last executing test programs: 2.440132801s ago: executing program 1 (id=38): r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000), 0x2) r1 = memfd_create(&(0x7f0000000340)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\xdenJ\xeb\x87\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\x008\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38\x14\xcb\xfa\xb3j\x92\f\xe0\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xd9w\\\xf0\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xd9\xbd\xd9\xaf\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x2) ftruncate(r1, 0xffff) fcntl$addseals(r1, 0x409, 0x7) ioctl$UDMABUF_CREATE(r0, 0x40187542, &(0x7f0000000140)={r1, 0x0, 0x0, 0x4000}) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xfe, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0xfffffffffffffffe) 2.426661562s ago: executing program 1 (id=39): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffff3) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) lseek(r0, 0xc, 0x3) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$uinput_user_dev(r1, 0x0, 0x0) ioctl$UI_DEV_CREATE(r1, 0x5501) r2 = syz_open_dev$evdev(0x0, 0x3, 0x101202) sendmsg(r2, &(0x7f0000000200)={0x0, 0x0, 0xfffffffffffffffc}, 0x90) ioctl$EVIOCSABS20(r2, 0x401845e0, 0x0) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_opts(r3, 0x29, 0x40, &(0x7f00000001c0)=ANY=[@ANYBLOB="000a000000000f"], 0xd0060) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.numa_stat\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) lseek(r5, 0x0, 0x4) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) 2.374514973s ago: executing program 1 (id=40): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), r0) sendmsg$ETHTOOL_MSG_FEATURES_GET(r0, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f0000000200)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="8fdf2cbd7000030000000b"], 0x14}, 0x1, 0x0, 0x0, 0x4005}, 0x40000) recvmmsg(r0, &(0x7f0000004080)=[{{0x0, 0x0, 0x0}, 0xb09}, {{0x0, 0x0, 0x0}, 0xca}, {{0x0, 0x0, &(0x7f00000057c0)=[{&(0x7f0000000bc0)=""/198, 0xc6}, {&(0x7f0000000cc0)=""/209, 0xd1}, {&(0x7f0000000dc0)=""/165, 0xa5}, {&(0x7f0000004280)=""/145, 0x91}, {&(0x7f0000004340)=""/132, 0x84}, {&(0x7f0000004400)=""/175, 0xaf}, {&(0x7f00000044c0)=""/226, 0xe2}, {&(0x7f00000045c0)=""/4096, 0x1000}, {&(0x7f00000055c0)=""/226, 0xe2}, {&(0x7f00000056c0)=""/250, 0xfa}], 0xa}, 0x1ff}, {{0x0, 0x1c000, 0x0}, 0x7}, {{0x0, 0x0, 0x0}, 0x5}], 0x5, 0x0, 0x0) 2.268582605s ago: executing program 1 (id=41): r0 = syz_usb_connect(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b510f210950b2a7773820102030109022400010000000009042200028953950009050a02ff0300fa000905820250"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000280)={0x20, 0x1, 0x6, "9a4ca7e636fe"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) fsopen(&(0x7f00000001c0)='binfmt_misc\x00', 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0) getdents64(r1, 0x0, 0x20) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}], 0x40}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f00000004c0)={0x0, 0x42cc, 0x10, 0x1, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe706, 0x1000, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x4, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93e9, 0x2000, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x230}}], 0x1, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f0000000600)=ANY=[@ANYBLOB="001606"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000380)={0x2c, &(0x7f0000000180)=ANY=[@ANYBLOB="500f02"], 0x0, 0x0, 0x0, 0x0}) 2.245729646s ago: executing program 2 (id=43): r0 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet6(r0, &(0x7f00000077c0)=[{{&(0x7f0000002780)={0xa, 0x5, 0x800, @local, 0x5}, 0x1c, 0x0, 0x0, &(0x7f0000002800)=[@dontfrag={{0x14, 0x29, 0x3e, 0x1}}], 0x18, 0x40000}}], 0x1, 0x40) 2.230139076s ago: executing program 2 (id=44): syz_usb_connect$uac1(0x3, 0x72, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x249c, 0x932c, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x60, 0x3, 0x1, 0x9, 0x70, 0x8, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x6, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x5, 0xf7, 0xd, {0x7, 0x25, 0x1, 0xc, 0x9, 0x42}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x5, 0x4, 0x8, {0x7, 0x25, 0x1, 0x4, 0x6, 0x4}}}}}}}}]}}, 0x0) 1.437308145s ago: executing program 0 (id=46): socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) fsopen(&(0x7f00000001c0)='binfmt_misc\x00', 0x1) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0) getdents64(r0, 0x0, 0x20) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) syz_ublk_setup_queues(r3, r1, &(0x7f00000004c0)={0x0, 0x42cc, 0x10, 0x1, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe706, 0x1000, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x4, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93e9, 0x2000, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x230}}], 0x20, 0x0, 0x0) 1.318365998s ago: executing program 0 (id=47): setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x300, 0x0, 0x1, 0x8, 0x0, 0x6}, 0x20) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0a41, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4002}) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}}) mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) connect$inet(r2, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$inet(r2, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0xc, &(0x7f0000000000)=0xa, 0x4) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/tty/ttyS0/console\x00', 0x2, 0x0) read$FUSE(r3, &(0x7f0000002fc0)={0x2020}, 0x2020) read$FUSE(r1, &(0x7f000000c3c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000000440)={0x50, 0x0, r4, {0x7, 0x29, 0x9, 0xffffffff9080edc4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x2}}, 0x50) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x2c) syz_fuse_handle_req(r1, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x0, {0x0, 0x1c}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$XFS_IOC_START_COMMIT(r5, 0x80585882, 0x0) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="0000001803040300d519c50010"], 0xef) r6 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) shutdown(r6, 0x0) r7 = dup2(r6, r6) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r7, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={0x0}}, 0x4004010) r8 = socket(0xa, 0x3, 0xff) r9 = syz_open_dev$evdev(&(0x7f0000000000), 0x24f9031b, 0x400100) ioctl$EVIOCGKEY(r9, 0x80404518, &(0x7f0000000280)=""/4096) setsockopt$inet6_int(r8, 0x29, 0xb, &(0x7f0000000040)=0xfffffffe, 0x4) 1.212597961s ago: executing program 0 (id=48): r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000300)=0x8, 0x4) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="40000000140001"], 