last executing test programs: 22.652671957s ago: executing program 1 (id=636): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x90}, 0x4000000) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000380)={0xfc, 0x2, 0x9, 0x101, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFCTH_TUPLE={0x54, 0x2, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x1d}}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x966}]}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x6c}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x15}, @NFCTH_TUPLE={0x7c, 0x2, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @loopback}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x7}}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @empty}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x4}, 0x80) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={0x0, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 21.738743218s ago: executing program 1 (id=637): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000300), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000640)=0xce0, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r1) connect$inet6(0xffffffffffffffff, 0x0, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8983, 0x0) syz_pidfd_open(0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(r1, &(0x7f0000000100)={&(0x7f0000000040), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x7, 0x1, 0x201, 0x0, 0x0, {0x1, 0x0, 0x1}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x4800) r2 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_channels={0x3d, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1}}) socket$netlink(0x10, 0x3, 0x10) (async) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) socket$netlink(0x10, 0x3, 0x10) (async) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000300), 0x4) (async) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000640)=0xce0, 0x4) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r1) (async) connect$inet6(0xffffffffffffffff, 0x0, 0x0) (async) connect$inet6(0xffffffffffffffff, 0x0, 0x0) (async) ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8983, 0x0) (async) syz_pidfd_open(0xffffffffffffffff, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(r1, &(0x7f0000000100)={&(0x7f0000000040), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x7, 0x1, 0x201, 0x0, 0x0, {0x1, 0x0, 0x1}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x4800) (async) socket(0x10, 0x803, 0x0) (async) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_channels={0x3d, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1}}) (async) 21.692061339s ago: executing program 1 (id=638): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x90}, 0x4000000) socket$xdp(0x2c, 0x3, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000380)={0xd0, 0x2, 0x9, 0x101, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFCTH_TUPLE={0x54, 0x2, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x1d}}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}]}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x1a}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x15}, @NFCTH_TUPLE={0x50, 0x2, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @empty}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0xb}]}, 0xd0}, 0x1, 0x0, 0x0, 0x4}, 0x80) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={0x0, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 20.79692334s ago: executing program 1 (id=643): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='ramfs\x00', 0x10, 0x0) (async) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000008c0)='./file0\x00', 0x0, 0x2a05004, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_procfs(r0, &(0x7f0000000340)='pagemap\x00') capset(&(0x7f0000000000)={0x20080522, r0}, &(0x7f0000000080)={0x0, 0x6, 0xa, 0x0, 0x9}) (async) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TCSETSF(r2, 0x5457, 0x0) (async) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r1, 0xc0145401, &(0x7f0000000100)={0x2, 0x1, 0x5, 0x1, 0x7}) (async) mount$tmpfs(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x20000, 0x0) (async) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x11050ca, 0x0) 20.700535953s ago: executing program 1 (id=644): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='freezer.self_freezing\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, 0x0}], 0x1, 0x55, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x1000000) 20.683079863s ago: executing program 1 (id=645): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x90}, 0x4000000) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000380)={0xfc, 0x2, 0x9, 0x101, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFCTH_TUPLE={0x54, 0x2, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x1d}}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x966}]}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x6c}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x15}, @NFCTH_TUPLE={0x7c, 0x2, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @loopback}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x7}}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @empty}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x4}, 0x80) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={0x0, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 20.663813614s ago: executing program 32 (id=645): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x90}, 0x4000000) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000380)={0xfc, 0x2, 0x9, 0x101, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFCTH_TUPLE={0x54, 0x2, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x1d}}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x966}]}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x6c}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x15}, @NFCTH_TUPLE={0x7c, 0x2, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @loopback}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x7}}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @empty}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x4}, 0x80) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={0x0, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 10.583571241s ago: executing program 0 (id=661): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x4000000) socket$xdp(0x2c, 0x3, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000380)={0xd0, 0x2, 0x9, 0x101, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFCTH_TUPLE={0x54, 0x2, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x1d}}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}]}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x1a}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x15}, @NFCTH_TUPLE={0x50, 0x2, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @empty}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0xb}]}, 0xd0}, 0x1, 0x0, 0x0, 0x4}, 0x80) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={0x0, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 9.073348427s ago: executing program 0 (id=663): r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_AVC(r0, &(0x7f0000000380)={0x0, 0xfe, &(0x7f0000000340)={&(0x7f0000000240)=ANY=[@ANYBLOB="f4000000530404"], 0xf4}, 0x1, 0x0, 0x0, 0x4000000}, 0x48004) 9.068198537s ago: executing program 2 (id=664): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0xc) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x220008d0}, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)={0x68, 0x0, 0x2, 0x301, 0x0, 0x0, {0x2, 0x0, 0x10}, [@CTA_EXPECT_NAT={0xc, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x4}, @CTA_EXPECT_NAT_TUPLE={0x4}]}, @CTA_EXPECT_NAT={0x48, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x44, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010101}, {0x8, 0x2, @local}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x2a}}}}]}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x40810}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000004, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x5, 0x5, 0xd500, 0x8, 0x79, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000002100)=ANY=[], 0x84}, 0x1, 0x0, 0x0, 0x200280d0}, 0x40) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x11, &(0x7f00000001c0)=0x8, 0x4) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r6 = dup(r5) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) r8 = userfaultfd(0x1) ioctl$UFFDIO_API(r8, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x52c}) ioctl$UFFDIO_REGISTER(r8, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) mlockall(0x1) ioctl$KVM_SET_CPUID(r0, 0x4008ae8a, &(0x7f0000000280)={0x7, 0x0, [{0xb, 0x4, 0xfffffff7, 0x6, 0x80000000}, {0x80000000, 0x9, 0x4, 0x2, 0x9}, {0xc0000001, 0xf, 0x9, 0x4, 0x80000001}, {0x80000008, 0xe, 0x8, 0x40e, 0x100}, {0x4, 0x7fffffff, 0x2, 0x8, 0x4}, {0x80000008, 0xd, 0x3, 0x8e, 0x5}, {0x40000009, 0x2, 0x3, 0x3}]}) 9.067100617s ago: executing program 3 (id=665): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x41, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r4, &(0x7f0000000040), 0xe09) r5 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000002240), 0x0, 0x0) vmsplice(r5, &(0x7f00000049c0)=[{&(0x7f0000004980)="83be22bbc8", 0x5}], 0x1, 0x0) ioctl$LOOP_CONFIGURE(r3, 0x4c0a, &(0x7f00000002c0)={r4, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x17, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) ioctl$sock_bt_hci(r4, 0x800448d5, &(0x7f00000000c0)="457c17b5ab3f1d4d31480cde36c1303dbf89320c934ed2a92e780bdc9306b6124065609509a1d792d07ff0d6394e9be0e0a25176fb9e587848f10ba651703813adba6112d80da0610ea5d9163f80d21b4e3f") ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f00000005c0)={0x1, 0x0, @pic={0x3, 0x5, 0xe1, 0x81, 0x9, 0xf9, 0x40, 0x42, 0xfb, 0x8, 0xc, 0x0, 0xe9, 0x4, 0xf9, 0x38}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x100000000005, 0x20, 0x3, 0x2, 0x80000000106c, 0x100, 0x8000000000000, 0x80000004000080, 0x1c00000, 0x8, 0x0, 0x4, 0x0, 0x8000], 0x1, 0x3c4210}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 7.461968554s ago: executing program 0 (id=666): syz_usb_connect$uac2(0x3, 0x8b, &(0x7f0000000340)=ANY=[@ANYBLOB="1201000300000020532b2300400001020301090279000301fb4004080b02010103200109040000000101200009240108000c1900e508240a00040b060308240a0901030602090401000001022000090401010101022000090501090002080706082501800f070000090402000001", @ANYBLOB="6577771c71dfbab3181db888d5cea5d795511ac9e66641c170bf35f5d832218e5c30fe1808da670008fd875ea12cd7ef53cd9420f2b63eea244e696b81baf6d1cf723e33ef940180b1b51e9b38fd45e5eaba8d"], 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) syz_usb_disconnect(r0) syz_usb_connect(0x3, 0x24, &(0x7f0000000000)=ANY=[], 0x0) ioctl$EVIOCRMFF(r0, 0xc0085508, 0x0) 7.461625254s ago: executing program 2 (id=667): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x41, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f00000005c0)={0x1, 0x0, @pic={0x3, 0x5, 0xe1, 0x81, 0x9, 0xf9, 0x40, 0x42, 0xfb, 0x8, 0xc, 0x0, 0xe9, 0x4, 0xf9, 0x38}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x100000000005, 0x20, 0x3, 0x2, 0x80000000106c, 0x100, 0x8000000000000, 0x80000004000080, 0x1c00000, 0x8, 0x0, 0x4, 0x0, 0x8000], 0x1, 0x3c4210}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 7.461413654s ago: executing program 3 (id=668): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000009c0)=[{&(0x7f0000000280)="6a61c2e7b06f180fe15972bfc5e3a70dcbf23bb25143ead3b2e2a81205754091882d8ecc6eb83a443e13ca915de5c8b8523a90dd924148f42806a0cb90ed7ed20e89637f78ccbf262fb7d605892239f6f7a24e3cf5bd165fd34aafdab2947899add6669e22383db59a2f3be04f571bc1213231b9fd8a60225e0a209fc61a3bb163ec47b5bb1aebd469dec3ec97ea75885c4a8cd6adc658e47c6cf3e30fbbe9773e96ce5a29149803a38cf5a72a3cb53bd4ce5a83be2473efa87974fbe851d5b3eaa6380e24ecaee51bd56a6679b4710cdf", 0xd1}], 0x1, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@textreal={0x8, &(0x7f0000000a80)="660f3881b0570066b9700b000066b8cdfca60066ba000000000f30afd9ff0f20e06635000040000f22e0368119f300baf80c66b868b2f38766efbafc0c66edbaf80c66b8b8d89f8066efbafc0c66b86000000066ef263e0fc73cd8c4", 0x5c}], 0x1, 0x6d, 0x0, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000080)={0x3, 0xbde, 0x0, &(0x7f0000000180)="a1984ec3aec3fc2e025f90eda6dbc903939aac644fd36f1e65174cae030c42cbacc392851a695f247112e91f059460a2c031929dc0515ac7cd20775ff9da9c2b6cb48968dcd6d8d982c492932c572f084d3af58650d207eec0794b3e47c5678c36b99eed61e1dbac68ce8a79aa21a51202018bdc4a51489844f785887083841d65c129992bbe5a51c71b95a9847d2bdede66c6e3184c386faf938fd6db888e73a5c0dcc69c3de7458e68ed3322", 0x0, 0xad}) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000100)=0x5000) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x1, 0x10, 0x0, 0x8, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x1, 0x0, 0x0, 0xfffffff8, 0x0, 0xff, 0xff, 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 5.741963625s ago: executing program 0 (id=669): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x6, 0x0, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfb, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000005c0)=[{{&(0x7f0000000280)=@ieee802154={0x24, @none={0x0, 0xffff}}, 0x80, &(0x7f0000000480)=[{&(0x7f0000000380)="2aa2f9d0c190ff5e31b4b010f0e9ab5c028c55471de71b2d5def7112a9bc3e3fb8dd9e82df5eac9b0f290c7f693a61a962c70495736e9be6a808ccb832785e8086f32c9026feb5865dd830fe9078fa6dc00321e51b23dd1caade68df0cf263752b4616da968062e305964a832488e53727a21d478a1a14048744ea778e0674520f10ac8f51b4daa411ff031ec424f33a984c76b13f0fc1e3e9dcf2233f5cc127c10940cfceed69b295df46d268cd91a6f8bc74cf83399c5079e5b3a21dd710136fc03ad0d79e8e14d2026212486be7dbb3e2020ed56f1ee7ac65265ed60eeb301bc3022991c60cb4ec170cec9a7aa10152c58a4d", 0xf4}], 0x1, &(0x7f00000004c0)=[{0xf0, 0x102, 0x5, "5880003f5d11fe9b8889a3c922fb7f2c739700b2e310b4b7d0393ee13d1aba7f43b19b827235bdbe5faf7fb616de3a611396363d42bf733355cdf6389901702921666e50e2300bdf086e8adbca539867cc60ef03d8da03831d1e3ae6d00ce68a56940dcea9ba6f19dcfddebba0c5db39ba28b9df97320c65234697f5bdd1087a39db77f91f54a39db5b5d24da9d537c23bade89b0a4b89a6fa7bee1d655bffe1163e43629a61f16700b41963ad8fcf412e2fe8ae3addaf48552a3a23ef9111f7567ca579c2614708d1151d5dcd51f53b38b2acc25d416d5c68"}], 0xf0}}], 0x1, 0x80) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socket$netlink(0x10, 0x3, 0x0) r4 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000090000102505a1a4400000000101090244000101000000090400001202060000052406000005240000000d240f010000000000000000000905810340000000000905820260000000000905030208"], 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r4, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000500)={0x0, 0x3, 0x1a, {0xfffffffffffffea4}}}, 0x0) syz_usb_control_io(r4, &(0x7f0000000780)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xc, 0x80, 0xe1, 0x4, 0x5, 0x1ff, 0x8}}}, 0x0) syz_usb_ep_write(r4, 0x82, 0xfffffcc6, &(0x7f0000000400)="16688a4a3f1cd2db03000007000000000d7c36e51e67f08f961d2fc0c37d7c8c2136536697a794f470c5f44c560dedb1b190fa63c35a3c256fb8b4e2542f15f331") sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x90}, 0x4000000) socket$xdp(0x2c, 0x3, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) r8 = dup3(r7, r6, 0x0) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f00000001c0)={0xffffffffffffff7f, 0x0, &(0x7f0000000040)=[@exit_looper={0x40086315}], 0x0, 0x0, 0x0}) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={0x0, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) 5.736564045s ago: executing program 2 (id=670): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000007ec0)=[{{0x0, 0x0, 0x0}, 0xfffffff8}, {{0x0, 0x0, 0x0}, 0xe2c3}, {{0x0, 0x0, &(0x7f00000030c0)=[{&(0x7f00000005c0)=""/163, 0xa3}, {&(0x7f0000000cc0)=""/232, 0xe8}, {&(0x7f0000000240)=""/92, 0x5c}, {&(0x7f0000000340)=""/180, 0xb4}, {&(0x7f0000000000)=""/245, 0xf5}, {&(0x7f0000001040)=""/52, 0x34}, {&(0x7f0000003140)=""/4096, 0x1000}], 0x7}, 0xe}, {{0x0, 0x0, 0x0}, 0x8000}], 0x4, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$wireguard(&(0x7f00000005c0), r1) r3 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$sock_linger(r3, 0x1, 0x44, &(0x7f0000000180)={0x200000000000001}, 0x8) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000009c0)=ANY=[@ANYRESDEC=r3, @ANYRES16=r2, @ANYBLOB="01000000000000000000010000000800050005000000140002007767310000000000000000000000000024000300a0cb879a47f5bc644c0e693fa6d031c74a1553b6e901b9ff2f518c78042fb5420800050000000000900008808c00008024000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691c640009801c000080a985acc6a5bb8795776676734333ea0e1c3daaf88124f86f69d2a211b81919247c225faff39d1ee34d707ac3d09c22e4", @ANYRESHEX=r0, @ANYRESHEX=r0, @ANYBLOB="27d6b1051df758ae69cb0e88177649f85280846d04a28b2aa181cf90da37e07332563b99c6bf47f32aace580e4f605a1c168d5cc949eef4914c0cc8096642acbee3195c94a46449f13a99ff02a994874fd8bd01e59d6943085dc50f9c9b958f81b9aa824b09e515744360fb8bbec228b402e2976e0d43b0f78a29c65b4bc0f", @ANYRES64=r2], 0xec}, 0x1, 0x0, 0x0, 0x4084}, 0x80) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000980)=ANY=[@ANYBLOB="1c0000005f000100000000000000000800c62a9d5a"], 0x1c}], 0x1, 0x0, 0x0, 0x80}, 0x0) r5 = memfd_secret(0x80000) r6 = gettid() r7 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(r7, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r6}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_clone3(&(0x7f0000000340)={0x20000, 0x0, 0x0, 0x0, {0x12}, 0x0, 0x0, 0x0, 0x0}, 0x8c) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0) r8 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) dup2(r8, r5) ioctl$BLKIOOPT(r5, 0x1279, &(0x7f0000000140)) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000001000/0x4000)=nil) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='net/ip6_tables_matches\x00') read$FUSE(r9, &(0x7f0000016440)={0x2020}, 0x2020) fadvise64(r4, 0x0, 0x1, 0x3) 5.735804175s ago: executing program 3 (id=671): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x4000000) socket$xdp(0x2c, 