last executing test programs: 2.844288812s ago: executing program 3 (id=243): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f0000006680)={0x0, 0x0, &(0x7f0000006640)={&(0x7f00000003c0)=ANY=[@ANYBLOB="500000000102010100000000000000000a0000003c0001802c00018014000300ff01000000000000000000000000000114000400000000000f00000000000000000000010c000280050001"], 0x50}}, 0x0) 2.844035642s ago: executing program 0 (id=244): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0xfc}}, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x41, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f0000000140), 0x10) sendmsg$can_bcm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="05"], 0x48}}, 0x0) sendmsg$can_bcm(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="050000000109"], 0x80}}, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) sendmsg$NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f00000001c0)=[{0x20, 0xff, 0x0, 0xffff7038}, {0x6, 0x0, 0x83, 0xfffffffd}]}, 0x10) write$bt_hci(r1, &(0x7f0000000040)=ANY=[], 0x6) openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./debug\x00', 0x1ff) r4 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$search(0xa, r4, &(0x7f0000000240)='keyring\x00', &(0x7f0000002380)={'syz', 0x2}, r4) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmmsg(r5, &(0x7f0000000180), 0x3ef, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000180)={'vxcan1\x00'}) r6 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/kvm/halt_successful_poll\x00', 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='pids.events\x00', 0x275a, 0x0) r7 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r7, 0x29, 0x6, &(0x7f00000000c0)={0x11, {{0x29, 0x0, 0x3000000, @empty, 0x3}}}, 0x88) r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000005200), 0x1, 0x0) unshare(0x2000c00) ioctl$SNAPSHOT_AVAIL_SWAP_SIZE(r8, 0x80083313, &(0x7f0000000000)) read$char_usb(r6, 0x0, 0x204) 2.843896492s ago: executing program 3 (id=245): fsopen(0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1f1) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB="38010000100033062cbd7000000000007f00000100000000000000000000000000000000000000000000000000000000000000050000fffd000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="e0000002000000000000030000000000fffffffd32000000ac1414aa00000000000000000000000001000000000000000300000000d5000009000000000001000000000000000000020000000000000000000000000000000000000000000000fcffffffffffffff000000000000000000000000000000005f000000000000000a00000000000000010000000000ffffffffffffffff00000000000002000000230000000000000048000200656362286369706865725f6e756c6c29"], 0x138}, 0x1, 0x0, 0x0, 0x20040}, 0x80) 2.843053912s ago: executing program 3 (id=246): syz_usb_connect$cdc_ncm(0x2, 0x8b, &(0x7f0000000280)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x79, 0x2, 0x1, 0x4, 0xf0, 0x6, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "9cec62d84cdb"}, {0x5, 0x24, 0x0, 0xfffb}, {0xd, 0x24, 0xf, 0x1, 0x6, 0xfe01, 0x3, 0x6d}, {0x6, 0x24, 0x1a, 0x8000, 0x1}, [@dmm={0x7, 0x24, 0x14, 0x1, 0x3}, @acm={0x3, 0x24, 0x2, 0x1}, @mbim={0xc, 0x24, 0x1b, 0xb0, 0x82, 0x4, 0x2, 0x3, 0xb}]}, {{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x3, 0x1, 0x36}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10, 0x0, 0x7f}}, {{0x9, 0x5, 0x3, 0x2, 0x8, 0x11, 0x1, 0x4}}}}}}}]}}, &(0x7f0000000540)={0xa, &(0x7f0000000340)={0xa, 0x6, 0x201, 0x4, 0x9, 0x1, 0x40, 0x7f}, 0x29, &(0x7f00000004c0)={0x5, 0xf, 0x29, 0x4, [@wireless={0xb, 0x10, 0x1, 0x8, 0x8, 0x40, 0x6, 0x90, 0x7d}, @ext_cap={0x7, 0x10, 0x2, 0x16, 0x7, 0x4, 0x5}, @wireless={0xb, 0x10, 0x1, 0xc, 0x73, 0x2, 0x7, 0xf8, 0x1}, @ss_container_id={0x0, 0x10, 0x4, 0x1, "c12858eb46aa12cdf040c42cf7781576"}]}, 0x5, [{0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0xc07}}, {0x3f, &(0x7f0000000400)=@string={0x3f, 0x3, "3997946897236f4d60017d2c006ca404f605374284ed649896db73b955d4d245631295857a7db49efd1087b00fcaccacbf6da766d69aa79ea8d8eaef8d"}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x40c}}, {0x41, &(0x7f00000005c0)=ANY=[@ANYBLOB="410380c6d6c38c95d9c4c433e9817b01f22c581b0a705ebb73eda8f537647cc459fe8d574d8a7562d1d38d3542736e48ffe4a0a434dea12b8e39d04bce4f966eeae7e26cac6c26d06cd0436d99972004cc14717065dc29ee6b10d0111025cdb77ad3ad2ac81c57a72750ec28b5c7714d75bc745aad134313ca5b503e160b4e70000000000000000000"]}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x41d}}]}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x400080, 0x0) mount$cgroup(0x0, &(0x7f0000000080)='./cgroup.cpu/cpuset.cpus\x00', &(0x7f00000000c0), 0xc00, &(0x7f0000000180)={[{@clone_children}]}) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1e) 2.831441753s ago: executing program 0 (id=247): mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = socket(0x28, 0xa, 0x62) setsockopt$inet_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000000)={0x1}, 0x4) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x2, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0xc, 0x0, &(0x7f00000000c0)=[@dead_binder_done], 0x0, 0x0, 0x0}) socket$nl_netfilter(0x10, 0x3, 0xc) 2.817256913s ago: executing program 0 (id=248): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net\x00') fstat(r1, &(0x7f0000000d40)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_XCRS(r4, 0x4188aea7, &(0x7f0000000380)={0x1000004, 0x1fc, [{0x6, 0x0, 0x48}, {0x84, 0x0, 0xc4e2}, {0x3, 0x0, 0x1}, {0x9d, 0x0, 0x7}, {0x6, 0x0, 0xc}, {0x22, 0x0, 0x8}, {0xa18, 0x0, 0x101ff}, {0x5, 0x0, 0x1}, {0x9, 0x0, 0xfffc}, {0x8001, 0x0, 0x200}, {0x10, 0x0, 0x5}, {0x8, 0x0, 0x101}, {0x6, 0x0, 0xfff}, {0x1000, 0x0, 0x8}, {0x400, 0x0, 0x8}, {0xbb, 0x0, 0x200401}]}) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="ac0100001700010000000000000000007f0000010000000000000000000000000000fefffffffffffd8000000000000000000000000000bbac1414bb000000000000000000000000ffffff2b6b57a470b83fce00000000004e210000000000000000006400000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc0200000000000000000000000000000000000000000000000000000000000100000000000000000a00802000000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000200000000f9ffffff000000000000000000000000840005"], 0x1ac}}, 0x0) 2.710070006s ago: executing program 0 (id=249): openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x2042, 0x19d) r0 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) execveat$binfmt(0xffffffffffffffff, r0, 0x0, 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', r1, &(0x7f00000004c0)='./file1\x00', 0x5) setxattr$security_selinux(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140), &(0x7f0000000080)='system_u:object_r:iptables_exec_t:s0\x00', 0x25, 0x0) 2.709908566s ago: executing program 0 (id=250): syz_usb_connect(0x0, 0x5a, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000ec13b2106d04f308280b0102030109024800010000000009046900000e010000"], 0x0) 2.624040198s ago: executing program 2 (id=253): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="7c0100001000130726bd70000000000000000000000000000000ffffe0000002ac1414130000000000000000000000004e22000100000003020000003a000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe8000000000000000000000000000bb0000000032000000fe8000000000000000000000000000aa0000000000000000000000000000000008000000000000000a000000000000000600000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000200000000000000f8ffffffffffffff0c000000000000000200000029bd70000000000002000100280000000000000068001200726663343534332867636d2861657329290000000000000000000a00000000000000000000000000000000000000000000000000000000000000000000000000e000000080"], 0x17c}, 0x1, 0x0, 0x0, 0xc0}, 0x0) 2.597077738s ago: executing program 2 (id=254): syz_usb_connect$uac3(0x0, 0xab, &(0x7f0000000380)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x582, 0x25, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x99, 0x3, 0x1, 0x3, 0x10, 0x4, {0x8, 0xb, 0x0, 0x0, 0x1, 0x24, 0x30, 0x10}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xf, 0x1e, 0x9}, [@feature_unit={0x9, 0x24, 0x7, 0x1, 0x6, [0xe]}, @multiply_unit={0xb, 0x24, 0xd, 0x0, 0x5, 0x0, 0x1}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@as_header={0x17, 0x24, 0x1, 0x0, 0xb16f, 0x9fc, 0x2, 0x3, 0xf8, 0x40}]}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x5, 0x5, 0x3d, {0xa, 0x25, 0x25, 0x7, 0x6, 0x9}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x40, 0xb, 0x6, 0xe, {0xa, 0x25, 0x25, 0xd1, 0x5e, 0x4}}}}}}}}]}}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_usb_connect$hid(0x1, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x56a, 0x26, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x90, 0x6, "", [{{0x9, 0x4, 0x0, 0xfe, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x1, 0x6, 0x1, {0x22, 0x25}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x9, 0xc4}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000000)={0x2c, &(0x7f0000000080)={0x0, 0x24, 0x25, {0x25, 0x4, "82631b612b8526792c3cbdeace918d0fb74237cc6e446c4e88e78881ce2a52973661d6"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001480)=ANY=[@ANYBLOB="200000001000010700000000000000000a0000000c0002006e6c3830323131"], 0x20}}, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000100), r0) recvmmsg(r0, &(0x7f0000001700)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000200)=""/185, 0xb9}, {&(0x7f0000000040)=""/137, 0x89}, {&(0x7f0000000480)=""/4084, 0xff4}], 0x3}, 0xfffffffd}, {{0x0, 0x0, 0x0}, 0x7}, {{0x0, 0x0, 0x0}, 0x3ff}], 0x3, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) writev(r2, &(0x7f00000003c0)=[{&(0x7f0000000040)="390000001300034700bb65e1c3e4ffff0100000001000000560000002500000019000a000400000007fdd411efc40800040000000000000000", 0x39}], 0x1) syz_usb_connect$printer(0x5, 0x36, &(0x7f0000000000)=ANY=[], &(0x7f00000005c0)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x110, 0xa, 0x9, 0x5, 0x8, 0xd0}, 0x37, &(0x7f0000000080)={0x5, 0xf, 0x37, 0x3, [@generic={0x25, 0x10, 0x2, "33546208768d4bc6031f068211e609d40d778096db4d8c4b047e2b28db352e6cb900"}, @ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x2, 0x5, 0x4}]}, 0x5, [{0x2d, &(0x7f0000000100)=@string={0x2d, 0x3, "40ba47fc49b6f0953431d729b488c752919a800a87b8e8e3b2a79c43f90d3ccc5593ce2d2e383ac0ddc61f"}}, {0x4, &(0x7f00000014c0)=@lang_id={0x4, 0x3, 0x447}}, {0xdc, &(0x7f0000000240)=@string={0xdc, 0x3, "7466d9316d047708307ae2c3e1222ea63110b55297b445afe0030729ad4d4bb011bb3b8788928ac5a35f456e9e4d8fa51e2e9e1b8de5f78ffa8b42dc064bffb7561d8802e6d799fb8bbbb575d3c894b03aec96ce0c0a98bd81936b3fc3fae79b9859a94672edf221c90374939cdb9b3d8376cae2aa4c3f66b1478a5ff027459b70771ad9fc4d3619d9dae482fbbc31b326fd55390799792363824dab2b22c71212fa8cfcf4f234e85c3f651f902fdc1076bce8df6c238db6b54d83e08a8413d5a957275d32b066c87c2968da06087bc8ade4e93d7c99018009a4"}}, {0x86, &(0x7f0000000140)=@string={0x86, 0x3, "8bbe54646322a4084dc2dc5e1a0d865b4857be7def8941f1ebca70b1ea822d289c97c04e7eabc7bc0a4602daa316ddcea758f677c03b4a11eeea83bb3af23746f326c78090b524ff4a2e0b2be25fdcba04733ebba8e80d0ff62b4af91e75cc32c2d687e054f0afaf3be182f9d2b905045b12b90140b552f19f7748cda9224ed25e6bb290"}}, {0xa2, &(0x7f0000000500)=@string={0xa2, 0x3, "ca56c08853b5c443697783af6d29f3295148a6db047cab10d695e8d809d9099810d88479268e0ea9b6d56459409ecb36c405dbbe88477039dd8c4cc286c6aa077eb7e37d0bc4df0e35bafada65257fa94985d5173cb1f5085afdb85bd67afe1bcf9225370ad73a245b06204ccbc11aa88807159d54aa3293fba10dd302a8106295eba9c66705494a6afc0ec65263a54e15e50fb49b208ecf1729fa3749cb8cc1"}}]}) 1.902148865s ago: executing program 1 (id=255): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x120140, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x26e8, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000300)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x3a, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @multicast2}, 0x2, 0x0, 0x4}}, 0x2e) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000640)={0x0, 0xd000}) ioctl$KVM_NMI(r3, 0xae9a) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1.790906607s ago: executing program 1 (id=256): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x120140, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x26e8, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000300)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x3a, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @multicast2}, 0x2, 0x0, 0x4}}, 0x2e) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000640)={0x0, 0xd000}) ioctl$KVM_NMI(r3, 0xae9a) ioctl$KVM_RUN(r3, 0xae80, 0x0) (fail_nth: 1) 1.336064258s ago: executing program 2 (id=257): fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x120140, 0x0) r0 = dup(0xffffffffffffffff) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000080)={0x26e8, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000300)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x3a, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @multicast2}, 0x2, 0x0, 0x4}}, 0x2e) ioctl$KVM_REGISTER_COALESCED_MMIO(0xffffffffffffffff, 0x4010ae67, &(0x7f0000000640)={0x0, 0xd000}) ioctl$KVM_RUN(r1, 0xae80, 0x0) 1.335275448s ago: executing program 2 (id=258): socket$inet_udp(0x2, 0x2, 0x0) (async) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) socket$inet_udp(0x2, 0x2, 0x0) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r1, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0x2, 0x4e20, @empty}, 0x10) recvfrom(r0, &(0x7f0000000100)=""/10, 0xa, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./bus\x00', 0x4d) inotify_init() (async) r2 = inotify_init() setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x2000000000000022, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) socket$can_raw(0x1d, 0x3, 0x1) (async) r3 = socket$can_raw(0x1d, 0x3, 0x1) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) prctl$PR_SET_IO_FLUSHER(0x39, 0x4) (async) prctl$PR_SET_IO_FLUSHER(0x39, 0x4) getsockopt$CAN_RAW_FD_FRAMES(r3, 0x65, 0x8, 0x0, &(0x7f0000000040)=0xffffffdd) inotify_add_watch(r2, &(0x7f0000000000)='.