last executing test programs: 3.732157038s ago: executing program 3 (id=84): lsetxattr(&(0x7f0000001680)='.\x00', &(0x7f00000016c0)=@known='security.selinux\x00', &(0x7f0000001700)='/]/\'):\x8c', 0x7, 0x3) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000000000/0x400000)=nil) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0xf, {[@main=@item_012={0x0, 0x0, 0xb}, @main=@item_4={0x3, 0x0, 0x8, "62966124"}, @global=@item_012={0x1, 0x1, 0x8, "f5"}, @global=@item_012={0x1, 0x1, 0x7, "86"}, @main=@item_4={0x3, 0x0, 0xb, "4070f43f"}]}}, 0x0}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socket$netlink(0x10, 0x3, 0xf) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) ioctl$HIDIOCGUSAGE(r1, 0xc018480b, &(0x7f00000002c0)={0x3, 0x200, 0x8505, 0x2, 0x9, 0x2}) 1.571715881s ago: executing program 1 (id=99): r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x970a40, 0x6ab858183a7ef6cb) r1 = inotify_init1(0x80000) inotify_add_watch(r1, &(0x7f0000000080)='./file2\x00', 0x120) truncate(&(0x7f0000000040)='./file2\x00', 0x10003) finit_module(r0, 0xfffffffffffffffe, 0x3) 1.273775078s ago: executing program 1 (id=102): r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x270}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000ff9000/0x4000)=nil, 0x4000}, 0x3}) 1.273557278s ago: executing program 1 (id=104): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING(r1, 0x4068aea3, &(0x7f0000000000)={0xc0, 0x0, 0x10000}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000080000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x11, r2, 0x40000) r3 = eventfd(0x7ff) read(r3, &(0x7f0000001000), 0x8) ioctl$KVM_RESET_DIRTY_RINGS(r1, 0xaec7) 1.273512898s ago: executing program 2 (id=105): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) bind$packet(r1, &(0x7f0000000100)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) close_range(r0, 0xffffffffffffffff, 0x0) 1.273447958s ago: executing program 2 (id=106): timer_create(0x1, 0x0, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x1fc) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, 0x0, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r2, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) recvfrom$inet(r2, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) 504.434947ms ago: executing program 2 (id=108): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r0 = openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0) pwritev(r0, &(0x7f0000000200)=[{&(0x7f0000001080)="d07188e7074c65622a40bbba1e15d8e8631b30abb2d08cc83bbad0f3470c270928133f65410ec0086a3770ee39947f3bbf632918164df36539dddab1eece73e6b6e6b1313e5216ab25b7904a39d3310508eb256d51bcd6de7223c8b626220c80e61b4aeafc8e12a93056c11010a26d7051ef91cca36d4887166f30f70783142b7abdf535acad79a54ed7f40d1d7ac4b968f44d5578cb84f4bf45729c287eb349bf340127711aaabcdcb6e0b8792fd0fab96861d72876e8dd0057230868a6449c3d9d7025cf0446c5d1b59fc061fe7913440d73600000003bf4d229aab291e71a2ef48569d01ca3c71ce6ed180aef31432c6b4430aed16c85ccc57f2af9d41a0fb7662eda15583c7e57cb0732289259ed63771a5209f69f013f02f22c384d747cfc820c2ea92d4d6a593754fbf4fee936f8ac916b21814f77350525aa4e1e523ff0f9b4e6d1811265e72d84a6935167c28fbe3b64b75481a697157236db412fbda9ceec9119ffca"}, {&(0x7f0000001200)="2698a0e773ffbe3a7d5d146e8e375b02bbec1dcc2357f2c5b8be0db698cac255fc233e77231ac7fc0c27b5c0fbc28e9d50a723c30897472bbdc6bd8c5901a5a7a902fcc36167f4a58d743db0f2f05b534ab0ae88e8229891315735c693330bbacb188d4a053db173f2802417ffc5e697987b39ef769fa18d272d7e4756daaad7f56acc2c5ebce2d7ae7b229aab7ad289d94e9c6e334500a90abe1d54f7998f12da175b3433f8ae8e0ffed3b60324c5357cc861e4366e65e76c80311fb71725aa9c068575cc66f17597835d0f", 0x3}], 0x2, 0xf7ffffff, 0x3) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) 414.295299ms ago: executing program 0 (id=109): r0 = syz_open_dev$rtc(&(0x7f0000000040), 0x8002, 0x1) ioctl$int_in(r0, 0x5452, &(0x7f0000000080)=0x9) 350.230391ms ago: executing program 0 (id=110): r0 = landlock_create_ruleset(&(0x7f0000000080)={0x10}, 0x10, 0x0) landlock_restrict_self(r0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r2 = landlock_create_ruleset(&(0x7f00000002c0)={0x7d6a}, 0x30, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r2, 0x1, &(0x7f0000000380)={0x7162, r1}, 0x0) landlock_restrict_self(r2, 0x0) symlinkat(&(0x7f0000000700)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') renameat2(r1, &(0x7f00000003c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', r1, &(0x7f0000000840)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x4) 350.006101ms ago: executing program 1 (id=111): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/cpu/cpu1/online\x00', 0x2, 0x0) r1 = dup(r0) read$FUSE(r1, &(0x7f0000000140)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_STATX(r1, &(0x7f0000003ac0)={0x130, 0x0, r2, {0x1, 0x100, 0x0, '\x00', {0x1000, 0x6, 0xb, 0xffff, 0x0, 0x0, 0xa000, '\x00', 0xffffffff00000000, 0x2, 0x80000000, 0x1, {0x4, 0x8}, {0x4, 0x2}, {0x5, 0x4}, {0xdc, 0x2}, 0x3, 0x7fff, 0xc68}}}, 0x130) 349.931781ms ago: executing program 0 (id=112): r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r0) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r1 = gettid() r2 = syz_open_procfs(r1, &(0x7f00000001c0)='timerslack_ns\x00') write$binfmt_format(r2, &(0x7f0000000280)='0\x00', 0x2) 343.785171ms ago: executing program 3 (id=113): r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000400)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000200000000000006040000000000f93132", 0x39}], 0x1) 320.585862ms ago: executing program 0 (id=114): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$sock_buf(r0, 0x1, 0x38, &(0x7f0000000640)=""/118, &(0x7f0000000600)=0x76) 210.076475ms ago: executing program 3 (id=115): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000440)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010825bd7000fedbdf250b00000008000300", @ANYRES32=r2, @ANYBLOB="0a0006000802110000ff000028005080050002000200000011000100329f339bbec48362427a40c8940000000800030001ac0f"], 0x50}}, 0x0) 209.965515ms ago: executing program 1 (id=116): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x20, 0x0, 0x9, 0x3, 0x0, 0x0, {0x3, 0x0, 0x9}, [@NFCTH_NAME={0x9, 0x1, 'syz1\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x8000) 209.875515ms ago: executing program 0 (id=117): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000bfe000/0x400000)=nil) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000180)={[0x800, 0x7, 0x3ff, 0x1ff, 0x1000, 0x8001, 0x1001002, 0xf, 0x8000006000000, 0x4, 0x8, 0xfff, 0x8bd7, 0x8, 0x401, 0x5], 0x25000, 0x216146}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 209.789404ms ago: executing program 2 (id=118): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001800010a00000000000000000400000008000c"], 0x1c}}, 0x0) 209.707375ms ago: executing program 3 (id=119): r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r1) sendmsg$ETHTOOL_MSG_TSINFO_GET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="18000000", @ANYRES16=r0, @ANYBLOB="a787000000ff000000000b00000404000180"], 0x18}}, 0x0) 204.867205ms ago: executing program 1 (id=120): pipe(&(0x7f0000000640)) r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='task\x00') lseek(r0, 0x4, 0x2) getdents64(r0, 0xffffffffffffffff, 0x43) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() r3 = socket(0x10, 0x3, 0x0) write(r3, 0x0, 0x0) sched_setscheduler(r2, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f00000006c0)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = syz_open_procfs(r2, &(0x7f0000000080)='net/udp\x00') preadv(r6, &(0x7f0000000040)=[{&(0x7f0000000180)=""/88, 0x58}], 0x1, 0x3c, 0x0) 124.464287ms ago: executing program 2 (id=121): recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x10002, 0x0) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0x1, 0x4, 0x401, 0x0, 0x0, {0xa, 0x0, 0x9}}, 0x14}, 0x1, 0x0, 0x0, 0x20040080}, 0x20000080) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, 0x0, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x40, r1, 0x5, 0x4, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_BSSID={0xa, 0xf5, @random="2421c44437f4"}, @NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST={0x6, 0xf7, {0x0, 0x3}}, @NL80211_ATTR_IE={0x4}]}, 0x40}}, 0x0) 86.844778ms ago: executing program 3 (id=122): mkdirat(0xffffffffffffff9c, 0x0, 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r2, &(0x7f0000000280)='0', 0x1) socket$nl_generic(0x10, 0x3, 0x10) openat(0xffffffffffffff9c, 0x0, 0x143042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='rdma.current\x00', 0x275a, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000640)='.log\x00', 0xa5d, 0x1) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) syz_clone(0x40000, 0x0, 0x0, 0x0, 0x0, 0x0) 15.248529ms ago: executing program 2 (id=123): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000040b455018212fb6a5040095f575"], 0x0}, 0x0) 6.27818ms ago: executing program 3 (id=124): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee7, 0x8031, 0xffffffffffffffff, 0x84c18000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/net/ipv4/conf/all/forwarding\x00', 0x1, 0x0) 0s ago: executing program 0 (id=125): r0 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000080)='\b\x00', 0x2}, {&(0x7f0000000180)="96bc1480bb35", 0x6}], 0x2}, 0x24048804) 0s ago: executing program 0 (id=126): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000409d04ffff00000000000109022400010000000009040000020300000009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0022180000000501150025ff3a6842292aa90188830f0000004787b442"], 0x0}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.234' (ED25519) to the list of known hosts. [ 20.646114][ T36] audit: type=1400 audit(1787578277.190:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 20.647263][ T286] cgroup: Unknown subsys name 'net' [ 20.668770][ T36] audit: type=1400 audit(1787578277.190:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.696038][ T36] audit: type=1400 audit(1787578277.220:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.696216][ T286] cgroup: Unknown subsys name 'devices' [ 20.821521][ T286] cgroup: Unknown subsys name 'hugetlb' [ 20.827116][ T286] cgroup: Unknown subsys name 'rlimit' [ 20.939571][ T36] audit: type=1400 audit(1787578277.480:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 20.962742][ T36] audit: type=1400 audit(1787578277.480:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 20.987595][ T36] audit: type=1400 audit(1787578277.490:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 20.995876][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 21.019549][ T36] audit: type=1400 audit(1787578277.560:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.045014][ T36] audit: type=1400 audit(1787578277.560:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.079701][ T36] audit: type=1400 audit(1787578277.620:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.105262][ T36] audit: type=1400 audit(1787578277.620:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.105608][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.952447][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.959507][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.966669][ T296] bridge_slave_0: entered allmulticast mode [ 21.973037][ T296] bridge_slave_0: entered promiscuous mode [ 21.979271][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.986325][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.993412][ T294] bridge_slave_0: entered allmulticast mode [ 21.999529][ T294] bridge_slave_0: entered promiscuous mode [ 22.008703][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.015766][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.022926][ T294] bridge_slave_1: entered allmulticast mode [ 22.029057][ T294] bridge_slave_1: entered promiscuous mode [ 22.035069][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.042132][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.049221][ T295] bridge_slave_0: entered allmulticast mode [ 22.055416][ T295] bridge_slave_0: entered promiscuous mode [ 22.061572][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.068602][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.075693][ T296] bridge_slave_1: entered allmulticast mode [ 22.082056][ T296] bridge_slave_1: entered promiscuous mode [ 22.088062][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.095152][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.102278][ T293] bridge_slave_0: entered allmulticast mode [ 22.108414][ T293] bridge_slave_0: entered promiscuous mode [ 22.117310][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.124369][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.131471][ T293] bridge_slave_1: entered allmulticast mode [ 22.137604][ T293] bridge_slave_1: entered promiscuous mode [ 22.143723][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.150767][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.157812][ T295] bridge_slave_1: entered allmulticast mode [ 22.164080][ T295] bridge_slave_1: entered promiscuous mode [ 22.315615][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.322687][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.329979][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.336998][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.350893][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.357940][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.365232][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.372271][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.396091][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.403159][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.410436][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.417460][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.435160][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.442222][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.449467][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.456508][