last executing test programs: 4.041590325s ago: executing program 0 (id=1): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$UI_BEGIN_FF_ERASE(r0, 0xc00c55ca, 0x0) 4.001837966s ago: executing program 2 (id=3): r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) ioctl$EVIOCGLED(r0, 0x80404519, 0x0) 3.993980406s ago: executing program 0 (id=5): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="12011f00abbe6740e9174e8b089c000000010902120001000000000904000000ff"], 0x0) r1 = syz_usb_connect(0x1, 0x0, 0x0, &(0x7f00000010c0)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r1, &(0x7f00000012c0)={0x14, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']}, 0x0) r2 = syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) r3 = syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a82300000904000002ca744d0009050303"], 0x0) syz_usb_connect$hid(0x6, 0x3f, &(0x7f0000000b80)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x8, 0x925, 0x5, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x6, 0x20, 0x4b, "", [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x3, 0x1, 0x3, 0x9, {0x9, 0x21, 0xff7f, 0x43, 0x1, {0x22, 0xa32}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x2, 0x7f, 0x3}}, [{{0x9, 0x5, 0x2, 0x3, 0x200, 0xc0, 0x1, 0x8}}]}}}]}}]}}, &(0x7f0000000dc0)={0xa, &(0x7f0000000bc0)={0xa, 0x6, 0x200, 0x5, 0x7, 0x7f, 0x20, 0x3}, 0x0, 0x0, 0x3, [{0x56, &(0x7f0000000c40)=@string={0x56, 0x3, "a7c055309a059950dedbf416e8c64065f4d0d20646b8e90c242af0061fad314d811e1c9a5335c0783f37867f49f51ca3decc506f5ecbf257d857459115217cfe738433bb08031ac7ea1be0ecd04bb6080a98d220"}}, {0xa9, &(0x7f0000000cc0)=@string={0xa9, 0x3, "c00c354f36b47b11d6479c9cb0975366133394ea3847699591fa7e8164f73af8b0b139bb5e9de70117e12b45e0751826e4cd39356d9ff34f5c9f4cc82a4869fdc15d0bb723bfc42fe58a8ee9ed7fe09896b8964d7c7cbb1fdf1d742da7e8751995c7faa6fdfe7207fc8218aab5ef448f419f4e1fc4d18437c47672f14e8d25dec2a859279e7aa09fbabe43a59ee12ff98c86526e8256f96605a6f3b30f385ef6e35a9f8dd347a9"}}, {0x4, &(0x7f0000000d80)=@lang_id={0x4, 0x3, 0x1401}}]}) syz_usb_disconnect(r3) syz_usb_connect(0x5, 0x2d, &(0x7f00000000c0)=ANY=[], 0x0) syz_usb_connect(0x2, 0x0, 0x0, &(0x7f0000000e80)={0xa, &(0x7f0000000b00)={0xa, 0x6, 0x0, 0x7f, 0x7f, 0xc5, 0x10, 0x6}, 0x1d, &(0x7f0000000b40)={0x5, 0xf, 0x1d, 0x1, [@ssp_cap={0x18, 0x10, 0xa, 0xc9, 0x3, 0x3, 0x0, 0x7ff, [0x3fff, 0xc0, 0xc0]}]}}) syz_usb_control_io$uac1(r1, &(0x7f0000002040)={0x14, 0x0, 0x0}, 0x0) syz_usb_control_io$printer(r1, 0x0, &(0x7f0000002800)={0x34, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, 0x0) syz_usb_control_io(r0, &(0x7f0000000400)={0x2c, &(0x7f0000000100)={0x40, 0x30, 0x3d, {0x3d, 0x6, "c45cffd69169250c9d52fe7997b64a11f541876b6e56a01d517620478a88dc0bbc025b0521a34dc1c91524f0b1068f8c6fa67d8fd1c994542ab1a9"}}, 0x0, &(0x7f0000000280)={0x0, 0xf, 0x2e, {0x5, 0xf, 0x2e, 0x3, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0xc, 0xf0, 0x2, 0xc}, @ss_container_id={0x14, 0x10, 0x4, 0x74, "138f6f4860d2af4be213a1da3e132a40"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x1, 0x0, 0xce, 0xff, 0x6}]}}, &(0x7f00000002c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0xff, 0x1, 0x0, 0x2d, "ea57514b", "ecaf9d58"}}, &(0x7f00000003c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xc, 0x0, 0x8d, 0xc0, 0x5, 0x2, 0x11d8}}}, &(0x7f0000001400)={0x84, &(0x7f0000000f00)={0x40, 0x4a748e414ddd9c0e, 0x21, "59248eb04fdf74032b18f408504b10e0edb3022df9ec361e6d22280eb1b0e84e02"}, &(0x7f0000000f80)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000fc0)={0x0, 0x8, 0x1, 0x5}, 0x0, 0x0, &(0x7f0000001080)={0x40, 0x7, 0x2, 0x8141}, 0x0, &(0x7f0000001140)={0x40, 0xb, 0x2, "3ecf"}, &(0x7f0000001180)={0x40, 0xf, 0x2, 0x3}, &(0x7f00000011c0)={0x40, 0x13, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, &(0x7f0000001200)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x17}}, 0x0, &(0x7f0000001300)={0x40, 0x1a, 0x2, 0x2}, &(0x7f0000001340)={0x40, 0x1c, 0x1, 0x4}, &(0x7f0000001380)={0x40, 0x1e, 0x1, 0xe}, &(0x7f00000013c0)={0x40, 0x21, 0x1, 0x7}}) syz_usb_connect$uac2(0x6, 0x0, 0x0, 0x0) r4 = syz_usb_connect$hid(0x3, 0x3f, &(0x7f00000004c0)=ANY=[@ANYBLOB="1201100100000040d9044aa000000000000109022d0001000080010904010002030002000921fd7f0001220c0009"], 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) r5 = syz_usb_connect(0x0, 0x32, 0x0, 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_disconnect(r2) r6 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100001b61e308d016a91052300102030109021b0001000000000904000001ff7f880009050302"], 0x0) syz_usb_control_io$hid(r6, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000280)={0x20, 0x31}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000340)={0x2c, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="000f22000000050f22000403f0000b10010000005d0004000080af249c7e99790c0c106507000000000000000000"], 0x0, 0x0}, 0x0) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f0000000000)=0x1) 