0x3, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000380)={0xd0, 0x2, 0x9, 0x101, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFCTH_TUPLE={0x54, 0x2, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x1d}}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}]}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x1a}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x15}, @NFCTH_TUPLE={0x50, 0x2, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @empty}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0xb}]}, 0xd0}, 0x1, 0x0, 0x0, 0x4}, 0x80) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={0x0, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 3.923614128s ago: executing program 2 (id=672): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x41, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f00000005c0)={0x1, 0x0, @pic={0x3, 0x5, 0xe1, 0x81, 0x9, 0xf9, 0x40, 0x42, 0xfb, 0x8, 0xc, 0x0, 0xe9, 0x4, 0xf9, 0x38}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x100000000005, 0x20, 0x3, 0x2, 0x80000000106c, 0x100, 0x8000000000000, 0x80000004000080, 0x1c00000, 0x8, 0x0, 0x4, 0x0, 0x8000], 0x1, 0x3c4210}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) (fail_nth: 1) 3.923117088s ago: executing program 3 (id=673): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000106a05310300000000000109022400010000800009040002010300010009210000000122f80409058103"], 0x0) syz_usb_connect$uac2(0x5, 0x0, 0x0, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x6, [{0x4, &(0x7f0000000000)=@lang_id={0x4, 0x3, 0xc0c}}, {0xca, &(0x7f0000000340)=@string={0xca, 0x3, "086f8359ca2ba09b4b8f3ffd0f6ab30efb839c613a465fd329446725eb5bc05bcb431fd238807026fbdd2920aa99e8c94f9691ad95a7b65004e72b5dbbb612bfcb1b191a506aa2e15b876958f831f65e768a26802098edd579ad1384a0265c7b20d1978bc89e67e68deb6eccb4ec7423e91253cabf6cf664fd780726909bd6b765c8f10bbfb43cc46c335662e8e814a0d5e99e11f8d9fb144a53c4d8ccee83ff939501a66f33da8ff5749f0620c05d20a8eea3cc38889b5cf258c1a69886b3f5e1c7832bb9a156d5"}}, {0x29, &(0x7f0000000440)=@string={0x29, 0x3, "3657b98113d6a40d10e6886497daf2ee731c953a6c3d1aecbbe6c5ced58c448028d19a0f0abbe7"}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x413}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x411}}, {0x20, &(0x7f0000000500)=@string={0x20, 0x3, "96b348b29b92b8b7963911071e2f4a8228b726441ae1004729126d7058e3"}}]}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000140)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) 2.011631533s ago: executing program 0 (id=674): mkdir(&(0x7f0000000000)='./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x64) init_module(&(0x7f0000000180)={{0x7f, 0x45, 0x4c, 0x46, 0xa3, 0x4, 0x9, 0x6, 0x2, 0x2, 0x3e, 0x10001, 0x29e, 0x40, 0x27b, 0x3, 0xf, 0x38, 0x1, 0xa, 0x40, 0xfffc}, [{0x1, 0xd, 0x0, 0x4, 0x3, 0xb7f, 0x1, 0x8}]}, 0x78, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_subtree(r0, &(0x7f0000001040), 0x201, 0x0) 2.011098623s ago: executing program 2 (id=675): r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x6011, r0, 0x0) prctl$PR_SET_MM_EXE_FILE(0x53564d41, 0xd, 0xffffffffffffffff) syz_clone(0x1022000, 0x0, 0xfffffffffffffc76, 0x0, 0x0, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) remap_file_pages(&(0x7f000042e000/0x13000)=nil, 0x13000, 0x4, 0x4, 0x40000) bind$bt_l2cap(r1, &(0x7f0000002080)={0x1f, 0xf, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) listen(r1, 0x7) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000180)=0x1, 0x4) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./debug\x00', 0x1c0) mount(0x0, &(0x7f0000000300)='./debug\x00', &(0x7f0000000340)='incremental-fs\x00', 0x4480, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f00000001c0)={0x0, 0x1, 0x0, &(0x7f0000000380)=""/70, 0x0, 0x4}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, 0x0, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f00000006c0)) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000000)=0x1) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f0000000140)={0x1, 0x7}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./debug/fail_page_alloc/min-order\x00', 0x1, 0x0) write$cgroup_pid(r3, &(0x7f0000000040), 0x12) r4 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000180)={@loopback, 0x800, 0x0, 0x3, 0x1, 0x80}, 0x20) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x66960000) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_buf(r5, 0x29, 0x2c, &(0x7f0000000000)="0bbb268dd6ffa80800000000000000000000210d0200aaa8fa017242ba9380d440fe000000000000290000003b000000", 0x30) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000080)={@loopback={0xffffffffffffffa4}, 0x800, 0x0, 0x3, 0x0, 0x40, 0x8}, 0x20) r6 = syz_open_dev$usbfs(&(0x7f00000001c0), 0x800000001fe, 0x2) dup(r6) ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000040)={0x23, 0x3, 0x12, 0x6, 0x0, 0x53, 0x0}) 2.010183453s ago: executing program 3 (id=676): syz_usb_connect$uac2(0x3, 0x8b, &(0x7f0000000340)=ANY=[@ANYBLOB="1201000300000020532b2300400001020301090279000301fb4004080b02010103200109040000000101200009240108000c1900e508240a00040b060308240a0901030602090401000001022000090401010101022000090501090002080706082501800f070000090402000001", @ANYBLOB="6577771c71dfbab3181db888d5cea5d795511ac9e66641c170bf35f5d832218e5c30fe1808da670008fd875ea12cd7ef53cd9420f2b63eea244e696b81baf6d1cf723e33ef940180b1b51e9b38fd45e5eaba8d"], 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) syz_usb_disconnect(r0) syz_usb_connect(0x3, 0x24, &(0x7f0000000000)=ANY=[], 0x0) ioctl$EVIOCRMFF(r0, 0xc0085508, 0x0) 1.06818ms ago: executing program 0 (id=677): r0 = socket$inet_udp(0x2, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f0000002240)=[{{&(0x7f0000000040)={0x2, 0x4e20, @multicast1=0xe000006a}, 0x10, 0x0, 0x0, &(0x7f0000000180)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0xc}, @local}}}], 0x20}}], 0x1, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = gettid() prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000000)=0x200, 0x4) syz_pidfd_open(r2, 0x0) r3 = syz_open_dev$evdev(&(0x7f0000000240), 0x20000, 0x0) ioctl$EVIOCGLED(r3, 0x80284504, &(0x7f0000000000)=""/52) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000040)={0xfffffffffffffffc, 0x100d000, 0x800}, 0x20) 682.54µs ago: executing program 2 (id=678): r0 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) mount$9p_fd(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000000040), 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r0}}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) r1 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r3, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000001900)=ANY=[@ANYBLOB="280000005e000dc9"], 0x28}], 0x1}, 0x40) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_int(r5, 0x29, 0x50, 0x0, &(0x7f0000000040)=0x28) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0xc45, 0x9, 0xfffffffffffffffd, 0x10000000, 0x10000, 0x3, 0x4002004c2, 0x803, 0x9, 0x0, 0x400, 0x7c, 0x89, 0xfffffffffffffffd, 0x8, 0x8e], 0x100000, 0x240046}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r6 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r2, 0xc0385868, &(0x7f0000000340)={r1, &(0x7f0000000140)='/dev/kvm\x00', 0x10000, &(0x7f0000000180)={@_ha_fsid={[0x7, 0x5]}, {0x6, 0x2}}, 0xfffffff7, &(0x7f00000002c0)={@_ha_fsid}, &(0x7f0000000300)=0x2}) r9 = openat$khugepaged_scan(0xffffffffffffff9c, &(0x7f00000003c0), 0x1, 0x0) write$khugepaged_scan(r9, &(0x7f0000000440), 0x8) ioctl$RTC_PLL_SET(r8, 0x40207012, &(0x7f0000000380)={0x5, 0x3, 0x6, 0x400, 0x19, 0x8000, 0x307}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r10 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/events/sched/sched_switch/trigger\x00', 0x2, 0x0) write(r10, &(0x7f0000000180)='enable_event:sched:sched_process_fork\x00', 0x26) ioctl$KVM_SET_MSRS(r7, 0x4008ae89, &(0x7f0000000600)={0x1, 0x0, [{0x400000f2, 0x0, 0x5}]}) 0s ago: executing program 3 (id=679): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000009c0)=[{&(0x7f0000000280)="6a61c2e7b06f180fe15972bfc5e3a70dcbf23bb25143ead3b2e2a81205754091882d8ecc6eb83a443e13ca915de5c8b8523a90dd924148f42806a0cb90ed7ed20e89637f78ccbf262fb7d605892239f6f7a24e3cf5bd165fd34aafdab2947899add6669e22383db59a2f3be04f571bc1213231b9fd8a60225e0a209fc61a3bb163ec47b5bb1aebd469dec3ec97ea75885c4a8cd6adc658e47c6cf3e30fbbe9773e96ce5a29149803a38cf5a72a3cb53bd4ce5a83be2473efa87974fbe851d5b3eaa6380e24ecaee51bd56a6679b4710cdf", 0xd1}], 0x1, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@textreal={0x8, &(0x7f0000000a80)="660f3881b0570066b9700b000066b8cdfca60066ba000000000f30afd9ff0f20e06635000040000f22e0368119f300baf80c66b868b2f38766efbafc0c66edbaf80c66b8b8d89f8066efbafc0c66b86000000066ef263e0fc73cd8c4", 0x5c}], 0x1, 0x6d, 0x0, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000080)={0x3, 0xbde, 0x0, &(0x7f0000000180)="a1984ec3aec3fc2e025f90eda6dbc903939aac644fd36f1e65174cae030c42cbacc392851a695f247112e91f059460a2c031929dc0515ac7cd20775ff9da9c2b6cb48968dcd6d8d982c492932c572f084d3af58650d207eec0794b3e47c5678c36b99eed61e1dbac68ce8a79aa21a51202018bdc4a51489844f785887083841d65c129992bbe5a51c71b95a9847d2bdede66c6e3184c386faf938fd6db888e73a5c0dcc69c3de7458e68ed33226a8d1c", 0x0, 0xb0}) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000100)=0x5000) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x1, 0x10, 0x0, 0x8, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x1, 0x0, 0x0, 0xfffffff8, 0x0, 0xff, 0xff, 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) kernel console output (not intermixed with test programs): me failslab, interval 1, probability 0, space 0, times 0 [ 88.310416][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 88.328091][ T1398] CPU: 1 UID: 0 PID: 1398 Comm: syz.1.348 Not tainted syzkaller #0 01d0fef691542fecbcfb5551c0a705324fcaa78c [ 88.328123][ T1398] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 88.328136][ T1398] Call Trace: [ 88.328144][ T1398] [ 88.328151][ T1398] __dump_stack+0x21/0x30 [ 88.328185][ T1398] dump_stack_lvl+0x140/0x1c0 [ 88.328212][ T1398] ? __cfi_dump_stack_lvl+0x10/0x10 [ 88.328239][ T1398] ? __kasan_check_write+0x18/0x20 [ 88.328263][ T1398] dump_stack+0x19/0x20 [ 88.328288][ T1398] should_fail_ex+0x3c2/0x510 [ 88.328313][ T1398] should_failslab+0xac/0x100 [ 88.328337][ T1398] __kmalloc_node_noprof+0x69/0x500 [ 88.328368][ T1398] ? __kvmalloc_node_noprof+0x128/0x300 [ 88.328388][ T1398] __kvmalloc_node_noprof+0x128/0x300 [ 88.328408][ T1398] ? __kasan_check_write+0x18/0x20 [ 88.328428][ T1398] ? __cfi___kvmalloc_node_noprof+0x10/0x10 [ 88.328447][ T1398] ? strncpy_from_user+0x14f/0x280 [ 88.328472][ T1398] __se_sys_add_key+0x291/0x4b0 [ 88.328495][ T1398] ? __x64_sys_add_key+0xf0/0xf0 [ 88.328519][ T1398] __x64_sys_add_key+0xc3/0xf0 [ 88.328542][ T1398] x64_sys_call+0x195f/0x2ee0 [ 88.328562][ T1398] do_syscall_64+0x57/0xf0 [ 88.328580][ T1398] ? clear_bhb_loop+0x50/0xa0 [ 88.328603][ T1398] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 88.328626][ T1398] RIP: 0033:0x7f7aa3b9e159 [ 88.328644][ T1398] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 88.328662][ T1398] RSP: 002b:00007f7aa4b39028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 88.328685][ T1398] RAX: ffffffffffffffda RBX: 00007f7aa3e25fa0 RCX: 00007f7aa3b9e159 [ 88.328701][ T1398] RDX: 0000200000000480 RSI: 0000000000000000 RDI: 0000200000000240 [ 88.328721][ T1398] RBP: 00007f7aa4b39090 R08: 0000000038126bd5 R09: 0000000000000000 [ 88.328737][ T1398] R10: 0000000000000110 R11: 0000000000000246 R12: 0000000000000001 [ 88.328747][ T1398] R13: 00007f7aa3e26038 R14: 00007f7aa3e25fa0 R15: 00007ffdc8eba8e8 [ 88.328773][ T1398] [ 88.533965][ T1396] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 88.542521][ T1396] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 88.555061][ T10] usb 1-1: unable to get BOS descriptor or descriptor too short [ 88.579762][ T10] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 88.589551][ T10] usb 1-1: can't read configurations, error -71 [ 88.912394][ T1414] FAULT_INJECTION: forcing a failure. [ 88.912394][ T1414] name failslab, interval 1, probability 0, space 0, times 0 [ 88.925081][ T1414] CPU: 1 UID: 0 PID: 1414 Comm: syz.1.353 Not tainted syzkaller #0 01d0fef691542fecbcfb5551c0a705324fcaa78c [ 88.925102][ T1414] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 88.925109][ T1414] Call Trace: [ 88.925113][ T1414] [ 88.925118][ T1414] __dump_stack+0x21/0x30 [ 88.925138][ T1414] dump_stack_lvl+0x140/0x1c0 [ 88.925152][ T1414] ? __cfi_dump_stack_lvl+0x10/0x10 [ 88.925168][ T1414] dump_stack+0x19/0x20 [ 88.925181][ T1414] should_fail_ex+0x3c2/0x510 [ 88.925194][ T1414] should_failslab+0xac/0x100 [ 88.925207][ T1414] kmem_cache_alloc_node_noprof+0x45/0x420 [ 88.925220][ T1414] ? dup_task_struct+0xc1/0xd80 [ 88.925234][ T1414] ? kasan_save_alloc_info+0x3a/0x50 [ 88.925243][ T1414] ? __kasan_kmalloc+0x96/0xb0 [ 88.925255][ T1414] ? __kmalloc_cache_noprof+0x23c/0x470 [ 88.925267][ T1414] dup_task_struct+0xc1/0xd80 [ 88.925280][ T1414] ? copy_process+0x3350/0x3350 [ 88.925292][ T1414] ? __kasan_check_write+0x18/0x20 [ 88.925303][ T1414] copy_process+0x57c/0x3350 [ 88.925317][ T1414] ? kasan_save_alloc_info+0x3a/0x50 [ 88.925327][ T1414] ? __cfi_copy_process+0x10/0x10 [ 88.925339][ T1414] ? __kmalloc_cache_noprof+0x23c/0x470 [ 88.925350][ T1414] ? __kasan_check_write+0x18/0x20 [ 88.925360][ T1414] ? __cfi_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 88.925373][ T1414] vhost_task_create+0x1f7/0x3f0 [ 88.925384][ T1414] ? __cfi_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 88.925397][ T1414] ? __cfi_vhost_task_create+0x10/0x10 [ 88.925408][ T1414] ? __cfi_vhost_task_fn+0x10/0x10 [ 88.925424][ T1414] ? __kasan_check_write+0x18/0x20 [ 88.925435][ T1414] ? mutex_lock+0x97/0x1d0 [ 88.925447][ T1414] ? __cfi_mutex_lock+0x10/0x10 [ 88.925458][ T1414] ? kernel_text_address+0xa9/0xe0 [ 88.925473][ T1414] kvm_mmu_post_init_vm+0x161/0x300 [ 88.925488][ T1414] kvm_arch_vcpu_ioctl_run+0xf3/0x1bc0 [ 88.925503][ T1414] ? _parse_integer_limit+0x195/0x1e0 [ 88.925516][ T1414] ? __cfi_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 88.925532][ T1414] ? kstrtoull+0x13b/0x1e0 [ 88.925551][ T1414] ? kstrtouint+0x78/0xf0 [ 88.925570][ T1414] ? ioctl_has_perm+0x1bc/0x500 [ 88.925588][ T1414] ? __asan_memcpy+0x5a/0x80 [ 88.925599][ T1414] ? ioctl_has_perm+0x408/0x500 [ 88.925609][ T1414] ? has_cap_mac_admin+0xd0/0xd0 [ 88.925620][ T1414] ? __kasan_check_write+0x18/0x20 [ 88.925630][ T1414] ? mutex_lock_killable+0x97/0x1d0 [ 88.925642][ T1414] ? __cfi_mutex_lock_killable+0x10/0x10 [ 88.925654][ T1414] ? proc_fail_nth_write+0x184/0x220 [ 88.925671][ T1414] kvm_vcpu_ioctl+0xa43/0x1000 [ 88.925682][ T1414] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 88.925691][ T1414] ? __cfi_vfs_write+0x10/0x10 [ 88.925703][ T1414] ? __kasan_check_write+0x18/0x20 [ 88.925713][ T1414] ? mutex_unlock+0x90/0x240 [ 88.925724][ T1414] ? __cfi_mutex_unlock+0x10/0x10 [ 88.925737][ T1414] ? __fget_files+0x2bc/0x330 [ 88.925750][ T1414] ? bpf_lsm_file_ioctl+0xd/0x20 [ 88.925763][ T1414] ? security_file_ioctl+0x3e/0x110 [ 88.925774][ T1414] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 88.925784][ T1414] __se_sys_ioctl+0x126/0x1b0 [ 88.925797][ T1414] __x64_sys_ioctl+0x7f/0xa0 [ 88.925810][ T1414] x64_sys_call+0x1878/0x2ee0 [ 88.925820][ T1414] do_syscall_64+0x57/0xf0 [ 88.925829][ T1414] ? clear_bhb_loop+0x50/0xa0 [ 88.925843][ T1414] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 88.925854][ T1414] RIP: 0033:0x7f7aa3b9e159 [ 88.925865][ T1414] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 88.925875][ T1414] RSP: 002b:00007f7aa4b39028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 88.925887][ T1414] RAX: ffffffffffffffda RBX: 00007f7aa3e25fa0 RCX: 00007f7aa3b9e159 [ 88.925896][ T1414] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 88.925903][ T1414] RBP: 00007f7aa4b39090 R08: 0000000000000000 R09: 0000000000000000 [ 88.925910][ T1414] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 88.925917][ T1414] R13: 00007f7aa3e26038 R14: 00007f7aa3e25fa0 R15: 00007ffdc8eba8e8 [ 88.925928][ T1414] [ 89.050454][ T310] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 89.480479][ T310] usb 3-1: Using ep0 maxpacket: 16 [ 89.493849][ T310] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 89.510411][ T310] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 96 [ 89.530434][ T310] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 89.545622][ T310] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 89.571096][ T310] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 89.590791][ T310] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 89.598918][ T310] usb 3-1: SerialNumber: syz [ 89.606645][ T1409] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 89.617375][ T1409] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 89.633965][ T310] hub 3-1:1.0: bad descriptor, ignoring hub [ 89.647379][ T310] hub 3-1:1.0: probe with driver hub failed with error -5 [ 89.720400][ T9] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 89.834409][ T1409] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 89.849518][ T1409] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 89.870383][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 89.876785][ T9] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 89.888871][ T9] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 89.908770][ T9] usb 4-1: config 0 interface 0 has no altsetting 0 [ 89.923326][ T9] usb 4-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 89.942215][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 89.962981][ T9] usb 4-1: config 0 descriptor?? [ 90.263279][ T310] cdc_ether 3-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.2-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 90.582640][ T9] usb 4-1: USB disconnect, device number 23 [ 90.828141][ T1437] rust_binder: 1408:1437 BC_FREEZE_NOTIFICATION_DONE 0000006002820509 not found [ 90.837585][ T1437] rust_binder: Write failure EINVAL in pid:238 [ 91.386919][ T1460] FAULT_INJECTION: forcing a failure. [ 91.386919][ T1460] name failslab, interval 1, probability 0, space 0, times 0 [ 91.405922][ T1460] CPU: 1 UID: 0 PID: 1460 Comm: syz.0.366 Not tainted syzkaller #0 01d0fef691542fecbcfb5551c0a705324fcaa78c [ 91.405958][ T1460] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 91.405974][ T1460] Call Trace: [ 91.405982][ T1460] [ 91.405992][ T1460] __dump_stack+0x21/0x30 [ 91.406027][ T1460] dump_stack_lvl+0x140/0x1c0 [ 91.406058][ T1460] ? __cfi_dump_stack_lvl+0x10/0x10 [ 91.406088][ T1460] ? kasan_save_alloc_info+0x3a/0x50 [ 91.406111][ T1460] dump_stack+0x19/0x20 [ 91.406137][ T1460] should_fail_ex+0x3c2/0x510 [ 91.406163][ T1460] ? security_inode_init_security+0x11c/0x600 [ 91.406191][ T1460] should_failslab+0xac/0x100 [ 91.406216][ T1460] __kmalloc_noprof+0x69/0x510 [ 91.406240][ T1460] ? security_inode_init_security+0x11c/0x600 [ 91.406266][ T1460] ? get_inode_acl+0x50/0x50 [ 91.406286][ T1460] ? __cfi_shmem_alloc_inode+0x10/0x10 [ 91.406312][ T1460] ? __cfi_shmem_initxattrs+0x10/0x10 [ 91.406342][ T1460] security_inode_init_security+0x11c/0x600 [ 91.406370][ T1460] ? __cfi_security_inode_init_security+0x10/0x10 [ 91.406398][ T1460] ? set_cached_acl+0xe1/0x1a0 [ 91.406427][ T1460] ? simple_acl_create+0x190/0x1c0 [ 91.406448][ T1460] shmem_mknod+0xd5/0x200 [ 91.406476][ T1460] shmem_mkdir+0x3b/0x80 [ 91.406505][ T1460] vfs_mkdir+0x58e/0x810 [ 91.406533][ T1460] do_mkdirat+0x240/0x530 [ 91.406560][ T1460] ? __cfi_do_mkdirat+0x10/0x10 [ 91.406587][ T1460] ? __kasan_check_write+0x18/0x20 [ 91.406608][ T1460] ? getname_flags+0x203/0x6b0 [ 91.406627][ T1460] ? __kasan_check_write+0x18/0x20 [ 91.406646][ T1460] __x64_sys_mkdirat+0x8b/0xa0 [ 91.406682][ T1460] x64_sys_call+0x2ba8/0x2ee0 [ 91.406704][ T1460] do_syscall_64+0x57/0xf0 [ 91.406723][ T1460] ? clear_bhb_loop+0x50/0xa0 [ 91.406751][ T1460] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 91.406774][ T1460] RIP: 0033:0x7f428f39e159 [ 91.406795][ T1460] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 91.406814][ T1460] RSP: 002b:00007f429025f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 91.406839][ T1460] RAX: ffffffffffffffda RBX: 00007f428f625fa0 RCX: 00007f428f39e159 [ 91.406856][ T1460] RDX: 00000000000001ed RSI: 0000200000000000 RDI: ffffffffffffff9c [ 91.406873][ T1460] RBP: 00007f428f43503b R08: 0000000000000000 R09: 0000000000000000 [ 91.406887][ T1460] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 91.406901][ T1460] R13: 00007f428f626038 R14: 00007f428f625fa0 R15: 00007fff2f6a72d8 [ 91.406924][ T1460] [ 91.662719][ T311] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 91.820385][ T311] usb 2-1: Using ep0 maxpacket: 32 [ 92.028654][ T1446] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 92.047285][ T1446] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 92.057284][ T45] usb 3-1: USB disconnect, device number 15 [ 92.070598][ T45] cdc_ether 3-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.2-1, CDC Ethernet Device [ 92.090155][ T311] usb 2-1: unable to get BOS descriptor or descriptor too short [ 92.107040][ T311] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 92.122704][ T311] usb 2-1: can't read configurations, error -71 [ 92.319573][ T1470] FAULT_INJECTION: forcing a failure. [ 92.319573][ T1470] name failslab, interval 1, probability 0, space 0, times 0 [ 92.335089][ T1470] CPU: 0 UID: 0 PID: 1470 Comm: syz.3.369 Not tainted syzkaller #0 01d0fef691542fecbcfb5551c0a705324fcaa78c [ 92.335125][ T1470] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 92.335139][ T1470] Call Trace: [ 92.335147][ T1470] [ 92.335155][ T1470] __dump_stack+0x21/0x30 [ 92.335193][ T1470] dump_stack_lvl+0x140/0x1c0 [ 92.335223][ T1470] ? __cfi_dump_stack_lvl+0x10/0x10 [ 92.335253][ T1470] dump_stack+0x19/0x20 [ 92.335279][ T1470] should_fail_ex+0x3c2/0x510 [ 92.335304][ T1470] ? security_sk_alloc+0x65/0x260 [ 92.335333][ T1470] should_failslab+0xac/0x100 [ 92.335366][ T1470] __kmalloc_noprof+0x69/0x510 [ 92.335387][ T1470] ? kasan_save_alloc_info+0x3a/0x50 [ 92.335409][ T1470] ? security_sk_alloc+0x65/0x260 [ 92.335436][ T1470] ? __kasan_kmalloc+0x96/0xb0 [ 92.335495][ T1470] security_sk_alloc+0x65/0x260 [ 92.335524][ T1470] ? avc_has_perm_noaudit+0x289/0x360 [ 92.335551][ T1470] sk_prot_alloc+0x123/0x3a0 [ 92.335576][ T1470] sk_alloc+0x40/0x590 [ 92.335601][ T1470] tun_chr_open+0x80/0x7f0 [ 92.335623][ T1470] ? __cfi_kobject_get_unless_zero+0x10/0x10 [ 92.335646][ T1470] ? __cfi_tun_chr_open+0x10/0x10 [ 92.335666][ T1470] misc_open+0x2ec/0x370 [ 92.335689][ T1470] chrdev_open+0x4eb/0x610 [ 92.335709][ T1470] ? __cfi_chrdev_open+0x10/0x10 [ 92.335729][ T1470] ? bpf_lsm_file_open+0xd/0x20 [ 92.335752][ T1470] ? __cfi_chrdev_open+0x10/0x10 [ 92.335773][ T1470] do_dentry_open+0x97c/0x1510 [ 92.335800][ T1470] vfs_open+0x86/0x240 [ 92.335821][ T1470] ? __cfi_vfs_open+0x10/0x10 [ 92.335844][ T1470] ? inode_owner_or_capable+0xf0/0x1b0 [ 92.335862][ T1470] ? may_open+0x398/0x430 [ 92.335885][ T1470] path_openat+0x2c49/0x35a0 [ 92.335909][ T1470] ? kasan_save_alloc_info+0x3a/0x50 [ 92.335926][ T1470] ? getname+0x1b/0x30 [ 92.335945][ T1470] ? x64_sys_call+0xe69/0x2ee0 [ 92.335961][ T1470] ? do_syscall_64+0x57/0xf0 [ 92.335981][ T1470] ? do_filp_open+0x440/0x440 [ 92.336007][ T1470] do_filp_open+0x1f2/0x440 [ 92.336043][ T1470] ? __cfi_do_filp_open+0x10/0x10 [ 92.336070][ T1470] ? alloc_fd+0x4c1/0x570 [ 92.336089][ T1470] do_sys_openat2+0x134/0x1d0 [ 92.336112][ T1470] ? fput+0x1a4/0x230 [ 92.336134][ T1470] ? do_sys_open+0x100/0x100 [ 92.336160][ T1470] __x64_sys_openat+0x13a/0x170 [ 92.336187][ T1470] x64_sys_call+0xe69/0x2ee0 [ 92.336202][ T1470] do_syscall_64+0x57/0xf0 [ 92.336218][ T1470] ? clear_bhb_loop+0x50/0xa0 [ 92.336243][ T1470] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 92.336267][ T1470] RIP: 0033:0x7f29e7f9e159 [ 92.336285][ T1470] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.336304][ T1470] RSP: 002b:00007f29e8f0e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 92.336327][ T1470] RAX: ffffffffffffffda RBX: 00007f29e8225fa0 RCX: 00007f29e7f9e159 [ 92.336344][ T1470] RDX: 0000000000040241 RSI: 0000200000000000 RDI: ffffffffffffff9c [ 92.336360][ T1470] RBP: 00007f29e803503b R08: 0000000000000000 R09: 0000000000000000 [ 92.336374][ T1470] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 92.336388][ T1470] R13: 00007f29e8226038 R14: 00007f29e8225fa0 R15: 00007fff6ca2a2e8 [ 92.336407][ T1470] [ 93.000378][ T670] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 93.180386][ T670] usb 1-1: Using ep0 maxpacket: 16 [ 93.186863][ T670] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 93.203908][ T670] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 93.222186][ T670] usb 1-1: config 0 interface 0 has no altsetting 0 [ 93.228893][ T670] usb 1-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 93.238586][ T670] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 93.252320][ T670] usb 1-1: config 0 descriptor?? [ 93.360468][ T311] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 93.520415][ T311] usb 2-1: Using ep0 maxpacket: 16 [ 93.526769][ T311] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 93.544739][ T311] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 96 [ 93.567311][ T311] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 93.587170][ T311] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 93.611750][ T311] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 93.630378][ T311] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 93.638437][ T311] usb 2-1: SerialNumber: syz [ 93.651297][ T1490] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 93.658518][ T1490] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 93.670958][ T311] hub 2-1:1.0: bad descriptor, ignoring hub [ 93.676897][ T311] hub 2-1:1.0: probe with driver hub failed with error -5 [ 93.872986][ T670] usb 1-1: USB disconnect, device number 24 [ 93.885087][ T1490] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 93.900411][ T1490] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 94.324200][ T311] cdc_ether 2-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.1-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 94.630395][ T9] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 94.790371][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 94.871314][ T1529] rust_binder: 1489:1529 BC_FREEZE_NOTIFICATION_DONE 0000006002820509 not found [ 94.880958][ T1529] rust_binder: Write failure EINVAL in pid:287 [ 95.000780][ T1515] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 95.039153][ T1515] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 95.049943][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 95.059665][ T9] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 95.067529][ T9] usb 1-1: can't read configurations, error -71 [ 95.555003][ T1545] kvm: pic: non byte write [ 95.783815][ T1554] bridge0: port 3(vlan0) entered blocking state [ 95.790107][ T1554] bridge0: port 3(vlan0) entered disabled state [ 95.796487][ T1554] vlan0: entered allmulticast mode [ 95.801656][ T1554] veth0_vlan: entered allmulticast mode [ 95.807707][ T1554] vlan0: entered promiscuous mode [ 95.813207][ T1554] bridge0: port 3(vlan0) entered blocking state [ 95.819458][ T1554] bridge0: port 3(vlan0) entered forwarding state [ 95.827738][ T1554] netlink: 'syz.2.391': attribute type 27 has an invalid length. [ 95.910586][ T9] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 96.060416][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 96.071502][ T9] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 96.090689][ T9] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 96.104262][ T9] usb 1-1: config 0 interface 0 has no altsetting 0 [ 96.119664][ T9] usb 1-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 96.128994][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 96.153163][ T9] usb 1-1: config 0 descriptor?? [ 96.190488][ T310] usb 2-1: USB disconnect, device number 24 [ 96.197336][ T310] cdc_ether 2-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.1-1, CDC Ethernet Device [ 96.574514][ T9] hid (null): invalid report_count 44433 [ 96.586825][ T9] hid (null): global environment stack underflow [ 96.600086][ T9] hid (null): unknown global tag 0xe [ 96.611008][ T9] hid (null): report_id 838359145 is invalid [ 96.623625][ T9] hid (null): unknown global tag 0x76 [ 96.635671][ T9] hid (null): bogus close delimiter [ 96.648618][ T9] hid (null): unknown global tag 0xd [ 96.659683][ T9] hid (null): unknown global tag 0xe [ 96.677423][ T9] hid (null): invalid report_count 1945039578 [ 96.768182][ T310] usb 1-1: USB disconnect, device number 26 [ 96.950703][ T9] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 97.121175][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 97.304435][ T1595] tmpfs: Unknown parameter 'noinode32' [ 97.329950][ T1579] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 97.340550][ T1579] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 97.353072][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 97.370254][ T9] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 97.384732][ T9] usb 4-1: can't read configurations, error -71 [ 98.250390][ T9] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 98.410378][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 98.416767][ T9] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 98.428098][ T9] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 96 [ 98.438291][ T9] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 98.448191][ T9] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 98.466866][ T9] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 98.476258][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 98.485320][ T9] usb 4-1: SerialNumber: syz [ 98.491214][ T1605] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 98.498471][ T1605] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 98.507433][ T9] hub 4-1:1.0: bad descriptor, ignoring hub [ 98.519321][ T9] hub 4-1:1.0: probe with driver hub failed with error -5 [ 98.707927][ T1605] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 98.722632][ T1605] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 98.859202][ T1626] rust_binder: 1625:1626 failed copying remainder into alloc: EFAULT [ 98.867522][ T1626] rust_binder: Failure in copy_transaction_data: EFAULT [ 98.867558][ T1626] rust_binder: 1625:1626 transaction async to 1625:0 failed EFAULT, code 0 size 104-24 [ 98.885363][ T310] rust_binder: 1625: undelivered TRANSACTION_ERROR: 29201 [ 99.080412][ T45] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 99.139481][ T9] cdc_ether 4-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.3-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 99.230386][ T45] usb 3-1: Using ep0 maxpacket: 16 [ 99.236646][ T45] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 99.247622][ T45] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 99.257513][ T45] usb 3-1: config 0 interface 0 has no altsetting 0 [ 99.264160][ T45] usb 3-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 99.273307][ T45] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 99.290390][ T311] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 99.298325][ T45] usb 3-1: config 0 descriptor?? [ 99.450394][ T311] usb 1-1: Using ep0 maxpacket: 32 [ 99.659672][ T1632] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 99.669255][ T1632] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 99.680700][ T311] usb 1-1: unable to get BOS descriptor or descriptor too short [ 99.690203][ T311] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 99.698165][ T311] usb 1-1: can't read configurations, error -71 [ 99.716481][ T45] hid (null): invalid report_count 44433 [ 99.720905][ T1639] rust_binder: 1604:1639 BC_FREEZE_NOTIFICATION_DONE 0000006002820509 not found [ 99.722223][ T45] hid (null): global environment stack underflow [ 99.737970][ T45] hid (null): unknown global tag 0xe [ 99.740378][ T1639] rust_binder: Write failure EINVAL in pid:311 [ 99.743546][ T45] hid (null): report_id 838359145 is invalid [ 99.757073][ T45] hid (null): unknown global tag 0x76 [ 99.762711][ T45] hid (null): bogus close delimiter [ 99.770157][ T45] hid (null): unknown global tag 0xd [ 99.775875][ T45] hid (null): unknown global tag 0xe [ 99.781484][ T45] hid (null): invalid report_count 1945039578 [ 99.915951][ T310] usb 3-1: USB disconnect, device number 16 [ 100.203126][ T1644] FAULT_INJECTION: forcing a failure. [ 100.203126][ T1644] name failslab, interval 1, probability 0, space 0, times 0 [ 100.215816][ T1644] CPU: 0 UID: 0 PID: 1644 Comm: syz.0.416 Not tainted syzkaller #0 01d0fef691542fecbcfb5551c0a705324fcaa78c [ 100.215849][ T1644] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 100.215862][ T1644] Call Trace: [ 100.215869][ T1644] [ 100.215877][ T1644] __dump_stack+0x21/0x30 [ 100.215900][ T1644] dump_stack_lvl+0x140/0x1c0 [ 100.215914][ T1644] ? __cfi_dump_stack_lvl+0x10/0x10 [ 100.215929][ T1644] ? __kasan_check_write+0x18/0x20 [ 100.215941][ T1644] ? mutex_unlock+0x90/0x240 [ 100.215955][ T1644] dump_stack+0x19/0x20 [ 100.215968][ T1644] should_fail_ex+0x3c2/0x510 [ 100.215982][ T1644] should_failslab+0xac/0x100 [ 100.215995][ T1644] kmem_cache_alloc_noprof+0x42/0x410 [ 100.216006][ T1644] ? getname_flags+0xcc/0x6b0 [ 100.216018][ T1644] ? __cfi_ksys_write+0x10/0x10 [ 100.216029][ T1644] ? __se_sys_chdir+0x1ad/0x280 [ 100.216042][ T1644] getname_flags+0xcc/0x6b0 [ 100.216054][ T1644] __x64_sys_rmdir+0x3e/0x60 [ 100.216069][ T1644] x64_sys_call+0xaf7/0x2ee0 [ 100.216079][ T1644] do_syscall_64+0x57/0xf0 [ 100.216088][ T1644] ? clear_bhb_loop+0x50/0xa0 [ 100.216102][ T1644] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 100.216114][ T1644] RIP: 0033:0x7f428f39e159 [ 100.216124][ T1644] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 100.216135][ T1644] RSP: 002b:00007f429025f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 100.216147][ T1644] RAX: ffffffffffffffda RBX: 00007f428f625fa0 RCX: 00007f428f39e159 [ 100.216156][ T1644] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000080 [ 100.216163][ T1644] RBP: 00007f429025f090 R08: 0000000000000000 R09: 0000000000000000 [ 100.216170][ T1644] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 100.216177][ T1644] R13: 00007f428f626038 R14: 00007f428f625fa0 R15: 00007fff2f6a72d8 [ 100.216186][ T1644] [ 100.622987][ T36] audit: type=1400 audit(1789040988.060:324): avc: denied { append } for pid=1651 comm="syz.2.419" name="uprobe_events" dev="tracefs" ino=1055 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 100.880397][ T670] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 101.020451][ T45] usb 4-1: USB disconnect, device number 25 [ 101.027126][ T45] cdc_ether 4-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.3-1, CDC Ethernet Device [ 101.037110][ T670] usb 3-1: Using ep0 maxpacket: 32 [ 101.044196][ T670] usb 3-1: unable to get BOS descriptor or descriptor too short [ 101.056091][ T670] usb 3-1: config 1 interface 0 altsetting 9 bulk endpoint 0x82 has invalid maxpacket 8 [ 101.076210][ T670] usb 3-1: config 1 interface 0 altsetting 9 endpoint 0x3 has invalid maxpacket 8186, setting to 1024 [ 101.090508][ T670] usb 3-1: config 1 interface 0 altsetting 9 bulk endpoint 0x3 has invalid maxpacket 1024 [ 101.101715][ T670] usb 3-1: config 1 interface 0 altsetting 9 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 101.118152][ T670] usb 3-1: config 1 interface 0 has no altsetting 0 [ 101.126742][ T670] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 101.139546][ T670] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 101.152796][ T670] usb 3-1: Product: ꭠ粨ᩢ媿⮵獓ܬ櫁⎱ᑵ䖯䕃ﰷﰛ๕ꔖ쟢ⴇ萬颢㋝຿놖饝ꝣ깔〱ᓟꗏﺯ䟩∶㔉῀蛮ߋ嘬즓꯴ᮺ鸷䎚熭⽡ෆѤ舝痲⌰쎬恸昧훵岴㪺鑘ꈋ᛭ꄥ氜槨꛿ៅ윻⦟냦麐ﵢ绊碢ꪙ㹈趩ퟆᓦ횎襢咯㜣ﭻ箍悍订ⶲ揺踐᪔됂鋊⇞僚畑瀄砕멟룛 [ 101.210383][ T670] usb 3-1: Manufacturer: 촫臩⍇쥋촛ᙸឝꠥᨪᨦ䘕ᩓ⨠쮆듎䨊볠脮鋜鞿퓨闄饊ﯲʙｊ襝ꃟ캟ꡨ扌禤聝錜ヴꭸĩﺷ㙥됛뿬뺊狹㖗硍៑⌤紃⍗筚꼮듡胏⽵º‷귗臵訝㬈ྞꌘ탞츐⡼ᔦꆚ豊띬䍗廀僟 [ 101.255182][ T670] usb 3-1: SerialNumber: ﳿ [ 101.263658][ T1652] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 101.273700][ T1652] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 101.487750][ T670] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -71 [ 101.507787][ T670] usb 3-1: USB disconnect, device number 17 [ 101.600389][ T310] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 101.760373][ T310] usb 1-1: Using ep0 maxpacket: 32 [ 101.973968][ T1669] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 101.983218][ T1669] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 102.005073][ T310] usb 1-1: unable to get BOS descriptor or descriptor too short [ 102.018432][ T310] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 102.026560][ T310] usb 1-1: can't read configurations, error -71 [ 102.230426][ T670] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 102.250437][ T566] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 102.381464][ T670] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 102.392341][ T670] usb 2-1: New USB device found, idVendor=046d, idProduct=c222, bcdDevice= 0.00 [ 102.401414][ T566] usb 3-1: Using ep0 maxpacket: 16 [ 102.406613][ T670] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.415472][ T566] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 102.420376][ T9] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 102.426436][ T566] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 102.444375][ T566] usb 3-1: config 0 interface 0 has no altsetting 0 [ 102.451052][ T566] usb 3-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 102.460092][ T566] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.468711][ T566] usb 3-1: config 0 descriptor?? [ 102.580417][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 102.586656][ T9] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 102.597591][ T9] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 96 [ 102.607543][ T9] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 102.617221][ T9] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 102.630889][ T9] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 102.640044][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 102.648305][ T9] usb 4-1: SerialNumber: syz [ 102.654218][ T1677] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 102.661672][ T1677] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 102.670101][ T9] hub 4-1:1.0: bad descriptor, ignoring hub [ 102.677004][ T9] hub 4-1:1.0: probe with driver hub failed with error -5 [ 102.686390][ T670] usbhid 2-1:1.0: can't add hid device: -71 [ 102.692424][ T670] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 102.701388][ T670] usb 2-1: USB disconnect, device number 25 [ 102.869994][ T1677] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 102.877261][ T1677] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 102.886347][ T566] hid (null): invalid report_count 44433 [ 102.892094][ T566] hid (null): global environment stack underflow [ 102.898447][ T566] hid (null): unknown global tag 0xe [ 102.903839][ T566] hid (null): report_id 838359145 is invalid [ 102.909835][ T566] hid (null): unknown global tag 0x76 [ 102.915288][ T566] hid (null): bogus close delimiter [ 102.922077][ T566] hid (null): unknown global tag 0xd [ 102.927408][ T566] hid (null): unknown global tag 0xe [ 102.932729][ T566] hid (null): invalid report_count 1945039578 [ 103.086762][ T670] usb 3-1: USB disconnect, device number 18 [ 103.287397][ T9] cdc_ether 4-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.3-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 103.615404][ T36] audit: type=1400 audit(1789040991.050:325): avc: denied { setcurrent } for pid=1699 comm="syz.2.435" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 103.660392][ T36] audit: type=1401 audit(1789040991.050:326): op=security_bounded_transition seresult=denied oldcontext=root:sysadm_r:sysadm_t newcontext=system_u:object_r:hugetlbfs_t [ 103.810397][ T9] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 103.861000][ T1705] rust_binder: 1676:1705 BC_FREEZE_NOTIFICATION_DONE 0000006002820509 not found [ 103.876735][ T1705] rust_binder: Write failure EINVAL in pid:325 [ 103.980363][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 104.011448][ T9] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 104.030357][ T9] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 104.050258][ T9] usb 1-1: config 0 interface 0 has no altsetting 0 [ 104.056936][ T9] usb 1-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 104.076213][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 104.091348][ T9] usb 1-1: config 0 descriptor?? [ 104.310648][ T9] usbhid 1-1:0.0: can't add hid device: -71 [ 104.324986][ T9] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 104.337047][ T9] usb 1-1: USB disconnect, device number 31 [ 104.569119][ T36] audit: type=1400 audit(1789040992.000:327): avc: denied { read } for pid=1708 comm="syz.2.438" name="kmsg" dev="proc" ino=4026532040 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_kmsg_t tclass=file permissive=1 [ 104.591570][ T566] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 104.591730][ T36] audit: type=1400 audit(1789040992.000:328): avc: denied { open } for pid=1708 comm="syz.2.438" path="/101/proc/kmsg" dev="proc" ino=4026532040 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_kmsg_t tclass=file permissive=1 [ 104.622683][ T36] audit: type=1400 audit(1789040992.010:329): avc: denied { map } for pid=1708 comm="syz.2.438" path="pipe:[2334]" dev="pipefs" ino=2334 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 104.690400][ T9] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 104.750375][ T566] usb 2-1: Using ep0 maxpacket: 32 [ 104.820386][ T9] usb 1-1: device descriptor read/64, error -71 [ 104.957815][ T1707] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 104.966440][ T1707] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 104.970383][ T65] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 104.975825][ T566] usb 2-1: unable to get BOS descriptor or descriptor too short [ 104.990066][ T566] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 104.997682][ T566] usb 2-1: can't read configurations, error -71 [ 105.070400][ T9] usb 1-1: device descriptor read/64, error -71 [ 105.130443][ T65] usb 3-1: Using ep0 maxpacket: 8 [ 105.136542][ T65] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 105.146675][ T65] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 105.155690][ T65] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 105.166691][ T65] usb 3-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 105.175784][ T65] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 105.183931][ T65] usb 3-1: Product: syz [ 105.188273][ T65] usb 3-1: Manufacturer: syz [ 105.192995][ T65] usb 3-1: SerialNumber: syz [ 105.310410][ T9] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 105.340482][ T310] usb 4-1: USB disconnect, device number 26 [ 105.346822][ T310] cdc_ether 4-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.3-1, CDC Ethernet Device [ 105.440456][ T9] usb 1-1: device descriptor read/64, error -71 [ 105.600485][ T1715] tipc: Enabling of bearer rejected, media not registered [ 105.663929][ T1731] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 105.672886][ T1731] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 105.680754][ T9] usb 1-1: device descriptor read/64, error -71 [ 105.683148][ T1731] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 105.696488][ T1731] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 105.710377][ T311] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 105.790495][ T9] usb usb1-port1: attempt power cycle [ 105.860376][ T311] usb 4-1: Using ep0 maxpacket: 16 [ 105.870475][ T311] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 105.882298][ T311] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 105.892269][ T311] usb 4-1: config 0 interface 0 has no altsetting 0 [ 105.899015][ T311] usb 4-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 105.908570][ T311] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.920436][ T65] usb 3-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 105.922471][ T311] usb 4-1: config 0 descriptor?? [ 105.929051][ T65] usb 3-1: clock source 0 is not valid, cannot use [ 105.940361][ T65] usb 3-1: 1:1: cannot get freq (v2/v3): err -71 [ 105.950510][ T65] usb 3-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 105.965325][ T65] usb 3-1: USB disconnect, device number 19 [ 105.971853][ T323] udevd[323]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 106.130392][ T9] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 106.161508][ T9] usb 1-1: device descriptor read/8, error -71 [ 106.291441][ T9] usb 1-1: device descriptor read/8, error -71 [ 106.357822][ T311] hid (null): invalid report_count 44433 [ 106.363625][ T311] hid (null): global environment stack underflow [ 106.370876][ T311] hid (null): unknown global tag 0xe [ 106.376214][ T311] hid (null): report_id 838359145 is invalid [ 106.382242][ T311] hid (null): unknown global tag 0x76 [ 106.387648][ T311] hid (null): bogus close delimiter [ 106.395021][ T311] hid (null): unknown global tag 0xd [ 106.400371][ T311] hid (null): unknown global tag 0xe [ 106.405738][ T311] hid (null): invalid report_count 1945039578 [ 106.530372][ T9] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 106.554482][ T9] usb 1-1: device descriptor read/8, error -71 [ 106.563877][ T65] usb 4-1: USB disconnect, device number 27 [ 106.700942][ T9] usb 1-1: device descriptor read/8, error -71 [ 106.810477][ T9] usb usb1-port1: unable to enumerate USB device [ 106.880383][ T311] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 107.040373][ T311] usb 2-1: Using ep0 maxpacket: 16 [ 107.046876][ T311] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 107.057951][ T311] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 96 [ 107.067918][ T311] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 107.083141][ T311] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 107.099488][ T311] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 107.110092][ T311] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 107.118180][ T311] usb 2-1: SerialNumber: syz [ 107.120382][ T9] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 107.136809][ T1746] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 107.146100][ T1746] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 107.155195][ T311] hub 2-1:1.0: bad descriptor, ignoring hub [ 107.161286][ T311] hub 2-1:1.0: probe with driver hub failed with error -5 [ 107.280372][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 107.291382][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 141, changing to 11 [ 107.306224][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 107.320685][ T9] usb 1-1: New USB device found, idVendor=2179, idProduct=0053, bcdDevice= 0.00 [ 107.329899][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 107.345085][ T9] usb 1-1: config 0 descriptor?? [ 107.358439][ T1746] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 107.369579][ T1746] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 107.610389][ T566] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 107.754366][ T9] usbhid 1-1:0.0: can't add hid device: -71 [ 107.760754][ T9] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 107.770703][ T566] usb 4-1: Using ep0 maxpacket: 32 [ 107.771106][ T9] usb 1-1: USB disconnect, device number 36 [ 107.786455][ T311] cdc_ether 2-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.1-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 107.999825][ T1753] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 108.009680][ T1753] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 108.020225][ T566] usb 4-1: unable to get BOS descriptor or descriptor too short [ 108.029575][ T566] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 108.037455][ T566] usb 4-1: can't read configurations, error -71 [ 108.350743][ T1782] rust_binder: 1745:1782 BC_FREEZE_NOTIFICATION_DONE 0000006002820509 not found [ 108.360266][ T1782] rust_binder: Write failure EINVAL in pid:351 [ 108.375819][ T1765] cgroup: fork rejected by pids controller in /syz0 [ 108.880406][ T670] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 109.040438][ T670] usb 3-1: Using ep0 maxpacket: 16 [ 109.046733][ T670] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 109.057920][ T670] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 109.067883][ T670] usb 3-1: config 0 interface 0 has no altsetting 0 [ 109.074693][ T670] usb 3-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 109.083922][ T670] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 109.100707][ T670] usb 3-1: config 0 descriptor?? [ 109.522560][ T670] hid (null): invalid report_count 44433 [ 109.528249][ T670] hid (null): global environment stack underflow [ 109.534793][ T670] hid (null): unknown global tag 0xe [ 109.540132][ T670] hid (null): report_id 838359145 is invalid [ 109.546450][ T670] hid (null): unknown global tag 0x76 [ 109.552710][ T670] hid (null): bogus close delimiter [ 109.560044][ T670] hid (null): unknown global tag 0xd [ 109.565661][ T670] hid (null): unknown global tag 0xe [ 109.571141][ T670] hid (null): invalid report_count 1945039578 [ 109.714053][ T310] usb 3-1: USB disconnect, device number 20 [ 109.800509][ T65] usb 2-1: USB disconnect, device number 28 [ 109.809435][ T65] cdc_ether 2-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.1-1, CDC Ethernet Device [ 109.840368][ T9] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 110.020352][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 110.234130][ T1831] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 110.258669][ T1831] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 110.268504][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 110.282334][ T9] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 110.296334][ T9] usb 4-1: can't read configurations, error -71 [ 110.565872][ T36] audit: type=1400 audit(1789040998.000:330): avc: denied { bind } for pid=1853 comm="syz.0.474" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 110.900378][ T310] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 111.060381][ T310] usb 2-1: Using ep0 maxpacket: 16 [ 111.070256][ T310] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 111.090412][ T310] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 96 [ 111.110378][ T310] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 111.122430][ T65] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 111.140475][ T310] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 111.161475][ T310] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 111.180381][ T310] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 111.193921][ T310] usb 2-1: SerialNumber: syz [ 111.205510][ T1860] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 111.214920][ T1860] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 111.232231][ T310] hub 2-1:1.0: bad descriptor, ignoring hub [ 111.249238][ T310] hub 2-1:1.0: probe with driver hub failed with error -5 [ 111.310360][ T65] usb 3-1: Using ep0 maxpacket: 16 [ 111.317776][ T65] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 111.328838][ T65] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 111.348732][ T65] usb 3-1: config 0 interface 0 has no altsetting 0 [ 111.360368][ T65] usb 3-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 111.379696][ T65] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.400783][ T65] usb 3-1: config 0 descriptor?? [ 111.431408][ T1860] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 111.455259][ T1860] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 111.792699][ T36] audit: type=1400 audit(1789040999.230:331): avc: denied { read } for pid=1877 comm="syz.0.483" path="socket:[34829]" dev="sockfs" ino=34829 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 111.829175][ T65] hid (null): invalid report_count 44433 [ 111.836011][ T65] hid (null): global environment stack underflow [ 111.842682][ T65] hid (null): unknown global tag 0xe [ 111.848210][ T65] hid (null): report_id 838359145 is invalid [ 111.854596][ T65] hid (null): unknown global tag 0x76 [ 111.860060][ T65] hid (null): bogus close delimiter [ 111.867899][ T65] hid (null): unknown global tag 0xd [ 111.873280][ T65] hid (null): unknown global tag 0xe [ 111.880393][ T310] cdc_ether 2-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.1-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 111.891946][ T65] hid (null): invalid report_count 1945039578 [ 112.020634][ T65] usb 3-1: USB disconnect, device number 21 [ 112.450906][ T1884] rust_binder: 1859:1884 BC_FREEZE_NOTIFICATION_DONE 0000006002820509 not found [ 112.460122][ T1884] rust_binder: Write failure EINVAL in pid:358 [ 112.790831][ T65] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 112.870404][ T310] usb 1-1: new full-speed USB device number 37 using dummy_hcd [ 112.950469][ T65] usb 3-1: Using ep0 maxpacket: 32 [ 113.041571][ T310] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 113.054619][ T310] usb 1-1: New USB device found, idVendor=0458, idProduct=5005, bcdDevice= 0.00 [ 113.064020][ T310] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 113.074598][ T310] usb 1-1: config 0 descriptor?? [ 113.159663][ T1887] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 113.169557][ T1887] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 113.178957][ T65] usb 3-1: unable to get BOS descriptor or descriptor too short [ 113.190734][ T65] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 113.198437][ T65] usb 3-1: can't read configurations, error -71 [ 113.490908][ T310] input: HID 0458:5005 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0458:5005.0017/input/input11 [ 113.505759][ T310] input: HID 0458:5005 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0458:5005.0017/input/input12 [ 113.523532][ T310] kye 0003:0458:5005.0017: input,hiddev96,hidraw0: USB HID v7f.fd Device [HID 0458:5005] on usb-dummy_hcd.0-1/input0 [ 113.552924][ T1896] fido_id[1896]: Failed to get parent HID device: No such file or directory [ 113.734980][ T1889] kvm: pic: non byte write [ 113.770991][ T36] audit: type=1400 audit(1789041001.210:332): avc: denied { map } for pid=1907 comm="syz.3.492" path="/dev/bus/usb/006/001" dev="devtmpfs" ino=111 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 113.771478][ T1908] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 113.806838][ T1908] capability: warning: `syz.3.492' uses 32-bit capabilities (legacy support in use) [ 113.825504][ T45] usb 2-1: USB disconnect, device number 29 [ 113.836265][ T45] cdc_ether 2-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.1-1, CDC Ethernet Device [ 113.896388][ T36] audit: type=1400 audit(1789041001.330:333): avc: denied { create } for pid=1907 comm="syz.3.492" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 114.250409][ T65] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 114.260553][ T45] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 114.410385][ T65] usb 3-1: Using ep0 maxpacket: 16 [ 114.416704][ T65] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 114.427697][ T65] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 114.431033][ T45] usb 2-1: Using ep0 maxpacket: 32 [ 114.437507][ T65] usb 3-1: config 0 interface 0 has no altsetting 0 [ 114.449209][ T65] usb 3-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 114.459741][ T65] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 114.470255][ T65] usb 3-1: config 0 descriptor?? [ 114.660454][ T1925] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 114.670085][ T1925] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 114.679118][ T45] usb 2-1: unable to get BOS descriptor or descriptor too short [ 114.690004][ T45] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 114.697872][ T45] usb 2-1: can't read configurations, error -71 [ 114.888762][ T65] hid (null): invalid report_count 44433 [ 114.894479][ T65] hid (null): global environment stack underflow [ 114.900853][ T65] hid (null): unknown global tag 0xe [ 114.906205][ T65] hid (null): report_id 838359145 is invalid [ 114.912234][ T65] hid (null): unknown global tag 0x76 [ 114.917635][ T65] hid (null): bogus close delimiter [ 114.925822][ T65] hid (null): unknown global tag 0xd [ 114.931203][ T65] hid (null): unknown global tag 0xe [ 114.936622][ T65] hid (null): invalid report_count 1945039578 [ 115.087076][ T65] usb 3-1: USB disconnect, device number 23 [ 115.290416][ T670] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 115.440461][ T670] usb 4-1: Using ep0 maxpacket: 16 [ 115.447101][ T670] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 115.458654][ T670] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 96 [ 115.468811][ T670] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 115.478808][ T670] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 115.493595][ T670] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 115.502726][ T670] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 115.511083][ T670] usb 4-1: SerialNumber: syz [ 115.516933][ T1933] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 115.524308][ T1933] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 115.532238][ T670] hub 4-1:1.0: bad descriptor, ignoring hub [ 115.538336][ T670] hub 4-1:1.0: probe with driver hub failed with error -5 [ 115.575628][ T1944] kvm: kvm [1943]: vcpu2, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x7 [ 115.584172][ T1944] kvm: kvm [1943]: vcpu2, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x7 [ 115.702537][ T45] usb 1-1: USB disconnect, device number 37 [ 115.732702][ T1933] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 115.739892][ T1933] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 115.796571][ T36] audit: type=1400 audit(1789041003.230:334): avc: denied { mounton } for pid=1957 comm="syz.2.509" path="/118/tracing" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 116.070410][ T65] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 116.150900][ T670] cdc_ether 4-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.3-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 116.220373][ T65] usb 3-1: Using ep0 maxpacket: 32 [ 116.290378][ T45] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 116.429359][ T1961] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 116.439091][ T1961] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 116.448138][ T65] usb 3-1: unable to get BOS descriptor or descriptor too short [ 116.456487][ T65] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 116.460363][ T45] usb 2-1: Using ep0 maxpacket: 16 [ 116.464121][ T65] usb 3-1: can't read configurations, error -71 [ 116.481463][ T45] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 116.492555][ T45] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 116.502347][ T45] usb 2-1: config 0 interface 0 has no altsetting 0 [ 116.509112][ T45] usb 2-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 116.518220][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 116.527686][ T45] usb 2-1: config 0 descriptor?? [ 116.632434][ T1974] futex_wake_op: syz.0.515 tries to shift op by 144; fix this program [ 116.726277][ T1975] rust_binder: 1932:1975 BC_FREEZE_NOTIFICATION_DONE 0000006002820509 not found [ 116.736045][ T1975] rust_binder: Write failure EINVAL in pid:386 [ 116.742900][ T1979] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 116.757738][ T1979] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 116.851094][ T36] audit: type=1400 audit(1789041004.290:335): avc: denied { ioctl } for pid=1977 comm="syz.0.516" path="net:[4026532299]" dev="nsfs" ino=4026532299 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 116.941780][ T45] hid (null): invalid report_count 44433 [ 116.947526][ T45] hid (null): global environment stack underflow [ 116.953894][ T45] hid (null): unknown global tag 0xe [ 116.959302][ T45] hid (null): report_id 838359145 is invalid [ 116.962547][ T36] audit: type=1400 audit(1789041004.390:336): avc: denied { getopt } for pid=1981 comm="syz.2.517" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 116.965337][ T45] hid (null): unknown global tag 0x76 [ 116.990162][ T45] hid (null): bogus close delimiter [ 116.996643][ T45] hid (null): unknown global tag 0xd [ 117.002196][ T45] hid (null): unknown global tag 0xe [ 117.007669][ T45] hid (null): invalid report_count 1945039578 [ 117.144454][ T9] usb 2-1: USB disconnect, device number 32 [ 118.175528][ T2007] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 118.188749][ T670] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 118.200387][ T2007] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 118.350363][ T670] usb 2-1: Using ep0 maxpacket: 32 [ 118.393651][ T36] audit: type=1400 audit(1789041005.830:337): avc: denied { ioctl } for pid=2008 comm="syz.0.527" path="socket:[36710]" dev="sockfs" ino=36710 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 118.418328][ T45] usb 4-1: reset high-speed USB device number 32 using dummy_hcd [ 118.426729][ T45] usb 4-1: device reset changed ep0 maxpacket size! [ 118.433957][ T45] usb 4-1: USB disconnect, device number 32 [ 118.441117][ T45] cdc_ether 4-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.3-1, CDC Ethernet Device [ 118.559681][ T2005] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 118.568502][ T2005] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 118.580906][ T670] usb 2-1: unable to get BOS descriptor or descriptor too short [ 118.589486][ T670] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 118.597380][ T670] usb 2-1: can't read configurations, error -71 [ 118.790569][ T45] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 118.941729][ T45] usb 4-1: unable to get BOS descriptor or descriptor too short [ 118.950246][ T45] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 1536, setting to 1024 [ 118.962676][ T45] usb 4-1: New USB device found, idVendor=2a39, idProduct=3fd2, bcdDevice= 0.40 [ 118.971790][ T45] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 118.979766][ T45] usb 4-1: Product: syz [ 118.984033][ T45] usb 4-1: Manufacturer: syz [ 118.988623][ T45] usb 4-1: SerialNumber: syz [ 119.050383][ T311] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 119.178756][ T36] audit: type=1400 audit(1789041006.610:338): avc: denied { setopt } for pid=2015 comm="syz.0.530" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 119.180809][ T2016] binder: Bad value for 'stats' [ 119.198169][ T36] audit: type=1400 audit(1789041006.610:339): avc: denied { bind } for pid=2015 comm="syz.0.530" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 119.215191][ T2007] netlink: 40 bytes leftover after parsing attributes in process `syz.3.526'. [ 119.222321][ T36] audit: type=1400 audit(1789041006.620:340): avc: denied { getopt } for pid=2015 comm="syz.0.530" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 119.231055][ T311] usb 3-1: Using ep0 maxpacket: 32 [ 119.250159][ T36] audit: type=1400 audit(1789041006.620:341): avc: denied { mounton } for pid=2015 comm="syz.0.530" path="/dev/binderfs" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 119.262117][ T2007] netlink: 40 bytes leftover after parsing attributes in process `syz.3.526'. [ 119.287796][ T36] audit: type=1400 audit(1789041006.730:342): avc: denied { listen } for pid=2006 comm="syz.3.526" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 119.312964][ T311] usb 3-1: config 0 has an invalid interface number: 196 but max is 0 [ 119.321213][ T311] usb 3-1: config 0 has no interface number 0 [ 119.327328][ T311] usb 3-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 119.337341][ T311] usb 3-1: config 0 interface 196 has no altsetting 0 [ 119.345979][ T311] usb 3-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 119.355097][ T311] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 119.364463][ T311] usb 3-1: Product: syz [ 119.368698][ T311] usb 3-1: Manufacturer: syz [ 119.373328][ T311] usb 3-1: SerialNumber: syz [ 119.379705][ T45] usb 4-1: unit 3 not found! [ 119.384658][ T311] usb 3-1: config 0 descriptor?? [ 119.391352][ T2012] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 119.404526][ T45] usb 4-1: USB disconnect, device number 33 [ 119.440401][ T670] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 119.482214][ T323] udevd[323]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 119.600387][ T670] usb 2-1: Using ep0 maxpacket: 16 [ 119.607974][ T670] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 119.619944][ T670] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 119.632244][ T670] usb 2-1: config 0 interface 0 has no altsetting 0 [ 119.638970][ T670] usb 2-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 119.651805][ T670] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 119.659975][ T2030] kvm: requested 16761 ns i8254 timer period limited to 200000 ns [ 119.662724][ T670] usb 2-1: config 0 descriptor?? [ 119.668267][ T2030] kvm: requested 162590 ns i8254 timer period limited to 200000 ns [ 119.681230][ T2030] kvm: requested 108952 ns i8254 timer period limited to 200000 ns [ 119.689602][ T2030] kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 119.700724][ T2030] kvm: requested 18438 ns i8254 timer period limited to 200000 ns [ 120.000387][ T9] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 120.008740][ T36] audit: type=1326 audit(1789041007.440:343): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2011 comm="syz.2.528" exe="/root/ci2-android-6-12-rust/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f5cddf9e159 code=0x0 [ 120.060401][ T311] ipheth 3-1:0.196: ipheth_enable_ncm: usb_control_msg: 0 [ 120.075160][ T311] ipheth 3-1:0.196: Apple iPhone USB Ethernet device attached [ 120.097461][ T670] hid (null): invalid report_count 44433 [ 120.103164][ T670] hid (null): global environment stack underflow [ 120.109501][ T670] hid (null): unknown global tag 0xe [ 120.114906][ T670] hid (null): report_id 838359145 is invalid [ 120.121107][ T670] hid (null): unknown global tag 0x76 [ 120.126508][ T670] hid (null): bogus close delimiter [ 120.133934][ T670] hid (null): unknown global tag 0xd [ 120.139251][ T670] hid (null): unknown global tag 0xe [ 120.144584][ T670] hid (null): invalid report_count 1945039578 [ 120.190364][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 120.196974][ T9] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 120.208043][ T9] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 96 [ 120.217934][ T9] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 120.227752][ T9] usb 1-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 120.241666][ T9] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 120.251071][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 120.259123][ T9] usb 1-1: SerialNumber: syz [ 120.270858][ T2035] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 120.278164][ T2035] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 120.280846][ T2040] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 120.291777][ T65] usb 2-1: USB disconnect, device number 34 [ 120.296136][ T2040] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 120.299911][ T9] hub 1-1:1.0: bad descriptor, ignoring hub [ 120.315866][ T9] hub 1-1:1.0: probe with driver hub failed with error -5 [ 120.508468][ T2035] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 120.515783][ T2035] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 120.516216][ T2040] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 120.532952][ T2040] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 120.543473][ T2040] SELinux: policydb table sizes (0,0) do not match mine (8,7) [ 120.551087][ T2040] SELinux: failed to load policy [ 120.934804][ T9] cdc_ether 1-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.0-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 121.010387][ T670] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 121.170364][ T670] usb 4-1: Using ep0 maxpacket: 32 [ 121.379977][ T2042] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 121.389715][ T2042] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 121.399857][ T670] usb 4-1: unable to get BOS descriptor or descriptor too short [ 121.409893][ T670] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 121.417784][ T670] usb 4-1: can't read configurations, error -71 [ 121.501078][ T2047] rust_binder: 2034:2047 BC_FREEZE_NOTIFICATION_DONE 0000006002820509 not found [ 121.510163][ T2047] rust_binder: Write failure EINVAL in pid:510 [ 121.722255][ T36] audit: type=1400 audit(1789041009.160:344): avc: denied { read } for pid=2049 comm="syz.1.539" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 121.812813][ T9] usb 3-1: USB disconnect, device number 26 [ 121.870553][ T9] ipheth 3-1:0.196: Apple iPhone USB Ethernet now disconnected [ 122.180376][ T9] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 122.330363][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 122.336708][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 122.347723][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 122.357582][ T9] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 122.366714][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 122.376235][ T9] usb 3-1: config 0 descriptor?? [ 122.386243][ T9] hub 3-1:0.0: USB hub found [ 122.585110][ T9] hub 3-1:0.0: 1 port detected [ 122.940568][ T670] usb 1-1: USB disconnect, device number 39 [ 122.947313][ T670] cdc_ether 1-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.0-1, CDC Ethernet Device [ 123.050384][ T311] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 123.190370][ T310] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 123.210369][ T311] usb 4-1: Using ep0 maxpacket: 16 [ 123.216641][ T311] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 123.227830][ T311] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 123.237805][ T311] usb 4-1: config 0 interface 0 has no altsetting 0 [ 123.238537][ T9] hub 3-1:0.0: activate --> -90 [ 123.244663][ T311] usb 4-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 123.258519][ T311] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 123.267478][ T311] usb 4-1: config 0 descriptor?? [ 123.370387][ T310] usb 2-1: Using ep0 maxpacket: 8 [ 123.376644][ T310] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 123.387104][ T310] usb 2-1: New USB device found, idVendor=2833, idProduct=0201, bcdDevice=2a.d1 [ 123.396388][ T310] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 123.410656][ T310] usb 2-1: config 0 descriptor?? [ 123.619770][ T566] usb 2-1: USB disconnect, device number 35 [ 123.640335][ T670] usb 3-1: USB disconnect, device number 27 [ 123.686597][ T311] hid (null): invalid report_count 44433 [ 123.692424][ T311] hid (null): global environment stack underflow [ 123.698801][ T311] hid (null): unknown global tag 0xe [ 123.704540][ T311] hid (null): report_id 838359145 is invalid [ 123.710730][ T311] hid (null): unknown global tag 0x76 [ 123.716279][ T311] hid (null): bogus close delimiter [ 123.724103][ T311] hid (null): unknown global tag 0xd [ 123.729601][ T311] hid (null): unknown global tag 0xe [ 123.735117][ T311] hid (null): invalid report_count 1945039578 [ 123.887131][ T311] usb 4-1: USB disconnect, device number 36 [ 124.470500][ T670] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 124.640375][ T670] usb 3-1: Using ep0 maxpacket: 32 [ 124.854265][ T2086] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 124.863697][ T2086] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 124.872895][ T670] usb 3-1: unable to get BOS descriptor or descriptor too short [ 124.881196][ T670] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 124.888799][ T670] usb 3-1: can't read configurations, error -71 [ 125.040399][ T9] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 125.190354][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 125.202877][ T9] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 125.220434][ T9] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 96 [ 125.231547][ T9] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 125.243064][ T9] usb 1-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 125.261695][ T9] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 125.270955][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 125.279035][ T9] usb 1-1: SerialNumber: syz [ 125.292216][ T2101] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 125.300652][ T2101] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 125.320580][ T9] hub 1-1:1.0: bad descriptor, ignoring hub [ 125.327394][ T9] hub 1-1:1.0: probe with driver hub failed with error -5 [ 125.396119][ T2107] netlink: 9 bytes leftover after parsing attributes in process `syz.2.559'. [ 125.425657][ T2107] gretap0: entered promiscuous mode [ 125.456238][ T2107] netlink: 5 bytes leftover after parsing attributes in process `syz.2.559'. [ 125.478650][ T2107] 0{X: renamed from gretap0 [ 125.489249][ T2107] 0{X: left promiscuous mode [ 125.494478][ T2107] 0{X: entered allmulticast mode [ 125.500754][ T2107] A link change request failed with some changes committed already. Interface 30{X may have been left with an inconsistent configuration, please check. [ 125.520805][ T2101] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 125.530475][ T2101] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 125.555745][ T2112] incfs_lookup_dentry err:-13 [ 125.688846][ T36] audit: type=1400 audit(1789041013.120:345): avc: denied { read } for pid=2117 comm="syz.3.563" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 125.713952][ T36] audit: type=1400 audit(1789041013.150:346): avc: denied { mounton } for pid=2117 comm="syz.3.563" path="/134/proc" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=dir permissive=1 [ 125.736760][ T2118] MTRR 1 not used [ 125.741148][ T36] audit: type=1400 audit(1789041013.180:347): avc: denied { append } for pid=2117 comm="syz.3.563" name="mtrr" dev="proc" ino=4026532004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 125.940385][ T670] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 125.960368][ T65] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 125.974040][ T9] cdc_ether 1-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.0-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 126.100384][ T670] usb 3-1: Using ep0 maxpacket: 16 [ 126.106839][ T670] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 126.118561][ T670] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 126.129641][ T670] usb 3-1: config 0 interface 0 has no altsetting 0 [ 126.136291][ T670] usb 3-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 126.145386][ T670] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 126.154197][ T670] usb 3-1: config 0 descriptor?? [ 126.252323][ T2123] fuse: Bad value for 'fd' [ 126.258661][ T36] audit: type=1400 audit(1789041013.690:348): avc: denied { watch } for pid=2122 comm="syz.1.565" path="/147/file0" dev="tmpfs" ino=796 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 126.305304][ T36] audit: type=1400 audit(1789041013.740:349): avc: denied { write } for pid=2124 comm="syz.1.566" name="/" dev="incremental-fs" ino=803 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 126.334108][ T36] audit: type=1400 audit(1789041013.770:350): avc: denied { bind } for pid=2128 comm="syz.1.568" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 126.335650][ T2129] tipc: Failed to remove unknown binding: 66,0,0/0:3130347289/3130347291 [ 126.361766][ T2129] tipc: Failed to remove unknown binding: 66,0,0/0:3130347289/3130347290 [ 126.374383][ T2129] tipc: Failed to remove unknown binding: 66,0,0/0:3130347289/3130347291 [ 126.382873][ T2129] tipc: Failed to remove unknown binding: 66,0,0/0:3130347289/3130347290 [ 126.540938][ T2134] rust_binder: 2100:2134 BC_FREEZE_NOTIFICATION_DONE 0000006002820509 not found [ 126.550074][ T2134] rust_binder: Write failure EINVAL in pid:524 [ 126.579843][ T670] hid (null): invalid report_count 44433 [ 126.592003][ T670] hid (null): global environment stack underflow [ 126.598505][ T670] hid (null): unknown global tag 0xe [ 126.603999][ T670] hid (null): report_id 838359145 is invalid [ 126.610053][ T670] hid (null): unknown global tag 0x76 [ 126.615629][ T670] hid (null): bogus close delimiter [ 126.623110][ T670] hid (null): unknown global tag 0xd [ 126.628682][ T670] hid (null): unknown global tag 0xe [ 126.630560][ T65] usb 4-1: device descriptor read/64, error -71 [ 126.634140][ T670] hid (null): invalid report_count 1945039578 [ 126.784034][ T670] usb 3-1: USB disconnect, device number 29 [ 126.920360][ T65] usb 4-1: Using ep0 maxpacket: 32 [ 127.129470][ T2127] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 127.138212][ T2127] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 127.148173][ T65] usb 4-1: unable to get BOS descriptor or descriptor too short [ 127.156463][ T65] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 127.164331][ T65] usb 4-1: can't read configurations, error -71 [ 127.294026][ T36] audit: type=1326 audit(1789041014.730:351): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2136 comm="syz.1.570" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7aa3b9e159 code=0x7ffc0000 [ 127.308111][ T2137] loop8: detected capacity change from 0 to 16384 [ 127.319482][ T36] audit: type=1326 audit(1789041014.730:352): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2136 comm="syz.1.570" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7aa3b9e159 code=0x7ffc0000 [ 127.355040][ T36] audit: type=1326 audit(1789041014.730:353): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2136 comm="syz.1.570" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7aa3b9e159 code=0x7ffc0000 [ 127.380243][ T36] audit: type=1326 audit(1789041014.730:354): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2136 comm="syz.1.570" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7aa3b9e159 code=0x7ffc0000 [ 127.408907][ T36] audit: type=1326 audit(1789041014.730:355): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2136 comm="syz.1.570" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f7aa3b9e159 code=0x7ffc0000 [ 127.434292][ T36] audit: type=1326 audit(1789041014.730:356): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2136 comm="syz.1.570" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7aa3b9e159 code=0x7ffc0000 [ 127.434739][ T2137] loop8: detected capacity change from 16384 to 16383 [ 127.459701][ T36] audit: type=1326 audit(1789041014.730:357): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2136 comm="syz.1.570" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7aa3b9e159 code=0x7ffc0000 [ 127.491470][ T36] audit: type=1326 audit(1789041014.730:358): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2136 comm="syz.1.570" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7aa3b9e159 code=0x7ffc0000 [ 127.520502][ T36] audit: type=1326 audit(1789041014.730:359): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2136 comm="syz.1.570" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7aa3b9e159 code=0x7ffc0000 [ 127.546470][ T36] audit: type=1326 audit(1789041014.730:360): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2136 comm="syz.1.570" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f7aa3b9e159 code=0x7ffc0000 [ 127.960486][ T45] usb 1-1: USB disconnect, device number 40 [ 127.967290][ T45] cdc_ether 1-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.0-1, CDC Ethernet Device [ 128.000356][ T65] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 128.160366][ T65] usb 4-1: Using ep0 maxpacket: 32 [ 128.373219][ T2154] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 128.391189][ T2154] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 128.436135][ T65] usb 4-1: unable to get BOS descriptor or descriptor too short [ 128.450913][ T65] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 128.468688][ T65] usb 4-1: can't read configurations, error -71 [ 128.482963][ T65] usb usb4-port1: attempt power cycle [ 128.618144][ T2167] FAULT_INJECTION: forcing a failure. [ 128.618144][ T2167] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 128.631489][ T2167] CPU: 0 UID: 0 PID: 2167 Comm: syz.2.580 Not tainted syzkaller #0 01d0fef691542fecbcfb5551c0a705324fcaa78c [ 128.631525][ T2167] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 128.631538][ T2167] Call Trace: [ 128.631545][ T2167] [ 128.631553][ T2167] __dump_stack+0x21/0x30 [ 128.631586][ T2167] dump_stack_lvl+0x140/0x1c0 [ 128.631613][ T2167] ? __cfi_dump_stack_lvl+0x10/0x10 [ 128.631641][ T2167] ? vsnprintf+0x7b4/0x1ad0 [ 128.631669][ T2167] ? check_stack_object+0x10f/0x150 [ 128.631692][ T2167] dump_stack+0x19/0x20 [ 128.631726][ T2167] should_fail_ex+0x3c2/0x510 [ 128.631751][ T2167] should_fail+0xf/0x20 [ 128.631773][ T2167] should_fail_usercopy+0x1e/0x30 [ 128.631798][ T2167] _copy_from_user+0x20/0xa0 [ 128.631826][ T2167] kstrtouint_from_user+0xde/0x170 [ 128.631850][ T2167] ? __cfi_kstrtouint_from_user+0x10/0x10 [ 128.631874][ T2167] ? selinux_file_permission+0x318/0xb60 [ 128.631896][ T2167] ? __cfi_selinux_file_permission+0x10/0x10 [ 128.631919][ T2167] proc_fail_nth_write+0x8f/0x220 [ 128.631947][ T2167] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 128.631977][ T2167] ? bpf_lsm_file_permission+0xd/0x20 [ 128.632004][ T2167] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 128.632031][ T2167] vfs_write+0x3c4/0xfd0 [ 128.632054][ T2167] ? __cfi_vfs_write+0x10/0x10 [ 128.632074][ T2167] ? __kasan_check_write+0x18/0x20 [ 128.632096][ T2167] ? mutex_lock+0x97/0x1d0 [ 128.632117][ T2167] ? __cfi_mutex_lock+0x10/0x10 [ 128.632142][ T2167] ksys_write+0x145/0x260 [ 128.632163][ T2167] ? xfd_validate_state+0x68/0x140 [ 128.632190][ T2167] ? __cfi_ksys_write+0x10/0x10 [ 128.632211][ T2167] ? __kasan_check_read+0x15/0x20 [ 128.632232][ T2167] __x64_sys_write+0x7f/0x90 [ 128.632253][ T2167] x64_sys_call+0x271c/0x2ee0 [ 128.632272][ T2167] do_syscall_64+0x57/0xf0 [ 128.632291][ T2167] ? clear_bhb_loop+0x50/0xa0 [ 128.632315][ T2167] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 128.632338][ T2167] RIP: 0033:0x7f5cddf5e98e [ 128.632355][ T2167] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 128.632375][ T2167] RSP: 002b:00007f5cdef12fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 128.632397][ T2167] RAX: ffffffffffffffda RBX: 00007f5cdef136c0 RCX: 00007f5cddf5e98e [ 128.632413][ T2167] RDX: 0000000000000001 RSI: 00007f5cdef130a0 RDI: 0000000000000005 [ 128.632428][ T2167] RBP: 00007f5cdef13090 R08: 0000000000000000 R09: 0000000000000000 [ 128.632441][ T2167] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 128.632454][ T2167] R13: 00007f5cde226128 R14: 00007f5cde226090 R15: 00007ffd1cc93788 [ 128.632473][ T2167] [ 128.780367][ T45] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 129.050384][ T45] usb 2-1: Using ep0 maxpacket: 16 [ 129.056656][ T45] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 129.067602][ T45] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 129.077378][ T45] usb 2-1: config 0 interface 0 has no altsetting 0 [ 129.084016][ T45] usb 2-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 129.093079][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 129.102003][ T45] usb 2-1: config 0 descriptor?? [ 129.350364][ T311] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 129.500380][ T311] usb 1-1: Using ep0 maxpacket: 32 [ 129.524903][ T45] hid (null): invalid report_count 44433 [ 129.530582][ T45] hid (null): global environment stack underflow [ 129.536904][ T45] hid (null): unknown global tag 0xe [ 129.540379][ T65] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 129.542247][ T45] hid (null): report_id 838359145 is invalid [ 129.555807][ T45] hid (null): unknown global tag 0x76 [ 129.561225][ T45] hid (null): bogus close delimiter [ 129.567685][ T45] hid (null): unknown global tag 0xd [ 129.570803][ T65] usb 4-1: Using ep0 maxpacket: 16 [ 129.573052][ T45] hid (null): unknown global tag 0xe [ 129.579200][ T65] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 129.583386][ T45] hid (null): invalid report_count 1945039578 [ 129.600356][ T65] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 96 [ 129.610176][ T65] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 129.619835][ T65] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 129.633532][ T65] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 129.642612][ T65] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 129.650656][ T65] usb 4-1: SerialNumber: syz [ 129.656143][ T2176] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 129.663376][ T2176] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 129.671066][ T65] hub 4-1:1.0: bad descriptor, ignoring hub [ 129.677011][ T65] hub 4-1:1.0: probe with driver hub failed with error -5 [ 129.707790][ T2171] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 129.716359][ T2171] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 129.725953][ T311] usb 1-1: unable to get BOS descriptor or descriptor too short [ 129.734972][ T310] usb 2-1: USB disconnect, device number 36 [ 129.735254][ T311] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 129.748571][ T311] usb 1-1: can't read configurations, error -71 [ 129.871263][ T2176] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 129.878497][ T2176] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 130.293848][ T65] cdc_ether 4-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.3-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 130.881987][ T2191] rust_binder: 2175:2191 BC_FREEZE_NOTIFICATION_DONE 0000006002820509 not found [ 130.900511][ T2191] rust_binder: Write failure EINVAL in pid:429 [ 131.710391][ T65] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 131.870454][ T65] usb 2-1: Using ep0 maxpacket: 32 [ 131.940415][ T310] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 132.080219][ T2206] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 132.089223][ T2206] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 132.100294][ T65] usb 2-1: unable to get BOS descriptor or descriptor too short [ 132.108060][ T310] usb 3-1: Using ep0 maxpacket: 16 [ 132.115025][ T65] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 132.123086][ T65] usb 2-1: can't read configurations, error -71 [ 132.129623][ T310] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 132.140972][ T310] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 132.150869][ T310] usb 3-1: config 0 interface 0 has no altsetting 0 [ 132.158586][ T310] usb 3-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 132.168154][ T310] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 132.179414][ T310] usb 3-1: config 0 descriptor?? [ 132.305850][ T36] kauditd_printk_skb: 123 callbacks suppressed [ 132.305866][ T36] audit: type=1400 audit(1789041019.740:484): avc: denied { write } for pid=2213 comm="syz.3.597" name="binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 132.306798][ T2214] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 132.334832][ T2214] rust_binder: Read failure Err(EFAULT) in pid:433 [ 132.370526][ T435] usb 4-1: USB disconnect, device number 39 [ 132.383442][ T435] cdc_ether 4-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.3-1, CDC Ethernet Device [ 132.459443][ T2220] audit: audit_lost=2 audit_rate_limit=0 audit_backlog_limit=64 [ 132.467139][ T2220] audit: out of memory in audit_log_start [ 132.599169][ T310] hid (null): invalid report_count 44433 [ 132.604871][ T310] hid (null): global environment stack underflow [ 132.611244][ T310] hid (null): unknown global tag 0xe [ 132.616655][ T310] hid (null): report_id 838359145 is invalid [ 132.622695][ T310] hid (null): unknown global tag 0x76 [ 132.628196][ T310] hid (null): bogus close delimiter [ 132.635771][ T310] hid (null): unknown global tag 0xd [ 132.642362][ T310] hid (null): unknown global tag 0xe [ 132.647671][ T310] hid (null): invalid report_count 1945039578 [ 132.720395][ T435] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 132.799061][ T310] usb 3-1: USB disconnect, device number 30 [ 132.870355][ T435] usb 1-1: Using ep0 maxpacket: 32 [ 132.876753][ T435] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 132.888045][ T435] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 132.898392][ T435] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 132.907751][ T435] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 132.920629][ T435] usb 1-1: config 0 descriptor?? [ 132.932482][ T435] hub 1-1:0.0: USB hub found [ 133.128593][ T435] hub 1-1:0.0: config failed, can't read hub descriptor (err -90) [ 133.348770][ T2222] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 133.363065][ T2222] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 133.410365][ T65] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 133.432726][ T435] usbhid 1-1:0.0: can't add hid device: -71 [ 133.443573][ T435] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 133.492310][ T435] usb 1-1: USB disconnect, device number 43 [ 133.514872][ T2244] FAULT_INJECTION: forcing a failure. [ 133.514872][ T2244] name failslab, interval 1, probability 0, space 0, times 0 [ 133.529699][ T2244] CPU: 0 UID: 0 PID: 2244 Comm: syz.2.608 Not tainted syzkaller #0 01d0fef691542fecbcfb5551c0a705324fcaa78c [ 133.529733][ T2244] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 133.529747][ T2244] Call Trace: [ 133.529754][ T2244] [ 133.529763][ T2244] __dump_stack+0x21/0x30 [ 133.529797][ T2244] dump_stack_lvl+0x140/0x1c0 [ 133.529824][ T2244] ? __cfi_dump_stack_lvl+0x10/0x10 [ 133.529864][ T2244] dump_stack+0x19/0x20 [ 133.529891][ T2244] should_fail_ex+0x3c2/0x510 [ 133.529916][ T2244] should_failslab+0xac/0x100 [ 133.529942][ T2244] __kmalloc_cache_noprof+0x41/0x470 [ 133.529964][ T2244] ? binderfs_init_fs_context+0x62/0x1c0 [ 133.529994][ T2244] ? __cfi_lockref_get+0x10/0x10 [ 133.530027][ T2244] binderfs_init_fs_context+0x62/0x1c0 [ 133.530051][ T2244] ? __cfi_binderfs_init_fs_context+0x10/0x10 [ 133.530077][ T2244] alloc_fs_context+0x5c7/0x800 [ 133.530104][ T2244] fs_context_for_reconfigure+0x77/0x90 [ 133.530132][ T2244] path_mount+0xb52/0xff0 [ 133.530153][ T2244] __se_sys_mount+0x2bf/0x480 [ 133.530175][ T2244] ? ksys_write+0x1f3/0x260 [ 133.530196][ T2244] ? __x64_sys_mount+0xf0/0xf0 [ 133.530220][ T2244] __x64_sys_mount+0xc3/0xf0 [ 133.530241][ T2244] x64_sys_call+0x2021/0x2ee0 [ 133.530260][ T2244] do_syscall_64+0x57/0xf0 [ 133.530279][ T2244] ? clear_bhb_loop+0x50/0xa0 [ 133.530303][ T2244] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 133.530322][ T2244] RIP: 0033:0x7f5cddf9e159 [ 133.530338][ T2244] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 133.530356][ T2244] RSP: 002b:00007f5cdef34028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 133.530380][ T2244] RAX: ffffffffffffffda RBX: 00007f5cde225fa0 RCX: 00007f5cddf9e159 [ 133.530396][ T2244] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000000 [ 133.530410][ T2244] RBP: 00007f5cdef34090 R08: 0000200000000000 R09: 0000000000000000 [ 133.530424][ T2244] R10: 0000000002030063 R11: 0000000000000246 R12: 0000000000000001 [ 133.530438][ T2244] R13: 00007f5cde226038 R14: 00007f5cde225fa0 R15: 00007ffd1cc93788 [ 133.530454][ T2244] [ 133.760358][ T65] usb 4-1: Using ep0 maxpacket: 16 [ 133.766838][ T65] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 133.777983][ T65] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 96 [ 133.788024][ T65] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 133.797714][ T65] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 133.818777][ T65] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 133.827968][ T65] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 133.836049][ T65] usb 4-1: SerialNumber: syz [ 133.846768][ T2235] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 133.854397][ T2235] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 133.862623][ T65] hub 4-1:1.0: bad descriptor, ignoring hub [ 133.868539][ T65] hub 4-1:1.0: probe with driver hub failed with error -5 [ 133.966190][ T2254] MTRR 1 not used [ 133.990385][ T311] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 134.062944][ T2235] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 134.070138][ T2235] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 134.140368][ T311] usb 3-1: Using ep0 maxpacket: 32 [ 134.170400][ T670] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 134.331416][ T670] usb 1-1: config 1 has an invalid interface number: 7 but max is 2 [ 134.339483][ T670] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 134.349690][ T670] usb 1-1: config 1 has no interface number 2 [ 134.351107][ T2246] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 134.355923][ T670] usb 1-1: too many endpoints for config 1 interface 7 altsetting 1: 255, using maximum allowed: 30 [ 134.364685][ T2246] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 134.375219][ T670] usb 1-1: config 1 interface 7 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 134.392470][ T670] usb 1-1: config 1 interface 7 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 134.405504][ T670] usb 1-1: config 1 interface 7 has no altsetting 0 [ 134.412349][ T311] usb 3-1: unable to get BOS descriptor or descriptor too short [ 134.421040][ T311] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 134.428693][ T311] usb 3-1: can't read configurations, error -71 [ 134.435286][ T670] usb 1-1: New USB device found, idVendor=1235, idProduct=8210, bcdDevice= 0.40 [ 134.444433][ T670] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 134.452426][ T670] usb 1-1: Product: syz [ 134.456579][ T670] usb 1-1: Manufacturer: syz [ 134.461182][ T670] usb 1-1: SerialNumber: syz [ 134.480109][ T65] cdc_ether 4-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.3-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 134.672084][ T670] usb 1-1: Focusrite Scarlett Gen 3 Mixer Driver enabled (pid=0x8210); report any issues to https://github.com/geoffreybennett/scarlett-gen2/issues [ 134.688904][ T670] usb 1-1: Error initialising Scarlett Gen 3 Mixer Driver: -71 [ 134.698042][ T670] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 134.698255][ T323] udevd[323]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 134.709898][ T670] usb 1-1: USB disconnect, device number 44 [ 134.789146][ T2256] FAULT_INJECTION: forcing a failure. [ 134.789146][ T2256] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 134.802364][ T2256] CPU: 1 UID: 0 PID: 2256 Comm: syz.1.613 Not tainted syzkaller #0 01d0fef691542fecbcfb5551c0a705324fcaa78c [ 134.802397][ T2256] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 134.802409][ T2256] Call Trace: [ 134.802418][ T2256] [ 134.802426][ T2256] __dump_stack+0x21/0x30 [ 134.802448][ T2256] dump_stack_lvl+0x140/0x1c0 [ 134.802463][ T2256] ? __cfi_dump_stack_lvl+0x10/0x10 [ 134.802478][ T2256] ? proc_fail_nth_write+0x184/0x220 [ 134.802494][ T2256] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 134.802517][ T2256] dump_stack+0x19/0x20 [ 134.802531][ T2256] should_fail_ex+0x3c2/0x510 [ 134.802544][ T2256] should_fail+0xf/0x20 [ 134.802555][ T2256] should_fail_usercopy+0x1e/0x30 [ 134.802569][ T2256] _copy_from_user+0x20/0xa0 [ 134.802584][ T2256] proc_ioctl_default+0x97/0x120 [ 134.802596][ T2256] ? proc_releaseinterface+0x4f0/0x4f0 [ 134.802607][ T2256] ? __kasan_check_write+0x18/0x20 [ 134.802619][ T2256] ? mutex_unlock+0x90/0x240 [ 134.802632][ T2256] usbdev_ioctl+0x1395/0x2120 [ 134.802643][ T2256] ? __cfi_usbdev_ioctl+0x10/0x10 [ 134.802653][ T2256] ? __fget_files+0x2bc/0x330 [ 134.802666][ T2256] ? bpf_lsm_file_ioctl+0xd/0x20 [ 134.802680][ T2256] ? security_file_ioctl+0x3e/0x110 [ 134.802691][ T2256] ? __cfi_usbdev_ioctl+0x10/0x10 [ 134.802700][ T2256] __se_sys_ioctl+0x126/0x1b0 [ 134.802715][ T2256] __x64_sys_ioctl+0x7f/0xa0 [ 134.802727][ T2256] x64_sys_call+0x1878/0x2ee0 [ 134.802737][ T2256] do_syscall_64+0x57/0xf0 [ 134.802746][ T2256] ? clear_bhb_loop+0x50/0xa0 [ 134.802759][ T2256] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 134.802771][ T2256] RIP: 0033:0x7f7aa3b9e159 [ 134.802782][ T2256] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 134.802791][ T2256] RSP: 002b:00007f7aa4b39028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 134.802804][ T2256] RAX: ffffffffffffffda RBX: 00007f7aa3e25fa0 RCX: 00007f7aa3b9e159 [ 134.802812][ T2256] RDX: 0000200000000200 RSI: 00000000c0105512 RDI: 0000000000000003 [ 134.802820][ T2256] RBP: 00007f7aa4b39090 R08: 0000000000000000 R09: 0000000000000000 [ 134.802827][ T2256] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 134.802833][ T2256] R13: 00007f7aa3e26038 R14: 00007f7aa3e25fa0 R15: 00007ffdc8eba8e8 [ 134.802842][ T2256] [ 135.060846][ T2259] rust_binder: 2234:2259 BC_FREEZE_NOTIFICATION_DONE 0000006002820509 not found [ 135.069986][ T2259] rust_binder: Write failure EINVAL in pid:435 [ 135.160374][ T9] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 135.162764][ T36] audit: type=1400 audit(1789041022.600:485): avc: denied { open } for pid=2262 comm="syz.2.616" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=42470 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 135.310358][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 135.316566][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 135.327582][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 135.337344][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 135.343968][ T9] usb 2-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 135.353023][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 135.361519][ T9] usb 2-1: config 0 descriptor?? [ 135.455079][ T36] audit: type=1326 audit(1789041022.890:486): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2267 comm="syz.0.617" exe="/root/ci2-android-6-12-rust/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f428f39e159 code=0x0 [ 135.774153][ T9] hid (null): invalid report_count 44433 [ 135.779825][ T9] hid (null): global environment stack underflow [ 135.786212][ T9] hid (null): unknown global tag 0xe [ 135.791541][ T9] hid (null): report_id 838359145 is invalid [ 135.797507][ T9] hid (null): unknown global tag 0x76 [ 135.802916][ T9] hid (null): bogus close delimiter [ 135.809397][ T9] hid (null): unknown global tag 0xd [ 135.814724][ T9] hid (null): unknown global tag 0xe [ 135.820005][ T9] hid (null): invalid report_count 1945039578 [ 135.971959][ T9] usb 2-1: USB disconnect, device number 39 [ 136.320790][ T9] usb 4-1: USB disconnect, device number 40 [ 136.336794][ T9] cdc_ether 4-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.3-1, CDC Ethernet Device [ 136.346581][ T36] audit: type=1400 audit(1789041023.780:487): avc: denied { append } for pid=2280 comm="syz.0.621" name="snapshot" dev="devtmpfs" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 136.487418][ T36] audit: type=1400 audit(1789041023.920:488): avc: denied { bind } for pid=2286 comm="syz.0.624" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 136.730358][ T9] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 136.780365][ T435] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 136.901136][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 136.922529][ T435] usb 1-1: device descriptor read/64, error -71 [ 137.123927][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 137.133874][ T9] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 137.141547][ T9] usb 4-1: can't read configurations, error -71 [ 137.170376][ T435] usb 1-1: device descriptor read/64, error -71 [ 137.240375][ T65] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 137.390450][ T65] usb 3-1: Using ep0 maxpacket: 16 [ 137.396753][ T65] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 137.407661][ T65] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 96 [ 137.417535][ T435] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 137.425402][ T65] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 137.437140][ T65] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 137.450914][ T65] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 137.460079][ T65] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 137.468168][ T65] usb 3-1: SerialNumber: syz [ 137.473855][ T2298] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 137.481214][ T2298] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 137.489921][ T65] hub 3-1:1.0: bad descriptor, ignoring hub [ 137.495958][ T65] hub 3-1:1.0: probe with driver hub failed with error -5 [ 137.540924][ T2303] input: syz1 as /devices/virtual/input/input14 [ 137.548617][ T36] audit: type=1400 audit(1789041024.980:489): avc: denied { append } for pid=2302 comm="syz.1.631" name="event3" dev="devtmpfs" ino=659 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 137.581621][ T36] audit: type=1400 audit(1789041025.020:490): avc: denied { mounton } for pid=2304 comm="syz.1.632" path="/170/mysys/devices/platform/dummy_hcd.1/usb2/2-0:1.0/usb2-port1/disable" dev="sysfs" ino=13413 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=file permissive=1 [ 137.609575][ T435] usb 1-1: device descriptor read/64, error -71 [ 137.616233][ T2307] overlayfs: conflicting options: metacopy=on,redirect_dir=nofollow [ 137.624919][ T2307] binder: Unknown parameter 'statR' [ 137.631801][ T2307] netlink: 100 bytes leftover after parsing attributes in process `syz.1.633'. [ 137.643113][ T2307] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 137.657602][ T2307] overlayfs: fs on './file0' does not support file handles, falling back to xino=off. [ 137.696562][ T2298] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 137.704195][ T2298] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 137.870361][ T435] usb 1-1: device descriptor read/64, error -71 [ 137.970362][ T9] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 137.980660][ T435] usb usb1-port1: attempt power cycle [ 138.117359][ T65] cdc_ether 3-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.2-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 138.140356][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 138.146707][ T9] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 138.158491][ T9] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 138.168558][ T9] usb 4-1: config 0 interface 0 has no altsetting 0 [ 138.175352][ T9] usb 4-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 138.184808][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 138.195545][ T9] usb 4-1: config 0 descriptor?? [ 138.330383][ T435] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 138.361447][ T435] usb 1-1: device descriptor read/8, error -71 [ 138.501420][ T435] usb 1-1: device descriptor read/8, error -71 [ 138.609390][ T9] hid (null): invalid report_count 44433 [ 138.615184][ T9] hid (null): global environment stack underflow [ 138.621868][ T9] hid (null): unknown global tag 0xe [ 138.627172][ T9] hid (null): report_id 838359145 is invalid [ 138.633731][ T9] hid (null): unknown global tag 0x76 [ 138.639120][ T9] hid (null): bogus close delimiter [ 138.646428][ T9] hid (null): unknown global tag 0xd [ 138.651788][ T9] hid (null): unknown global tag 0xe [ 138.657082][ T9] hid (null): invalid report_count 1945039578 [ 138.660167][ T36] audit: type=1400 audit(1789041026.090:491): avc: denied { bind } for pid=2316 comm="syz.1.637" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 138.685545][ T36] audit: type=1400 audit(1789041026.090:492): avc: denied { setopt } for pid=2316 comm="syz.1.637" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 138.710501][ T2318] rust_binder: 2297:2318 BC_FREEZE_NOTIFICATION_DONE 0000006002820509 not found [ 138.719654][ T2318] rust_binder: Write failure EINVAL in pid:434 [ 138.760374][ T435] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 138.791442][ T435] usb 1-1: device descriptor read/8, error -71 [ 138.808549][ T9] usb 4-1: USB disconnect, device number 42 [ 138.921484][ T435] usb 1-1: device descriptor read/8, error -71 [ 139.031790][ T435] usb usb1-port1: unable to enumerate USB device [ 139.427873][ T36] audit: type=1400 audit(1789041026.860:493): avc: denied { ioctl } for pid=2330 comm="syz.3.641" path="socket:[43306]" dev="sockfs" ino=43306 ioctlcmd=0x8916 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 139.599217][ T36] audit: type=1400 audit(1789041027.030:494): avc: denied { mounton } for pid=2334 comm="syz.1.643" path="/176/file0" dev="ramfs" ino=44090 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=dir permissive=1 [ 139.624550][ T36] audit: type=1400 audit(1789041027.060:495): avc: denied { checkpoint_restore } for pid=2334 comm="syz.1.643" capability=40 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 139.648525][ T36] audit: type=1400 audit(1789041027.090:496): avc: denied { unmount } for pid=296 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 139.700448][ T435] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 139.850404][ T435] usb 4-1: Using ep0 maxpacket: 16 [ 139.856979][ T435] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 139.867120][ T435] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 139.877730][ T435] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 139.886834][ T435] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 139.894837][ T435] usb 4-1: Product: syz [ 139.899101][ T435] usb 4-1: Manufacturer: syz [ 139.903757][ T435] usb 4-1: SerialNumber: syz [ 139.930361][ T10] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 140.080368][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 140.130445][ T9] usb 3-1: USB disconnect, device number 33 [ 140.136791][ T9] cdc_ether 3-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.2-1, CDC Ethernet Device [ 140.219265][ T36] audit: type=1400 audit(1789041027.650:497): avc: denied { audit_read } for pid=2344 comm="syz.2.647" capability=37 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 140.288068][ T10] usb 1-1: unable to get BOS descriptor or descriptor too short [ 140.300648][ T10] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 140.308249][ T10] usb 1-1: can't read configurations, error -71 [ 140.351681][ T435] usb 4-1: cannot find UAC_HEADER [ 140.357934][ T323] udevd[323]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 140.373958][ T323] udevd[323]: setting owner of /dev/snd/controlC0 to uid=0, gid=29 failed: No such file or directory [ 140.374408][ T435] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 140.395350][ T435] usb 4-1: USB disconnect, device number 43 [ 140.910408][ T435] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 141.060395][ T435] usb 3-1: Using ep0 maxpacket: 16 [ 141.066718][ T435] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 141.077645][ T435] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 141.087405][ T435] usb 3-1: config 0 interface 0 has no altsetting 0 [ 141.094121][ T435] usb 3-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 141.103545][ T435] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 141.112155][ T435] usb 3-1: config 0 descriptor?? [ 141.524517][ T435] hid (null): invalid report_count 44433 [ 141.530191][ T435] hid (null): global environment stack underflow [ 141.536576][ T435] hid (null): unknown global tag 0xe [ 141.540422][ T670] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 141.541957][ T435] hid (null): report_id 838359145 is invalid [ 141.555444][ T435] hid (null): unknown global tag 0x76 [ 141.560865][ T435] hid (null): bogus close delimiter [ 141.567182][ T435] hid (null): unknown global tag 0xd [ 141.572521][ T435] hid (null): unknown global tag 0xe [ 141.577815][ T435] hid (null): invalid report_count 1945039578 [ 141.690407][ T670] usb 4-1: Using ep0 maxpacket: 16 [ 141.696686][ T670] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 141.706802][ T670] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 141.719701][ T670] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 141.726168][ T435] usb 3-1: USB disconnect, device number 34 [ 141.728776][ T670] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 141.743108][ T670] usb 4-1: config 0 descriptor?? [ 141.748831][ T670] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 142.304192][ T36] audit: type=1400 audit(1789041029.740:498): avc: denied { relabelfrom } for pid=2352 comm="syz.3.650" name="TCPv6" dev="sockfs" ino=43409 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 142.304200][ T2361] SELinux: Context system_u:object_r:devtty_t:s0 is not valid (left unmapped). [ 143.260379][ T435] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 143.390379][ T435] usb 3-1: device descriptor read/64, error -71 [ 143.630496][ T435] usb 3-1: device descriptor read/64, error -71 [ 143.870385][ T435] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 143.980377][ T670] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 144.010390][ T435] usb 3-1: device descriptor read/64, error -71 [ 144.131736][ T670] usb 1-1: unable to get BOS descriptor or descriptor too short [ 144.140243][ T670] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x8C has an invalid bInterval 109, changing to 10 [ 144.151487][ T670] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x8C has invalid wMaxPacketSize 0 [ 144.161290][ T670] usb 1-1: New USB device found, idVendor=ff35, idProduct=0007, bcdDevice= 0.00 [ 144.170389][ T670] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 144.250363][ T435] usb 3-1: device descriptor read/64, error -71 [ 144.291616][ T10] usb 4-1: USB disconnect, device number 44 [ 144.360528][ T435] usb usb3-port1: attempt power cycle [ 144.481355][ T670] usb 1-1: string descriptor 0 read error: -71 [ 144.488173][ T670] usb 1-1: MIDIStreaming interface descriptor not found [ 144.498589][ T323] udevd[323]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 144.515883][ T670] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -12 [ 144.525780][ T670] usb 1-1: USB disconnect, device number 51 [ 144.710432][ T435] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 144.731475][ T435] usb 3-1: device descriptor read/8, error -71 [ 144.861501][ T435] usb 3-1: device descriptor read/8, error -71 [ 145.110426][ T435] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 145.131428][ T435] usb 3-1: device descriptor read/8, error -71 [ 145.261381][ T435] usb 3-1: device descriptor read/8, error -71 [ 145.370518][ T435] usb usb3-port1: unable to enumerate USB device [ 146.110416][ T311] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 146.240376][ T10] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 146.270446][ T311] usb 1-1: Using ep0 maxpacket: 16 [ 146.276689][ T311] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 146.287616][ T311] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 96 [ 146.297492][ T311] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 146.307175][ T311] usb 1-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 146.320837][ T311] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 146.329873][ T311] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 146.337916][ T311] usb 1-1: SerialNumber: syz [ 146.343333][ T2379] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 146.350546][ T2379] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 146.358065][ T311] hub 1-1:1.0: bad descriptor, ignoring hub [ 146.364000][ T311] hub 1-1:1.0: probe with driver hub failed with error -5 [ 146.400369][ T10] usb 3-1: Using ep0 maxpacket: 32 [ 146.558568][ T2379] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 146.565834][ T2379] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 146.608601][ T10] usb 3-1: unable to get BOS descriptor or descriptor too short [ 146.616856][ T10] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 146.624444][ T10] usb 3-1: can't read configurations, error -71 [ 146.975592][ T311] cdc_ether 1-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.0-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 147.528880][ T2385] rust_binder: 2375:2385 BC_FREEZE_NOTIFICATION_DONE 0000006002820509 not found [ 147.537982][ T2385] rust_binder: Write failure EINVAL in pid:590 [ 148.640379][ T311] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 148.800393][ T311] usb 4-1: Using ep0 maxpacket: 16 [ 148.806595][ T311] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 148.817511][ T311] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 148.827268][ T311] usb 4-1: config 0 interface 0 has no altsetting 0 [ 148.833883][ T311] usb 4-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 148.842923][ T311] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 148.851463][ T311] usb 4-1: config 0 descriptor?? [ 149.031044][ T10] usb 1-1: USB disconnect, device number 52 [ 149.037545][ T10] cdc_ether 1-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.0-1, CDC Ethernet Device [ 149.263771][ T311] hid (null): invalid report_count 44433 [ 149.269425][ T311] hid (null): global environment stack underflow [ 149.275826][ T311] hid (null): unknown global tag 0xe [ 149.281146][ T311] hid (null): report_id 838359145 is invalid [ 149.287135][ T311] hid (null): unknown global tag 0x76 [ 149.292539][ T311] hid (null): bogus close delimiter [ 149.298879][ T311] hid (null): unknown global tag 0xd [ 149.304199][ T311] hid (null): unknown global tag 0xe [ 149.309475][ T311] hid (null): invalid report_count 1945039578 [ 149.461627][ T311] usb 4-1: USB disconnect, device number 45 [ 151.328679][ T36] kauditd_printk_skb: 1 callbacks suppressed [ 151.328697][ T36] audit: type=1400 audit(1789041038.760:500): avc: denied { audit_write } for pid=2401 comm="syz.0.663" capability=29 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 151.365042][ T36] audit: type=1107 audit(1789041038.790:501): pid=2401 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='' [ 151.394069][ T2406] loop2: detected capacity change from 0 to 7 [ 153.180405][ T670] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 153.330372][ T670] usb 1-1: Using ep0 maxpacket: 32 [ 153.537827][ T2417] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 153.546386][ T2417] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 153.555375][ T670] usb 1-1: unable to get BOS descriptor or descriptor too short [ 153.563542][ T670] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 153.571123][ T670] usb 1-1: can't read configurations, error -71 [ 154.900362][ T670] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 155.060368][ T670] usb 1-1: Using ep0 maxpacket: 16 [ 155.066489][ T670] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 155.077396][ T670] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 96 [ 155.087233][ T670] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 155.096933][ T670] usb 1-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 155.110578][ T670] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 155.119636][ T670] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 155.127678][ T670] usb 1-1: SerialNumber: syz [ 155.133196][ T2425] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 155.140430][ T2425] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 155.148025][ T670] hub 1-1:1.0: bad descriptor, ignoring hub [ 155.153967][ T670] hub 1-1:1.0: probe with driver hub failed with error -5 [ 155.348368][ T2425] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 155.355568][ T2425] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 155.765280][ T670] cdc_ether 1-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.0-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 156.318967][ T2434] rust_binder: 2422:2434 BC_FREEZE_NOTIFICATION_DONE 0000006002820509 not found [ 156.328083][ T2434] rust_binder: Write failure EINVAL in pid:602 [ 156.500394][ T2439] FAULT_INJECTION: forcing a failure. [ 156.500394][ T2439] name failslab, interval 1, probability 0, space 0, times 0 [ 156.519271][ T2439] CPU: 1 UID: 0 PID: 2439 Comm: syz.2.672 Not tainted syzkaller #0 01d0fef691542fecbcfb5551c0a705324fcaa78c [ 156.519294][ T2439] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 156.519303][ T2439] Call Trace: [ 156.519309][ T2439] [ 156.519315][ T2439] __dump_stack+0x21/0x30 [ 156.519335][ T2439] dump_stack_lvl+0x140/0x1c0 [ 156.519350][ T2439] ? __cfi_dump_stack_lvl+0x10/0x10 [ 156.519364][ T2439] ? avc_has_perm+0x155/0x240 [ 156.519378][ T2439] ? __cfi_avc_has_perm+0x10/0x10 [ 156.519391][ T2439] dump_stack+0x19/0x20 [ 156.519405][ T2439] should_fail_ex+0x3c2/0x510 [ 156.519418][ T2439] should_failslab+0xac/0x100 [ 156.519432][ T2439] __kmalloc_cache_noprof+0x41/0x470 [ 156.519445][ T2439] ? vhost_task_create+0x12c/0x3f0 [ 156.519457][ T2439] ? __cfi_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 156.519471][ T2439] vhost_task_create+0x12c/0x3f0 [ 156.519482][ T2439] ? __cfi_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 156.519495][ T2439] ? __cfi_vhost_task_create+0x10/0x10 [ 156.519507][ T2439] ? __cfi_vhost_task_fn+0x10/0x10 [ 156.519522][ T2439] ? __kasan_check_write+0x18/0x20 [ 156.519555][ T2439] ? mutex_lock+0x97/0x1d0 [ 156.519568][ T2439] ? __cfi_mutex_lock+0x10/0x10 [ 156.519579][ T2439] ? kernel_text_address+0xa9/0xe0 [ 156.519595][ T2439] kvm_mmu_post_init_vm+0x161/0x300 [ 156.519611][ T2439] kvm_arch_vcpu_ioctl_run+0xf3/0x1bc0 [ 156.519626][ T2439] ? _parse_integer_limit+0x195/0x1e0 [ 156.519639][ T2439] ? __cfi_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 156.519653][ T2439] ? kstrtoull+0x13b/0x1e0 [ 156.519665][ T2439] ? kstrtouint+0x78/0xf0 [ 156.519676][ T2439] ? ioctl_has_perm+0x1bc/0x500 [ 156.519688][ T2439] ? __asan_memcpy+0x5a/0x80 [ 156.519698][ T2439] ? ioctl_has_perm+0x408/0x500 [ 156.519709][ T2439] ? has_cap_mac_admin+0xd0/0xd0 [ 156.519721][ T2439] ? __kasan_check_write+0x18/0x20 [ 156.519731][ T2439] ? mutex_lock_killable+0x97/0x1d0 [ 156.519745][ T2439] ? __cfi_mutex_lock_killable+0x10/0x10 [ 156.519766][ T2439] ? proc_fail_nth_write+0x184/0x220 [ 156.519793][ T2439] kvm_vcpu_ioctl+0xa43/0x1000 [ 156.519806][ T2439] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 156.519816][ T2439] ? __cfi_vfs_write+0x10/0x10 [ 156.519828][ T2439] ? __kasan_check_write+0x18/0x20 [ 156.519839][ T2439] ? mutex_unlock+0x90/0x240 [ 156.519851][ T2439] ? __cfi_mutex_unlock+0x10/0x10 [ 156.519863][ T2439] ? __fget_files+0x2bc/0x330 [ 156.519877][ T2439] ? bpf_lsm_file_ioctl+0xd/0x20 [ 156.519891][ T2439] ? security_file_ioctl+0x3e/0x110 [ 156.519902][ T2439] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 156.519912][ T2439] __se_sys_ioctl+0x126/0x1b0 [ 156.519925][ T2439] __x64_sys_ioctl+0x7f/0xa0 [ 156.519938][ T2439] x64_sys_call+0x1878/0x2ee0 [ 156.519949][ T2439] do_syscall_64+0x57/0xf0 [ 156.519958][ T2439] ? clear_bhb_loop+0x50/0xa0 [ 156.519972][ T2439] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 156.519984][ T2439] RIP: 0033:0x7f5cddf9e159 [ 156.519994][ T2439] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 156.520004][ T2439] RSP: 002b:00007f5cdef34028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 156.520017][ T2439] RAX: ffffffffffffffda RBX: 00007f5cde225fa0 RCX: 00007f5cddf9e159 [ 156.520026][ T2439] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 156.520034][ T2439] RBP: 00007f5cdef34090 R08: 0000000000000000 R09: 0000000000000000 [ 156.520043][ T2439] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 156.520050][ T2439] R13: 00007f5cde226038 R14: 00007f5cde225fa0 R15: 00007ffd1cc93788 [ 156.520060][ T2439] [ 156.990358][ T670] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 157.140375][ T670] usb 4-1: Using ep0 maxpacket: 16 [ 157.146570][ T670] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 157.157474][ T670] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 157.167254][ T670] usb 4-1: config 0 interface 0 has no altsetting 0 [ 157.173895][ T670] usb 4-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 157.182962][ T670] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 157.191517][ T670] usb 4-1: config 0 descriptor?? [ 157.604651][ T670] hid (null): invalid report_count 44433 [ 157.610376][ T670] hid (null): global environment stack underflow [ 157.616728][ T670] hid (null): unknown global tag 0xe [ 157.622081][ T670] hid (null): report_id 838359145 is invalid [ 157.628059][ T670] hid (null): unknown global tag 0x76 [ 157.633470][ T670] hid (null): bogus close delimiter [ 157.639957][ T670] hid (null): unknown global tag 0xd [ 157.645305][ T670] hid (null): unknown global tag 0xe [ 157.650614][ T670] hid (null): invalid report_count 1945039578 [ 157.790481][ T10] usb 1-1: USB disconnect, device number 55 [ 157.796872][ T10] cdc_ether 1-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.0-1, CDC Ethernet Device [ 157.811086][ T670] usb 4-1: USB disconnect, device number 46 [ 158.388558][ T2445] Invalid ELF header type: 2 != 1 [ 158.391108][ T36] audit: type=1400 audit(1789041045.820:502): avc: denied { module_load } for pid=2442 comm="syz.0.674" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 158.406269][ T2446] mmap: syz.2.675 (2446) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 158.428505][ T2446] incfs: Backing dir is not set, filesystem can't be mounted. [ 158.436276][ T2446] incfs: mount failed -2 [ 158.630394][ T10] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 158.780406][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 158.987944][ T2447] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 158.996492][ T2447] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 159.005992][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 159.014249][ T10] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 159.021877][ T10] usb 4-1: can't read configurations, error -71 SYZFAIL: open of /sys/kernel/debug/kcov failed (errno 2: No such file or directory) SYZFAIL: open of /sys/kernel/debug/kcov failed (errno 2: No such file or directory) SYZFAIL: open of /sys/kernel/debug/kcov failed (errno 2: No such file or directory) SYZFAIL: open of /sys/kernel/debug/kcov failed (errno 2: No such file or directory) SYZFAIL: open of /sys/kernel/debug/kcov failed (errno 2: No such file or directory) SYZFAIL: open of /sys/kernel/debug/kcov failed (errno 2: No such file or directory) SYZFAIL: open of /sys/kernel/debug/kcov failed (errno 2: No such file or directory) SYZFAIL: open of /sys/kernel/debug/kcov failed (errno 2: No such file or directory) SYZFAIL: open of /sys/kernel/debug/kcov failed (errno 2: No such file or directory) SYZFAIL: open of /sys/kernel/debug/kcov failed (errno 2: No such file or directory) SYZFAIL: open of /sys/kernel/debug/kcov failed (errno 2: No such file or directory) SYZFAIL: open of /sys/kernel/debug/kcov failed (errno 2: No such file or directory) SYZFAIL: open of /sys/kernel/debug/kcov failed (errno 2: No such file or directory) SYZFAIL: open of /sys/kernel/debug/kcov failed (errno 2: No such file or directory) SYZFAIL: open of /sys/kernel/debug/kcov failed (errno 2: No such file or directory) SYZFAIL: open of /sys/kernel/debug/kcov failed (errno 2: No such file or directory) SYZFAIL: open of /sys/kernel/debug/kcov failed (errno 2: No such file or directory) SYZFAIL: open of /sys/kernel/debug/kcov failed (errno 2: No such file or directory) SYZFAIL: open of /sys/kernel/debug/kcov failed (errno 2: No such file or directory) SYZFAIL: open of /sys/kernel/debug/kcov failed (errno 2: No such file or directory) SYZFAIL: open of /sys/kernel/debug/kcov failed (errno 2: No such file or directory) SYZFAIL: repeatedly failed to execute the program proc=4 req=646 state=1 status=67 (errno 9: Bad file descriptor) [ 160.400126][ T36] audit: type=1400 audit(1789041047.830:503): avc: denied { write } for pid=287 comm="syz-executor" path="pipe:[2329]" dev="pipefs" ino=2329 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 160.564097][ T128] vlan0: left allmulticast mode [ 160.568986][ T128] veth0_vlan: left allmulticast mode [ 160.577340][ T128] vlan0: left promiscuous mode [ 160.590398][ T128] bridge0: port 3(vlan0) entered disabled state [ 160.598558][ T128] bridge_slave_1: left allmulticast mode [ 160.604302][ T128] bridge_slave_1: left promiscuous mode [ 160.620404][ T128] bridge0: port 2(bridge_slave_1) entered disabled state [ 160.639212][ T128] bridge_slave_0: left allmulticast mode [ 160.645045][ T128] bridge_slave_0: left promiscuous mode [ 160.650758][ T128] bridge0: port 1(bridge_slave_0) entered disabled state [ 160.732686][ T128] veth1_macvtap: left promiscuous mode [ 160.738221][ T128] veth0_vlan: left promiscuous mode [ 160.991884][ T128] bridge_slave_1: left allmulticast mode [ 160.997533][ T128] bridge_slave_1: left promiscuous mode [ 161.003190][ T128] bridge0: port 2(bridge_slave_1) entered disabled state [ 161.010665][ T128] bridge_slave_0: left allmulticast mode [ 161.016300][ T128] bridge_slave_0: left promiscuous mode [ 161.021992][ T128] bridge0: port 1(bridge_slave_0) entered disabled state [ 161.029541][ T128] bridge_slave_1: left allmulticast mode [ 161.035281][ T128] bridge_slave_1: left promiscuous mode [ 161.040911][ T128] bridge0: port 2(bridge_slave_1) entered disabled state [ 161.048292][ T128] bridge_slave_0: left allmulticast mode [ 161.054032][ T128] bridge_slave_0: left promiscuous mode [ 161.059797][ T128] bridge0: port 1(bridge_slave_0) entered disabled state [ 161.204170][ T128] veth1_macvtap: left promiscuous mode [ 161.209696][ T128] veth0_vlan: left promiscuous mode [ 161.215257][ T128] veth1_macvtap: left promiscuous mode [ 161.220819][ T128] veth0_vlan: left promiscuous mode