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.469435][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.476675][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.484304][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.492102][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.499401][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.506762][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.514025][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.521353][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.542087][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.549131][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.556767][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.563796][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.602156][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.609212][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.616865][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.623926][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.631600][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.638630][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.646202][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.653234][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.665011][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.672063][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.679609][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.686669][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.728593][ T293] veth0_vlan: entered promiscuous mode [ 22.737979][ T296] veth0_vlan: entered promiscuous mode [ 22.755899][ T295] veth0_vlan: entered promiscuous mode [ 22.764555][ T293] veth1_macvtap: entered promiscuous mode [ 22.776448][ T294] veth0_vlan: entered promiscuous mode [ 22.789439][ T296] veth1_macvtap: entered promiscuous mode [ 22.803486][ T294] veth1_macvtap: entered promiscuous mode [ 22.832667][ T295] veth1_macvtap: entered promiscuous mode [ 22.846156][ T293] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 22.922290][ T322] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 22.936073][ T324] capability: warning: `syz.2.5' uses deprecated v2 capabilities in a way that may be insecure [ 22.953063][ T321] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4'. [ 23.014711][ T322] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1677787136 (3355574272 ns) > initial count (33686216 ns). Using initial count to start timer. [ 23.073266][ T330] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7'. [ 23.139912][ T45] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 23.212857][ T334] ôÛWgÚq: renamed from bridge_slave_0 (while UP) [ 23.290939][ T45] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 23.301222][ T45] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 23.311878][ T45] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 23.323112][ T45] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 23.334160][ T45] usb 2-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 23.343745][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 23.354847][ T313] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 23.362749][ T313] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 23.370964][ T45] pl2303 2-1:1.0: pl2303 converter detected [ 23.390866][ T45] usb 2-1: pl2303 converter now attached to ttyUSB0 [ 23.519938][ T311] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 23.639639][ T45] usb 2-1: USB disconnect, device number 2 [ 23.647347][ T313] pl2303 2-1:1.0: pl2303_vendor_write - failed to write [0007]: -71 [ 23.670301][ T313] pl2303 ttyUSB0: pl2303_get_line_request - failed: -19 [ 23.677513][ T313] pl2303 ttyUSB0: pl2303_set_line_request - failed: -19 [ 23.691984][ T313] pl2303 2-1:1.0: pl2303_vendor_read - failed to read [000a]: -19 [ 23.709225][ T311] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 23.712187][ T313] pl2303 ttyUSB0: failed to submit interrupt urb: -19 [ 23.725297][ T311] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 23.730753][ T346] netlink: 'syz.2.12': attribute type 11 has an invalid length. [ 23.755646][ T311] usb 1-1: New USB device found, idVendor=0458, idProduct=5016, bcdDevice= 0.00 [ 23.760365][ T45] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 23.780709][ T311] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 23.782909][ T45] pl2303 2-1:1.0: device disconnected [ 23.806494][ T311] usb 1-1: config 0 descriptor?? [ 23.958981][ T351] overlayfs: missing 'workdir' [ 24.218104][ T311] kye 0003:0458:5016.0001: control desc unexpectedly large [ 24.227179][ T311] input: HID 0458:5016 