0x40}, 0x1, 0x0, 0x0, 0x20000804}, 0x8018) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000380)={'gre0\x00', &(0x7f0000000240)={'tunl0\x00', 0x0, 0x40, 0x40, 0x415c, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x2f, 0x0, @loopback, @multicast1}}}}) r2 = socket$tipc(0x1e, 0x2, 0x0) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r2, 0x50009418, &(0x7f00000013c0)={{r1}, 0x0, 0x1e, @inherit={0x58, &(0x7f00000000c0)=ANY=[@ANYBLOB="00000000000000000200000000000000fbdd7e82ffffffffffffff0000060000000000000000000000000006000000000000000200000000000000c708000000000000000100000000000002000000000000000100000000000080"]}, @subvolid}) r3 = socket$tipc(0x1e, 0x5, 0x0) connect$tipc(r3, &(0x7f0000000080)=@id={0x1e, 0x3, 0x1, {0x4e22, 0x2}}, 0x10) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)="86fea6a14ace9a2aa83aaea82063356911caa06a05db35534a0efd665cf6cb21e570ea63e580448fb341bf173f57450cc1e14ac1714ce3f9da34191fdd22469c6326c219efdba5136998d5782e75cb73056dbd61399377996a69c3e4316b41ba4d2dc42b7029541ac5dbe177215765346ec208414cd8a2807e559c806e19459dc50d1e4a5a42b5c0283520b8ca64cdc526652c4b1d78a5f5ad83f9afc0b5586a9065f00cb196e28989a9ca2da9cd33e23a", 0xb1) socket$netlink(0x10, 0x3, 0x0) (async) setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000300)=0x8, 0x4) (async) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="40000000140001"], 0x40}, 0x1, 0x0, 0x0, 0x20000804}, 0x8018) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000380)={'gre0\x00', &(0x7f0000000240)={'tunl0\x00', 0x0, 0x40, 0x40, 0x415c, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x2f, 0x0, @loopback, @multicast1}}}}) (async) socket$tipc(0x1e, 0x2, 0x0) (async) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r2, 0x50009418, &(0x7f00000013c0)={{r1}, 0x0, 0x1e, @inherit={0x58, &(0x7f00000000c0)=ANY=[@ANYBLOB="00000000000000000200000000000000fbdd7e82ffffffffffffff0000060000000000000000000000000006000000000000000200000000000000c708000000000000000100000000000002000000000000000100000000000080"]}, @subvolid}) (async) socket$tipc(0x1e, 0x5, 0x0) (async) connect$tipc(r3, &(0x7f0000000080)=@id={0x1e, 0x3, 0x1, {0x4e22, 0x2}}, 0x10) (async) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)="86fea6a14ace9a2aa83aaea82063356911caa06a05db35534a0efd665cf6cb21e570ea63e580448fb341bf173f57450cc1e14ac1714ce3f9da34191fdd22469c6326c219efdba5136998d5782e75cb73056dbd61399377996a69c3e4316b41ba4d2dc42b7029541ac5dbe177215765346ec208414cd8a2807e559c806e19459dc50d1e4a5a42b5c0283520b8ca64cdc526652c4b1d78a5f5ad83f9afc0b5586a9065f00cb196e28989a9ca2da9cd33e23a", 0xb1) (async) 1.212481191s ago: executing program 0 (id=49): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000001e00)={0x0, 0x0, &(0x7f0000001d80)=[{&(0x7f0000000240)=ANY=[@ANYBLOB="340000002eef0305000000000000000020000080080000000000000008000000", @ANYRES32, @ANYBLOB="0c000f0000001e39be"], 0x34}], 0x1}, 0x0) 1.188625951s ago: executing program 0 (id=50): r0 = syz_usb_connect$hid(0x2, 0x90, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000000000105804165000000000000109022400010000c04009040000010300000009210900000122a00009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async, rerun: 32) prctl$PR_SET_SECUREBITS(0x1c, 0xd) (async, rerun: 32) syz_usb_control_io(r0, &(0x7f0000000640)={0x2c, &(0x7f0000000380)=ANY=[@ANYBLOB="0005a0"], 0x0, 0x0, 0x0, 0x0}, 0x0) (async) r1 = inotify_init1(0x800) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) (async) inotify_add_watch(r1, &(0x7f0000005780)='./file0\x00', 0x44000001) r2 = syz_open_procfs(0x0, &(0x7f0000000140)='fdinfo/3\x00') (async) creat(&(0x7f0000000000)='./file0\x00', 0x1a3) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r4 = syz_open_dev$evdev(&(0x7f0000000080), 0x2, 0x842) r5 = dup3(r4, r3, 0x0) syz_usb_connect$cdc_ncm(0x0, 0x10f, &(0x7f0000000980)=ANY=[@ANYBLOB="12010001020000402505a1a44000010203010902fd0002013d00030904000001020d00000725060001318805240005000d240f0102000000d60846b4c0ff6364005c06241a8b0d0e1524120800a317a80a00000001a607c0ffcb7e392a0a2407020900030003005224130167d1c18d5d0043c227ab70e808000000000000005330b60be496fa32cc27884568a4a5572a4903119e525928720a3d07f577b9b610b499540d3f48c9aac4fd2fa7b633ea6c708c1ec40fbd04000000000000000ba317a88b045e4f01a607c0ffcb7e392a1524120300a3f7a78b045e4f01a607c0ff6ecb7e392a09058103100003005b0904010000020d00000904010102020d000009058202080000000509050302000492001029a622d6da279465af81c65451e8f5303b7c1f3b3d326d58792dd1855f33d08dc92a59aae3ce1004f4fb7f59719a528df11dfaa5fb17c635d4b00062e70764af3f23fc4aba1128850071898b57074645b6d4e976fbdd0c5b8c514f492bf0fbbfd883228f2f6c9671121a42d2018312b1b91fe1c2332c4f55c753d88672042bb912d50a6ce27d772cfb5fceae3ea0b73a1aaa2d4584ccd41d45abf97ece0707cc5160987fc00a177b14000000bdc4153f8235b42de243a133a1c267eb92fadbf217846854ef26e8797aee8e228b035b46602ee74c31b98f4b71b62123b2d65c793c931d3dfe55481db9a17562bbc54880cc51"], &(0x7f0000000940)={0xa, &(0x7f00000008c0)={0xa, 0x6, 0x200, 0x9, 0x9, 0x8, 0x20}, 0x2d, &(0x7f0000000900)={0x5, 0xf, 0x2d, 0x4, [@ssp_cap={0x14, 0x10, 0xa, 0x4, 0x2, 0x4a8, 0xf0f, 0x9, [0xffc03f, 0xf]}, @ext_cap={0x7, 0x10, 0x2, 0x4, 0x1, 0xc, 0x8}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x1, 0x4, 0x2, 0x7f}, @ptm_cap={0x3}]}}) (async, rerun: 64) ioctl$EVIOCGID(r5, 0x80084502, &(0x7f0000000180)=""/134) (rerun: 64) fsopen(&(0x7f0000000040)='configfs\x00', 0x0) (async) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r6, 0x0, 0x60, &(0x7f0000000340)={'filter\x00', 0x7, 0x4, 0x3e8, 0x218, 0x218, 0x108, 0x108, 0x300, 0x300, 0x4, 0x0, {[{{@arp={@local, @broadcast, 0xff000000, 0xff000000, 0xf, 0xf, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x43}, {[0xff, 0xff, 0xff, 0xff]}}, {@mac=@local, {[0xff, 0xff, 0x0, 0xff]}}, 0xffff, 0x9, 0x0, 0x40, 0x3f0, 0x2, 'bond0\x00', 'pimreg0\x00', {}, {}, 0x0, 0x4}, 0xc0, 0x108}, @unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x6af, 'syz1\x00', {0xed}}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @remote, @broadcast, 0x8, 0x1}}}, {{@arp={@local, @initdev={0xac, 0x1e, 0x0, 0x0}, 0xffffff00, 0xffffff00, 0x5, 0xe, {@empty, {[0x0, 0x0, 0xff, 0xff, 0x0, 0xff]}}, {@empty, {[0x0, 0x0, 0xff, 0xff, 0xff]}}, 0x80, 0x9, 0x0, 0x6, 0x9, 0x5, 'veth0_to_bridge\x00', 'gretap0\x00', {0xff}, {0xff}, 0x0, 0x13}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x438) (async, rerun: 32) r7 = landlock_create_ruleset(&(0x7f0000000240)={0xbfbb, 0x2, 0x3}, 0x18, 0x0) (rerun: 32) landlock_restrict_self(r7, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) (async) r8 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r8, &(0x7f0000000040)={0x2, 0x4e23, @remote}, 0x10) read$FUSE(r2, &(0x7f00000040c0)={0x2020}, 0x2020) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) ioctl$KVM_X86_SET_MCE(r11, 0x4040ae9e, &(0x7f0000000040)={0xa980000000000000, 0x40000, 