last executing test programs: 1.789193235s ago: executing program 3 (id=4): r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000480)=ANY=[@ANYBLOB="1201000200000040110700090001010203010902200001010080fa0904000002070102000705810200020007050202"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000200)={0x84, &(0x7f0000000040)=ANY=[@ANYRES8=0x0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r2 = socket$netlink(0x10, 0x3, 0x0) writev(r2, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r2, 0x0, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x24, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) get_robust_list(r3, &(0x7f00000003c0)=&(0x7f0000000380)={&(0x7f0000000100), 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={&(0x7f00000001c0)}}}, &(0x7f0000000400)=0x18) ptrace(0x10, r3) ptrace$getregs(0xc, r3, 0x2, &(0x7f00000012c0)=""/224) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r4, &(0x7f0000000440)="de43c3f8beb13647", 0x8) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r5, 0x1, 0x2c, &(0x7f0000000140)=0x1, 0x4) setsockopt$sock_int(r5, 0x1, 0x32, &(0x7f0000000180)=0x4, 0x4) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000340)="ab") pread64(r4, 0x0, 0x0, 0xd000) capset(&(0x7f0000000080)={0x20080522, r3}, &(0x7f00000000c0)={0xfffffffb, 0xa9, 0x6, 0x6, 0xfffffffe, 0x7f}) 1.788500855s ago: executing program 1 (id=2): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r0 = creat(0x0, 0xf2) write$cgroup_int(r0, &(0x7f0000000540), 0xfffffdd8) madvise(&(0x7f0000000000/0x400000)=nil, 0x40001e, 0x15) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) 1.702472377s ago: executing program 2 (id=3): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = mmap$IORING_OFF_SQES(0x0, 0x1001, 0x0, 0x109031, 0xffffffffffffffff, 0x10000000) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000340)=0x1) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000100)={0x2, 0x0, [{0x8080000, 0x8d, &(0x7f0000000000)=""/141}, {0x58000, 0x2c, &(0x7f0000000480)=""/44}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000140)={0x0, 0x0}) capset(&(0x7f00000001c0)={0x20080522, r3}, &(0x7f0000000280)={0x8d, 0x4, 0xfffffff9, 0x40, 0x80, 0xffff7aec}) r4 = openat$fault_inject(0xffffffffffffff9c, &(0x7f00000005c0)='/sys/kernel/debug/fail_make_request/times\x00', 0x1, 0x0) r5 = socket$inet6(0xa, 0x802, 0x0) r6 = syz_usb_connect$uac2(0x3, 0x7b, &(0x7f0000000240)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x2b73, 0xa, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x5, 0x30, 0x9, {0x8, 0xb, 0x0, 0x1, 0x1, 0x7, 0x20, 0x8c}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x4000, 0x0, 0x9, 0xb}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x3, 0xb, 0x4, {0x8, 0x25, 0x1, 0x0, 0x0, 0x40, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x40, 0x6, 0x3, {0x8, 0x25, 0x1, 0x82, 0x3, 0x80, 0x6}}}}}}}}]}}, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_opts(r5, 0x29, 0x3b, 0x0, 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ptype\x00') mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x8) preadv(r7, &(0x7f0000000580)=[{&(0x7f0000000280)=""/182, 0xb6}, {&(0x7f00000004c0)=""/157, 0x9d}], 0x2, 0x2000004f, 0x7) write$fault_inject(0xffffffffffffffff, &(0x7f00000000c0)='100\x00', 0x4) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000200)={0x1, &(0x7f0000000040)=[{0x7, 0xc0, 0xde, 0x7fffffff}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/usbcore/parameters/autosuspend\x00', 0x1, 0x0) write(r8, &(0x7f0000000200)='0', 0x1) r9 = socket$inet_tcp(0x2, 0x1, 0x0) close(0xffffffffffffffff) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f00000008c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TID_CONFIG(r10, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001640)={&(0x7f0000000700)=ANY=[@ANYBLOB="0c009900010000007000000004001d80", @ANYRES16=r11, @ANYRESHEX=r2, @ANYRES32=0x0, @ANYBLOB="010028bd7000fedbdf258900000008000300", @ANYRESDEC=r7, @ANYRES8=r7, @ANYRESOCT, @ANYRESOCT=r1, @ANYRES8=r6, @ANYRES8=r0, @ANYRES8=r11, @ANYRES16=r4, @ANYRES32=r2, @ANYRESOCT=r1, @ANYRES16=r9], 0x2c}, 0x1, 0x0, 0x0, 0x90}, 0x4000000) syz_open_dev$usbfs(0x0, 0x19, 0x2) syz_open_procfs(0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000380)={0x4, &(0x7f0000000100)=[{0x3, 