\x00', 0x400017e) rename(&(0x7f0000000180)='./bus\x00', &(0x7f00000001c0)='./file0\x00') 1.325701108s ago: executing program 1 (id=259): r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/mnt\x00') ioctl$NS_GET_PARENT(r0, 0x8008b705, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x0, &(0x7f0000000200)}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000005c0)={0x70, 0x17, 0x4, 0x70bd2b, 0x25dfdbfd, {0x1d, 0xd601, 0x9}, [@nested={0x5b, 0x12, 0x0, 0x1, [@generic="843f3dc11c0282d2d016c5e6e450a6565f62984b42bb038e91d7aaa68b63fda6ca61408ba643a0bae98e527758915afb32db", @generic="428184a477201ac90f24d8c531680464a01e08554baff2279134e2a452c739471e1c7bd4ae"]}]}, 0x70}, 0x1, 0x0, 0x0, 0x20004030}, 0x804) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)={@multicast1, @local}, 0xc) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r3, 0xae9a) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000700)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x8}, 0x4040810) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000440)={[0x0, 0x100000000, 0x0, 0x7f, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x0, 0x2, 0xffffffffffffffff], 0x0, 0x102280}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000002c0)={[0x100, 0x5, 0x6, 0x4002, 0x9, 0x5, 0xefffffffffffffff, 0x0, 0xffffffffffffffff, 0x2000001, 0x0, 0x40000000001c, 0x1, 0xffffffffffffffff, 0x100], 0x0, 0x41801}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x24000045, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x200006}, 0x1c) shutdown(r4, 0x1) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r4, 0x6, 0x23, 0x0, 0x0) syz_usb_connect$rtl8150(0x3, 0x3f, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) recvfrom$inet6(r4, 0x0, 0x0, 0x24, 0x0, 0x0) 1.26232187s ago: executing program 0 (id=260): socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r1, &(0x7f0000000080)={0x2, 0x3, @loopback}, 0x70) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendmmsg$inet(r1, &(0x7f0000000d00)=[{{0x0, 0x0, &(0x7f0000002c00)=[{&(0x7f0000001500)='\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x9}, {&(0x7f0000002800)="cf", 0x1}, {&(0x7f0000000380)="08e0ac8fb1d99df61d7b518d0a62", 0xe}, {&(0x7f0000000180)="8a", 0x1}, {&(0x7f00000005c0)="f5fbfd4f1595317700ff55f1f960ff70fba64053ef1c952b8561071ccfbed96b7227eaaf92a1358afc148a8aafa58b2444561acf9a5114b207019da8518fea9fd189e3616ec0ad37f86f431d6f4f1fbe1b0e3e640ac2b1f7ff33cf28d27c40513b6cee87fbd144c842c5c7b6752ea19efcfca738ac5207318c1bc30db2a727ce9a82303920eb2a3b0aa99902f8423e754843e7d6ceb06048a8d918680c042a42370dc807a398af793f4b1a3107c3771474ba13d826ce5634d33c485f3f97cffc9ea1e026f4327e96d5a40268c75358061e75633ebe43e946f2bad55973c81fff7d4843dd1db36180dd3b5692f98ace6805c67a9e20216aac908b9a6111c6", 0xfe}], 0x5}}, {{0x0, 0x0, &(0x7f0000002f00)=[{&(0x7f0000001580)="ce90bfdb", 0x68}, {&(0x7f00000007c0)="f2e659", 0x3}, {&(0x7f0000002e40)="d4", 0x1}], 0x3}}, {{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000003000)="e1", 0x1}, {&(0x7f00000010c0)="fa", 0x1}, {&(0x7f0000001680)="d8", 0x1}, {&(0x7f0000001600)="f2964dd1", 0x4}, {&(0x7f0000000580)="b8a2f6", 0x3}, {&(0x7f00000002c0)="7940e900e0377757a9edc0d9376c21328ad2f7584fe4c8b712b3e5e08ecff5258151bd9eea7b4ce21f67ab51922ce035987127fda5812df903188e321419610f4beb6cdf6fa073876157c4f1d2054439d8db3f4d937872de928b62741fd60e6b56979ad883f89a02e24a577275bfb498b7a127abd0eb099e704d18d63dad611b45acfc3b8dc5457c8383d7d8621942e8e2ce6e4017dd6e5ed9732e739be6593c3b033524669ce17c3b822a6953eb11a20921220000000000000000", 0xbb}, {&(0x7f0000000280)="87", 0x1}], 0x7}}, {{0x0, 0x0, &(0x7f0000000a40)=[{&(0x7f0000000880)="87", 0x1}, {&(0x7f0000000900)="11e09017", 0xfffffec4}], 0x2}}], 0x4, 0x4000000) setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000000)=0x7fffffff, 0x4) r2 = memfd_create(&(0x7f0000000000)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x2) ftruncate(r2, 0x80079a0) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0xb, 0x2012, r2, 0x0) socket$netlink(0x10, 0x3, 0x8000000004) r3 = dup(r0) syz_ublk_setup_io_uring(0x6dff, &(0x7f0000000080)={0x0, 0x156c, 0x1, 0x3, 0x154, 0x0, r0}, 0x0, 0x0, 0x0) syz_ublk_setup_queues(r3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0) socket$igmp6(0xa, 0x3, 0x2) syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x2002) syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$key(0xf, 0x3, 0x2) socket$inet6(0xa, 0x3, 0x5) r4 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="3000000010000100000000020000000008000000", @ANYRES32, @ANYBLOB='\b\x00\x00\x00', @ANYRES32, @ANYRES8=r4], 0x30}], 0x1, 0x0, 0x0, 0x4048001}, 0x0) syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44100010203010902bf0002010650000900000000020d001b052401082400a9b30d2d0f010a0000000300ff000606241a05001407240a050905580c240c00000000a90c0900030424020204240200042406024424"], 0x0) syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c2402"], 0x0) 1.25726112s ago: executing program 3 (id=261): socket$inet(0x2, 0x3, 0x4) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002f80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="18"], 0x18}}], 0x1, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001000010700000100000000000a000000060001001b"], 0x1c}}, 0x0) r0 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f00000003c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="dfff2abd7000fbdbdf2501"], 0x5c}, 0x1, 0x0, 0x0, 0x4004002}, 0x20040004) 1.208129021s ago: executing program 3 (id=262): eventfd2(0x9, 0x1) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b8, 0x10, 0x2, 0x158}, &(0x7f00000020c0)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)) syz_usb_connect$hid(0x5, 0x0, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000680)={0x2c, &(0x7f0000000400)={0x60, 0x21, 0x18, {0x18, 0xd, "1fed11614b9be3835b30b7c450de20d06a582264a6ca"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$rtl8150(0xffffffffffffffff, &(0x7f0000000240)={0x14, 0x0, 0x0}, &(0x7f00000003c0)={0x2c, 0x0, 0x0, &(0x7f0000000300)={0x0, 0x8, 0x1, 0x8}, 0x0, 0x0}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r4) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000340)={{0x2, 0x3, 0xf3b, 0x2, 0x13fffffc}}) 724.990163ms ago: executing program 3 (id=263): socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0), 0xa041, 0x0) write$vga_arbiter(r0, &(0x7f0000000480)=ANY=[@ANYBLOB='unlock '], 0xc) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x38) ioctl$KVM_CAP_EXIT_ON_EMULATION_FAILURE(r1, 0x4068aea3, &(0x7f0000000100)={0xcc, 0x0, 0x1}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xf) ioctl$FS_IOC_FSGETXATTR(r2, 0x400455c8, 0x0) syz_usb_connect$cdc_ecm(0x3, 0x0, 0x0, 0x0) ioctl$TIOCVHANGUP(r2, 0x5437, 0x0) 520.680327ms ago: executing program 2 (id=264): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="ac0100321700010000000000000000007f0000010000000000000000000000000000fefffffffffffd8000000000000000000000000000bbac1414bb000000000000000000000000ffffff2b6b57a470b83fce00000000004e210000000000000000006400000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc0200000000000000000000000000000000000000000000000000000000000100000000000000000a00802000000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000200000000f9ffffff000000000000000000000000840005"], 0x1ac}}, 0x0) 463.946669ms ago: executing program 2 (id=265): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="180000005200016d9bffffff000000000a"], 0x18}}, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000100)={0x0, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xff}}, {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x41, 0x0}}, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0xaf, 0x0, 0x0, 0x0, 0x5, 0x0, 0xc8, 0x0, 0x6}) socket$packet(0x11, 0x3, 0x300) r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'ip_vti0\x00'}) sendmsg$FOU_CMD_GET(0xffffffffffffffff, 0x0, 0x4000) r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x2, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ppoll(&(0x7f00000000c0)=[{r2, 0x441}], 0x1, 0x0, 0x0, 0x0) write$FUSE_NOTIFY_STORE(0xffffffffffffffff, &(0x7f0000000000)={0x28, 0x4, 0x0, {0x1, 0xfffffffffffffffc}}, 0x28) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f00000000c0), 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x0, 0x144) ioctl(r3, 0xc138fd05, &(0x7f0000000000)="0400000002000000000000007e0100003801") ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_usb_connect(0x6, 0x8a5, &(0x7f0000000a40)={{0x12, 0x1, 0x250, 0xc6, 0xff, 0xfb, 0x8, 0x572, 0xc688, 0xcfdd, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x893, 0x4, 0x5, 0x60, 0x8, 0x6, "", [{{0x9, 0x4, 0xf5, 0xc, 0xc, 0xf0, 0xb9, 0xc, 0x7, [@hid_hid={0x9, 0x21, 0x1, 0x1, 0x1, {0x22, 0xa88}}], [{{0x9, 0x5, 0x9, 0x0, 0x400, 0x4, 0x0, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x5, 0x7}]}}, {{0x9, 0x5, 0x2, 0x10, 0x40, 0x8, 0x6, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x3, 0x1000}]}}, {{0x9, 0x5, 0xf, 0x3, 0x20, 0x4, 0x7, 0xb, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x0, 0x9}]}}, {{0x9, 0x5, 0x3, 0x10, 0x40, 0x3, 0x1, 0x1}}, {{0x9, 0x5, 0x9, 0x0, 0x400, 0x1, 0x10, 0xe, [@generic={0x6c, 0x0, "654314e6c9dad9f9a3416ffdf31c5c8f49aab7f63e455efd55e53f8439b9b779b9cd64ee64e2853ffe443c71fc7ab821d52ab62f82fcb6d2e552248f3b162960ff5a927d78ad0e6300b8ecc8c1e75b651a2356dc2d4abfcb3ce52f85d26b96bb1cc238600d8510a34440"}]}}, {{0x9, 0x5, 0xb, 0x8, 0x120, 0x19, 0xc, 0x3}}, {{0x9, 0x5, 0x8b, 0x8, 0x200, 0x3, 0x0, 0xea, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0x5, 0x8675}, @generic={0x51, 0x9, "691e2ea2d3cbffd31041d12d6cf38d09e10701d8b95fd1dddec74e7a4a941c3aa9a47b2384bc2baa001d615eafd43da7a10acf904329c3752d151cba4e2bb529be04886d2be9af361404a8abf038f8"}]}}, {{0x9, 0x5, 0x2, 0x0, 0x200, 0x81, 0x40, 0x40}}, {{0x9, 0x5, 0x2, 0xc, 0x8, 0x1, 0x5, 0xbc, [@generic={0x8c, 0xb, "2fc4a4ba7c1a5ef6fab5255508a42e6440fc43e20d04483d9b0aef499a59946795a8776ebb23a05f0d5b3a808afa3d0adbaf8425f6804b63d5263d635b46d1a3939f9fd6c82056fd6ae8fed9a78a20015c5d394e65947ed05436e7061bd59abce0e8d5de8f8336e6b5a2ea0047ff06edb84ea3d712ce3589339372172ba4c7434ec471e3561b153e62c8"}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0x7, 0x400}]}}, {{0x9, 0x5, 0x5, 0x2, 0x3ff, 0x9, 0x0, 0x8}}, {{0x9, 0x5, 0x7, 0x4, 0x200, 0xf, 0xa6, 0x1, [@generic={0xa5, 0x5, "b2642dbd414cb59d526a61c94ef0788d7a25a77475edb0ffd1fb9f76215b534f18195ef5c2f469145fe37d40bdfd175cc05ee15e124ae3b9c056cff3756d472b335a5ee73db216c75f29d878b1345049f5ec11df42b6da6f74106921f4b69f9bad501937266e5061dcafd03640bcf87f1d7e31b119af431b096250bd18092b54e66ab31e8f7bb81ad9595be72b513e719ecdcd0b25b67ae5c65f6cfed62a77fc2a7688"}]}}, {{0x9, 0x5, 0x4, 0x0, 0x8, 0xd, 0xa, 0xf, [@generic={0xe8, 0x8, "f648c20663bad8f67d165b69f980f6e5447d052a720907a6cf2506eb5b42c63526f5571b59218a25067fc7542ae75e6678fd7a4ce30f906340060257bb399446b58addb7756b4a5d654a1f9ffb8adbf90b6b98de34a251f053bd91303bdcb4fbbaa3fe8e863dff4e2e639d6ee5a20ddb9742d52e9057f2a0f7ffcc60b10f9e56bfa5fab00b31abb286d25c5e298d018d9629b8da6b610aa08724969d466610f71568e5fa24010364ceb0a4e5e9f35ae3b317d5e3aff17317aef555d42c5d79005c05e26d12d0834babaf627189bd6317f466d775ec98050562768394719e86256cc73857b471"}]}}]}}, {{0x9, 0x4, 0xf3, 0x2, 0x5, 0xff, 0x4b, 0x10, 0x3, [], [{{0x9, 0x5, 0x2, 0x4, 0x3ff, 0x4, 0x8, 0x3, [@generic={0xae, 0x11, "66eb39f87cb6dd9ae7680672710ff55e1dc8ddfe29785068b9676e46fde8ce73caf0abaa45fd9dc8409630d438d6050fe06d366195646786b349c6ca67689383c9213fa39d120ac798400a8e93607208b1e5ae415d998b2333285418d8333c445520903f413a03540b6b85ed16b83053d47071d8bd1b84b95396a9cfbe96d96fc71e12fc7bf76256e4193167e586b215fd12469c1861af6d36c3394a3c1b615991a40ef948d6d7237115ec40"}]}}, {{0x9, 0x5, 0x5, 0x0, 0x3ff, 0x1, 0xf7, 0x3}}, {{0x9, 0x5, 0x4, 0x8, 0x20, 0x7, 0x9, 0x2, [@generic={0x64, 0xe, "69eba5f65de5e465adfedb8c63716145d8290c83bd6f2185d844a71f8d37c97e6e3ac00523a1fc1c661fbedc23db7111df039ce8983289e10782f6e5dd846fe698cad735ff9780d3fa676224504bc4bf241a236e83ecea499ee8e1de5baf48b9ac81"}, @generic={0x7e, 0x11, "41f00892bf807b4e8175a3fd39bb0caa4a789da8b200ce584f957e7af936552b2caa6c04d10f960b0c14191bfb238e671a9dd77503ceeec34dd3b9d6d96fa72d4e2251141b526cc54a76498b49c5f6ff89b006236e1af9a0a543321047544221f0472c4373eeee827e5b44f8b1b490478b053a757d6449800688c982"}]}}, {{0x9, 0x5, 0x2, 0x14, 0x400, 0x1, 0x5, 0x40, [@uac_iso={0x7, 0x25, 0x1, 0xe36a1648c1553c19, 0x1, 0x6}]}}, {{0x9, 0x5, 0x6, 0xb, 0x200, 0x0, 0x7, 0x4f, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0x7, 0x7fff}, @generic={0xc3, 0x60, "6c8489daa38c8dc10fd38a84595dd5737dad9ec544ce0bb7afe23d9b0ef852e1342bdf8b55556fabbcdc374f7ac0de22aa86d09fe5873fcbea09787a857f8ebcfc63631bc5b3f9ae63b1fcc78597513cf11d6878d3a24307fc9dcc617d7ae8ec0f7b97094ec1df8c26c24bfb1c66a6e0f4581f21a81f57d8dce49e94ed54f466aab433669373467ebfc1cebbdc7f689dd38e8c16cf49ccf77de24fba8f36fd4d8b56aa0dc6829475b3952baa69ecbc2712903cb377058a333534e646b05fc61406"}]}}]}}, {{0x9, 0x4, 0x45, 0x2, 0x0, 0x2, 0x2, 0xff, 0x3, [@generic={0xc9, 0x4, "59be85a86945064e4b9bebf9d93169fb37ea739a548f50cfd7d20cbbbe212f676f925046de6a6080b46bb55e08f1d8a61eb7b4c68635b2bb1950f5ef71742342756e9f6a83d33e05de78d163577df85f8fa53a066a0a5fc10be91b64c2ee289646783e7c5db39dfc368120e342dc4a3000dc739d0a46d2d4140c37f69ab946f15d65b335c192d291ab6b58ed41f7e0ed3f1b7cff6bba25cb4da1c2e9ea3e369ce431a04215b7c066ddf06b3e1d162131cf5efc4bfe983493982776f109758783bb72c133b0bc3e"}, @generic={0xa6, 0x7, "5a4e076cfa47983b95bec7cf9791244f3a47a85278ee58060cc6b3eea2944d11080b97ae570c4efaa7ba26d2aba82b9eacb8da5a9a46dd9f29786e4bef4eb4b5207c017d9a9b788472558b615393fec2f800dccfbc856859151f14a2478bb2facb2ee2e5c6afd445cf90ab77b61309557ccb99ce23527ece98f93ec4f67c7e883aa88fa01bf363e51aebb4b006b0ed9523f6061e59455ade95e52e75b3b223dcc402afd1"}]}}, {{0x9, 0x4, 0xca, 0x2, 0x3, 0xff, 0x47, 0xd0, 0x7, [], [{{0x9, 0x5, 0x2, 0x10, 0x40, 0x7f, 0x10, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x1, 0x10}]}}, {{0x9, 0x5, 0x4, 0x10, 0x200, 0x3, 0x5a, 0x1d, [@generic={0xd2, 0x23, "4267a0dfe62fc76d6b9e740abeadecbb0b0dc43d6c68e1e87c4debfaa3ee0d65da05113b9ee42a789c2956225c08c74bfdd7061dfd8217f9e4cd542bae82bfe1e10b605981576db472fb66ee55153d31a5dffa03b785ff6316cb0c5f330ce39600689c2db7b8fc7c7656f3234f918aba1fa7188e64e2f92e370961f9b231b5d6ae8a381ae8cc0e69a172e89529b568f2e933d5e18a4c5652f5afa256c6529e31f3fb84c194b257763c9e19445d5f5051700235f481bb4352d8bb11f81fce20d68c7074aae55591dff567c4fb3bbf61c7"}]}}, {{0x9, 0x5, 0x6, 0x0, 0x200, 0x8, 0x30, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0xed, 0x7}]}}]}}]}}]}}, &(0x7f0000001600)={0xa, &(0x7f0000001340)={0xa, 0x6, 0x200, 0xb, 0x7, 0x5, 0x20, 0x5}, 0x5, &(0x7f0000001380)={0x5, 0xf, 0x5}, 0x4, [{0xbc, &(0x7f00000013c0)=@string={0xbc, 0x3, "7d37b55dd03ff364784c8984f32b6690c06c498e787330af94c8ffc02c60536dfb1bc82bd43a2c0b0bc31daeba231a0607ee33b642a9933ad970925717bc34924dc800d5a96e5bceafe0e376c8d382e56c08bc17294188fb12e9a9de2526da42ab48ca0b3975e5d0acb82e3b19a583e82556fd15e80705d93d5f4b25998e1ce8dc569d1447ec80be2f294ae36ecb1ff7120b83d0dc3c5d09cedb5baf393bc2a29020edd67b99b36c61d989efbe12b029610945133c53a6abc7f4"}}, {0x4, &(0x7f0000001480)=@lang_id={0x4, 0x3, 0x444}}, {0xc8, &(0x7f00000002c0)=ANY=[@ANYBLOB="c8035b63da2872f31f230dff4075cb2814e66c93bac8a8edba97e68aa6f93ce393e72b6d397cc46a6e404110cfd4fa221494d72bc2456cf72e52f900fce3ded0a05f64b2a41af2787ba9a68239241503815bcd56b206da972ebd4fef79b3423a8cf5185216df5b366b5ea16a111ae8d6d339987774edab99fba61ebdf515540dbc53e5311f03e82f806ddf909b1414fdacaf8c5950c7d9c7441cfe30682be99d22899b0952809d1bd98c143057e87a6fea34799d56ac1b45b72c7f9f6169767bff3b390ec0153b062505b7f509edfe7d8434bc913adc00"]}, {0x4, &(0x7f00000015c0)=@lang_id={0x4, 0x3, 0x81a}}]}) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000a00)=ANY=[@ANYBLOB="400c041b000035128742"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 62.887118ms ago: executing program 1 (id=266): r0 = openat$sysfs(0xffffff9c, &(0x7f0000000000)='/sys/power/pm_trace_dev_match', 0x0, 0x87) preadv(r0, &(0x7f0000000180)=[{&(0x7f0000000040)=""/117, 0x75}], 0x1, 0x500, 0xeffd) 51.655319ms ago: executing program 1 (id=267): fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x120140, 0x0) r0 = dup(0xffffffffffffffff) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000080)={0x26e8, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000300)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x3a, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @multicast2}, 0x2, 0x0, 0x4}}, 0x2e) ioctl$KVM_REGISTER_COALESCED_MMIO(0xffffffffffffffff, 0x4010ae67, &(0x7f0000000640)={0x0, 0xd000}) ioctl$KVM_RUN(r1, 0xae80, 0x0) 0s ago: executing program 1 (id=268): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x4000) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc_mnt\x00', 0x1ed) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc_mnt/irq/1/smp_affinity\x00', 0x1, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x80, &(0x7f00000003c0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@blksize={'blksize', 0x3d, 0xc00}}, {@max_read={'max_read', 0x3d, 0x7a}}]}}) write$P9_RLERRORu(r0, &(0x7f0000000140)=ANY=[@ANYRES8=r0], 0xfffffde3) clock_settime(0xcc80f84dcac64fc7, &(0x7f0000000680)) madvise(&(0x7f00009a0000/0x3000)=nil, 0x3000, 0xb) r1 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r2 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r1) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000180)={r2}, &(0x7f0000000940)=ANY=[@ANYBLOB="656e633d706b63733120686173683d7467723132380000000000000000000000000000000000000d000000000000000000000000000000000000000000e100afcc669560f9c2250423c171427e7ae8bb5d10686fd196800c821aee64fdb22831e532a582105bf93064936b3b46c2727636901eb1ea532bb6c0f20dfbba53bfd4342c3e8e2b8a7cf78cf5460a2b32c731746ae67051cd125ac7e83a2a8199a3490ebdd5db2089e57f9a9c75188dd962e1ae9abe078bd1bd9e3653e9afe4407647f0b74175a19439a88ecb7fca6e4cb18b690adafa9beb19118ec742da871d0f3d6502a144b252a6b7b974b8dddbdb9dea50bd2e378796ec5260144d1161cbca8c3eecdf84a4c469fd79da4394a2c598915afe8f7fef9197ea61dc0b0a50bad0df2028d54cf353603a8386864dc8c7db7bea4f97201268a3a6a60aa3628f25f29d50"], 0x0, 0x0) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/62, 0x328000, 0x800, 0x9, 0x3}, 0x20) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) accept4$unix(r4, &(0x7f0000000780), &(0x7f0000000800)=0x6e, 0x800) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x81c0, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x80000) madvise(&(0x7f000001c000/0x3000)=nil, 0x3000, 0x9) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) bind$unix(r4, &(0x7f0000000840)=@file={0x1, './file1\x00'}, 0x6e) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000640)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="01000000000000ff000005000000180001801400020073797a5f74756e00000000000000000005000200fc0000000800090003"], 0x3c}, 0x1, 0x0, 0x0, 0x44851}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.57' (ED25519) to the list