3.933660388s ago: executing program 2 (id=6): r0 = syz_usb_connect(0x0, 0x371, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000057ec0020c215dcff30bd0102030109025f03019b000000090400000b403b4e000905e2379c"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r2, 0x0, 0x0) 3.933417168s ago: executing program 3 (id=4): syz_usb_connect(0x0, 0x36, &(0x7f00000004c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a8230800090400bc6435fb4d00090503034d00ff99090805", @ANYRES32], &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r0, 0x0, 0x0) syz_usb_connect(0x0, 0x3d7, &(0x7f00000007c0)=ANY=[@ANYBLOB="120100004cefc008e10593085bfd010203010902c50301000000000904"], 0x0) syz_usb_ep_write(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000087f0410c0400001020301090269852d76a030d77bd5f5c76d1db549180092a66cd781c0e12ed22edc7ee36200030102a009080b020201ff20ff09040000000101200009240102200009040101010102200009050109080081ff010825018201000400090402000001022000090402010101022000090582090004200501082501820a00f03f00"/151], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) 3.918643578s ago: executing program 1 (id=2): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000000)={0x0, 0x0}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x80) write(r4, &(0x7f00000002c0)='0', 0x1) 3.645929995s ago: executing program 1 (id=7): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1532, 0x11d, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x1, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}}}]}}]}}, 0x0) syz_usb_connect_ath9k(0x3, 0xa, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x225, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_disconnect(0xffffffffffffffff) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_disconnect(r1) syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12015002d424e940e11d02c1"], &(0x7f00000011c0)={0x0, 0x0, 0x0, 0x0}) syz_usb_connect(0x0, 0x34, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x22, 0x1c, {[@global=@item_012={0x1, 0x1, 0x0, '['}, @global=@item_4={0x3, 0x1, 0xb, "70f5db3e"}, @local=@item_4={0x3, 0x2, 0x2, "3c2c01ba"}, @local=@item_012={0x2, 0x2, 0x8, "62c0"}, @main=@item_012={0x1, 0x0, 0xa, "01"}, @main=@item_4={0x3, 0x0, 0xc, "7beb2da8"}, @local=@item_012={0x2, 0x2, 0x4, "010a"}, @global, @global=@item_012={0x1, 0x1, 0x9, "01"}]}}, 0x0}, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x6) 2.042171442s ago: executing program 3 (id=8): syz_usb_connect(0x0, 0x2d, &(0x7f0000000780)=ANY=[@ANYBLOB="12010000ec31f8104c1302007eec0102030109021b0001000000000904002c11018b75000905", @ANYRES32], 0x0) syz_open_dev$evdev(&(0x7f0000000100), 0x4a, 0x0) 1.309390189s ago: executing program 1 (id=9): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x90}, 0x4000000) socket$xdp(0x2c, 0x3, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000380)={0xe0, 0x2, 0x9, 0x101, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFCTH_TUPLE={0x5c, 0x2, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x1d}}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x966}, @CTA_TUPLE_ZONE={0x6}]}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x1a}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x6c}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x15}, @NFCTH_TUPLE={0x50, 0x2, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @loopback}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x7}}}}]}]}, 0xe0}, 0x1, 0x0, 0x0, 0x4}, 0x80) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x7c0, 0x1125, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xb0, 0x1f, "", [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x0, 0x2, 0x1, {0x22, 0x26}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x7, 0x13, 0x2}}}}}]}}]}}, 0x0) 959.550007ms ago: executing program 0 (id=10): r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120141014813442024040075ee69010203010902240001000010000904b8"], 0x0) syz_usb_disconnect(r1) r2 = syz_usb_connect(0x0, 0x4fa, &(0x7f0000000540)=ANY=[@ANYBLOB="120100022502aa10120a105d"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) ioctl$EVIOCRMFF(r0, 0x550c, 0x0) r3 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_ep_write(r3, 0x81, 0xe, &(0x7f0000000200)="0e00000000000000000000020000") 762.138492ms ago: executing program 3 (id=11): r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000080)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000480)={0x34, &(0x7f0000000200)={0x768e0786a6d7b697, 0x1, 0x1, "ce"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000040)={0x1c, &(0x7f0000000080)=ANY=[], 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000100)={0x34, &(0x7f0000000140)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000340)={0x2c, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 211.070995ms ago: executing program 2 (id=12): r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xfffffffffffffe9f}}]}}, 