0x3, 0xf1, 0xfffffffc}, {0x6, 0x4, 0x2, 0x7}, {0x7ff, 0x0, 0xd, 0x5e0c}, {0x800, 0x9, 0x2, 0x6}]}) close_range(r4, 0xffffffffffffffff, 0x0) 1.19117031s ago: executing program 1 (id=10): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)=ANY=[@ANYRESOCT=0x0], 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYRES16, @ANYBLOB="01000000000000000000030000005800018044000400200001000a00000000005b582d"], 0x6c}, 0x1, 0x0, 0x0, 0x1}, 0x4000) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000440)=ANY=[@ANYBLOB="a400000054000100000000000000800007"], 0xa4}], 0x1, 0x0, 0x0, 0x4000001}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000340)={0x2c, &(0x7f0000000700)=ANY=[@ANYBLOB=' \n\a'], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2) r2 = socket(0x10, 0x803, 0x0) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, 0x0, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000004000)={0x4, 0x0, 0x10000, 0x2000, &(0x7f0000f68000/0x2000)=nil}) r5 = syz_kvm_setup_syzos_vm$x86(r4, &(0x7f0000c00000/0x400000)=nil) r6 = syz_kvm_add_vcpu$x86(r5, &(0x7f0000000180)={0x0, 0x0}) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f00000006c0)={0x0, 0x7fff, 0x0, {0x0, 0x1}, {0x4a, 0x2}, @period={0x5d, 0xa370, 0x0, 0x7f, 0x2, {0x1, 0x3, 0x4, 0x2}, 0x0, 0x0}}) r7 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x822b01) write$char_usb(r7, &(0x7f0000000040)="e2", 0x12d8) ioctl$EVIOCGKEY(r7, 0x80404518, &(0x7f0000000280)=""/6) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000140)={'dummy0\x00', &(0x7f0000000280)=@ethtool_channels={0x4a, 0x0, 0x7, 0xfffffffd, 0x4, 0x2, 0x1}}) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r8, 0xffffffffffffffff, 0x0) 379.81755ms ago: executing program 2 (id=16): r0 = userfaultfd(0x800) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x210}) munmap(&(0x7f000092b000/0x4000)=nil, 0x4000) r1 = epoll_create1(0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000010)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000020)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000030)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000050)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000060)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000070)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000080)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000090)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000a0)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000b0)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000c0)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000d0)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000e0)) r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) write(r2, &(0x7f0000000200)="580000001400010300000000000000001e000000ffffffff00"/88, 0x58) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000000080)={@private1, @empty, @private0={0xfc, 0x0, '\x00', 0x20}, 0x0, 0xffff, 0x0, 0x0, 0x6, 0x4180107}) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1f7) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000001600)='proc\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000400)={&(0x7f000092b000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x1000}) syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r4) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000100)={'dummy0\x00', 0x200}) 301.707293ms ago: executing program 2 (id=18): mkdir(&(0x7f0000000000)='./tracing\x00', 0x1ff) getxattr(&(0x7f00000003c0)='./tracing\x00', &(0x7f0000000400)=@random={'trusted.', 'eth'}, &(0x7f0000000440)=""/115, 0x73) r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000000a00)) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f0000000000)={0x60, 0x0, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0x16, &(0x7f00000000c0)=[{0x8, 0x7f, 0x6}], 0xaaaaaaaaaaaad64, 0xfffffffffffffffa, 0x11, 0x0, 0x3, 0x30}) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r1, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="48498026", @ANYRES16=r2, @ANYBLOB="000429bd7000fedbdf2516000000340004800c00078008000300010000002400078008000300ff070000080003000002000008000300070000000800020005000000"], 0x48}, 0x1, 0x0, 0x0, 0x8000}, 0x200000c4) unshare(0x60000600) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) syz_usb_connect$uac2(0x3, 