0x8, 0x5, 0x12}) (async, rerun: 32) syz_usb_control_io(r0, 0x0, 0x0) (rerun: 32) syz_open_dev$hiddev(&(0x7f0000000340), 0x0, 0x801c0) 1.055578295s ago: executing program 3 (id=53): r0 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x1) fchdir(r1) openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) syz_pidfd_open(r3, 0x0) syz_pidfd_open(r3, 0x0) getpgid(r3) lseek(r2, 0xc33e, 0x2) syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040490d00700100010203010902270001010080320904000003080650000705010200020007058202000200070583"], 0x0) getdents64(r2, 0xfffffffffffffffe, 0x29) fsopen(&(0x7f0000000180)='proc\x00', 0x1) (async) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) (async) fsmount(r0, 0x0, 0x1) (async) fchdir(r1) (async) openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x0, 0x0) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0) (async) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) (async) syz_pidfd_open(r3, 0x0) (async) syz_pidfd_open(r3, 0x0) (async) getpgid(r3) (async) lseek(r2, 0xc33e, 0x2) (async) syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040490d00700100010203010902270001010080320904000003080650000705010200020007058202000200070583"], 0x0) (async) getdents64(r2, 0xfffffffffffffffe, 0x29) (async) 1.021053026s ago: executing program 2 (id=54): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) setsockopt(0xffffffffffffffff, 0x107, 0x1, 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) setsockopt(0xffffffffffffffff, 0x107, 0x2, 0x0, 0x0) ioctl$TIOCMSET(r0, 0x5418, &(0x7f0000000140)=0xfffffdfb) ioctl$TCSETSF(r0, 0x5404, &(0x7f0000000000)={0xffffffff, 0xc9a, 0x8007fffd, 0x0, 0xe, "dce4f0020100000000001b347d5c0001029600"}) r1 = socket(0xa, 0x3, 0x87) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000000)={@private2={0xfc, 0x2, '\x00', 0x1}, 0x8000018}) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f00000001c0)={@local, 0x18}) ioctl$sock_inet6_tcp_SIOCINQ(r1, 0x8936, &(0x7f0000000000)) socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TIOCOUTQ(r2, 0x5411, &(0x7f0000000080)) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r4, &(0x7f0000000680)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_STOP_AP(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x20, r3, 0x100, 0x70bd2d, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1f5, 0x6a}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x8000}, 0x40040) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, 0x0, 0x20000010) 952.395997ms ago: executing program 2 (id=55): r0 = socket$netlink(0x10, 0x3, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0x3, 0xf, 0x8, 0x80, 0x2, 0x3, 0x7f, 0x20000006, 0x20000000, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0x0, 0x5, 0x4, 0x0, 0xa, 0x3c1b, 0x1, 0x24, 0x800000d, 0x1, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x3, 0xc, 0x0, 0x8071, 0x7, 0x6, 0xffffffff, 0x7, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x5, 0x4, 0x8, 0x3ff, 0x80, 0xfffffff9, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012d, 0x8004, 0x5, 0xfffffff3, 0x129432e2, 0xc8, 0xf9, 0xe, 0x2ff, 0x1, 0x9, 0xfffffffc, 0x4, 0x10001, 0x0, 0x3, 0x2f, 0xe, 0x6, 0x78, 0xea4, 0x0, 0x3, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0x1000d, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x4, 0xf, 0xffff8001, 0x47, 0x31f3, 0x1, 0xfe000000, 0xfffe, 0x202, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x3, 0x42, 0x3], [0x5, 0x408, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x2, 0x5, 0x8, 0x4, 0x5, 0x5, 0x4, 0x1ef, 0x2, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0xc, 0x2, 0x2, 0x3, 0x20000008, 0x4004, 0xffffff11, 0x6, 0x38, 0x800003, 0x200, 0x83, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x3, 0xa9, 0x5, 0x6, 0xac8, 0xbf, 0x4002, 0x3, 0x7ff, 0x12b, 0x4, 0x40000001, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x1, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0x9, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10000, 0x9, 0x7fff, 0xffff, 0xa620, 0x1, 0x78b, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x1, 0xc8, 0x1, 0xfffff000, 0x5, 0x3, 0x0, 0x100, 0x9602, 0x7, 0xaf, 0x8, 0x6, 0x1, 0x5, 0x5, 0x8, 0x30b1d693, 0xa1f, 0xf44, 0x7, 0x1, 0x6c1b, 0x2, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff343e, 0xfff]}, 0x45c) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x2000000000000022, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r1 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_FD_FRAMES(r1, 0x65, 0x8, 0x0, &(0x7f0000000040)=0xffffffdd) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000580)=ANY=[@ANYBLOB="3400000013000100000100dffddbdf25070000f61600000008000000", @ANYRES32, @ANYBLOB="14001a8008"], 0x34}], 0x1, 0x0, 0x0, 0x4000}, 0x0) 952.293807ms ago: executing program 2 (id=56): openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) socket$igmp(0x2, 0x3, 0x2) socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/raw\x00') preadv(r0, &(0x7f0000000000)=[{&(0x7f0000000240)=""/4066, 0xfe2}], 0x1, 0x75, 0x0) mount(0x0, &(0x7f0000000200)='./tracing\x00', &(0x7f0000000280)='tracefs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./tracing/events/enable\x00', 0x100, 0x0) read$msr(r1, 0x0, 0x0) 951.884997ms ago: executing program 2 (id=57): syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000000000406d0762c20000000000010902240001"], 0x0) (async) syz_usb_connect$uac2(0x5, 0x8c, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0xe41, 0x4252, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x7a, 0x3, 0x1, 0x80, 0xe0, 0x7, {0x8, 0xb, 0x1, 0x1}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x2, 0x3, 0x1a, 0xc5}, [@processing_unit={0x5, 0x24, 0x8, 0x6, 0x1}, @output_terminal={0xc, 0x24, 0x3, 0xfd, 0x400, 0xa8, 0x2, 0x6, 0xfff9, 0xa}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x5, 0x4, 0x0, {0x8, 0x25, 0x1, 0x81, 0x9, 0x9, 0x2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x5, 0x4, 0x10, {0x8, 0x25, 0x1, 0x83, 0x0, 0xa, 0x2}}}}}}}}]}}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000380)={'team_slave_0\x00', &(0x7f0000000200)=@ethtool_sset_info={0x12, 0x0, 0x101}}) (async) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r0) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r2, @ANYRESHEX=r2], 0x34}}, 0x0) 879.486459ms ago: executing program 3 (id=58): r0 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet6(r0, &(0x7f00000077c0)=[{{&(0x7f0000002780)={0xa, 0x5, 0x800, @local, 0x5}, 0x1c, 0x0, 0x0, &(0x7f0000002800)=[@dontfrag={{0x14, 0x29, 0x3e, 0x1}}], 0x18, 0x1000000}}], 0x1, 0x40) 865.097819ms ago: executing program 3 (id=59): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x3, 0x8, @loopback, 0xfffffffe}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000540), 