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0458:5016.0001/input/input4 [ 24.240604][ T311] input: HID 0458:5016 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0458:5016.0001/input/input5 [ 24.256103][ T311] kye 0003:0458:5016.0001: input,hiddev96,hidraw0: USB HID v0.09 Device [HID 0458:5016] on usb-dummy_hcd.0-1/input0 [ 24.309860][ T9] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 24.428943][ T311] usb 1-1: USB disconnect, device number 2 [ 24.461980][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 24.473166][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 24.484016][ T9] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 24.497542][ T9] usb 4-1: New USB device found, idVendor=044f, idProduct=b324, bcdDevice= 0.00 [ 24.509275][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 24.525724][ T9] usb 4-1: config 0 descriptor?? [ 24.946665][ T9] thrustmaster 0003:044F:B324.0002: unbalanced collection at end of report description [ 24.962383][ T9] thrustmaster 0003:044F:B324.0002: parse failed [ 24.969199][ T9] thrustmaster 0003:044F:B324.0002: probe with driver thrustmaster failed with error -22 [ 25.147817][ T45] usb 4-1: USB disconnect, device number 2 [ 25.336153][ T409] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=409 comm=syz.2.38 [ 25.497841][ T428] netlink: 16 bytes leftover after parsing attributes in process `syz.2.47'. [ 25.779970][ T36] kauditd_printk_skb: 91 callbacks suppressed [ 25.780050][ T36] audit: type=1400 audit(1787578282.240:165): avc: denied { write } for pid=429 comm="syz.2.48" name="mcfilter" dev="proc" ino=4026532505 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 26.089862][ T31] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 26.097401][ T45] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 26.188949][ T444] netlink: 68 bytes leftover after parsing attributes in process `syz.1.53'. [ 26.226197][ T36] audit: type=1400 audit(1787578282.770:166): avc: denied { name_bind } for pid=449 comm="syz.1.56" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 26.259833][ T45] usb 4-1: Using ep0 maxpacket: 8 [ 26.264991][ T31] usb 1-1: Using ep0 maxpacket: 8 [ 26.267677][ T36] audit: type=1400 audit(1787578282.810:167): avc: denied { mount } for pid=451 comm="syz.1.57" name="/" dev="configfs" ino=2486 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 26.271995][ T45] usb 4-1: config 5 has an invalid interface number: 253 but max is 0 [ 26.292686][ T36] audit: type=1400 audit(1787578282.820:168): avc: denied { unmount } for pid=296 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 26.301764][ T45] usb 4-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 26.331092][ T45] usb 4-1: config 5 has no interface number 0 [ 26.332572][ T36] audit: type=1400 audit(1787578282.880:169): avc: denied { read write } for pid=453 comm="syz.1.58" name="vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 26.337307][ T45] usb 4-1: config 5 interface 253 has no altsetting 0 [ 26.362530][ T36] audit: type=1400 audit(1787578282.880:170): avc: denied { open } for pid=453 comm="syz.1.58" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 26.373209][ T31] usb 1-1: New USB device found, idVendor=1a86, idProduct=752d, bcdDevice= 0.40 [ 26.400644][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.408651][ T31] usb 1-1: Product: syz [ 26.413232][ T31] usb 1-1: Manufacturer: syz [ 26.418004][ T31] usb 1-1: SerialNumber: syz [ 26.423355][ T45] usb 4-1: New USB device found, idVendor=0421, idProduct=04c9, bcdDevice=8e.41 [ 26.432687][ T45] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.441552][ T45] usb 4-1: Product: syz [ 26.447970][ T456] FAULT_INJECTION: forcing a failure. [ 26.447970][ T456] name failslab, interval 1, probability 0, space 0, times 1 [ 26.461740][ T45] usb 4-1: Manufacturer: syz [ 26.464976][ T456] CPU: 0 UID: 0 PID: 456 Comm: syz.2.59 Not tainted syzkaller #0 9a2c17613351c9eac8e18d74829f474689ac6bc1 [ 26.465005][ T456] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.465023][ T456] Call Trace: [ 26.465029][ T456] [ 26.465036][ T456] __dump_stack+0x21/0x30 [ 26.465068][ T456] dump_stack_lvl+0x140/0x1c0 [ 26.465091][ T456] ? __cfi_dump_stack_lvl+0x10/0x10 [ 26.465115][ T456] ? release_sock+0x171/0x1f0 [ 26.465133][ T456] dump_stack+0x19/0x20 [ 26.465154][ T456] should_fail_ex+0x3c2/0x510 [ 26.465175][ T456] should_failslab+0xac/0x100 [ 26.465197][ T456] kmem_cache_alloc_node_noprof+0x45/0x420 [ 26.465216][ T456] ? netlink_data_ready+0x20/0x20 [ 26.465236][ T456] ? __alloc_skb+0x10c/0x360 [ 26.465253][ T456] __alloc_skb+0x10c/0x360 [ 26.465270][ T456] netlink_alloc_large_skb+0xf7/0x1b0 [ 26.465289][ T456] netlink_sendmsg+0x576/0xad0 [ 26.465310][ T456] ? __cfi_netlink_sendmsg+0x10/0x10 [ 26.465332][ T456] ? bpf_lsm_socket_sendmsg+0xd/0x20 [ 26.465353][ T456] ? security_socket_sendmsg+0x3d/0x100 [ 26.465376][ T456] ____sys_sendmsg+0x9a1/0xa00 [ 26.465398][ T456] ? __import_iovec+0x5b9/0x7d0 [ 26.465433][ T456] ? __sys_sendmsg_sock+0x50/0x50 [ 26.465455][ T456] ? import_iovec+0x80/0xb0 [ 26.465478][ T456] ___sys_sendmsg+0x2a6/0x370 [ 26.465499][ T456] ? __sys_sendmsg+0x2a0/0x2a0 [ 26.465520][ T456] ? proc_fail_nth_write+0x184/0x220 [ 26.465545][ T456] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 26.465572][ T456] ? __fget_files+0x2bc/0x330 [ 26.465593][ T456] __x64_sys_sendmsg+0x206/0x2e0 [ 26.465614][ T456] ? fput+0x1a4/0x230 [ 26.465636][ T456] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 26.465656][ T456] ? ksys_write+0x1f3/0x260 [ 26.465675][ T456] ? __kasan_check_read+0x15/0x20 [ 26.465694][ T456] x64_sys_call+0x2a4c/0x2ee0 [ 26.465710][ T456] do_syscall_64+0x57/0xf0 [ 26.465733][ T456] ? clear_bhb_loop+0x50/0xa0 [ 26.465751][ T456] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 26.465776][ T456] RIP: 0033:0x7f496c99e0d9 [ 26.465792][ T456] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 26.465806][ T456] RSP: 002b:00007f496d88d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 26.465830][ T456] RAX: ffffffffffffffda RBX: 00007f496cc25fa0 RCX: 00007f496c99e0d9 [ 26.465844][ T456] RDX: 0000000000000804 RSI: 0000200000000040 RDI: 0000000000000007 [ 26.465856][ T456] RBP: 00007f496d88d090 R08: 0000000000000000 R09: 0000000000000000 [ 26.465867][ T456] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 26.465878][ T456] R13: 00007f496cc26038 R14: 00007f496cc25fa0 R15: 00007fffeae17528 [ 26.465892][ T456] [ 26.719823][ T9] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 26.725189][ T45] usb 4-1: SerialNumber: syz [ 26.749731][ T31] snd-usb-audio 1-1:1.1: probe with driver snd-usb-audio failed with error -2 [ 26.760870][ T31] usb 1-1: USB disconnect, device number 3 [ 26.890902][ T9] usb 2-1: config 0 has an invalid interface number: 251 but max is 0 [ 26.899093][ T9] usb 2-1: config 0 has no interface number 0 [ 26.906590][ T9] usb 2-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 26.915705][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.923716][ T9] usb 2-1: Product: syz [ 26.927878][ T9] usb 2-1: Manufacturer: syz [ 26.932508][ T9] usb 2-1: SerialNumber: syz [ 26.937762][ T9] usb 2-1: config 0 descriptor?? [ 26.971255][ T45] rndis_host 4-1:5.253: skipping garbage [ 26.976955][ T45] usb 4-1: bad CDC descriptors [ 26.981952][ T45] cdc_acm 4-1:5.253: skipping garbage [ 26.991455][ T45] usb 4-1: USB disconnect, device number 3 [ 26.999810][ T310] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 27.144903][ T9] asix 2-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 27.155130][ T9] asix 2-1:0.251 (unnamed net_device) (uninitialized): Failed to read MAC address: -32 [ 27.165234][ T9] asix 2-1:0.251: probe with driver asix failed with error -5 [ 27.173857][ T310] usb 3-1: config 0 has an invalid interface number: 41 but max is 0 [ 27.183392][ T310] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 27.188972][ T464] netlink: 36 bytes leftover after parsing attributes in process `syz.0.62'. [ 27.194085][ T36] audit: type=1400 audit(1787578283.730:171): avc: denied { nlmsg_write } for pid=463 comm="syz.0.62" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 27.222850][ T310] usb 3-1: config 0 has no interface number 0 [ 27.228990][ T310] usb 3-1: config 0 interface 41 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 27.240090][ T310] usb 3-1: config 0 interface 41 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 27.246525][ T36] audit: type=1400 audit(1787578283.790:172): avc: denied { mounton } for pid=465 comm="syz.0.63" path="/8/file0" dev="tmpfs" ino=60 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 27.253184][ T310] usb 3-1: config 0 interface 41 has no altsetting 0 [ 27.284838][ T310] usb 3-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 27.295301][ T310] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.303367][ T310] usb 3-1: Product: syz [ 27.308094][ T310] usb 3-1: Manufacturer: syz [ 27.312698][ T310] usb 3-1: SerialNumber: syz [ 27.317828][ T310] usb 3-1: config 0 descriptor?? [ 27.323554][ T310] CoreChips 3-1:0.41: probe with driver CoreChips failed with error -22 [ 27.348415][ T45] usb 2-1: USB disconnect, device number 3 [ 27.417385][ T36] audit: type=1400 audit(1787578283.960:173): avc: denied { create } for pid=478 comm="syz.1.66" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 27.454404][ T36] audit: type=1400 audit(1787578283.980:174): avc: denied { connect } for pid=480 comm="syz.1.67" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 27.496721][ T489] netlink: 68 bytes leftover after parsing attributes in process `syz.1.71'. [ 27.648402][ T516] SELinux: Context /]/'):Œ is not valid (left unmapped). [ 27.648761][ T512] syzkaller0: entered promiscuous mode [ 27.662414][ T512] syzkaller0: entered allmulticast mode [ 27.919895][ T310] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 27.949830][ T45] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 28.070938][ T310] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 28.082013][ T310] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1296, setting to 1024 [ 28.093270][ T310] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 28.100836][ T45] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 28.106438][ T310] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 28.116616][ T45] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 28.125558][ T310] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.137069][ T45] usb 2-1: New USB device found, idVendor=0644, idProduct=800f, bcdDevice= 0.40 [ 28.143867][ T310] usb 4-1: config 0 descriptor?? [ 28.151541][ T45] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.159412][ T516] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 28.164374][ T45] usb 2-1: Product: syz [ 28.175605][ T45] usb 2-1: Manufacturer: syz [ 28.180372][ T45] usb 2-1: SerialNumber: syz [ 28.389657][ T45] usb 2-1: Unsupported UAC3 BADD profile [ 28.397157][ T45] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 28.408699][ T45] usb 2-1: USB disconnect, device number 4 [ 28.420104][ T339] udevd[339]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 28.576161][ T310] plantronics 0003:047F:FFFF.0003: No inputs registered, leaving [ 28.587855][ T310] plantronics 0003:047F:FFFF.0003: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 29.736754][ T550] dummy_hcd dummy_hcd.0: remove, state 4 [ 29.742576][ T550] usb usb1: USB disconnect, device number 1 [ 29.752405][ T550] dummy_hcd dummy_hcd.0: stopped [ 29.757442][ T550] dummy_hcd dummy_hcd.0: USB bus 1 deregistered [ 29.790172][ C1] plantronics 0003:047F:FFFF.0003: usb_submit_urb(ctrl) failed: -1 [ 29.796976][ T310] usb 3-1: USB disconnect, device number 2 [ 30.879004][ T36] kauditd_printk_skb: 25 callbacks suppressed [ 30.879020][ T36] audit: type=1400 audit(1787578287.420:200): avc: denied { read write } for pid=579 comm="syz.0.107" name="binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 30.908731][ T36] audit: type=1400 audit(1787578287.420:201): avc: denied { open } for pid=579 comm="syz.0.107" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 30.933153][ T36] audit: type=1400 audit(1787578287.470:202): avc: denied { ioctl } for pid=579 comm="syz.0.107" path="/dev/binderfs/binder0" dev="binder" ino=13 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 30.967267][ T36] audit: type=1400 audit(1787578287.470:203): avc: denied { set_context_mgr } for pid=579 comm="syz.0.107" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 31.027127][ T36] audit: type=1400 audit(1787578287.470:204): avc: denied { map } for pid=579 comm="syz.0.107" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 31.057646][ T590] netlink: 'syz.3.113': attribute type 4 has an invalid length. [ 31.070903][ T36] audit: type=1400 audit(1787578287.470:205): avc: denied { call } for pid=579 comm="syz.0.107" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 31.095241][ T310] smpboot: CPU 1 is now offline [ 31.143318][ T31] usb 4-1: USB disconnect, device number 4 [ 31.206070][ T607] Zero length message leads to an empty skb [ 31.263521][ T36] audit: type=1400 audit(1787578287.470:206): avc: denied { transfer } for pid=579 comm="syz.0.107" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 31.441998][ T36] audit: type=1400 audit(1787578287.510:207): avc: denied { write } for pid=581 comm="syz.0.109" name="rtc0" dev="devtmpfs" ino=195 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 31.526678][ T621] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI [ 31.539289][ T621] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 31.547679][ T621] CPU: 0 UID: 0 PID: 621 Comm: syz.0.126 Not tainted syzkaller #0 9a2c17613351c9eac8e18d74829f474689ac6bc1 [ 31.559762][ T621] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 31.569838][ T621] RIP: 0010:dummy_udc_start+0xd1/0x1f0 [ 31.575305][ T621] Code: 41 83 ff 03 74 18 41 83 ff 05 0f 85 94 00 00 00 e8 14 c0 cd fd eb 0c e8 0d c0 cd fd eb 05 e8 06 c0 cd fd 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 30 9c 26 fe 4d 8b 36 4c 89 f7 e8 [ 31.594902][ T621] RSP: 0018:ffffc9000ddef818 EFLAGS: 00010246 [ 31.600956][ T621] RAX: 0000000000000000 RBX: ffff88811eba0010 RCX: 0000000000080000 [ 31.608907][ T621] RDX: ffffc90001681000 RSI: 00000000000009ae RDI: 00000000000009af [ 31.616861][ T621] RBP: ffffc9000ddef840 R08: ffff88811eb92600 R09: 0000000000000004 [ 31.624820][ T621] R10: 0000000000000005 R11: 0000000000000002 R12: dffffc0000000000 [ 31.632774][ T621] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000003 [ 31.640732][ T621] FS: 00007feff9bae6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 31.649681][ T621] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 31.656253][ T621] CR2: 00007feff8d87240 CR3: 000000011ec76000 CR4: 00000000003526b0 [ 31.664219][ T621] Call Trace: [ 31.667481][ T621] [ 31.670392][ T621] ? __cfi_dummy_udc_start+0x10/0x10 [ 31.675678][ T621] gadget_bind_driver+0x3e4/0x9c0 [ 31.680702][ T621] ? __cfi_gadget_bind_driver+0x10/0x10 [ 31.686240][ T621] really_probe+0x2e1/0x8b0 [ 31.690819][ T621] __driver_probe_device+0x193/0x280 [ 31.696114][ T621] driver_probe_device+0x54/0x3f0 [ 31.701121][ T621] __driver_attach+0x422/0x5e0 [ 31.705868][ T621] bus_for_each_dev+0x249/0x2d0 [ 31.710698][ T621] ? __cfi___driver_attach+0x10/0x10 [ 31.715981][ T621] ? __cfi_bus_for_each_dev+0x10/0x10 [ 31.721334][ T621] ? __kasan_kmalloc+0x96/0xb0 [ 31.726079][ T621] ? _raw_spin_unlock+0x45/0x60 [ 31.730912][ T621] ? klist_add_tail+0x1dd/0x220 [ 31.735749][ T621] driver_attach+0x46/0x50 [ 31.740149][ T621] bus_add_driver+0x393/0x730 [ 31.744813][ T621] driver_register+0x2b7/0x3c0 [ 31.749568][ T621] usb_gadget_register_driver_owner+0xfc/0x270 [ 31.755727][ T621] raw_ioctl+0x144c/0x37a0 [ 31.760169][ T621] ? __cfi_raw_ioctl+0x10/0x10 [ 31.764922][ T621] ? selinux_file_ioctl+0x732/0x1480 [ 31.770194][ T621] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 31.775728][ T621] ? bpf_lsm_file_ioctl+0xd/0x20 [ 31.780671][ T621] ? security_file_ioctl+0x3e/0x110 [ 31.785853][ T621] ? __cfi_raw_ioctl+0x10/0x10 [ 31.790607][ T621] __se_sys_ioctl+0x135/0x1b0 [ 31.795269][ T621] __x64_sys_ioctl+0x7f/0xa0 [ 31.799866][ T621] x64_sys_call+0x1878/0x2ee0 [ 31.804527][ T621] do_syscall_64+0x57/0xf0 [ 31.808928][ T621] ? clear_bhb_loop+0x50/0xa0 [ 31.813597][ T621] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 31.819516][ T621] RIP: 0033:0x7feff8d9dd6b [ 31.823922][ T621] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 31.843523][ T621] RSP: 002b:00007feff9babf00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 31.851929][ T621] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007feff8d9dd6b [ 31.859898][ T621] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000003 [ 31.867890][ T621] RBP: 00007feff9bacfd0 R08: 0000000000000001 R09: 00000000ffffffff [ 31.875843][ T621] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 31.883801][ T621] R13: 0000200000000000 R14: 0000000000000000 R15: 0000000000000000 [ 31.891757][ T621] [ 31.894761][ T621] Modules linked in: [ 31.899079][ T621] ---[ end trace 0000000000000000 ]--- [ 31.905263][ T36] audit: type=1400 audit(1787578287.510:208): avc: denied { open } for pid=581 comm="syz.0.109" path="/dev/rtc0" dev="devtmpfs" ino=195 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 31.928530][ T36] audit: type=1400 audit(1787578287.570:209): avc: denied { mounton } for pid=587 comm="syz.0.112" path="/proc/56/task" dev="proc" ino=6164 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 31.953064][ T621] RIP: 0010:dummy_udc_start+0xd1/0x1f0 [ 31.958601][ T621] Code: 41 83 ff 03 74 18 41 83 ff 05 0f 85 94 00 00 00 e8 14 c0 cd fd eb 0c e8 0d c0 cd fd eb 05 e8 06 c0 cd fd 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 30 9c 26 fe 4d 8b 36 4c 89 f7 e8 [ 31.978499][ T621] RSP: 0018:ffffc9000ddef818 EFLAGS: 00010246 [ 31.985097][ T621] RAX: 0000000000000000 RBX: ffff88811eba0010 RCX: 0000000000080000 [ 31.993278][ T621] RDX: ffffc90001681000 RSI: 00000000000009ae RDI: 00000000000009af [ 32.001407][ T621] RBP: ffffc9000ddef840 R08: ffff88811eb92600 R09: 0000000000000004 [ 32.009478][ T621] R10: 0000000000000005 R11: 0000000000000002 R12: dffffc0000000000 [ 32.017627][ T621] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000003 [ 32.025977][ T621] FS: 00007feff9bae6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 32.054707][ T621] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.061496][ T621] CR2: 00007feff8d87240 CR3: 000000011ec76000 CR4: 00000000003526b0 [ 32.069722][ T621] Kernel panic - not syncing: Fatal exception [ 32.075827][ T621] Kernel Offset: disabled [ 32.080137][ T621] Rebooting in 86400 seconds..