0x7b, &(0x7f0000000140)=ANY=[@ANYBLOB="120110030000004035121482400001020301090269000301053009080b00010107208c09040000000101200009"], &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000600)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0x8b, 0x6, 0xffff, 0x39, @private1={0xfc, 0x1, '\x00', 0x1}, @empty, 0x2000, 0xba88, 0xa3c, 0x4}}) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000280)={0x4000}, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000f80)={0x1c, 0x1e, 0xa01, 0x2, 0x0, {0xa}, [@nested={0x8, 0xf9, 0x0, 0x1, [@nested={0x4, 0x9a}]}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000380), r1) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_MON_SET(r7, &(0x7f0000000980)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000940)={&(0x7f0000000780)={0xbc, r6, 0x800, 0x70bd2b, 0x25dfdbfe, {}, [@TIPC_NLA_PUBL={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x5}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x3}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x100}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1cc}]}, @TIPC_NLA_NODE={0x54, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xffffffff}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xc737}, @TIPC_NLA_NODE_KEY={0x3d, 0x4, {'gcm(aes)\x00', 0x15, "d75ad0f608986f97df75719fd464b0c9b98e2bacc9"}}]}, @TIPC_NLA_NODE={0x4}, @TIPC_NLA_MON={0x14, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1}]}]}, 0xbc}, 0x1, 0x0, 0x0, 0x8800}, 0x8000) sendmsg$netlink(r5, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)=ANY=[@ANYBLOB="20000000110001000000000000000000100000e60b"], 0x20}], 0x1}, 0x0) mount(0x0, &(0x7f0000000100)='./tracing\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) r8 = open$dir(&(0x7f0000000040)='./tracing/trace\x00', 0x101000, 0x22) openat(r8, &(0x7f0000000500)='./tracing\x00', 0x0, 0x140) 242.421764ms ago: executing program 0 (id=19): r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = syz_open_dev$ptys(0xc, 0x3, 0x0) ioctl$KDSKBENT(r1, 0x4b47, &(0x7f0000001140)={0x1, 0x4, 0x7}) ioctl$KVM_GET_PIT2(0xffffffffffffffff, 0x8070ae9f, &(0x7f0000001300)) futex(0x0, 0x85, 0x0, 0x0, 0x0, 0x1) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/4096, 0x1000, 0x800}, 0x20) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x21, 0x1, 0x0, 0x0, "", [@typed={0xa, 0x0, 0x0, 0x0, @str='\x00\x00\x00\x01\x01b'}, @nested={0x7, 0x13, 0x0, 0x1, [@generic="1b9216"]}]}, 0x24}], 0x1}, 0x0) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000000080)=0x4, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000100)=0x4, 0x4) r3 = getpid() r4 = syz_pidfd_open(r3, 0x0) setns(r4, 0x24020000) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='\x00', 0x274) bind$xdp(r0, &(0x7f0000000200)={0x2c, 0x0, 0x1, 0x0, 0x0}, 0x10) openat$ashmem(0xffffffffffffff9c, 0x0, 0x14b040, 0x0) r6 = openat$rtc(0xffffffffffffff9c, 0x0, 0x140, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x29) mount(0x0, &(0x7f0000000140)='./sys\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./sys/class/udc/dummy_udc.0/soft_connect\x00', 0x81, 0x0) write(r7, &(0x7f0000000f00)="6ee9f7e4ca79", 0x6) close(r0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001040), 0xffffffffffffffff) sendmsg$NL80211_CMD_CHANGE_NAN_CONFIG(0xffffffffffffffff, &(0x7f0000001100)={&(0x7f0000001000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000010c0)={&(0x7f00000011c0)=ANY=[@ANYBLOB="1c000000d801a4ac756fd7914277d957f021245c8b360ed773671d4992f666e2ef3591bb6fce29e2dff40cc1df3138e081790163ed35804f8896ebe116d00f9deca845c1241e925f69e2222b849627b156e026d40b0fb2841e9cfb32adbd9506d1a889e14666a9235f84dd164190545d083b2e40955adbaf20c6042d733cb2c90331fbc2a585436b7099ac41b5ec08940a81b6a98349549eeed61c01aa0c3ea836e59f52cd7e841c4a3f24981c4d5bc687b9e1223e5831c4b7a93786ba814cfbce0f5aea4d00c4e27761f8695e706a810d5e9fdce65c111aafedb24667bcd5b7370fec89b9915231f68a319a13977b", @ANYRES16=r8, @ANYBLOB="08002bbd7000ffdbdf25770000000800ef0000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x44}, 0x20008001) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000001080)={0x6, 0x2, 0xb, 0x800, 0x1a, "ee2881eddcf5c820"}) r9 = openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000001180), 0xf00c0, 0x0) sync_file_range(r6, 