0x0) syz_usb_connect(0x3, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="12012000f1048108cd060202"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$rtl8150(0x5, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$rtl8150(r1, 0x0, 0x0) syz_usb_ep_write(r1, 0x83, 0x0, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x87, &(0x7f0000000100)=@generic={0x7, 0x0, 0x7f, "48cf933b", "e33c5fad1c7b75da638fb76b10d96c7f97dcc1db05d256cc8516c0dcc5d3574214b3beb7e498504e68b1759bada7dcec613e6011e4ec3352092e8840abda1982636549fda81ac392457231f5dbcb33bef65e899c85c9e7395d7ec67ef9103eb3f16a1d2cd355f65f24d8430b740539cff92b060456d66faaf5b48062a09c5f"}) syz_usb_control_io$rtl8150(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_ep_write(r0, 0x83, 0x0, 0x0) 0s ago: executing program 1 (id=13): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1038, 0x1410, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x1, "", [{{0x9, 0x4, 0x0, 0x8, 0x1, 0x3, 0x0, 0x7, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101959530263b7b49760829309102c0"], 0x0}, 0x0) r1 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x63, 0x86, 0x35, 0x10, 0xcf3, 0x1010, 0x3687, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x7f, 0x4, 0x50, 0x0, "", [{{0x9, 0x4, 0x7c, 0xb, 0x0, 0xa4, 0xca, 0xd4}}]}}]}}, &(0x7f0000000200)={0x0, 0x0, 0x10, &(0x7f0000000040)={0x5, 0xf, 0x10, 0x1, [@wireless={0xb, 0x10, 0x1, 0x8, 0xc0, 0x6, 0x9, 0x7, 0x10}]}, 0x1, [{0x9f, &(0x7f00000000c0)=@string={0x9f, 0x3, "af707e4b3db7351ced7b6cda2b96bb47e1ef384a392955e1f30a2b7c0570c5145637f2615c78a97bcac42e69cb1298c1e0ced36e1b945ef40ad61d22321678bf8a3b9adf69f88a9ee3bdcf1e384124af60c9ad058c23184599396ce723193c95573aec2be17e486ed424ebcb2400b052fc4f34eb486f3fa62ed37cfbc7a957c9db387a2f136487aa520f1939ac199a72f3aebb232a2370a9847ec7e9e8"}}]}) syz_usb_disconnect(r1) syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000e00)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8f, 0x41e, 0x3000, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x4, 0x10, 0x2, {0x8, 0xb, 0x1, 0x1, 0x1, 0x5, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5409, 0xb, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x2, 0x1, 0x80, {0x8, 0x25, 0x1, 0x80, 0x0, 0x6, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x81, 0x6, 0x9, {0x8, 0x25, 0x1, 0x0, 0x3c, 0x3, 0x9}}}}}}}}]}}, &(0x7f0000000080)={0x0, 0x0, 0x3b, &(0x7f0000000180)={0x5, 0xf, 0x3b, 0x5, [@ssp_cap={0x10, 0x10, 0xa, 0x0, 0x1, 0x3, 0x7700, 0x2, [0xc000]}, @ssp_cap={0xc, 0x10, 0xa, 0x3, 0x0, 0x10001, 0x0, 0x5}, @ptm_cap={0x3}, @ssp_cap={0x10, 0x10, 0xa, 0x61, 0x1, 0x7, 0xee07, 0xc, [0xffff00]}, @ext_cap={0x7, 0x10, 0x2, 0x0, 0x8, 0x9, 0x4}]}}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.196' (ED25519) to the list of known hosts. [ 34.331091][ T36] audit: type=1400 audit(1789043877.020:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 34.332804][ T286] cgroup: Unknown subsys name 'net' [ 34.357569][ T36] audit: type=1400 audit(1789043877.020:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 34.390932][ T36] audit: type=1400 audit(1789043877.050:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 34.391194][ T286] cgroup: Unknown subsys name 'devices' [ 34.517697][ T286] cgroup: Unknown subsys name 'hugetlb' [ 34.524893][ T286] cgroup: Unknown subsys name 'rlimit' [ 34.638002][ T36] audit: type=1400 audit(1789043877.330:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 34.668978][ T36] audit: type=1400 audit(1789043877.330:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 34.700850][ T36] audit: type=1400 audit(1789043877.330:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 34.701015][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 34.743443][ T36] audit: type=1400 audit(1789043877.430:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 34.778222][ T36] audit: type=1400 audit(1789043877.430:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 34.812567][ T36] audit: type=1400 audit(1789043877.500:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 34.845001][ T36] audit: type=1400 audit(1789043877.500:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 34.845655][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 36.161150][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.170115][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.180228][ T294] bridge_slave_0: entered allmulticast mode [ 36.188142][ T294] bridge_slave_0: entered promiscuous mode [ 36.202156][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.210086][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.221004][ T294] bridge_slave_1: entered allmulticast mode [ 36.228616][ T294] bridge_slave_1: entered promiscuous mode [ 36.279819][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.289255][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.299007][ T295] bridge_slave_0: entered allmulticast mode [ 36.306828][ T295] bridge_slave_0: entered promiscuous mode [ 36.315644][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.325430][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.334557][ T296] bridge_slave_0: entered allmulticast mode [ 36.342519][ T296] bridge_slave_0: entered promiscuous mode [ 36.353164][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.361213][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.369009][ T296] bridge_slave_1: entered allmulticast mode [ 36.376014][ T296] bridge_slave_1: entered promiscuous mode [ 36.384890][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.393498][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.402439][ T295] bridge_slave_1: entered allmulticast mode [ 36.409460][ T295] bridge_slave_1: entered promiscuous mode [ 36.437030][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.444477][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.453032][ T293] bridge_slave_0: entered allmulticast mode [ 36.459937][ T293] bridge_slave_0: entered promiscuous mode [ 36.469903][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.477953][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.486265][ T293] bridge_slave_1: entered allmulticast mode [ 36.493643][ T293] bridge_slave_1: entered promiscuous mode [ 36.653330][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.661637][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.670157][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.678793][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.705556][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.714296][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.724045][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.731518][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.755405][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.764721][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.774157][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.783072][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.801897][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.812392][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.824190][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.832665][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.872182][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.883011][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.896698][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.906959][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.919263][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.929174][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.937546][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.948208][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.965282][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.974466][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.986241][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.996058][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.010206][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.019366][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.044751][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.054316][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.116087][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.125901][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.135795][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.143967][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.168160][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.178456][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.191787][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.200763][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.233442][ T294] veth0_vlan: entered promiscuous mode [ 37.271795][ T294] veth1_macvtap: entered promiscuous mode [ 37.283378][ T293] veth0_vlan: entered promiscuous mode [ 37.320393][ T293] veth1_macvtap: entered promiscuous mode [ 37.331719][ T295] veth0_vlan: entered promiscuous mode [ 37.374227][ T295] veth1_macvtap: entered promiscuous mode [ 37.385728][ T294] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 37.412748][ T296] veth0_vlan: entered promiscuous mode [ 37.463238][ T296] veth1_macvtap: entered promiscuous mode [ 37.561366][ T326] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 37.775114][ T10] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 37.784458][ T72] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 37.795057][ T31] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 37.946946][ T10] usb 1-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 37.964028][ T72] usb 3-1: Using ep0 maxpacket: 32 [ 37.965234][ T31] usb 4-1: Using ep0 maxpacket: 8 [ 37.970324][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 37.981438][ T31] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 37.991401][ T72] usb 3-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 38.001246][ T31] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 38.014678][ T72] usb 3-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 38.030935][ T31] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 38.045004][ T10] usb 1-1: config 0 descriptor?? [ 38.066029][ T31] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 38.068868][ T72] usb 3-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 38.085833][ T311] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 38.100067][ T72] usb 3-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 38.120305][ T31] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 38.136228][ T72] usb 3-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 38.145482][ T31] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 38.156686][ T72] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.171452][ T31] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 38.184701][ T72] usb 3-1: Product: syz [ 38.199182][ T31] usb 4-1: config 168 interface 0 has no altsetting 0 [ 38.202618][ T72] usb 3-1: Manufacturer: syz [ 38.214750][ T31] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 38.220541][ T72] usb 3-1: SerialNumber: syz [ 38.228283][ T31] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 38.245355][ T31] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 38.262609][ T31] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 38.277961][ T31] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 38.292651][ T31] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 38.307712][ T31] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 38.323209][ T31] usb 4-1: config 168 interface 0 has no altsetting 0 [ 38.332510][ T31] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 38.340950][ T319] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 38.343906][ T31] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 38.359785][ T319] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 38.373346][ T311] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 38.397499][ T311] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid wMaxPacketSize 0 [ 38.411808][ T31] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 38.427185][ T311] usb 2-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 38.443804][ T31] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 38.452344][ T72] usb 3-1: USB disconnect, device number 2 [ 38.457869][ T311] usb 2-1: config 0 interface 0 has no altsetting 0 [ 38.474914][ T311] usb 2-1: New USB device found, idVendor=1532, idProduct=011d, bcdDevice= 0.00 [ 38.485227][ T31] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 38.499525][ T311] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 38.510124][ T31] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 38.526809][ T31] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 38.544396][ T311] usb 2-1: config 0 descriptor?? [ 38.550598][ T31] usb 4-1: config 168 interface 0 has no altsetting 0 [ 38.562249][ T31] usb 4-1: string descriptor 0 read error: -22 [ 38.571155][ T31] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 38.582789][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.591258][ T319] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 38.614485][ T319] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 38.826026][ T324] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 38.836987][ T324] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 38.848915][ T324] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 38.859274][ T324] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 38.870764][ T9] usb 4-1: USB disconnect, device number 2 [ 38.925057][ T72] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 38.963636][ T329] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 38.978003][ T329] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 38.980003][ T331] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 38.998415][ T331] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 39.085258][ T72] usb 3-1: Using ep0 maxpacket: 32 [ 39.094046][ T72] usb 3-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 39.109833][ T72] usb 3-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 39.126523][ T72] usb 3-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 39.140186][ T72] usb 3-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 39.159081][ T72] usb 3-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 39.175574][ T72] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.187459][ T72] usb 3-1: Product: syz [ 39.193462][ T72] usb 3-1: Manufacturer: syz [ 39.194616][ T329] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 39.202066][ T72] usb 3-1: SerialNumber: syz [ 39.215925][ T329] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 39.220590][ T331] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 39.242975][ T331] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 39.437497][ T311] hid-rmi 0003:1532:011D.0001: global environment stack underflow [ 39.446530][ T311] hid-rmi 0003:1532:011D.0001: item 0 4 1 11 parsing failed [ 39.455266][ T311] hid-rmi 0003:1532:011D.0001: parse failed [ 39.461433][ T311] hid-rmi 0003:1532:011D.0001: probe with driver hid-rmi failed with error -22 [ 39.625439][ T72] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 39.645645][ T311] usb 2-1: USB disconnect, device number 2 [ 39.795106][ T72] usb 4-1: Using ep0 maxpacket: 16 [ 39.804163][ T72] usb 4-1: config 0 interface 0 altsetting 44 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 39.823375][ T72] usb 4-1: config 0 interface 0 altsetting 44 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 39.838197][ T72] usb 4-1: config 0 interface 0 altsetting 44 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 39.854156][ T72] usb 4-1: config 0 interface 0 altsetting 44 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 39.870947][ T72] usb 4-1: config 0 interface 0 has no altsetting 0 [ 39.879954][ T72] usb 4-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ec.7e [ 39.891946][ T72] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.904219][ T72] usb 4-1: Product: syz [ 39.909705][ T72] usb 4-1: Manufacturer: syz [ 39.916785][ T72] usb 4-1: SerialNumber: syz [ 39.923531][ T72] usb 4-1: config 0 descriptor?? [ 39.930086][ T333] raw-gadget.9 gadget.3: fail, usb_ep_enable returned -22 [ 40.143873][ T72] usb 4-1: USB disconnect, device number 3 [ 40.171536][ T36] kauditd_printk_skb: 31 callbacks suppressed [ 40.171555][ T36] audit: type=1400 audit(1789043882.860:105): avc: denied { create } for pid=336 comm="syz.1.9" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 40.455010][ T311] usb 2-1: new low-speed USB device number 3 using dummy_hcd [ 40.499002][ T72] usb 1-1: USB disconnect, device number 2 [ 40.616367][ T311] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 40.629155][ T311] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 40.643991][ T311] usb 2-1: New USB device found, idVendor=07c0, idProduct=1125, bcdDevice= 0.00 [ 40.655993][ T311] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 40.669519][ T311] usb 2-1: config 0 descriptor?? [ 40.676827][ T337] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 40.894807][ T311] usbhid 2-1:0.0: can't add hid device: -71 [ 40.903608][ T311] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 40.915822][ T10] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 40.928375][ T311] usb 2-1: USB disconnect, device number 3 [ 40.955047][ T72] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 41.078527][ T10] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 41.088756][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 41.102271][ T10] usb 4-1: Product: syz [ 41.107079][ T10] usb 4-1: Manufacturer: syz [ 41.111974][ T10] usb 4-1: SerialNumber: syz [ 41.118115][ T10] usb 4-1: config 0 descriptor?? [ 41.125143][ T72] usb 1-1: Using ep0 maxpacket: 32 [ 41.133231][ T72] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 41.144242][ T72] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 41.156709][ T72] usb 1-1: config 0 has no interface number 0 [ 41.167385][ T72] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 41.181027][ T72] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 41.191621][ T72] usb 1-1: Product: syz [ 41.196473][ T72] usb 1-1: Manufacturer: syz [ 41.202173][ T72] usb 1-1: SerialNumber: syz [ 41.208312][ T72] usb 1-1: config 0 descriptor?? [ 41.216359][ T72] smsc75xx v1.0.0 [ 41.222061][ T72] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 41.237186][ T72] smsc75xx 1-1:0.184: probe with driver smsc75xx failed with error -22 [ 41.238450][ T311] usb 3-1: USB disconnect, device number 3 [ 41.424181][ T31] usb 1-1: USB disconnect, device number 3 [ 41.555048][ T311] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 41.715152][ T45] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 41.725311][ T311] usb 3-1: config index 0 descriptor too short (expected 65183, got 72) [ 41.736996][ T311] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 41.749280][ T311] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 41.759106][ T311] usb 3-1: Product: syz [ 41.763668][ T311] usb 3-1: Manufacturer: syz [ 41.768527][ T311] usb 3-1: SerialNumber: syz [ 41.865112][ T72] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 41.866535][ T45] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 41.890897][ T45] usb 2-1: config 0 interface 0 has no altsetting 0 [ 41.899002][ T45] usb 2-1: New USB device found, idVendor=1038, idProduct=1410, bcdDevice= 0.00 [ 41.913280][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 41.924218][ T45] usb 2-1: config 0 descriptor?? [ 42.015068][ T72] usb 1-1: Using ep0 maxpacket: 16 [ 42.022318][ T72] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 42.033322][ T72] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 42.046478][ T72] usb 1-1: config 0 has no interface number 0 [ 42.054480][ T72] usb 1-1: New USB device found, idVendor=0a12, idProduct=5d10, bcdDevice=69.ee [ 42.067040][ T72] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 42.078299][ T72] usb 1-1: Product: syz [ 42.084223][ T72] usb 1-1: Manufacturer: syz [ 42.091525][ T72] usb 1-1: SerialNumber: syz [ 42.098804][ T72] usb 1-1: config 0 descriptor?? [ 42.336439][ T45] steelseries 0003:1038:1410.0002: unknown main item tag 0x3 [ 42.347629][ T45] steelseries 0003:1038:1410.0002: No inputs registered, leaving [ 42.358037][ T45] steelseries 0003:1038:1410.0002: hidraw0: USB HID v0.00 Joystick [HID 1038:1410] on usb-dummy_hcd.1-1/input0 [ 42.375233][ T45] steelseries 0003:1038:1410.0002: implement() called with too large value 64 (n: 0)! (kworker/1:1) [ 42.544624][ T351] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 42.555789][ T351] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 42.663962][ T357] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 42.676715][ T357] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 42.767904][ T351] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 42.778314][ T351] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 42.790815][ T72] usb 2-1: USB disconnect, device number 4 [ 42.799658][ T72] ------------[ cut here ]------------ [ 42.808851][ T72] UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.c:131:9 [ 42.819291][ T72] index 1333 is out of range for type 'unsigned long[8]' [ 42.831354][ T72] CPU: 0 UID: 0 PID: 72 Comm: kworker/0:2 Not tainted syzkaller #0 01d0fef691542fecbcfb5551c0a705324fcaa78c [ 42.831377][ T72] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 42.831387][ T72] Workqueue: usb_hub_wq hub_event [ 42.831427][ T72] Call Trace: [ 42.831434][ T72] [ 42.831440][ T72] __dump_stack+0x21/0x30 [ 42.831464][ T72] dump_stack_lvl+0x140/0x1c0 [ 42.831480][ T72] ? __cfi_dump_stack_lvl+0x10/0x10 [ 42.831497][ T72] ? ret_from_fork+0x64/0xa0 [ 42.831515][ T72] dump_stack+0x19/0x20 [ 42.831528][ T72] ubsan_epilogue+0xe/0x40 [ 42.831539][ T72] __ubsan_handle_out_of_bounds+0xe8/0xf0 [ 42.831561][ T72] __pv_queued_spin_lock_slowpath+0xbf7/0xe90 [ 42.831575][ T72] ? __cfi___pv_queued_spin_lock_slowpath+0x10/0x10 [ 42.831593][ T72] ? __kasan_check_write+0x18/0x20 [ 42.831608][ T72] ? rwsem_read_trylock+0x275/0x5a0 [ 42.831629][ T72] ? downgrade_write+0x470/0x470 [ 42.831652][ T72] _raw_spin_lock_irqsave+0x153/0x160 [ 42.831662][ T72] ? __cfi__raw_spin_lock_irqsave+0x10/0x10 [ 42.831682][ T72] ? down_write+0xee/0x2b0 [ 42.831697][ T72] ? kernfs_name_hash+0x1c7/0x220 [ 42.831727][ T72] steelseries_remove+0x85/0x180 [ 42.831741][ T72] ? __cfi_steelseries_remove+0x10/0x10 [ 42.831753][ T72] hid_device_remove+0x293/0x400 [ 42.831765][ T72] ? __cfi_hid_device_remove+0x10/0x10 [ 42.831778][ T72] device_release_driver_internal+0x4ad/0x830 [ 42.831792][ T72] device_release_driver+0x1d/0x30 [ 42.831805][ T72] bus_remove_device+0x34f/0x370 [ 42.831828][ T72] device_del+0x583/0xcf0 [ 42.831843][ T72] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 42.831861][ T72] ? __pm_runtime_resume+0xa0/0xa0 [ 42.831879][ T72] ? __cfi_device_del+0x10/0x10 [ 42.831887][ T72] ? __kasan_check_write+0x18/0x20 [ 42.831899][ T72] ? _raw_spin_lock_irq+0x93/0x120 [ 42.831909][ T72] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 42.831921][ T72] hid_destroy_device+0x6e/0x110 [ 42.831935][ T72] usbhid_disconnect+0xa3/0xc0 [ 42.831946][ T72] usb_unbind_interface+0x2b0/0xa40 [ 42.831966][ T72] ? __cfi_usb_unbind_interface+0x10/0x10 [ 42.831980][ T72] device_release_driver_internal+0x525/0x830 [ 42.831991][ T72] device_release_driver+0x1d/0x30 [ 42.832000][ T72] bus_remove_device+0x34f/0x370 [ 42.832013][ T72] device_del+0x583/0xcf0 [ 42.832022][ T72] ? kfree_const+0x3d/0x50 [ 42.832037][ T72] ? __cfi_device_release+0x10/0x10 [ 42.832049][ T72] ? __cfi_device_del+0x10/0x10 [ 42.832057][ T72] ? kobject_put+0x238/0x2a0 [ 42.832073][ T72] ? device_unregister+0x2b/0x40 [ 42.832082][ T72] usb_disable_device+0x3af/0x770 [ 42.832097][ T72] usb_disconnect+0x331/0x950 [ 42.832110][ T72] hub_event+0x1ad5/0x4360 [ 42.832124][ T72] ? hub_event+0x1160/0x4360 [ 42.832144][ T72] ? __cfi_hub_event+0x10/0x10 [ 42.832158][ T72] ? kick_pool+0xb9/0x540 [ 42.832171][ T72] process_scheduled_works+0x7f4/0x1060 [ 42.832184][ T72] worker_thread+0xc99/0x13f0 [ 42.832196][ T72] kthread+0x2c4/0x360 [ 42.832207][ T72] ? __cfi_worker_thread+0x10/0x10 [ 42.832218][ T72] ? __cfi_kthread+0x10/0x10 [ 42.832229][ T72] ret_from_fork+0x64/0xa0 [ 42.832243][ T72] ? __cfi_kthread+0x10/0x10 [ 42.832255][ T72] ret_from_fork_asm+0x1a/0x30 [ 42.832266][ T72] [ 42.832270][ T72] ---[ end trace ]--- [ 43.314585][ T72] ================================================================== [ 43.329211][ T72] BUG: KASAN: global-out-of-bounds in __pv_queued_spin_lock_slowpath+0x39a/0xe90 [ 43.342372][ T72] Write of size 8 at addr ffffffff88c66720 by task kworker/0:2/72 [ 43.355134][ T72] [ 43.358231][ T72] CPU: 0 UID: 0 PID: 72 Comm: kworker/0:2 Not tainted syzkaller #0 01d0fef691542fecbcfb5551c0a705324fcaa78c [ 43.358390][ T72] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 43.358407][ T72] Workqueue: usb_hub_wq hub_event [ 43.358444][ T72] Call Trace: [ 43.358452][ T72] [ 43.358465][ T72] __dump_stack+0x21/0x30 [ 43.358831][ T72] dump_stack_lvl+0x140/0x1c0 [ 43.358857][ T72] ? __cfi_dump_stack_lvl+0x10/0x10 [ 43.358893][ T72] ? __cfi__printk+0x10/0x10 [ 43.359362][ T72] print_address_description+0x71/0x210 [ 43.359400][ T72] print_report+0x4a/0x70 [ 43.359426][ T72] kasan_report+0x162/0x1a0 [ 43.359448][ T72] ? __pv_queued_spin_lock_slowpath+0x39a/0xe90 [ 43.359471][ T72] ? __pv_queued_spin_lock_slowpath+0x39a/0xe90 [ 43.359490][ T72] __asan_report_store8_noabort+0x1b/0x30 [ 43.359507][ T72] __pv_queued_spin_lock_slowpath+0x39a/0xe90 [ 43.359526][ T72] ? __cfi___pv_queued_spin_lock_slowpath+0x10/0x10 [ 43.359544][ T72] ? __kasan_check_write+0x18/0x20 [ 43.359559][ T72] ? rwsem_read_trylock+0x275/0x5a0 [ 43.359582][ T72] ? downgrade_write+0x470/0x470 [ 43.359605][ T72] _raw_spin_lock_irqsave+0x153/0x160 [ 43.359627][ T72] ? __cfi__raw_spin_lock_irqsave+0x10/0x10 [ 43.359657][ T72] ? down_write+0xee/0x2b0 [ 43.359680][ T72] ? kernfs_name_hash+0x1c7/0x220 [ 43.359705][ T72] steelseries_remove+0x85/0x180 [ 43.359728][ T72] ? __cfi_steelseries_remove+0x10/0x10 [ 43.359761][ T72] hid_device_remove+0x293/0x400 [ 43.359782][ T72] ? __cfi_hid_device_remove+0x10/0x10 [ 43.359806][ T72] device_release_driver_internal+0x4ad/0x830 [ 43.359823][ T72] device_release_driver+0x1d/0x30 [ 43.359838][ T72] bus_remove_device+0x34f/0x370 [ 43.359857][ T72] device_del+0x583/0xcf0 [ 43.359871][ T72] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 43.359886][ T72] ? __pm_runtime_resume+0xa0/0xa0 [ 43.360395][ T72] ? __cfi_device_del+0x10/0x10 [ 43.360415][ T72] ? __kasan_check_write+0x18/0x20 [ 43.361211][ T72] ? _raw_spin_lock_irq+0x93/0x120 [ 43.361232][ T72] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 43.361258][ T72] hid_destroy_device+0x6e/0x110 [ 43.361290][ T72] usbhid_disconnect+0xa3/0xc0 [ 43.361310][ T72] usb_unbind_interface+0x2b0/0xa40 [ 43.361342][ T72] ? __cfi_usb_unbind_interface+0x10/0x10 [ 43.361368][ T72] device_release_driver_internal+0x525/0x830 [ 43.361388][ T72] device_release_driver+0x1d/0x30 [ 43.361402][ T72] bus_remove_device+0x34f/0x370 [ 43.361422][ T72] device_del+0x583/0xcf0 [ 43.361436][ T72] ? kfree_const+0x3d/0x50 [ 43.361460][ T72] ? __cfi_device_release+0x10/0x10 [ 43.361476][ T72] ? __cfi_device_del+0x10/0x10 [ 43.361490][ T72] ? kobject_put+0x238/0x2a0 [ 43.361513][ T72] ? device_unregister+0x2b/0x40 [ 43.361527][ T72] usb_disable_device+0x3af/0x770 [ 43.361549][ T72] usb_disconnect+0x331/0x950 [ 43.361569][ T72] hub_event+0x1ad5/0x4360 [ 43.361590][ T72] ? hub_event+0x1160/0x4360 [ 43.361616][ T72] ? __cfi_hub_event+0x10/0x10 [ 43.361638][ T72] ? kick_pool+0xb9/0x540 [ 43.361658][ T72] process_scheduled_works+0x7f4/0x1060 [ 43.361678][ T72] worker_thread+0xc99/0x13f0 [ 43.361703][ T72] kthread+0x2c4/0x360 [ 43.361721][ T72] ? __cfi_worker_thread+0x10/0x10 [ 43.361791][ T72] ? __cfi_kthread+0x10/0x10 [ 43.361810][ T72] ret_from_fork+0x64/0xa0 [ 43.361840][ T72] ? __cfi_kthread+0x10/0x10 [ 43.361859][ T72] ret_from_fork_asm+0x1a/0x30 [ 43.361878][ T72] [ 43.361887][ T72] [ 43.853664][ T72] The buggy address belongs to the variable: [ 43.861086][ T72] delayed_register+0x100/0x140 [ 43.869048][ T72] [ 43.871641][ T72] The buggy address belongs to the physical page: [ 43.880186][ T72] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8c66 [ 43.891031][ T72] flags: 0x4000(reserved|zone=0) [ 43.899045][ T72] raw: 0000000000004000 ffffea0000231988 ffffea0000231988 0000000000000000 [ 43.909555][ T72] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 43.920959][ T72] page dumped because: kasan: bad access detected [ 43.929387][ T72] page_owner info is not present (never set?) [ 43.936893][ T72] [ 43.939781][ T72] Memory state around the buggy address: [ 43.947539][ T72] ffffffff88c66600: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00 [ 43.958428][ T72] ffffffff88c66680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 43.970240][ T72] >ffffffff88c66700: 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 [ 43.980108][ T72] ^ [ 43.987455][ T72] ffffffff88c66780: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00 [ 43.999791][ T72] ffffffff88c66800: 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 [ 44.012422][ T72] ================================================================== [ 44.021846][ T72] Disabling lock debugging due to kernel taint [ 47.665082][ C1] sched: DL replenish lagged too much