"\xf3\xcc\xd2i\xc8\xd8\xc6\xbeD\xda\x86?\xf9\x13\xe5L`R\xe8Vq\xa3\nD\x9f\xe4M\xe6\xab\xdd!=%\x06z$\x99\';O\xfc\xf0u\x83\v\x83\a8\xfe<\x9e\xa8\xfe\xca`D\x91\x81!QT$\x05T\x85\xd6\xe9!\xb9wfL\x12\xa8\xb0\xb0\x86\xc2\xa1\xf7\x05i\xf5\xf0\r\xe7h\xdaD\xcb\xd4\x87\x84\xe5\xc7r;.\xf0\xed\x17\x83Nn\xb7\x0f!u}J)\xa1\xa1\x16\xc5`Z,\xa3\xcf\xfdy\aH\x06\x14l\x92x\xdbB=\xcc\xcdf\xe5\x04=HQ\xeaE-v\x02\x0eY\x8e\xbf\xec\x16\xc4G\xea\x8bS\x8e\xd5f\xdcj\xe1\x86\xf9s\x90\xe5\xf9\x89\xc0\xf3\xcd;r4j]\x9b\xdf\xf5\xe9\x82\xe1\xdb\x11\xb3\b\xa2Y\xdb\\\xc1H\xc3\xcf\xb1W\xe9(\xee\x18\xca\xda\xf5p,\x16\xbc\x17\xfe\xd8\n\xe1\xa1&\xfb|\x01\x03\xfcr\x80N\x9f\xc7}\xd7\xf9=+)\xf9Vd\x11\xf6hX\xbe\x85O=\xe2\x9f~I\xc4\"\xa9\xd9\x19\xa2\\\xb8>f\xe2Jh+u\x90\x13\x94\x12\xc8X\xd7\xb4\xf1JS0FN\xa0\xda\xb6ez`\x9a\xea\xcf^\xa5\x17{\v\xe8n\xe9 \xc0/D\t\x7f\xd8\xad\xf2e\xff\x8b\x16p\x0f\xe4\x1a/\xe1\x96\xd2\xae\x94\x0e5\xb0b+\xac\x14\xaa\xb0\xae\xa5.\x15\x8a\xca\xb5~=D-\x90\xc1\xbf\x05\xb9\xd5\x86\xeb\xd2#\xda\xc132\'\xfc!%\x94\x1f\xbfL)\xc2c\xa8\xef\x152\x8d\xef\xde\xbe\xab\xf5g\x80\x02G>\xf5\x04a-\xff\x06X+\xc1\xd3\xb1\xcdn\x15p\xdf\xd8.\x89\x95{\xb6+:`\x9c\xcf2\x01\x1d1\xf7\xe6\x7f\x1f\xf5\xb0\xb9\t2\x14\x81\x99\xb8@7y\xb4\xce\xf1]\a\x03y\xc5F\xfa\xae\xd1Ov7\xa7\xc1\xb2.~B\xe8@G\xd1\xd9R~\x1b\xf7\xa8\x86\xa7\xc1\b\x9ej\x01\xf4\xb7\xd2\x0e\xc2\x15S\x19\xd7\xd4\xe6\xaf!\xf8_\x8aEOp@>4\xd7\xcf\x11\xe0;\x99}QmE\xdd\xa69)Q\x9e\xb9\'\x97\x9b\xe7\xa4?Ed\x9c\x7fE\xba5\x90\xc07\x96S\x9d\xe1\x84\xfa\x1a\xd6\x9a\x15\xd1o \xc0\xd28\x01\xa7\x99\x85q\xbd\x80\x00\x00\x00\x00\x00\x00\x00H\x0f\xbbT\xd5\xb3\xf4\xcd<\x8a\x01\x19\xd0\xf3\x91\x0fS\f|B\f0\xf8i\xd3\x1bJke\t\x8b7Q\x1dQ&\x96H\x05\xec\x80\xf0\xab\x8f\x94{\x9d+\xefs\x1c\xfck\xf7q\x10\xf6\x16\xbc\xe7\x93\x0f\x7f\xcd\xa7b\xbe\x88\xcc\xb6^\x93\xa9P\xf3\xa3\xe4Az=\xe0+Q\x9e\xb5\x01\xb3\xc1\xa8P0+\xc9\xa1\xdbU~J$\xa4\x03\x11\x1aa~\x9du\x8f\x8d\xbcI\x85k\xa0\xae\xf6\xa0\x94r\xfb\xe3\xaa\xd4\xf0\x99\x06\xe1i\x1f\xfa\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\\\xb2/R\xedI2e5\x88(\xc0+^\xe7G\x17\x03^\xd7g\xb9n\x8c2\xb3\x12\x91\x86b\t\xd0R\x01\xda$Y\x85\x02&\x95FC\xc8\xd9\x00\x00\x00\xb6u\xbb\n{\x90\xfd>\xd0-\xfa\xa9\xfd{\x95E8\xe4\x10\x06\x0eB\xf9\xc3\x83.\xc1\xf2D\xcb\xb4\xcb\x7f\\\x8f\xac\xaa\xc088G\x06\xb5\x82\xbe\b\x89l\xc2P:\xa1\xa8\x8f\xa3\xd6\x02$k\x11\x1f\xf8}\xde\x9b\xc4s\x9e\xe4#\f\x9fx\xf3\x01\xda\x8c\x13x\xac\x10\x04\xe0w\xbd\xba2pH\xb7I\xef\r6Ml\xb4v\xdb<\xae$\x8d\xcf\xefg0\xb2\xc2)vE8\x0er\xb5\x83\x1f$<\xac@s\xe7\x85\x06B\xf3\xbe`\xa5_\"j.RSK\x89\xc2P\x10\xa8:J\x8dZ\x80\xb4Jy\xaa\x7f\'G\xdb\xab\x94\xe3\xc0\xa7$\xc5\xe4\f\xd3\xb9\xcd\b\xa2T\x1cL\xf2aK\x02\f\x84#_\x0f\x8eo\xc14\xdcL\xf2\xc24\xf3\xa6\xae\'W\xe1\xa2\xdeC}\b\xc6\x98\x01\x92\xd9\xadon3k\xdc\rMrJ\xd8|E|U\xa1\x89\xfd\x95\xe9\x03\v\x05\xa9\xdacl\x10*\x8a\xef\xd2\xd4^-\xa4\xeb\xfeGq\x819d\xb6\xb5\xb5B&\x00%\xb5\x12\xbe\x9a\xe47\xe1\xafF\x9eQAle,\xb5L\x00\x00\x00\x00\x00') ioctl$ASHMEM_SET_NAME(r0, 0x40087707, &(0x7f0000000d40)='\x00\x000\x10\x00\x00\x00\x1f\x00x\x85\x1c \xf3\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f_D\xbdt/\'\xf6\xc3\x8c\xb8\vS\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b^:4\xeb\xd37\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\x00\x00\x00\x000Hd\xcf\xb9\xa2\x1d\x13\x8fC\xd2&\xd8\x9d\x8b\xe0E\xd2\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xc9\x91\xbfB\xe7\x80\x1a\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\xa0\xa9:\xceY\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\x13Y\x86\xd8\t\x00\x00\x00\x8cs4\r\xcd\xd1\x83JT\xf9\xa2\x83?\xb3\x0f\xc6&\x1d\xa3\xc4\xc3\xd2\xfd\xad\xa35o\xe8\xcd^/\xd8\xf4[n\x9fJ\xf4\n\x92c\xaa\xddT&L<+\x19R\a\xfc\xf2\x17\xb8$\x89]\xc2\\\xda<\xc8d.w\x9c\xaf4\xbb\xe8CoB\xdc\xc26\x06\x10\x92\xc7\xa55\x9f\x04\x00*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146%Z\x83H\xabF\x18<\x86h\x01=\x03\xae\xc4\t\x8e/\x12\a\xdf\xe7zU\x1d\x15\x0e\xc1?\xeau\xb4\x84\x1b\xdaR-\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&e$\f\rrT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\xedo\x92\xae\r\x05\xfa\x99\x15\x87\x14\x13$\t\x01\x00\x00\x00\x00\x00\x00\x00\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\x82\x8f\xc0\xab\xe3a\x99\x17\x85\f\x03\xbb\x14\xa7\xda\x19M\xa3!\x95\xa0\x9a\x05\x06\x00\x00\x00\xf2\xd5\b^[D~\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00f\x8a\x9b\xe2\xa7k9\xd9`=}\t\x82\nw!y\x91\xbeM\xdck=\xcc\xef\x16vt\x1d\x1c\xa3\xee\x13\x16\xdbb0\b`/c\x9f\x8c\xee\xb1\x1a\xcf\x8ba\x11Oh\xc7\xb8\x8e#\xeeAh\xd9\x15\xc6\xe7>\x95\xe2\xdaQ\x0e\xc0E\xdd\xc3^7Y\xd2\xf0\xf7DZ\x12\xce\xba\vI$[v\x00\x830p\xd4\xbf\xa3\xf28\xab\xd4e\xc9z\xff\xfc\xeb\x04\xff\x98\xda\x01.\b\x00\xcb7!W\x98\xc4\xa5\xb4\xc3\xd8\x94\xe6\xd7\x9e\xed\x1f\xafBF\xd6\xbfu5=.\x92\xc8-\xcc~6Y\xa7K\xd5=v\xdctJ\xba\x17\x18\xc8x\x95\xd8\xb2\xd6\x10)\xcfs\xaf\xf5E\x18\xa2*\x82\tU\xd3\xf7Y\x1d\x175\x04X2\xa3K\xab\x14\xec\xc9\x9c?\xa9\xc4\xc7\xe3{\xbfA\x16\xfcY\nR\x93\xb3\xcd\x0fg\xf6L3\xe87\x8aX\x82Y\x95\v\xbf%\xef\x83\x02\xc1\xd5c}\x18(\x13\x9e\xe7\xb2$\xee\xc4\x94\x00\xf6S9\xb7\xbcu\xb9\xad\xc6$=D\xb9\x82\x15yM\xa8\xf1N\xaeB\xf8.q\x90\x8a\xb57_\x98\x7f\xf2b\xbd\x97\xfc\xefN\xc6\xad\x99IJW\'\xd6m\xf0[WO\xf3\xd0\x9e\xda\xbd8\xd5FVA>\xa8p\vp*\xd1\xd9\v\xa3\xb2\x1b)E/\xbb\x90\xcct_K\x8d\xa3\xd2\xad,y\xa7\x8b\xa3\xb8\x86\xa9Q~\x1f\xbf\xa3(,\x91\x1a\x15\x9eJ\xedZ\xb8|\xc6\f\x0f+N\n\xe3\v\xdb\x05\xd1+8\x14\xa6b\xfd\x8a\x1f`\x8e\xe5m\xdd\x9ej\x9a(\xe6\x8f\xad[\\4\xa6>\xe5K\xb9\xc3') 4.332656564s ago: executing program 2 (id=2200): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) ioctl$RTC_PIE_OFF(r1, 0x7006) sendmsg$nl_xfrm(r0, &(0x7f0000001980)={0x0, 0x0, &(0x7f00000019c0)={&(0x7f0000001a00)=ANY=[@ANYBLOB="60010000100033062cbd7000ffdbdf250000000000000007ddffffff00000001fe800000000000050080effd000000003a000000000000000000000000800000", @ANYRES32, @ANYRES32=0x0, @ANYBLOB="e0000002000000000000000000000000fffffffd320000007f0000010000000000000000000000000100000000000000030000000000000009000000000000000900000000000000020000000000000000000000000000000000000000000000fcffffffffffffff000000000000000000000000000000005f000000000000000a00000000000000010000000000000000000000020100000000000002000000800000000000000048000200656362286369706865725f6e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000170001"], 0x160}, 0x1, 0x0, 0x0, 0x20040}, 0x40080) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) r3 = syz_usb_connect(0x0, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="120100009f187620ef170372362e010203010902240001000010000904bc00029e8833000905020200020200000905820220"], 0x0) syz_usb_control_io$rtl8150(r3, 0x0, 0x0) syz_usb_control_io$uac1(r3, 0x0, &(0x7f00000002c0)={0x44, &(0x7f0000000340)={0x20, 0x10, 0x2, '!k'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r3, 0x0, &(0x7f0000000380)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x40, 0xb, 0x2, "31fb"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r3, 0x0, &(0x7f0000000480)={0x34, &(0x7f00000004c0)={0x0, 0x16, 0x2, "f610"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r3, 0x0, &(0x7f0000000500)={0x44, &(0x7f0000000580)={0x0, 0xc, 0x1, '!'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) syz_usb_control_io$rtl8150(r3, 0x0, 0x0) 4.27788366s ago: executing program 0 (id=2202): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) ioctl$RTC_PIE_OFF(r1, 0x7006) sendmsg$nl_xfrm(r0, &(0x7f0000001980)={0x0, 0x0, &(0x7f00000019c0)={&(0x7f0000001a00)=ANY=[@ANYBLOB="60010000100033062cbd7000ffdbdf250000000000000007ddffffff00000001fe800000000000050080effd000000003a000000000000000000000000800000", @ANYRES32, @ANYRES32=0x0, @ANYBLOB="e0000002000000000000000000000000fffffffd320000007f0000010000000000000000000000000100000000000000030000000000000009000000000000000900000000000000020000000000000000000000000000000000000000000000fcffffffffffffff000000000000000000000000000000005f000000000000000a00000000000000010000000000000000000000020100000000000002000000800000000000000048000200656362286369706865725f6e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000170001"], 0x160}, 0x1, 0x0, 0x0, 0x20040}, 0x40080) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) syz_usb_control_io$rtl8150(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$rtl8150(0xffffffffffffffff, 0x0, &(0x7f0000000240)={0x2c, &(0x7f0000000280)=ANY=[@ANYBLOB="200302"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x44, &(0x7f0000000340)={0x20, 0x10, 0x2, '!k'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x40, 0xb, 0x2, "31fb"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000480)={0x34, &(0x7f00000004c0)={0x0, 0x16, 0x2, "f610"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000500)={0x44, &(0x7f0000000580)={0x0, 0xc, 0x1, '!'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 4.205697517s ago: executing program 1 (id=2126): r0 = syz_open_dev$usbmon(&(0x7f0000000000), 0x0, 0x0) (async) r1 = socket$tipc(0x1e, 0x2, 0x0) getsockopt$TIPC_IMPORTANCE(r1, 0x10f, 0x7f, &(0x7f0000000040), &(0x7f0000000080)=0x4) (async) ioctl$MON_IOCT_RING_SIZE(r0, 0x9204, 0xa6db7) 2.238821349s ago: executing program 0 (id=2208): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) ioctl$RTC_PIE_OFF(r1, 0x7006) sendmsg$nl_xfrm(r0, &(0x7f0000001980)={0x0, 0x0, &(0x7f00000019c0)={&(0x7f0000001a00)=ANY=[@ANYBLOB="60010000100033062cbd7000ffdbdf250000000000000007ddffffff00000001fe800000000000050080effd000000003a000000000000000000000000800000", @ANYRES32, @ANYRES32=0x0, @ANYBLOB="e0000002000000000000000000000000fffffffd320000007f0000010000000000000000000000000100000000000000030000000000000009000000000000000900000000000000020000000000000000000000000000000000000000000000fcffffffffffffff000000000000000000000000000000005f000000000000000a00000000000000010000000000000000000000020100000000000002000000800000000000000048000200656362286369706865725f6e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000170001"], 0x160}, 0x1, 0x0, 0x0, 0x20040}, 0x40080) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) r3 = syz_usb_connect(0x0, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="120100009f187620ef170372362e010203010902240001000010000904bc00029e8833000905020200020200000905820220"], 0x0) syz_usb_control_io$rtl8150(r3, 0x0, 0x0) syz_usb_control_io$rtl8150(r3, 0x0, &(0x7f0000000240)={0x2c, &(0x7f0000000280)=ANY=[@ANYBLOB="200302"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r3, 0x0, &(0x7f0000000380)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x40, 0xb, 0x2, "31fb"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r3, 0x0, &(0x7f0000000480)={0x34, &(0x7f00000004c0)={0x0, 0x16, 0x2, "f610"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r3, 0x0, &(0x7f0000000500)={0x44, &(0x7f0000000580)={0x0, 0xc, 0x1, '!'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 2.238428889s ago: executing program 3 (id=2209): ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001180)={0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f00000011c0)=@req={0x3fc, 0x0, 0x0, 0xffffffff}, 0xfffffe81) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001200), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(r3, &(0x7f0000001240)={0x0, 0x0, &(0x7f00000034c0)={&(0x7f0000007700)={0x24, r4, 0x201, 0x70bd2b, 0x21000000, {{}, {}, {0x8, 0x11, 0x4}}}, 0x24}}, 0x80) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000007780)=@req={0x3fc}, 0x10) process_vm_writev(0x0, &(0x7f0000000800)=[{0x0}, {&(0x7f00000002c0)=""/167, 0xa7}, {&(0x7f0000000380)=""/18, 0x12}, {&(0x7f00000003c0)=""/73, 0x49}, {&(0x7f0000000440)=""/65, 0x41}, {&(0x7f0000000680)=""/200, 0xc8}, {&(0x7f0000000780)=""/115, 0x73}], 0x7, 0x0, 0x0, 0x0) fstat(r0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r0, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000580)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x20000000) r5 = add_key$keyring(&(0x7f0000000980), &(0x7f00000009c0)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key(&(0x7f0000000a00)='keyring\x00', &(0x7f0000000a40)={'syz', 0x0}, 0x0, 0x0, r5) creat(&(0x7f0000001300)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000001340), 0x2, 0x0) 2.238208089s ago: executing program 3 (id=2210): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb0, 0xfa97, 0xa2b9, 0x6, 0x9, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffff9, 0x101bd, 0x4000000d, 0x0, 0x0, 0x6, 0x4, 0x100002, 0x2, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x2, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0xff, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x5, 0xfff, 0x1, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000086f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x3, 0x200b398, 0x8001, 0x1, 0x6, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff4, 0x4, 0x46, 0x5, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x200, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x1000, 0x31, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0x9, 0x9, 0xc, 0x2, 0x69, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2800004, 0x1, 0x10, 0x5, 0x9, 0x405, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xfff, 0x4, 0x7f, 0x9, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x27, 0xf7cc, 0xd502, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x81, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x6, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0x10dab, 0xfffffffd, 0x8, 0x13fff, 0xffff, 0x9]}, 0x45c) process_vm_writev(0x0, 0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000540)=""/213, 0xd5}], 0x1, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000280)={[0x8, 0x4, 0x7, 0x7, 0x5, 0x80000000, 0x1, 0x8001, 0xc646, 0x1, 0x8, 0x3, 0x4, 0x0, 0x8, 0x8000000000000], 0x3000, 0xa400}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 2.238008599s ago: executing program 3 (id=2211): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x18, 0x1e, 0x21, 0x70bd2b, 0x0, {0x8}, [@nested={0x4, 0xf}]}, 0x18}, 0x1, 0x0, 0x0, 0x2008800}, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000300)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b8000000000f23c00f21f835010003000f23f8ee6d6c2f800000c00f3266bac0000f3066b808008ed0660f38806f008ee0", 0xfffffffffffffdf4}], 0x1, 0x3b, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x36, 0x40000000788, 0x80000000002, 0x6e7, 0x400000004, 0x0, 0xee, 0x80000001, 0x3, 0x1000045, 0xfffc, 0x9, 0xf, 0x6, 0x0, 0xab], 0x8000000, 0x3c4210}) capset(&(0x7f00000000c0)={0x20080522}, &(0x7f0000000100)) landlock_restrict_self(0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) (async) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x18, 0x1e, 0x21, 0x70bd2b, 0x0, {0x8}, [@nested={0x4, 0xf}]}, 0x18}, 0x1, 0x0, 0x0, 0x2008800}, 0x0) (async) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000300)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b8000000000f23c00f21f835010003000f23f8ee6d6c2f800000c00f3266bac0000f3066b808008ed0660f38806f008ee0", 0xfffffffffffffdf4}], 0x1, 0x3b, 0x0, 0x0) (async) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) (async) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x36, 0x40000000788, 0x80000000002, 0x6e7, 0x400000004, 0x0, 0xee, 0x80000001, 0x3, 0x1000045, 0xfffc, 0x9, 0xf, 0x6, 0x0, 0xab], 0x8000000, 0x3c4210}) (async) capset(&(0x7f00000000c0)={0x20080522}, &(0x7f0000000100)) (async) landlock_restrict_self(0xffffffffffffffff, 0x0) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) 2.176975856s ago: executing program 3 (id=2212): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) ioctl$RTC_PIE_OFF(r1, 0x7006) sendmsg$nl_xfrm(r0, &(0x7f0000001980)={0x0, 0x0, &(0x7f00000019c0)={&(0x7f0000001a00)=ANY=[@ANYBLOB="60010000100033062cbd7000ffdbdf250000000000000007ddffffff00000001fe800000000000050080effd000000003a000000000000000000000000800000", @ANYRES32, @ANYRES32=0x0, @ANYBLOB="e0000002000000000000000000000000fffffffd320000007f0000010000000000000000000000000100000000000000030000000000000009000000000000000900000000000000020000000000000000000000000000000000000000000000fcffffffffffffff000000000000000000000000000000005f000000000000000a00000000000000010000000000000000000000020100000000000002000000800000000000000048000200656362286369706865725f6e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000170001"], 0x160}, 0x1, 0x0, 0x0, 0x20040}, 0x40080) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) r3 = syz_usb_connect(0x0, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="120100009f187620ef170372362e010203010902240001000010000904bc00029e8833000905020200020200000905820220"], 0x0) syz_usb_control_io$rtl8150(r3, 0x0, 0x0) syz_usb_control_io$rtl8150(r3, 0x0, &(0x7f0000000240)={0x2c, &(0x7f0000000280)=ANY=[@ANYBLOB="200302"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r3, 0x0, &(0x7f00000002c0)={0x44, &(0x7f0000000340)={0x20, 0x10, 0x2, '!k'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r3, 0x0, &(0x7f0000000380)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x40, 0xb, 0x2, "31fb"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r3, 0x0, &(0x7f0000000480)={0x34, &(0x7f00000004c0)={0x0, 0x16, 0x2, "f610"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r3, 0x0, &(0x7f0000000500)={0x44, &(0x7f0000000580)={0x0, 0xc, 0x1, '!'