0x4, 0x3, 0x3) pidfd_getfd(r9, r2, 0x0) 72.299278ms ago: executing program 0 (id=20): openat$uinput(0xffffffffffffff9c, &(0x7f0000000100), 0x802, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'ip6tnl0\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xf, [0x1, 0x1, 0x107fff, 0x10, 0x4, 0x9, 0xa4, 0xffb, 0x7, 0xb6b, 0x800c1, 0x4, 0x3, 0x3, 0x9, 0xff, 0x1000, 0xc, 0x3, 0x3, 0x80000001, 0xfffffff2, 0x0, 0x1, 0x2009, 0x4, 0x7, 0x5, 0x100000, 0x762, 0x3, 0x63c, 0xe, 0x6, 0x100, 0x6, 0x1bfe, 0xb, 0x40, 0x40bed4, 0x8, 0x8000100, 0xb, 0x0, 0x11004, 0x8, 0x8, 0x79b, 0x5, 0x5, 0x7f, 0x4, 0x4, 0x7, 0xf, 0x101, 0xa, 0x1fa0860b, 0x7, 0xa9, 0x81, 0x2, 0x180000, 0x4003, 0x8b, 0x5, 0x2af, 0x3, 0x5, 0x2, 0x1, 0x209, 0x4, 0x182e, 0x4009, 0x0, 0x2, 0x100002, 0x8, 0x752, 0xfffffffd, 0x3, 0x0, 0x10000, 0x3f6, 0xffffffff, 0x6, 0x6, 0x9, 0xcf, 0xfdffffff, 0x2, 0xfffffffe, 0x84, 0x100, 0x5, 0x100252, 0x81, 0xb, 0x100004, 0x20006, 0xc50, 0x2, 0x9, 0x2, 0xd9a, 0xc8, 0x6, 0xfffffffd, 0x3, 0x2, 0x5, 0x8, 0x0, 0x4, 0x2, 0x40, 0xfffffff9, 0x4, 0x4, 0x3fd, 0x66dd, 0x8, 0x8, 0x3, 0x81fc, 0x1ff, 0xffffffff]}}) sendmsg$IPCTNL_MSG_CT_DELETE(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="e40000000201010800000000000000000a000000d00001800c000280050001000000000014000180080001000000000008000200000000002c00018014000300ff01000000000000000000000000000114000400ff0100000000000000000000000000010c00028005000100000000004700028005000100010000000600064000000000060005"], 0xe4}}, 0x4000005) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xc) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) keyctl$restrict_keyring(0x1d, 0xfffffffffffffffd, &(0x7f0000000100)='syzkaller\x00', &(0x7f0000000140)='802.15.4 MAC\x00') 10.07816ms ago: executing program 0 (id=21): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000080)='4', 0x1) setsockopt$IP_VS_SO_SET_DEL(r0, 0x0, 0x484, &(0x7f0000000000)={0x67, @private=0xa010102, 0x4e23, 0x3, 'lc\x00', 0x14, 0x7, 0x7c}, 0x2c) 9.86239ms ago: executing program 0 (id=22): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_BT_POWER(r0, 0x112, 0x9, 0x0, &(0x7f0000001040)) 9.63102ms ago: executing program 0 (id=23): r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r0, 0x8008551d, &(0x7f0000000040)={0xb4cc, 0x3, [{0x8}, {0x5, 0x1}, {0xb, 0x1}]}) 0s ago: executing program 0 (id=24): r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r2 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000002c0), 0x1, 0x0) write$binfmt_register(r2, &(0x7f0000000040)={0x3a, 'syz3', 0x3a, 'E', 0x3a, 0xffffffffffffffff, 0x3a, 'allow_other', 0x3a, '', 0x3a, './cgroup.cpu/cpuset.cpus', 0x3a, [0x46, 0x46]}, 0x45) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000440)={@ptr={0x77622a85, 0x1, 0x0, 0x0, 0xffffffffffffffff, 0x3c}, @ptr={0x73622a85, 0x0, 0x0, 0x0, 0x0, 0xb}, @flat=@weak_handle={0x77682a85, 0x0, 0x1}}, &(0x7f0000000280)={0x5b, 0x28, 0x50}}, 0x10}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000500)="cc568130b324d2a9b9f6bec573154bf65ff2e843cd0db24bbe86d1c7c641d8763cef74b3650bed05bf42a1874dec8665d4887872dff4956a366cd8c79a59b408fd74f3907ce3567079bae6091297e7e7"}) userfaultfd(0x80001) ioctl$UFFDIO_POISON(r0, 0xc020aa08, &(0x7f00000001c0)={{&(0x7f0000ff9000/0x4000)=nil, 0x4000}}) ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) r4 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) r5 = openat$selinux_policy(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r5, 0x0) r6 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$selinux_user(r6, &(0x7f0000000040)=ANY=[@ANYBLOB='system_u:object_r:auth_cache_t root'], 0x27) read(r6, &(0x7f0000000340)=""/72, 0x48) write$selinux_load(r4, &(0x7f0000000000)=ANY=[], 0xffaf) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.121' (ED25519) to the list of known hosts. [ 27.886644][ T36] audit: type=1400 audit(1785861001.000:64): avc: denied { mounton } for pid=287 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 27.890575][ T287] cgroup: Unknown subsys name 'net' [ 27.913582][ T36] audit: type=1400 audit(1785861001.000:65): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 27.948182][ T36] audit: type=1400 audit(1785861001.030:66): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 27.949147][ T287] cgroup: Unknown subsys name 'devices' [ 