0x3c) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000140)=[{&(0x7f00000001c0)="580000001400192340834b80040d8c560a067f0202ff000000008700000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100040c10000000010000000000", 0x58}], 0x1) 773.511582ms ago: executing program 3 (id=60): socket(0x10, 0x803, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x38f680, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) socket$igmp(0x2, 0x3, 0x2) r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)={0x14, 0x15, 0x1, 0x70bd2c, 0x25dfdbfe, {0x28, 0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x20040000) socket$packet(0x11, 0x3, 0x300) r1 = socket$key(0xf, 0x3, 0x2) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) ioctl$TIOCSETD(r2, 0x5423, 0x0) syz_usb_connect$uac1(0x3, 0xdc, &(0x7f00000017c0)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c240208000103000000ff000924060506020100000924030003030005490c240206", @ANYRES8=r1, @ANYBLOB='\a'], 0x0) socket(0x10, 0x803, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x38f680, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) socket$igmp(0x2, 0x3, 0x2) (async) socket$nl_sock_diag(0x10, 0x3, 0x4) (async) sendmsg$SOCK_DIAG_BY_FAMILY(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)={0x14, 0x15, 0x1, 0x70bd2c, 0x25dfdbfe, {0x28, 0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x20040000) (async) socket$packet(0x11, 0x3, 0x300) (async) socket$key(0xf, 0x3, 0x2) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) (async) ioctl$TIOCSETD(r2, 0x5423, 0x0) (async) syz_usb_connect$uac1(0x3, 0xdc, &(0x7f00000017c0)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c240208000103000000ff000924060506020100000924030003030005490c240206", @ANYRES8=r1, @ANYBLOB='\a'], 0x0) (async) 499.640448ms ago: executing program 0 (id=61): r0 = syz_open_procfs(0x0, &(0x7f0000002100)='net/igmp\x00') preadv(r0, &(0x7f00000029c0)=[{&(0x7f0000002200)=""/175, 0xaf}], 0x1, 0x20007c, 0x8001) syz_usb_connect$uac1(0x3, 0x87, &(0x7f0000000100)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x8, 0x499, 0x1509, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x75, 0x3, 0x1, 0x7a, 0x60, 0x3, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xffff, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x6, 0x4, 0xfc, 0x2, "715eb9483414"}, @as_header={0x7, 0x24, 0x1, 0xff, 0x9, 0x1002}]}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x8, 0x1, 0x81, {0x7, 0x25, 0x1, 0xe, 0x0, 0x8}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x3, 0xc, 0xe9, {0x7, 0x25, 0x1, 0x0, 0x8, 0x3}}}}}}}}]}}, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) 101.156718ms ago: executing program 1 (id=62): r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000380)=[{&(0x7f0000000040)="39000000130003474cbb65e1c3e4160006000d00010000000700000025000000040016000c0014000800001f000006060400180000008cdb25", 0x39}], 0x1) 53.732289ms ago: executing program 3 (id=63): r0 = socket$netlink(0x10, 0x3, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)={0x130, 0x0, 0x4fcb6233, {0x0, 0x0, 0x0, '\x00', {0x7ff, 0x801, 0xadf, 0x804, 0xee01, 0x0, 0x2000, '\x00', 0x6, 0x81, 0x1, 0x3, {0x8, 0x8}, {0x4000000000006, 0x9}, {0x1, 0x7}, {0x1000000000, 0xa00}, 0x80008003, 0xa, 0xfffffffe, 0x6}}}}) sendmsg$netlink(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000300)=ANY=[@ANYBLOB="2400000076001f03000000000000800e08000000ffffffff0c000d80080003"], 0x24}], 0x1}, 0x0) 110.4µs ago: executing program 1 (id=64): r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) rmdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000240)={'gretap0\x00', &(0x7f0000000140)={'syztnl0\x00', 0x0, 0x1, 0x3, 0x7f, 0x5, {{0x1b, 0x4, 0x1, 0x14, 0x6c, 0x64, 0x0, 0x9a, 0x4, 0x0, @remote, @local, {[@timestamp_addr={0x44, 0x34, 0x20, 0x1, 0xf, [{@remote, 0x2}, {@empty, 0x1}, {@multicast2, 0x3}, {@multicast1, 0x5}, {@empty}, {@remote, 0x5}]}, @generic={0x7, 0xc, "da942f247729740da15f"}, @timestamp_addr={0x44, 0xc, 0xf, 0x1, 0xd, [{@empty, 0x4}]}, @end, @ssrr={0x89, 0x7, 0x5, [@multicast1]}, @end]}}}}}) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000200)={0x28, r0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@ETHTOOL_A_CHANNELS_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}]}, @ETHTOOL_A_CHANNELS_COMBINED_COUNT={0x8, 0x9, 0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x20008000}, 0x40850) 0s ago: executing program 3 (id=65): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010026bd7000fbdbdf2505000000090001800d0001007564703a244bf1a32e26"], 0x34}, 0x1, 0x0, 0x0, 0x48c05}, 0x4040140) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.52' (ED25519) to the list of known hosts. [ 23.147130][ T36] audit: type=1400 audit(1787620028.310:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.150723][ T286] cgroup: Unknown subsys name 'net' [ 23.169986][ T36] audit: type=1400 audit(1787620028.310:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.197254][ T36] audit: type=1400 audit(1787620028.340:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.197652][ T286] cgroup: Unknown subsys name 'devices' [ 23.318447][ T286] cgroup: Unknown subsys name 'hugetlb' [ 23.324192][ T286] cgroup: Unknown subsys name 'rlimit' [ 23.439553][ T36] audit: type=1400 audit(1787620028.600:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.462782][ T36] audit: type=1400 audit(1787620028.600:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.487754][ T36] audit: type=1400 audit(1787620028.600:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.511951][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 23.520802][ T36] audit: type=1400 audit(1787620028.680:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.546327][ T36] audit: type=1400 audit(1787620028.680:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.600082][ T36] audit: type=1400 audit(1787620028.760:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.625754][ T36] audit: type=1400 audit(1787620028.760:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.626536][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 24.377005][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.384125][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.394478][ T293] bridge_slave_0: entered allmulticast mode [ 24.401140][ T293] bridge_slave_0: entered promiscuous mode [ 24.421246][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.428733][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.435853][ T293] bridge_slave_1: entered allmulticast mode [ 24.442305][ T293] bridge_slave_1: entered promiscuous mode [ 24.570991][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.578105][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.585185][ T297] bridge_slave_0: entered allmulticast mode [ 24.591764][ T297] bridge_slave_0: entered promiscuous mode [ 