of known hosts. [ 29.034391][ T36] audit: type=1400 audit(1787178427.590:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 29.035423][ T286] cgroup: Unknown subsys name 'net' [ 29.058178][ T36] audit: type=1400 audit(1787178427.590:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.086287][ T36] audit: type=1400 audit(1787178427.620:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.086506][ T286] cgroup: Unknown subsys name 'devices' [ 29.231831][ T286] cgroup: Unknown subsys name 'hugetlb' [ 29.237482][ T286] cgroup: Unknown subsys name 'rlimit' [ 29.349966][ T36] audit: type=1400 audit(1787178427.910:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 29.373229][ T36] audit: type=1400 audit(1787178427.910:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 29.382016][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 29.398329][ T36] audit: type=1400 audit(1787178427.910:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 29.430857][ T36] audit: type=1400 audit(1787178427.960:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.456925][ T36] audit: type=1400 audit(1787178427.960:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.491521][ T36] audit: type=1400 audit(1787178428.050:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.517230][ T36] audit: type=1400 audit(1787178428.050:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.517512][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 30.352495][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.359815][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.366916][ T294] bridge_slave_0: entered allmulticast mode [ 30.373455][ T294] bridge_slave_0: entered promiscuous mode [ 30.381587][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.388745][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.396186][ T294] bridge_slave_1: entered allmulticast mode [ 30.402614][ T294] bridge_slave_1: entered promiscuous mode [ 30.467636][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.474832][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.482262][ T296] bridge_slave_0: entered allmulticast mode [ 30.488600][ T296] bridge_slave_0: entered promiscuous mode [ 30.498224][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.505428][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.512972][ T296] bridge_slave_1: entered allmulticast mode [ 30.519354][ T296] bridge_slave_1: entered promiscuous mode [ 30.552885][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.560051][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.567310][ T295] bridge_slave_0: entered allmulticast mode [ 30.573809][ T295] bridge_slave_0: entered promiscuous mode [ 30.582429][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.589691][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.596861][ T295] bridge_slave_1: entered allmulticast mode [ 30.603381][ T295] bridge_slave_1: entered promiscuous mode [ 30.660711][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.667772][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.675050][ T293] bridge_slave_0: entered allmulticast mode [ 30.681707][ T293] bridge_slave_0: entered promiscuous mode [ 30.688209][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.695468][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.702858][ T293] bridge_slave_1: entered allmulticast mode [ 30.709127][ T293] bridge_slave_1: entered promiscuous mode [ 30.822400][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.829570][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.837014][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.844283][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.858375][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.865689][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.873116][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.880282][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.899107][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.906314][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.913755][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.920822][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.948354][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.955552][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.962897][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.969953][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.991860][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.999318][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.007061][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.014579][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.021983][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.029463][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.037240][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.044963][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.072306][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.079493][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.087573][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.094775][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.106315][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.113496][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.135447][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.142538][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.150213][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.158078][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.166430][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.174284][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.205624][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.212809][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.232074][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.239143][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.258229][ T296] veth0_vlan: entered promiscuous mode [ 31.289151][ T295] veth0_vlan: entered promiscuous mode [ 31.302060][ T293] veth0_vlan: entered promiscuous mode [ 31.313966][ T294] veth0_vlan: entered promiscuous mode [ 31.322848][ T296] veth1_macvtap: entered promiscuous mode [ 31.332308][ T295] veth1_macvtap: entered promiscuous mode [ 31.351988][ T293] veth1_macvtap: entered promiscuous mode [ 31.373314][ T294] veth1_macvtap: entered promiscuous mode [ 31.401914][ T295] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 31.458008][ T314] FAULT_INJECTION: forcing a failure. [ 31.458008][ T314] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 31.483368][ T317] ======================================================= [ 31.483368][ T317] WARNING: The mand mount option has been deprecated and [ 31.483368][ T317] and is ignored by this kernel. Remove the mand [ 31.483368][ T317] option from the mount to silence this warning. [ 31.483368][ T317] ======================================================= [ 31.513704][ T314] CPU: 1 UID: 0 PID: 314 Comm: syz.2.3 Not tainted syzkaller #0 03d350d479d1c05c2ac57b56e0973d7fc75f4bbd [ 31.513738][ T314] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 31.513749][ T314] Call Trace: [ 31.513756][ T314] [ 31.513764][ T314] __dump_stack+0x21/0x30 [ 31.513794][ T314] dump_stack_lvl+0x140/0x1c0 [ 31.513817][ T314] ? __cfi_dump_stack_lvl+0x10/0x10 [ 31.513840][ T314] ? check_stack_object+0x81/0x150 [ 31.513860][ T314] dump_stack+0x19/0x20 [ 31.513882][ T314] should_fail_ex+0x3c2/0x510 [ 31.513903][ T314] should_fail+0xf/0x20 [ 31.513921][ T314] should_fail_usercopy+0x1e/0x30 [ 31.513942][ T314] _copy_to_user+0x24/0xa0 [ 31.513966][ T314] simple_attr_read+0x381/0x4c0 [ 31.513989][ T314] ? __kasan_check_write+0x18/0x20 [ 31.514007][ T314] ? __cfi_simple_attr_read+0x10/0x10 [ 31.514031][ T314] ? __kasan_check_write+0x18/0x20 [ 31.514048][ T314] ? proc_fail_nth_write+0x184/0x220 [ 31.514073][ T314] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 31.514106][ T314] full_proxy_read+0x125/0x1e0 [ 31.514129][ T314] ? __cfi_full_proxy_read+0x10/0x10 [ 31.514151][ T314] vfs_read+0x288/0xc70 [ 31.514170][ T314] ? __cfi_vfs_read+0x10/0x10 [ 31.514187][ T314] ? __kasan_check_write+0x18/0x20 [ 31.514205][ T314] ? mutex_lock+0x97/0x1d0 [ 31.514222][ T314] ? __cfi_mutex_lock+0x10/0x10 [ 31.514241][ T314] ksys_read+0x145/0x260 [ 31.514259][ T314] ? __cfi_ksys_read+0x10/0x10 [ 31.514277][ T314] ? __kasan_check_read+0x15/0x20 [ 31.514294][ T314] __x64_sys_read+0x7f/0x90 [ 31.514312][ T314] x64_sys_call+0x2638/0x2ee0 [ 31.514329][ T314] do_syscall_64+0x57/0xf0 [ 31.514351][ T314] ? clear_bhb_loop+0x50/0xa0 [ 31.514368][ T314] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 31.514394][ T314] RIP: 0033:0x7f8debd9e0d9 [ 31.514410][ T314] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 31.514424][ T314] RSP: 002b:00007f8decba6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 31.514445][ T314] RAX: ffffffffffffffda RBX: 00007f8dec025fa0 RCX: 00007f8debd9e0d9 [ 31.514458][ T314] RDX: 0000000000000204 RSI: 0000000000000000 RDI: 0000000000000006 [ 31.514469][ T314] RBP: 00007f8decba6090 R08: 0000000000000000 R09: 0000000000000000 [ 31.514481][ T314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 31.514492][ T314] R13: 00007f8dec026038 R14: 00007f8dec025fa0 R15: 00007ffd2eee3cc8 [ 31.514506][ T314] [ 31.552098][ T322] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 31.558880][ T324] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 31.911927][ T312] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 31.922787][ T351] netlink: 36 bytes leftover after parsing attributes in process `syz.1.13'. [ 32.043558][ T46] Bluetooth: hci0: Frame reassembly failed (-84) [ 32.089896][ T312] usb 1-1: Using ep0 maxpacket: 16 [ 32.099895][ T45] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 32.107637][ T312] usb 1-1: unable to get BOS descriptor or descriptor too short [ 32.120724][ T312] usb 1-1: config 1 has an invalid descriptor of length 238, skipping remainder of the config [ 32.135286][ T312] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 103, changing to 7 [ 32.154615][ T312] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 16416, setting to 1024 [ 32.173443][ T312] usb 1-1: config 1 interface 2 has no altsetting 0 [ 32.191849][ T312] usb 1-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 32.201499][ T312] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.209516][ T312] usb 1-1: Product: syz [ 32.214112][ T312] usb 1-1: SerialNumber: syz [ 32.279928][ T45] usb 3-1: Using ep0 maxpacket: 32 [ 32.290113][ T45] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 32.302204][ T45] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 32.312402][ T45] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 32.321807][ T45] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.330870][ T45] usb 3-1: config 0 descriptor?? [ 32.333961][ T367] kvm: emulating exchange as write [ 32.336967][ T45] hub 3-1:0.0: USB hub found [ 32.546804][ T45] hub 3-1:0.0: 1 port detected [ 32.614665][ T380] netlink: 36 bytes leftover after parsing attributes in process `syz.3.21'. [ 32.841394][ T312] usb 1-1: Audio class v2/v3 interfaces need an interface association [ 32.849963][ T312] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 32.869838][ T312] usb 1-1: USB disconnect, device number 2 [ 32.930060][ T376] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 33.081028][ T376] usb 4-1: config 17 has an invalid descriptor of length 0, skipping remainder of the config [ 33.091394][ T376] usb 4-1: config 17 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 33.105307][ T376] usb 4-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 33.114411][ T376] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 33.122654][ T376] usb 4-1: Manufacturer: syz [ 33.130168][ T376] aiptek 4-1:17.0: interface has no int in endpoints, but must have minimum 1 [ 33.149743][ T312] hub 3-1:0.0: activate --> -90 [ 33.551246][ T376] usb 3-1: USB disconnect, device number 2 [ 33.604420][ T408] netlink: 28 bytes leftover after parsing attributes in process `syz.0.31'. [ 33.731999][ T420] netlink: 8 bytes leftover after parsing attributes in process `syz.0.32'. [ 33.833961][ T312] usb 4-1: USB disconnect, device number 2 [ 33.926661][ T427] sock: sock_timestamping_bind_phc: sock not bind to device [ 34.053547][ T36] kauditd_printk_skb: 85 callbacks suppressed [ 34.053566][ T36] audit: type=1400 audit(1787178432.610:159): avc: denied { setopt } for pid=435 comm="syz.0.39" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 34.086027][ T440] FAULT_INJECTION: forcing a failure. [ 34.086027][ T440] name failslab, interval 1, probability 0, space 0, times 1 [ 34.099262][ T440] CPU: 1 UID: 0 PID: 440 Comm: syz.2.40 Not tainted syzkaller #0 03d350d479d1c05c2ac57b56e0973d7fc75f4bbd [ 34.099293][ T440] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 34.099305][ T440] Call Trace: [ 34.099312][ T440] [ 34.099319][ T440] __dump_stack+0x21/0x30 [ 34.099346][ T440] dump_stack_lvl+0x140/0x1c0 [ 34.099361][ T440] ? __cfi_dump_stack_lvl+0x10/0x10 [ 34.099376][ T440] dump_stack+0x19/0x20 [ 34.099390][ T440] should_fail_ex+0x3c2/0x510 [ 34.099403][ T440] should_failslab+0xac/0x100 [ 34.099417][ T440] kmem_cache_alloc_noprof+0x42/0x410 [ 34.099486][ T440] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 34.099499][ T440] ? alloc_empty_file+0xbf/0x270 [ 34.099514][ T440] ? arch_stack_walk+0x10a/0x170 [ 34.099527][ T440] alloc_empty_file+0xbf/0x270 [ 34.099544][ T440] path_openat+0xf4/0x35a0 [ 34.099558][ T440] ? stack_depot_save_flags+0x38/0x800 [ 34.099573][ T440] ? kasan_save_track+0x4f/0x80 [ 34.099589][ T440] ? kasan_save_track+0x3e/0x80 [ 34.099608][ T440] ? kasan_save_alloc_info+0x3a/0x50 [ 34.099625][ T440] ? __kasan_slab_alloc+0x73/0x90 [ 34.099647][ T440] ? getname+0x1b/0x30 [ 34.099667][ T440] ? do_sys_openat2+0xda/0x1d0 [ 34.099692][ T440] ? __x64_sys_open+0x120/0x150 [ 34.099719][ T440] ? x64_sys_call+0x131a/0x2ee0 [ 34.099738][ T440] ? do_syscall_64+0x57/0xf0 [ 34.099766][ T440] ? do_filp_open+0x440/0x440 [ 34.099794][ T440] do_filp_open+0x1f2/0x440 [ 34.099817][ T440] ? __cfi_do_filp_open+0x10/0x10 [ 34.099843][ T440] ? alloc_fd+0x4c1/0x570 [ 34.099865][ T440] do_sys_openat2+0x134/0x1d0 [ 34.099888][ T440] ? fput+0x1a4/0x230 [ 34.099930][ T440] ? do_sys_open+0x100/0x100 [ 34.099951][ T440] ? ksys_write+0x1f3/0x260 [ 34.099967][ T440] ? __cfi_ksys_write+0x10/0x10 [ 34.099985][ T440] __x64_sys_open+0x120/0x150 [ 34.100007][ T440] x64_sys_call+0x131a/0x2ee0 [ 34.100021][ T440] do_syscall_64+0x57/0xf0 [ 34.100041][ T440] ? clear_bhb_loop+0x50/0xa0 [ 34.100059][ T440] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 34.100087][ T440] RIP: 0033:0x7f8debd9e0d9 [ 34.100105][ T440] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.100121][ T440] RSP: 002b:00007f8decba6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 34.100143][ T440] RAX: ffffffffffffffda RBX: 00007f8dec025fa0 RCX: 00007f8debd9e0d9 [ 34.100158][ T440] RDX: 0000000000000080 RSI: 0000000000143142 RDI: 0000200000000040 [ 34.100172][ T440] RBP: 00007f8decba6090 R08: 0000000000000000 R09: 0000000000000000 [ 34.100184][ T440] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 34.100195][ T440] R13: 00007f8dec026038 R14: 00007f8dec025fa0 R15: 00007ffd2eee3cc8 [ 34.100212][ T440] [ 34.386227][ T362] Bluetooth: hci0: command 0x1003 tx timeout [ 34.386354][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 34.411321][ T36] audit: type=1400 audit(1787178432.970:160): avc: denied { read write } for pid=441 comm="syz.1.41" name="binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 34.444283][ T36] audit: type=1400 audit(1787178432.970:161): avc: denied { open } for pid=441 comm="syz.1.41" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 34.468360][ T36] audit: type=1400 audit(1787178432.990:162): avc: denied { ioctl } for pid=441 comm="syz.1.41" path="/dev/binderfs/binder0" dev="binder" ino=13 ioctlcmd=0x6201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 34.829691][ T10] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 34.858460][ T36] audit: type=1400 audit(1787178433.410:163): avc: denied { create } for pid=449 comm="syz.0.44" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 34.879262][ T36] audit: type=1400 audit(1787178433.410:164): avc: denied { connect } for pid=449 comm="syz.0.44" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 