28.088985][ T287] cgroup: Unknown subsys name 'hugetlb' [ 28.095957][ T287] cgroup: Unknown subsys name 'rlimit' [ 28.191203][ T36] audit: type=1400 audit(1785861001.300:67): avc: denied { setattr } for pid=287 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 28.218427][ T36] audit: type=1400 audit(1785861001.300:68): avc: denied { mounton } for pid=287 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 28.247578][ T36] audit: type=1400 audit(1785861001.300:69): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 28.278732][ T289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 28.290570][ T36] audit: type=1400 audit(1785861001.400:70): avc: denied { relabelto } for pid=289 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 28.329189][ T36] audit: type=1400 audit(1785861001.400:71): avc: denied { write } for pid=289 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.357156][ T287] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 28.360150][ T36] audit: type=1400 audit(1785861001.440:72): avc: denied { read } for pid=287 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.405875][ T36] audit: type=1400 audit(1785861001.440:73): avc: denied { open } for pid=287 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.250769][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.258332][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.265688][ T294] bridge_slave_0: entered allmulticast mode [ 29.272318][ T294] bridge_slave_0: entered promiscuous mode [ 29.283060][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.291036][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.298890][ T294] bridge_slave_1: entered allmulticast mode [ 29.305410][ T294] bridge_slave_1: entered promiscuous mode [ 29.408287][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.416284][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.423396][ T296] bridge_slave_0: entered allmulticast mode [ 29.430015][ T296] bridge_slave_0: entered promiscuous mode [ 29.439860][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.450561][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.458589][ T296] bridge_slave_1: entered allmulticast mode [ 29.466449][ T296] bridge_slave_1: entered promiscuous mode [ 29.544131][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.552921][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.561322][ T297] bridge_slave_0: entered allmulticast mode [ 29.569634][ T297] bridge_slave_0: entered promiscuous mode [ 29.577009][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.584492][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.592412][ T297] bridge_slave_1: entered allmulticast mode [ 29.599243][ T297] bridge_slave_1: entered promiscuous mode [ 29.638186][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.645335][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.653755][ T295] bridge_slave_0: entered allmulticast mode [ 29.661018][ T295] bridge_slave_0: entered promiscuous mode [ 29.675659][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.683322][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.692096][ T295] bridge_slave_1: entered allmulticast mode [ 29.698618][ T295] bridge_slave_1: entered promiscuous mode [ 29.767090][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.774317][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.782495][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.789724][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.848896][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.858478][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.866245][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.874893][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.903221][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.913273][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.921827][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.929325][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.949598][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.958636][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.967015][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.975075][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.016394][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