24.602978][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.610125][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.617264][ T297] bridge_slave_1: entered allmulticast mode [ 24.623529][ T297] bridge_slave_1: entered promiscuous mode [ 24.642451][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.649554][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.656896][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.663930][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.684734][ T299] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.691908][ T299] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.699358][ T299] bridge_slave_0: entered allmulticast mode [ 24.705638][ T299] bridge_slave_0: entered promiscuous mode [ 24.713248][ T299] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.720346][ T299] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.727595][ T299] bridge_slave_1: entered allmulticast mode [ 24.733891][ T299] bridge_slave_1: entered promiscuous mode [ 24.755622][ T298] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.762777][ T298] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.769944][ T298] bridge_slave_0: entered allmulticast mode [ 24.776256][ T298] bridge_slave_0: entered promiscuous mode [ 24.797950][ T298] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.805039][ T298] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.812303][ T298] bridge_slave_1: entered allmulticast mode [ 24.818761][ T298] bridge_slave_1: entered promiscuous mode [ 24.907236][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.929067][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.936252][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.019039][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.026147][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.033869][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.040949][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.080829][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.088008][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.095789][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.102866][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.110996][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.118075][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.125585][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.132653][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.156858][ T293] veth0_vlan: entered promiscuous mode [ 25.162544][ T297] veth0_vlan: entered promiscuous mode [ 25.189103][ T297] veth1_macvtap: entered promiscuous mode [ 25.206800][ T299] veth0_vlan: entered promiscuous mode [ 25.225758][ T293] veth1_macvtap: entered promiscuous mode [ 25.253301][ T298] veth0_vlan: entered promiscuous mode [ 25.260440][ T297] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 25.264136][ T299] veth1_macvtap: entered promiscuous mode [ 25.295092][ T298] veth1_macvtap: entered promiscuous mode [ 25.341797][ T315] netlink: 5 bytes leftover after parsing attributes in process `syz.2.5'. [ 25.351742][ T315] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 25.450777][ T329] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=329 comm=syz.3.7 [ 25.463682][ T329] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7'. [ 25.515807][ T337] raw_sendmsg: syz.1.10 forgot to set AF_INET. Fix it! [ 25.554498][ T339] Zero length message leads to an empty skb [ 25.611058][ T343] rust_binder: 342:343 FDA parent offset not aligned correctly [ 25.618827][ T343] rust_binder: 342:343 error while translating object: EINVAL [ 25.626581][ T343] rust_binder: Failure in copy_transaction_data: EINVAL [ 25.626642][ T343] rust_binder: 342:343 transaction call to 342:0 failed EINVAL, code 0 size 80-24 [ 25.643676][ T316] rust_binder: 342: undelivered TRANSACTION_ERROR: 29201 [ 25.666186][ T66] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 25.686250][ T31] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 25.712645][ T349] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.736902][ T327] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 25.816320][ T66] usb 3-1: Using ep0 maxpacket: 32 [ 25.821558][ T31] usb 1-1: device descriptor read/64, error -71 [ 25.829811][ T66] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 25.841162][ T66] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 25.851442][ T66] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 25.860767][ T66] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.870471][ T66] usb 3-1: config 0 descriptor?? [ 25.876724][ T66] hub 3-1:0.0: USB hub found [ 25.887232][ T327] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 25.895471][ T327] usb 4-1: config 0 has no interface number 0 [ 25.902854][ T327] usb 4-1: config 0 interface 1 altsetting 128 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 25.914347][ T327] usb 4-1: config 0 interface 1 altsetting 128 endpoint 0x81 has invalid wMaxPacketSize 0 [ 25.924717][ T327] usb 4-1: config 0 interface 1 altsetting 128 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 25.940771][ T327] usb 4-1: config 0 interface 1 has no altsetting 0 [ 25.956861][ T327] usb 4-1: New USB device found, idVendor=145f, idProduct=0212, bcdDevice= 0.00 [ 25.970131][ T353] syz.1.17: attempt to access beyond end of device [ 25.970131][ T353] loop1: rw=0, sector=0, nr_sectors = 1 limit=0 [ 25.983334][ T327] usb 4-1: New USB device strings: Mfr=93, Product=0, SerialNumber=0 [ 25.991945][ T327] usb 4-1: Manufacturer: syz [ 25.997668][ T327] usb 4-1: config 0 descriptor?? [ 26.002850][ T353] FAT-fs (loop1): unable to read boot sector [ 26.076397][ T31] usb 1-1: device descriptor read/64, error -71 [ 26.083624][ T66] hub 3-1:0.0: config failed, hub has too many ports! (err -19) [ 26.284868][ T66] usbhid 3-1:0.0: can't add hid device: -71 [ 26.291161][ T66] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 26.316466][ T66] usb 3-1: USB disconnect, device number 2 [ 26.326227][ T31] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 26.333795][ T45] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 26.466208][ T31] usb 1-1: device descriptor read/64, error -71 [ 26.487297][ T45] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x8 has invalid wMaxPacketSize 0 [ 26.498353][ T45] usb 2-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 26.507506][ T45] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.515561][ T45] usb 2-1: Product: syz [ 26.519806][ T45] usb 2-1: Manufacturer: syz [ 26.524437][ T45] usb 2-1: SerialNumber: syz [ 26.623169][ T327] uclogic 0003:145F:0212.0001: failed retrieving string descriptor #100: -71 [ 26.632263][ T327] uclogic 0003:145F:0212.0001: failed retrieving pen parameters: -71 [ 26.640439][ T327] uclogic 0003:145F:0212.0001: pen probing failed: -71 [ 26.647565][ T327] uclogic 0003:145F:0212.0001: failed probing parameters: -71 [ 26.655085][ T327] uclogic 0003:145F:0212.0001: probe with driver uclogic failed with error -71 [ 26.665733][ T327] usb 4-1: USB disconnect, device number 2 [ 26.726198][ T31] usb 1-1: device descriptor read/64, error -71 [ 26.737324][ T362] netlink: 96 bytes leftover after parsing attributes in process `syz.1.19'. [ 26.816481][ T45] usb 2-1: MIDIStreaming interface descriptor not found [ 26.827789][ T45] usb 2-1: too many endpoints [ 26.836572][ T45] usb 2-1: USB disconnect, device number 2 [ 26.846382][ T31] usb usb1-port1: attempt power cycle [ 26.859105][ T322] udevd[322]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 26.878545][ T372] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=59950 sclass=netlink_route_socket pid=372 comm=syz.1.23 [ 27.216155][ T31] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 27.237441][ T31] usb 1-1: device descriptor read/8, error -71 [ 27.362254][ T392] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=392 comm=syz.1.32 [ 27.375244][ T392] netlink: 8 bytes leftover after parsing attributes in process `syz.1.32'. [ 27.377747][ T31] usb 1-1: device descriptor read/8, error -71 [ 27.386408][ T316] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 27.533346][ T406] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 27.557558][ T316] usb 4-1: unable to get BOS descriptor or descriptor too short [ 27.567883][ T316] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 27.578858][ T316] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 27.587858][ T316] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 27.605147][ T316] usb 4-1: New USB device found, idVendor=8086, idProduct=0ad2, bcdDevice= 0.00 [ 27.614751][ T316] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 27.622851][ T316] usb 4-1: Product: syz [ 27.628108][ T316] usb 4-1: Manufacturer: syz [ 27.636145][ T31] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 27.638367][ T316] usb 4-1: Found UVC 1.00 device syz (8086:0ad2) [ 27.667144][ T31] usb 1-1: device descriptor read/8, error -71 [ 27.679746][ T412] netlink: 20 bytes leftover after parsing attributes in process `syz.2.42'. [ 27.797261][ T31] usb 1-1: device descriptor read/8, error -71 [ 27.886152][ T327] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 27.906223][ T31] usb usb1-port1: unable to enumerate USB device [ 27.956243][ T10] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 28.039817][ T316] usb 4-1: No streaming interface found for terminal 2. [ 28.057350][ T327] usb 2-1: Using ep0 maxpacket: 16 [ 28.063644][ T327] usb 2-1: config 0 has an invalid interface number: 34 but max is 0 [ 28.071966][ T327] usb 2-1: config 0 has no interface number 0 [ 28.078111][ T327] usb 2-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 28.088175][ T327] usb 2-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 28.099570][ T327] usb 2-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 28.108687][ T327] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.116199][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 28.116768][ T327] usb 2-1: Product: syz [ 28.125429][ T10] usb 3-1: New USB device found, idVendor=249c, idProduct=932c, bcdDevice= 0.40 [ 28.125910][ T327] usb 2-1: Manufacturer: syz [ 28.136016][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.139863][ T327] usb 2-1: SerialNumber: syz [ 28.148245][ T10] usb 3-1: Product: syz [ 28.156551][ T10] usb 3-1: Manufacturer: syz [ 28.157171][ T327] usb 2-1: config 0 descriptor?? [ 28.162241][ T10] usb 3-1: SerialNumber: syz [ 28.170966][ T410] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 28.178381][ T410] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 28.248474][ T31] usb 4-1: USB disconnect, device number 3 [ 28.381277][ T10] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 28.388486][ T10] usb 3-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 28.390532][ T410] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 28.403747][ T410] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 28.404315][ T10] usb 3-1: USB disconnect, device number 3 [ 28.425010][ T310] udevd[310]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 28.452256][ T36] kauditd_printk_skb: 81 callbacks suppressed [ 28.452275][ T36] audit: type=1400 audit(1787620033.610:155): avc: denied { write } for pid=419 comm="syz.0.45" name="001" dev="devtmpfs" ino=120 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 28.487661][ T420] usb usb9: usbfs: process 420 (syz.0.45) did not claim interface 0 before use [ 28.513204][ T36] audit: type=1400 audit(1787620033.670:156): avc: denied { create } for pid=422 comm="syz.0.46" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 28.532599][ T36] audit: type=1400 audit(1787620033.670:157): avc: denied { create } for pid=422 comm="syz.0.46" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 28.553476][ T36] audit: type=1400 audit(1787620033.670:158): avc: denied { mmap_zero } for pid=422 comm="syz.0.46" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 28.573065][ T36] audit: type=1400 audit(1787620033.680:159): avc: denied { map } for pid=422 comm="syz.0.46" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=3909 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 28.598580][ T36] audit: type=1400 audit(1787620033.680:160): avc: denied { read write } for pid=422 comm="syz.0.46" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=3909 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 28.623781][ T36] audit: type=1400 audit(1787620033.680:161): avc: denied { map } for pid=422 comm="syz.0.46" path="socket:[3908]" dev="sockfs" ino=3908 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 28.650995][ T36] audit: type=1400 audit(1787620033.810:162): avc: denied { create } for pid=425 comm="syz.0.47" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 28.672880][ T36] audit: type=1400 audit(1787620033.810:163): avc: denied { shutdown } for pid=425 comm="syz.0.47" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 28.698481][ T36] audit: type=1400 audit(1787620033.810:164): avc: denied { write } for pid=425 comm="syz.0.47" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 28.733722][ T433] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=61230 sclass=netlink_route_socket pid=433 comm=syz.0.49 [ 28.994257][ T456] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 29.002752][ T10] usb 1-1: new full-speed USB device number 6 using dummy_hcd [ 29.006757][ T456] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 29.157351][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 29.168710][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 29.179191][ T10] usb 1-1: New USB device found, idVendor=0458, idProduct=5016, bcdDevice= 0.00 [ 29.188325][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.197336][ T10] usb 1-1: config 0 descriptor?? [ 29.226148][ T66] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 29.307300][ T327] asix 2-1:0.34 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 29.317622][ T327] asix 2-1:0.34 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x00b0: ffffffb9 [ 29.346203][ T327] asix 2-1:0.34: probe with driver asix failed with error -71 [ 29.355103][ T327] usb 2-1: USB disconnect, device number 3 [ 29.377319][ T66] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 29.387510][ T66] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 29.396585][ T66] usb 3-1: New USB device found, idVendor=076d, idProduct=c262, bcdDevice= 0.00 [ 29.405672][ T66] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.414705][ T66] usb 3-1: config 0 descriptor?? [ 29.422919][ T10] kye 0003:0458:5016.0002: control desc unexpectedly large [ 29.428836][ T31] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 29.450430][ T10] input: HID 0458:5016 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0458:5016.0002/input/input5 [ 29.474466][ T10] input: HID 0458:5016 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0458:5016.0002/input/input6 [ 29.496889][ T10] kye 0003:0458:5016.0002: input,hiddev96,hidraw0: USB HID v0.09 Device [HID 0458:5016] on usb-dummy_hcd.0-1/input0 [ 29.512537][ T10] usb 1-1: USB disconnect, device number 6 [ 29.536592][ T472] fido_id[472]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 29.586172][ T31] usb 4-1: Using ep0 maxpacket: 16 [ 29.592690][ T31] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 29.604105][ T31] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 29.614736][ T31] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 29.623880][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.631988][ T31] usb 4-1: Product: syz [ 29.636216][ T31] usb 4-1: Manufacturer: syz [ 29.640326][ T418] usb 3-1: USB disconnect, device number 4 [ 29.640820][ T31] usb 4-1: SerialNumber: syz [ 29.851493][ T474] netlink: 5 bytes leftover after parsing attributes in process `syz.1.62'. [ 29.863448][ T474] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 29.880291][ T31] usb 4-1: 0:2 : does not exist [ 29.890406][ T31] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 29.906249][ T10] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 29.916249][ T31] usb 4-1: USB disconnect, device number 4 [ 29.930833][ T481] BUG: scheduling while atomic: syz.1.64/481/0x00000002 [ 29.937876][ T481] Modules linked in: [ 29.942048][ T481] CPU: 0 UID: 0 PID: 481 Comm: syz.1.64 Not tainted syzkaller #0 f2f9be0cb5819eb91f3cdfab905957d5e4b40d7b [ 29.942082][ T481] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 29.942105][ T481] Call Trace: [ 29.942113][ T481] [ 29.942122][ T481] __dump_stack+0x21/0x30 [ 29.942167][ T481] dump_stack_lvl+0x140/0x1c0 [ 29.942201][ T481] ? __cfi_dump_stack_lvl+0x10/0x10 [ 29.942235][ T481] ? is_bpf_text_address+0x17b/0x1a0 [ 29.942271][ T481] dump_stack+0x19/0x20 [ 29.942303][ T481] __schedule_bug+0x12b/0x200 [ 29.942329][ T481] ? find_proxy_task+0x2460/0x2460 [ 29.942357][ T481] __schedule+0xb85/0x20b0 [ 29.942395][ T481] ? is_bpf_text_address+0x17b/0x1a0 [ 29.942432][ T481] ? kernel_text_address+0xa9/0xe0 [ 29.942466][ T481] ? __sched_text_start+0x10/0x10 [ 29.942501][ T481] ? unwind_get_return_address+0x51/0x90 [ 29.942534][ T481] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 29.942564][ T481] ? arch_stack_walk+0x10a/0x170 [ 29.942589][ T481] ? __kasan_check_write+0x18/0x20 [ 29.942614][ T481] ? _raw_spin_lock_irq+0x93/0x120 [ 29.942646][ T481] ? rwsem_set_nonspinnable+0x140/0x140 [ 29.942684][ T481] schedule+0xc5/0x240 [ 29.942720][ T481] schedule_preempt_disabled+0x14/0x30 [ 29.942756][ T481] rwsem_down_read_slowpath+0x88c/0x14c0 [ 29.942797][ T481] ? down_write_killable+0x2d0/0x2d0 [ 29.942827][ T481] ? __kasan_check_write+0x18/0x20 [ 29.942852][ T481] ? downgrade_write+0x470/0x470 [ 29.942889][ T481] ? call_rcu_nocb+0x694/0xc60 [ 29.942925][ T481] down_read+0x95/0xe0 [ 29.942950][ T481] ? __cfi_down_read+0x10/0x10 [ 29.942977][ T481] kernfs_find_and_get_ns+0x76/0x130 [ 29.943011][ T481] sysfs_unmerge_group+0x66/0x130 [ 29.943040][ T481] dpm_sysfs_remove+0x64/0xd0 [ 29.943072][ T481] device_del+0x241/0xcf0 [ 29.943106][ T481] ? __cfi_class_find_device+0x10/0x10 [ 29.943133][ T481] ? __cfi_device_del+0x10/0x10 [ 29.943168][ T481] ? __kasan_check_write+0x18/0x20 [ 29.943190][ T481] ? kobject_put+0x1cc/0x2a0 [ 29.943221][ T481] device_destroy+0xb0/0x100 [ 29.943243][ T481] ? __cfi_device_destroy+0x10/0x10 [ 29.943264][ T481] ? __kasan_check_write+0x18/0x20 [ 29.943288][ T481] android_device_destroy+0x118/0x180 [ 29.943322][ T481] gadgets_drop+0x1d/0x30 [ 29.943345][ T481] ? __cfi_gadgets_drop+0x10/0x10 [ 29.943367][ T481] configfs_rmdir+0x8b7/0x9b0 [ 29.943401][ T481] vfs_rmdir+0x3db/0x560 [ 29.943436][ T481] do_rmdir+0x29a/0x590 [ 29.943467][ T481] ? __cfi_do_rmdir+0x10/0x10 [ 29.943500][ T481] ? __kasan_check_write+0x18/0x20 [ 29.943527][ T481] __x64_sys_rmdir+0x4b/0x60 [ 29.943562][ T481] x64_sys_call+0xaf7/0x2ee0 [ 29.943585][ T481] do_syscall_64+0x57/0xf0 [ 29.943617][ T481] ? clear_bhb_loop+0x50/0xa0 [ 29.943647][ T481] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 29.943685][ T481] RIP: 0033:0x7f69bc59e0d9 [ 29.943706][ T481] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 29.943727][ T481] RSP: 002b:00007f69bd52e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 29.943753][ T481] RAX: ffffffffffffffda RBX: 00007f69bc825fa0 RCX: 00007f69bc59e0d9 [ 29.943779][ T481] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000600 [ 29.943786][ T483] netlink: 20 bytes leftover after parsing attributes in process `syz.3.65'. [ 29.943794][ T481] RBP: 00007f69bc635024 R08: 0000000000000000 R09: 0000000000000000 [ 29.943810][ T481] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 29.943846][ T481] R13: 00007f69bc826038 R14: 00007f69bc825fa0 R15: 00007fffa57b1528 [ 29.943929][ T481] [ 30.096235][ T10] usb 1-1: Using ep0 maxpacket: 8 [ 30.098571][ T483] netlink: 5 bytes leftover after parsing attributes in process `syz.3.65'. [ 30.105864][ T481] ------------[ cut here ]------------ [ 30.324141][ T481] WARNING: CPU: 1 PID: 481 at lib/stackdepot.c:635 stack_depot_save_flags+0x266/0x800 [ 30.333818][ T481] Modules linked in: [ 30.337790][ T481] CPU: 1 UID: 0 PID: 481 Comm: syz.1.64 Tainted: G W syzkaller #0 f2f9be0cb5819eb91f3cdfab905957d5e4b40d7b [ 30.338495][ T10] usb 1-1: unable to get BOS descriptor or descriptor too short [ 30.350628][ T481] Tainted: [W]=WARN [ 30.350639][ T481] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 30.362795][ T10] usb 1-1: string descriptor 0 read error: -22 [ 30.372300][ T481] RIP: 0010:stack_depot_save_flags+0x266/0x800 [ 30.380018][ T10] usb 1-1: New USB device found, idVendor=0499, idProduct=1509, bcdDevice= 0.40 [ 30.385049][ T481] Code: 48 83 3d b4 f8 db 05 00 0f 84 00 04 00 00 48 c7 45 c0 00 00 00 00 48 89 d3 65 8b 05 cc 69 1e 7d 4d 89 d7 a9 00 00 f0 00 74 2d <0f> 0b 48 c7 45 c8 00 00 00 00 9c 8f 45 c8 4c 8b 6d c8 fa 48 c7 c7 [ 30.385071][ T481] RSP: 0018:ffffc9000ddb7980 EFLAGS: 00010206 [ 30.394276][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.403940][ T10] usb 1-1: 1:1: invalid format type 0x1002 is detected, processed as PCM [ 30.414126][ T481] [ 30.414137][ T481] RAX: 000000007fffffff RBX: ffff8881f5e8ea10 RCX: 0000000000c8ea10 [ 30.421010][ T10] usb 1-1: 1:1 : sample bitwidth 252 in over sample bytes 4 [ 30.428239][ T481] RDX: ffff8881f5e8ea10 RSI: 0000000000000001 RDI: 000000008df43d8d [ 30.462686][ T481] RBP: ffffc9000ddb79e0 R08: 000000007b61c6d6 R09: 00000000c61f2355 [ 30.471008][ T481] R10: 000000000000000d R11: ffffffff81759ed0 R12: 00000000465c8ea1 [ 30.479062][ T481] R13: 0000000000000000 R14: ffffc9000ddb79f0 R15: 000000000000000d [ 30.487095][ T481] FS: 00007f69bd52e6c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 30.496126][ T481] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 30.502746][ T481] CR2: 000055dba3c2e008 CR3: 000000013454a000 CR4: 00000000003526b0 [ 30.510779][ T481] Call Trace: [ 30.514081][ T481] [ 30.517078][ T481] ? do_syscall_64+0x57/0xf0 [ 30.521723][ T481] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 30.527866][ T481] kasan_save_track+0x4f/0x80 [ 30.532585][ T481] ? kasan_save_track+0x3e/0x80 [ 30.538080][ T481] ? kasan_save_free_info+0x44/0x50 [ 30.543319][ T481] ? __kasan_slab_free+0x5f/0x80 [ 30.548594][ T481] ? kfree+0x158/0x440 [ 30.552729][ T481] ? gadget_info_attr_release+0xcb/0x130 [ 30.558425][ T481] ? config_item_put+0x178/0x240 [ 30.563405][ T481] ? configfs_rmdir+0x8e8/0x9b0 [ 30.568353][ T481] ? vfs_rmdir+0x3db/0x560 [ 30.572806][ T481] ? do_rmdir+0x29a/0x590 [ 30.577218][ T481] ? __x64_sys_rmdir+0x4b/0x60 [ 30.582026][ T481] ? x64_sys_call+0xaf7/0x2ee0 [ 30.586845][ T481] ? do_syscall_64+0x57/0xf0 [ 30.591517][ T481] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 30.597670][ T481] kasan_save_free_info+0x44/0x50 [ 30.602731][ T481] __kasan_slab_free+0x5f/0x80 [ 30.607575][ T481] kfree+0x158/0x440 [ 30.610463][ T10] usb 1-1: failed to enable PITCH for EP 0x1 [ 30.611501][ T481] ? gadget_info_attr_release+0xcb/0x130 [ 30.623659][ T481] ? __cfi_gadget_info_attr_release+0x10/0x10 [ 30.626238][ T10] usb 1-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 30.630495][ T481] gadget_info_attr_release+0xcb/0x130 [ 30.641986][ T481] config_item_put+0x178/0x240 [ 30.646846][ T481] ? __cfi_gadgets_drop+0x10/0x10 [ 30.651937][ T481] configfs_rmdir+0x8e8/0x9b0 [ 30.656693][ T481] vfs_rmdir+0x3db/0x560 [ 30.660988][ T481] do_rmdir+0x29a/0x590 [ 30.665196][ T481] ? __cfi_do_rmdir+0x10/0x10 [ 30.669963][ T481] ? __kasan_check_write+0x18/0x20 [ 30.675123][ T481] __x64_sys_rmdir+0x4b/0x60 [ 30.679838][ T481] x64_sys_call+0xaf7/0x2ee0 [ 30.684488][ T481] do_syscall_64+0x57/0xf0 [ 30.689000][ T481] ? clear_bhb_loop+0x50/0xa0 [ 30.693731][ T481] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 30.694746][ T10] usb 1-1: USB disconnect, device number 7 [ 30.699812][ T481] RIP: 0033:0x7f69bc59e0d9 [ 30.699836][ T481] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 30.699856][ T481] RSP: 002b:00007f69bd52e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 30.699888][ T481] RAX: ffffffffffffffda RBX: 00007f69bc825fa0 RCX: 00007f69bc59e0d9 [ 30.699907][ T481] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000600 [ 30.699923][ T481] RBP: 00007f69bc635024 R08: 0000000000000000 R09: 0000000000000000 [ 30.699938][ T481] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 30.699952][ T481] R13: 00007f69bc826038 R14: 00007f69bc825fa0 R15: 00007fffa57b1528 [ 30.699973][ T481] [ 30.699982][ T481] ---[ end trace 0000000000000000 ]--- [ 30.738285][ T481] BUG: scheduling while atomic: syz.1.64/481/0x00000000 [ 30.795160][ T481] Modules linked in: [ 30.799201][ T481] CPU: 1 UID: 0 PID: 481 Comm: syz.1.64 Tainted: G W syzkaller #0 f2f9be0cb5819eb91f3cdfab905957d5e4b40d7b [ 30.799240][ T481] Tainted: [W]=WARN [ 30.799248][ T481] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 30.799262][ T481] Call Trace: [ 30.799269][ T481] [ 30.799277][ T481] __dump_stack+0x21/0x30 [ 30.799317][ T481] dump_stack_lvl+0x140/0x1c0 [ 30.799353][ T481] ? __cfi_dump_stack_lvl+0x10/0x10 [ 30.799387][ T481] ? kernel_text_address+0xa9/0xe0 [ 30.799423][ T481] dump_stack+0x19/0x20 [ 30.799456][ T481] __schedule_bug+0x12b/0x200 [ 30.799483][ T481] ? find_proxy_task+0x2460/0x2460 [ 30.799511][ T481] ? is_bpf_text_address+0x17b/0x1a0 [ 30.799549][ T481] __schedule+0xb85/0x20b0 [ 30.799585][ T481] ? __kernel_text_address+0x11/0x40 [ 30.799619][ T481] ? plist_check_list+0x2a1/0x2c0 [ 30.799654][ T481] ? __sched_text_start+0x10/0x10 [ 30.799689][ T481] ? plist_add+0x4d4/0x570 [ 30.799722][ T481] ? __futex_queue+0x19f/0x350 [ 30.799755][ T481] ? __cfi___futex_queue+0x10/0x10 [ 30.799787][ T481] schedule+0xc5/0x240 [ 30.799822][ T481] futex_wait_queue+0xfc/0x240 [ 30.799845][ T481] __futex_wait+0x15b/0x3d0 [ 30.799877][ T481] ? __cfi___futex_wait+0x10/0x10 [ 30.799902][ T481] ? __cfi_futex_wake_mark+0x10/0x10 [ 30.799925][ T481] ? __kasan_check_read+0x15/0x20 [ 30.799951][ T481] ? futex_wake+0x627/0x950 [ 30.799973][ T481] ? futex_setup_timer+0xb4/0xd0 [ 30.800004][ T481] futex_wait+0x128/0x7c0 [ 30.800027][ T481] ? __cfi_futex_wait+0x10/0x10 [ 30.800053][ T481] do_futex+0x32a/0x510 [ 30.800086][ T481] ? __cfi_do_futex+0x10/0x10 [ 30.800117][ T481] ? __kasan_slab_free+0x6a/0x80 [ 30.800147][ T481] ? kmem_cache_free+0x1bd/0x4f0 [ 30.800174][ T481] __se_sys_futex+0x13c/0x320 [ 30.800207][ T481] ? putname+0x113/0x150 [ 30.800235][ T481] ? __x64_sys_futex+0x110/0x110 [ 30.800270][ T481] __x64_sys_futex+0xe9/0x110 [ 30.800304][ T481] x64_sys_call+0x227f/0x2ee0 [ 30.800326][ T481] do_syscall_64+0x57/0xf0 [ 30.800359][ T481] ? clear_bhb_loop+0x50/0xa0 [ 30.800386][ T481] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 30.800425][ T481] RIP: 0033:0x7f69bc59e0d9 [ 30.800446][ T481] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 30.800466][ T481] RSP: 002b:00007f69bd52e0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 30.800504][ T481] RAX: ffffffffffffffda RBX: 00007f69bc825fa8 RCX: 00007f69bc59e0d9 [ 30.800521][ T481] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f69bc825fa8 [ 30.800537][ T481] RBP: 00007f69bc825fa0 R08: 0000000000000000 R09: 0000000000000000 [ 30.800551][ T481] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 30.800565][ T481] R13: 00007f69bc826038 R14: 00007fffa57b1440 R15: 00007fffa57b1528 [ 30.800586][ T481]