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) 2.176813156s ago: executing program 1 (id=2126): r0 = syz_open_dev$usbmon(&(0x7f0000000000), 0x0, 0x0) (async) r1 = socket$tipc(0x1e, 0x2, 0x0) getsockopt$TIPC_IMPORTANCE(r1, 0x10f, 0x7f, &(0x7f0000000040), &(0x7f0000000080)=0x4) (async) ioctl$MON_IOCT_RING_SIZE(r0, 0x9204, 0xa6db7) 160.545083ms ago: executing program 2 (id=2213): memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x10, 0x803, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$FIBMAP(r0, 0x5393, 0x0) 160.204903ms ago: executing program 3 (id=2214): r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000000)=0x80000004, 0x4) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x33, &(0x7f0000000040)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x2}]}, 0x10) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x6352, @loopback, 0x68}, 0x1c) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='./dev/sda1\x00', &(0x7f0000000240)='./mnt\x00', &(0x7f0000000280)='ext4\x00', 0x8410, 0x0) r1 = openat$selinux_user(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) fgetxattr(r1, &(0x7f00000024c0)=@known='system.posix_acl_access\x00', 0x0, 0x0) bind$vsock_stream(0xffffffffffffffff, &(0x7f00000002c0)={0x28, 0x0, 0x0, @local}, 0x10) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000300)='./file0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x18d042, 0x15) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x1, &(0x7f00000003c0)=ANY=[]) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f0000000400)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, 0x0) r3 = userfaultfd(0x80001) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000002400)={0xaa, 0xe0}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000002440)={{&(0x7f0000000000/0x400000)=nil, 0x400000}, 0x1}) pwrite64(r2, &(0x7f0000002480)="ff", 0x58200, 0x0) listen(r0, 0x8) 150.075204ms ago: executing program 2 (id=2215): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000480)=[@exit_looper={0x400c630e}]}) (async) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) (async) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x1c1) (async) capset(&(0x7f0000000780)={0x20080522}, &(0x7f00000007c0)={0x200002, 0x200003, 0x801, 0x4, 0x7}) (async) mkdir(&(0x7f00000001c0)='./bus\x00', 0x63) setns(0xc9, 0x0) (async) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_COALESCE(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)={0x28, r1, 0x1, 0xfffbfffe, 0x0, {{0x2}, {@void, @val={0xc, 0x99, {0x1}}}}, [@NL80211_ATTR_COALESCE_RULE_CONDITION={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x8844}, 0x4800) openat(0xffffffffffffff9c, &(0x7f0000000200)='./bus\x00', 0x648280, 0x120) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r3, r3) (async) setpgid(0x0, r3) write(r2, &(0x7f0000000580)="13f03e16dabe63f563ce889f98a9c994a958fad5b06714a3c04630dc99579103341962536f45582aa912dc42f5f6be4403d109a2b72cd9f9c4e4e9fdf006577e579350ccb8a2e25a125ba4c52e5ba158", 0x50) r4 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r4, &(0x7f00000004c0)={0x28, 0x0, 0x2710, @host}, 0x10) (async) r5 = socket$vsock_stream(0x28, 0x1, 0x0) (async) r6 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r6, &(0x7f0000000500)={0x28, 0x0, 0x2710, @local}, 0x10) (async) bind$vsock_stream(r5, &(0x7f0000000540)={0x28, 0x0, 0x88bbcfd08703268b, @host}, 0x10) (async) tkill(r3, 0x7) wait4(r3, 0x0, 0x0, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000680)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r2, &(0x7f0000000740)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000700)={&(0x7f0000000800)=ANY=[@ANYBLOB="d2f7803725081b00006680cd837f978f6bf00ba322b9ee3ad75e1adf7f22230169fa01a3b0f642ae772ec2dfaf2dcc23bf086fc7bc0b77e026659f2eb51710bf2bda5fe68891d792302fbc0cc0ed50c6f4b12016ca74fb4fb153369940da527a32701eaba4ddd51dfaf09b96b4f3dfa302530146d69629eadf41ff51c597474db21a227ce2712c46b3187e8823b576fbfba9878ba05dc495eeeb557bdc4408974e77ef59fd9b2ea2a9cfa5cf0ab21fba2553b1754d71c94b82d5dad0f60b766d033603827b28aeb01745e3f6834ed47fd976b024861c610a6b4b19a39da3d28eed2f020e", @ANYRES16=r1, @ANYBLOB="100028bd7000ffdbdf253100000008000300", @ANYRES32=0x0, @ANYRES16=r0, @ANYRES32=r3, @ANYRES64, @ANYRES32=r7, @ANYBLOB], 0x40}}, 0x20008080) (async) ptrace$ARCH_SHSTK_DISABLE(0x1e, r3, 0x4, 0x5002) r8 = add_key$keyring(&(0x7f0000000100), &(0x7f0000000140)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffff8) add_key(&(0x7f0000000040)='rxrpc_s\x00', &(0x7f0000000080)={'syz', 0x0}, 0x0, 0x0, r8) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280), 0x1408, &(0x7f0000000000)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0/file1'}}, {@metacopy_on}]}) (async) linkat(0xffffffffffffff9c, &(0x7f0000000340)='./file0/file1\x00', 0xffffffffffffff9c, &(0x7f0000000380)='./file0/file2\x00', 0x1000) 80.899531ms ago: executing program 3 (id=2216): openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) syz_usb_connect(0x5, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010040772904202404019957c20102bf000000240001000010000904430002317d55000905020200020200000905f3"], 0x0) unshare(0x60000600) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.bfq.io_merged\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x7000003, 0x12, r0, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600000, 0x600000, 0x3, &(0x7f0000a00000/0x600000)=nil) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r1 = socket$inet_udp(0x2, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg(r2, &(0x7f0000000280)={0x0, 0xfffffffffffffea5, &(0x7f0000000880)=[{&(0x7f00000008c0)="50000000300005040000000000000000000000003c0001003800010009000100676163740000000028000280180002000000000000000000020000000c00030001000000000000200000000000000000", 0x50}], 0x1}, 0x0) munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x40, 0x0) r3 = socket$inet6(0xa, 0x80002, 0x0) ioctl$KVM_SET_PIT(r0, 0x8048ae66, &(0x7f0000000800)={[{0x7a1c, 0x6, 0x9, 0xf1, 0x7, 0x4, 0x3, 0x8, 0x5, 0x9, 0xe6, 0x8, 0xf2f}, {0x3, 0x3, 0x0, 0x3, 0x9, 0x9c, 0x5, 0x6, 0x5b, 0x5, 0x0, 0x80, 0x2}, {0x9, 0x7, 0x6, 0x40, 0x8, 0x9, 0x81, 0x60, 0x2, 0x1, 0x6, 0x0, 0x7}], 0x7}) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x33, &(0x7f0000000780)={0x1, &(0x7f00000007c0)=[{0x6, 0x0, 0x0, 0x2}]}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000200)={'tunl0\x00', &(0x7f00000000c0)={'syztnl0\x00', 0x0, 0x1, 0x38, 0x4000006, 0x81, {{0x9, 0x4, 0x0, 0x0, 0x24, 0x61, 0x0, 0x9, 0x2f, 0x0, @dev={0xac, 0x14, 0x14, 0x17}, @empty, {[@lsrr={0x83, 0xf, 0x65, [@remote, @rand_addr=0x64010100, @private=0xa010100]}]}}}}}) socket(0x10, 0x803, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0xa2f01, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000580)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f00000005c0)={'syzkaller1\x00', 0x1}) write$tun(r4, &(0x7f0000000600)={@val={0xa, 0x80}, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x48, 0x3a, 0xff, @private0={0xfc, 0x0, '\x00', 0x1}, @mcast2, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x3, {0x3, 0x6, "2c7b82", 0xa, 0x33, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @local, [@hopopts={0x29, 0x1, '\x00', [@calipso={0x7, 0x8, {0x1, 0x0, 0x8, 0x5}}]}]}}}}}}}}, 0x82) 80.593581ms ago: executing program 2 (id=2217): r0 = socket$inet6(0xa, 0x80002, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0xfffffffe, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) r1 = socket$inet6(0xa, 0x80002, 0x0) r2 = socket$inet6(0xa, 0x80002, 0x0) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e20, 0x4000b, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x31}}, 0x80ad}, 0x1c) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0xce20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}}, 0x1c) r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r3, 0x0, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r4, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @mcast1, 0x6}, 0x1c) r5 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r5, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) r6 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r6, &(0x7f0000000240)={0xa, 0x4e20, 0xf, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x2}, 0x1c) r7 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r7, &(0x7f0000000280)={0xa, 0x4e20, 0x0, @mcast1, 0x5}, 0x1c) r8 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r8, &(0x7f00000002c0)={0xa, 0x4e20, 0x1, @mcast1, 0x7}, 0x1c) r9 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r9, &(0x7f0000000300)={0xa, 0xe20, 0x0, @mcast1, 0x1}, 0x1c) r10 = socket$inet6(0xa, 0x2, 0x0) r11 = socket(0xa, 0x2, 0x0) bind$inet6(r11, &(0x7f0000000340)={0xa, 0x4e20, 0x0, @mcast2={0xff, 0x5}}, 0x1c) bind$inet6(r10, &(0x7f0000000380)={0xa, 0x4e20, 0x0, @mcast1, 0x6}, 0x1c) 80.129781ms ago: executing program 2 (id=2218): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) ioctl$RTC_PIE_OFF(r1, 0x7006) sendmsg$nl_xfrm(r0, &(0x7f0000001980)={0x0, 0x0, &(0x7f00000019c0)={&(0x7f0000001a00)=ANY=[@ANYBLOB="60010000100033062cbd7000ffdbdf250000000000000007ddffffff00000001fe800000000000050080effd000000003a000000000000000000000000800000", @ANYRES32, @ANYRES32=0x0, @ANYBLOB="e0000002000000000000000000000000fffffffd320000007f0000010000000000000000000000000100000000000000030000000000000009000000000000000900000000000000020000000000000000000000000000000000000000000000fcffffffffffffff000000000000000000000000000000005f000000000000000a00000000000000010000000000000000000000020100000000000002000000800000000000000048000200656362286369706865725f6e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000170001"], 0x160}, 0x1, 0x0, 0x0, 0x20040}, 0x40080) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) syz_usb_control_io$rtl8150(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$rtl8150(0xffffffffffffffff, 0x0, &(0x7f0000000240)={0x2c, &(0x7f0000000280)=ANY=[@ANYBLOB="200302"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x44, &(0x7f0000000340)={0x20, 0x10, 0x2, '!k'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000380)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x40, 0xb, 0x2, "31fb"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000480)={0x34, &(0x7f00000004c0)={0x0, 0x16, 0x2, "f610"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000500)={0x44, &(0x7f0000000580)={0x0, 0xc, 0x1, '!'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 70.140122ms ago: executing program 0 (id=2219): mkdir(&(0x7f0000000240)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) r0 = epoll_create(0x10000e9) recvmmsg(0xffffffffffffffff, &(0x7f0000001540)=[{{&(0x7f0000001600)=@in6={0xa, 0x0, 0x0, @ipv4}, 0x80, &(0x7f0000001680)=[{&(0x7f0000001700)=""/182, 0xb6}, {&(0x7f0000001800)=""/4096, 0x1000}, {&(0x7f0000002800)=""/81, 0x51}, {&(0x7f0000002880)=""/96, 0x60}, {&(0x7f0000002900)=""/22, 0x16}, {&(0x7f0000002940)=""/218, 0xda}], 0x6}, 0xa}, {{&(0x7f0000002a40)=@tipc=@name, 0x80, &(0x7f0000002ac0)=[{&(0x7f0000002b40)=""/212, 0xd4}, {&(0x7f0000002c40)=""/226, 0xe2}, {&(0x7f0000002d40)=""/51, 0x33}, {&(0x7f0000002d80)=""/20, 0x14}, {&(0x7f0000002dc0)=""/182, 0xb6}], 0x5, &(0x7f0000002ec0)=""/53, 0x35}, 0x7}, {{&(0x7f0000002f00)=@qipcrtr, 0x80, &(0x7f0000002f80), 0x0, &(0x7f0000003680)=""/217, 0xd9}, 0xf}], 0x3, 0x10042, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f0000003780)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r2 = socket$unix(0x1, 0x0, 0x0) connect$unix(r2, &(0x7f0000003800)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) writev(r2, &(0x7f0000003880)=[{&(0x7f00000038c0)='`', 0x1}], 0x1) setsockopt$SO_TIMESTAMP(r1, 0x1, 0x23, &(0x7f0000003900)=0x6, 0x26) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000003940)=0x4a51, 0x4) recvmmsg(r1, &(0x7f0000003980), 0x40000000000049e, 0x1000000000fe, 0x0) r3 = memfd_create(&(0x7f0000001300)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\x008\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xd9w\\\xf8\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xd9\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00', 0x3) ftruncate(r3, 0xffff) fcntl$addseals(r3, 0x409, 0x7) r4 = ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f0000001440)={r3, 0x0, 0x0, 0x1000}) fcntl$dupfd(r4, 0x0, r0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x33, &(0x7f00000001c0)=0xfffffff6, 0x4) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 37.326536ms ago: executing program 0 (id=2220): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb0, 0xfa97, 0xa2b9, 0x6, 0x9, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffff9, 0x101bd, 0x4000000d, 0x0, 0x0, 0x6, 0x4, 0x100002, 0x2, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x2, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0xff, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x5, 0xfff, 0x1, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000086f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x3, 0x200b398, 0x8001, 0x1, 0x6, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff4, 0x4, 0x46, 0x5, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x200, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x1000, 0x31, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0x9, 0x9, 0xc, 0x2, 0x69, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2800004, 0x1, 0x10, 0x5, 0x9, 0x405, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xfff, 0x4, 0x7f, 0x9, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x27, 0xf7cc, 0xd502, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x81, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x6, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0x10dab, 0xfffffffd, 0x8, 0x13fff, 0xffff, 0x9]}, 0x45c) process_vm_writev(0x0, 0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000540)=""/213, 0xd5}], 0x1, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000280)={[0x8, 0x4, 0x7, 0x7, 0x5, 0x80000000, 0x1, 0x8001, 0xc646, 0x1, 0x8, 0x3, 0x4, 0x0, 0x8, 0x8000000000000], 0x3000, 0xa400}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 0s ago: executing program 1 (id=2126): r0 = syz_open_dev$usbmon(&(0x7f0000000000), 0x0, 0x0) (async) r1 = socket$tipc(0x1e, 0x2, 0x0) getsockopt$TIPC_IMPORTANCE(r1, 0x10f, 0x7f, &(0x7f0000000040), &(0x7f0000000080)=0x4) (async) ioctl$MON_IOCT_RING_SIZE(r0, 0x9204, 0xa6db7) kernel console output (not intermixed with test programs): 7506][ T4276] ? __x64_sys_futex+0x110/0x110 [ 150.527528][ T4276] __x64_sys_futex+0xe9/0x110 [ 150.527550][ T4276] x64_sys_call+0x227f/0x2ee0 [ 150.527570][ T4276] do_syscall_64+0x57/0xf0 [ 150.527589][ T4276] ? clear_bhb_loop+0x50/0xa0 [ 150.527613][ T4276] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 150.527637][ T4276] RIP: 0033:0x7f902539f559 [ 150.527654][ T4276] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 150.527673][ T4276] RSP: 002b:00007f90261c80e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 150.527696][ T4276] RAX: ffffffffffffffda RBX: 00007f9025625fa8 RCX: 00007f902539f559 [ 150.527713][ T4276] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f9025625fa8 [ 150.527728][ T4276] RBP: 00007f9025625fa0 R08: 0000000000000000 R09: 0000000000000000 [ 150.527742][ T4276] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 150.527756][ T4276] R13: 00007f9025626038 R14: 00007fffb73c9830 R15: 00007fffb73c9918 [ 150.527774][ T4276] [ 150.532931][ T4284] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1715'. [ 150.822419][ C1] sd 0:0:1:0: [sda] tag#7476 UNKNOWN(0x2003) Result: hostbyte=0x07 driverbyte=DRIVER_OK cmd_age=0s [ 150.833190][ C1] sd 0:0:1:0: [sda] tag#7476 CDB: opcode=0xa 0a 00 00 00 0b 00 00 00 00 00 00 00 [ 150.842525][ T3086] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 150.855789][ T4293] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1709'. [ 150.993257][ T3086] usb 1-1: Using ep0 maxpacket: 32 [ 150.999371][ T3086] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 151.007573][ T3086] usb 1-1: config 0 has no interface number 0 [ 151.013682][ T3086] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 151.025029][ T3086] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 151.034084][ T3086] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 151.042041][ T3086] usb 1-1: Product: syz [ 151.046202][ T3086] usb 1-1: Manufacturer: syz [ 151.050793][ T3086] usb 1-1: SerialNumber: syz [ 151.055952][ T3086] usb 1-1: config 0 descriptor?? [ 151.061148][ T4286] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 151.103229][ T3092] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 151.253239][ T3092] usb 2-1: Using ep0 maxpacket: 32 [ 151.259444][ T3092] usb 2-1: config 0 has an invalid interface number: 188 but max is 0 [ 151.267627][ T3092] usb 2-1: config 0 has no interface number 0 [ 151.273011][ T4284] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 151.273724][ T3092] usb 2-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 151.292154][ T3092] usb 2-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 151.301228][ T3092] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 151.309226][ T3092] usb 2-1: Product: syz [ 151.313412][ T3092] usb 2-1: Manufacturer: syz [ 151.317994][ T3092] usb 2-1: SerialNumber: syz [ 151.323154][ T3092] usb 2-1: config 0 descriptor?? [ 151.328421][ T4293] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 151.536303][ T4293] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 152.084228][ T3086] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 152.094353][ T3086] asix 1-1:0.188 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffc3 [ 152.104745][ T3086] asix 1-1:0.188: probe with driver asix failed with error -61 [ 152.290457][ T3086] usb 1-1: USB disconnect, device number 41 [ 152.346062][ T3092] asix 2-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 152.356228][ T3092] asix 2-1:0.188 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffc3 [ 152.366647][ T3092] asix 2-1:0.188: probe with driver asix failed with error -61 [ 153.855976][ T534] usb 2-1: USB disconnect, device number 52 [ 153.872992][ T4299] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1713'. [ 153.890076][ T4303] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1714'. [ 153.950787][ C1] sd 0:0:1:0: [sda] tag#7479 UNKNOWN(0x2003) Result: hostbyte=0x07 driverbyte=DRIVER_OK cmd_age=0s [ 153.961489][ C1] sd 0:0:1:0: [sda] tag#7479 CDB: opcode=0xa 0a 00 00 00 0b 00 00 00 00 00 00 00 [ 154.113252][ T3086] usb 3-1: new full-speed USB device number 47 using dummy_hcd [ 154.123241][ T3087] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 154.193272][ T534] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 154.264295][ T3086] usb 3-1: config 0 has an invalid interface number: 41 but max is 0 [ 154.272394][ T3086] usb 3-1: config 0 has no interface number 0 [ 154.278504][ T3087] usb 4-1: Using ep0 maxpacket: 32 [ 154.283649][ T3086] usb 3-1: config 0 interface 41 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 154.294467][ T3086] usb 3-1: config 0 interface 41 has no altsetting 0 [ 154.302049][ T3087] usb 4-1: config 0 has an invalid interface number: 188 but max is 0 [ 154.310263][ T3087] usb 4-1: config 0 has no interface number 0 [ 154.316394][ T3087] usb 4-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 154.326658][ T3086] usb 3-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 154.335798][ T3086] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 154.343832][ T3086] usb 3-1: Product: syz [ 154.348083][ T3086] usb 3-1: Manufacturer: syz [ 154.352676][ T3086] usb 3-1: SerialNumber: syz [ 154.357315][ T534] usb 2-1: Using ep0 maxpacket: 32 [ 154.362789][ T3087] usb 4-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 154.372390][ T3087] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 154.380658][ T3086] usb 3-1: config 0 descriptor?? [ 154.385678][ T3087] usb 4-1: Product: syz [ 154.389869][ T3087] usb 4-1: Manufacturer: syz [ 154.394536][ T534] usb 2-1: config 0 has an invalid interface number: 188 but max is 0 [ 154.402686][ T534] usb 2-1: config 0 has no interface number 0 [ 154.409123][ T3086] CoreChips 3-1:0.41: probe with driver CoreChips failed with error -22 [ 154.417491][ T3087] usb 4-1: SerialNumber: syz [ 154.423231][ T534] usb 2-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 154.433461][ T3087] usb 4-1: config 0 descriptor?? [ 154.438702][ T4299] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 154.439830][ T534] usb 2-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 154.455275][ T534] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 154.463313][ T534] usb 2-1: Product: syz [ 154.467472][ T534] usb 2-1: Manufacturer: syz [ 154.472066][ T534] usb 2-1: SerialNumber: syz [ 154.477355][ T534] usb 2-1: config 0 descriptor?? [ 154.482598][ T4303] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 154.655428][ T4299] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 154.690405][ T4303] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 155.465170][ T3087] asix 4-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 155.475330][ T3087] asix 4-1:0.188 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffc3 [ 155.485755][ T3087] asix 4-1:0.188: probe with driver asix failed with error -61 [ 155.900958][ T534] asix 2-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 155.911215][ T534] asix 2-1:0.188 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x0080: ffffffb9 [ 155.933279][ T534] asix 2-1:0.188: probe with driver asix failed with error -71 [ 155.942075][ T534] usb 2-1: USB disconnect, device number 53 [ 156.870755][ T534] usb 3-1: USB disconnect, device number 47 [ 156.888902][ C1] sd 0:0:1:0: [sda] tag#7483 UNKNOWN(0x2003) Result: hostbyte=0x07 driverbyte=DRIVER_OK cmd_age=0s [ 156.889871][ T4314] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1727'. [ 156.899677][ C1] sd 0:0:1:0: [sda] tag#7483 CDB: opcode=0xa 0a 00 00 00 0b 00 00 00 00 00 00 00 [ 156.920891][ T3087] usb 4-1: USB disconnect, device number 49 [ 156.931447][ T4316] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1721'. [ 156.955909][ T4321] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1723'. [ 157.163270][ T916] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 157.193251][ T3092] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 157.273272][ T534] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 157.323233][ T916] usb 1-1: Using ep0 maxpacket: 32 [ 157.329353][ T916] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 157.337581][ T916] usb 1-1: config 0 has no interface number 0 [ 157.343679][ T3092] usb 2-1: Using ep0 maxpacket: 32 [ 157.348829][ T916] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 157.353231][ T3087] usb 4-1: new full-speed USB device number 50 using dummy_hcd [ 157.360216][ T916] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 157.375403][ T3092] usb 2-1: config 0 has an invalid interface number: 188 but max is 0 [ 157.383578][ T3092] usb 2-1: config 0 has no interface number 0 [ 157.389646][ T3092] usb 2-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 157.399643][ T916] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 157.407652][ T916] usb 1-1: Product: syz [ 157.411793][ T916] usb 1-1: Manufacturer: syz [ 157.416467][ T916] usb 1-1: SerialNumber: syz [ 157.421759][ T916] usb 1-1: config 0 descriptor?? [ 157.427067][ T4314] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 157.427124][ T3092] usb 2-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 157.434342][ T534] usb 3-1: Using ep0 maxpacket: 32 [ 157.443315][ T3092] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 157.449651][ T534] usb 3-1: config 0 has an invalid interface number: 188 but max is 0 [ 157.457045][ T3092] usb 2-1: Product: syz [ 157.464827][ T534] usb 3-1: config 0 has no interface number 0 [ 157.468707][ T3092] usb 2-1: Manufacturer: syz [ 157.474910][ T534] usb 3-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 157.479347][ T3092] usb 2-1: SerialNumber: syz [ 157.490849][ T534] usb 3-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 157.495046][ T3092] usb 2-1: config 0 descriptor?? [ 157.507864][ T534] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 157.508219][ T4316] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 157.515987][ T534] usb 3-1: Product: syz [ 157.527180][ T534] usb 3-1: Manufacturer: syz [ 157.531763][ T534] usb 3-1: SerialNumber: syz [ 157.537026][ T534] usb 3-1: config 0 descriptor?? [ 157.542321][ T4321] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 157.544347][ T3087] usb 4-1: config 0 has an invalid interface number: 41 but max is 0 [ 157.557546][ T3087] usb 4-1: config 0 has no interface number 0 [ 157.564537][ T3087] usb 4-1: config 0 interface 41 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 157.574403][ T3087] usb 4-1: config 0 interface 41 has no altsetting 0 [ 157.582441][ T3087] usb 4-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 157.591537][ T3087] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 157.599549][ T3087] usb 4-1: Product: syz [ 157.603736][ T3087] usb 4-1: Manufacturer: syz [ 157.608332][ T3087] usb 4-1: SerialNumber: syz [ 157.613675][ T3087] usb 4-1: config 0 descriptor?? [ 157.619418][ T3087] CoreChips 4-1:0.41: probe with driver CoreChips failed with error -22 [ 157.665078][ T4314] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 157.726309][ T4316] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 157.758137][ T4321] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 158.876658][ T916] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 158.886913][ T916] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x0080: ffffffb9 [ 158.913279][ T916] asix 1-1:0.188: probe with driver asix failed with error -71 [ 158.922236][ T916] usb 1-1: USB disconnect, device number 42 [ 158.937664][ T3092] asix 2-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 158.947917][ T3092] asix 2-1:0.188 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x0080: ffffffb9 [ 158.983270][ T3092] asix 2-1:0.188: probe with driver asix failed with error -71 [ 158.993136][ T3092] usb 2-1: USB disconnect, device number 54 [ 159.168280][ T534] asix 3-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 159.178537][ T534] asix 3-1:0.188: probe with driver asix failed with error -71 [ 159.188800][ T534] usb 3-1: USB disconnect, device number 48 [ 159.469879][ T4334] device-mapper: table: 252:8: adding target device (start sect 0 len 5320) caused an alignment inconsistency [ 159.490851][ T4337] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1732'. [ 159.633255][ T534] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 159.692614][ T36] audit: type=1400 audit(1793449206.099:1068): avc: denied { nlmsg_read } for pid=4338 comm="syz.2.1733" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 159.733255][ T3092] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 159.803240][ T534] usb 1-1: Using ep0 maxpacket: 32 [ 159.809723][ T534] usb 1-1: unable to get BOS descriptor or descriptor too short [ 159.818068][ T534] usb 1-1: config 1 has an invalid descriptor of length 121, skipping remainder of the config [ 159.828367][ T534] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x89 has invalid maxpacket 23694, setting to 1024 [ 159.839491][ T534] usb 1-1: config 1 interface 2 altsetting 1 bulk endpoint 0x89 has invalid maxpacket 1024 [ 159.849493][ T534] usb 1-1: config 1 interface 2 has no altsetting 0 [ 159.857402][ T534] usb 1-1: New USB device found, idVendor=0582, idProduct=0016, bcdDevice= 0.40 [ 159.866464][ T534] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 159.874470][ T534] usb 1-1: Product: syz [ 159.878622][ T534] usb 1-1: Manufacturer: syz [ 159.883223][ T534] usb 1-1: SerialNumber: syz [ 159.883234][ T3092] usb 2-1: Using ep0 maxpacket: 32 [ 159.894231][ T3092] usb 2-1: config 0 has an invalid interface number: 188 but max is 0 [ 159.902426][ T3092] usb 2-1: config 0 has no interface number 0 [ 159.908691][ T3092] usb 2-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 159.920103][ T3092] usb 2-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 159.929202][ T916] usb 3-1: new full-speed USB device number 49 using dummy_hcd [ 159.936780][ T3092] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 159.944849][ T3092] usb 2-1: Product: syz [ 159.949036][ T3092] usb 2-1: Manufacturer: syz [ 159.953777][ T3092] usb 2-1: SerialNumber: syz [ 159.958983][ T3092] usb 2-1: config 0 descriptor?? [ 159.964248][ T4337] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 160.068962][ T9] usb 4-1: USB disconnect, device number 50 [ 160.106790][ T916] usb 3-1: unable to get BOS descriptor or descriptor too short [ 160.115143][ T916] usb 3-1: not running at top speed; connect to a high speed hub [ 160.136986][ T916] usb 3-1: New USB device found, idVendor=0e41, idProduct=4650, bcdDevice= 0.40 [ 160.146107][ T916] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 160.158747][ T916] usb 3-1: Product: syz [ 160.159516][ T534] usb 1-1: invalid MIDI out EP 0 [ 160.163218][ T916] usb 3-1: Manufacturer: syz [ 160.170476][ T534] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 160.173592][ T916] usb 3-1: SerialNumber: syz [ 160.182061][ T4337] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 160.195775][ T534] usb 1-1: invalid MIDI out EP 0 [ 160.200990][ T534] snd-usb-audio 1-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 160.211883][ T534] usb 1-1: invalid MIDI out EP 0 [ 160.225839][ T534] snd-usb-audio 1-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 160.237223][ T2476] udevd[2476]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.2/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 160.241248][ T534] usb 1-1: USB disconnect, device number 43 [ 160.269243][ T4351] tipc: Enabling of bearer rejected, failed to enable media [ 160.416942][ T916] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 160.423999][ T916] usb 3-1: 2:1: invalid format type 0x1002 is detected, processed as PCM [ 160.432445][ T916] usb 3-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 160.444179][ T916] usb 3-1: USB disconnect, device number 49 [ 160.452415][ T3718] udevd[3718]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 160.691125][ T4373] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1746'. [ 160.763420][ T534] usb 4-1: new full-speed USB device number 51 using dummy_hcd [ 160.914292][ T534] usb 4-1: config 0 has an invalid interface number: 41 but max is 0 [ 160.922402][ T534] usb 4-1: config 0 has no interface number 0 [ 160.928773][ T534] usb 4-1: config 0 interface 41 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 160.933239][ T916] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 160.938874][ T534] usb 4-1: config 0 interface 41 has no altsetting 0 [ 160.954453][ T534] usb 4-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 160.955670][ T4377] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=8208 sclass=netlink_xfrm_socket pid=4377 comm=syz.2.1748 [ 160.963562][ T534] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 160.963587][ T534] usb 4-1: Product: syz [ 160.988265][ T534] usb 4-1: Manufacturer: syz [ 160.993221][ T534] usb 4-1: SerialNumber: syz [ 160.999646][ T534] usb 4-1: config 0 descriptor?? [ 161.005986][ T4381] rust_binder: 4378:4381 BC_REQUEST_FREEZE_NOTIFICATION invalid ref 3 [ 161.006762][ T534] CoreChips 4-1:0.41: probe with driver CoreChips failed with error -22 [ 161.014660][ T4381] rust_binder: Write failure EINVAL in pid:959 [ 161.028973][ T36] audit: type=1400 audit(1793449207.429:1069): avc: denied { map } for pid=4378 comm="syz.2.1749" path="/dev/binderfs/binder0" dev="binder" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 161.103230][ T916] usb 1-1: Using ep0 maxpacket: 32 [ 161.109997][ T916] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 161.118399][ T916] usb 1-1: config 0 has no interface number 0 [ 161.124551][ T916] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 161.136039][ T916] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 161.145242][ T916] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 161.153298][ T916] usb 1-1: Product: syz [ 161.158448][ T916] usb 1-1: Manufacturer: syz [ 161.164040][ T916] usb 1-1: SerialNumber: syz [ 161.169273][ T916] usb 1-1: config 0 descriptor?? [ 161.174541][ T4373] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 161.322434][ T36] audit: type=1400 audit(1793449207.729:1070): avc: denied { getopt } for pid=4405 comm="syz.2.1758" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 161.382292][ T4373] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 161.593246][ T9] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 161.743228][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 161.749464][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 161.760541][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 161.770298][ T9] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 161.779446][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 161.788042][ T9] usb 3-1: config 0 descriptor?? [ 161.797176][ T9] hub 3-1:0.0: USB hub found [ 161.803974][ T3092] asix 2-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 161.814728][ T3092] asix 2-1:0.188 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 161.825179][ T3092] asix 2-1:0.188: probe with driver asix failed with error -71 [ 161.834628][ T3092] usb 2-1: USB disconnect, device number 55 [ 161.995662][ T9] hub 3-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 162.318187][ T4410] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1760'. [ 162.366139][ T36] audit: type=1400 audit(1793449208.779:1071): avc: denied { compute_member } for pid=4416 comm="syz.1.1763" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 162.397522][ T9] hid-generic 0003:046D:C31C.000D: unknown main item tag 0x0 [ 162.413377][ T9] hid-generic 0003:046D:C31C.000D: hidraw0: USB HID v8.00 Device [HID 046d:c31c] on usb-dummy_hcd.2-1/input0 [ 162.429096][ T4420] udevd[4420]: open /dev/null failed: Not a directory [ 162.598354][ T916] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 162.608558][ T916] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x0080: ffffffb9 [ 162.633269][ T916] asix 1-1:0.188: probe with driver asix failed with error -71 [ 162.642450][ T916] usb 1-1: USB disconnect, device number 44 [ 162.753413][ T3092] usb 3-1: USB disconnect, device number 50 [ 163.268900][ T4434] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1769'. [ 163.383502][ T3092] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 163.523231][ T916] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 163.538832][ T10] usb 4-1: USB disconnect, device number 51 [ 163.544859][ T3092] usb 2-1: Using ep0 maxpacket: 32 [ 163.661622][ T4439] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1768'. [ 163.674273][ T916] usb 3-1: Using ep0 maxpacket: 32 [ 163.687443][ T916] usb 3-1: config 0 has an invalid interface number: 188 but max is 0 [ 163.696065][ T916] usb 3-1: config 0 has no interface number 0 [ 163.702223][ T916] usb 3-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 163.714065][ T916] usb 3-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 163.723600][ T916] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 163.731640][ T916] usb 3-1: Product: syz [ 163.736219][ T916] usb 3-1: Manufacturer: syz [ 163.740879][ T916] usb 3-1: SerialNumber: syz [ 163.749829][ T916] usb 3-1: config 0 descriptor?? [ 163.755342][ T4434] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 163.963303][ T4434] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 164.063244][ T10] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 164.103111][ T36] audit: type=1400 audit(1793449210.509:1072): avc: denied { bind } for pid=4447 comm="syz.0.1775" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 164.172935][ T4454] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1776'. [ 164.213257][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 164.219451][ T10] usb 4-1: config 0 has an invalid interface number: 196 but max is 0 [ 164.227728][ T10] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 164.237865][ T10] usb 4-1: config 0 has no interface number 0 [ 164.243995][ T10] usb 4-1: config 0 interface 196 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 164.257082][ T10] usb 4-1: config 0 interface 196 has no altsetting 0 [ 164.265400][ T10] usb 4-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 164.274456][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 164.284756][ T3092] usb 2-1: unable to get BOS descriptor or descriptor too short [ 164.292465][ T10] usb 4-1: Product: syz [ 164.296868][ T3092] usb 2-1: no configurations [ 164.301496][ T10] usb 4-1: Manufacturer: syz [ 164.306145][ T3092] usb 2-1: can't read configurations, error -22 [ 164.312431][ T10] usb 4-1: SerialNumber: syz [ 164.317647][ T10] usb 4-1: config 0 descriptor?? [ 164.324187][ T10] ipheth 4-1:0.196: Unable to find endpoints [ 164.413254][ T3091] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 164.523570][ T3087] usb 4-1: USB disconnect, device number 52 [ 164.563240][ T3091] usb 1-1: Using ep0 maxpacket: 32 [ 164.569436][ T3091] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 164.577757][ T3091] usb 1-1: config 0 has no interface number 0 [ 164.583908][ T3091] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 164.595526][ T3091] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 164.604606][ T3091] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 164.612715][ T3091] usb 1-1: Product: syz [ 164.616942][ T3091] usb 1-1: Manufacturer: syz [ 164.621552][ T3091] usb 1-1: SerialNumber: syz [ 164.626840][ T3091] usb 1-1: config 0 descriptor?? [ 164.632114][ T4454] raw-gadget.3 gadget.0: fail, usb_ep_enable returned -22 [ 164.653225][ T3092] usb 2-1: new full-speed USB device number 57 using dummy_hcd [ 164.804279][ T3092] usb 2-1: config 0 has an invalid interface number: 41 but max is 0 [ 164.812395][ T3092] usb 2-1: config 0 has no interface number 0 [ 164.818539][ T3092] usb 2-1: config 0 interface 41 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 164.828377][ T3092] usb 2-1: config 0 interface 41 has no altsetting 0 [ 164.836424][ T3092] usb 2-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 164.845522][ T3092] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 164.845921][ T4454] raw-gadget.3 gadget.0: fail, usb_ep_enable returned -22 [ 164.853546][ T3092] usb 2-1: Product: syz [ 164.864896][ T3092] usb 2-1: Manufacturer: syz [ 164.869485][ T3092] usb 2-1: SerialNumber: syz [ 164.875093][ T3092] usb 2-1: config 0 descriptor?? [ 164.880813][ T3092] CoreChips 2-1:0.41: probe with driver CoreChips failed with error -22 [ 165.047068][ T4465] overlayfs: fs on './file0' does not support file handles, falling back to xino=off. [ 165.062672][ T36] audit: type=1400 audit(1793449211.469:1073): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 165.579251][ T916] asix 3-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 165.591503][ T916] asix 3-1:0.188 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 165.601972][ T916] asix 3-1:0.188: probe with driver asix failed with error -71 [ 165.613269][ T916] usb 3-1: USB disconnect, device number 51 [ 166.094701][ T3091] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 166.104985][ T3091] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x0080: ffffffb9 [ 166.133256][ T3091] asix 1-1:0.188: probe with driver asix failed with error -71 [ 166.141713][ T3091] usb 1-1: USB disconnect, device number 45 [ 166.293247][ T3087] usb 4-1: new full-speed USB device number 53 using dummy_hcd [ 166.444260][ T3087] usb 4-1: config 0 has an invalid interface number: 41 but max is 0 [ 166.452401][ T3087] usb 4-1: config 0 has no interface number 0 [ 166.458504][ T3087] usb 4-1: config 0 interface 41 has no altsetting 0 [ 166.466477][ T3087] usb 4-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 166.475542][ T3087] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 166.483555][ T3087] usb 4-1: Product: syz [ 166.487713][ T3087] usb 4-1: Manufacturer: syz [ 166.492308][ T3087] usb 4-1: SerialNumber: syz [ 166.497892][ T3087] usb 4-1: config 0 descriptor?? [ 166.621811][ T4489] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1791'. [ 167.306425][ T3087] CoreChips 4-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffb9 [ 167.321303][ T3087] CoreChips 4-1:0.41: probe with driver CoreChips failed with error -71 [ 167.332165][ T3087] usb 4-1: USB disconnect, device number 53 [ 167.386494][ T348] usb 2-1: USB disconnect, device number 57 [ 167.406290][ T4504] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1797'. [ 167.566104][ T36] audit: type=1400 audit(1793449213.979:1074): avc: denied { getopt } for pid=4505 comm="syz.0.1798" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 167.743247][ T348] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 167.829914][ T4509] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1799'. [ 167.893264][ T348] usb 2-1: Using ep0 maxpacket: 32 [ 167.893558][ T4513] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1801'. [ 167.899531][ T348] usb 2-1: config 0 has an invalid interface number: 188 but max is 0 [ 167.915516][ T348] usb 2-1: config 0 has no interface number 0 [ 167.921615][ T348] usb 2-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 167.932957][ T348] usb 2-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 167.942018][ T348] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 167.950253][ T348] usb 2-1: Product: syz [ 167.954429][ T348] usb 2-1: Manufacturer: syz [ 167.959019][ T348] usb 2-1: SerialNumber: syz [ 167.964261][ T348] usb 2-1: config 0 descriptor?? [ 167.969470][ T4504] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 168.073250][ T3087] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 168.137152][ T36] audit: type=1400 audit(1793449214.549:1075): avc: denied { create } for pid=4514 comm="syz.0.1802" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=iucv_socket permissive=1 [ 168.156765][ T916] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 168.177291][ T4504] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 168.212312][ T4520] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1804'. [ 168.223228][ T3087] usb 4-1: Using ep0 maxpacket: 32 [ 168.229357][ T3087] usb 4-1: config 0 has an invalid interface number: 188 but max is 0 [ 168.237571][ T3087] usb 4-1: config 0 has no interface number 0 [ 168.243666][ T3087] usb 4-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 168.254972][ T3087] usb 4-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 168.264043][ T3087] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 168.272018][ T3087] usb 4-1: Product: syz [ 168.276184][ T3087] usb 4-1: Manufacturer: syz [ 168.280798][ T3087] usb 4-1: SerialNumber: syz [ 168.286044][ T3087] usb 4-1: config 0 descriptor?? [ 168.291267][ T4509] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 168.313239][ T916] usb 3-1: Using ep0 maxpacket: 32 [ 168.319400][ T916] usb 3-1: config 0 has an invalid interface number: 188 but max is 0 [ 168.327590][ T916] usb 3-1: config 0 has no interface number 0 [ 168.333702][ T916] usb 3-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 168.345098][ T916] usb 3-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 168.354159][ T916] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 168.362139][ T916] usb 3-1: Product: syz [ 168.366307][ T916] usb 3-1: Manufacturer: syz [ 168.370891][ T916] usb 3-1: SerialNumber: syz [ 168.376120][ T916] usb 3-1: config 0 descriptor?? [ 168.381351][ T4513] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 168.463260][ T534] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 168.499265][ T4509] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 168.589280][ T4513] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 168.613219][ T534] usb 1-1: Using ep0 maxpacket: 32 [ 168.619453][ T534] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 168.627646][ T534] usb 1-1: config 0 has no interface number 0 [ 168.633759][ T534] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 168.645142][ T534] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 168.654205][ T534] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 168.662197][ T534] usb 1-1: Product: syz [ 168.666388][ T534] usb 1-1: Manufacturer: syz [ 168.670996][ T534] usb 1-1: SerialNumber: syz [ 168.676331][ T534] usb 1-1: config 0 descriptor?? [ 168.681530][ T4520] raw-gadget.3 gadget.0: fail, usb_ep_enable returned -22 [ 168.889400][ T4520] raw-gadget.3 gadget.0: fail, usb_ep_enable returned -22 [ 169.710502][ T3087] asix 4-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 169.720750][ T3087] asix 4-1:0.188 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x0080: ffffffb9 [ 169.743280][ T3087] asix 4-1:0.188: probe with driver asix failed with error -71 [ 169.751896][ T3087] usb 4-1: USB disconnect, device number 54 [ 169.792384][ T348] asix 2-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 169.802623][ T348] asix 2-1:0.188 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 169.802923][ T916] asix 3-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 169.813143][ T348] asix 2-1:0.188: probe with driver asix failed with error -71 [ 169.827732][ T916] asix 3-1:0.188 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x0080: ffffffb9 [ 169.833911][ T348] usb 2-1: USB disconnect, device number 58 [ 169.853283][ T916] asix 3-1:0.188: probe with driver asix failed with error -71 [ 169.862946][ T916] usb 3-1: USB disconnect, device number 52 [ 170.249045][ T36] audit: type=1400 audit(1793449216.659:1076): avc: denied { checkpoint_restore } for pid=4521 comm="syz.3.1805" capability=40 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 170.287678][ T4525] futex_wake_op: syz.3.1806 tries to shift op by 144; fix this program [ 170.301197][ T534] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 170.323249][ T534] asix 1-1:0.188: probe with driver asix failed with error -71 [ 170.332517][ T534] usb 1-1: USB disconnect, device number 46 [ 170.403934][ T36] audit: type=1400 audit(1793449216.819:1077): avc: denied { mounton } for pid=4536 comm="syz.1.1813" path="/proc/1155/ns/mnt" dev="proc" ino=38181 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=lnk_file permissive=1 [ 170.492640][ T4541] FAULT_INJECTION: forcing a failure. [ 170.492640][ T4541] name failslab, interval 1, probability 0, space 0, times 0 [ 170.505666][ T4541] CPU: 1 UID: 0 PID: 4541 Comm: syz.1.1814 Not tainted syzkaller #0 86ffabe033aa4b611dc1eaf9ec72dc67ec78bb97 [ 170.505702][ T4541] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 170.505715][ T4541] Call Trace: [ 170.505723][ T4541] [ 170.505732][ T4541] __dump_stack+0x21/0x30 [ 170.505757][ T4541] dump_stack_lvl+0x140/0x1c0 [ 170.505776][ T4541] ? __cfi_dump_stack_lvl+0x10/0x10 [ 170.505797][ T4541] dump_stack+0x19/0x20 [ 170.505814][ T4541] should_fail_ex+0x3c2/0x510 [ 170.505842][ T4541] should_failslab+0xac/0x100 [ 170.505864][ T4541] kmem_cache_alloc_noprof+0x42/0x410 [ 170.505891][ T4541] ? pcpu_block_update_hint_alloc+0x8a0/0xc50 [ 170.505912][ T4541] ? mas_dup_build+0x3bb/0x1ac0 [ 170.505938][ T4541] mas_dup_build+0x3bb/0x1ac0 [ 170.505964][ T4541] ? pcpu_memcg_post_alloc_hook+0x202/0x2e0 [ 170.505983][ T4541] ? mutex_unlock+0x90/0x240 [ 170.506007][ T4541] ? pcpu_alloc_noprof+0x1440/0x1440 [ 170.506028][ T4541] __mt_dup+0x16f/0x290 [ 170.506051][ T4541] ? __cfi___mt_dup+0x10/0x10 [ 170.506078][ T4541] ? __kasan_check_write+0x18/0x20 [ 170.506105][ T4541] copy_mm+0x716/0x1da0 [ 170.506132][ T4541] ? copy_signal+0x6a0/0x6a0 [ 170.506158][ T4541] ? _raw_spin_lock+0x92/0x120 [ 170.506186][ T4541] ? __asan_memset+0x39/0x50 [ 170.506212][ T4541] ? __init_rwsem+0x110/0x1f0 [ 170.506234][ T4541] ? copy_signal+0x4d5/0x6a0 [ 170.506260][ T4541] copy_process+0x12a4/0x3370 [ 170.506288][ T4541] ? __cfi_copy_process+0x10/0x10 [ 170.506315][ T4541] kernel_clone+0x233/0x810 [ 170.506341][ T4541] ? __cfi_kernel_clone+0x10/0x10 [ 170.506366][ T4541] ? do_futex+0x37d/0x510 [ 170.506388][ T4541] __x64_sys_clone+0x1b7/0x230 [ 170.506426][ T4541] ? __cfi___x64_sys_clone+0x10/0x10 [ 170.506456][ T4541] ? __kasan_check_write+0x18/0x20 [ 170.506482][ T4541] ? fpregs_restore_userregs+0x11c/0x260 [ 170.506510][ T4541] ? switch_fpu_return+0x12/0x20 [ 170.506536][ T4541] x64_sys_call+0x2b3c/0x2ee0 [ 170.506556][ T4541] do_syscall_64+0x57/0xf0 [ 170.506575][ T4541] ? clear_bhb_loop+0x50/0xa0 [ 170.506598][ T4541] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 170.506622][ T4541] RIP: 0033:0x7f902539f559 [ 170.506640][ T4541] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 170.506661][ T4541] RSP: 002b:00007f90261c7fd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 170.506684][ T4541] RAX: ffffffffffffffda RBX: 00007f9025625fa0 RCX: 00007f902539f559 [ 170.506701][ T4541] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 170.506714][ T4541] RBP: 00007f9025436b50 R08: 0000000000000000 R09: 0000000000000000 [ 170.506728][ T4541] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 170.506742][ T4541] R13: 00007f9025626038 R14: 00007f9025625fa0 R15: 00007fffb73c9918 [ 170.506760][ T4541] [ 170.811514][ T4545] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1816'. [ 170.841798][ T4541] incfs_lookup_dentry err:-5 [ 170.846697][ T4541] incfs: Can't find or create .incomplete dir in ./file0 [ 170.853944][ T4541] incfs: mount failed -5 [ 170.859116][ T4550] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1817'. [ 170.933516][ T348] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 171.063354][ T534] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 171.093239][ T348] usb 3-1: Using ep0 maxpacket: 32 [ 171.103426][ T916] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 171.164300][ T4539] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1812'. [ 171.213232][ T534] usb 4-1: Using ep0 maxpacket: 32 [ 171.219407][ T534] usb 4-1: config 0 has an invalid interface number: 188 but max is 0 [ 171.227612][ T534] usb 4-1: config 0 has no interface number 0 [ 171.233734][ T534] usb 4-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 171.245000][ T534] usb 4-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 171.254055][ T534] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 171.262063][ T534] usb 4-1: Product: syz [ 171.266240][ T534] usb 4-1: Manufacturer: syz [ 171.270858][ T534] usb 4-1: SerialNumber: syz [ 171.273228][ T916] usb 1-1: Using ep0 maxpacket: 32 [ 171.276597][ T534] usb 4-1: config 0 descriptor?? [ 171.280581][ T3091] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 171.285846][ T4545] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 171.295682][ T916] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 171.308479][ T916] usb 1-1: config 0 has no interface number 0 [ 171.314583][ T916] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 171.326014][ T916] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 171.335113][ T916] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 171.343093][ T916] usb 1-1: Product: syz [ 171.347304][ T916] usb 1-1: Manufacturer: syz [ 171.351897][ T916] usb 1-1: SerialNumber: syz [ 171.357308][ T916] usb 1-1: config 0 descriptor?? [ 171.364410][ T4550] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 171.434236][ T3091] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 171.445154][ T3091] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 171.454912][ T3091] usb 2-1: New USB device found, idVendor=056a, idProduct=033b, bcdDevice= 0.00 [ 171.463967][ T3091] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 171.503056][ T4545] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 171.572244][ T4550] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 171.732540][ T348] usb 3-1: unable to get BOS descriptor or descriptor too short [ 171.740257][ T348] usb 3-1: no configurations [ 171.745326][ T348] usb 3-1: can't read configurations, error -22 [ 171.874975][ T4562] netlink: 'syz.1.1822': attribute type 4 has an invalid length. [ 171.888452][ T4562] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 171.897926][ T4562] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 171.908138][ T36] audit: type=1400 audit(1793449218.319:1078): avc: denied { append } for pid=4561 comm="syz.1.1822" name="uprobe_events" dev="tracefs" ino=1043 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 171.931895][ T3091] usbhid 2-1:1.0: can't add hid device: -71 [ 171.937865][ T3091] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 171.946774][ T3091] usb 2-1: USB disconnect, device number 59 [ 172.393254][ T348] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 172.444079][ C1] sd 0:0:1:0: [sda] tag#7465 UNKNOWN(0x2003) Result: hostbyte=0x07 driverbyte=DRIVER_OK cmd_age=0s [ 172.454822][ C1] sd 0:0:1:0: [sda] tag#7465 CDB: opcode=0xa 0a 00 00 00 0b 00 00 00 00 00 00 00 [ 172.543214][ T348] usb 3-1: Using ep0 maxpacket: 8 [ 172.549327][ T348] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 191, changing to 7 [ 172.561798][ T348] usb 3-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 172.570883][ T348] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 172.578894][ T348] usb 3-1: Product: syz [ 172.583065][ T348] usb 3-1: Manufacturer: syz [ 172.587688][ T348] usb 3-1: SerialNumber: syz [ 172.723256][ T3091] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 172.785261][ T916] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 172.795586][ T916] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x0080: ffffffb9 [ 172.801261][ T348] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 172.816814][ T348] snd-usb-audio 3-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 172.823269][ T916] asix 1-1:0.188: probe with driver asix failed with error -71 [ 172.830627][ T348] snd-usb-audio 3-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 172.835815][ T916] usb 1-1: USB disconnect, device number 47 [ 172.849945][ T348] usb 3-1: USB disconnect, device number 54 [ 172.852057][ T2476] udevd[2476]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.2/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 172.893242][ T3091] usb 2-1: Using ep0 maxpacket: 32 [ 172.966185][ T4583] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1831'. [ 173.119539][ T534] asix 4-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 173.129775][ T534] asix 4-1:0.188 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 173.140221][ T534] asix 4-1:0.188: probe with driver asix failed with error -71 [ 173.149161][ T534] usb 4-1: USB disconnect, device number 55 [ 173.328806][ T4588] netlink: 'syz.2.1833': attribute type 4 has an invalid length. [ 173.336645][ T4588] netlink: 3657 bytes leftover after parsing attributes in process `syz.2.1833'. [ 173.498140][ T4604] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1840'. [ 173.546680][ T3091] usb 2-1: unable to get BOS descriptor or descriptor too short [ 173.563228][ T3091] usb 2-1: no configurations [ 173.571353][ T3091] usb 2-1: can't read configurations, error -22 [ 173.577802][ T36] audit: type=1400 audit(1793449219.989:1079): avc: denied { write } for pid=4609 comm="syz.1.1844" name=".pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 173.601775][ T36] audit: type=1400 audit(1793449219.989:1080): avc: denied { ioctl } for pid=4609 comm="syz.1.1844" path="/538/file0/.pending_reads" dev="incremental-fs" ino=2 ioctlcmd=0x6725 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 173.704621][ T36] audit: type=1400 audit(1793449220.119:1081): avc: denied { setopt } for pid=4627 comm="syz.3.1850" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 173.706399][ T4630] FAULT_INJECTION: forcing a failure. [ 173.706399][ T4630] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 173.738241][ T4630] CPU: 1 UID: 0 PID: 4630 Comm: syz.0.1851 Not tainted syzkaller #0 86ffabe033aa4b611dc1eaf9ec72dc67ec78bb97 [ 173.738272][ T4630] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 173.738286][ T4630] Call Trace: [ 173.738292][ T4630] [ 173.738301][ T4630] __dump_stack+0x21/0x30 [ 173.738323][ T4630] dump_stack_lvl+0x140/0x1c0 [ 173.738342][ T4630] ? __cfi_dump_stack_lvl+0x10/0x10 [ 173.738362][ T4630] dump_stack+0x19/0x20 [ 173.738379][ T4630] should_fail_ex+0x3c2/0x510 [ 173.738406][ T4630] should_fail+0xf/0x20 [ 173.738431][ T4630] should_fail_usercopy+0x1e/0x30 [ 173.738458][ T4630] _copy_from_user+0x20/0xa0 [ 173.738479][ T4630] do_ipv6_setsockopt+0x27f/0x3350 [ 173.738506][ T4630] ? __cfi_do_ipv6_setsockopt+0x10/0x10 [ 173.738530][ T4630] ? avc_has_perm_noaudit+0x26b/0x360 [ 173.738551][ T4630] ? __asan_memcpy+0x5a/0x80 [ 173.738578][ T4630] ? avc_has_perm_noaudit+0x289/0x360 [ 173.738599][ T4630] ? avc_has_perm+0x155/0x240 [ 173.738619][ T4630] ? __cfi_avc_has_perm+0x10/0x10 [ 173.738648][ T4630] ? selinux_socket_setsockopt+0x324/0x3d0 [ 173.738672][ T4630] ? __cfi_selinux_socket_setsockopt+0x10/0x10 [ 173.738694][ T4630] ? bpf_lsm_file_permission+0xd/0x20 [ 173.738716][ T4630] ? vfs_write+0xbcf/0xfd0 [ 173.738743][ T4630] ipv6_setsockopt+0x5d/0x170 [ 173.738767][ T4630] udpv6_setsockopt+0xa3/0xc0 [ 173.738787][ T4630] sock_common_setsockopt+0xb5/0xd0 [ 173.738814][ T4630] ? __cfi_sock_common_setsockopt+0x10/0x10 [ 173.738843][ T4630] do_sock_setsockopt+0x27f/0x410 [ 173.738866][ T4630] ? __cfi_do_sock_setsockopt+0x10/0x10 [ 173.738890][ T4630] ? __fget_files+0x2bc/0x330 [ 173.738910][ T4630] __x64_sys_setsockopt+0x18c/0x220 [ 173.738934][ T4630] x64_sys_call+0x2adc/0x2ee0 [ 173.738954][ T4630] do_syscall_64+0x57/0xf0 [ 173.738972][ T4630] ? clear_bhb_loop+0x50/0xa0 [ 173.738996][ T4630] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 173.739020][ T4630] RIP: 0033:0x7f82ca79f559 [ 173.739038][ T4630] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 173.739055][ T4630] RSP: 002b:00007f82cb63c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 173.739078][ T4630] RAX: ffffffffffffffda RBX: 00007f82caa25fa0 RCX: 00007f82ca79f559 [ 173.739093][ T4630] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000004 [ 173.739107][ T4630] RBP: 00007f82cb63c090 R08: 00000000000d0060 R09: 0000000000000000 [ 173.739121][ T4630] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 173.739134][ T4630] R13: 00007f82caa26038 R14: 00007f82caa25fa0 R15: 00007ffcb8e93618 [ 173.739151][ T4630] [ 174.000361][ T3087] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 174.113113][ T36] audit: type=1400 audit(1793449220.519:1082): avc: denied { remount } for pid=4636 comm="syz.1.1854" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 174.141696][ T4641] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1855'. [ 174.173225][ T3087] usb 3-1: Using ep0 maxpacket: 32 [ 174.180638][ T3087] usb 3-1: config 0 has an invalid interface number: 188 but max is 0 [ 174.188841][ T3087] usb 3-1: config 0 has no interface number 0 [ 174.194945][ T3087] usb 3-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 174.206146][ T3087] usb 3-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 174.215256][ T3087] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 174.223318][ T3087] usb 3-1: Product: syz [ 174.227471][ T3087] usb 3-1: Manufacturer: syz [ 174.232039][ T3087] usb 3-1: SerialNumber: syz [ 174.237385][ T3087] usb 3-1: config 0 descriptor?? [ 174.242635][ T4604] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 174.249841][ T3092] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 174.293239][ T4655] futex_wake_op: syz.3.1861 tries to shift op by 144; fix this program [ 174.403259][ T3092] usb 1-1: Using ep0 maxpacket: 32 [ 174.453241][ T3091] usb 2-1: new high-speed USB device number 61 using dummy_hcd [ 174.454811][ T4604] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 174.633218][ T3091] usb 2-1: Using ep0 maxpacket: 32 [ 174.639414][ T3091] usb 2-1: config 0 has an invalid interface number: 188 but max is 0 [ 174.647636][ T3091] usb 2-1: config 0 has no interface number 0 [ 174.653741][ T3091] usb 2-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 174.665115][ T3091] usb 2-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 174.674182][ T3091] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 174.682159][ T3091] usb 2-1: Product: syz [ 174.686346][ T3091] usb 2-1: Manufacturer: syz [ 174.691078][ T3091] usb 2-1: SerialNumber: syz [ 174.696450][ T3091] usb 2-1: config 0 descriptor?? [ 174.701721][ T4641] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 174.910036][ T4641] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 175.065055][ T3092] usb 1-1: unable to get BOS descriptor or descriptor too short [ 175.072814][ T3092] usb 1-1: no configurations [ 175.077496][ T3092] usb 1-1: can't read configurations, error -22 [ 175.146033][ T4671] tipc: Cannot configure node identity twice [ 175.166338][ T4673] FAULT_INJECTION: forcing a failure. [ 175.166338][ T4673] name failslab, interval 1, probability 0, space 0, times 0 [ 175.179067][ T4673] CPU: 1 UID: 0 PID: 4673 Comm: syz.0.1866 Not tainted syzkaller #0 86ffabe033aa4b611dc1eaf9ec72dc67ec78bb97 [ 175.179099][ T4673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 175.179113][ T4673] Call Trace: [ 175.179121][ T4673] [ 175.179128][ T4673] __dump_stack+0x21/0x30 [ 175.179154][ T4673] dump_stack_lvl+0x140/0x1c0 [ 175.179175][ T4673] ? __cfi_dump_stack_lvl+0x10/0x10 [ 175.179196][ T4673] dump_stack+0x19/0x20 [ 175.179209][ T4673] should_fail_ex+0x3c2/0x510 [ 175.179223][ T4673] should_failslab+0xac/0x100 [ 175.179235][ T4673] kmem_cache_alloc_noprof+0x42/0x410 [ 175.179251][ T4673] ? anon_vma_fork+0x1fc/0x610 [ 175.179278][ T4673] anon_vma_fork+0x1fc/0x610 [ 175.179305][ T4673] copy_mm+0xc14/0x1da0 [ 175.179332][ T4673] ? copy_signal+0x6a0/0x6a0 [ 175.179346][ T4673] ? _raw_spin_lock+0x92/0x120 [ 175.179362][ T4673] ? __asan_memset+0x39/0x50 [ 175.179375][ T4673] ? __init_rwsem+0x110/0x1f0 [ 175.179390][ T4673] ? copy_signal+0x4d5/0x6a0 [ 175.179412][ T4673] copy_process+0x12a4/0x3370 [ 175.179440][ T4673] ? __cfi_copy_process+0x10/0x10 [ 175.179467][ T4673] kernel_clone+0x233/0x810 [ 175.179485][ T4673] ? __cfi_kernel_clone+0x10/0x10 [ 175.179499][ T4673] ? do_futex+0x32a/0x510 [ 175.179511][ T4673] __x64_sys_clone+0x1b7/0x230 [ 175.179525][ T4673] ? __cfi___x64_sys_clone+0x10/0x10 [ 175.179542][ T4673] ? __kasan_check_write+0x18/0x20 [ 175.179568][ T4673] ? fpregs_restore_userregs+0x11c/0x260 [ 175.179594][ T4673] ? switch_fpu_return+0x12/0x20 [ 175.179618][ T4673] x64_sys_call+0x2b3c/0x2ee0 [ 175.179630][ T4673] do_syscall_64+0x57/0xf0 [ 175.179640][ T4673] ? clear_bhb_loop+0x50/0xa0 [ 175.179652][ T4673] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 175.179665][ T4673] RIP: 0033:0x7f82ca79f559 [ 175.179675][ T4673] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 175.179687][ T4673] RSP: 002b:00007f82cb63bfd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 175.179709][ T4673] RAX: ffffffffffffffda RBX: 00007f82caa25fa0 RCX: 00007f82ca79f559 [ 175.179725][ T4673] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 175.179738][ T4673] RBP: 00007f82ca836b50 R08: 0000000000000000 R09: 0000000000000000 [ 175.179752][ T4673] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 175.179764][ T4673] R13: 00007f82caa26038 R14: 00007f82caa25fa0 R15: 00007ffcb8e93618 [ 175.179774][ T4673] [ 175.666383][ T36] audit: type=1400 audit(1793449222.079:1083): avc: denied { mount } for pid=4683 comm="syz.3.1870" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 175.688050][ T36] audit: type=1400 audit(1793449222.079:1084): avc: denied { remount } for pid=4683 comm="syz.3.1870" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 175.711447][ T36] audit: type=1400 audit(1793449222.079:1085): avc: denied { mounton } for pid=4683 comm="syz.3.1870" path="/385/file0" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=dir permissive=1 [ 175.733639][ T36] audit: type=1400 audit(1793449222.099:1086): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 175.824880][ T3087] asix 3-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 175.835365][ T3087] asix 3-1:0.188 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x0080: ffffffb9 [ 175.862917][ T4689] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1872'. [ 175.873392][ T3087] asix 3-1:0.188: probe with driver asix failed with error -71 [ 175.881828][ T3087] usb 3-1: USB disconnect, device number 55 [ 175.998204][ T4674] incfs_lookup_dentry err:-107 [ 176.003064][ T4674] incfs: Can't find or create .index dir in ./file0 [ 176.009775][ T4674] incfs: mount failed -107 [ 176.103251][ T916] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 176.253273][ T916] usb 4-1: Using ep0 maxpacket: 32 [ 176.259452][ T916] usb 4-1: config 0 has an invalid interface number: 188 but max is 0 [ 176.267851][ T916] usb 4-1: config 0 has no interface number 0 [ 176.273961][ T916] usb 4-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 176.285291][ T916] usb 4-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 176.294369][ T916] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 176.302341][ T916] usb 4-1: Product: syz [ 176.306507][ T916] usb 4-1: Manufacturer: syz [ 176.311178][ T916] usb 4-1: SerialNumber: syz [ 176.316635][ T916] usb 4-1: config 0 descriptor?? [ 176.321859][ T4689] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 176.367897][ T36] audit: type=1400 audit(1793449222.779:1087): avc: denied { append } for pid=4694 comm="syz.2.1875" name="001" dev="devtmpfs" ino=95 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 176.530332][ T4689] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 176.637090][ T3091] asix 2-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 176.648602][ T3091] asix 2-1:0.188 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 176.659490][ T3091] asix 2-1:0.188: probe with driver asix failed with error -71 [ 176.672197][ T3091] usb 2-1: USB disconnect, device number 61 [ 176.885875][ T4707] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1878'. [ 176.908191][ T36] audit: type=1400 audit(1793449223.319:1088): avc: denied { load_policy } for pid=4708 comm="syz.0.1879" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 176.908212][ T4709] SELinux: policydb magic number 0xffffffff does not match expected magic number 0xf97cff8c [ 176.938869][ T4709] SELinux: failed to load policy [ 177.140383][ T4718] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1883'. [ 177.393251][ T348] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 177.442861][ T4741] tipc: Enabling of bearer rejected, already enabled [ 177.458396][ T4743] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1893'. [ 177.477346][ T36] audit: type=1400 audit(1793449223.889:1089): avc: denied { mounton } for pid=4744 comm="syz.2.1894" path="/460/dev" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=dir permissive=1 [ 177.501021][ T4745] EXT4-fs error (device sda1): ext4_validate_inode_bitmap:105: comm syz.2.1894: Corrupt inode bitmap - block_group = 0, inode_bitmap = 137 [ 177.516051][ T4745] EXT4-fs error (device sda1): ext4_validate_inode_bitmap:105: comm syz.2.1894: Corrupt inode bitmap - block_group = 1, inode_bitmap = 138 [ 177.532392][ T36] audit: type=1400 audit(1793449223.939:1090): avc: denied { mounton } for pid=4744 comm="syz.2.1894" path="/460/dev/dev" dev="sda1" ino=2043 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=chr_file permissive=1 [ 177.532755][ T4749] ./dev/sda1: Can't lookup blockdev [ 177.555420][ T348] usb 1-1: Using ep0 maxpacket: 32 [ 177.566787][ T348] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 177.575013][ T348] usb 1-1: config 0 has no interface number 0 [ 177.581101][ T348] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 177.592671][ T348] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 177.601907][ T348] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 177.610013][ T348] usb 1-1: Product: syz [ 177.614304][ T348] usb 1-1: Manufacturer: syz [ 177.618910][ T348] usb 1-1: SerialNumber: syz [ 177.624513][ T348] usb 1-1: config 0 descriptor?? [ 177.629785][ T4718] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 177.703241][ T3092] usb 2-1: new high-speed USB device number 62 using dummy_hcd [ 177.713585][ T4758] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1898'. [ 177.837726][ T4718] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 177.853252][ T3092] usb 2-1: Using ep0 maxpacket: 32 [ 177.863037][ T3092] usb 2-1: config 0 has an invalid interface number: 188 but max is 0 [ 177.871402][ T3092] usb 2-1: config 0 has no interface number 0 [ 177.877717][ T3092] usb 2-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 177.889747][ T3092] usb 2-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 177.898871][ T3092] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 177.906880][ T3092] usb 2-1: Product: syz [ 177.911093][ T3092] usb 2-1: Manufacturer: syz [ 177.915701][ T3092] usb 2-1: SerialNumber: syz [ 177.920945][ T3092] usb 2-1: config 0 descriptor?? [ 177.926252][ T4743] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 177.934399][ T36] audit: type=1400 audit(1793449224.349:1091): avc: denied { map } for pid=4765 comm="syz.2.1901" path="pipe:[42692]" dev="pipefs" ino=42692 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 177.962475][ T916] asix 4-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 177.972941][ T916] asix 4-1:0.188: probe with driver asix failed with error -71 [ 177.981676][ T916] usb 4-1: USB disconnect, device number 56 [ 178.157791][ T4743] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 178.486694][ T36] audit: type=1400 audit(1793449224.899:1092): avc: denied { create } for pid=4772 comm="syz.3.1903" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 178.528925][ T4779] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1906'. [ 178.534279][ T4781] netlink: 108 bytes leftover after parsing attributes in process `syz.2.1907'. [ 178.729810][ T4792] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1911'. [ 178.783271][ T3091] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 178.933223][ T3091] usb 4-1: Using ep0 maxpacket: 32 [ 178.939395][ T3091] usb 4-1: config 0 has an invalid interface number: 188 but max is 0 [ 178.947642][ T3091] usb 4-1: config 0 has no interface number 0 [ 178.953754][ T3091] usb 4-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 178.965181][ T3091] usb 4-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 178.974272][ T3091] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 178.982300][ T916] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 178.990010][ T3091] usb 4-1: Product: syz [ 178.994225][ T3091] usb 4-1: Manufacturer: syz [ 178.998988][ T3091] usb 4-1: SerialNumber: syz [ 179.004417][ T3091] usb 4-1: config 0 descriptor?? [ 179.009696][ T4779] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 179.047969][ T348] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 179.058214][ T348] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x0080: ffffffb9 [ 179.083301][ T348] asix 1-1:0.188: probe with driver asix failed with error -71 [ 179.092093][ T348] usb 1-1: USB disconnect, device number 50 [ 179.143258][ T916] usb 3-1: Using ep0 maxpacket: 32 [ 179.149500][ T916] usb 3-1: config 0 has an invalid interface number: 188 but max is 0 [ 179.157895][ T916] usb 3-1: config 0 has no interface number 0 [ 179.164117][ T916] usb 3-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 179.175437][ T916] usb 3-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 179.184566][ T916] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 179.192550][ T916] usb 3-1: Product: syz [ 179.196751][ T916] usb 3-1: Manufacturer: syz [ 179.201365][ T916] usb 3-1: SerialNumber: syz [ 179.206587][ T916] usb 3-1: config 0 descriptor?? [ 179.211847][ T4792] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 179.219525][ T4779] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 179.419667][ T4792] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 179.786437][ T3092] asix 2-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 179.796994][ T3092] asix 2-1:0.188 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 179.807490][ T3092] asix 2-1:0.188: probe with driver asix failed with error -71 [ 179.816082][ T3092] usb 2-1: USB disconnect, device number 62 [ 180.328432][ T4807] serio: Serial port ptm0 [ 180.429609][ T3091] asix 4-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 180.440870][ T3091] asix 4-1:0.188 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x0080: ffffffb9 [ 180.482167][ T4807] serio: Serial port ptm0 [ 180.486736][ T3091] asix 4-1:0.188: probe with driver asix failed with error -71 [ 180.497135][ T3091] usb 4-1: USB disconnect, device number 57 [ 180.582608][ T4817] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1921'. [ 180.673961][ T36] kauditd_printk_skb: 1 callbacks suppressed [ 180.673978][ T36] audit: type=1400 audit(1793449227.089:1094): avc: denied { ioctl } for pid=4821 comm="syz.1.1923" path="user:[4026531837]" dev="nsfs" ino=4026531837 ioctlcmd=0x660c scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 180.681865][ T4822] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1923'. [ 180.740841][ C1] sd 0:0:1:0: [sda] tag#7429 UNKNOWN(0x2003) Result: hostbyte=0x07 driverbyte=DRIVER_OK cmd_age=0s [ 180.751563][ C1] sd 0:0:1:0: [sda] tag#7429 CDB: opcode=0xa 0a 00 00 00 0b 00 00 00 00 00 00 00 [ 180.769828][ T4828] capability: warning: `syz.1.1926' uses 32-bit capabilities (legacy support in use) [ 180.788556][ T4830] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1927'. [ 180.797572][ T4831] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1927'. [ 180.810184][ T4831] FAULT_INJECTION: forcing a failure. [ 180.810184][ T4831] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 180.823327][ T4831] CPU: 0 UID: 0 PID: 4831 Comm: syz.1.1927 Not tainted syzkaller #0 86ffabe033aa4b611dc1eaf9ec72dc67ec78bb97 [ 180.823355][ T4831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 180.823368][ T4831] Call Trace: [ 180.823375][ T4831] [ 180.823383][ T4831] __dump_stack+0x21/0x30 [ 180.823421][ T4831] dump_stack_lvl+0x140/0x1c0 [ 180.823437][ T4831] ? __cfi_dump_stack_lvl+0x10/0x10 [ 180.823456][ T4831] dump_stack+0x19/0x20 [ 180.823472][ T4831] should_fail_ex+0x3c2/0x510 [ 180.823498][ T4831] should_fail+0xf/0x20 [ 180.823521][ T4831] should_fail_usercopy+0x1e/0x30 [ 180.823547][ T4831] strncpy_from_user+0x29/0x280 [ 180.823573][ T4831] getname_flags+0x106/0x6b0 [ 180.823600][ T4831] ? __cfi_make_kuid+0x10/0x10 [ 180.823628][ T4831] user_path_at+0x2b/0x60 [ 180.823646][ T4831] do_faccessat+0x58c/0xd00 [ 180.823670][ T4831] ? fsnotify_parent+0x220/0x220 [ 180.823693][ T4831] ? __kasan_check_write+0x18/0x20 [ 180.823719][ T4831] ? fpregs_restore_userregs+0x11c/0x260 [ 180.823745][ T4831] __x64_sys_faccessat2+0x9e/0xb0 [ 180.823764][ T4831] x64_sys_call+0x2854/0x2ee0 [ 180.823783][ T4831] do_syscall_64+0x57/0xf0 [ 180.823801][ T4831] ? clear_bhb_loop+0x50/0xa0 [ 180.823825][ T4831] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 180.823848][ T4831] RIP: 0033:0x7f902539f559 [ 180.823869][ T4831] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 180.823885][ T4831] RSP: 002b:00007f90261a7028 EFLAGS: 00000246 ORIG_RAX: 00000000000001b7 [ 180.823910][ T4831] RAX: ffffffffffffffda RBX: 00007f9025626090 RCX: 00007f902539f559 [ 180.823925][ T4831] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffffffffffff [ 180.823939][ T4831] RBP: 00007f9025436b50 R08: 0000000000000000 R09: 0000000000000000 [ 180.823952][ T4831] R10: 0000000000001100 R11: 0000000000000246 R12: 0000000000000000 [ 180.823966][ T4831] R13: 00007f9025626128 R14: 00007f9025626090 R15: 00007fffb73c9918 [ 180.823984][ T4831] [ 180.824807][ T4831] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1539 sclass=netlink_route_socket pid=4831 comm=syz.1.1927 [ 180.824883][ T4830] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1539 sclass=netlink_route_socket pid=4830 comm=syz.1.1927 [ 180.836443][ T9] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 181.056370][ T916] asix 3-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 181.066576][ T916] asix 3-1:0.188: probe with driver asix failed with error -71 [ 181.075246][ T916] usb 3-1: USB disconnect, device number 56 [ 181.161379][ T36] audit: type=1400 audit(1793449227.569:1095): avc: denied { mounton } for pid=4838 comm="syz.3.1930" path="/file0" dev="tmpfs" ino=1189 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 181.161804][ T4839] overlay: ./file0 is not a directory [ 181.210292][ T36] audit: type=1400 audit(1793449227.619:1096): avc: denied { ioctl } for pid=4842 comm="syz.3.1932" path="socket:[43996]" dev="sockfs" ino=43996 ioctlcmd=0x7453 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 181.223303][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 181.241276][ T9] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 181.249518][ T9] usb 1-1: config 0 has no interface number 0 [ 181.255717][ T9] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 181.267327][ T9] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 181.276408][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 181.284416][ T9] usb 1-1: Product: syz [ 181.288567][ T9] usb 1-1: Manufacturer: syz [ 181.293169][ T9] usb 1-1: SerialNumber: syz [ 181.298240][ T9] usb 1-1: config 0 descriptor?? [ 181.303492][ T4817] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 181.371945][ C1] sd 0:0:1:0: [sda] tag#7430 UNKNOWN(0x2003) Result: hostbyte=0x07 driverbyte=DRIVER_OK cmd_age=0s [ 181.382711][ C1] sd 0:0:1:0: [sda] tag#7430 CDB: opcode=0xa 0a 00 00 00 0b 00 00 00 00 00 00 00 [ 181.417975][ T4853] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1937'. [ 181.511176][ T4817] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 181.542980][ T4858] netlink: 'syz.1.1939': attribute type 46 has an invalid length. [ 181.599133][ T4866] netlink: 'syz.1.1940': attribute type 27 has an invalid length. [ 181.613804][ T4866] bridge0: port 2(bridge_slave_1) entered disabled state [ 181.621017][ T4866] bridge0: port 1(bridge_slave_0) entered disabled state [ 181.663246][ T916] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 181.737909][ T4872] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1943'. [ 181.821301][ T4876] netlink: 288 bytes leftover after parsing attributes in process `syz.1.1945'. [ 181.830436][ T916] usb 3-1: Using ep0 maxpacket: 32 [ 181.838742][ T916] usb 3-1: config 0 has an invalid interface number: 188 but max is 0 [ 181.847019][ T916] usb 3-1: config 0 has no interface number 0 [ 181.853167][ T916] usb 3-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 181.865284][ T916] usb 3-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 181.874391][ T916] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 181.882408][ T916] usb 3-1: Product: syz [ 181.886646][ T916] usb 3-1: Manufacturer: syz [ 181.891246][ T916] usb 3-1: SerialNumber: syz [ 181.896393][ T916] usb 3-1: config 0 descriptor?? [ 181.901622][ T4853] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 182.109533][ T4853] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 182.420869][ T4887] fuse: Bad value for 'fd' [ 182.426053][ T36] audit: type=1400 audit(1793449228.839:1097): avc: denied { execute } for pid=4886 comm="syz.3.1949" name="file0" dev="tmpfs" ino=2148 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 182.721441][ T9] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 182.732102][ T9] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x0080: ffffffb9 [ 182.760340][ T36] audit: type=1400 audit(1793449229.169:1098): avc: denied { ioctl } for pid=4898 comm="syz.1.1950" path="/572/file0" dev="tmpfs" ino=3040 ioctlcmd=0x1268 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 182.784671][ T36] audit: type=1400 audit(1793449229.169:1099): avc: denied { mounton } for pid=4898 comm="syz.1.1950" path="/572/file0" dev="tmpfs" ino=3040 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 182.784693][ T9] asix 1-1:0.188: probe with driver asix failed with error -71 [ 182.818528][ T9] usb 1-1: USB disconnect, device number 51 [ 183.323602][ T916] asix 3-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 183.333848][ T916] asix 3-1:0.188 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x0080: ffffffb9 [ 183.363266][ T916] asix 3-1:0.188: probe with driver asix failed with error -71 [ 183.372374][ T916] usb 3-1: USB disconnect, device number 57 [ 183.543283][ T348] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 183.612453][ T4945] __nla_validate_parse: 4 callbacks suppressed [ 183.612465][ T4945] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1970'. [ 183.627631][ T4945] FAULT_INJECTION: forcing a failure. [ 183.627631][ T4945] name failslab, interval 1, probability 0, space 0, times 0 [ 183.640345][ T4945] CPU: 0 UID: 0 PID: 4945 Comm: syz.1.1970 Not tainted syzkaller #0 86ffabe033aa4b611dc1eaf9ec72dc67ec78bb97 [ 183.640372][ T4945] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 183.640384][ T4945] Call Trace: [ 183.640389][ T4945] [ 183.640395][ T4945] __dump_stack+0x21/0x30 [ 183.640417][ T4945] dump_stack_lvl+0x140/0x1c0 [ 183.640433][ T4945] ? __cfi_dump_stack_lvl+0x10/0x10 [ 183.640450][ T4945] ? kasan_save_alloc_info+0x3a/0x50 [ 183.640477][ T4945] dump_stack+0x19/0x20 [ 183.640494][ T4945] should_fail_ex+0x3c2/0x510 [ 183.640522][ T4945] should_failslab+0xac/0x100 [ 183.640540][ T4945] __kmalloc_node_noprof+0x69/0x500 [ 183.640565][ T4945] ? down_read+0x7f/0xe0 [ 183.640586][ T4945] ? crypto_create_tfm_node+0xa0/0x4d0 [ 183.640611][ T4945] ? crypto_alg_extsize+0x1f/0x90 [ 183.640631][ T4945] crypto_create_tfm_node+0xa0/0x4d0 [ 183.640655][ T4945] ? up_read+0x26/0x1c0 [ 183.640676][ T4945] crypto_spawn_tfm2+0x60/0x90 [ 183.640698][ T4945] crypto_authenc_esn_init_tfm+0x6e/0x290 [ 183.640718][ T4945] ? __cfi_crypto_authenc_esn_init_tfm+0x10/0x10 [ 183.640739][ T4945] crypto_aead_init_tfm+0x121/0x1a0 [ 183.640763][ T4945] crypto_create_tfm_node+0x199/0x4d0 [ 183.640787][ T4945] crypto_alloc_tfm_node+0x166/0x350 [ 183.640811][ T4945] crypto_alloc_aead+0x34/0x40 [ 183.640833][ T4945] esp_init_state+0x621/0x1280 [ 183.640854][ T4945] ? x64_sys_call+0x2a4c/0x2ee0 [ 183.640873][ T4945] ? do_syscall_64+0x57/0xf0 [ 183.640890][ T4945] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 183.640914][ T4945] ? __cfi_esp_init_state+0x10/0x10 [ 183.640938][ T4945] ? kasan_save_alloc_info+0x3a/0x50 [ 183.640961][ T4945] ? __xfrm_init_state+0x56a/0xf70 [ 183.640986][ T4945] ? __asan_memcpy+0x5a/0x80 [ 183.641010][ T4945] __xfrm_init_state+0xaf6/0xf70 [ 183.641036][ T4945] xfrm_add_sa+0x2560/0x37b0 [ 183.641059][ T4945] ? __cfi_xfrm_add_sa+0x10/0x10 [ 183.641083][ T4945] xfrm_user_rcv_msg+0x696/0x900 [ 183.641106][ T4945] ? __cfi_xfrm_user_rcv_msg+0x10/0x10 [ 183.641133][ T4945] ? __asan_memcpy+0x5a/0x80 [ 183.641159][ T4945] ? avc_has_perm_noaudit+0x289/0x360 [ 183.641181][ T4945] ? avc_has_perm+0x155/0x240 [ 183.641202][ T4945] netlink_rcv_skb+0x24d/0x4e0 [ 183.641225][ T4945] ? __cfi_xfrm_user_rcv_msg+0x10/0x10 [ 183.641251][ T4945] ? __cfi_netlink_rcv_skb+0x10/0x10 [ 183.641282][ T4945] ? __kasan_check_write+0x18/0x20 [ 183.641306][ T4945] ? mutex_lock+0x97/0x1d0 [ 183.641325][ T4945] ? __cfi_mutex_lock+0x10/0x10 [ 183.641345][ T4945] ? netlink_autobind+0x1c0/0x1c0 [ 183.641368][ T4945] xfrm_netlink_rcv+0x76/0x90 [ 183.641391][ T4945] netlink_unicast+0x8bc/0xa70 [ 183.641413][ T4945] netlink_sendmsg+0x7d1/0xad0 [ 183.641435][ T4945] ? __cfi_netlink_sendmsg+0x10/0x10 [ 183.641458][ T4945] ? bpf_lsm_socket_sendmsg+0xd/0x20 [ 183.641483][ T4945] ? security_socket_sendmsg+0x3d/0x100 [ 183.641505][ T4945] ____sys_sendmsg+0x9a1/0xa00 [ 183.641527][ T4945] ? __import_iovec+0x5b9/0x7d0 [ 183.641547][ T4945] ? __sys_sendmsg_sock+0x50/0x50 [ 183.641569][ T4945] ? import_iovec+0x80/0xb0 [ 183.641588][ T4945] ___sys_sendmsg+0x2a6/0x370 [ 183.641610][ T4945] ? __sys_sendmsg+0x260/0x260 [ 183.641632][ T4945] ? proc_fail_nth_write+0x184/0x220 [ 183.641654][ T4945] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 183.641678][ T4945] ? __fget_files+0x2bc/0x330 [ 183.641697][ T4945] __x64_sys_sendmsg+0x1be/0x2a0 [ 183.641718][ T4945] ? fput+0x1a4/0x230 [ 183.641737][ T4945] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 183.641758][ T4945] ? ksys_write+0x1f3/0x260 [ 183.641783][ T4945] ? __kasan_check_read+0x15/0x20 [ 183.641806][ T4945] x64_sys_call+0x2a4c/0x2ee0 [ 183.641826][ T4945] do_syscall_64+0x57/0xf0 [ 183.641841][ T4945] ? clear_bhb_loop+0x50/0xa0 [ 183.641862][ T4945] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 183.641883][ T4945] RIP: 0033:0x7f902539f559 [ 183.641900][ T4945] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 183.641916][ T4945] RSP: 002b:00007f90261c8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 183.641936][ T4945] RAX: ffffffffffffffda RBX: 00007f9025625fa0 RCX: 00007f902539f559 [ 183.641950][ T4945] RDX: 0000000000040080 RSI: 0000200000001980 RDI: 0000000000000003 [ 183.641963][ T4945] RBP: 00007f90261c8090 R08: 0000000000000000 R09: 0000000000000000 [ 183.641975][ T4945] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 183.641987][ T4945] R13: 00007f9025626038 R14: 00007f9025625fa0 R15: 00007fffb73c9918 [ 183.642003][ T4945] [ 183.693218][ T348] usb 1-1: Using ep0 maxpacket: 32 [ 183.874618][ T4947] FAULT_INJECTION: forcing a failure. [ 183.874618][ T4947] name failslab, interval 1, probability 0, space 0, times 0 [ 183.883554][ T348] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 183.890777][ T4947] CPU: 0 UID: 0 PID: 4947 Comm: syz.1.1971 Not tainted syzkaller #0 86ffabe033aa4b611dc1eaf9ec72dc67ec78bb97 [ 183.890813][ T4947] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 183.890826][ T4947] Call Trace: [ 183.890833][ T4947] [ 183.890840][ T4947] __dump_stack+0x21/0x30 [ 183.890863][ T4947] dump_stack_lvl+0x140/0x1c0 [ 183.890879][ T4947] ? __cfi_dump_stack_lvl+0x10/0x10 [ 183.890898][ T4947] dump_stack+0x19/0x20 [ 183.890914][ T4947] should_fail_ex+0x3c2/0x510 [ 183.890939][ T4947] should_failslab+0xac/0x100 [ 183.890958][ T4947] kmem_cache_alloc_noprof+0x42/0x410 [ 183.890982][ T4947] ? __kvm_mmu_topup_memory_cache+0x1dd/0x7e0 [ 183.891002][ T4947] __kvm_mmu_topup_memory_cache+0x1dd/0x7e0 [ 183.891021][ T4947] ? mutex_unlock+0x90/0x240 [ 183.891044][ T4947] kvm_mmu_topup_memory_cache+0x24/0x30 [ 183.891062][ T4947] kvm_mmu_load+0xa1/0x2900 [ 183.891086][ T4947] ? kvm_hv_setup_tsc_page+0x5f6/0xa80 [ 183.891112][ T4947] ? vmx_flush_tlb_guest+0x1d3/0x3b0 [ 183.891136][ T4947] ? kvm_apic_has_interrupt+0x77a/0x790 [ 183.891162][ T4947] ? kvm_vcpu_flush_tlb_guest+0xfe/0x220 [ 183.891182][ T4947] vcpu_run+0x4d56/0x7810 [ 183.891207][ T4947] ? kvm_sched_clock_read+0x15/0x30 [ 183.891238][ T4947] ? signal_pending+0xc0/0xc0 [ 183.891261][ T4947] ? __kasan_check_write+0x18/0x20 [ 183.891285][ T4947] ? xfd_validate_state+0x68/0x140 [ 183.891310][ T4947] ? fpu_swap_kvm_fpstate+0x92/0x5e0 [ 183.891332][ T4947] ? __kasan_check_write+0x18/0x20 [ 183.891355][ T4947] ? fpregs_mark_activate+0x68/0x160 [ 183.891378][ T4947] ? fpu_swap_kvm_fpstate+0x44c/0x5e0 [ 183.891400][ T4947] ? fpu_swap_kvm_fpstate+0x92/0x5e0 [ 183.891423][ T4947] kvm_arch_vcpu_ioctl_run+0x114c/0x1bc0 [ 183.891448][ T4947] ? _parse_integer_limit+0x195/0x1e0 [ 183.891473][ T4947] ? __cfi_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 183.891498][ T4947] ? kstrtoull+0x13b/0x1e0 [ 183.891520][ T4947] ? kstrtouint+0x78/0xf0 [ 183.891542][ T4947] ? ioctl_has_perm+0x1bc/0x500 [ 183.891567][ T4947] ? __asan_memcpy+0x5a/0x80 [ 183.891590][ T4947] ? ioctl_has_perm+0x408/0x500 [ 183.891614][ T4947] ? has_cap_mac_admin+0xd0/0xd0 [ 183.891638][ T4947] ? __kasan_check_write+0x18/0x20 [ 183.891661][ T4947] ? mutex_lock_killable+0x97/0x1d0 [ 183.891683][ T4947] ? __cfi_mutex_lock_killable+0x10/0x10 [ 183.891703][ T4947] ? proc_fail_nth_write+0x184/0x220 [ 183.891726][ T4947] kvm_vcpu_ioctl+0xa43/0x1000 [ 183.891747][ T4947] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 183.891767][ T4947] ? __cfi_vfs_write+0x10/0x10 [ 183.891791][ T4947] ? __kasan_check_write+0x18/0x20 [ 183.891822][ T4947] ? mutex_unlock+0x90/0x240 [ 183.891841][ T4947] ? __cfi_mutex_unlock+0x10/0x10 [ 183.891863][ T4947] ? __fget_files+0x2bc/0x330 [ 183.891882][ T4947] ? bpf_lsm_file_ioctl+0xd/0x20 [ 183.891901][ T4947] ? security_file_ioctl+0x3e/0x110 [ 183.891926][ T4947] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 183.891945][ T4947] __se_sys_ioctl+0x126/0x1b0 [ 183.891964][ T4947] __x64_sys_ioctl+0x7f/0xa0 [ 183.891982][ T4947] x64_sys_call+0x1878/0x2ee0 [ 183.892000][ T4947] do_syscall_64+0x57/0xf0 [ 183.892017][ T4947] ? clear_bhb_loop+0x50/0xa0 [ 183.892039][ T4947] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 183.892060][ T4947] RIP: 0033:0x7f902539f559 [ 183.892076][ T4947] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 183.892092][ T4947] RSP: 002b:00007f90261c8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 183.892112][ T4947] RAX: ffffffffffffffda RBX: 00007f9025625fa0 RCX: 00007f902539f559 [ 183.892126][ T4947] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000007 [ 183.892139][ T4947] RBP: 00007f90261c8090 R08: 0000000000000000 R09: 0000000000000000 [ 183.892151][ T4947] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 183.892164][ T4947] R13: 00007f9025626038 R14: 00007f9025625fa0 R15: 00007fffb73c9918 [ 183.892179][ T4947] [ 183.908867][ T4951] process 'syz.2.1972' launched './file1' with NULL argv: empty string added [ 183.910623][ T348] usb 1-1: config 0 has no interface number 0 [ 183.924721][ T36] audit: type=1400 audit(1793449230.329:1100): avc: denied { execute_no_trans } for pid=4950 comm="syz.2.1972" path="/479/file1" dev="tmpfs" ino=2539 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 183.925839][ T348] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 184.006461][ T4956] overlayfs: failed to clone upperpath [ 184.009954][ T348] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 184.163225][ T916] usb 3-1: new full-speed USB device number 58 using dummy_hcd [ 184.165728][ T348] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 184.303252][ T916] usb 3-1: device descriptor read/64, error -71 [ 184.304523][ T348] usb 1-1: Product: syz [ 184.328736][ T9] kernel write not supported for file [eventfd] (pid: 9 comm: kworker/0:0) [ 184.330793][ T348] usb 1-1: Manufacturer: syz [ 184.470585][ T4972] netlink: 140 bytes leftover after parsing attributes in process `syz.3.1980'. [ 184.474583][ T348] usb 1-1: SerialNumber: syz [ 184.553242][ T916] usb 3-1: device descriptor read/64, error -71 [ 184.556996][ T348] usb 1-1: config 0 descriptor?? [ 184.612342][ T4917] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 184.693250][ T3092] usb 2-1: new high-speed USB device number 63 using dummy_hcd [ 184.803264][ T916] usb 3-1: new full-speed USB device number 59 using dummy_hcd [ 184.820210][ T4917] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 184.843232][ T3092] usb 2-1: Using ep0 maxpacket: 32 [ 184.916695][ T4970] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1979'. [ 184.943249][ T916] usb 3-1: device descriptor read/64, error -71 [ 185.143689][ T4977] overlayfs: failed to clone upperpath [ 185.183235][ T916] usb 3-1: device descriptor read/64, error -71 [ 185.293327][ T916] usb usb3-port1: attempt power cycle [ 185.438000][ T3092] usb 2-1: unable to get BOS descriptor or descriptor too short [ 185.446927][ T3092] usb 2-1: no configurations [ 185.451684][ T3092] usb 2-1: can't read configurations, error -22 [ 185.633240][ T916] usb 3-1: new full-speed USB device number 60 using dummy_hcd [ 185.664233][ T916] usb 3-1: device descriptor read/8, error -71 [ 185.794261][ T916] usb 3-1: device descriptor read/8, error -71 [ 185.943787][ T4992] incfs: Options parsing error. -22 [ 185.949119][ T4992] incfs: mount failed -22 [ 186.043272][ T916] usb 3-1: new full-speed USB device number 61 using dummy_hcd [ 186.064332][ T916] usb 3-1: device descriptor read/8, error -71 [ 186.204331][ T916] usb 3-1: device descriptor read/8, error -71 [ 186.232034][ T348] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 186.244976][ T348] asix 1-1:0.188: probe with driver asix failed with error -71 [ 186.259122][ T348] usb 1-1: USB disconnect, device number 52 [ 186.313437][ T916] usb usb3-port1: unable to enumerate USB device [ 186.502370][ T36] audit: type=1400 audit(1793449232.909:1101): avc: denied { sqpoll } for pid=5003 comm="syz.3.1993" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 186.521634][ T36] audit: type=1400 audit(1793449232.909:1102): avc: denied { execute } for pid=5003 comm="syz.3.1993" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=45611 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 186.539927][ T5009] capability: warning: `syz.3.1995' uses deprecated v2 capabilities in a way that may be insecure [ 186.683227][ T3092] usb 2-1: new high-speed USB device number 65 using dummy_hcd [ 186.833219][ T3092] usb 2-1: Using ep0 maxpacket: 32 [ 186.914218][ T5024] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2000'. [ 187.313254][ T916] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 187.483274][ T916] usb 3-1: Using ep0 maxpacket: 32 [ 187.492840][ T916] usb 3-1: config 0 has an invalid interface number: 188 but max is 0 [ 187.505574][ T916] usb 3-1: config 0 has no interface number 0 [ 187.511686][ T916] usb 3-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 187.543442][ T3092] usb 2-1: unable to get BOS descriptor or descriptor too short [ 187.551134][ T3092] usb 2-1: no configurations [ 187.555819][ T3092] usb 2-1: can't read configurations, error -22 [ 187.562988][ T916] usb 3-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 187.578481][ T916] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 187.593207][ T916] usb 3-1: Product: syz [ 187.597382][ T916] usb 3-1: Manufacturer: syz [ 187.601974][ T916] usb 3-1: SerialNumber: syz [ 187.630298][ T916] usb 3-1: config 0 descriptor?? [ 187.643543][ T5024] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 187.693941][ T5034] futex_wake_op: syz.3.2001 tries to shift op by 144; fix this program [ 187.702415][ T5034] futex_wake_op: syz.3.2001 tries to shift op by 144; fix this program [ 187.837388][ T5041] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2007'. [ 187.854588][ T5024] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 187.993254][ T3092] usb 2-1: new high-speed USB device number 66 using dummy_hcd [ 188.083228][ T9] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 188.143221][ T3092] usb 2-1: Using ep0 maxpacket: 8 [ 188.149280][ T3092] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 188.159470][ T3092] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 188.168419][ T3092] usb 2-1: config 1 has no interface number 0 [ 188.174509][ T3092] usb 2-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 188.184877][ T3092] usb 2-1: New USB device found, idVendor=0582, idProduct=00a3, bcdDevice= 0.40 [ 188.193942][ T3092] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 188.201920][ T3092] usb 2-1: Product: syz [ 188.206109][ T3092] usb 2-1: Manufacturer: syz [ 188.210706][ T3092] usb 2-1: SerialNumber: syz [ 188.224264][ T3718] udevd[3718]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.1/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 188.243236][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 188.249506][ T9] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 188.259257][ T9] usb 1-1: config 0 has no interface number 0 [ 188.266281][ T9] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 188.277945][ T9] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 188.297614][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 188.313222][ T9] usb 1-1: Product: syz [ 188.317458][ T9] usb 1-1: Manufacturer: syz [ 188.322432][ T9] usb 1-1: SerialNumber: syz [ 188.331328][ T9] usb 1-1: config 0 descriptor?? [ 188.337024][ T5041] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 188.350312][ T5056] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2010'. [ 188.417831][ T348] usb 2-1: USB disconnect, device number 66 [ 188.545473][ T5041] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 188.888818][ T36] audit: type=1400 audit(1793449235.299:1103): avc: denied { getopt } for pid=5061 comm="syz.3.2013" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 189.079823][ T916] asix 3-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 189.090068][ T916] asix 3-1:0.188 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x0080: ffffffb9 [ 189.109527][ T5078] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2019'. [ 189.113265][ T916] asix 3-1:0.188: probe with driver asix failed with error -71 [ 189.130315][ T916] usb 3-1: USB disconnect, device number 62 [ 189.353236][ T3087] usb 2-1: new high-speed USB device number 67 using dummy_hcd [ 189.503228][ T3087] usb 2-1: Using ep0 maxpacket: 32 [ 189.509438][ T3087] usb 2-1: config 0 has an invalid interface number: 188 but max is 0 [ 189.517647][ T3087] usb 2-1: config 0 has no interface number 0 [ 189.523750][ T3087] usb 2-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 189.535134][ T3087] usb 2-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 189.544182][ T3087] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 189.552154][ T3087] usb 2-1: Product: syz [ 189.556330][ T3087] usb 2-1: Manufacturer: syz [ 189.560924][ T3087] usb 2-1: SerialNumber: syz [ 189.566176][ T3087] usb 2-1: config 0 descriptor?? [ 189.571437][ T5078] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 189.724149][ T5084] tipc: Enabling of bearer rejected, already enabled [ 189.743595][ T5086] rust_binder: Write failure EINVAL in pid:1122 [ 189.779702][ T5078] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 189.809448][ T5092] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2025'. [ 189.963095][ T9] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 189.974572][ T9] asix 1-1:0.188: probe with driver asix failed with error -71 [ 189.984115][ T9] usb 1-1: USB disconnect, device number 53 [ 190.039757][ T5113] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2029'. [ 190.477291][ T36] audit: type=1400 audit(1793449236.889:1104): avc: denied { lock } for pid=5114 comm="syz.0.2030" path="socket:[46020]" dev="sockfs" ino=46020 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 190.511212][ T36] audit: type=1400 audit(1793449236.899:1105): avc: denied { lock } for pid=5114 comm="syz.0.2030" path="/dev/binderfs/binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 190.603446][ T3087] asix 2-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 190.617018][ T3087] asix 2-1:0.188 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffc3 [ 190.629122][ T3087] asix 2-1:0.188: probe with driver asix failed with error -61 [ 190.634519][ T5128] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2031'. [ 190.740183][ T5144] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2041'. [ 190.805655][ T916] usb 2-1: USB disconnect, device number 67 [ 190.942807][ T36] audit: type=1400 audit(1793449237.349:1106): avc: denied { listen } for pid=5147 comm="syz.0.2043" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 191.023232][ T9] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 191.183233][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 191.189482][ T9] usb 3-1: config 0 has an invalid interface number: 188 but max is 0 [ 191.200288][ T9] usb 3-1: config 0 has no interface number 0 [ 191.206421][ T9] usb 3-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 191.217663][ T9] usb 3-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 191.226742][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 191.234750][ T9] usb 3-1: Product: syz [ 191.238914][ T9] usb 3-1: Manufacturer: syz [ 191.243554][ T9] usb 3-1: SerialNumber: syz [ 191.251734][ T9] usb 3-1: config 0 descriptor?? [ 191.257051][ T5144] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 191.302754][ T5164] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2050'. [ 191.344256][ T5172] futex_wake_op: syz.3.2054 tries to shift op by 144; fix this program [ 191.352612][ T5172] futex_wake_op: syz.3.2054 tries to shift op by 144; fix this program [ 191.465711][ T5144] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 191.645987][ T5191] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2061'. [ 191.893252][ T3087] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 192.043304][ T3087] usb 1-1: Using ep0 maxpacket: 32 [ 192.049489][ T3087] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 192.057876][ T3087] usb 1-1: config 0 has no interface number 0 [ 192.064105][ T3087] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 192.075526][ T3087] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 192.084820][ T3087] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 192.090070][ T5193] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2062'. [ 192.092965][ T3087] usb 1-1: Product: syz [ 192.106175][ T3087] usb 1-1: Manufacturer: syz [ 192.110967][ T3087] usb 1-1: SerialNumber: syz [ 192.116515][ T3087] usb 1-1: config 0 descriptor?? [ 192.123236][ T5191] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 192.187123][ T5201] FAULT_INJECTION: forcing a failure. [ 192.187123][ T5201] name failslab, interval 1, probability 0, space 0, times 0 [ 192.199796][ T5201] CPU: 0 UID: 0 PID: 5201 Comm: syz.1.2066 Not tainted syzkaller #0 86ffabe033aa4b611dc1eaf9ec72dc67ec78bb97 [ 192.199825][ T5201] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 192.199839][ T5201] Call Trace: [ 192.199845][ T5201] [ 192.199853][ T5201] __dump_stack+0x21/0x30 [ 192.199876][ T5201] dump_stack_lvl+0x140/0x1c0 [ 192.199894][ T5201] ? __cfi_dump_stack_lvl+0x10/0x10 [ 192.199914][ T5201] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 192.199940][ T5201] ? __cfi__raw_spin_lock_irqsave+0x10/0x10 [ 192.199969][ T5201] dump_stack+0x19/0x20 [ 192.199985][ T5201] should_fail_ex+0x3c2/0x510 [ 192.200012][ T5201] should_failslab+0xac/0x100 [ 192.200031][ T5201] kmem_cache_alloc_lru_noprof+0x44/0x410 [ 192.200058][ T5201] ? __sock_create+0x3a2/0x810 [ 192.200073][ T5201] ? __sys_socket+0xe1/0x1c0 [ 192.200089][ T5201] ? __d_alloc+0x42/0x8c0 [ 192.200112][ T5201] ? expand_files+0xda/0x6f0 [ 192.200131][ T5201] __d_alloc+0x42/0x8c0 [ 192.200153][ T5201] d_alloc_pseudo+0x23/0xc0 [ 192.200176][ T5201] alloc_file_pseudo+0xde/0x1f0 [ 192.200198][ T5201] ? __cfi_alloc_file_pseudo+0x10/0x10 [ 192.200218][ T5201] ? _raw_spin_unlock+0x45/0x60 [ 192.200234][ T5201] sock_alloc_file+0xbe/0x2b0 [ 192.200256][ T5201] __sys_socket+0x14c/0x1c0 [ 192.200275][ T5201] __x64_sys_socket+0x7e/0x90 [ 192.200293][ T5201] x64_sys_call+0x2608/0x2ee0 [ 192.200312][ T5201] do_syscall_64+0x57/0xf0 [ 192.200330][ T5201] ? clear_bhb_loop+0x50/0xa0 [ 192.200353][ T5201] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 192.200376][ T5201] RIP: 0033:0x7f902539f559 [ 192.200393][ T5201] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 192.200410][ T5201] RSP: 002b:00007f90261c8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 192.200434][ T5201] RAX: ffffffffffffffda RBX: 00007f9025625fa0 RCX: 00007f902539f559 [ 192.200450][ T5201] RDX: 0000000000000000 RSI: 0000000000000803 RDI: 0000000000000010 [ 192.200464][ T5201] RBP: 00007f9025436b50 R08: 0000000000000000 R09: 0000000000000000 [ 192.200477][ T5201] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 192.200487][ T5201] R13: 00007f9025626038 R14: 00007f9025625fa0 R15: 00007fffb73c9918 [ 192.200504][ T5201] [ 192.331220][ T5191] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 192.477239][ T5212] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2070'. [ 192.733237][ T348] usb 2-1: new high-speed USB device number 68 using dummy_hcd [ 192.743324][ T9] asix 3-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 192.753573][ T9] asix 3-1:0.188 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x0080: ffffffb9 [ 192.783277][ T9] asix 3-1:0.188: probe with driver asix failed with error -71 [ 192.791737][ T9] usb 3-1: USB disconnect, device number 63 [ 192.893225][ T348] usb 2-1: Using ep0 maxpacket: 32 [ 192.899440][ T348] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 192.910592][ T348] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 192.922123][ T348] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 192.933045][ T348] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 192.945533][ T348] usb 2-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 192.954622][ T348] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 192.962617][ T348] usb 2-1: Product: syz [ 192.966819][ T348] usb 2-1: Manufacturer: syz [ 192.971412][ T348] usb 2-1: SerialNumber: syz [ 192.976808][ T348] usb 2-1: config 0 descriptor?? [ 192.983673][ T5214] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 192.992778][ T348] input: Generic X-Box pad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input12 [ 193.025364][ T5222] raw_sendmsg: syz.3.2075 forgot to set AF_INET. Fix it! [ 193.193944][ T5214] syz.1.2071 (5214): /proc/5213/oom_adj is deprecated, please use /proc/5213/oom_score_adj instead. [ 193.205266][ T5214] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 193.213875][ T5214] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 193.222230][ T5214] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 193.230705][ T5214] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 193.237137][ T3087] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 193.239344][ T9] usb 2-1: USB disconnect, device number 68 [ 193.248553][ T3087] asix 1-1:0.188 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffc3 [ 193.269582][ T3087] asix 1-1:0.188: probe with driver asix failed with error -61 [ 193.444810][ T9] usb 1-1: USB disconnect, device number 54 [ 193.622601][ T36] audit: type=1400 audit(1793449240.029:1107): avc: denied { create } for pid=5239 comm="syz.3.2083" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 193.643376][ T36] audit: type=1400 audit(1793449240.029:1108): avc: denied { write } for pid=5239 comm="syz.3.2083" path="socket:[47354]" dev="sockfs" ino=47354 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 193.765492][ T5244] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2085'. [ 194.043397][ T9] usb 2-1: new high-speed USB device number 69 using dummy_hcd [ 194.173234][ T3087] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 194.193393][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 194.205080][ T9] usb 2-1: config 0 has an invalid interface number: 188 but max is 0 [ 194.219216][ T9] usb 2-1: config 0 has no interface number 0 [ 194.231904][ T9] usb 2-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 194.253317][ T9] usb 2-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 194.271989][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 194.288899][ T9] usb 2-1: Product: syz [ 194.297446][ T9] usb 2-1: Manufacturer: syz [ 194.306430][ T9] usb 2-1: SerialNumber: syz [ 194.316378][ T9] usb 2-1: config 0 descriptor?? [ 194.328169][ T5248] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 194.355087][ T3087] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 194.383215][ T3087] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 194.393811][ T3087] usb 3-1: New USB device found, idVendor=05c6, idProduct=1000, bcdDevice= 0.00 [ 194.403725][ T3087] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 194.422073][ T3087] usb-storage 3-1:1.0: USB Mass Storage device detected [ 194.441334][ T3087] scsi host1: usb-storage 3-1:1.0 [ 194.551958][ T5248] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 194.622009][ T3087] usb 3-1: USB disconnect, device number 64 [ 194.841836][ T5290] __nla_validate_parse: 1 callbacks suppressed [ 194.841860][ T5290] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2100'. [ 195.788596][ T9] asix 2-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 195.810497][ T9] asix 2-1:0.188 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x0080: ffffffb9 [ 195.843256][ T9] asix 2-1:0.188: probe with driver asix failed with error -71 [ 195.861443][ T9] usb 2-1: USB disconnect, device number 69 [ 196.159574][ T5347] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 196.173812][ T5347] overlayfs: overlay with incompat feature 'volatile' cannot be mounted [ 196.247708][ T5355] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2122'. [ 196.390635][ T5361] EXT4-fs error (device sda1): ext4_validate_block_bitmap:423: comm syz-executor: bg 0: bad block bitmap checksum [ 196.493297][ T9] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 196.534604][ T36] audit: type=1400 audit(1793449242.949:1109): avc: denied { mounton } for pid=5363 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 196.563276][ T36] audit: type=1400 audit(1793449242.949:1110): avc: denied { create } for pid=5363 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 196.658585][ T309] bridge_slave_1: left allmulticast mode [ 196.668068][ T309] bridge_slave_1: left promiscuous mode [ 196.678156][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 196.683459][ T309] bridge0: port 2(bridge_slave_1) entered disabled state [ 196.701104][ T9] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 196.709521][ T309] bridge_slave_0: left allmulticast mode [ 196.715221][ T9] usb 1-1: config 0 has no interface number 0 [ 196.721322][ T9] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 196.731359][ T309] bridge_slave_0: left promiscuous mode [ 196.737299][ T309] bridge0: port 1(bridge_slave_0) entered disabled state [ 196.745924][ T9] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 196.763209][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 196.773368][ T9] usb 1-1: Product: syz [ 196.777538][ T9] usb 1-1: Manufacturer: syz [ 196.785259][ T9] usb 1-1: SerialNumber: syz [ 196.792500][ T9] usb 1-1: config 0 descriptor?? [ 196.799714][ T5355] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 196.845904][ T5371] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2128'. [ 196.874533][ T309] tipc: Disabling bearer [ 196.879963][ T309] tipc: Left network mode [ 197.008903][ T5355] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 197.625459][ T9] asix 1-1:0.188 (unnamed net_device) (uninitialized): invalid hw address, using random [ 197.635883][ T5393] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=6161 sclass=netlink_route_socket pid=5393 comm=syz.2.2135 [ 197.826060][ T9] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 197.836237][ T9] asix 1-1:0.188 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffc3 [ 197.846781][ T9] asix 1-1:0.188: probe with driver asix failed with error -61 [ 198.027778][ T9] usb 1-1: USB disconnect, device number 55 [ 198.929078][ T36] audit: type=1400 audit(1793449245.339:1111): avc: denied { mounton } for pid=5410 comm="syz.3.2141" path="/509/file0" dev="tmpfs" ino=2745 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 198.952357][ T5411] fuse: Bad value for 'user_id' [ 198.957242][ T5411] fuse: Bad value for 'user_id' [ 198.963906][ T36] audit: type=1400 audit(1793449245.379:1112): avc: denied { watch } for pid=5410 comm="syz.3.2141" path="/509/file0" dev="tmpfs" ino=2745 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 198.988878][ T36] audit: type=1400 audit(1793449245.379:1113): avc: denied { watch_reads } for pid=5410 comm="syz.3.2141" path="/509/file0" dev="tmpfs" ino=2745 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 199.143261][ T348] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 199.293237][ T348] usb 3-1: Using ep0 maxpacket: 16 [ 199.299718][ T348] usb 3-1: unable to get BOS descriptor or descriptor too short [ 199.308162][ T348] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 199.318266][ T348] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 199.327261][ T348] usb 3-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 199.341689][ T348] usb 3-1: New USB device found, idVendor=17cc, idProduct=0839, bcdDevice= 0.40 [ 199.350769][ T348] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 199.358767][ T348] usb 3-1: Product: syz [ 199.362920][ T348] usb 3-1: Manufacturer: syz [ 199.367542][ T348] usb 3-1: SerialNumber: syz [ 199.735832][ T36] audit: type=1400 audit(1793449246.149:1114): avc: denied { execmem } for pid=5414 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 199.759886][ T5421] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2144'. [ 199.770167][ T36] audit: type=1400 audit(1793449246.169:1115): avc: denied { create } for pid=5420 comm="syz.0.2144" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 199.791182][ T36] audit: type=1400 audit(1793449246.169:1116): avc: denied { write } for pid=5420 comm="syz.0.2144" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 199.814281][ T36] audit: type=1400 audit(1793449246.169:1117): avc: denied { nlmsg_write } for pid=5420 comm="syz.0.2144" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 199.835141][ T5423] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2145'. [ 200.013234][ T916] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 200.163226][ T916] usb 1-1: Using ep0 maxpacket: 32 [ 200.169396][ T916] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 200.177594][ T916] usb 1-1: config 0 has no interface number 0 [ 200.183694][ T916] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 200.195079][ T916] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 200.204174][ T916] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 200.212162][ T916] usb 1-1: Product: syz [ 200.216350][ T916] usb 1-1: Manufacturer: syz [ 200.220936][ T916] usb 1-1: SerialNumber: syz [ 200.226149][ T916] usb 1-1: config 0 descriptor?? [ 200.231418][ T5421] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 200.439522][ T5421] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 200.728110][ T36] audit: type=1400 audit(1793449247.139:1118): avc: denied { create } for pid=5430 comm="syz.3.2148" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 200.822650][ T5438] netlink: 'syz.3.2151': attribute type 4 has an invalid length. [ 200.830472][ T5438] netlink: 'syz.3.2151': attribute type 30 has an invalid length. [ 201.248194][ T916] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 201.258319][ T916] asix 1-1:0.188 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffc3 [ 201.268722][ T916] asix 1-1:0.188: probe with driver asix failed with error -61 [ 201.892159][ T348] usb 3-1: unit 5 not found! [ 201.899423][ T348] usb 3-1: USB disconnect, device number 65 [ 201.904324][ T1826] udevd[1826]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 202.763133][ T916] usb 1-1: USB disconnect, device number 56 [ 202.873463][ T5448] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2154'. [ 202.943081][ T5463] futex_wake_op: syz.3.2161 tries to shift op by 144; fix this program [ 203.133257][ T9] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 203.293239][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 203.299531][ T9] usb 3-1: config 0 has an invalid interface number: 188 but max is 0 [ 203.307720][ T9] usb 3-1: config 0 has no interface number 0 [ 203.313815][ T9] usb 3-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 203.325068][ T9] usb 3-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 203.334141][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 203.342103][ T9] usb 3-1: Product: syz [ 203.346264][ T9] usb 3-1: Manufacturer: syz [ 203.350853][ T9] usb 3-1: SerialNumber: syz [ 203.356016][ T9] usb 3-1: config 0 descriptor?? [ 203.361241][ T5448] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 203.568976][ T5448] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 204.131867][ T5470] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2162'. [ 204.182246][ T9] asix 3-1:0.188 (unnamed net_device) (uninitialized): invalid hw address, using random [ 204.330019][ T36] audit: type=1400 audit(1793449250.739:1119): avc: denied { lock } for pid=5468 comm="syz.3.2163" path="socket:[49295]" dev="sockfs" ino=49295 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 204.377822][ T9] asix 3-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 204.387971][ T3092] usb 1-1: new high-speed USB device number 57 using dummy_hcd [ 204.395530][ T9] asix 3-1:0.188 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffc3 [ 204.405956][ T9] asix 3-1:0.188: probe with driver asix failed with error -61 [ 204.563248][ T3092] usb 1-1: Using ep0 maxpacket: 32 [ 204.569425][ T3092] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 204.577658][ T3092] usb 1-1: config 0 has no interface number 0 [ 204.580907][ T348] usb 3-1: USB disconnect, device number 66 [ 204.585121][ T3092] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 204.600934][ T3092] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 204.610006][ T3092] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 204.618042][ T3092] usb 1-1: Product: syz [ 204.622214][ T3092] usb 1-1: Manufacturer: syz [ 204.626815][ T3092] usb 1-1: SerialNumber: syz [ 204.631914][ T3092] usb 1-1: config 0 descriptor?? [ 204.637174][ T5470] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 204.844991][ T5470] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 205.474762][ T5481] netlink: 'syz.3.2167': attribute type 4 has an invalid length. [ 205.482534][ T5481] netlink: 'syz.3.2167': attribute type 5 has an invalid length. [ 205.490496][ T5481] netlink: 3657 bytes leftover after parsing attributes in process `syz.3.2167'. [ 205.538266][ T5489] 9pnet_fd: Insufficient options for proto=fd [ 205.561742][ T5492] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=35 sclass=netlink_tcpdiag_socket