.025307][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.036319][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.043970][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.052711][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.061567][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.081938][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.091825][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.101137][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.108546][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.140366][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.148569][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.158485][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.166465][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.197677][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.205436][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.224461][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.231968][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.245150][ T296] veth0_vlan: entered promiscuous mode [ 30.275714][ T297] veth0_vlan: entered promiscuous mode [ 30.285638][ T294] veth0_vlan: entered promiscuous mode [ 30.300562][ T296] veth1_macvtap: entered promiscuous mode [ 30.333507][ T297] veth1_macvtap: entered promiscuous mode [ 30.344117][ T294] veth1_macvtap: entered promiscuous mode [ 30.364713][ T295] veth0_vlan: entered promiscuous mode [ 30.399404][ T296] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 30.419768][ T295] veth1_macvtap: entered promiscuous mode [ 30.490093][ T313] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 30.746367][ T311] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 30.807625][ T335] capability: warning: `syz.0.7' uses 32-bit capabilities (legacy support in use) [ 30.841669][ T337] netlink: 20 bytes leftover after parsing attributes in process `syz.0.8'. [ 30.896336][ T9] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 30.907455][ T311] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 30.928144][ T311] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 30.945799][ T311] usb 4-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 30.962431][ T311] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.971226][ T311] usb 4-1: Product: syz [ 30.977433][ T311] usb 4-1: Manufacturer: syz [ 30.982327][ T311] usb 4-1: SerialNumber: syz [ 31.008665][ T340] netlink: 72 bytes leftover after parsing attributes in process `syz.0.9'. [ 31.057593][ T9] usb 3-1: unable to get BOS descriptor or descriptor too short [ 31.070677][ T9] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 31.085603][ T9] usb 3-1: New USB device found, idVendor=2b73, idProduct=000a, bcdDevice= 0.40 [ 31.095663][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 31.107338][ T9] usb 3-1: Product: syz [ 31.111754][ T9] usb 3-1: Manufacturer: syz [ 31.116474][ T9] usb 3-1: SerialNumber: syz [ 31.204708][ T311] usblp 4-1:1.0: usblp0: USB Bidirectional printer dev 2 if 0 alt 0 proto 2 vid 0x0711 pid 0x0900 [ 31.326209][ T10] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 31.347223][ T9] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 31.358473][ T9] usb 3-1: USB disconnect, device number 2 [ 31.375497][ T316] udevd[316]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 31.406539][ T315] netlink: 'syz.3.4': attribute type 4 has an invalid length. [ 31.466287][ T10] usb 2-1: device descriptor read/64, error -71 [ 31.706495][ T10] usb 2-1: device descriptor read/64, error -71 [ 31.765471][ T354] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 31.889846][ T363] FAULT_INJECTION: forcing a failure. [ 31.889846][ T363] name failslab, interval 1, probability 0, space 0, times 0 [ 31.903189][ T363] CPU: 0 UID: 0 PID: 363 Comm: syz.0.17 Not tainted syzkaller #0 1c659cfea3877f078df945e50c8eb7045fd035a9 [ 31.903221][ T363] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 31.903245][ T363] Call Trace: [ 31.903252][ T363] [ 31.903260][ T363] __dump_stack+0x21/0x30 [ 31.903308][ T363] dump_stack_lvl+0x140/0x1c0 [ 31.903339][ T363] ? __cfi_dump_stack_lvl+0x10/0x10 [ 31.903369][ T363] ? __kasan_check_write+0x18/0x20 [ 31.903390][ T363] ? proc_fail_nth_write+0x184/0x220 [ 31.903423][ T363] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 31.903456][ T363] dump_stack+0x19/0x20 [ 31.903484][ T363] should_fail_ex+0x3c2/0x510 [ 31.903509][ T363] should_failslab+0xac/0x100 [ 31.903536][ T363] kmem_cache_alloc_noprof+0x42/0x410 [ 31.903559][ T363] ? getname_flags+0xcc/0x6b0 [ 31.903583][ T363] ? __cfi_vfs_write+0x10/0x10 [ 31.903606][ T363] getname_flags+0xcc/0x6b0 [ 31.903632][ T363] getname+0x1b/0x30 [ 31.903654][ T363] do_sys_openat2+0xda/0x1d0 [ 31.903684][ T363] ? fput+0x1a4/0x230 [ 31.903712][ T363] ? do_sys_open+0x100/0x100 [ 31.903743][ T363] ? ksys_write+0x1f3/0x260 [ 31.903781][ T363] ? __cfi_ksys_write+0x10/0x10 [ 31.903806][ T363] __x64_sys_openat+0x13a/0x170 [ 31.903839][ T363] x64_sys_call+0xe69/0x2ee0 [ 31.903881][ T363] do_syscall_64+0x57/0xf0 [ 31.903921][ T363] ? clear_bhb_loop+0x50/0xa0 [ 31.903953][ T363] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 31.903990][ T363] RIP: 0033:0x7fc95ab9e019 [ 31.904010][ T363] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 31.904029][ T363] RSP: 002b:00007fc95ba72028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 31.904062][ T363] RAX: ffffffffffffffda RBX: 00007fc95ae25fa0 RCX: 00007fc95ab9e019 [ 31.904080][ T363] RDX: 0000000000000000 RSI: 0000200000000500 RDI: ffffffffffffff9c [ 31.904096][ T363] RBP: 00007fc95ba72090 R08: 0000000000000000 R09: 0000000000000000 [ 31.904120][ T363] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 31.904133][ T363] R13: 00007fc95ae26038 R14: 00007fc95ae25fa0 R15: 00007fff52905a28 [ 31.904155][ T363] [ 32.127196][ T10] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 32.145414][ T368] netlink: 'syz.0.19': attribute type 19 has an invalid length. [ 32.156311][ T368] udc dummy_udc.0: soft-connect without a gadget driver [ 32.181494][ T370] Zero length message leads to an empty skb [ 32.247109][ T45] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 32.259575][ T378] binfmt_misc: register: failed to install interpreter file ./cgroup.cpu/cpuset.cpus [ 32.271337][ T378] rust_binder: 377:378 got transaction with invalid offset [ 32.280357][ T10] usb 2-1: device descriptor read/64, error -71 [ 32.280446][ T378] rust_binder: Failure in copy_transaction_data: EINVAL [ 32.287050][ T378] rust_binder: 377:378 transaction call to 377:0 failed EINVAL, code 0 size 120-24 [ 32.315794][ T378] ------------[ cut here ]------------ [ 32.321508][ T378] WARNING: CPU: 1 PID: 378 at mm/page_alloc.c:5285 __alloc_pages_noprof+0x109/0x7e0 [ 32.331012][ T378] Modules linked in: [ 32.334961][ T378] CPU: 1 UID: 0 PID: 378 Comm: syz.0.24 Not tainted syzkaller #0 1c659cfea3877f078df945e50c8eb7045fd035a9 [ 32.347657][ T378] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 32.357968][ T378] RIP: 0010:__alloc_pages_noprof+0x109/0x7e0 [ 32.364626][ T378] Code: 00 0f 1f 44 00 00 83 fb 0b 72 28 b8 00 20 00 00 23 44 24 40 75 1d 80 3d 54 d8 0b 06 00 0f 85 c2 00 00 00 c6 05 47 d8 0b 06 01 <0f> 0b 31 c0 e9 b4 00 00 00 83 fb 0a 0f 87 a9 00 00 00 44 8b 64 24 [ 32.385583][ T378] RSP: 0018:ffffc9000b83f640 EFLAGS: 00010246 [ 32.392104][ T378] RAX: 0000000000000000 RBX: 0000000000000016 RCX: 0000000000000000 [ 32.402401][ T378] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000b83f6f8 [ 32.410725][ T378] RBP: ffffc9000b83f780 R08: ffffc9000b83f6f7 R09: 0000000000000000 [ 32.420361][ T378] R10: ffffc9000b83f6e0 R11: fffff52001707edf R12: ffffc9000b83f680 [ 32.428629][ T378] R13: dffffc0000000000 R14: 1ffff92001707ecc R15: 0000000000000000 [ 32.436975][ T378] FS: 00007fc95ba726c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 32.447871][ T378] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.454611][ T378] CR2: 000020000000f000 CR3: 0000000114d4e000 CR4: 00000000003526b0 [ 32.462832][ T378] Call Trace: [ 32.466526][ T378] [ 32.469546][ T378] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 32.475423][ T378] ? __kasan_slab_alloc+0x73/0x90 [ 32.482449][ T378] ? kmem_cache_alloc_noprof+0x1e2/0x410 [ 32.488182][ T378] ? hashtab_init+0xd6/0x1f0 [ 32.493138][ T378] ___kmalloc_large_node+0x81/0x220 [ 32.498445][ T378] ? hashtab_init+0xd6/0x1f0 [ 32.503229][ T378] __kmalloc_large_node_noprof+0x1e/0xd0 [ 32.508966][ T378] ? hashtab_init+0xd6/0x1f0 [ 32.513608][ T378] __kmalloc_noprof+0x326/0x510 [ 32.518617][ T378] ? __cfi_ebitmap_read+0x10/0x10 [ 32.523713][ T378] hashtab_init+0xd6/0x1f0 [ 32.528371][ T378] ? policydb_read+0x865/0x2860 [ 32.533363][ T378] symtab_init+0x44/0x70 [ 32.536372][ T10] usb 2-1: device descriptor read/64, error -71 [ 32.538403][ T378] policydb_read+0x8e1/0x2860 [ 32.549380][ T378] ? __kasan_kmalloc+0x96/0xb0 [ 32.554278][ T378] ? __cfi_policydb_read+0x10/0x10 [ 32.559745][ T378] ? security_load_policy+0x130/0x12d0 [ 32.565291][ T378] security_load_policy+0x16a/0x12d0 [ 32.570684][ T378] ? irqentry_exit+0x4a/0x60 [ 32.575321][ T378] ? __kasan_check_write+0x18/0x20 [ 32.580552][ T378] ? mutex_lock+0x97/0x1d0 [ 32.585021][ T378] ? __cfi_security_load_policy+0x10/0x10 [ 32.591132][ T378] ? rep_movs_alternative+0x4a/0xa0 [ 32.596492][ T378] sel_write_load+0x258/0x600 [ 32.601414][ T378] ? __cfi_sel_write_load+0x10/0x10 [ 32.606694][ T378] ? bpf_lsm_file_permission+0xd/0x20 [ 32.612416][ T378] ? __cfi_sel_write_load+0x10/0x10 [ 32.617879][ T378] vfs_write+0x3c4/0xfd0 [ 32.622289][ T378] ? __cfi_vfs_write+0x10/0x10 [ 32.627406][ T378] ? __kasan_check_write+0x18/0x20 [ 32.632704][ T378] ? mutex_lock+0x97/0x1d0 [ 32.637413][ T378] ? __cfi_mutex_lock+0x10/0x10 [ 32.642510][ T378] ksys_write+0x145/0x260 [ 32.647296][ T378] ? __cfi_ksys_write+0x10/0x10 [ 32.652525][ T378] ? __kasan_check_write+0x18/0x20 [ 32.656693][ T10] usb usb2-port1: attempt power cycle [ 32.658115][ T378] ? fpregs_restore_userregs+0x11c/0x260 [ 32.669419][ T378] __x64_sys_write+0x7f/0x90 [ 32.674131][ T378] x64_sys_call+0x271c/0x2ee0 [ 32.678949][ T378] do_syscall_64+0x57/0xf0 [ 32.683541][ T378] ? clear_bhb_loop+0x50/0xa0 [ 32.688632][ T378] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 32.694915][ T378] RIP: 0033:0x7fc95ab9e019 [ 32.700369][ T378] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.720285][ T378] RSP: 002b:00007fc95ba72028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 32.729190][ T378] RAX: ffffffffffffffda RBX: 00007fc95ae25fa0 RCX: 00007fc95ab9e019 [ 32.738902][ T378] RDX: 000000000000ffaf RSI: 0000200000000000 RDI: 0000000000000008 [ 32.747299][ T378] RBP: 00007fc95ac3500c R08: 0000000000000000 R09: 0000000000000000 [ 32.755970][ T378] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 32.764086][ T378] R13: 00007fc95ae26038 R14: 00007fc95ae25fa0 R15: 00007fff52905a28 [ 32.772171][ T378] [ 32.776087][ T378] ---[ end trace 0000000000000000 ]--- [ 32.782051][ T378] SELinux: failed to load policy [ 32.858874][ T45] usb 3-1: unable to get BOS descriptor or descriptor too short [ 32.868257][ T45] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 32.879800][ T45] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 32.890318][ T45] usb 3-1: New USB device found, idVendor=1235, idProduct=8214, bcdDevice= 0.40 [ 32.902369][ T45] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.911266][ T45] usb 3-1: Product: syz [ 32.915635][ T45] usb 3-1: Manufacturer: syz [ 32.920979][ T45] usb 3-1: SerialNumber: syz [ 33.006218][ T10] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 33.027512][ T10] usb 2-1: device descriptor read/8, error -71 [ 33.129132][ T36] kauditd_printk_skb: 85 callbacks suppressed [ 33.129157][ T36] audit: type=1400 audit(1785861006.240:159): avc: denied { mount } for pid=364 comm="syz.2.18" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 33.187490][ T10] usb 2-1: device descriptor read/8, error -71 [ 33.426228][ T10] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 33.447633][ T10] usb 2-1: device descriptor read/8, error -71 [ 33.577613][ T10] usb 2-1: device descriptor read/8, error -71 [ 33.645798][ T36] audit: type=1400 audit(1785861006.750:160): avc: denied { unmount } for pid=295 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 33.667581][ T45] usb 3-1: Focusrite Scarlett Gen 3 Mixer Driver enabled (pid=0x8214); report any issues to https://github.com/geoffreybennett/scarlett-gen2/issues [ 33.683527][ T45] usb 3-1: Error initialising Scarlett Gen 3 Mixer Driver: -22 [ 33.693333][ T45] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 33.696954][ T10] usb usb2-port1: unable to enumerate USB device [ 33.709739][ T45] usb 3-1: USB disconnect, device number 3 [ 33.762467][ T316] udevd[316]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory