last executing test programs: 6.987150918s ago: executing program 1 (id=167): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r1) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$sock_int(r1, 0x1, 0x29, &(0x7f0000000280)=0x80000000, 0x4) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) r3 = inotify_init1(0x800) sync_file_range(r3, 0xfffffffffffff800, 0x10004, 0x5) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000200)=[{0x6, 0x3, 0x0, 0x6}]}, 0x10) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000240)={0x2, 0xffff, @dev={0xac, 0x14, 0x14, 0x2d}}, 0x10) sendmmsg$inet(r4, &(0x7f0000002080)=[{{&(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10, &(0x7f0000000c80)=[{&(0x7f00000000c0)="fe3c75b276077fc35911f546eac465645aa92c329d22ffbc788e506d852723e2337591365c05e594c38a11b4f2baff4d0f1602c0bdf4c3fbb581421631d4e319aad5acd0922cc47e1ad1af5118208a8887090b7589a06ee0cdfc4a91092393ff52aa490100032d557ceec6ff521222d645daf4da328a8e481f4e07e0bca05b5a8f87a1ae2bbb7e428921b3f350c9641376946127f5ffa0953dea4489a5071812df69bd736d31ac5920beb426e82aef92caa9426c45a59ba821f951b1eb3009237bc67102b3d53cd38229b990778c9f1eddc861d9a8e88518793bc58a696d47b6c44573599123bf52a5965f4b0d03dc76c0a87ea24812681833d2788d022bf57bee519bfa20c6c698480062647785d9667cd3804ac83d5e65c9a667aa43a063", 0x11f}, {&(0x7f0000000640)="6c8c778bd61f52153eadf672a8afd4ac2cd4485dcd4ec767a7bc9928c1328c782cc6c00961536b8714456de68c0b95c356c5b4aabed86f3324eeb0d0c5180e6ee7", 0x41}, {&(0x7f00000006c0)="0998b6d80a5faee59cbeec7bcfcf9c1e2063f5c7082c6896033bfc01320f555949aa7fb3aa9d03660281ad546de98f985dd938e4ed7e46ad0a835981830e04e89e6a70df4c3d0e95a4ff35c7fdcdc22db9305a009437df2d7eeb7d268c412a2a8b4dc9a4a82b330784399d9b907b59e310e590915cf77c7e8aebd679af6993193e5d6f9b2d040a353af1b5a36d640147dc4a59034dfb80c58eaf1ed1b1c0a1d6c26cd0e6238521f2e427", 0xaa}, {&(0x7f0000000780)="b36fb12aeed1fca7dbe86cf8a51fcba64a4500b788fff99c2fea82772ec33fc8474c776390bdeadd0d0163242a6aeee9f37464", 0x33}, {&(0x7f00000007c0)="c53403c9821d42ed436ddabc91e99c52cf74e4b7206281f94b750df03503ba7407ac3ed8d4423ff381d8c5ac6672bec3e85d29de039e96e57d5f68983261f0f7ab687cee54125ba3c3ae32dc0a78f5fefac1a06071f63da3c50eac66f63e6faad0176c96972e6e4e6314f80acf08a24b714ad9cd607f1e1d680b8f6be20f06fad2a91d3bbed6eb8651887af873", 0x8d}], 0x5}}, {{0x0, 0x0, &(0x7f0000003780)=[{&(0x7f00000037c0)="6985100ddecb741d39068639baefb93383602f529580bd26d98f9828ed127dc304fdbd412cc02db818e9aa5a571f4983db5477c17a5166c472fa579c92bd6748b0f88f7a2909e7ec90e01a290bc57641e89ab31b7997f4e77b7e2593fa025834ebad7838e2ac033a1b08c204f5edf137845a52cc8464cc0c830bee7efcaa7e7198735b9555b2b57898f2fa42b97f3f6e64fddace78578c97f758559d5146abcfdd1a5f4edeb1c0680f2d95f86b8efd69a60d1a65320421d09224d9cd3fa1396ce69c1d98ef782820e57640dc567209d4cc1fd2fec98ef36a18e90ba68f415f2c7a70ecd21a964ba0a2dc76bee9d8534da8d976607882b63076cf18f34b2b888b56d18993074fec22409fabfe420740c3b7305a005459d8916d796929111028cd9919704c2a55c55b1507476832867d4b0014fc5332ccb7a79a8c30b6c40d9601931d320a4ad31dfd2307d2962df7ac92dd5aea2b2912bd92654bfbc4109ab73805b59d42d687e35a76390b252526f5fc8baa10faae1b26861f730661f0678deeafc08d40f6cbce9d38f8e788fd3dbc4811b75544e494f9857af640880e082098a7d0a621cc341f05d9f9d8fd4585d0d8e55514f6f974d07f064fda30fafc7fb5d123250c4eab673fceeaeb247ec3fa2499257001dcf140222519cd44b04cf1c73c87d73d97e7c5acd63dcb6c37454bb37ef299183574e059b6849dfa6c9f9785d6becfe7e150effe821f2d13d804c0fcc31769ff2d3b13a41681ce046a790159dd996525e65c43201fa21967e002771e47cdb5fb4dceb24147c7c4e6ebb14cebfa8598a8a848bd43b44e79c22be5a053bd3ce2a7bfa48b05db8413a38772321617ee68c8f79d30f799ec85b6b4cace3b98350733c393aebdea0f62f937a3e9f9fa48eb3cbadcd33e70cacd5e803aeb6842278107925c8f419890947a4665866c40a0327f4ecb818a65941f4b4e854909335aec1fb9c01b9a84fe8cd2009ebabc855d8df6a3fdafec88c954cf1dec34031024f0aa711bb7ea4bbc69e8cefc349398f4bbc5b4926ad9151f5c86c4f0ba56c41755509424", 0x2f6}], 0x1, 0x0, 0x1e}}], 0x2, 0x2000c044) writev(r4, &(0x7f0000002640)=[{&(0x7f0000000c40)="b4", 0x1}], 0x1) ioctl$OCFS2_IOC_UNRESVSP64(r1, 0x4030582b, &(0x7f0000000080)={0x2, 0x0, 0x9, 0x9, 0x8, 0x42}) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nbd(&(0x7f0000000300), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000004c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="040028bd7000fedbdf2502000000340007800c00018008000100", @ANYRES32=r8, @ANYBLOB="0c00018008000100", @ANYRES32=r9, @ANYBLOB="018008000100", @ANYRES32, @ANYBLOB="0c00018008000100", @ANYRES32=r3, @ANYBLOB="0d000a002f6465762f6b766d000000000c00040004000000000000000c00060002000000000000000c0003000100000001000000"], 0x7c}}, 0x20000802) syz_usb_connect$uac1(0x3, 0x99, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x20, 0x8e4, 0x17f, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x87, 0x3, 0x1, 0xc, 0x80, 0x1, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x11, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x1, 0xb, 0x7, {0x7, 0x25, 0x1, 0x8, 0xd, 0xd7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0xf, 0x24, 0x2, 0x2, 0x101, 0x8d7d, 0x0, "b2c60e7ad9d4"}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x0, 0x3, 0x5, 0x4}, @as_header={0x7, 0x24, 0x1, 0x9, 0x8, 0x1003}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0xa, 0x84, 0x85, 0x0, 0x2}]}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x96, 0xbf, 0x81, {0x7, 0x25, 0x1, 0xc, 0x5d, 0xbc}}}}}}}}]}}, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000580), r6) r10 = dup(r5) r11 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x441, 0x0) write$binfmt_aout(r11, &(0x7f00000000c0)=ANY=[@ANYBLOB="0c40188ce1a390de00ac6cac0d"], 0xff2e) ioctl$TCFLSH(r11, 0x540b, 0x2) r12 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r10, r0, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x42, 0x0, 0x0) syz_kvm_setup_cpu$x86(r5, r12, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f0000000500)="b9800000c00f3235000400000f31440f20c03508000000440f22c036646665f36526f20f22a5430f01c566ba4000edc4a39979250b00000008b9800000c00f3235010000000f30f245ab48b800000000000000800f23c00f21f8b805000000b9008000000f01c10f23f8c481e57dcd", 0x6f}], 0x1, 0x16, 0x0, 0x0) ioctl$KVM_RUN(r12, 0xae80, 0x0) 3.927343423s ago: executing program 1 (id=185): syz_usb_connect$uac2(0x5, 0xb8, &(0x7f0000000180)=ANY=[@ANYBLOB="1201500200000020990457104000010203010902a6000301070008080b00010101200f0904"], &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0}) r0 = fspick(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000380)='/[,-\xd9].@!\x00', &(0x7f00000003c0)='%@,\'\\\xfd}/\x00', 0x0) syz_usb_connect$cdc_ncm(0x6, 0x79, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x67, 0x2, 0x1, 0xa7, 0x50, 0x2, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x8, 0x24, 0x6, 0x0, 0x1, "14ad89"}, {0x5, 0x24, 0x0, 0x6}, {0xd, 0x24, 0xf, 0x1, 0x6, 0x3, 0xd9}, {0x6, 0x24, 0x1a, 0x8, 0x29}, [@mbim_extended={0x8, 0x24, 0x1c, 0xe, 0x2}]}, {{0x9, 0x5, 0x81, 0x3, 0x200, 0x1, 0x3, 0xa9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x40, 0x7, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x9, 0x2, 0x40}}}}}}}]}}, &(0x7f0000000340)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x250, 0x6, 0x5, 0x3, 0x20, 0x2}, 0x19, &(0x7f0000000100)={0x5, 0xf, 0x19, 0x1, [@ssp_cap={0x14, 0x10, 0xa, 0x5, 0x2, 0x6, 0xf, 0x7, [0xff00f0, 0xc000]}]}, 0x3, [{0x86, &(0x7f00000001c0)=@string={0x86, 0x3, "a892ef4467996c65484b6b49d886592855e8e2f90a6fe2df96e926e23e0aee88d41311303ac5f43cb2a9008b2e1d81711d3e45022e929acf16b336778946e22e1205997381d1b5c3d23d570b3526378789450a03c4a0f34fcb4c3515d21fc54c07e460b78715f28d74fced3d69cc9a0436a879738533feb7db0d5f27c17bf53d4455fedf"}}, {0x4b, &(0x7f0000000280)=@string={0x4b, 0x3, "6c6d858086738a5e6b2f83a5e255264e8c5e5e370a859217e885928506f62a47aa8f391189052dfb8159de75ee5fb51803b32d992662fe870779847102b8d7c0c757f1fb5061fd6787"}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0xe6ac1140a1770b5d}}]}) 3.543584283s ago: executing program 0 (id=187): r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000200)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000001fc0)=""/4094, 0xffe}, {&(0x7f0000000000)=""/102, 0x66}, {&(0x7f0000000140)=""/116, 0x74}, {&(0x7f0000003740)=""/40, 0x28}, {&(0x7f0000003800)=""/4096, 0x1000}], 0x5}, 0x400c}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0, 0x2000}, 0x80002}, {{0x0, 0x0, 0x0}}], 0x4, 0x0, 0x0) 3.543322983s ago: executing program 0 (id=188): setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x38, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000000c0)='sysfs\x00', 0x40042, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = syz_usb_connect(0x2, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000751c0110e60f00989ad1010203010902240001000000000904290202b48cbb0009050402100000fa000905820240"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000940)={0x2c, &(0x7f00000009c0)=ANY=[@ANYBLOB="00032d"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/rtc/rtc0/wakealarm\x00', 0x2, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) statx(r1, &(0x7f00000001c0)='./sys/class/rtc/rtc0/wakealarm\x00', 0x100, 0x80, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$netlink(r2, &(0x7f0000001e00)={0x0, 0x0, &(0x7f0000001bc0)=[{&(0x7f0000000040)={0x28, 0x2c, 0x503, 0x70bd26, 0x0, "", [@nested={0x18, 0x0, 0x0, 0x1, [@typed={0xc, 0x0, 0x0, 0x0, @u64=0xd}, @typed={0x8, 0x110, 0x0, 0x0, @ipv4=@private=0xa010100}]}]}, 0x28}, {&(0x7f00000009c0)={0x11fc, 0x1a, 0xb10, 0x70bd27, 0x25dfdbfc, "", [@typed={0x4, 0x15}, @typed={0xc, 0x1b, 0x0, 0x0, @u64=0x2}, @generic="2ec32f95dea55bec7461cb47a8fbc59532aed43cb742958368fecd6ba396f68bb49894eddbc59a1bd6a77b89a99ba5306475364dd319cbad", @generic="6043dda319820f3c647ee60fb18cd9a1d720ddf2a46b9fe6b347ebad915a200f348c04839a87ac931e87abd92e4a24dc766d51f92e20c31ef8765623439862eaf9b00574e027702193e5a68bec6625d75e6b470053c6c8b7d7366756a7bf58f89b165b364034153989cb271e1cf6ff3260921b09b6b4f9304da9", @generic="90f6f63d18512cd08a4fb1b3375f715e48900f8397561d006585d5b616bc298b934c6eb2c68ebe5a791326495a5b39c644bcf4d16d2f674cbe13e5dc69a4dc81ad5c658f4289309995167f54398f6cbe8dc8f372275cf5af6cad604420d275d2dc065c5d3d19d47274877c53d127d0989bf2380ebd4a2b9fa0d35cf61ea1f0db627a53038d5160868a44823fa3f542802077678086c8c164daf7aac306fc8e5b1471d9a780b2f6c6c069ff1d6d913bbf7b0b41e314d84564b27c6becbd6c7d34bdbd36a56d2695196947366339794d040ef99ef265e9c0da6c3463a449dc305b64e55254f9f321ef9aa5514588206294b3b26ff195a656966ddf969772ef0b64f70adcca0b8d100d2487542479e9c9b6b8dbd974921b6ed11f58d7c2ec27e4f59c5e07e33befe84dae03e83701c0bbb3eef1904c1dbc861d878d4d0e44828de12f27390ac909e10fc9193df79668e7fdb2ff46d83b32b5bd750ed7845fbf33d535c33b6abad6f3c62581b24ab43f1d7ca2221a4baacaf01ed44a5f3549bf617d42501b99450a60a52bfaa10b46d00038ac03c5f1a7284785af29ced208ae1d00d56b91eeb25300ef280a8c886962e902bcdfb981a24647287494a5b75f0215a3be4977e57a0b63f9fd476947b1578853dc3847df411357fa8f9f95097c052714ff895ae1cf080342eaa899e28a598ebd3406bc7332eb988c8e8058993035b2bcb4c3e7fbf61840dd4301fd1d424c1d5689d380491b04bb30d14280cb7b9d2d6118a2d5897906fc964240ebbc6877144b1b73bc732a3c43ae1566db1e9f57687b0ce68ca7a753fdbb33c0161836629f83e16187cb25d2bf9508fa67e7b2990077f4a93d5f2967023f0c26c10ee3d11d7b654547d3c0d7d6584bfa38c906ddcab1c910d5e1da69256a31fa93b9908385a53a372288c8ad571eb911d70baf2251ad941192087bd7c2dd9c2e7e0861746daac9c8ddb84aa7026c9c884ead5bde34c509183df69b76b8bcb0f1e777df309ab096f657342fa5aa04cd593d88e8a233eace303cd431a19ae23e11df38febe85478b6709e0a9916ddd39946ca0de18b4a22f0ead3d2529b259f68e9ec62a6cf52ec8f6a6fbd33c7df359aeeebb8abf81db13bf79ee70b11e247807a6ba45c8a23c5bb7943b7339e168cba5e4359899d379306dc8b6674b2bdd5467ab643f01ec1c2d7cd8214dfdea6b9ac958890741c7968ebd2c935935e0e31d5c1ee0d17c50b853cd1dcf7a97382198e4e9ae35c8c7bada6d2883c2a924855c34323a8ac291b9a2595cf29d6087acf77f09d83b1d64b5cd7341eb91aabc2037f6086e74962004addbeace3a309537eb73b3ddc7954aa26e0533978f3e6d28ee4fd202ec795bd7e82464e7c18b958d071026313640addd00b1909d3f8f4bd6fe6f648358e9dae0ed9421e3fd7827490b0de4e7e61cbf5bb21c55bb34aa8195e7c61dd502c71b7182e88f50836d5227ed9c46fec8400fb3773fdb210637367a3ac3f69f1312135d145b9ebb02c7abadc40d1123bf6cdca1c5b5986444767ccb1164886f8e2657087fede1fba1ffd8ba5dac01dc9af1bea1df1577cf3a8edb2d6d98e79bd52597506a0e0647971466b2269e28997effde695b295796d6762e7a6283a051264a13e22d97e053bf06583aeb3852d191f23d9da02f0104469b1bba6d0e983f3adba14617553e66be5140c51a9edebb08740e14adea3a13353d70a25ead8197afe511afe8b6d8f36e6596b9232718d8e0b72a24e8be053e50e6f5c6879bc9b7b4bce6e714223a594a96ad04e7d67a13a6a9966ff2809c9cbbc056c3788915465b53c789248fd5a06337171e1e357378b4378d2489bfdf2ac73c2a0318d514252f63f0a5a9cf740bc7b13b03d3784cdf4147fce28d502fd05c9caaeabea34610e244b46809cf9642f5b153b6607e04668842c986162d2b07245459cf48fc732c488f1f869786104b0bb78134dc5b53715b5600ab0fe4fd76f8b539deb9cc586d61213b3920ef64cad0b7def92046b839ebf9c34450f64e479eebe3aca1969c92d37e0e6b1978514e013107b683c597a08002722f0343e8989c9f345e21387faf38582c62e1cab9b4ab6d5f0886475cb75f769fec1d113a9b9d93eaf2ed5661a29b7170cd7d45b1a39fd793ed46907305d51971b35a550ecc0307b6e5fbf044eeaac6ae444adc4ed7cd51f741362c67dcdba5f6368e572765ded15f066df03760f10f0e7648eea7a0b65cc932133f064b66dc40f057396cb39b12873a7338fca4c81c27e976ae342d4884e6b5f8a38a2d2ca1a066855e8bcaec77473a7c7e54072ea3b34b6ea57daf74767b466b8ffa3b6c584297c673a717834232bcf8d3fa66836eb41406ae9fff3ea463fdeccbef17d93ec301efb954a9404d83f05ea8b647604301423231f1ef4777a54159a3733684921fee8091488bdddd5f744e6a606dc51852dc3e098a7fad03525afc4ad2feae16c2878b38618f2ad9e8c18c269982017359cd83fd64f9a1f5cdd52a4028f395d90f10fc7e49f73ebb9100fbdecfaee0765f880899bccd1d43ccd183d9ab4d63b9db5b2e84ef83153df356efb8c316c1ec55dfec674b96ca748a832d86c917171c33f6344d2df887ac2351cddcf6bb074cc454139192b64948166f11ed4ba24e5f8b1a6a134befed9f475f3f0de9e680f32bc4f65bfeee020395656ff0f6083ebbc83d0b4ed044eb9f79931c7fb5299e5cfdec663a7f6ec8be46063444b23cad80504165367efc9ce88f22a132dbd15c8da6ccd086fc4a5b9303e46e630f3e8a29c917705d381643a046ee3dcccfbbc5a418b67491dc53435e113ccfa2dcbbc4c6c461c03c808335e6e20c2754b7331fea50e377f003314709d209084460847bc5b8a9c3d14503e585a26f6cc7d2fc71a34428894dcd4b29457115c6937e50b052a662ccf031596d51a1ed090288e3a68f1cbd26e8399af174467a9d4b70228d61d873f02602e829b56778da8f29648887e9b13be5f0ccd01a9969e240e2ccd479001faa225d96bd002d116056dcf669fca3d5f6b8ea1841e5e07e8ba7eac48c7729b91b1dc0dcbf62090256a750e8184c31112cb2ee87a1b5d18dd323ca1b06de4d5425d3ed1a8150f9b93e30e97b58d56ac7ef9963c780839e87c52c5f0773fcf42c2a5c51e8c1a2ce8062c26a3de23e7538bded0cad8cbfe7b17e38083b13083bde2a1ca86096751a0a0fc9095f2a78dbca10603cbe2799e4ced7176c9172e2eb3f9dcb9a437fcbf931b1be8cc0c77d08eadbb5c18d7a8ac6fb12dffd568e9092c5bad1d9aa2888b9c08027004469022fe56c5670de5cbfac9e38dc0037fa6817a7f687786374d936d2a136cd7296e72e5c705520a4def78b92b80282be3e9798e63085dd2f88621b9548b2efc343330208b967f07ad98ad1b1ea0ca33fb04558d25ae63c0055353bd0374fbeacb1e257162167b48b514ae5368820be67044c43665e5aab7633c4069f69caded267cb3360e6b889376397c00aa78ad338dae4efd4da3a895166c8e2de95ae13e0fb9ec1eb87294a53eb56083d7059cba8f9aa7c80868e32f84d065203313362a69711f4a218a98b711fdc7c4f4fc106b7e07bb941018f5cd8a7b7bb8500b2e8c81f19aebcc69916f5d682af6894c1fd16e99195784714cb052dc17903c8e19bc3fba647065797251d093ac489625ce3c50b2d64f022ecd9a6c53fcbd4f3ef101f214a4c8f98f9b9c06d46e23e1701bb49374e91f22eb55805298066f8598afef46283c02133fed00675f977e228c7039f16ea96cef9ebc05dcc7b78dbb373f049cfcc027eba93812d749bafd81ba8724b0d8a55473d244fdd40b9c2c0c6b28547efeefe7f4b4f277b91cd2ee9df4c96b34c67eade83434e473791a8206083803c347eb9e68dc553ca3647476e857f72a0572458dc0948050ab5f5585fe5c141e4f52bbba8337515d3ad1e932627fc4e6885e5661a7506c30cc11895ba7f383d5f8c4a43a9da6456dc5b463f80b25fba5cc51445d9181781d798a402122bffffdf545ec9526654c158c41573f73cd01daecc37857223fff7bb932444d4526bbc0e3de6f875505eab013fa90da2eb5f8182010d8ae95b333c388b677894fda3c183c740396ca7f043d390ef7c79d757e18d85f4487bf30da9f98f2fb9f709290b6ca245cf02256aca1d1d791ab0b7b4aaeab2e774f80633f7f507aa6e500fe91a08333be6c69d5ec82ed5cc4b7bc24870c3df88d42f04287fafddac63769bce0fd9e74f70a44573be28d10842932c04c231818d5013ccc9c5a8ff71177ebd432c2482af3b7943bdd357559b2ce180a329463039911a02deeb4998b4bdfdf006cfb633b9464cd3ff3e26a382233c44527017437c1f1de463b6bda53e25d42ec53fb5fa86ffcd02636b6d2da1e2736bf6a7f98ad0df4fe0994c0e5f1719a52a9e77b5c0c1d99e1bae7016970f73939659229c89f728f904ad3653b9fb2f0e55d428a19bb0c95082712813bb3acf0c56fbbaab145cb8818072f5709509f3455b731bdd33ccfb9f12182ab23354b81b54ecee169a0636f1eeff118f5de84d0da0c7d4cb34fe760df1c0f3643ceae98551ca335257c42d157cf663f2ae3bc4a506c13dd246a0aa082dd52ff4a8548e8b3d9f6e26c37d1e6a8f06d08aa449e3f6061c4d92fd840b0aa74ef73944ae4a33262f8f39aed8f6789d939b1410185bf29305eb19352fb8dd6a295a7c16c69d9d4a86b91b1d1e97c98f214775b74ca284c0c58fa595fd62ace2372eec04ecacab54a16597d953630815086d21638601c735adda9d24457912c5f66cfa2df23d40a17906fd9a26db4ea5dfba322f2dc9f3ccd3b9afe7cda1025e5a89929af87be16d0f30edb5e189e2680448c0b8be4cfb0b55da0e09deaf1ed541cbb986080130157822e714b93f1e9f09d4bdd778280b8710fa2cfd937b86509a0151396a8b396c214ad6d8bee8d2402df87ecbb47fe729134dfa929030d505bfcaf4e22bb59cfde84ec2c68f1b9d15d6cfbe23614c98b5490b106b937f43d55924ed04befa9baab007ff79717c123e9e43fee4b2ff5a1c4138c275959e93d666c170e05c931e3b04c9cba1095ebd06e9d83729793c396c5a5fa06b8ec3dc3c4d4a197efadfcf8883f61132e5112f75a7e02d5e1b6a6aee80c5e84615cda7c5e85fc2bd8f68816b5ef40bd6b6607bf1b03f05aeebf02d46702f3ab6e072ae4de3065eb4526a0e463deafc2b06ea866614172ed1bfcda9a6adc42b74b4af8b45d47276629b31b8f1b34e65dfe92e90b722502ad19fad2bce8d2de2a8ed575bcc0f206bcc4b0cbe64aaad8423268c7f3386edba4c6878e10d95c2e686a20f6a446841b4b99bc1d5e2e3be62574a11b048fb305ffed670100f18c5828fc12f2eb53f890312db7da185a460a616a2856e42e6e981d652cc9a627e7b3bfef07f6dd231027fe8ce38512450948f87a3aa1b8a3a5870aca50299e078d6106b4b128c9336dd818cb8057ad8da80231d89f853e30dd8ef6362f0e5ecd515f4953ef0b87d6ce125dca94f919a7eba73c03d8d6a3a60fd70da1981fc875777293a8f93caa54b2d56cb4c893bb3008c4d594da902d09558beaa56d62ad3d6e280fa8eb2ccbd94011c1b7e6a224b0c459e7fd7bcc494b3f5d5fd63636765cc5073ab58fcf386241c7e1d0edf4fa5d58ac708843cfc3a87424f99953ed9911d599451c528ebdabd1987b3c74ae6f13e8377c71084786f8c29f9720696cc2bbdf2c8400669e7f213b5b668ff0686893100d93ccee0ce", @generic="617b3be705b17fd05e399229d508443722eb628b38bcad5454fae6c2bf9bcbafce3467b66164724b2620b778b0da542e3a9c6142ff812f3a9d9f86e8276262f401e3d950bbc3e4ebecb69dcccdad07fbdcad5dfd9a95f3d58e6612502e56c16bc6d8dc036cd2d24130095fd163d1fcd1ddcd6e37bc0050221933994c9ab37e8356d00886f69513a0f7db1d2ae64f1baed6b889265faecae715660bbd28749ec25f3885e859a210f48cb34c7f82adf375b26465e4cfc659d827290bd4eea3c629ca690d3b26c0d41040a87b338adf41e5f6a204a485167c1a859b3c4b8f00f2ecea478071f194b56af72c769cca4ce1038c94a4be88807a22d1b16f96", @typed={0x17, 0xdf, 0x0, 0x0, @binary="b614a9c79429acde58f5c9ac88f94baf5f04f4"}, @typed={0x8, 0xaf, 0x0, 0x0, @uid=r3}, @typed={0xc, 0x32, 0x0, 0x0, @u64=0x7fffffffffffffff}]}, 0x11fc}], 0x2, 0x0, 0x0, 0x4040000}, 0x14008010) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = add_key$keyring(&(0x7f0000000100), &(0x7f0000000140)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) clock_nanosleep(0x2, 0x0, &(0x7f0000000080)={0x77359400}, 0x0) keyctl$invalidate(0x15, r6) connect$unix(r5, &(0x7f0000000000)=@abs={0x1, 0x0, 0x4e24}, 0x6e) ioctl$BTRFS_IOC_LOGICAL_INO_V2(r2, 0xc038943b, &(0x7f00000000c0)={0x2, 0x40, '\x00', 0x1, &(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) modify_ldt$write(0x1, &(0x7f0000000040)={0x3, 0x0, 0x1000, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1}, 0x10) sendmsg$nl_xfrm(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000180)=ANY=[], 0x2c4}, 0x1, 0x0, 0x0, 0x400c000}, 0x4048094) getsockopt$IP_SET_OP_GET_BYNAME(r4, 0x1, 0x53, &(0x7f0000000200)={0x6, 0x7, 'syz2\x00'}, &(0x7f0000000240)=0x28) 3.007380446s ago: executing program 3 (id=191): syz_usb_connect$uac1(0x5, 0x81, &(0x7f0000000180)=ANY=[@ANYBLOB="12010002000000106307012040000102030109026f0003010300050904000000010100000a240100000a0002010209040100000102000009040101010102000009050109081a02fc0a072501000e060009040200000102000009040201010102000008240201f9033c7f0724010704021009058209400025010805"], 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)) setitimer(0x2, &(0x7f0000000b40)={{}, {0x0, 0x2710}}, 0x0) getitimer(0x4, &(0x7f0000000080)) socket(0x27, 0x3, 0x7f) syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab1204000000000000010902240001b30000040904410c17ff5d810009050f1f05e13f0000090583", @ANYRES16], 0x0) 2.568868617s ago: executing program 1 (id=192): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000000c0)={'batadv_slave_1\x00', &(0x7f0000000640)=@ethtool_rxnfc={0x2e, 0x12, 0x1, {0x0, @ah_ip6_spec={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @mcast1, 0x1, 0x1}, {0x0, @remote, 0x4, 0xffff, [0x9]}, @tcp_ip6_spec={@private0={0xfc, 0x0, '\x00', 0x1}, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x24}}, 0x4e23, 0x4e1e, 0x2}, {0x0, @local, 0xa7f, 0x3, [0x1, 0x4]}, 0x9a}}}) socket$inet(0x2, 0x2, 0x1) r2 = socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0x3, 0x300) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000000)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'ip_vti0\x00', 0x0}) sendto$packet(r3, &(0x7f0000000180)="0b03feff4f11021202004788aa96a13bb1000011000088ca1a00", 0x1fffc, 0x0, &(0x7f0000000140)={0x11, 0x0, r4}, 0x14) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x20000845, &(0x7f0000b63fe4)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}, 0x1c) getsockopt$inet6_buf(r5, 0x29, 0x3d, 0x0, &(0x7f00000000c0)=0x37) syz_io_uring_setup(0x11d39, &(0x7f0000000180)={0x0, 0x2079d6, 0x3fff, 0x1, 0x29d}, 0x0, 0x0, &(0x7f0000000000)) socketpair$unix(0x1, 0x3, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x4004000) recvmsg$unix(0xffffffffffffffff, 0x0, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9}}}, &(0x7f0000000300)=0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000003c40)={0xa0, 0x0, 0x0, {{0x4, 0x0, 0x6, 0xf, 0x8, 0xd, {0x6, 0xc, 0x2, 0x1, 0x10001, 0x0, 0xfffeffff, 0x10, 0xa, 0x2000, 0x81, 0x0, 0x0, 0x1}}, {0x0, 0x11}}}, 0xa0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r2) sendmsg$NL80211_CMD_NOTIFY_RADAR(r0, &(0x7f0000000380)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRESOCT=r0, @ANYBLOB="080027bd7000fcdbff25860000000c009900000000005c00000005001801270000000800a000040000000800a00001000000080022012d02000008009f00060000000800a1000100000008009f0005000000"], 0x60}, 0x1, 0x0, 0x0, 0x48010}, 0x20000000) dup(r7) r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='cgroup\x00') preadv(r8, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/205, 0xcd}], 0x1, 0x7fff, 0x0) syz_ublk_setup_queues(0xffffffffffffffff, r6, &(0x7f00000003c0)={0x0, 0xb5b9, 0x8, 0x1, 0x82, 0x0, r8}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3320, 0x40, 0x1000002, 0x51, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x20000, 0x2, 0x3aa, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x49b, 0x4000, 0x1, 0x373, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2b11, 0x400, 0x800000, 0x26d}}], 0x1, 0x0, 0x0) 2.568556937s ago: executing program 1 (id=193): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x181403, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_GUEST_DEBUG_x86(r2, 0x4048ae9b, &(0x7f0000000000)={0x9f63422128830807, 0x0, {[0x7, 0xffffffffff7fff00, 0x4000000000010022, 0xfffffffffffffff6, 0x4009, 0xa3, 0x40, 0x4803]}}) (async, rerun: 32) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, &(0x7f0000000240)="66baf80cb8adc5648e48b89ab6a3fd000000000f23d80f21f835400000900f23f86dbafc0cecb972000040b804000000ba000000000f30b99a020000b800000000430f01c20f30c744240000400000c7442402dfc50000c7442406000000000f011c242642fec719c4c2590df80f38f044b75a0f07d9c9b9800000c0ae2d6666000400000f30", 0x86}], 0x1, 0x41, 0x0, 0x0) (async, rerun: 32) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = syz_usb_connect$hid(0x3, 0x3f, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0x25b5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0xfb, 0x10, 0x27, "", [{{0x9, 0x4, 0x0, 0x1, 0xfe, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0xa, 0x3, 0x1, {0x22, 0x9}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x3, 0x81, 0x2}}, [{{0x9, 0x5, 0x2, 0x3, 0x40, 0x4, 0x5, 0xa}}]}}}]}}]}}, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) (async) r4 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f0000000080)={0x0, 0x8}, 0x8) syz_usb_control_io(r3, &(0x7f0000000000)={0x2c, &(0x7f0000000080)={0x50, 0x8, 0x28, {0x28, 0x31, "f17d3816e9bc3556382b1cb20f9dba43be78bb82c5fcf4dd381a3d09291bb59e2b8c801e9e4d"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 2.499950909s ago: executing program 1 (id=194): mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0x2, 0x4e20, @empty}, 0x10) r1 = fsopen(&(0x7f0000001080)='ecryptfs\x00', 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) getrusage(0x1, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x200) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r2 = fsmount(r1, 0x0, 0x1) fchdir(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000001000)='./file1\x00', 0x1a5) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) getsockopt$bt_l2cap_L2CAP_LM(r3, 0x6, 0x3, &(0x7f0000000000), &(0x7f00000000c0)=0x4) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001040), 0x410000, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x27) lseek(r4, 0x4, 0x2) ioctl$KVM_CAP_EXIT_HYPERCALL(r6, 0x4068aea3, &(0x7f0000000000)={0xc9, 0x0, 0xc}) 2.486514279s ago: executing program 1 (id=195): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000940)=[{{&(0x7f0000000680)={0xa, 0x4e23, 0x7, @mcast2, 0x684d0670}, 0x1c, &(0x7f0000000880)=[{&(0x7f00000006c0)="f2cf1faf44084756e24c86d58328942fcad70fc73888b559c364a0ecf753dcf17c918266db3afb25e8eaf498c43a6be5612415e813551091c1b393c0e5700579b4b6", 0x42}, {&(0x7f0000000780)="980a79283080b4a9537b63b81f6b92e5cecd85f91f6f27a735ec9e874fd721fe867ea81e384560d217ab014f6026a35a7623a6ac1aa5be5d6cb63abb3599cffe5e19b9aab9d2b72a93ee1980c3aa8fe8ce8ba97a5f683ac72808433a6dcd7e399a21d350999f9c476e306887f051c7180c4ecf4b5b1f8b1a2423abf52131c9e35e8f2bb92326b0965d2087a348f39f2a4f21cdf278e5cf0296620c5dcb0f5c901c8152930ea11faf48706c29ec8a91f18c4c14b5268178bcff8674f8ae4b412c0685397a6e3774617c0295a45fa21dfd1c9a73cf05c72c79b55b76d8c4", 0xdd}], 0x2}}], 0x1, 0x20000081) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000") 1.743349847s ago: executing program 3 (id=196): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002000), 0x2, 0x0) syz_fuse_handle_req(r0, &(0x7f0000002180)="0000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x2000, &(0x7f0000004180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.743082777s ago: executing program 3 (id=197): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet(0x2, 0x1, 0x0) getsockopt$inet_opts(r1, 0x0, 0x4, 0x0, &(0x7f0000000240)) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, &(0x7f0000000040)={0x0, 'macvlan0\x00', {0x2}, 0xc56}) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) r3 = syz_open_dev$ptys(0xc, 0x3, 0x1) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000380)={{{@in6=@remote, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@initdev}}, &(0x7f0000000480)=0xe8) mount$9p_fd(0x0, &(0x7f0000000180)='./file1/file4/file5\x00', 0x0, 0x810, &(0x7f0000000680)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@noextend}], [{@obj_role={'obj_role', 0x3d, 'trylock'}}, {@smackfshat={'smackfshat', 0x3d, 'syzkaller1\x00'}}, {@uid_lt={'uid<', r4}}, {@fsuuid={'fsuuid', 0x3d, {[0x36, 0x65, 0x39, 0x61, 0x63, 0x5c, 0x31, 0x63], 0x2d, [0x63, 0x36, 0x39, 0x38], 0x2d, [0x66, 0x6c, 0x30, 0x34], 0x2d, [0x30, 0x62, 0x34, 0x34], 0x2d, [0x0, 0x38, 0x65, 0x30, 0x37, 0x32, 0x66, 0x39]}}}]}}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x3, &(0x7f0000000000)=[{0x3, 0x81, 0x3}, {0x61, 0xf}, {0x6, 0x0, 0x0, 0x5}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1/file4\x00', 0x1c0) mknodat(0xffffffffffffff9c, &(0x7f0000000200)='./file1/file4/file5\x00', 0x81c0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file1/file4/file7\x00', 0x1c0) r5 = landlock_create_ruleset(&(0x7f00000002c0)={0x2001}, 0x30, 0x0) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x200000, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r5, 0x1, &(0x7f0000000340)={0x2000, r6}, 0x0) landlock_restrict_self(r5, 0x0) linkat(0xffffffffffffff9c, &(0x7f0000000500)='./file1/file4/file5\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./file1/file4/file7/file5\x00', 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) r8 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000200), 0x1, 0x0) write$vga_arbiter(r8, &(0x7f0000000000)=@other={'trylock', ' ', 'io+mem'}, 0xf) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x22001, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) ioctl$KVM_CAP_EXCEPTION_PAYLOAD(r10, 0x4068aea3, &(0x7f00000000c0)={0x8f, 0x0, 0x1}) write$tun(r2, &(0x7f0000000580)=ANY=[@ANYBLOB="5108000090780002846891fd58f1e61b342d832ad432ea42c6f8e2d52a8bc4788eb91c97ef54e2acc6eeb447fb3cbcece1fbe019b98a8ee9eb070239ddc73a1e525841c832cb068bc6da2cb97437d5cb8ac9126281145e334292f3f399b5b063dd5236868bd817a8aac18e37c037c6420243e2d5ffbb8b", @ANYRES16=r6, @ANYBLOB="aa4fb428a6bc5d4d91f1fef74681e708c2d24b56a61885c7e73f47a8c4f87ba83a6dc11584bbef376f5771a643cb24852e9283d9949afb020821ca7a841e524c9a2e624a4027ca4e5ddd502f867021cbed", @ANYRES64=0x0, @ANYRESHEX=r6, @ANYRESHEX=r0], 0x36) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001180)=ANY=[@ANYBLOB="180000005500010000040000000000000700000002"], 0x18}, 0x1, 0x0, 0x0, 0x4c504}, 0x0) 854.145159ms ago: executing program 3 (id=198): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/tracing/trace_pipe\x00', 0x800, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) mount$9p_fd(0x0, &(0x7f0000000040)='./debug/tracing/trace_pipe\x00', &(0x7f0000000100), 0x2008040, &(0x7f0000000180)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB]) (fail_nth: 3) 630.745344ms ago: executing program 2 (id=199): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec773000) r1 = syz_clone(0x2080, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r1, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x1, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/116, 0x20001c34}], 0x1, 0x0) 529.549037ms ago: executing program 2 (id=200): openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x2042, 0x19d) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', r0, &(0x7f00000004c0)='./file1\x00', 0x5) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a74000000060a030400000000000000000a00000a0900010073797a3100000000400004803c0001800a00010071756575650000002c000280060002400fea000006000140000100000600034000010000060002"], 0x9c}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) sendmsg$netlink(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000580)=ANY=[@ANYBLOB="3400000013000100000100dffddbdf25070000f61600000008000000", @ANYRES32, @ANYBLOB="14001a"], 0x34}], 0x1, 0x0, 0x0, 0x4000}, 0x0) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000180)={0x1}) r4 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000240)={'batadv_slave_1\x00', 0x0}) setsockopt$packet_add_memb(r4, 0x107, 0x1, &(0x7f0000000040)={r5, 0x1, 0x6, @multicast}, 0x10) setsockopt$packet_add_memb(r4, 0x107, 0x1, &(0x7f00000000c0)={r5, 0x1, 0x6, @multicast}, 0x10) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000002000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000040)="0f01cb650f7410262e66f36d0f330f09660f3a0cb90000a6752066b9800000c00f326635004000000f300f01d7ba4100ed", 0x31}], 0x1, 0x4498bda7e2139f37, 0x0, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000140)={0x3, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000240)={[0x0, 0x5, 0x40, 0x40, 0x0, 0x7, 0x2004cb, 0x9, 0x5, 0x41e3, 0x0, 0x1, 0x0, 0xc5a, 0x9, 0x1], 0x80a0000, 0x450}) ioctl$KVM_RUN(r6, 0xae80, 0x0) unlinkat(r0, &(0x7f00000011c0)='./file0\x00', 0x0) creat(&(0x7f0000000080)='./file0\x00', 0x6a) r7 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x802, 0x0) memfd_create(0x0, 0x20) write$input_event(r7, &(0x7f0000000200)={{0x0, 0xea60}, 0x3, 0x59, 0xda4b}, 0x18) 468.003118ms ago: executing program 0 (id=201): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)={@multicast1, @local}, 0xc) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x67, &(0x7f0000000000)=0x1, 0x4) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002b80)=[{{&(0x7f0000000040)={0x2, 0x4e24, @remote}, 0x10, 0x0}}], 0x1, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000440)={[0x0, 0x100000000, 0x0, 0x7f, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x8, 0x2, 0xffffffffffffffff], 0x0, 0x200}) fsopen(&(0x7f0000000080)='pvfs2\x00', 0x1) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0x101, 0xaec4, 0x6, 0x4004, 0x2, 0x4, 0xefffffffffffffff, 0x0, 0x0, 0x2000000, 0x20000, 0x1c, 0x0, 0x5, 0x1], 0x0, 0x41981}) ioctl$KVM_RUN(r2, 0xae80, 0x4000000) 448.941339ms ago: executing program 3 (id=202): mlock2(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) socket$vsock_stream(0x28, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x801ffff, 0x0, 0x1010, 0xffffffffffffffff, 0x0) unshare(0x400) r1 = socket$can_raw(0x1d, 0x3, 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x66) setsockopt$CAN_RAW_JOIN_FILTERS(r1, 0x65, 0x6, &(0x7f0000000080)=0x1, 0x4) socketpair$unix(0x1, 0x3, 0x0, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$RFKILL_IOCTL_NOINPUT(r2, 0x5202) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), 0xffffffffffffffff) (async) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="2503030000000000000016000000140001"], 0x28}, 0x1, 0x0, 0x0, 0x180a4}, 0x4000010) mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil) (async) mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil) 422.484189ms ago: executing program 0 (id=203): capset(&(0x7f0000001440)={0x19980330}, &(0x7f0000001400)={0x0, 0x2}) memfd_create(&(0x7f0000000180)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xecz\xabq\x95t*T9\xa9\b X \x04\"\x17\xbf\xcb\xccF\xda\xcf\xdd^\xa0\x15\xc0\xcb^h>\x1b\xb5d\xc7\x7f0\x9a&\xb0\x12#\x9c`\xa6\xed\x05\x95g\a\xccYb\xaf\xe9\xb6G?\x9f\xf5\xfe\xc1\xc0JJ\xc8\xd9d\x80\x13\x8fX\xb4\x19\xc4\\\xcb\x89-)\x90\x01\v\xac^\xdbBQ|\xaej;\x92\\\xf8u\x19Y\xee\x99EI\xf1t\xadn<\x9b\xc9\x87\xd0\xa7\x1a\x81\xb9\xc87sq\xd7\x15\xd6\x91O\x9c\x99!9>\xff\xa8\xfa\xe6=d\xcf\xca\xa9\xc61!\xc6P\x13\xd0\x88gZ\xbe\xdfl\xfa\xff\xb0m;d07tx\xbb\xabd\xe5\x16\xc4\xae\xf0', 0x2000000) 335.621352ms ago: executing program 0 (id=204): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000100)={0x0, &(0x7f0000000140)=[@wrmsr={0x65, 0x20, {0x838, 0x10000}}], 0x20}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/kernel/mm/lru_gen/enabled\x00', 0x1, 0x0) write(r4, &(0x7f0000000400)='7\n\x00', 0x2) ioctl$KVM_RUN(r3, 0xae80, 0x0) 237.151903ms ago: executing program 2 (id=205): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) syz_ublk_setup_io_uring(0x540e, &(0x7f0000000000)={0x0, 0x8e2f, 0x80, 0x1, 0x12c}, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100)) ioctl$KVM_CREATE_VM(r0, 0xae03, 0x76) 235.417954ms ago: executing program 0 (id=206): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet(0x2, 0x1, 0x0) getsockopt$inet_opts(r1, 0x0, 0x4, 0x0, &(0x7f0000000240)) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, &(0x7f0000000040)={0x0, 'macvlan0\x00', {0x2}, 0xc56}) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) r3 = syz_open_dev$ptys(0xc, 0x3, 0x1) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000380)={{{@in6=@remote, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@initdev}}, &(0x7f0000000480)=0xe8) mount$9p_fd(0x0, &(0x7f0000000180)='./file1/file4/file5\x00', 0x0, 0x810, &(0x7f0000000680)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@noextend}], [{@obj_role={'obj_role', 0x3d, 'trylock'}}, {@smackfshat={'smackfshat', 0x3d, 'syzkaller1\x00'}}, {@uid_lt={'uid<', r4}}, {@fsuuid={'fsuuid', 0x3d, {[0x36, 0x65, 0x39, 0x61, 0x63, 0x5c, 0x31, 0x63], 0x2d, [0x63, 0x36, 0x39, 0x38], 0x2d, [0x66, 0x6c, 0x30, 0x34], 0x2d, [0x30, 0x62, 0x34, 0x34], 0x2d, [0x0, 0x38, 0x65, 0x30, 0x37, 0x32, 0x66, 0x39]}}}]}}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x3, &(0x7f0000000000)=[{0x3, 0x81, 0x3}, {0x61, 0xf}, {0x6, 0x0, 0x0, 0x5}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1/file4\x00', 0x1c0) mknodat(0xffffffffffffff9c, &(0x7f0000000200)='./file1/file4/file5\x00', 0x81c0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file1/file4/file7\x00', 0x1c0) r5 = landlock_create_ruleset(&(0x7f00000002c0)={0x2001}, 0x30, 0x0) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x200000, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r5, 0x1, &(0x7f0000000340)={0x2000, r6}, 0x0) landlock_restrict_self(r5, 0x0) linkat(0xffffffffffffff9c, &(0x7f0000000500)='./file1/file4/file5\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./file1/file4/file7/file5\x00', 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) r8 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000200), 0x1, 0x0) write$vga_arbiter(r8, &(0x7f0000000000)=@other={'trylock', ' ', 'io+mem'}, 0xf) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x22001, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) ioctl$KVM_CAP_EXCEPTION_PAYLOAD(r10, 0x4068aea3, &(0x7f00000000c0)={0x8f, 0x0, 0x1}) write$tun(r2, &(0x7f0000000580)=ANY=[@ANYBLOB="5108000090780002846891fd58f1e61b342d832ad432ea42c6f8e2d52a8bc4788eb91c97ef54e2acc6eeb447fb3cbcece1fbe019b98a8ee9eb070239ddc73a1e525841c832cb068bc6da2cb97437d5cb8ac9126281145e334292f3f399b5b063dd5236868bd817a8aac18e37c037c6420243e2d5ffbb8b", @ANYRES16=r6, @ANYBLOB="aa4fb428a6bc5d4d91f1fef74681e708c2d24b56a61885c7e73f47a8c4f87ba83a6dc11584bbef376f5771a643cb24852e9283d9949afb020821ca7a841e524c9a2e624a4027ca4e5ddd502f867021cbed", @ANYRES64=0x0, @ANYRESHEX=r6, @ANYRESHEX=r0], 0x36) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001180)=ANY=[@ANYBLOB="180000005500010000040000000000000700000002"], 0x18}, 0x1, 0x0, 0x0, 0x4c504}, 0x0) 143.552056ms ago: executing program 2 (id=207): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000000140)={0x0, 0x9a83, 0x0, 0x2, 0x1e2}, &(0x7f0000000600)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe69b, 0x2, 0x1, 0x354}, 0xffffffffffffffff}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xff58, 0x2000, 0x0, 0x2ec}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfe98, 0x100, 0x0, 0xbd}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xa386, 0x80, 0x3, 0x8c}}], 0x4, &(0x7f0000001880)={0x2e, 0x4a, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x3}, 0x0, 0x0, '\x00', {0x4, 0x3ef, 0x0, &(0x7f0000000880)=@buf_4k="8f9f86dbd3c7431a0328ce3a23ad3c948adc6edf9ded220da9b801a39443340a9f9d85561ce5a8e1d73dfb302659a607257543f218f887dd40b9d3dec6c84d23937c7227701824426ed2c388b4b507a4e86806afb6336e7b26b190e778a93a4b12f9075e0278672bc39b2f251eb2b5b52e0664c4ad6be7fced15d1fe9218097430eeb443b35da0c8807d9813ca1a90d0cbb9cf824959f16c228c01b8c9445d85e31ad1c024b82ab1a2c5088cb98d6ccea9400e9ebd22efada8e4e5b87b44d51b93aefafd026e247b590f9e93a67d6c0298787d292c1075ccfbc1f1220ed7cab5c5022283291fadad715f8d6303d9a64fc0c03fc89a0956e4d6502972b6f6ce7e20cf0487c2235913228a4295ceba555e781ad7ce1ad2ac194e21a67b7368b19e5ba045ab3250e86a7b647668b9800b3bf77182dad96d0fe445ff2e379f9e04d13f8d43a67c63a60303a7064ea63dfcadf02f0180a7b9ce9393e0bd9f523e5a44e7bf93ef5fb9cdda664b123722a9b894f69f711babba78d6a19ef953d4e549445e86ae52e5d27907c38639bf76ffd6bd10f52c37c082e5629ea454eb7ca5879a5bf916d6af89ea4791c1cfb0ddd6b80d855386c5d0515e018381be0c4d77f09d863a4b4fe8b6d45e04bdf919d063c22fda26d6b81206aba2ae067c1161d9f6579813a9c8e877825e9b08d7446064bacec986ca93ec3b1a942b10d6b0910517faca7f1ef68264524f3edd94a197d1ec20d5fecc213c3ede3fc414475aada3a5d9363f03f4b350ef8ba9339ffc22b687aa2edb95c240687fc3c16b2fe9c971636ed072ed8df9a0c009cc0e97ec137a72ea0a484f7a12dea34133bbae95c506ff8b4d760ad448ebd4d1bc611be14c8ed2e521559e30dc81c7769368eea67b56b358327bf58d01539b50149dcf1fac7bed6fb9a179c74b6db0b9c197640088c3226a39821c9d50e4c45434612d08a0844a6f0362a9cd0a1e0410f921a9485a1721cb078db1883d377c219db2a7ddbf022c1fa3eafff9bad0b2c173d5bb8b32dad8f21e8e6a8916b3ce2c1f4719472cf1aac1116896f322dae4a5eb9cc0a089bee99de89a47ee4b16ecbd5a349d903efdd4c03bd91edb187211fa34239610e56dec80cfcffcce9060b9374e63a8edd719a53d52b3692f04291deb4d9a55aed3ec6c4cad515ebfe2ed15f0224ece32c370c0242e0f3a87965085975af5814ee2e2f992b90fd0119d6cf2c5cb76507c4f1a6478a5244525a7f50422f262dd8e49fe2c2e866601d081c5ec42da09d0a8278691aac9b456cffa1038e05043d46ebeb04d2cfdfd48f52bf171b361c7e50b3e847112993b03c3561e775835f1007f47fbc9322e96510886d7f96b5c0b58cbf112ac186b78a95c42b60e1ec097057cc208468ba5523de4cc34d77547ad95318a0998e8e74ac62a0cfc156dd0743295ecb38c05ba283f467c0c217567bb4c9d7742cc6ff06e60173faa186f3f1841ea082f9b5afb86280791edd015b72d3d6673a89cc7a7a5880ed43b02683dcb7409c7cd713e51fb7c51a78788b8f424dfb6138eba36d277e54bfbfc814101f9ff5f38da6b8ba44c05bdebe9a0c375ee97191fcf03ce9186310c507cabb7d912d0fd1ff5f49bb8a919f9759781ae55925fff45d0a95b091c2841380088adae09f39a1a8af4611cb641506fbb1a04efe72fe7e9319b57744d775ad4ce32a46f0f5daa113d0fbe89a40f4bae2bef33b950d24d0d19e0ea88cdc72e8a4d4e8cd34bb2d422a46ade946006abb0de0723bb8fb7b1f7af78002d1f1988517cee990cacad1df5ac73d26a04e7160fd05049cefd7cd31a37228f6863f54a64811d1b971003a6b5990dd3fda1f79e4fbccbb622e6f500ec354e3f45fa7fe3d744ae44eb73b870414b9abb56112f9ec2a36722b05712a1fb718f83a7e7ef9e2b8b2d7354b4c56974fc2ba3d01a663162e8b9db769f8a3d5d0c9ba664c2281e2ffde3d4e70bff7c860c50d29e8d55c16c0ab3fa1a82ffa816c532464f21d91e239282ce48ab4033ecb11d56ac68db0a2e4ef1abfc7c3cb60adaae2371573ed8a0f55375fa713612cae2c35466445f15c7c793fd1bbf8cadc576b6b5e3cec9b741b34de29697df1c4b3a486750899d48f376902996a4f4d95ab44f3393ea2f01bce8bf576690fe756244dc75fd7514457ac2304f60f2b7eba166bf0d0d6dc73e358729863bcf7dc3cee3695126ba6c7c215eec7927efdcf5b962b2784ba6fe3a545eda8c4e2762b80933c0f49182df4c18afbaf6f180a44379d93382061c3c3b9ad7103896e2edff54877749abe62e6caa4d01942ea1523dac406c1c113032a6db7b58f9f4b789926cf867962d8dc9ba0b00139b012472722423d4f877279c2afd6f72f1c58f8cc67688038342cb7280a5ab4a76f3286254c1a6e7efce91b4d607b090f3a5fbdb749176655370761429c140b8c863918a56e2cdb155db9751af91727e6d10ecbcaca2b9116e5efcc83e4ec261a274f59624edf595518379cad6497b233e33893e0e644f156bead43a9fbcd7edae3f9678e7a6fd9b51c274d0e913ac679f5fbe9dc929b12448b21db9766925bbe3d70e1c8bddafcdf21eede8f6c970ebc0c5d9c3fe99244146d95151af185b82961b05d85a688133ed13ab0b30c80649c6a29e9d9aefedac9e86ed334b0beb21df3613b607377717dfada03093edc76998a5324808d7b91469be09cf8262a6317adfeab876c7bb38ad91ad71a1feba44fe0eba95b3bebfde2a0aa6c55ecd64912348d8308838050baa6b31699e0cd31f9f2bb991d650ed49b80a34c216bec18c06922f3839812c1cca1598954427a514a0d4620e1063339f50e23058bdb9456c99ef0f95d371d4ff608f371aebd1d091aa4eb52982d60a4b42ba5e84f9253b2720bb6f4048e9137286c328addb95104ce82075a942ca6a520295218a97b0a7aa835fec6b633fdf6607177bd4fa2ab607517ab62b68c526161e7bbc36db6c5a9a8164bab31eb2e958d43109520d98d7b2e9271a7b3b9e44f7316328f085f3f955a9b95a8a3e01aefab90b4d2c69d235725daeb3d784eaa0c93d9a191d52f1da4190888127016b89325f10bc4323e03d337fa142a2c1a988afc92f70f98951b8b0367eb3fd0e8df241e44746e16036de9d280636d88510af4fb6919a9d14ec0d684e407ef73e17bd095be93cdb9d9117ba80be1bc2a532e8c34957df53a0443a4016c546d53234372b17777e5a552d2c3632287cd60b5c7558412b02b8c0971b4785d2b009ea29befa1ad46e358caab52ecc1b96e4d1bf4f66e3fdd8526f1c4dd9af79aacb8b107bc02d99e7d11b092f14ba6f1c980d1d514dc404dfba23bd8c597b4711db185d5b78999746927f579098cd0ba2c8176dc85442a96ca90fe48586f17f9f0122383a95baa6331204325b99b5685624b3f025f7acd7c5c4958e8d18496bcb3eb434b792e72b8210e6c3dc9a066a4c80c126acd00cb0626b5c7f63d44f857a9c0a43dd76c3753ba1c28f9a7f53d51b4dedfb3990c7d27b92ed4c57bed33bbc3d0ffd278ffd57c12d8adb55a60d808986cef82b27c765b8be3d44c3919a6b76928a606a9554f6c881515a89384fd05afa93f2126135bd3ddc28babf4f7f0b58040e116720c47395a1c493b6ba733e648659d87377044f9785f44d36bcc0fc54d065fddb197c7b921c791431eead1287bb2fbfafcba25df2a58b6076c804ca04ef0ae21cb1ddfc1eca8cf44e36a7307094b123a99e32f81c40b8ba7eb0533d4bebb22ae04f186b56473e1f316ea66728e2cb8d8b3c2bdc30cac2abdddef8a1d3ba6392562d0e28abbfee4c96df92ff963404da4ad60ea4615e7c405d5efec01d6a33aa7e80011603700334324cfb6900b53a4f3b0fd9ec66c194bbe54439ae5f5a4e9cf6f39b15fee46422beb46d86124127b0c665291774141f641de52e8fa88bf2572a8b3784a8dc9f7b784232dd0e383c121034c5c5ef52d30a0bbfb602ce68888533f7a97b9f9e120657e755b5e3de14be611eb15e10a98dd2fb05fbf135a39e17e1cf60412a34160b08b77adcbefa024ec125715ccf3360b45547b3f4e8baef66eac64320b848d2b797a9f080a1104b803a5edde0b4df62a73bd40957395bbd701dc372a12da8ea6de94bccea211caa0191c34df0bdc5648cf8e0e75133b4f2474db8d612ad4bd4f2c0974e1439e0d7b4e01b32ede3cf7d7aa61227a3dbaf925f52e46e5436e1b60cd92a69a18934d8fbfec0296ebf125589ba23cb9a6a22ee75e4f5b50cfe6bf3f0559bad90d2124a7493a2ca61da9473f23b072039c5c775df43ad90ab275bd7fbff244f7a0f69b19e28373c99f0055b024fc7c7ad79187c1a89d4a90166b2e26e8a5e94d250bc64c215fbc9240d8dea6ac52b2212f2f3db3c4d5f76738b9b85e27808868478049bca3ea93419ff6779da9ca323f16e495b6de4161c3ade208deaeca5180def7bad02c81f8480fde003910716b44985af22b3a0fed2728178721862ae126ede933331e72212092721f62129a94721bb861a861a0d3fdf0c37da957aa6f36f0d6273a113ef16c9b739ab4abac562530444c2f466be1751b86fc3ccb14e4397378dd23bfd85dc8a94ef9b34bd2d67b48d3b5fb94b162c80b6fe3286f7618bf47c36af79b10fd2e5d6c116d0cf4e3c804a35a5a1a2a1cb7620c8e10ad2cd07b66dc9a2bfb55151f10aa39c345afee56de542132f1e294d3f09f4398d4e4a30c762b468b72962c010c2fb6ec7b3c30cf32d9f585ab5b111c80972b0a91f32b135531aa3a1a17676eb88ab00a2c7a6982e0f6a5bc655752dddf69fe2f11ccf80312aab5c6ba1a9db0c8cb12b99a9a3a7e7767801e0f9719b241e10e75a795dcc9828996d84d1525de21c0e4b6d1e5ea048117dab150048633c3e3e2dffd9a486061bbdd4dbab8c690e126deb30dc2d9bdb2afdc85e685610ce1189f042f3ab46036350c4fd53439ecb301a17ffa0baa67df3f5fdefff702709337f5c8580891889d1383cf07d9807e9461a8a2b66dfb3bea96e7efc3288228031aab3d7681d63766121ea86bcd58faf459e43881df971e265ff29f5a323a688d2c0b0765fc39f6ea2bd3e12f048980d525e7ef4b11ae59bea51294cadde6fbe7bb5ebc3626053de067714ebfd8012eb5d7d65ebb13f6b77fcc8fae74f31229d4660a6ffc71721a897c10883fd910f1ee251a131b9e47cf94aa6c5e53f4bab41be6f20b5f73e75f8a3db3a17dcc396a9b1097aac859b6fbf8b03d5bbe347c6e97ea1f0c376a4e3184cac48e9be356263a4b718c9a2fc96f550762bb8f1c7c6482fa057d8d5f53a8a57d7ff917dedd60dae151bf859a8f5cbb3860365fc25b62044a2337aaeb32985112727e51211794e2b29a0862ec8aad30febbe57febc78132121af05d15a4fc0211d1091eb4951d9b9dcf56e9ccb7068ba24155145d326481e096af5d66091a970383b277b80ae3a776ef56ea3c7782daa01778a291cc94e0b84e475563d0f62d299cbdb5c7fc4457f9286ba129fe19d14ac19b78dc9f633b43e8738b9b9f5d9419e88af38a1232c41e39501fdac8406ebabf027ad4ad119121cdff07ce9acdfaeb25eee47ff5b6d3c2c36d4780431a398fb36efc9ed8b9f1b62b29adf37d0c2d92fa5763159324e947e44b86a0fd2f382a8729e5fec12580286a93599222dc0a0ace1cc62ccd453f95a39007c7ddcb10259b8f9021911f41e9570945626401d64210ad5b85908d22e8f1051d84efb3a02bc3c272d754eb78c58287a2ab5cfc691e4c66ae468cb"}}, &(0x7f0000001900)) syz_io_uring_setup(0x7c2e, &(0x7f0000001940)={0x0, 0xa0e7, 0x40, 0x2, 0x2fa, 0x0, r2}, &(0x7f00000019c0), &(0x7f0000001a00), &(0x7f0000001a40)) ioctl(r1, 0x7fff, &(0x7f00000004c0)="1f05516fff9f29eea1e966542cadf5a56143f39096dfe2623d90802471a60a920334a317774385357438664598de5daa4d1dff371c835542a91e37f2a34be9cb7e00ecedb1e3ee12ddc72bdefeb68b37473effe4d5331d7dad38440461c615693d52b3fb476ebabd6716ecc707edd1e4558350293c6427f03b6f78ab2a3768cd63894bad7c25674c7ac776335fcd9c850e8048b56e5172ebdbc98aa53d42d72ae8af02") syz_kvm_setup_cpu$x86(0xffffffffffffffff, r0, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f00000005c0)="0f1cbe0000ba6100b05eee440f20c066350900000044070722c0b838000f00d8ba400066b80000000066eff4d09800000f4da2ee005df2ab", 0x38}], 0x1, 0x15, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000003600)={0x0, 0x0, &(0x7f00000035c0)={&(0x7f0000002100)=ANY=[@ANYBLOB="5c0000001500010029bd7000fcdbdf25ff02000000000000000000000000000100000000000000000000ffff000000004e2300004e2200030200a0a000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="b28e6e00000000b2a500"/20], 0x5c}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000200)={0x101fd, 0x5, 0x100000, 0x2000, &(0x7f0000015000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000001c0)={0x205, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x4, 0x7, 0xe1, 0x81, 0x9, 0xd9, 0x40, 0x41, 0xfb, 0x1, 0xc, 0x2, 0x2, 0x41, 0x0, 0xf7}}) r5 = syz_open_procfs(0x0, &(0x7f0000000000)='pagemap\x00') pread64(r5, &(0x7f0000001240)=""/102400, 0x19000, 0x80000000000000) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x80000000, 0x9, 0x20, 0x7, 0x2, 0x106c, 0x100, 0x8000000000000001, 0x80000004000080, 0x380000, 0x8, 0x0, 0x3, 0x7, 0x2], 0x1, 0x386312}) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f00000000c0)={0x5}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 143.448496ms ago: executing program 3 (id=208): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec773000) r1 = syz_clone(0x2080, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r1, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x1, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/116, 0x20001c34}], 0x1, 0x0) 61.411118ms ago: executing program 2 (id=209): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) shutdown(r0, 0x1) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$USBDEVFS_CLEAR_HALT(r1, 0xc0105502, &(0x7f0000000300)={0x1, 0x1}) 0s ago: executing program 2 (id=210): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43, 0x0, 0x3}}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) (async) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x1, 0x3, 0x3}, 0x10) (async, rerun: 64) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) (rerun: 64) sendmsg$tipc(r0, &(0x7f0000000280)={&(0x7f0000000040), 0x10, 0x0}, 0x0) (async) sendmsg$tipc(r0, &(0x7f0000000380)={&(0x7f0000000000)=@id={0x1e, 0x3, 0x0, {0x4e24, 0x1}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4048001}, 0x24004095) (async) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x30, r3, 0x400, 0x70bd29, 0x25dfdbff, {{}, {}, {0x14, 0x19, {0x1, 0x9, 0x0, 0x1000}}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x20004014}, 0x40) (async) ioctl$BTRFS_IOC_ENCODED_READ(r1, 0x80809440, &(0x7f0000000940)={&(0x7f00000008c0)=[{&(0x7f00000003c0)="28f3c661c8d78215cc9a59cdb9a199dd51446f314038cb5dddf124bb84c33a73b41eb619043352cc18e51b1ef79d69c18107da3808357f103360abd8eff4302044b1edad7d47e26e87cefa719431e2e835b82587fdf3bf1dbab174dd3fa35d4c7cd3e56205f5b71a9393d689bdcaa7e32a5b4454e76b0a167f626727747a64e3ac4c337a0ec03be2aec53ba263422d03a637ef72fcf68983080f53d6ea0d48d1098fba5524be81f81e0e010758760cd98b40ea4730a29973df5fd1b1c338f3bba6fb40aa4fd6ed", 0xc7}, {&(0x7f00000004c0)="f2a2347675bbc4d9c9b8502e79cd0e7dfab2c0ec9266993d27b202fff430e4cd7047f1ea3d9797c42c5436b005add9bf5791b9f0e0007419ad46c98fabd41a995f14fbcd685bb89387456928ab5b13fed81cc920a7bf70cad9b8160b807088ada00becdd8b046849956ee6306cb84604aa79116ee491071adb04a2fc70feb1431d8aea9774c1bd067a44aaaf44274669d62a21cd9a1cdc91078d04221744911a9c21a530e7e487c3a2614a75fa396aa1892021c3b41d4060b5a229f982516c6623a23498921095cec3946fe93e7558af3c8b771d8c0ad8baca1db21d12a7636f08ae5015f722822bd92ebef9389d1320e25c7a183fa23bb7199e2804e0ce", 0xfe}, {&(0x7f00000005c0)="fe4765ef0cc869056d0520c425aaf69346e9bb498ca60a51fcc4f78f7e2f22072ba98081772b4ee289b6655da20f79ec48052b78316f548f033466a9138dfca377e740936d2045ca35b7c36a4aadacf006ce5c591afabbe49efce3420c6e43197ac76672489a5b4a166efd31bd3d79fc1c9ec9af716880f20efec1d39527d30bf32fbe7195c71652111a1dc2896539494812a55f9cb48467421b2cc410c29f368fcbbaabeb614cc347c6d07ff535b6d521e4e0a39b023edca7949c42121f86c080be8a8435241b99bed8a809b5b2183f139664b9d6c1837b40dc5158c6435220d0bc5a05c2c3fd41c710713acc58d74d4851ae6273f6678d", 0xf8}, {&(0x7f00000006c0)="13cc31eaaa9f2621fb69fd800b0009331a60313cb96c78ab499b59fbe3142e410373eae699f78916bff0c4957d4ef34d7b978d82f8f139f2518a07e6a30747385e7cb1118144be110403725a9bbfa6ceda89735eae66afdbfb3a6961ef190ba5f723489f4e247d43181ef4c37334cd76b0508a68f6da", 0x76}, {&(0x7f0000000740)="0b86c10d4d15632e168aadc0ee06dc61473595d529bf046fac557f64c4e310bfe6af745c1ca1c5f2dd23c54e45157b0018303ccad06ac688d70e9bbcffaf737a1bb63a04d953464007a3d5c2c2ff6fe50ce598adc3d700558916c900d1eea21c8c4f00203bbb49a7bbf9cfa329aa0b2576dd3bc826ef20799e2f1a7c429e5677e253ca8a46ea28b6cce6f5f9f3783992ea3698c8d8541eb07e6eba0bcc63da3e3ccab32234f98b8587c654deee040bbbdf691c9053fd6cb65b2227711114162097aa8eb3306b05f5de079630", 0xcc}, {&(0x7f0000000840)="14d4b6e014620080d6719d936dfb5dfdb440ba8bf8c4c3879cae1b6b5df5cc9ee8c3a36ecef539d0cba219dbe537e0c6", 0x30}, {&(0x7f0000000880)="45c0382b5cf4df7291949f5ae8d1f85a684ac4b273063e9076f6c6197f0dd09cc5980a906817fca9", 0x28}], 0x7, 0x8, 0x0, 0xfff, 0x7, 0xd56, 0x7, 0x1}) getsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000080), &(0x7f0000000140)=0x4) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 22.985159][ T36] kauditd_printk_skb: 26 callbacks suppressed [ 22.985178][ T36] audit: type=1400 audit(1785507285.250:59): avc: denied { transition } for pid=275 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 22.990006][ T36] audit: type=1400 audit(1785507285.250:60): avc: denied { noatsecure } for pid=275 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 22.994373][ T36] audit: type=1400 audit(1785507285.260:61): avc: denied { write } for pid=275 comm="sh" path="pipe:[2729]" dev="pipefs" ino=2729 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 22.998006][ T36] audit: type=1400 audit(1785507285.260:62): avc: denied { rlimitinh } for pid=275 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 23.001086][ T36] audit: type=1400 audit(1785507285.260:63): avc: denied { siginh } for pid=275 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.161' (ED25519) to the list of known hosts. [ 31.179704][ T36] audit: type=1400 audit(1785507293.440:64): avc: denied { mounton } for pid=287 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 31.182790][ T287] cgroup: Unknown subsys name 'net' [ 31.202542][ T36] audit: type=1400 audit(1785507293.440:65): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 31.229800][ T36] audit: type=1400 audit(1785507293.470:66): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 31.230347][ T287] cgroup: Unknown subsys name 'devices' [ 31.354599][ T287] cgroup: Unknown subsys name 'hugetlb' [ 31.360216][ T287] cgroup: Unknown subsys name 'rlimit' [ 31.475141][ T36] audit: type=1400 audit(1785507293.740:67): avc: denied { setattr } for pid=287 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 31.498333][ T36] audit: type=1400 audit(1785507293.740:68): avc: denied { mounton } for pid=287 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 31.523129][ T36] audit: type=1400 audit(1785507293.740:69): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 31.583231][ T289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 31.592024][ T36] audit: type=1400 audit(1785507293.850:70): avc: denied { relabelto } for pid=289 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 31.617544][ T36] audit: type=1400 audit(1785507293.850:71): avc: denied { write } for pid=289 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 31.632921][ T287] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 31.643463][ T36] audit: type=1400 audit(1785507293.890:72): avc: denied { read } for pid=287 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 31.677270][ T36] audit: type=1400 audit(1785507293.890:73): avc: denied { open } for pid=287 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 32.438725][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.445874][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.454339][ T294] bridge_slave_0: entered allmulticast mode [ 32.460563][ T294] bridge_slave_0: entered promiscuous mode [ 32.468176][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.475276][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.482548][ T294] bridge_slave_1: entered allmulticast mode [ 32.488756][ T294] bridge_slave_1: entered promiscuous mode [ 32.616357][ T300] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.623478][ T300] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.630593][ T300] bridge_slave_0: entered allmulticast mode [ 32.636893][ T300] bridge_slave_0: entered promiscuous mode [ 32.643633][ T300] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.650689][ T300] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.657784][ T300] bridge_slave_1: entered allmulticast mode [ 32.664063][ T300] bridge_slave_1: entered promiscuous mode [ 32.677874][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.685034][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.692084][ T295] bridge_slave_0: entered allmulticast mode [ 32.698439][ T295] bridge_slave_0: entered promiscuous mode [ 32.707254][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.714324][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.721398][ T295] bridge_slave_1: entered allmulticast mode [ 32.727727][ T295] bridge_slave_1: entered promiscuous mode [ 32.733788][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.740831][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.747933][ T296] bridge_slave_0: entered allmulticast mode [ 32.754299][ T296] bridge_slave_0: entered promiscuous mode [ 32.760925][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.768023][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.775133][ T296] bridge_slave_1: entered allmulticast mode [ 32.781434][ T296] bridge_slave_1: entered promiscuous mode [ 32.829823][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.836931][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.844261][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.851296][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.941767][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.948959][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.956269][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.963327][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.983474][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.990751][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.998707][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.006407][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.020560][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.027745][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.069005][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.076155][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.084376][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.091417][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.100310][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.107404][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.144608][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.151673][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.164549][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.171615][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.179477][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.186544][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.194285][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.201313][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.229943][ T294] veth0_vlan: entered promiscuous mode [ 33.258282][ T295] veth0_vlan: entered promiscuous mode [ 33.269336][ T294] veth1_macvtap: entered promiscuous mode [ 33.279596][ T300] veth0_vlan: entered promiscuous mode [ 33.285985][ T296] veth0_vlan: entered promiscuous mode [ 33.303781][ T300] veth1_macvtap: entered promiscuous mode [ 33.317047][ T295] veth1_macvtap: entered promiscuous mode [ 33.339406][ T296] veth1_macvtap: entered promiscuous mode [ 33.373160][ T294] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 33.427441][ T318] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 33.458264][ T314] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=314 comm=syz.0.1 [ 33.502030][ T318] kvm: pic: level sensitive irq not supported [ 33.600040][ T330] FAULT_INJECTION: forcing a failure. [ 33.600040][ T330] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 33.619844][ T330] CPU: 0 UID: 0 PID: 330 Comm: syz.3.6 Not tainted syzkaller #0 91781886e4a1baa38ce9d8cd537274748dd3a26f [ 33.619873][ T330] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 33.619892][ T330] Call Trace: [ 33.619898][ T330] [ 33.619905][ T330] __dump_stack+0x21/0x30 [ 33.619939][ T330] dump_stack_lvl+0x140/0x1c0 [ 33.619963][ T330] ? __cfi_dump_stack_lvl+0x10/0x10 [ 33.619986][ T330] ? check_stack_object+0x81/0x150 [ 33.620021][ T330] ? __virt_addr_valid+0x2a1/0x370 [ 33.620042][ T330] dump_stack+0x19/0x20 [ 33.620065][ T330] should_fail_ex+0x3c2/0x510 [ 33.620086][ T330] should_fail+0xf/0x20 [ 33.620115][ T330] should_fail_usercopy+0x1e/0x30 [ 33.620134][ T330] _copy_from_user+0x20/0xa0 [ 33.620156][ T330] bm_register_write+0x119/0x14f0 [ 33.620177][ T330] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 33.620201][ T330] ? bpf_lsm_file_permission+0xd/0x20 [ 33.620223][ T330] ? __cfi_bm_register_write+0x10/0x10 [ 33.620243][ T330] vfs_write+0x3c1/0xfd0 [ 33.620260][ T330] ? __cfi_vfs_write+0x10/0x10 [ 33.620276][ T330] ? __kasan_check_write+0x18/0x20 [ 33.620311][ T330] ? mutex_lock+0x97/0x1d0 [ 33.620334][ T330] ? __cfi_mutex_lock+0x10/0x10 [ 33.620359][ T330] ksys_write+0x145/0x260 [ 33.620376][ T330] ? __cfi_ksys_write+0x10/0x10 [ 33.620394][ T330] ? __kasan_check_read+0x15/0x20 [ 33.620411][ T330] __x64_sys_write+0x7f/0x90 [ 33.620429][ T330] x64_sys_call+0x271c/0x2ee0 [ 33.620446][ T330] do_syscall_64+0x57/0xf0 [ 33.620465][ T330] ? clear_bhb_loop+0x50/0xa0 [ 33.620488][ T330] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 33.620511][ T330] RIP: 0033:0x7f49e139e019 [ 33.620526][ T330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 33.620541][ T330] RSP: 002b:00007f49e2235028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 33.620567][ T330] RAX: ffffffffffffffda RBX: 00007f49e1625fa0 RCX: 00007f49e139e019 [ 33.620581][ T330] RDX: 0000000000000034 RSI: 0000200000000040 RDI: 0000000000000004 [ 33.620593][ T330] RBP: 00007f49e2235090 R08: 0000000000000000 R09: 0000000000000000 [ 33.620604][ T330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 33.620615][ T330] R13: 00007f49e1626038 R14: 00007f49e1625fa0 R15: 00007ffef8bb5c08 [ 33.620631][ T330] [ 33.860980][ T310] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 34.014810][ T310] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 34.025802][ T310] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 34.036669][ T310] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.054014][ T310] usb 3-1: config 0 descriptor?? [ 34.099251][ T346] input: syz1 as /devices/virtual/input/input4 [ 34.176861][ T350] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=350 comm=syz.3.14 [ 34.270641][ T310] usbhid 3-1:0.0: can't add hid device: -71 [ 34.277101][ T310] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 34.285981][ T310] usb 3-1: USB disconnect, device number 2 [ 34.459120][ T397] usb usb8: usbfs: interface 0 claimed by hub while 'syz.1.28' resets device [ 34.521941][ T400] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 34.530393][ T400] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 34.590801][ T404] fido_id[404]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 34.752403][ T10] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 34.759987][ T66] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 34.913642][ T66] usb 4-1: config 0 has more interface descriptors, than it declares in bNumInterfaces, ignoring interface number: 0 [ 34.926025][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 34.937318][ T66] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 34.947782][ T10] usb 3-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 34.956953][ T66] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 4 [ 34.969871][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.978923][ T10] usb 3-1: config 0 descriptor?? [ 34.988287][ T66] usb 4-1: New USB device found, idVendor=1908, idProduct=1315, bcdDevice= 0.00 [ 34.997486][ T66] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.005543][ T66] usb 4-1: Product: syz [ 35.009725][ T66] usb 4-1: Manufacturer: syz [ 35.014552][ T66] usb 4-1: SerialNumber: syz [ 35.020903][ T66] usb 4-1: config 0 descriptor?? [ 35.026954][ T66] usb-storage 4-1:0.0: USB Mass Storage device detected [ 35.034951][ T66] usb-storage 4-1:0.0: Quirks match for vid 1908 pid 1315: 20000 [ 35.229263][ T66] usb 4-1: USB disconnect, device number 2 [ 35.235937][ T420] ======================================================= [ 35.235937][ T420] WARNING: The mand mount option has been deprecated and [ 35.235937][ T420] and is ignored by this kernel. Remove the mand [ 35.235937][ T420] option from the mount to silence this warning. [ 35.235937][ T420] ======================================================= [ 35.274933][ T420] tipc: Started in network mode [ 35.279941][ T420] tipc: Node identity 338, cluster identity 7 [ 35.286071][ T420] tipc: Node number set to 824 [ 35.292133][ T420] random: crng reseeded on system resumption [ 35.378604][ T310] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 35.386785][ T310] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz0 [ 35.802776][ T10] aiptek 3-1:0.0: Aiptek using 400 ms programming speed [ 35.810320][ T10] input: Aiptek as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input5 [ 36.015575][ T441] netlink: 132 bytes leftover after parsing attributes in process `syz.1.42'. [ 36.030485][ T441] netlink: 72 bytes leftover after parsing attributes in process `syz.1.42'. [ 36.107414][ T310] usb 3-1: USB disconnect, device number 3 [ 36.113332][ C1] aiptek 3-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 36.276168][ T36] kauditd_printk_skb: 105 callbacks suppressed [ 36.276186][ T36] audit: type=1400 audit(1785507298.540:179): avc: denied { read } for pid=480 comm="syz.0.47" name="usbmon2" dev="devtmpfs" ino=96 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 36.305730][ T36] audit: type=1400 audit(1785507298.540:180): avc: denied { open } for pid=480 comm="syz.0.47" path="/dev/usbmon2" dev="devtmpfs" ino=96 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 36.329884][ T36] audit: type=1400 audit(1785507298.570:181): avc: denied { ioctl } for pid=480 comm="syz.0.47" path="/dev/usbmon2" dev="devtmpfs" ino=96 ioctlcmd=0x9205 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 36.552390][ T45] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 36.681511][ T36] audit: type=1400 audit(1785507298.940:182): avc: denied { create } for pid=483 comm="syz.2.48" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 36.700932][ T36] audit: type=1400 audit(1785507298.940:183): avc: denied { getopt } for pid=483 comm="syz.2.48" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 36.741682][ T45] usb 1-1: too many configurations: 65, using maximum allowed: 8 [ 36.752301][ T486] FAULT_INJECTION: forcing a failure. [ 36.752301][ T486] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 36.768255][ T486] CPU: 0 UID: 0 PID: 486 Comm: syz.3.49 Not tainted syzkaller #0 91781886e4a1baa38ce9d8cd537274748dd3a26f [ 36.768288][ T486] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 36.768303][ T486] Call Trace: [ 36.768310][ T486] [ 36.768319][ T486] __dump_stack+0x21/0x30 [ 36.768357][ T486] dump_stack_lvl+0x140/0x1c0 [ 36.768390][ T486] ? __cfi_dump_stack_lvl+0x10/0x10 [ 36.768435][ T486] ? seq_write+0xe3/0x140 [ 36.768466][ T486] ? __asan_memcpy+0x5a/0x80 [ 36.768488][ T486] dump_stack+0x19/0x20 [ 36.768519][ T486] should_fail_ex+0x3c2/0x510 [ 36.768545][ T486] should_fail+0xf/0x20 [ 36.768569][ T486] should_fail_usercopy+0x1e/0x30 [ 36.768596][ T486] _copy_to_iter+0x3b6/0x1520 [ 36.768626][ T486] ? __kmalloc_node_noprof+0x252/0x500 [ 36.768653][ T486] ? __cfi__copy_to_iter+0x10/0x10 [ 36.768682][ T486] ? __check_object_size+0x54c/0x870 [ 36.768706][ T486] ? __cfi___check_object_size+0x10/0x10 [ 36.768732][ T486] seq_read_iter+0xcb2/0xf30 [ 36.768763][ T486] seq_read+0x368/0x490 [ 36.768791][ T486] ? __cfi_seq_read+0x10/0x10 [ 36.768819][ T486] ? __cfi_selinux_file_permission+0x10/0x10 [ 36.768843][ T486] ? __kasan_check_write+0x18/0x20 [ 36.768865][ T486] ? proc_fail_nth_write+0x184/0x220 [ 36.768899][ T486] ? __cfi_seq_read+0x10/0x10 [ 36.768927][ T486] proc_reg_read+0x1f7/0x2f0 [ 36.768950][ T486] ? __cfi_proc_reg_read+0x10/0x10 [ 36.768973][ T486] vfs_read+0x28b/0xc70 [ 36.768998][ T486] ? __cfi_vfs_read+0x10/0x10 [ 36.769020][ T486] ? __kasan_check_write+0x18/0x20 [ 36.769051][ T486] ? mutex_lock+0x97/0x1d0 [ 36.769082][ T486] ? __cfi_mutex_lock+0x10/0x10 [ 36.769116][ T486] ksys_read+0x145/0x260 [ 36.769139][ T486] ? __cfi_ksys_read+0x10/0x10 [ 36.769163][ T486] ? __kasan_check_read+0x15/0x20 [ 36.769185][ T486] __x64_sys_read+0x7f/0x90 [ 36.769209][ T486] x64_sys_call+0x2638/0x2ee0 [ 36.769230][ T486] do_syscall_64+0x57/0xf0 [ 36.769256][ T486] ? clear_bhb_loop+0x50/0xa0 [ 36.769287][ T486] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 36.769318][ T486] RIP: 0033:0x7f49e139e019 [ 36.769336][ T486] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 36.769354][ T486] RSP: 002b:00007f49e2235028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 36.769377][ T486] RAX: ffffffffffffffda RBX: 00007f49e1625fa0 RCX: 00007f49e139e019 [ 36.769395][ T486] RDX: 0000000000002020 RSI: 0000200000001fc0 RDI: 0000000000000003 [ 36.769410][ T486] RBP: 00007f49e2235090 R08: 0000000000000000 R09: 0000000000000000 [ 36.769424][ T486] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 36.769437][ T486] R13: 00007f49e1626038 R14: 00007f49e1625fa0 R15: 00007ffef8bb5c08 [ 36.769456][ T486] [ 36.774970][ T45] usb 1-1: New USB device found, idVendor=046d, idProduct=08c1, bcdDevice=ee.8d [ 36.806247][ T36] audit: type=1400 audit(1785507299.050:184): avc: denied { nlmsg_write } for pid=487 comm="syz.2.50" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 36.826762][ T45] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.894834][ T36] audit: type=1400 audit(1785507299.160:185): avc: denied { append } for pid=489 comm="syz.3.51" name="ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 37.004539][ T45] usb 1-1: Found UVC 0.00 device (046d:08c1) [ 37.125635][ T45] usb 1-1: No valid video chain found. [ 37.137355][ T496] FAULT_INJECTION: forcing a failure. [ 37.137355][ T496] name failslab, interval 1, probability 0, space 0, times 1 [ 37.151652][ T496] CPU: 1 UID: 0 PID: 496 Comm: syz.3.54 Not tainted syzkaller #0 91781886e4a1baa38ce9d8cd537274748dd3a26f [ 37.151682][ T496] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 37.151695][ T496] Call Trace: [ 37.151702][ T496] [ 37.151709][ T496] __dump_stack+0x21/0x30 [ 37.151742][ T496] dump_stack_lvl+0x140/0x1c0 [ 37.151771][ T496] ? __cfi_dump_stack_lvl+0x10/0x10 [ 37.151801][ T496] ? release_sock+0x171/0x1f0 [ 37.151829][ T496] dump_stack+0x19/0x20 [ 37.151857][ T496] should_fail_ex+0x3c2/0x510 [ 37.151881][ T496] should_failslab+0xac/0x100 [ 37.151916][ T496] kmem_cache_alloc_node_noprof+0x45/0x420 [ 37.151939][ T496] ? netlink_data_ready+0x20/0x20 [ 37.151970][ T496] ? __alloc_skb+0x10c/0x360 [ 37.152018][ T496] __alloc_skb+0x10c/0x360 [ 37.152048][ T496] netlink_alloc_large_skb+0xf7/0x1b0 [ 37.152081][ T496] netlink_sendmsg+0x576/0xad0 [ 37.152104][ T496] ? __cfi_netlink_sendmsg+0x10/0x10 [ 37.152127][ T496] ? bpf_lsm_socket_sendmsg+0xd/0x20 [ 37.152152][ T496] ? security_socket_sendmsg+0x3d/0x100 [ 37.152185][ T496] ____sys_sendmsg+0x99e/0xa00 [ 37.152208][ T496] ? __import_iovec+0x5b9/0x7d0 [ 37.152240][ T496] ? __sys_sendmsg_sock+0x50/0x50 [ 37.152264][ T496] ? import_iovec+0x80/0xb0 [ 37.152296][ T496] ___sys_sendmsg+0x2a6/0x370 [ 37.152319][ T496] ? __sys_sendmsg+0x2a0/0x2a0 [ 37.152344][ T496] ? proc_fail_nth_write+0x184/0x220 [ 37.152375][ T496] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 37.152412][ T496] ? __fget_files+0x2bc/0x330 [ 37.152440][ T496] __x64_sys_sendmsg+0x206/0x2e0 [ 37.152462][ T496] ? fput+0x1a4/0x230 [ 37.152490][ T496] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 37.152513][ T496] ? ksys_write+0x1f3/0x260 [ 37.152537][ T496] ? __kasan_check_read+0x15/0x20 [ 37.152560][ T496] x64_sys_call+0x2a4c/0x2ee0 [ 37.152581][ T496] do_syscall_64+0x57/0xf0 [ 37.152606][ T496] ? clear_bhb_loop+0x50/0xa0 [ 37.152635][ T496] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 37.152664][ T496] RIP: 0033:0x7f49e139e019 [ 37.152682][ T496] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 37.152701][ T496] RSP: 002b:00007f49e2235028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 37.152724][ T496] RAX: ffffffffffffffda RBX: 00007f49e1625fa0 RCX: 00007f49e139e019 [ 37.152741][ T496] RDX: 0000000040048000 RSI: 0000200000002f00 RDI: 0000000000000003 [ 37.152756][ T496] RBP: 00007f49e2235090 R08: 0000000000000000 R09: 0000000000000000 [ 37.152771][ T496] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 37.152784][ T496] R13: 00007f49e1626038 R14: 00007f49e1625fa0 R15: 00007ffef8bb5c08 [ 37.152803][ T496] [ 37.427015][ T45] usb 1-1: USB disconnect, device number 2 [ 37.459275][ T66] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 37.513636][ T36] audit: type=1326 audit(1785507299.780:186): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=502 comm="syz.2.57" exe="/root/ci2-android-6-12-rust/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3692f9e019 code=0x0 [ 37.555759][ T509] FAULT_INJECTION: forcing a failure. [ 37.555759][ T509] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 37.568876][ T509] CPU: 1 UID: 0 PID: 509 Comm: syz.3.59 Not tainted syzkaller #0 91781886e4a1baa38ce9d8cd537274748dd3a26f [ 37.568908][ T509] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 37.568921][ T509] Call Trace: [ 37.568933][ T509] [ 37.568939][ T509] __dump_stack+0x21/0x30 [ 37.568965][ T509] dump_stack_lvl+0x140/0x1c0 [ 37.568988][ T509] ? __cfi_dump_stack_lvl+0x10/0x10 [ 37.569010][ T509] ? vsnprintf+0x7b4/0x1ad0 [ 37.569027][ T509] ? check_stack_object+0x10f/0x150 [ 37.569044][ T509] dump_stack+0x19/0x20 [ 37.569065][ T509] should_fail_ex+0x3c2/0x510 [ 37.569083][ T509] should_fail+0xf/0x20 [ 37.569099][ T509] should_fail_usercopy+0x1e/0x30 [ 37.569118][ T509] _copy_from_user+0x20/0xa0 [ 37.569140][ T509] kstrtouint_from_user+0xde/0x170 [ 37.569157][ T509] ? __cfi_kstrtouint_from_user+0x10/0x10 [ 37.569174][ T509] ? selinux_file_permission+0x318/0xb60 [ 37.569191][ T509] ? __cfi_selinux_file_permission+0x10/0x10 [ 37.569206][ T509] proc_fail_nth_write+0x8f/0x220 [ 37.569229][ T509] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 37.569252][ T509] ? rwsem_read_trylock+0x275/0x5a0 [ 37.569277][ T509] ? bpf_lsm_file_permission+0xd/0x20 [ 37.569298][ T509] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 37.569321][ T509] vfs_write+0x3c1/0xfd0 [ 37.569337][ T509] ? __cfi___blk_flush_plug+0x10/0x10 [ 37.569358][ T509] ? __cfi_vfs_write+0x10/0x10 [ 37.569374][ T509] ? __kasan_check_write+0x18/0x20 [ 37.569389][ T509] ? mutex_lock+0x97/0x1d0 [ 37.569410][ T509] ? __cfi_mutex_lock+0x10/0x10 [ 37.569433][ T509] ksys_write+0x145/0x260 [ 37.569449][ T509] ? __cfi_ksys_write+0x10/0x10 [ 37.569465][ T509] ? __kasan_check_read+0x15/0x20 [ 37.569480][ T509] __x64_sys_write+0x7f/0x90 [ 37.569508][ T509] x64_sys_call+0x271c/0x2ee0 [ 37.569522][ T509] do_syscall_64+0x57/0xf0 [ 37.569539][ T509] ? clear_bhb_loop+0x50/0xa0 [ 37.569571][ T509] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 37.569590][ T509] RIP: 0033:0x7f49e135e84e [ 37.569601][ T509] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 37.569612][ T509] RSP: 002b:00007f49e2234fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 37.569627][ T509] RAX: ffffffffffffffda RBX: 00007f49e22356c0 RCX: 00007f49e135e84e [ 37.569638][ T509] RDX: 0000000000000001 RSI: 00007f49e22350a0 RDI: 0000000000000003 [ 37.569647][ T509] RBP: 00007f49e2235090 R08: 0000000000000000 R09: 0000000000000000 [ 37.569656][ T509] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 37.569664][ T509] R13: 00007f49e1626038 R14: 00007f49e1625fa0 R15: 00007ffef8bb5c08 [ 37.569676][ T509] [ 37.852044][ T36] audit: type=1400 audit(1785507300.110:187): avc: denied { create } for pid=511 comm="syz.3.60" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 37.871776][ T36] audit: type=1400 audit(1785507300.110:188): avc: denied { connect } for pid=511 comm="syz.3.60" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 37.874667][ T66] usb 2-1: unable to get BOS descriptor or descriptor too short [ 37.899736][ T66] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 37.912869][ T66] usb 2-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 37.928903][ T66] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.950392][ T66] usb 2-1: Product: syz [ 37.955681][ T66] usb 2-1: Manufacturer: syz [ 37.960421][ T66] usb 2-1: SerialNumber: syz [ 37.967121][ T514] tap0: tun_chr_ioctl cmd 1074025672 [ 37.972816][ T514] tap0: ignored: set checksum disabled [ 38.183616][ T494] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 38.193093][ T494] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 38.204855][ T66] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 38.222420][ T66] usb 2-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 38.231283][ T66] usb 2-1: found format II with max.bitrate = 4, frame size=7372 [ 38.242406][ T66] usb 2-1: parse_audio_format_rates_v2v3(): unable to retrieve number of sample rates (clock 0) [ 38.266373][ T66] usb 2-1: USB disconnect, device number 2 [ 38.432692][ T522] FAULT_INJECTION: forcing a failure. [ 38.432692][ T522] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 38.445872][ T522] CPU: 1 UID: 0 PID: 522 Comm: syz.2.64 Not tainted syzkaller #0 91781886e4a1baa38ce9d8cd537274748dd3a26f [ 38.445899][ T522] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 38.445908][ T522] Call Trace: [ 38.445912][ T522] [ 38.445918][ T522] __dump_stack+0x21/0x30 [ 38.445941][ T522] dump_stack_lvl+0x140/0x1c0 [ 38.445959][ T522] ? __cfi_dump_stack_lvl+0x10/0x10 [ 38.445979][ T522] dump_stack+0x19/0x20 [ 38.445997][ T522] should_fail_ex+0x3c2/0x510 [ 38.446013][ T522] should_fail+0xf/0x20 [ 38.446026][ T522] should_fail_usercopy+0x1e/0x30 [ 38.446042][ T522] strncpy_from_user+0x29/0x280 [ 38.446057][ T522] getname_flags+0x106/0x6b0 [ 38.446073][ T522] getname+0x1b/0x30 [ 38.446086][ T522] do_sys_openat2+0xda/0x1d0 [ 38.446106][ T522] ? do_sys_open+0x100/0x100 [ 38.446125][ T522] __x64_sys_creat+0x92/0xc0 [ 38.446145][ T522] x64_sys_call+0x2710/0x2ee0 [ 38.446157][ T522] do_syscall_64+0x57/0xf0 [ 38.446172][ T522] ? clear_bhb_loop+0x50/0xa0 [ 38.446191][ T522] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 38.446209][ T522] RIP: 0033:0x7f3692f9e019 [ 38.446220][ T522] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 38.446231][ T522] RSP: 002b:00007f3693eb0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 [ 38.446246][ T522] RAX: ffffffffffffffda RBX: 00007f3693225fa0 RCX: 00007f3692f9e019 [ 38.446256][ T522] RDX: 0000000000000000 RSI: 0000000000000108 RDI: 00002000000001c0 [ 38.446264][ T522] RBP: 00007f3693eb0090 R08: 0000000000000000 R09: 0000000000000000 [ 38.446273][ T522] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 38.446281][ T522] R13: 00007f3693226038 R14: 00007f3693225fa0 R15: 00007ffe9fa34ea8 [ 38.446297][ T522] [ 38.725963][ T529] overlay: Unknown parameter 'subj_type' [ 39.172400][ T66] usb 4-1: new low-speed USB device number 3 using dummy_hcd [ 39.200537][ T551] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=55 sclass=netlink_route_socket pid=551 comm=syz.1.76 [ 39.213348][ T551] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=27 sclass=netlink_route_socket pid=551 comm=syz.1.76 [ 39.297019][ T555] random: crng reseeded on system resumption [ 39.323473][ T66] usb 4-1: LPM exit latency is zeroed, disabling LPM. [ 39.331102][ T66] usb 4-1: config 1 has an invalid descriptor of length 71, skipping remainder of the config [ 39.343572][ T66] usb 4-1: string descriptor 0 read error: -22 [ 39.349866][ T66] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 39.358977][ T66] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.369487][ T66] usb 4-1: bad CDC descriptors [ 39.571897][ T540] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 39.580485][ T540] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 39.589074][ T9] usb 4-1: USB disconnect, device number 3 [ 39.742381][ T66] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 39.892417][ T66] usb 3-1: Using ep0 maxpacket: 16 [ 39.899972][ T66] usb 3-1: config 5 has an invalid interface number: 48 but max is 0 [ 39.908155][ T66] usb 3-1: config 5 has no interface number 0 [ 39.914329][ T66] usb 3-1: config 5 interface 48 has no altsetting 0 [ 39.922635][ T66] usb 3-1: New USB device found, idVendor=108c, idProduct=0169, bcdDevice=bb.44 [ 39.931736][ T66] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.939884][ T66] usb 3-1: Product: syz [ 39.944841][ T66] usb 3-1: Manufacturer: syz [ 39.949431][ T66] usb 3-1: SerialNumber: syz [ 40.160322][ T66] usb 3-1: USB disconnect, device number 4 [ 40.167620][ T574] rust_binder: BC_FREEZE_NOTIFICATION_DONE 4004630500000000 not found [ 40.176508][ T574] rust_binder: Write failure EINVAL in pid:55 [ 40.261429][ T583] kvm: emulating exchange as write [ 40.367881][ T592] FAULT_INJECTION: forcing a failure. [ 40.367881][ T592] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 40.381127][ T592] CPU: 0 UID: 0 PID: 592 Comm: syz.3.89 Not tainted syzkaller #0 91781886e4a1baa38ce9d8cd537274748dd3a26f [ 40.381157][ T592] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 40.381170][ T592] Call Trace: [ 40.381176][ T592] [ 40.381184][ T592] __dump_stack+0x21/0x30 [ 40.381221][ T592] dump_stack_lvl+0x140/0x1c0 [ 40.381252][ T592] ? __cfi_dump_stack_lvl+0x10/0x10 [ 40.381283][ T592] dump_stack+0x19/0x20 [ 40.381313][ T592] should_fail_ex+0x3c2/0x510 [ 40.381339][ T592] should_fail+0xf/0x20 [ 40.381361][ T592] should_fail_usercopy+0x1e/0x30 [ 40.381387][ T592] strncpy_from_user+0x29/0x280 [ 40.381413][ T592] getname_flags+0x106/0x6b0 [ 40.381437][ T592] vfs_fstatat+0xcb/0x1d0 [ 40.381463][ T592] __se_sys_newfstatat+0x127/0x3c0 [ 40.381493][ T592] ? __x64_sys_newfstatat+0xc0/0xc0 [ 40.381520][ T592] ? vfs_write+0xbcf/0xfd0 [ 40.381543][ T592] ? __cfi_vfs_write+0x10/0x10 [ 40.381566][ T592] ? __kasan_check_write+0x18/0x20 [ 40.381589][ T592] ? mutex_unlock+0x90/0x240 [ 40.381623][ T592] ? __cfi_ksys_write+0x10/0x10 [ 40.381646][ T592] __x64_sys_newfstatat+0x9f/0xc0 [ 40.381674][ T592] x64_sys_call+0x1821/0x2ee0 [ 40.381701][ T592] do_syscall_64+0x57/0xf0 [ 40.381723][ T592] ? clear_bhb_loop+0x50/0xa0 [ 40.381751][ T592] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 40.381779][ T592] RIP: 0033:0x7f49e139e019 [ 40.381798][ T592] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 40.381816][ T592] RSP: 002b:00007f49e2214028 EFLAGS: 00000246 ORIG_RAX: 0000000000000106 [ 40.381838][ T592] RAX: ffffffffffffffda RBX: 00007f49e1626090 RCX: 00007f49e139e019 [ 40.381855][ T592] RDX: 0000000000000000 RSI: 0000200000000280 RDI: ffffffffffffff9c [ 40.381871][ T592] RBP: 00007f49e2214090 R08: 0000000000000000 R09: 0000000000000000 [ 40.381902][ T592] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 40.381916][ T592] R13: 00007f49e1626128 R14: 00007f49e1626090 R15: 00007ffef8bb5c08 [ 40.381936][ T592] [ 40.996970][ T606] netlink: 44 bytes leftover after parsing attributes in process `syz.2.95'. [ 41.005896][ T606] netlink: 43 bytes leftover after parsing attributes in process `syz.2.95'. [ 41.014726][ T606] netlink: 'syz.2.95': attribute type 6 has an invalid length. [ 41.022298][ T606] netlink: 43 bytes leftover after parsing attributes in process `syz.2.95'. [ 41.220458][ T9] smpboot: CPU 1 is now offline [ 41.229316][ T620] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 41.291701][ T36] kauditd_printk_skb: 42 callbacks suppressed [ 41.291717][ T36] audit: type=1400 audit(1785507303.550:231): avc: denied { unmount } for pid=296 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 41.317714][ T45] usb 3-1: new low-speed USB device number 5 using dummy_hcd [ 41.452441][ T45] usb 3-1: device descriptor read/64, error -71 [ 41.621610][ T36] audit: type=1400 audit(1785507303.880:232): avc: denied { map } for pid=627 comm="syz.1.104" path="socket:[6055]" dev="sockfs" ino=6055 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 41.702395][ T45] usb 3-1: device descriptor read/64, error -71 [ 41.721391][ T632] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 41.734133][ T36] audit: type=1400 audit(1785507304.000:233): avc: denied { getopt } for pid=631 comm="syz.1.106" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 41.842691][ T635] netlink: 144 bytes leftover after parsing attributes in process `syz.1.107'. [ 41.853639][ T635] netlink: 68 bytes leftover after parsing attributes in process `syz.1.107'. [ 41.942422][ T45] usb 3-1: new low-speed USB device number 6 using dummy_hcd [ 41.993482][ T36] audit: type=1400 audit(1785507304.260:234): avc: denied { create } for pid=636 comm="syz.0.108" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dccp_socket permissive=1 [ 42.072387][ T45] usb 3-1: device descriptor read/64, error -71 [ 42.088714][ T36] audit: type=1400 audit(1785507304.350:235): avc: denied { write } for pid=639 comm="syz.0.109" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 42.176052][ T643] netlink: 'syz.0.110': attribute type 4 has an invalid length. [ 42.183864][ T643] netlink: 3657 bytes leftover after parsing attributes in process `syz.0.110'. [ 42.322432][ T45] usb 3-1: device descriptor read/64, error -71 [ 42.398580][ T36] audit: type=1326 audit(1785507304.660:236): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=648 comm="syz.3.112" exe="/root/ci2-android-6-12-rust/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f49e139e019 code=0x0 [ 42.432562][ T45] usb usb3-port1: attempt power cycle [ 42.452374][ T9] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 42.603470][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 42.614689][ T9] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 42.624136][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 42.634618][ T9] usb 1-1: config 0 descriptor?? [ 42.744746][ T36] audit: type=1400 audit(1785507305.010:237): avc: denied { write } for pid=654 comm="syz.1.114" name="usb_gadget" dev="configfs" ino=2354 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 42.751599][ T655] FAULT_INJECTION: forcing a failure. [ 42.751599][ T655] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 42.770701][ T36] audit: type=1400 audit(1785507305.010:238): avc: denied { add_name } for pid=654 comm="syz.1.114" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 42.780769][ T655] CPU: 0 UID: 0 PID: 655 Comm: syz.1.114 Not tainted syzkaller #0 91781886e4a1baa38ce9d8cd537274748dd3a26f [ 42.780845][ T655] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 42.780872][ T655] Call Trace: [ 42.780892][ T655] [ 42.780910][ T655] __dump_stack+0x21/0x30 [ 42.780976][ T655] dump_stack_lvl+0x140/0x1c0 [ 42.781039][ T655] ? __cfi_dump_stack_lvl+0x10/0x10 [ 42.781108][ T655] dump_stack+0x19/0x20 [ 42.781174][ T655] should_fail_ex+0x3c2/0x510 [ 42.781227][ T655] should_fail+0xf/0x20 [ 42.781277][ T655] should_fail_usercopy+0x1e/0x30 [ 42.781331][ T655] strncpy_from_user+0x29/0x280 [ 42.781378][ T655] getname_flags+0x106/0x6b0 [ 42.781431][ T655] __x64_sys_symlink+0x61/0x90 [ 42.781496][ T655] x64_sys_call+0x28d8/0x2ee0 [ 42.781539][ T655] do_syscall_64+0x57/0xf0 [ 42.781594][ T655] ? clear_bhb_loop+0x50/0xa0 [ 42.781657][ T655] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 42.781718][ T655] RIP: 0033:0x7f57d2d9e019 [ 42.781754][ T655] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 42.781796][ T655] RSP: 002b:00007f57d17e3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000058 [ 42.781850][ T655] RAX: ffffffffffffffda RBX: 00007f57d3025fa0 RCX: 00007f57d2d9e019 [ 42.781912][ T655] RDX: 0000000000000000 RSI: 0000200000001200 RDI: 0000200000001100 [ 42.781961][ T655] RBP: 00007f57d17e3090 R08: 0000000000000000 R09: 0000000000000000 [ 42.782003][ T655] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 42.782049][ T655] R13: 00007f57d3026038 R14: 00007f57d3025fa0 R15: 00007ffc77cd1618 [ 42.782088][ T655] [ 42.783768][ T655] UDC core: g1: couldn't find an available UDC or it's busy [ 42.802666][ T45] usb 3-1: new low-speed USB device number 7 using dummy_hcd [ 42.835043][ T36] audit: type=1400 audit(1785507305.010:239): avc: denied { create } for pid=654 comm="syz.1.114" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 43.005253][ T36] audit: type=1400 audit(1785507305.010:240): avc: denied { write } for pid=654 comm="syz.1.114" name="use" dev="configfs" ino=6414 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 43.020116][ T9] usbhid 1-1:0.0: can't add hid device: -71 [ 43.039763][ T45] usb 3-1: device descriptor read/8, error -71 [ 43.042927][ T9] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 43.067962][ T9] usb 1-1: USB disconnect, device number 3 [ 43.173498][ T45] usb 3-1: device descriptor read/8, error -71 [ 43.312438][ T66] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 43.412459][ T45] usb 3-1: new low-speed USB device number 8 using dummy_hcd [ 43.433497][ T45] usb 3-1: device descriptor read/8, error -71 [ 43.462355][ T66] usb 2-1: Using ep0 maxpacket: 16 [ 43.468762][ T66] usb 2-1: config index 0 descriptor too short (expected 255, got 152) [ 43.477299][ T66] usb 2-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 43.487482][ T66] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 43.497673][ T66] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 43.506762][ T66] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 43.514989][ T66] usb 2-1: Product: syz [ 43.519172][ T66] usb 2-1: Manufacturer: syz [ 43.523821][ T66] usb 2-1: SerialNumber: syz [ 43.532386][ T9] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 43.563462][ T45] usb 3-1: device descriptor read/8, error -71 [ 43.672452][ T45] usb usb3-port1: unable to enumerate USB device [ 43.683349][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 43.694342][ T9] usb 1-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 43.703464][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 43.712167][ T9] usb 1-1: config 0 descriptor?? [ 43.729859][ T659] netlink: 8 bytes leftover after parsing attributes in process `syz.1.116'. [ 43.945506][ T66] usb 2-1: cannot find UAC_HEADER [ 43.953321][ T66] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 43.963174][ T66] usb 2-1: USB disconnect, device number 3 [ 43.971948][ T320] udevd[320]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 44.066610][ T672] FAULT_INJECTION: forcing a failure. [ 44.066610][ T672] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 44.079732][ T672] CPU: 0 UID: 0 PID: 672 Comm: syz.2.119 Not tainted syzkaller #0 91781886e4a1baa38ce9d8cd537274748dd3a26f [ 44.079751][ T672] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 44.079759][ T672] Call Trace: [ 44.079764][ T672] [ 44.079769][ T672] __dump_stack+0x21/0x30 [ 44.079792][ T672] dump_stack_lvl+0x140/0x1c0 [ 44.079819][ T672] ? __cfi_dump_stack_lvl+0x10/0x10 [ 44.079839][ T672] dump_stack+0x19/0x20 [ 44.079856][ T672] should_fail_ex+0x3c2/0x510 [ 44.079872][ T672] should_fail+0xf/0x20 [ 44.079885][ T672] should_fail_usercopy+0x1e/0x30 [ 44.079901][ T672] strncpy_from_user+0x29/0x280 [ 44.079917][ T672] path_setxattr+0x142/0x5a0 [ 44.079932][ T672] ? simple_xattrs_free+0x180/0x180 [ 44.079951][ T672] ? __cfi_ksys_write+0x10/0x10 [ 44.079966][ T672] __x64_sys_setxattr+0xc9/0xe0 [ 44.079979][ T672] x64_sys_call+0x2d94/0x2ee0 [ 44.079991][ T672] do_syscall_64+0x57/0xf0 [ 44.080006][ T672] ? clear_bhb_loop+0x50/0xa0 [ 44.080025][ T672] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 44.080042][ T672] RIP: 0033:0x7f3692f9e019 [ 44.080053][ T672] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 44.080064][ T672] RSP: 002b:00007f3693eb0028 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc [ 44.080079][ T672] RAX: ffffffffffffffda RBX: 00007f3693225fa0 RCX: 00007f3692f9e019 [ 44.080089][ T672] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000200000000000 [ 44.080097][ T672] RBP: 00007f3693eb0090 R08: 0000000000000002 R09: 0000000000000000 [ 44.080106][ T672] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 44.080114][ T672] R13: 00007f3693226038 R14: 00007f3693225fa0 R15: 00007ffe9fa34ea8 [ 44.080125][ T672] [ 44.674955][ T9] aiptek 1-1:0.0: Aiptek using 400 ms programming speed [ 44.682508][ T9] input: Aiptek as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input7 [ 44.968662][ T10] usb 1-1: USB disconnect, device number 4 [ 44.974733][ C0] aiptek 1-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 44.992379][ T9] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 45.142415][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 45.148864][ T9] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 45.157465][ T9] usb 2-1: config 179 has no interface number 0 [ 45.163841][ T9] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 45.175316][ T9] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 45.187300][ T9] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 45.198834][ T9] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0 [ 45.209132][ T9] usb 2-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 45.223070][ T9] usb 2-1: config 179 interface 65 has no altsetting 0 [ 45.230011][ T9] usb 2-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 45.239407][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 45.251665][ T9] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:179.65/input/input8 [ 45.455156][ T10] usb 2-1: USB disconnect, device number 4 [ 45.461317][ T10] xpad 2-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 45.593880][ T709] netlink: 20 bytes leftover after parsing attributes in process `syz.2.134'. [ 45.622729][ T709] FAULT_INJECTION: forcing a failure. [ 45.622729][ T709] name failslab, interval 1, probability 0, space 0, times 0 [ 45.643518][ T709] CPU: 0 UID: 0 PID: 709 Comm: syz.2.134 Not tainted syzkaller #0 91781886e4a1baa38ce9d8cd537274748dd3a26f [ 45.643540][ T709] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 45.643555][ T709] Call Trace: [ 45.643560][ T709] [ 45.643565][ T709] __dump_stack+0x21/0x30 [ 45.643590][ T709] dump_stack_lvl+0x140/0x1c0 [ 45.643610][ T709] ? __cfi_dump_stack_lvl+0x10/0x10 [ 45.643629][ T709] ? avc_has_perm+0x155/0x240 [ 45.643646][ T709] ? __cfi_avc_has_perm+0x10/0x10 [ 45.643662][ T709] dump_stack+0x19/0x20 [ 45.643681][ T709] should_fail_ex+0x3c2/0x510 [ 45.643697][ T709] should_failslab+0xac/0x100 [ 45.643715][ T709] __kmalloc_cache_noprof+0x41/0x470 [ 45.643730][ T709] ? vhost_task_create+0x12c/0x3f0 [ 45.643746][ T709] ? __cfi_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 45.643763][ T709] vhost_task_create+0x12c/0x3f0 [ 45.643777][ T709] ? __cfi_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 45.643795][ T709] ? __cfi_vhost_task_create+0x10/0x10 [ 45.643810][ T709] ? __cfi_vhost_task_fn+0x10/0x10 [ 45.643824][ T709] ? __kasan_check_write+0x18/0x20 [ 45.643838][ T709] ? mutex_lock+0x97/0x1d0 [ 45.643858][ T709] ? __cfi_mutex_lock+0x10/0x10 [ 45.643876][ T709] ? kernel_text_address+0xa9/0xe0 [ 45.643896][ T709] kvm_mmu_post_init_vm+0x161/0x300 [ 45.643917][ T709] kvm_arch_vcpu_ioctl_run+0xf3/0x1bc0 [ 45.643936][ T709] ? _parse_integer_limit+0x195/0x1e0 [ 45.643952][ T709] ? __cfi_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 45.643971][ T709] ? kstrtoull+0x13b/0x1e0 [ 45.643984][ T709] ? kstrtouint+0x78/0xf0 [ 45.643998][ T709] ? ioctl_has_perm+0x1bc/0x500 [ 45.644011][ T709] ? __asan_memcpy+0x5a/0x80 [ 45.644025][ T709] ? ioctl_has_perm+0x408/0x500 [ 45.644037][ T709] ? has_cap_mac_admin+0xd0/0xd0 [ 45.644051][ T709] ? __kasan_check_write+0x18/0x20 [ 45.644064][ T709] ? mutex_lock_killable+0x97/0x1d0 [ 45.644084][ T709] ? __cfi_mutex_lock_killable+0x10/0x10 [ 45.644104][ T709] ? proc_fail_nth_write+0x184/0x220 [ 45.644126][ T709] kvm_vcpu_ioctl+0xa43/0x1000 [ 45.644140][ T709] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 45.644158][ T709] ? __cfi_vfs_write+0x10/0x10 [ 45.644173][ T709] ? __kasan_check_write+0x18/0x20 [ 45.644186][ T709] ? mutex_unlock+0x90/0x240 [ 45.644205][ T709] ? __cfi_mutex_unlock+0x10/0x10 [ 45.644226][ T709] ? bpf_lsm_file_ioctl+0xd/0x20 [ 45.644244][ T709] ? security_file_ioctl+0x3e/0x110 [ 45.644266][ T709] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 45.644279][ T709] __se_sys_ioctl+0x132/0x1b0 [ 45.644297][ T709] __x64_sys_ioctl+0x7f/0xa0 [ 45.644313][ T709] x64_sys_call+0x1878/0x2ee0 [ 45.644326][ T709] do_syscall_64+0x57/0xf0 [ 45.644341][ T709] ? clear_bhb_loop+0x50/0xa0 [ 45.644361][ T709] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 45.644390][ T709] RIP: 0033:0x7f3692f9e019 [ 45.644402][ T709] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 45.644412][ T709] RSP: 002b:00007f3693eb0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 45.644427][ T709] RAX: ffffffffffffffda RBX: 00007f3693225fa0 RCX: 00007f3692f9e019 [ 45.644437][ T709] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000008 [ 45.644445][ T709] RBP: 00007f3693eb0090 R08: 0000000000000000 R09: 0000000000000000 [ 45.644453][ T709] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 45.644461][ T709] R13: 00007f3693226038 R14: 00007f3693225fa0 R15: 00007ffe9fa34ea8 [ 45.644472][ T709] [ 46.096505][ T719] syzkaller0: tun_chr_ioctl cmd 1074025678 [ 46.102455][ T719] syzkaller0: group set to 0 [ 46.107992][ T720] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 46.116554][ T720] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 46.261066][ T726] netlink: 'syz.0.139': attribute type 27 has an invalid length. [ 46.392071][ T36] kauditd_printk_skb: 17 callbacks suppressed [ 46.392089][ T36] audit: type=1326 audit(1785507308.650:258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=732 comm="syz.3.142" exe="/root/ci2-android-6-12-rust/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f49e139e019 code=0x0 [ 46.393003][ T9] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 46.572466][ T400] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 46.602620][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 46.611102][ T9] usb 3-1: config 1 has an invalid descriptor of length 169, skipping remainder of the config [ 46.621520][ T9] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 46.635203][ T9] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 46.644573][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 46.660509][ T9] usb 3-1: Product: syz [ 46.669133][ T9] usb 3-1: Manufacturer: syz [ 46.678149][ T9] usb 3-1: SerialNumber: syz [ 46.733624][ T400] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 46.744690][ T400] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 46.762400][ T400] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 46.780398][ T400] usb 2-1: config 0 descriptor?? [ 46.891013][ T9] usb 3-1: 0:2 : does not exist [ 46.898238][ T9] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 46.915041][ T9] usb 3-1: USB disconnect, device number 9 [ 46.925072][ T320] udevd[320]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 46.994594][ T400] usbhid 2-1:0.0: can't add hid device: -71 [ 47.001686][ T400] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 47.022762][ T400] usb 2-1: USB disconnect, device number 5 [ 47.137824][ T741] Zero length message leads to an empty skb [ 47.310004][ T36] audit: type=1400 audit(1785507309.570:259): avc: denied { bind } for pid=742 comm="syz.3.145" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 47.330856][ T36] audit: type=1400 audit(1785507309.570:260): avc: denied { name_bind } for pid=742 comm="syz.3.145" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 47.351628][ T36] audit: type=1400 audit(1785507309.570:261): avc: denied { node_bind } for pid=742 comm="syz.3.145" saddr=224.0.0.1 src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 47.432433][ T400] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 47.593500][ T400] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 47.604529][ T400] usb 2-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 47.615440][ T400] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 47.624387][ T400] usb 2-1: config 0 descriptor?? [ 47.642370][ T9] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 47.652506][ T10] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 47.793327][ T9] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 47.804395][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 47.815480][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 47.825429][ T9] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 47.838958][ T10] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 47.850132][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 47.861181][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 47.871258][ T9] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 47.880561][ T9] usb 4-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 47.888784][ T10] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 47.901872][ T9] usb 4-1: Manufacturer: syz [ 47.907555][ T9] usb 4-1: config 0 descriptor?? [ 47.912699][ T10] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 47.927370][ T10] usb 3-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 47.945809][ T10] usb 3-1: Manufacturer: syz [ 47.958859][ T10] usb 3-1: config 0 descriptor?? [ 47.973441][ T754] FAULT_INJECTION: forcing a failure. [ 47.973441][ T754] name failslab, interval 1, probability 0, space 0, times 0 [ 47.986164][ T754] CPU: 0 UID: 0 PID: 754 Comm: syz.0.150 Not tainted syzkaller #0 91781886e4a1baa38ce9d8cd537274748dd3a26f [ 47.986186][ T754] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 47.986196][ T754] Call Trace: [ 47.986201][ T754] [ 47.986207][ T754] __dump_stack+0x21/0x30 [ 47.986238][ T754] dump_stack_lvl+0x140/0x1c0 [ 47.986260][ T754] ? __cfi_dump_stack_lvl+0x10/0x10 [ 47.986282][ T754] ? unwind_get_return_address+0x51/0x90 [ 47.986303][ T754] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 47.986329][ T754] dump_stack+0x19/0x20 [ 47.986349][ T754] should_fail_ex+0x3c2/0x510 [ 47.986368][ T754] should_failslab+0xac/0x100 [ 47.986388][ T754] kmem_cache_alloc_node_noprof+0x45/0x420 [ 47.986405][ T754] ? __alloc_skb+0x10c/0x360 [ 47.986427][ T754] __alloc_skb+0x10c/0x360 [ 47.986447][ T754] ? kmem_cache_alloc_noprof+0x1bf/0x410 [ 47.986463][ T754] sock_omalloc+0xcd/0x1f0 [ 47.986478][ T754] msg_zerocopy_realloc+0x9d/0x750 [ 47.986493][ T754] tcp_sendmsg_locked+0x42a8/0x4ac0 [ 47.986509][ T754] ? avc_has_perm_noaudit+0x26b/0x360 [ 47.986527][ T754] ? __asan_memcpy+0x5a/0x80 [ 47.986543][ T754] ? avc_has_perm_noaudit+0x289/0x360 [ 47.986562][ T754] ? __kasan_check_write+0x18/0x20 [ 47.986577][ T754] ? _raw_spin_lock_bh+0x96/0x130 [ 47.986595][ T754] ? __cfi__raw_spin_lock_bh+0x10/0x10 [ 47.986613][ T754] ? _raw_spin_unlock_bh+0x54/0x60 [ 47.986631][ T754] ? lock_sock_nested+0x216/0x2a0 [ 47.986649][ T754] ? __cfi_tcp_sendmsg_locked+0x10/0x10 [ 47.986666][ T754] ? __cfi_tcp_sendmsg+0x10/0x10 [ 47.986681][ T754] tcp_sendmsg+0x3e/0xd0 [ 47.986694][ T754] ? __cfi_tcp_sendmsg+0x10/0x10 [ 47.986709][ T754] inet_sendmsg+0xb7/0x120 [ 47.986727][ T754] ____sys_sendmsg+0x822/0xa00 [ 47.986743][ T754] ? __import_iovec+0x5b9/0x7d0 [ 47.986765][ T754] ? __sys_sendmsg_sock+0x50/0x50 [ 47.986780][ T754] ? unwind_get_return_address+0x51/0x90 [ 47.986801][ T754] ? import_iovec+0x80/0xb0 [ 47.986823][ T754] ___sys_sendmsg+0x2a6/0x370 [ 47.986839][ T754] ? __sys_sendmsg+0x2a0/0x2a0 [ 47.986855][ T754] ? kstrtouint+0x78/0xf0 [ 47.986874][ T754] ? __fget_files+0x2bc/0x330 [ 47.986893][ T754] __sys_sendmmsg+0x2b4/0x4e0 [ 47.986910][ T754] ? __cfi___sys_sendmmsg+0x10/0x10 [ 47.986929][ T754] ? __cfi_ksys_write+0x10/0x10 [ 47.986946][ T754] __x64_sys_sendmmsg+0xa4/0xc0 [ 47.986962][ T754] x64_sys_call+0xfec/0x2ee0 [ 47.986976][ T754] do_syscall_64+0x57/0xf0 [ 47.986993][ T754] ? clear_bhb_loop+0x50/0xa0 [ 47.987015][ T754] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 47.987035][ T754] RIP: 0033:0x7fded6b9e019 [ 47.987048][ T754] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 47.987060][ T754] RSP: 002b:00007fded7a99028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 47.987077][ T754] RAX: ffffffffffffffda RBX: 00007fded6e25fa0 RCX: 00007fded6b9e019 [ 47.987089][ T754] RDX: 0000000000000001 RSI: 00002000000060c0 RDI: 0000000000000003 [ 47.987099][ T754] RBP: 00007fded7a99090 R08: 0000000000000000 R09: 0000000000000000 [ 47.987109][ T754] R10: 0000000004000000 R11: 0000000000000246 R12: 0000000000000001 [ 47.987118][ T754] R13: 00007fded6e26038 R14: 00007fded6e25fa0 R15: 00007fffbe9bde68 [ 47.987132][ T754] [ 48.516630][ T36] audit: type=1326 audit(1785507310.780:262): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=760 comm="syz.0.153" exe="/root/ci2-android-6-12-rust/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fded6b9e019 code=0x0 [ 48.527670][ T9] appleir 0003:05AC:8243.0003: unknown main item tag 0x0 [ 48.548701][ T9] appleir 0003:05AC:8243.0003: No inputs registered, leaving [ 48.557534][ T9] appleir 0003:05AC:8243.0003: hiddev96,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.3-1/input0 [ 48.573104][ T10] appleir 0003:05AC:8243.0004: unknown main item tag 0x0 [ 48.580395][ T10] appleir 0003:05AC:8243.0004: No inputs registered, leaving [ 48.593160][ T10] appleir 0003:05AC:8243.0004: hiddev97,hidraw1: USB HID v0.00 Device [syz] on usb-dummy_hcd.2-1/input0 [ 48.732720][ T400] aiptek 2-1:0.0: Aiptek using 400 ms programming speed [ 48.740368][ T400] input: Aiptek as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input9 [ 48.813081][ T400] usb 4-1: USB disconnect, device number 4 [ 49.033525][ T400] usb 2-1: USB disconnect, device number 6 [ 49.039409][ C0] aiptek 2-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 49.318713][ T400] usb 3-1: USB disconnect, device number 10 [ 49.356335][ T36] audit: type=1400 audit(1785507311.620:263): avc: denied { cmd } for pid=767 comm="syz.3.155" path="/dev/ublk-control" dev="devtmpfs" ino=82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=io_uring permissive=1 [ 49.385136][ T36] audit: type=1400 audit(1785507311.640:264): avc: denied { map } for pid=767 comm="syz.3.155" path="/dev/ublkc0" dev="devtmpfs" ino=515 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 49.419553][ T36] audit: type=1400 audit(1785507311.680:265): avc: denied { ioctl } for pid=767 comm="syz.3.155" path="/dev/rnullb0" dev="devtmpfs" ino=31 ioctlcmd=0x1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 49.464152][ T772] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=64792 sclass=netlink_route_socket pid=772 comm=syz.3.156 [ 49.530061][ T36] audit: type=1400 audit(1785507311.790:266): avc: denied { write } for pid=776 comm="syz.0.158" name="udplite6" dev="proc" ino=4026532449 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 49.678725][ T36] audit: type=1400 audit(1785507311.940:267): avc: denied { ioctl } for pid=793 comm="syz.0.163" path="socket:[7824]" dev="sockfs" ino=7824 ioctlcmd=0x89a1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 49.736663][ T796] netlink: 104 bytes leftover after parsing attributes in process `syz.0.164'. [ 50.082512][ T400] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 50.142402][ T10] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 50.242396][ T400] usb 2-1: Using ep0 maxpacket: 32 [ 50.254257][ T400] usb 2-1: unable to get BOS descriptor or descriptor too short [ 50.265866][ T400] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 150, changing to 7 [ 50.284802][ T400] usb 2-1: New USB device found, idVendor=08e4, idProduct=017f, bcdDevice= 0.40 [ 50.298303][ T400] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 50.311932][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 50.326897][ T400] usb 2-1: Product: syz [ 50.334315][ T400] usb 2-1: Manufacturer: syz [ 50.340104][ T10] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 50.353591][ T400] usb 2-1: SerialNumber: syz [ 50.362783][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 50.385443][ T10] usb 3-1: config 0 descriptor?? [ 50.464109][ T820] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 50.583922][ T822] netlink: 4 bytes leftover after parsing attributes in process `syz.3.173'. [ 50.598854][ T10] usbhid 3-1:0.0: can't add hid device: -71 [ 50.605123][ T10] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 50.614154][ T10] usb 3-1: USB disconnect, device number 11 [ 50.660850][ T826] netlink: 8 bytes leftover after parsing attributes in process `syz.3.174'. [ 50.671099][ T826] netlink: 8 bytes leftover after parsing attributes in process `syz.3.174'. [ 50.932356][ T66] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 50.972403][ T666] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 51.032345][ T10] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 51.083325][ T66] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 51.093548][ T66] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 51.103656][ T66] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 51.113470][ T66] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 51.127285][ T666] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 51.137667][ T666] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 51.147539][ T666] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 51.147657][ T66] usb 4-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice= 1.00 [ 51.166668][ T666] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 51.179655][ T66] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 51.187781][ T66] usb 4-1: Product: syz [ 51.192090][ T66] usb 4-1: Manufacturer: syz [ 51.196943][ T66] usb 4-1: SerialNumber: syz [ 51.202387][ T666] usb 1-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice= 1.00 [ 51.211511][ T666] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 51.219676][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 51.230700][ T10] usb 3-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 51.240054][ T666] usb 1-1: Product: syz [ 51.244759][ T666] usb 1-1: Manufacturer: syz [ 51.249539][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 51.258213][ T66] usbserial_generic 4-1:1.0: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 51.269644][ T666] usb 1-1: SerialNumber: syz [ 51.274315][ T66] usbserial_generic 4-1:1.0: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 51.286153][ T10] usb 3-1: config 0 descriptor?? [ 51.295630][ T666] usbserial_generic 1-1:1.0: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 51.307049][ T66] usbserial_generic 4-1:1.0: generic converter detected [ 51.314105][ T666] usbserial_generic 1-1:1.0: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 51.325626][ T666] usbserial_generic 1-1:1.0: generic converter detected [ 51.332853][ T66] usb 4-1: generic converter now attached to ttyUSB0 [ 51.342040][ T666] usb 1-1: generic converter now attached to ttyUSB1 [ 51.471276][ T666] usb 4-1: USB disconnect, device number 5 [ 51.479801][ T666] generic ttyUSB0: generic converter now disconnected from ttyUSB0 [ 51.488143][ T666] usbserial_generic 4-1:1.0: device disconnected [ 51.495105][ T832] FAULT_INJECTION: forcing a failure. [ 51.495105][ T832] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 51.508696][ T832] CPU: 0 UID: 0 PID: 832 Comm: syz.0.176 Not tainted syzkaller #0 91781886e4a1baa38ce9d8cd537274748dd3a26f [ 51.508727][ T832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 51.508742][ T832] Call Trace: [ 51.508753][ T832] [ 51.508761][ T832] __dump_stack+0x21/0x30 [ 51.508798][ T832] dump_stack_lvl+0x140/0x1c0 [ 51.508830][ T832] ? __cfi_dump_stack_lvl+0x10/0x10 [ 51.508862][ T832] ? check_stack_object+0x10f/0x150 [ 51.508887][ T832] dump_stack+0x19/0x20 [ 51.508917][ T832] should_fail_ex+0x3c2/0x510 [ 51.508944][ T832] should_fail+0xf/0x20 [ 51.508965][ T832] should_fail_usercopy+0x1e/0x30 [ 51.508993][ T832] _copy_from_user+0x20/0xa0 [ 51.509023][ T832] core_sys_select+0x404/0x7f0 [ 51.509055][ T832] ? __kasan_check_write+0x18/0x20 [ 51.509093][ T832] ? __cfi_core_sys_select+0x10/0x10 [ 51.509128][ T832] ? __cfi_set_user_sigmask+0x10/0x10 [ 51.509158][ T832] ? mutex_unlock+0x90/0x240 [ 51.509189][ T832] ? __cfi_mutex_unlock+0x10/0x10 [ 51.509220][ T832] __se_sys_pselect6+0x268/0x320 [ 51.509251][ T832] ? fput+0x1a4/0x230 [ 51.509292][ T832] ? __x64_sys_pselect6+0x110/0x110 [ 51.509321][ T832] ? __cfi_ksys_write+0x10/0x10 [ 51.509346][ T832] __x64_sys_pselect6+0xe9/0x110 [ 51.509377][ T832] x64_sys_call+0x2980/0x2ee0 [ 51.509398][ T832] do_syscall_64+0x57/0xf0 [ 51.509422][ T832] ? clear_bhb_loop+0x50/0xa0 [ 51.509451][ T832] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 51.509480][ T832] RIP: 0033:0x7fded6b9e019 [ 51.509498][ T832] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 51.509516][ T832] RSP: 002b:00007fded7a99028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 51.509539][ T832] RAX: ffffffffffffffda RBX: 00007fded6e25fa0 RCX: 00007fded6b9e019 [ 51.509556][ T832] RDX: 0000200000000040 RSI: 0000200000000240 RDI: 0000000000000040 [ 51.509571][ T832] RBP: 00007fded7a99090 R08: 0000000000000000 R09: 0000000000000000 [ 51.509586][ T832] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 51.509599][ T832] R13: 00007fded6e26038 R14: 00007fded6e25fa0 R15: 00007fffbe9bde68 [ 51.509618][ T832] [ 51.510842][ T9] usb 1-1: USB disconnect, device number 5 [ 51.739975][ T9] generic ttyUSB1: generic converter now disconnected from ttyUSB1 [ 51.748383][ T9] usbserial_generic 1-1:1.0: device disconnected [ 52.142493][ T36] kauditd_printk_skb: 11 callbacks suppressed [ 52.142529][ T36] audit: type=1400 audit(1785507314.400:279): avc: denied { unmount } for pid=296 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 52.143165][ T10] aiptek 3-1:0.0: Aiptek using 400 ms programming speed [ 52.198792][ T10] input: Aiptek as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input10 [ 52.292516][ T36] audit: type=1400 audit(1785507314.560:280): avc: denied { remount } for pid=839 comm="syz.0.179" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 52.422178][ T849] batadv_slave_0: entered allmulticast mode [ 52.428476][ T849] netlink: 148 bytes leftover after parsing attributes in process `syz.3.182'. [ 52.441094][ T849] batadv_slave_0 (unregistering): left allmulticast mode [ 52.523113][ T10] usb 3-1: USB disconnect, device number 12 [ 52.523156][ C1] aiptek 3-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 52.570031][ T36] audit: type=1326 audit(1785507314.830:281): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=852 comm="syz.3.184" exe="/root/ci2-android-6-12-rust/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f49e139e019 code=0x0 [ 52.858278][ T400] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 52.867725][ T400] usb 2-1: 2:1 : unknown format tag 0x1003 is detected. processed as MPEG. [ 52.882769][ T400] usb 2-1: found format II with max.bitrate = 257, frame size=36221 [ 52.890953][ T400] usb 2-1: 2:1 : unknown format tag 0x1003 is detected. processed as MPEG. [ 52.900174][ T400] usb 2-1: found format II with max.bitrate = 257, frame size=36221 [ 52.912730][ T400] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 52.925689][ T400] usb 2-1: USB disconnect, device number 7 [ 52.937995][ T316] udevd[316]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 53.222481][ T400] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 53.282362][ T10] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 53.382400][ T400] usb 2-1: Using ep0 maxpacket: 32 [ 53.388919][ T400] usb 2-1: unable to get BOS descriptor or descriptor too short [ 53.399078][ T400] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 53.409307][ T400] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 53.421403][ T400] usb 2-1: New USB device found, idVendor=0499, idProduct=1057, bcdDevice= 0.40 [ 53.431116][ T400] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 53.439294][ T400] usb 2-1: Product: syz [ 53.443647][ T400] usb 2-1: Manufacturer: syz [ 53.448339][ T400] usb 2-1: SerialNumber: syz [ 53.459496][ T10] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 53.475299][ T9] usb 1-1: new full-speed USB device number 6 using dummy_hcd [ 53.484449][ T10] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 53.500208][ T36] audit: type=1400 audit(1785507315.760:282): avc: denied { connect } for pid=863 comm="syz.3.189" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 53.502727][ T10] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 53.532151][ T10] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 53.566334][ T10] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 53.582412][ T10] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 53.600621][ T10] usb 3-1: Product: syz [ 53.604864][ T10] usb 3-1: Manufacturer: syz [ 53.614188][ T10] cdc_wdm 3-1:1.0: probe with driver cdc_wdm failed with error -22 [ 53.653350][ T9] usb 1-1: config 0 has an invalid interface number: 41 but max is 0 [ 53.661504][ T9] usb 1-1: config 0 has no interface number 0 [ 53.671441][ T9] usb 1-1: config 0 interface 41 has no altsetting 0 [ 53.684252][ T400] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 53.703214][ T400] usb 2-1: USB disconnect, device number 8 [ 53.709452][ T9] usb 1-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 53.722382][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 53.734665][ T320] udevd[320]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 53.741464][ T9] usb 1-1: Product: syz [ 53.764710][ T9] usb 1-1: Manufacturer: syz [ 53.769405][ T9] usb 1-1: SerialNumber: syz [ 53.790569][ T9] usb 1-1: config 0 descriptor?? [ 53.830071][ T36] audit: type=1326 audit(1785507316.090:283): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=857 comm="syz.2.186" exe="/root/ci2-android-6-12-rust/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3692f9e019 code=0x0 [ 53.881417][ T666] usb 3-1: USB disconnect, device number 13 [ 54.032383][ T10] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 54.183069][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 54.194544][ T10] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 54.213270][ T10] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 37, changing to 7 [ 54.242888][ T10] usb 4-1: New USB device found, idVendor=0763, idProduct=2001, bcdDevice= 0.40 [ 54.256289][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 54.264490][ T10] usb 4-1: Product: syz [ 54.268725][ T10] usb 4-1: Manufacturer: syz [ 54.273433][ T10] usb 4-1: SerialNumber: syz [ 54.481456][ T870] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 54.490105][ T870] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 54.501890][ T10] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 54.509017][ T10] usb 4-1: 2:1 : no or invalid class specific endpoint descriptor [ 54.517018][ T10] usb 4-1: 2:1: invalid format type 0x1002 is detected, processed as PCM [ 54.525590][ T10] usb 4-1: 2:1 : sample bitwidth 60 in over sample bytes 3 [ 54.532940][ T10] usb 4-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 54.542229][ T10] usb 4-1: USB disconnect, device number 6 [ 54.552362][ T666] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 54.563565][ T316] udevd[316]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 54.607329][ T9] CoreChips 1-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffe0 [ 54.703387][ T666] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 54.714544][ T666] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 54.724023][ T666] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 54.732908][ T666] usb 2-1: config 0 descriptor?? [ 54.820382][ T862] netlink: 4 bytes leftover after parsing attributes in process `syz.0.188'. [ 54.880864][ T885] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=8192 sclass=netlink_xfrm_socket pid=885 comm=syz.0.188 [ 54.894447][ T36] audit: type=1400 audit(1785507317.160:284): avc: denied { getopt } for pid=861 comm="syz.0.188" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 54.940351][ T666] usbhid 2-1:0.0: can't add hid device: -71 [ 54.946442][ T666] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 54.955165][ T666] usb 2-1: USB disconnect, device number 9 [ 55.029188][ T36] audit: type=1326 audit(1785507317.290:285): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=888 comm="syz.3.197" exe="/root/ci2-android-6-12-rust/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f49e139e019 code=0x0 [ 55.382424][ T10] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 55.533330][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 55.544406][ T10] usb 2-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 55.553581][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 55.562888][ T10] usb 2-1: config 0 descriptor?? [ 55.947089][ T892] FAULT_INJECTION: forcing a failure. [ 55.947089][ T892] name failslab, interval 1, probability 0, space 0, times 0 [ 55.959911][ T892] CPU: 0 UID: 0 PID: 892 Comm: syz.3.198 Not tainted syzkaller #0 91781886e4a1baa38ce9d8cd537274748dd3a26f [ 55.959933][ T892] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 55.959943][ T892] Call Trace: [ 55.959947][ T892] [ 55.959953][ T892] __dump_stack+0x21/0x30 [ 55.959977][ T892] dump_stack_lvl+0x140/0x1c0 [ 55.959997][ T892] ? __cfi_dump_stack_lvl+0x10/0x10 [ 55.960021][ T892] ? check_stack_object+0x81/0x150 [ 55.960036][ T892] ? __virt_addr_valid+0x2a1/0x370 [ 55.960054][ T892] dump_stack+0x19/0x20 [ 55.960072][ T892] should_fail_ex+0x3c2/0x510 [ 55.960089][ T892] should_failslab+0xac/0x100 [ 55.960107][ T892] __kmalloc_cache_noprof+0x41/0x470 [ 55.960122][ T892] ? memdup_user+0xb1/0x170 [ 55.960133][ T892] ? __se_sys_mount+0x15f/0x480 [ 55.960149][ T892] __se_sys_mount+0x15f/0x480 [ 55.960164][ T892] ? ksys_write+0x1f3/0x260 [ 55.960178][ T892] ? __x64_sys_mount+0xf0/0xf0 [ 55.960194][ T892] __x64_sys_mount+0xc3/0xf0 [ 55.960209][ T892] x64_sys_call+0x2021/0x2ee0 [ 55.960221][ T892] do_syscall_64+0x57/0xf0 [ 55.960237][ T892] ? clear_bhb_loop+0x50/0xa0 [ 55.960257][ T892] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 55.960275][ T892] RIP: 0033:0x7f49e139e019 [ 55.960287][ T892] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 55.960300][ T892] RSP: 002b:00007f49e2235028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 55.960315][ T892] RAX: ffffffffffffffda RBX: 00007f49e1625fa0 RCX: 00007f49e139e019 [ 55.960326][ T892] RDX: 0000200000000100 RSI: 0000200000000040 RDI: 0000000000000000 [ 55.960336][ T892] RBP: 00007f49e2235090 R08: 0000200000000180 R09: 0000000000000000 [ 55.960346][ T892] R10: 0000000002008040 R11: 0000000000000246 R12: 0000000000000001 [ 55.960356][ T892] R13: 00007f49e1626038 R14: 00007f49e1625fa0 R15: 00007ffef8bb5c08 [ 55.960369][ T892] [ 56.296168][ T9] CoreChips 1-1:0.41 (unnamed net_device) (uninitialized): Failed to send software reset:ffffffb9 [ 56.306892][ T9] CoreChips 1-1:0.41 (unnamed net_device) (uninitialized): Failed to power down PHY : -71 [ 56.316869][ T9] CoreChips 1-1:0.41: probe with driver CoreChips failed with error -71 [ 56.326497][ T9] usb 1-1: USB disconnect, device number 6 [ 56.333620][ T897] batadv_slave_1: entered promiscuous mode [ 56.383488][ T908] capability: warning: `syz.0.203' uses 32-bit capabilities (legacy support in use) [ 56.418360][ T896] batadv_slave_1: left promiscuous mode [ 56.419239][ T36] audit: type=1400 audit(1785507318.680:286): avc: denied { unlink } for pid=896 comm="syz.2.200" name="file0" dev="tmpfs" ino=206 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 56.576720][ T36] audit: type=1326 audit(1785507318.840:287): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=914 comm="syz.0.206" exe="/root/ci2-android-6-12-rust/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fded6b9e019 code=0x0 [ 56.636750][ T920] netlink: 12 bytes leftover after parsing attributes in process `syz.2.207'. [ 56.702720][ T10] aiptek 2-1:0.0: Aiptek using 400 ms programming speed [ 56.710253][ T10] input: Aiptek as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input11 [ 56.765185][ C1] ------------[ cut here ]------------ [ 56.770700][ C1] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31 [ 56.779333][ C1] index 14724 is out of range for type 'const int[34]' [ 56.786213][ C1] CPU: 1 UID: 0 PID: 31 Comm: kworker/1:0 Not tainted syzkaller #0 91781886e4a1baa38ce9d8cd537274748dd3a26f [ 56.786246][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 56.786261][ C1] Workqueue: rcu_gp process_srcu [ 56.786288][ C1] Call Trace: [ 56.786295][ C1] [ 56.786303][ C1] __dump_stack+0x21/0x30 [ 56.786337][ C1] dump_stack_lvl+0x140/0x1c0 [ 56.786367][ C1] ? __cfi_dump_stack_lvl+0x10/0x10 [ 56.786397][ C1] ? kthread+0x2c7/0x360 [ 56.786433][ C1] dump_stack+0x19/0x20 [ 56.786464][ C1] ubsan_epilogue+0xe/0x40 [ 56.786483][ C1] __ubsan_handle_out_of_bounds+0xe8/0xf0 [ 56.786515][ C1] aiptek_irq+0x208d/0x2a00 [ 56.786545][ C1] ? _raw_spin_unlock+0x45/0x60 [ 56.786569][ C1] ? kcov_remote_start+0x1d2/0x3c0 [ 56.786594][ C1] __usb_hcd_giveback_urb+0x36e/0x530 [ 56.786629][ C1] usb_hcd_giveback_urb+0x12b/0x400 [ 56.786668][ C1] dummy_timer+0xa3f/0x4900 [ 56.786696][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 56.786716][ C1] ? timerqueue_del+0xd7/0x130 [ 56.786735][ C1] ? __hrtimer_run_queues+0x2bd/0x8e0 [ 56.786765][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 56.786783][ C1] __hrtimer_run_queues+0x3ae/0x8e0 [ 56.786814][ C1] ? hrtimer_interrupt+0xf30/0xf30 [ 56.786840][ C1] ? read_tsc+0xd/0x20 [ 56.786865][ C1] ? ktime_get_update_offsets_now+0x3c0/0x3e0 [ 56.786890][ C1] hrtimer_run_softirq+0x159/0x560 [ 56.786908][ C1] ? irqtime_account_irq+0x51/0x1c0 [ 56.786936][ C1] handle_softirqs+0x1aa/0x620 [ 56.786957][ C1] __irq_exit_rcu+0x47/0xb0 [ 56.786975][ C1] irq_exit_rcu+0xd/0x30 [ 56.786993][ C1] sysvec_apic_timer_interrupt+0x82/0x90 [ 56.787021][ C1] [ 56.787028][ C1] [ 56.787036][ C1] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 56.787069][ C1] RIP: 0010:delay_tsc+0x5c/0xa0 [ 56.787101][ C1] Code: 48 29 f2 48 39 fa 73 44 65 ff 0d 47 44 62 7a 74 1d f3 90 65 ff 05 3c 44 62 7a 65 44 8b 0d 38 44 62 7a 45 39 c8 75 0e 0f 01 f9 <66> 90 eb cb e8 6b 54 67 fb eb dc 48 29 d7 0f 01 f9 66 90 48 89 d6 [ 56.787119][ C1] RSP: 0018:ffffc90000207ae8 EFLAGS: 00000246 [ 56.787137][ C1] RAX: 000000002d2a5d00 RBX: 0000000000002032 RCX: 0000000000000001 [ 56.787151][ C1] RDX: 000000000000001f RSI: 0000001f2d2a34b8 RDI: 0000000000002af9 [ 56.787166][ C1] RBP: ffffc90000207ae8 R08: 0000000000000001 R09: 0000000000000001 [ 56.787179][ C1] R10: 0000000000000000 R11: ffffffff85a2a740 R12: ffff8881f6f731c8 [ 56.787194][ C1] R13: dffffc0000000000 R14: 0000000000002033 R15: 0000000000000002 [ 56.787208][ C1] ? __cfi_delay_tsc+0x10/0x10 [ 56.787237][ C1] __const_udelay+0x7a/0x90 [ 56.787254][ C1] __udelay+0x14/0x20 [ 56.787270][ C1] try_check_zero+0x383/0x3b0 [ 56.787294][ C1] process_srcu+0x231/0x1570 [ 56.787316][ C1] ? __schedule+0x149e/0x20b0 [ 56.787343][ C1] ? irqentry_exit+0x4a/0x60 [ 56.787362][ C1] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 56.787395][ C1] ? pwq_dec_nr_in_flight+0x943/0xba0 [ 56.787418][ C1] ? _raw_spin_lock_irq+0x93/0x120 [ 56.787442][ C1] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 56.787467][ C1] ? kick_pool+0xb9/0x540 [ 56.787492][ C1] process_scheduled_works+0x7f7/0x1060 [ 56.787519][ C1] worker_thread+0xc99/0x13f0 [ 56.787544][ C1] kthread+0x2c7/0x360 [ 56.787569][ C1] ? __cfi_worker_thread+0x10/0x10 [ 56.787590][ C1] ? __cfi_kthread+0x10/0x10 [ 56.787615][ C1] ret_from_fork+0x67/0xa0 [ 56.787645][ C1] ? __cfi_kthread+0x10/0x10 [ 56.787670][ C1] ret_from_fork_asm+0x1a/0x30 [ 56.787692][ C1] [ 56.787700][ C1] ---[ end trace ]--- [ 56.807175][ T36] audit: type=1400 audit(1785507319.070:288): avc: denied { bind } for pid=927 comm="syz.2.210" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 56.809237][ C1] ------------[ cut here ]------------ [ 56.809251][ C1] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30 [ 57.170939][ C1] index 14725 is out of range for type 'const int[34]' [ 57.177827][ C1] CPU: 1 UID: 0 PID: 31 Comm: kworker/1:0 Not tainted syzkaller #0 91781886e4a1baa38ce9d8cd537274748dd3a26f [ 57.177862][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 57.177881][ C1] Workqueue: rcu_gp process_srcu [ 57.177901][ C1] Call Trace: [ 57.177907][ C1] [ 57.177913][ C1] __dump_stack+0x21/0x30 [ 57.177938][ C1] dump_stack_lvl+0x140/0x1c0 [ 57.177961][ C1] ? __cfi_dump_stack_lvl+0x10/0x10 [ 57.177982][ C1] ? input_event_dispose+0x2f5/0x6d0 [ 57.178007][ C1] dump_stack+0x19/0x20 [ 57.178027][ C1] ubsan_epilogue+0xe/0x40 [ 57.178043][ C1] __ubsan_handle_out_of_bounds+0xe8/0xf0 [ 57.178066][ C1] aiptek_irq+0x1f3c/0x2a00 [ 57.178087][ C1] ? kcov_remote_start+0x1d2/0x3c0 [ 57.178104][ C1] __usb_hcd_giveback_urb+0x36e/0x530 [ 57.178129][ C1] usb_hcd_giveback_urb+0x12b/0x400 [ 57.178152][ C1] dummy_timer+0xa3f/0x4900 [ 57.178193][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 57.178209][ C1] ? timerqueue_del+0xd7/0x130 [ 57.178226][ C1] ? __hrtimer_run_queues+0x2bd/0x8e0 [ 57.178251][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 57.178267][ C1] __hrtimer_run_queues+0x3ae/0x8e0 [ 57.178293][ C1] ? hrtimer_interrupt+0xf30/0xf30 [ 57.178318][ C1] ? read_tsc+0xd/0x20 [ 57.178340][ C1] ? ktime_get_update_offsets_now+0x3c0/0x3e0 [ 57.178362][ C1] hrtimer_run_softirq+0x159/0x560 [ 57.178377][ C1] ? irqtime_account_irq+0x51/0x1c0 [ 57.178402][ C1] handle_softirqs+0x1aa/0x620 [ 57.178421][ C1] __irq_exit_rcu+0x47/0xb0 [ 57.178454][ C1] irq_exit_rcu+0xd/0x30 [ 57.178470][ C1] sysvec_apic_timer_interrupt+0x82/0x90 [ 57.178495][ C1] [ 57.178500][ C1] [ 57.178506][ C1] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 57.178530][ C1] RIP: 0010:delay_tsc+0x5c/0xa0 [ 57.178556][ C1] Code: 48 29 f2 48 39 fa 73 44 65 ff 0d 47 44 62 7a 74 1d f3 90 65 ff 05 3c 44 62 7a 65 44 8b 0d 38 44 62 7a 45 39 c8 75 0e 0f 01 f9 <66> 90 eb cb e8 6b 54 67 fb eb dc 48 29 d7 0f 01 f9 66 90 48 89 d6 [ 57.178571][ C1] RSP: 0018:ffffc90000207ae8 EFLAGS: 00000246 [ 57.178585][ C1] RAX: 000000002d2a5d00 RBX: 0000000000002032 RCX: 0000000000000001 [ 57.178597][ C1] RDX: 000000000000001f RSI: 0000001f2d2a34b8 RDI: 0000000000002af9 [ 57.178608][ C1] RBP: ffffc90000207ae8 R08: 0000000000000001 R09: 0000000000000001 [ 57.178619][ C1] R10: 0000000000000000 R11: ffffffff85a2a740 R12: ffff8881f6f731c8 [ 57.178649][ C1] R13: dffffc0000000000 R14: 0000000000002033 R15: 0000000000000002 [ 57.178668][ C1] ? __cfi_delay_tsc+0x10/0x10 [ 57.178708][ C1] __const_udelay+0x7a/0x90 [ 57.178731][ C1] __udelay+0x14/0x20 [ 57.178744][ C1] try_check_zero+0x383/0x3b0 [ 57.178762][ C1] process_srcu+0x231/0x1570 [ 57.178777][ C1] ? __schedule+0x149e/0x20b0 [ 57.178798][ C1] ? irqentry_exit+0x4a/0x60 [ 57.178812][ C1] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 57.178837][ C1] ? pwq_dec_nr_in_flight+0x943/0xba0 [ 57.178854][ C1] ? _raw_spin_lock_irq+0x93/0x120 [ 57.178872][ C1] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 57.178892][ C1] ? kick_pool+0xb9/0x540 [ 57.178934][ C1] process_scheduled_works+0x7f7/0x1060 [ 57.178972][ C1] worker_thread+0xc99/0x13f0 [ 57.178993][ C1] kthread+0x2c7/0x360 [ 57.179011][ C1] ? __cfi_worker_thread+0x10/0x10 [ 57.179029][ C1] ? __cfi_kthread+0x10/0x10 [ 57.179047][ C1] ret_from_fork+0x67/0xa0 [ 57.179071][ C1] ? __cfi_kthread+0x10/0x10 [ 57.179090][ C1] ret_from_fork_asm+0x1a/0x30 [ 57.179107][ C1] [ 57.179113][ C1] ---[ end trace ]--- [ 57.734451][ T10] usb 2-1: USB disconnect, device number 10 [ 57.734505][ C1] aiptek 2-1:0.0: aiptek_irq - usb_submit_urb failed with result -19