pid=5492 comm=syz.3.2171 [ 205.657414][ T3092] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 205.667546][ T3092] asix 1-1:0.188 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffc3 [ 205.677948][ T3092] asix 1-1:0.188: probe with driver asix failed with error -61 [ 206.911631][ T5498] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2173'. [ 207.135772][ T9] usb 1-1: USB disconnect, device number 57 [ 207.143232][ T3092] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 207.294317][ T3092] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 207.304500][ T3092] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 207.316913][ T3092] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 207.325988][ T3092] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 207.334011][ T3092] usb 3-1: Product: syz [ 207.338161][ T3092] usb 3-1: Manufacturer: syz [ 207.342729][ T3092] usb 3-1: SerialNumber: syz [ 207.349201][ T3092] cdc_ncm 3-1:1.0: NCM or ECM functional descriptors missing [ 207.356621][ T3092] cdc_ncm 3-1:1.0: bind() failure [ 207.550909][ T5497] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 207.559385][ T5497] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 207.567888][ T348] usb 3-1: USB disconnect, device number 67 [ 208.436905][ T5511] ./dev/sda1: Can't lookup blockdev [ 208.443211][ T5511] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 208.450695][ T5511] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 208.463613][ T5511] ÿÿÿÿÿÿ: renamed from veth0_vlan [ 208.473668][ T5513] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 210.066203][ T5527] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2184'. [ 210.082259][ T5529] overlayfs: conflicting options: metacopy=off,verity=on [ 210.090116][ T5531] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2185'. [ 210.313270][ T348] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 210.343236][ T3092] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 210.463228][ T348] usb 1-1: Using ep0 maxpacket: 32 [ 210.469311][ T348] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 210.477604][ T348] usb 1-1: config 0 has no interface number 0 [ 210.483772][ T348] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 210.495129][ T348] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 210.503230][ T3092] usb 3-1: Using ep0 maxpacket: 32 [ 210.504175][ T348] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 210.510399][ T3092] usb 3-1: config 0 has an invalid interface number: 188 but max is 0 [ 210.517243][ T348] usb 1-1: Product: syz [ 210.517261][ T348] usb 1-1: Manufacturer: syz [ 210.525815][ T3092] usb 3-1: config 0 has no interface number 0 [ 210.529596][ T348] usb 1-1: SerialNumber: syz [ 210.534375][ T3092] usb 3-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 210.543989][ T348] usb 1-1: config 0 descriptor?? [ 210.554731][ T3092] usb 3-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 210.555162][ T5527] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 210.559724][ T3092] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 210.583966][ T3092] usb 3-1: Product: syz [ 210.588116][ T3092] usb 3-1: Manufacturer: syz [ 210.592696][ T3092] usb 3-1: SerialNumber: syz [ 210.597982][ T3092] usb 3-1: config 0 descriptor?? [ 210.603272][ T5531] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 210.770905][ T5527] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 210.811002][ T5531] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 211.419297][ T3092] asix 3-1:0.188 (unnamed net_device) (uninitialized): invalid hw address, using random [ 211.580261][ T348] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 211.590388][ T348] asix 1-1:0.188 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffc3 [ 211.600783][ T348] asix 1-1:0.188: probe with driver asix failed with error -61 [ 211.619626][ T3092] asix 3-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 211.629777][ T3092] asix 3-1:0.188 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffc3 [ 211.640164][ T3092] asix 3-1:0.188: probe with driver asix failed with error -61 [ 211.830489][ T3092] usb 3-1: USB disconnect, device number 68 [ 211.854415][ T5547] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2190'. [ 213.070028][ T348] usb 1-1: USB disconnect, device number 58 [ 213.679236][ T5561] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2195'. [ 213.739334][ T5569] FAULT_INJECTION: forcing a failure. [ 213.739334][ T5569] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 213.773208][ T5569] CPU: 1 UID: 0 PID: 5569 Comm: syz.2.2198 Not tainted syzkaller #0 86ffabe033aa4b611dc1eaf9ec72dc67ec78bb97 [ 213.773241][ T5569] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 213.773255][ T5569] Call Trace: [ 213.773262][ T5569] [ 213.773270][ T5569] __dump_stack+0x21/0x30 [ 213.773293][ T5569] dump_stack_lvl+0x140/0x1c0 [ 213.773311][ T5569] ? __cfi_dump_stack_lvl+0x10/0x10 [ 213.773330][ T5569] ? __kvmalloc_node_noprof+0x128/0x300 [ 213.773357][ T5569] dump_stack+0x19/0x20 [ 213.773374][ T5569] should_fail_ex+0x3c2/0x510 [ 213.773408][ T5569] should_fail+0xf/0x20 [ 213.773433][ T5569] should_fail_usercopy+0x1e/0x30 [ 213.773461][ T5569] _copy_from_user+0x20/0xa0 [ 213.773482][ T5569] copy_from_sockptr_offset+0x77/0xb0 [ 213.773509][ T5569] do_ip6t_set_ctl+0x901/0xd70 [ 213.773535][ T5569] ? avc_has_perm_noaudit+0x26b/0x360 [ 213.773556][ T5569] ? __cfi_do_ip6t_set_ctl+0x10/0x10 [ 213.773582][ T5569] ? avc_has_perm_noaudit+0x289/0x360 [ 213.773604][ T5569] ? __cfi_avc_has_perm+0x10/0x10 [ 213.773624][ T5569] ? __kasan_check_write+0x18/0x20 [ 213.773650][ T5569] ? mutex_unlock+0x90/0x240 [ 213.773671][ T5569] ? __cfi_mutex_unlock+0x10/0x10 [ 213.773694][ T5569] ? selinux_socket_setsockopt+0x324/0x3d0 [ 213.773718][ T5569] nf_setsockopt+0x290/0x2b0 [ 213.773746][ T5569] ipv6_setsockopt+0x130/0x170 [ 213.773770][ T5569] udpv6_setsockopt+0xa3/0xc0 [ 213.773790][ T5569] sock_common_setsockopt+0xb5/0xd0 [ 213.773818][ T5569] ? __cfi_sock_common_setsockopt+0x10/0x10 [ 213.773846][ T5569] do_sock_setsockopt+0x27f/0x410 [ 213.773870][ T5569] ? __cfi_do_sock_setsockopt+0x10/0x10 [ 213.773893][ T5569] ? __fget_files+0x2bc/0x330 [ 213.773913][ T5569] __x64_sys_setsockopt+0x18c/0x220 [ 213.773937][ T5569] x64_sys_call+0x2adc/0x2ee0 [ 213.773958][ T5569] do_syscall_64+0x57/0xf0 [ 213.773976][ T5569] ? clear_bhb_loop+0x50/0xa0 [ 213.773999][ T5569] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 213.774023][ T5569] RIP: 0033:0x7f7662f9f559 [ 213.774040][ T5569] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 213.774058][ T5569] RSP: 002b:00007f7663e17028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 213.774080][ T5569] RAX: ffffffffffffffda RBX: 00007f7663225fa0 RCX: 00007f7662f9f559 [ 213.774096][ T5569] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000004 [ 213.774110][ T5569] RBP: 00007f7663e17090 R08: 00000000000d0060 R09: 0000000000000000 [ 213.774124][ T5569] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 213.774139][ T5569] R13: 00007f7663226038 R14: 00007f7663225fa0 R15: 00007ffd925f0f78 [ 213.774156][ T5569] [ 215.874345][ T5577] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2200'. [ 215.905328][ T5582] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2202'. [ 216.123274][ T3092] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 216.273246][ T3092] usb 3-1: Using ep0 maxpacket: 32 [ 216.279523][ T3092] usb 3-1: config 0 has an invalid interface number: 188 but max is 0 [ 216.287753][ T3092] usb 3-1: config 0 has no interface number 0 [ 216.293862][ T3092] usb 3-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 216.305176][ T3092] usb 3-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 216.314232][ T3092] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 216.322229][ T3092] usb 3-1: Product: syz [ 216.326397][ T3092] usb 3-1: Manufacturer: syz [ 216.330987][ T3092] usb 3-1: SerialNumber: syz [ 216.336127][ T3092] usb 3-1: config 0 descriptor?? [ 216.341325][ T5577] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 216.549097][ T5577] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 217.157500][ T3092] asix 3-1:0.188 (unnamed net_device) (uninitialized): invalid hw address, using random [ 217.357788][ T3092] asix 3-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 217.367896][ T3092] asix 3-1:0.188 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffc3 [ 217.378279][ T3092] asix 3-1:0.188: probe with driver asix failed with error -61 [ 217.916684][ T5601] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2208'. [ 217.929856][ T5602] tipc: Cannot configure node identity twice [ 217.972753][ T5612] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2212'. [ 218.173265][ T348] usb 1-1: new high-speed USB device number 59 using dummy_hcd [ 218.323255][ T348] usb 1-1: Using ep0 maxpacket: 32 [ 218.329456][ T348] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 218.337781][ T348] usb 1-1: config 0 has no interface number 0 [ 218.343909][ T348] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 218.355214][ T348] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 218.364309][ T348] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 218.372294][ T348] usb 1-1: Product: syz [ 218.376460][ T348] usb 1-1: Manufacturer: syz [ 218.381044][ T348] usb 1-1: SerialNumber: syz [ 218.386159][ T348] usb 1-1: config 0 descriptor?? [ 218.391340][ T5601] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 218.599145][ T5601] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 218.872121][ T3087] usb 3-1: USB disconnect, device number 69 [ 219.408213][ T348] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 219.418324][ T348] asix 1-1:0.188 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffc3 [ 219.428721][ T348] asix 1-1:0.188: probe with driver asix failed with error -61 [ 219.615517][ T348] usb 1-1: USB disconnect, device number 59 [ 220.045715][ T5618] ./dev/sda1: Can't lookup blockdev [ 220.046959][ T5620] rust_binder: Write failure EFAULT in pid:1232 [ 220.066635][ T36] audit: type=1400 audit(1793449266.479:1120): avc: denied { ioctl } for pid=5619 comm="syz.2.2215" path="socket:[48723]" dev="sockfs" ino=48723 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 220.133949][ T5631] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2218'. SYZFAIL: failed to mkdtemp (errno 74: Bad message) SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: repeatedly failed to execute the program proc=1 req=2126 state=3 status=67 (errno 9: Bad file descriptor) [ 220.238806][ T36] audit: type=1400 audit(1793449266.649:1121): avc: denied { write } for pid=286 comm="syz-executor" path="pipe:[1550]" dev="pipefs" ino=1550 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 220.335031][ T286] EXT4-fs error (device sda1) in ext4_free_inode:361: Corrupt filesystem [ 220.351196][ T286] EXT4-fs error (device sda1) in ext4_free_inode:361: Corrupt filesystem [ 220.536446][ T5627] EXT4-fs error (device sda1) in ext4_free_inode:361: Corrupt filesystem [ 220.552272][ T5627] EXT4-fs error (device sda1) in ext4_free_inode:361: Corrupt filesystem [ 220.627165][ T1090] EXT4-fs error (device sda1) in ext4_free_inode:361: Corrupt filesystem [ 220.636624][ T1090] EXT4-fs error (device sda1) in ext4_free_inode:361: Corrupt filesystem [ 220.685175][ T1090] EXT4-fs error (device sda1) in ext4_free_inode:361: Corrupt filesystem [ 220.739528][ T5639] EXT4-fs error (device sda1) in ext4_free_inode:361: Corrupt filesystem [ 220.751533][ T5639] EXT4-fs error (device sda1) in ext4_free_inode:361: Corrupt filesystem [ 220.762273][ T309] bridge_slave_1: left allmulticast mode [ 220.767959][ T309] bridge_slave_1: left promiscuous mode [ 220.773603][ T309] bridge0: port 2(bridge_slave_1) entered disabled state [ 220.781286][ T309] bridge_slave_1: left allmulticast mode [ 220.787159][ T309] bridge_slave_1: left promiscuous mode [ 220.792804][ T309] bridge0: port 2(bridge_slave_1) entered disabled state [ 220.800256][ T309] bridge_slave_0: left allmulticast mode [ 220.805947][ T309] bridge_slave_0: left promiscuous mode [ 220.811540][ T309] bridge0: port 1(bridge_slave_0) entered disabled state [ 220.996677][ T309] tipc: Disabling bearer [ 221.002280][ T309] tipc: Left network mode [ 221.007134][ T309] tipc: Left network mode [ 221.013114][ T309] veth1_macvtap: left promiscuous mode [ 221.394429][ T309] ------------[ cut here ]------------ [ 221.399922][ T309] WARNING: CPU: 0 PID: 309 at net/ipv6/xfrm6_tunnel.c:341 xfrm6_tunnel_net_exit+0xc4/0x140 [ 221.409933][ T309] Modules linked in: [ 221.413864][ T309] CPU: 0 UID: 0 PID: 309 Comm: kworker/u8:3 Not tainted syzkaller #0 86ffabe033aa4b611dc1eaf9ec72dc67ec78bb97 [ 221.425505][ T309] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 221.435601][ T309] Workqueue: netns cleanup_net [ 221.440361][ T309] RIP: 0010:xfrm6_tunnel_net_exit+0xc4/0x140 [ 221.446363][ T309] Code: e8 31 5d d3 fc 4b 83 3c 3e 00 75 19 e8 55 ca 79 fc 49 81 ff f8 07 00 00 74 1b e8 47 ca 79 fc 49 83 c7 08 eb c9 e8 3c ca 79 fc <0f> 0b 49 81 ff f8 07 00 00 75 e5 49 8d 9e 00 08 00 00 45 31 ff 4a [ 221.465991][ T309] RSP: 0018:ffffc9000b81fb90 EFLAGS: 00010293 [ 221.472067][ T309] RAX: ffffffff850f8d04 RBX: ffff888132abc700 RCX: ffff88810bf213c0 [ 221.480064][ T309] RDX: 0000000000000000 RSI: 0000000000400000 RDI: ffff888104bf00b8 [ 221.488051][ T309] RBP: ffffc9000b81fbb0 R08: ffffffff88551547 R09: 1ffffffff10aa2a8 [ 221.496028][ T309] R10: dffffc0000000000 R11: fffffbfff10aa2a9 R12: dffffc0000000000 [ 221.504032][ T309] R13: dffffc0000000000 R14: ffff888104bf0000 R15: 00000000000000b8 [ 221.511989][ T309] FS: 0000000000000000(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 [ 221.520933][ T309] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 221.527541][ T309] CR2: 00007f7887ffae9c CR3: 000000010b722000 CR4: 00000000003526b0 [ 221.535533][ T309] Call Trace: [ 221.538809][ T309] [ 221.541721][ T309] cleanup_net+0x6bd/0xc90 [ 221.546151][ T309] ? __cfi_cleanup_net+0x10/0x10 [ 221.551093][ T309] ? kick_pool+0xb9/0x540 [ 221.555457][ T309] process_scheduled_works+0x7f7/0x1060 [ 221.561002][ T309] worker_thread+0xc99/0x13f0 [ 221.565699][ T309] ? __cfi_set_cpus_allowed_ptr+0x10/0x10 [ 221.571464][ T309] ? __kasan_check_read+0x15/0x20 [ 221.576555][ T309] kthread+0x2c7/0x360 [ 221.580634][ T309] ? __cfi_worker_thread+0x10/0x10 [ 221.585772][ T309] ? __cfi_kthread+0x10/0x10 [ 221.590364][ T309] ret_from_fork+0x64/0xa0 [ 221.594792][ T309] ? __cfi_kthread+0x10/0x10 [ 221.599384][ T309] ret_from_fork_asm+0x1a/0x30 [ 221.604161][ T309] [ 221.607176][ T309] ---[ end trace 0000000000000000 ]--- [ 221.612796][ T309] ------------[ cut here ]------------ [ 221.618265][ T309] WARNING: CPU: 1 PID: 309 at net/ipv6/xfrm6_tunnel.c:344 xfrm6_tunnel_net_exit+0x119/0x140 [ 221.628350][ T309] Modules linked in: [ 221.632263][ T309] CPU: 1 UID: 0 PID: 309 Comm: kworker/u8:3 Tainted: G W syzkaller #0 86ffabe033aa4b611dc1eaf9ec72dc67ec78bb97 [ 221.645385][ T309] Tainted: [W]=WARN [ 221.649178][ T309] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 221.659250][ T309] Workqueue: netns cleanup_net [ 221.664044][ T309] RIP: 0010:xfrm6_tunnel_net_exit+0x119/0x140 [ 221.670127][ T309] Code: fc 4b 83 bc 3e 00 08 00 00 00 75 19 e8 00 ca 79 fc 49 81 ff f8 07 00 00 74 1b e8 f2 c9 79 fc 49 83 c7 08 eb c5 e8 e7 c9 79 fc <0f> 0b 49 81 ff f8 07 00 00 75 e5 e8 d7 c9 79 fc 5b 41 5c 41 5e 41 [ 221.689759][ T309] RSP: 0018:ffffc9000b81fb90 EFLAGS: 00010293 [ 221.695844][ T309] RAX: ffffffff850f8d59 RBX: ffff888104bf0800 RCX: ffff88810bf213c0 [ 221.703824][ T309] RDX: 0000000000000000 RSI: 0000000000400000 RDI: ffff888104bf0808 [ 221.711862][ T309] RBP: ffffc9000b81fbb0 R08: ffffffff88551547 R09: 1ffffffff10aa2a8 [ 221.720147][ T309] R10: dffffc0000000000 R11: fffffbfff10aa2a9 R12: dffffc0000000000 [ 221.728197][ T309] R13: dffffc0000000000 R14: ffff888104bf0000 R15: 0000000000000008 [ 221.736185][ T309] FS: 0000000000000000(0000) GS:ffff8881f6d00000(0000) knlGS:0000000000000000 [ 221.745140][ T309] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 221.751712][ T309] CR2: 0000562f2cbed1c8 CR3: 000000010d718000 CR4: 00000000003526b0 [ 221.759718][ T309] Call Trace: [ 221.762993][ T309] [ 221.765961][ T309] cleanup_net+0x6bd/0xc90 [ 221.770387][ T309] ? __cfi_cleanup_net+0x10/0x10 [ 221.775343][ T309] ? kick_pool+0xb9/0x540 [ 221.779699][ T309] process_scheduled_works+0x7f7/0x1060 [ 221.785266][ T309] worker_thread+0xc99/0x13f0 [ 221.789942][ T309] ? __cfi_set_cpus_allowed_ptr+0x10/0x10 [ 221.795676][ T309] ? __kasan_check_read+0x15/0x20 [ 221.800702][ T309] kthread+0x2c7/0x360 [ 221.804802][ T309] ? __cfi_worker_thread+0x10/0x10 [ 221.809919][ T309] ? __cfi_kthread+0x10/0x10 [ 221.814531][ T309] ret_from_fork+0x64/0xa0 [ 221.818947][ T309] ? __cfi_kthread+0x10/0x10 [ 221.823549][ T309] ret_from_fork_asm+0x1a/0x30 [ 221.828313][ T309] [ 221.831314][ T309] ---[ end trace 0000000000000000 ]--- [ 221.845652][ T309] ------------[ cut here ]------------ [ 221.851140][ T309] WARNING: CPU: 1 PID: 309 at net/xfrm/xfrm_state.c:3230 xfrm_state_fini+0x2be/0x310 [ 221.860636][ T309] Modules linked in: [ 221.864543][ T309] CPU: 1 UID: 0 PID: 309 Comm: kworker/u8:3 Tainted: G W syzkaller #0 86ffabe033aa4b611dc1eaf9ec72dc67ec78bb97 [ 221.877666][ T309] Tainted: [W]=WARN [ 221.881466][ T309] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 221.891540][ T309] Workqueue: netns cleanup_net [ 221.896331][ T309] RIP: 0010:xfrm_state_fini+0x2be/0x310 [ 221.901863][ T309] Code: 3c 20 00 74 08 48 89 df e8 cf 39 ee fc 48 8b 3b e8 77 26 d9 fc 5b 41 5c 41 5d 41 5e 41 5f 5d e9 88 e3 b7 00 cc e8 e2 a6 94 fc <0f> 0b e9 b0 fd ff ff e8 d6 a6 94 fc 0f 0b e9 18 fe ff ff e8 ca a6 [ 221.921482][ T309] RSP: 0018:ffffc9000b81fb70 EFLAGS: 00010293 [ 221.927573][ T309] RAX: ffffffff84f4b05e RBX: ffff888132abc700 RCX: ffff88810bf213c0 [ 221.935558][ T309] RDX: 0000000000000000 RSI: 0000000000400000 RDI: ffff88810bf213c0 [ 221.943545][ T309] RBP: ffffc9000b81fb98 R08: ffffffff88551547 R09: 1ffffffff10aa2a8 [ 221.951499][ T309] R10: dffffc0000000000 R11: fffffbfff10aa2a9 R12: 1ffffffff10a9ffc [ 221.959473][ T309] R13: dffffc0000000000 R14: ffff888132abd300 R15: dffffc0000000000 [ 221.967474][ T309] FS: 0000000000000000(0000) GS:ffff8881f6d00000(0000) knlGS:0000000000000000 [ 221.976412][ T309] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 221.983024][ T309] CR2: 0000562f2cbed1c8 CR3: 000000010d718000 CR4: 00000000003526b0 [ 221.991026][ T309] Call Trace: [ 221.994320][ T309] [ 221.997244][ T309] xfrm_net_exit+0x31/0x80 [ 222.001647][ T309] cleanup_net+0x6bd/0xc90 [ 222.006083][ T309] ? __cfi_cleanup_net+0x10/0x10 [ 222.011021][ T309] ? kick_pool+0xb9/0x540 [ 222.015498][ T309] process_scheduled_works+0x7f7/0x1060 [ 222.021047][ T309] worker_thread+0xc99/0x13f0 [ 222.025737][ T309] ? __cfi_set_cpus_allowed_ptr+0x10/0x10 [ 222.031456][ T309] ? __kasan_check_read+0x15/0x20 [ 222.036493][ T309] kthread+0x2c7/0x360 [ 222.040562][ T309] ? __cfi_worker_thread+0x10/0x10 [ 222.045702][ T309] ? __cfi_kthread+0x10/0x10 [ 222.050289][ T309] ret_from_fork+0x64/0xa0 [ 222.054715][ T309] ? __cfi_kthread+0x10/0x10 [ 222.059307][ T309] ret_from_fork_asm+0x1a/0x30 [ 222.064092][ T309] [ 222.067103][ T309] ---[ end trace 0000000000000000 ]---