35.179711][ T10] usb 3-1: Using ep0 maxpacket: 32 [ 35.186402][ T10] usb 3-1: config 2 has an invalid interface number: 88 but max is 0 [ 35.194705][ T10] usb 3-1: config 2 has no interface number 0 [ 35.200938][ T10] usb 3-1: config 2 interface 88 altsetting 25 bulk endpoint 0x6 has invalid maxpacket 256 [ 35.211237][ T10] usb 3-1: config 2 interface 88 has no altsetting 0 [ 35.219812][ T10] usb 3-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 35.228983][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 35.237072][ T10] usb 3-1: Product: syz [ 35.241380][ T10] usb 3-1: Manufacturer: syz [ 35.246076][ T10] usb 3-1: SerialNumber: syz [ 35.255656][ T445] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 35.268875][ T36] audit: type=1400 audit(1787178433.820:165): avc: denied { ioctl } for pid=454 comm="syz.1.45" path="socket:[4936]" dev="sockfs" ino=4936 ioctlcmd=0x52d3 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 35.470187][ T445] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 35.765239][ T36] audit: type=1400 audit(1787178434.320:166): avc: denied { create } for pid=459 comm="syz.0.47" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 35.789673][ T36] audit: type=1400 audit(1787178434.320:167): avc: denied { write } for pid=459 comm="syz.0.47" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 35.878419][ T36] audit: type=1400 audit(1787178434.430:168): avc: denied { write } for pid=466 comm="syz.0.50" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 35.922883][ T469] FAULT_INJECTION: forcing a failure. [ 35.922883][ T469] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 35.936435][ T469] CPU: 1 UID: 0 PID: 469 Comm: syz.0.51 Not tainted syzkaller #0 03d350d479d1c05c2ac57b56e0973d7fc75f4bbd [ 35.936466][ T469] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 35.936480][ T469] Call Trace: [ 35.936487][ T469] [ 35.936495][ T469] __dump_stack+0x21/0x30 [ 35.936526][ T469] dump_stack_lvl+0x140/0x1c0 [ 35.936564][ T469] ? __cfi_dump_stack_lvl+0x10/0x10 [ 35.936591][ T469] dump_stack+0x19/0x20 [ 35.936617][ T469] should_fail_ex+0x3c2/0x510 [ 35.936639][ T469] should_fail+0xf/0x20 [ 35.936658][ T469] should_fail_usercopy+0x1e/0x30 [ 35.936683][ T469] _copy_from_iter+0x1a6/0x1520 [ 35.936715][ T469] ? __virt_addr_valid+0x2a1/0x370 [ 35.936739][ T469] ? __cfi__copy_from_iter+0x10/0x10 [ 35.936765][ T469] ? __check_object_size+0x54c/0x870 [ 35.936786][ T469] ? __cfi___check_object_size+0x10/0x10 [ 35.936810][ T469] ? skb_put+0x10e/0x200 [ 35.936830][ T469] netlink_sendmsg+0x66d/0xad0 [ 35.936853][ T469] ? __cfi_netlink_sendmsg+0x10/0x10 [ 35.936877][ T469] ? bpf_lsm_socket_sendmsg+0xd/0x20 [ 35.936899][ T469] ? security_socket_sendmsg+0x3d/0x100 [ 35.936924][ T469] ____sys_sendmsg+0x99e/0xa00 [ 35.936951][ T469] ? __import_iovec+0x5b9/0x7d0 [ 35.936976][ T469] ? __sys_sendmsg_sock+0x50/0x50 [ 35.937011][ T469] ? import_iovec+0x80/0xb0 [ 35.937037][ T469] ___sys_sendmsg+0x2a6/0x370 [ 35.937062][ T469] ? __sys_sendmsg+0x2a0/0x2a0 [ 35.937085][ T469] ? proc_fail_nth_write+0x184/0x220 [ 35.937114][ T469] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 35.937144][ T469] ? __fget_files+0x2bc/0x330 [ 35.937167][ T469] __x64_sys_sendmsg+0x206/0x2e0 [ 35.937193][ T469] ? fput+0x1a4/0x230 [ 35.937216][ T469] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 35.937241][ T469] ? ksys_write+0x1f3/0x260 [ 35.937262][ T469] ? __kasan_check_read+0x15/0x20 [ 35.937282][ T469] x64_sys_call+0x2a4c/0x2ee0 [ 35.937299][ T469] do_syscall_64+0x57/0xf0 [ 35.937327][ T469] ? clear_bhb_loop+0x50/0xa0 [ 35.937346][ T469] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 35.937377][ T469] RIP: 0033:0x7fee8a99e0d9 [ 35.937393][ T469] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.937408][ T469] RSP: 002b:00007fee8b948028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 35.937437][ T469] RAX: ffffffffffffffda RBX: 00007fee8ac25fa0 RCX: 00007fee8a99e0d9 [ 35.937453][ T469] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 35.937466][ T469] RBP: 00007fee8b948090 R08: 0000000000000000 R09: 0000000000000000 [ 35.937478][ T469] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 35.937492][ T469] R13: 00007fee8ac26038 R14: 00007fee8ac25fa0 R15: 00007ffcfa67b598 [ 35.937509][ T469] [ 36.260992][ T471] FAULT_INJECTION: forcing a failure. [ 36.260992][ T471] name failslab, interval 1, probability 0, space 0, times 0 [ 36.275388][ T471] CPU: 1 UID: 0 PID: 471 Comm: syz.0.52 Not tainted syzkaller #0 03d350d479d1c05c2ac57b56e0973d7fc75f4bbd [ 36.275420][ T471] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 36.275440][ T471] Call Trace: [ 36.275448][ T471] [ 36.275456][ T471] __dump_stack+0x21/0x30 [ 36.275488][ T471] dump_stack_lvl+0x140/0x1c0 [ 36.275509][ T471] ? __cfi_dump_stack_lvl+0x10/0x10 [ 36.275531][ T471] dump_stack+0x19/0x20 [ 36.275550][ T471] should_fail_ex+0x3c2/0x510 [ 36.275569][ T471] should_failslab+0xac/0x100 [ 36.275589][ T471] kmem_cache_alloc_noprof+0x42/0x410 [ 36.275607][ T471] ? security_file_alloc+0x49/0x220 [ 36.275630][ T471] ? kasan_save_alloc_info+0x3a/0x50 [ 36.275645][ T471] security_file_alloc+0x49/0x220 [ 36.275666][ T471] init_file+0x9e/0x210 [ 36.275686][ T471] alloc_empty_file+0xd9/0x270 [ 36.275705][ T471] path_openat+0xf4/0x35a0 [ 36.275726][ T471] ? stack_depot_save_flags+0x38/0x800 [ 36.275747][ T471] ? kasan_save_track+0x4f/0x80 [ 36.275764][ T471] ? kasan_save_track+0x3e/0x80 [ 36.275781][ T471] ? kasan_save_alloc_info+0x3a/0x50 [ 36.275794][ T471] ? __kasan_slab_alloc+0x73/0x90 [ 36.275812][ T471] ? getname+0x1b/0x30 [ 36.275827][ T471] ? do_sys_openat2+0xda/0x1d0 [ 36.275848][ T471] ? __x64_sys_open+0x120/0x150 [ 36.275871][ T471] ? x64_sys_call+0x131a/0x2ee0 [ 36.275885][ T471] ? do_syscall_64+0x57/0xf0 [ 36.275907][ T471] ? do_filp_open+0x440/0x440 [ 36.275926][ T471] ? sysvec_call_function_single+0x4d/0x90 [ 36.275943][ T471] ? asm_sysvec_call_function_single+0x1f/0x30 [ 36.275960][ T471] do_filp_open+0x1f2/0x440 [ 36.275979][ T471] ? __sanitizer_cov_trace_pc+0x3a/0x70 [ 36.275997][ T471] ? __cfi_do_filp_open+0x10/0x10 [ 36.276021][ T471] ? alloc_fd+0x4c1/0x570 [ 36.276039][ T471] do_sys_openat2+0x134/0x1d0 [ 36.276059][ T471] ? fput+0x1a4/0x230 [ 36.276078][ T471] ? do_sys_open+0x100/0x100 [ 36.276097][ T471] ? ksys_write+0x1f3/0x260 [ 36.276113][ T471] ? __cfi_ksys_write+0x10/0x10 [ 36.276130][ T471] __x64_sys_open+0x120/0x150 [ 36.276154][ T471] x64_sys_call+0x131a/0x2ee0 [ 36.276168][ T471] do_syscall_64+0x57/0xf0 [ 36.276187][ T471] ? clear_bhb_loop+0x50/0xa0 [ 36.276202][ T471] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 36.276225][ T471] RIP: 0033:0x7fee8a99e0d9 [ 36.276240][ T471] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 36.276252][ T471] RSP: 002b:00007fee8b948028 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 36.276272][ T471] RAX: ffffffffffffffda RBX: 00007fee8ac25fa0 RCX: 00007fee8a99e0d9 [ 36.276285][ T471] RDX: 0000000000000080 RSI: 0000000000143142 RDI: 0000200000000040 [ 36.276296][ T471] RBP: 00007fee8b948090 R08: 0000000000000000 R09: 0000000000000000 [ 36.276306][ T471] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 36.276315][ T471] R13: 00007fee8ac26038 R14: 00007fee8ac25fa0 R15: 00007ffcfa67b598 [ 36.276328][ T471] [ 36.694559][ T479] netlink: 36 bytes leftover after parsing attributes in process `syz.0.55'. [ 36.768434][ T482] device-mapper: ioctl: Unable to rename non-existent device, to uuid [ 36.789804][ T10] asix 3-1:2.88 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 36.800408][ T10] asix 3-1:2.88: probe with driver asix failed with error -32 [ 36.907798][ T494] netlink: 28 bytes leftover after parsing attributes in process `syz.3.61'. [ 37.189717][ T10] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 37.339727][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 37.346567][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 37.356726][ T10] usb 4-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 37.366019][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.374057][ T10] usb 4-1: Product: syz [ 37.378484][ T10] usb 4-1: Manufacturer: syz [ 37.383120][ T10] usb 4-1: SerialNumber: syz [ 37.452948][ T496] netlink: 36 bytes leftover after parsing attributes in process `syz.1.62'. [ 37.476150][ T498] fuseblk: Bad value for 'source' [ 37.514329][ T502] netlink: 'syz.1.65': attribute type 3 has an invalid length. [ 37.600342][ T10] usb 4-1: MIDIStreaming interface descriptor not found [ 37.612875][ T10] usb 4-1: USB disconnect, device number 3 [ 37.626903][ T315] udevd[315]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 38.125134][ T518] netlink: 36 bytes leftover after parsing attributes in process `syz.3.73'. [ 38.170898][ T376] usb 3-1: USB disconnect, device number 3 [ 38.379696][ T312] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 38.444220][ T527] netlink: 132 bytes leftover after parsing attributes in process `syz.1.77'. [ 38.519722][ T312] usb 4-1: device descriptor read/64, error -71 [ 38.759690][ T312] usb 4-1: device descriptor read/64, error -71 [ 38.789686][ T376] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 38.950867][ T376] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 38.962057][ T376] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 38.972539][ T376] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a5, bcdDevice= 0.40 [ 38.981704][ T376] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 38.989724][ T376] usb 2-1: SerialNumber: syz [ 38.996000][ T376] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -22 [ 39.004429][ T312] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 39.012038][ T376] usb-storage 2-1:1.0: USB Mass Storage device detected [ 39.020550][ T376] usb-storage 2-1:1.0: Quirks match for vid 0525 pid a4a5: 10000 [ 39.048094][ T538] netlink: 28 bytes leftover after parsing attributes in process `syz.2.81'. [ 39.149803][ T312] usb 4-1: device descriptor read/64, error -71 [ 39.198117][ T31] usb 2-1: USB disconnect, device number 2 [ 39.339686][ T376] usb 3-1: new full-speed USB device number 4 using dummy_hcd [ 39.389769][ T312] usb 4-1: device descriptor read/64, error -71 [ 39.491302][ T376] usb 3-1: unable to get BOS descriptor or descriptor too short [ 39.499424][ T376] usb 3-1: not running at top speed; connect to a high speed hub [ 39.507461][ T312] usb usb4-port1: attempt power cycle [ 39.515917][ T376] usb 3-1: New USB device found, idVendor=1235, idProduct=000a, bcdDevice= 0.40 [ 39.525135][ T376] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.533176][ T376] usb 3-1: Product: syz [ 39.537464][ T376] usb 3-1: Manufacturer: syz [ 39.542127][ T376] usb 3-1: SerialNumber: syz [ 39.726952][ T36] kauditd_printk_skb: 25 callbacks suppressed [ 39.726980][ T36] audit: type=1400 audit(1787178438.280:194): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 39.810517][ T36] audit: type=1400 audit(1787178438.370:195): avc: denied { mount } for pid=540 comm="syz.2.82" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 39.849651][ T312] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 39.890787][ T312] usb 4-1: device descriptor read/8, error -71 [ 39.909731][ T376] usb 3-1: USB disconnect, device number 4 [ 39.954859][ T36] audit: type=1400 audit(1787178438.510:196): avc: denied { create } for pid=543 comm="syz.1.83" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 39.977366][ T36] audit: type=1400 audit(1787178438.530:197): avc: denied { setopt } for pid=543 comm="syz.1.83" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 40.021046][ T312] usb 4-1: device descriptor read/8, error -71 [ 40.079647][ T311] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 40.169300][ T36] audit: type=1400 audit(1787178438.720:198): avc: denied { write } for pid=565 comm="syz.1.91" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 40.189037][ T36] audit: type=1400 audit(1787178438.720:199): avc: denied { read } for pid=565 comm="syz.1.91" path="socket:[6339]" dev="sockfs" ino=6339 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 40.241039][ T311] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 40.251426][ T311] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 40.261653][ T311] usb 1-1: New USB device found, idVendor=0582, idProduct=0074, bcdDevice= 0.40 [ 40.270760][ T311] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.278846][ T311] usb 1-1: Product: syz [ 40.283062][ T312] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 40.290862][ T311] usb 1-1: Manufacturer: syz [ 40.295634][ T311] usb 1-1: SerialNumber: syz [ 40.320817][ T312] usb 4-1: device descriptor read/8, error -71 [ 40.417486][ T36] audit: type=1400 audit(1787178438.970:200): avc: denied { unmount } for pid=296 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 40.450722][ T312] usb 4-1: device descriptor read/8, error -71 [ 40.499681][ T10] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 40.501714][ T569] device-mapper: ioctl: Unable to rename non-existent device, to uuid [ 40.559781][ T312] usb usb4-port1: unable to enumerate USB device [ 40.659698][ T10] usb 2-1: Using ep0 maxpacket: 8 [ 40.666333][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 40.675092][ T10] usb 2-1: config 3 has an invalid interface number: 239 but max is 0 [ 40.683328][ T10] usb 2-1: config 3 has no interface number 0 [ 40.689630][ T10] usb 2-1: config 3 interface 239 has no altsetting 0 [ 40.697975][ T10] usb 2-1: New USB device found, idVendor=04e6, idProduct=0007, bcdDevice= 1.31 [ 40.707119][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.715139][ T10] usb 2-1: Product: syz [ 40.719485][ T10] usb 2-1: Manufacturer: syz [ 40.720611][ T311] usb 1-1: 0:1 : does not exist [ 40.725768][ T10] usb 2-1: SerialNumber: syz [ 40.730370][ T311] usb 1-1: 0:2 : does not exist [ 40.739152][ T311] usb 1-1: unit 5 not found! [ 40.745965][ T311] usb 1-1: USB disconnect, device number 3 [ 40.758905][ T341] udevd[341]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 40.940203][ T10] usb-storage 2-1:3.239: USB Mass Storage device detected [ 40.949200][ T10] usb-storage 2-1:3.239: Quirks match for vid 04e6 pid 0007: 1 [ 40.972598][ T10] usb 2-1: USB disconnect, device number 3 [ 41.180894][ T577] FAULT_INJECTION: forcing a failure. [ 41.180894][ T577] name failslab, interval 1, probability 0, space 0, times 0 [ 41.193675][ T577] CPU: 1 UID: 0 PID: 577 Comm: syz.3.95 Not tainted syzkaller #0 03d350d479d1c05c2ac57b56e0973d7fc75f4bbd [ 41.193706][ T577] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 41.193717][ T577] Call Trace: [ 41.193723][ T577] [ 41.193730][ T577] __dump_stack+0x21/0x30 [ 41.193759][ T577] dump_stack_lvl+0x140/0x1c0 [ 41.193782][ T577] ? __cfi_dump_stack_lvl+0x10/0x10 [ 41.193807][ T577] dump_stack+0x19/0x20 [ 41.193839][ T577] should_fail_ex+0x3c2/0x510 [ 41.193859][ T577] should_failslab+0xac/0x100 [ 41.193889][ T577] __kmalloc_node_track_caller_noprof+0x65/0x4f0 [ 41.193910][ T577] ? __kasan_check_write+0x18/0x20 [ 41.193927][ T577] ? _raw_spin_lock+0x92/0x120 [ 41.193949][ T577] ? _RNvMs4_NtCswPamI0U300_11rust_binder7processNtB5_7Process18get_current_thread+0x469/0x1a60 [ 41.193985][ T577] ? __cfi__raw_spin_lock+0x10/0x10 [ 41.194007][ T577] krealloc_noprof+0x8d/0x130 [ 41.194026][ T577] _RNvMs4_NtCswPamI0U300_11rust_binder7processNtB5_7Process18get_current_thread+0x469/0x1a60 [ 41.194056][ T577] ? __cfi_selinux_file_open+0x10/0x10 [ 41.194077][ T577] ? __cfi__RNvMs4_NtCswPamI0U300_11rust_binder7processNtB5_7Process18get_current_thread+0x10/0x10 [ 41.194109][ T577] ? avc_has_extended_perms+0x7fb/0xe60 [ 41.194129][ T577] ? __asan_memcpy+0x5a/0x80 [ 41.194146][ T577] _RNvCswPamI0U300_11rust_binder17rust_binder_ioctl+0x379/0x3fe0 [ 41.194174][ T577] ? __asan_set_shadow_00+0x12/0x20 [ 41.194198][ T577] ? do_vfs_ioctl+0x182d/0x2010 [ 41.194219][ T577] ? arch_stack_walk+0x10a/0x170 [ 41.194238][ T577] ? __ia32_compat_sys_ioctl+0x920/0x920 [ 41.194260][ T577] ? __cfi__RNvCswPamI0U300_11rust_binder17rust_binder_ioctl+0x10/0x10 [ 41.194286][ T577] ? _parse_integer+0x2e/0x40 [ 41.194308][ T577] ? ioctl_has_perm+0x39a/0x500 [ 41.194325][ T577] ? has_cap_mac_admin+0xd0/0xd0 [ 41.194343][ T577] ? proc_fail_nth_write+0x184/0x220 [ 41.194367][ T577] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 41.194392][ T577] ? selinux_file_ioctl+0x732/0x1480 [ 41.194410][ T577] ? vfs_write+0xbcf/0xfd0 [ 41.194427][ T577] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 41.194445][ T577] ? __cfi_vfs_write+0x10/0x10 [ 41.194463][ T577] ? __kasan_check_write+0x18/0x20 [ 41.194480][ T577] ? mutex_unlock+0x90/0x240 [ 41.194496][ T577] ? __cfi_mutex_unlock+0x10/0x10 [ 41.194515][ T577] ? bpf_lsm_file_ioctl+0xd/0x20 [ 41.194536][ T577] ? security_file_ioctl+0x3e/0x110 [ 41.194552][ T577] ? __cfi__RNvCswPamI0U300_11rust_binder17rust_binder_ioctl+0x10/0x10 [ 41.194580][ T577] __se_sys_ioctl+0x135/0x1b0 [ 41.194601][ T577] __x64_sys_ioctl+0x7f/0xa0 [ 41.194621][ T577] x64_sys_call+0x1878/0x2ee0 [ 41.194637][ T577] do_syscall_64+0x57/0xf0 [ 41.194658][ T577] ? clear_bhb_loop+0x50/0xa0 [ 41.194676][ T577] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 41.194710][ T577] RIP: 0033:0x7fbbcd59e0d9 [ 41.194726][ T577] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 41.194740][ T577] RSP: 002b:00007fbbce49e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 41.194760][ T577] RAX: ffffffffffffffda RBX: 00007fbbcd825fa0 RCX: 00007fbbcd59e0d9 [ 41.194780][ T577] RDX: 0000200000000300 RSI: 00000000c0306201 RDI: 0000000000000003 [ 41.194792][ T577] RBP: 00007fbbce49e090 R08: 0000000000000000 R09: 0000000000000000 [ 41.194803][ T577] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 41.194814][ T577] R13: 00007fbbcd826038 R14: 00007fbbcd825fa0 R15: 00007ffe9f004c48 [ 41.194829][ T577] [ 41.633611][ T36] audit: type=1400 audit(1787178440.190:201): avc: denied { mounton } for pid=594 comm="syz.3.103" path="/dev/binderfs" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 41.633640][ T595] SELinux: security_context_str_to_sid (user_u) failed with errno=-22 [ 41.753673][ T596] SELinux: security_context_str_to_sid (user_u) failed with errno=-22 [ 41.816979][ T604] FAULT_INJECTION: forcing a failure. [ 41.816979][ T604] name failslab, interval 1, probability 0, space 0, times 0 [ 41.829740][ T312] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 41.834058][ T604] CPU: 0 UID: 0 PID: 604 Comm: syz.3.106 Not tainted syzkaller #0 03d350d479d1c05c2ac57b56e0973d7fc75f4bbd [ 41.834100][ T604] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 41.834112][ T604] Call Trace: [ 41.834118][ T604] [ 41.834125][ T604] __dump_stack+0x21/0x30 [ 41.834155][ T604] dump_stack_lvl+0x140/0x1c0 [ 41.834178][ T604] ? __cfi_dump_stack_lvl+0x10/0x10 [ 41.834203][ T604] dump_stack+0x19/0x20 [ 41.834225][ T604] should_fail_ex+0x3c2/0x510 [ 41.834247][ T604] should_failslab+0xac/0x100 [ 41.834268][ T604] __kmalloc_node_track_caller_noprof+0x65/0x4f0 [ 41.834289][ T604] ? _RNvMs3_NtCswPamI0U300_11rust_binder6threadNtB5_11ThreadError7try_new+0x4f/0x470 [ 41.834322][ T604] krealloc_noprof+0x8d/0x130 [ 41.834341][ T604] _RNvMs3_NtCswPamI0U300_11rust_binder6threadNtB5_11ThreadError7try_new+0x4f/0x470 [ 41.834370][ T604] _RNvMs4_NtCswPamI0U300_11rust_binder7processNtB5_7Process18get_current_thread+0x57d/0x1a60 [ 41.834406][ T604] ? __cfi_selinux_file_open+0x10/0x10 [ 41.834427][ T604] ? __cfi__RNvMs4_NtCswPamI0U300_11rust_binder7processNtB5_7Process18get_current_thread+0x10/0x10 [ 41.834459][ T604] ? avc_has_extended_perms+0x7fb/0xe60 [ 41.834480][ T604] ? __asan_memcpy+0x5a/0x80 [ 41.834497][ T604] _RNvCswPamI0U300_11rust_binder17rust_binder_ioctl+0x379/0x3fe0 [ 41.834526][ T604] ? __asan_set_shadow_00+0x12/0x20 [ 41.834550][ T604] ? do_vfs_ioctl+0x182d/0x2010 [ 41.834571][ T604] ? arch_stack_walk+0x10a/0x170 [ 41.834588][ T604] ? __ia32_compat_sys_ioctl+0x920/0x920 [ 41.834610][ T604] ? __cfi__RNvCswPamI0U300_11rust_binder17rust_binder_ioctl+0x10/0x10 [ 41.834638][ T604] ? _parse_integer+0x2e/0x40 [ 41.834659][ T604] ? ioctl_has_perm+0x39a/0x500 [ 41.834677][ T604] ? has_cap_mac_admin+0xd0/0xd0 [ 41.834695][ T604] ? proc_fail_nth_write+0x184/0x220 [ 41.834720][ T604] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 41.834745][ T604] ? selinux_file_ioctl+0x732/0x1480 [ 41.834762][ T604] ? vfs_write+0xbcf/0xfd0 [ 41.834781][ T604] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 41.834799][ T604] ? __cfi_vfs_write+0x10/0x10 [ 41.834817][ T604] ? __kasan_check_write+0x18/0x20 [ 41.834834][ T604] ? mutex_unlock+0x90/0x240 [ 41.834852][ T604] ? __cfi_mutex_unlock+0x10/0x10 [ 41.834871][ T604] ? bpf_lsm_file_ioctl+0xd/0x20 [ 41.834893][ T604] ? security_file_ioctl+0x3e/0x110 [ 41.834920][ T604] ? __cfi__RNvCswPamI0U300_11rust_binder17rust_binder_ioctl+0x10/0x10 [ 41.834947][ T604] __se_sys_ioctl+0x135/0x1b0 [ 41.834968][ T604] __x64_sys_ioctl+0x7f/0xa0 [ 41.834988][ T604] x64_sys_call+0x1878/0x2ee0 [ 41.835005][ T604] do_syscall_64+0x57/0xf0 [ 41.835027][ T604] ? clear_bhb_loop+0x50/0xa0 [ 41.835049][ T604] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 41.835075][ T604] RIP: 0033:0x7fbbcd59e0d9 [ 41.835091][ T604] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 41.835105][ T604] RSP: 002b:00007fbbce49e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 41.835126][ T604] RAX: ffffffffffffffda RBX: 00007fbbcd825fa0 RCX: 00007fbbcd59e0d9 [ 41.835140][ T604] RDX: 0000200000000300 RSI: 00000000c0306201 RDI: 0000000000000003 [ 41.835152][ T604] RBP: 00007fbbce49e090 R08: 0000000000000000 R09: 0000000000000000 [ 41.835163][ T604] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 41.835183][ T604] R13: 00007fbbcd826038 R14: 00007fbbcd825fa0 R15: 00007ffe9f004c48 [ 41.835198][ T604] [ 41.846952][ T607] netlink: 36 bytes leftover after parsing attributes in process `syz.3.108'. [ 42.000801][ T312] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 42.206502][ T312] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 42.218248][ T312] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 42.236266][ T36] audit: type=1400 audit(1787178440.790:202): avc: denied { connect } for pid=615 comm="syz.1.112" lport=60 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 42.256890][ T312] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 42.270270][ T312] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 42.287740][ T36] audit: type=1400 audit(1787178440.790:203): avc: denied { ioctl } for pid=615 comm="syz.1.112" path="socket:[5782]" dev="sockfs" ino=5782 ioctlcmd=0x6e81 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 42.313190][ T312] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 42.323056][ T312] usb 1-1: config 0 descriptor?? [ 42.334870][ T622] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 42.343896][ T622] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 42.441089][ T635] netlink: 36 bytes leftover after parsing attributes in process `syz.1.121'. [ 42.731862][ T654] syzkaller1: entered promiscuous mode [ 42.737406][ T654] syzkaller1: entered allmulticast mode [ 42.740936][ T312] plantronics 0003:047F:FFFF.0001: No inputs registered, leaving [ 42.754510][ T312] plantronics 0003:047F:FFFF.0001: hiddev96,hidraw0: USB HID v0.00 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 42.819644][ T376] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 42.989708][ T376] usb 4-1: Using ep0 maxpacket: 16 [ 42.997055][ T376] usb 4-1: config index 0 descriptor too short (expected 51443, got 18) [ 43.007895][ T311] usb 1-1: USB disconnect, device number 4 [ 43.015147][ T376] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 43.024858][ T376] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 43.036810][ T376] usb 4-1: Product: syz [ 43.041915][ T376] usb 4-1: Manufacturer: syz [ 43.046748][ T376] usb 4-1: SerialNumber: syz [ 43.054988][ T376] r8152-cfgselector 4-1: Unknown version 0x0000 [ 43.063207][ T376] r8152-cfgselector 4-1: config 0 descriptor?? [ 43.271721][ T376] r8152-cfgselector 4-1: Unknown version 0x0000 [ 43.278265][ T376] r8152-cfgselector 4-1: bad CDC descriptors [ 43.286241][ T376] r8152-cfgselector 4-1: USB disconnect, device number 8 [ 43.349702][ T10] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 43.472547][ T671] netlink: 36 bytes leftover after parsing attributes in process `syz.2.135'. [ 43.500757][ T10] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 43.517548][ T10] usb 2-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 43.534961][ T10] usb 2-1: config 0 interface 0 has no altsetting 0 [ 43.544477][ T10] usb 2-1: New USB device found, idVendor=044f, idProduct=b65a, bcdDevice= 0.00 [ 43.553942][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 43.562861][ T10] usb 2-1: config 0 descriptor?? [ 43.756445][ T697] device-mapper: ioctl: Unable to rename non-existent device, to uuid [ 43.775622][ T699] sit0: entered promiscuous mode [ 43.782629][ T699] netlink: 'syz.2.146': attribute type 1 has an invalid length. [ 43.791404][ T699] netlink: 1 bytes leftover after parsing attributes in process `syz.2.146'. [ 43.810716][ T701] capability: warning: `syz.3.147' uses 32-bit capabilities (legacy support in use) [ 43.862271][ T704] netlink: 36 bytes leftover after parsing attributes in process `syz.2.148'. [ 43.975421][ T10] thrustmaster 0003:044F:B65A.0002: invalid report_count 1039285047 [ 43.999689][ T10] thrustmaster 0003:044F:B65A.0002: item 0 4 1 9 parsing failed [ 44.007759][ T10] thrustmaster 0003:044F:B65A.0002: parse failed [ 44.015272][ T10] thrustmaster 0003:044F:B65A.0002: probe with driver thrustmaster failed with error -22 [ 44.129693][ T312] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 44.176535][ T667] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 44.185625][ T667] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 44.194674][ T10] usb 2-1: USB disconnect, device number 4 [ 44.280813][ T312] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 44.291223][ T312] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 44.302361][ T312] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 44.313310][ T312] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 44.326284][ T312] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 44.335466][ T312] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 44.344477][ T312] usb 3-1: config 0 descriptor?? [ 44.551530][ T707] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 44.560458][ T707] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 44.663137][ T711] rust_binder: 710:711 no such ref 3 [ 44.668584][ T711] rust_binder: 710:711 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 44.676661][ T711] rust_binder: 710:711 got transaction to invalid handle 4294967293 [ 44.684826][ T711] rust_binder: 710:711 transaction call to 0:0 failed ENOENT, code 0 size 96-24 [ 44.771007][ T312] usbhid 3-1:0.0: can't add hid device: -71 [ 44.777063][ T312] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 44.788899][ T312] usb 3-1: USB disconnect, device number 5 [ 44.989686][ T10] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 45.141227][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 45.150281][ T10] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 45.163549][ T10] usb 2-1: string descriptor 0 read error: -22 [ 45.169868][ T10] usb 2-1: New USB device found, idVendor=200c, idProduct=100b, bcdDevice= 0.40 [ 45.179289][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 45.299179][ T728] netlink: 36 bytes leftover after parsing attributes in process `syz.2.158'. [ 45.434260][ T734] FAULT_INJECTION: forcing a failure. [ 45.434260][ T734] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 45.448266][ T734] CPU: 0 UID: 0 PID: 734 Comm: syz.3.161 Not tainted syzkaller #0 03d350d479d1c05c2ac57b56e0973d7fc75f4bbd [ 45.448293][ T734] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 45.448301][ T734] Call Trace: [ 45.448307][ T734] [ 45.448312][ T734] __dump_stack+0x21/0x30 [ 45.448334][ T734] dump_stack_lvl+0x140/0x1c0 [ 45.448349][ T734] ? __cfi_dump_stack_lvl+0x10/0x10 [ 45.448371][ T734] ? do_vfs_ioctl+0x182d/0x2010 [ 45.448390][ T734] ? check_stack_object+0x10f/0x150 [ 45.448405][ T734] dump_stack+0x19/0x20 [ 45.448419][ T734] should_fail_ex+0x3c2/0x510 [ 45.448431][ T734] should_fail+0xf/0x20 [ 45.448443][ T734] should_fail_usercopy+0x1e/0x30 [ 45.448455][ T734] _copy_from_user+0x20/0xa0 [ 45.448470][ T734] kvm_vm_ioctl+0x657/0xc40 [ 45.448486][ T734] ? __cfi_kvm_vm_ioctl+0x10/0x10 [ 45.448500][ T734] ? ioctl_has_perm+0x1bc/0x500 [ 45.448512][ T734] ? __asan_memcpy+0x5a/0x80 [ 45.448524][ T734] ? ioctl_has_perm+0x408/0x500 [ 45.448535][ T734] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 45.448553][ T734] ? selinux_file_ioctl+0x732/0x1480 [ 45.448564][ T734] ? vfs_write+0xbcf/0xfd0 [ 45.448575][ T734] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 45.448586][ T734] ? __cfi_vfs_write+0x10/0x10 [ 45.448597][ T734] ? __kasan_check_write+0x18/0x20 [ 45.448608][ T734] ? mutex_unlock+0x90/0x240 [ 45.448619][ T734] ? __cfi_mutex_unlock+0x10/0x10 [ 45.448631][ T734] ? bpf_lsm_file_ioctl+0xd/0x20 [ 45.448645][ T734] ? security_file_ioctl+0x3e/0x110 [ 45.448656][ T734] ? __cfi_kvm_vm_ioctl+0x10/0x10 [ 45.448670][ T734] __se_sys_ioctl+0x135/0x1b0 [ 45.448694][ T734] __x64_sys_ioctl+0x7f/0xa0 [ 45.448707][ T734] x64_sys_call+0x1878/0x2ee0 [ 45.448717][ T734] do_syscall_64+0x57/0xf0 [ 45.448731][ T734] ? clear_bhb_loop+0x50/0xa0 [ 45.448742][ T734] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 45.448758][ T734] RIP: 0033:0x7fbbcd59e0d9 [ 45.448770][ T734] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 45.448779][ T734] RSP: 002b:00007fbbce49e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 45.448793][ T734] RAX: ffffffffffffffda RBX: 00007fbbcd825fa0 RCX: 00007fbbcd59e0d9 [ 45.448802][ T734] RDX: 0000200000000100 RSI: 000000004020ae46 RDI: 0000000000000004 [ 45.448810][ T734] RBP: 00007fbbce49e090 R08: 0000000000000000 R09: 0000000000000000 [ 45.448817][ T734] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 45.448824][ T734] R13: 00007fbbcd826038 R14: 00007fbbcd825fa0 R15: 00007ffe9f004c48 [ 45.448834][ T734] [ 45.569653][ T312] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 45.593599][ T10] usb 2-1: USB disconnect, device number 5 [ 45.739667][ T312] usb 3-1: Using ep0 maxpacket: 32 [ 45.746561][ T312] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 45.758561][ T312] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 45.771580][ T312] usb 3-1: New USB device found, idVendor=056a, idProduct=00fa, bcdDevice= 0.00 [ 45.780716][ T312] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 45.789629][ T312] usb 3-1: config 0 descriptor?? [ 45.931373][ T741] FAULT_INJECTION: forcing a failure. [ 45.931373][ T741] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 45.944859][ T741] CPU: 0 UID: 0 PID: 741 Comm: syz.3.164 Not tainted syzkaller #0 03d350d479d1c05c2ac57b56e0973d7fc75f4bbd [ 45.944893][ T741] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 45.944905][ T741] Call Trace: [ 45.944913][ T741] [ 45.944921][ T741] __dump_stack+0x21/0x30 [ 45.944954][ T741] dump_stack_lvl+0x140/0x1c0 [ 45.944979][ T741] ? __cfi_dump_stack_lvl+0x10/0x10 [ 45.944994][ T741] dump_stack+0x19/0x20 [ 45.945007][ T741] should_fail_ex+0x3c2/0x510 [ 45.945024][ T741] should_fail+0xf/0x20 [ 45.945043][ T741] should_fail_usercopy+0x1e/0x30 [ 45.945064][ T741] _copy_from_user+0x20/0xa0 [ 45.945089][ T741] _RNvCswPamI0U300_11rust_binder17rust_binder_ioctl+0xeef/0x3fe0 [ 45.945120][ T741] ? __asan_set_shadow_00+0x12/0x20 [ 45.945143][ T741] ? do_vfs_ioctl+0x182d/0x2010 [ 45.945156][ T741] ? arch_stack_walk+0x10a/0x170 [ 45.945167][ T741] ? __ia32_compat_sys_ioctl+0x920/0x920 [ 45.945183][ T741] ? __cfi__RNvCswPamI0U300_11rust_binder17rust_binder_ioctl+0x10/0x10 [ 45.945212][ T741] ? _parse_integer+0x2e/0x40 [ 45.945235][ T741] ? ioctl_has_perm+0x39a/0x500 [ 45.945254][ T741] ? has_cap_mac_admin+0xd0/0xd0 [ 45.945273][ T741] ? proc_fail_nth_write+0x184/0x220 [ 45.945289][ T741] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 45.945304][ T741] ? selinux_file_ioctl+0x732/0x1480 [ 45.945315][ T741] ? vfs_write+0xbcf/0xfd0 [ 45.945337][ T741] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 45.945356][ T741] ? __cfi_vfs_write+0x10/0x10 [ 45.945375][ T741] ? __kasan_check_write+0x18/0x20 [ 45.945394][ T741] ? mutex_unlock+0x90/0x240 [ 45.945412][ T741] ? __cfi_mutex_unlock+0x10/0x10 [ 45.945428][ T741] ? bpf_lsm_file_ioctl+0xd/0x20 [ 45.945441][ T741] ? security_file_ioctl+0x3e/0x110 [ 45.945452][ T741] ? __cfi__RNvCswPamI0U300_11rust_binder17rust_binder_ioctl+0x10/0x10 [ 45.945468][ T741] __se_sys_ioctl+0x135/0x1b0 [ 45.945484][ T741] __x64_sys_ioctl+0x7f/0xa0 [ 45.945506][ T741] x64_sys_call+0x1878/0x2ee0 [ 45.945524][ T741] do_syscall_64+0x57/0xf0 [ 45.945547][ T741] ? clear_bhb_loop+0x50/0xa0 [ 45.945566][ T741] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 45.945584][ T741] RIP: 0033:0x7fbbcd59e0d9 [ 45.945595][ T741] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 45.945605][ T741] RSP: 002b:00007fbbce49e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 45.945620][ T741] RAX: ffffffffffffffda RBX: 00007fbbcd825fa0 RCX: 00007fbbcd59e0d9 [ 45.945629][ T741] RDX: 0000200000000300 RSI: 00000000c0306201 RDI: 0000000000000003 [ 45.945642][ T741] RBP: 00007fbbce49e090 R08: 0000000000000000 R09: 0000000000000000 [ 45.945653][ T741] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 45.945665][ T741] R13: 00007fbbcd826038 R14: 00007fbbcd825fa0 R15: 00007ffe9f004c48 [ 45.945681][ T741] [ 46.250436][ T36] kauditd_printk_skb: 15 callbacks suppressed [ 46.250455][ T36] audit: type=1400 audit(1787178444.810:219): avc: denied { read } for pid=742 comm="syz.3.165" name="msr" dev="devtmpfs" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 46.280453][ T36] audit: type=1400 audit(1787178444.810:220): avc: denied { open } for pid=742 comm="syz.3.165" path="/dev/cpu/0/msr" dev="devtmpfs" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 46.404430][ T312] usbhid 3-1:0.0: can't add hid device: -71 [ 46.413128][ T312] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 46.426273][ T312] usb 3-1: USB disconnect, device number 6 [ 46.559654][ T64] usb 2-1: new full-speed USB device number 6 using dummy_hcd [ 46.721484][ T64] usb 2-1: unable to get BOS descriptor or descriptor too short [ 46.734125][ T64] usb 2-1: not running at top speed; connect to a high speed hub [ 46.743126][ T64] usb 2-1: config 129 has an invalid interface number: 80 but max is 0 [ 46.751671][ T64] usb 2-1: config 129 has an invalid interface number: 5 but max is 0 [ 46.760231][ T64] usb 2-1: config 129 has 2 interfaces, different from the descriptor's value: 1 [ 46.769759][ T64] usb 2-1: config 129 has no interface number 0 [ 46.776283][ T64] usb 2-1: config 129 has no interface number 1 [ 46.782989][ T64] usb 2-1: config 129 interface 80 altsetting 11 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 46.796828][ T64] usb 2-1: too many endpoints for config 129 interface 5 altsetting 7: 37, using maximum allowed: 30 [ 46.808080][ T64] usb 2-1: config 129 interface 5 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 37 [ 46.822055][ T64] usb 2-1: config 129 interface 80 has no altsetting 0 [ 46.828973][ T64] usb 2-1: config 129 interface 5 has no altsetting 0 [ 46.838249][ T64] usb 2-1: New USB device found, idVendor=2040, idProduct=721f, bcdDevice=f2.00 [ 46.847811][ T64] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 46.857242][ T64] usb 2-1: Product: syz [ 46.862360][ T64] usb 2-1: Manufacturer: syz [ 46.867291][ T64] usb 2-1: SerialNumber: syz [ 46.989687][ T312] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 47.037009][ T765] netlink: 36 bytes leftover after parsing attributes in process `syz.2.174'. [ 47.071693][ T767] FAULT_INJECTION: forcing a failure. [ 47.071693][ T767] name failslab, interval 1, probability 0, space 0, times 0 [ 47.084931][ T767] CPU: 1 UID: 0 PID: 767 Comm: syz.2.175 Not tainted syzkaller #0 03d350d479d1c05c2ac57b56e0973d7fc75f4bbd [ 47.084975][ T767] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 47.084986][ T767] Call Trace: [ 47.084996][ T767] [ 47.085004][ T767] __dump_stack+0x21/0x30 [ 47.085034][ T767] dump_stack_lvl+0x140/0x1c0 [ 47.085062][ T767] ? __cfi_dump_stack_lvl+0x10/0x10 [ 47.085088][ T767] dump_stack+0x19/0x20 [ 47.085111][ T767] should_fail_ex+0x3c2/0x510 [ 47.085138][ T767] should_failslab+0xac/0x100 [ 47.085160][ T767] __kmalloc_cache_noprof+0x41/0x470 [ 47.085184][ T767] ? kvm_check_memslot_overlap+0x35e/0x3d0 [ 47.085211][ T767] ? __kvm_set_memory_region+0x6c7/0xb40 [ 47.085240][ T767] __kvm_set_memory_region+0x6c7/0xb40 [ 47.085268][ T767] kvm_set_memory_region+0x2f/0x50 [ 47.085289][ T767] kvm_vm_ioctl+0xb01/0xc40 [ 47.085314][ T767] ? __cfi_kvm_vm_ioctl+0x10/0x10 [ 47.085342][ T767] ? ioctl_has_perm+0x1bc/0x500 [ 47.085361][ T767] ? __asan_memcpy+0x5a/0x80 [ 47.085378][ T767] ? ioctl_has_perm+0x408/0x500 [ 47.085401][ T767] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 47.085429][ T767] ? selinux_file_ioctl+0x732/0x1480 [ 47.085451][ T767] ? vfs_write+0xbcf/0xfd0 [ 47.085470][ T767] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 47.085489][ T767] ? __cfi_vfs_write+0x10/0x10 [ 47.085512][ T767] ? __kasan_check_write+0x18/0x20 [ 47.085530][ T767] ? mutex_unlock+0x90/0x240 [ 47.085548][ T767] ? __cfi_mutex_unlock+0x10/0x10 [ 47.085572][ T767] ? bpf_lsm_file_ioctl+0xd/0x20 [ 47.085594][ T767] ? security_file_ioctl+0x3e/0x110 [ 47.085615][ T767] ? __cfi_kvm_vm_ioctl+0x10/0x10 [ 47.085638][ T767] __se_sys_ioctl+0x135/0x1b0 [ 47.085664][ T767] __x64_sys_ioctl+0x7f/0xa0 [ 47.085687][ T767] x64_sys_call+0x1878/0x2ee0 [ 47.085703][ T767] do_syscall_64+0x57/0xf0 [ 47.085730][ T767] ? clear_bhb_loop+0x50/0xa0 [ 47.085747][ T767] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 47.085778][ T767] RIP: 0033:0x7f8debd9e0d9 [ 47.085794][ T767] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 47.085811][ T767] RSP: 002b:00007f8decba6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 47.085834][ T767] RAX: ffffffffffffffda RBX: 00007f8dec025fa0 RCX: 00007f8debd9e0d9 [ 47.085848][ T767] RDX: 0000200000000100 RSI: 000000004020ae46 RDI: 0000000000000004 [ 47.085860][ T767] RBP: 00007f8decba6090 R08: 0000000000000000 R09: 0000000000000000 [ 47.085876][ T767] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 47.085888][ T767] R13: 00007f8dec026038 R14: 00007f8dec025fa0 R15: 00007ffd2eee3cc8 [ 47.085902][ T767] [ 47.358388][ T312] usb 1-1: device descriptor read/64, error -71 [ 47.510954][ T64] usb 2-1: MIDIStreaming interface descriptor not found [ 47.520946][ T64] usb 2-1: USB disconnect, device number 6 [ 47.542830][ T36] audit: type=1400 audit(1787178446.100:221): avc: denied { map } for pid=772 comm="syz.2.178" path="socket:[7019]" dev="sockfs" ino=7019 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 47.599729][ T312] usb 1-1: device descriptor read/64, error -71 [ 47.640399][ T786] netlink: 36 bytes leftover after parsing attributes in process `syz.3.180'. [ 47.779698][ T311] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 47.839704][ T312] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 47.889716][ T376] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 47.929699][ T311] usb 3-1: Using ep0 maxpacket: 8 [ 47.936404][ T311] usb 3-1: unable to get BOS descriptor or descriptor too short [ 47.944909][ T311] usb 3-1: config 10 has an invalid interface number: 91 but max is 0 [ 47.953170][ T311] usb 3-1: config 10 has no interface number 0 [ 47.959333][ T311] usb 3-1: config 10 interface 91 has no altsetting 0 [ 47.967970][ T311] usb 3-1: New USB device found, idVendor=097b, idProduct=61f6, bcdDevice=d4.9a [ 47.977109][ T312] usb 1-1: device descriptor read/64, error -71 [ 47.983442][ T311] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 47.991573][ T311] usb 3-1: Product: syz [ 47.995756][ T311] usb 3-1: Manufacturer: syz [ 48.000398][ T311] usb 3-1: SerialNumber: syz [ 48.039939][ T376] usb 4-1: Using ep0 maxpacket: 16 [ 48.047917][ T376] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 48.053112][ T794] FAULT_INJECTION: forcing a failure. [ 48.053112][ T794] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 48.062679][ T376] usb 4-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 48.074563][ T794] CPU: 0 UID: 0 PID: 794 Comm: syz.1.184 Not tainted syzkaller #0 03d350d479d1c05c2ac57b56e0973d7fc75f4bbd [ 48.074590][ T794] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 48.074609][ T794] Call Trace: [ 48.074615][ T794] [ 48.074622][ T794] __dump_stack+0x21/0x30 [ 48.074651][ T794] dump_stack_lvl+0x140/0x1c0 [ 48.074680][ T794] ? __cfi_dump_stack_lvl+0x10/0x10 [ 48.074705][ T794] dump_stack+0x19/0x20 [ 48.074744][ T794] should_fail_ex+0x3c2/0x510 [ 48.074765][ T794] should_fail+0xf/0x20 [ 48.074783][ T794] should_fail_usercopy+0x1e/0x30 [ 48.074805][ T794] _copy_from_user+0x20/0xa0 [ 48.074828][ T794] _RNvMs2_NtCswPamI0U300_11rust_binder6threadNtB5_6Thread5write+0x1429/0xb8e0 [ 48.074873][ T794] ? __cfi__RNvMs2_NtCswPamI0U300_11rust_binder6threadNtB5_6Thread5write+0x10/0x10 [ 48.074909][ T794] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 48.074936][ T794] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 48.074961][ T794] ? __kernel_text_address+0x11/0x40 [ 48.074984][ T794] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 48.075007][ T794] ? arch_stack_walk+0x12c/0x170 [ 48.075025][ T794] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 48.075053][ T794] ? is_bpf_text_address+0x17b/0x1a0 [ 48.075079][ T794] ? kernel_text_address+0xa9/0xe0 [ 48.075101][ T794] ? __kernel_text_address+0x11/0x40 [ 48.075123][ T794] ? unwind_get_return_address+0x51/0x90 [ 48.075148][ T794] ? is_bpf_text_address+0x17b/0x1a0 [ 48.075172][ T794] ? kernel_text_address+0xa9/0xe0 [ 48.075195][ T794] ? __kernel_text_address+0x11/0x40 [ 48.075216][ T794] ? unwind_get_return_address+0x51/0x90 [ 48.075237][ T794] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 48.075258][ T794] ? arch_stack_walk+0x10a/0x170 [ 48.075276][ T794] ? stack_depot_save_flags+0x38/0x800 [ 48.075298][ T794] ? kasan_save_alloc_info+0x3a/0x50 [ 48.075315][ T794] ? kasan_save_track+0x4f/0x80 [ 48.075334][ T794] ? kasan_save_track+0x3e/0x80 [ 48.075353][ T794] ? kasan_save_alloc_info+0x3a/0x50 [ 48.075377][ T794] ? __kasan_kmalloc+0x96/0xb0 [ 48.075396][ T794] ? __kmalloc_node_track_caller_noprof+0x24e/0x4f0 [ 48.075416][ T794] ? krealloc_noprof+0x8d/0x130 [ 48.075435][ T794] ? _RNvMs4_NtCswPamI0U300_11rust_binder7processNtB5_7Process18get_current_thread+0x874/0x1a60 [ 48.075465][ T794] ? _RNvCswPamI0U300_11rust_binder17rust_binder_ioctl+0x379/0x3fe0 [ 48.075492][ T794] ? __se_sys_ioctl+0x135/0x1b0 [ 48.075520][ T794] ? __x64_sys_ioctl+0x7f/0xa0 [ 48.075540][ T794] ? x64_sys_call+0x1878/0x2ee0 [ 48.075556][ T794] ? do_syscall_64+0x57/0xf0 [ 48.075578][ T794] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 48.075608][ T794] ? __kasan_kmalloc+0x96/0xb0 [ 48.075628][ T794] ? kasan_save_alloc_info+0x3a/0x50 [ 48.075644][ T794] ? __kasan_kmalloc+0x96/0xb0 [ 48.075665][ T794] ? __kasan_check_write+0x18/0x20 [ 48.075682][ T794] ? _raw_spin_lock+0x92/0x120 [ 48.075703][ T794] ? __cfi__raw_spin_lock+0x10/0x10 [ 48.075726][ T794] ? _raw_spin_unlock+0x45/0x60 [ 48.075747][ T794] ? _RNvMs4_NtCswPamI0U300_11rust_binder7processNtB5_7Process18get_current_thread+0xff4/0x1a60 [ 48.075778][ T794] ? __cfi_selinux_file_open+0x10/0x10 [ 48.075798][ T794] ? __cfi__RNvMs4_NtCswPamI0U300_11rust_binder7processNtB5_7Process18get_current_thread+0x10/0x10 [ 48.075830][ T794] ? _RNvCswPamI0U300_11rust_binder17rust_binder_ioctl+0x1952/0x3fe0 [ 48.075857][ T794] ? __asan_memcpy+0x5a/0x80 [ 48.075874][ T794] _RNvCswPamI0U300_11rust_binder17rust_binder_ioctl+0x199a/0x3fe0 [ 48.075902][ T794] ? __asan_set_shadow_00+0x12/0x20 [ 48.075925][ T794] ? do_vfs_ioctl+0x182d/0x2010 [ 48.075953][ T794] ? arch_stack_walk+0x10a/0x170 [ 48.075971][ T794] ? __ia32_compat_sys_ioctl+0x920/0x920 [ 48.075993][ T794] ? __cfi__RNvCswPamI0U300_11rust_binder17rust_binder_ioctl+0x10/0x10 [ 48.076020][ T794] ? _parse_integer+0x2e/0x40 [ 48.076041][ T794] ? ioctl_has_perm+0x39a/0x500 [ 48.076058][ T794] ? has_cap_mac_admin+0xd0/0xd0 [ 48.076078][ T794] ? selinux_file_ioctl+0x732/0x1480 [ 48.076094][ T794] ? vfs_write+0xbcf/0xfd0 [ 48.076112][ T794] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 48.076130][ T794] ? __cfi_vfs_write+0x10/0x10 [ 48.076148][ T794] ? __kasan_check_write+0x18/0x20 [ 48.076165][ T794] ? mutex_unlock+0x90/0x240 [ 48.076181][ T794] ? __cfi_mutex_unlock+0x10/0x10 [ 48.076200][ T794] ? bpf_lsm_file_ioctl+0xd/0x20 [ 48.076222][ T794] ? security_file_ioctl+0x3e/0x110 [ 48.076238][ T794] ? __cfi__RNvCswPamI0U300_11rust_binder17rust_binder_ioctl+0x10/0x10 [ 48.076264][ T794] __se_sys_ioctl+0x135/0x1b0 [ 48.076285][ T794] __x64_sys_ioctl+0x7f/0xa0 [ 48.076305][ T794] x64_sys_call+0x1878/0x2ee0 [ 48.076321][ T794] do_syscall_64+0x57/0xf0 [ 48.076342][ T794] ? clear_bhb_loop+0x50/0xa0 [ 48.076360][ T794] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 48.076385][ T794] RIP: 0033:0x7f216079e0d9 [ 48.076401][ T794] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 48.076416][ T794] RSP: 002b:00007f216163f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 48.076436][ T794] RAX: ffffffffffffffda RBX: 00007f2160a25fa0 RCX: 00007f216079e0d9 [ 48.076450][ T794] RDX: 0000200000000300 RSI: 00000000c0306201 RDI: 0000000000000003 [ 48.076462][ T794] RBP: 00007f216163f090 R08: 0000000000000000 R09: 0000000000000000 [ 48.076473][ T794] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 48.076484][ T794] R13: 00007f2160a26038 R14: 00007f2160a25fa0 R15: 00007ffdf91f6da8 [ 48.076506][ T794] [ 48.076515][ T794] rust_binder: Write failure EFAULT in pid:131 [ 48.083176][ T376] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 48.114029][ T36] audit: type=1400 audit(1787178446.660:222): avc: denied { bind } for pid=795 comm="syz.1.185" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 48.120434][ T376] usb 4-1: Product: syz [ 48.670987][ T376] usb 4-1: Manufacturer: syz [ 48.676083][ T376] usb 4-1: SerialNumber: syz [ 48.681501][ T311] uvcvideo 3-1:10.91: Found Unit with invalid ID 0 [ 48.688405][ T376] usb 4-1: config 0 descriptor?? [ 48.693832][ T311] usb 3-1: Found UVC 0.40 device syz (097b:61f6) [ 48.702776][ T311] usb 3-1: No valid video chain found. [ 48.710081][ T311] usb 3-1: USB disconnect, device number 7 [ 48.799676][ T312] usb 1-1: device descriptor read/64, error -71 [ 48.904407][ T311] usb 4-1: USB disconnect, device number 9 [ 48.910505][ T312] usb usb1-port1: attempt power cycle [ 49.013179][ T36] audit: type=1400 audit(1787178447.570:223): avc: denied { read write } for pid=801 comm="syz.1.187" name="vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 49.040757][ T36] audit: type=1400 audit(1787178447.570:224): avc: denied { open } for pid=801 comm="syz.1.187" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 49.077322][ T808] FAULT_INJECTION: forcing a failure. [ 49.077322][ T808] name failslab, interval 1, probability 0, space 0, times 0 [ 49.090660][ T808] CPU: 1 UID: 0 PID: 808 Comm: syz.1.188 Not tainted syzkaller #0 03d350d479d1c05c2ac57b56e0973d7fc75f4bbd [ 49.090693][ T808] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 49.090704][ T808] Call Trace: [ 49.090711][ T808] [ 49.090720][ T808] __dump_stack+0x21/0x30 [ 49.090751][ T808] dump_stack_lvl+0x140/0x1c0 [ 49.090776][ T808] ? __cfi_dump_stack_lvl+0x10/0x10 [ 49.090796][ T808] dump_stack+0x19/0x20 [ 49.090810][ T808] should_fail_ex+0x3c2/0x510 [ 49.090823][ T808] should_failslab+0xac/0x100 [ 49.090838][ T808] __kmalloc_cache_noprof+0x41/0x470 [ 49.090853][ T808] ? is_bpf_text_address+0x17b/0x1a0 [ 49.090872][ T808] ? kvm_set_memslot+0x9b/0x13a0 [ 49.090888][ T808] kvm_set_memslot+0x9b/0x13a0 [ 49.090903][ T808] ? __kmalloc_cache_noprof+0x23c/0x470 [ 49.090915][ T808] __kvm_set_memory_region+0x7f7/0xb40 [ 49.090931][ T808] kvm_set_memory_region+0x2f/0x50 [ 49.090941][ T808] kvm_vm_ioctl+0xb01/0xc40 [ 49.090964][ T808] ? __cfi_kvm_vm_ioctl+0x10/0x10 [ 49.090979][ T808] ? ioctl_has_perm+0x1bc/0x500 [ 49.090991][ T808] ? __asan_memcpy+0x5a/0x80 [ 49.091002][ T808] ? ioctl_has_perm+0x408/0x500 [ 49.091013][ T808] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 49.091030][ T808] ? selinux_file_ioctl+0x732/0x1480 [ 49.091041][ T808] ? vfs_write+0xbcf/0xfd0 [ 49.091052][ T808] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 49.091063][ T808] ? __cfi_vfs_write+0x10/0x10 [ 49.091074][ T808] ? __kasan_check_write+0x18/0x20 [ 49.091085][ T808] ? mutex_unlock+0x90/0x240 [ 49.091097][ T808] ? __cfi_mutex_unlock+0x10/0x10 [ 49.091109][ T808] ? bpf_lsm_file_ioctl+0xd/0x20 [ 49.091122][ T808] ? security_file_ioctl+0x3e/0x110 [ 49.091133][ T808] ? __cfi_kvm_vm_ioctl+0x10/0x10 [ 49.091147][ T808] __se_sys_ioctl+0x135/0x1b0 [ 49.091160][ T808] __x64_sys_ioctl+0x7f/0xa0 [ 49.091173][ T808] x64_sys_call+0x1878/0x2ee0 [ 49.091183][ T808] do_syscall_64+0x57/0xf0 [ 49.091197][ T808] ? clear_bhb_loop+0x50/0xa0 [ 49.091208][ T808] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 49.091225][ T808] RIP: 0033:0x7f216079e0d9 [ 49.091237][ T808] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 49.091247][ T808] RSP: 002b:00007f216163f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 49.091261][ T808] RAX: ffffffffffffffda RBX: 00007f2160a25fa0 RCX: 00007f216079e0d9 [ 49.091270][ T808] RDX: 0000200000000100 RSI: 000000004020ae46 RDI: 0000000000000004 [ 49.091279][ T808] RBP: 00007f216163f090 R08: 0000000000000000 R09: 0000000000000000 [ 49.091286][ T808] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 49.091293][ T808] R13: 00007f2160a26038 R14: 00007f2160a25fa0 R15: 00007ffdf91f6da8 [ 49.091303][ T808] [ 49.403074][ T36] audit: type=1400 audit(1787178447.960:225): avc: denied { create } for pid=809 comm="syz.2.189" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=chr_file permissive=1 [ 49.424076][ T812] netlink: 36 bytes leftover after parsing attributes in process `syz.3.190'. [ 49.444633][ T312] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 49.461819][ T36] audit: type=1400 audit(1787178447.960:226): avc: denied { link } for pid=809 comm="syz.2.189" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="ramfs" ino=7808 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=chr_file permissive=1 [ 49.507319][ T312] usb 1-1: device descriptor read/8, error -71 [ 49.572434][ T36] audit: type=1400 audit(1787178448.130:227): avc: denied { map } for pid=821 comm="syz.2.192" path="socket:[7839]" dev="sockfs" ino=7839 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 49.640850][ T312] usb 1-1: device descriptor read/8, error -71 [ 49.683005][ T36] audit: type=1400 audit(1787178448.240:228): avc: denied { read write } for pid=816 comm="syz.1.194" name="event1" dev="devtmpfs" ino=193 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 49.789678][ T10] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 49.879690][ T64] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 49.929657][ T376] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 49.949815][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 49.956035][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 49.966996][ T10] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 49.980249][ T10] usb 4-1: New USB device found, idVendor=056a, idProduct=00fa, bcdDevice= 0.00 [ 49.989384][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 49.998248][ T10] usb 4-1: config 0 descriptor?? [ 50.009690][ T64] usb 3-1: device descriptor read/64, error -71 [ 50.090883][ T376] usb 2-1: config 220 has an invalid interface number: 76 but max is 2 [ 50.099267][ T376] usb 2-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 50.109989][ T376] usb 2-1: config 220 has no interface number 2 [ 50.116362][ T376] usb 2-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 50.130299][ T376] usb 2-1: config 220 interface 0 has no altsetting 0 [ 50.137462][ T376] usb 2-1: config 220 interface 76 has no altsetting 0 [ 50.144592][ T376] usb 2-1: config 220 interface 1 has no altsetting 0 [ 50.153434][ T376] usb 2-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 50.162687][ T376] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 50.171063][ T312] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 50.178607][ T376] usb 2-1: Product: syz [ 50.182840][ T376] usb 2-1: Manufacturer: syz [ 50.187456][ T376] usb 2-1: SerialNumber: syz [ 50.210026][ T312] usb 1-1: Using ep0 maxpacket: 16 [ 50.216384][ T312] usb 1-1: config 0 has an invalid interface number: 105 but max is 0 [ 50.224626][ T312] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 50.235183][ T312] usb 1-1: config 0 has no interface number 0 [ 50.242897][ T312] usb 1-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 50.252309][ T312] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 50.260624][ T312] usb 1-1: Product: syz [ 50.265001][ T312] usb 1-1: Manufacturer: syz [ 50.269639][ T64] usb 3-1: device descriptor read/64, error -71 [ 50.276186][ T312] usb 1-1: SerialNumber: syz [ 50.281933][ T312] usb 1-1: config 0 descriptor?? [ 50.288221][ T312] usb 1-1: Found UVC 0.00 device syz (046d:08f3) [ 50.294836][ T312] usb 1-1: No valid video chain found. [ 50.397965][ T376] usb 2-1: Found UVC 7.01 device syz (8086:0b07) [ 50.404520][ T376] usb 2-1: No valid video chain found. [ 50.410222][ T376] usb 2-1: selecting invalid altsetting 0 [ 50.419167][ T376] usb 2-1: USB disconnect, device number 7 [ 50.494286][ T312] usb 1-1: USB disconnect, device number 8 [ 50.509789][ T64] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 50.611848][ T10] usbhid 4-1:0.0: can't add hid device: -71 [ 50.617850][ T10] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 50.626688][ T10] usb 4-1: USB disconnect, device number 10 [ 50.639709][ T64] usb 3-1: device descriptor read/64, error -71 [ 50.879715][ T64] usb 3-1: device descriptor read/64, error -71 [ 50.989859][ T64] usb usb3-port1: attempt power cycle [ 51.006542][ T833] FAULT_INJECTION: forcing a failure. [ 51.006542][ T833] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 51.019767][ T833] CPU: 1 UID: 0 PID: 833 Comm: syz.0.200 Not tainted syzkaller #0 03d350d479d1c05c2ac57b56e0973d7fc75f4bbd [ 51.019798][ T833] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 51.019810][ T833] Call Trace: [ 51.019818][ T833] [ 51.019825][ T833] __dump_stack+0x21/0x30 [ 51.019857][ T833] dump_stack_lvl+0x140/0x1c0 [ 51.019882][ T833] ? __cfi_dump_stack_lvl+0x10/0x10 [ 51.019908][ T833] dump_stack+0x19/0x20 [ 51.019932][ T833] should_fail_ex+0x3c2/0x510 [ 51.019954][ T833] should_fail+0xf/0x20 [ 51.019974][ T833] should_fail_usercopy+0x1e/0x30 [ 51.019995][ T833] _copy_to_user+0x24/0xa0 [ 51.020011][ T833] _RNvCswPamI0U300_11rust_binder17rust_binder_ioctl+0x3370/0x3fe0 [ 51.020030][ T833] ? __asan_set_shadow_00+0x12/0x20 [ 51.020046][ T833] ? do_vfs_ioctl+0x182d/0x2010 [ 51.020060][ T833] ? arch_stack_walk+0x10a/0x170 [ 51.020072][ T833] ? __ia32_compat_sys_ioctl+0x920/0x920 [ 51.020086][ T833] ? __cfi__RNvCswPamI0U300_11rust_binder17rust_binder_ioctl+0x10/0x10 [ 51.020104][ T833] ? _parse_integer+0x2e/0x40 [ 51.020117][ T833] ? ioctl_has_perm+0x39a/0x500 [ 51.020129][ T833] ? has_cap_mac_admin+0xd0/0xd0 [ 51.020142][ T833] ? selinux_file_ioctl+0x732/0x1480 [ 51.020153][ T833] ? vfs_write+0xbcf/0xfd0 [ 51.020164][ T833] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 51.020176][ T833] ? __cfi_vfs_write+0x10/0x10 [ 51.020187][ T833] ? __kasan_check_write+0x18/0x20 [ 51.020198][ T833] ? mutex_unlock+0x90/0x240 [ 51.020210][ T833] ? __cfi_mutex_unlock+0x10/0x10 [ 51.020222][ T833] ? bpf_lsm_file_ioctl+0xd/0x20 [ 51.020236][ T833] ? security_file_ioctl+0x3e/0x110 [ 51.020246][ T833] ? __cfi__RNvCswPamI0U300_11rust_binder17rust_binder_ioctl+0x10/0x10 [ 51.020271][ T833] __se_sys_ioctl+0x135/0x1b0 [ 51.020285][ T833] __x64_sys_ioctl+0x7f/0xa0 [ 51.020298][ T833] x64_sys_call+0x1878/0x2ee0 [ 51.020309][ T833] do_syscall_64+0x57/0xf0 [ 51.020324][ T833] ? clear_bhb_loop+0x50/0xa0 [ 51.020335][ T833] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 51.020352][ T833] RIP: 0033:0x7fee8a99e0d9 [ 51.020363][ T833] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 51.020373][ T833] RSP: 002b:00007fee8b948028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 51.020387][ T833] RAX: ffffffffffffffda RBX: 00007fee8ac25fa0 RCX: 00007fee8a99e0d9 [ 51.020396][ T833] RDX: 0000200000000300 RSI: 00000000c0306201 RDI: 0000000000000003 [ 51.020404][ T833] RBP: 00007fee8b948090 R08: 0000000000000000 R09: 0000000000000000 [ 51.020411][ T833] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 51.020419][ T833] R13: 00007fee8ac26038 R14: 00007fee8ac25fa0 R15: 00007ffcfa67b598 [ 51.020428][ T833] [ 51.030203][ T835] capability: warning: `syz.0.201' uses deprecated v2 capabilities in a way that may be insecure [ 51.179660][ T312] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 51.449702][ T64] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 51.470877][ T64] usb 3-1: device descriptor read/8, error -71 [ 51.480950][ T312] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 51.491233][ T312] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 51.504778][ T312] usb 2-1: New USB device found, idVendor=04d8, idProduct=c002, bcdDevice= 0.00 [ 51.514229][ T312] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 51.527671][ T312] usbhid 2-1:1.0: couldn't find an input interrupt endpoint [ 51.600781][ T64] usb 3-1: device descriptor read/8, error -71 [ 51.731047][ T831] netlink: 4 bytes leftover after parsing attributes in process `syz.1.199'. [ 51.740894][ T10] usb 2-1: USB disconnect, device number 8 [ 51.839699][ T64] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 51.861035][ T64] usb 3-1: device descriptor read/8, error -71 [ 51.949697][ T312] usb 4-1: new full-speed USB device number 11 using dummy_hcd [ 51.990938][ T64] usb 3-1: device descriptor read/8, error -71 [ 52.079686][ T312] usb 4-1: device descriptor read/64, error -71 [ 52.099805][ T64] usb usb3-port1: unable to enumerate USB device [ 52.319807][ T312] usb 4-1: device descriptor read/64, error -71 [ 52.324195][ T866] netlink: 'syz.1.213': attribute type 11 has an invalid length. [ 52.326241][ T36] kauditd_printk_skb: 2 callbacks suppressed [ 52.326256][ T36] audit: type=1400 audit(1787178450.880:231): avc: denied { listen } for pid=865 comm="syz.1.213" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 52.360572][ T36] audit: type=1400 audit(1787178450.880:232): avc: denied { ioctl } for pid=865 comm="syz.1.213" path="socket:[8191]" dev="sockfs" ino=8191 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 52.419753][ T376] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 52.465345][ T869] FAULT_INJECTION: forcing a failure. [ 52.465345][ T869] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 52.479046][ T869] CPU: 0 UID: 0 PID: 869 Comm: syz.1.214 Not tainted syzkaller #0 03d350d479d1c05c2ac57b56e0973d7fc75f4bbd [ 52.479093][ T869] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 52.479106][ T869] Call Trace: [ 52.479133][ T869] [ 52.479140][ T869] __dump_stack+0x21/0x30 [ 52.479174][ T869] dump_stack_lvl+0x140/0x1c0 [ 52.479199][ T869] ? __cfi_dump_stack_lvl+0x10/0x10 [ 52.479224][ T869] ? check_stack_object+0x138/0x150 [ 52.479246][ T869] dump_stack+0x19/0x20 [ 52.479269][ T869] should_fail_ex+0x3c2/0x510 [ 52.479289][ T869] should_fail+0xf/0x20 [ 52.479305][ T869] should_fail_usercopy+0x1e/0x30 [ 52.479318][ T869] _copy_to_user+0x24/0xa0 [ 52.479332][ T869] simple_read_from_buffer+0xed/0x160 [ 52.479348][ T869] proc_fail_nth_read+0x1aa/0x220 [ 52.479364][ T869] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 52.479380][ T869] ? bpf_lsm_file_permission+0xd/0x20 [ 52.479395][ T869] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 52.479409][ T869] vfs_read+0x288/0xc70 [ 52.479420][ T869] ? fput+0x1a4/0x230 [ 52.479434][ T869] ? __cfi_vfs_read+0x10/0x10 [ 52.479445][ T869] ? __kasan_check_write+0x18/0x20 [ 52.479464][ T869] ? mutex_lock+0x97/0x1d0 [ 52.479475][ T869] ? __cfi_mutex_lock+0x10/0x10 [ 52.479487][ T869] ksys_read+0x145/0x260 [ 52.479498][ T869] ? __cfi_ksys_read+0x10/0x10 [ 52.479510][ T869] ? __kasan_check_read+0x15/0x20 [ 52.479521][ T869] __x64_sys_read+0x7f/0x90 [ 52.479533][ T869] x64_sys_call+0x2638/0x2ee0 [ 52.479543][ T869] do_syscall_64+0x57/0xf0 [ 52.479557][ T869] ? clear_bhb_loop+0x50/0xa0 [ 52.479568][ T869] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 52.479596][ T869] RIP: 0033:0x7f216075e90e [ 52.479614][ T869] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 52.479631][ T869] RSP: 002b:00007f216163efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 52.479654][ T869] RAX: ffffffffffffffda RBX: 00007f216163f6c0 RCX: 00007f216075e90e [ 52.479669][ T869] RDX: 000000000000000f RSI: 00007f216163f0a0 RDI: 0000000000000004 [ 52.479682][ T869] RBP: 00007f216163f090 R08: 0000000000000000 R09: 0000000000000000 [ 52.479694][ T869] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 52.479705][ T869] R13: 00007f2160a26038 R14: 00007f2160a25fa0 R15: 00007ffdf91f6da8 [ 52.479734][ T869] [ 52.749632][ T376] usb 1-1: Using ep0 maxpacket: 32 [ 52.758647][ T376] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 52.772554][ T873] netlink: 44 bytes leftover after parsing attributes in process `syz.2.217'. [ 52.774718][ T376] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 52.794654][ T312] usb 4-1: new full-speed USB device number 12 using dummy_hcd [ 52.802758][ T36] audit: type=1326 audit(1787178451.350:233): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=874 comm="syz.1.216" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f216079e0d9 code=0x7ff00000 [ 52.829449][ T376] usb 1-1: New USB device found, idVendor=056a, idProduct=00fa, bcdDevice= 0.00 [ 52.831332][ T36] audit: type=1326 audit(1787178451.350:234): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=874 comm="syz.1.216" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f216079e0d9 code=0x7ff00000 [ 52.840353][ T376] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 52.866383][ T36] audit: type=1326 audit(1787178451.350:235): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=874 comm="syz.1.216" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f216079e0d9 code=0x7ff00000 [ 52.878636][ T376] usb 1-1: config 0 descriptor?? [ 52.900096][ T36] audit: type=1326 audit(1787178451.350:236): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=874 comm="syz.1.216" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f216079e0d9 code=0x7ff00000 [ 52.930587][ T36] audit: type=1326 audit(1787178451.350:237): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=874 comm="syz.1.216" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f216079e0d9 code=0x7ff00000 [ 52.956831][ T36] audit: type=1326 audit(1787178451.350:238): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=874 comm="syz.1.216" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f216079e0d9 code=0x7ff00000 [ 52.981953][ T312] usb 4-1: device descriptor read/64, error -71 [ 52.984339][ T880] netlink: 'syz.1.216': attribute type 1 has an invalid length. [ 52.988388][ T36] audit: type=1326 audit(1787178451.350:239): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=874 comm="syz.1.216" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f216079e0d9 code=0x7ff00000 [ 53.021171][ T36] audit: type=1326 audit(1787178451.350:240): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=874 comm="syz.1.216" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f216079e0d9 code=0x7ff00000 [ 53.179641][ T64] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 53.219652][ T312] usb 4-1: device descriptor read/64, error -71 [ 53.329639][ T64] usb 3-1: device descriptor read/64, error -71 [ 53.329792][ T312] usb usb4-port1: attempt power cycle [ 53.512163][ T376] usbhid 1-1:0.0: can't add hid device: -71 [ 53.518293][ T376] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 53.531958][ T376] usb 1-1: USB disconnect, device number 9 [ 53.569643][ T64] usb 3-1: device descriptor read/64, error -71 [ 53.699743][ T312] usb 4-1: new full-speed USB device number 13 using dummy_hcd [ 53.720797][ T312] usb 4-1: device descriptor read/8, error -71 [ 53.819710][ T64] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 53.849659][ T10] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 53.850773][ T312] usb 4-1: device descriptor read/8, error -71 [ 53.949697][ T64] usb 3-1: device descriptor read/64, error -71 [ 53.999690][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 54.006025][ T10] usb 2-1: config 64 has an invalid interface number: 238 but max is 0 [ 54.014542][ T10] usb 2-1: config 64 has an invalid descriptor of length 0, skipping remainder of the config [ 54.025264][ T10] usb 2-1: config 64 has no interface number 0 [ 54.031923][ T10] usb 2-1: config 64 interface 238 has no altsetting 0 [ 54.038622][ T884] netlink: 36 bytes leftover after parsing attributes in process `syz.0.220'. [ 54.040670][ T10] usb 2-1: New USB device found, idVendor=046d, idProduct=087c, bcdDevice=b0.7a [ 54.057780][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 54.066115][ T10] usb 2-1: Product: syz [ 54.070874][ T10] usb 2-1: Manufacturer: syz [ 54.075687][ T10] usb 2-1: SerialNumber: syz [ 54.099719][ T312] usb 4-1: new full-speed USB device number 14 using dummy_hcd [ 54.120692][ T312] usb 4-1: device descriptor read/8, error -71 [ 54.209695][ T64] usb 3-1: device descriptor read/64, error -71 [ 54.250829][ T312] usb 4-1: device descriptor read/8, error -71 [ 54.285271][ T10] uvcvideo 2-1:64.238: Found Unit with invalid ID 0 [ 54.292036][ T10] usb 2-1: Found UVC 0.00 device syz (046d:087c) [ 54.298397][ T10] usb 2-1: No valid video chain found. [ 54.305185][ T10] usb 2-1: USB disconnect, device number 9 [ 54.319949][ T64] usb usb3-port1: attempt power cycle [ 54.359881][ T312] usb usb4-port1: unable to enumerate USB device [ 54.659661][ T64] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 54.688377][ T64] usb 3-1: device descriptor read/8, error -71 [ 54.712061][ T895] netlink: 36 bytes leftover after parsing attributes in process `syz.3.225'. [ 54.821311][ T64] usb 3-1: device descriptor read/8, error -71 [ 54.912551][ T12] Bluetooth: hci0: Frame reassembly failed (-84) [ 55.069675][ T64] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 55.090867][ T64] usb 3-1: device descriptor read/8, error -71 [ 55.119661][ T312] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 55.230812][ T64] usb 3-1: device descriptor read/8, error -71 [ 55.269666][ T312] usb 4-1: Using ep0 maxpacket: 32 [ 55.276195][ T312] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 55.288315][ T312] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 55.298643][ T312] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 55.307730][ T312] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 55.316580][ T312] usb 4-1: config 0 descriptor?? [ 55.323786][ T312] hub 4-1:0.0: USB hub found [ 55.339854][ T64] usb usb3-port1: unable to enumerate USB device [ 55.499655][ T374] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 55.523930][ T312] hub 4-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 55.649684][ T374] usb 1-1: Using ep0 maxpacket: 16 [ 55.656356][ T374] usb 1-1: config 0 has an invalid interface number: 105 but max is 0 [ 55.664681][ T374] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 55.675138][ T374] usb 1-1: config 0 has no interface number 0 [ 55.682782][ T374] usb 1-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 55.691995][ T374] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 55.700070][ T374] usb 1-1: Product: syz [ 55.704376][ T374] usb 1-1: Manufacturer: syz [ 55.709161][ T374] usb 1-1: SerialNumber: syz [ 55.714674][ T374] usb 1-1: config 0 descriptor?? [ 55.720921][ T374] usb 1-1: Found UVC 0.00 device syz (046d:08f3) [ 55.727322][ T374] usb 1-1: No valid video chain found. [ 55.738583][ T312] hid-generic 0003:046D:C31C.0003: item fetching failed at offset 0/1 [ 55.746994][ T312] hid-generic 0003:046D:C31C.0003: probe with driver hid-generic failed with error -22 [ 55.829227][ T919] overlayfs: missing 'lowerdir' [ 55.837255][ T921] netlink: 4 bytes leftover after parsing attributes in process `syz.2.235'. [ 55.922760][ T312] usb 1-1: USB disconnect, device number 10 [ 56.039784][ T311] usb 4-1: USB disconnect, device number 15 [ 56.471727][ T943] random: crng reseeded on system resumption [ 56.595186][ T953] SELinux: Context system_u:object_r:iptables_exec_t:s0 is not valid (left unmapped). [ 56.721099][ T961] netlink: 36 bytes leftover after parsing attributes in process `syz.2.253'. [ 56.749653][ T312] usb 4-1: new full-speed USB device number 16 using dummy_hcd [ 56.859714][ T311] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 56.901403][ T312] usb 4-1: not running at top speed; connect to a high speed hub [ 56.910242][ T312] usb 4-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 56.920691][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 56.920691][ T312] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 56.920740][ T312] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 56.950920][ T312] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 56.960013][ T312] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 56.968014][ T312] usb 4-1: Product: Ќ [ 56.972194][ T312] usb 4-1: Manufacturer: 霹梔⎗䵯Šⱽ氀Ҥ׶䈷顤륳푕䗒ባ薕絺麴ჽ낇쨏곌涿暧髖麧 [ 56.983682][ T312] usb 4-1: SerialNumber: 욀쏖閌쓙㏄臩ŻⳲ᭘瀊뭞搷쑼﹙垍詍扵폑㖍獂䡮꒠⮡㦎䯐俎準 [ 56.989657][ T64] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 57.019749][ T311] usb 1-1: Using ep0 maxpacket: 16 [ 57.026096][ T311] usb 1-1: config 0 has an invalid interface number: 105 but max is 0 [ 57.034323][ T311] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 57.044525][ T311] usb 1-1: config 0 has no interface number 0 [ 57.052060][ T311] usb 1-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 57.061187][ T311] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 57.069838][ T311] usb 1-1: Product: syz [ 57.074237][ T311] usb 1-1: Manufacturer: syz [ 57.078837][ T311] usb 1-1: SerialNumber: syz [ 57.084294][ T311] usb 1-1: config 0 descriptor?? [ 57.090411][ T311] usb 1-1: Found UVC 0.00 device syz (046d:08f3) [ 57.096825][ T311] usb 1-1: No valid video chain found. [ 57.149666][ T64] usb 3-1: Using ep0 maxpacket: 32 [ 57.157384][ T64] usb 3-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 57.166526][ T64] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 57.174558][ T64] usb 3-1: Product: syz [ 57.178734][ T64] usb 3-1: Manufacturer: syz [ 57.183346][ T64] usb 3-1: SerialNumber: syz [ 57.205459][ T312] cdc_ncm 4-1:1.0: CDC Union missing and no IAD found [ 57.212954][ T312] cdc_ncm 4-1:1.0: bind() failure [ 57.220784][ T312] usb 4-1: USB disconnect, device number 16 [ 57.292679][ T374] usb 1-1: USB disconnect, device number 11 [ 57.390808][ T963] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 57.399381][ T963] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 57.413881][ T963] netlink: 'syz.2.254': attribute type 10 has an invalid length. [ 57.423357][ T963] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 57.432703][ T963] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 57.460662][ T64] usb 3-1: USB disconnect, device number 16 [ 57.582419][ T969] FAULT_INJECTION: forcing a failure. [ 57.582419][ T969] name failslab, interval 1, probability 0, space 0, times 0 [ 57.596360][ T969] CPU: 0 UID: 0 PID: 969 Comm: syz.1.256 Not tainted syzkaller #0 03d350d479d1c05c2ac57b56e0973d7fc75f4bbd [ 57.596396][ T969] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 57.596405][ T969] Call Trace: [ 57.596410][ T969] [ 57.596416][ T969] __dump_stack+0x21/0x30 [ 57.596437][ T969] dump_stack_lvl+0x140/0x1c0 [ 57.596452][ T969] ? __cfi_dump_stack_lvl+0x10/0x10 [ 57.596466][ T969] ? avc_has_perm+0x155/0x240 [ 57.596480][ T969] ? __cfi_avc_has_perm+0x10/0x10 [ 57.596493][ T969] dump_stack+0x19/0x20 [ 57.596507][ T969] should_fail_ex+0x3c2/0x510 [ 57.596520][ T969] should_failslab+0xac/0x100 [ 57.596534][ T969] __kmalloc_cache_noprof+0x41/0x470 [ 57.596548][ T969] ? vhost_task_create+0x12c/0x3f0 [ 57.596560][ T969] ? __cfi_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 57.596574][ T969] vhost_task_create+0x12c/0x3f0 [ 57.596586][ T969] ? __cfi_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 57.596599][ T969] ? __cfi_vhost_task_create+0x10/0x10 [ 57.596612][ T969] ? __cfi_vhost_task_fn+0x10/0x10 [ 57.596623][ T969] ? __kasan_check_write+0x18/0x20 [ 57.596634][ T969] ? mutex_lock+0x97/0x1d0 [ 57.596645][ T969] ? __cfi_mutex_lock+0x10/0x10 [ 57.596655][ T969] ? kernel_text_address+0xa9/0xe0 [ 57.596670][ T969] kvm_mmu_post_init_vm+0x161/0x300 [ 57.596686][ T969] kvm_arch_vcpu_ioctl_run+0xf3/0x1bc0 [ 57.596701][ T969] ? _parse_integer_limit+0x195/0x1e0 [ 57.596717][ T969] ? __cfi_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 57.596733][ T969] ? kstrtoull+0x13b/0x1e0 [ 57.596744][ T969] ? kstrtouint+0x78/0xf0 [ 57.596755][ T969] ? ioctl_has_perm+0x1bc/0x500 [ 57.596767][ T969] ? __asan_memcpy+0x5a/0x80 [ 57.596777][ T969] ? ioctl_has_perm+0x408/0x500 [ 57.596788][ T969] ? has_cap_mac_admin+0xd0/0xd0 [ 57.596807][ T969] ? __kasan_check_write+0x18/0x20 [ 57.596818][ T969] ? mutex_lock_killable+0x97/0x1d0 [ 57.596829][ T969] ? __cfi_mutex_lock_killable+0x10/0x10 [ 57.596841][ T969] ? proc_fail_nth_write+0x184/0x220 [ 57.596858][ T969] kvm_vcpu_ioctl+0xa43/0x1000 [ 57.596870][ T969] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 57.596881][ T969] ? __cfi_vfs_write+0x10/0x10 [ 57.596893][ T969] ? __kasan_check_write+0x18/0x20 [ 57.596904][ T969] ? mutex_unlock+0x90/0x240 [ 57.596914][ T969] ? __cfi_mutex_unlock+0x10/0x10 [ 57.596926][ T969] ? bpf_lsm_file_ioctl+0xd/0x20 [ 57.596940][ T969] ? security_file_ioctl+0x3e/0x110 [ 57.596951][ T969] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 57.596962][ T969] __se_sys_ioctl+0x135/0x1b0 [ 57.596975][ T969] __x64_sys_ioctl+0x7f/0xa0 [ 57.596988][ T969] x64_sys_call+0x1878/0x2ee0 [ 57.596999][ T969] do_syscall_64+0x57/0xf0 [ 57.597012][ T969] ? clear_bhb_loop+0x50/0xa0 [ 57.597024][ T969] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 57.597040][ T969] RIP: 0033:0x7f216079e0d9 [ 57.597052][ T969] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 57.597062][ T969] RSP: 002b:00007f216163f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 57.597076][ T969] RAX: ffffffffffffffda RBX: 00007f2160a25fa0 RCX: 00007f216079e0d9 [ 57.597085][ T969] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 57.597093][ T969] RBP: 00007f216163f090 R08: 0000000000000000 R09: 0000000000000000 [ 57.597100][ T969] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 57.597108][ T969] R13: 00007f2160a26038 R14: 00007f2160a25fa0 R15: 00007ffdf91f6da8 [ 57.597117][ T969] [ 57.979808][ T36] kauditd_printk_skb: 6806 callbacks suppressed [ 57.979826][ T36] audit: type=1400 audit(1787178456.530:7047): avc: denied { name_bind } for pid=972 comm="syz.2.258" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 58.019240][ T36] audit: type=1400 audit(1787178456.570:7048): avc: denied { ioctl } for pid=975 comm="syz.1.259" path="mnt:[4026532296]" dev="nsfs" ino=4026532296 ioctlcmd=0xb705 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 58.052955][ T36] audit: type=1400 audit(1787178456.600:7049): avc: denied { getopt } for pid=972 comm="syz.2.258" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 58.339682][ T10] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 58.419672][ T312] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 58.502098][ T10] usb 2-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 58.511261][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 58.520577][ T10] usb 2-1: Product: syz [ 58.524767][ T10] usb 2-1: Manufacturer: syz [ 58.529395][ T10] usb 2-1: SerialNumber: syz [ 58.570758][ T312] usb 1-1: config 220 has an invalid interface number: 76 but max is 2 [ 58.579511][ T312] usb 1-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 58.589948][ T312] usb 1-1: config 220 has no interface number 2 [ 58.596270][ T312] usb 1-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 58.611787][ T702] Bluetooth: hci0: Frame reassembly failed (-84) [ 58.615064][ T312] usb 1-1: config 220 interface 0 has no altsetting 0 [ 58.626526][ T312] usb 1-1: config 220 interface 76 has no altsetting 0 [ 58.633689][ T312] usb 1-1: config 220 interface 1 has no altsetting 0 [ 58.642222][ T312] usb 1-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 58.651584][ T312] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 58.659640][ T312] usb 1-1: Product: syz [ 58.663845][ T312] usb 1-1: Manufacturer: syz [ 58.668518][ T312] usb 1-1: SerialNumber: syz [ 58.755049][ T10] rtl8150 2-1:1.0: couldn't reset the device [ 58.761357][ T10] rtl8150 2-1:1.0: probe with driver rtl8150 failed with error -5 [ 58.770834][ T10] usb 2-1: USB disconnect, device number 10 [ 58.883438][ T312] usb 1-1: Found UVC 7.01 device syz (8086:0b07) [ 58.889845][ T993] device-mapper: ioctl: Unable to rename non-existent device, to uuid [ 58.898446][ T312] usb 1-1: No valid video chain found. [ 58.903993][ T312] usb 1-1: selecting invalid altsetting 0 [ 58.912888][ T312] usb 1-1: USB disconnect, device number 12 [ 59.348011][ T999] ------------[ cut here ]------------ [ 59.353581][ T999] WARNING: CPU: 0 PID: 999 at mm/page_alloc.c:5285 __alloc_pages_noprof+0x109/0x7e0 [ 59.363020][ T999] Modules linked in: [ 59.366920][ T999] CPU: 0 UID: 0 PID: 999 Comm: syz.1.268 Not tainted syzkaller #0 03d350d479d1c05c2ac57b56e0973d7fc75f4bbd [ 59.378488][ T999] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 59.388706][ T999] RIP: 0010:__alloc_pages_noprof+0x109/0x7e0 [ 59.394762][ T999] Code: 00 0f 1f 44 00 00 83 fb 0b 72 28 b8 00 20 00 00 23 44 24 40 75 1d 80 3d 84 c4 0b 06 00 0f 85 c2 00 00 00 c6 05 77 c4 0b 06 01 <0f> 0b 31 c0 e9 b4 00 00 00 83 fb 0a 0f 87 a9 00 00 00 44 8b 64 24 [ 59.414636][ T999] RSP: 0018:ffffc9000fa5f8c0 EFLAGS: 00010246 [ 59.421063][ T999] RAX: 0000000000000000 RBX: 0000000000000013 RCX: 0000000000000000 [ 59.429075][ T999] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000fa5f978 [ 59.437089][ T999] RBP: ffffc9000fa5f9f0 R08: ffffc9000fa5f977 R09: 0000000000000000 [ 59.439658][ T36] audit: type=1400 audit(1787178457.980:7050): avc: denied { write } for pid=998 comm="syz.1.268" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 59.445235][ T999] R10: ffffc9000fa5f960 R11: fffff52001f4bf2f R12: ffffc9000fa5f900 [ 59.472182][ T999] R13: dffffc0000000000 R14: 1ffff92001f4bf1c R15: 0000000000000000 [ 59.480204][ T999] FS: 00007f216163f6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 59.483424][ T36] audit: type=1400 audit(1787178458.040:7051): avc: denied { accept } for pid=998 comm="syz.1.268" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 59.489157][ T999] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 59.489180][ T999] CR2: 0000000000000000 CR3: 000000010df36000 CR4: 00000000003526b0 [ 59.489200][ T999] DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000002 [ 59.531637][ T999] DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 59.539756][ T999] Call Trace: [ 59.543075][ T999] [ 59.546041][ T999] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 59.551922][ T999] ? plist_add+0x4d4/0x570 [ 59.556393][ T999] ? __futex_queue+0x19f/0x350 [ 59.561309][ T999] ___kmalloc_large_node+0x81/0x220 [ 59.566537][ T999] __kmalloc_large_node_noprof+0x1e/0xd0 [ 59.572294][ T999] __kmalloc_node_track_caller_noprof+0x30d/0x4f0 [ 59.578734][ T999] ? bitmap_parse_user+0x29/0x80 [ 59.583801][ T999] memdup_user_nul+0x40/0x1a0 [ 59.588502][ T999] ? bitmap_parse_user+0x1f/0x80 [ 59.593586][ T999] bitmap_parse_user+0x29/0x80 [ 59.598474][ T999] irq_affinity_proc_write+0x139/0x230 [ 59.604077][ T999] ? __cfi_irq_affinity_proc_write+0x10/0x10 [ 59.610386][ T999] ? futex_wait+0x2b8/0x7c0 [ 59.614919][ T999] ? __cfi_irq_affinity_proc_write+0x10/0x10 [ 59.620930][ T999] proc_reg_write+0x1fa/0x2f0 [ 59.625722][ T999] ? __cfi_proc_reg_write+0x10/0x10 [ 59.631039][ T999] vfs_write+0x3c4/0xfd0 [ 59.635386][ T999] ? __cfi_vfs_write+0x10/0x10 [ 59.640192][ T999] ? __kasan_check_write+0x18/0x20 [ 59.645421][ T999] ? mutex_lock+0x97/0x1d0 [ 59.649882][ T999] ? __cfi_mutex_lock+0x10/0x10 [ 59.654850][ T999] ksys_write+0x145/0x260 [ 59.659218][ T999] ? __cfi_ksys_write+0x10/0x10 [ 59.664154][ T999] ? __kasan_check_write+0x18/0x20 [ 59.669316][ T999] ? fpregs_restore_userregs+0x11c/0x260 [ 59.675091][ T999] __x64_sys_write+0x7f/0x90 [ 59.679910][ T999] x64_sys_call+0x271c/0x2ee0 [ 59.684618][ T999] do_syscall_64+0x57/0xf0 [ 59.689153][ T999] ? clear_bhb_loop+0x50/0xa0 [ 59.693906][ T999] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 59.699967][ T999] RIP: 0033:0x7f216079e0d9 [ 59.704528][ T999] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 59.724375][ T999] RSP: 002b:00007f216163f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 59.732843][ T999] RAX: ffffffffffffffda RBX: 00007f2160a25fa0 RCX: 00007f216079e0d9 [ 59.740877][ T999] RDX: 00000000fffffde3 RSI: 0000200000000140 RDI: 0000000000000003 [ 59.748869][ T999] RBP: 00007f2160835024 R08: 0000000000000000 R09: 0000000000000000 [ 59.756907][ T999] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 59.764932][ T999] R13: 00007f2160a26038 R14: 00007f2160a25fa0 R15: 00007ffdf91f6da8 [ 59.772945][ T999] [ 59.775972][ T999] ---[ end trace 0000000000000000 ]--- [ 60.679768][ T362] Bluetooth: hci0: command 0x1003 tx timeout [ 60.679782][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -110